Android中APP、AMS、WMS的Binder IPC

APP、AMS、WMS的IPC是一个极其值得深入研究的过程。下面通过非常常见的startActivity来解析APP、AMS、WMS进程之间的通信过程。

1.startActivity Binder IPC流程图

ServiceManager，AMS，WMS，SurfaceFlinger都是android系统服务，在前面《从底层看android5.0启动过程》一文中已经解析过，不清楚的可先浏览该文章。在android系统启动完毕后，这些系统服务也随之开启了。

2.APP与AMS间的Binder IPC

2.1.APP启动Activity

当APP内部Activity.startActivity()，当启动一个Activity，APP需要和AMS通信，所以APP需要向ServiceManager查询AMS的Binder引用。下面分析关键源码体会该过程，Activity.startActivity()主线程经过辗转最终调用Instrumentation.execStartActivity(),其关键源码如下

public ActivityResult execStartActivity(            Context who, IBinder contextThread, IBinder token, Activity target,            Intent intent, int requestCode, Bundle options) {            //获取AMS引用并调用AMS.startActiviy()            int result = ActivityManagerNative.getDefault()                .startActivity(whoThread, who.getBasePackageName(), intent,                        intent.resolveTypeIfNeeded(who.getContentResolver()),                        token, target != null ? target.mEmbeddedID : null,                        requestCode, 0, null, options);            checkStartActivityResult(result, intent);        } catch (RemoteException e) {        }        return null;    }

2.2.APP获取AMS的Binder引用

APP主线程执行ActivityManagerNative.getDefault()获取的就是一个AMS的Binder引用，其关键源码如下

public abstract class ActivityManagerNative extends Binder implements IActivityManager {//... private static final Singleton<IActivityManager> gDefault = new Singleton<IActivityManager>() {        protected IActivityManager create() {            //向ServiceManager获取AMS的Binder引用            IBinder b = ServiceManager.getService("activity");            if (false) {                Log.v("ActivityManager", "default service binder = " + b);            }            //类型转换，如果是本进程的其他类获取Binder引用，则不需要通过Binder Driver可直 //接获得Binder引用，得到的IActivityManager是AMS            //如果是其他进程，得到的IActivityManager是ActivityManagerProxy,双方            //通过Binder Driver通信            IActivityManager am = asInterface(b);            if (false) {                Log.v("ActivityManager", "default service = " + am);            }            return am;        }    };//...｝

ActivityManagerNative只是一个抽象类，IActivityManager接口实际上是由ActivityManagerNative子类AMS实现的。
上一篇文章《AMS管理四大组件》已经解析过AMS向ServiceManager登记了“域名”为“activity”的Binder。因此上述的逻辑主要是获取AMS的Binder引用，由于是不同进程间通信，asInterface转化为ActivityManagerProxy类型，ActivityManagerProxy.startActvity通过Binder Driver作为中介，最终调用的是AMS.startActvity.

2.3.AMS启动Activity

接下来由AMS线程执行AMS.startActivity(),其主要源码如下

public final class ActivityManagerService extends ActivityManagerNative implements Watchdog.Monitor, BatteryStatsImpl.BatteryCallback {        public final int startActivity(...) {        return startActivityAsUser(...);    }}

2.4.APP的ActivityThread启动Activity

最终辗转执行ActivityThread.startActivity()。Activity分别经历onCreate->onStart->onResume三个状态迁移。其中onResume是当界面即将可见时才调用。

3.APP与WMS间的Binder IPC

3.1.应用窗口添加到系统

在handleResumeActivity阶段会把应用窗口添加到系统，首先会对窗口设置一系列的属性，最终调用WindowMangerImpl.addView()把DecorView添加到系统中，主要源码如下

final void handleResumeActivity(IBinder token,            boolean clearHide, boolean isForward, boolean reallyResume) {        // If we are getting ready to gc after going to the background, well        // we are back active so skip it.        unscheduleGcIdler();        mSomeActivitiesChanged = true;        // 这个函数最终将调用Activity.onResume        ActivityClientRecord r = performResumeActivity(token, clearHide);        //...        if (r.window == null && !a.mFinished && willBeVisible) {                r.window = r.activity.getWindow();                //DecorView是Activity整棵View树的最外围                View decor = r.window.getDecorView();                decor.setVisibility(View.INVISIBLE);                //得到的是WindowMangerImpl对象                ViewManager wm = a.getWindowManager();                //获取窗口属性                WindowManager.LayoutParams l = r.window.getAttributes();                a.mDecor = decor;                //窗口类型                l.type = WindowManager.LayoutParams.TYPE_BASE_APPLICATION;                l.softInputMode |= forwardBit;                if (a.mVisibleFromClient) {                    a.mWindowAdded = true;                    wm.addView(decor, l);//将窗口添加到WMS中                }       //...

