Android--Binder源码解析(一)
2022-06-02 本文已影响0人
_Jun
Binder源码解析(一)
Binder的jni方法注册
1. zygote启动
1.1 启动zygote进程
zygote是由init进程通过解析 init.zygote.rc 文件而创建的,zygote所对应的可执行程序app_process,所对应的源文件是 app_main.cpp ,进程名为zygote。
// system/core/rootdir/init.zygote32.rc
service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
class main
socket zygote stream 660 root system
onrestart write /sys/android_power/request_state wake
onrestart write /sys/power/state on
onrestart restart media
onrestart restart netd
writepid /dev/cpuset/foreground/tasks
1.2 执行app_main.cpp 中的main方法
启动zygote的入口函数是 app_main.cpp 中的main方法。
frameworks/base/cmds/app_process/app_main.cpp
// 186
int main(int argc, char* const argv[])
// 248 将zygote标志位置为true。
if (strcmp(arg, "--zygote") == 0) {
zygote = true;
}
// 306 运行AndroidRuntime.cpp的start方法
if (zygote) {
runtime.start("com.android.internal.os.ZygoteInit", args, zygote);
}
1.3 AndroidRuntime::start
调用startReg方法来完成jni方法的注册。
frameworks/base/core/jni/AndroidRuntime.cpp
// 1007
void AndroidRuntime::start(const char* className, const Vector<String8>& options, bool zygote)
//1051
if (startReg(env) < 0)
//1440
int AndroidRuntime::startReg(JNIEnv* env){}
//1459 注册jni方法
if (register_jni_procs(gRegJNI, NELEM(gRegJNI), env) < 0) {}
//1283
static int register_jni_procs(const RegJNIRec array[], size_t count, JNIEnv* env)
{
//循环注册jni方法
for (size_t i = 0; i < count; i++) {
if (array[i].mProc(env) < 0) {
return -1;
}
}
return 0;
}
// 1296
static const RegJNIRec gRegJNI[] = {
// 1312
REG_JNI(register_android_os_Binder),
}
2 register_android_os_Binder
frameworks/base/core/jni/android_util_Binder.cpp
int register_android_os_Binder(JNIEnv* env)
{
if (int_register_android_os_Binder(env) < 0)
return -1;
if (int_register_android_os_BinderInternal(env) < 0)
return -1;
if (int_register_android_os_BinderProxy(env) < 0)
return -1;
}
2.1 int_register_android_os_Binder
//843
static const JNINativeMethod gBinderMethods[] = {
/* name, signature, funcPtr */
{ "getCallingPid", "()I", (void*)android_os_Binder_getCallingPid },
{ "getCallingUid", "()I", (void*)android_os_Binder_getCallingUid },
{ "clearCallingIdentity", "()J", (void*)android_os_Binder_clearCallingIdentity },
{ "restoreCallingIdentity", "(J)V", (void*)android_os_Binder_restoreCallingIdentity },
{ "setThreadStrictModePolicy", "(I)V", (void*)android_os_Binder_setThreadStrictModePolicy },
{ "getThreadStrictModePolicy", "()I", (void*)android_os_Binder_getThreadStrictModePolicy },
{ "flushPendingCommands", "()V", (void*)android_os_Binder_flushPendingCommands },
{ "init", "()V", (void*)android_os_Binder_init },
{ "destroy", "()V", (void*)android_os_Binder_destroy },
{ "blockUntilThreadAvailable", "()V", (void*)android_os_Binder_blockUntilThreadAvailable }
};
//857
const char* const kBinderPathName = "android/os/Binder";
//859
static int int_register_android_os_Binder(JNIEnv* env)
{
//查找文件kBinderPathName = “android/os/Binder”,返回对应Class对象
jclass clazz = FindClassOrDie(env, kBinderPathName);
//通过gBinderOffsets结构体,保存Java层Binder类的信息,为JNI层访问Java层提供通道
