App 进程初始化binder、获取ServiceManager服务
数据结构
ProcessState：用户空间下表示进程状态，单个进程只有一个ProcessState对象。负责打开Binder驱动和建立线程池
IPCThreadState：用户空间下线程通过IPCthreadState跟binder驱动进行命令交互
App进程启动
Init进程启动了zygote进程、system_server进程、ServiceManager进程、lwkd服务等
zygote并没有利用binder通信，而是利用socket接收信息，在执行ZygoteInit.main()后便进入runSelectLoop()循环体内，当有客户端连接时便会执行ZygoteConnection.runOnce()方法，再经过层层调用后fork出新的应用进程；
java层Process.start()来启动一个进程，在ZygoteConnection.runOnce()中：
// ZygoteConnection.runOnce
boolean runOnce(ZygoteServer zygoteServer) throws Zygote.MethodAndArgsCaller {
pid = Zygote.forkAndSpecialize(parsedArgs.uid, parsedArgs.gid, parsedArgs.gids,
parsedArgs.debugFlags, rlimits, parsedArgs.mountExternal, parsedArgs.seInfo,
parsedArgs.niceName, fdsToClose, fdsToIgnore, parsedArgs.instructionSet,
parsedArgs.appDataDir);
...
if (pid == 0) { // fork完成之后，子进程的pid会等于0，会进入
zygoteServer.closeServerSocket(); // 子进程结束掉zygote的socket监听
IoUtils.closeQuietly(serverPipeFd);
serverPipeFd = null;
handleChildProc(parsedArgs, descriptors, childPipeFd, newStderr);
return true;
}
}
private void handleChildProc(Arguments parsedArgs,
FileDescriptor[] descriptors, FileDescriptor pipeFd, PrintStream newStderr)
throws Zygote.MethodAndArgsCaller {
...
ZygoteInit.zygoteInit(parsedArgs.targetSdkVersion,
parsedArgs.remainingArgs, null /* classLoader */);
}
// ZygoteInit.java
public static final void zygoteInit(int targetSdkVersion, String[] argv,
ClassLoader classLoader) throws Zygote.MethodAndArgsCaller {
RuntimeInit.commonInit();
ZygoteInit.nativeZygoteInit();
RuntimeInit.applicationInit(targetSdkVersion, argv, classLoader);
}
ZygonteInit
//frameworks/base/core/jni/AndroidRuntime.cpp
static void com_android_internal_os_ZygoteInit_nativeZygoteInit(JNIEnv* env, jobject clazz)
{
gCurRuntime->onZygoteInit();
}
// frameworks/base/cmds/app_process/App_main.cpp
virtual void onZygoteInit()
{
sp<ProcessState> proc = ProcessState::self();
proc->startThreadPool();
}
进程只有一个ProcessState实例，且只有在ProcessState对象建立时才打开Binder设备以及做内存映射
// frameworks/native/libs/binder/ProcessState.cpp
// 单例模式
sp<ProcessState> ProcessState::self()
{
Mutex::Autolock _l(gProcessMutex);
if (gProcess != NULL) {
return gProcess;
}
gProcess = new ProcessState("/dev/binder");
return gProcess;
}
ProcessState::ProcessState(const char *driver)
: mDriverName(String8(driver))
, mDriverFD(open_driver(driver))
, mVMStart(MAP_FAILED)
, mThreadCountLock(PTHREAD_MUTEX_INITIALIZER)
, mThreadCountDecrement(PTHREAD_COND_INITIALIZER)
, mExecutingThreadsCount(0)
, mMaxThreads(DEFAULT_MAX_BINDER_THREADS)
, mStarvationStartTimeMs(0)
, mManagesContexts(false)
, mBinderContextCheckFunc(NULL)
, mBinderContextUserData(NULL)
, mThreadPoolStarted(false)
, mThreadPoolSeq(1)
{
if (mDriverFD >= 0) {
// mmap the binder, providing a chunk of virtual address space to receive transactions.
mVMStart = mmap(0, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
if (mVMStart == MAP_FAILED) {
close(mDriverFD);
mDriverFD = -1;
mDriverName.clear();
}
}
}
open_driver、mmap() 已经分析过了，可以参考 https://blog.csdn.net/qq_15893929/article/details/103965875
startThreadPool创建一个PoolThread表示当前线程并注册为binder线程
void ProcessState::startThreadPool()
{
AutoMutex _l(mLock);
if (!mThreadPoolStarted) {
mThreadPoolStarted = true;
spawnPooledThread(true);
}
}
// 创建一个新的子线程
void ProcessState::spawnPooledThread(bool isMain)
{
if (mThreadPoolStarted) {
String8 name = makeBinderThreadName();
sp<Thread> t = new PoolThread(isMain);
t->run(name.string());
}
}
PoolThread表示binder线程
class PoolThread : public Thread
{
public:
explicit PoolThread(bool isMain)
: mIsMain(isMain)
{
}
protected:
virtual bool threadLoop()
{
IPCThreadState::self()->joinThreadPool(mIsMain);
return false;
}
const bool mIsMain;
};
IPCThreadState跟binder驱动交互
void IPCThreadState::joinThreadPool(bool isMain)
{
// 如果是主线程，则命令是BC_ENTER_LOOPER，如果是子线程则是BC_REGISTER_LOOPER
mOut.writeInt32(isMain ? BC_ENTER_LOOPER : BC_REGISTER_LOOPER);
status_t result;
do {
processPendingDerefs(); // 清除队列的引用
// now get the next command to be processed, waiting if necessary
result = getAndExecuteCommand(); // 阻塞获取下个命令并执行
if (result < NO_ERROR && result != TIMED_OUT && result != -ECONNREFUSED && result != -EBADF) {
ALOGE("getAndExecuteCommand(fd=%d) returned unexpected error %d, aborting",
mProcess->mDriverFD, result);
abort();
}
// Let this thread exit the thread pool if it is no longer
// needed and it is not the main process thread.
