縱觀Binder通訊過程,無不在跟ServiceManager打交道,瞭解ServiceManager 交互流程就顯得很有必要了。ServiceManager分爲啓動和、獲取、添加、註冊服務。首先從啓動過程來了解,ServiceManager如何成爲Binder守護進程。
源碼路徑
android/system/core/rootdir/init.rc
android/frameworks/native/cmds/servicemanager/
|-- service_manager.c
|-- binder.c
Binder內核
1 啓動ServiceManager
- 1.Android在init進程啓動以後,通過腳本init.rc,啓動ServiceManager:
|– init.rc
service servicemanager /system/bin/servicemanager
class core
user system
group system
critical
onrestart restart healthd
onrestart restart zygote
onrestart restart media
onrestart restart surfaceflinger
onrestart restart drm
對應執行程序/system/bin/servicemanager,源碼service_manager.c。下一步追蹤一下service_manager.c的main()入口程序。
2.1 main
|– service_manager.c
int main(int argc, char **argv)
{
struct binder_state *bs;
// 打開Binder驅動..並申請128字節內存
bs = binder_open(128*1024);
if (!bs) {
ALOGE("failed to open binder driver\n");
return -1;
}
// 變成 Context Manager
if (binder_become_context_manager(bs)) {
ALOGE("cannot become context manager (%s)\n", strerror(errno));
return -1;
}
// 判斷 selinux 權限能否使用
selinux_enabled = is_selinux_enabled();
sehandle = selinux_android_service_context_handle();
selinux_status_open(true);
if (selinux_enabled > 0) {
if (sehandle == NULL) {
// 獲取sehandle 權限失敗
ALOGE("SELinux: Failed to acquire sehandle. Aborting.\n");
abort();
}
if (getcon(&service_manager_context) != 0) {
// 獲取service_manager 上下文失敗
ALOGE("SELinux: Failed to acquire service_manager context. Aborting.\n");
abort();
}
}
union selinux_callback cb;
cb.func_audit = audit_callback;
selinux_set_callback(SELINUX_CB_AUDIT, cb);
cb.func_log = selinux_log_callback;
selinux_set_callback(SELINUX_CB_LOG, cb);
// 進入 binder 循環
binder_loop(bs, svcmgr_handler);
return 0;
}
- mian 入口函數一共處理了三件事:
- 1.打開Binder驅動並申請內存
- 2.告訴Binder驅動成爲Binder的上下文管理者(ServiceManager成爲守護進程)
- 3.開啓循環,處理IPC請求(等待Client請求)
2.2 binder_open
在ServiceManaer 的main入口第一步看到打開Binder驅動,調用了binder_open。binder_open又做了哪些具體的工作呢?
|– binder.c
struct binder_state *binder_open(size_t mapsize)
{
struct binder_state *bs; // 初始化狀態參數
struct binder_version vers;
bs = malloc(sizeof(*bs));
if (!bs) {
errno = ENOMEM;
return NULL;
}
//打開 Binder 設備驅動
bs->fd = open("/dev/binder", O_RDWR);
if (bs->fd < 0) {
fprintf(stderr,"binder: cannot open device (%s)\n",
strerror(errno));
goto fail_open; //打開失敗
}
//系統調用 ioctl獲取binder版本信息
if ((ioctl(bs->fd, BINDER_VERSION, &vers) == -1) ||
(vers.protocol_version != BINDER_CURRENT_PROTOCOL_VERSION)) {
fprintf(stderr,
"binder: kernel driver version (%d) differs from user space version (%d)\n",
vers.protocol_version, BINDER_CURRENT_PROTOCOL_VERSION);
goto fail_open;//內核空間與用戶空間的binder不是同一版本
}
bs->mapsize = mapsize;
// 系統調用,mmap內存映射,必須是page的整數倍
bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);
if (bs->mapped == MAP_FAILED) {
fprintf(stderr,"binder: cannot map device (%s)\n",
strerror(errno));
goto fail_map; // 映射失敗
}
return bs;
fail_map: // 映射失敗關閉
close(bs->fd);
fail_open: // 打開驅動失敗
free(bs);
return NULL;
}
// 初始化狀態參數
struct binder_state
{
int fd; // binder_open中 /dev/binder的描述
void *mapped; // 指向mmap映射地址
size_t mapsize;// 分配內存大小 默認128字節
};
- 打開Binder驅動相關操作:
- 初始化狀態參數 binder_state
- 通過open打開Binder驅動
- 通過ioctl()校驗內核空間Binder與用戶空間Binder是否版本一致
- 映射mmap內存
2.3 binder_become_context_manager
- 在ServiceManaer 的main入口第一步看到打開Binder驅動,調用了binder_open。隨後執行了binder_become_context_manager。使Binder成爲上下文的管理者,具體的操作解讀一下源碼來看看
|– binder.c
int binder_become_context_manager(struct binder_state *bs)
{
