frameworks 之ServiceManager
ServiceManager 作为android中的路由器提供服务注册以及查询的功能。本文讲解对应的 启动，以及如何服务端和客户端一个沟通。
涉及到的类如下
- frameworks/native/cmds/servicemanager/servicemanager.rc
- frameworks/native/cmds/servicemanager/Android.bp
- frameworks/native/cmds/servicemanager/main.cpp
- frameworks/native/cmds/servicemanager/ServiceManager.h
- frameworks/native/cmds/servicemanager/ServiceManager.cpp
- frameworks/native/libs/binder/include/binder/IInterface.h
- frameworks/native/libs/binder/include/binder/Binder.h
- frameworks/native/libs/binder/include/binder/IBinder.h
- frameworks/native/libs/binder/aidl/android/os/IServiceManager.aidl
- frameworks/native/libs/binder/Android.bp
- frameworks/native/libs/binder/include/binder/IServiceManager.h
- frameworks/native/libs/binder/Binder.cpp
解析启动入口
ServiceManager 也是在init解析时候，通过解析 rc 文件启动。对应的 rc 文件详解。可以看到启动名称为 servicemanager 对应执行的脚本为 /system/bin/servicemanager。所以 bp 肯定会生成对应的脚本名称为 servicemanager。
# frameworks/native/cmds/servicemanager/servicemanager.rc
service servicemanager /system/bin/servicemanager
class core animation
user system
group system readproc
# 表明这个Service对设备至关重要，如果Service在四分钟内退出超过4次，则设备将重启进入recovery模式
critical
# onrestart在重启时执行一条命令
onrestart restart apexd
onrestart restart audioserver
onrestart restart gatekeeperd
# 重启时，重启class为main、hal、early_hal的所有服务
onrestart class_restart main
onrestart class_restart hal
onrestart class_restart early_hal
writepid /dev/cpuset/system-background/tasks
shutdown critical
查看该目录对应的 Bp 文件，根据生成的名称，可以看到启动入口为 main.cpp 。(ServiceManager.cpp和Access.cpp一起生成了servicemanager_defaults,然后通过servicemanager_defaults编译生成可运行的servicemanager.)
# frameworks/native/cmds/servicemanager/Android.bp
cc_defaults {
name: "servicemanager_defaults",
...
srcs: [
"Access.cpp",
"ServiceManager.cpp",
],
...
}
...
cc_binary {
name: "servicemanager",
defaults: ["servicemanager_defaults"],
init_rc: ["servicemanager.rc"],
srcs: ["main.cpp"],
}
启动
查看对应 main.cpp 的 main 入口。其中会根据是否传参数传驱动节点，因为 rc 文件后面不带参数，所以 driver 值为 /dev/binder。该方法主要作用是
- 加载驱动，映射内存，主要在该方法进行 initWithDriver 。该方法的实现可查看 Binder启动 该文章。
- 创建 ServiceManager， 并通过 addService 添加自己到服务中。其中 ServiceManager继承BnServiceManager。（在头文件建中继承，该BnServiceManager 通过AIDL生成）
- 调用 setTheContextObject 设置到 单例 IPCThreadState 中，并且通过 ProcessState的****becomeContextManager 通知驱动设置为标识。
- 调用 Looper::prepare 初始化 Looper，并注册对应的回调监听。最后通过 pollAll 开启等待消息。）具体的实现可参看 Looper 文章。
// frameworks/native/cmds/servicemanager/main.cpp
int main(int argc, char** argv) {
if (argc > 2) {
LOG(FATAL) << "usage: " << argv[0] << " [binder driver]";
}
// rc 文件没有参数 所以默认为 "/dev/binder"
const char* driver = argc == 2 ? argv[1] : "/dev/binder";
// 和binder启动一样 调用 initWithDriver 里面也是调用 init 方法 打开驱动和映射内存大小
sp<ProcessState> ps = ProcessState::initWithDriver(driver);
// 设置thread poll的最大线程数量
ps->setThreadPoolMaxThreadCount(0);
//设置调用限制，FATAL_IF_NOT_ONEWA意思是：在阻塞调用时中止进程
//oneway 限制，ServiceManager发起的 Binder 调用必须是单向，否则打印堆栈日志提示
ps->setCallRestriction(ProcessState::CallRestriction::FATAL_IF_NOT_ONEWAY);
// 实例化ServiceManager， Access为鉴权
sp<ServiceManager> manager = sp<ServiceManager>::make(std::make_unique<Access>());
// 将自己添加到服务中ServiceManager
