前面从不同片段分析了Android的Binder通信机制，本文结合前面介绍的内容，对整个Android的Binder通信过程进行一次完整的分析。分析以AudioService服务的注册过程为例。
由于Android中的所有Java服务都驻留在SystemServer进程中，在SystemServer启动的时候，通过创建ServerThread线程来注册所有的Java服务，AudioService也不例外，因此AudioService的注册过程其实就是SystemServer进程与ServiceManager进程之间的一次远程RPC调用过程。
进程间通信过程的具体步骤如下图所示：
客户进程向目标进程发送服务注册信息
- if (!"0".equals(SystemProperties.get("system_init.startaudioservice"))) {
- try {
- Slog.i(TAG, "Audio Service");
- ServiceManager.addService(Context.AUDIO_SERVICE, new AudioService(context));
- } catch (Throwable e) {
- reportWtf("starting Audio Service", e);
- }
- }
通过ServiceManager.addService(Context.AUDIO_SERVICE, new AudioService(context))向ServiceManager进程注册一个AudioService服务。
- public static void addService(String name, IBinder service) {
- try {
- getIServiceManager().addService(name, service, false);
- } catch (RemoteException e) {
- Log.e(TAG, "error in addService", e);
- }
- }
getIServiceManager()函数已经在Android请求注册服务过程源码分析文中进行了详细分析，该函数用于得到IServiceManager的远程代理ServiceManagerProxy接口对象，因此调用ServiceManagerProxy对象的addService函数来完成服务注册过程
- public void addService(String name, IBinder service, boolean allowIsolated)
- throws RemoteException {
- Parcel data = Parcel.obtain();
- Parcel reply = Parcel.obtain();
- data.writeInterfaceToken(IServiceManager.descriptor);
- data.writeString(name);
- data.writeStrongBinder(service);
- data.writeInt(allowIsolated ? 1 : 0);
- mRemote.transact(ADD_SERVICE_TRANSACTION, data, reply, 0);
- reply.recycle();
- data.recycle();
- }
发送的数据为：
data.writeInterfaceToken("android.os.IServiceManager");
data.writeString("audio");
data.writeStrongBinder(new AudioService(context));
data.writeInt(0);
关于Parcel数据序列化问题请阅读Android 数据Parcel序列化过程源码分析 AudioService是一个Binder对象，其flat_binder_object结构体描述如下：
- obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
- obj.type = BINDER_TYPE_BINDER;
- obj.binder = local->getWeakRefs();
- obj.cookie = local;
由于数据传输的目标进程时ServiceManager进程，在Android系统中，ServiceManager的引用句柄值规定为0，因此ServiceManager进程的通信Binder代理对象为new BpBinder(0)，其对应的Java层的Binder代理对象mRemote = new BinderProxy(new BpBinder(0)),于是这里调用BinderProxy的transact()函数来传输数据,Android请求注册服务过程源码分析中通过图说明了BinderProxy与BpBinder之间的关系，BinderProxy通过其成员变量mObject来保存其对应的BpBinder对象地址。BinderProxy对象的transact函数的定义如下：
- public native boolean transact(int code, Parcel data, Parcel reply,int flags) throws RemoteException;
这是一个本地函数，其对应的JNI函数的实现为：
frameworks\base\core\jni\android_util_Binder.cpp
- static jboolean android_os_BinderProxy_transact(JNIEnv* env, jobject obj,
- jint code, jobject dataObj, jobject replyObj, jint flags)
- {
- if (dataObj == NULL) {
- jniThrowNullPointerException(env, NULL);
- return JNI_FALSE;
- }
-
- Parcel* data = parcelForJavaObject(env, dataObj);
- if (data == NULL) {
- return JNI_FALSE;
- }
- Parcel* reply = parcelForJavaObject(env, replyObj);
- if (reply == NULL && replyObj != NULL) {
- return JNI_FALSE;
- }
-
- IBinder* target = (IBinder*)env->GetIntField(obj, gBinderProxyOffsets.mObject);
- if (target == NULL) {
- jniThrowException(env, "java/lang/IllegalStateException", "Binder has been finalized!");
- return JNI_FALSE;
- }
-
- ALOGV("Java code calling transact on %p in Java object %p with code %d\n",
- target, obj, code);
-
-
-
- const bool time_binder_calls = should_time_binder_calls();
-
- int64_t start_millis;
- if (time_binder_calls) {
- start_millis = uptimeMillis();
- }
-
- status_t err = target->transact(code, *data, reply, flags);
-
- if (time_binder_calls) {
- conditionally_log_binder_call(start_millis, target, code);
- }
-
- if (err == NO_ERROR) {
- return JNI_TRUE;
- } else if (err == UNKNOWN_TRANSACTION) {
- return JNI_FALSE;
- }
-
- signalExceptionForError(env, obj, err, true );
- return JNI_FALSE;
- }
该函数在
Android请求注册服务过程源码分析中已经详细分析过来，首先通过BinderProxy的成员变量mObject取得C++层的BpBinder对象new BpBinder(0) 的地址，并使用该对象来真正传输数据
- status_t BpBinder::transact(uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
- {
- if (mAlive) {
- status_t status = IPCThreadState::self()->transact(mHandle, code, data, reply, flags);
- if (status == DEAD_OBJECT) mAlive = 0;
- return status;
- }
-
- return DEAD_OBJECT;
- }
code = ADD_SERVICE_TRANSACTION
mHandle = 0
flags = 0
该函数最终调用IPCThreadState的transact来完成数据传输
- status_t IPCThreadState::transact(int32_t handle,
- uint32_t code, const Parcel& data,
- Parcel* reply, uint32_t flags)
- {
- status_t err = data.errorCheck();
-
- flags |= TF_ACCEPT_FDS;
- if (err == NO_ERROR) {
- err = writeTransactionData(BC_TRANSACTION, flags, handle, code, data, NULL);
- }
-
- if (err != NO_ERROR) {
- if (reply) reply->setError(err);
- return (mLastError = err);
- }
-
- if ((flags & TF_ONE_WAY) == 0) {
- if (reply) {
- err = waitForResponse(reply);
- } else {
- Parcel fakeReply;
- err = waitForResponse(&fakeReply);
- }
- } else {
- err = waitForResponse(NULL, NULL);
- }
-
- return err;
- }
函数通过writeTransactionData()函数将上面的数据写入到IPCThreadState的成员变量mOut中，writeTransactionData(BC_TRANSACTION, TF_ACCEPT_FDS, 0, GET_SERVICE_TRANSACTION, data, NULL)
- status_t IPCThreadState::writeTransactionData(int32_t cmd, uint32_t binderFlags,
- int32_t handle, uint32_t code, const Parcel& data, status_t* statusBuffer)
- {
- binder_transaction_data tr;
-
- tr.target.handle = handle;
- tr.code = code;
- tr.flags = binderFlags;
- tr.cookie = 0;
- tr.sender_pid = 0;
- tr.sender_euid = 0;
-
- const status_t err = data.errorCheck();
- if (err == NO_ERROR) {
- tr.data_size = data.ipcDataSize();
- tr.data.ptr.buffer = data.ipcData();
- tr.offsets_size = data.ipcObjectsCount()*sizeof(size_t);
- tr.data.ptr.offsets = data.ipcObjects();
