Android binder-Service Manager

Service Manager is the manager of all services. Therefore, all servers (system servers) must register with it, and applications query corresponding services from service manager. Its implementation is located in the "frameworks/base/cmds/servicemanager \ service_manager.c" file.

int main(int argc, char **argv){    struct binder_state *bs;    void *svcmgr = BINDER_SERVICE_MANAGER;    bs = binder_open(128*1024);    if (binder_become_context_manager(bs)) {        LOGE("cannot become context manager (%s)\n", strerror(errno));        return -1;    }    svcmgr_handle = svcmgr;    binder_loop(bs, svcmgr_handler);    return 0;}

First, call binder_open to open the binder device/dev/binder. The mapsize parameter specifies the memory size to be mapped. Why is the ing required? Where is the ing address BS-> mapped used?

struct binder_state *binder_open(unsigned mapsize){           struct binder_state *bs;    bs = malloc(sizeof(*bs));    if (!bs) {        errno = ENOMEM;        return 0;    }    bs->fd = open("/dev/binder", O_RDWR);    if (bs->fd < 0) {        fprintf(stderr,"binder: cannot open device (%s)\n",                strerror(errno));        goto fail_open;    }            bs->mapsize = mapsize;    bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);    if (bs->mapped == MAP_FAILED) {        fprintf(stderr,"binder: cannot map device (%s)\n",                strerror(errno));        goto fail_map;    }        /* TODO: check version */    return bs;fail_map:    close(bs->fd);fail_open:    free(bs);    return 0;}

Call binder_become_context_manager to call it context manager, which is also the service manager. This special service is used to manage all other services.

int binder_become_context_manager(struct binder_state *bs){           return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);}

Service Manager listens to requests

Service Manager declares to the binder driver via IOCTL binder_set_context_mgr that it is the service manager. As the Service Manager, it has two most important tasks: receiving service registration from other servers and providing query and retrieval services for clients. Therefore, the Service enters a listener loop, waits for user requests, and uses the srcmgr_handler callback function to process user requests.

void binder_loop(struct binder_state *bs, binder_handler func){           int res;    struct binder_write_read bwr;    unsigned readbuf[32];         bwr.write_size = 0;    bwr.write_consumed = 0;    bwr.write_buffer = 0;     readbuf[0] = BC_ENTER_LOOPER;    binder_write(bs, readbuf, sizeof(unsigned));    for (;;) {        bwr.read_size = sizeof(readbuf);        bwr.read_consumed = 0;        bwr.read_buffer = (unsigned) readbuf;                res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);        if (res < 0) {            LOGE("binder_loop: ioctl failed (%s)\n", strerror(errno));            break;        }        res = binder_parse(bs, 0, readbuf, bwr.read_consumed, func);        if (res == 0) {            LOGE("binder_loop: unexpected reply?!\n");            break;        }        if (res < 0) {            LOGE("binder_loop: io error %d %s\n", res, strerror(errno));            break;        }    }}

Before service manager can serve server and client requests, set bind proc to looper_enter and call IOCTL binder_write_read to wait for requests from server and client. This IOCTL is a blocking operation, it will not be returned until a request enters

Binder_parse analysis @ readbuf requests. BWR. read_consumed indicates the request length, and @ func indicates the request processing function.

Servicemanager Data Structure

 90 struct svcinfo 91 { 92     struct svcinfo *next; 93     void *ptr; 94     struct binder_death death; 95     unsigned len; 96     uint16_t name[0]; 97 };

Each svcinfo represents a registered service.

@ Next: all services are linked to the global variable svclist through next.

@ PTR: although it is named as a pointer, it stores a handle. Generally, starting from 0x01, 0x00 is reserved for the Service Manager itself.

@ Len, Name Length

@ Name: indicates the service name. The client must use this name to find the matching service.

struct binder_io{    char *data;            /* pointer to read/write from */    uint32_t *offs;        /* array of offsets */    uint32_t data_avail;   /* bytes available in data buffer */    uint32_t offs_avail;   /* entries available in offsets array */    char *data0;           /* start of data buffer */    uint32_t *offs0;       /* start of offsets buffer */    uint32_t flags;    uint32_t unused;};

Binder_io is the auxiliary structure used to generate the binder message.

@ Data is the current available buffer location. This address changes with the addition of data.

@ Offs is the currently available offset buffer location, which can be used to store the OBJ offset address relative to @ data0, 4 bytes

@ Data_avail current available data space size

@ Offs_avail the size of the offsets currently empty

@ Data0 the starting position of the data buffer. data0 records the starting position of the binder_io data buffer.

@ Offs0 offset buffer start position, offs0 records the start position of binder_io offset Buffer

From @ data0 ~ @ Data stores the object, @ offs0 ~ @ Offs stores the OBJ offset position, which is the OBJ address's offset position relative to @ data0