Android Binder通信机制浅析

关注

原创最新推荐文章于 2026-03-22 01:13:40 发布 544 阅读 AI 写同款· GEO 优化 ›

Android Binder进程间通信机制今天关于面试的分享就到这里，还是那句话，有些东西你不仅要懂，而且要能够很好地表达出来，能够让面试官认可你的理解，例如Handler机制，这个是面试必问之题。有些晦涩的点，或许它只活在面试当中，实际工作当中你压根不会用到它，但是你要知道它是什么东西。最后在这里小编分享一份自己收录整理上述技术体系图相关的几十套腾讯、头条、阿里、美团等公司2021年的面试题，把技术点整理成了视频和PDF（实际上比预期多花了不少精力），包含知识脉络 + 诸多细节，由于篇幅有限，这里以图片的形式给大家展示一部分。还有。阅读详情

一.实现Binder简单版本（我们模仿AIDL方式生成的接口文件，来自己实现Binder.代替AIDL的创建方式）

1.定义接口

package netease.com.canvasdemo;

import android.os.IBinder;
import android.os.IInterface;
import android.os.RemoteException;

/**
 * Created by zhukkun on 7/25/16.
 */
public interface IBank extends IInterface {

    static final String DESCRIPTOR = "netease.com.canvasdemo.IBank";

    static final int TRANSACTION_queryMoney = (IBinder.FIRST_CALL_TRANSACTION + 0);

    public long queryMoney(int uid) throws RemoteException;

}

2.Binder实现类

package netease.com.canvasdemo;

import android.os.Binder;
import android.os.IBinder;
import android.os.IInterface;
import android.os.Parcel;
import android.os.Process;
import android.os.RemoteException;
import android.util.Log;

/**
 * Created by zhukkun on 7/25/16.
 */
public class BankImpl extends Binder implements IBank {

    public BankImpl() {
        Log.d("ClientActivity", "BankImpl Construct,pid"+Process.myPid()+"," + this);
        this.attachInterface(this, DESCRIPTOR);
    }

    public static IBank asInterface(IBinder obj) {
        if ((obj == null)) {
            return null;
        }

        android.os.IInterface iin = obj.queryLocalInterface(DESCRIPTOR);
        Log.d("ClientActivity", "queryInterface return iin:" + iin +",this,"+obj);
        if (((iin != null) && (iin instanceof IBank))) {
            return ((IBank) iin);
        }
        return new BankImpl.Proxy(obj);
    }

    @Override
    public IInterface queryLocalInterface(String descriptor) {
        Log.d("ClientActivity", "queryInterface" + descriptor);
        Log.d("ClientActivity", "getInterfaceDescriptor" + getInterfaceDescriptor());
        if (getInterfaceDescriptor().equals(descriptor)) {
            return this;
        }
        return null;
    }

    @Override
    public IBinder asBinder() {
        return this;
    }

    @Override
    public boolean onTransact(int code, Parcel data, Parcel reply, int flags)
            throws RemoteException {
        switch (code) {
            case INTERFACE_TRANSACTION: {
                reply.writeString(DESCRIPTOR);
                return true;
            }
            case TRANSACTION_queryMoney: {
                data.enforceInterface(DESCRIPTOR);
                int uid = data.readInt();
                long result = this.queryMoney(uid);
                reply.writeNoException();
                reply.writeLong(result);
                return true;
            }
        }
        return super.onTransact(code, data, reply, flags);
    }

    @Override
    public long queryMoney(int uid) throws RemoteException {
        Log.d("ClientActivity", "query Money,remote pid:" + Process.myPid());
        return uid * 10l;
    }

    private static class Proxy implements IBank {
        private IBinder mRemote;

        Proxy(IBinder remote) {
            mRemote = remote;
        }

        @Override
        public IBinder asBinder() {
            return mRemote;
        }

        public java.lang.String getInterfaceDescriptor() {
            return DESCRIPTOR;
        }

