//system\core\rootdir\init.rc	
	//啟動的服務(wù)，這里是用的服務(wù)名稱。服務(wù)名稱是在對應(yīng)的rc文件中注冊并啟動的
  start servicemanager

//\frameworks\native\cmds\servicemanager\servicemanager.rc
service servicemanager /system/bin/servicemanager
  class core animation
  user system //說明以用戶system身份運行
  group system readproc
  //說明servicemanager是系統(tǒng)中的關(guān)鍵服務(wù)，
  //關(guān)鍵服務(wù)是不會退出的，如果退出了，系統(tǒng)就會重啟，當(dāng)系統(tǒng)重啟時就會啟動用onrestart關(guān)鍵字修飾的進程，
  //比如zygote、media、surfaceflinger等等。
  critical
  onrestart restart healthd
  onrestart restart zygote
  onrestart restart audioserver
  onrestart restart media
  onrestart restart surfaceflinger
  onrestart restart inputflinger
  onrestart restart drm
  onrestart restart cameraserver
  onrestart restart keystore
  onrestart restart gatekeeperd
  onrestart restart thermalservice
  ..

//frameworks\native\libs\binder\ndk\service_manager.cpp
int main(int argc, char** argv)
{
	//binder_state結(jié)構(gòu)體，用來存儲binder的三個信息
  struct binder_state *bs;
	//打開binder驅(qū)動，并申請125k字節(jié)的內(nèi)存空間
  bs = binder_open(driver, 128*1024);
  ...
	//將自己注冊為Binder機制的管理者
  if (binder_become_context_manager(bs)) {
    ALOGE("cannot become context manager (%s)\n", strerror(errno));
    return -1;
  }
  ...
	//啟動循環(huán)，等待并處理client端發(fā)來的請求
  binder_loop(bs, svcmgr_handler);

  return 0;
}

//frameworks\native\cmds\servicemanager\binder.c
struct binder_state *binder_open(const char* driver, size_t mapsize)
{
  struct binder_state *bs;
  struct binder_version vers;
  //申請對應(yīng)的內(nèi)存空間 
  bs = malloc(sizeof(*bs));
	//打開binder設(shè)備文件，這種屬于設(shè)備驅(qū)動的操作方法
  bs->fd = open(driver, O_RDWR | O_CLOEXEC);
	//通過ioctl獲取binder的版本號
  if ((ioctl(bs->fd, BINDER_VERSION, &vers) == -1) ||
    (vers.protocol_version != BINDER_CURRENT_PROTOCOL_VERSION)) {
    fprintf(stderr,
        "binder: kernel driver version (%d) differs from user space version (%d)\n",
        vers.protocol_version, BINDER_CURRENT_PROTOCOL_VERSION);
    goto fail_open;
  }
  bs->mapsize = mapsize;
	//mmap進行內(nèi)存映射，將Binder設(shè)備文件映射到進程的對應(yīng)地址空間，地址空間大小為128k
	//映射之后，會將地址空間的起始地址和大小保存到結(jié)構(gòu)體中，
  bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);
  return bs;
}

//frameworks\native\cmds\servicemanager\binder.c
int binder_become_context_manager(struct binder_state *bs)
{
  return ioctl(bs->fd, BINDER_SET_CONTEXT_MGR, 0);
}

//frameworks\native\cmds\servicemanager\binder.c
void binder_loop(struct binder_state *bs, binder_handler func)
{
  int res;
  struct binder_write_read bwr;
  uint32_t readbuf[32];

