Binder通信守护者ServiceManager

前面几章我们讨论了Binder驱动的核心实现，包括数据结构和跨进程操作方法。今天我们就在Android系统中看看整个实现的流程是什么样子，我们就从service_manager.c开始！

可能有人要问了，为什么是service_manager.c而不是其他的，这里我需要说明一下，service_manager.c是整个系统管理Binder的代码，也是一个守护进程，并且自己就是一个binder。所以我们就从它下手！

---

framework/native/cnds/servicemanager.cpp

int main(int argc, char **argv){    struct binder_state *bs;//[1]    bs = binder_open(128*1024);//[2]    if (binder_become_context_manager(bs)) {//[3]    ...    }    ...    binder_loop(bs, svcmgr_handler);//[4]    return 0;}

---

1 binder_state结构体

struct binder_state{    int fd;//表示打开的dev/binder文件描述符    void *mapped;//把设备文件映射到进程空间的起始地址    size_t mapsize;//内存映射空间的大小};

---

2 binder_open()

• 打开设备驱动
• 分配虚拟空间对应物理空间

struct binder_state *binder_open(size_t mapsize){    struct binder_state *bs;    bs = malloc(sizeof(*bs));    bs->fd = open("/dev/binder", O_RDWR);//[2.1]打开设备驱动    bs->mapsize = mapsize;    bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);//[2.2]分配虚拟空间对应物理空间    ...    return bs;    ...}

2.1 open()->binder_open()

打开设备节点，创建binder_proc进程结构体

static int     binder_open(struct inode *nodp, struct file *filp){    struct binder_proc *proc;//[2.1]binder进程    proc = kzalloc(sizeof(*proc), GFP_KERNEL);//给进程分配空间    get_task_struct(current);    proc->tsk = current;    INIT_LIST_HEAD(&proc->todo);//初始化todo链表    init_waitqueue_head(&proc->wait);//初始化wait队列    proc->default_priority = task_nice(current);//优先级相关    binder_lock(__func__);    binder_stats_created(BINDER_STAT_PROC);    hlist_add_head(&proc->proc_node, &binder_procs);    proc->pid = current->group_leader->pid;    INIT_LIST_HEAD(&proc->delivered_death);    filp->private_data = proc; //file文件指针的private_data变量指向binder_proc数据    binder_unlock(__func__);    return 0;}

2.2 mmap()->binder_mmap()

作用是在内存中分配内存，并且交给proc中
- proc->buffer = area->addr
- proc->user_buffer_offset
进行管理

static int binder_mmap(struct file *filp, struct vm_area_struct *vma){    int ret;    struct vm_struct *area;//内核虚拟空间    struct binder_proc *proc = filp->private_data;//在binder_open时候赋值的进程    const char *failure_string;    struct binder_buffer *buffer;    if ((vma->vm_end - vma->vm_start) > SZ_4M)        vma->vm_end = vma->vm_start + SZ_4M;//虚拟内存不能超过4M    ...    mutex_lock(&binder_mmap_lock);    area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP);//分配内存    proc->buffer = area->addr;//将内核的空间首地址分配proc->buffer    proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer;    mutex_unlock(&binder_mmap_lock);    ...    proc->pages = kzalloc(sizeof(proc->pages[0]) * ((vma->vm_end - vma->vm_start) / PAGE_SIZE), GFP_KERNEL);    ...    return ret;}

这里整个函数是在内核分配空间，分配好之后将物理内存与虚拟内存中内核空间接收到的Buffer与用户控件接收到的Buffer映射起来。

---

3 binder_become_context_manager()

给内核发送的消息是BINDER_SET_CONTEXT_MGR，然后内核创建一个binder_node *binder_context_mgr_node，这个binder_node是一个binder实体对象。

int binder_become_context_manager(struct binder_state *bs){    return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);//[3.1]}

3.1 ioctl()->binder_ioctl()

static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg){    int ret;    struct binder_proc *proc = filp->private_data;    struct binder_thread *thread;//binder线程    unsigned int size = _IOC_SIZE(cmd);    void __user *ubuf = (void __user *)arg;    ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);//进行睡眠直到唤醒操作发生    binder_lock(__func__);//进行锁操作    thread = binder_get_thread(proc);//[3.1.1]从进程中得到线程    switch (cmd) {        case BINDER_SET_CONTEXT_MGR://        ret = security_binder_set_context_mgr(proc->tsk);        if (binder_context_mgr_uid != -1) {        } else            binder_context_mgr_uid = current->cred->euid;        binder_context_mgr_node = binder_new_node(proc, NULL, NULL);//[3.1.2]创建ServiceManager实体        ...        break;    }    ...    return ret;}

