Android-Binder是如何启动和获取service_ma
2020-12-19 本文已影响0人
zzq_nene
image.png
一、启动service_manager服务
ServiceManager也是一个服务，其handle==0。
ServiceManager其实就是用来获取AMS、PMS等服务的Binder对象，然后就可以通过AMS等服务的IBinder对象与对应的AMS进行跨进程通信。AMS等服务在启动的时候就会把其IBinder对象注册到ServiceManager中，然后客户端找到ServiceManager，然后通过ServiceManager找到AMS的IBinder返回给客户端，然后客户端就可以通过该AMS的IBinder与AMS进行跨进程通信。
就是在system/core/rootdir/init.rc中，有
service servicemanager /system/bin/servicemanager这样的命令，执行这个命令之后，就会进行native/cmds/servicemanager/service_manager.c中的main方法
service servicemanager /system/bin/servicemanager
class core
user system
group system
critical
onrestart restart healthd
onrestart restart zygote
onrestart restart media
onrestart restart surfaceflinger
onrestart restart drm
1.native/cmds/servicemanager/service_manager.c中的main方法
这里完成service_manager（SM）的注册：主要分三步（这是流程）
- （1）打开binder驱动，将SM与binder驱动进行内存映射，SM内存大小与128KB
- （2）设置SM为大管家（设置为守护进程）--- SM作用：为了管理系统服务
- 创建binder_node结构体对象
- 将binder_node添加到proc->nodes中
- 创建work和todo队列，保存客户端和服务端需要处理的消息
- （3）直接BC_ENTER_LOOPER命令
- 向thread->looper写入状态为ENTER
- 读取数据，修改thread->looper状态，并且调用ret = wait_event_freezable_exclusive(proc->wait, binder_has_proc_work(proc, thread));使SM进入阻塞等待状态
int main(int argc, char **argv)
{
struct binder_state *bs;
// 这个binder_open是native层的binder_open，而不是驱动层的binder_open
// 这里其实就是调用了native/cmds/servicemanager/binder.c的binder_open方法
// 在native层binder.c的binder_open方法中会调用open方法，这个open方法就是调用了kernel层binder.c的binder_open方法
// 然后在native层binder.c的binder_open方法中还会调用mmap方法，这个mmap方法就是调用了kernel层binder.c的binder_mmap方法
// sm的内存大小是128K
// 这里主要就是做两件事：1.打开驱动；2.映射SM和Binder驱动的内存地址
bs = binder_open(128*1024);
if (!bs) {
ALOGE("failed to open binder driver\n");
return -1;
}
// 把service_manager设置为大管家（大管家就是为了管理系统服务的，其实就是守护进程）
if (binder_become_context_manager(bs)) {
ALOGE("cannot become context manager (%s)\n", strerror(errno));
return -1;
}
selinux_enabled = is_selinux_enabled();
sehandle = selinux_android_service_context_handle();
selinux_status_open(true);
if (selinux_enabled > 0) {
if (sehandle == NULL) {
ALOGE("SELinux: Failed to acquire sehandle. Aborting.\n");
abort();
}
if (getcon(&service_manager_context) != 0) {
ALOGE("SELinux: Failed to acquire service_manager context. Aborting.\n");
abort();
}
}
union selinux_callback cb;
cb.func_audit = audit_callback;
selinux_set_callback(SELINUX_CB_AUDIT, cb);
cb.func_log = selinux_log_callback;
selinux_set_callback(SELINUX_CB_LOG, cb);
// 进入无限循环。不断监听有没有人访问ServiceManager
// 轮询处理数据
binder_loop(bs, svcmgr_handler);
return 0;
}
2.native/cmds/servicemanager/binder.c#binder_open
在native/cmds/servicemanager/service_manager.c中的main方法中调用了binder_open，进入该方法。
struct binder_state *binder_open(size_t mapsize)
{
struct binder_state *bs;
struct binder_version vers;
bs = malloc(sizeof(*bs));
if (!bs) {
errno = ENOMEM;
return NULL;
}
// 调用驱动，这里开启的是binder驱动。
// 这里调用open，实际上就是根据native与kernel层的方法关系，调用到了驱动层的binder.c的binder_open方法
bs->fd = open("/dev/binder", O_RDWR);
if (bs->fd < 0) {
fprintf(stderr,"binder: cannot open device (%s)\n",
strerror(errno));
goto fail_open;
}
if ((ioctl(bs->fd, BINDER_VERSION, &vers) == -1) ||
(vers.protocol_version != BINDER_CURRENT_PROTOCOL_VERSION)) {
fprintf(stderr,
"binder: kernel driver version (%d) differs from user space version (%d)\n",
vers.protocol_version, BINDER_CURRENT_PROTOCOL_VERSION);
goto fail_open;
}
bs->mapsize = mapsize;
// 这里就是把SM的虚拟内存和Binder驱动的虚拟内存做地址映射
// 这里调用mmap，实际上就是根据native与kernel层的方法关系，调用到了驱动层的binder.c的binder_mmap方法
bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);
if (bs->mapped == MAP_FAILED) {
fprintf(stderr,"binder: cannot map device (%s)\n",
strerror(errno));
goto fail_map;
}
return bs;
fail_map:
close(bs->fd);
fail_open:
free(bs);
return NULL;
}
3.native/cmds/servicemanager/binder.c#binder_become_context_manager
在native/cmds/servicemanager/service_manager.c中的main方法中调用了binder_become_context_manager方法进入，在这里其实就是直接调用了ioctl，而这里是native的ioctl方法，native层的ioctl方法与kernel（驱动层）的binder_ioctl方法映射，就直接调用的是驱动层的binder_ioctl方法，这里传入了命令是BINDER_SET_CONTEXT_MGR，这样在binder_ioctl就会处理BINDER_SET_CONTEXT_MGR分支的内容
int binder_become_context_manager(struct binder_state *bs)
{
// 直接调用了ioctl，命令是BINDER_SET_CONTEXT_MGR
// 其实就是调用了kernel下的binder.c的binder_ioctl
return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);
}
在这里我们看下驱动层的binder_ioctl方法：因为这里是从native层binder.c的ioctl函数，映射调用到了kernel层的binder.c的binder_ioctl函数
/**
* 主要是读写操作的
*
*/
static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
{
int ret;
struct binder_proc *proc = filp->private_data;
struct binder_thread *thread;
unsigned int size = _IOC_SIZE(cmd);
void __user *ubuf = (void __user *)arg;
/*pr_info("binder_ioctl: %d:%d %x %lx\n",
proc->pid, current->pid, cmd, arg);*/