if(result == TIMED_OUT && !isMain) {
break;
}
} while (result != -ECONNREFUSED && result != -EBADF);
mOut.writeInt32(BC_EXIT_LOOPER);
talkWithDriver(false);
}
status_t IPCThreadState::getAndExecuteCommand()
{
status_t result;
int32_t cmd;
result = talkWithDriver();
if (result >= NO_ERROR) {
...
pthread_mutex_unlock(&mProcess->mThreadCountLock);
result = executeCommand(cmd);
pthread_mutex_lock(&mProcess->mThreadCountLock);
...
}
return result;
}
// 跟binder驱动ioctl，修改bwr，修改 mOut、mIn
status_t IPCThreadState::talkWithDriver(bool doReceive)
{
binder_write_read bwr;
…
bwr.write_consumed = 0;
bwr.read_consumed = 0;
status_t err;
do {
if (ioctl(mProcess->mDriverFD, BINDER_WRITE_READ, &bwr) >= 0)
err = NO_ERROR;
else
err = -errno;
} while (err == -EINTR);
if (err >= NO_ERROR) {
if (bwr.write_consumed > 0) {
if (bwr.write_consumed < mOut.dataSize())
mOut.remove(0, bwr.write_consumed);
else
mOut.setDataSize(0);
}
if (bwr.read_consumed > 0) {
mIn.setDataSize(bwr.read_consumed);
mIn.setDataPosition(0);
}
return NO_ERROR;
}
return err;
}
status_t IPCThreadState::executeCommand(int32_t cmd)
{
BBinder* obj;
RefBase::weakref_type* refs;
status_t result = NO_ERROR;
switch ((uint32_t)cmd) {
case BR_ACQUIRE:
...
break;
case BR_TRANSACTION:
...
break;
}
return result;
}
如何添加新的binder线程，因为会有同时多个任务需要执行
IPCThreadState线程中，进行ioctl(BINDER_WRITE_READ), 在binder内核中会进入binder_ioctl_write_read，如果bwr有读缓存的数据，
两个进程之间相互传递的数据格式是binder_transaction_data
进程跟驱动进程相互传递的数据格式是binder_write_read
那可能需要更多的binder线程来处理binder_transaction_data数据
static int binder_thread_read(struct binder_proc *proc, struct binder_thread *thread, binder_uintptr_t binder_buffer, size_t size,binder_size_t *consumed, int non_block)
{
void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
void __user *ptr = buffer + *consumed;
void __user *end = buffer + size;
int ret = 0;
int wait_for_proc_work;
retry:
binder_inner_proc_lock(proc);
// 获取当前线程是否空闲等待，即线程事务栈和todo队列都为空
wait_for_proc_work = binder_available_for_proc_work_ilocked(thread);
binder_inner_proc_unlock(proc);
// 线程即将进入睡眠等待，设置线程状态改为BINDER_LOOPER_STATE_WAITING*/
thread->looper |= BINDER_LOOPER_STATE_WAITING;
if (non_block) {
if (!binder_has_work(thread, wait_for_proc_work))
ret = -EAGAIN;
} else {
// wait_for_proc_work 线程没有事务项，需要进入阻塞等待
ret = binder_wait_for_work(thread, wait_for_proc_work);
}
thread->looper &= ~BINDER_LOOPER_STATE_WAITING;
if (ret)
return ret;
while (1) {
uint32_t cmd;
struct binder_transaction_data_secctx tr;
struct binder_transaction_data *trd = &tr.transaction_data;
struct binder_work *w = NULL;
switch (w->type) {
case BINDER_WORK_TRANSACTION: {
...
} break;
case BINDER_WORK_RETURN_ERROR: {
...