if (!manager->addService("manager", manager, false /*allowIsolated*/, IServiceManager::DUMP_FLAG_PRIORITY_DEFAULT).isOk()) {
LOG(ERROR) << "Could not self register servicemanager";
}
// 创建设置全局变量给IPCThreadState, 并设置 ServiceManager 值给the_context_object
IPCThreadState::self()->setTheContextObject(manager);
// 将handle是0注册到binder驱动中
ps->becomeContextManager();
// 准备looper
sp<Looper> looper = Looper::prepare(false /*allowNonCallbacks*/);
// 以前是 binder_loop死 循环接收驱动的消息，现在是 通知驱动BC_ENTER_LOOPER，监听驱动fd，有消息时回调到handleEvent处理binder调用
// 在looper的 response
BinderCallback::setupTo(looper);
// 服务的注册监听相关
ClientCallbackCallback::setupTo(looper, manager);
// 无限循环等待消息
while(true) {
looper->pollAll(-1);
}
// should not be reached
return EXIT_FAILURE;
}
// frameworks/native/cmds/servicemanager/ServiceManager.h
class ServiceManager : public os::BnServiceManager, public IBinder::DeathRecipient {...}
becomeContextManager 通过 ioctl 跟驱动交互。
bool ProcessState::becomeContextManager()
{
AutoMutex _l(mLock);
flat_binder_object obj {
.flags = FLAT_BINDER_FLAG_TXN_SECURITY_CTX,
};
int result = ioctl(mDriverFD, BINDER_SET_CONTEXT_MGR_EXT, &obj);
// fallback to original method
if (result != 0) {
android_errorWriteLog(0x534e4554, "121035042");
int unused = 0;
result = ioctl(mDriverFD, BINDER_SET_CONTEXT_MGR, &unused);
}
if (result == -1) {
ALOGE("Binder ioctl to become context manager failed: %s\n", strerror(errno));
}
return result == 0;
}
AIDL实现类
serviceManger 启动后，其他的服务端和客户端跟ServiceManger 不是直接跟 ServiceManger 交互，而是通过Binder驱动 跟 ServiceManger交互。
有几个类需要区分，非常重要
如果要创建一个AIDL交互，
需要Server端继承BnInterface, Client端继承BpInterface
BnInterface 在 IInterface.h 中，继承于 BBinder（而BBinder又继承于 IBinder）
BpInterface 在 IInterface.h 中，继承于 BpRefBase(而 RefBase 又继承于 RefBase)
// frameworks/native/libs/binder/include/binder/IInterface.h
// 继承于 BBinder
template<typename INTERFACE>
class BnInterface : public INTERFACE, public BBinder
{
public:
virtual sp<IInterface> queryLocalInterface(const String16& _descriptor);
virtual const String16& getInterfaceDescriptor() const;
protected:
typedef INTERFACE BaseInterface;
virtual IBinder* onAsBinder();
};
template<typename INTERFACE>
class BpInterface : public INTERFACE, public BpRefBase
{
public:
explicit BpInterface(const sp<IBinder>& remote);
protected:
typedef INTERFACE BaseInterface;
virtual IBinder* onAsBinder();
};
BBinder 代码位于 Binder.h 中
// frameworks/native/libs/binder/include/binder/Binder.h
class BBinder : public IBinder
{
...
}
IBinder 位于IBinder.h 中
// frameworks/native/libs/binder/include/binder/IBinder.h
class [[clang::lto_visibility_public]] IBinder : public virtual RefBase
{
...
}
BpRefBase f位于 Binder.h 中
// frameworks/native/libs/binder/include/binder/Binder.h
class BpRefBase : public virtual RefBase
{
...
}
便于理解 可以总结为 Bp 代表 AIDL 客户端，Bn 代表 AIDL 服务端。
ServiceManger 的 AIDL 位于 frameworks/native/libs/binder/aidl/android/os/文件下，其中IServiceManager.aidl 定义了 addService 等方法。
对应模块下的 bp 文件定义了对该AIDL的引用
# frameworks/native/libs/binder/Android.bp
cc_library {
name: "libbinder",
// for vndbinder
vendor_available: true, vndk: { enabled: true, },
...
srcs: [
"Binder.cpp",
"BpBinder.cpp",
"IInterface.cpp",
"IPCThreadState.cpp",
"IServiceManager.cpp", //对应的cpp文件
...
