ServiceManager启动过程（一）

一、servicemanager启动（init.rc）

init是android系统系统启动的第一个进程，它通过解析init.rc脚本来构建系统的初始形态，servicemanager就是在这个时候被启动的。

service servicemanager /system/bin/servicemanager
    class core
    user system
    group system
    critical
    onrestart restart healthd
    onrestart restart zygote
    onrestart restart media
    onrestart restart surfaceflinger
    onrestart restart drm

二、service_manager.c

启动过程在service_manager.c中的主函数中

int main(int argc, char **argv)
{
    struct binder_state *bs;//映射状态
    void *svcmgr = BINDER_SERVICE_MANAGER;//servicemanager的句柄为0

    bs = binder_open(128*1024);//打开binder设备，设置映射内存区大小为128k

    if (binder_become_context_manager(bs)) {
        ALOGE("cannot become context manager (%s)\n", strerror(errno));
        return -1;
    }
    svcmgr_handle = svcmgr;
    binder_loop(bs, svcmgr_handler);
    return 0;
}

其中，binder_state定义在service_manager.c中

struct binder_state
{
    int fd;//binder设备文件描述符
    void *mapped;//映射起始地址
    unsigned mapsize;//映射内存区大小
};

BINDER_SERVICE_MANAGER定义在/servicemanager/binder.h中，标识servicemanager的句柄值为0

#define BINDER_SERVICE_MANAGER ((void*) 0)

binder_open方法定义在/servicemanager/binder.h中

struct binder_state *binder_open(unsigned mapsize)
{
    struct binder_state *bs;

    bs = malloc(sizeof(*bs));
    if (!bs) {
        errno = ENOMEM;
        return 0;
    }

    bs->fd = open("/dev/binder", O_RDWR);//打开binder设备，获取文件描述符
    if (bs->fd < 0) {
        fprintf(stderr,"binder: cannot open device (%s)\n",
                strerror(errno));
        goto fail_open;
    }

    bs->mapsize = mapsize;//映射内存区大小
    //方法原型
    //start起始地址 length长度 prot权限 flags影响 fd文件描述符 offset被映射内容起点
    //void *mmap(void *start, size_t length, int prot, int flags,int fd, off_t offset);
    bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);//内存映射
    if (bs->mapped == MAP_FAILED) {
        fprintf(stderr,"binder: cannot map device (%s)\n",
                strerror(errno));
        goto fail_map;
    }

        /* TODO: check version */

    return bs;

fail_map:
    close(bs->fd);
fail_open:
    free(bs);
    return 0;
}

binder_become_context_manager(bs)方法定义在servicemanager/binder.c中，将servicemanager设置为service的管理者

int binder_become_context_manager(struct binder_state *bs)
{
    return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);//向binder server发送BINDER_SET_CONTEXT_MGR命令
}

binder_loop方法定义在servicemanager/binder.c中，进入循环，处理消息

void binder_loop(struct binder_state *bs, binder_handler func)
{
    int res;
    struct binder_write_read bwr;
    unsigned readbuf[32];

    bwr.write_size = 0;
    bwr.write_consumed = 0;
    bwr.write_buffer = 0;

    readbuf[0] = BC_ENTER_LOOPER;//发送指令，进入循环
    binder_write(bs, readbuf, sizeof(unsigned));

    for (;;) {
        bwr.read_size = sizeof(readbuf);
        bwr.read_consumed = 0;
        bwr.read_buffer = (unsigned) readbuf;

        res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);

        if (res < 0) {
            ALOGE("binder_loop: ioctl failed (%s)\n", strerror(errno));
            break;
        }

        res = binder_parse(bs, 0, readbuf, bwr.read_consumed, func);
        if (res == 0) {
            ALOGE("binder_loop: unexpected reply?!\n");
            break;
        }
        if (res < 0) {
            ALOGE("binder_loop: io error %d %s\n", res, strerror(errno));
            break;
        }
    }
}

binder_write_read定义在binder.h中

struct binder_write_read {
    signed long write_size; /* bytes to write */
    signed long write_consumed; /* bytes consumed by driver */
    unsigned long   write_buffer;
    signed long read_size;  /* bytes to read */
    signed long read_consumed;  /* bytes consumed by driver */
    unsigned long   read_buffer;
};

binder_write定义在/servicemanager/binder.c中

int binder_write(struct binder_state *bs, void *data, unsigned len)
{
    struct binder_write_read bwr;
    int res;
    bwr.write_size = len;
    bwr.write_consumed = 0;
    bwr.write_buffer = (unsigned) data;
    bwr.read_size = 0;
    bwr.read_consumed = 0;
    bwr.read_buffer = 0;
    res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);//发起写操作
    if (res < 0) {
        fprintf(stderr,"binder_write: ioctl failed (%s)\n",
                strerror(errno));
    }
    return res;
}