trace_binder_ioctl(cmd, arg);
// 这里是一个挂起中断，正常情况下是不会中断的
ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
if (ret)
goto err_unlocked;
binder_lock(__func__);
thread = binder_get_thread(proc);
if (thread == NULL) {
ret = -ENOMEM;
goto err;
}
switch (cmd) {
case BINDER_WRITE_READ:
// 读写命令 --- 读写操作的时候，由应用层ioctl(BINDER_WRITE_READ)调用
ret = binder_ioctl_write_read(filp, cmd, arg, thread);
if (ret)
goto err;
break;
case BINDER_SET_MAX_THREADS:
if (copy_from_user(&proc->max_threads, ubuf, sizeof(proc->max_threads))) {
ret = -EINVAL;
goto err;
}
break;
case BINDER_SET_CONTEXT_MGR:
ret = binder_ioctl_set_ctx_mgr(filp);
if (ret)
goto err;
break;
case BINDER_THREAD_EXIT:
binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n",
proc->pid, thread->pid);
binder_free_thread(proc, thread);
thread = NULL;
break;
case BINDER_VERSION: {
struct binder_version __user *ver = ubuf;
if (size != sizeof(struct binder_version)) {
ret = -EINVAL;
goto err;
}
if (put_user(BINDER_CURRENT_PROTOCOL_VERSION,
&ver->protocol_version)) {
ret = -EINVAL;
goto err;
}
break;
}
default:
ret = -EINVAL;
goto err;
}
ret = 0;
err:
if (thread)
thread->looper &= ~BINDER_LOOPER_STATE_NEED_RETURN;
binder_unlock(__func__);
wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
if (ret && ret != -ERESTARTSYS)
pr_info("%d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret);
err_unlocked:
trace_binder_ioctl_done(ret);
return ret;
}
可以看到BINDER_SET_CONTEXT_MGR命令，主要就是调用了binder_ioctl_set_ctx_mgr方法
看kernel/drivers/staging/android/binder.c#binder_ioctl_set_ctx_mgr方法：
在这里就会创建了service_manager的实体，binder_new_node就是代表了service_manager服务
/**
* 只创建一次
*/
static int binder_ioctl_set_ctx_mgr(struct file *filp)
{
int ret = 0;
struct binder_proc *proc = filp->private_data;
struct binder_context *context = proc->context;
kuid_t curr_euid = current_euid();
// 判断是否存在，如果存在，则直接返回
if (context->binder_context_mgr_node) {
pr_err("BINDER_SET_CONTEXT_MGR already set\n");
ret = -EBUSY;
goto out;
}
ret = security_binder_set_context_mgr(proc->tsk);
if (ret < 0)
goto out;
// 这里第一次SM的uid是无效的
if (uid_valid(context->binder_context_mgr_uid)) {
if (!uid_eq(context->binder_context_mgr_uid, curr_euid)) {
pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n",
from_kuid(&init_user_ns, curr_euid),
from_kuid(&init_user_ns,
context->binder_context_mgr_uid));
ret = -EPERM;
goto out;
}
} else {
// 设置uid
context->binder_context_mgr_uid = curr_euid;
}
// 创建sm的实体，这里的binder_new_node创建的node其实就是代表了service_manager
// 会添加到proc->nodes中
// 并且会对这个node做初始化
// 不过最先会对这个node分配虚拟内存
// context中的binder_context_mgr_node就是代表了SM的实体
context->binder_context_mgr_node = binder_new_node(proc, 0, 0);
if (!context->binder_context_mgr_node) {
ret = -ENOMEM;
goto out;
}
context->binder_context_mgr_node->local_weak_refs++;
context->binder_context_mgr_node->local_strong_refs++;
context->binder_context_mgr_node->has_strong_ref = 1;
context->binder_context_mgr_node->has_weak_ref = 1;
out:
return ret;
}
在这里会创建了binder_node，这个binder_node其实就是SM实体，通过调用kernel/drivers/staging/android/binder.c#binder_new_node方法
/**
* 1.创建了binder_node结构体对象
* 2.proc --> binder_node
* 3.创建work和todo消息队列，分别由客户端和服务端进行不断的读取消息，
* 类似于Handler中的MessageQueue
*/
static struct binder_node *binder_new_node(struct binder_proc *proc,
binder_uintptr_t ptr,
binder_uintptr_t cookie)
{
struct rb_node **p = &proc->nodes.rb_node;
struct rb_node *parent = NULL;
struct binder_node *node;
while (*p) {
parent = *p;
node = rb_entry(parent, struct binder_node, rb_node);
if (ptr < node->ptr)
p = &(*p)->rb_left;
else if (ptr > node->ptr)
p = &(*p)->rb_right;
else
return NULL;
}
// 分配内存空间
node = kzalloc(sizeof(*node), GFP_KERNEL);
if (node == NULL)
return NULL;
binder_stats_created(BINDER_STAT_NODE);
rb_link_node(&node->rb_node, parent, p);
// 添加到proc->nodes中
rb_insert_color(&node->rb_node, &proc->nodes);
// 进行node初始化
node->debug_id = ++binder_last_id;
node->proc = proc;
node->ptr = ptr;
node->cookie = cookie;
node->work.type = BINDER_WORK_NODE;
// work和todo，这是客户端和服务端用来处理的消息队列
// 因为存在客户端和服务端，所以需要两个来不断的读取消息的消息队列
INIT_LIST_HEAD(&node->work.entry);
INIT_LIST_HEAD(&node->async_todo);
binder_debug(BINDER_DEBUG_INTERNAL_REFS,
"%d:%d node %d u%016llx c%016llx created\n",
proc->pid, current->pid, node->debug_id,
(u64)node->ptr, (u64)node->cookie);
return node;
}
4.native/cmds/servicemanager/binder.c#binder_loop
在native层的service_manager.c的main方法，创建驱动对象，并且调用binder_ioctl创建了service_manager服务之后，就会在native层的service_manager.c的main方法中调用binder_loop函数
最初始的时候，binder_loop方法，主要是做两个工作：
- 根据命令BC_ENTER_LOOPER，向thread_looper写入状态，为BINDER_LOOPER_STATE_ENTERED，即进入binder_looper
- 读取数据，首先修改thread->looper的状态为BINDER_LOOPER_STATE_WAITING，即进入等待状态，然后根据wait_for_proc_work=true，调用ret = wait_event_freezable_exclusive方法进入阻塞等待状态，等待需要处理的消息的进入