gBinderOffsets.mClass = MakeGlobalRefOrDie(env, clazz);
gBinderOffsets.mExecTransact = GetMethodIDOrDie(env, clazz, "execTransact", "(IJJI)Z");
gBinderOffsets.mObject = GetFieldIDOrDie(env, clazz, "mObject", "J");
//通过RegisterMethodsOrDie,将为gBinderMethods数组完成映射关系,从而为Java层访问JNI层提供通道
return RegisterMethodsOrDie(
env, kBinderPathName,
gBinderMethods, NELEM(gBinderMethods));
}
2.2 int_register_android_os_BinderInternal
frameworks/base/core/jni/android_util_Binder.cpp
//925
static const JNINativeMethod gBinderInternalMethods[] = {
/* name, signature, funcPtr */
{ "getContextObject", "()Landroid/os/IBinder;", (void*)android_os_BinderInternal_getContextObject },
{ "joinThreadPool", "()V", (void*)android_os_BinderInternal_joinThreadPool },
{ "disableBackgroundScheduling", "(Z)V", (void*)android_os_BinderInternal_disableBackgroundScheduling },
{ "handleGc", "()V", (void*)android_os_BinderInternal_handleGc }
};
//933
const char* const kBinderInternalPathName = "com/android/internal/os/BinderInternal";
//935
static int int_register_android_os_BinderInternal(JNIEnv* env)
{
//查找文件kBinderPathName = “com/android/internal/os/BinderInternal”,返回对应Class对象
jclass clazz = FindClassOrDie(env, kBinderInternalPathName);
//通过gBinderInternalOffsets,保存Java层BinderInternal类的信息,为JNI层访问Java层提供通道
gBinderInternalOffsets.mClass = MakeGlobalRefOrDie(env, clazz);
gBinderInternalOffsets.mForceGc = GetStaticMethodIDOrDie(env, clazz, "forceBinderGc", "()V");
//通过RegisterMethodsOrDie(),将为gBinderInternalMethods数组完成映射关系,从而为Java层访问JNI层提供通道
return RegisterMethodsOrDie(
env, kBinderInternalPathName,
gBinderInternalMethods, NELEM(gBinderInternalMethods));
}
2.3 int_register_android_os_BinderProxy
frameworks/base/core/jni/android_util_Binder.cpp
//1241
static const JNINativeMethod gBinderProxyMethods[] = {
/* name, signature, funcPtr */
{"pingBinder", "()Z", (void*)android_os_BinderProxy_pingBinder},
{"isBinderAlive", "()Z", (void*)android_os_BinderProxy_isBinderAlive},
{"getInterfaceDescriptor", "()Ljava/lang/String;", (void*)android_os_BinderProxy_getInterfaceDescriptor},
{"transactNative", "(ILandroid/os/Parcel;Landroid/os/Parcel;I)Z", (void*)android_os_BinderProxy_transact},
{"linkToDeath", "(Landroid/os/IBinder$DeathRecipient;I)V", (void*)android_os_BinderProxy_linkToDeath},
{"unlinkToDeath", "(Landroid/os/IBinder$DeathRecipient;I)Z", (void*)android_os_BinderProxy_unlinkToDeath},
{"destroy", "()V", (void*)android_os_BinderProxy_destroy},
};
//1252
const char* const kBinderProxyPathName = "android/os/BinderProxy";
//1254
static int int_register_android_os_BinderProxy(JNIEnv* env)
{
//查找文件kBinderPathName = “android/os/BinderProxy”,返回对应Class对象
jclass clazz = FindClassOrDie(env, "java/lang/Error");
gErrorOffsets.mClass = MakeGlobalRefOrDie(env, clazz);
//通过gBinderProxyOffsets,保存Java层BinderProxy类的信息,为JNI层访问Java提供通道
clazz = FindClassOrDie(env, kBinderProxyPathName);
gBinderProxyOffsets.mClass = MakeGlobalRefOrDie(env, clazz);
gBinderProxyOffsets.mConstructor = GetMethodIDOrDie(env, clazz, "<init>", "()V");
