Android Binder机制学习总结(三)-ServiceManager部分

最新推荐文章于 2023-04-23 14:26:07 发布

VIP文章 a220315410

最新推荐文章于 2023-04-23 14:26:07 发布

阅读量3.4k

点赞数

分类专栏： android

本文链接：https://blog.csdn.net/a220315410/article/details/18669113

版权

接上篇的内容，分析下ServiceManager的实现。

ServiceManager的实现位于：

4.2：/frameworks/base/cmds/servicemanager/

4.3：frameworks/native/cmds/servicemanager/

ServiceManager的启动

ServiceManager的的启动由init进程根据init.rc文件的配置执行，从时间顺序上来说，ServiceManager的启动优先于Zygote进程

service servicemanager /system/bin/servicemanager
    class core            //core类服务
    user system           //用户名
    group system          //用户组
    critical              //重要service， 如果4分钟内crush4次以上，则重启系统并进入recovery
    onrestart restart zygote          //servicemanager重启以后，自动重启zygote
    onrestart restart media           //同上
    onrestart restart surfaceflinger  //同上
    onrestart restart drm             //同上

ServiceManager是一个可执行文件,所以，我们从main函数看起（frameworks/base/cmds/servicemanager/servicemanager.c)：

int main(int argc, char **argv)
{
    struct binder_state *bs;
    void *svcmgr = BINDER_SERVICE_MANAGER;

    bs = binder_open(128*1024);

    if (binder_become_context_manager(bs)) {
        ALOGE("cannot become context manager (%s)\n", strerror(errno));
        return -1;
    }

    svcmgr_handle = svcmgr;
    binder_loop(bs, svcmgr_handler);//svcmgr_handle为具体的请求处理逻辑
    return 0;
}

简单来说，ServiceManager的启动分为三个步骤：

打开dev/binder，并创建binder缓冲区
注册当前进程为上下文管理者（ServiceManager)
进入处理循环，等待Service/Client的请求

步骤一

步骤一，由binder_open函数实现（frameworks/base/cmds/servicemanager/binder.c):

struct binder_state *binder_open(unsigned mapsize)
{
    struct binder_state *bs;

    bs = malloc(sizeof(*bs));
    if (!bs) {
        errno = ENOMEM;
        return 0;
    }

    bs->fd = open("/dev/binder", O_RDWR);//上一节讲过，这里会转入内核态，执行binder_open,创建binder_proc
    if (bs->fd < 0) {
        fprintf(stderr,"binder: cannot open device (%s)\n",
                strerror(errno));
        goto fail_open;
    }

    bs->mapsize = mapsize;//mapsize = 128KB
    bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);//上一节讲过，这里会转入内核态，执行binder_mmap
                                                                        //在内核态创建相同size的缓冲区，并分配第一个物理页面，计算内核缓冲区地址和用户缓冲区地址的偏移量
    if (bs->mapped == MAP_FAILED) {
        fprintf(stderr,"binder: cannot map device (%s)\n",
                strerror(errno));
        goto fail_map;
    }

        /* TODO: check version */

    return bs;

fail_map:
    close(bs->fd);
fail_open:
    free(bs);
    return 0;
}

如果上一节binder driver部分的内容有比较好的理解的话，这边的代码应该比较好理解的，顺便看看binder_state的实现：

struct binder_state
{
    int fd;
    void *mapped;
    unsigned mapsize;
};

步骤二

步骤二，由binder_become_context_manager函数实现：

int binder_become_context_manager(struct binder_state *bs)
{
    return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);
}

灰常简单的实现，有木有? 让我们来回忆一下，上一节的内容，ioctl的调用会转入到binder driver的binder_ioctl函数来处理BINDER_SET_CONTEXT_MGR:

        case BINDER_SET_CONTEXT_MGR:
		if (binder_context_mgr_node != NULL) {
			printk(KERN_ERR "binder: BINDER_SET_CONTEXT_MGR already set\n");
			ret = -EBUSY;
			goto err;
		}
		ret = security_binder_set_context_mgr(proc->tsk);
		if (ret < 0)
			goto err;
		if (binder_context_mgr_uid != -1) {
			if (binder_context_mgr_uid != current->cred->euid) {
				printk(KERN_ERR "binder: BINDER_SET_"
				       "CONTEXT_MGR bad uid %d != %d\n",
				       current->cred->euid,
				       binder_context_mgr_uid);
				ret = -EPERM;
				goto err;
			}
		} else
			binder_context_mgr_uid = current->cred->euid;
		binder_context_mgr_node = binder_new_node(proc, NULL, NULL);//binder_context_mgr_node->proc = servicemanager
		if (binder_context_mgr_node == NULL) {
			ret = -ENOMEM;
			goto err;
		}
		binder_context_mgr_node->local_weak_refs++;
		binder_context_mgr_node->local_strong_refs++;
		binder_context_mgr_node->has_strong_ref = 1;
		binder_context_mgr_node->has_weak_ref = 1;
		break;

