Android Binder------ServiceManager啓動分析

ServiceManager啓動分析

 

簡述：

　　ServiceManager是一個全局的manager、調用了Jni函數，實現addServicew getService checkService listService等函數，

Server進程先註冊一些service到SercviceManager中。

Client想得到一些service，就要到Service中去獲取該Service。

這樣，Server和Client之間就能夠進行通信了，

Server和Client之間的通信都是經過Binder進行的。

 

 

三步走：

1.初始化Binder通信環境，打開Binder設備，並映射內存。

2.註冊自身爲上下文管理者（context_manager）

3.進入無限循環的looping！！！

 

詳細過程：

 

1 ，啓動入口  一個標準的  main函數！

int main(int argc, char **argv)
{
//記錄serviceManager的狀態
struct binder_state *bs;
void *svcmgr = BINDER_SERVICE_MANAGER;
//用於打開binder設備 用於打開設備 後把設備映射到內存時申請的內存大小128*1024
bs = binder_open(128*1024);
//註冊自身爲上下文管理者（context_manager）
if (binder_become_context_manager(bs)) {
ALOGE("cannot become context manager (%s)\n", strerror(errno));
return -1;
}

svcmgr_handle = svcmgr;
//loop無線循環，等待接收IPC同請求
binder_loop(bs, svcmgr_handler);
return 0;
}

 

 

2 bind_open函數。用來打開binder設備。 call by1

struct binder_state *binder_open(unsigned mapsize)
{
struct binder_state *bs;

bs = malloc(sizeof(*bs));
if (!bs) {
errno = ENOMEM;
return 0;
}

bs->fd = open("/dev/binder", O_RDWR);//打開binder設備
if (bs->fd < 0) {
fprintf(stderr,"binder: cannot open device (%s)\n",
strerror(errno));
goto fail_open;
}

bs->mapsize = mapsize;//bs是用來保存open 和mmap的返回信息
bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);//進行內存映射，返回的映射區的起始地址給bs->mapped
if (bs->mapped == MAP_FAILED) {//映射失敗吹裏邏輯
fprintf(stderr,"binder: cannot map device (%s)\n",
strerror(errno));
goto fail_map;
}

/* TODO: check version */

return bs;

fail_map://映射失敗的 goto處。
close(bs->fd);
fail_open://打開設備失敗的goto處。
free(bs);
return 0;

 

 

 

3.設置上下文Manager call by1

int binder_become_context_manager(struct binder_state *bs)
{
return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);
//直接用ioctl函數（ 提供了一種得到設備信息和向設備發送控制參數的手段）來讓設備Binder設置上下文
}
 

 

4.進入loop。 call by 1

void binder_loop(struct binder_state *bs, binder_handler func)
{
int res;
struct binder_write_read bwr;
unsigned readbuf[32];

bwr.write_size = 0;
bwr.write_consumed = 0;
bwr.write_buffer = 0;
//設置事務類型，Binder Command 爲 BC_ENTER_LOOPER
readbuf[0] = BC_ENTER_LOOPER;
//在binder_write中調用了ioctl函數，調用Binder設備的函數，標誌serviceManager進入的Loop 狀態。
binder_write(bs, readbuf, sizeof(unsigned));

for (;;) {
bwr.read_size = sizeof(readbuf);
bwr.read_consumed = 0;
bwr.read_buffer = (unsigned) readbuf;
//每次循環都進入Binder設備的緩衝區中，看看是否有IPC請求。
res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);

if (res < 0) {
ALOGE("binder_loop: ioctl failed (%s)\n", strerror(errno));
break;
}
//對獲取的結果進行解析。
res = binder_parse(bs, 0, readbuf, bwr.read_consumed, func);
if (res == 0) {
ALOGE("binder_loop: unexpected reply?!\n");
break;
}
if (res < 0) {
ALOGE("binder_loop: io error %d %s\n", res, strerror(errno));
break;
}
}
}

 

 