":libbinder_aidl",//引用aidl文件
],
aidl: {//输出aidl头文件
export_aidl_headers: true,
},
},
// AIDL interface between libbinder and framework.jar
filegroup {
name: "libbinder_aidl",
srcs: [//aidl文件
"aidl/android/os/IClientCallback.aidl",
"aidl/android/os/IServiceCallback.aidl",
"aidl/android/os/IServiceManager.aidl",
"aidl/android/os/ServiceDebugInfo.aidl",
],
path: "aidl",
}
其中 IServiceManager.cpp 通过using 关键字定义了别名 AidlServiceManager，提供了 defaultServiceManager 方法。类ServiceManagerShim继承了IServiceManager，Client端的请求都是由ServiceManagerShim 代理类进行调用。
AIDL 生成的文件 位于 该目录下out/soong/.intermediates/frameworks/native/libs/binder/libbinder/android_x86_64_shared/gen/aidl/android/os。其中 IServiceManager.h， BnServiceManager.h，BpServiceManager.h，为生成了这几个类的头文件。IServiceManager.cpp 则是 BnServiceManager，BpServiceManager 的具体实现。该类主要实现对binder数据的调用。
客户端Bp发送讲解
正常我们对ServiceManger 添加服务调用 addService 代码如下
sp<ProcessState> proc(ProcessState::self());
//获取B对应BpServiceManager指针
sp<IServiceManager> sm = defaultServiceManager();
sp<SimpleManagerService> mService = new SimpleManagerService();
//通过IServiceManager注册服务
sm->addService(String16(NATIVESERVICE_NAME), mService, false);
ProcessState::self()->startThreadPool();
// 开启消息监听，不循环 测试程序会结束
IPCThreadState::self()->joinThreadPool();
1. 获取 BpServiceManager
可以看出调用 ServiceManger 第一步是调用 defaultServiceManager 获取对应的对ServiceManger代理对象。
defaultServiceManager 方法如下，部分代码中文说明。
sp<IServiceManager> defaultServiceManager()
{
std::call_once(gSmOnce, []() {
sp<AidlServiceManager> sm = nullptr;
while (sm == nullptr) {
// 拿到客户端BpServiceManager(new BpBinder(0))的实例
// frameworks/native/libs/binder/include/binder/IInterface.h
// （interface_cast<IServiceManager>() 等价于 IServiceManager::asInterface(),asInterface是通过模板函数来定义的
sm = interface_cast<AidlServiceManager>(ProcessState::self()->getContextObject(nullptr));
// 如果为空 serviceManger还没好则循环睡眠1秒
if (sm == nullptr) {
ALOGE("Waiting 1s on context object on %s.", ProcessState::self()->getDriverName().c_str());
sleep(1);
}
}
gDefaultServiceManager = sp<ServiceManagerShim>::make(sm);
});
return gDefaultServiceManager;
}
interface_cast 方法需要一个参数，该参数为**BpBInder(0)**对象。具体流程如下，通过调用 getContextObject ,而该方法又会调用 getStrongProxyForHandle 并传入参数为0。
// frameworks/native/libs/binder/ProcessState.cpp
sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& /*caller*/)
{
// 调用 getStrongProxyForHandle 传入参数为0
sp<IBinder> context = getStrongProxyForHandle(0);
if (context) {
// The root object is special since we get it directly from the driver, it is never
// written by Parcell::writeStrongBinder.
internal::Stability::markCompilationUnit(context.get());
} else {
ALOGW("Not able to get context object on %s.", mDriverName.c_str());
}
return context;
}
而 getStrongProxyForHandle 会创建对象并判断 handle 为0 ，继而创建了 BpBInder对象。这很重要。后续将会用到该对象。所以可以说 getContextObject 返回了 BpBinder对象。
// frameworks/native/libs/binder/ProcessState.cpp
ProcessState::handle_entry* ProcessState::lookupHandleLocked(int32_t handle)
{
// 第一次为空，所以size 等于0， 传进来的参数handle也为0，所以会插入一个实体类为空的
const size_t N=mHandleToObject.size();
if (N <= (size_t)handle) {
handle_entry e;
e.binder = nullptr;
e.refs = nullptr;
status_t err = mHandleToObject.insertAt(e, N, handle+1-N);
if (err < NO_ERROR) return nullptr;
}
return &mHandleToObject.editItemAt(handle);
}
sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle)
{
sp<IBinder> result;
AutoMutex _l(mLock);
// 会判断是否大于该数字，如果小于则创建
handle_entry* e = lookupHandleLocked(handle);
if (e != nullptr) {
// We need to create a new BpBinder if there isn't currently one, OR we
// are unable to acquire a weak reference on this current one. The
// attemptIncWeak() is safe because we know the BpBinder destructor will always
// call expungeHandle(), which acquires the same lock we are holding now.
// We need to do this because there is a race condition between someone
// releasing a reference on this BpBinder, and a new reference on its handle
// arriving from the driver.
IBinder* b = e->binder;
// 因为刚插入所以为空
if (b == nullptr || !e->refs->attemptIncWeak(this)) {
if (handle == 0) {
// Special case for context manager...
// The context manager is the only object for which we create
// a BpBinder proxy without already holding a reference.
// Perform a dummy transaction to ensure the context manager
// is registered before we create the first local reference
// to it (which will occur when creating the BpBinder).
// If a local reference is created for the BpBinder when the
// context manager is not present, the driver will fail to
// provide a reference to the context manager, but the
// driver API does not return status.
//
// Note that this is not race-free if the context manager
// dies while this code runs.
