1
2
3
4
//frameworks/native/libs/binder/IPCThreadState.cpp
//bwr为binder_write_read，上层是通过bwr去交换数据的,协议是BINDER_WRITE_READ
if (ioctl(mProcess->mDriverFD, BINDER_WRITE_READ, &bwr) >= 0)
    err = NO_ERROR;

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
//frameworks/native/libs/binder/IPCThreadState.cpp
//talkWithDriver前，首先需要将想要发送给驱动的内容mOut填充好。
status_t IPCThreadState::talkWithDriver(bool doReceive)
{
    if (mProcess->mDriverFD <= 0) {
        return -EBADF;
    }
    binder_write_read bwr;
    //当前数据位置大于当前数据大小时，表明需要读取
    const bool needRead = mIn.dataPosition() >= mIn.dataSize();
    //只要还在读过程中就不会去做写操作
    const size_t outAvail = (!doReceive || needRead) ? mOut.dataSize() : 0;
    //写缓冲区大小
    bwr.write_size = outAvail;
    //write_buffer指向了用户空间缓冲区地址(mOut)
    //以joinThreadPool为例，调用了mOut.writeInt32(BC_ENTER_LOOPER)
    //write_buffer即指向协议BC_ENTER_LOOPER
    bwr.write_buffer = (uintptr_t)mOut.data();

    //将要读取的内容信息
    if (doReceive && needRead) {
        //read_size是读缓冲区大小,大小为mIn的容量
        bwr.read_size = mIn.dataCapacity();
        //read_buffer指向了用户缓冲区地址(mIn)
        bwr.read_buffer = (uintptr_t)mIn.data();
    } else {
        //假如不需要读取，都设置为0
        bwr.read_size = 0;
        bwr.read_buffer = 0;
    }
    ... 
    //假如读写都为0，马上返回
    if ((bwr.write_size == 0) && (bwr.read_size == 0)) return NO_ERROR;

    bwr.write_consumed = 0;
    bwr.read_consumed = 0;
    status_t err;
    do {
        //这里对接到上文提到的驱动binder_ioctl,返回后，bwr内容被更新
        if (ioctl(mProcess->mDriverFD, BINDER_WRITE_READ, &bwr) >= 0)
            err = NO_ERROR;
        else
            err = -errno;
        if (mProcess->mDriverFD <= 0) {
            err = -EBADF;
        }
    } while (err == -EINTR);

    if (err >= NO_ERROR) {
        if (bwr.write_consumed > 0) {
            if (bwr.write_consumed < mOut.dataSize())
                mOut.remove(0, bwr.write_consumed);
            else {
                mOut.setDataSize(0);
                processPostWriteDerefs();
            }
        }
        if (bwr.read_consumed > 0) {
            mIn.setDataSize(bwr.read_consumed);
            mIn.setDataPosition(0);
        }
        IF_LOG_COMMANDS() {
            TextOutput::Bundle _b(alog);
            alog << "Remaining data size: " << mOut.dataSize() << endl;
            alog << "Received commands from driver: " << indent;
            const void* cmds = mIn.data();
            const void* end = mIn.data() + mIn.dataSize();
            alog << HexDump(cmds, mIn.dataSize()) << endl;
            //解析驱动传上来的信息
            while (cmds < end) cmds = printReturnCommand(alog, cmds);
            alog << dedent;
        }
        return NO_ERROR;
    }
    return err;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
//frameworks/native/libs/binder/IPCThreadState.cpp
status_t IPCThreadState::waitForResponse(Parcel *reply, status_t *acquireResult)
{
    uint32_t cmd;
    int32_t err;

    while (1) {
        //调用完talkWithDriver后，mIn中刷新了从驱动上来的数据
        if ((err=talkWithDriver()) < NO_ERROR) break;
        err = mIn.errorCheck();
        if (err < NO_ERROR) break;
        if (mIn.dataAvail() == 0) continue;