- } else if (statusBuffer) {
- tr.flags |= TF_STATUS_CODE;
- *statusBuffer = err;
- tr.data_size = sizeof(status_t);
- tr.data.ptr.buffer = statusBuffer;
- tr.offsets_size = 0;
- tr.data.ptr.offsets = NULL;
- } else {
- return (mLastError = err);
- }
-
- mOut.writeInt32(cmd);
- mOut.write(&tr, sizeof(tr));
-
- return NO_ERROR;
- }
然后调用函数waitForResponse将mOut中的数据发送到Binder驱动中，并等待服务进程返回执行结果
- status_t IPCThreadState::waitForResponse(Parcel *reply, status_t *acquireResult)
- {
- int32_t cmd;
- int32_t err;
- while (1) {
- if ((err=talkWithDriver()) < NO_ERROR) break;
- err = mIn.errorCheck();
- if (err < NO_ERROR) break;
- if (mIn.dataAvail() == 0) continue;
-
- cmd = mIn.readInt32();
-
- switch (cmd) {
- case BR_TRANSACTION_COMPLETE:
- case BR_DEAD_REPLY:
- case BR_FAILED_REPLY:
- case BR_ACQUIRE_RESULT:
- case BR_REPLY:
- default:
- err = executeCommand(cmd);
- if (err != NO_ERROR) goto finish;
- break;
- }
- }
- finish:
- if (err != NO_ERROR) {
- if (acquireResult) *acquireResult = err;
- if (reply) reply->setError(err);
- mLastError = err;
- }
- return err;
- }
使用函数talkWithDriver()与Binder驱动交互
- status_t IPCThreadState::talkWithDriver(bool doReceive)
- {
- ALOG_ASSERT(mProcess->mDriverFD >= 0, "Binder driver is not opened");
- binder_write_read bwr;
-
- const bool needRead = mIn.dataPosition() >= mIn.dataSize();
- const size_t outAvail = (!doReceive || needRead) ? mOut.dataSize() : 0;
-
- bwr.write_size = outAvail;
- bwr.write_buffer = (long unsigned int)mOut.data();
-
- if (doReceive && needRead) {
- bwr.read_size = mIn.dataCapacity();
- bwr.read_buffer = (long unsigned int)mIn.data();
- } else {
- bwr.read_size = 0;
- bwr.read_buffer = 0;
- }
- if ((bwr.write_size == 0) && (bwr.read_size == 0)) return NO_ERROR;
-
- bwr.write_consumed = 0;
- bwr.read_consumed = 0;
- status_t err;
- do {
- #if defined(HAVE_ANDROID_OS)
- if (ioctl(mProcess->mDriverFD, BINDER_WRITE_READ, &bwr) >= 0)
- err = NO_ERROR;
- else
- err = -errno;
- #else
- err = INVALID_OPERATION;
- #endif
- } while (err == -EINTR);
-
- if (err >= NO_ERROR) {
- if (bwr.write_consumed > 0) {
- if (bwr.write_consumed < (ssize_t)mOut.dataSize())
- mOut.remove(0, bwr.write_consumed);
- else
- mOut.setDataSize(0);
- }
- if (bwr.read_consumed > 0) {
- mIn.setDataSize(bwr.read_consumed);
- mIn.setDataPosition(0);
- }
- return NO_ERROR;
- }
-
- return err;
- }
将数据发送与接收容器Parce封装在binder_write_read结构体中，最后通过ioctl系统调用进入Binder驱动，此时的数据为：
cmd = BINDER_WRITE_READ
bwr.write_size = outAvail;
bwr.write_buffer = (long unsigned int)mOut.data();
bwr.write_consumed = 0;
bwr.read_size = mIn.dataCapacity();
bwr.read_buffer = (long unsigned int)mIn.data();
bwr.read_consumed = 0;
因为write_size大于0，因此在此次的ioctl函数的BINDER_WRITE_READ命令下只执行Binder数据写操作
- static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
- {
- int ret;
- struct binder_proc *proc = filp->private_data;
- struct binder_thread *thread;
- unsigned int size = _IOC_SIZE(cmd);
- void __user *ubuf = (void __user *)arg;
-
-
-
- ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
- if (ret)
- return ret;
-
- mutex_lock(&binder_lock);
- thread = binder_get_thread(proc);
- if (thread == NULL) {
- ret = -ENOMEM;
- goto err;
- }
-
- switch (cmd) {
- case BINDER_WRITE_READ: {
- struct binder_write_read bwr;
- if (size != sizeof(struct binder_write_read)) {
- ret = -EINVAL;
- goto err;
- }
- if (copy_from_user(&bwr, ubuf, sizeof(bwr))) {
- ret = -EFAULT;
- goto err;
- }
- if (bwr.write_size > 0) {
- ret = binder_thread_write(proc, thread, (void __user *)bwr.write_buffer, bwr.write_size, &bwr.write_consumed);
- if (ret < 0) {
- bwr.read_consumed = 0;
- if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
- ret = -EFAULT;
- goto err;
- }
- }
- if (bwr.read_size > 0) {
- ret = binder_thread_read(proc, thread, (void __user *)bwr.read_buffer, bwr.read_size, &bwr.read_consumed, filp->f_flags & O_NONBLOCK);
- if (!list_empty(&proc->todo))
- wake_up_interruptible(&proc->wait);
- if (ret < 0) {
- if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
- ret = -EFAULT;
- goto err;
- }
- }
- if (copy_to_user(ubuf, &bwr, sizeof(bwr))) {
- ret = -EFAULT;
- goto err;
- }
- break;
- }
- default:
- ret = -EINVAL;
- goto err;
- }
- ret = 0;
- err:
- if (thread)
- thread->looper &= ~BINDER_LOOPER_STATE_NEED_RETURN;
- mutex_unlock(&binder_lock);
- wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
- if (ret && ret != -ERESTARTSYS)
- printk(KERN_INFO "binder: %d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret);
- return ret;
- }
binder_ioctl函数在Android IPC数据在内核空间中的发送过程分析中已经详细介绍了，根据传进来的参数可知，这里只执行binder_thread_write数据写操作。
- int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread,
- void __user *buffer, int size, signed long *consumed)
- {
- uint32_t cmd;
- void __user *ptr = buffer + *consumed;
- void __user *end = buffer + size;
-
- while (ptr < end && thread->return_error == BR_OK) {
- if (get_user(cmd, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
- if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) {
- binder_stats.bc[_IOC_NR(cmd)]++;
- proc->stats.bc[_IOC_NR(cmd)]++;
- thread->stats.bc[_IOC_NR(cmd)]++;
- }
- switch (cmd) {
- case BC_TRANSACTION:
- case BC_REPLY: {
- struct binder_transaction_data tr;
- if (copy_from_user(&tr, ptr, sizeof(tr)))
- return -EFAULT;
- ptr += sizeof(tr);
- binder_transaction(proc, thread, &tr, cmd == BC_REPLY);
- break;
- }
- default:
- printk(KERN_ERR "binder: %d:%d unknown command %d\n",
- proc->pid, thread->pid, cmd);
- return -EINVAL;
- }
- *consumed = ptr - buffer;
- }
