Android Binder驱动分析九 RPC

港控/mmm° 2022-11-17 14:59 188阅读 0赞

# 前言 #

接上文  
[Android Binder驱动分析八 getService][Android Binder_ getService]

本文将研究`MediaPlayer`最后如何将数据传输到`MediaPlayService`

//MainActivity.java
    public class MainActivity extends Activity {
        
        @Override
        public void onCreate(Bundle savedInstanceState) {
        
            super.onCreate(savedInstanceState);
    
            setContentView(R.layout.main);
            testMediaPlayer();
        }   
    
        private void testMediaPlayer() {
        
            try {
        
            	//新建一个mediplayer我们观察源码，他是
            	//如何跟远端mediaplayservice交换和转化数据
                MediaPlayer mp = new MediaPlayer();
                //我们利用这个函数完成最后的分析
                mp.setDataSource("/sdcard/test.mp3");
               
            } catch (Exception e) {
        
                e.printStackTrace();
            }   
        }   
    }

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FmYW5taW5neWlx_size_16_color_FFFFFF_t_70]

为了加深印象

我们看下服务端提供的标准类

///frameworks/av/include/media/IMediaPlayerService.h
    class IMediaPlayerService: public IInterface
    {
        
    public:
        DECLARE_META_INTERFACE(MediaPlayerService);
    
        virtual sp<IMediaRecorder> createMediaRecorder() = 0;
        virtual sp<IMediaMetadataRetriever> createMetadataRetriever() = 0;
        virtual sp<IMediaPlayer> create(const sp<IMediaPlayerClient>& client, int audioSessionId = 0) = 0;
    
        virtual status_t         decode(
                const sp<IMediaHTTPService> &httpService,
                const char* url,
                uint32_t *pSampleRate,
                int* pNumChannels,
                audio_format_t* pFormat,
                const sp<IMemoryHeap>& heap, size_t *pSize) = 0;
    
        virtual status_t         decode(int fd, int64_t offset, int64_t length, uint32_t *pSampleRate,
                                        int* pNumChannels, audio_format_t* pFormat,
                                        const sp<IMemoryHeap>& heap, size_t *pSize) = 0;
        virtual sp<IOMX>            getOMX() = 0;
        virtual sp<ICrypto>         makeCrypto() = 0;
        virtual sp<IDrm>            makeDrm() = 0;
        virtual sp<IHDCP>           makeHDCP(bool createEncryptionModule) = 0;
        virtual sp<IMediaCodecList> getCodecList() const = 0;
    
        // Connects to a remote display.
        // 'iface' specifies the address of the local interface on which to listen for
        // a connection from the remote display as an ip address and port number
        // of the form "x.x.x.x:y".  The media server should call back into the provided remote
        // display client when display connection, disconnection or errors occur.
        // The assumption is that at most one remote display will be connected to the
        // provided interface at a time.
        virtual sp<IRemoteDisplay> listenForRemoteDisplay(const sp<IRemoteDisplayClient>& client,
                const String8& iface) = 0;
    
        // codecs and audio devices usage tracking for the battery app
        enum BatteryDataBits {
        
            // tracking audio codec
            kBatteryDataTrackAudio          = 0x1,
            // tracking video codec
            kBatteryDataTrackVideo          = 0x2,
            // codec is started, otherwise codec is paused
            kBatteryDataCodecStarted        = 0x4,
            // tracking decoder (for media player),
            // otherwise tracking encoder (for media recorder)
            kBatteryDataTrackDecoder        = 0x8,
            // start to play an audio on an audio device
            kBatteryDataAudioFlingerStart   = 0x10,
            // stop/pause the audio playback
            kBatteryDataAudioFlingerStop    = 0x20,
            // audio is rounted to speaker
            kBatteryDataSpeakerOn           = 0x40,
            // audio is rounted to devices other than speaker
            kBatteryDataOtherAudioDeviceOn  = 0x80,
        };
    
        virtual void addBatteryData(uint32_t params) = 0;
        virtual status_t pullBatteryData(Parcel* reply) = 0;
    };

//frameworks/av/media/libmedia/mediaplayer.cpp
    status_t MediaPlayer::setDataSource(
            const sp<IMediaHTTPService> &httpService,
            const char *url, const KeyedVector<String8, String8> *headers)
    {
        
        status_t err = BAD_VALUE;
        if (url != NULL) {
        
            //我们重点关心如何获取服务
            const sp<IMediaPlayerService>& service(getMediaPlayerService());
            
            if (service != 0) {
        
            	//这里的函数很多我们只分析
            	//service->create(this, mAudioSessionId)如何跨进程即可
            	//IMediaPlayerService的实现类是BpMediaPlayerService
            	//所以我们继续跟到BpMediaPlayerService的create
                sp<IMediaPlayer> player(service->create(this, mAudioSessionId));
     		