//通過ioctl,傳遞BINDER_SET_CONTEXT_MGR指令
return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);
}
- 1.這裏直接調用系統ioctl()方法。由於沒找到kernel/drivers/android/binder.c源碼文件。這裏主要梳理一下調用邏輯好了
- ioctl() 後會回調binder_ioctl(),根據BINDER_SET_CONTEXT_MGR參數,最終調用binder_ioctl_set_ctx_mgr(),過程中會持有binder_main_lock。
- 3.binder_ioctl_set_ctx_mgr中首先保證只創建一次mgr_node對象,並將當前線程euid作爲Service Manager的uid。在最後通過binder_new_node創建ServiceManager類
- 4.binder_new_node 中創建binder_node給新創建對象分配內存空間,同時將新創建的node對象添加到proc紅黑樹;最後init兩個隊列:async_todo和binder_work。
2.4 binder_loop
在執行了binder_become_context_manager之後,調用了binder_loop開啓循環,處理IPC請求。查看其源碼:
void binder_loop(struct binder_state *bs, binder_handler func)
{
int res;
struct binder_write_read bwr;
uint32_t readbuf[32];
bwr.write_size = 0;
bwr.write_consumed = 0;
bwr.write_buffer = 0;
readbuf[0] = BC_ENTER_LOOPER;
//將BC_ENTER_LOOPER命令傳遞給binder驅動,使Service Manager進入循環
binder_write(bs, readbuf, sizeof(uint32_t));
for (;;) {
bwr.read_size = sizeof(readbuf);
bwr.read_consumed = 0;
bwr.read_buffer = (uintptr_t) readbuf;
//進入循環,不斷地binder讀寫過程
res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
if (res < 0) {
ALOGE("binder_loop: ioctl failed (%s)\n", strerror(errno));
break;
}
// 解析binder信息
res = binder_parse(bs, 0, (uintptr_t) readbuf, bwr.read_consumed, func);
if (res == 0) {
ALOGE("binder_loop: unexpected reply?!\n");
break;
}
if (res < 0) {
ALOGE("binder_loop: io error %d %s\n", res, strerror(errno));
break;
}
}
}
主要操作:
* binder_write通過ioctl()將BC_ENTER_LOOPER命令發送給binder驅動,ServiceManager進入循環
* 進入循環,不斷讀寫
* 讀寫需要進行 binder_parse 解析
2.4.1 binder_write
- binder_loop 中將BC_ENTER_LOOPER命令發送給binder驅動,ServiceManager進入循環
|– binder.c
int binder_write(struct binder_state *bs, void *data, size_t len)
{
struct binder_write_read bwr;
int res;
bwr.write_size = len;
bwr.write_consumed = 0;
bwr.write_buffer = (uintptr_t) data;//這裏data爲BC_ENTER_LOOPER
bwr.read_size = 0;
bwr.read_consumed = 0;
bwr.read_buffer = 0;
res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
if (res < 0) {
fprintf(stderr,"binder_write: ioctl failed (%s)\n",
strerror(errno));
}
return res;
}
- 這裏其實將傳遞過來的BC_ENTER_LOOPER通過ioctl()調用回調給binder_ioctl
2.4.2 binder_ioctl
- binder_ioctl中通過binder_ioctl_write_read將用戶空間的binder_write_read結構體拷貝到內核空間.
- 如果層次是有緩存數據,通過binder_thread_write,從bwr.write_buffer拿出cmd數據,設置線程的looper狀態爲BINDER_LOOPER_STATE_ENTERED
2.5 binder_parse
- 在循環讀寫過程中,對相應的binder進行解析,查看binder_parse源碼:
int binder_parse(struct binder_state *bs, struct binder_io *bio,
uintptr_t ptr, size_t size, binder_handler func)
{
int r = 1;
uintptr_t end = ptr + (uintptr_t) size;
while (ptr < end) {
uint32_t cmd = *(uint32_t *) ptr;
ptr += sizeof(uint32_t);
#if TRACE
fprintf(stderr,"%s:\n", cmd_name(cmd));
#endif
switch(cmd) {
case BR_NOOP:
break;
case BR_TRANSACTION_COMPLETE:
break;
case BR_INCREFS:
case BR_ACQUIRE:
case BR_RELEASE:
case BR_DECREFS:
#if TRACE
fprintf(stderr," %p, %p\n", (void *)ptr, (void *)(ptr + sizeof(void *)));
#endif
ptr += sizeof(struct binder_ptr_cookie);
break;
case BR_TRANSACTION: {
struct binder_transaction_data *txn = (struct binder_transaction_data *) ptr;
if ((end - ptr) < sizeof(*txn)) {
ALOGE("parse: txn too small!\n");
return -1;
}
binder_dump_txn(txn);
if (func) {
unsigned rdata[256/4];
struct binder_io msg;
struct binder_io reply;
int res;
bio_init(&reply, rdata, sizeof(rdata), 4);
bio_init_from_txn(&msg, txn);
res = func(bs, txn, &msg, &reply);
binder_send_reply(bs, &reply, txn->data.ptr.buffer, res);
