Android : 跟我学Binder --- (6) JAVA实现

---

目录：

• Android : 跟我学Binder --- (1) 什么是Binder IPC？为何要使用Binder机制？

• Android : 跟我学Binder --- (2) AIDL分析及手动实现

• Android : 跟我学Binder --- (3) C程序示例

• Android : 跟我学Binder --- (4) 驱动情景分析

• Android : 跟我学Binder --- (5) C++实现

• Android : 跟我学Binder --- (6)  JAVA实现

一、Java程序的编译和运行

 1.单步操作

　PC：Hello.java 编译成 Hello.class，运行于 jvm。

javac Hello.java
java Hello

　 Android：Hello.java 编译成 Hello.class，通过dx指令转换成.dex格式，运行于 dalvikvm。

javac Hello.java
dx --dex --output=Hello.jar Hello.class
dalvikvm -cp /mnt/android_fs/pack.jar Pack (启动方法1)
CLASSPATH=/mnt/android_fs/pack.jar app_process /mnt/android_fs Pack（启动方法2）

启动方式的差别:
dalvikvm
app_process ：会创建2个binder线程: Binder_1, Binder_2 (实现读数据、解析数据、返回等操作)

2.Android编译系统(Android.mk)

把代码放到android源码中编译:
 添加Androd.mk，内容类似:  // 参考frameworks/base/cmds/am/Android.mk

include $(CLEAR_VARS)
LOCAL_SRC_FILES := $(call all-subdir-java-files)
LOCAL_MODULE := pack
include $(BUILD_JAVA_LIBRARY)

3.使用java代码实现hello服务

　(1)IHelloService.aidl

　接口定义，编译生成IHelloService.java，里面有Stub  : onTransact, 它会分辨收到数据然后调用sayhello, sayhello_to；
　　Proxy : 提供有sayhello, sayhello_to两个函数, 它们会构造数据然后发送给server。

/** {@hide} */
interface IHelloService
{
    void sayhello();
    int sayhello_to(String name);
}

　(2)IHelloService.java

/*
 * This file is auto-generated.  DO NOT MODIFY.
 * Original file: frameworks/base/core/java/android/os/IHelloService.aidl
 */
/** {@hide} */
public interface IHelloService extends android.os.IInterface
{
    /** Local-side IPC implementation stub class. */
    public static abstract class Stub extends android.os.Binder implements IHelloService
    {
        private static final java.lang.String DESCRIPTOR = "IHelloService";
        /** Construct the stub at attach it to the interface. */
        public Stub()
        {
            this.attachInterface(this, DESCRIPTOR);
        }
        /**
         * Cast an IBinder object into an IHelloService interface,
         * generating a proxy if needed.
         */
        public static IHelloService asInterface(android.os.IBinder obj)
        {
            if ((obj==null)) {
            return null;
            }
            android.os.IInterface iin = obj.queryLocalInterface(DESCRIPTOR);
            if (((iin!=null)&&(iin instanceof IHelloService))) {
            return ((IHelloService)iin);
            }
            return new IHelloService.Stub.Proxy(obj);
        }

        @Override public android.os.IBinder asBinder()
        {
            return this;
        }
        @Override public boolean onTransact(int code, android.os.Parcel data, android.os.Parcel reply, int flags) throws android.os.RemoteException
        {
            switch (code)
            {
                case INTERFACE_TRANSACTION:
                {
                    reply.writeString(DESCRIPTOR);
                    return true;
                }
                case TRANSACTION_sayhello:
                {
                    data.enforceInterface(DESCRIPTOR);
                    this.sayhello();
                    reply.writeNoException();
                    return true;
                }
                case TRANSACTION_sayhello_to:
                {
                    data.enforceInterface(DESCRIPTOR);
                    java.lang.String _arg0;
                    _arg0 = data.readString();
                    int _result = this.sayhello_to(_arg0);
                    reply.writeNoException();
                    reply.writeInt(_result);
                    return true;
                }
            }
            return super.onTransact(code, data, reply, flags);
        }

