Android Binder机制浅析之ServiceManager

Android系统进程间通信机制Binder的总体架构由Client、Server、ServiceManager和驱动程序Binder四个组件构成。今天主要来看看ServiceManager的实现吧。

Service Manager

Service Manager是系统中一个独立的进程，它是整个Binder机制的守护进程，用来管理开发者创建的各种Server，并且向Client提供查询Server远程接口的功能。

Service Manager的启动

前面我们说过，在init进程启动的过程中会去解析init.rc文件，然后启动相应的服务或者进程。其中在boot阶段，有如下一段语句：

service servicemanager/system/bin/servicemanager

   class core

   user system

   group system

   critical

   onrestart restart healthd

   onrestart restart zygote

   onrestart restart media

   onrestart restart surfaceflinger

onrestartrestart drm

由此可见，servicemanager服务还是很重要的，它带了critical标志，即如果该进程连续crash几次，系统会进入恢复模式。而且如果该进程挂了，系统还会重启zygote、surfaceflinger等系统关键进程。其重要性真是不言而喻啊。

 

Service Manager的使命

Servicemanager的代码在frameworks\native\cmds\servicemanager\service_manager.c中，main函数如下：

int main(int argc, char **argv)
{
	/*
		struct binder_state
		{
    			int fd;	// /dev/binder的文件描述符
    			void *mapped;	// mmap映射出来的地址
    			unsigned mapsize;	// mmap映射的大小
		};
	/*
	struct binder_state *bs;

	/*
		/* the one magic object */
		#define BINDER_SERVICE_MANAGER ((void*) 0)
		一个magic对象，用0来标识一个Service Manager
	*/
    	void *svcmgr = BINDER_SERVICE_MANAGER;
	
	// 打开/dev/binder设备，并mmap映射之，大小为128K
    	bs = binder_open(128*1024);
	
	// 告诉binder驱动我是Service Manager进程
    	if (binder_become_context_manager(bs)) {
        	ALOGE("cannot become context manager (%s)\n", strerror(errno));
        	return -1;
    	}

	svcmgr_handle = svcmgr;

	// 循环接受并处理消息
    	binder_loop(bs, svcmgr_handler);
    	return 0;
}

打开binder驱动

首先来看看binder_open的实现，代码很简单，就不详细说明了：

struct binder_state *binder_open(unsigned mapsize)
{
    struct binder_state *bs;

    bs = malloc(sizeof(*bs));
    if (!bs) {
        errno = ENOMEM;
        return 0;
    }

    bs->fd = open("/dev/binder", O_RDWR);
    if (bs->fd < 0) {
        fprintf(stderr,"binder: cannot open device (%s)\n",
                strerror(errno));
        goto fail_open;
    }

    bs->mapsize = mapsize;
    bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);
    if (bs->mapped == MAP_FAILED) {
        fprintf(stderr,"binder: cannot map device (%s)\n",
                strerror(errno));
        goto fail_map;
}

    return bs;

fail_map:
    close(bs->fd);
fail_open:
    free(bs);
    return 0;
}

注册为服务进程

接着来看binder_become_context_manager的实现：

int binder_become_context_manager(struct binder_state *bs)
{
    return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);
}

binder_become_context_manager原来是通过ioctl的系统调用来告诉binder驱动自己是MGR进程。

消息循环

最后，调用binder_loop开始接受消息：

void binder_loop(struct binder_state *bs, binder_handler func)
{
	int res;
	/*
		binder_write_read结构用来应用层和驱动层传递数据。
		struct binder_write_read {
 		 	signed long write_size;
 			signed long write_consumed;
 			unsigned long write_buffer;
 			signed long read_size;
 			signed long read_consumed;
		 	unsigned long read_buffer;
		};
	*/
    	struct binder_write_read bwr;
    	unsigned readbuf[32];

    	bwr.write_size = 0;
    	bwr.write_consumed = 0;
    	bwr.write_buffer = 0;
    
	// 通知binder驱动，我要开始循环接受消息了。
    	readbuf[0] = BC_ENTER_LOOPER;
    	binder_write(bs, readbuf, sizeof(unsigned));
	
	// 开始循环接收数据
    	for (;;) {
        	bwr.read_size = sizeof(readbuf);
        	bwr.read_consumed = 0;
        	bwr.read_buffer = (unsigned) readbuf;
		