            }
        }
        return err;
    }

//frameworks\av\media\libmedia\IMediaPlayerService.cpp
    
    class BpMediaPlayerService: public BpInterface<IMediaPlayerService>
    {
        
    
    		virtual sp<IMediaPlayer> create(
    	            const sp<IMediaPlayerClient>& client, int audioSessionId) {
        
    	        Parcel data, reply;
    	        data.writeInterfaceToken(IMediaPlayerService::getInterfaceDescriptor());
    	        data.writeStrongBinder(client->asBinder());
    	        data.writeInt32(audioSessionId);
    			//首先记下我们传入了一个CREATE命令
    	        remote()->transact(CREATE, data, &reply);
    	        return interface_cast<IMediaPlayer>(reply.readStrongBinder());
    	    }
     }

上面的代码陷入内核binder驱动

//kernel\common\drivers\staging\android\binder.c
    //由于讲解过所以不做过多解释
    static int binder_thread_write(struct binder_proc *proc,
    			struct binder_thread *thread,
    			binder_uintptr_t binder_buffer, size_t size,
    			binder_size_t *consumed)
    {
        
    	uint32_t cmd;
    	struct binder_context *context = proc->context;
    	void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
    	void __user *ptr = buffer + *consumed;
    	void __user *end = buffer + size;
    
    	while (ptr < end && thread->return_error.cmd == BR_OK) {
        
    		int ret;
    
    		if (get_user(cmd, (uint32_t __user *)ptr))
    			return -EFAULT;
    		ptr += sizeof(uint32_t);
    		
    		
    		switch (cmd) {
        
    
    		case BC_TRANSACTION:
    		case BC_REPLY: {
        
    			struct binder_transaction_data tr;
    			if (copy_from_user(&tr, ptr, sizeof(tr)))
    				return -EFAULT;
    			ptr += sizeof(tr);
    			//跟入
    			binder_transaction(proc, thread, &tr,
    					   cmd == BC_REPLY, 0);
    			break;
    		}
    
    		
    		}
    		*consumed = ptr - buffer;
    	}
    	return 0;
    }
    
    static void binder_transaction(struct binder_proc *proc,
    			       struct binder_thread *thread,
    			       struct binder_transaction_data *tr, int reply,
    			       binder_size_t extra_buffers_size)
    {
        
    	int ret;
    	struct binder_transaction *t;
    	struct binder_work *tcomplete;
    	binder_size_t *offp, *off_end, *off_start;
    	binder_size_t off_min;
    	u8 *sg_bufp, *sg_buf_end;
    	struct binder_proc *target_proc = NULL;
    	struct binder_thread *target_thread = NULL;
    	struct binder_node *target_node = NULL;
    	struct binder_transaction *in_reply_to = NULL;
    	struct binder_transaction_log_entry *e;
    	uint32_t return_error = 0;
    	uint32_t return_error_param = 0;
    	uint32_t return_error_line = 0;
    	struct binder_buffer_object *last_fixup_obj = NULL;
    	binder_size_t last_fixup_min_off = 0;
    	struct binder_context *context = proc->context;
    
    	
    
    	if (reply) {
        
    		//...
    	} else {
        
    		//因为句柄值是指向MediaPlayService的binder_node 
    		if (tr->target.handle) {
        
    			struct binder_ref *ref;
    			//从当前进程的refs_by_desc获取对应的rb_node_desc的节点
    			ref = binder_get_ref_olocked(proc, tr->target.handle, true);
    			//寻找到就将节点转化为binder_node，而这个binder_node会存放MediaPlayService的内存地址，
    			//可以用过这个找到实体对象
    			if (ref) {
        
    				target_node = binder_get_node_refs_for_txn(
    						ref->node, &target_proc,
    						&return_error);
    			} else {
        
    				//...
    			}
    		
    		} else {
        
    			//.句柄为0的情况，如果句柄为0那么是寻找
    		}
    		
    	
    	
    
    
    
    	t = kzalloc(sizeof(*t), GFP_KERNEL);
    	
    	
    
    	tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL);
    	
    
    	//如果不需要答复 并且是非TF_ONE_WAY，那么就不需要设置回复事务回复的线程
    	if (!reply && !(tr->flags & TF_ONE_WAY))
    		t->from = thread;
    	else
    		t->from = NULL;
    	
    	t->sender_euid = task_euid(proc->tsk);
    	t->to_proc = target_proc;
    	t->to_thread = target_thread;
    	t->code = tr->code;
    	t->flags = tr->flags;
    
