Binder 机制详解—Binder Java框架(转自Cloud Chou's Tech Blog)

1
2
3
4
5
6
7
8
9
10
11
12

static struct bindernative_offsets_t
{
    // 指向class对象android.os.Binder 
    jclass mClass;
    //指向 android.os.Binder的execTransact方法
    jmethodID mExecTransact;
 
    //指向android.os.Binder的mObject字段，
    //将用于保存指向JavaBBinderHolder对象的指针
    jfieldID mObject;
 
} gBinderOffsets;

1
2
3
4
5
6
7
8

static struct binderinternal_offsets_t
{
    //指向 class对象com.android.internal.os.BinderInternal
    jclass mClass;
    //指向BinderInternal的forceGc方法
    jmethodID mForceGc;
 
} gBinderInternalOffsets;

1
2
3
4
5
6
7
8
9
10
11
1213
14
15
16
17

static struct binderproxy_offsets_t
{
    //指向 class对象android.os.BinderProxy
    jclass mClass;
    //指向 BinderProxy的构造方法
    jmethodID mConstructor;
    //指向 BinderProxy的sendDeathNotice方法
    jmethodID mSendDeathNotice;
 
    //指向 BinderProxy的mObject字段
    jfieldID mObject;
    //指向 BinderProxy的mSelf字段
    jfieldID mSelf;
    //指向 BinderProxy的mOrgue字段
    jfieldID mOrgue;
 
} gBinderProxyOffsets;

1
2
3
4
5
6
7
8
9
10
11
1213
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

jobject javaObjectForIBinder(JNIEnv* env, const sp<IBinder>& val)
{
    if (val == NULL) return NULL;
 
    //如果是 binder 服务端进程调用javaObjectForIBinder 
    //将调用JavaBBinder的object方法返回jobject，
    //这里jobject的实际Java类型是Binder
    if (val->checkSubclass(&gBinderOffsets)) {
        // One of our own!
        jobject object = static_cast<JavaBBinder*>(val.get())->object();
        LOGDEATH("objectForBinder %p: it's our own %p!\n", val.get(),
                 object);
        return object;
    }
    //如果是binder客户端进程，则需要返回Java层的BinderProxy对象
 
    // For the rest of the function we will hold this lock, to serialize
    // looking/creation of Java proxies for native Binder proxies.
    AutoMutex _l(mProxyLock);
 
    // 如果已有用Java层WeakReference保存的BinderProxy对象，则返回该对象
    jobject object = (jobject)val->findObject(&gBinderProxyOffsets);
    if (object != NULL) {
        jobject res = env->CallObjectMethod(object, 
                          gWeakReferenceOffsets.mGet);
        if (res != NULL) {
            ALOGV("objectForBinder %p: found existing %p!\n", val.get(),
                   res);
            return res;
        }
        LOGDEATH("Proxy object %p of IBinder %p no longer 
                  in working set!!!", object, val.get());
        android_atomic_dec(&gNumProxyRefs);
        val->detachObject(&gBinderProxyOffsets);
        env->DeleteGlobalRef(object);
    }
 
    //创建BinderProxy对象
    object = env->NewObject(gBinderProxyOffsets.mClass, 
                 gBinderProxyOffsets.mConstructor);
    if (object != NULL) {
        LOGDEATH("objectForBinder %p: created new proxy %p !\n",
            val.get(), object);
        // The proxy holds a reference to the native object.
        //设置BinderProxy对象的mObject字段为本地IBinder对象指针，
        //本地IBinder对象的实际类型是BpBinder
        env->SetIntField(object, gBinderProxyOffsets.mObject, 
               (int)val.get());
        val->incStrong(object);
 
        // The native object needs to hold a weak reference back to the
        // proxy, so we can retrieve 
        //the same proxy if it is still active.
        jobject refObject = env->NewGlobalRef(
                env->GetObjectField(object, gBinderProxyOffsets.mSelf));
        //关联gBinderProxyOffsets，故此第20行代码用findObject才能找到      
        val->attachObject(&gBinderProxyOffsets, refObject,
                jnienv_to_javavm(env), proxy_cleanup);
 
        // Also remember the death recipients registered on this proxy
        sp<DeathRecipientList> drl = new DeathRecipientList;
        drl->incStrong((void*)javaObjectForIBinder);
        env->SetIntField(object, gBinderProxyOffsets.mOrgue, 
                    reinterpret_cast<jint>(drl.get()));
 
        // Note that a new object reference has been created.
        android_atomic_inc(&gNumProxyRefs);
        incRefsCreated(env);
    }
 
    return object;
}

1
2
3
4
5
6
7
8
9
10
11
1213
14
15
16
17
18
19
20
21
22
23
24

sp<IBinder> ibinderForJavaObject(JNIEnv* env, jobject obj)
{
    if (obj == NULL) return NULL;
 
    //如果是Java层Binder对象 
    //则将Binder对象的mObject字段转为JavaBBinderHolder指针
    //然后调用它的get方法即可转为本地IBinder对象，实际类型是JavaBBinder
    if (env->IsInstanceOf(obj, gBinderOffsets.mClass)) {
        JavaBBinderHolder* jbh = (JavaBBinderHolder*)
            env->GetIntField(obj, gBinderOffsets.mObject);
        return jbh != NULL ? jbh->get(env, obj) : NULL;
    }
 
    //如果是Java层的BinderProxy对象，
    //则将BinderProxy对象的mObject字段直接转为本地的IBinder对象指针
    //实际类型是本地框架里的BpBinder
    if (env->IsInstanceOf(obj, gBinderProxyOffsets.mClass)) {
        return (IBinder*)
            env->GetIntField(obj, gBinderProxyOffsets.mObject);
    }
 
    ALOGW("ibinderForJavaObject: %p is not a Binder object", obj);
    return NULL;
}