縱觀Binder通訊過程，無不在跟ServiceManager打交道，了解ServiceManager 交互流程就顯得很有必要了。ServiceManager分為啟動和、獲取、添加、注冊服務(wù)。首先從啟動過程來了解,ServiceManager如何成為Binder守護(hù)進(jìn)程。

源碼路徑
android/system/core/rootdir/init.rc
android/frameworks/native/cmds/servicemanager/
    |-- service_manager.c
    |-- binder.c
Binder內(nèi)核

1 啟動ServiceManager

• 1.Android在init進(jìn)程啟動以后，通過腳本init.rc,啟動ServiceManager:

|-- init.rc

service servicemanager /system/bin/servicemanager
    class core
    user system
    group system
    critical
    onrestart restart healthd
    onrestart restart zygote
    onrestart restart media
    onrestart restart surfaceflinger
    onrestart restart drm

對應(yīng)執(zhí)行程序/system/bin/servicemanager，源碼service_manager.c。下一步追蹤一下service_manager.c的main()入口程序。

2.1 main

|-- service_manager.c

int main(int argc, char **argv)
{
    struct binder_state *bs;
    // 打開Binder驅(qū)動..并申請128字節(jié)內(nèi)存
    bs = binder_open(128*1024);
    if (!bs) {
        ALOGE("failed to open binder driver\n");
        return -1;
    }
    // 變成 Context Manager
    if (binder_become_context_manager(bs)) {
        ALOGE("cannot become context manager (%s)\n", strerror(errno));
        return -1;
    }
    // 判斷 selinux 權(quán)限能否使用
    selinux_enabled = is_selinux_enabled();
    sehandle = selinux_android_service_context_handle();
    selinux_status_open(true);

    if (selinux_enabled > 0) {
        if (sehandle == NULL) {
            // 獲取sehandle 權(quán)限失敗
            ALOGE("SELinux: Failed to acquire sehandle. Aborting.\n");
            abort();
        }

        if (getcon(&service_manager_context) != 0) {
            // 獲取service_manager 上下文失敗
            ALOGE("SELinux: Failed to acquire service_manager context. Aborting.\n");
            abort();
        }
    }

    union selinux_callback cb;
    cb.func_audit = audit_callback;
    selinux_set_callback(SELINUX_CB_AUDIT, cb);
    cb.func_log = selinux_log_callback;
    selinux_set_callback(SELINUX_CB_LOG, cb);
    // 進(jìn)入 binder 循環(huán)
    binder_loop(bs, svcmgr_handler);

    return 0;
}

• mian 入口函數(shù)一共處理了三件事：
  • 1.打開Binder驅(qū)動并申請內(nèi)存
  • 2.告訴Binder驅(qū)動成為Binder的上下文管理者（ServiceManager成為守護(hù)進(jìn)程）
  • 3.開啟循環(huán)，處理IPC請求（等待Client請求）

2.2 binder_open

在ServiceManaer 的main入口第一步看到打開Binder驅(qū)動，調(diào)用了binder_open。binder_open又做了哪些具體的工作呢？

|-- binder.c

struct binder_state *binder_open(size_t mapsize)
{
    struct binder_state *bs; // 初始化狀態(tài)參數(shù)
    struct binder_version vers;

    bs = malloc(sizeof(*bs));
    if (!bs) {
        errno = ENOMEM;
        return NULL;
    }
    //打開 Binder 設(shè)備驅(qū)動
    bs->fd = open("/dev/binder", O_RDWR);
    if (bs->fd < 0) {
        fprintf(stderr,"binder: cannot open device (%s)\n",
                strerror(errno));
        goto fail_open; //打開失敗
    }
    //系統(tǒng)調(diào)用 ioctl獲取binder版本信息
    if ((ioctl(bs->fd, BINDER_VERSION, &vers) == -1) ||
        (vers.protocol_version != BINDER_CURRENT_PROTOCOL_VERSION)) {
        fprintf(stderr,
                "binder: kernel driver version (%d) differs from user space version (%d)\n",
                vers.protocol_version, BINDER_CURRENT_PROTOCOL_VERSION);
        goto fail_open;//內(nèi)核空間與用戶空間的binder不是同一版本
    }

    bs->mapsize = mapsize;
    // 系統(tǒng)調(diào)用，mmap內(nèi)存映射，必須是page的整數(shù)倍
    bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);
    if (bs->mapped == MAP_FAILED) {
        fprintf(stderr,"binder: cannot map device (%s)\n",
                strerror(errno));
        goto fail_map; // 映射失敗
    }

    return bs;

fail_map: // 映射失敗關(guān)閉
    close(bs->fd);
fail_open: // 打開驅(qū)動失敗
    free(bs);
    return NULL;
}