        cmd = (uint32_t)mIn.readInt32();
        ...
        switch (cmd) {
            ...//解析驱动上来的BR_xxxx协议
        }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
//frameworks/native/cmds/servicemanager/service_manager.c
int main(int argc, char** argv)
{
    char *driver;
    if (argc > 1) {
        driver = argv[1];
    } else {
        driver = "/dev/binder";
    }
    //1.打开binder驱动,且映射大小为124K
    bs = binder_open(driver, 128*1024);
    ...
    //2.将自身注册为context manager的角色
    if (binder_become_context_manager(bs)) {
        return -1;
    }
    ...
    //3.循环处理消息
    binder_loop(bs, svcmgr_handler);
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
//frameworks/native/cmds/servicemanager/binder.c
struct binder_state *binder_open(const char* driver, size_t mapsize)
{
    struct binder_state *bs;
    struct binder_version vers;
    bs = malloc(sizeof(*bs));
    //检查bs是否分配成功
    ...
    //对接到驱动的binder_open,底层创建了一个binder_proc结构体
    bs->fd = open(driver, O_RDWR | O_CLOEXEC);
    //检查fd是否创建成功
    ...
    //获取当前BINDER_VERSION版本
    if ((ioctl(bs->fd, BINDER_VERSION, &vers) == -1) ||
        (vers.protocol_version != BINDER_CURRENT_PROTOCOL_VERSION)) {
        ... 
        goto fail_open;
    }

    bs->mapsize = mapsize;
    //底层调用binder_mmap并将返回地址存到bs的mapped字段中,详情参见binder_mmap
    bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);
    if (bs->mapped == MAP_FAILED) {
        ...
        goto fail_map;
    }
    return bs;
fail_map:
    close(bs->fd);
fail_open:
    free(bs);
    return NULL;
} 

1
2
3
4
5
//frameworks/native/cmds/servicemanager/binder.c
int binder_become_context_manager(struct binder_state *bs)
{
    return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
//frameworks/native/cmds/servicemanager/binder.c
static int binder_ioctl_set_ctx_mgr(struct file *filp)
{
	int ret = 0;
	struct binder_proc *proc = filp->private_data;
	struct binder_context *context = proc->context;
	struct binder_node *new_node;
	kuid_t curr_euid = current_euid();

	mutex_lock(&context->context_mgr_node_lock);
	//已经存在了ServiceManager,返回EBUSY
	if (context->binder_context_mgr_node) {
		pr_err("BINDER_SET_CONTEXT_MGR already set\n");
		ret = -EBUSY;
		goto out;
	}
    ...	
	//设置uid
	if (uid_valid(context->binder_context_mgr_uid)) {
		if (!uid_eq(context->binder_context_mgr_uid, curr_euid)) {
		    ....	
			ret = -EPERM;
			goto out;
		}
	} else {
		context->binder_context_mgr_uid = curr_euid;
	}
	//为serviceManager新建binder_node,serviceManager只有唯一一个binder_node
	new_node = binder_new_node(proc, NULL);
	if (!new_node) {
		ret = -ENOMEM;
		goto out;
	}
	binder_node_lock(new_node);
	new_node->local_weak_refs++;
	new_node->local_strong_refs++;
	new_node->has_strong_ref = 1;
	new_node->has_weak_ref = 1;
	//binder_context_mgr_node指向new_node
	context->binder_context_mgr_node = new_node;
	binder_node_unlock(new_node);
	binder_put_node(new_node);
out:
	mutex_unlock(&context->context_mgr_node_lock);
	return ret;
}

1
2
sm->addService(String16(SERVICE::getServiceName()), new SERVICE(), 
        allowIsolated, dumpFlags);

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
//frameworks/native/libs/binder/IServiceManager.cpp
virtual status_t addService(const String16& name, const sp<IBinder>& service,
                            bool allowIsolated, int dumpsysPriority) {
    Parcel data, reply;
    data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
    data.writeString16(name);
    //将服务写入到data并传给Binder驱动!
    data.writeStrongBinder(service);
    data.writeInt32(allowIsolated ? 1 : 0);
    data.writeInt32(dumpsysPriority);
    //remote返回的是mRemote,即IBinder
    status_t err = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply);
    return err == NO_ERROR ? reply.readExceptionCode() : err;
}