  bwr.write_size = 0;
  bwr.write_consumed = 0;
  bwr.write_buffer = 0;
	//當(dāng)前線程注冊為Binder的指令
  readbuf[0] = BC_ENTER_LOOPER;
	//將BC_ENTER_LOOPER指令寫入到Binder驅(qū)動，
	//將當(dāng)前的ServiceManager線程注冊為了一個Binder線程(注意ServiceManager本身也是一個Binder線程)。
	//注冊為Binder線程之后，就可以處理進程間的請求了
  binder_write(bs, readbuf, sizeof(uint32_t));
	//不斷的循環(huán)遍歷
  for (;;) {
    bwr.read_size = sizeof(readbuf);
    bwr.read_consumed = 0;
    bwr.read_buffer = (uintptr_t) readbuf;
		//使用BINDER_WRITE_READ指令查詢Binder驅(qū)動中是否有請求。
		//如果有請求，就走到下面的binder_parse部分處理，如果沒有，當(dāng)前的ServiceManager線程就會在Binder驅(qū)動中水命，等待新的進程間請求
    res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
		//走到這里說明有請求信息。將請求的信息用binder_parse來處理,處理方法是func
    res = binder_parse(bs, 0, (uintptr_t) readbuf, bwr.read_consumed, func);
  }
}

//frameworks\native\cmds\servicemanager\binder.c
int binder_write(struct binder_state *bs, void *data, size_t len)
{
  struct binder_write_read bwr;
  int res;

  bwr.write_size = len;
  bwr.write_consumed = 0;
  bwr.write_buffer = (uintptr_t) data;
  bwr.read_size = 0;
  bwr.read_consumed = 0;
  bwr.read_buffer = 0;
	//BINDER_WRITE_READ既可以讀也可以寫。關(guān)鍵在于read_size和write_size。
	//如果write_size>0。則是寫。如果read_size>0則是讀。
	//如果都大于0，則先寫，再讀
  res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
  if (res < 0) {
    fprintf(stderr,"binder_write: ioctl failed (%s)\n",
        strerror(errno));
  }
  return res;
}

//frameworks\native\services\surfaceflinger\main_surfaceflinger.cpp
#include <binder/IServiceManager.h>
int main(int, char**) {
  ....
  //獲取一個SM對象，相當(dāng)于是new BpServiceManager(new BpBinder(0))
  sp<IServiceManager> sm(defaultServiceManager());
	//向ServiceManager注冊SurfaceFling服務(wù)
  sm->addService(String16(SurfaceFlinger::getServiceName()), flinger, false,
          IServiceManager::DUMP_FLAG_PRIORITY_CRITICAL | IServiceManager::DUMP_FLAG_PROTO);
	//在SurfaceFlinger調(diào)用init方法的時候，會初始化Display的相關(guān)信息
  startDisplayService(); // dependency on SF getting registered above
  ...
  return 0;
}

//frameworks\native\libs\binder\IServiceManager.cpp
sp<IServiceManager> defaultServiceManager()
{
  if (gDefaultServiceManager != nullptr) return gDefaultServiceManager;

  {
    AutoMutex _l(gDefaultServiceManagerLock);
		/*
		 * 1. ProcessState::self()->getContextObject(NULL): 返回的是一個 BpBinder. ServiceManager 的 desc 默認(rèn)為0.
		 * 2. interface_cast 就是將 BpBinder 封裝為 IServiceManager,這樣可以直接調(diào)用 IServiceManager 的接口.
		*/
		
		/*
		 * 這里,有一個設(shè)計思想.
		 * 1. defaultServiceManager 首先實例化 BpBinder.
		 * 2. interface_cast 就是 實例化 BpXXX,并將 BpBinder 交給其管理.
		 * 
		 * Proxy 端的用戶無法直接看到 BpBinder , BpBinder 由 BpXXX 持有.用戶本身不關(guān)心 BpBinder 的能力,只關(guān)心 IXXX 定義的 接口.
		 * 所以這里很好的進行了封裝.
		*/

    while (gDefaultServiceManager == nullptr) {//如果不為空，表示設(shè)置過了，直接返回
    	//嘗試不斷的獲取ServiceManager對象，如果獲取不到，就sleep（1）,
    	//這里之所以會獲取不到，是因為ServiceManager和一些通過init.rc啟動的服務(wù)是同時啟動的，不能保證ServiceManager能夠優(yōu)先啟動完成。
    	//所以會存在獲取ServiceManager的時候獲取不到。
      gDefaultServiceManager = interface_cast<IServiceManager>(
        ProcessState::self()->getContextObject(nullptr));
      if (gDefaultServiceManager == nullptr)
        sleep(1);
    }
  }

  return gDefaultServiceManager;
}

//system\libhwbinder\ProcessState.cpp
//返回一個ProcessState
sp<ProcessState> ProcessState::self()
{
  Mutex::Autolock _l(gProcessMutex);
  if (gProcess != nullptr) {
    return gProcess;
  }
  gProcess = new ProcessState(kDefaultDriver);
  return gProcess;
}

