Android Binder通信机制浅析

最新推荐文章于 2025-05-06 18:05:08 发布

kkdev

最新推荐文章于 2025-05-06 18:05:08 发布

阅读量506

点赞数

CC 4.0 BY-SA版权

分类专栏： Android 文章标签： Binder IPC android

本文链接：https://blog.youkuaiyun.com/kkdev/article/details/52024885

Android 专栏收录该内容

5 篇文章

订阅专栏

本文浅析Android Binder通信机制，通过实例说明在相同进程与不同进程下onServiceConnected回调中IBinder实例的区别，以及如何实现跨进程调用。关键在于Binder的queryInterface和Proxy的角色，数据通过Parcel在进程间传递。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

一.实现Binder简单版本（我们模仿AIDL方式生成的接口文件，来自己实现Binder.代替AIDL的创建方式）

1.定义接口

package netease.com.canvasdemo;

import android.os.IBinder;
import android.os.IInterface;
import android.os.RemoteException;

/**
 * Created by zhukkun on 7/25/16.
 */
public interface IBank extends IInterface {

    static final String DESCRIPTOR = "netease.com.canvasdemo.IBank";

    static final int TRANSACTION_queryMoney = (IBinder.FIRST_CALL_TRANSACTION + 0);

    public long queryMoney(int uid) throws RemoteException;

}

2.Binder实现类

package netease.com.canvasdemo;

import android.os.Binder;
import android.os.IBinder;
import android.os.IInterface;
import android.os.Parcel;
import android.os.Process;
import android.os.RemoteException;
import android.util.Log;

/**
 * Created by zhukkun on 7/25/16.
 */
public class BankImpl extends Binder implements IBank {

    public BankImpl() {
        Log.d("ClientActivity", "BankImpl Construct,pid"+Process.myPid()+"," + this);
        this.attachInterface(this, DESCRIPTOR);
    }

    public static IBank asInterface(IBinder obj) {
        if ((obj == null)) {
            return null;
        }

        android.os.IInterface iin = obj.queryLocalInterface(DESCRIPTOR);
        Log.d("ClientActivity", "queryInterface return iin:" + iin +",this,"+obj);
        if (((iin != null) && (iin instanceof IBank))) {
            return ((IBank) iin);
        }
        return new BankImpl.Proxy(obj);
    }

    @Override
    public IInterface queryLocalInterface(String descriptor) {
        Log.d("ClientActivity", "queryInterface" + descriptor);
        Log.d("ClientActivity", "getInterfaceDescriptor" + getInterfaceDescriptor());
        if (getInterfaceDescriptor().equals(descriptor)) {
            return this;
        }
        return null;
    }

    @Override
    public IBinder asBinder() {
        return this;
    }

    @Override
    public boolean onTransact(int code, Parcel data, Parcel reply, int flags)
            throws RemoteException {
        switch (code) {
            case INTERFACE_TRANSACTION: {
                reply.writeString(DESCRIPTOR);
                return true;
            }
            case TRANSACTION_queryMoney: {
                data.enforceInterface(DESCRIPTOR);
                int uid = data.readInt();
                long result = this.queryMoney(uid);
                reply.writeNoException();
                reply.writeLong(result);
                return true;
            }
        }
        return super.onTransact(code, data, reply, flags);
    }

    @Override
    public long queryMoney(int uid) throws RemoteException {
        Log.d("ClientActivity", "query Money,remote pid:" + Process.myPid());
        return uid * 10l;
    }

    private static class Proxy implements IBank {
        private IBinder mRemote;

        Proxy(IBinder remote) {
            mRemote = remote;
        }

        @Override
        public IBinder asBinder() {
            return mRemote;
        }

        public java.lang.String getInterfaceDescriptor() {
            return DESCRIPTOR;
        }