- return 0;
- }
在数据发送Parcel对象中可以发送多个Binder命令
此次发送到Binder驱动的命令只有一个，因此在遍历buffer时，只能取出cmd = BINDER_WRITE_READ，该命令下发送的数据为：
binder_thread_write函数在Android IPC数据在内核空间中的发送过程分析中也详细介绍了，由于Binder命令为BC_TRANSACTION，因此会调用binder_transaction函数来传输Binder实体对象到目标进程。binder_transaction函数首先将参数binder_transaction_data来封装一个工作事务binder_transaction
- struct binder_transaction *t;
-
- t = kzalloc(sizeof(*t), GFP_KERNEL);
-
- tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL);
- binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE);
-
- t->debug_id = ++binder_last_id;
- if (!reply && !(tr->flags & TF_ONE_WAY))
- t->from = thread;
- else
- t->from = NULL;
- t->sender_euid = proc->tsk->cred->euid;
- t->to_proc = target_proc;
- t->to_thread = target_thread;
- t->code = tr->code;
- t->flags = tr->flags;
- t->priority = task_nice(current);
- t->buffer = binder_alloc_buf(target_proc, tr->data_size,
- tr->offsets_size, !reply && (t->flags & TF_ONE_WAY));
- if (t->buffer == NULL) {
- return_error = BR_FAILED_REPLY;
- goto err_binder_alloc_buf_failed;
- }
- t->buffer->allow_user_free = 0;
- t->buffer->debug_id = t->debug_id;
- t->buffer->transaction = t;
- t->buffer->target_node = target_node;
- offp = (size_t *)(t->buffer->data + ALIGN(tr->data_size, sizeof(void *)));
- if (copy_from_user(t->buffer->data, tr->data.ptr.buffer, tr->data_size)) {
-
- }
- if (copy_from_user(offp, tr->data.ptr.offsets, tr->offsets_size)) {
-
- }
接下来遍历Parcel对象中的所有flat_binder_object结构体，因为这里传输了一个AudioService Binder对象，其对应的flat_binder_object如下：
- obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
- obj.type = BINDER_TYPE_BINDER;
- obj.binder = local->getWeakRefs();
- obj.cookie = local;
这是一个Binder实体对象，在传输过程中对Binder实体对象的处理过程如下：
- for (; offp < off_end; offp++) {
- struct flat_binder_object *fp;
- if (*offp > t->buffer->data_size - sizeof(*fp) ||
- t->buffer->data_size < sizeof(*fp) ||
- !IS_ALIGNED(*offp, sizeof(void *))) {
- return_error = BR_FAILED_REPLY;
- goto err_bad_offset;
- }
- fp = (struct flat_binder_object *)(t->buffer->data + *offp);
- switch (fp->type) {
-
- case BINDER_TYPE_BINDER:
- case BINDER_TYPE_WEAK_BINDER: {
- struct binder_ref *ref;
-
- struct binder_node *node = binder_get_node(proc, fp->binder);
-
- if (node == NULL) {
-
- node = binder_new_node(proc, fp->binder, fp->cookie);
- if (node == NULL) {
- return_error = BR_FAILED_REPLY;
- goto err_binder_new_node_failed;
- }
- node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK;
- node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS);
- }
- if (fp->cookie != node->cookie) {
- goto err_binder_get_ref_for_node_failed;
- }
-
- ref = binder_get_ref_for_node(target_proc, node);
- if (ref == NULL) {
- return_error = BR_FAILED_REPLY;
- goto err_binder_get_ref_for_node_failed;
- }
-
- if (fp->type == BINDER_TYPE_BINDER)
- fp->type = BINDER_TYPE_HANDLE;
- else
- fp->type = BINDER_TYPE_WEAK_HANDLE;
-
- fp->handle = ref->desc;
- binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE,&thread->todo);
- } break;
-
- default:
- return_error = BR_FAILED_REPLY;
- goto err_bad_object_type;
- }
- }
函数首先从当前进程的binder_proc中查找该Binder对象在内核中的Binder节点
- struct binder_node *node = binder_get_node(proc, fp->binder);
参数proc为当前进程即SystemServer进程的binder_proc，参数fp->binder为传输的Binder实体对象内部的弱引用对象地址，binder_get_node函数就是从SystemServer进程中根据Binder实体对象内部的弱引用对象地址查找该Binder实体对象在内核空间中的Binder节点，其实现如下：
- static struct binder_node *binder_get_node(struct binder_proc *proc,
- void __user *ptr)
- {
- struct rb_node *n = proc->nodes.rb_node;
- struct binder_node *node;
-
- while (n) {
- node = rb_entry(n, struct binder_node, rb_node);
-
- if (ptr < node->ptr)
- n = n->rb_left;
- else if (ptr > node->ptr)
- n = n->rb_right;
- else
- return node;
- }
- return NULL;
- }
该函数实现比较简单，就是从binder_proc的nodes红黑树中查找指定的binder_node节点，因为是第一次传输AudioService对象，因此在内核空间中不存在该对象对应的Binder节点，于是调用函数binder_new_node在内核空间中为该Binder实体对象创建对应的Binder节点，在后续传输该Binder实体对象时就可以查找到了
- static struct binder_node *binder_new_node(struct binder_proc *proc,
- void __user *ptr,
- void __user *cookie)
- {
- struct rb_node **p = &proc->nodes.rb_node;
- struct rb_node *parent = NULL;
- struct binder_node *node;
-
- while (*p) {
- parent = *p;
- node = rb_entry(parent, struct binder_node, rb_node);
-
- if (ptr < node->ptr)
- p = &(*p)->rb_left;
- else if (ptr > node->ptr)
- p = &(*p)->rb_right;
- else
- return NULL;
- }
-
- node = kzalloc(sizeof(*node), GFP_KERNEL);
- if (node == NULL)
- return NULL;
- binder_stats_created(BINDER_STAT_NODE);
-
- rb_link_node(&node->rb_node, parent, p);
- rb_insert_color(&node->rb_node, &proc->nodes);
-
- node->debug_id = ++binder_last_id;
- node->proc = proc;
- node->ptr = ptr;
- node->cookie = cookie;
- node->work.type = BINDER_WORK_NODE;
- INIT_LIST_HEAD(&node->work.entry);
- INIT_LIST_HEAD(&node->async_todo);
- return node;
- }
函数为AudioService这个服务Binder实体对象在内核空间中创建了对应的Binder节点，并且将该Binder实体对象的用户空间地址保存到了其对应的Binder节点中，这样就可以通过内核空间的Binder节点找到对应的用户空间的Binder实体对象，同时将创建的该Binder节点挂载到SystemServer进程的binder_proc中。
然后为ServiceManager进程创建该Binder节点的Binder引用对象
- ref = binder_get_ref_for_node(target_proc, node);
target_proc此时是ServiceManager进程的binder_proc，参数node是前面为注册的AudioService这个Binder实体对象创建的内核空间的Binder节点。调用binder_get_ref_for_node函数为ServiceManager进程创建一个AudioService对应的Binder节点的Binder引用对象
- static struct binder_ref *binder_get_ref_for_node(struct binder_proc *proc,
- struct binder_node *node)
- {
- struct rb_node *n;
- struct rb_node **p = &proc->refs_by_node.rb_node;
- struct rb_node *parent = NULL;
- struct binder_ref *ref, *new_ref;
-
- while (*p) {
- parent = *p;