//system\libhwbinder\ProcessState.cpp
sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& /*caller*/)
{
  //傳入的參數(shù)是handle。0，
  return getStrongProxyForHandle(0);
}

sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle)
{
  handle_entry* e = lookupHandleLocked(handle);
  if (e != nullptr) {
    IBinder* b = e->binder;
    if (b == nullptr || !e->refs->attemptIncWeak(this)) {
			//如果b為空，那么創(chuàng)建一個BpHwBinder
      b = new BpHwBinder(handle);
      e->binder = b;
      if (b) e->refs = b->getWeakRefs();
      result = b;
    } else {
      result.force_set(b);
      e->refs->decWeak(this);
    }
  }

  return result;
}

//注意，方法中傳入的handle為0，所以BpBinder參數(shù)為0
gDefaultServiceManager = interface_cast<IServiceManager>(new BpBinder(0));

//frameworks\native\include\binder\IInterface.h
inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj)
{
  return INTERFACE::asInterface(obj);
}
//INTERFACE帶入為IServiceManager之后，得到的代碼為
inline sp<IServiceManager> interface_cast(const sp<IBinder>& obj)
{
  return IServiceManager::asInterface(obj);//靜態(tài)方法所以直接調(diào)用
}

#define IMPLEMENT_META_INTERFACE(INTERFACE, NAME)            
  DO_NOT_DIRECTLY_USE_ME_IMPLEMENT_META_INTERFACE(INTERFACE, NAME)  
#endif

#define DO_NOT_DIRECTLY_USE_ME_IMPLEMENT_META_INTERFACE(INTERFACE, NAME)\
  ::android::sp<I##INTERFACE> I##INTERFACE::asInterface(       \
      const ::android::sp<::android::IBinder>& obj)        \
  {                                  \
    android::sp<I##INTERFACE> intr;                \
    if (obj != nullptr) {                      \
      intr = static_cast<I##INTERFACE*>(             \
        obj->queryLocalInterface(                \
            I##INTERFACE::descriptor).get());        \
      if (intr == nullptr) {                   \
        intr = new Bp##INTERFACE(obj);             \
      }                              \
    }                                \
    return intr;                          \
  }                                  \

android::sp<IServiceManager> IIServiceManager::asInterface(const android::sp<android::IBinder>& obj)                 
{                                           
	android::sp<IServiceManager> intr;                          
	if (obj != NULL) {                                   
		intr = static_cast<IIServiceManager*>(                         
          obj->queryLocalInterface(IServiceManager::descriptor).get());//返回NULL
		if (intr == NULL) {        
			intr = new BpServiceManager(obj); //創(chuàng)建了ServiceManager代理對象           
		}                     
	｝
	return intr;                 
} 

  virtual status_t addService(const String16& name, const sp<IBinder>& service,
                bool allowIsolated, int dumpsysPriority) {
    Parcel data, reply;
    data.writeInterfaceToken(IServiceManager::getInterfaceDescriptor());
    data.writeString16(name);
    data.writeStrongBinder(service);
    data.writeInt32(allowIsolated ? 1 : 0);
    data.writeInt32(dumpsysPriority);
    status_t err = remote()->transact(ADD_SERVICE_TRANSACTION, data, &reply);
    return err == NO_ERROR ? reply.readExceptionCode() : err;
  }

status_t BpBinder::transact(
  uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
  //如果binder已經(jīng)died，則不會返回數(shù)據(jù)
  if (mAlive) {
    ...
		//調(diào)用IPCThreadState的transact方法。
    status_t status = IPCThreadState::self()->transact(
      mHandle, code, data, reply, flags);
    if (status == DEAD_OBJECT) mAlive = 0;
    return status;
  }
  return DEAD_OBJECT;
}

