启动ServiceManager流程

init.rc
service servicemanager /system/bin/servicemanager

启动service_manager.c

main()
  binder_open(128*1024)//设置大小128k
  binder_become_context_manager()
  binder_loop()

binder_become_context_manager

设置SM为管家

ioctl(bs,BINDER_SET_CONTEXT_MGR)
binder_ioctl_set_ctx_mgr(struct file *flip)
//1.创建binder_node结构体对象
//2.proc->binder_node
//3.创建work和todo队列
binder_new_node(proc,0,0)

binder_loop()

循环监听

//写入状态loop
binder_write(bs,readbuf,sizeof(uint32_t))
  ioctl(BINDER_WRITE_READ)
    binder_ioctl_write_read()
      binder_thread_write() 
      binder_thread_read()
//读取数据，进入等待
for(;;){
  ioctl(bs->fd,BINDER_WRITE_READ,&bwr)
    binder_ioctl_write_read()
}

注册服务到ServiceManager

IServiceManager.cpp

sp<IServiceManager> defaultServiceManager()
  ProcessState::self()->getContextObject(NULL)
    ProcessState::self()
      open_driver()//打开驱动
        ioctl(fd,BINDER_SET_MAX_THREADS,15)//设置最大线程数
      mmap(1*1024*1024-2*4096)//设置内存映射  普通服务大小1M-8k
    getContextObject(NULL)
      b = new BpBinder(handle)//客户端的对象
  interface_cast<IServiceManager>
    asinterface 
      intr = new BpServiceManager(obj)  //obj 就是BpBinder
        remote.transact//远程调用   remote==BpBinder