        private static class Proxy implements IHelloService
        {
            private android.os.IBinder mRemote;
            Proxy(android.os.IBinder remote)
            {
                mRemote = remote;
            }
            @Override public android.os.IBinder asBinder()
            {
                return mRemote;
            }
            public java.lang.String getInterfaceDescriptor()
            {
                return DESCRIPTOR;
            }
            @Override public void sayhello() throws android.os.RemoteException
            {
                android.os.Parcel _data = android.os.Parcel.obtain();
                android.os.Parcel _reply = android.os.Parcel.obtain();
                try {
                    _data.writeInterfaceToken(DESCRIPTOR);
                    mRemote.transact(Stub.TRANSACTION_sayhello, _data, _reply, 0);
                    _reply.readException();
                }
                finally {
                    _reply.recycle();
                    _data.recycle();
                }
            }
            @Override public int sayhello_to(java.lang.String name) throws android.os.RemoteException
            {
                android.os.Parcel _data = android.os.Parcel.obtain();
                android.os.Parcel _reply = android.os.Parcel.obtain();
                int _result;
                try {
                    _data.writeInterfaceToken(DESCRIPTOR);
                    _data.writeString(name);
                    mRemote.transact(Stub.TRANSACTION_sayhello_to, _data, _reply, 0);
                    _reply.readException();
                    _result = _reply.readInt();
                }
                finally {
                    _reply.recycle();
                    _data.recycle();
                }
                    return _result;
            }
        }

        static final int TRANSACTION_sayhello = (android.os.IBinder.FIRST_CALL_TRANSACTION + 0);
        static final int TRANSACTION_sayhello_to = (android.os.IBinder.FIRST_CALL_TRANSACTION + 1);

    }

    public void sayhello() throws android.os.RemoteException;
    public int sayhello_to(java.lang.String name) throws android.os.RemoteException;
}

　(3)HelloService.java

　　实现服务类: HelloService.java，在里面定义sayhello, sayhello_to；

import android.util.Slog;

/* 实现Hello服务的函数 */

public class HelloService extends IHelloService.Stub {
    private static final String TAG = "HelloService";
    private int cnt1 = 0;
    private int cnt2 = 0;

    public void sayhello() throws android.os.RemoteException {
        cnt1++;
        Slog.i(TAG, "sayhello : cnt = "+cnt1);
    }

    public int sayhello_to(java.lang.String name) throws android.os.RemoteException {
        cnt2++;
        Slog.i(TAG, "sayhello_to "+name+" : cnt = "+cnt2);
        return cnt2;
    }
}

　(4)IGoodbyeService.aidl （同HelloService）

/** {@hide} */
interface IGoodbyeService
{
    void saygoodbye();
    int saygoodbye_to(String name);
}