//
// TODO: add a driver API to wait for context manager, or
// stop special casing handle 0 for context manager and add
// a driver API to get a handle to the context manager with
// proper reference counting.
IPCThreadState* ipc = IPCThreadState::self();
CallRestriction originalCallRestriction = ipc->getCallRestriction();
ipc->setCallRestriction(CallRestriction::NONE);
Parcel data;
status_t status = ipc->transact(
0, IBinder::PING_TRANSACTION, data, nullptr, 0);
ipc->setCallRestriction(originalCallRestriction);
if (status == DEAD_OBJECT)
return nullptr;
}
// 创建 BpBInder对象
sp<BpBinder> b = BpBinder::create(handle);
// 对实体类赋值
e->binder = b.get();
if (b) e->refs = b->getWeakRefs();
result = b;
} else {
// This little bit of nastyness is to allow us to add a primary
// reference to the remote proxy when this team doesn't have one
// but another team is sending the handle to us.
result.force_set(b);
e->refs->decWeak(this);
}
}
return result;
}
返回了 BpBInder 对象做参数参数，传进去 interface_cast 方法，该方法创建了对象代理对象。interface_cast 方法在 IInterface.h 。采用模板类，类似于java 范型方法。
// frameworks/native/libs/binder/include/binder/IInterface.h
// 模板类 类似范型
template<typename INTERFACE>
inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj)
{
return INTERFACE::asInterface(obj);
}
而上面调用 interface_cast 传进去的类型为 AidlServiceManager 也即为 IServiceManager 的别名。
// frameworks/native/libs/binder/IServiceManager.cpp
// 定义别名，所以 AidlServiceManager 就是 IServiceManager
using AidlServiceManager = android::os::IServiceManager;
iServiceManger 继承 IInterface， 查看 IInterface 里面的 asInterface 实现和定义
// frameworks/native/libs/binder/include/binder/IServiceManager.h
class IServiceManager : public IInterface { ... }
// frameworks/native/libs/binder/include/binder/IInterface.h
#define DECLARE_META_INTERFACE(INTERFACE) \
public: \
... \
// 定义了方法
static ::android::sp<I##INTERFACE> asInterface( \
const ::android::sp<::android::IBinder>& obj);
可以看到 对应的实现 如果不为空则先进行获取，获取不到则创建对应的对象 可以看到根据对应的模板通过make创建对象， 返回的是 BpServiceManger。
#define DO_NOT_DIRECTLY_USE_ME_IMPLEMENT_META_INTERFACE(INTERFACE, NAME)\
... \
::android::sp<I##INTERFACE> I##INTERFACE::asInterface( \
const ::android::sp<::android::IBinder>& obj) \
{ \
::android::sp<I##INTERFACE> intr; \
if (obj != nullptr) { \
intr = ::android::sp<I##INTERFACE>::cast( \
obj->queryLocalInterface(I##INTERFACE::descriptor)); \
if (intr == nullptr) {
// 通过make 创建带Bp实现类，也则是 BpServiceManger
intr = ::android::sp<Bp##INTERFACE>::make(obj); \
} \
} \
return intr; \
}
创建代理类 ServiceManagerShim 返回
接下来 通过make参数 创建 ServiceManagerShim代理类 （该类在IServiceManager.cpp）并将上面创建 BpServiceManger 作为参数传进去，查看对应的构造方法。该参数赋值给了 mTheRealServiceManager，所以 mTheRealServiceManager 就是 BpServiceManger。
// frameworks/native/libs/binder/IServiceManager.cpp
gDefaultServiceManager = sp<ServiceManagerShim>::make(sm);
// 构造方法赋值给了 mTheRealServiceManager
ServiceManagerShim::ServiceManagerShim(const sp<AidlServiceManager>& impl)
: mTheRealServiceManager(impl)
{}
所以得到最终 defaultServiceManager 返回的就是 ServiceManagerShim 对象。
调用对应AIDL方法
用 addService 为例子，查看 ServiceManagerShim 的实现，可以看到该方法最终是调用 BpServiceManger 的方法。
status_t ServiceManagerShim::addService(const String16& name, const sp<IBinder>& service,
bool allowIsolated, int dumpsysPriority)
{
// mTheRealServiceManager 为 BpServiceManger
Status status = mTheRealServiceManager->addService(
String8(name).c_str(), service, allowIsolated, dumpsysPriority);
