Binder mechanism based on Android IPC

IPC

Concept : Inter-process communication or cross-process communication refers to the process of data exchange between two processes.
Origin : The premise that two objects can directly access each other is that both objects exist in the same memory address space. Two objects exist in two different processes, so the two objects cannot call each other directly, and cross-process communication technology is required

Binder mechanism

Binder is a class in Android that implements the IBinder interface. In Android development, Binder is mainly used in Service, including AIDL and Messenger. Binder in ordinary Service does not involve inter-process communication, and the bottom layer of Messenger is actually AIDL; all interfaces that can be transmitted in Binder need to integrate the IInterface interface

• From the perspective of IPC, Binder is a cross-process communication method in Android. Binder can be understood as a virtual physical device. Its device driver is /dev/binder, which is not available in Linux.
• From the perspective of Android Framework, Binder is a bridge between ServiceManager and various Managers (ActivityManager, WindowManager, etc.) and corresponding ManagerService
• From the Android application layer, Binder is the communication medium between the client and the server. When bindService, the server will return a Binder object that contains the server-side business calls. Through this Binder object, the client can obtain the server-side Provided services or data, the services here include ordinary servers and AIDL-based services

Binder composition

Illustration of four important modules involved in Binder: Client, Server, Server Manager and Binder Driver :

1. The Binder Driver is located in the kernel space, registered as the misc type in the character device, communicates with the Binder Driver through the open and ioctl file operation functions, and is mainly responsible for the establishment of Binder communication, as well as its transfer between processes and Binder reference counting management/data packet management
2. The cross-process communication between the Binder Client and the Binder Server is uniformly processed and forwarded through the Binder Driver
3. The name of the Binder used by the Binder Client and the Binder entity are referenced in ServerManager at No. 0, and the Binder reference is obtained by accessing the Server Manager through reference No. (The Binder reference is converted by the Server Manager ), and then the Binder entity method can be called; Binder Client queries the Binder Server interface through ServerManager.
4. When the Binder Server generates a Binder entity, it binds a name to it and encapsulates the name into a data packet and passes it to the Binder Driver. After the Binder Driver receives the data packet, if it finds that the Binder is newly delivered, it It will be a Binder entity node (Binder_node) and a entity node reference (Binder_ref) in the kernel space. After the creation is completed, the Binder Driver will pass the reference to the ServerManager, and the ServerManager will take out the Binder's name and The reference is inserted into a data table.

Note: ServerManager is a standard Binder Server, and it is agreed in Android that its unique identifier in the Binder communication process is 0

ServerManager

The main function is to convert the name of Binder in characters into a reference

 public interface IServiceManager extends IInterface
30{
31    
36    IBinder getService(String name) throws RemoteException;
38  
42    IBinder checkService(String name) throws RemoteException;
43
48    void addService(String name, IBinder service, boolean allowIsolated, int dumpFlags)
49            throws RemoteException;
50
54    String[] listServices(int dumpFlags) throws RemoteException;

60    void setPermissionController(IPermissionController controller)
61            throws RemoteException;
62
63    static final String descriptor = "android.os.IServiceManager";
64
65    int GET_SERVICE_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION;
66    int CHECK_SERVICE_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+1;
67    int ADD_SERVICE_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+2;
68    int LIST_SERVICES_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+3;
69    int CHECK_SERVICES_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+4;
70    int SET_PERMISSION_CONTROLLER_TRANSACTION = IBinder.FIRST_CALL_TRANSACTION+5;
90}

For ServiceManagerNative and ServiceManagerProxy on the client side, this interface is implemented.