}
ptr += sizeof(*txn);
break;
}
case BR_REPLY: {
struct binder_transaction_data *txn = (struct binder_transaction_data *) ptr;
if ((end - ptr) < sizeof(*txn)) {
ALOGE("parse: reply too small!\n");
return -1;
}
binder_dump_txn(txn);
if (bio) {
bio_init_from_txn(bio, txn);
bio = 0;
} else {
/* todo FREE BUFFER */
}
ptr += sizeof(*txn);
r = 0;
break;
}
case BR_DEAD_BINDER: {
struct binder_death *death = (struct binder_death *)(uintptr_t) *(binder_uintptr_t *)ptr;
ptr += sizeof(binder_uintptr_t);
death->func(bs, death->ptr);
break;
}
case BR_FAILED_REPLY:
r = -1;
break;
case BR_DEAD_REPLY:
r = -1;
break;
default:
ALOGE("parse: OOPS %d\n", cmd);
return -1;
}
}
return r;
}
- 參考ServiceManager中開啓循環時的調用, binder_loop(bs, svcmgr_handler)
- ptr 指向BC_ENTER_LOOPER,func指向svcmgr_handler;
2.6 svcmgr_handler
|– service_manager.c
繼續查看ServiceManager中的svcmgr_handler源碼:
int svcmgr_handler(struct binder_state *bs,
struct binder_transaction_data *txn,
struct binder_io *msg,
struct binder_io *reply)
{
struct svcinfo *si;
uint16_t *s;
size_t len;
uint32_t handle;
uint32_t strict_policy;
int allow_isolated;
//ALOGI("target=%p code=%d pid=%d uid=%d\n",
// (void*) txn->target.ptr, txn->code, txn->sender_pid, txn->sender_euid);
if (txn->target.ptr != BINDER_SERVICE_MANAGER)
return -1;
if (txn->code == PING_TRANSACTION)
return 0;
// Equivalent to Parcel::enforceInterface(), reading the RPC
// header with the strict mode policy mask and the interface name.
// Note that we ignore the strict_policy and don't propagate it
// further (since we do no outbound RPCs anyway).
strict_policy = bio_get_uint32(msg);
s = bio_get_string16(msg, &len);
if (s == NULL) {
return -1;
}
if ((len != (sizeof(svcmgr_id) / 2)) ||
memcmp(svcmgr_id, s, sizeof(svcmgr_id))) {
fprintf(stderr,"invalid id %s\n", str8(s, len));
return -1;
}
if (sehandle && selinux_status_updated() > 0) {
struct selabel_handle *tmp_sehandle = selinux_android_service_context_handle();
if (tmp_sehandle) {
selabel_close(sehandle);
sehandle = tmp_sehandle;
}
}
switch(txn->code) {
case SVC_MGR_GET_SERVICE: // 獲取服務
case SVC_MGR_CHECK_SERVICE: //查找服務
s = bio_get_string16(msg, &len);
if (s == NULL) {
return -1;
}
handle = do_find_service(bs, s, len, txn->sender_euid, txn->sender_pid);
if (!handle)
break;
bio_put_ref(reply, handle);
return 0;
case SVC_MGR_ADD_SERVICE: // 查找服務
s = bio_get_string16(msg, &len);
if (s == NULL) {
return -1;
}
handle = bio_get_ref(msg);
allow_isolated = bio_get_uint32(msg) ? 1 : 0;
if (do_add_service(bs, s, len, handle, txn->sender_euid,
allow_isolated, txn->sender_pid))
return -1;
break;
case SVC_MGR_LIST_SERVICES: { // 列舉服務list
uint32_t n = bio_get_uint32(msg);
if (!svc_can_list(txn->sender_pid)) {
ALOGE("list_service() uid=%d - PERMISSION DENIED\n",
txn->sender_euid);
return -1;
}
si = svclist;
while ((n-- > 0) && si)
si = si->next;
if (si) {
bio_put_string16(reply, si->name);
return 0;
}
return -1;
}
default:
ALOGE("unknown code %d\n", txn->code);
return -1;
}
bio_put_uint32(reply, 0);
return 0;
}
- 該方法提供了查詢服務,添加註冊服務,列舉服務list功能。
總結
ServiceManager通過init.rc腳本啓動成爲Android 進程間通信機制Binder的守護進程的過程:
* 1.打開Binder驅動 /dev/binder文件:open(“/dev/binder”, O_RDWR)
* 2.申請128k內存隨後並建立映射: mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0)
* 3.告訴Binder驅動成爲Binder的上下文管理者(ServiceManager成爲其守護進程):binder_become_context_manager(struct binder_state *bs)
* 4.開啓循環,處理IPC請求(等待Client請求):binder_loop(bs, svcmgr_handler);