Android 日誌系統logcat內核代碼分析

http://blog.csdn.net/andyhuabing/article/details/8547875

前一篇文章：http://blog.csdn.net/andyhuabing/article/details/8547719 簡要介紹了log系統的上層使用方法，本文重點分
析其log內核驅動代碼，使得我們對Android日誌系統有一個深刻的認識。


內核代碼路徑：

kernel/drivers/staging/android/logger.h
kernel/drivers/staging/android/logger.c


1、Logger驅動程序的相關數據結構

首先來看logger.h頭文件的內容：

/* include/linux/logger.h
 *
 * Copyright (C) 2007-2008 Google, Inc.
 * Author: Robert Love <[email protected]>
 *
 * This software is licensed under the terms of the GNU General Public
 * License version 2, as published by the Free Software Foundation, and
 * may be copied, distributed, and modified under those terms.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 */

#ifndef _LINUX_LOGGER_H
#define _LINUX_LOGGER_H

#include <linux/types.h>
#include <linux/ioctl.h>

struct logger_entry {
    __u16       len;    /* length of the payload */
    __u16       __pad;  /* no matter what, we get 2 bytes of padding */
    __s32       pid;    /* generating process's pid */
    __s32       tid;    /* generating process's tid */
    __s32       sec;    /* seconds since Epoch */
    __s32       nsec;   /* nanoseconds */
    char        msg[0]; /* the entry's payload */
};

#define LOGGER_LOG_RADIO    "log_radio" /* radio-related messages */
#define LOGGER_LOG_EVENTS   "log_events"    /* system/hardware events */
#define LOGGER_LOG_SYSTEM   "log_system"    /* system/framework messages */
#define LOGGER_LOG_MAIN     "log_main"  /* everything else */

#define LOGGER_ENTRY_MAX_LEN        (4*1024)
#define LOGGER_ENTRY_MAX_PAYLOAD    \
    (LOGGER_ENTRY_MAX_LEN - sizeof(struct logger_entry))

#define __LOGGERIO  0xAE

#define LOGGER_GET_LOG_BUF_SIZE     _IO(__LOGGERIO, 1) /* size of log */
#define LOGGER_GET_LOG_LEN      _IO(__LOGGERIO, 2) /* used log len */
#define LOGGER_GET_NEXT_ENTRY_LEN   _IO(__LOGGERIO, 3) /* next entry len */
#define LOGGER_FLUSH_LOG        _IO(__LOGGERIO, 4) /* flush log */

#endif /* _LINUX_LOGGER_H */

struct logger_entry是一個用於描述一條Log記錄的結構體。
其中len成員變量記錄了這條記錄的有效負載的長度，有效負載指定的日誌記錄本身的長度，但是不包括用於描述這個記錄的struct logger_entry結構體。

從struct logger_entry中也可以看出：優先級別Priority、Tag字符串以及Msg字符串，pid和tid成員變量分別用來記錄是哪條進程寫入了這條記錄。sec和nsec成員變量記錄日誌寫的時間。msg成員變量記錄的就有效負載的內容了，它的大小由len成員變量來確定

#define LOGGER_ENTRY_MAX_LEN(4*1024)
#define LOGGER_ENTRY_MAX_PAYLOAD \
(LOGGER_ENTRY_MAX_LEN - sizeof(struct logger_entry))

這兩個宏定義記錄了 最大有效負載長度。

再分析下logger.c實現文件：

/*
 * struct logger_log - represents a specific log, such as 'main' or 'radio'
 *
 * This structure lives from module insertion until module removal, so it does
 * not need additional reference counting. The structure is protected by the
 * mutex 'mutex'.
 */
struct logger_log {
    unsigned char       *buffer;/* the ring buffer itself */
    struct miscdevice   misc;   /* misc device representing the log */
    wait_queue_head_t   wq; /* wait queue for readers */
    struct list_head    readers; /* this log's readers */
    struct mutex        mutex;  /* mutex protecting buffer */
    size_t          w_off;  /* current write head offset */
    size_t          head;   /* new readers start here */
    size_t          size;   /* size of the log */
};