// 初始化狀態(tài)參數(shù)
struct binder_state
{
    int fd; // binder_open中 /dev/binder的描述
    void *mapped; // 指向mmap映射地址
    size_t mapsize;// 分配內(nèi)存大小 默認(rèn)128字節(jié)
};

• 打開Binder驅(qū)動相關(guān)操作：
  • 初始化狀態(tài)參數(shù) binder_state
  • 通過open打開Binder驅(qū)動
  • 通過ioctl()校驗(yàn)內(nèi)核空間Binder與用戶空間Binder是否版本一致
  • 映射mmap內(nèi)存

2.3 binder_become_context_manager

• 在ServiceManaer 的main入口第一步看到打開Binder驅(qū)動，調(diào)用了binder_open。隨后執(zhí)行了binder_become_context_manager。使Binder成為上下文的管理者，具體的操作解讀一下源碼來看看

|-- binder.c

int binder_become_context_manager(struct binder_state *bs)
{
    //通過ioctl，傳遞BINDER_SET_CONTEXT_MGR指令
    return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);
}

• 1.這里直接調(diào)用系統(tǒng)ioctl()方法。由于沒找到kernel/drivers/android/binder.c源碼文件。這里主要梳理一下調(diào)用邏輯好了
• 2. ioctl() 后會回調(diào)binder_ioctl()，根據(jù)BINDER_SET_CONTEXT_MGR參數(shù)，最終調(diào)用binder_ioctl_set_ctx_mgr()，過程中會持有binder_main_lock。
• 3.binder_ioctl_set_ctx_mgr中首先保證只創(chuàng)建一次mgr_node對象，并將當(dāng)前線程euid作為Service Manager的uid。在最后通過binder_new_node創(chuàng)建ServiceManager類
• 4.binder_new_node 中創(chuàng)建binder_node給新創(chuàng)建對象分配內(nèi)存空間，同時將新創(chuàng)建的node對象添加到proc紅黑樹；最后init兩個隊(duì)列：async_todo和binder_work。

2.4 binder_loop

在執(zhí)行了binder_become_context_manager之后，調(diào)用了binder_loop開啟循環(huán)，處理IPC請求。查看其源碼：

void binder_loop(struct binder_state *bs, binder_handler func)
{
    int res;
    struct binder_write_read bwr;
    uint32_t readbuf[32];

    bwr.write_size = 0;
    bwr.write_consumed = 0;
    bwr.write_buffer = 0;

    readbuf[0] = BC_ENTER_LOOPER;
    //將BC_ENTER_LOOPER命令傳遞給binder驅(qū)動，使Service Manager進(jìn)入循環(huán)
    binder_write(bs, readbuf, sizeof(uint32_t));

    for (;;) {
        bwr.read_size = sizeof(readbuf);
        bwr.read_consumed = 0;
        bwr.read_buffer = (uintptr_t) readbuf;
        
        //進(jìn)入循環(huán)，不斷地binder讀寫過程
        res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);

        if (res < 0) {
            ALOGE("binder_loop: ioctl failed (%s)\n", strerror(errno));
            break;
        }

        // 解析binder信息
        res = binder_parse(bs, 0, (uintptr_t) readbuf, bwr.read_consumed, func);
        if (res == 0) {
            ALOGE("binder_loop: unexpected reply?!\n");
            break;
        }
        if (res < 0) {
            ALOGE("binder_loop: io error %d %s\n", res, strerror(errno));
            break;
        }
    }
}

主要操作：

• binder_write通過ioctl()將BC_ENTER_LOOPER命令發(fā)送給binder驅(qū)動，ServiceManager進(jìn)入循環(huán)
• 進(jìn)入循環(huán)，不斷讀寫
• 讀寫需要進(jìn)行 binder_parse 解析