//frameworks/native/libs/binder/BpBinder.cpp
BpBinder继承了IBinder,调用的transact遵循多态
status_t BpBinder::transact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    if (mAlive) {
        //命令协议为BC_TRANSACTION
        status_t status = IPCThreadState::self()->transact(
            mHandle, code, data, reply, flags);
        if (status == DEAD_OBJECT) mAlive = 0;
        return status;
    }
    return DEAD_OBJECT;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
//frameworks/native/cmds/servicemanager/service_manager.c
int svcmgr_handler(struct binder_state *bs,
                   struct binder_transaction_data *txn,
                   struct binder_io *msg,
                   struct binder_io *reply)
{
...
    //对应ADD_SERVICE_TRANSACTION
    case SVC_MGR_ADD_SERVICE:
        s = bio_get_string16(msg, &len);
        if (s == NULL) {
            return -1;
        }
        //bio_get_ref首先将binder_io类型的msg抽取出flat_binder_object数据
        //并从flat_binder_object中获取出handle
        handle = bio_get_ref(msg);
        allow_isolated = bio_get_uint32(msg) ? 1 : 0;
        dumpsys_priority = bio_get_uint32(msg);
        //调用do_add_service
        if (do_add_service(bs, s, len, handle, txn->sender_euid, allow_isolated, 
            dumpsys_priority,txn->sender_pid))
            return -1;
        break;
...
}

uint32_t bio_get_ref(struct binder_io *bio)
{
    struct flat_binder_object *obj;
    //这里获取了服务的内容,估计是经过了一次拷贝后,将服务的信息拷贝到了ServiceManager的内核空间中,又由于内核空间和用户空间经过了映射,所以ServiceManager可以直接获取数据. 
    obj = _bio_get_obj(bio);
    if (!obj)
        return 0;
    //服务首先写入时,类型为BINDER_TYPE_BINDER,但在驱动的bidner_transaction中的
    //binder_translate_binder方法中会改为BINDER_TYPE_HANDLE,并尝试找到binder_node对应的binder_ref,最后将binder_ref的handle值更新下去.所以serviceManager拿到的已经不是binder_node的信息,而是binder_ref的handle值.
    if (obj->hdr.type == BINDER_TYPE_HANDLE)
        return obj->handle;
    return 0;
}

int do_add_service(struct binder_state *bs, const uint16_t *s, size_t len, uint32_t handle,
                   uid_t uid, int allow_isolated, uint32_t dumpsys_priority, pid_t spid) {
    struct svcinfo *si;
    if (!handle || (len == 0) || (len > 127))
        return -1;

    if (!svc_can_register(s, len, spid, uid)) {
        ...
        return -1;
    }
    //根据服务名s,从svclist链表中找是否存在相同的服务
    si = find_svc(s, len);
    if (si) {//存在相同的service,则更新handle值
        if (si->handle) {
            ....
            svcinfo_death(bs, si);
        }
        si->handle = handle;
    } else {
        si = malloc(sizeof(*si) + (len + 1) * sizeof(uint16_t));
        //处理分配错误逻辑，并返回 
        ...
        si->handle = handle;
        si->len = len;
        memcpy(si->name, s, (len + 1) * sizeof(uint16_t));
        si->name[len] = '\0';
        si->death.func = (void*) svcinfo_death;
        si->death.ptr = si;
        si->allow_isolated = allow_isolated;
        si->dumpsys_priority = dumpsys_priority;
        //将服务名安排至头部
        si->next = svclist;
        svclist = si;
    }
    //增加指定handle的binder_ref对应的binder_node的强引用计数
    binder_acquire(bs, handle);
    binder_link_to_death(bs, handle, &si->death);
    return 0;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
//frameworks/native/libs/binder/IPCThreadState.cpp
//isMain参数默认为true
void IPCThreadState::joinThreadPool(bool isMain)
{
    //上层将BC_ENTER_LOOPER写入到Parcel类型的mOut中。
    mOut.writeInt32(isMain ? BC_ENTER_LOOPER : BC_REGISTER_LOOPER);
    status_t result;
    do {
        processPendingDerefs();
        //发送并处理驱动的消息
        result = getAndExecuteCommand();
        //处理result的错误或者超时信息
        .. 
    } while (result != -ECONNREFUSED && result != -EBADF);
    //最后发送BC_EXIT_LOOPER告诉驱动该进程退出
    mOut.writeInt32(BC_EXIT_LOOPER);
    talkWithDriver(false);
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
//linux-4.9/drivers/android/binder.c
static int binder_thread_write(struct binder_proc *proc,
			struct binder_thread *thread,
			binder_uintptr_t binder_buffer, size_t size,
			binder_size_t *consumed)
{
	uint32_t cmd;
	//binder_context主要用于记录当前的systemServer对应的binder_node节点
	struct binder_context *context = proc->context;
	//buffer指向binder_buffer的起始地址
	void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
	//consumed表明驱动处理了多少写数据，ptr指向该位置,即指向上层写协议数据(BC_ENTER_LOOPER)的起始位置。
	void __user *ptr = buffer + *consumed;
	void __user *end = buffer + size;