  結構體struct logger_log就是真正用來保存日誌的地方了。buffer成員變量變是用保存日誌信息的內存緩衝區，它的大小由size成員變量確定。

 buffer是一個循環使用的環形緩衝區，緩衝區中保存的內容是以struct logger_entry爲單位的，其組成方式是：

struct logger_entry | priority | tag | msg

/*

* struct logger_reader - a logging device open for reading
*
* This object lives from open to release, so we don't need additional
* reference counting. The structure is protected by log->mutex.
*/
truct logger_reader {
struct logger_log   *log;   /* associated log */
struct list_head    list;   /* entry in logger_log's list */
size_t          r_off;  /* current read head offset */
;

 結構體struct logger_reader用來表示一個讀取日誌的進程，log成員變量指向要讀取的日誌緩衝區。list成員變量用來連接其它讀者進程。r_off成員變量表示當前要讀取的日誌在緩衝區中的位置。

2、模塊初始化過程：

logger是一個misc設備，那麼misc設備是個什麼東東呢？網上有很多資料，這裏簡要說明一下：

雜設備——misc

簡單的說，雜設備就是內核自動幫你分配設備號並且自動創建設備文件。

1、自動分配設備號，是指所有註冊爲雜設備的設備的主設備號爲10，而次設備號內核自動分配。

2、自動創建設備文件是指，內核會使用udev（前提是你已經移植udev），動態創建設備節點。

利用：

int misc_register(struct miscdevice * misc); //註冊

int misc_deregister(struct miscdevice *misc); //註銷

執行cat /proc/devices命令可以查看此類設備

# cat /proc/devices

Character devices:

1 mem

4 /dev/vc/0

4 tty

5 /dev/tty

5 /dev/console

5 /dev/ptmx

10 misc //創建的設備在misc中

定義了三個日誌設備：

/*
 * Defines a log structure with name 'NAME' and a size of 'SIZE' bytes, which
 * must be a power of two, greater than LOGGER_ENTRY_MAX_LEN, and less than
 * LONG_MAX minus LOGGER_ENTRY_MAX_LEN.
 */
#define DEFINE_LOGGER_DEVICE(VAR, NAME, SIZE) \
static unsigned char _buf_ ## VAR[SIZE]; \
static struct logger_log VAR = { \
    .buffer = _buf_ ## VAR, \
    .misc = { \
        .minor = MISC_DYNAMIC_MINOR, \
        .name = NAME, \
        .fops = &logger_fops, \
        .parent = NULL, \
    }, \
    .wq = __WAIT_QUEUE_HEAD_INITIALIZER(VAR .wq), \
    .readers = LIST_HEAD_INIT(VAR .readers), \
    .mutex = __MUTEX_INITIALIZER(VAR .mutex), \
    .w_off = 0, \
    .head = 0, \
    .size = SIZE, \
};

DEFINE_LOGGER_DEVICE(log_main, LOGGER_LOG_MAIN, 64*1024)
DEFINE_LOGGER_DEVICE(log_events, LOGGER_LOG_EVENTS, 256*1024)
DEFINE_LOGGER_DEVICE(log_radio, LOGGER_LOG_RADIO, 64*1024)
DEFINE_LOGGER_DEVICE(log_system, LOGGER_LOG_SYSTEM, 64*1024)

分別是log_main、log_events和log_radio，名稱分別LOGGER_LOG_MAIN、LOGGER_LOG_EVENTS和LOGGER_LOG_RADIO

這三個不同名稱的設備文件操作方法如下：

static const struct file_operations logger_fops = {
    .owner = THIS_MODULE,
    .read = logger_read,
    .aio_write = logger_aio_write,
    .poll = logger_poll,
    .unlocked_ioctl = logger_ioctl,
    .compat_ioctl = logger_ioctl,
    .open = logger_open,
    .release = logger_release,
};