/**
* 循环处理数据的
*/
void binder_loop(struct binder_state *bs, binder_handler func)
{
int res;
// binder_write_read是在kernel层中的binder.h中定义的
struct binder_write_read bwr;
uint32_t readbuf[32];
bwr.write_size = 0;
bwr.write_consumed = 0;
bwr.write_buffer = 0;
// 进入BC_ENTER_LOOPER命令，进入循环
readbuf[0] = BC_ENTER_LOOPER;
// 将readbuf写入
// 这里是处理write
// 写入BC_ENTER_LOOPER命令，根据该命令设置thread->looper的状态
binder_write(bs, readbuf, sizeof(uint32_t));
// 无限死循环不断读取数据
for (;;) {
// 在进入for循环的时候，write_size最初是为0的
// 而read_size是不为0
bwr.read_size = sizeof(readbuf);
bwr.read_consumed = 0;
bwr.read_buffer = (uintptr_t) readbuf;
// 又是通过BINDER_WRITE_READ命令进行读写，进入kernel层的binder_ioctl方法
// 这里是处理read
res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
if (res < 0) {
ALOGE("binder_loop: ioctl failed (%s)\n", strerror(errno));
break;
}
res = binder_parse(bs, 0, (uintptr_t) readbuf, bwr.read_consumed, func);
if (res == 0) {
ALOGE("binder_loop: unexpected reply?!\n");
break;
}
if (res < 0) {
ALOGE("binder_loop: io error %d %s\n", res, strerror(errno));
break;
}
}
}
binder_write_read结构体
/*
* On 64-bit platforms where user code may run in 32-bits the driver must
* translate the buffer (and local binder) addresses appropriately.
*/
struct binder_write_read {
binder_size_t write_size; /* bytes to write */
binder_size_t write_consumed; /* bytes consumed by driver */
binder_uintptr_t write_buffer;
binder_size_t read_size; /* bytes to read */
binder_size_t read_consumed; /* bytes consumed by driver */
binder_uintptr_t read_buffer;
};
（1）写入BC_ENTER_LOOPER命令
在native/cmds/servicemanager/binder.c#binder_loop中调用binder_write写入readbuf数据，而readbuf中是只有一个命令数据。binder_write写入BC_ENTER_LOOPER命令的时候，就是将该命令数据保存在binder_write_read实体对象中的write_buffer中，然后调用驱动层的binder_ioctl函数，执行BINDER_WRITE_READ分支的功能，此时因为binder_write_read实体的write_buffer中有数据，所以会执行binder_ioctl函数的write功能。
/**
* 写数据
*/
int binder_write(struct binder_state *bs, void *data, size_t len)
{
struct binder_write_read bwr;
int res;
// 因为是写数据，所以write_size不为0
bwr.write_size = len;
bwr.write_consumed = 0;
// 这里的data其实就是readbuf命令数据，将命令数据保存在binder_write_read
// 这个结构体的对象的write_buffer中
bwr.write_buffer = (uintptr_t) data;
// 写数据，所以read部分的信息都是0
bwr.read_size = 0;
bwr.read_consumed = 0;
bwr.read_buffer = 0;
// 初始化binder_write_read之后，调用ioctl执行BINDER_WRITE_READ功能
// 这里就是调用了kernel层的binder_ioctl，触发调用BINDER_WRITE_READ部分功能
res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
if (res < 0) {
fprintf(stderr,"binder_write: ioctl failed (%s)\n",
strerror(errno));
}
return res;
}
在在native/cmds/servicemanager/binder.c#binder_write中调用了ioctl写入进入循环的命令，接着就会调用kernel层的binder.c#binder_ioctl方法，而触发的是BINDER_WRITE_READ分支，所以会最终调用了binder_ioctl_write_read方法
/**
* binder_ioctl
* 读写操作
*
*/
static int binder_ioctl_write_read(struct file *filp,
unsigned int cmd, unsigned long arg,
struct binder_thread *thread)
{
int ret = 0;
struct binder_proc *proc = filp->private_data;
unsigned int size = _IOC_SIZE(cmd);
void __user *ubuf = (void __user *)arg;
struct binder_write_read bwr;
if (size != sizeof(struct binder_write_read)) {
ret = -EINVAL;
goto out;
}
// 这里copy的不是有效数据，copy的是数据头。但是也是将用户空间的数据拷贝到内核空间
// 这里拷贝的依然是数据头，即readbuf[0] = BC_ENTER_LOOPER;这个数据的数据头
if (copy_from_user(&bwr, ubuf, sizeof(bwr))) {
ret = -EFAULT;
goto out;
}
binder_debug(BINDER_DEBUG_READ_WRITE,
"%d:%d write %lld at %016llx, read %lld at %016llx\n",
proc->pid, thread->pid,
(u64)bwr.write_size, (u64)bwr.write_buffer,
(u64)bwr.read_size, (u64)bwr.read_buffer);
// 判断写入数据是否有
// 这里的bwr其实就是在native/cmds/servicemanager/binder.c#binder_write
// 方法中初始化的binder_write_read结构体对象bwr
// 这里的bwr.buffer其实就是readbuf[0]=BC_ENTER_LOOPER
// write_size是大于0的
if (bwr.write_size > 0) {
// 这里就会处理命令，这里的命令是BC_ENTER_LOOPER
// 进入binder_thread_write方法中进行处理该命令
ret = binder_thread_write(proc, thread,
bwr.write_buffer,
bwr.write_size,
&bwr.write_consumed);
trace_binder_write_done(ret);
if (ret < 0) {
bwr.read_consumed = 0;
if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
ret = -EFAULT;
goto out;
}
}
// 判断读的数据是否有
if (bwr.read_size > 0) {
ret = binder_thread_read(proc, thread, bwr.read_buffer,
bwr.read_size,
&bwr.read_consumed,
filp->f_flags & O_NONBLOCK);
trace_binder_read_done(ret);
if (!list_empty(&proc->todo))
wake_up_interruptible(&proc->wait);
if (ret < 0) {
if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
ret = -EFAULT;
goto out;
}
}
binder_debug(BINDER_DEBUG_READ_WRITE,
"%d:%d wrote %lld of %lld, read return %lld of %lld\n",
proc->pid, thread->pid,
(u64)bwr.write_consumed, (u64)bwr.write_size,
(u64)bwr.read_consumed, (u64)bwr.read_size);
// 把内核空间的数据拷贝到用户空间
if (copy_to_user(ubuf, &bwr, sizeof(bwr))) {
ret = -EFAULT;
goto out;