	while (ptr < end && thread->return_error.cmd == BR_OK) {
		int ret;
        //获取cmd,即BC_ENTER_LOOPER
		if (get_user(cmd, (uint32_t __user *)ptr))
			return -EFAULT;
		ptr += sizeof(uint32_t);
		if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) {
			atomic_inc(&binder_stats.bc[_IOC_NR(cmd)]);
			atomic_inc(&proc->stats.bc[_IOC_NR(cmd)]);
			atomic_inc(&thread->stats.bc[_IOC_NR(cmd)]);
		}
		switch (cmd) {
		...
		//驱动请求进程注册一个新线程注册到线程池中处理Binder通信。
		case BC_REGISTER_LOOPER:
			binder_inner_proc_lock(proc);
			//假如已经是Binder主线程了，就不需要再通过驱动创建了
			if (thread->looper & BINDER_LOOPER_STATE_ENTERED) {
				thread->looper |= BINDER_LOOPER_STATE_INVALID;
			    ...//打印错误提示	
			} else if (proc->requested_threads == 0) {
				thread->looper |= BINDER_LOOPER_STATE_INVALID;
			    ...//打印错误提示	
			} else {
				proc->requested_threads--;
				proc->requested_threads_started++;
			}
			//设置binder线程状态为BINDER_LOOPER_STATE_REGISTERED
			thread->looper |= BINDER_LOOPER_STATE_REGISTERED;
			binder_inner_proc_unlock(proc);
			break;
	    //上层要将一个线程注册到线程池中处理Binder通信。
	    case BC_ENTER_LOOPER:
			if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) {
				thread->looper |= BINDER_LOOPER_STATE_INVALID;
			    ...//打印错误提示	
			}
			//设置binder线程状态为BINDER_LOOPER_STATE_ENTERED
			thread->looper |= BINDER_LOOPER_STATE_ENTERED;
			break;	
		}
...
}

1
2
3
4
5
6
7
8
//获取ServiceManager
sp<IServiceManager> sm = defaultServiceManager();
//获取服务端的IBinder
sp<IBinder> binder = sm->getService(String16("media.drm"));
//通过interface_cast将binder转化为Bp代理端,从而可以通过代理请求服务
sp<IMediaDrmService> service = interface_cast<IMediaDrmService>(binder);
//这里使用了Binder通信
sp<IDrm> drm = service->makeDrm();

1
2
3
4
5
6
7
8
9
10
11
12
13
//frameworks/native/libs/binder/BpBinder.cpp
status_t BpBinder::transact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    // Once a binder has died, it will never come back to life.
    if (mAlive) {
        status_t status = IPCThreadState::self()->transact(
            mHandle, code, data, reply, flags);
        if (status == DEAD_OBJECT) mAlive = 0;
        return status;
    }
    return DEAD_OBJECT;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
//frameworks/native/libs/binder/IPCThreadState.cpp
status_t IPCThreadState::transact(int32_t handle,
                                  uint32_t code, const Parcel& data,
                                  Parcel* reply, uint32_t flags)
{
    status_t err;
    //默认flags设置了TF_ACCEPT_FDS
    flags |= TF_ACCEPT_FDS;
    //将协议BC_TRANSACTION,handle值传入
    err = writeTransactionData(BC_TRANSACTION, flags, handle, code, data, NULL);
    ... 
    //同步通信
    if ((flags & TF_ONE_WAY) == 0) {
        ...
        //waitForResponse调用了talkWithDriver，将数据传输到驱动
        if (reply) {
            err = waitForResponse(reply);
        } else {
            Parcel fakeReply;
            err = waitForResponse(&fakeReply);
        }
    //异步通信
    } else {
        err = waitForResponse(NULL, NULL);
    }
    return err;
}

