android binder机制---servicemanager进程启动
2, servicemanager进程启动
ServiceManager是android系统中Binder IPC通信过程中的守护进程,主要负责系统服务的注册和获取。
ServiceManager进程是init进程通过init.rc脚本里的配置文件启动的。init.rc有关的配置如下,
service servicemanager /system/bin/servicemanager
class core
user system
group system
critical
onrestart restart healthd
onrestart restart zygote
onrestart restart media
onrestart restart surfaceflinger
onrestart restart drm
可以看到，servicemanager是一种native service。这种native service都是需要用C/C++编写的。
Service Manager Service对应的实现代码位于frameworks/native/cmds/servicemanager/service_manager.c文件中。
这个文件中有每个C程序员都熟悉的main()函数。
service_manager.c的main方法主要代码如下,
int main(int argc, char **argv)
{
struct binder_state *bs;
bs = binder_open(128*1024);
•••
if (binder_become_context_manager(bs)) {
ALOGE("cannot become context manager (%s)\n", strerror(errno));
return -1;
}
•••
binder_loop(bs, svcmgr_handler);
return 0;
}
1,声明一个binder_state类型的结构体。
2,调用binder_open方法打开binder驱动。
3,调用binder_become_context_manager方法注册成为binder服务的大管家。
4,调用binder_loop方法进入无限循环, 处理binder驱动发来的请求。
2.1 结构体
struct binder_state *bs;binder.c 中binder_state定义如下,
struct binder_state
{
int fd; // 驱动文件dev/binder的描述符
void *mapped; //指向驱动文件映射的内存地址
size_t mapsize; //分配的内存大小，默认为128KB
};
2.2 打开binder驱动
打开驱动的调用流程图如下,
binder_open的方法如下,
struct binder_state *binder_open(size_t mapsize)
{
struct binder_state *bs;
struct binder_version vers;
bs = malloc(sizeof(*bs));
if (!bs) {
errno = ENOMEM;
return NULL;
}
bs->fd = open("/dev/binder", O_RDWR); //通过系统调用陷入内核，打开Binder设备驱动
if (bs->fd < 0) {
fprintf(stderr,"binder: cannot open device (%s)\n",
strerror(errno));
goto fail_open;
}
//通过系统调用，ioctl获取binder版本信息
if ((ioctl(bs->fd, BINDER_VERSION, &vers) == -1) ||
(vers.protocol_version != BINDER_CURRENT_PROTOCOL_VERSION)) {
fprintf(stderr,
"binder: kernel driver version (%d) differs from user space version (%d)\n",
vers.protocol_version, BINDER_CURRENT_PROTOCOL_VERSION);
goto fail_open;
}
bs->mapsize = mapsize; //通过系统调用，mmap内存映射.
bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);
if (bs->mapped == MAP_FAILED) {
fprintf(stderr,"binder: cannot map device (%s)\n",
strerror(errno));
goto fail_map;
}
return bs;
fail_map:
close(bs->fd);
fail_open:
free(bs);
return NULL;
}
这三个方法都是通过系统调用来对binder驱动进行操作。
2.3 注册服务管家
Binder.c 的binder_become_context_manager方法如下,
int binder_become_context_manager(struct binder_state *bs)
{
return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);
}
binder_become_context_manager()的作用是让当前进程成为整个系统中唯一的上下文管理器，即service管理器。
仅仅是把BINDER_SET_CONTEXT_MGR发送到binder驱动而已。通过调用ioctl文件操作函数来通知Binder驱动程
序自己是守护进程，命令是BINDER_SET_CONTEXT_MGR.
