浅析android下native层binder的部分具体实现
在defaultServiceManager()方法中：[luther.gliethttp]
==>defaultServiceManager
==>
sp<IServiceManager> gDefaultServiceManager;的m_ptr指向new BpServiceManager(obj);因为=这个操作符被sp类模板重载
这个obj就是ProcessState::self()->getContextObject(NULL)返回的gProcess.
sp<ProcessState> gProcess;的m_ptr指向new BpBinder(handle);[ProcessState::self()函数返回]因为=这个操作符被sp类模板重载
看看BpServiceManager构造函数：
BpServiceManager(const sp<IBinder>& impl)
: BpInterface<IServiceManager>(impl)
{
}
template<typename INTERFACE>
inline BpInterface<INTERFACE>::BpInterface(const sp<IBinder>& remote)
: BpRefBase(remote)
{
}
BpRefBase::BpRefBase(const sp<IBinder>& o)
: mRemote(o.get()), mRefs(NULL), mState(0)//这里o.get()就是gProcess.get(),返回gProcess指向new BpBinder(handle);的m_ptr
{//mRemote在类IBinder中的定义：IBinder* const mRemote;[luther.gliethttp]
extendObjectLifetime(OBJECT_LIFETIME_WEAK);
if (mRemote) {
mRemote->incStrong(this); // Removed on first IncStrong().
mRefs = mRemote->createWeak(this); // Held for our entire lifetime.
}
}
remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply);
这里的remote来自inline IBinder* remote() { return mRemote; }
因为mRemote为IBinder类的指针,->操作符没有被重载,所以就是调用BpBinder::transact方法[luther.gliethttp]
status_t BpBinder::transact(
uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
// Once a binder has died, it will never come back to life.
if (mAlive) {
status_t status = IPCThreadState::self()->transact(
mHandle, code, data, reply, flags);
if (status == DEAD_OBJECT) mAlive = 0;
return status;
}
return DEAD_OBJECT;
}
status_t flatten_binder(const sp<ProcessState>& proc,
const sp<IBinder>& binder, Parcel* out)
{
flat_binder_object obj;
obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
if (binder != NULL) {
IBinder *local = binder->localBinder();
//对于BBinder* BBinder::localBinder()
//{
// return this;
//}
//对于BBinder* IBinder::localBinder()
//{
// return NULL;
//}
if (!local) {
BpBinder *proxy = binder->remoteBinder();
if (proxy == NULL) {
LOGE("null proxy");
}
const int32_t handle = proxy ? proxy->handle() : 0;
obj.type = BINDER_TYPE_HANDLE;
obj.handle = handle;
obj.cookie = NULL;
} else {//对于IServiceManager::addService将执行到这里
obj.type = BINDER_TYPE_BINDER;
obj.binder = local->getWeakRefs();//作为红黑节点树的唯一id标号
obj.cookie = local;
}
} else {
obj.type = BINDER_TYPE_BINDER;
obj.binder = NULL;
obj.cookie = NULL;
}
return finish_flatten_binder(binder, obj, out);
}
commands/binder/service_manager.c
=>svcmgr_handler
=>do_add_service
commands/binder/service_manager.c
==>main
==>bs = binder_open(128*1024);
//proc->tsk = current;
//filp->private_data = proc;
==>binder_become_context_manager(bs);//将bs作为context_manager管理binder,发送ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);
//这样binder驱动的binder_context_mgr_node就是该bs了
==>binder_loop(bs, svcmgr_handler);//回调函数svcmgr_handler,用来处理消息
void binder_loop(struct binder_state *bs, binder_handler func)
{
...
readbuf[0] = BC_ENTER_LOOPER;
binder_write(bs, readbuf, sizeof(unsigned));
//thread->looper |= BINDER_LOOPER_STATE_ENTERED;
//struct binder_thread *thread = binder_get_thread()会查找该proc自己是否已经在binder_thread,
//rb_link_node(&thread->rb_node, parent, p);
//rb_insert_color(&thread->rb_node, &proc->threads);将该current[就是proc打开者自己]绑定到binder_thread,然后插入到proc管理的红黑树中.
//proc管理的红黑树的索引依据为pid数值：thread->pid = current->pid;
/*
*struct binder_stats {
int br[_IOC_NR(BR_FAILED_REPLY) + 1];
int bc[_IOC_NR(BC_DEAD_BINDER_DONE) + 1];
int obj_created[BINDER_STAT_COUNT];
int obj_deleted[BINDER_STAT_COUNT];
};
static struct binder_stats binder_stats;
* */
for (;;) {
...
bwr.read_size = sizeof(readbuf);
bwr.read_consumed = 0;
bwr.read_buffer = (unsigned) readbuf;
//wait_for_proc_work = thread->transaction_stack == NULL && list_empty(&thread->todo);
//没有todo的咚咚
res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
//首先binder推入4字节的BR_NOOP控制头
...
res = binder_parse(bs, 0, readbuf, bwr.read_consumed, func);
...