}
out:
return ret;
}
因为在binder_loop流程中，首先是需要写入BC_ENTER_LOOPER命令，所以binder_write_read实体的write_buffer有值，并且write_size>0，所以在驱动层binder.c的binder_ioctl_write_read函数中，会调用bwr.write_size>0的if条件，即调用到了binder_thread_write函数
在kernel/drivers/staging/android/binder.c中的binder_thread_write方法中进行处理BC_ENTER_LOOPER命令，主要处理代码如下：
这里其实就是设置了thread->looper的状态
case BC_ENTER_LOOPER:
binder_debug(BINDER_DEBUG_THREADS,
"%d:%d BC_ENTER_LOOPER\n",
proc->pid, thread->pid);
if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) {
thread->looper |= BINDER_LOOPER_STATE_INVALID;
binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n",
proc->pid, thread->pid);
}
thread->looper |= BINDER_LOOPER_STATE_ENTERED;
break;
（2）处理BC_ENTER_LOOPER命令
写入操作完成之后，在native/cmds/servicemanager/binder.c#binder_loop方法中的for循环，会循环调用ioctl，这里就是对binder_write_read的read数据做初始化，去读取BC_ENTER_LOOPER命令数据，然后调用ioctl的BINDER_WRITE_READ指令操作，这里因为对binder_write_read的read数据做了初始，read_size>0，而write_size不是大于0，所以会调用到kernel/drivers/staging/android/binder.c中的binder_ioctl，最终根据BINDER_WRITE_READ指令调用到了binder_ioctl_write_read方法，又因为read_size>0，所以最终调用到了binder_thread_read方法
/**
* binder_ioctl
* 读写操作
*
*/
static int binder_ioctl_write_read(struct file *filp,
unsigned int cmd, unsigned long arg,
struct binder_thread *thread)
{
int ret = 0;
struct binder_proc *proc = filp->private_data;
unsigned int size = _IOC_SIZE(cmd);
void __user *ubuf = (void __user *)arg;
struct binder_write_read bwr;
if (size != sizeof(struct binder_write_read)) {
ret = -EINVAL;
goto out;
}
// 这里copy的不是有效数据，copy的是数据头。但是也是将用户空间的数据拷贝到内核空间
if (copy_from_user(&bwr, ubuf, sizeof(bwr))) {
ret = -EFAULT;
goto out;
}
binder_debug(BINDER_DEBUG_READ_WRITE,
"%d:%d write %lld at %016llx, read %lld at %016llx\n",
proc->pid, thread->pid,
(u64)bwr.write_size, (u64)bwr.write_buffer,
(u64)bwr.read_size, (u64)bwr.read_buffer);
// 判断写入数据是否有
if (bwr.write_size > 0) {
ret = binder_thread_write(proc, thread,
bwr.write_buffer,
bwr.write_size,
&bwr.write_consumed);
trace_binder_write_done(ret);
if (ret < 0) {
bwr.read_consumed = 0;
if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
ret = -EFAULT;
goto out;
}
}
// 判断读的数据是否有，在native/cmds/servicemanager/binder.c中的binder_loop方法中
// for循环的read数据不为0，read_size>0，调用kernel层的binder_ioctl
// 进而根据BINDER_WRITE_READ调用此方法，根据read_size>0调用这里
if (bwr.read_size > 0) {
ret = binder_thread_read(proc, thread, bwr.read_buffer,
bwr.read_size,
&bwr.read_consumed,
filp->f_flags & O_NONBLOCK);
trace_binder_read_done(ret);
if (!list_empty(&proc->todo))
wake_up_interruptible(&proc->wait);
if (ret < 0) {
if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
ret = -EFAULT;
goto out;
}
}
binder_debug(BINDER_DEBUG_READ_WRITE,
"%d:%d wrote %lld of %lld, read return %lld of %lld\n",
proc->pid, thread->pid,
(u64)bwr.write_consumed, (u64)bwr.write_size,
(u64)bwr.read_consumed, (u64)bwr.read_size);
// 把内核空间的数据拷贝到用户空间
if (copy_to_user(ubuf, &bwr, sizeof(bwr))) {
ret = -EFAULT;
goto out;
}
out:
return ret;
}
接着调用binder_thread_read方法，进入处理BC_ENTER_LOOPER命令的过程，让SM进入等待状态，进行阻塞，等待消息的进入。
在执行到ret = wait_event_freezable_exclusive(proc->wait, binder_has_proc_work(proc, thread));的时候，service_manager服务就进入阻塞，等待消息的进入。
/**
* 这里wait_for_proc_work=true
* 而会调用ret = wait_event_freezable_exclusive方法，SM进入阻塞状态
*/
static int binder_thread_read(struct binder_proc *proc,
struct binder_thread *thread,
binder_uintptr_t binder_buffer, size_t size,
binder_size_t *consumed, int non_block)
{
// 这里的buffer其实就是bwr中的read_buffer
void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
void __user *ptr = buffer + *consumed;
void __user *end = buffer + size;
int ret = 0;
int wait_for_proc_work;
// 这里的read_consumed是为0的
if (*consumed == 0) {
// 如果是从native层的binder.c中的binder_loop方法调用binder_ioctl
// 这里的ptr就是在binder_loop调用ioctl传入的bwr
// ptr中其实是有很多个命令的，以先入先出的原则，先进入的命令先处理
if (put_user(BR_NOOP, (uint32_t __user *)ptr))
return -EFAULT;
ptr += sizeof(uint32_t);
}
retry:
// wait_for_proc_work这里是为true
// 因为两个条件都满足为null
wait_for_proc_work = thread->transaction_stack == NULL &&
list_empty(&thread->todo);
if (thread->return_error != BR_OK && ptr < end) {
if (thread->return_error2 != BR_OK) {
if (put_user(thread->return_error2, (uint32_t __user *)ptr))
return -EFAULT;
ptr += sizeof(uint32_t);
binder_stat_br(proc, thread, thread->return_error2);
if (ptr == end)
goto done;
thread->return_error2 = BR_OK;
}
if (put_user(thread->return_error, (uint32_t __user *)ptr))
return -EFAULT;
ptr += sizeof(uint32_t);
binder_stat_br(proc, thread, thread->return_error);
thread->return_error = BR_OK;
goto done;
}
thread->looper |= BINDER_LOOPER_STATE_WAITING;
// 这里进行已经准备好的线程++，后面就会--
// 这里++是告诉binder已经service_manager已经准备好
// 已经在等待消息的进入，而如果SM在处理消息，则会ready_threads--，表示正在处理消息