　(5)IGoodbyeService.java

/*
 * This file is auto-generated.  DO NOT MODIFY.
 * Original file: frameworks/base/core/java/android/os/IGoodbyeService.aidl
 */
/** {@hide} */
public interface IGoodbyeService extends android.os.IInterface
{
    /** Local-side IPC implementation stub class. */
    public static abstract class Stub extends android.os.Binder implements IGoodbyeService
    {
        private static final java.lang.String DESCRIPTOR = "IGoodbyeService";
        /** Construct the stub at attach it to the interface. */
        public Stub()
        {
            this.attachInterface(this, DESCRIPTOR);
        }
        /**
         * Cast an IBinder object into an IGoodbyeService interface,
         * generating a proxy if needed.
         */
        public static IGoodbyeService asInterface(android.os.IBinder obj)
        {
            if ((obj==null)) {
                return null;
            }
            android.os.IInterface iin = obj.queryLocalInterface(DESCRIPTOR);
            if (((iin!=null)&&(iin instanceof IGoodbyeService))) {
                return ((IGoodbyeService)iin);
            }
            return new IGoodbyeService.Stub.Proxy(obj);
        }
        @Override public android.os.IBinder asBinder()
        {
            return this;
        }
        @Override public boolean onTransact(int code, android.os.Parcel data, android.os.Parcel reply, int flags) throws android.os.RemoteException
        {
            switch (code)
            {
                case INTERFACE_TRANSACTION:
                {
                    reply.writeString(DESCRIPTOR);
                    return true;
                }
                case TRANSACTION_saygoodbye:
                {
                    data.enforceInterface(DESCRIPTOR);
                    this.saygoodbye();
                    reply.writeNoException();
                    return true;
                }
                case TRANSACTION_saygoodbye_to:
                {
                    data.enforceInterface(DESCRIPTOR);
                    java.lang.String _arg0;
                    _arg0 = data.readString();
                    int _result = this.saygoodbye_to(_arg0);
                    reply.writeNoException();
                    reply.writeInt(_result);
                    return true;
                }
            }
            return super.onTransact(code, data, reply, flags);
        }
        private static class Proxy implements IGoodbyeService
        {
            private android.os.IBinder mRemote;
            Proxy(android.os.IBinder remote)
            {
                mRemote = remote;
            }
            @Override public android.os.IBinder asBinder()
            {
                return mRemote;
            }
            public java.lang.String getInterfaceDescriptor()
            {
                return DESCRIPTOR;
            }
            @Override public void saygoodbye() throws android.os.RemoteException
            {
                android.os.Parcel _data = android.os.Parcel.obtain();
                android.os.Parcel _reply = android.os.Parcel.obtain();
                try {
                    _data.writeInterfaceToken(DESCRIPTOR);
                    mRemote.transact(Stub.TRANSACTION_saygoodbye, _data, _reply, 0);
                    _reply.readException();
                }
                finally {
                    _reply.recycle();
                    _data.recycle();
                }
            }
            @Override public int saygoodbye_to(java.lang.String name) throws android.os.RemoteException
            {
                android.os.Parcel _data = android.os.Parcel.obtain();
                android.os.Parcel _reply = android.os.Parcel.obtain();
                int _result;
                try {
                    _data.writeInterfaceToken(DESCRIPTOR);
                    _data.writeString(name);
                    mRemote.transact(Stub.TRANSACTION_saygoodbye_to, _data, _reply, 0);
                    _reply.readException();
                    _result = _reply.readInt();
                }
                finally {
                    _reply.recycle();
                    _data.recycle();
                }
                return _result;
            }
        }
        static final int TRANSACTION_saygoodbye = (android.os.IBinder.FIRST_CALL_TRANSACTION + 0);
        static final int TRANSACTION_saygoodbye_to = (android.os.IBinder.FIRST_CALL_TRANSACTION + 1);
    }
    public void saygoodbye() throws android.os.RemoteException;
    public int saygoodbye_to(java.lang.String name) throws android.os.RemoteException;
}

　(6)GoodbyeService.java

import android.util.Slog;

/* 实现Goodbye服务的函数 */

public class GoodbyeService extends IGoodbyeService.Stub {
    private static final String TAG = "GoodbyeService";
    private int cnt1 = 0;
    private int cnt2 = 0;

    public void saygoodbye() throws android.os.RemoteException {
        cnt1++;
        Slog.i(TAG, "saygoodbye : cnt = "+cnt1);
    }

    public int saygoodbye_to(java.lang.String name) throws android.os.RemoteException {
        cnt2++;
        Slog.i(TAG, "saygoodbye_to "+name+" : cnt = "+cnt2);
        return cnt2;
    }
}

　(7)TestServer.java （addService, 循环）

import android.util.Slog;
import android.os.ServiceManager;

/* 1. addService
 * 2. while(true) { read data, parse data, call function, reply }
 */

public class TestServer {
    private static final String TAG = "TestServer";

    public static void main(String args[])
    {
        /* add Service */
        Slog.i(TAG, "add hello service");
        ServiceManager.addService("hello", new HelloService());

        Slog.i(TAG, "add goodbye service");
        ServiceManager.addService("goodbye", new GoodbyeService());

        while (true)
        {
            try {
                Thread.sleep(100);
              } catch (Exception e){}
        }

    }
}

　(8)TestClient.java （getService, 调用sayhello,sayhello_to(来自Proxy)）

import android.util.Slog;
import android.os.ServiceManager;
import android.os.IBinder;

/* 1. getService
 * 2. 调用服务的sayhello,sayhello_to
 *
 */

/* test_client <hello|goodbye> [name] */

public class TestClient {
    private static final String TAG = "TestClient";

    public static void main(String args[])
    {
        if (args.length == 0)
        {
            System.out.println("Usage: need parameter: <hello|goodbye> [name]");
            return;
        }

        if (args[0].equals("hello"))
        {
            /* 1. getService */
            IBinder binder = ServiceManager.getService("hello");
            if (binder == null)
            {
                System.out.println("can not get hello service");
                Slog.i(TAG, "can not get hello service");
                return;
            }

