Android 系统核心机制binder(03)binder C++层实现

本章关键点总结 & 说明：

这里主要关注 Binder C++部分即可，看到，也是本章节的核心内容，主要就是以C++封装的框架为主来解读binder。

之前主要针对于底层驱动binder的 数据交互以及 如何注册服务、获取服务、使用服务；而android的C++层实际上仅仅是换了一种方式，加了框架的理念来更好的复用驱动层的代码而已；同时java层的封装更是为了上层的使用方便。

1 binder C++层实现框架案例

1.1 binder的C++ 相关类图 关系说明：

这里仅仅从 Binder的 客户端和服务端通信IPC角度 来看Binder的 C++实现框架，红色部分的mRemote在使用中 实际上就是 BpBinder，蓝色部分为 用户在使用 该binder C++框架时 需要自己编写的类，而其他未标明的类是系统本身自带的。该图描述了BpBinder BBinder IBinder BpRefBase IInterface BpInterface BnInterface BpHelloService BnHelloService之间的关系。

1.2 binder C++层 HelloService demo 代码实现

这里以HelloService为例，解读 binder的C++框架，看看几个关键类IHelloService、BpHelloService、BnHelloService 如何使用？

@1 IHelloService.h的实现如下：

C++
#ifndef ANDROID_IHELLOERVICE_H
#define ANDROID_IHELLOERVICE_H

#include <utils/Errors.h> // for status_t
#include <utils/KeyedVector.h>
#include <utils/RefBase.h>
#include <utils/String8.h>
#include <binder/IInterface.h>
#include <binder/Parcel.h>
#define HELLO_SVR_CMD_SAYHELLO 1
#define HELLO_SVR_CMD_SAYHELLO_TO 2
#define HELLO_SVR_CMD_GET_FD 3 //后面会单独分析这个部分

namespace android {
class IHelloService: public IInterface
{
public:
DECLARE_META_INTERFACE(HelloService);
virtual void sayhello(void) = 0;
virtual int sayhello_to(const char name) = 0;
virtual int get_fd(void) = 0;
};

class BnHelloService: public BnInterface<IHelloService>
{
private:
int fd;
public:
virtual status_t onTransact( uint32_t code,
const Parcel& data,
Parcel reply,
uint32_t flags = 0);
virtual void sayhello(void);
virtual int sayhello_to(const char *name);
virtual int get_fd(void); //后面会单独分析这个部分

BnHelloService();
BnHelloService(int fd);
};
}
#endif

@2 BnHelloService.cpp的实现如下（这里参考了 frameworks\av\media\libmedia\IMediaPlayerService.cpp）：

C++
#define LOG_TAG "HelloService"
#include "IHelloService.h"
namespace android {
BnHelloService::BnHelloService()
{
}

BnHelloService::BnHelloService(int fd)
{
this->fd = fd;
}

status_t BnHelloService::onTransact( uint32_t code,
const Parcel& data,
Parcel* reply,
uint32_t flags)
{
switch (code) {
case HELLO_SVR_CMD_SAYHELLO: {
sayhello();
reply->writeInt32(0); /* no exception /
return NO_ERROR;
} break;

case HELLO_SVR_CMD_SAYHELLO_TO: {
//@1 读取传入参数，并转换
int32_t policy = data.readInt32();
String16 name16_tmp = data.readString16(); / IHelloService /
String16 name16 = data.readString16();
String8 name8(name16);
//@2 调用对应函数
int cnt = sayhello_to(name8.string());

//@3 返回值转换，并发送
reply->writeInt32(0); / no exception /
reply->writeInt32(cnt);

return NO_ERROR;
} break;

case HELLO_SVR_CMD_GET_FD: {
int fd = this->get_fd();
reply->writeInt32(0); / no exception /
reply->writeDupFileDescriptor(fd);
return NO_ERROR;
} break; 
default:
return BBinder::onTransact(code, data, reply, flags);
}
}

void BnHelloService::sayhello(void)
{
static int cnt = 0;
ALOGI("say hello : %d\n", ++cnt);
}

int BnHelloService::sayhello_to(const char name)
{
static int cnt = 0;
ALOGI("say hello to %s : %d\n", name, ++cnt);
return cnt;
}

int BnHelloService::get_fd(void)
{
return fd;
}
}

@3 BpHelloService.cpp的实现如下：

C++
#include "IHelloService.h"
namespace android {

class BpHelloService: public BpInterface<IHelloService>
{
public:
BpHelloService(const sp<IBinder>& impl): BpInterface<IHelloService>(impl)
{
}

