ServiceManager启动分析
简述： ServiceManager是一个全局的manager、调用了Jni函数，实现addServicew getService checkService listService等函数， Server进程先注册一些service到SercviceManager中。 Client想获得一些service，就要到Service中去获取该Service。 这样，Server和Client之间就可以进行通讯了， Server和Client之间的通讯都是通过Binder进行的。 三步走： 1.初始化Binder通讯环境，打开Binder设备，并映射内存。 2.注册自身为上下文管理者（context_manager） 3.进入无限循环的looping！！！ 详细过程： 1 ，启动入口一个标准的main函数！
文章图片

int main(int argc, char **argv) { //记录serviceManager的状态 struct binder_state *bs; void *svcmgr = BINDER_SERVICE_MANAGER; //用于打开binder设备 用于打开设备 后把设备映射到内存时申请的内存大小128*1024 bs = binder_open(128*1024); //注册自身为上下文管理者（context_manager） if (binder_become_context_manager(bs)) { ALOGE("cannot become context manager (%s)\n", strerror(errno)); return -1; }svcmgr_handle = svcmgr; //loop无线循环，等待接收IPC同请求 binder_loop(bs, svcmgr_handler); return 0; }

文章图片

2 bind_open函数。用来打开binder设备。 call by1

文章图片

struct binder_state *binder_open(unsigned mapsize) { struct binder_state *bs; bs = malloc(sizeof(*bs)); if (!bs) { errno = ENOMEM; return 0; }bs->fd = open("/dev/binder", O_RDWR); //打开binder设备 if (bs->fd < 0) { fprintf(stderr,"binder: cannot open device (%s)\n", strerror(errno)); goto fail_open; }bs->mapsize = mapsize; //bs是用来保存open 和mmap的返回信息 bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0); //进行内存映射，返回的映射区的起始地址给bs->mapped if (bs->mapped == MAP_FAILED) {//映射失败吹里逻辑 fprintf(stderr,"binder: cannot map device (%s)\n", strerror(errno)); goto fail_map; }/* TODO: check version */return bs; fail_map://映射失败的 goto处。 close(bs->fd); fail_open://打开设备失败的goto处。 free(bs); return 0;

文章图片

3.设置上下文Manager call by1

int binder_become_context_manager(struct binder_state *bs) { return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0); //直接用ioctl函数（ 提供了一种获得设备信息和向设备发送控制参数的手段）来让设备Binder设置上下文 }

4.进入loop。 call by 1
文章图片

void binder_loop(struct binder_state *bs, binder_handler func) { int res; struct binder_write_read bwr; unsigned readbuf[32]; bwr.write_size = 0; bwr.write_consumed = 0; bwr.write_buffer = 0; //设置事务类型，Binder Command 为 BC_ENTER_LOOPER readbuf[0] = BC_ENTER_LOOPER; //在binder_write中调用了ioctl函数，调用Binder设备的函数，标志serviceManager进入的Loop 状态。 binder_write(bs, readbuf, sizeof(unsigned)); for (; ; ) { bwr.read_size = sizeof(readbuf); bwr.read_consumed = 0; bwr.read_buffer = (unsigned) readbuf; //每次循环都进入Binder设备的缓冲区中，看看是否有IPC请求。 res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr); if (res < 0) { ALOGE("binder_loop: ioctl failed (%s)\n", strerror(errno)); break; } //对获取的结果进行解析。 res = binder_parse(bs, 0, readbuf, bwr.read_consumed, func); if (res == 0) { ALOGE("binder_loop: unexpected reply?!\n"); break; } if (res < 0) { ALOGE("binder_loop: io error %d %s\n", res, strerror(errno)); break; } } }

文章图片
【Android|Android Binder------ServiceManager启动分析】
5.把返回的数据进行解析 call by 4
文章图片