if (wait_for_proc_work)
proc->ready_threads++;
binder_unlock(__func__);
trace_binder_wait_for_work(wait_for_proc_work,
!!thread->transaction_stack,
!list_empty(&thread->todo));
if (wait_for_proc_work) {
if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
BINDER_LOOPER_STATE_ENTERED))) {
binder_user_error("%d:%d ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state %x)\n",
proc->pid, thread->pid, thread->looper);
wait_event_interruptible(binder_user_error_wait,
binder_stop_on_user_error < 2);
}
binder_set_nice(proc->default_priority);
// sm进入的时候，这里是阻塞的，所以non_block是false
if (non_block) {
if (!binder_has_proc_work(proc, thread))
ret = -EAGAIN;
} else
ret = wait_event_freezable_exclusive(proc->wait, binder_has_proc_work(proc, thread));// 这里就是进行一个等待，因为没有数据
} else {
if (non_block) {
if (!binder_has_thread_work(thread))
ret = -EAGAIN;
} else
ret = wait_event_freezable(thread->wait, binder_has_thread_work(thread));
}
binder_lock(__func__);
if (wait_for_proc_work)
proc->ready_threads--;
thread->looper &= ~BINDER_LOOPER_STATE_WAITING;
if (ret)
return ret;
while (1) {
uint32_t cmd;
struct binder_transaction_data tr;
struct binder_work *w;
struct binder_transaction *t = NULL;
if (!list_empty(&thread->todo)) {
w = list_first_entry(&thread->todo, struct binder_work,
entry);
} else if (!list_empty(&proc->todo) && wait_for_proc_work) {
w = list_first_entry(&proc->todo, struct binder_work,
entry);
} else {
/* no data added */
if (ptr - buffer == 4 &&
!(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN))
goto retry;
break;
}
if (end - ptr < sizeof(tr) + 4)
break;
switch (w->type) {
case BINDER_WORK_TRANSACTION: {
t = container_of(w, struct binder_transaction, work);
} break;
case BINDER_WORK_TRANSACTION_COMPLETE: {
cmd = BR_TRANSACTION_COMPLETE;
if (put_user(cmd, (uint32_t __user *)ptr))
return -EFAULT;
ptr += sizeof(uint32_t);
binder_stat_br(proc, thread, cmd);
binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE,
"%d:%d BR_TRANSACTION_COMPLETE\n",
proc->pid, thread->pid);
list_del(&w->entry);
kfree(w);
binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
} break;
case BINDER_WORK_NODE: {
struct binder_node *node = container_of(w, struct binder_node, work);
uint32_t cmd = BR_NOOP;
const char *cmd_name;
int strong = node->internal_strong_refs || node->local_strong_refs;
int weak = !hlist_empty(&node->refs) || node->local_weak_refs || strong;
if (weak && !node->has_weak_ref) {
cmd = BR_INCREFS;
cmd_name = "BR_INCREFS";
node->has_weak_ref = 1;
node->pending_weak_ref = 1;
node->local_weak_refs++;
} else if (strong && !node->has_strong_ref) {
cmd = BR_ACQUIRE;
cmd_name = "BR_ACQUIRE";
node->has_strong_ref = 1;
node->pending_strong_ref = 1;
node->local_strong_refs++;
} else if (!strong && node->has_strong_ref) {
cmd = BR_RELEASE;
cmd_name = "BR_RELEASE";
node->has_strong_ref = 0;
} else if (!weak && node->has_weak_ref) {
cmd = BR_DECREFS;
cmd_name = "BR_DECREFS";
node->has_weak_ref = 0;
}
if (cmd != BR_NOOP) {
if (put_user(cmd, (uint32_t __user *)ptr))
return -EFAULT;
ptr += sizeof(uint32_t);
if (put_user(node->ptr,
(binder_uintptr_t __user *)ptr))
return -EFAULT;
ptr += sizeof(binder_uintptr_t);
if (put_user(node->cookie,
(binder_uintptr_t __user *)ptr))
return -EFAULT;
ptr += sizeof(binder_uintptr_t);
binder_stat_br(proc, thread, cmd);
binder_debug(BINDER_DEBUG_USER_REFS,
"%d:%d %s %d u%016llx c%016llx\n",
proc->pid, thread->pid, cmd_name,
node->debug_id,
(u64)node->ptr, (u64)node->cookie);
} else {
list_del_init(&w->entry);
if (!weak && !strong) {
binder_debug(BINDER_DEBUG_INTERNAL_REFS,
"%d:%d node %d u%016llx c%016llx deleted\n",
proc->pid, thread->pid,
node->debug_id,
(u64)node->ptr,
(u64)node->cookie);
rb_erase(&node->rb_node, &proc->nodes);
kfree(node);
binder_stats_deleted(BINDER_STAT_NODE);
} else {
binder_debug(BINDER_DEBUG_INTERNAL_REFS,
"%d:%d node %d u%016llx c%016llx state unchanged\n",
proc->pid, thread->pid,
node->debug_id,
(u64)node->ptr,
(u64)node->cookie);
}
}
} break;
case BINDER_WORK_DEAD_BINDER:
case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
struct binder_ref_death *death;
uint32_t cmd;
death = container_of(w, struct binder_ref_death, work);
if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION)
cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE;
else
cmd = BR_DEAD_BINDER;
if (put_user(cmd, (uint32_t __user *)ptr))
return -EFAULT;
ptr += sizeof(uint32_t);
if (put_user(death->cookie,
(binder_uintptr_t __user *)ptr))
return -EFAULT;
ptr += sizeof(binder_uintptr_t);
binder_stat_br(proc, thread, cmd);
binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
"%d:%d %s %016llx\n",
proc->pid, thread->pid,
cmd == BR_DEAD_BINDER ?
