service_manager 启动

文件路径：

server_manager.c:(.../frameworks//native/cmds/servicemanager/service_manager.c)
server_manager.c 单独使用的 binder.c(.../frameworks//native/cmds/servicemanager/binder.c)

入口函数是main()@server_manager.c

int main(int argc, char** argv){
    struct binder_state *bs;
    //打开 binder 驱动，申请128字节内存
    //对于 server_manager.c专门写了一个单独的 binder.c 供其使用
    bs = binder_open(128*1024);
    ...
    if(binder_become_context_manager(bs)){
        ...
    }
    ...
    binder_loop(bs, svcmgr_handler);
}

server_manager的启动分为三步，第一步binder_open()打开 binder 驱动，第二步binder_become_context_manager()告知 Binder 驱动让自己称为管理者，第三步 binder_loop 进入循环与其他进程进行通信。

first:binder_open()

//.../frameworks//native/cmds/servicemanager/binder.c
struct binder_state *binder_open(size_t mapsize){
    ...
    //打开 binder 驱动，调用到内核代码
    //binder_open@goldfish/drivers/staging/android/binder.c
    bs->fd = open("/dev/binder", O_RDWR);
    ...
    //通过系统调用到binder_ioctl()@goldfish/drivers/staging/android/binder.c
    //与 binder 驱动进行通信，参数用 BINDER_VERSION获取 binder 版本信息
    //如果版本不一致会报错
    if((ioctl(bf->fd, BINDER_VERSION, &vers) == -1) || (...)){
        ...
    }

    //通过系统调用到binder_mmap()@goldfish/drivers/staging/android/binder.c
    //进行内存映射
    bs->mmaped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0){
        ...
    }
}

////.../frameworks//native/cmds/servicemanager/binder.c
int binder_become_context_manager(struct binder_state *bs){
    //一样的系统调用到binder_ioctl()，传递参数BINDER_SET_CONTEXT_MGR
    //表明自己成为上下文管理者
    return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);
}

//这里的 func 传递的是一个方法，表明处理消息的方法
//传递是是svcmgr_handler
void binder_loop(struct binder_state *bs, binder_handler func){
    int res;
    struct binder_write_read bwr;
    uint32_t readbuf[32];

    bwr.write_size = 0;
    bwr.write_consumed = 0;
    bwr.write_buffer = 0;

    readbuf[0] = BC_ENTER_LOOPER;
    binder_write(bs, readbuf, sizeof(uint32_t));

    for (;;) {
        bwr.read_size = sizeof(readbuf);
        bwr.read_consumed = 0;
        bwr.read_buffer = (uintptr_t) readbuf;
        //进入循环，不断得 binder 读写过程
        res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);

        if (res < 0) {
            ALOGE("binder_loop: ioctl failed (%s)\n", strerror(errno));
            break;
        }
        //解析 binder 信息，如果有需要进行 reply
        res = binder_parse(bs, 0, (uintptr_t) readbuf, bwr.read_consumed, func);
        if (res == 0) {
            ALOGE("binder_loop: unexpected reply?!\n");
            break;
        }
        if (res < 0) {
            ALOGE("binder_loop: io error %d %s\n", res, strerror(errno));
            break;
        }
    }
}

int binder_parse(struct binder_state *bs, struct_io *bio,
    uintprt_t ptr, size_t size, binder_handler fun){
    ...
    switch(cmd){
        case BR_NOOP:
                break;
        ....
        case BR_TRANSACTION:
                ...
                binder_send_reply(bs, &reply, txn->data.ptr.buffer, res);
                ...
        
    }
    ...
}

接下来看处理消息的函数

int scvmgr_handler(struct binder_state *bs, struct binder_transaction_data *txn,
    struct binder_io *msg,
    struct binder_ios *reply){
    ...
    switch(txn->code){
        case SVC_MGR_GET_SERVICE:
        case SVC_MGR_CHECK_SERVICE:
            ...
            handle = do_find_service(bs, s, len, txn_sender_euid, txn->sender_pid);
            ...
            break;
        case SVC_MGR_LIST_SERVICES:
            ...
            break;
    }
}

可以看到 service_manager 的主要功能是提供服务添加和服务查询功能；

总结下流程:

• binder_open()
  • open("/dev/binder/) 打开 binder 驱动
  • ioctl(,BINDER_VERSION,)获得 binder 版本信息
  • mmap()进行内存映射
• binder_become_context_manager()
• binder_loop()进入 loop
  • ioctl()读写 binder
  • binder_parse()解析 binder 信息
    • svcmgr_handler()处理解析的信息