Android IPC 通讯机制源码分析

核心提示：if (copy_to_user(ubuf, &bwr, sizeof(bwr)))ret = -EFAULT;goto err;}}.........................................}Int binder_thread_write(struct binder_proc *proc, s

if (copy_to_user(ubuf, &bwr, sizeof(bwr)))

ret = -EFAULT;

goto err;

}

}

.........................................

}

Int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread,void __user *buffer, int size, signed long *consumed)

{

uint32_t cmd;

void __user *ptr = buffer + *consumed;

void __user *end = buffer + size;

while (ptr < end && thread->return_error == BR_OK) {

if (get_user(cmd, (uint32_t __user *)ptr))//从user空间获取cmd数据到内核空间

return -EFAULT;

ptr += sizeof(uint32_t);

if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) {

binder_stats.bc[_IOC_NR(cmd)]++;

proc->stats.bc[_IOC_NR(cmd)]++;

thread->stats.bc[_IOC_NR(cmd)]++;

}

switch (cmd) {

case BC_INCREFS:

.........................................

case BC_TRANSACTION: //IPCThreadState通过writeTransactionData设置该cmd

case BC_REPLY: {

struct binder_transaction_data tr;

if (copy_from_user(&tr, ptr, sizeof(tr)))

return -EFAULT;

ptr += sizeof(tr);

binder_transaction(proc, thread, &tr, cmd == BC_REPLY);

break;

}

........................................

}

static void

binder_transaction(struct binder_proc *proc, struct binder_thread *thread,

struct binder_transaction_data *tr, int reply)

{

..............................................

if (reply) // cmd != BC_REPLY 不走这个case

{

......................................

}

else

{

if (tr->target.handle) { //对于service_manager来说这个条件不满足(handle == 0)