service_manager.c :
struct binder_state *bs;
bs = binder_open(128*1024);
a. binder_open
b. binder_become_context_manager
c. binder_loop(bs, svcmgr_handler);
void binder_loop(struct binder_state *bs, binder_handler func)
Binder.c
c.2 binder_parse
res = binder_parse(bs, 0, (uintptr_t) readbuf, bwr.read_consumed, func);
int binder_parse(struct binder_state *bs, struct binder_io *bio,
uintptr_t ptr, size_t size, binder_handler func)
{
// 解析
// 处理 : svcmgr_handler
binder_loop(bs, svcmgr_handler);
int svcmgr_handler(struct binder_state *bs,
struct binder_transaction_data *txn,
struct binder_io *msg,
struct binder_io *reply)
SVC_MGR_GET_SERVICE/SVC_MGR_CHECK_SERVICE : 获取服务
SVC_MGR_ADD_SERVICE : 注册服务
// 回复
bctest.c
注册服务的过程:
a. binder_open
bs = binder_open(128*1024);
uint32_t svcmgr_lookup(struct binder_state *bs, uint32_t target, const char *name)
{
if (binder_call(bs, &msg, &reply, target, SVC_MGR_ADD_SERVICE)) 注册服务的过程
b. binder_call(bs, &msg, &reply, 0, SVC_MGR_ADD_SERVICE)
int binder_call(struct binder_state *bs,
struct binder_io *msg, struct binder_io *reply,
uint32_t target, uint32_t code)
writebuf.cmd = BC_TRANSACTION;
writebuf.txn.target.handle = target;
writebuf.txn.code = code;
// 含有服务的名字
// 它会含有servicemanager回复的数据
// 0表示servicemanager
// code: 表示要调用servicemanager中的"addservice函数"
获取服务的过程:
a. binder_open
b. binder_call(bs, &msg, &reply, target, SVC_MGR_CHECK_SERVICE)
// 含有服务的名字
// 它会含有servicemanager回复的数据, 表示提供服务的进程
// 0表示servicemanager
// code: 表示要调用servicemanager中的"getservice函数"
binder.c (封装好的C函数)
binder_call分析
bctest.c
TestServer.c
testclient.c
struct binder_death death;
Binder.h
struct binder_death {
void (*func)(struct binder_state *bs, void *ptr);
void *ptr;
};
service_manager.c
si->death.func = (void*) svcinfo_death;
void svcinfo_death(struct binder_state *bs, void *ptr)
{
si->next = svclist;
svclist = si;
Binder.h
struct binder_io
{
char *data; /* pointer to read/write from */
binder_size_t *offs; /* array of offsets */
size_t data_avail; /* bytes available in data buffer */
size_t offs_avail; /* entries available in offsets array */
char *data0; /* start of data buffer */
binder_size_t *offs0; /* start of offsets buffer */
uint32_t flags;
uint32_t unused;
};
Binder.c
static void *bio_get(struct binder_io *bio, size_t size) {
void *ptr = bio->data;
bio->data += size;//bio指针游标每次进入到bio_get方法都会右移size
bio->data_avail -= size;
return ptr;//返回bio指针移动之前的地址
}
service_manager.c
case SVC_MGR_GET_SERVICE:
case SVC_MGR_CHECK_SERVICE:
s = bio_get_string16(msg, &len);
if (s == NULL) {
return -1;
}
handle = do_find_service(bs, s, len, txn->sender_euid, txn->sender_pid);
case SVC_MGR_ADD_SERVICE:
s = bio_get_string16(msg, &len);
if (s == NULL) {
return -1;
}
handle = bio_get_ref(msg);
allow_isolated = bio_get_uint32(msg) ? 1 : 0;
if (do_add_service(bs, s, len, handle, txn->sender_euid,
allow_isolated, txn->sender_pid))
struct binder_transaction_data *txn,
struct binder_transaction_data {
union {
size_t handle;
void *ptr;
} target;
void *cookie;
unsigned int code;
unsigned int flags;
pid_t sender_pid;
uid_t sender_euid;
size_t data_size;
size_t offsets_size;
union {
struct {
const void *buffer;
const void *offsets;
} ptr;
uint8_t buf[8];
} data;
};