gBinderProxyOffsets.mSendDeathNotice = GetStaticMethodIDOrDie(env, clazz, "sendDeathNotice",
"(Landroid/os/IBinder$DeathRecipient;)V");
gBinderProxyOffsets.mObject = GetFieldIDOrDie(env, clazz, "mObject", "J");
gBinderProxyOffsets.mSelf = GetFieldIDOrDie(env, clazz, "mSelf",
"Ljava/lang/ref/WeakReference;");
gBinderProxyOffsets.mOrgue = GetFieldIDOrDie(env, clazz, "mOrgue", "J");
clazz = FindClassOrDie(env, "java/lang/Class");
gClassOffsets.mGetName = GetMethodIDOrDie(env, clazz, "getName", "()Ljava/lang/String;");
//通过RegisterMethodsOrDie(),将为gBinderProxyMethods数组完成映射关系,从而为Java 层访问JNI层提供通道
return RegisterMethodsOrDie(
env, kBinderProxyPathName,
gBinderProxyMethods, NELEM(gBinderProxyMethods));
}
binder驱动
binder_driver1. binder_init
kernel/drivers/staging/android/binder.c
//4290 设备驱动入口函数
device_initcall(binder_init);
//4213
static int __init binder_init(void)
//4220 创建名为binder的单线程的工作队列
binder_deferred_workqueue = create_singlethread_workqueue("binder");
//4269
ret = init_binder_device(device_name);
//4186
static int __init init_binder_device(const char *name)
{
int ret;
struct binder_device *binder_device;
//4191 为binder设备分配内存
binder_device = kzalloc(sizeof(*binder_device), GFP_KERNEL);
//4195 初始化设备
binder_device->miscdev.fops = &binder_fops;//设备的文件操作结构,这是file_operations结构
binder_device->miscdev.minor = MISC_DYNAMIC_MINOR;//次设备号,动态分配
binder_device->miscdev.name = name;//设备名,“binder”
binder_device->context.binder_context_mgr_uid = INVALID_UID;
binder_device->context.name = name;
//4202 misc驱动注册
ret = misc_register(&binder_device->miscdev);
// 4208 将hlist节点添加到binder_devices为表头的设备链表
hlist_add_head(&binder_device->hlist, &binder_devices);
return ret;
}
2. binder_open
kernel/drivers/staging/android/binder.c
//3454
static int binder_open(struct inode *nodp, struct file *filp)
//3462 为binder_proc结构体在kernel分配内存空间
proc = kzalloc(sizeof(*proc), GFP_KERNEL);
//3465 将当前线程task保存到binder进程的task中
get_task_struct(current);
proc->tsk = current;
INIT_LIST_HEAD(&proc->todo); //初始化todo列表
init_waitqueue_head(&proc->wait); //初始化wait列表
proc->default_priority = task_nice(current); //将当前进程的nice值转为进程优先级
//3474 同步锁,因为binder支持多线程访问
binder_lock(__func__);
binder_stats_created(BINDER_STAT_PROC);//binder_proc对象创建数加1
hlist_add_head(&proc->proc_node, &binder_procs);//将proc_node节点添加到binder_procs的队列头部
proc->pid = current->group_leader->pid;//进程pid
INIT_LIST_HEAD(&proc->delivered_death);//初始化已发布的死亡通知列表
filp->private_data = proc;//将这个binder_proc与filp关联起来,这样下次通过flip就能找到这个proc了
binder_unlock(__func__);//释放同步锁
3. binder_mmap
kernel/drivers/staging/android/binder.c
//3355
static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
//3366 保证映射内存大小不超过4M
if ((vma->vm_end - vma->vm_start) > SZ_4M)
vma->vm_end = vma->vm_start + SZ_4M;
//3382 同步锁,保证一次只有一个进程分配内存,保证多进程间的并发访问
mutex_lock(&binder_mmap_lock);
// 是否已经做过了映射,执行过则进入if,goto跳转,释放同步锁后结束binder_mmap方法
if (proc->buffer) {
goto err_already_mapped;
}
//采用VM_IOREMAP方式,分配一个连续的内核虚拟内存,与进程虚拟内存大小一致
area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP);
//内存分配不成功直接报错
if (area == NULL) {
ret = -ENOMEM;