    	
    	//返回给mediaplayserice的事务
    	tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
    	//将这个事务放入mediaplayservice线程队列中
    	//后面线程检查队列是否有任务即可
    	binder_enqueue_work(proc, tcomplete, &thread->todo);
    
    	//设置交给servicemanager的事务类型
    	t->work.type = BINDER_WORK_TRANSACTION;
    	
    	if (reply) {
        
    		
    		//略
    		
    	} else if (!(t->flags & TF_ONE_WAY)) {
        
    		
    		t->need_reply = 1;
    		
    		t->from_parent = thread->transaction_stack;
    
    		thread->transaction_stack = t;
    	
    		//这里就是将事务t提交给servicemanager任务队列，然后唤醒servicemanager处理这个事务
    		if (!binder_proc_transaction(t, target_proc, target_thread)) {
        
    			//错误处理
    		}
    	} 
    	
    	//略
    	return;
    
    }

接着执行`binder_thread_read`函数

//kernel\common\drivers\staging\android\binder.c
    
    
    static int binder_thread_read(struct binder_proc *proc,
    			      struct binder_thread *thread,
    			      binder_uintptr_t binder_buffer, size_t size,
    			      binder_size_t *consumed, int non_block)
    {
        
    	void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
    	void __user *ptr = buffer + *consumed;
    	void __user *end = buffer + size;
    
    	int ret = 0;
    	int wait_for_proc_work;
    
    	if (*consumed == 0) {
        
    		if (put_user(BR_NOOP, (uint32_t __user *)ptr))
    			return -EFAULT;
    		ptr += sizeof(uint32_t);
    	}
    
    retry:
    
    	//这里返回false.   binder_available_for_proc_work_ilocked如果有事务就返回true，没有就返回false
    	wait_for_proc_work = binder_available_for_proc_work_ilocked(thread);
    
    
    	thread->looper |= BINDER_LOOPER_STATE_WAITING;
    
    
    	if (non_block) {
        
    		//...
    	} else {
        
    		//如果没有任务就会被阻塞
    		ret = binder_wait_for_work(thread, wait_for_proc_work);
    	}
    
    	thread->looper &= ~BINDER_LOOPER_STATE_WAITING;
    
    	
    
    	while (1) {
        
    		uint32_t cmd;
    		struct binder_transaction_data_secctx tr;
    		struct binder_transaction_data *trd = &tr.transaction_data;
    		struct binder_work *w = NULL;
    		struct list_head *list = NULL;
    		struct binder_transaction *t = NULL;
    		struct binder_thread *t_from;
    		size_t trsize = sizeof(*trd);
    
    		//待办事务可能存在线程对象todo 或者进程对象的proc的todo
    		if (!binder_worklist_empty_ilocked(&thread->todo))
    			list = &thread->todo;
    		else if (!binder_worklist_empty_ilocked(&proc->todo) &&
    			   wait_for_proc_work)
    			list = &proc->todo;
    		
    
    	
    		
    		//binder_work * w
    		//从待办事务取出对象
    		w = binder_dequeue_work_head_ilocked(list);
    
    		switch (w->type) {
        
    			//这是MediaPlayer传入的事务类型
    			case BINDER_WORK_TRANSACTION: {
        
    				t = container_of(w, struct binder_transaction, work);
    			} break;
    		}
    
    		if (!t)
    			continue;
    
    		//目标对象
    		//target_nodes是MediaPlayerService对应的binder节点
    		//这里不为空 所以为true
    		if (t->buffer->target_node) {
        
    
    			//后面就是将一些数据拷贝到trd
    			struct binder_node *target_node = t->buffer->target_node;
    			trd->target.ptr = target_node->ptr;
    			trd->cookie =  target_node->cookie;
    		
    			
    			//传给servicemanager的命令
    			cmd = BR_TRANSACTION;
    		} else {
        
    			//略
    		}
    
    		//拷贝数据到trd 这里是CREATE
    		trd->code = t->code;
    		trd->flags = t->flags;
    		trd->sender_euid = from_kuid(current_user_ns(), t->sender_euid);
    
    		t_from = binder_get_txn_from(t);
    		if (t_from) {
        
    			struct task_struct *sender = t_from->proc->tsk;
    
    			trd->sender_pid =
    				task_tgid_nr_ns(sender,
    						task_active_pid_ns(current));
    		} else {
        
    			trd->sender_pid = 0;
    		}
    
    		trd->data_size = t->buffer->data_size;
    		trd->offsets_size = t->buffer->offsets_size;
    		trd->data.ptr.buffer = (binder_uintptr_t)
    			((uintptr_t)t->buffer->data +
    			binder_alloc_get_user_buffer_offset(&proc->alloc));
    		trd->data.ptr.offsets = trd->data.ptr.buffer +
    					ALIGN(t->buffer->data_size,
    					    sizeof(void *));
    