        @Override
        public long queryMoney(int uid) throws RemoteException {
            Parcel data = Parcel.obtain();
            Parcel reply = Parcel.obtain();
            long result;
            try {
                data.writeInterfaceToken(DESCRIPTOR);
                data.writeInt(uid);
                mRemote.transact(TRANSACTION_queryMoney, data, reply, 0);
                reply.readException();
                result = reply.readLong();
            } finally {
                reply.recycle();
                data.recycle();
            }
            return result;
        }

    }

}

3.Service

package netease.com.canvasdemo;

import android.app.Service;
import android.content.Intent;
import android.os.IBinder;
import android.support.annotation.Nullable;
import android.util.Log;

/**
 * Created by zhukkun on 7/23/16.
 */
public class MyService extends Service {

    BankImpl mBank;

    @Nullable
    @Override
    public IBinder onBind(Intent intent) {
        mBank = new BankImpl();
        Log.d("ClientActivity", "onBind return:" + mBank);
        return mBank;

    }
}

4.Client

package netease.com.canvasdemo;

import android.app.Activity;
import android.content.ComponentName;
import android.content.Intent;
import android.content.ServiceConnection;
import android.os.Bundle;
import android.os.IBinder;
import android.os.Process;
import android.util.Log;

/**
 * Created by zhukkun on 7/23/16.
 */
public class ClientActivity extends Activity {

    private IBank remote;

    private ServiceConnection con = new ServiceConnection() {
        @Override
        public void onServiceConnected(ComponentName name, IBinder service) {
            Log.d("ClientActivity", "onServiceConnected:" + service);
            try {
                remote =  BankImpl.asInterface(service);
                Log.d("ClientActivity", "query Money,client pid:" + Process.myPid());
                Log.d("ClientActivity", "money" + remote.queryMoney(10));
            }catch (Exception e){
                e.printStackTrace();
            }
        }

        @Override
        public void onServiceDisconnected(ComponentName name) {
        }
    };

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        Intent intent = new Intent("netease.com.aidldemo.MyService");
        bindService(intent, con, BIND_AUTO_CREATE);
    }

    @Override
    protected void onDestroy() {
        super.onDestroy();
        unbindService(con);
    }
}

4.首先我们不在AndroidManifest中专门制定MyService的进程，尝试运行，来看下结果。

我们可以看到，Service 与Client运行在相同的进程中，并且在onBind中创建的实例，就是onServiceConnected中拿到的实例。

5.我们再来看看如果在AndroidManifest中指定MyService的进程，使得Service与Client运行在不同的进程中，运行来看下结果。

可以看到，服务端在onBind中创建的的进程是pid=25143,创建的IBinder实现实例是 BankImpl@52827de8，并且返回的也是这个实例。但是，在onServiceConnected中拿到的IBinder实现实例却是BinderProxy@52832fc8, 这是为了实现IPC，Android底层对IBinder进行了包装，里面的实现机制日后再分析，我们只要了解拿到的实现类不是onBind中创建的那一个就Ok了，这点在后面的分析中很重要。

我们首先得出一个结论：根据是否是跨进程，onServiceConnected回调中传回的IBinder实现实例是不同的，如果是同一进程，返回的就是Service中创建的实例，如果是跨进程，Android底层会对IBinder的实现实例进行一层包装，返回BinderProxy。

二.返回的IBinder实例的不同所造成的影响

private ServiceConnection con = new ServiceConnection() {
        @Override
        public void onServiceConnected(ComponentName name, IBinder service) {
            Log.d("ClientActivity", "onServiceConnected:" + service);
            try {
                remote =  <span style="color:#ff0000;">BankImpl.asInterface(service);</span>
                Log.d("ClientActivity", "query Money,client pid:" + Process.myPid());
                Log.d("ClientActivity", "money" + remote.queryMoney(10));
            }catch (Exception e){
                e.printStackTrace();
            }
        }

