开发笔记:AndroidBinder系统学习笔记Binder系统的基本使用方法

frameworks/native/cmds/servicemanager/bctest.c
frameworks/native/cmds/servicemanager/binder.c
frameworks/native/cmds/servicemanager/binder.h
frameworks/native/cmds/servicemanager/service_manager.c

/*test_server.h*/
#ifndef _TEST_SERVER_H
#define _TEST_SERVER_H
/*事先约定好的Server进程的相应函数的代号*/
#define HELLO_SVR_CMD_SAYHELLO 0
#define HELLO_SVR_CMD_SAYHELLO_TO 1
#endif // _TEST_SERVER_H

/*test_server.c*/
/* Copyright 2008 The Android Open Source Project
*/
#include
#include
#include
#include
#include
#include <string.h>
#include <private/android_filesystem_config.h>
#include "binder.h"
#include "test_server.h"
int svcmgr_publish(struct binder_state *bs, uint32_t target, const char *name, void *ptr)
{
int status;
unsigned iodata[512/4];
struct binder_io msg, reply;
bio_init(&msg, iodata, sizeof(iodata), 4);
bio_put_uint32(&msg, 0); // strict mode header
bio_put_string16_x(&msg, SVC_MGR_NAME);
bio_put_string16_x(&msg, name);
bio_put_obj(&msg, ptr);
/*远程调用ServiceManager的do_add_service函数*/
if (binder_call(bs, &msg, &reply, target, SVC_MGR_ADD_SERVICE))
return -1;
status = bio_get_uint32(&reply);
binder_done(bs, &msg, &reply);
return status;
}
void sayhello(void)
{
static int cnt = 0;
fprintf(stderr, "say hello : %d\\n", cnt++);
}
int sayhello_to(char *name)
{
static int cnt = 0;
fprintf(stderr, "say hello to %s : %d\\n", name, cnt++);
return cnt;
}
int hello_service_handler(struct binder_state *bs,
struct binder_transaction_data *txn,
struct binder_io *msg,
struct binder_io *reply)
{
/* 根据txn->code知道要调用哪一个函数
* 如果需要参数, 可以从msg取出
* 如果要返回结果, 可以把结果放入reply
*/
/* sayhello
* sayhello_to
*/

uint16_t *s;
char name[512];
size_t len;
uint32_t handle;
uint32_t strict_policy;
int i;
// Equivalent to Parcel::enforceInterface(), reading the RPC
// header with the strict mode policy mask and the interface name.
// Note that we ignore the strict_policy and don\'t propagate it
// further (since we do no outbound RPCs anyway).
strict_policy = bio_get_uint32(msg);
switch(txn->code) {
case HELLO_SVR_CMD_SAYHELLO:
sayhello();
return 0;
case HELLO_SVR_CMD_SAYHELLO_TO:
/* 从msg里取出字符串 */
s = bio_get_string16(msg, &len);
if (s == NULL) {
return -1;
}
for (i = 0; i )
name[i] = s[i];
name[i] = \'\\0\';
/* 处理 */
i = sayhello_to(name);
/* 把结果放入reply */
bio_put_uint32(reply, i);

break;
default:
fprintf(stderr, "unknown code %d\\n", txn->code);
return -1;
}
return 0;
}
int main(int argc, char **argv)
{
int fd;
struct binder_state *bs;
uint32_t svcmgr = BINDER_SERVICE_MANAGER;
uint32_t handle;
int ret;
/*打开并映射binder驱动*/
bs = binder_open(128*1024);
if (!bs) {
fprintf(stderr, "failed to open binder driver\\n");
return -1;
}
/* 向ServiceManager注册服务 */
ret = svcmgr_publish(bs, svcmgr, "hello", (void *)123);
if (ret) {
fprintf(stderr, "failed to publish hello service\\n");
return -1;
}
ret = svcmgr_publish(bs, svcmgr, "goodbye", (void *)124);
if (ret) {
fprintf(stderr, "failed to publish goodbye service\\n");
}
#if 0
while (1)
{
/* read data */
/* parse data, and process */
/* reply */
}
#endif
/*通过我们传入的hello_service_handler循环处理从binder驱动读出的数据*/
binder_loop(bs, hello_service_handler);
return 0;
}