failure_string = "get_vm_area";
goto err_get_vm_area_failed;
}
//将proc中的buffer指针指向这块内核的虚拟内存
proc->buffer = area->addr;
//计算出用户空间和内核空间的地址偏移量。地址偏移量 = 用户虚拟内存地址 - 内核虚拟内存地址
proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer;
//释放锁
mutex_unlock(&binder_mmap_lock);
//3407 分配物理页的指针数组,数组大小为vma的等效page个数
proc->pages = kzalloc(sizeof(proc->pages[0]) * ((vma->vm_end - vma->vm_start) / PAGE_SIZE), GFP_KERNEL);
//3418 分配物理页面,同时映射到内核空间和进程空间,先分配1个物理页
if (binder_update_page_range(proc, 1, proc->buffer, proc->buffer + PAGE_SIZE, vma)) {}
//576
static int binder_update_page_range(struct binder_proc *proc, int allocate,
void *start, void *end,
struct vm_area_struct *vma)
//609 allocate为1,代表分配内存过程。如果为0则代表释放内存过程
if (allocate == 0)
goto free_range;
//624 分配一个page的物理内存
*page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO);
//630 物理空间映射到虚拟内核空间
ret = map_kernel_range_noflush((unsigned long)page_addr,
PAGE_SIZE, PAGE_KERNEL, page);
//641 物理空间映射到虚拟进程空间
ret = vm_insert_page(vma, user_page_addr, page[0]);
//3355
static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
//3425
list_add(&buffer->entry, &proc->buffers); //将buffer连入buffers链表中
buffer->free = 1;//此内存可用
binder_insert_free_buffer(proc, buffer);//将buffer插入proc -> free_buffers链表中
proc->free_async_space = proc->buffer_size / 2; //异步的可用空闲空间大小
barrier();
proc->files = get_files_struct(current);
proc->vma = vma;
proc->vma_vm_mm = vma->vm_mm;
//494
static void binder_insert_free_buffer(struct binder_proc *proc,
struct binder_buffer *new_buffer)
//511
while (*p) {
parent = *p;
buffer = rb_entry(parent, struct binder_buffer, rb_node);
BUG_ON(!buffer->free);
//计算得出空闲内存的大小
buffer_size = binder_buffer_size(proc, buffer);
if (new_buffer_size < buffer_size)
p = &parent->rb_left;
else
p = &parent->rb_right;
}
rb_link_node(&new_buffer->rb_node, parent, p);
//将buffer插入proc -> free_buffers链表中
rb_insert_color(&new_buffer->rb_node, &proc->free_buffers);
4. binder_ioctl
kernel/drivers/staging/android/binder.c
//3241
static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
//3254 进入休眠状态,知道中断唤醒
ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
//3259 根据当前进程的pid,从binder_proc中查找binder_thread, 如果当前线程已经加入到proc的线程队列则直接返回,如果不存在则创建binder_thread,并将当前线程添加到当前的proc
thread = binder_get_thread(proc);
//3265 进行binder的读写操作
switch (cmd) {
case BINDER_WRITE_READ:
ret = binder_ioctl_write_read(filp, cmd, arg, thread);
if (ret)
goto err;
break;
}
//3136
static int binder_ioctl_write_read(struct file *filp,
unsigned int cmd, unsigned long arg,
struct binder_thread *thread)
//3150 把用户空间数据ubuf拷贝到bwr
if (copy_from_user(&bwr, ubuf, sizeof(bwr)))
//3160
if (bwr.write_size > 0) { //当写缓存中有数据,则执行binder写操作
ret = binder_thread_write(proc, thread,
bwr.write_buffer,
bwr.write_size,
&bwr.write_consumed);
}
if (bwr.read_size > 0) {//当读缓存中有数据,则执行binder读操作
ret = binder_thread_read(proc, thread, bwr.read_buffer,
bwr.read_size,
&bwr.read_consumed,
filp->f_flags & O_NONBLOCK);
trace_binder_read_done(ret);
//进程todo队列不为空,则唤醒该队列中的线程
if (!list_empty(&proc->todo))
wake_up_interruptible(&proc->wait);
}