"BR_DEAD_BINDER" :
"BR_CLEAR_DEATH_NOTIFICATION_DONE",
(u64)death->cookie);
if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) {
list_del(&w->entry);
kfree(death);
binder_stats_deleted(BINDER_STAT_DEATH);
} else
list_move(&w->entry, &proc->delivered_death);
if (cmd == BR_DEAD_BINDER)
goto done; /* DEAD_BINDER notifications can cause transactions */
} break;
}
if (!t)
continue;
BUG_ON(t->buffer == NULL);
if (t->buffer->target_node) {
struct binder_node *target_node = t->buffer->target_node;
tr.target.ptr = target_node->ptr;
tr.cookie = target_node->cookie;
t->saved_priority = task_nice(current);
if (t->priority < target_node->min_priority &&
!(t->flags & TF_ONE_WAY))
binder_set_nice(t->priority);
else if (!(t->flags & TF_ONE_WAY) ||
t->saved_priority > target_node->min_priority)
binder_set_nice(target_node->min_priority);
cmd = BR_TRANSACTION;
} else {
tr.target.ptr = 0;
tr.cookie = 0;
cmd = BR_REPLY;
}
tr.code = t->code;
tr.flags = t->flags;
tr.sender_euid = from_kuid(current_user_ns(), t->sender_euid);
if (t->from) {
struct task_struct *sender = t->from->proc->tsk;
tr.sender_pid = task_tgid_nr_ns(sender,
task_active_pid_ns(current));
} else {
tr.sender_pid = 0;
}
tr.data_size = t->buffer->data_size;
tr.offsets_size = t->buffer->offsets_size;
tr.data.ptr.buffer = (binder_uintptr_t)(
(uintptr_t)t->buffer->data +
proc->user_buffer_offset);
tr.data.ptr.offsets = tr.data.ptr.buffer +
ALIGN(t->buffer->data_size,
sizeof(void *));
if (put_user(cmd, (uint32_t __user *)ptr))
return -EFAULT;
ptr += sizeof(uint32_t);
if (copy_to_user(ptr, &tr, sizeof(tr)))
return -EFAULT;
ptr += sizeof(tr);
trace_binder_transaction_received(t);
binder_stat_br(proc, thread, cmd);
binder_debug(BINDER_DEBUG_TRANSACTION,
"%d:%d %s %d %d:%d, cmd %d size %zd-%zd ptr %016llx-%016llx\n",
proc->pid, thread->pid,
(cmd == BR_TRANSACTION) ? "BR_TRANSACTION" :
"BR_REPLY",
t->debug_id, t->from ? t->from->proc->pid : 0,
t->from ? t->from->pid : 0, cmd,
t->buffer->data_size, t->buffer->offsets_size,
(u64)tr.data.ptr.buffer, (u64)tr.data.ptr.offsets);
list_del(&t->work.entry);
t->buffer->allow_user_free = 1;
if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) {
t->to_parent = thread->transaction_stack;
t->to_thread = thread;
thread->transaction_stack = t;
} else {
t->buffer->transaction = NULL;
kfree(t);
binder_stats_deleted(BINDER_STAT_TRANSACTION);
}
break;
}
done:
*consumed = ptr - buffer;
if (proc->requested_threads + proc->ready_threads == 0 &&
proc->requested_threads_started < proc->max_threads &&
(thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */
/*spawn a new thread if we leave this out */) {
proc->requested_threads++;
binder_debug(BINDER_DEBUG_THREADS,
"%d:%d BR_SPAWN_LOOPER\n",
proc->pid, thread->pid);
if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer))
return -EFAULT;
binder_stat_br(proc, thread, BR_SPAWN_LOOPER);
}
return 0;
}
二、如何获取service_manager服务
主要是native层。native/cmds/libs/binder/下
IServiceManager.cpp中的defaultServiceManager方法
获取sm的情况：
- 注册服务到sm -- native
- 通过sm获取服务 -- java
java层：ServiceManagerProxy->BinderProxy->BpBinder（java层获取SM）
java层，比如AIDL中，其Proxy代理类中，会有一个mRemote，这个mRemote其实就是BinderProxy，而BinderProxy这个代理类其实在native就是调用BpBinder，而这里的BpBinder其实就是客户端的SM代理，用来代理服务端的BBinder，而服务端的BBinder其实就可以认为是SM
native层：BpServiceManager->BpBinder（native获取sm）
1.frameworks/native/libs/binder/IServiceManager.cpp#defaultServiceManager()
这里主要分析defaultServiceManager中调用的三个部分：
- （1）ProcessState::self()
- （2）getContextObject(NULL)
- （3）interface_cast<IServiceManager>
sp<IServiceManager> defaultServiceManager()
{
if (gDefaultServiceManager != NULL) return gDefaultServiceManager;
{
AutoMutex _l(gDefaultServiceManagerLock);
// 这里的while循环，就是为了防止SM还没有注册，或者是正在注册但是未注册完成
// 这样的情况下，进入循环的进入睡眠状态进行等待SM注册完成
while (gDefaultServiceManager == NULL) {
// ProcessState::self()->getContextObject(NULL)返回的其实就是BpBinder对象，
// BpBinder其实就是执行服务端的
// BBinder是服务端的对象，而BpBinder可以认为是BBinder的代理
// 这里就可以把BpBinder认为是SM的代理，而BBinder认为是SM
// 因为客户端没有办法拿到BBinder（sm），而客户端可以创建BpBinder
// 可以认为BpBinder是BBinder的代理（sm的代理），客户端就可以通过BpBinder操作BBinder
// 即通过sm代理跨进程远程操作sm进程
gDefaultServiceManager = interface_cast<IServiceManager>(
ProcessState::self()->getContextObject(NULL));
// 如果没有获取到，则睡眠
if (gDefaultServiceManager == NULL)
sleep(1);
}
}
return gDefaultServiceManager;
}
2.frameworks/native/libs/binder/ProcessState.cpp#self()
这里主要就是处理ProcessState，new了一个ProcessState对象。
而ProcessState::self()其实就是创建进程对象，然后通过ProcessState的getContextObject函数获取到对应的BpBinder对象，用BpBinder对象与服务端的BBinder进行通信。而在这里，就会创建对应的内存大小，这里其实就是native层对binder的内存大小限制，这里限制的大小就是1M-8K。就是10241024-(40962)
new ProcessState做的事情：
- 打开驱动 -- 调用open_driver，设置最大线程数为15
- mmap -- 将设置ProcessState内存大小，并且与Binder驱动做内存映射
// 在IServiceManager.cpp中的defaultServiceManager中调用
sp<ProcessState> ProcessState::self()
{
Mutex::Autolock _l(gProcessMutex);
if (gProcess != NULL) {
return gProcess;
}
gProcess = new ProcessState;
return gProcess;
}
看ProcessState在new的时候做了什么操作：
ProcessState::ProcessState()
: mDriverFD(open_driver())// 打开设备（其实就是binder）
, mVMStart(MAP_FAILED)
, mThreadCountLock(PTHREAD_MUTEX_INITIALIZER)
, mThreadCountDecrement(PTHREAD_COND_INITIALIZER)
, mExecutingThreadsCount(0)
, mMaxThreads(DEFAULT_MAX_BINDER_THREADS)// 最大线程数 -- 15个
, mManagesContexts(false)
, mBinderContextCheckFunc(NULL)
, mBinderContextUserData(NULL)
, mThreadPoolStarted(false)
, mThreadPoolSeq(1)
{
if (mDriverFD >= 0) {
// XXX Ideally, there should be a specific define for whether we
// have mmap (or whether we could possibly have the kernel module
// availabla).