        @Override
        public long queryMoney(int uid) throws RemoteException {
            Parcel data = Parcel.obtain();
            Parcel reply = Parcel.obtain();
            long result;
            try {
                data.writeInterfaceToken(DESCRIPTOR);
                data.writeInt(uid);
                mRemote.transact(TRANSACTION_queryMoney, data, reply, 0);
                reply.readException();
                result = reply.readLong();
            } finally {
                reply.recycle();
                data.recycle();
            }
            return result;
        }

    }

}

3.Service

package netease.com.canvasdemo;

import android.app.Service;
import android.content.Intent;
import android.os.IBinder;
import android.support.annotation.Nullable;
import android.util.Log;

/**
 * Created by zhukkun on 7/23/16.
 */
public class MyService extends Service {

    BankImpl mBank;

    @Nullable
    @Override
    public IBinder onBind(Intent intent) {
        mBank = new BankImpl();
        Log.d("ClientActivity", "onBind return:" + mBank);
        return mBank;

    }
}

4.Client

package netease.com.canvasdemo;

import android.app.Activity;
import android.content.ComponentName;
import android.content.Intent;
import android.content.ServiceConnection;
import android.os.Bundle;
import android.os.IBinder;
import android.os.Process;
import android.util.Log;

/**
 * Created by zhukkun on 7/23/16.
 */
public class ClientActivity extends Activity {

    private IBank remote;

    private ServiceConnection con = new ServiceConnection() {
        @Override
        public void onServiceConnected(ComponentName name, IBinder service) {
            Log.d("ClientActivity", "onServiceConnected:" + service);
            try {
                remote =  BankImpl.asInterface(service);
                Log.d("ClientActivity", "query Money,client pid:" + Process.myPid());
                Log.d("ClientActivity", "money" + remote.queryMoney(10));
            }catch (Exception e){
                e.printStackTrace();
            }
        }

        @Override
        public void onServiceDisconnected(ComponentName name) {
        }
    };

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        Intent intent = new Intent("netease.com.aidldemo.MyService");
        bindService(intent, con, BIND_AUTO_CREATE);
    }

    @Override
    protected void onDestroy() {
        super.onDestroy();
        unbindService(con);
    }
}

4.首先我们不在AndroidManifest中专门制定MyService的进程，尝试运行，来看下结果。

我们可以看到，Service 与Client运行在相同的进程中，并且在onBind中创建的实例，就是onServiceConnected中拿到的实例。

5.我们再来看看如果在AndroidManifest中指定MyService的进程，使得Service与Client运行在不同的进程中，运行来看下结果。

可以看到，服务端在onBind中创建的的进程是pid=25143,创建的IBinder实现实例是 BankImpl@52827de8，并且返回的也是这个实例。但是，在onServiceConnected中拿到的IBinder实现实例却是BinderProxy@52832fc8, 这是为了实现IPC，Android底层对IBinder进行了包装，里面的实现机制日后再分析，我们只要了解拿到的实现类不是onBind中创建的那一个就Ok了，这点在后面的分析中很重要。

我们首先得出一个结论：根据是否是跨进程，onServiceConnected回调中传回的IBinder实现实例是不同的，如果是同一进程，返回的就是Service中创建的实例，如果是跨进程，Android底层会对IBinder的实现实例进行一层包装，返回BinderProxy。

二.返回的IBinder实例的不同所造成的影响

private ServiceConnection con = new ServiceConnection() {
        @Override
        public void onServiceConnected(ComponentName name, IBinder service) {
            Log.d("ClientActivity", "onServiceConnected:" + service);
            try {
                remote =  <span style="color:#ff0000;">BankImpl.asInterface(service);</span>
                Log.d("ClientActivity", "query Money,client pid:" + Process.myPid());
                Log.d("ClientActivity", "money" + remote.queryMoney(10));
            }catch (Exception e){
                e.printStackTrace();
            }
        }