//frameworks\native\libs\binder\ndk\service_manager.cpp
int main(int argc, char** argv){
	...
	//啟動循環(huán)，等待并處理client端發(fā)來的請求
  binder_loop(bs, svcmgr_handler);
  ...
}

//frameworks\native\cmds\servicemanager\service_manager.c
int svcmgr_handler(struct binder_state *bs,
          struct binder_transaction_data_secctx *txn_secctx,
          struct binder_io *msg,
          struct binder_io *reply)
{
  ...
  struct binder_transaction_data *txn = &txn_secctx->transaction_data;
  ...	
	//根據(jù)傳輸?shù)牟煌愋蛠磉M行處理。
  switch(txn->code) {
    case SVC_MGR_ADD_SERVICE://添加服務(wù)
      //進行服務(wù)的添加
      do_add_service(bs, s, len, handle, txn->sender_euid, allow_isolated, dumpsys_priority,
                txn->sender_pid, (const char*) txn_secctx->secctx)
      ... 
}

  
int do_add_service(struct binder_state *bs, const uint16_t *s, size_t len, uint32_t handle,
          uid_t uid, int allow_isolated, uint32_t dumpsys_priority, pid_t spid, const char* sid) {
  struct svcinfo *si;

  //ALOGI("add_service('%s',%x,%s) uid=%d\n", str8(s, len), handle,
  //    allow_isolated ? "allow_isolated" : "!allow_isolated", uid);
  //服務(wù)的名稱長度不能超過127字節(jié)
  if (!handle || (len == 0) || (len > 127))
    return -1;
	//最終調(diào)用selinux_check_access方法，會進行權(quán)限的檢測，檢查服務(wù)是否有進行服務(wù)注冊
  if (!svc_can_register(s, len, spid, sid, uid)) {
    ALOGE("add_service('%s',%x) uid=%d - PERMISSION DENIED\n",
       str8(s, len), handle, uid);
    return -1;
  }
	//查詢是否已經(jīng)有包含了name的svcinfo
  si = find_svc(s, len);
  if (si) {
    if (si->handle) {
      ALOGE("add_service('%s',%x) uid=%d - ALREADY REGISTERED, OVERRIDE\n",
         str8(s, len), handle, uid);
			//已經(jīng)注冊了，釋放相應(yīng)的服務(wù)
      svcinfo_death(bs, si);
    }
		//更新服務(wù)的handle
    si->handle = handle;
  } else {
		//申請內(nèi)存
    si = malloc(sizeof(*si) + (len + 1) * sizeof(uint16_t));
    si->handle = handle;
    si->len = len;
    memcpy(si->name, s, (len + 1) * sizeof(uint16_t));
    si->name[len] = '\0';
    si->death.func = (void*) svcinfo_death;
    si->death.ptr = si;
    si->allow_isolated = allow_isolated;
    si->dumpsys_priority = dumpsys_priority;
		//將其注冊到服務(wù)列表svclist中，這里使用的鏈表來保存數(shù)據(jù)
    si->next = svclist;
    svclist = si;
  }
	//以handle為目標(biāo)，發(fā)送BC_ACQUIRE指令。
  binder_acquire(bs, handle);
	//以handle為目標(biāo)，發(fā)送BC_REQUEST_DEATH_NOTIFICATION指令。
  binder_link_to_death(bs, handle, &si->death);
  return 0;
}

//frameworks\native\cmds\servicemanager\service_manager.c
int svcmgr_handler(struct binder_state *bs,
          struct binder_transaction_data_secctx *txn_secctx,
          struct binder_io *msg,
          struct binder_io *reply)
{
  ...
  struct binder_transaction_data *txn = &txn_secctx->transaction_data;
  ...	
	//根據(jù)傳輸?shù)牟煌愋蛠磉M行處理。
  switch(txn->code) {
    case SVC_MGR_GET_SERVICE://獲取服務(wù)
    case SVC_MGR_CHECK_SERVICE:
      s = bio_get_string16(msg, &len);
      if (s == NULL) {
        return -1;
      }
      //根據(jù)pid，uid來獲取服務(wù)對應(yīng)的handle值
      handle = do_find_service(s, len, txn->sender_euid, txn->sender_pid,
                   (const char*) txn_secctx->secctx);
      if (!handle)
        break;
      //返回服務(wù)對應(yīng)的handle
      bio_put_ref(reply, handle);
      return 0;
}

