Android ServiceManager

1.启动servicemanager进程

        ServiceManager是由init进程通过解析init.rc文件而创建的，其所对应的可执行程序servicemanager，所对应的源文件是service_manager.c，进程名为servicemanager。

system/core/rootdir/init.rc
// 602
service servicemanager /system/bin/servicemanager
class core
user system
group system
critical
onrestart restart healthd
onrestart restart zygote
onrestart restart media
onrestart restart surfaceflinger
onrestart restart drm

2.启动ServiceManager的入口函数是 service_manager.c 中的main()方法

int main(int argc, char **argv)
{
    struct binder_state *bs;
    //打开 binder驱动，申请 128k字节大小的内存空间
    bs = binder_open(128*1024);
    if (!bs) {
        ALOGE("failed to open binder driver\n");
        return -1;
    }
    //设为守护进程，成为 binder大管理者
    if (binder_become_context_manager(bs)) {
        ALOGE("cannot become context manager (%s)\n", strerror(errno));
        return -1;
    }
    ...

    //进入无限循环，处理client端发来的请求
    binder_loop(bs, svcmgr_handler);

    return 0;
}

2-1.binder_open

frameworks/native/cmds/servicemanager/binder.c

//打开 binder驱动，得到文件描述符
bs->fd = open("/dev/binder", O_RDWR);
// service_manager自己设置的，大小为 128kb
bs->mapsize = mapsize; 
/*通过系统调用，mmap内存映射，mmap必须是 page的整数倍(即 4kb的整数倍)*/
bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);

2-2.binder_become_context_manager

frameworks/native/cmds/servicemanager/binder.c

int binder_become_context_manager(struct binder_state *bs)
{
return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);
}

...

//创建 service_manager实体
context->binder_context_mgr_node = binder_new_node(proc, 0, 0);

binder_new_node 

kernel/drivers/staging/android/binder.c

static struct binder_node *binder_new_node(struct binder_proc *proc,
binder_uintptr_t ptr,
binder_uintptr_t cookie)

while (*p) {
//给新创建的binder_node 分配内核空间
node = kzalloc(sizeof(*node), GFP_KERNEL);
//将新创建的 node对象添加到 proc红黑树
rb_link_node(&node->rb_node, parent, p);
rb_insert_color(&node->rb_node, &proc->nodes);
//初始化 binder_node
node->proc = proc;
node->ptr = ptr;
node->cookie = cookie;
node->work.type = BINDER_WORK_NODE; // 设置 binder_work的 type
INIT_LIST_HEAD(&node->work.entry);
INIT_LIST_HEAD(&node->async_todo);

2-3.binder_loop

frameworks/native/cmds/servicemanager/binder.c

void binder_loop(struct binder_state *bs, binder_handler func)
{
    int res;
    struct binder_write_read bwr;
    uint32_t readbuf[32];

    bwr.write_size = 0;
    bwr.write_consumed = 0;
    bwr.write_buffer = 0;

    readbuf[0] = BC_ENTER_LOOPER;
    binder_write(bs, readbuf, sizeof(uint32_t));

    for (;;) {
        bwr.read_size = sizeof(readbuf);
        bwr.read_consumed = 0;
        bwr.read_buffer = (uintptr_t) readbuf;
        /* 不断地 binder读数据，没有数据会进入休眠状态 */
        res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
        res = binder_parse(bs, 0, (uintptr_t) readbuf, bwr.read_consumed, func);
        
    }
}

2-3-1.binder_write

frameworks/native/cmds/servicemanager/binder.c

int binder_write(struct binder_state *bs, void *data, size_t len)

bwr.write_size = len; // 大于 0，进入 binder_thread_write
bwr.write_consumed = 0;
bwr.write_buffer = (uintptr_t) data; // 此处 data为 BC_ENTER_LOOPER
bwr.read_size = 0; // read 不会进去
bwr.read_consumed = 0;
bwr.read_buffer = 0;
/* 进入内核binder_thread_write，设置线程的looper状态为循环状态 */
res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);