            IHelloService svr = IHelloService.Stub.asInterface(binder);

            if (args.length == 1)
            {
                    try {
                    svr.sayhello();
                    System.out.println("call sayhello");
                    Slog.i(TAG, "call sayhello");
                  } catch (Exception e) {}
            }
            else
            {
                    try {
                    int cnt = svr.sayhello_to(args[1]);
                    System.out.println("call sayhello_to "+args[1]+" : cnt = "+cnt);
                    Slog.i(TAG, "call sayhello_to "+args[1]+" : cnt = "+cnt);
                  } catch (Exception e) {
                        System.out.println("call sayhello_to , err :"+e);
                        Slog.i(TAG, "call sayhello_to , err : "+e);
                  }
            }
        }
        else if (args[0].equals("goodbye"))
        {
            /* 1. getService */
            IBinder binder = ServiceManager.getService("goodbye");
            if (binder == null)
            {
                System.out.println("can not get goodbye service");
                Slog.i(TAG, "can not get goodbye service");
                return;
            }

            IGoodbyeService svr = IGoodbyeService.Stub.asInterface(binder);

            if (args.length == 1)
            {
                    try {
                    svr.saygoodbye();
                    System.out.println("call saygoodbye");
                    Slog.i(TAG, "call saygoodbye");
                  } catch (Exception e) {}
            }
            else
            {
                    try {
                    int cnt = svr.saygoodbye_to(args[1]);
                    System.out.println("call saygoodbye_to "+args[1]+" : cnt = "+cnt);
                    Slog.i(TAG, "call saygoodbye_to "+args[1]+" : cnt = "+cnt);
                  } catch (Exception e) {}
            }
        }
    }
}

　

　(9)Android.mk

# Copyright 2008 The Android Open Source Project
#
LOCAL_PATH:= $(call my-dir)

include $(CLEAR_VARS)
LOCAL_SRC_FILES := HelloService.java IHelloService.java GoodbyeService.java IGoodbyeService.java TestServer.java
LOCAL_MODULE := TestServer
include $(BUILD_JAVA_LIBRARY)

include $(CLEAR_VARS)
LOCAL_SRC_FILES := HelloService.java IHelloService.java GoodbyeService.java IGoodbyeService.java TestClient.java
LOCAL_MODULE := TestClient
include $(BUILD_JAVA_LIBRARY)

 编译&测试说明：

(1) AIDL
1. 把 IHelloService.aidl, IGoodbyeService.aidl 放入 frameworks/base/core/java/android/os
2. 修改 frameworks/base/Android.mk  添加一行
         core/java/android/os/IVibratorService.aidl \
+        core/java/android/os/IHelloService.aidl \
+        core/java/android/os/IGoodbyeService.aidl \

3. mmm frameworks/base

4. 它会生成:
./out/target/common/obj/JAVA_LIBRARIES/framework_intermediates/src/core/java/android/os/IHelloService.java
./out/target/common/obj/JAVA_LIBRARIES/framework_intermediates/src/core/java/android/os/IGoodbyeService.java

(2) 编译:
把程序放到 /work/android-5.0.2/frameworks/testing/APP_0005_Binder_JAVA_App
执行:

cd /work/android-5.0.2
. setenv
lunch // 选择单板

mmm frameworks/testing/APP_0005_Binder_JAVA_App
它会生成 TestServer.jar, TestClient.jar

复制文件到NFS目录
cp /work/android-5.0.2/out/target/product/tiny4412/system/framework/Test*.jar /work/nfs_root/android_fs/

(3) 测试:
logcat TestServer:* TestClient:* HelloService:* *:S &
CLASSPATH=/mnt/android_fs/TestServer.jar app_process / TestServer &
CLASSPATH=/mnt/android_fs/TestClient.jar app_process / TestClient hello
CLASSPATH=/mnt/android_fs/TestClient.jar app_process / TestClient hello 100ask.taobao.com
CLASSPATH=/mnt/android_fs/TestClient.jar app_process / TestClient goodbye
CLASSPATH=/mnt/android_fs/TestClient.jar app_process / TestClient goodbye weidongshan