return status.exceptionCode();
}
BpServiceManger 是 AIDL生成的，如上面AIDL的讲解以及对应生成路径，BpServiceManger 实现方法逻辑代码 在 IServiceManager.cpp，查看对应的实现方法可以看到 通过 创建 Parcel 实体类作为数据传输。然后通过调用关键代码 remote()->transact 通知驱动。
// out/soong/.intermediates/frameworks/native/libs/binder/libbinder/android_x86_64_shared/gen/aidl/android/os/IServiceManager.cpp
::android::binder::Status BpServiceManager::addService(const ::std::string& name, const ::android::sp<::android::IBinder>& service, bool allowIsolated, int32_t dumpPriority) {
::android::Parcel _aidl_data;
_aidl_data.markForBinder(remoteStrong());
::android::Parcel _aidl_reply;
::android::status_t _aidl_ret_status = ::android::OK;
::android::binder::Status _aidl_status;
// 注远程服务名称，getInterfaceDescriptor为远程服务端接口描述
_aidl_ret_status = _aidl_data.writeInterfaceToken(getInterfaceDescriptor());
if (((_aidl_ret_status) != (::android::OK))) {
goto _aidl_error;
}
_aidl_ret_status = _aidl_data.writeUtf8AsUtf16(name);
if (((_aidl_ret_status) != (::android::OK))) {
goto _aidl_error;
}
_aidl_ret_status = _aidl_data.writeStrongBinder(service);
if (((_aidl_ret_status) != (::android::OK))) {
goto _aidl_error;
}
_aidl_ret_status = _aidl_data.writeBool(allowIsolated);
if (((_aidl_ret_status) != (::android::OK))) {
goto _aidl_error;
}
_aidl_ret_status = _aidl_data.writeInt32(dumpPriority);
if (((_aidl_ret_status) != (::android::OK))) {
goto _aidl_error;
}
// 关键代码， 通过调用 remote()->transact
_aidl_ret_status = remote()->transact(BnServiceManager::TRANSACTION_addService, _aidl_data, &_aidl_reply, 0);
if (UNLIKELY(_aidl_ret_status == ::android::UNKNOWN_TRANSACTION && IServiceManager::getDefaultImpl())) {
return IServiceManager::getDefaultImpl()->addService(name, service, allowIsolated, dumpPriority);
}
if (((_aidl_ret_status) != (::android::OK))) {
goto _aidl_error;
}
_aidl_ret_status = _aidl_status.readFromParcel(_aidl_reply);
if (((_aidl_ret_status) != (::android::OK))) {
goto _aidl_error;
}
if (!_aidl_status.isOk()) {
return _aidl_status;
}
_aidl_error:
_aidl_status.setFromStatusT(_aidl_ret_status);
return _aidl_status;
}
remote() 返回的是什么对象，查看生成头文件继承自 BpInterface，而 BpInterface 又继承 BpRefBase
// out/soong/.intermediates/frameworks/native/libs/binder/libbinder/android_x86_64_shared/gen/aidl/android/os/BpServiceManager.h
class BpServiceManager : public ::android::BpInterface<IServiceManager> {}
查看 BpRefBase，可以看到该对象又继承 RefBase,可以看到 方法 remote() 返回了 mRemote 对象。
// frameworks/native/libs/binder/include/binder/Binder.h
class BpRefBase : public virtual RefBase
{
protected:
explicit BpRefBase(const sp<IBinder>& o);
virtual ~BpRefBase();
virtual void onFirstRef();
virtual void onLastStrongRef(const void* id);
virtual bool onIncStrongAttempted(uint32_t flags, const void* id);
// 返回的是 mRemote 对象
inline IBinder* remote() const { return mRemote; }
inline sp<IBinder> remoteStrong() const { return sp<IBinder>::fromExisting(mRemote); }
private:
BpRefBase(const BpRefBase& o);
BpRefBase& operator=(const BpRefBase& o);
IBinder* const mRemote;
RefBase::weakref_type* mRefs;
std::atomic<int32_t> mState;
};
mRemote 又是在 在其构造方法通过参数赋值
// frameworks/native/libs/binder/Binder.cpp
// 通过构造参数传入
BpRefBase::BpRefBase(const sp<IBinder>& o)
: mRemote(o.get()), mRefs(nullptr), mState(0)
{
extendObjectLifetime(OBJECT_LIFETIME_WEAK);
if (mRemote) {
mRemote->incStrong(this); // Removed on first IncStrong().
mRefs = mRemote->createWeak(this); // Held for our entire lifetime.