		// 通过ioctl获得驱动中的数据
        	res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);

        	if (res < 0) {
            		ALOGE("binder_loop: ioctl failed (%s)\n", strerror(errno));
            		break;
        	}
		
		// 获得之后开始解析处理
        	res = binder_parse(bs, 0, readbuf, bwr.read_consumed, func);
        	if (res == 0) {
            		ALOGE("binder_loop: unexpected reply?!\n");
            		break;
        	}
        	if (res < 0) {
            		ALOGE("binder_loop: io error %d %s\n", res, strerror(errno));
            		break;
        	}
    	}
}

具体来看下binder_parse的实现：

int binder_parse(struct binder_state *bs, struct binder_io *bio,
                 uint32_t *ptr, uint32_t size, binder_handler func)
{
    int r = 1;
    uint32_t *end = ptr + (size / 4);

    while (ptr < end) {
        uint32_t cmd = *ptr++;
        switch(cmd) {
        case BR_NOOP:
            break;
        case BR_TRANSACTION_COMPLETE:
            break;
        case BR_INCREFS:
        case BR_ACQUIRE:
        case BR_RELEASE:
        case BR_DECREFS:
#if TRACE
            fprintf(stderr,"  %08x %08x\n", ptr[0], ptr[1]);
#endif
            ptr += 2;
            break;
        case BR_TRANSACTION: {
            struct binder_txn *txn = (void *) ptr;
            if ((end - ptr) * sizeof(uint32_t) < sizeof(struct binder_txn)) {
                ALOGE("parse: txn too small!\n");
                return -1;
            }
            binder_dump_txn(txn);
            if (func) {
                unsigned rdata[256/4];
                struct binder_io msg;
                struct binder_io reply;
                int res;

                bio_init(&reply, rdata, sizeof(rdata), 4);
                bio_init_from_txn(&msg, txn);
                res = func(bs, txn, &msg, &reply);
                binder_send_reply(bs, &reply, txn->data, res);
            }
            ptr += sizeof(*txn) / sizeof(uint32_t);
            break;
        }
        case BR_REPLY: {
            struct binder_txn *txn = (void*) ptr;
            if ((end - ptr) * sizeof(uint32_t) < sizeof(struct binder_txn)) {
                ALOGE("parse: reply too small!\n");
                return -1;
            }
            binder_dump_txn(txn);
            if (bio) {
                bio_init_from_txn(bio, txn);
                bio = 0;
            } else {
                    /* todo FREE BUFFER */
            }
            ptr += (sizeof(*txn) / sizeof(uint32_t));
            r = 0;
            break;
        }
        case BR_DEAD_BINDER: {
            struct binder_death *death = (void*) *ptr++;
            death->func(bs, death->ptr);
            break;
        }
        case BR_FAILED_REPLY:
            r = -1;
            break;
        case BR_DEAD_REPLY:
            r = -1;
            break;
        default:
            ALOGE("parse: OOPS %d\n", cmd);
            return -1;
        }
    }

    return r;
}

如果接收到了消息，那么binder_parse会经过简单的转换，最后还是会调用回调函数svcmgr_handler:

int svcmgr_handler(struct binder_state *bs,
                   struct binder_txn *txn,
                   struct binder_io *msg,
                   struct binder_io *reply)
{
    struct svcinfo *si;
    uint16_t *s;
    unsigned len;
    void *ptr;
    uint32_t strict_policy;
    int allow_isolated;
	
	// 确认消息是发给server manager
    if (txn->target != svcmgr_handle)
        return -1;

    …….

    switch(txn->code) {
    case SVC_MGR_GET_SERVICE:
case SVC_MGR_CHECK_SERVICE:
	// 获得当前服务名，s变量为服务名
        s = bio_get_string16(msg, &len);
		/*
			Server manager在其进程空间维护了一个service的全局链表svclist，
			do_find_service通过服务名来查找该服务是否存在，并返回给客户端
		*/
        ptr = do_find_service(bs, s, len, txn->sender_euid);
        if (!ptr)
            break;
        bio_put_ref(reply, ptr);
        return 0;

	// 其他的server进程来添加服务
    case SVC_MGR_ADD_SERVICE:
        s = bio_get_string16(msg, &len);
        ptr = bio_get_ref(msg);
        allow_isolated = bio_get_uint32(msg) ? 1 : 0;
        if (do_add_service(bs, s, len, ptr, txn->sender_euid, allow_isolated))
            return -1;
        break;