#if !defined(HAVE_WIN32_IPC)
// mmap the binder, providing a chunk of virtual address space to receive transactions.
// 这里是注册服务到SM中 -- ProcessState也是服务端
// 这里就是设置ProcessState与binder驱动的内存映射
// 通过mmap设置共享内存（binder和服务端之间的内存大小），大小是((1*1024*1024) - (4096 *2))=1M-8K
// 这是普通服务的内存大小
// #define BINDER_VM_SIZE ((1*1024*1024) - (4096 *2))
mVMStart = mmap(0, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
if (mVMStart == MAP_FAILED) {
// *sigh*
ALOGE("Using /dev/binder failed: unable to mmap transaction memory.\n");
close(mDriverFD);
mDriverFD = -1;
}
#else
mDriverFD = -1;
#endif
}
LOG_ALWAYS_FATAL_IF(mDriverFD < 0, "Binder driver could not be opened. Terminating.");
}
（1）打开binder驱动 -- 设置最大线程数（默认最大线程数15）
// 打开设备（其实就是打开binder驱动）
static int open_driver()
{
// 打开binder驱动，这里就是调用了kernel层的binder_open方法
int fd = open("/dev/binder", O_RDWR);
if (fd >= 0) {
fcntl(fd, F_SETFD, FD_CLOEXEC);
int vers = 0;
status_t result = ioctl(fd, BINDER_VERSION, &vers);
if (result == -1) {
ALOGE("Binder ioctl to obtain version failed: %s", strerror(errno));
close(fd);
fd = -1;
}
if (result != 0 || vers != BINDER_CURRENT_PROTOCOL_VERSION) {
ALOGE("Binder driver protocol does not match user space protocol!");
close(fd);
fd = -1;
}
// 设置最大线程数 -- 15个
size_t maxThreads = DEFAULT_MAX_BINDER_THREADS;
// 这里就是将最大线程数写入，具体实现设置的功能
result = ioctl(fd, BINDER_SET_MAX_THREADS, &maxThreads);
if (result == -1) {
ALOGE("Binder ioctl to set max threads failed: %s", strerror(errno));
}
} else {
ALOGW("Opening '/dev/binder' failed: %s\n", strerror(errno));
}
return fd;
}
3.frameworks/native/libs/binder/ProcessState.cpp#getContextObject
这里通过调用getStrongProxyForHandle方法，传入handle=0
getContextObject做的事情：
- 创建一个BpBinder --- 这是客户端的对象，是服务端的BBinder的代理类，服务端的BBinder其实就是SM（service_manager服务）
其实BpBinder就相当于service_manager的引用，是相对于服务端的BBinder，服务端的BBinder其实就是相当于service_manager的引用，而客户端的BpBinder就是相当于服务端BBinder的代理，客户端使用SM的时候，其实就是通过BpBinder来使用SM，而BpBinder使用其内部具体是依赖于服务端的BBinder来使用SM。
可以根据Java层的来看：
Java层操作ServiceManager，在低版本中使用类似AIDL的方式，而在高版本系统是直接使用AIDL的方式。而AIDL在编译完成之后，会有对应的Java代码，即对应的实现了android.os.IInterface接口的interface，在这个interface中会有一个内部抽象类Stub，而在Stub中会有一个Proxy(其实Proxy可以不需要在Stub中)，这个Proxy就是interface的实现类。
比如ServiceManager相关的ServiceManagerProxy可以认为是AIDL中的Proxy，而在Proxy中会通过操作mRemote来进行跨进程，而mRemote就是一个IBinder，而mRemote的值其实在ServiceManagerProxy中就是BinderProxy，而BinderProxy就是代理了native层的BpBinder，而BpBinder其实就是客户端在native层的对于服务端BBinder的代理，服务端的BBinder其实就是SM（service_manager）
ServiceManagerProxy-->BinderProxy-->BpBinder
从native层来看：
native层操作ServiceManager是通过BpServiceManager操作BpBinder。
BpServiceManager-->BpBinder
操作ServiceManager，Java层和native层最终都是通过BpBinder来操作，最终都是由BpBinder进行transact操作，因为BpBinder其实是BBinder的代理，类似于上面的Proxy的方式，BpBinder会代理一个BBinder对象，通过BpBinder的transact之后调用到BBinder对象的transact之后，然后调用到BBinder的onTransact，这样就进行了跨进程，从客户端跨越到了服务端。
因为客户端是需要跨进程，客户端部分是没有真正的SM的，而服务端的SM，其实就是BBinder，客户端是通过BBinder的代理，即BpBinder来实现对SM的调用。
sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& /*caller*/)
{
return getStrongProxyForHandle(0);
}
sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle)
{
sp<IBinder> result;
AutoMutex _l(mLock);
// 查找handle对应的资源线，获取handle_entry结构体对象
handle_entry* e = lookupHandleLocked(handle);
// 这个e不为null
if (e != NULL) {
// We need to create a new BpBinder if there isn't currently one, OR we
// are unable to acquire a weak reference on this current one. See comment
// in getWeakProxyForHandle() for more info about this.