- ref = rb_entry(parent, struct binder_ref, rb_node_node);
-
- if (node < ref->node)
- p = &(*p)->rb_left;
- else if (node > ref->node)
- p = &(*p)->rb_right;
- else
- return ref;
- }
-
- new_ref = kzalloc(sizeof(*ref), GFP_KERNEL);
- if (new_ref == NULL)
- return NULL;
- binder_stats_created(BINDER_STAT_REF);
- new_ref->debug_id = ++binder_last_id;
-
- new_ref->proc = proc;
- new_ref->node = node;
- rb_link_node(&new_ref->rb_node_node, parent, p);
- rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node);
-
- new_ref->desc = (node == binder_context_mgr_node) ? 0 : 1;
-
- for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) {
- ref = rb_entry(n, struct binder_ref, rb_node_desc);
- if (ref->desc > new_ref->desc)
- break;
- new_ref->desc = ref->desc + 1;
- }
-
- p = &proc->refs_by_desc.rb_node;
- while (*p) {
- parent = *p;
- ref = rb_entry(parent, struct binder_ref, rb_node_desc);
-
- if (new_ref->desc < ref->desc)
- p = &(*p)->rb_left;
- else if (new_ref->desc > ref->desc)
- p = &(*p)->rb_right;
- else
- BUG();
- }
- rb_link_node(&new_ref->rb_node_desc, parent, p);
- rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc);
- return new_ref;
- }
函数首先从binder_proc的红黑树中查找是否存在引用node这个Binder节点的Binder引用对象，如果没有，则创建一个引用node这个Binder节点的Binder引用对象，同时设置该Binder引用对象的描述符，同一个进程中的每个Binder引用对象都有唯一的描述符。在Android系统中，服务的注册过程其实就是为用户空间的Binder实体对象在内核空间中创建对应的Binder节点，并且在ServiceManager进程的binder_proc中创建引用该Binder节点的引用对象，同时将该引用对象的描述符保存到ServiceManager进程的用户空间的链表中。
- if (fp->type == BINDER_TYPE_BINDER)
- fp->type = BINDER_TYPE_HANDLE;
- else
- fp->type = BINDER_TYPE_WEAK_HANDLE;
- fp->handle = ref->desc;
由于此时注册的是AudioService Binder实体对象，因此fp的值被修改为：
- fp->flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
- fp->type = BINDER_TYPE_HANDLE;
- fp->cookie = local;
- fp->handle = ref->desc;
然后将事务t挂载到目标进程的待处理队列，将完成事务tcomplete挂载到当前Binder线程的待处理队列中
-
- t->work.type = BINDER_WORK_TRANSACTION;
-
- list_add_tail(&t->work.entry, target_list);
-
- tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
-
- list_add_tail(&tcomplete->entry, &thread->todo);
然后唤醒目标进程
- wake_up_interruptible(target_wait);
由于mHandle =0
- target_node = binder_context_mgr_node;
- target_proc = target_node->proc;
- target_list = &target_proc->todo;
- target_wait = &target_proc->wait;
此时的目标进程就是ServiceManager进程，ServiceManager进程此时睡眠在binder_thread_read函数中，被唤醒后继续执行binder_thread_read函数，同时客户端进程将从刚才执行的binder_transaction函数返回到binder_ioctl函数，由于bwr.read_size = mIn.dataCapacity()，于是进入binder_thread_read函数：
- static int binder_thread_read(struct binder_proc *proc,
- struct binder_thread *thread,
- void __user *buffer, int size,
- signed long *consumed, int non_block)
- {
- void __user *ptr = buffer + *consumed;
- void __user *end = buffer + size;
-
- int ret = 0;
- int wait_for_proc_work;
-
- if (*consumed == 0) {
-
- if (put_user(BR_NOOP, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
- }
- retry:
-
- wait_for_proc_work = thread->transaction_stack == NULL && list_empty(&thread->todo);
-
- if (thread->return_error != BR_OK && ptr < end) {
- if (thread->return_error2 != BR_OK) {
- if (put_user(thread->return_error2, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
- if (ptr == end)
- goto done;
- thread->return_error2 = BR_OK;
- }
- if (put_user(thread->return_error, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
- thread->return_error = BR_OK;
- goto done;
- }
-
- thread->looper |= BINDER_LOOPER_STATE_WAITING;
-
- if (wait_for_proc_work)
- proc->ready_threads++;
- mutex_unlock(&binder_lock);
- if (wait_for_proc_work) {
- if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED))) {
- wait_event_interruptible(binder_user_error_wait,binder_stop_on_user_error < 2);
- }
-
- binder_set_nice(proc->default_priority);
-
- if (non_block) {
- if (!binder_has_proc_work(proc, thread))
- ret = -EAGAIN;
- } else
- ret = wait_event_interruptible_exclusive(proc->wait, binder_has_proc_work(proc, thread));
- } else {
- if (non_block) {
- if (!binder_has_thread_work(thread))
- ret = -EAGAIN;
- } else
-
- ret = wait_event_interruptible(thread->wait, binder_has_thread_work(thread));
- }
函数通过wait_event_interruptible_exclusive睡眠等待目标进程发送服务注册结果，到此和Binder驱动交互的客户端当前Binder线程就进入睡眠等待状态了。接下来分析目标进程被唤醒后的执行过程。
目标进程IPC数据接收过程
ServiceManager 进程启动源码分析分析了ServiceManager进程的启动过程，ServiceManager启动完成后最终将睡眠等待客户进程的请求，前面分析了当客户进程将IPC数据发送给目标进程后，会唤醒正在睡眠等待客户请求的目标进程，当ServiceManager进程被唤醒后，会继续执行睡眠等待wait_event_interruptible之后的代码，这部分代码如下：
- mutex_lock(&binder_lock);
-
- if (wait_for_proc_work)
-
- proc->ready_threads--;
-
- thread->looper &= ~BINDER_LOOPER_STATE_WAITING;
- if (ret)
- return ret;
-
- while (1) {
- uint32_t cmd;
- struct binder_transaction_data tr;
- struct binder_work *w;
- struct binder_transaction *t = NULL;
-
- if (!list_empty(&thread->todo))
-
- w = list_first_entry(&thread->todo, struct binder_work, entry);
-
- else if (!list_empty(&proc->todo) && wait_for_proc_work)
-
- w = list_first_entry(&proc->todo, struct binder_work, entry);
- else {
- if (ptr - buffer == 4 && !(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN))
- goto retry;
- break;
- }
-
- if (end - ptr < sizeof(tr) + 4)
- break;
-
- switch (w->type) {
- case BINDER_WORK_TRANSACTION: {
-
- t = container_of(w, struct binder_transaction, work);
- } break;
- case BINDER_WORK_TRANSACTION_COMPLETE: {
- cmd = BR_TRANSACTION_COMPLETE;
- if (put_user(cmd, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
- binder_stat_br(proc, thread, cmd);
- list_del(&w->entry);
- kfree(w);
- binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
- } break;