        @Override
        public void onServiceDisconnected(ComponentName name) {
        }
    };

public class BankImpl extends Binder implements IBank {
<span style="white-space:pre">	</span>
    public BankImpl() {
        Log.d("ClientActivity", "BankImpl Construct,pid"+Process.myPid()+"," + this);
        this.attachInterface(this, DESCRIPTOR); //设置当前的接口实例，和描述信息
    }

    public static IBank asInterface(IBinder obj) {
        if ((obj == null)) {
            return null;
        }

        android.os.IInterface iin = obj.queryLocalInterface(DESCRIPTOR);  //根据描述信息，取出接口实例
        Log.d("ClientActivity", "queryInterface return iin:" + iin +",this,"+obj);
        if (((iin != null) && (iin instanceof IBank))) {
            return ((IBank) iin);
        }
        return new BankImpl.Proxy(obj);
    } ...<span style="font-family: Arial, Helvetica, sans-serif;">}</span>

按照我们上面的例子 BankImpl()是在Service的onBind()中创建的，this.attachInterface(this, DESCRIPTOR) ，我们看下代码：

/**
     * Convenience method for associating a specific interface with the Binder.
     * After calling, queryLocalInterface() will be implemented for you
     * to return the given owner IInterface when the corresponding
     * descriptor is requested.
     */
    public void attachInterface(IInterface owner, String descriptor) {
        mOwner = owner;
        mDescriptor = descriptor;
    }

再来看下，Binder的queryInterface

/**
 * Use information supplied to attachInterface() to return the
 * associated IInterface if it matches the requested
 * descriptor.
 */
public IInterface queryLocalInterface(String descriptor) {
    if (mDescriptor.equals(descriptor)) {
        return mOwner;
    }
    return null;
}

代码看完了以后，我们根据上面的运行catlog中进行分析。

1.在相同进程中，onBind中创建的实例就是onServiceConnect中返回的实例，所以能根据描述信息，直接返回该实例给Client，然后直接调用该实例的方法。

2.不同进程，因为返回的实例不是同一个，所以queryLocalInterface查找为null，故要将返回的实例再进行一次代理包装，把包装后的实例返回给Client进行调用。

三.使用Proxy来进行方法调用

private static class Proxy implements IBank {
        private IBinder mRemote;

        Proxy(IBinder remote) {
            mRemote = remote;
        }

        @Override
        public IBinder asBinder() {
            return mRemote;
        }

        public java.lang.String getInterfaceDescriptor() {
            return DESCRIPTOR;
        }

        @Override
        public long queryMoney(int uid) throws RemoteException {
            Parcel data = Parcel.obtain();
            Parcel reply = Parcel.obtain();
            long result;
            try {
                data.writeInterfaceToken(DESCRIPTOR);
                data.writeInt(uid);
                <span style="color:#ff0000;">mRemote.transact(TRANSACTION_queryMoney, data, reply, 0);</span>
                reply.readException();
                result = reply.readLong();
            } finally {
                reply.recycle();
                data.recycle();
            }
            return result;
        }

    }

实现跨进程调用的关键语句，是上面红色的部分。通过把数据包装成Parcel，通过管道的形式传递到服务端进程中，

再看下BankImpl的onTransct()

@Override
    public boolean onTransact(int code, Parcel data, Parcel reply, int flags)
            throws RemoteException {
        switch (code) {
            case INTERFACE_TRANSACTION: {
                reply.writeString(DESCRIPTOR);
                return true;
            }
            case TRANSACTION_queryMoney: {
                data.enforceInterface(DESCRIPTOR);
                int uid = data.readInt();
                long result = <span style="color:#ff0000;">this.queryMoney(uid);</span>
                reply.writeNoException();
                reply.writeLong(result);
                return true;
            }
        }
        return super.onTransact(code, data, reply, flags);
    }

然后在onTransct()中进行参数的解析，在调用自身的方法，最后把结果写回管道里，传回客户端进程。

至于如何返回给客户端的IBinder，是如何进行包装，还有管道的具体实现，太过于底层了，以后有机会再分析。

参考文章：https://github.com/simple-android-framework/android_design_patterns_analysis/tree/master/proxy/singwhatiwanna

收录于