binder.h中对该命令的定义如下,
#define BINDER_SET_CONTEXT_MGR _IOW('b', 7, __s32)内核态的binder驱动的binder_ioctl方法对BINDER_SET_CONTEXT_MGR命令处理如下,
binder_context_mgr_node = binder_new_node(proc, 0, 0);
•••
binder_context_mgr_node->local_weak_refs++;
binder_context_mgr_node->local_strong_refs++;
binder_context_mgr_node->has_strong_ref = 1;
binder_context_mgr_node->has_weak_ref = 1;
binder驱动为servicemanager进程生成一个binder_node节点，并记入静态变量binder_context_mgr_node。
2.4 读取binder驱动信息
binder_loop调用流程图如下,
binder.c的binder_loop方法如下,
void binder_loop(struct binder_state *bs, binder_handler func)
{
int res;
struct binder_write_read bwr;
uint32_t readbuf[32];
bwr.write_size = 0;
bwr.write_consumed = 0;
bwr.write_buffer = 0;
readbuf[0] = BC_ENTER_LOOPER;
//将BC_ENTER_LOOPER命令发送给binder驱动
binder_write(bs, readbuf, sizeof(uint32_t));
for (;;) {
bwr.read_size = sizeof(readbuf);
bwr.read_consumed = 0;
bwr.read_buffer = (uintptr_t) readbuf;
// 读取驱动的命令
res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
if (res < 0) {
ALOGE("binder_loop: ioctl failed (%s)\n", strerror(errno));
break;
}
// 解析命令
res = binder_parse(bs, 0, (uintptr_t) readbuf, bwr.read_consumed, func);
if (res == 0) {
ALOGE("binder_loop: unexpected reply?!\n");
break;
}
if (res < 0) {
ALOGE("binder_loop: io error %d %s\n", res, strerror(errno));
break;
}
}
}
binder_loop方法主要分为3个阶段,
1,首先调用binder_write方法向binder驱动发送BC_ENTER_LOOPER命令, 告诉binder驱动“本线程要进入循环状态了”。
2,然后调用ioctl方法读取binder驱动信息。
3,读取驱动信息之后,调用binder_parse方法进行解析。
2.4.1 binder_write
binder_write方法如下,
int binder_write(struct binder_state *bs, void *data, size_t len)
{
struct binder_write_read bwr;
int res;
bwr.write_size = len;
bwr.write_consumed = 0;
bwr.write_buffer = (uintptr_t) data;
bwr.read_size = 0;
bwr.read_consumed = 0;
bwr.read_buffer = 0;
res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
if (res < 0) {
fprintf(stderr,"binder_write: ioctl failed (%s)\n",
strerror(errno));
}
return res;
}
实质也是调用ioctl方法。发送BINDER_WRITE_READ命令,内容为BC_ENTER_LOOPER。
binder驱动的binder_ioctl方法对BINDER_WRITE_READ命令处理如下,
case BINDER_WRITE_READ: {
struct binder_write_read bwr;
if (size != sizeof(struct binder_write_read)) {
ret = -EINVAL;
goto err;
}
if (copy_from_user(&bwr, ubuf, sizeof(bwr))) {
ret = -EFAULT;
goto err;
}
binder_debug(BINDER_DEBUG_READ_WRITE,
"%d:%d write %lld at %016llx, read %lld at %016llx\n",
proc->pid, thread->pid,
(u64)bwr.write_size, (u64)bwr.write_buffer,
(u64)bwr.read_size, (u64)bwr.read_buffer);
if (bwr.write_size > 0) {
ret = binder_thread_write(proc, thread, bwr.write_buffer, bwr.write_size, &bwr.write_consumed);
trace_binder_write_done(ret);
if (ret < 0) {
bwr.read_consumed = 0;
if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
ret = -EFAULT;
goto err;
}
}
首先调用copy_from_user方法将用户态数据复制到内核态,然后调用binder_thread_write进行处理,有关BC_ENTER_LOOPER处理如下,
case BC_ENTER_LOOPER:
if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) {
thread->looper |= BINDER_LOOPER_STATE_INVALID;
binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n",
proc->pid, thread->pid);
}
thread->looper |= BINDER_LOOPER_STATE_ENTERED;
break;
执行完BC_ENTER_LOOPER时，thread->looper值就变为BINDER_LOOPER_STATE_ENTERED了，表明当前线程进入循环状态了。
回到binder_ioctl函数，由于bwr.read_size == 0，binder_thread_read函数就不会被执行了，这样，binder_ioctl的任务就完成了。
2.4.2读取驱动信息
读取驱动信息也是一个ioctl命令,发送的是BINDER_WRITE_READ命令
输入参数bwr各个成员的值
bwr.write_size = 0;
bwr.write_consumed = 0;
bwr.write_buffer = 0;
readbuf[0] = BC_ENTER_LOOPER;
bwr.read_size = sizeof(readbuf);
bwr.read_consumed = 0;
bwr.read_buffer = (unsigned) readbuf;
再次进入到binder_ioctl方法, binder_ioctl对BINDER_WRITE_READ命令处理如下,
if (copy_from_user(&bwr, ubuf, sizeof(bwr))) {
ret = -EFAULT;
goto err;
}
if (bwr.write_size > 0) {
ret = binder_thread_write(proc, thread, bwr.write_buffer, bwr.write_size, &bwr.write_consumed);
trace_binder_write_done(ret);
if (ret < 0) {
bwr.read_consumed = 0;
if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
ret = -EFAULT;
goto err;
}
}
if (bwr.read_size > 0) {
ret = binder_thread_read(proc, thread, bwr.read_buffer, bwr.read_size, &bwr.read_consumed, filp->f_flags & O_NONBLOCK);
trace_binder_read_done(ret);
if (!list_empty(&proc->todo))
wake_up_interruptible(&proc->wait);
if (ret < 0) {
if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
ret = -EFAULT;
goto err;
}
}
•••
这次，bwr.write_size等于0，于是不会执行binder_thread_write方法，bwr.read_size等于32，
于是进入到binder_thread_read方法：
static int binder_thread_read(struct binder_proc *proc,
•••
thread->looper &= ~BINDER_LOOPER_STATE_WAITING;
•••
当然,这时候该读取线程一直在唱独角戏, 线程处于等待状态。那什么时候会唤醒呢?