- case BINDER_WORK_NODE: {
- struct binder_node *node = container_of(w, struct binder_node, work);
- uint32_t cmd = BR_NOOP;
- const char *cmd_name;
- int strong = node->internal_strong_refs || node->local_strong_refs;
- int weak = !hlist_empty(&node->refs) || node->local_weak_refs || strong;
- if (weak && !node->has_weak_ref) {
- cmd = BR_INCREFS;
- cmd_name = "BR_INCREFS";
- node->has_weak_ref = 1;
- node->pending_weak_ref = 1;
- node->local_weak_refs++;
- } else if (strong && !node->has_strong_ref) {
- cmd = BR_ACQUIRE;
- cmd_name = "BR_ACQUIRE";
- node->has_strong_ref = 1;
- node->pending_strong_ref = 1;
- node->local_strong_refs++;
- } else if (!strong && node->has_strong_ref) {
- cmd = BR_RELEASE;
- cmd_name = "BR_RELEASE";
- node->has_strong_ref = 0;
- } else if (!weak && node->has_weak_ref) {
- cmd = BR_DECREFS;
- cmd_name = "BR_DECREFS";
- node->has_weak_ref = 0;
- }
- if (cmd != BR_NOOP) {
- if (put_user(cmd, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
- if (put_user(node->ptr, (void * __user *)ptr))
- return -EFAULT;
- ptr += sizeof(void *);
- if (put_user(node->cookie, (void * __user *)ptr))
- return -EFAULT;
- ptr += sizeof(void *);
- binder_stat_br(proc, thread, cmd);
- } else {
- list_del_init(&w->entry);
- if (!weak && !strong) {
- kfree(node);
- binder_stats_deleted(BINDER_STAT_NODE);
- } else {
-
- }
- }
- } break;
- case BINDER_WORK_DEAD_BINDER:
- case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
- case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
- struct binder_ref_death *death;
- uint32_t cmd;
- death = container_of(w, struct binder_ref_death, work);
- if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION)
- cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE;
- else
- cmd = BR_DEAD_BINDER;
- if (put_user(cmd, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
- if (put_user(death->cookie, (void * __user *)ptr))
- return -EFAULT;
- ptr += sizeof(void *);
- if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) {
- list_del(&w->entry);
- kfree(death);
- binder_stats_deleted(BINDER_STAT_DEATH);
- } else
- list_move(&w->entry, &proc->delivered_death);
- if (cmd == BR_DEAD_BINDER)
- goto done;
- } break;
- }
-
- if (!t)
- continue;
-
- BUG_ON(t->buffer == NULL);
- if (t->buffer->target_node) {
-
- struct binder_node *target_node = t->buffer->target_node;
-
- tr.target.ptr = target_node->ptr;
- tr.cookie = target_node->cookie;
- t->saved_priority = task_nice(current);
- if (t->priority < target_node->min_priority &&
- !(t->flags & TF_ONE_WAY))
- binder_set_nice(t->priority);
- else if (!(t->flags & TF_ONE_WAY) ||
- t->saved_priority > target_node->min_priority)
- binder_set_nice(target_node->min_priority);
- cmd = BR_TRANSACTION;
- } else {
- tr.target.ptr = NULL;
- tr.cookie = NULL;
- cmd = BR_REPLY;
- }
- tr.code = t->code;
- tr.flags = t->flags;
- tr.sender_euid = t->sender_euid;
-
- if (t->from) {
- struct task_struct *sender = t->from->proc->tsk;
- tr.sender_pid = task_tgid_nr_ns(sender,current->nsproxy->pid_ns);
- } else {
- tr.sender_pid = 0;
- }
-
- tr.data_size = t->buffer->data_size;
- tr.offsets_size = t->buffer->offsets_size;
- tr.data.ptr.buffer = (void *)t->buffer->data + proc->user_buffer_offset;
- tr.data.ptr.offsets = tr.data.ptr.buffer + ALIGN(t->buffer->data_size,sizeof(void *));
-
- if (put_user(cmd, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
-
- if (copy_to_user(ptr, &tr, sizeof(tr)))
- return -EFAULT;
- ptr += sizeof(tr);
- binder_stat_br(proc, thread, cmd);
- list_del(&t->work.entry);
- t->buffer->allow_user_free = 1;
- if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) {
- t->to_parent = thread->transaction_stack;
- t->to_thread = thread;
-
- thread->transaction_stack = t;
- } else {
- t->buffer->transaction = NULL;
- kfree(t);
- binder_stats_deleted(BINDER_STAT_TRANSACTION);
- }
- break;
- }
-
- done:
- *consumed = ptr - buffer;
- if (proc->requested_threads + proc->ready_threads == 0 &&
- proc->requested_threads_started < proc->max_threads &&
- (thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
- BINDER_LOOPER_STATE_ENTERED))
- ) {
- proc->requested_threads++;
- if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer))
- return -EFAULT;
- }
- return 0;
ServiceManager进程被唤醒后，首先从当前进程或线程的待处理队列todo中取出binder_work，这是客户进程在发送IPC数据时以binder_work的形式挂载到了目标进程或线程的todo队列中，这里就从中取出来，因为客户进程在将一个事务添加到目标进程的待处理队列前将该事务封装成了binder_work形式，并且设置了该binder_work的类型为BINDER_WORK_TRANSACTION
-
- t->work.type = BINDER_WORK_TRANSACTION;
-
- list_add_tail(&t->work.entry, target_list);
根据取出的binder_work来得到客户进程发送过来的事务binder_transaction
- t = container_of(w, struct binder_transaction, work);
然后从该事务中取出IPC数据，并封装成binder_transaction_data结构体
- if (t->buffer->target_node) {
-
- struct binder_node *target_node = t->buffer->target_node;
-
- tr.target.ptr = target_node->ptr;
- tr.cookie = target_node->cookie;
- t->saved_priority = task_nice(current);
- if (t->priority < target_node->min_priority &&
- !(t->flags & TF_ONE_WAY))
- binder_set_nice(t->priority);
- else if (!(t->flags & TF_ONE_WAY) ||
- t->saved_priority > target_node->min_priority)
- binder_set_nice(target_node->min_priority);
- cmd = BR_TRANSACTION;
- } else {
- tr.target.ptr = NULL;
- tr.cookie = NULL;
- cmd = BR_REPLY;
- }
- tr.code = t->code;
- tr.flags = t->flags;
- tr.sender_euid = t->sender_euid;
-
- if (t->from) {
- struct task_struct *sender = t->from->proc->tsk;
- tr.sender_pid = task_tgid_nr_ns(sender,current->nsproxy->pid_ns);
- } else {
- tr.sender_pid = 0;
- }
-
- tr.data_size = t->buffer->data_size;