int binder_parse(struct binder_state *bs, struct binder_io *bio, uint32_t *ptr, uint32_t size, binder_handler func) { int r = 1; uint32_t *end = ptr + (size / 4); while (ptr < end) { uint32_t cmd = *ptr++; #if TRACE fprintf(stderr,"%s:\n", cmd_name(cmd)); #endif switch(cmd) { case BR_NOOP: break; case BR_TANSACTION_COMPLETE: break; R case BR_INCREFS: case BR_ACQUIRE: case BR_RELEASE: case BR_DECREFS: #if TRACE fprintf(stderr," %08x %08x\n", ptr[0], ptr[1]); #endif ptr += 2; break; case BR_TRANSACTION: { struct binder_txn *txn = (void *) ptr; if ((end - ptr) * sizeof(uint32_t) < sizeof(struct binder_txn)) { ALOGE("parse: txn too small!\n"); return -1; } binder_dump_txn(txn); if (func) { unsigned rdata[256/4]; struct binder_io msg; // struct binder_io reply; //回复信息的结构体 int res; bio_init(&reply, rdata, sizeof(rdata), 4); //数据的初始化 bio_init_from_txn(&msg, txn); //fun函数中会进行事务最终的处理，add Service find service 注册 service res = func(bs, txn, &msg, &reply); binder_send_reply(bs, &reply, txn->data, res); } ptr += sizeof(*txn) / sizeof(uint32_t); break; } case BR_REPLY: { struct binder_txn *txn = (void*) ptr; if ((end - ptr) * sizeof(uint32_t) < sizeof(struct binder_txn)) { ALOGE("parse: reply too small!\n"); return -1; } binder_dump_txn(txn); if (bio) { bio_init_from_txn(bio, txn); bio = 0; } else { /* todo FREE BUFFER */ } ptr += (sizeof(*txn) / sizeof(uint32_t)); r = 0; break;

文章图片

6 在该函数中会对事务进行相应的出路 callby 5

文章图片

int svcmgr_handler(struct binder_state *bs, struct binder_txn *txn, struct binder_io *msg, struct binder_io *reply) { struct svcinfo *si; uint16_t *s; unsigned len; void *ptr; uint32_t strict_policy; int allow_isolated; // ALOGI("target=%p code=%d pid=%d uid=%d\n", // txn->target, txn->code, txn->sender_pid, txn->sender_euid); if (txn->target != svcmgr_handle) return -1; // Equivalent to Parcel::enforceInterface(), reading the RPC // header with the strict mode policy mask and the interface name. // Note that we ignore the strict_policy and don't propagate it // further (since we do no outbound RPCs anyway). strict_policy = bio_get_uint32(msg); s = bio_get_string16(msg, &len); if ((len != (sizeof(svcmgr_id) / 2)) || memcmp(svcmgr_id, s, sizeof(svcmgr_id))) { fprintf(stderr,"invalid id %s\n", str8(s)); return -1; }switch(txn->code) { case SVC_MGR_GET_SERVICE: case SVC_MGR_CHECK_SERVICE: s = bio_get_string16(msg, &len); //查找相应的service ptr = do_find_service(bs, s, len, txn->sender_euid); //call 7 if (!ptr) break; bio_put_ref(reply, ptr); return 0; case SVC_MGR_ADD_SERVICE: s = bio_get_string16(msg, &len); ptr = bio_get_ref(msg); allow_isolated = bio_get_uint32(msg) ? 1 : 0; //add service 进行service的注册。 if (do_add_service(bs, s, len, ptr, txn->sender_euid, allow_isolated)) return -1; break; case SVC_MGR_LIST_SERVICES: { unsigned n = bio_get_uint32(msg); si = svclist; while ((n-- > 0) && si) si = si->next; if (si) { bio_put_string16(reply, si->name); return 0; } return -1; } default: ALOGE("unknown code %d\n", txn->code); return -1; }bio_put_uint32(reply, 0); return 0; }

文章图片

7 查找service call by 6

文章图片

void *do_find_service(struct binder_state *bs, uint16_t *s, unsigned len, unsigned uid) { struct svcinfo *si; //最终的查找函数了 si = find_svc(s, len); // ALOGI("check_service('%s') ptr = %p\n", str8(s), si ? si->ptr : 0); if (si && si->ptr) { if (!si->allow_isolated) { // If this service doesn't allow access from isolated processes, // then check the uid to see if it is isolated. unsigned appid = uid % AID_USER; if (appid >= AID_ISOLATED_START && appid <= AID_ISOLATED_END) { return 0; } } return si->ptr; } else { return 0; } }

文章图片

8 最终的findservice动作是在这里结束 callby 7

文章图片

struct svcinfo *find_svc(uint16_t *s16, unsigned len) { struct svcinfo *si; //svcinfo就是一个链表的node数据结构，存放了service的信息 //svclist存放了所有已经注册的了的 service，这里进行遍历，通过mencmp进行匹配 for (si = svclist; si; si = si->next) { if ((len == si->len) && !memcmp(s16, si->name, len * sizeof(uint16_t))) { return si; } } return 0; }