void binder_loop(struct binder_state *bs, binder_handler func)
{
int res;
struct binder_write_read bwr;
uint32_t readbuf[32];
//bwr.write_size = 0 表明下面的ioctl不会发起写操作，只不过发起读操作
bwr.write_size = 0;
bwr.write_consumed = 0;
bwr.write_buffer = 0;
readbuf[0] = BC_ENTER_LOOPER;
binder_write(bs, readbuf, sizeof(uint32_t));
for (;;) {
bwr.read_size = sizeof(readbuf);
bwr.read_consumed = 0;
bwr.read_buffer = (uintptr_t) readbuf;
/*通过ioctl从binder驱动中读数据*/
res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
if (res <0) {
ALOGE("binder_loop: ioctl failed (%s)\\n", strerror(errno));
break;
}
//读到数据之后调用binder_parse解析数据，如果传入func参数还会处理数据
res = binder_parse(bs, 0, (uintptr_t) readbuf, bwr.read_consumed, func);
if (res == 0) {
ALOGE("binder_loop: unexpected reply?!\\n");
break;
}
if (res <0) {
ALOGE("binder_loop: io error %d %s\\n", res, strerror(errno));
break;
}
}
}

int binder_parse(struct binder_state *bs, struct binder_io *bio,
uintptr_t ptr, size_t size, binder_handler func)
{
int r = 1;
uintptr_t end = ptr + (uintptr_t) size;
while (ptr < end) {
uint32_t cmd = *(uint32_t *) ptr;
ptr += sizeof(uint32_t);
#if TRACE
fprintf(stderr,"%s:\\n", cmd_name(cmd));
#endif
switch(cmd) {
case BR_NOOP:
break;
case BR_TRANSACTION_COMPLETE:
break;
case BR_INCREFS:
case BR_ACQUIRE:
case BR_RELEASE:
case BR_DECREFS:
#if TRACE
fprintf(stderr," %p, %p\\n", (void *)ptr, (void *)(ptr + sizeof(void *)));
#endif
ptr += sizeof(struct binder_ptr_COOKIE);
break;
//我们收到的命令是BR_TRANSACTION
case BR_TRANSACTION: {
struct binder_transaction_data *txn = (struct binder_transaction_data *) ptr;
if ((end - ptr) <sizeof(*txn)) {
ALOGE("parse: txn too small!\\n");
return -1;
}
binder_dump_txn(txn);
if (func) {
unsigned rdata[256/4];
struct binder_io msg;
struct binder_io reply;
int res;
//接收到数据之后，构造一个binder_io
bio_init(&reply, rdata, sizeof(rdata), 4);
bio_init_from_txn(&msg, txn);
//调用我们的处理函数
res = func(bs, txn, &msg, &reply);
//处理完之后发送一个reply
binder_send_reply(bs, &reply, txn->data.ptr.buffer, res);
}
ptr += sizeof(*txn);
break;
}
case BR_REPLY: {
struct binder_transaction_data *txn = (struct binder_transaction_data *) ptr;
if ((end - ptr) <sizeof(*txn)) {
ALOGE("parse: reply too small!\\n");
return -1;
}
binder_dump_txn(txn);
if (bio) {
bio_init_from_txn(bio, txn);
bio = 0;
} else {
/* todo FREE BUFFER */
}
ptr += sizeof(*txn);
r = 0;
break;
}
case BR_DEAD_BINDER: {
struct binder_death *death = (struct binder_death *)(uintptr_t) *(binder_uintptr_t *)ptr;
ptr += sizeof(binder_uintptr_t);
death->func(bs, death->ptr);
break;
}
case BR_FAILED_REPLY:
r = -1;
break;
case BR_DEAD_REPLY:
r = -1;
break;
default:
ALOGE("parse: OOPS %d\\n", cmd);
return -1;
}
}
return r;
}

/*test_client.c*/
/* Copyright 2008 The Android Open Source Project
*/
#include
#include
#include
#include
#include
#include <string.h>
#include <private/android_filesystem_config.h>
#include "binder.h"
#include "test_server.h"
uint32_t svcmgr_lookup(struct binder_state *bs, uint32_t target, const char *name)
{
uint32_t handle;
unsigned iodata[512/4];
struct binder_io msg, reply;
bio_init(&msg, iodata, sizeof(iodata), 4);
bio_put_uint32(&msg, 0); // strict mode header
bio_put_string16_x(&msg, SVC_MGR_NAME);
bio_put_string16_x(&msg, name);
/*远程调用ServiceManager的do_find_service函数*/
if (binder_call(bs, &msg, &reply, target, SVC_MGR_CHECK_SERVICE))
return 0;
handle = bio_get_ref(&reply);
if (handle)
binder_acquire(bs, handle);
binder_done(bs, &msg, &reply);
return handle;
}
struct binder_state *g_bs;
uint32_t g_handle;
void sayhello(void)
{
unsigned iodata[512/4];
struct binder_io msg, reply;
/* 构造binder_io */
bio_init(&msg, iodata, sizeof(iodata), 4);
bio_put_uint32(&msg, 0); // strict mode header
/* 放入参数 */
/* 调用binder_call远程调用Server的sayhello函数*/
if (binder_call(g_bs, &msg, &reply, g_handle, HELLO_SVR_CMD_SAYHELLO))
return ;