- tr.offsets_size = t->buffer->offsets_size;
- tr.data.ptr.buffer = (void *)t->buffer->data + proc->user_buffer_offset;
- tr.data.ptr.offsets = tr.data.ptr.buffer + ALIGN(t->buffer->data_size,sizeof(void *));
然后写入用户空间的buffer中
-
- if (put_user(cmd, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
-
- if (copy_to_user(ptr, &tr, sizeof(tr)))
- return -EFAULT;
- ptr += sizeof(tr);
这样ServiceManager进程在用户空间就真正得到了客户进程发送过来的服务注册信息。接着将客户进程发送过来的事务项添加到当前线程的事务堆栈中，交给当前线程处理。
-
- thread->transaction_stack = t;
到此ServiceManager进程就从binder_thread_read函数中返回，从binder_ioctl函数中返回到用户空间中的binder_loop函数中去
- void binder_loop(struct binder_state *bs, binder_handler func)
- {
- int res;
- struct binder_write_read bwr;
- unsigned readbuf[32];
- bwr.write_size = 0;
- bwr.write_consumed = 0;
- bwr.write_buffer = 0;
- readbuf[0] = BC_ENTER_LOOPER;
- binder_write(bs, readbuf, sizeof(unsigned));
- for (;;) {
- bwr.read_size = sizeof(readbuf);
- bwr.read_consumed = 0;
- bwr.read_buffer = (unsigned) readbuf;
-
- res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
- if (res < 0) {
- ALOGE("binder_loop: ioctl failed (%s)\n", strerror(errno));
- break;
- }
-
- res = binder_parse(bs, 0, readbuf, bwr.read_consumed, func);
- if (res == 0) {
- ALOGE("binder_loop: unexpected reply?!\n");
- break;
- }
- if (res < 0) {
- ALOGE("binder_loop: io error %d %s\n", res, strerror(errno));
- break;
- }
- }
- }
ServiceManager进程接收到客户进程的服务注册请求后，从ioctl函数中返回，并得到客户进程发送过来的注册信息，然后调用binder_parse函数进行数据解析，并传入回调函数svcmgr_handler的指针。
- int binder_parse(struct binder_state *bs, struct binder_io *bio,
- uint32_t *ptr, uint32_t size, binder_handler func)
- {
- int r = 1;
- uint32_t *end = ptr + (size / 4);
-
- while (ptr < end) {
- uint32_t cmd = *ptr++;
- switch(cmd) {
- case BR_NOOP:
- case BR_TRANSACTION_COMPLETE:
- case BR_INCREFS:
- case BR_ACQUIRE:
- case BR_RELEASE:
- case BR_DECREFS:
- case BR_TRANSACTION:
- case BR_REPLY:
- case BR_DEAD_BINDER:
- case BR_FAILED_REPLY:
- case BR_DEAD_REPLY:
- default:
- return -1;
- }
- }
- return r;
- }
此时的cmd=BR_TRANSACTION
- case BR_TRANSACTION: {
-
- struct binder_txn *txn = (void *) ptr;
- if ((end - ptr) * sizeof(uint32_t) < sizeof(struct binder_txn)) {
- ALOGE("parse: txn too small!\n");
- return -1;
- }
- binder_dump_txn(txn);
- if (func) {
- unsigned rdata[256/4];
- struct binder_io msg;
- struct binder_io reply;
- int res;
- bio_init(&reply, rdata, sizeof(rdata), 4);
- bio_init_from_txn(&msg, txn);
-
- res = func(bs, txn, &msg, &reply);
-
- binder_send_reply(bs, &reply, txn->data, res);
- }
- ptr += sizeof(*txn) / sizeof(uint32_t);
- break;
- }
函数首先初始化结构体数据，然后调用通过binder_loop函数传进来的回调函数svcmgr_handler来完成服务查询工作，将查询结果通过binder_send_reply函数发送给客户端进程。
目标进程服务注册过程
在binder_parse函数中，通过bio_init和bio_init_from_txn函数分别初始化了reply和msg变量，初始化值为：
- reply->data = (char *) rdata + n;
- reply->offs = rdata;
- reply->data0 = (char *) rdata + n;
- reply->offs0 = rdata;
- reply->data_avail = sizeof(rdata) - n;
- reply->offs_avail = 4;
- reply->flags = 0;
-
- msg->data = txn->data;
- msg->offs = txn->offs;
- msg->data0 = txn->data;
- msg->offs0 = txn->offs;
- msg->data_avail = txn->data_size;
- msg->offs_avail = txn->offs_size / 4;
- msg->flags = BIO_F_SHARED;
msg：
ServiceManager进程对服务的注册是通过回调函数svcmgr_handler来完成的
- int svcmgr_handler(struct binder_state *bs,
- struct binder_txn *txn,
- struct binder_io *msg,
- struct binder_io *reply)
- {
- struct svcinfo *si;
- uint16_t *s;
- unsigned len;
- void *ptr;
- uint32_t strict_policy;
- int allow_isolated;
- if (txn->target != svcmgr_handle)
- return -1;
-
- strict_policy = bio_get_uint32(msg);
-
-
-
- s = bio_get_string16(msg, &len);
- if ((len != (sizeof(svcmgr_id) / 2)) ||
-
-
-
-
- memcmp(svcmgr_id, s, sizeof(svcmgr_id))) {
- fprintf(stderr,"invalid id %s\n", str8(s));
- return -1;
- }
-
- switch(txn->code) {
-
- case SVC_MGR_ADD_SERVICE:
-
- s = bio_get_string16(msg, &len);
- ptr = bio_get_ref(msg);
- allow_isolated = bio_get_uint32(msg) ? 1 : 0;
- if (do_add_service(bs, s, len, ptr, txn->sender_euid, allow_isolated))
- return -1;
- break;
- default:
- ALOGE("unknown code %d\n", txn->code);
- return -1;
- }
- bio_put_uint32(reply, 0);
- return 0;
- }
在客户端和服务端都统一定义了对应的函数调用码
客户端进程：
- enum {
- GET_SERVICE_TRANSACTION = IBinder::FIRST_CALL_TRANSACTION,
- CHECK_SERVICE_TRANSACTION,
- ADD_SERVICE_TRANSACTION,
- LIST_SERVICES_TRANSACTION,
- };
服务端进程：
- enum {
- SVC_MGR_GET_SERVICE = 1,
- SVC_MGR_CHECK_SERVICE,
- SVC_MGR_ADD_SERVICE,
- SVC_MGR_LIST_SERVICES,
- };
ServiceManager进程注册服务过程：
- case SVC_MGR_ADD_SERVICE:
-
- s = bio_get_string16(msg, &len);
- ptr = bio_get_ref(msg);
- allow_isolated = bio_get_uint32(msg) ? 1 : 0;
- if (do_add_service(bs, s, len, ptr, txn->sender_euid, allow_isolated))
- return -1;
- break;
函数bio_get_ref()是从msg中取出flat_binder_object结构体的成员binder 的值
- void *bio_get_ref(struct binder_io *bio)
- {
- struct binder_object *obj;
-
- obj = _bio_get_obj(bio);
- if (!obj)
- return 0;
-
- if (obj->type == BINDER_TYPE_HANDLE)
-
- return obj->pointer;
-
- return 0;
- }
在Android 数据Parcel序列化过程源码分析中介绍了writeStrongBinder函数将Binder实体对象封装为flat_binde_robject结构体写入到Parcel对象中，在前面的binder_transaction()函数中，如果传输的是一个Binder实体对象，首先会在内核空间为该Binder实体对象创建Binder节点，同时为ServiceManager进程创建引用该Binder节点的Binder引用对象，并且修改该Binder引用对象在内核空间的描述flat_binder_object的类型及句柄值为：
- obj->flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
- obj->type = BINDER_TYPE_HANDLE;
- obj->cookie = local;
- obj->handle = ref->desc;
flat_binder_object对象的查找过程
- static struct binder_object *_bio_get_obj(struct binder_io *bio)
- {
- unsigned n;
