App启动的时候，是通过zygote进行fork后调用ZygoteInit.nativeZygoteInit()
android_12.0.0_r28/frameworks/base/core/java/com/android/internal/os/ZygoteInit.java
public static Runnable zygoteInit(int targetSdkVersion, long[] disabledCompatChanges,
String[] argv, ClassLoader classLoader) {
//省略一堆代码...;
//ZygoteInit.nativeZygoteInit()
ZygoteInit.nativeZygoteInit();
return RuntimeInit.applicationInit(targetSdkVersion, disabledCompatChanges, argv,
classLoader);
}
//省略一堆代码...
private static native void nativeZygoteInit();
nativeZygoteInit()是一个native方法，它的实现在AndroidRuntime里面，最后调到app_main.cpp的onZygoteInit，来启动binder线程池。
android_12.0.0_r28/frameworks/base/cmds/app_process/app_main.cpp
virtual void onZygoteInit()
{
//1、分析ProcessState的构造方法
sp<ProcessState> proc = ProcessState::self();
ALOGV("App process: starting thread pool.\n");
//2、调用ProcessState的方法startThreadPool
proc->startThreadPool();
}
android_12.0.0_r28/frameworks/native/libs/binder/ProcessState.cpp
//android 的sysconf(_SC_PAGE_SIZE)一般是4096（即4K），所以BINDER_VM_SIZE实际就是（1MB-8KB）
#define BINDER_VM_SIZE ((1 * 1024 * 1024) - sysconf(_SC_PAGE_SIZE) * 2)
const char* kDefaultDriver = "/dev/binder";
//省略一堆代码...
sp<ProcessState> ProcessState::self()
{
return init(kDefaultDriver, false /*requireDefault*/);
}
//省略一堆代码...
sp<ProcessState> ProcessState::init(const char *driver, bool requireDefault)
{
//省略一堆代码...
[[clang::no_destroy]] static std::once_flag gProcessOnce;
//std::call_once只执行一次的代码
std::call_once(gProcessOnce, [&](){
if (access(driver, R_OK) == -1) {
ALOGE("Binder driver %s is unavailable. Using /dev/binder instead.", driver);
driver = "/dev/binder";
}
std::lock_guard<std::mutex> l(gProcessMutex);
//1、make是智能指针sp模板类的一个方法，该方法会调用ProcessState的构造方法
gProcess = sp<ProcessState>::make(driver);
});
//省略一堆代码...
return gProcess;
}
//省略一堆代码...
ProcessState::ProcessState(const char *driver)
: mDriverName(String8(driver))
, mDriverFD(open_driver(driver))//2、关键：打开binder驱动
, mVMStart(MAP_FAILED)
, mThreadCountLock(PTHREAD_MUTEX_INITIALIZER)
, mThreadCountDecrement(PTHREAD_COND_INITIALIZER)
, mExecutingThreadsCount(0)
, mWaitingForThreads(0)
, mMaxThreads(DEFAULT_MAX_BINDER_THREADS)
, mStarvationStartTimeMs(0)
, mThreadPoolStarted(false)
, mThreadPoolSeq(1)
, mCallRestriction(CallRestriction::NONE)
{
if (mDriverFD >= 0) {
// mmap the binder, providing a chunk of virtual address space to receive transactions.
//3、通过mmap，向驱动申一块虚拟地址空间来接收事务，大小为BINDER_VM_SIZE = (1MB-8KB);
mVMStart = mmap(nullptr, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
//省略一堆注释...
}
static int open_driver(const char *driver)
{
//打开binder驱动，获取相对应的fd返回
int fd = open(driver, O_RDWR | O_CLOEXEC);
if (fd >= 0) {
int vers = 0;
//通过ioctl获取binder的版本号
status_t result = ioctl(fd, BINDER_VERSION, &vers);
if (result == -1) {
ALOGE("Binder ioctl to obtain version failed: %s", strerror(errno));
close(fd);
fd = -1;
}
if (result != 0 || vers != BINDER_CURRENT_PROTOCOL_VERSION) {
ALOGE("Binder driver protocol(%d) does not match user space protocol(%d)! ioctl() return value: %d",
vers, BINDER_CURRENT_PROTOCOL_VERSION, result);
close(fd);
fd = -1;
}
size_t maxThreads = DEFAULT_MAX_BINDER_THREADS;
//通过ioctl设置binder的最大线程数
result = ioctl(fd, BINDER_SET_MAX_THREADS, &maxThreads);
if (result == -1) {
ALOGE("Binder ioctl to set max threads failed: %s", strerror(errno));
}
//通过ioctl设置binder的单身spam方向
uint32_t enable = DEFAULT_ENABLE_ONEWAY_SPAM_DETECTION;
result = ioctl(fd, BINDER_ENABLE_ONEWAY_SPAM_DETECTION, &enable);
if (result == -1) {
ALOGD("Binder ioctl to enable oneway spam detection failed: %s", strerror(errno));
}
} else {
ALOGW("Opening '%s' failed: %s\n", driver, strerror(errno));
}
return fd;
}
ProcessState构造方法主要做了两件事：
- 打开了
binder驱动，设置或者获取一些相关信息 - 通过
mmap，向驱动申一块虚拟地址空间(大小为(1MB-8KB))来接收事务
android_12.0.0_r28/frameworks/native/libs/binder/ProcessState.cpp
void ProcessState::startThreadPool()
{
AutoMutex _l(mLock);
if (!mThreadPoolStarted) {
mThreadPoolStarted = true;
//1、调用spawnPooledThread方法
spawnPooledThread(true);
}
}
//省略一堆代码...
void ProcessState::spawnPooledThread(bool isMain)
{
if (mThreadPoolStarted) {
//为下面启动binder线程时，创建个binder名字
String8 name = makeBinderThreadName();
ALOGV("Spawning new pooled thread, name=%s\n", name.string());
sp<Thread> t = sp<PoolThread>::make(isMain);
//2、启动PoolThread线程
t->run(name.string());
//省略一堆代码...
