Android_Binder—BnServiceManager的作用

原创

已于 2022-07-18 22:57:52 修改 · 674 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#android

于 2022-07-15 18:32:27 首次发布

本文详细介绍了Android系统中ServiceManager如何初始化并注册到Binder驱动的过程，包括打开Binder设备、成为Context Manager和开启消息轮询。ServiceManager主要负责系统服务的管理和权限控制，如添加、检查和获取服务。

前文：Android_Binder—分析MediaServer解析服务的初始化和注册

前文介绍了服务怎么去向BPServiceManager注册自己，BPServiceManager是一个handle值为0的BPBinder封装而成的。BPServiceManager是客户端，所以说还有服务端即BnServiceManager来获取Binder设备的这些请求数据。

\frameworks\native\cmds\servicemanager\service_manager.c

int main(int argc, char** argv)
{
    struct binder_state *bs;
    union selinux_callback cb;
    char *driver;
    if (argc > 1) {
        driver = argv[1];
    } else {
        driver = "/dev/binder";
    }
    bs = binder_open(driver, 128*1024);
    ......
    if (binder_become_context_manager(bs)) {
        ALOGE("cannot become context manager (%s)\n", strerror(errno));
        return -1;
    }
    ......
    binder_loop(bs, svcmgr_handler);
    return 0;
}

service_manager主要做了三件事：

binder_open打开Binder设备
binder_become_context_manager成为manager
binder_loop开启轮询

1.binder_open

\frameworks\native\cmds\servicemanager\binder.c

struct binder_state *binder_open(const char* driver, size_t mapsize)
{
    struct binder_state *bs;
    struct binder_version vers;
    ....
    bs->fd = open(driver, O_RDWR | O_CLOEXEC);
    if ((ioctl(bs->fd, BINDER_VERSION, &vers) == -1) ||
        (vers.protocol_version != BINDER_CURRENT_PROTOCOL_VERSION)) {
        goto fail_open;
    }
    bs->mapsize = mapsize;
    bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);
    ....
    return bs;
}

可以看到跟ProcessState一样，去打开Binder并向Binder驱动申请一块(1M-8K)的虚拟地址空间来接收事务。

2.binder_become_context_manager

\frameworks\native\cmds\servicemanager\binder.c

int binder_become_context_manager(struct binder_state *bs)
{
    struct flat_binder_object obj;
    memset(&obj, 0, sizeof(obj));
    obj.flags = FLAT_BINDER_FLAG_TXN_SECURITY_CTX;

    int result = ioctl(bs->fd, BINDER_SET_CONTEXT_MGR_EXT, &obj);

    // fallback to original method
    if (result != 0) {
        android_errorWriteLog(0x534e4554, "121035042");

        result = ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);
    }
    return result;
}

主要内容就一句

result = ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);

注意这里传了个0

3.binder_loop开启轮询

\frameworks\native\cmds\servicemanager\binder.c

void binder_loop(struct binder_state *bs, binder_handler func)
{
    int res;
    struct binder_write_read bwr;
    uint32_t readbuf[32];

    bwr.write_size = 0;
    bwr.write_consumed = 0;
    bwr.write_buffer = 0;

    readbuf[0] = BC_EN

最低0.47元/天解锁文章