在进行dumpsys调用的时候，dump方法的第一个参数是文件描述符
BinderProxy.java
publicvoid dump(FileDescriptor fd, String[] args)
通过传送文件描述符来让服务端向给定的文件写数据，
等等，仔细想想，好像有什么不对
是啊，每个进程中的文件描述符是独立无关的，你把C进程中的文件描述符传给S进程，这不是刻舟求剑么？
但是，Android的binder看上去就是传送了文件描述符，这里面暗藏了什么玄机呢？
我们在读写文件描述符的地方加上log
frameworks/native/libs/binder/Parcel.cpp
status_t Parcel::writeDupFileDescriptor(int fd)
{
int dupFd = dup(fd);
if (dupFd < 0) {
return -errno;
}
//在这里添加log，查看fd的值
ALOGE("writeDupFileDescriptor: fd = %d, dupfd = %d\n", fd, dupFd);
status_t err = writeFileDescriptor(dupFd, true /*takeOwnership*/);
if (err) {
close(dupFd);
}
return err;
}
frameworks/base/core/jni/android_os_Parcel.cpp
static jobject android_os_Parcel_readFileDescriptor(JNIEnv* env, jclass clazz, jlong nativePtr)
{
Parcel* parcel = reinterpret_cast<Parcel*>(nativePtr);
if (parcel != NULL) {
int fd = parcel->readFileDescriptor();
ALOGD("00 ========== android_os_Parcel_readFileDescriptor, fd=%d", fd);
if (fd < 0) return NULL;
fd = dup(fd);
ALOGD("========== android_os_Parcel_readFileDescriptor, fd=%d", fd);
if (fd < 0) return NULL;
return jniCreateFileDescriptor(env, fd);
}
return NULL;
}
进行一次dump调用，查看log
我们会发现，写入的fd和服务端读出的fd不一样，但是服务端却正确的完成了数据的输出，为什么呢？
肯定有地方进行了处理。
通过查看，我们发现，原来是在数据传输的过程中被做了手脚，binder驱动在传送数据的时候，在服务端上创建了一个新的fd，并且把这个fd和客户端fd所对应的文件进行了关联。
处理流程
BinderProxy.java
public void dump(FileDescriptor fd,String[] args) throws RemoteException {
Parcel data = Parcel.obtain();
Parcel reply = Parcel.obtain();
data.writeFileDescriptor(fd);
data.writeStringArray(args);
try {
transact(DUMP_TRANSACTION, data,reply, 0);
reply.readException();
} finally {
data.recycle();
reply.recycle();
}
}
调用到
Parcel.java
public final void writeFileDescriptor(FileDescriptor val) {
updateNativeSize(nativeWriteFileDescriptor(mNativePtr,val));
}
frameworks/base/core/jni/android_util_Binder.cpp
staticjboolean android_os_BinderProxy_transact(JNIEnv* env, jobject obj,
jint code, jobject dataObj, jobjectreplyObj, jint flags) // throws RemoteException
{
frameworks/native/libs/binder/BpBinder.cpp
status_tBpBinder::transact(
uint32_t code, const Parcel& data,Parcel* reply, uint32_t flags)
{
// Once a binder has died, it will nevercome back to life.
if (mAlive) {
status_t status =IPCThreadState::self()->transact(
mHandle, code, data, reply, flags);
./frameworks/native/libs/binder/IPCThreadState.cpp
status_tIPCThreadState::transact(int32_t handle,
uint32_t code, const Parcel& data,
Parcel*reply, uint32_t flags)
{
status_t err = data.errorCheck();
flags |= TF_ACCEPT_FDS;
IF_LOG_TRANSACTIONS() {
TextOutput::Bundle _b(alog);
alog << "BC_TRANSACTION thr" << (void*)pthread_self() << " / hand "
<< handle << " /code " << TypeCode(code) << ": "
<< indent << data<< dedent << endl;
}
if (err == NO_ERROR) {
LOG_ONEWAY(">>>> SENDfrom pid %d uid %d %s", getpid(), getuid(),
(flags & TF_ONE_WAY) == 0 ?"READ REPLY" : "ONE WAY");
err = writeTransactionData(BC_TRANSACTION, flags, handle,code, data, NULL);
}
… …
if (reply) {
err = waitForResponse(reply);
} else {
Parcel fakeReply;
err =waitForResponse(&fakeReply);
}
status_tIPCThreadState::waitForResponse(Parcel *reply, status_t *acquireResult)
{
uint32_t cmd;
int32_t err;
#ifdef_MTK_ENG_BUILD_
cmd = 0;// initialze it for build error[-Werror=maybe-uninitialized]
#endif
while (1) {
if ((err=talkWithDriver()) < NO_ERROR) break;
err = mIn.errorCheck();
if (err < NO_ERROR) break;
if (mIn.dataAvail() == 0) continue;
cmd = (uint32_t)mIn.readInt32();
status_tIPCThreadState::talkWithDriver(bool doReceive)
{
if (ioctl(mProcess->mDriverFD, BINDER_WRITE_READ,&bwr) >= 0)
然后调用到binder驱动里
最终，调用到方法binder_transaction
在里面对fd进行了处理
kernel-3.18/drivers/staging/android/binder.c
static void binder_transaction(structbinder_proc *proc,
structbinder_thread *thread,
structbinder_transaction_data *tr, int reply)
{
… …
case BINDER_TYPE_FD:{
int target_fd;
struct file *file;
if (reply) {
if(!(in_reply_to->flags & TF_ACCEPT_FDS)) {
binder_user_error
("%d:%dgot reply with fd, %d, but target does not allow fds\n",
proc->pid, thread->pid, fp->handle);
return_error = BR_FAILED_REPLY;
goto err_fd_not_allowed;
}
} else if(!target_node->accept_fds) {
binder_user_error
("%d:%d got transaction with fd, %d, but target does not allowfds\n",
proc->pid, thread->pid, fp->handle);
return_error = BR_FAILED_REPLY;
gotoerr_fd_not_allowed;
}
//根据文件描述符获取到其对应的文件信息
//在某些Unix系统中，该方法名是getf
file =fget(fp->handle);
if (file ==NULL) {
binder_user_error
("%d:%d got transaction with invalid fd, %d\n",
proc->pid, thread->pid, fp->handle);
return_error = BR_FAILED_REPLY;
gotoerr_fget_failed;
}
if(security_binder_transfer_file
(proc->tsk, target_proc->tsk, file) < 0) {
fput(file);
return_error = BR_FAILED_REPLY;
goto err_get_unused_fd_failed;
}
//在目标进程中获取一个没有使用的文件描述符
target_fd =task_get_unused_fd_flags(target_proc, O_CLOEXEC);
if (target_fd< 0) {
fput(file);
return_error = BR_FAILED_REPLY;
gotoerr_get_unused_fd_failed;
}
//把目标进程中新建的fd和file信息关联起来，实现了进程间fd的复制
task_fd_install(target_proc, target_fd, file);
trace_binder_transaction_fd(t, fp->handle, target_fd);
binder_debug(BINDER_DEBUG_TRANSACTION,
" fd %d -> %d\n", fp->handle,target_fd);
/* TODO: fput?*/
fp->binder =0;
fp->handle = target_fd;
#ifdefBINDER_MONITOR
e->fd =target_fd;
#endif
}
break;
1443
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