	// 枚举所有已经注册了的服务名
    case SVC_MGR_LIST_SERVICES: {
        unsigned n = bio_get_uint32(msg);

        si = svclist;
        while ((n-- > 0) && si)
            si = si->next;
        if (si) {
            bio_put_string16(reply, si->name);
            return 0;
        }
        return -1;
    }
    default:
        ALOGE("unknown code %d\n", txn->code);
        return -1;
    }

    bio_put_uint32(reply, 0);
    return 0;
}

具体来看下添加服务的规程吧：

int do_add_service(struct binder_state *bs,
                   uint16_t *s, unsigned len,
                   void *ptr, unsigned uid, int allow_isolated)
{
    struct svcinfo *si;
	// 参数检查
    if (!ptr || (len == 0) || (len > 127))
        return -1;
	
	// 根据uid和服务名判断是否可以被注册
    if (!svc_can_register(uid, s)) {
        ALOGE("add_service('%s',%p) uid=%d - PERMISSION DENIED\n",
             str8(s), ptr, uid);
        return -1;
    }
	
	// 根据服务名，遍历svclist服务链表
    si = find_svc(s, len);
    if (si) {
        if (si->ptr) {
            ALOGE("add_service('%s',%p) uid=%d - ALREADY REGISTERED, OVERRIDE\n",
                 str8(s), ptr, uid);
            svcinfo_death(bs, si);	// 清理前一个服务
        }
        si->ptr = ptr;	// 赋值新服务
    } else {
        si = malloc(sizeof(*si) + (len + 1) * sizeof(uint16_t));
        if (!si) {
            ALOGE("add_service('%s',%p) uid=%d - OUT OF MEMORY\n",
                 str8(s), ptr, uid);
            return -1;
        }
        si->ptr = ptr;
        si->len = len;
        memcpy(si->name, s, (len + 1) * sizeof(uint16_t));
        si->name[len] = '\0';
        si->death.func = svcinfo_death;	// 如果server进程挂了，那么调用该函数处理
        si->death.ptr = si;
        si->allow_isolated = allow_isolated;
        si->next = svclist;
        svclist = si;
    }

binder_acquire(bs, ptr);
binder_link_to_death(bs, ptr, &si->death);
    return 0;
}

do_add_service首先会调用svc_can_register函数检测当前要添加的服务是否被允许，函数如下：

int svc_can_register(unsigned uid, uint16_t *name)
{
    unsigned n;
    // 如果uid为root或者system权限，那么直接放行
    if ((uid == 0) || (uid == AID_SYSTEM))
        return 1;

	// 否则，检查allowed数组
    for (n = 0; n < sizeof(allowed) / sizeof(allowed[0]); n++)
        if ((uid == allowed[n].uid) && str16eq(name, allowed[n].name))
            return 1;

    return 0;
}

allowed数组内容如下：

static struct {
    unsigned uid;
    const char *name;
} allowed[] = {
    { AID_MEDIA, "media.audio_flinger" },
    { AID_MEDIA, "media.log" },
    { AID_MEDIA, "media.player" },
    { AID_MEDIA, "media.camera" },
    { AID_MEDIA, "media.audio_policy" },
    { AID_DRM,   "drm.drmManager" },
    { AID_NFC,   "nfc" },
    { AID_BLUETOOTH, "bluetooth" },
    { AID_RADIO, "radio.phone" },
    { AID_RADIO, "radio.sms" },
    { AID_RADIO, "radio.phonesubinfo" },
    { AID_RADIO, "radio.simphonebook" },
/* TODO: remove after phone services are updated: */
    { AID_RADIO, "phone" },
    { AID_RADIO, "sip" },
    { AID_RADIO, "isms" },
    { AID_RADIO, "iphonesubinfo" },
    { AID_RADIO, "simphonebook" },
    { AID_MEDIA, "common_time.clock" },
    { AID_MEDIA, "common_time.config" },
    { AID_KEYSTORE, "android.security.keystore" },
};

Service Manager存在的意义

1.      Service Manager能集中管理系统内的所有服务，它能被施加权限控制，并不是任何进程都能注册服务的。

2.      Service Manager支持通过字符串名称来查找对应的Service。

3.      由于各种原因的影响，Server进程可能生死无常。如果有了Service Manager做统一的管理，那么Client只要向Service Manager做查询，就能得到Server的最新信息。