void sayhello(void)
{
Parcel data, reply;
data.writeInt32(0);
data.writeString16(String16("IHelloService"));
remote()->transact(HELLO_SVR_CMD_SAYHELLO, data, &reply);
}

int sayhello_to(const char *name)
{
Parcel data, reply;
int exception;

data.writeInt32(0);
data.writeString16(String16("IHelloService"));
data.writeString16(String16(name));
remote()->transact(HELLO_SVR_CMD_SAYHELLO_TO, data, &reply);
exception = reply.readInt32();
if (exception)
return -1;
else
return reply.readInt32();
}

int get_fd(void)
{
Parcel data, reply;
int exception;

data.writeInt32(0);
data.writeString16(String16("IHelloService"));
remote()->transact(HELLO_SVR_CMD_GET_FD, data, &reply);

exception = reply.readInt32();
if (exception)
return -1;
else
{
int rawFd = reply.readFileDescriptor();
return dup(rawFd);
}
}
};
IMPLEMENT_META_INTERFACE(HelloService, "android.media.IHelloService");
}

@4 客户端代码 Test_client.cpp的实现如下：

C++
#define LOG_TAG "TestService"
//#define LOG_NDEBUG 0

#include <fcntl.h>
#include <sys/prctl.h>
#include <sys/wait.h>
#include <binder/IPCThreadState.h>
#include <binder/ProcessState.h>
#include <binder/IServiceManager.h>
#include <cutils/properties.h>
#include <utils/Log.h>
#include <unistd.h>

#include "IHelloService.h"

using namespace android;

/* ./test_client <hello>
* ./test_client <readfile>
* ./test_client <hello> <name>
/

int main(int argc, char argv)
{
int cnt;

if (argc < 2){
ALOGI("Usage:\n");
ALOGI("%s <readfile>\n", argv[0]);
ALOGI("%s <hello|goodbye>\n", argv[0]);
ALOGI("%s <hello|goodbye> <name>\n", argv[0]);
return -1;
}

/ getService /
/ 打开驱动, mmap /
sp<ProcessState> proc(ProcessState::self());

/ 获得BpServiceManager /
sp<IServiceManager> sm = defaultServiceManager();

if (strcmp(argv[1], "hello") == 0)
{
sp<IBinder> binder = sm->getService(String16("hello"));
if (binder == 0)
{
ALOGI("can't get hello service\n");
return -1;
}

// service肯定是BpHelloServie指针
sp<IHelloService> service = interface_cast<IHelloService>(binder);

/ 调用Service的函数 /
if (argc < 3) {
service->sayhello();
ALOGI("client call sayhello");
}
else {
cnt = service->sayhello_to(argv[2]);
ALOGI("client call sayhello_to, cnt = %d", cnt);
}
}
else if (strcmp(argv[1], "readfile") == 0)
{

sp<IBinder> binder =
sm->getService(String16("hello"));

if (binder == 0)
{
ALOGI("can't get hello service\n");
return -1;
}

/ service肯定是BpHelloServie指针 /
sp<IHelloService> service = interface_cast<IHelloService>(binder);

/ 调用Service的函数 /
int fd = service->get_fd();

ALOGI("client call get_fd = %d", fd);

char buf[500];
int len;
int cnt = 0;

while (1)
{
//向 test_server 进程数据: Hello, test_server /
len = sprintf(buf, "Hello, test_server, cnt = %d", cnt++);
write(fd, buf, len);
len = read(fd, buf, 500);
buf[len] = '\0';
ALOGI("%s\n", buf);
sleep(5);
}
}
return 0;
}

@5 服务端Test_server.cpp的实现如下：

C++
#define LOG_TAG "TestService"
//#define LOG_NDEBUG 0

#include <fcntl.h>
#include <sys/prctl.h>
#include <sys/wait.h>
#include <binder/IPCThreadState.h>
#include <binder/ProcessState.h>
#include <binder/IServiceManager.h>
#include <cutils/properties.h>
#include <utils/Log.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/socket.h>
#include "IHelloService.h"
#define SOCKET_BUFFER_SIZE (32768U)

using namespace android;

class MyThread: public Thread { 
private:
int fd;
public: 
MyThread() {}
MyThread(int fd) { this->fd = fd; }

//说明：若返回true,循环调用此函数,返回false下一次不会再调用此函数 
bool threadLoop()
{
char buf[500];
int len;
int cnt = 0;

while(1)
{
len = read(fd, buf, 500);
buf[len] = '\0';
ALOGI("%s\n", buf);