}
}
而因为 BpInterface 继承 BpRefBase 所以又是他将 将入参remote赋值给了BpRefBase。
template<typename INTERFACE>
inline BpInterface<INTERFACE>::BpInterface(const sp<IBinder>& remote)
: BpRefBase(remote)
{
}
而上面 BpServiceManager 继承于BpInterface，所以该参数又来自BpServiceManager的构造参数。而上面调用 interface_cast 创建 BpServiceManager对象的时候，我们又知道 传进去的 就是 BpBinder(0)。 所以可知
remote() 返回的对象就是 BpBinder。所以 remote()->transact 调用的 就是 BpBinder 的 transact方法。
调用驱动通知
查看对应 BpBInder transact 方法。最终又会调用 IPCThreadState::self()->transact 方法
// frameworks/native/libs/binder/BpBinder.cpp
status_t BpBinder::transact(
uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
// Once a binder has died, it will never come back to life.
if (mAlive) {
bool privateVendor = flags & FLAG_PRIVATE_VENDOR;
// don't send userspace flags to the kernel
flags = flags & ~FLAG_PRIVATE_VENDOR;
// user transactions require a given stability level
if (code >= FIRST_CALL_TRANSACTION && code <= LAST_CALL_TRANSACTION) {
using android::internal::Stability;
auto category = Stability::getCategory(this);
Stability::Level required = privateVendor ? Stability::VENDOR
: Stability::getLocalLevel();
if (CC_UNLIKELY(!Stability::check(category, required))) {
ALOGE("Cannot do a user transaction on a %s binder (%s) in a %s context.",
category.debugString().c_str(),
String8(getInterfaceDescriptor()).c_str(),
Stability::levelString(required).c_str());
return BAD_TYPE;
}
}
status_t status;
if (CC_UNLIKELY(isRpcBinder())) {
status = rpcSession()->transact(rpcAddress(), code, data, reply, flags);
} else {
// //调用 IPCThreadState 方法
status = IPCThreadState::self()->transact(binderHandle(), code, data, reply, flags);
}
if (status == DEAD_OBJECT) mAlive = 0;
return status;
}
return DEAD_OBJECT;
}
查看 IPCThreadState 方法 该方法又会调用 writeTransactionData 方法。
status_t IPCThreadState::transact(int32_t handle,
uint32_t code, const Parcel& data,
Parcel* reply, uint32_t flags)
{
....
LOG_ONEWAY(">>>> SEND from pid %d uid %d %s", getpid(), getuid(),
(flags & TF_ONE_WAY) == 0 ? "READ REPLY" : "ONE WAY");
// 写入数据
err = writeTransactionData(BC_TRANSACTION, flags, handle, code, data, nullptr);
...
if (reply) {
err = waitForResponse(reply);
} else {
Parcel fakeReply;
err = waitForResponse(&fakeReply);
}
....
}
进入该方法，通知驱动的数据格式为 binder_transaction_data。所以要创建该实体类，并写入数据，因为是客户端，所以 cmd 为 BC_TRANSACTION
status_t IPCThreadState::writeTransactionData(int32_t cmd, uint32_t binderFlags,
int32_t handle, uint32_t code, const Parcel& data, status_t* statusBuffer)
{
binder_transaction_data tr;
tr.target.ptr = 0; /* Don't pass uninitialized stack data to a remote process */
tr.target.handle = handle;
tr.code = code;
tr.flags = binderFlags;
tr.cookie = 0;
tr.sender_pid = 0;
tr.sender_euid = 0;
const status_t err = data.errorCheck();
if (err == NO_ERROR) {
tr.data_size = data.ipcDataSize();
tr.data.ptr.buffer = data.ipcData();
tr.offsets_size = data.ipcObjectsCount()*sizeof(binder_size_t);
tr.data.ptr.offsets = data.ipcObjects();
} else if (statusBuffer) {
tr.flags |= TF_STATUS_CODE;
*statusBuffer = err;
tr.data_size = sizeof(status_t);
tr.data.ptr.buffer = reinterpret_cast<uintptr_t>(statusBuffer);
tr.offsets_size = 0;
tr.data.ptr.offsets = 0;
} else {
return (mLastError = err);
}
mOut.writeInt32(cmd);
mOut.write(&tr, sizeof(tr));
return NO_ERROR;
}
waitForResponse 通过 talkWithDriver 方法跟 驱动通信将数据写入到驱动。该方法里面最终调用 ioctl 发送。
status_t IPCThreadState::waitForResponse(Parcel *reply, status_t *acquireResult)
{
... //和Driver通信
if ((err=talkWithDriver()) < NO_ERROR) break;
...
}
status_t IPCThreadState::talkWithDriver(bool doReceive) {
...
if (ioctl(mProcess->mDriverFD, BINDER_WRITE_READ, &bwr) >= 0)
...
}
这样客户端调用完整流程就结束了。
服务端Bn接收讲解
注册Binder回调监听
服务端的接收回到 一开始 main.cpp 注册的Looper监听回调。代码如下 通过 setupTo 方法 添加对应的监听。BinderCallback 主要监听对应的消息进行处理。
// frameworks/native/cmds/servicemanager/main.cpp
class BinderCallback : public LooperCallback {
public:
static sp<BinderCallback> setupTo(const sp<Looper>& looper) {
// 实例化BinderCallback
sp<BinderCallback> cb = sp<BinderCallback>::make();
int binder_fd = -1;
//通过IPCThreadState获取binder_fd，即监听binder驱动的消息
IPCThreadState::self()->setupPolling(&binder_fd);
LOG_ALWAYS_FATAL_IF(binder_fd < 0, "Failed to setupPolling: %d", binder_fd);
// 添加文件描述符
int ret = looper->addFd(binder_fd,
Looper::POLL_CALLBACK,
Looper::EVENT_INPUT,
cb,
nullptr /*data*/);
LOG_ALWAYS_FATAL_IF(ret != 1, "Failed to add binder FD to Looper");
return cb;
}
int handleEvent(int /* fd */, int /* events */, void* /* data */) override {
IPCThreadState::self()->handlePolledCommands();
return 1; // Continue receiving callbacks.
