相关栏目: IT资讯 当前位置:主页 > IT资讯 >

Android Binder进程间通信---注册Service组件---Server处理BC_TRANSACTION

发布时间:2019-01-26 作者:admin 分类:IT资讯

本文参考《Android系统源代码情景分析》,作者罗升阳

一、测试代码:

~/Android/external/binder/server

----FregServer.cpp

~/Android/external/binder/common

----IFregService.cpp

----IFregService.h

~/Android/external/binder/client

----FregClient.cpp


Binder库(libbinder)代码:

~/Android/frameworks/base/libs/binder

----BpBinder.cpp

----Parcel.cpp

----ProcessState.cpp

----Binder.cpp

----IInterface.cpp

----IPCThreadState.cpp

----IServiceManager.cpp

----Static.cpp

~/Android/frameworks/base/include/binder

----Binder.h

----BpBinder.h

----IInterface.h

----IPCThreadState.h

----IServiceManager.h

----IBinder.h

----Parcel.h

----ProcessState.h


驱动层代码:

~/Android//kernel/goldfish/drivers/staging/android

----binder.c

----binder.h


二、源码分析 在上一篇文章中,Android Binder进程间通信---注册Service组件---Client发送BC_TRANSACTIONhttp://blog.csdn.net/jltxgcy/article/details/26076149, list_add_tail(&t->work.entry, target_list);已经加入到目标进程的todo列表。 wake_up_interruptible(target_wait);唤醒了目标进程。 还记得在Andorid Binder进程间通信---启动ServiceManager一文中http://blog.csdn.net/jltxgcy/article/details/25797011,最后进程睡眠等待直到有新的未处理项为止,此时有新的处理项,继续执行binder_thread_read函数。实现如下:

~/Android//kernel/goldfish/drivers/staging/android

----binder.c

static int
binder_thread_read(struct binder_proc *proc, struct binder_thread *thread,
	void  __user *buffer, int size, signed long *consumed, int non_block)
{
	void __user *ptr = buffer + *consumed;
	void __user *end = buffer + size;

	int ret = 0;
	.........

	while (1) {
		uint32_t cmd;
		struct binder_transaction_data tr;
		struct binder_work *w;
		struct binder_transaction *t = NULL;

		if (!list_empty(&thread->todo))
			w = list_first_entry(&thread->todo, struct binder_work, entry);
		else if (!list_empty(&proc->todo) && wait_for_proc_work)
			w = list_first_entry(&proc->todo, struct binder_work, entry);//将要处理的工作项保存在binder_work结构体w中
		else {
			if (ptr - buffer == 4 && !(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN)) /* no data added */
				goto retry;
			break;
		}

		........

		switch (w->type) {
		case BINDER_WORK_TRANSACTION: {
			t = container_of(w, struct binder_transaction, work);//由于binder_work结构体w的类型为BINDER_WORK_TRANSACTION,即它是一个嵌入在一个binder_transaction结构体中的工作项,因此可以安全地将它转换为一个binder_transaction结构体t
		} break;
		.........
		}

		if (!t)
			continue;

		BUG_ON(t->buffer == NULL);
		if (t->buffer->target_node) {
			struct binder_node *target_node = t->buffer->target_node;
			tr.target.ptr = target_node->ptr;//Binder实体对象ptr为NULL
			tr.cookie =  target_node->cookie;//Binder实体对象cookie为NULL
			t->saved_priority = task_nice(current);
			if (t->priority < target_node->min_priority &&
			    !(t->flags & TF_ONE_WAY))
				binder_set_nice(t->priority);
			else if (!(t->flags & TF_ONE_WAY) ||
				 t->saved_priority > target_node->min_priority)
				binder_set_nice(target_node->min_priority);
			cmd = BR_TRANSACTION;//cmd设置BR_TRANSACTION
		} else {
			.....
		}
		tr.code = t->code;//ADD_SERVICE_TRANCATION
		tr.flags = t->flags;//TF_ACCEPTS_FDS
		tr.sender_euid = t->sender_euid;