/* 向 test_client 发出: Hello, test_client */
len = sprintf(buf, "Hello, test_client, cnt = %d", cnt++);
write(fd, buf, len);
}

return true; 
}

}; 

int main(void)
{
int sockets[2];

socketpair(AF_UNIX, SOCK_SEQPACKET, 0, sockets);

int bufferSize = SOCKET_BUFFER_SIZE;
setsockopt(sockets[0], SOL_SOCKET, SO_SNDBUF, &bufferSize, sizeof(bufferSize));
setsockopt(sockets[0], SOL_SOCKET, SO_RCVBUF, &bufferSize, sizeof(bufferSize));
setsockopt(sockets[1], SOL_SOCKET, SO_SNDBUF, &bufferSize, sizeof(bufferSize));
setsockopt(sockets[1], SOL_SOCKET, SO_RCVBUF, &bufferSize, sizeof(bufferSize));

// 创建线程, 和test_client使用socketpiar通信
sp<MyThread> th = new MyThread(sockets[0]);
th->run(); 

// 关键点1 初始化binder
sp<ProcessState> proc(ProcessState::self());

// 关键点2 获得BpServiceManager
sp<IServiceManager> sm = defaultServiceManager();

// 关键点3
sm->addService(String16("hello"), new BnHelloService(sockets[1]));

// 关键点4 创建新的子线程，并开始处理驱动上报的消息
ProcessState::self()->startThreadPool();

// 关键点5 主线程 循环，循环并处理驱动上报的消息
IPCThreadState::self()->joinThreadPool();//辅助类 IPCThreadState的分析

return 0;
}

@6 最后描述下 Android.mk的实现

Bash
LOCAL_PATH:= $(call my-dir)

include $(CLEAR_VARS)

LOCAL_SRC_FILES:= \
BnHelloService.cpp \
BpHelloService.cpp \
test_server.cpp

LOCAL_SHARED_LIBRARIES := \
libcutils \
libutils \
liblog \
libbinder 


LOCAL_MODULE:= test_server
LOCAL_32_BIT_ONLY := true

include $(BUILD_EXECUTABLE)

include $(CLEAR_VARS)

LOCAL_SRC_FILES:= \
BpHelloService.cpp \
test_client.cpp

LOCAL_SHARED_LIBRARIES := \
libcutils \
libutils \
liblog \
libbinder 


LOCAL_MODULE:= test_client
LOCAL_32_BIT_ONLY := true

include $(BUILD_EXECUTABLE)

几段代码的整体说明：

前三段代码实现了HelloService整个服务（接口IHelloService 和BpHelloService 和 BnHelloService）

服务端TestServer实现了Hello服务的注册和socket通信架构机制（读& 写）。

客户端TestClient实现了Hello服务的获取和使用，同时 获取了fd(服务端的socket句柄)并使用

Android.mk的实现，可以直接编译即可使用。

根据上面的例子基本上就可以写出一个基于Binder的 C++ demo程序，如果仅仅是使用binder的话，那已经足够了。

2 binder C++层实现 BpServiceManager

这一部分专门解读下 BpServiceManager的通信流程框架和部分代码，因为针对于系统的ServiceManager服务而言，它本身就相当于BnServiceManager的角色，而我们在分析Binder C++层代码时，当时也陷入了一个误区，觉得有BpXXX就一定要有BnXXX，实际上是不一定的，ServiceManager本身就是一个很好的例子。

2.1 BpServiceManager 的单边类关系框架图如下：

跟1.1的框架图相比，实际上是少了BnInterface那一半的，而这一半实际上就是开机启动的那个程序 servicemanager，在下一章节中我们会专门讲解到。

2.2 IServiceManager的实现说明

@1 IServiceManager.h的实现如下：

C++
#ifndef ANDROID_ISERVICE_MANAGER_H
#define ANDROID_ISERVICE_MANAGER_H

#include <binder/IInterface.h>
#include <binder/IPermissionController.h>
#include <utils/Vector.h>
#include <utils/String16.h>

namespace android {
class IServiceManager : public IInterface
{
public:
DECLARE_META_INTERFACE(ServiceManager);

virtual sp<IBinder> getService( const String16& name) const = 0;
virtual sp<IBinder> checkService( const String16& name) const = 0;
virtual status_t addService( const String16& name,
const sp<IBinder>& service,
bool allowIsolated = false) = 0;
virtual Vector<String16> listServices() = 0;

enum {
GET_SERVICE_TRANSACTION = IBinder::FIRST_CALL_TRANSACTION,
CHECK_SERVICE_TRANSACTION,
ADD_SERVICE_TRANSACTION,
LIST_SERVICES_TRANSACTION,
};
};

sp<IServiceManager> defaultServiceManager();

template<typename INTERFACE>
status_t getService(const String16& name, sp<INTERFACE>* outService)
{
const sp<IServiceManager> sm = defaultServiceManager();
if (sm != NULL) {
outService = interface_cast<INTERFACE>(sm->getService(name));
if ((outService) != NULL) return NO_ERROR;
}
return NAME_NOT_FOUND;
}
//...