status_t IPCThreadState::writeTransactionData(int32_t cmd, uint32_t binderFlags,
    int32_t handle, uint32_t code, const Parcel& data, status_t* statusBuffer)
{
    //binder_transaction_data描述进程间通信过程中所传输的数据
    binder_transaction_data tr;
    //默认初始化tr
    tr.target.ptr = 0;
    //设置binder_transaction_data的target.handle值
    tr.target.handle = handle;
    tr.code = code;//即
    tr.flags = binderFlags;
    tr.cookie = 0;
    tr.sender_pid = 0;
    tr.sender_euid = 0;

    const status_t err = data.errorCheck();
    //将Parcel类型的data内容传到tr中。
    if (err == NO_ERROR) {
        //数据缓冲区大小
        tr.data_size = data.ipcDataSize();
        //buffer指向数据缓冲区首地址
        tr.data.ptr.buffer = data.ipcData();
        //offsets_size指向后面Binder对象的大小
        tr.offsets_size = data.ipcObjectsCount()*sizeof(binder_size_t);
        //offsets指向Parcel的mObjects数组，其中保存着前面flat_binder_object的地址
        tr.data.ptr.offsets = data.ipcObjects();
    }
    ... 
    //mOut写入通信协议cmd，这里指BC_TRANSACTION
    mOut.writeInt32(cmd);
    //紧接其后写入通信数据
    mOut.write(&tr, sizeof(tr));
    return NO_ERROR;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
//linux-4.9/drivers/android/binder.c
static int binder_thread_write(struct binder_proc *proc,
			struct binder_thread *thread,
			binder_uintptr_t binder_buffer, size_t size,
			binder_size_t *consumed){
...
    case BC_TRANSACTION:
    case BC_REPLY: {
    	struct binder_transaction_data tr;
        //获取上层的通信数据binder_transaction_data
    	if (copy_from_user(&tr, ptr, sizeof(tr)))
    		return -EFAULT;
    	ptr += sizeof(tr);
    	//调用binder_transaction处理,并在输入判断是BC_TRANSACTION还是BC_REPLY
    	binder_transaction(proc, thread, &tr,
    			   cmd == BC_REPLY, 0);
    	break;
    }
}
...