//frameworks\native\cmds\servicemanager\service_manager.c 
//獲取對應(yīng)的服務(wù)
uint32_t do_find_service(const uint16_t *s, size_t len, uid_t uid, pid_t spid, const char* sid)
{
	//獲取對應(yīng)的服務(wù)
  struct svcinfo *si = find_svc(s, len);

  if (!si || !si->handle) {
    return 0;
  }

  if (!si->allow_isolated) {
    // If this service doesn't allow access from isolated processes,
    // then check the uid to see if it is isolated.
    uid_t appid = uid % AID_USER;
		//檢查服務(wù)是否是允許孤立于進程而單獨存在的
    if (appid >= AID_ISOLATED_START && appid <= AID_ISOLATED_END) {
      return 0;
    }
  }
	//檢測是否有selinx權(quán)限。
  if (!svc_can_find(s, len, spid, sid, uid)) {
    return 0;
  }
	//返回服務(wù)的handle
  return si->handle;
}

//frameworks\native\cmds\servicemanager\service_manager.c
void bio_put_ref(struct binder_io *bio, uint32_t handle)
{
  struct flat_binder_object *obj;
	//申請對應(yīng)的地址空間
  if (handle)
    obj = bio_alloc_obj(bio);
  else
    obj = bio_alloc(bio, sizeof(*obj));

  if (!obj)
    return;

  obj->flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
	//類型是BINDER_TYPE_HANDLE
  obj->hdr.type = BINDER_TYPE_HANDLE;
	//記錄handle
  obj->handle = handle;
  obj->cookie = 0;
}

//frameworks\native\cmds\servicemanager\binder.c
int binder_parse(struct binder_state *bs, struct binder_io *bio,
         uintptr_t ptr, size_t size, binder_handler func)
{
  ...
    case BR_TRANSACTION: {
      ...
				//調(diào)用func函數(shù)
        res = func(bs, txn, &msg, &reply);
        if (txn->flags & TF_ONE_WAY) {
          binder_free_buffer(bs, txn->data.ptr.buffer);
        } else {
        	//發(fā)送協(xié)議指令給Binder驅(qū)動，向Client端發(fā)送reply
          binder_send_reply(bs, &reply, txn->data.ptr.buffer, res);
        }
      ...
  return r;
}

void binder_send_reply(struct binder_state *bs,
            struct binder_io *reply,
            binder_uintptr_t buffer_to_free,
            int status)
{
  struct {
    uint32_t cmd_free;
    binder_uintptr_t buffer;
    uint32_t cmd_reply;
    struct binder_transaction_data txn;
  } __attribute__((packed)) data;

  data.cmd_free = BC_FREE_BUFFER;
  data.buffer = buffer_to_free;
	//返回指令
  data.cmd_reply = BC_REPLY;
  data.txn.target.ptr = 0;
  data.txn.cookie = 0;
  data.txn.code = 0;
  if (status) {
    data.txn.flags = TF_STATUS_CODE;
    data.txn.data_size = sizeof(int);
    data.txn.offsets_size = 0;
    data.txn.data.ptr.buffer = (uintptr_t)&status;
    data.txn.data.ptr.offsets = 0;
  } else {//svcmgr_handler執(zhí)行成功，將reply數(shù)據(jù)組裝到txn中
    data.txn.flags = 0;
    data.txn.data_size = reply->data - reply->data0;
    data.txn.offsets_size = ((char*) reply->offs) - ((char*) reply->offs0);
    data.txn.data.ptr.buffer = (uintptr_t)reply->data0;
    data.txn.data.ptr.offsets = (uintptr_t)reply->offs0;
  }
	//發(fā)送數(shù)據(jù)
  binder_write(bs, &data, sizeof(data));
}