一、servicemanager启动(init.rc)
init是android系统系统启动的第一个进程,它通过解析init.rc脚本来构建系统的初始形态,servicemanager就是在这个时候被启动的。
service servicemanager /system/bin/servicemanager
class core
user system
group system
critical
onrestart restart healthd
onrestart restart zygote
onrestart restart media
onrestart restart surfaceflinger
onrestart restart drm
二、service_manager.c
启动过程在service_manager.c中的主函数中
int main(int argc, char **argv)
{
struct binder_state *bs;//映射状态
void *svcmgr = BINDER_SERVICE_MANAGER;//servicemanager的句柄为0
bs = binder_open(128*1024);//打开binder设备,设置映射内存区大小为128k
if (binder_become_context_manager(bs)) {
ALOGE("cannot become context manager (%s)\n", strerror(errno));
return -1;
}
svcmgr_handle = svcmgr;
binder_loop(bs, svcmgr_handler);
return 0;
}
其中,binder_state定义在service_manager.c中
struct binder_state
{
int fd;//binder设备文件描述符
void *mapped;//映射起始地址
unsigned mapsize;//映射内存区大小
};
BINDER_SERVICE_MANAGER定义在/servicemanager/binder.h中,标识servicemanager的句柄值为0
#define BINDER_SERVICE_MANAGER ((void*) 0)
binder_open方法定义在/servicemanager/binder.h中
struct binder_state *binder_open(unsigned mapsize)
{
struct binder_state *bs;
bs = malloc(sizeof(*bs));
if (!bs) {
errno = ENOMEM;
return 0;
}
bs->fd = open("/dev/binder", O_RDWR);//打开binder设备,获取文件描述符
if (bs->fd < 0) {
fprintf(stderr,"binder: cannot open device (%s)\n",
strerror(errno));
goto fail_open;
}
bs->mapsize = mapsize;//映射内存区大小
//方法原型
//start起始地址 length长度 prot权限 flags影响 fd文件描述符 offset被映射内容起点
//void *mmap(void *start, size_t length, int prot, int flags,int fd, off_t offset);
bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);//内存映射
if (bs->mapped == MAP_FAILED) {
fprintf(stderr,"binder: cannot map device (%s)\n",
strerror(errno));
goto fail_map;
}
/* TODO: check version */
return bs;
fail_map:
close(bs->fd);
fail_open:
free(bs);
return 0;
}
binder_become_context_manager(bs)方法定义在servicemanager/binder.c中,将servicemanager设置为service的管理者
int binder_become_context_manager(struct binder_state *bs)
{
return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);//向binder server发送BINDER_SET_CONTEXT_MGR命令
}
binder_loop方法定义在servicemanager/binder.c中,进入循环,处理消息
void binder_loop(struct binder_state *bs, binder_handler func)
{
int res;
struct binder_write_read bwr;
unsigned readbuf[32];
bwr.write_size = 0;
bwr.write_consumed = 0;
bwr.write_buffer = 0;
readbuf[0] = BC_ENTER_LOOPER;//发送指令,进入循环
binder_write(bs, readbuf, sizeof(unsigned));
for (;;) {
bwr.read_size = sizeof(readbuf);
bwr.read_consumed = 0;
bwr.read_buffer = (unsigned) readbuf;
res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
if (res < 0) {
ALOGE("binder_loop: ioctl failed (%s)\n", strerror(errno));
break;
}
res = binder_parse(bs, 0, readbuf, bwr.read_consumed, func);
if (res == 0) {
ALOGE("binder_loop: unexpected reply?!\n");
break;
}
if (res < 0) {
ALOGE("binder_loop: io error %d %s\n", res, strerror(errno));
break;
}
}
}
binder_write_read定义在binder.h中
struct binder_write_read {
signed long write_size; /* bytes to write */
signed long write_consumed; /* bytes consumed by driver */
unsigned long write_buffer;
signed long read_size; /* bytes to read */
signed long read_consumed; /* bytes consumed by driver */
unsigned long read_buffer;
};
binder_write定义在/servicemanager/binder.c中
int binder_write(struct binder_state *bs, void *data, unsigned len)
{
struct binder_write_read bwr;
int res;
bwr.write_size = len;
bwr.write_consumed = 0;
bwr.write_buffer = (unsigned) data;
bwr.read_size = 0;
bwr.read_consumed = 0;
bwr.read_buffer = 0;
res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);//发起写操作
if (res < 0) {
fprintf(stderr,"binder_write: ioctl failed (%s)\n",
strerror(errno));
}
return res;
}