- unsigned off = bio->data - bio->data0;
-
- for (n = 0; n < bio->offs_avail; n++) {
- if (bio->offs[n] == off)
-
- return bio_get(bio, sizeof(struct binder_object));
- }
-
- bio->data_avail = 0;
- bio->flags |= BIO_F_OVERFLOW;
- return 0;
- }
flat_binder_object结构与binder_object结构之间的关系
svcmgr_handler函数最后调用do_add_service函数来注册服务。
- int do_add_service(struct binder_state *bs,
- uint16_t *s, unsigned len,
- void *ptr, unsigned uid, int allow_isolated)
- {
-
-
-
-
-
- struct svcinfo *si;
- if (!ptr || (len == 0) || (len > 127))
- return -1;
-
- if (!svc_can_register(uid, s)) {
- ALOGE("add_service('%s',%p) uid=%d - PERMISSION DENIED\n",str8(s), ptr, uid);
- return -1;
- }
-
- si = find_svc(s, len);
-
- if (si) {
- if (si->ptr) {
- ALOGE("add_service('%s',%p) uid=%d - ALREADY REGISTERED, OVERRIDE\n",str8(s), ptr, uid);
- svcinfo_death(bs, si);
- }
- si->ptr = ptr;
-
- } else {
- si = malloc(sizeof(*si) + (len + 1) * sizeof(uint16_t));
- if (!si) {
- ALOGE("add_service('%s',%p) uid=%d - OUT OF MEMORY\n",str8(s), ptr, uid);
- return -1;
- }
- si->ptr = ptr;
- si->len = len;
- memcpy(si->name, s, (len + 1) * sizeof(uint16_t));
- si->name[len] = '\0';
- si->death.func = svcinfo_death;
- si->death.ptr = si;
- si->allow_isolated = allow_isolated;
- si->next = svclist;
- svclist = si;
- }
- binder_acquire(bs, ptr);
- binder_link_to_death(bs, ptr, &si->death);
- return 0;
- }
服务注册完成后，返回到svcmgr_handler函数中，并执行最后一条语句
- bio_put_uint32(reply, 0);
设置reply指向的地址空间值为0，最后又返回到函数binder_parse中，通过binder_send_reply(bs, &reply, txn->data, res)语句向客户进程发送服务注册结果，当服务注册成功svcmgr_handler函数返回0,因此
binder_send_reply(bs, &reply, txn->data, 0)
目标进程向客户进程发送服务注册结果
- void binder_send_reply(struct binder_state *bs,
- struct binder_io *reply,
- void *buffer_to_free,
- int status)
- {
- struct {
- uint32_t cmd_free;
- void *buffer;
- uint32_t cmd_reply;
- struct binder_txn txn;
- } __attribute__((packed)) data;
-
- data.cmd_free = BC_FREE_BUFFER;
- data.buffer = buffer_to_free;
- data.cmd_reply = BC_REPLY;
- data.txn.target = 0;
- data.txn.cookie = 0;
- data.txn.code = 0;
- if (status) {
- data.txn.flags = TF_STATUS_CODE;
- data.txn.data_size = sizeof(int);
- data.txn.offs_size = 0;
- data.txn.data = &status;
- data.txn.offs = 0;
- } else {
- data.txn.flags = 0;
- data.txn.data_size = reply->data - reply->data0;
- data.txn.offs_size = ((char*) reply->offs) - ((char*) reply->offs0);
- data.txn.data = reply->data0;
- data.txn.offs = reply->offs0;
- }
- binder_write(bs, &data, sizeof(data));
- }
函数调用binder_write将服务注册结果通过Binder驱动发送给客户进程，前面介绍了客户进程此时正睡眠在Binder线程数据读取中
- int binder_write(struct binder_state *bs, void *data, unsigned len)
- {
- struct binder_write_read bwr;
- int res;
- bwr.write_size = len;
- bwr.write_consumed = 0;
- bwr.write_buffer = (unsigned) data;
- bwr.read_size = 0;
- bwr.read_consumed = 0;
- bwr.read_buffer = 0;
- res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
- if (res < 0) {
- fprintf(stderr,"binder_write: ioctl failed (%s)\n",
- strerror(errno));
- }
- return res;
- }
发送的数据为：
bwr.write_size = sizeof(data);
bwr.write_consumed = 0;
bwr.write_buffer = (unsigned) data;
bwr.read_size = 0;
bwr.read_consumed = 0;
bwr.read_buffer = 0;
通过ioctl命令控制函数再次进入到Binder驱动程序中，并进入BINDER_WRITE_READ命令处理过程中，由于bwr.write_size > 0而bwr.read_size = 0，因此在binder_ioctl中只调用binder_thread_write函数进行数据发送。
- int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread,
- void __user *buffer, int size, signed long *consumed)
- {
- uint32_t cmd;
- void __user *ptr = buffer + *consumed;
- void __user *end = buffer + size;
-
- while (ptr < end && thread->return_error == BR_OK) {
- if (get_user(cmd, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
- if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) {
- binder_stats.bc[_IOC_NR(cmd)]++;
- proc->stats.bc[_IOC_NR(cmd)]++;
- thread->stats.bc[_IOC_NR(cmd)]++;
- }
- switch (cmd) {
- case BC_FREE_BUFFER:
- case BC_TRANSACTION:
- case BC_REPLY: {
- default:
- return -EINVAL;
- }
- *consumed = ptr - buffer;
- }
- return 0;
- }
binder_thread_write函数循环从buffer中读取命令cmd，然后对不同的命令进行不同的处理，从上图data的存储结构可以看出，binder_thread_write函数首先读取到BC_FREE_BUFFER命令，BC_FREE_BUFFER命令的处理如下：
- case BC_FREE_BUFFER: {
- void __user *data_ptr;
- struct binder_buffer *buffer;
-
- if (get_user(data_ptr, (void * __user *)ptr))
- return -EFAULT;
-
- ptr += sizeof(void *);
-
- buffer = binder_buffer_lookup(proc, data_ptr);
- if (buffer == NULL) {
- break;
- }
- if (!buffer->allow_user_free) {
- break;
- }
-
- if (buffer->transaction) {
- buffer->transaction->buffer = NULL;
- buffer->transaction = NULL;
- }
- if (buffer->async_transaction && buffer->target_node) {
- BUG_ON(!buffer->target_node->has_async_transaction);
- if (list_empty(&buffer->target_node->async_todo))
- buffer->target_node->has_async_transaction = 0;
- else
- list_move_tail(buffer->target_node->async_todo.next, &thread->todo);
- }
-
- binder_transaction_buffer_release(proc, buffer, NULL);
- binder_free_buf(proc, buffer);
- break;
- }
首先从当前进程的binder_proc中查找出指定的binder_buffer，然后判断是否可以释放该binder_buffer的内存空间，然后调用binder_free_buf函数释放该内核缓冲区。处理完BC_FREE_BUFFER命令后，binder_thread_write函数继续遍历buffer，从而取出第二个命令BC_REPLY，以下是对BC_REPLY命令的处理过程：
- case BC_REPLY: {
- struct binder_transaction_data tr;
-
- if (copy_from_user(&tr, ptr, sizeof(tr)))
- return -EFAULT;
- ptr += sizeof(tr);
- binder_transaction(proc, thread, &tr, cmd == BC_REPLY);
- break;
- }