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
//linux-4.9/drivers/android/binder.c
static void binder_transaction(struct binder_proc *proc,
			       struct binder_thread *thread,
			       struct binder_transaction_data *tr, int reply,
			       binder_size_t extra_buffers_size)
{
	int ret;
	struct binder_transaction *t;
	struct binder_work *tcomplete;
	binder_size_t *offp, *off_end, *off_start;
	binder_size_t off_min;
	u8 *sg_bufp, *sg_buf_end;
	struct binder_proc *target_proc = NULL;
	struct binder_thread *target_thread = NULL;
	struct binder_node *target_node = NULL;
	struct binder_transaction *in_reply_to = NULL;
	...
	struct binder_context *context = proc->context;
    ...
    //BC_REPLY，暂不分析
	if (reply) {
	    ....	
	} 
	//BC_TRANSACTION
	else {
		//本情况属于代理端请求服务,handle存在,该handle值是从ServiceManager中获得的
		if (tr->target.handle) {
			struct binder_ref *ref;
		    //对进程公共部分操作，需要上锁	
			binder_proc_lock(proc);
			//在binder进程(binder_proc)的红黑树refs_by_desc中搜索binder_ref,通过desc去寻找。
			//解释一下，当服务注册时，会在ServiceManager中创建与新建binder_node对应的binder_ref，
			//并加入两个红黑树当中．那么当client需要查询服务时，ServiceManager会首先查找是否存在，如果存在，
			//会在client内核空间中的红黑树中新建binder_ref,所以这里当client发起binder_transaciton时，一定要
			//在client所在的红黑树refs_by_desc中找到对应的binder_ref
			ref = binder_get_ref_olocked(proc, tr->target.handle,
						     true);
			if (ref) {
				//通过binder_ref类型的ref,可以找到指向的唯一的binder_node类型的node,即服务端
				//target_proc此处被赋值，为当前node所在的进程
				target_node = binder_get_node_refs_for_txn(
						ref->node, &target_proc,
						&return_error);
			} else {
				//handle值无效
				return_error = BR_FAILED_REPLY;
			}
			binder_proc_unlock(proc);
		} else {//假如传输的是binder服务对象，即进行服务的注册,需要找到serviceManager
			mutex_lock(&context->context_mgr_node_lock);
			//获取serviceManager的binder_node，此时target_node为serviceManager的binder_node
			target_node = context->binder_context_mgr_node;
			if (target_node)//找到target_node对应的target_proc
				target_node = binder_get_node_refs_for_txn(
						target_node, &target_proc,
						&return_error);
			else
				return_error = BR_DEAD_REPLY;
			mutex_unlock(&context->context_mgr_node_lock);
			if (target_node && target_proc == proc) {
				//目标进程和发起transaction的进程为同一进程时,返回错误
				//(既然是同一个进程直接调用不就好了吗?)
				return_error = BR_FAILED_REPLY;
				....
				goto err_invalid_target_handle;
			}
		}
		if (!target_node) {
		    //target_node为空时,即服务已死	
			...
			goto err_dead_binder;
		}
	    //至此，无论是服务注册，还是客户请求服务，都确定了target_proc(serviceManager或者client请求的服务)
	    //以及对应的binder_node
		binder_inner_proc_lock(proc);
		//当transaction为同步模式且transaction_stack不为空时
		//transaction_stack不为空说明有需要处理的事务，此时要确认是否有事务的发起者是目标进程．
		if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) {
			struct binder_transaction *tmp;
			tmp = thread->transaction_stack;
			//to_thread指向处理该transaction的线程，假如不等于当前thread则报错
			if (tmp->to_thread != thread) {
			    ...	
				binder_inner_proc_unlock(proc);
				return_error = BR_FAILED_REPLY;
				...
				goto err_bad_call_stack;
			}
			//遍历transaction栈,获取处理该事务的线程。紧接着检查线程所在进程是否为目标进程(target_proc)
			//找到则将该事务的线程设置为目标线程(target_thread),否则，将从当前transaction依赖的transaction继续往下找。
			while (tmp) {
				struct binder_thread *from;
				spin_lock(&tmp->lock);
				//找到发起当前transaction的线程。
				from = tmp->from;
				//检查发起线程是否为空，并检查线程所在的进程是否是target_proc(node所在进程或service_manager)
				//如果是,target_thread指向线程from，并且增加线程的tmp_ref，表明该线程正在临时使用。
				if (from && from->proc == target_proc) {
					atomic_inc(&from->tmp_ref);
					target_thread = from;
					spin_unlock(&tmp->lock);
					break;
				}
				spin_unlock(&tmp->lock);
				//将当前transaction替换为依赖的transaction。