日誌驅動程序模塊的初始化函數爲logger_init：

static int __init init_log(struct logger_log *log)
{
    int ret;

    ret = misc_register(&log->misc);
    if (unlikely(ret)) {
        printk(KERN_ERR "logger: failed to register misc "
               "device for log '%s'!\n", log->misc.name);
        return ret;
    }

    printk(KERN_INFO "logger: created %luK log '%s'\n",
           (unsigned long) log->size >> 10, log->misc.name);

    return 0;
}

static int __init logger_init(void)
{
    int ret;

    ret = init_log(&log_main);
    if (unlikely(ret))
        goto out;

    ret = init_log(&log_events);
    if (unlikely(ret))
        goto out;

    ret = init_log(&log_radio);
    if (unlikely(ret))
        goto out;

    ret = init_log(&log_system);
    if (unlikely(ret))
        goto out;

out:
    return ret;
}
device_initcall(logger_init);

logger_init函數通過調用init_log函數來初始化了上述提到的三個日誌設備，而init_log函數主要調用了misc_register函數來註冊misc設備。

3、日誌寫入重要過程分析：

註冊的寫入日誌設備文件的方法爲logger_aio_write

<span style="color:#333333;">/*
 * logger_aio_write - our write method, implementing support for write(),
 * writev(), and aio_write(). Writes are our fast path, and we try to optimize
 * them above all else.
 */
ssize_t logger_aio_write(struct kiocb *iocb, const struct iovec *iov,
             unsigned long nr_segs, loff_t ppos)
{
    struct logger_log *log = file_get_log(iocb->ki_filp);
    size_t orig = log->w_off;
    </span><span style="color:#cc0000;">struct logger_entry header</span><span style="color:#333333;">;
    struct timespec now;
    ssize_t ret = 0;
</span><span style="color:#ff6600;"><span style="white-space: pre;">    </span>// 下面重點構造 <span style="background-color: rgb(230, 230, 230); font-family: Arial;">struct logger_entry header 結構體</span></span><span style="color:#333333;">
    now = current_kernel_time();

    header.pid = current->tgid;
    header.tid = current->pid;
    header.sec = now.tv_sec;
    header.nsec = now.tv_nsec;
    header.len = min_t(size_t, iocb->ki_left, LOGGER_ENTRY_MAX_PAYLOAD);

    /* null writes succeed, return zero */
    if (unlikely(!header.len))
        return 0;

    mutex_lock(&log->mutex);

    /*
     * Fix up any readers, pulling them forward to the first readable
     * entry after (what will be) the new write offset. We do this now
     * because if we partially fail, we can end up with clobbered log
     * entries that encroach on readable buffer.
     */
    fix_up_readers(log, sizeof(struct logger_entry) + header.len);

    do_write_log(log, &header, sizeof(struct logger_entry));

    while (nr_segs-- > 0) {
        size_t len;
        ssize_t nr;

        /* figure out how much of this vector we can keep */
        len = min_t(size_t, iov->iov_len, header.len - ret);

        /* write out this segment's payload */
        nr = do_write_log_from_user(log, iov->iov_base, len);
        if (unlikely(nr < 0)) {
            log->w_off = orig;
            mutex_unlock(&log->mutex);
            return nr;
        }

        iov++;
        ret += nr;
    }

    mutex_unlock(&log->mutex);

    /* wake up any blocked readers */
    wake_up_interruptible(&log->wq);

    return ret;
}</span>

首先利用內核信息構造header信息，然後寫入：do_write_log(log, &header, sizeof(struct logger_entry));

然後根據nr_segs數目，通過一個while循環把iov的內容寫入到日誌緩衝區中，也就是日誌的優先級別priority、日誌Tag和日誌主體Msg。

最後一個重要函數說明：

    /*
     * Fix up any readers, pulling them forward to the first readable
     * entry after (what will be) the new write offset. We do this now
     * because if we partially fail, we can end up with clobbered log
     * entries that encroach on readable buffer.
     */
    fix_up_readers(log, sizeof(struct logger_entry) + header.len);

/*
 * fix_up_readers - walk the list of all readers and "fix up" any who were
 * lapped by the writer; also do the same for the default "start head".
 * We do this by "pulling forward" the readers and start head to the first
 * entry after the new write head.
 *
 * The caller needs to hold log->mutex.
 */
static void fix_up_readers(struct logger_log *log, size_t len)
{
    size_t old = log->w_off;
    size_t new = logger_offset(old + len);
    struct logger_reader *reader;

    if (clock_interval(old, new, log->head))
        log->head = get_next_entry(log, log->head, len);

    list_for_each_entry(reader, &log->readers, list)
        if (clock_interval(old, new, reader->r_off))
            reader->r_off = get_next_entry(log, reader->r_off, len);
}