		if (t->from) {
			struct task_struct *sender = t->from->proc->tsk;
			tr.sender_pid = task_tgid_nr_ns(sender, current->nsproxy->pid_ns);
		} else {
			.......
		}

		tr.data_size = t->buffer->data_size;//数据缓冲区大小
		tr.offsets_size = t->buffer->offsets_size;//偏移数组大小
		tr.data.ptr.buffer = (void *)t->buffer->data + proc->user_buffer_offset;//内核缓冲区的内核空间地址和用户空间地址相差一个固定值,并且保存在它的成员变量user_buffer_offset中
		tr.data.ptr.offsets = tr.data.ptr.buffer + ALIGN(t->buffer->data_size, sizeof(void *));//偏移保存在数据缓冲区的后面

		if (put_user(cmd, (uint32_t __user *)ptr))//将命令返回
			return -EFAULT;
		ptr += sizeof(uint32_t);
		if (copy_to_user(ptr, &tr, sizeof(tr)))//将binder_transaction_data结构体tr返回
			return -EFAULT;
		ptr += sizeof(tr);

		.......

		list_del(&t->work.entry);//删除该任务项
		t->buffer->allow_user_free = 1;//允许释放
		if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) {
			t->to_parent = thread->transaction_stack;
			t->to_thread = thread;
			thread->transaction_stack = t;
		} else {
			t->buffer->transaction = NULL;
			kfree(t);
			........
		}
		break;
	}

done:

	*consumed = ptr - buffer;//cmd和binder_transaction_data结构体tr大小之和
	........
	return 0;
}
if语句首先检查线程thread自己的todo队列中是否有个工作项需要处理。如果没有,第19行的if语句再检查它所属进程proc的todo队列中是否有工作项需要处理。只要其中的一个todo队列中有工作项需要处理,函数binder_thread_read就将它取出来处理,并且保存在binder_work结构体w中。 由于binder_work结构体w的类型为BINDER_WORK_TRANSACTION,即它是一个嵌入在一个binder_transaction结构体中的工作项,因此可以安全地将它转换为一个binder_transaction结构体t。 利用binder_transaction结构体t设置binder_transaction_data结构体tr各参数。并将cmd和binder_transaction_data结构体tr返回到binder_ioctl,然后再返回到binder_loop: ~/Android/frameworks/base/cmd/servicemanager ----binder.c
void binder_loop(struct binder_state *bs, binder_handler func)
{
    int res;
    struct binder_write_read bwr;
    unsigned readbuf[32];

    bwr.write_size = 0;
    bwr.write_consumed = 0;
    bwr.write_buffer = 0;
    
    readbuf[0] = BC_ENTER_LOOPER;//首先将BC_ENTER_LOOPER协议写入缓冲区readbuf中
    binder_write(bs, readbuf, sizeof(unsigned));//调用binder_write将它发送到Binder驱动程序中

    for (;;) {
        bwr.read_size = sizeof(readbuf);
        bwr.read_consumed = 0;
        bwr.read_buffer = (unsigned) readbuf;

        res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);//bwr.write_size为0,bwr.read_size不为0

        if (res < 0) {
            LOGE("binder_loop: ioctl failed (%s)
", strerror(errno));
            break;
        }

        res = binder_parse(bs, 0, readbuf, bwr.read_consumed, func);//此时readbuf为cmd和binder_transaction_data结构体tr,bwr.read_consumed为cmd和binder_transaction_data结构体tr大小之和
        if (res == 0) {
            LOGE("binder_loop: unexpected reply?!
");
            break;
        }
        if (res < 0) {
            LOGE("binder_loop: io error %d %s
", res, strerror(errno));
            break;
        }
    }
}
开始执行binder_parse。实现如下:
int binder_parse(struct binder_state *bs, struct binder_io *bio,
                 uint32_t *ptr, uint32_t size, binder_handler func)
{
    int r = 1;
    uint32_t *end = ptr + (size / 4);

    while (ptr < end) {
        uint32_t cmd = *ptr++;
        .......
        switch(cmd) {//cmd为BR_TRANSACTION
        ......
        case BR_TRANSACTION: {
            struct binder_txn *txn = (void *) ptr;//binder_transaction_data结构体tr取出放到binder_txt结构体中
            ........
            if (func) {//svcmgr_handler函数指针
                unsigned rdata[256/4];
                struct binder_io msg;
                struct binder_io reply;
                int res;