} break;
…
}
done:
*consumed = ptr - buffer;
binder_inner_proc_lock(proc);
// 当满足条件时候，会创建一个binder_thread，同时告诉给用户进程空间BR_SPAWN_LOOPER去创建多一个线程
if (proc->requested_threads == 0 && list_empty(&thread->proc->waiting_threads) && proc->requested_threads_started < proc->max_threads &&
(thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */
/*spawn a new thread if we leave this out */) {
proc->requested_threads++;
binder_inner_proc_unlock(proc);
// 返回给用户空间BR_SPAWN_LOOPER
if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer))
return -EFAULT;
binder_stat_br(proc, thread, BR_SPAWN_LOOPER);
} else
binder_inner_proc_unlock(proc);
return 0;
}
继续看用户进程IPCThreadState如何处理BR_SPAWN_LOOPER
status_t IPCThreadState::executeCommand(int32_t cmd)
{
switch ((uint32_t)cmd) {
mProcess->spawnPooledThread(false);
break;
}
return result;
}
获取ServiceManager服务
在此之前，先介绍几个数据结构
IBinder
class IBinder : public virtual RefBase
{
public:
virtual sp<IInterface> queryLocalInterface(const String16& descriptor);
// 查询服务返回一个IInterface
virtual status_t pingBinder() = 0;
virtual status_t transact(uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags = 0) = 0;
// 发送IPC请求
virtual status_t linkToDeath(const sp<DeathRecipient>& recipient, void* cookie = NULL,
uint32_t flags = 0) = 0;
// 死亡通知回调
virtual BBinder* localBinder();
// 同一个进程下，返回一个BBinder，表示 binder实体
virtual BpBinder* remoteBinder();
// 不同进程下，返回一个BpBinder，表示binder引用代理
}
BBinder
在用户进程空间下，表示binder实体
class BBinder : public IBinder
{
protected:
virtual status_t onTransact( uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags = 0);
// 接收IPC请求
private:
std::atomic<Extras*> mExtras;
void* mReserved0;
}
BPBinder
在用户进程空间下，表示binder代理
// 在用户进程下，保存着binder_ref handle句柄
class BpBinder : public IBinder
{
public:
inline int32_t handle() const { return mHandle; }
virtual status_t transact( uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags = 0);
// 发送IPC请求
KeyedVector<const void*, entry_t> mObjects;
};
private:
const int32_t mHandle;
mutable Mutex mLock;
volatile int32_t mAlive;
volatile int32_t mObitsSent;
Vector<Obituary>* mObituaries;
ObjectManager mObjects;
Parcel* mConstantData;
mutable String16 mDescriptorCache;
};
所有的进程获取ServiceManger都是通过IServiceMnager.cpp的静态方法获取
App进程获取ServiceManager，就是获取ServiceManager的代理，在binder驱动角度看，就是App对应的binder_proc获取对应的binder_ref，在App用户进程上看，App获取对应ServiceManager的BpBinder。
// framework/native/libs/binder/IServiceMnager.cpp
sp<IServiceManager> defaultServiceManager()
{
if (gDefaultServiceManager != NULL) return gDefaultServiceManager;
{
AutoMutex _l(gDefaultServiceManagerLock);
while (gDefaultServiceManager == NULL) {
gDefaultServiceManager = interface_cast<IServiceManager>(
ProcessState::self()->getContextObject(NULL));
if (gDefaultServiceManager == NULL)
sleep(1);
}
}
return gDefaultServiceManager;
}
从 ProcessState::self()->getContextObject(NULL) 获取ServiceManager，若为空，则说明ServiceManager进程还没起来，进入sleep，再次循环获取，直至非空。
ProcessState 是进程单例，表示当前进程状态
// frameworks/native/libs/binder/ProcessState.cppkkj
sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& /*caller*/)
{
// 获取句柄为0，即ServiceManager的BpBinder
return getStrongProxyForHandle(0);
}
struct handle_entry {
IBinder* binder; // 指向BBinder或者BpBinder
RefBase::weakref_type* refs;
};
sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle)
{
sp<IBinder> result;
AutoMutex _l(mLock);
// 查找对应的BBinder或者BpBinder，在这里是取BpBinder
handle_entry* e = lookupHandleLocked(handle);
if (e != NULL) {
IBinder* b = e->binder;
if (b == NULL || !e->refs->attemptIncWeak(this)) {
if (handle == 0) { // handle为0，即ServiceManager
Parcel data;
// 底层是binder_ioctl，查看对应的handle对应的binder是否已死
status_t status = IPCThreadState::self()->transact(0, IBinder::PING_TRANSACTION, data, NULL, 0);
if (status == DEAD_OBJECT)
return NULL;
}
// 创建BpBinder
b = new BpBinder(handle);
e->binder = b;
if (b) e->refs = b->getWeakRefs();
result = b;
} else {
result.force_set(b);
e->refs->decWeak(this);
}
}
return result;
}
更多参考：http://gityuan.com/2016/10/29/binder-thread-pool/
利用 ProcessState::self()->getContextObject(NULL)) App进程获取到了ServiceManager的BpBinder，其中BpBinder的handle是0
gDefaultServiceManager = interface_cast(ProcessState::self()->getContextObject(NULL)); 转型为IServiceManager，接着App进程需要向ServiceManager查询所需要的服务，其实也是binder的跨进程通信。