爲何需要這麼一個函數呢？

由於日誌緩衝區是循環使用的，即舊的日誌記錄如果沒有及時讀取，而緩衝區的內容又已經用完時，就需要覆蓋舊的記錄來容納新的記錄。而這部分將要被覆蓋的內容，有可能是某些reader的下一次要讀取的日誌所在的位置，以及爲新的reader準備的日誌開始讀取位置head所在的位置。因此，需要調整這些位置，使它們能夠指向一個新的有效的位置。

4、日誌讀取重要過程分析：

註冊的讀取日誌設備文件的方法爲logger_read

/*
 * logger_read - our log's read() method
 *
 * Behavior:
 *
 *  - O_NONBLOCK works
 *  - If there are no log entries to read, blocks until log is written to
 *  - Atomically reads exactly one log entry
 *
 * Optimal read size is LOGGER_ENTRY_MAX_LEN. Will set errno to EINVAL if read
 * buffer is insufficient to hold next entry.
 */
static ssize_t logger_read(struct file *file, char __user *buf,
               size_t count, loff_t *pos)
{
    struct logger_reader *reader = file->private_data;
    struct logger_log *log = reader->log;
    ssize_t ret;
    DEFINE_WAIT(wait);

start:
    while (1) {
        prepare_to_wait(&log->wq, &wait, TASK_INTERRUPTIBLE);

        mutex_lock(&log->mutex);
        ret = (log->w_off == reader->r_off);
        mutex_unlock(&log->mutex);
        if (!ret)
            break;

        if (file->f_flags & O_NONBLOCK) {
            ret = -EAGAIN;
            break;
        }

        if (signal_pending(current)) {
            ret = -EINTR;
            break;
        }

        schedule();
    }

    finish_wait(&log->wq, &wait);
    if (ret)
        return ret;

    mutex_lock(&log->mutex);

    /* is there still something to read or did we race? */
    if (unlikely(log->w_off == reader->r_off)) {
        mutex_unlock(&log->mutex);
        goto start;
    }

    /* get the size of the next entry */
    ret = get_entry_len(log, reader->r_off);
    if (count < ret) {
        ret = -EINVAL;
        goto out;
    }

    /* get exactly one entry from the log */
    ret = do_read_log_to_user(log, reader, buf, ret);

out:
    mutex_unlock(&log->mutex);

    return ret;
}

struct logger_reader *reader = file->private_data; 在這裏直接使用 file->private_data是因爲在device open時將private_data賦值爲reader,在文件操作方法 logger_open 中：

<span style="color:#333333;">/*
 * logger_open - the log's open() file operation
 *
 * Note how near a no-op this is in the write-only case. Keep it that way!
 */
static int logger_open(struct inode *inode, struct file *file)
{
    struct logger_log *log;
    int ret;

    ret = nonseekable_open(inode, file);
    if (ret)
        return ret;

    log = get_log_from_minor(MINOR(inode->i_rdev));
    if (!log)
        return -ENODEV;

    if (file->f_mode & FMODE_READ) {
        struct logger_reader *reader;

        reader = kmalloc(sizeof(struct logger_reader), GFP_KERNEL);
        if (!reader)
            return -ENOMEM;

        reader->log = log;
        INIT_LIST_HEAD(&reader->list);

        mutex_lock(&log->mutex);
        reader->r_off = log->head; </span><span style="color:#ff0000;">// 從<span style="font-family: Arial; line-height: 26px;">log->head位置開始讀取日誌的，保存在struct logger_reader的成員變量r_off中</span></span><span style="color:#333333;">
        list_add_tail(&reader->list, &log->readers);
        mutex_unlock(&log->mutex);

        </span><span style="color:#ff0000;">file->private_data = reader;  // 這裏對</span><span style="color: rgb(255, 0, 0); background-color: rgb(230, 230, 230); font-family: Arial;">private_data進行了賦值</span><span style="color:#ff0000;">
</span><span style="color:#333333;">
    } else
        file->private_data = log;

    return 0;
}</span>

首先在 while (1)循環中判定是否有日誌可讀，判定語句如下：

ret = (log->w_off == reader->r_off);