文章图片

9 注册服务 callby 6
文章图片

int do_add_service(struct binder_state *bs, uint16_t *s, unsigned len, void *ptr, unsigned uid, int allow_isolated) { struct svcinfo *si; //ALOGI("add_service('%s',%p,%s) uid=%d\n", str8(s), ptr, // allow_isolated ? "allow_isolated" : "!allow_isolated", uid); if (!ptr || (len == 0) || (len > 127)) return -1; //验证UID是否有添加服务的权限。 if (!svc_can_register(uid, s)) { ALOGE("add_service('%s',%p) uid=%d - PERMISSION DENIED\n", str8(s), ptr, uid); return -1; } //判断服务是否存在，存在就不进行重复注册了。 si = find_svc(s, len); if (si) { if (si->ptr) { ALOGE("add_service('%s',%p) uid=%d - ALREADY REGISTERED, OVERRIDE\n", str8(s), ptr, uid); svcinfo_death(bs, si); } si->ptr = ptr; } else {//不存在则为心注册的服务分配内存 si = malloc(sizeof(*si) + (len + 1) * sizeof(uint16_t)); if (!si) {//分配内存失败 ALOGE("add_service('%s',%p) uid=%d - OUT OF MEMORY\n", str8(s), ptr, uid); return -1; } //为注册的服务的 scvinfo 结构体赋值， si->ptr = ptr; si->len = len; memcpy(si->name, s, (len + 1) * sizeof(uint16_t)); si->name[len] = '\0'; si->death.func = svcinfo_death; si->death.ptr = si; si->allow_isolated = allow_isolated; //可见list的插入可以头插入法。 si->next = svclist; svclist = si; }binder_acquire(bs, ptr); binder_link_to_death(bs, ptr, &si->death); return 0; }

文章图片

10 判断当前uid是否具有注册service的权限，没有就拒绝 callby9
文章图片

int svc_can_register(unsigned uid, uint16_t *name) { unsigned n; if ((uid == 0) || (uid == AID_SYSTEM))//uid=0为root用户， AID_SYSTEM为系统 service return 1; //遍历允许注册service的进程数组 for (n = 0; n < sizeof(allowed) / sizeof(allowed[0]); n++) if ((uid == allowed[n].uid) && str16eq(name, allowed[n].name)) return 1; return 0; }

文章图片
允许注册服务的进程列表（如果自定义rom自己增加系统服务，就可以在这里增加以获得权限啦）
?

static struct { unsigned uid; const char *name; } allowed[] = { { AID_MEDIA, "media.audio_flinger" }, { AID_MEDIA, "media.player" }, { AID_MEDIA, "media.camera" }, { AID_MEDIA, "media.audio_policy" }, { AID_DRM, "drm.drmManager" }, { AID_NFC, "nfc" }, { AID_RADIO, "radio.phone" }, { AID_RADIO, "radio.sms" }, { AID_RADIO, "radio.phonesubinfo" }, { AID_RADIO, "radio.simphonebook" }, /* TODO: remove after phone services are updated: */ { AID_RADIO, "phone" }, { AID_RADIO, "sip" }, { AID_RADIO, "isms" }, { AID_RADIO, "iphonesubinfo" }, { AID_RADIO, "simphonebook" }, { AID_MEDIA, "common_time.clock" }, { AID_MEDIA, "common_time.config" }, };

推荐阅读

• 

  桂鱼不能和什么一起吃 桂鱼和什么相克
• 

  王湾是唐代诗人吗
• 

  羊脂白玉和白玉的区别
• 

  这可能是我最走心的一次聊天了
• 

  迷你世界怎么在游戏里弄人物
• 

  去皮椰子常温保存还是冷藏
• 

  鹅汤怎么炖最营养价值 鹅汤怎么炖好喝又营养
• 

  ios分析是做什么的软件，有哪些第三方工具可分析得到 iOS App 的运营数据
• 

  耳鸣|造成耳鸣出现的诱因是什么？怎样才能避免耳鸣出现？
• 

  windows11镜像下载详情介绍
• 

  政治角色扮演单机游戏，政治类游戏
• 

  泡打粉和酵母的区别哪个好
• 

  英伟达显卡排名 显卡天梯图2021最新版
• 

  壁挂炉出现e9怎么解决 博世壁挂炉e9故障代码
• 

  C#对XML文件的创建及增删改查操作
• 

  关中四关是哪四大关
• 

  思路|关于数据过程的想法
• 

  红木知识普及：何谓大红酸枝？ 大红酸枝
• 

  下载小说txt，下载小说TXT的网站免费
• 

  小新超人,小心超人