3.1.1 binder_get_thread()

通过进程指针查找线程表，如果有当前线程则进行获取，如果没有当前线程将当前线程的资料整理之后放入进程中，并且返回。static struct binder_thread *binder_get_thread(struct binder_proc *proc){    struct binder_thread *thread = NULL;    struct rb_node *parent = NULL;    struct rb_node **p = &proc->threads.rb_node;//拿到存取线程的红黑树    while (*p) {//在红黑树中查找当前线程        parent = *p;        thread = rb_entry(parent, struct binder_thread, rb_node);        if (current->pid < thread->pid)            p = &(*p)->rb_left;        else if (current->pid > thread->pid)            p = &(*p)->rb_right;        else            break;    }    if (*p == NULL) {//当线程为null时候进行创建线程        thread = kzalloc(sizeof(*thread), GFP_KERNEL);        binder_stats_created(BINDER_STAT_THREAD);        thread->proc = proc;        thread->pid = current->pid;//保存当前线程的pid        init_waitqueue_head(&thread->wait);        INIT_LIST_HEAD(&thread->todo);        // 将新创建的node对象添加到proc红黑树；        rb_link_node(&thread->rb_node, parent, p);        rb_insert_color(&thread->rb_node, &proc->threads);        thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN;        thread->return_error = BR_OK;        thread->return_error2 = BR_OK;    }    return thread;}

3.1.2 binder_new_node()

static struct binder_node *binder_new_node(struct binder_proc *proc,                       void __user *ptr,                       void __user *cookie){    struct rb_node **p = &proc->nodes.rb_node;//拿到存取线程的红黑树    struct rb_node *parent = NULL;    struct binder_node *node;    while (*p) {//在红黑树中查找当前线程        parent = *p;        node = rb_entry(parent, struct binder_node, rb_node);        if (ptr < node->ptr)            p = &(*p)->rb_left;        else if (ptr > node->ptr)            p = &(*p)->rb_right;        else            return NULL;    }    node = kzalloc(sizeof(*node), GFP_KERNEL);    if (node == NULL)        return NULL;    binder_stats_created(BINDER_STAT_NODE);    rb_link_node(&node->rb_node, parent, p);    rb_insert_color(&node->rb_node, &proc->nodes);    node->debug_id = ++binder_last_id;    node->proc = proc;//保存当前线程的id    node->ptr = ptr;    node->cookie = cookie;    node->work.type = BINDER_WORK_NODE;//设置binder_work的type    //加入到binder_node的async_todo和binder_work两个队列。    INIT_LIST_HEAD(&node->work.entry);    INIT_LIST_HEAD(&node->async_todo);    return node;}

---

4 binder_loop()

void binder_loop(struct binder_state *bs, binder_handler func){    int res;    struct binder_write_read bwr;    uint32_t readbuf[32];    bwr.write_size = 0;    bwr.write_consumed = 0;    bwr.write_buffer = 0;    readbuf[0] = BC_ENTER_LOOPER;//此标记最后到binder_thread_write中对应//改变当前binder_thread里面的looper的标记(整型)    binder_write(bs, readbuf, sizeof(uint32_t));    for (;;) {        bwr.read_size = sizeof(readbuf);        bwr.read_consumed = 0;        bwr.read_buffer = (uintptr_t) readbuf;        res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);//[4.2]        res = binder_parse(bs, 0, (uintptr_t) readbuf, bwr.read_consumed, func);//[4.3]        ...    }}

4.2 ioctl()

这里要注意的是，拿到数据是看todo链表中有没有数据，写数据也是写入todo链表中。其中数据是binder_transaction结构体，当binder_transaction()写入数据给线程或者进程的todo链表之后，然后进行唤醒操作，之后就可以通过binder_thread_read()方法进行读取数据到用户态的bwr中。