2.4.1 binder_write

• binder_loop 中將BC_ENTER_LOOPER命令發(fā)送給binder驅(qū)動，ServiceManager進(jìn)入循環(huán)

|-- binder.c

int binder_write(struct binder_state *bs, void *data, size_t len)
{
    struct binder_write_read bwr;
    int res;

    bwr.write_size = len;
    bwr.write_consumed = 0;
    bwr.write_buffer = (uintptr_t) data;//這里data為BC_ENTER_LOOPER
    bwr.read_size = 0;
    bwr.read_consumed = 0;
    bwr.read_buffer = 0;
    res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
    if (res < 0) {
        fprintf(stderr,"binder_write: ioctl failed (%s)\n",
                strerror(errno));
    }
    return res;
}

• 這里其實(shí)將傳遞過來的BC_ENTER_LOOPER通過ioctl（）調(diào)用回調(diào)給binder_ioctl

2.4.2 binder_ioctl

• binder_ioctl中通過binder_ioctl_write_read將用戶空間的binder_write_read結(jié)構(gòu)體拷貝到內(nèi)核空間.
• 如果層次是有緩存數(shù)據(jù)，通過binder_thread_write，從bwr.write_buffer拿出cmd數(shù)據(jù)，設(shè)置線程的looper狀態(tài)為BINDER_LOOPER_STATE_ENTERED

2.5 binder_parse

• 在循環(huán)讀寫過程中，對相應(yīng)的binder進(jìn)行解析，查看binder_parse源碼：

int binder_parse(struct binder_state *bs, struct binder_io *bio,
                 uintptr_t ptr, size_t size, binder_handler func)
{
    int r = 1;
    uintptr_t end = ptr + (uintptr_t) size;

    while (ptr < end) {
        uint32_t cmd = *(uint32_t *) ptr;
        ptr += sizeof(uint32_t);
#if TRACE
        fprintf(stderr,"%s:\n", cmd_name(cmd));
#endif
        switch(cmd) {
        case BR_NOOP:
            break;
        case BR_TRANSACTION_COMPLETE:
            break;
        case BR_INCREFS:
        case BR_ACQUIRE:
        case BR_RELEASE:
        case BR_DECREFS:
#if TRACE
            fprintf(stderr,"  %p, %p\n", (void *)ptr, (void *)(ptr + sizeof(void *)));
#endif
            ptr += sizeof(struct binder_ptr_cookie);
            break;
        case BR_TRANSACTION: {
            struct binder_transaction_data *txn = (struct binder_transaction_data *) ptr;
            if ((end - ptr) < sizeof(*txn)) {
                ALOGE("parse: txn too small!\n");
                return -1;
            }
            binder_dump_txn(txn);
            if (func) {
                unsigned rdata[256/4];
                struct binder_io msg;
                struct binder_io reply;
                int res;

                bio_init(&reply, rdata, sizeof(rdata), 4);
                bio_init_from_txn(&msg, txn);
                res = func(bs, txn, &msg, &reply);
                binder_send_reply(bs, &reply, txn->data.ptr.buffer, res);
            }
            ptr += sizeof(*txn);
            break;
        }
        case BR_REPLY: {
            struct binder_transaction_data *txn = (struct binder_transaction_data *) ptr;
            if ((end - ptr) < sizeof(*txn)) {
                ALOGE("parse: reply too small!\n");
                return -1;
            }
            binder_dump_txn(txn);
            if (bio) {
                bio_init_from_txn(bio, txn);
                bio = 0;
            } else {
                /* todo FREE BUFFER */
            }
            ptr += sizeof(*txn);
            r = 0;
            break;
        }
        case BR_DEAD_BINDER: {
            struct binder_death *death = (struct binder_death *)(uintptr_t) *(binder_uintptr_t *)ptr;
            ptr += sizeof(binder_uintptr_t);
            death->func(bs, death->ptr);
            break;
        }
        case BR_FAILED_REPLY:
            r = -1;
            break;
        case BR_DEAD_REPLY:
            r = -1;
            break;
        default:
            ALOGE("parse: OOPS %d\n", cmd);
            return -1;
        }
    }

    return r;
}

• 參考ServiceManager中開啟循環(huán)時的調(diào)用， binder_loop(bs, svcmgr_handler)
• ptr 指向BC_ENTER_LOOPER，func指向svcmgr_handler；