主线程ActivityThread执行WindowMangerImpl.addView()，这个过程肯定也会涉及到Binder IPC,下面重点分析。

3.2.ViewRootImpl是整棵View树和WMS的中介

WindowMangerImpl其实仅仅是WindowManagerGlobal的一个代理类，而且WindowManagerGlobal是一个全局单例对象存在着，UI主线程执行WindowManagerGlobal.addView()方法，会创建一个ViewRootImpl对象作为中介，ViewRootImpl就是应用程序和WMS 的Binder IPC关键，其源码如下

 public void addView(View view, ViewGroup.LayoutParams params,            Display display, Window parentWindow) {             ViewRootImpl root;        View panelParentView = null;       //...        root = new ViewRootImpl(view.getContext(), display);        view.setLayoutParams(wparams);        mViews.add(view);        mRoots.add(root);        mParams.add(wparams);             // do this last because it fires off messages to start doing things        try {            root.setView(view, wparams, panelParentView);        //...     }

3.3.追踪APP主线程获取的WMS的引用

ViewRootImpl构造函数会调用getWindowSession(),getWindowSession()通过getWindowManagerService()获取到了WMS对象，因此可以确定APP主线程获取的WMS的Binder引用是在getWindowManagerService()方法中，在该方法中，调用ServiceManager.getService(“window”)，来获取域名为“window”的Bindr引用，也就是WMS的引用。获取到WMS的引用后，会打开一个Seesion连接，用于APP进程和WMS进程之间的通信。在其关键源码如下

 public ViewRootImpl(Context context, Display display) {        mContext = context;        //打开一个Seesion,用于于WMS连接        mWindowSession = WindowManagerGlobal.getWindowSession(); ｝ public static IWindowSession getWindowSession() {        synchronized (WindowManagerGlobal.class) {            if (sWindowSession == null) {                try {                    InputMethodManager imm = InputMethodManager.getInstance();                    //获取WindowManagerService                    IWindowManager windowManager = getWindowManagerService();                    //打开一个Session连接，用于与WMS连接                    sWindowSession = windowManager.openSession(                            new IWindowSessionCallback.Stub() {                                @Override                                public void onAnimatorScaleChanged(float scale) {                                    ValueAnimator.setDurationScale(scale);                                }                            },                            imm.getClient(), imm.getInputContext());                    ValueAnimator.setDurationScale(windowManager.getCurrentAnimatorScale());                } catch (RemoteException e) {                    Log.e(TAG, "Failed to open window session", e);                }            }            return sWindowSession;        }    }public static IWindowManager getWindowManagerService() {        synchronized (WindowManagerGlobal.class) {            if (sWindowManagerService == null) {                sWindowManagerService = IWindowManager.Stub.asInterface(                        ServiceManager.getService("window"));            }            return sWindowManagerService;        }    }

4.4.session会话addWindow

ViewRootImpl.setView利用Session来发起一个添加窗口的服务，在Session的addToDisplay方法中，通过AMS.addWindow正式发起添加窗口的服务请求。其源码如下

public void setView(View view, WindowManager.LayoutParams attrs, View panelParentView) {  //调用Session接口  res = mWindowSession.addToDisplay(mWindow, mSeq, mWindowAttributes,                            getHostVisibility(), mDisplay.getDisplayId(),                            mAttachInfo.mContentInsets, mInputChannel);    }

final class Session extends IWindowSession.Stub implements IBinder.DeathRecipient {  public int addToDisplay(IWindow window, int seq, WindowManager.LayoutParams attrs,            int viewVisibility, int displayId, Rect outContentInsets,            InputChannel outInputChannel) {        return mService.addWindow(this, window, seq, attrs, viewVisibility, displayId,                outContentInsets, outInputChannel);    }}

addWindow会对该窗口进行权限检查，判断窗口类型，调整窗口属性以及分配层机值等操作，最终由“摄像机”SurfaceFlinger捕抓当前画面，然后真实地呈现给观众。