}
};
int main(int argc, char** argv) {
...
// 在looper的 response
BinderCallback::setupTo(looper);
...
}
之前说过 Looper 通过 addFd 添加监听，添加对应的 fd 通过 setupPolling 方法获取，进去方法可知 返回的正是驱动FD。所以可知，监听的正在Binder驱动的响应。
// frameworks/native/libs/binder/IPCThreadState.cpp
status_t IPCThreadState::setupPolling(int* fd)
{
if (mProcess->mDriverFD < 0) {
return -EBADF;
}
mOut.writeInt32(BC_ENTER_LOOPER);
flushCommands();
// 驱动FD
*fd = mProcess->mDriverFD;
return 0;
}
Binder消息处理
通过 Looper 文章可知，有消息相应会触发 handleEvent 回调。查看BinderCallback 对应的 handleEvent 方法。而 handleEvent 里面又会调用 handlePolledCommands 方法。
// frameworks/native/cmds/servicemanager/main.cpp
int handleEvent(int /* fd */, int /* events */, void* /* data */) override {
IPCThreadState::self()->handlePolledCommands();
return 1; // Continue receiving callbacks.
}
查看 handlePolledCommands 又会接着调用 getAndExecuteCommand 方法。
// frameworks/native/libs/binder/IPCThreadState.cpp
status_t IPCThreadState::handlePolledCommands()
{
status_t result;
do {
result = getAndExecuteCommand();
} while (mIn.dataPosition() < mIn.dataSize());
processPendingDerefs();
flushCommands();
return result;
}
getAndExecuteCommand 会调用 talkWithDriver 读取对应的对象，并读取对应的cmd值，传进去 executeCommand 进行解析，对应的 cmd 为 BR_TRANSACTION。
status_t IPCThreadState::getAndExecuteCommand()
{
status_t result;
int32_t cmd;
//从binder driver获取mIn数据
result = talkWithDriver();
if (result >= NO_ERROR) {
size_t IN = mIn.dataAvail();
if (IN < sizeof(int32_t)) return result;
// 读取出对应 CMD，服务端的应该为 BR_TRANSACTION
cmd = mIn.readInt32();
...
// 解析出对应的cmd，执行cmd
result = executeCommand(cmd);
...
}
return result;
}
查看对应的 executeCommand 方法。查看对应的 BR_TRANSACTION 解析可以看到最终调用了 the_context_object 方法。而 the_context_object 在 ServiceManger 的 main.cpp 方法，可知是通过 setTheContextObject 赋值，所以可知 the_context_object 即为 serviceManger。
// frameworks/native/libs/binder/IPCThreadState.cpp
status_t IPCThreadState::executeCommand(int32_t cmd)
{
...
switch ((uint32_t)cmd) {
case BR_TRANSACTION:
{
...
} else {
//sp<ServiceManager> manager = sp<ServiceManager>::make(std::make_unique<Access>());
//IPCThreadState::self()->setTheContextObject(manager);//将manager设置给了the_context_object，所以the_context_object就是Server端ServerManager对象
//调用BBinder的transact
error = the_context_object->transact(tr.code, buffer, &reply, tr.flags);
}
...
}
因为 ServiceManger 继承自 BnServiceManager （AIDL生成）
class ServiceManager : public os::BnServiceManager, public IBinder::DeathRecipient {}
而 BnServiceManager 又继承自 BnInterface
// out/soong/.intermediates/frameworks/native/libs/binder/libbinder/android_x86_64_shared/gen/aidl/android/os/BnServiceManager.h
class BnServiceManager : public ::android::BnInterface<IServiceManager> {}
BnInterface 又是继承 BBinder
// frameworks/native/libs/binder/include/binder/IInterface.h
template<typename INTERFACE>
class BnInterface : public INTERFACE, public BBinder
{
public:
virtual sp<IInterface> queryLocalInterface(const String16& _descriptor);
virtual const String16& getInterfaceDescriptor() const;
protected:
typedef INTERFACE BaseInterface;
virtual IBinder* onAsBinder();
};
所以 the_context_object->transact 也就是调用了 BBinder的 transact 方法。查看对应实现，可发现该方法调用了 onTransact 方法。
// frameworks/native/libs/binder/Binder.cpp
status_t BBinder::transact(
uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
data.setDataPosition(0);
if (reply != nullptr && (flags & FLAG_CLEAR_BUF)) {
reply->markSensitive();
}
status_t err = NO_ERROR;
switch (code) {
case PING_TRANSACTION:
err = pingBinder();
break;
case EXTENSION_TRANSACTION:
err = reply->writeStrongBinder(getExtension());
break;
case DEBUG_PID_TRANSACTION:
err = reply->writeInt32(getDebugPid());
break;
default:
// 调用对应的 onTransact 方法
err = onTransact(code, data, reply, flags);
break;
}
// In case this is being transacted on in the same process.