2-3-2.binder_thread_write

kernel/drivers/staging/android/binder.c

static int binder_thread_write(struct binder_proc *proc,struct binder_thread *thread,binder_uintptr_t binder_buffer, size_t size,binder_size_t *consumed){

...
//获取命令，即 BC_ENTER_LOOPER
if (get_user(cmd, (uint32_t __user *)ptr))
case BC_ENTER_LOOPER:
//设置该线程的 looper状态
thread->looper |= BINDER_LOOPER_STATE_ENTERED;
...
}

2-3-3.binder_thread_read

kernel/drivers/staging/android/binder.c

static int binder_thread_read(struct binder_proc *proc,struct binder_thread*thread,
binder_uintptr_t binder_buffer, size_t size,binder_size_t *consumed, int non_block)
//设置命令为 BR_NOOP
if (*consumed == 0) {
if (put_user(BR_NOOP, (uint32_t __user *)ptr))
//wait_for_proc_work 为 true
wait_for_proc_work = thread->transaction_stack == NULL &&
list_empty(&thread->todo);
//准备就绪的线程个数加 1
if (wait_for_proc_work)
proc->ready_threads++;

if (wait_for_proc_work) {
if (non_block) { // 非阻塞操作，service_manager是阻塞的，所以 if不命中
} else // 进入 else，开始等待
ret = wait_event_freezable_exclusive(proc->wait,
binder_has_proc_work(proc, thread));
}

2.获取service_manager

获取Service Manager是通过defaultServiceManager()方法来完成

frameworks/native/libs/binder/IServiceManager.cpp

sp<IServiceManager> defaultServiceManager()
{
    if (gDefaultServiceManager != NULL) return gDefaultServiceManager;
    
    {
        AutoMutex _l(gDefaultServiceManagerLock);
        while (gDefaultServiceManager == NULL) {
            gDefaultServiceManager = interface_cast<IServiceManager>(
                ProcessState::self()->getContextObject(NULL));
            if (gDefaultServiceManager == NULL)
                sleep(1);
        }
    }
    
    return gDefaultServiceManager;
}

1-1.ProcessState::self

sp<ProcessState> ProcessState::self()
{
    Mutex::Autolock _l(gProcessMutex);
    if (gProcess != NULL) {
        return gProcess;
    }
    gProcess = new ProcessState;
    return gProcess;
}

ProcessState::ProcessState()
    : mDriverFD(open_driver())
    , mVMStart(MAP_FAILED)
    , mThreadCountLock(PTHREAD_MUTEX_INITIALIZER)
    , mThreadCountDecrement(PTHREAD_COND_INITIALIZER)
    , mExecutingThreadsCount(0)
    , mMaxThreads(DEFAULT_MAX_BINDER_THREADS)
    , mManagesContexts(false)
    , mBinderContextCheckFunc(NULL)
    , mBinderContextUserData(NULL)
    , mThreadPoolStarted(false)
    , mThreadPoolSeq(1){
    if (mDriverFD >= 0) {
        //采用内存映射函数 mmap，给 binder分配一块大小为 (1M-8K)的虚拟地址空间,用来接收事务
        mVMStart = mmap(0, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, 

    }

static int open_driver()
{
    //打开 /dev/binder设备，建立与内核的 Binder驱动的交互通道
    int fd = open("/dev/binder", O_RDWR);
    if (fd >= 0) {
        ...
        //通过 ioctl设置 binder驱动，能支持的最大线程数15
        size_t maxThreads = DEFAULT_MAX_BINDER_THREADS;
        result = ioctl(fd, BINDER_SET_MAX_THREADS, &maxThreads);
        ...
    }
    return fd;
}

1-2.ProcessState::getContextObject

1.2.1 new BpBinder(handle);