static int binder_thread_read(struct binder_proc *proc,                  struct binder_thread *thread,                  void  __user *buffer, int size,                  signed long *consumed, int non_block){    void __user *ptr = buffer + *consumed;//bwr.read_buffer    void __user *end = buffer + size;    //当一开始读的时候，马上写入一个BR_NOOP，对于所有读操作数据头部都是BR_NOOP    //给bwr.read_buffer内写的数据格式是:BR_NOOP+cmd+数据+cmd+数据...    //如果保存返回结果的缓冲区中还没有数据先写入BR_NOOP消息    if (*consumed == 0) {        if (put_user(BR_NOOP, (uint32_t __user *)ptr))            return -EFAULT;        ptr += sizeof(uint32_t);    }    ret = wait_event_interruptible_exclusive(proc->wait, binder_has_proc_work(proc, thread));//如果没有数据的话，就停留在休眠状态    while (1) {        if (!list_empty(&thread->todo))//如果线程里面的todo链表有数据拿出来            w = list_first_entry(&thread->todo, struct binder_work, entry);        else if (!list_empty(&proc->todo) && wait_for_proc_work)            //否则线程所属的进程链表有数据的话拿出来            w = list_first_entry(&proc->todo, struct binder_work, entry);        switch (w->type) {        case BINDER_WORK_TRANSACTION: {//这个type是binder_thread_write最后添加链表的时候写的            t = container_of(w, struct binder_transaction, work);//根据work得到binder_transaction        } break;        //调整优先级        if (t->buffer->target_node) {            struct binder_node *target_node = t->buffer->target_node;            tr.target.ptr = target_node->ptr;            tr.cookie =  target_node->cookie;            t->saved_priority = task_nice(current);            if (t->priority < target_node->min_priority &&                !(t->flags & TF_ONE_WAY))                binder_set_nice(t->priority);            else if (!(t->flags & TF_ONE_WAY) ||                 t->saved_priority > target_node->min_priority)                binder_set_nice(target_node->min_priority);            cmd = BR_TRANSACTION;//由于是从驱动返回用户空间把命令改成BR_TRANSACTION        }        //这里进行构造binder_transaction_data，然后返回到service_manager.c中，这里ioctl就执行完毕        tr.data_size = t->buffer->data_size;        tr.offsets_size = t->buffer->offsets_size;        tr.data.ptr.buffer = (void *)t->buffer->data +                    proc->user_buffer_offset;        tr.data.ptr.offsets = tr.data.ptr.buffer +                    ALIGN(t->buffer->data_size,                        sizeof(void *));        //把tr数据复制到用户空间        if (put_user(cmd, (uint32_t __user *)ptr))            return -EFAULT;        ptr += sizeof(uint32_t);        if (copy_to_user(ptr, &tr, sizeof(tr)))            return -EFAULT;        ptr += sizeof(tr);        break;    }    return 0;}

4.3 binder_parse()

int binder_parse(struct binder_state *bs, struct binder_io *bio,                 uintptr_t ptr, size_t size, binder_handler func){    int r = 1;    uintptr_t end = ptr + (uintptr_t) size;    while (ptr < end) {        uint32_t cmd = *(uint32_t *) ptr;        ptr += sizeof(uint32_t);        switch(cmd) {        case BR_NOOP:            break;        case BR_TRANSACTION_COMPLETE:            break;        case BR_INCREFS:        case BR_ACQUIRE:        case BR_RELEASE:        case BR_DECREFS:            ptr += sizeof(struct binder_ptr_cookie);            break;        case BR_TRANSACTION: {            struct binder_transaction_data *txn = (struct binder_transaction_data *) ptr;            binder_dump_txn(txn);            if (func) {                unsigned rdata[256/4];                struct binder_io msg;                struct binder_io reply;                int res;                bio_init(&reply, rdata, sizeof(rdata), 4);                bio_init_from_txn(&msg, txn);                res = func(bs, txn, &msg, &reply);//[4.3.1]调用传递进来的处理方法                binder_send_reply(bs, &reply, txn->data.ptr.buffer, res);            }            ptr += sizeof(*txn);            break;        }        case BR_REPLY: {            struct binder_transaction_data *txn = (struct binder_transaction_data *) ptr;            if ((end - ptr) < sizeof(*txn)) {                ALOGE("parse: reply too small!\n");                return -1;            }            binder_dump_txn(txn);            if (bio) {                bio_init_from_txn(bio, txn);                bio = 0;            } else {                /* todo FREE BUFFER */            }            ptr += sizeof(*txn);            r = 0;            break;        }        case BR_DEAD_BINDER: {            struct binder_death *death = (struct binder_death *)(uintptr_t) *(binder_uintptr_t *)ptr;            ptr += sizeof(binder_uintptr_t);            death->func(bs, death->ptr);            break;        }        case BR_FAILED_REPLY:            r = -1;            break;        case BR_DEAD_REPLY:            r = -1;            break;        default:            ALOGE("parse: OOPS %d\n", cmd);            return -1;        }    }    return r;}