即判斷當前緩衝區的寫入位置和當前讀進程的讀取位置是否相等，如果不相等，則說明有新的日誌可讀。

首先通過get_entry_len獲取下一條可讀的日誌記錄的長度（日誌讀取進程是以日誌記錄爲單位進行讀取的，一次只讀取一條記錄）：

/* get the size of the next entry */
ret = get_entry_len(log, reader->r_off);

如果其中有數據時則利用do_read_log_to_user執行真正的讀取動作：

/* get exactly one entry from the log */
ret = do_read_log_to_user(log, reader, buf, ret);

下面我們仔細看下get_entry_len函數：

/*
 * get_entry_len - Grabs the length of the payload of the next entry starting
 * from 'off'.
 *
 * Caller needs to hold log->mutex.
 */
static __u32 get_entry_len(struct logger_log *log, size_t off)
{
    __u16 val;

    switch (log->size - off) {
    case 1:
        memcpy(&val, log->buffer + off, 1);
        memcpy(((char *) &val) + 1, log->buffer, 1);
        break;
    default:
        memcpy(&val, log->buffer + off, 2);
    }

    return sizeof(struct logger_entry) + val;
}

上面這段代碼第一次也看不很久，後來想到buffer是一個循環緩衝區終於明白啦！！

我們知道每一條日誌記錄由兩大部分組成，一部分是結構體：struct logger_entry，另外一部是payload有效負載即打印主體數據。
有效負載長度記錄在struct logger_entry中的len字段中，佔用兩個字節，與結構的struct logger_entry的首地址相同。因此只要讀取記錄
最前面兩個字節就可以了。
1、兩個字節連在一起，直接讀取即可，所以直接使用 memcpy(&val, log->buffer + off, 2); 
2、兩個字節不連在一起，則需要分別讀取，這種情況就是讀取緩衝區最後一個字節和第一個字節來獲取其長度，而此時r_off與size的長度相差1

ok,繼續分析真正的數據讀取函數：

/*
 * do_read_log_to_user - reads exactly 'count' bytes from 'log' into the
 * user-space buffer 'buf'. Returns 'count' on success.
 *
 * Caller must hold log->mutex.
 */
static ssize_t do_read_log_to_user(struct logger_log *log,
                   struct logger_reader *reader,
                   char __user *buf,
                   size_t count)
{
    size_t len;

    /*
     * We read from the log in two disjoint operations. First, we read from
     * the current read head offset up to 'count' bytes or to the end of
     * the log, whichever comes first.
     */
    len = min(count, log->size - reader->r_off);
    if (copy_to_user(buf, log->buffer + reader->r_off, len))
        return -EFAULT;

    /*
     * Second, we read any remaining bytes, starting back at the head of
     * the log.
     */
    if (count != len)
        if (copy_to_user(buf + len, log->buffer, count - len))
            return -EFAULT;

    reader->r_off = logger_offset(reader->r_off + count);

    return count;
}

根據緩衝區中數據分兩段的情況，調用copy_to_user函數來把位於內核空間的日誌緩衝區指定的內容拷貝到用戶空間的內存緩衝區就可以了，同時，把當前讀取日誌進程的上下文信息中的讀偏移r_off前進到下一條日誌記錄的開始的位置上。

5、其它函數:

logger_poll  用於log用戶態調用select函數進行查詢，利用

if (log->w_off != reader->r_off)
ret |= POLLIN | POLLRDNORM;

通知用戶是否有有日記需要讀取

logger_ioctl 用於一些常用的信息查詢，

#define LOGGER_GET_LOG_BUF_SIZE_IO(__LOGGERIO, 1) /* size of log */
#define LOGGER_GET_LOG_LEN _IO(__LOGGERIO, 2) /* used log len */
#define LOGGER_GET_NEXT_ENTRY_LEN _IO(__LOGGERIO, 3) /* next entry len */
#define LOGGER_FLUSH_LOG _IO(__LOGGERIO, 4) /* flush log */

獲取緩衝區中數據長度，下一個日誌的記錄，比較有意義的是 LOGGER_FLUSH_LOG：

list_for_each_entry(reader, &log->readers, list)
reader->r_off = log->w_off;
log->head = log->w_off;

清除緩衝區中的所有數據