if (reply != nullptr) {
reply->setDataPosition(0);
}
return err;
}
BnServiceManager 实现了 onTransact 方法。 跟BpServiceManager一样，该类的方法实现也在AIDL 生成的 IServiceManager.cpp 里。查看 BnServiceManager 方法，这里举例 addService 方法，可以看到 最终调用了addService(in_name, in_service, in_allowIsolated, in_dumpPriority) 方法。该方法为ServiceManger实现，也就是回调了 ServiceManger类里面的方法
// out/soong/.intermediates/frameworks/native/libs/binder/libbinder/android_x86_64_shared/gen/aidl/android/os/IServiceManager.cpp
::android::status_t BnServiceManager::onTransact(uint32_t _aidl_code, const ::android::Parcel& _aidl_data, ::android::Parcel* _aidl_reply, uint32_t _aidl_flags) {
::android::status_t _aidl_ret_status = ::android::OK;
switch (_aidl_code) {
...
// 添加的方法
case BnServiceManager::TRANSACTION_addService:
{
::std::string in_name;
::android::sp<::android::IBinder> in_service;
bool in_allowIsolated;
int32_t in_dumpPriority;
if (!(_aidl_data.checkInterface(this))) {
_aidl_ret_status = ::android::BAD_TYPE;
break;
}
_aidl_ret_status = _aidl_data.readUtf8FromUtf16(&in_name);
if (((_aidl_ret_status) != (::android::OK))) {
break;
}
_aidl_ret_status = _aidl_data.readStrongBinder(&in_service);
if (((_aidl_ret_status) != (::android::OK))) {
break;
}
_aidl_ret_status = _aidl_data.readBool(&in_allowIsolated);
if (((_aidl_ret_status) != (::android::OK))) {
break;
}
_aidl_ret_status = _aidl_data.readInt32(&in_dumpPriority);
if (((_aidl_ret_status) != (::android::OK))) {
break;
}
// 调用 addService 方法，该方法为ServiceManger实现，也就是回调了 ServiceManger类里面的方法。
::android::binder::Status _aidl_status(addService(in_name, in_service, in_allowIsolated, in_dumpPriority));
_aidl_ret_status = _aidl_status.writeToParcel(_aidl_reply);
if (((_aidl_ret_status) != (::android::OK))) {
break;
}
if (!_aidl_status.isOk()) {
break;
}
}
break;
}
return _aidl_ret_status;
}
...
ServiceManger 的 addService 方法
// frameworks/native/cmds/servicemanager/ServiceManager.cpp
Status ServiceManager::addService(const std::string& name, const sp<IBinder>& binder, bool allowIsolated, int32_t dumpPriority) {
...
// Overwrite the old service if it exists
mNameToService[name] = Service {
.binder = binder,
.allowIsolated = allowIsolated,
.dumpPriority = dumpPriority,
.debugPid = ctx.debugPid,
};
auto it = mNameToRegistrationCallback.find(name);
if (it != mNameToRegistrationCallback.end()) {
for (const sp<IServiceCallback>& cb : it->second) {
mNameToService[name].guaranteeClient = true;
// permission checked in registerForNotifications
cb->onRegistration(name, binder);
}
}
return Status::ok();
}
至此 服务端也接收和处理完对应的Binder消息，实现 客户端到服务端通讯。
备注
在Android的Binder通信机制中，BR_TRANSACTION 和 BC_TRANSACTION 都是用于定义Binder通信中的消息类型的宏，但它们有着不同的作用和用途。
BR_TRANSACTION 用于定义一个读取操作的IO控制码，表示从用户空间读取数据到内核空间。
‘r’ 表示操作的方向，即从用户空间到内核空间的读取操作
BC_TRANSACTION 用于定义一个写入操作的IO控制码，表示从内核空间写入数据到用户空间。
‘c’ 表示操作的方向，即从内核空间到用户空间的写入操作。
struct binder_transaction_data 是与该IO操作相关联的数据结构，用于描述从内核传递到用户空间的Binder事务的详细信息。
IO控制码类型：_IOR 和 _IOW 分别用于指定读取和写入操作
378
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