2.6 svcmgr_handler

|-- service_manager.c

繼續(xù)查看ServiceManager中的svcmgr_handler源碼：

int svcmgr_handler(struct binder_state *bs,
                   struct binder_transaction_data *txn,
                   struct binder_io *msg,
                   struct binder_io *reply)
{
    struct svcinfo *si;
    uint16_t *s;
    size_t len;
    uint32_t handle;
    uint32_t strict_policy;
    int allow_isolated;

    //ALOGI("target=%p code=%d pid=%d uid=%d\n",
    //      (void*) txn->target.ptr, txn->code, txn->sender_pid, txn->sender_euid);

    if (txn->target.ptr != BINDER_SERVICE_MANAGER)
        return -1;

    if (txn->code == PING_TRANSACTION)
        return 0;

    // Equivalent to Parcel::enforceInterface(), reading the RPC
    // header with the strict mode policy mask and the interface name.
    // Note that we ignore the strict_policy and don't propagate it
    // further (since we do no outbound RPCs anyway).
    strict_policy = bio_get_uint32(msg);
    s = bio_get_string16(msg, &len);
    if (s == NULL) {
        return -1;
    }

    if ((len != (sizeof(svcmgr_id) / 2)) ||
        memcmp(svcmgr_id, s, sizeof(svcmgr_id))) {
        fprintf(stderr,"invalid id %s\n", str8(s, len));
        return -1;
    }

    if (sehandle && selinux_status_updated() > 0) {
        struct selabel_handle *tmp_sehandle = selinux_android_service_context_handle();
        if (tmp_sehandle) {
            selabel_close(sehandle);
            sehandle = tmp_sehandle;
        }
    }

    switch(txn->code) {
    case SVC_MGR_GET_SERVICE: // 獲取服務(wù)
    case SVC_MGR_CHECK_SERVICE: //查找服務(wù)
        s = bio_get_string16(msg, &len);
        if (s == NULL) {
            return -1;
        }
        handle = do_find_service(bs, s, len, txn->sender_euid, txn->sender_pid);
        if (!handle)
            break;
        bio_put_ref(reply, handle);
        return 0;

    case SVC_MGR_ADD_SERVICE: // 查找服務(wù)
        s = bio_get_string16(msg, &len);
        if (s == NULL) {
            return -1;
        }
        handle = bio_get_ref(msg);
        allow_isolated = bio_get_uint32(msg) ? 1 : 0;
        if (do_add_service(bs, s, len, handle, txn->sender_euid,
            allow_isolated, txn->sender_pid))
            return -1;
        break;

    case SVC_MGR_LIST_SERVICES: { // 列舉服務(wù)list
        uint32_t n = bio_get_uint32(msg);

        if (!svc_can_list(txn->sender_pid)) {
            ALOGE("list_service() uid=%d - PERMISSION DENIED\n",
                    txn->sender_euid);
            return -1;
        }
        si = svclist;
        while ((n-- > 0) && si)
            si = si->next;
        if (si) {
            bio_put_string16(reply, si->name);
            return 0;
        }
        return -1;
    }
    default:
        ALOGE("unknown code %d\n", txn->code);
        return -1;
    }

    bio_put_uint32(reply, 0);
    return 0;
}

• 該方法提供了查詢服務(wù)，添加注冊服務(wù)，列舉服務(wù)list功能。

總結(jié)

ServiceManager通過init.rc腳本啟動成為Android 進(jìn)程間通信機(jī)制Binder的守護(hù)進(jìn)程的過程：

• 1.打開Binder驅(qū)動 /dev/binder文件：open("/dev/binder", O_RDWR)
• 2.申請128k內(nèi)存隨后并建立映射: mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0)
• 3.告訴Binder驅(qū)動成為Binder的上下文管理者（ServiceManager成為其守護(hù)進(jìn)程）：binder_become_context_manager(struct binder_state *bs)
• 4.開啟循環(huán)，處理IPC請求（等待Client請求）:binder_loop(bs, svcmgr_handler);

image