5.把返回的數據進行解析 call by 4

 

int binder_parse(struct binder_state *bs, struct binder_io *bio,
uint32_t *ptr, uint32_t size, binder_handler func)
{
int r = 1;
uint32_t *end = ptr + (size / 4);

while (ptr < end) {
uint32_t cmd = *ptr++;
#if TRACE
fprintf(stderr,"%s:\n", cmd_name(cmd));
#endif
switch(cmd) {
case BR_NOOP:
break;
case BR_TANSACTION_COMPLETE:
break;R
case BR_INCREFS:
case BR_ACQUIRE:
case BR_RELEASE:
case BR_DECREFS:
#if TRACE
fprintf(stderr," %08x %08x\n", ptr[0], ptr[1]);
#endif
ptr += 2;
break;
case BR_TRANSACTION: {
struct binder_txn *txn = (void *) ptr;
if ((end - ptr) * sizeof(uint32_t) < sizeof(struct binder_txn)) {
ALOGE("parse: txn too small!\n");
return -1;
}
binder_dump_txn(txn);
if (func) {
unsigned rdata[256/4];
struct binder_io msg;//
struct binder_io reply;//回覆信息的結構體
int res;

bio_init(&reply, rdata, sizeof(rdata), 4);//數據的初始化
bio_init_from_txn(&msg, txn);
//fun函數中會進行事務最終的處理，add Service find service 註冊 service
res = func(bs, txn, &msg, &reply);
binder_send_reply(bs, &reply, txn->data, res);
}
ptr += sizeof(*txn) / sizeof(uint32_t);
break;
}
case BR_REPLY: {
struct binder_txn *txn = (void*) ptr;
if ((end - ptr) * sizeof(uint32_t) < sizeof(struct binder_txn)) {
ALOGE("parse: reply too small!\n");
return -1;
}
binder_dump_txn(txn);
if (bio) {
bio_init_from_txn(bio, txn);
bio = 0;
} else {
/* todo FREE BUFFER */
}
ptr += (sizeof(*txn) / sizeof(uint32_t));
r = 0;
break;

 

 

6 在該函數中會對事務進行相應的出路 callby 5

int svcmgr_handler(struct binder_state *bs,
struct binder_txn *txn,
struct binder_io *msg,
struct binder_io *reply)
{
struct svcinfo *si;
uint16_t *s;
unsigned len;
void *ptr;
uint32_t strict_policy;
int allow_isolated;

// ALOGI("target=%p code=%d pid=%d uid=%d\n",
// txn->target, txn->code, txn->sender_pid, txn->sender_euid);

if (txn->target != svcmgr_handle)
return -1;

// Equivalent to Parcel::enforceInterface(), reading the RPC
// header with the strict mode policy mask and the interface name.
// Note that we ignore the strict_policy and don't propagate it
// further (since we do no outbound RPCs anyway).
strict_policy = bio_get_uint32(msg);
s = bio_get_string16(msg, &len);
if ((len != (sizeof(svcmgr_id) / 2)) ||
memcmp(svcmgr_id, s, sizeof(svcmgr_id))) {
fprintf(stderr,"invalid id %s\n", str8(s));
return -1;
}

switch(txn->code) {
case SVC_MGR_GET_SERVICE:
case SVC_MGR_CHECK_SERVICE:
s = bio_get_string16(msg, &len);
//查找相應的service
ptr = do_find_service(bs, s, len, txn->sender_euid);//call 7
if (!ptr)
break;
bio_put_ref(reply, ptr);
return 0;

case SVC_MGR_ADD_SERVICE:
s = bio_get_string16(msg, &len);
ptr = bio_get_ref(msg);
allow_isolated = bio_get_uint32(msg) ? 1 : 0;
//add service 進行service的註冊。
if (do_add_service(bs, s, len, ptr, txn->sender_euid, allow_isolated))
return -1;
break;

case SVC_MGR_LIST_SERVICES: {
unsigned n = bio_get_uint32(msg);

si = svclist;
while ((n-- > 0) && si)
si = si->next;
if (si) {
bio_put_string16(reply, si->name);
return 0;
}
return -1;
}
default:
ALOGE("unknown code %d\n", txn->code);
return -1;
}

bio_put_uint32(reply, 0);
return 0;
}
 

 

7 查找service call by 6

void *do_find_service(struct binder_state *bs, uint16_t *s, unsigned len, unsigned uid)
{
struct svcinfo *si;
//最終的查找函數了
si = find_svc(s, len);

