在進行dumpsys呼叫的時候，dump方法的第一個引數是檔案描述符

BinderProxy.java

    publicvoid dump(FileDescriptor fd, String[] args) 

通過傳送檔案描述符來讓服務端向給定的檔案寫資料，

等等，仔細想想，好像有什麼不對

是啊，每個程序中的檔案描述符是獨立無關的，你把C程序中的檔案描述符傳給S程序，這不是刻舟求劍麼？

但是，Android的binder看上去就是傳送了檔案描述符，這裡面暗藏了什麼玄機呢？

我們在讀寫檔案描述符的地方加上log

{

    int dupFd = dup(fd);

    if
 
 (dupFd < 0) {

        return -errno;

    }

//在這裡新增log，檢視fd的值

ALOGE("writeDupFileDescriptor: fd = %d, dupfd =  %d\n", fd, dupFd);

    if (err) {

close(dupFd);

    }

    return err;

}

{

    if (

ALOGD("00 ========== android_os_Parcel_readFileDescriptor, fd=%d", fd);

        if (fd < 0) return
 
 NULL;

fd = dup(fd);

ALOGD("========== android_os_Parcel_readFileDescriptor, fd=%d", fd);

        if (fd < 0) return NULL;

    }

    return NULL;

}

進行一次dump呼叫，檢視log

我們會發現，寫入的fd和服務端讀出的fd不一樣，但是服務端卻正確的完成了資料的輸出，為什麼呢？

肯定有地方進行了處理。

通過檢視，我們發現，原來是在資料傳輸的過程中被做了手腳，binder驅動在傳送資料的時候，在服務端上建立了一個新的fd，並且把這個fd和客戶端fd所對應的檔案進行了關聯。

處理流程

BinderProxy.java

    public void dump(FileDescriptor fd,String[] args) throws RemoteException {

        Parcel data = Parcel.obtain();

        Parcel reply = Parcel.obtain();

        data.writeFileDescriptor(fd);

        data.writeStringArray(args);

        try {

            transact(DUMP_TRANSACTION, data,reply, 0);

            reply.readException();

        } finally {

            data.recycle();

            reply.recycle();

        }

    }

呼叫到

Parcel.java

    public final void writeFileDescriptor(FileDescriptor val) {

        updateNativeSize(nativeWriteFileDescriptor(mNativePtr,val));

    }

frameworks/base/core/jni/android_util_Binder.cpp

staticjboolean android_os_BinderProxy_transact(JNIEnv* env, jobject obj,

        jint code, jobject dataObj, jobjectreplyObj, jint flags) // throws RemoteException

{

frameworks/native/libs/binder/BpBinder.cpp

status_tBpBinder::transact(

    uint32_t code, const Parcel& data,Parcel* reply, uint32_t flags)

{

    // Once a binder has died, it will nevercome back to life.

    if (mAlive) {

        status_t status =IPCThreadState::self()->transact(

            mHandle, code, data, reply, flags);

./frameworks/native/libs/binder/IPCThreadState.cpp

status_tIPCThreadState::transact(int32_t handle,

                                  uint32_t code, const Parcel& data,

                                  Parcel*reply, uint32_t flags)

{

    status_t err = data.errorCheck();

    flags |= TF_ACCEPT_FDS;

    IF_LOG_TRANSACTIONS() {

        TextOutput::Bundle _b(alog);

        alog << "BC_TRANSACTION thr" << (void*)pthread_self() << " / hand "

            << handle << " /code " << TypeCode(code) << ": "

            << indent << data<< dedent << endl;

    }

    if (err == NO_ERROR) {

        LOG_ONEWAY(">>>> SENDfrom pid %d uid %d %s", getpid(), getuid(),

            (flags & TF_ONE_WAY) == 0 ?"READ REPLY" : "ONE WAY");

        err = writeTransactionData(BC_TRANSACTION, flags, handle,code, data, NULL);

    }

… …

        if (reply) {

            err = waitForResponse(reply);

        } else {

            Parcel fakeReply;

            err =waitForResponse(&fakeReply);

        }

status_tIPCThreadState::waitForResponse(Parcel *reply, status_t *acquireResult)

{

    uint32_t cmd;

    int32_t err;

#ifdef_MTK_ENG_BUILD_

    cmd = 0;// initialze it for build error[-Werror=maybe-uninitialized]

#endif

    while (1) {

        if ((err=talkWithDriver()) < NO_ERROR) break;

        err = mIn.errorCheck();

        if (err < NO_ERROR) break;

        if (mIn.dataAvail() == 0) continue;

        cmd = (uint32_t)mIn.readInt32();

status_tIPCThreadState::talkWithDriver(bool doReceive)

{

        if (ioctl(mProcess->mDriverFD, BINDER_WRITE_READ,&bwr) >= 0)

然後呼叫到binder驅動裡

最終，呼叫到方法binder_transaction

在裡面對fd進行了處理

kernel-3.18/drivers/staging/android/binder.c

static void binder_transaction(structbinder_proc *proc,

                               structbinder_thread *thread,

                               structbinder_transaction_data *tr, int reply)

{

… …

                case BINDER_TYPE_FD:{

                                int target_fd;

                                struct file *file;

                                if (reply) {

                                        if(!(in_reply_to->flags & TF_ACCEPT_FDS)) {

                                               binder_user_error

                                                    ("%d:%dgot reply with fd, %d, but target does not allow fds\n",

                                                    proc->pid, thread->pid, fp->handle);

                                               return_error = BR_FAILED_REPLY;

                                               goto err_fd_not_allowed;

                                        }

                                } else if(!target_node->accept_fds) {

                                       binder_user_error

                                           ("%d:%d got transaction with fd, %d, but target does not allowfds\n",

                                            proc->pid, thread->pid, fp->handle);

                                       return_error = BR_FAILED_REPLY;

                                        gotoerr_fd_not_allowed;

                                }

//根據檔案描述符獲取到其對應的檔案資訊

//在某些Unix系統中，該方法名是getf

                                file =fget(fp->handle);

                                if (file ==NULL) {

                                       binder_user_error

                                           ("%d:%d got transaction with invalid fd, %d\n",

                                            proc->pid, thread->pid, fp->handle);

                                       return_error = BR_FAILED_REPLY;

                                        gotoerr_fget_failed;

                                }

                                if(security_binder_transfer_file

                                   (proc->tsk, target_proc->tsk, file) < 0) {

                                       fput(file);

                                       return_error = BR_FAILED_REPLY;

                                        goto err_get_unused_fd_failed;

                                }

//在目標程序中獲取一個沒有使用的檔案描述符

                                target_fd =task_get_unused_fd_flags(target_proc, O_CLOEXEC);

                                if (target_fd< 0) {

                                        fput(file);

                                       return_error = BR_FAILED_REPLY;

                                        gotoerr_get_unused_fd_failed;

                                }

//把目標程序中新建的fd和file資訊關聯起來，實現了程序間fd的複製

                               task_fd_install(target_proc, target_fd, file);

                               trace_binder_transaction_fd(t, fp->handle, target_fd);

                               binder_debug(BINDER_DEBUG_TRANSACTION,

                                             "        fd %d -> %d\n", fp->handle,target_fd);

                                /* TODO: fput?*/

                                fp->binder =0;

                                fp->handle = target_fd;

#ifdefBINDER_MONITOR

                                e->fd =target_fd;

#endif

                        }

                        break;