    
    		//放入数据				
    		if (put_user(cmd, (uint32_t __user *)ptr)) {
        
    			if (t_from)
    				binder_thread_dec_tmpref(t_from);
    			return -EFAULT;
    		}
    		ptr += sizeof(uint32_t);
    		//拷贝对象数据到用户空间
    		if (copy_to_user(ptr, &tr, trsize)) {
        
    			if (t_from)
    				binder_thread_dec_tmpref(t_from);
    			return -EFAULT;
    		}
    		ptr += trsize;
    
    		binder_stat_br(proc, thread, cmd);
    		
    
    		if (t_from)
    			binder_thread_dec_tmpref(t_from);
    		t->buffer->allow_user_free = 1;
    		if (cmd != BR_REPLY && !(t->flags & TF_ONE_WAY)) {
        
    			binder_inner_proc_lock(thread->proc);
    			t->to_parent = thread->transaction_stack;
    			t->to_thread = thread;
    			thread->transaction_stack = t;
    			binder_inner_proc_unlock(thread->proc);
    		} else {
        
    			binder_free_transaction(t);
    		}
    		break;
    	}
    
    done:
    	//修改consumed为实际写入的数据大小，然后返回
    	*consumed = ptr - buffer;
    	//略
    	return 0;
    
    
    }

接下来我们看下`MediaPlayService`被唤醒后的代码

//frameworks\native\libs\binder\IPCThreadState.cpp
    
    status_t IPCThreadState::getAndExecuteCommand()
    {
        
     
    	//跟binder驱动通信
        result = talkWithDriver();
     
       	//解析命令
        result = executeCommand(cmd);
    
        return result;
    }
    
    
    status_t IPCThreadState::executeCommand(int32_t cmd)
    {
        
        BBinder* obj;
        RefBase::weakref_type* refs;
        status_t result = NO_ERROR;
        
        switch (cmd) {
        
       
        
        case BR_TRANSACTION:
            {
        
                binder_transaction_data tr;
                result = mIn.read(&tr, sizeof(tr));
              
                if (result != NO_ERROR) break;
                
                Parcel buffer;
                //把数据解析到tr中
                buffer.ipcSetDataReference(
                    reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
                    tr.data_size,
                    reinterpret_cast<const binder_size_t*>(tr.data.ptr.offsets),
                    tr.offsets_size/sizeof(binder_size_t), freeBuffer, this);
                
                const pid_t origPid = mCallingPid;
                const uid_t origUid = mCallingUid;
                const int32_t origStrictModePolicy = mStrictModePolicy;
                const int32_t origTransactionBinderFlags = mLastTransactionBinderFlags;
    
                mCallingPid = tr.sender_pid;
                mCallingUid = tr.sender_euid;
                mLastTransactionBinderFlags = tr.flags;
    
                Parcel reply;
                status_t error;
                //这里指向MediplayService弱引用
                if (tr.target.ptr) {
        
                	//tr.cookie指向Binder对象的内存地址
                	//这里指向MediaPlayService内存地址
                    sp<BBinder> b((BBinder*)tr.cookie);
                    //这里会运行到MediaPlayService的transact对象
                    //这个函数的实现类位于BnMediaPlayerService
                    error = b->transact(tr.code, buffer, &reply, tr.flags);
    
                } else {
        
                    error = the_context_object->transact(tr.code, buffer, &reply, tr.flags);
                }
    
                if ((tr.flags & TF_ONE_WAY) == 0) {
        
                    if (error < NO_ERROR) reply.setError(error);
                    sendReply(reply, 0);
                } 
               
            }
            break;
        
      
            
     
        }
    
        if (result != NO_ERROR) {
        
            mLastError = result;
        }
        
        return result;
    }

最后看下实现类，这里最后就是`MediaPlayservice`的实现细节，后面回复我们就不在讲解

//\frameworks\av\media\libmedia\IMediaPlayerService.cpp
    status_t BnMediaPlayerService::onTransact(
        uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
    {
        
        switch (code) {
        
            case CREATE: {
        
                CHECK_INTERFACE(IMediaPlayerService, data, reply);
                sp<IMediaPlayerClient> client =
                    interface_cast<IMediaPlayerClient>(data.readStrongBinder());
                int audioSessionId = data.readInt32();
                sp<IMediaPlayer> player = create(client, audioSessionId);
                reply->writeStrongBinder(player->asBinder());
                return NO_ERROR;
            } break;
          
        }
    }

[Android Binder_ getService]: https://fanmingyi.blog.csdn.net/article/details/115502511
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FmYW5taW5neWlx_size_16_color_FFFFFF_t_70]: /images/20221022/de07c61832f442469163b28488944b41.png