一、前言

我们在BpServierManager的addService方法中，有一段初始化Parcel的代码，我们借此来分析一下Parcel的结构

二、源码分析

我们看下addService中Parcel的使用：












::android::Parcel _aidl_data;











_aidl_data.markForBinder(remoteStrong());










::android::Parcel _aidl_reply;










::android::status_t _aidl_ret_status = ::android::OK;









::android::binder::Status _aidl_status;








_aidl_ret_status = _aidl_data.writeInterfaceToken(getInterfaceDescriptor());





_aidl_ret_status = _aidl_data.writeUtf8AsUtf16(name);




_aidl_ret_status = _aidl_data.writeStrongBinder(service);



_aidl_ret_status = _aidl_data.writeBool(allowIsolated);




_aidl_ret_status = _aidl_data.writeInt32(dumpPriority);

2.1 初始化

mOut是IPCThreadState的成员变量，在IPCThreadState构造函数中设置：












mOut.setDataCapacity(256);

设定初始大小：












status_t Parcel::setDataCapacity(size_t size)











{
















    if (size > mDataCapacity) return continueWrite(size);










    return NO_ERROR;









}








  










status_t Parcel::continueWrite(size_t desired)





{





    // This is the first data.  Easy!




    uint8_t* data = (uint8_t*)malloc(desired);




    gParcelGlobalAllocSize += desired;





    gParcelGlobalAllocCount++;





    mData = data;






    mDataSize = mDataPos = 0;





    mDataCapacity = desired;





    return NO_ERROR;




}

从内存中申请256字节内存，将返回的地址存储到mData，mDataSize与mDataPos初始化为0，代表没有任何数据，mDataCapacity代表数据容量，初始化为256。

我们接下来依次看下Parcel被调用的各个方法

2.2 markForBinder












void Parcel::markForBinder(const sp<IBinder>& binder) {











    LOG_ALWAYS_FATAL_IF(mData != nullptr, "format must be set before data is written");










  











    if (binder && binder->remoteBinder() && binder->remoteBinder()->isRpcBinder()) {

        markForRpc(binder->remoteBinder()->getPrivateAccessorForId().rpcSession());




    }





}





  









void Parcel::markForRpc(const sp<RpcSession>& session) {




    LOG_ALWAYS_FATAL_IF(mData != nullptr && mOwner == nullptr,



                        "format must be set before data is written OR on IPC data");


  








    LOG_ALWAYS_FATAL_IF(session == nullptr, "markForRpc requires session");





    mSession = session;





}

这个方法并不涉及主体数据的修改，只是保存mSession

2.3 writeInterfaceToken












status_t Parcel::writeInterfaceToken(const String16& interface)











{
















    return writeInterfaceToken(interface.string(), interface.size());










}












  














status_t Parcel::writeInterfaceToken(const char16_t* str, size_t len) {





    if (CC_LIKELY(!isForRpc())) {





        const IPCThreadState* threadState = IPCThreadState::self();





        writeInt32(threadState->getStrictModePolicy() | STRICT_MODE_PENALTY_GATHER);




        updateWorkSourceRequestHeaderPosition();




        writeInt32(threadState->shouldPropagateWorkSource() ? threadState->getCallingWorkSourceUid()





                                                            : IPCThreadState::kUnsetWorkSource);





        writeInt32(kHeader);






    }






  







    // currently the interface identification token is just its name as a string


    return writeString16(str, len);


}

看下writeInt32：












status_t Parcel::writeInt32(int32_t val)











{
















    return writeAligned(val);










}












  














template<class T>





status_t Parcel::writeAligned(T val) {





    static_assert(PAD_SIZE_UNSAFE(sizeof(T)) == sizeof(T));





    //如果容量够，直接写入




    if ((mDataPos+sizeof(val)) <= mDataCapacity) {




restart_write:





        *reinterpret_cast<T*>(mData+mDataPos) = val;





        return finishWrite(sizeof(val));






    }






    //容量不够的话，先扩容





    status_t err = growData(sizeof(val));




    if (err == NO_ERROR) goto restart_write;



    return err;


}


  




status_t Parcel::finishWrite(size_t len)


{


    //更新mDataPos（与mDataSize）


    mDataPos += len;


    if (mDataPos > mDataSize) {


        mDataSize = mDataPos;


    }


    return NO_ERROR;


}

writeAligned是个模板方法，包含了数据写入与扩容操作，写操作结束之后，更新mDataPos，再看下writeString16：












status_t Parcel::writeString16(const String16& str)











{
















    return writeString16(str.string(), str.size());










}

与上面的类似，只是写入长度不同，到目前为止，我们写入了三个int32，一个string16。

2.4 writeUtf8AsUtf16












status_t Parcel::writeUtf8AsUtf16(const std::string& str) {











    const uint8_t* strData = (uint8_t*)str.data();










    const size_t strLen= str.length();










    const ssize_t utf16Len = utf8_to_utf16_length(strData, strLen);









    status_t err = writeInt32(utf16Len);








    if (err) {





        return err;