                bio_init(&reply, rdata, sizeof(rdata), 4);
                bio_init_from_txn(&msg, txn);
                res = func(bs, txn, &msg, &reply);//svcmgr_handler函数指针
                binder_send_reply(bs, &reply, txn->data, res);
            }
            ptr += sizeof(*txn) / sizeof(uint32_t);
            break;
        }
        ......
    }

    return r;
}
在介绍binder_parse前,首先看几个结构体。 ~/Android/frameworks/base/cmd/servicemanager ----binder.h
struct binder_object
{
    uint32_t type;
    uint32_t flags;
    void *pointer;
    void *cookie;
};

struct binder_txn
{
    void *target;
    void *cookie;
    uint32_t code;
    uint32_t flags;

    uint32_t sender_pid;
    uint32_t sender_euid;

    uint32_t data_size;
    uint32_t offs_size;
    void *data;
    void *offs;
};

struct binder_io //具体含义见英文注释
{
    char *data;            /* pointer to read/write from */
    uint32_t *offs;        /* array of offsets */
    uint32_t data_avail;   /* bytes available in data buffer */
    uint32_t offs_avail;   /* entries available in offsets array */

    char *data0;           /* start of data buffer */
    uint32_t *offs0;       /* start of offsets buffer */
    uint32_t flags;
    uint32_t unused;
};
结构体binder_txn用来描述进程间通信数据,它等同于前面介绍的binder_transaction_data结构体。
结构体binder_io用来解析进程间通信数据的,它的作用类似于Binder库中的Parcel类。 结构体binder_object用来描述进程间通信数据中的一个Binder对象,它等同于结构体flat_binder_object。 执行binder_parse,首先取出cmd,然后取出binder_transaction_data结构体tr保存在binder_txn结构体txn中。然后调用bio_init函数,实现如下:
~/Android/frameworks/base/cmd/servicemanager ----binder.c
void bio_init(struct binder_io *bio, void *data,
              uint32_t maxdata, uint32_t maxoffs)
{
    uint32_t n = maxoffs * sizeof(uint32_t);//偏移数组所占的大小

    if (n > maxdata) {//偏移数组所占的大小不能大于最大能分配大小
        bio->flags = BIO_F_OVERFLOW;
        bio->data_avail = 0;
        bio->offs_avail = 0;
        return;
    }

    bio->data = bio->data0 = data + n;//偏移数组后面是数据缓冲区
    bio->offs = bio->offs0 = data;//开始是偏移数组
    bio->data_avail = maxdata - n;//数据缓冲区大小
    bio->offs_avail = maxoffs;//偏移数组大小
    bio->flags = 0;
}
bio_init初始化了binder_io结构体reply。返回binder_parse执行bio_init_from_txn函数,实现如下: ~/Android/frameworks/base/cmd/servicemanager ----binder.c
void bio_init_from_txn(struct binder_io *bio, struct binder_txn *txn)
{
    bio->data = bio->data0 = txn->data;
    bio->offs = bio->offs0 = txn->offs;
    bio->data_avail = txn->data_size;
    bio->offs_avail = txn->offs_size / 4;
    bio->flags = BIO_F_SHARED;
}
bio_init_from_txn初始化了binder_io结构体msg。 返回binder_parse执行svcmgr_handler函数,实现如下: ~/Android/frameworks/base/cmd/servicemanager ----service_manager.c
int svcmgr_handler(struct binder_state *bs,
                   struct binder_txn *txn,
                   struct binder_io *msg,
                   struct binder_io *reply)
{
    struct svcinfo *si;
    uint16_t *s;
    unsigned len;
    void *ptr;
    uint32_t strict_policy;

    ......

    if (txn->target != svcmgr_handle)//txn->target为NULL,svcmgr_handle为NULL(void* (0))
        return -1;