2.4.3 binder_parse
binder_parse方法中会处理各种类型的消息,现在主要看BR_TRANSACTION类型消息的处理,主要包含服务的注册和获取。
相关代码如下,
case BR_TRANSACTION: {
struct binder_transaction_data *txn = (struct binder_transaction_data *) ptr;
if ((end - ptr) < sizeof(*txn)) {
ALOGE("parse: txn too small!\n");
return -1;
}
binder_dump_txn(txn);
if (func) {
unsigned rdata[256/4];
struct binder_io msg;
struct binder_io reply;
int res;
bio_init(&reply, rdata, sizeof(rdata), 4);
bio_init_from_txn(&msg, txn); //从txn解析出binder_io信息
res = func(bs, txn, &msg, &reply);
binder_send_reply(bs, &reply, txn->data.ptr.buffer, res);
}
ptr += sizeof(*txn);
break;
}
1,首先从txn解析出binder_io信息。
2,回调svcmgr_handler方法进行处理,func指向的是service_manager.c中的svcmgr_handler方法,binder驱动的请求会回调该方法。
3,处理完成之后通知处理结果。
2.5, svcmgr_handler
service_manager.c的svcmgr_handler有关注册和获取服务的处理如下,
case SVC_MGR_GET_SERVICE:
case SVC_MGR_CHECK_SERVICE:
s = bio_get_string16(msg, &len);
if (s == NULL) {
return -1;
}
handle = do_find_service(bs, s, len, txn->sender_euid, txn->sender_pid);
if (!handle)
break;
bio_put_ref(reply, handle);
return 0;
case SVC_MGR_ADD_SERVICE:
s = bio_get_string16(msg, &len);
if (s == NULL) {
return -1;
}
handle = bio_get_ref(msg);
allow_isolated = bio_get_uint32(msg) ? 1 : 0;
if (do_add_service(bs, s, len, handle, txn->sender_euid,
allow_isolated, txn->sender_pid))
return -1;
break;
注册服务时会调用do_add_service方法。
获取服务时会调用do_find_service方法。
2.5.1 注册服务
某个服务进程调用Service Manager Service接口，向其注册service。这个注册动作到最后就会走到svcmgr_handler()的
case SVC_MGR_ADD_SERVICE分支。此时会先获取三个数据，而后再调用do_add_service()函数。
do_add_service方法如下,
int do_add_service(struct binder_state *bs,
const uint16_t *s, size_t len,
uint32_t handle, uid_t uid, int allow_isolated,
pid_t spid)
{
struct svcinfo *si;
//ALOGI("add_service('%s',%x,%s) uid=%d\n", str8(s, len), handle,
// allow_isolated ? "allow_isolated" : "!allow_isolated", uid);
if (!handle || (len == 0) || (len > 127))
return -1;
if (!svc_can_register(s, len, spid)) {
ALOGE("add_service('%s',%x) uid=%d - PERMISSION DENIED\n",
str8(s, len), handle, uid);
return -1;
}
si = find_svc(s, len);
if (si) {
if (si->handle) {
ALOGE("add_service('%s',%x) uid=%d - ALREADY REGISTERED, OVERRIDE\n",
str8(s, len), handle, uid);
svcinfo_death(bs, si);
}
si->handle = handle;
} else {
si = malloc(sizeof(*si) + (len + 1) * sizeof(uint16_t));
if (!si) {
ALOGE("add_service('%s',%x) uid=%d - OUT OF MEMORY\n",
str8(s, len), handle, uid);
return -1;
}
si->handle = handle;
si->len = len;
memcpy(si->name, s, (len + 1) * sizeof(uint16_t));
si->name[len] = '\0';
si->death.func = (void*) svcinfo_death;
si->death.ptr = si;
si->allow_isolated = allow_isolated;
si->next = svclist;
svclist = si;
}
binder_acquire(bs, handle);
binder_link_to_death(bs, handle, &si->death);
return 0;
}
1,首先调用svc_can_register方法检查进程是否可以注册服务。并不是android系统中所有的服务都可以注册, 如果发起端
是root进程或者system server进程的话，是可以注册service的；至于其他绝大部分普通进程，不允许注册service。
2,调用find_svc方法在service链表里查询对应的service是否已经添加过了。如果可以查到，那么就不用生成新的service
节点了。否则就需要在链表起始处再加一个新节点，节点类型为svcinfo。
3,如果未注册,则添加到service链表中。
2.5.2 获取服务
在service被注册进service manager之后，其他应用都可以调用ServiceManager的getService()来获取相应的服务代理，
并调用代理的成员函数。这个getService()函数最终会向service manager进程发出SVC_MGR_GET_SERVICE命令,
调用do_find_service方法。do_find_service方法如下,
uint32_t do_find_service(struct binder_state *bs, const uint16_t *s, size_t len, uid_t uid, pid_t spid)
{
struct svcinfo *si = find_svc(s, len);
if (!si || !si->handle) {
return 0;
}
if (!si->allow_isolated) {
// If this service doesn't allow access from isolated processes,
// then check the uid to see if it is isolated.
