Android binder 自学

1. ServiceManager

        从名字上看，就是service的管理者，其有独立的进程，会涉及一个问题，server向ServiceManager注册服务，或者client向ServiceManager请求服务，都是跨进程的，也需要进程通信，那binder是如何实现的呢，就是系统启动时，ServiceManager先通过ioctl BINDER_SET_CONTEXT_MGR 创建一个binder实体，这个binder不需要注册，Server向ServiceManager注册自己的服务通过引用号0实现。

1.1 ServiceManager启动

frameworks/native/cmds/servicemanager/

Init.rc:

service servicemanager /system/bin/servicemanager

int main()
{
    struct binder_state *bs;

    bs = binder_open(128*1024);
    if (!bs) {
        ALOGE("failed to open binder driver\n");
        return -1;
    }

    if (binder_become_context_manager(bs)) {
        ALOGE("cannot become context manager (%s)\n", strerror(errno));
        return -1;
    }

    selinux_enabled = is_selinux_enabled();
    sehandle = selinux_android_service_context_handle();
    selinux_status_open(true);

    if (selinux_enabled > 0) {
        if (sehandle == NULL) {
            ALOGE("SELinux: Failed to acquire sehandle. Aborting.\n");
            abort();
        }

        if (getcon(&service_manager_context) != 0) {
            ALOGE("SELinux: Failed to acquire service_manager context. Aborting.\n");
            abort();
        }
    }

    union selinux_callback cb;
    cb.func_audit = audit_callback;
    selinux_set_callback(SELINUX_CB_AUDIT, cb);
    cb.func_log = selinux_log_callback;
    selinux_set_callback(SELINUX_CB_LOG, cb);

    binder_loop(bs, svcmgr_handler);

    return 0;
}

1.2 ServiceManager自注册binder

        如下通过ioctl BINDER_SET_CONTEXT_MGR创建binder实体

int binder_become_context_manager(struct binder_state *bs)
{
    return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);
}

1.3 Server获得ServiceManager引用

sp<IServiceManager> defaultServiceManager()
{
    if (gDefaultServiceManager != NULL) return gDefaultServiceManager;
    {
        AutoMutex _l(gDefaultServiceManagerLock);
        while (gDefaultServiceManager == NULL) {
            gDefaultServiceManager = interface_cast<IServiceManager>(
                ProcessState::self()->getContextObject(NULL));
            if (gDefaultServiceManager == NULL)
                sleep(1);
        }
    }
    return gDefaultServiceManager;
}
通过模板带入实参，将如上的核心代码变为：

IServiceManager::asInterface(new BpBinder(0));

如上，就是创建Binder引用号为0的代理

2. ProcessState

从名字上看就是处理进程的，是单例模型

sp<ProcessState> ProcessState::self()
{
    Mutex::Autolock _l(gProcessMutex);
    if (gProcess != NULL) {
        return gProcess;
    }
    gProcess = new ProcessState;
    return gProcess;
}

class PoolThread : public Thread
{
......
protected:
    virtual bool threadLoop()
    {
        IPCThreadState::self()->joinThreadPool(mIsMain);
        return false;
    }
......
};

3. IPCThreadState

从名字上可以看出是负责线程

这个文件看起来会比较费劲，因为client和server都会使用这个类