}
}
class PoolThread : public Thread
{
public:
explicit PoolThread(bool isMain)
: mIsMain(isMain)
{
}
protected:
virtual bool threadLoop()
{
//3、PoolThread线程循环执行方法，启动IPCThreadState的joinThreadPool，这个方法会开启一个do while循环
// threadLoop()的返回false代表只执行一次。
IPCThreadState::self()->joinThreadPool(mIsMain);
return false;
}
const bool mIsMain;
};
android_12.0.0_r28/frameworks/native/libs/binder/IPCThreadState.cpp
首先看一下它的self()静态方法
static std::atomic<bool> gHaveTLS(false);
static pthread_key_t gTLS = 0;
static std::atomic<bool> gShutdown = false;
static std::atomic<bool> gDisableBackgroundScheduling = false;
IPCThreadState* IPCThreadState::self()
{
// 1.1、第一次进来gHaveTLS为false
if (gHaveTLS.load(std::memory_order_acquire)) {
restart:
const pthread_key_t k = gTLS;
// 1.5、 第一次进入时，应该没有pthread_setspecific,所以pthread_getspecific时，st为空
IPCThreadState* st = (IPCThreadState*)pthread_getspecific(k);
if (st) return st;
// 1.6 、创建IPCThreadState对象，再看它的构造方法(1.7分析)
return new IPCThreadState;
}
//...省略一堆代码
pthread_mutex_lock(&gTLSMutex);
if (!gHaveTLS.load(std::memory_order_relaxed)) {
//1.2、当前线程创建一个线程私有数据的键，并设置它的线程退出时回调的释放函数threadDestructor
int key_create_value = pthread_key_create(&gTLS, threadDestructor);
//...省略一堆代码
// 1.3、当成功创建线程私有数据的键后，把gHaveTLS设置为true
gHaveTLS.store(true, std::memory_order_release);
}
pthread_mutex_unlock(&gTLSMutex);
goto restart;// 1.4、进入上面restart代码块（1.5分析）
}
//省略一堆代码...
//构造方法
IPCThreadState::IPCThreadState()
: mProcess(ProcessState::self()),
mServingStackPointer(nullptr),
mWorkSource(kUnsetWorkSource),
mPropagateWorkSource(false),
mIsLooper(false),
mIsFlushing(false),
mStrictModePolicy(0),
mLastTransactionBinderFlags(0),
mCallRestriction(mProcess->mCallRestriction) {
// 1.7 、为当前线程设置线程私有数据this，即IPCThreadState，将当下次进入1.5时，可直接返回IPCThreadStatec引用
pthread_setspecific(gTLS, this);
clearCaller();
mIn.setDataCapacity(256);
mOut.setDataCapacity(256);
}
//省略一堆代码...
//线程退出时回调的释放函数threadDestructor
void IPCThreadState::threadDestructor(void *st)
{
IPCThreadState* const self = static_cast<IPCThreadState*>(st);
if (self) {
// 清空命令
self->flushCommands();
#if defined(__ANDROID__)
if (self->mProcess->mDriverFD >= 0) {
//通过ioctl通知binder驱动线程退出
ioctl(self->mProcess->mDriverFD, BINDER_THREAD_EXIT, 0);
}
#endif
delete self;
}
}
再看它的joinThreadPool()
void IPCThreadState::joinThreadPool(bool isMain)
{
LOG_THREADPOOL("**** THREAD %p (PID %d) IS JOINING THE THREAD POOL\n", (void*)pthread_self(), getpid());
mOut.writeInt32(isMain ? BC_ENTER_LOOPER : BC_REGISTER_LOOPER);
mIsLooper = true;
status_t result;
do {
processPendingDerefs();
// now get the next command to be processed, waiting if necessary
// 在循环中不断的读取命令数据，然后解析命令数据，并给出相应的响应。
result = getAndExecuteCommand();
if (result < NO_ERROR && result != TIMED_OUT && result != -ECONNREFUSED && result != -EBADF) {
LOG_ALWAYS_FATAL("getAndExecuteCommand(fd=%d) returned unexpected error %d, aborting",
mProcess->mDriverFD, result);
}
// Let this thread exit the thread pool if it is no longer
// needed and it is not the main process thread.
if(result == TIMED_OUT && !isMain) {
break;
}
} while (result != -ECONNREFUSED && result != -EBADF);
LOG_THREADPOOL("**** THREAD %p (PID %d) IS LEAVING THE THREAD POOL err=%d\n",
(void*)pthread_self(), getpid(), result);
mOut.writeInt32(BC_EXIT_LOOPER);
mIsLooper = false;
talkWithDriver(false);
}