/* 从reply中解析出返回值 */
binder_done(g_bs, &msg, &reply);

}
int sayhello_to(char *name)
{
unsigned iodata[512/4];
struct binder_io msg, reply;
int ret;
/* 构造binder_io */
bio_init(&msg, iodata, sizeof(iodata), 4);
bio_put_uint32(&msg, 0); // strict mode header
/* 放入参数 */
bio_put_string16_x(&msg, name);
/* 调用binder_call远程调用Server的sayhello_to函数 */
if (binder_call(g_bs, &msg, &reply, g_handle, HELLO_SVR_CMD_SAYHELLO_TO))
return 0;

/* 从reply中解析出返回值 */
ret = bio_get_uint32(&reply);
binder_done(g_bs, &msg, &reply);
return ret;

}
/* ./test_client hello
* ./test_client hello
*/
int main(int argc, char **argv)
{
int fd;
struct binder_state *bs;
uint32_t svcmgr = BINDER_SERVICE_MANAGER;
uint32_t handle;
int ret;
if (argc <2){
fprintf(stderr, "Usage:\\n");
fprintf(stderr, "%s hello\\n", argv[0]);
fprintf(stderr, "%s hello \\n", argv[0]);
return -1;
}
/*打开binder驱动*/
bs = binder_open(128*1024);
if (!bs) {
fprintf(stderr, "failed to open binder driver\\n");
return -1;
}
g_bs = bs;
/* 向ServiceManager查询hello服务 */
handle = svcmgr_lookup(bs, svcmgr, "hello");
if (!handle) {
fprintf(stderr, "failed to get hello service\\n");
return -1;
}
g_handle = handle;
/* send data to server */
if (argc == 2) {
sayhello();
} else if (argc == 3) {
ret = sayhello_to(argv[2]);
fprintf(stderr, "get ret of sayhello_to = %d\\n", ret);
}
binder_release(bs, handle);
return 0;
}

int binder_call(struct binder_state *bs,
struct binder_io *msg, struct binder_io *reply,
uint32_t target, uint32_t code)
{
int res;
/*构造参数*/
struct binder_write_read bwr;
struct {
uint32_t cmd;
struct binder_transaction_data txn;
} __attribute__((packed)) writebuf;
unsigned readbuf[32];
if (msg->flags & BIO_F_OVERFLOW) {
fprintf(stderr,"binder: txn buffer overflow\\n");
goto fail;
}

writebuf.cmd = BC_TRANSACTION;
writebuf.txn.target.handle = target;
writebuf.txn.code = code;
writebuf.txn.flags = 0;
writebuf.txn.data_size = msg->data - msg->data0;
writebuf.txn.offsets_size = ((char*) msg->offs) - ((char*) msg->offs0);
writebuf.txn.data.ptr.buffer = (uintptr_t)msg->data0;
writebuf.txn.data.ptr.offsets = (uintptr_t)msg->offs0;
bwr.write_size = sizeof(writebuf);
bwr.write_consumed = 0;
bwr.write_buffer = (uintptr_t) &writebuf;
hexdump(msg->data0, msg->data - msg->data0);
for (;;) {
bwr.read_size = sizeof(readbuf);
bwr.read_consumed = 0;
bwr.read_buffer = (uintptr_t) readbuf;
/*调用ioctl发送数据*/
res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
if (res <0) {
fprintf(stderr,"binder: ioctl failed (%s)\\n", strerror(errno));
goto fail;
}
/*解析返回的数据*/
res = binder_parse(bs, reply, (uintptr_t) readbuf, bwr.read_consumed, 0);
if (res == 0) return 0;
if (res <0) goto fail;
}
fail:
memset(reply, 0, sizeof(*reply));
reply->flags |= BIO_F_IOERROR;
return -1;
}