// ALOGI("check_service('%s') ptr = %p\n", str8(s), si ? si->ptr : 0);
if (si && si->ptr) {
if (!si->allow_isolated) {
// If this service doesn't allow access from isolated processes,
// then check the uid to see if it is isolated.
unsigned appid = uid % AID_USER;
if (appid >= AID_ISOLATED_START && appid <= AID_ISOLATED_END) {
return 0;
}
}
return si->ptr;
} else {
return 0;
}
}

 

 

 

8 最終的findservice動做是在這裏結束 callby 7

struct svcinfo *find_svc(uint16_t *s16, unsigned len)
{
struct svcinfo *si;//svcinfo就是一個鏈表的node數據結構，存放了service的信息
//svclist存放了全部已經註冊的了的 service，這裏進行遍歷，經過mencmp進行匹配
for (si = svclist; si; si = si->next) {
if ((len == si->len) &&
!memcmp(s16, si->name, len * sizeof(uint16_t))) {
return si;
}
}
return 0;
}

 

 

9 註冊服務 callby 6

 

int do_add_service(struct binder_state *bs,
uint16_t *s, unsigned len,
void *ptr, unsigned uid, int allow_isolated)
{
struct svcinfo *si;
//ALOGI("add_service('%s',%p,%s) uid=%d\n", str8(s), ptr,
// allow_isolated ? "allow_isolated" : "!allow_isolated", uid);

if (!ptr || (len == 0) || (len > 127))
return -1;
//驗證UID是否有添加服務的權限。
if (!svc_can_register(uid, s)) {
ALOGE("add_service('%s',%p) uid=%d - PERMISSION DENIED\n",
str8(s), ptr, uid);
return -1;
}
//判斷服務是否存在，存在就不進行重複註冊了。
si = find_svc(s, len);
if (si) {
if (si->ptr) {
ALOGE("add_service('%s',%p) uid=%d - ALREADY REGISTERED, OVERRIDE\n",
str8(s), ptr, uid);
svcinfo_death(bs, si);
}
si->ptr = ptr;
} else {//不存在則爲心註冊的服務分配內存
si = malloc(sizeof(*si) + (len + 1) * sizeof(uint16_t));
if (!si) {//分配內存失敗
ALOGE("add_service('%s',%p) uid=%d - OUT OF MEMORY\n",
str8(s), ptr, uid);
return -1;
}
//爲註冊的服務的 scvinfo 結構體賦值，
si->ptr = ptr;
si->len = len;
memcpy(si->name, s, (len + 1) * sizeof(uint16_t));
si->name[len] = '\0';
si->death.func = svcinfo_death;
si->death.ptr = si;
si->allow_isolated = allow_isolated;
//可見list的插入能夠頭插入法。
si->next = svclist;
svclist = si;
}

binder_acquire(bs, ptr);
binder_link_to_death(bs, ptr, &si->death);
return 0;
}

 

 

 

10 判斷當前uid是否具備註冊service的權限，沒有就拒絕 callby9

 

int svc_can_register(unsigned uid, uint16_t *name)
{
unsigned n;
if ((uid == 0) || (uid == AID_SYSTEM))//uid=0爲root用戶， AID_SYSTEM爲系統 service
return 1;
//遍歷容許註冊service的進程數組
for (n = 0; n < sizeof(allowed) / sizeof(allowed[0]); n++)
if ((uid == allowed[n].uid) && str16eq(name, allowed[n].name))
return 1;
return 0;
}

容許註冊服務的進程列表（若是自定義rom本身增長系統服務，就能夠在這裏增長以得到權限啦）

static struct {
unsigned uid;
const char *name;
} allowed[] = {
{ AID_MEDIA, "media.audio_flinger" },
{ AID_MEDIA, "media.player" },
{ AID_MEDIA, "media.camera" },
{ AID_MEDIA, "media.audio_policy" },
{ AID_DRM, "drm.drmManager" },
{ AID_NFC, "nfc" },
{ AID_RADIO, "radio.phone" },
{ AID_RADIO, "radio.sms" },
{ AID_RADIO, "radio.phonesubinfo" },
{ AID_RADIO, "radio.simphonebook" },
/* TODO: remove after phone services are updated: */
{ AID_RADIO, "phone" },
{ AID_RADIO, "sip" },
{ AID_RADIO, "isms" },
{ AID_RADIO, "iphonesubinfo" },
{ AID_RADIO, "simphonebook" },
{ AID_MEDIA, "common_time.clock" },
{ AID_MEDIA, "common_time.config" },
};