				tmp = tmp->from_parent;
			}
		}
		binder_inner_proc_unlock(proc);
	}
    ...
    //分配一个新的transaction *t，初始化并将它最终加入到栈中。
	t = kzalloc(sizeof(*t), GFP_KERNEL);
	if (t == NULL) {
		return_error = BR_FAILED_REPLY;
		...
		goto err_alloc_t_failed;
	}
	//binder_stats的obj_created数组自增,binder_stats用于统计新建obj的数量
	binder_stats_created(BINDER_STAT_TRANSACTION);
	spin_lock_init(&t->lock);
    //分配binder_work
	tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL);
	if (tcomplete == NULL) {
		return_error = BR_FAILED_REPLY;
		...
		goto err_alloc_tcomplete_failed;
	}
	binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE);
	...
	//当协议为BC_TRANSACTION以及为同步模式时，t事务的发起线程设置为当前线程thread,异步就设置为NULL
	if (!reply && !(tr->flags & TF_ONE_WAY))
		t->from = thread;
	else
		t->from = NULL;
	t->sender_euid = task_euid(proc->tsk);
	//binder_transaction t的处理进程和线程就是target_proc以及target_thread
	t->to_proc = target_proc;
	t->to_thread = target_thread;
	t->code = tr->code;
	t->flags = tr->flags;
	if (!(t->flags & TF_ONE_WAY) &&
	    binder_supported_policy(current->policy)) {
		//继承原有的策略
		t->priority.sched_policy = current->policy;
		t->priority.prio = current->normal_prio;
	} else {
		//设置为默认权限
		t->priority = target_proc->default_priority;
	}
    //为transaction分配buffer,根据上文分析,binder_alloc_new_buf将用户空间以及内核空间映射到物理页面上.
    //且t->buffer是在目标进程(target_proc)中分配的.所以后续copy_from_user到t->buffer时，就涉及到一次拷贝过程
	t->buffer = binder_alloc_new_buf(&target_proc->alloc, tr->data_size,
		tr->offsets_size, extra_buffers_size,
		!reply && (t->flags & TF_ONE_WAY));
	if (IS_ERR(t->buffer)) {
	    ...	
		goto err_binder_alloc_buf_failed;
	}
	t->buffer->allow_user_free = 0;
	t->buffer->debug_id = t->debug_id;
	t->buffer->transaction = t;
	//正在使用该内核缓冲区的binder实体是binder_node或者是serviceManager的binder_node
	t->buffer->target_node = target_node;
	//off_start指向的是Binder对象
	off_start = (binder_size_t *)(t->buffer->data +
				      ALIGN(tr->data_size, sizeof(void *)));
	offp = off_start;
    //从用户空间的transaction数据缓冲区拷贝到target_proc的buffer中,这里即一次拷贝流程,
    //将数据从进程A的用户空间拷贝到进程B的内核空间,又B的内核空间和用户空间相互映射,即一次拷贝到B的用户空间中.从client角度，即将数据拷贝到了server端.
	if (copy_from_user(t->buffer->data, (const void __user *)(uintptr_t)
			   tr->data.ptr.buffer, tr->data_size)) {
	    ...//错误处理	
		goto err_copy_data_failed;
	}
	if (copy_from_user(offp, (const void __user *)(uintptr_t)
			   tr->data.ptr.offsets, tr->offsets_size)) {
	    ...//错误处理	
		goto err_copy_data_failed;
	}
    ...	
	off_end = (void *)off_start + tr->offsets_size;
	sg_bufp = (u8 *)(PTR_ALIGN(off_end, sizeof(void *)));
	sg_buf_end = sg_bufp + extra_buffers_size;
	off_min = 0;
	//遍历处理跨进程拷贝到目标进程中的Binder对象
	for (; offp < off_end; offp++) {
		struct binder_object_header *hdr;
		size_t object_size = binder_validate_object(t->buffer, *offp);
		if (object_size == 0 || *offp < off_min) {
		    ...//错误处理	
			goto err_bad_offset;
		}
		hdr = (struct binder_object_header *)(t->buffer->data + *offp);
		off_min = *offp + object_size;
		switch (hdr->type) {
		//Binder服务端
		case BINDER_TYPE_BINDER:
		case BINDER_TYPE_WEAK_BINDER: {
			struct flat_binder_object *fp;
            //计算出flat_binder_object,这是上层传输的结构
			fp = to_flat_binder_object(hdr);
			//将binder_node数据转化为binder_ref
			ret = binder_translate_binder(fp, t, thread);
			if (ret < 0) {
			    ...//错误处理	
				goto err_translate_failed;
			}
		} break;
		//Binder代理端
		case BINDER_TYPE_HANDLE:
		case BINDER_TYPE_WEAK_HANDLE: {
			struct flat_binder_object *fp;
			fp = to_flat_binder_object(hdr);
			ret = binder_translate_handle(fp, t, thread);
			if (ret < 0) {
			    ...//错误处理	
				goto err_translate_failed;
			}
		} break;