class BnServiceManager : public BnInterface<IServiceManager>
{
public:
virtual status_t onTransact( uint32_t code,
const Parcel& data,
Parcel* reply,
uint32_t flags = 0);
};
}; // namespace android

#endif // ANDROID_ISERVICE_MANAGER_H

@2 IServiceManager.cpp的实现如下：

C++
#define LOG_TAG "ServiceManager"

#include <binder/IServiceManager.h>

#include <utils/Log.h>
#include <binder/IPCThreadState.h>
#include <binder/Parcel.h>
#include <utils/String8.h>
#include <utils/SystemClock.h>

#include <private/binder/Static.h>

#include <unistd.h>

namespace android {

sp<IServiceManager> defaultServiceManager()
{
if (gDefaultServiceManager != NULL) return gDefaultServiceManager;

{
AutoMutex _l(gDefaultServiceManagerLock);
while (gDefaultServiceManager == NULL) {
gDefaultServiceManager = interface_cast<IServiceManager>(
ProcessState::self()->getContextObject(NULL));
if (gDefaultServiceManager == NULL)
sleep(1);
}
}

return gDefaultServiceManager;
}
//。。。
class BpServiceManager : public BpInterface<IServiceManager>
{
public:
BpServiceManager(const sp<IBinder>& impl)
: BpInterface<IServiceManager>(impl)
{
}

virtual sp<IBinder> getService(const String16& name) const
{
unsigned n;
for (n = 0; n < 5; n++){
sp<IBinder> svc = checkService(name);
if (svc != NULL) return svc;
ALOGI("Waiting for service %s...\n", String8(name).string());
sleep(1);
}
return NULL;
}

virtual sp<IBinder> checkService( const String16& name) const
{
Parcel data, reply;
data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
data.writeString16(name);
remote()->transact(CHECK_SERVICE_TRANSACTION, data, &reply);
return reply.readStrongBinder();
}

virtual status_t addService(const String16& name, const sp<IBinder>& service,
bool allowIsolated)
{
Parcel data, reply;
data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
data.writeString16(name);
data.writeStrongBinder(service);
data.writeInt32(allowIsolated ? 1 : 0);
status_t err = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply);
return err == NO_ERROR ? reply.readExceptionCode() : err;
}

virtual Vector<String16> listServices()
{
Vector<String16> res;
int n = 0;

for (;;) {
Parcel data, reply;
data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
data.writeInt32(n++);
status_t err = remote()->transact(LIST_SERVICES_TRANSACTION, data, &reply);
if (err != NO_ERROR)
break;
res.add(reply.readString16());
}
return res;
}
};

IMPLEMENT_META_INTERFACE(ServiceManager, "android.os.IServiceManager");

// ----------------------------------------------------------------------

status_t BnServiceManager::onTransact(
uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
//printf("ServiceManager received: "); data.print();
switch(code) {
case GET_SERVICE_TRANSACTION: {
CHECK_INTERFACE(IServiceManager, data, reply);
String16 which = data.readString16();
sp<IBinder> b = const_cast<BnServiceManager*>(this)->getService(which);
reply->writeStrongBinder(b);
return NO_ERROR;
} break;
//...
default:
return BBinder::onTransact(code, data, reply, flags);
}
}

}; // namespace android

总结下，这两个文件主要实现了IServiceManager，BpServiceManager，BnServiceManager，然而这里最让人疑惑的就是BnServiceManager不是由 servicemanager替换了吗？那为什么还有BnServiceManager的存在？

BnServiceManager并没有在系统中注册，因此也就无法在驱动层生成对应的binder_node节点，事实上也没必要注册；因为servicemanager开机就启动，已经替代了所谓的BnServiceManager，同时在驱动层 给自己创建了对应的binder_node节点，所以最后的答案很简单，因为BnServiceManager压根就没有使用，只是一个摆设而已，真正实现功能的是servicemanager。