// 获取handle_entry中的binder对象
IBinder* b = e->binder;
// 查看弱引用是否存在（当前是不存在的）
if (b == NULL || !e->refs->attemptIncWeak(this)) {
// handle为0
if (handle == 0) {
// Special case for context manager...
// The context manager is the only object for which we create
// a BpBinder proxy without already holding a reference.
// Perform a dummy transaction to ensure the context manager
// is registered before we create the first local reference
// to it (which will occur when creating the BpBinder).
// If a local reference is created for the BpBinder when the
// context manager is not present, the driver will fail to
// provide a reference to the context manager, but the
// driver API does not return status.
//
// Note that this is not race-free if the context manager
// dies while this code runs.
//
// TODO: add a driver API to wait for context manager, or
// stop special casing handle 0 for context manager and add
// a driver API to get a handle to the context manager with
// proper reference counting.
// 这里就是测试binder是否准备就绪
// 通过PING命令测试
Parcel data;
status_t status = IPCThreadState::self()->transact(
0, IBinder::PING_TRANSACTION, data, NULL, 0);
if (status == DEAD_OBJECT)
return NULL;
}
// 创建了BpBinder，里面调用incWeakHandle，会进行弱引用计数
b = new BpBinder(handle);
e->binder = b;
if (b) e->refs = b->getWeakRefs();
result = b;
} else {
// This little bit of nastyness is to allow us to add a primary
// reference to the remote proxy when this team doesn't have one
// but another team is sending the handle to us.
result.force_set(b);
e->refs->decWeak(this);
}
}
// 返回BpBinder
return result;
}
4.frameworks/native/include/binder/IInterface.h#interface_cast
interface_cast主要是：
- 根据上面创建的BpBinder对象创建了BpServiceManager(BpBinder)对象，BpServiceManager对象中会有一个mRemote
- 通过mRemote.transact进行远程调用
- mRemote其实就是BpBinder，而BpBinder是客户端的，是服务端的BBinder的代理类，调用BpBinder其实就是调用了BBinder，然后进而调用了BBinder的onTransact，这样实现了跨进程调用SM
这里使用的是一个模板方法，具体的模板实现就是在IInterface.h中定义的。而asInterface就是在IInterface.h通过#define宏定义进行展开
template<typename INTERFACE>
// 这里的obj其实就是BpBinder
inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj)
{
// 这里的INTERFACE可以认为是泛型，就是将IServiceManager替换INTERFACE
return INTERFACE::asInterface(obj);
}
宏定义，定义了asInterface方法，而这里的就是需要把INTERFACE替换成IServiceManager
#define DECLARE_META_INTERFACE(INTERFACE)
static const android::String16 descriptor;
static android::sp<I##INTERFACE> asInterface(
const android::sp<android::IBinder>& obj);
virtual const android::String16& getInterfaceDescriptor() const;
I##INTERFACE();
virtual ~I##INTERFACE();
#define IMPLEMENT_META_INTERFACE(INTERFACE, NAME)
const android::String16 I##INTERFACE::descriptor(NAME);
const android::String16&
I##INTERFACE::getInterfaceDescriptor() const {
return I##INTERFACE::descriptor;
}
android::sp<I##INTERFACE> I##INTERFACE::asInterface(
const android::sp<android::IBinder>& obj)
{
android::sp<I##INTERFACE> intr;
if (obj != NULL) {
intr = static_cast<I##INTERFACE*>(
obj->queryLocalInterface(
I##INTERFACE::descriptor).get());
if (intr == NULL) {
intr = new Bp##INTERFACE(obj);
}
}
return intr;
}
I##INTERFACE::I##INTERFACE() { }
I##INTERFACE::~I##INTERFACE() { }
针对DECLARE_META_INTERFACE部分做替换展开
DECLARE_META_INTERFACE部分主要是声明asInterface和getInterfaceDescriptor方法的
static const android::String16 descriptor;
static android::sp< IServiceManager > asInterface(const
android::sp<android::IBinder>& obj)
virtual const android::String16& getInterfaceDescriptor() const;
IServiceManager ();
virtual ~IServiceManager();
针对IMPLEMENT_META_INTERFACE部分做替换展开
这部分是asInterface和getInterfaceDescriptor方法的具体实现
const android::String16
IServiceManager::descriptor(“android.os.IServiceManager”);
const android::String16& IServiceManager::getInterfaceDescriptor() const
{
return IServiceManager::descriptor;
}
// 这里的obj其实就是BpBinder
android::sp<IServiceManager> IServiceManager::asInterface(const
android::sp<android::IBinder>& obj)
{
android::sp<IServiceManager> intr;
if(obj != NULL) {
intr = static_cast<IServiceManager *>(
obj->queryLocalInterface(IServiceManager::descriptor).get());
if (intr == NULL) {
// 等价于 new BpServiceManager(BpBinder)
// BpServiceManager是在IServiceManager的内部类
intr = new BpServiceManager(obj);
}
}
return intr;
}
IServiceManager::IServiceManager () { }
IServiceManager::~ IServiceManager() { }
调用asInterface之后，其内部会new BpServiceManager，在new BpServiceManager的时候，会传入BpBinder对象。
BpServiceManager(const sp<IBinder>& impl)
: BpInterface<IServiceManager>(impl)
{
}
template<typename INTERFACE>
// 调用了BpRefBase，这里的remote其实就是BpBinder
inline BpInterface<INTERFACE>::BpInterface(const sp<IBinder>& remote)
: BpRefBase(remote)
{
}
而BpInterface是实现了frameworks/native/libs/binder/Binder.cpp中的
BpRefBase::BpRefBase(const sp<IBinder>& o)
: mRemote(o.get()), mRefs(NULL), mState(0)
{
extendObjectLifetime(OBJECT_LIFETIME_WEAK);
if (mRemote) {
mRemote->incStrong(this); // Removed on first IncStrong().
mRefs = mRemote->createWeak(this); // Held for our entire lifetime.
}
}
这里的o其实还是BpBinder
而这里又有mRemote，说明BpServiceManager中也会有一个mRemote，这个mRemote是对BpBinder的封装，而调用mRemote.transact的时候，其实就是调用了BpBinder.transact，而BpBinder又是BBinder的代理，所以就是调用了BBinder.transact，这样就跨进程调用。