        @Override
        public void onServiceDisconnected(ComponentName name) {
        }
    };

public class BankImpl extends Binder implements IBank {
<span style="white-space:pre">	</span>
    public BankImpl() {
        Log.d("ClientActivity", "BankImpl Construct,pid"+Process.myPid()+"," + this);
        this.attachInterface(this, DESCRIPTOR); //设置当前的接口实例，和描述信息
    }

    public static IBank asInterface(IBinder obj) {
        if ((obj == null)) {
            return null;
        }

        android.os.IInterface iin = obj.queryLocalInterface(DESCRIPTOR);  //根据描述信息，取出接口实例
        Log.d("ClientActivity", "queryInterface return iin:" + iin +",this,"+obj);
        if (((iin != null) && (iin instanceof IBank))) {
            return ((IBank) iin);
        }
        return new BankImpl.Proxy(obj);
    } ...<span style="font-family: Arial, Helvetica, sans-serif;">}</span>

按照我们上面的例子 BankImpl()是在Service的onBind()中创建的，this.attachInterface(this, DESCRIPTOR) ，我们看下代码：

/**
     * Convenience method for associating a specific interface with the Binder.
     * After calling, queryLocalInterface() will be implemented for you
     * to return the given owner IInterface when the corresponding
     * descriptor is requested.
     */
    public void attachInterface(IInterface owner, String descriptor) {
        mOwner = owner;
        mDescriptor = descriptor;
    }

再来看下，Binder的queryInterface

/**
 * Use information supplied to attachInterface() to return the
 * associated IInterface if it matches the requested
 * descriptor.
 */
public IInterface queryLocalInterface(String descriptor) {
    if (mDescriptor.equals(descriptor)) {
        return mOwner;
    }
    return null;
}

代码看完了以后，我们根据上面的运行catlog中进行分析。

1.在相同进程中，onBind中创建的实例就是onServiceConnect中返回的实例，所以能根据描述信息，直接返回该实例给Client，然后直接调用该实例的方法。

2.不同进程，因为返回的实例不是同一个，所以queryLocalInterface查找为null，故要将返回的实例再进行一次代理包装，把包装后的实例返回给Client进行调用。

三.使用Proxy来进行方法调用

private static class Proxy implements IBank {
        private IBinder mRemote;

        Proxy(IBinder remote) {
            mRemote = remote;
        }

        @Override
        public IBinder asBinder() {
            return mRemote;
        }

        public java.lang.String getInterfaceDescriptor() {
            return DESCRIPTOR;
        }

        @Override
        public long queryMoney(int uid) throws RemoteException {
            Parcel data = Parcel.obtain();
            Parcel reply = Parcel.obtain();
            long result;
            try {
                data.writeInterfaceToken(DESCRIPTOR);
                data.writeInt(uid);
                <span style="color:#ff0000;">mRemote.transact(TRANSACTION_queryMoney, data, reply, 0);</span>
                reply.readException();
                result = reply.readLong();
            } finally {
                reply.recycle();
                data.recycle();
            }
            return result;
        }

    }

实现跨进程调用的关键语句，是上面红色的部分。通过把数据包装成Parcel，通过管道的形式传递到服务端进程中，

再看下BankImpl的onTransct()

@Override
    public boolean onTransact(int code, Parcel data, Parcel reply, int flags)
            throws RemoteException {
        switch (code) {
            case INTERFACE_TRANSACTION: {
                reply.writeString(DESCRIPTOR);
                return true;
            }
            case TRANSACTION_queryMoney: {
                data.enforceInterface(DESCRIPTOR);
                int uid = data.readInt();
                long result = <span style="color:#ff0000;">this.queryMoney(uid);</span>
                reply.writeNoException();
                reply.writeLong(result);
                return true;
            }
        }
        return super.onTransact(code, data, reply, flags);
    }

然后在onTransct()中进行参数的解析，在调用自身的方法，最后把结果写回管道里，传回客户端进程。

至于如何返回给客户端的IBinder，是如何进行包装，还有管道的具体实现，太过于底层了，以后有机会再分析。

参考文章：https://github.com/simple-android-framework/android_design_patterns_analysis/tree/master/proxy/singwhatiwanna