uid_t appid = uid % AID_USER;
if (appid >= AID_ISOLATED_START && appid <= AID_ISOLATED_END) {
return 0;
}
}
if (!svc_can_find(s, len, spid)) {
return 0;
}
return si->handle;
}
直接调用find_svc方法从svclist链表中查找服务。
find_svc方法如下,
struct svcinfo *find_svc(const uint16_t *s16, size_t len)
{
struct svcinfo *si;
for (si = svclist; si; si = si->next) {
if ((len == si->len) &&
!memcmp(s16, si->name, len * sizeof(uint16_t))) {
return si;
}
}
return NULL;
}
结构体svcinfo定义如下,
struct svcinfo
{
struct svcinfo *next;
uint32_t handle;
struct binder_death death;
int allow_isolated;
size_t len;
uint16_t name[0];
};
其实,使用handle来表示服务代理对应的句柄值,最后返回的也是handle。
2.5.3 结果返回
当svcmgr_handler()返回后，会接着把整理好的reply对象send出去, 也就是把查找到的信息，发送给发起查找的一方。
Binder.c的binder_send_reply方法如下,
void binder_send_reply(struct binder_state *bs,
struct binder_io *reply,
binder_uintptr_t buffer_to_free,
int status)
{
struct {
uint32_t cmd_free;
binder_uintptr_t buffer;
uint32_t cmd_reply;
struct binder_transaction_data txn;
} __attribute__((packed)) data;
data.cmd_free = BC_FREE_BUFFER;
data.buffer = buffer_to_free;
data.cmd_reply = BC_REPLY;
data.txn.target.ptr = 0;
data.txn.cookie = 0;
data.txn.code = 0;
if (status) {
data.txn.flags = TF_STATUS_CODE;
data.txn.data_size = sizeof(int);
data.txn.offsets_size = 0;
data.txn.data.ptr.buffer = (uintptr_t)&status;
data.txn.data.ptr.offsets = 0;
} else {
data.txn.flags = 0;
data.txn.data_size = reply->data - reply->data0;
data.txn.offsets_size = ((char*) reply->offs) - ((char*) reply->offs0);
data.txn.data.ptr.buffer = (uintptr_t)reply->data0;
data.txn.data.ptr.offsets = (uintptr_t)reply->offs0;
}
binder_write(bs, &data, sizeof(data));
}
直接调用binder_write方法,如下,
int binder_write(struct binder_state *bs, void *data, size_t len)
{
struct binder_write_read bwr;
int res;
bwr.write_size = len;
bwr.write_consumed = 0;
bwr.write_buffer = (uintptr_t) data;
bwr.read_size = 0;
bwr.read_consumed = 0;
bwr.read_buffer = 0;
res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
if (res < 0) {
fprintf(stderr,"binder_write: ioctl failed (%s)\n",
strerror(errno));
}
return res;
}
还是调用ioctl方法进入到binder驱动中。
小结:
1, servicemanager进程打开binder驱动后,读取驱动的命令,相当于监听。
2, servicemanager进程一般也是调用ioctl方法通过系统调用进入到binder驱动。
3, servicemanager进程简单的完成消息的注册和获取,是binder的桥梁。
4, servicemanager和binder驱动交互通过简单的指令标记。
其实, binder驱动对应的文件是 /kernel/drivers目录里面的binder.c。
根据实际情况,该文件在/kernel/drivers里的不同目录下。
Ioctl方法对应的是驱动binder.c的binder_ioctl方法。