忽略安全检查等代码，上面的代码就是设定了全局变量binder_context_mgr_node，并增加引用计数。

步骤三

处理循环的实现在binder_loop函数中：

void binder_loop(struct binder_state *bs, binder_handler func)
{
    int res;
    struct binder_write_read bwr;
    unsigned readbuf[32];

    bwr.write_size = 0;
    bwr.write_consumed = 0;
    bwr.write_buffer = 0;
    
    readbuf[0] = BC_ENTER_LOOPER;
    binder_write(bs, readbuf, sizeof(unsigned));//binder driver会通过binder_thread_write函数处理BC_ENTER_LOOPER指令

    for (;;) {
        bwr.read_size = sizeof(readbuf);
        bwr.read_consumed = 0;
        bwr.read_buffer = (unsigned) readbuf;

        res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);//读取client/service的请求

        if (res < 0) {
            ALOGE("binder_loop: ioctl failed (%s)\n", strerror(errno));
            break;
        }

        res = binder_parse(bs, 0, readbuf, bwr.read_consumed, func);//处理请求
        if (res == 0) {
            ALOGE("binder_loop: unexpected reply?!\n");
            break;
        }
        if (res < 0) {
            ALOGE("binder_loop: io error %d %s\n", res, strerror(errno));
            break;
        }
    }
}

ServiceManager客户端代理

ServiceManager运行在自己的进程中，为了向Client/Service进程提供服务，ServiceManager为自己准备了客户端代理，方便Client/Service调用。

IServiceManager和BpServiceManager

IServiceManager是ServiceManager在native层的接口（framework/native/include/binder/IServiceManager.h）：

class IServiceManager : public IInterface
{
public:
    DECLARE_META_INTERFACE(ServiceManager);


    /**
     * Retrieve an existing service, blocking for a few seconds
     * if it doesn't yet exist.
     */
    virtual sp<IBinder>         getService( const String16& name) const = 0;


    /**
     * Retrieve an existing service, non-blocking.
     */
    virtual sp<IBinder>         checkService( const String16& name) const = 0;


    /**
     * Register a service.
     */
    virtual status_t            addService( const String16& name,
                                            const sp<IBinder>& service,
                                            bool allowIsolated = false) = 0;


    /**
     * Return list of all existing services.
     */
    virtual Vector<String16>    listServices() = 0;


    enum {
        GET_SERVICE_TRANSACTION = IBinder::FIRST_CALL_TRANSACTION,
        CHECK_SERVICE_TRANSACTION,
        ADD_SERVICE_TRANSACTION,
        LIST_SERVICES_TRANSACTION,
    };
};

从接口中，我们看到SeviceManager提供了4个功能：

getService，同checkService
checkService，供Client获取Service的binder
addService, 供Service注册binder
listService，用于枚举所有已经注册的binder

而BpServiceManager是IServiceManager的一个子类，提供了IServiceManager的实现（frameworks/native/libs/binder/IServiceManager.cpp)：

class BpServiceManager : public BpInterface<IServiceManager>
{
public:
    BpServiceManager(const sp<IBinder>& impl)
        : BpInterface<IServiceManager>(impl)
    {
    }

    virtual sp<IBinder> getService(const String16& name) const
    {
          ...... //实现啥的，我们后面再看
    }

    virtual sp<IBinder> checkService( const String16& name) const
    {
          ......
    }

    virtual status_t addService(const String16& name, const sp<IBinder>& service,
            bool allowIsolated)
    {
          ......
    }

    virtual Vector<String16> listServices()
    {
          ......
    }
};