    // Equivalent to Parcel::enforceInterface(), reading the RPC
    // header with the strict mode policy mask and the interface name.
    // Note that we ignore the strict_policy and don't propagate it
    // further (since we do no outbound RPCs anyway).
    strict_policy = bio_get_uint32(msg);//strict_policy为STRICT_MODE_PENALTY_GATHER
    s = bio_get_string16(msg, &len);//s为android.os.IServiceManager
    if ((len != (sizeof(svcmgr_id) / 2)) ||
        memcmp(svcmgr_id, s, sizeof(svcmgr_id))) {//比较是否一致,如果不一致,直接返回出错
        fprintf(stderr,"invalid id %s
", str8(s));
        return -1;
    }

    switch(txn->code) {//ADD_SERVICE_TRANSACTION,即SVC_MGR_ADD_SERVICE
    ........
    case SVC_MGR_ADD_SERVICE:
        s = bio_get_string16(msg, &len);//s为shy.luo.FregService,len为它的长度
        ptr = bio_get_ref(msg);//返回Binder引用对象的句柄值
        if (do_add_service(bs, s, len, ptr, txn->sender_euid))
            return -1;
        break;
    .......
    bio_put_uint32(reply, 0);
    return 0;
}
其中svcmgr_id[]实现如下: ~/Android/frameworks/base/cmd/servicemanager ----service_manager.c
uint16_t svcmgr_id[] = { 
    'a','n','d','r','o','i','d','.','o','s','.',
    'I','S','e','r','v','i','c','e','M','a','n','a','g','e','r' 
};
程序从binder_io结构体msg从获取了3个字符串信息,然后调用bio_get_ref函数返回Binder引用对象的句柄值,实现如下: ~/Android/frameworks/base/cmd/servicemanager ----binder.c
void *bio_get_ref(struct binder_io *bio)
{
    struct binder_object *obj;

    obj = _bio_get_obj(bio);
    if (!obj)
        return 0;

    if (obj->type == BINDER_TYPE_HANDLE)
        return obj->pointer;

    return 0;
}
_bio_get_obj实现如下: ~/Android/frameworks/base/cmd/servicemanager ----binder.c
static struct binder_object *_bio_get_obj(struct binder_io *bio)
{
    unsigned n;
    unsigned off = bio->data - bio->data0;//flat_binder_object偏移,由于前面获取字符串移动了data

        /* TODO: be smarter about this? */
    for (n = 0; n < bio->offs_avail; n++) {//offs_avail等于1
        if (bio->offs[n] == off)
            return bio_get(bio, sizeof(struct binder_object));
    }

    bio->data_avail = 0;
    bio->flags |= BIO_F_OVERFLOW;
    return 0;
}
_bio_get_obj首先计算出flat_binder_object偏移,然后看看偏移是否和bio->offs[0]一致,如果一致,那么就调用bio_get函数,实现如下。 ~/Android/frameworks/base/cmd/servicemanager ----binder.c
static void *bio_get(struct binder_io *bio, uint32_t size)
{
    size = (size + 3) & (~3);

    if (bio->data_avail < size){
        .......
    }  else {
        void *ptr = bio->data;
        bio->data += size;//数据指针增加
        bio->data_avail -= size;//可用空间减少
        return ptr;//返回了flat_binder_object结构体
    }
}
函数返回了flat_binder_object结构体,最后返回到bio_get_ref函数,转换成binder_object结构体指针。由于type等于BINDER_TYPE_HANDLE,所以返回Binder引用对象的句柄值。

http://www.bkjia.com/Androidjc/772088.htmlwww.bkjia.comtruehttp://www.bkjia.com/Androidjc/772088.htmlTechArticle本文参考《Android系统源代码情景分析》,作者罗升阳 一、测试代码: ~/Android/external/binder/server ----FregServer.cpp ~/Android/external/binder/common...

本文源自: 凯发国际

上一篇:[Unity3D]Unity3D游戏开发之怪物AI 下一篇:没有了

Copyright © 2005-2016 http://www.owlpma.com 凯发国际_凯发国际开户礼金_凯发注册送_新浪娱乐版权所有 凯发国际_凯发国际开户礼金_凯发注册送_新浪娱乐