二、内部机制

1.Client端
1.1 ServiceManagerProxy中mRemote的构造 (用于addService/getService)
　  使用0直接构造出一个java BinderProxy对象
getIServiceManager().addService  / getIServiceManager().getService

getIServiceManager()
        return ServiceManagerNative.asInterface(BinderInternal.getContextObject())

a. BinderInternal.getContextObject()  // 得到了一个Java BinderProxy对象, 其中mObject指向new BpBinder(0);
   它是一个JNI调用，对应 android_os_BinderInternal_getContextObject // android_util_Binder.cpp
   
   android_os_BinderInternal_getContextObject
           sp<IBinder> b = ProcessState::self()->getContextObject(NULL);
                                                                                               getStrongProxyForHandle(0);
                                                                                                       b = new BpBinder(handle);  // mHandle = 0
            return javaObjectForIBinder(env, b);        // b = new BpBinder(0), mHandle = 0
            
                                    // 使用c代码调用NewObject来创建JAVA BinderProxy对象
                                    object = env->NewObject(gBinderProxyOffsets.mClass, gBinderProxyOffsets.mConstructor);
                                    
                                    // 设置该对象的mObject = val.get = b = new BpBinder(0)
                                    env->SetLongField(object, gBinderProxyOffsets.mObject, (jlong)val.get());
                                    
                                    return object;

b. ServiceManagerNative.asInterface
            new ServiceManagerProxy(obj); // obj = BinderProxy对象
                            mRemote = obj = BinderProxy对象, 其中mObject指向new BpBinder(0);

1.2 hello服务里的mRemote如何构造
a. IBinder binder = ServiceManager.getService("hello");
　它的返回值就是一个java BinderProxy对象, 其中的mObject=new BpBinder(handle)
new ServiceManagerProxy().getService("hello")
            ....
            IBinder binder = reply.readStrongBinder();
                                                                nativeReadStrongBinder  // Parcel.java

nativeReadStrongBinder是一个JNI调用, 对应的代码是 android_os_Parcel_readStrongBinder                                                                
android_os_Parcel_readStrongBinder    
      // 把java Parce对象转换为c++ Parcel对象
      // client程序向sevice_manager发出getService请求，
      // 得到一个回复reply, 它里面含有flat_binder_object
      // 它被封装成一个c++ Parcel对象
        Parcel* parcel = reinterpret_cast<Parcel*>(nativePtr);
        
        /* parcel->readStrongBinder()应该是一个 new BpBinder(handle)
         *             unflatten_binder(ProcessState::self(), *this, &val);
         *                  *out = proc->getStrongProxyForHandle(flat->handle);
         *                                  b = new BpBinder(handle);
         */
        
      // 它会创建一个java BinderProxy对象, 其中的mObject=new BpBinder(handle)对象
        return javaObjectForIBinder(env, parcel->readStrongBinder());

b. IHelloService svr = IHelloService.Stub.asInterface(binder);
                                                        new IHelloService.Stub.Proxy(obj);  // obj = 步骤a得到的binder
                                                                        mRemote = remote;

1.3 现在知道了：mRemote就是一个java BinderProxy 对象
    看一下mRemote.transact()
                                    transactNative(code, data, reply, flags);
                                    它是一个JNI调用，对应android_os_BinderProxy_transact

android_os_BinderProxy_transact
   // 从java BinderProxy对象中把mObject取出, 它就是一个BpBinder对象
    IBinder* target = (IBinder*)env->GetLongField(obj, gBinderProxyOffsets.mObject);                                    
    
    // 然后调用BpBinder的transact
    status_t err = target->transact(code, *data, reply, flags);

2.Server端

2.1 server如何读取数据
　使用app_process来启动server进程,

/*测试指令*/
logcat TestServer:* TestClient:* HelloService:* *:S &
CLASSPATH=/mnt/android_fs/TestServer.jar app_process / TestServer &
CLASSPATH=/mnt/android_fs/TestClient.jar app_process / TestClient hello
CLASSPATH=/mnt/android_fs/TestClient.jar app_process / TestClient hello sheldon