}
...
}
driver中
device_initcall(binder_init);
=>binder_init
=>创建/proc/binder根目录
=>创建/proc/binder/proc目录
=>misc_register(&binder_miscdev);注册/dev/binder字符设备文件
=>该/dev/binder节点由init进程在handle_device_fd(device_fd);==>handle_device_event(&uevent);中uevent-netlink处理之后,"/dev/"目录下创建.
=>创建只读文件"state"、"stats"、"transactions"、"transaction_log"和"failed_transaction_log",
帮定读文件函数binder_read_proc_stats
这样binder驱动在内核中登记工作就完成了,剩下的工作就是应用程序使用这个binder进行IPC了.
if (tr->target.handle) {//目的handle
struct binder_ref *ref;
ref = binder_get_ref(proc, tr->target.handle);//返回目的handle的ref,该handle由后面的binder_get_ref_for_node()函数生成
if (ref == NULL) {
binder_user_error("binder: %d:%d got "
"transaction to invalid handle\n",
proc->pid, thread->pid);
return_error = BR_FAILED_REPLY;
goto err_invalid_target_handle;
}
target_node = ref->node;
} else {
target_node = binder_context_mgr_node;
if (target_node == NULL) {
return_error = BR_DEAD_REPLY;
goto err_no_context_mgr_node;
}
}
static struct binder_ref *
binder_get_ref(struct binder_proc *proc, uint32_t desc)
{
struct rb_node *n = proc->refs_by_desc.rb_node;//是否有该desc对应的内容
struct binder_ref *ref;
while (n) {
ref = rb_entry(n, struct binder_ref, rb_node_desc);
if (desc < ref->desc)
n = n->rb_left;
else if (desc > ref->desc)
n = n->rb_right;
else
return ref;
}
return NULL;
}
struct flat_binder_object {
/* 8 bytes for large_flat_header. */
unsigned long type;
unsigned long flags;
/* 8 bytes of data. */
union {
void *binder; /* local object */
signed long handle; /* remote object */
};
/* extra data associated with local object */
void *cookie;
};
==>binder_transaction
==> struct flat_binder_object *fp;
...
switch (fp->type) {
case BINDER_TYPE_BINDER:
case BINDER_TYPE_WEAK_BINDER: {
struct binder_ref *ref;
//上面obj.binder = local->getWeakRefs();//作为红黑节点树的唯一id标号,所以这里从红黑树上查找fp->binder节点[luther.gliethttp]
struct binder_node *node = binder_get_node(proc, fp->binder);//如果从红黑树中没有找到,那么
if (node == NULL) {
node = binder_new_node(proc, fp->binder, fp->cookie);//创建一个新的node
if (node == NULL) {
return_error = BR_FAILED_REPLY;
goto err_binder_new_node_failed;
}
node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK;
node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS);
}
if (fp->cookie != node->cookie) {
binder_user_error("binder: %d:%d sending u%p "
"node %d, cookie mismatch %p != %p\n",
proc->pid, thread->pid,
fp->binder, node->debug_id,
fp->cookie, node->cookie);
goto err_binder_get_ref_for_node_failed;
}
ref = binder_get_ref_for_node(target_proc, node);//将新创建的node挂接到红黑树上
if (ref == NULL) {
return_error = BR_FAILED_REPLY;
goto err_binder_get_ref_for_node_failed;
}
if (fp->type == BINDER_TYPE_BINDER)
fp->type = BINDER_TYPE_HANDLE;
else
fp->type = BINDER_TYPE_WEAK_HANDLE;
fp->handle = ref->desc;//获取唯一id号,作为handle用来区分service们
binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE, &thread->todo);
if (binder_debug_mask & BINDER_DEBUG_TRANSACTION)
printk(KERN_INFO " node %d u%p -> ref %d desc %d\n",
node->debug_id, node->ptr, ref->debug_id, ref->desc);
} break;
case BINDER_TYPE_HANDLE:
case BINDER_TYPE_WEAK_HANDLE: {
...
new_ref = binder_get_ref_for_node(target_proc, ref->node);
...
==>binder_thread_write
==> if (target == 0 && binder_context_mgr_node &&
(cmd == BC_INCREFS || cmd == BC_ACQUIRE)) {
ref = binder_get_ref_for_node(proc,
binder_context_mgr_node);
static struct binder_ref *
binder_get_ref_for_node(struct binder_proc *proc, struct binder_node *node)
{
...
rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc);
new_ref->desc = (node == binder_context_mgr_node) ? 0 : 1;
for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) {
ref = rb_entry(n, struct binder_ref, rb_node_desc);
if (ref->desc > new_ref->desc)
break;
new_ref->desc = ref->desc + 1;//计算service们对应的唯一handle号[luther.gliethttp]
}
...
}
|