4.3.1 svcmgr_handler()

int svcmgr_handler(struct binder_state *bs,                   struct binder_transaction_data *txn,                   struct binder_io *msg,                   struct binder_io *reply){   ...    switch(txn->code) {    case SVC_MGR_GET_SERVICE:    case SVC_MGR_CHECK_SERVICE:        s = bio_get_string16(msg, &len);        if (s == NULL) {            return -1;        }        //[4.3.1.1]找service        handle = do_find_service(bs, s, len, txn->sender_euid, txn->sender_pid);        if (!handle)            break;        bio_put_ref(reply, handle);        return 0;    case SVC_MGR_ADD_SERVICE:        s = bio_get_string16(msg, &len);        if (s == NULL) {            return -1;        }        handle = bio_get_ref(msg);        allow_isolated = bio_get_uint32(msg) ? 1 : 0;        if (do_add_service(bs, s, len, handle, txn->sender_euid,            allow_isolated, txn->sender_pid))            return -1;        break;    case SVC_MGR_LIST_SERVICES: {        uint32_t n = bio_get_uint32(msg);        if (!svc_can_list(txn->sender_pid)) {            ALOGE("list_service() uid=%d - PERMISSION DENIED\n",                    txn->sender_euid);            return -1;        }        si = svclist;        while ((n-- > 0) && si)            si = si->next;        if (si) {            bio_put_string16(reply, si->name);            return 0;        }        return -1;    }    default:        ALOGE("unknown code %d\n", txn->code);        return -1;    }    bio_put_uint32(reply, 0);    return 0;}

4.3.1.1 do_find_service()

同时我们知道找到服务返回的是handle值，这个值就在内核中引用的Binder对象。

uint32_t do_find_service(struct binder_state *bs, const uint16_t *s, size_t len, uid_t uid, pid_t spid){    struct svcinfo *si = find_svc(s, len);[4.3.1.1.1]    if (!si || !si->handle) {        return 0;    }    if (!si->allow_isolated) {        uid_t appid = uid % AID_USER;        if (appid >= AID_ISOLATED_START && appid <= AID_ISOLATED_END) {            return 0;        }    }    if (!svc_can_find(s, len, spid)) {        return 0;    }    return si->handle;}

4.3.1.1.1 find_svc()

从svclist服务列表中，根据服务名遍历查找是否已经注册。当服务已存在svclist，则返回相应的服务名，否则返回NULL。

struct svcinfo *find_svc(const uint16_t *s16, size_t len){    struct svcinfo *si;    for (si = svclist; si; si = si->next) {        if ((len == si->len) &&            !memcmp(s16, si->name, len * sizeof(uint16_t))) {            return si;        }    }    return NULL;}

这里我们知道有svclist，但是我们并不知道从哪里来的这个数据结构，看下面

int do_add_service(struct binder_state *bs,                   const uint16_t *s, size_t len,                   uint32_t handle, uid_t uid, int allow_isolated,                   pid_t spid){    struct svcinfo *si;    if (!handle || (len == 0) || (len > 127))        return -1;    if (!svc_can_register(s, len, spid)) {        ALOGE("add_service('%s',%x) uid=%d - PERMISSION DENIED\n",             str8(s, len), handle, uid);        return -1;    }    si = find_svc(s, len);    if (si) {        if (si->handle) {            svcinfo_death(bs, si);        }        si->handle = handle;    } else {        si = malloc(sizeof(*si) + (len + 1) * sizeof(uint16_t));        if (!si) {            return -1;        }        si->handle = handle;        si->len = len;        memcpy(si->name, s, (len + 1) * sizeof(uint16_t));        si->name[len] = '\0';        si->death.func = (void*) svcinfo_death;        si->death.ptr = si;        si->allow_isolated = allow_isolated;        si->next = svclist;        svclist = si;//不断向链表中添加    }    binder_acquire(bs, handle);    binder_link_to_death(bs, handle, &si->death);    return 0;}

总结：

首先我们知道了ServiceManager做的事情就是管理Binder。那么我们也知道到ServiceManager的流程如下：

• 1.打开open()驱动文件节点，并且通过mmap()分配虚拟空间，对应到真实的物理空间中去。
• 2.然后通过binder_become_context_manager()创建一个Binder实体在内核
• 3.进入循环状态，等待Client端的请求：binder_loop()。