	    ...	
		default:
			...//错误处理	
			goto err_bad_object_type;
		}
	}
	//binder_work将类型设置为BINDER_WORK_TRANSACTION_COMPLETE。
	tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
	//binder_transaciton的work的type类型设置为BINDER_WORK_TRANSACTION。牢记这是在目标进程
	t->work.type = BINDER_WORK_TRANSACTION;

	if (reply) {
	    ...	
	} else if (!(t->flags & TF_ONE_WAY)) {
		binder_inner_proc_lock(proc);
		//将tcomplete加入到当前线程(client)的todo任务列表中,当进程被唤醒时会进行处理(即唤醒的时候，
		//表明transaciton工作已经完成了(BINDER_WORK_TRANSACTION_COMPLETE))
		binder_enqueue_deferred_thread_work_ilocked(thread, tcomplete);
		t->need_reply = 1;
		//将t加入到当前线程的transaction_stack的栈顶
		t->from_parent = thread->transaction_stack;
		thread->transaction_stack = t;
		binder_inner_proc_unlock(proc);
		//刚才先把tcomplete放到当前线程，却把要处理的t->work放入了target_thread的todo列表中
		//并在最后，唤醒目标线程，即让server去处理．假如此时target_thread为空，会从目标进程中挑选一个作为
		//目标线程
		if (!binder_proc_transaction(t, target_proc, target_thread)) {
			binder_inner_proc_lock(proc);
			binder_pop_transaction_ilocked(thread, t);
			binder_inner_proc_unlock(proc);
			goto err_dead_proc_or_thread;
		}
	} else {//异步
	    //仅仅是将tcomplete加入到线程thread的todo任务列表中,而不去唤醒目标线程！
		binder_enqueue_thread_work(thread, tcomplete);
		if (!binder_proc_transaction(t, target_proc, NULL))
			goto err_dead_proc_or_thread;
	}
	//使用完毕后，将target_thread的临时标志去掉，表明线程已经用完了
	if (target_thread)
		binder_thread_dec_tmpref(target_thread);
	binder_proc_dec_tmpref(target_proc);
	if (target_node)
		binder_dec_node_tmpref(target_node);
	smp_wmb();
	WRITE_ONCE(e->debug_id_done, t_debug_id);
	return;
    ...//错误处理
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
//linux-4.9/drivers/android/binder.c
static int binder_translate_binder(struct flat_binder_object *fp,
				   struct binder_transaction *t,
				   struct binder_thread *thread)
{
	struct binder_node *node;
	struct binder_proc *proc = thread->proc;
	struct binder_proc *target_proc = t->to_proc;
	struct binder_ref_data rdata;
	int ret = 0;
    //在binder_proc进程中的nodes红黑树中，根据地址(fp->binder)找到flat_binder_object
	node = binder_get_node(proc, fp->binder);
	if (!node) {
	    //假如找不到则新建一个binder_node,新建的node会加入服务进程的nodes红黑树中
	    //服务在注册服务时，就会在服务进程中新建一个binder_node到nodes红黑树中
		node = binder_new_node(proc, fp);
		if (!node)
			return -ENOMEM;
	}
	if (fp->cookie != node->cookie) {
	    ...	
		ret = -EINVA;
		goto done;
	}
	//尝试获取node对应的binder_ref,如果找不到,则会在红黑树binder_ref_desc以及binder_ref_node中增加binder_ref
	//当服务使用addService时,对应的target_proc为ServiceManager,即在ServiceManager
	ret = binder_inc_ref_for_node(target_proc, node,
			fp->hdr.type == BINDER_TYPE_BINDER,
			&thread->todo, &rdata);
	if (ret)
		goto done;
    //当上层设定的类型为BINDER_TYPE_BINDER时，即服务时，会将类型改为BINDER_TYPE_HANDLE
	if (fp->hdr.type == BINDER_TYPE_BINDER)
		fp->hdr.type = BINDER_TYPE_HANDLE;
	else//其余的都改成BINDER_TYPE_WEAK_HANDLE
		fp->hdr.type = BINDER_TYPE_WEAK_HANDLE;
	fp->binder = 0;
	//将binder_ref对应的binder_ref_data中的desc值赋值给handle
	fp->handle = rdata.desc;
	fp->cookie = 0;
    ...
done:
	binder_put_node(node);
	return ret;
}

static struct binder_node *binder_get_node(struct binder_proc *proc,
					   binder_uintptr_t ptr)
{
	struct binder_node *node;
	binder_inner_proc_lock(proc);
	node = binder_get_node_ilocked(proc, ptr);
	binder_inner_proc_unlock(proc);
	return node;
}

static struct binder_node *binder_get_node_ilocked(struct binder_proc *proc,
						   binder_uintptr_t ptr)
{
    //从进程binder_proc中的nodes红黑树中获取根节点
	struct rb_node *n = proc->nodes.rb_node;
	struct binder_node *node;
	assert_spin_locked(&proc->inner_lock);
    //在nodes红黑树中找到对应的node并返回
	while (n) {
		node = rb_entry(n, struct binder_node, rb_node);

		if (ptr < node->ptr)
			n = n->rb_left;
		else if (ptr > node->ptr)
			n = n->rb_right;
		else {
			//增加node的tmp_refs计数器,表明正在使用
			binder_inc_node_tmpref_ilocked(node);
			return node;
		}
    }
}