前缀Bp可以理解为Binder Proxy，即BpServiceManager实际上是ServiceManager在客户进程中的一个代理，所以BpServiceManager并不负责实现真正的功能，而是通过Binder通信发送请求到前面启动的ServiceManager进程。上一节中我们讲到过，Binder通信的前提是客户端进程需要有BpBinder，那么BpBinder从何而来呢？

defaultServiceManager

作为一个特殊的“Service”，Android系统为ServiceManager准备了“快捷方式”，这个快捷方式就是defaultServiceManager（frameworks/native/libs/binder/IServiceManager.cpp):

sp<IServiceManager> defaultServiceManager()
{
    if (gDefaultServiceManager != NULL) return gDefaultServiceManager;//单例模式
    
    {
        AutoMutex _l(gDefaultServiceManagerLock);
        if (gDefaultServiceManager == NULL) {
            gDefaultServiceManager = interface_cast<IServiceManager>(
                ProcessState::self()->getContextObject(NULL));
        }
    }
    
    return gDefaultServiceManager;
}

这里可以把defaultServiceManager分解为三个步骤：

ProcessState::self()
ProcessState->getContextObject(NULL)
interface_cast<IServiceManager>()

1.1 ProcessState::self（）看起：

sp<ProcessState> ProcessState::self()
{
    Mutex::Autolock _l(gProcessMutex);//又是单例模式，因为是进程信息，所以，一个进程只能有一个实例
    if (gProcess != NULL) {
        return gProcess;
    }
    gProcess = new ProcessState;
    return gProcess;
}

1.2 ProcessState的构造函数：

ProcessState::ProcessState()
    : mDriverFD(open_driver())
    , mVMStart(MAP_FAILED)
    , mManagesContexts(false)
    , mBinderContextCheckFunc(NULL)
    , mBinderContextUserData(NULL)
    , mThreadPoolStarted(false)
    , mThreadPoolSeq(1)
{
    if (mDriverFD >= 0) {
        // XXX Ideally, there should be a specific define for whether we
        // have mmap (or whether we could possibly have the kernel module
        // availabla).
#if !defined(HAVE_WIN32_IPC)
        // mmap the binder, providing a chunk of virtual address space to receive transactions.
        mVMStart = mmap(0, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
        if (mVMStart == MAP_FAILED) {
            // *sigh*
            ALOGE("Using /dev/binder failed: unable to mmap transaction memory.\n");
            close(mDriverFD);
            mDriverFD = -1;
        }
#else
        mDriverFD = -1;
#endif
    }

    LOG_ALWAYS_FATAL_IF(mDriverFD < 0, "Binder driver could not be opened.  Terminating.");
}

是不是觉得有点熟悉？又看到mmap了，但是mDriverFD是哪来的呢？上面很容易忽略的地方有个open_driver(),让我们来看看。

1.3 open_driver()

static int open_driver()
{
    int fd = open("/dev/binder", O_RDWR);
    if (fd >= 0) {
        fcntl(fd, F_SETFD, FD_CLOEXEC);
        int vers;
        status_t result = ioctl(fd, BINDER_VERSION, &vers);
        if (result == -1) {
            ALOGE("Binder ioctl to obtain version failed: %s", strerror(errno));
            close(fd);
            fd = -1;
        }
        if (result != 0 || vers != BINDER_CURRENT_PROTOCOL_VERSION) {
            ALOGE("Binder driver protocol does not match user space protocol!");
            close(fd);
            fd = -1;
        }
        size_t maxThreads = 15;
        result = ioctl(fd, BINDER_SET_MAX_THREADS, &maxThreads);
        if (result == -1) {
            ALOGE("Binder ioctl to set max threads failed: %s", strerror(errno));
        }
    } else {
        ALOGW("Opening '/dev/binder' failed: %s\n", strerror(errno));
    }
    return fd;
}

现在，更加熟悉了:

    int fd = open("/dev/binder", O_RDWR);

所以，ProcessState::self()做了两件事：

mDriverFD = open（“dev/binde")
mmap(mDriveFD)

这就为调用binder通信做好了准备。然后再来看看ProcessState->getContextObject(NULL):

2.1 getContextObject

最低0.47元/天解锁文章

a220315410

关注

0
点赞
踩
4

收藏

觉得还不错? 一键收藏
0
评论
Android Binder机制学习总结(三)-ServiceManager部分

接上篇的内容，分析下ServiceManager的实现。 ServiceManager的实现位于： 4.2：/frameworks/base/cmds/servicemanager/ 4.3：frameworks/native/cmds/servicemanager/
复制链接

扫一扫