首先从用户空间的buffer中取出binder_txn数据结构，并保持到binder_transaction_data中，binder_txn和binder_transaction_data结构体之间的对应关系在前面已经通过图来说明了。将用户空间的binder_txn拷贝到内核空间的binder_transaction_data中后，调用binder_transaction函数进行夸进程数据发送。关于binder_transaction函数的详细介绍请查看Android IPC数据在内核空间中的发送过程分析。通过binder_transaction函数将参数binder_transaction_data来封装一个工作事务binder_transaction，然后唤醒正在睡眠等待的客户线程。服务注册完成并将结果发送回客户进程后，返回到函数binder_loop中
- void binder_loop(struct binder_state *bs, binder_handler func)
- {
- int res;
- struct binder_write_read bwr;
- unsigned readbuf[32];
- bwr.write_size = 0;
- bwr.write_consumed = 0;
- bwr.write_buffer = 0;
- readbuf[0] = BC_ENTER_LOOPER;
- binder_write(bs, readbuf, sizeof(unsigned));
- for (;;) {
- bwr.read_size = sizeof(readbuf);
- bwr.read_consumed = 0;
- bwr.read_buffer = (unsigned) readbuf;
-
- res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
- if (res < 0) {
- ALOGE("binder_loop: ioctl failed (%s)\n", strerror(errno));
- break;
- }
-
- res = binder_parse(bs, 0, readbuf, bwr.read_consumed, func);
- if (res == 0) {
- ALOGE("binder_loop: unexpected reply?!\n");
- break;
- }
- if (res < 0) {
- ALOGE("binder_loop: io error %d %s\n", res, strerror(errno));
- break;
- }
- }
- }
binder_loop()函数闭环执行ioctl()和binder_parse()函数，当binder_parse()函数返回时，binder_loop()又在一次通过ioctl系统调用进入到Binder驱动中，此时发送的数据为：
bwr.write_size = 0;
bwr.write_consumed = 0;
bwr.write_buffer = 0;
bwr.read_size = sizeof(readbuf);
bwr.read_consumed = 0;
bwr.read_buffer = (unsigned) readbuf;
由于bwr.read_size >0，因此在binder_ioctl中，只执行binder_thread_read(), ServiceManager进程在Binder驱动中读取数据时，又会通过wait_event_interruptible()函数睡眠等待客户端发送请求。
客户进程接收目标进程发送过来的执行结果
客户线程被ServiceManager唤醒后，继续执行binder_thread_read函数，读取ServiceManager进程发送过来的binder_transaction事务，并从该事务中取出binder_transaction_data结构，因为客户进程发送的数据就是通过binder_transaction_data来描述的。客户线程从binder_thread_read函数返回到binder_ioctl函数，并一路向上返回到用户空间的talkWithDriver()函数，最后返回到waitForResponse()函数执行talkWithDriver()语句之后的代码
- status_t IPCThreadState::waitForResponse(Parcel *reply, status_t *acquireResult)
- {
- int32_t cmd;
- int32_t err;
-
- while (1) {
- if ((err=talkWithDriver()) < NO_ERROR) break;
-
- err = mIn.errorCheck();
- if (err < NO_ERROR) break;
- if (mIn.dataAvail() == 0) continue;
-
- cmd = mIn.readInt32();
-
- switch (cmd) {
- case BR_TRANSACTION_COMPLETE:
- if (!reply && !acquireResult) goto finish;
- break;
-
- case BR_DEAD_REPLY:
- err = DEAD_OBJECT;
- goto finish;
-
- case BR_FAILED_REPLY:
- err = FAILED_TRANSACTION;
- goto finish;
-
- case BR_ACQUIRE_RESULT:
- {
- ALOG_ASSERT(acquireResult != NULL, "Unexpected brACQUIRE_RESULT");
- const int32_t result = mIn.readInt32();
- if (!acquireResult) continue;
- *acquireResult = result ? NO_ERROR : INVALID_OPERATION;
- }
- goto finish;
-
- case BR_REPLY:
- {
- binder_transaction_data tr;
- err = mIn.read(&tr, sizeof(tr));
- ALOG_ASSERT(err == NO_ERROR, "Not enough command data for brREPLY");
- if (err != NO_ERROR) goto finish;
-
- if (reply) {
- if ((tr.flags & TF_STATUS_CODE) == 0) {
- reply->ipcSetDataReference(
- reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
- tr.data_size,
- reinterpret_cast<const size_t*>(tr.data.ptr.offsets),
- tr.offsets_size/sizeof(size_t),
- freeBuffer, this);
- } else {
- err = *static_cast<const status_t*>(tr.data.ptr.buffer);
- freeBuffer(NULL,
- reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
- tr.data_size,
- reinterpret_cast<const size_t*>(tr.data.ptr.offsets),
- tr.offsets_size/sizeof(size_t), this);
- }
- } else {
- freeBuffer(NULL,
- reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
- tr.data_size,
- reinterpret_cast<const size_t*>(tr.data.ptr.offsets),
- tr.offsets_size/sizeof(size_t), this);
- continue;
- }
- }
- goto finish;
-
- default:
- err = executeCommand(cmd);
- if (err != NO_ERROR) goto finish;
- break;
- }
- }
-
- finish:
- if (err != NO_ERROR) {
- if (acquireResult) *acquireResult = err;
- if (reply) reply->setError(err);
- mLastError = err;
- }
- return err;
- }
在前面介绍目标进程向客户进程发送服务注册结果知道，ServiceManager进程发送了两个命令及参数到Binder驱动中，命令分别是BC_FREE_BUFFER和BC_REPLY
命令BC_FREE_BUFFER在Binder驱动中就完成了对内涵缓冲区的释放；执行命令BC_REPLY时，通过binder_transaction()函数将该命令下的数据发送给了客户进程，因此当客户进程被唤醒，并读取Binder数据时，既可以读取到BC_REPLY命令及其发送过来的数据，对命令BC_REPLY的处理过程如下：
- case BR_REPLY:
- {
- binder_transaction_data tr;
- err = mIn.read(&tr, sizeof(tr));
- ALOG_ASSERT(err == NO_ERROR, "Not enough command data for brREPLY");
- if (err != NO_ERROR) goto finish;
-
- if (reply) {
- if ((tr.flags & TF_STATUS_CODE) == 0) {
- reply->ipcSetDataReference(
- reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
- tr.data_size,
- reinterpret_cast<const size_t*>(tr.data.ptr.offsets),
- tr.offsets_size/sizeof(size_t),
- freeBuffer, this);
- } else {
- err = *static_cast<const status_t*>(tr.data.ptr.buffer);
- freeBuffer(NULL,
- reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
- tr.data_size,
- reinterpret_cast<const size_t*>(tr.data.ptr.offsets),
- tr.offsets_size/sizeof(size_t), this);
- }
- } else {
- freeBuffer(NULL,
- reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
- tr.data_size,
- reinterpret_cast<const size_t*>(tr.data.ptr.offsets),
- tr.offsets_size/sizeof(size_t), this);
- continue;
- }
- }
- goto finish;
这样客户进程就得到了目标进程ServiceManager发送过来的服务注册结果了，Android服务注册过程可以总结为以下几个步骤：
1）在Java层将服务名称及服务对应的Binder对象写入到Parcel对象中；
2）在C++层为该服务创建对应的Binder实体对象JavaBBinder，并且将上层发送过来的数据序列化到C++的Parcel对象中，同时使用flat_binder_object结构体来描述Binder实体对象；
3）通过ServiceManager的Binder代理对象将数据发送到Binder驱动中；
4）Binder驱动在内核空间中为传输的Binder实体对象创建对应的Binder节点；
5）Binder驱动在内核空间中为ServiceManager进程创建引用该服务Binder节点的Binder引用对象；
6）修改Binder驱动中传输的flat_binder_object的类型和描述符；
7）将服务名称和为ServiceManager进程创建的Binder引用对象的描述符注册到ServiceManager进程中；
扫一扫
2653
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