/*参考源码*/
// app_process: frameworks\base\cmds\app_process\app_main.cpp

它会先创建子线程(前面示例提到的两个binder线程:Binder_1, Binder_2)：
AppRuntime::onStarted()
        proc->startThreadPool();
                        spawnPooledThread(true);
                                sp<Thread> t = new PoolThread(isMain);
                                t->run(name.string());
                                        // 它会创建子线程, 并执行threadLoop
                                           IPCThreadState::self()->joinThreadPool(mIsMain);
                                           {
                                                    do {
                                                                    result = getAndExecuteCommand();
                                                                                            result = talkWithDriver();
                                                                                            result = executeCommand(cmd);
                                                                                                                    对于BR_TRANSACTION数据,
                                                                                                                    sp<BBinder> b((BBinder*)tr.cookie); //将.cookie转换成BBinder对象
                                                                                                                    error = b->transact(tr.code, buffer, &reply, tr.flags); //并调用其transact方法
                                                 } while(...)
                                           }

2.2 server读到数据后怎么调用服务PRC层的onTransact函数
　　在addService时设置.ptr/.cookie
　　ServiceManager.addService("hello", new HelloService());

结论:
① addService会通过JNI调用c++函数:
        创建一个BBinder派生类JavaBBinder对象,
            它的.mObject指向JAVA对象: new HelloService()
            它含有onTransact函数
        把这个对象存入.cookie(最终存入binder驱动中该服务对应的binder_node.cookie)

② server进程从驱动中读到数据，里面含有.cookie
    把它转换为BBinder对象，
    调用它的transact函数
    最终调用到派生类JavaBBinder中定义的onTransact函数

③ JavaBBinder中定义的onTransact函数(c++)
    它通过JNI调用java Binder的execTransact方法，
    然后调用Binder派生类IHelloService.Stub中定义的onTransact函数(JAVA)

④ IHelloService.Stub中定义的onTransact函数(JAVA):
        分析数据
        调用sayhello/sayhello_to

源码阅读：
（1） ServiceManager.addService("hello", new HelloService());
    ServiceManagerProxy.addService:
            // Parcel.java
            data.writeStrongBinder(service);
                            nativeWriteStrongBinder(mNativePtr, val); // val = service = new HelloService()
                            它是一个JNI调用，对应android_os_Parcel_writeStrongBinder(c++)

（2） android_os_Parcel_writeStrongBinder(c++)
    它会构造一个JavaBBinder对象(c++)，.mObject=new HelloService() JAVA对象
    然后让.cookie=JavaBBinder对象(c++)
    
    // 把Java Parcel转换为c++ Parcel
    Parcel* parcel = reinterpret_cast<Parcel*>(nativePtr);
    
    // .cookie = ibinderForJavaObject(env, object)得到一个JavaBBinder对象
    parcel->writeStrongBinder(ibinderForJavaObject(env, object))

（3） ibinderForJavaObject(env, object) //object = new HelloService()
    把一个Java对象(new HelloService())转换为c++ IBinder对象
    
    JavaBBinderHolder* jbh = (JavaBBinderHolder*)env->GetLongField(obj, gBinderOffsets.mObject);
    return jbh != NULL ? jbh->get(env, obj) : NULL;
                                                     b = new JavaBBinder(env, obj); // obj = new HelloService()
                                                                 mObject = new HelloService()

（4） 从驱动中得过了.cookie, 它是一个JavaBBinder对象
    调用它的transact函数，导致JavaBBinder对象的onTransact被调用
    
    JavaBBinder::onTransact (调用java里的某个函数)
    
            // mObject指向 HelloService对象
            // gBinderOffsets.mExecTransact指向: java Binder类中的execTransact方法
            // 调用HelloService(派生自Binder)对象中的execTransact方法
        jboolean res = env->CallBooleanMethod(mObject, gBinderOffsets.mExecTransact,
            code, reinterpret_cast<jlong>(&data), reinterpret_cast<jlong>(reply), flags);

（5） java Binder execTransact:  
                res = onTransact(code, data, reply, flags);
                                    调用HelloService中的onTransact方法(来自IHelloService.Stube)
                                        分辨数据
                                        调用sayhello/sayhello_to

-end-