Binder 跨进程通信原理

#define BINDER_VM_SIZE ((1 * 1024 * 1024) - sysconf(_SC_PAGE_SIZE) * 2)

ProcessState::ProcessState(const char *driver)
    : mDriverFD(open_driver(driver))
    // ...省略
{
    if (mDriverFD >= 0) {
        // 把内核中的一块缓冲区映射到本进程的用户空间
        mVMStart = mmap(nullptr, BINDER_VM_SIZE, PROT_READ,
                        MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
        // ...省略
    }
}

public static abstract class Stub extends Binder implements IBookManager {
    private static final String DESCRIPTOR = "com.example.binderdemo.IBookManager";
    static final int TRANSACTION_getBooks = IBinder.FIRST_CALL_TRANSACTION + 0;

    public static IBookManager asInterface(IBinder obj) {
        if (obj == null) return null;
        IInterface iin = obj.queryLocalInterface(DESCRIPTOR);
        if (iin instanceof IBookManager) {
            return (IBookManager) iin;   // 同一进程：直接返回 Stub 本身
        }
        return new Stub.Proxy(obj);      // 跨进程：返回代理对象
    }

    @Override
    public boolean onTransact(int code, Parcel data, Parcel reply, int flags)
            throws RemoteException {
        if (code == TRANSACTION_getBooks) {
            // 服务端：在 Binder 线程中执行
            data.enforceInterface(DESCRIPTOR);
            List<String> result = this.getBooks(); // 调用服务端自己实现的 getBooks()
            reply.writeNoException();
            reply.writeStringList(result);
            return true;
        }
        return super.onTransact(code, data, reply, flags);
    }
}

private static class Proxy implements IBookManager {
    private IBinder mRemote;

    Proxy(IBinder remote) {
        mRemote = remote;
    }

    @Override
    public List<String> getBooks() throws RemoteException {
        // 客户端：在调用方线程中执行（比如主线程）
        Parcel _data = Parcel.obtain();
        Parcel _reply = Parcel.obtain();
        try {
            _data.writeInterfaceToken(DESCRIPTOR);
            // 发起跨进程调用，当前线程会阻塞到服务端返回
            mRemote.transact(Stub.TRANSACTION_getBooks, _data, _reply, 0);
            _reply.readException();
            return _reply.createStringArrayList();
        } finally {
            _reply.recycle();
            _data.recycle();
        }
    }
}

#define DEFAULT_MAX_BINDER_THREADS 15

<service
    android:name=".BookService"
    android:process=":remote" />

class BookService : Service() {

    // 方法运行在 Binder 线程池，使用线程安全的集合
    private val books = CopyOnWriteArrayList<String>()

    private val binder = object : IBookManager.Stub() {
        override fun getBooks(): List<String> = books

        override fun addBook(name: String) {
            books.add(name)
        }
    }

    override fun onBind(intent: Intent): IBinder = binder
}

class MainActivity : AppCompatActivity() {

    private var bookManager: IBookManager? = null

    private val deathRecipient = object : IBinder.DeathRecipient {
        override fun binderDied() {
            // 运行在 Binder 线程，服务端进程已经不在了
            bookManager?.asBinder()?.unlinkToDeath(this, 0)
            bookManager = null
            bindBookService() // 重新绑定
        }
    }

    private val connection = object : ServiceConnection {
        override fun onServiceConnected(name: ComponentName, service: IBinder) {
            bookManager = IBookManager.Stub.asInterface(service)
            service.linkToDeath(deathRecipient, 0)
        }

        override fun onServiceDisconnected(name: ComponentName) {
            bookManager = null
        }
    }

    private fun bindBookService() {
        val intent = Intent(this, BookService::class.java)
        bindService(intent, connection, Context.BIND_AUTO_CREATE)
    }
}