    }



    void* dst = writeInplace((utf16Len + 1) * sizeof(char16_t));




    utf8_to_utf16(strData, strLen, (char16_t*)dst, (size_t) utf16Len + 1);




  








    return NO_ERROR;





}

从名字可以看出来，是将UTF-8的字符串写入为UTF-16的字符串，writeInplace我们不再深究，结果是：写入了一个int32与char16。

2.5 writeStrongBinder












status_t Parcel::writeStrongBinder(const sp<IBinder>& val)











{
















    return flattenBinder(val);










}












  














status_t Parcel::flattenBinder(const sp<IBinder>& binder)





{





    flat_binder_object obj;





    obj.flags = FLAT_BINDER_FLAG_ACCEPTS_FDS;




    if (binder != nullptr) {




        BBinder *local = binder->localBinder();





        if (!local) {





            BpBinder *proxy = binder->remoteBinder();






            const int32_t handle = proxy ? proxy->getPrivateAccessorForId().binderHandle() : 0;





            obj.hdr.type = BINDER_TYPE_HANDLE;





            obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */




            obj.handle = handle;



            obj.cookie = 0;


        } else {


            obj.hdr.type = BINDER_TYPE_BINDER;


            obj.binder = reinterpret_cast<uintptr_t>(local->getWeakRefs());

            obj.cookie = reinterpret_cast<uintptr_t>(local);

        }

    } else {

        obj.hdr.type = BINDER_TYPE_BINDER;

        obj.binder = 0;

        obj.cookie = 0;

    }

    obj.flags |= schedBits;

    status_t status = writeObject(obj, false);

    return finishFlattenBinder(binder);

}

  



status_t Parcel::writeObject(const flat_binder_object& val, bool nullMetaData)


{


    const bool enoughData = (mDataPos+sizeof(val)) <= mDataCapacity;


    const bool enoughObjects = mObjectsSize < mObjectsCapacity;


    //容量是否足够


    if (enoughData && enoughObjects) {

restart_write:

        *reinterpret_cast<flat_binder_object*>(mData+mDataPos) = val;

  


        //给mObjects赋值，值为当前object的offset

        if (nullMetaData || val.binder != 0) {

            mObjects[mObjectsSize] = mDataPos;

            acquire_object(ProcessState::self(), val, this, &mOpenAshmemSize);

            mObjectsSize++;

        }

  


        return finishWrite(sizeof(flat_binder_object));

    }

    //容量不够

    if (!enoughData) {

        const status_t err = growData(sizeof(val));

        if (err != NO_ERROR) return err;

    }

    // ... exception

    goto restart_write;

}

  


status_t Parcel::finishFlattenBinder(const sp<IBinder>& binder)

{

    internal::Stability::tryMarkCompilationUnit(binder.get());

    auto category = internal::Stability::getCategory(binder.get());

    return writeInt32(category.repr());

}

将Binder对象“展开”为flat_binder_object，然后将其写入，然后写入一个int32

最后写入一个bool和int32。

我们之前都忽略了容量不足的情况，现在来看一下：

2.6 growData












status_t Parcel::growData(size_t len)











{
















    size_t newSize = ((mDataSize+len)*3)/2;










    return (newSize <= mDataSize)









            ? (status_t) NO_MEMORY








            : continueWrite(std::max(newSize, (size_t) 128));





}

扩容计算公式为：(旧容量+新增长度) * 3 / 2，举个例子：如果旧容量为256，新增长度为4，那么结果为(256+4) * 3 / 2 = 390，然后执行continueWrite:












status_t Parcel::continueWrite(size_t desired)











{
















    size_t objectsSize = mObjectsSize;










    //缩容逻辑，如果目标小于当前size，则缩容到相应大小









    if (desired < mDataSize) {








        if (desired == 0) {





            objectsSize = 0;




        } else {



            while (objectsSize > 0) {




                if (mObjects[objectsSize-1] < desired)




                    break;



                objectsSize--;


            }


        }

    }

    if (mData) {


        if (objectsSize < mObjectsSize) {


            //缩容之后，对应的Object释放等逻辑


        }


        //容量不够，申请修改内存大小

        if (desired > mDataCapacity) {


            uint8_t* data = reallocZeroFree(mData, mDataCapacity, desired, mDeallocZero);


            if (data) {


                mData = data;


                mDataCapacity = desired;


            } else {


                mError = NO_MEMORY;


                return NO_MEMORY;


            }


        } else {


            //fix当前offset尺寸与位置

            if (mDataSize > desired) {

                mDataSize = desired;

            }


            if (mDataPos > desired) {


                mDataPos = desired;


            }


        }


  



    }

    return NO_ERROR;

}