//3192 把内核空间数据bwr拷贝到ubuf
if (copy_to_user(ubuf, &bwr, sizeof(bwr))) {}
数据结构
1. file_operations
static const struct file_operations binder_fops = {
.owner = THIS_MODULE,
.poll = binder_poll,
.unlocked_ioctl = binder_ioctl,
.compat_ioctl = binder_ioctl,
.mmap = binder_mmap,
.open = binder_open,
.flush = binder_flush,
.release = binder_release,
};
2. binder_proc
每个进程调用open()打开binder驱动都会创建该结构体,用于管理IPC所需的各种信息。
struct binder_proc {
struct hlist_node proc_node; // 进程节点
struct rb_root threads; // binder_thread红黑树的根节点
struct rb_root nodes; // binder_node红黑树的根节点
struct rb_root refs_by_desc; // binder_ref红黑树的根节点(以 handle为 key)
struct rb_root refs_by_node; // binder_ref红黑树的根节点(以 ptr为 key)
int pid; // 相应进程 id
struct vm_area_struct *vma; // 指向进程虚拟地址空间的指针
struct mm_struct *vma_vm_mm; // 相应进程的内存结构体
struct task_struct *tsk; // 相应进程的 task结构体
struct files_struct *files; // 相应进程的文件结构体
struct hlist_node deferred_work_node;
int deferred_work;
void *buffer; // 内核空间的起始地址
ptrdiff_t user_buffer_offset; // 内核空间与用户空间的地址偏移量
struct list_head buffers; // 所有的 buffer
struct rb_root free_buffers; // 空闲的 buffer
struct rb_root allocated_buffers; // 已分配的 buffer
size_t free_async_space; // 异步的可用空闲空间大小
struct page **pages; // 指向物理内存页指针的指针
size_t buffer_size; // 映射的内核空间大小
uint32_t buffer_free; // 可用内存总大小
struct list_head todo; // 进程将要做的事
wait_queue_head_t wait; // 等待队列
struct binder_stats stats; // binder统计信息
struct list_head delivered_death; // 已分发的死亡通知
int max_threads; // 最大线程数
int requested_threads; // 请求的线程数
int requested_threads_started; // 已启动的请求线程数
int ready_threads; // 准备就绪的线程个数
long default_priority; // 默认优先级
struct dentry *debugfs_entry;
struct binder_context *context;
};
3. binder_node
struct binder_node {
int debug_id; // 节点创建时分配,具有全局唯一性,用于调试使用
struct binder_work work;
union {
struct rb_node rb_node; // binder节点正常使用,union
struct hlist_node dead_node; // binder节点已销毁,union
};
struct binder_proc *proc; // binder所在的进程
struct hlist_head refs; // 所有指向该节点的 binder引用队列
int internal_strong_refs;
int local_weak_refs;
int local_strong_refs;
binder_uintptr_t ptr; // 指向用户空间 binder_node的指针,对应于 flat_binder_object.binder
binder_uintptr_t cookie; // 指向用户空间 binder_node的指针,附件数据,对应于 flat_binder_object.cookie
unsigned has_strong_ref:1; // 占位 1bit
unsigned pending_strong_ref:1; // 占位 1bit
unsigned has_weak_ref:1; // 占位 1bit
unsigned pending_weak_ref:1; // 占位 1bit
unsigned has_async_transaction:1; // 占位 1bit
unsigned accept_fds:1; // 占位 1bit
unsigned min_priority:8; // 占位 8bit,最小优先级
struct list_head async_todo; // 异步todo队列
};
4. binder_buffer
struct binder_buffer {
struct list_head entry; // buffer实体的地址
struct rb_node rb_node; // buffer实体的地址
/* by address */
unsigned free:1; // 标记是否是空闲buffer,占位1bit
unsigned allow_user_free:1; // 是否允许用户释放,占位1bit
unsigned async_transaction:1; // 占位1bit
unsigned debug_id:29; // 占位29bit
struct binder_transaction *transaction; // 该缓存区的需要处理的事务
struct binder_node *target_node; // 该缓存区所需处理的Binder实体
size_t data_size; // 数据大小
size_t offsets_size; // 数据偏移量
size_t extra_buffers_size;
uint8_t data[0]; // 数据地址
};