4、Binder线程模型：Binder主线程、Binder线程池、BC_ENTER_LOOPER/BC_EXIT_LOOPER、线程唤醒机制

// frameworks/native/libs/binder/ProcessState.cpp
void ProcessState::startThreadPool() {
    AutoMutex _l(mLock);
    if (!mThreadPoolStarted) {
        mThreadPoolStarted = true;
        spawnPooledThread(true); // true 表示主线程
    }
}

void ProcessState::spawnPooledThread(bool isMain) {
    sp<Thread> t = new PoolThread(isMain);
    t->run("Binder_%d", mThreadPoolSeq++);
}

// PoolThread 的 threadLoop 最终调用 IPCThreadState::joinThreadPool
void IPCThreadState::joinThreadPool(bool isMain) {
    // 发送 BC_ENTER_LOOPER 或 BC_REGISTER_LOOPER
    mOut.writeInt32(isMain ? BC_ENTER_LOOPER : BC_REGISTER_LOOPER);
    // 进入循环
    do {
        processPendingDerefs();
        result = getAndExecuteCommand(); // 阻塞在 ioctl
    } while (result != TIMED_OUT && result != -ECONNREFUSED);
    // 退出时发送 BC_EXIT_LOOPER
    mOut.writeInt32(BC_EXIT_LOOPER);
    talkWithDriver();
}

// kernel/drivers/android/binder.c
static void binder_wakeup_thread(struct binder_proc *proc,
                                 struct binder_thread *thread,
                                 bool sync) {
    // 如果指定了线程，直接唤醒
    if (thread) {
        wake_up_interruptible(&thread->wait);
        return;
    }
    // 否则遍历进程的线程红黑树，找到等待线程
    struct rb_node *n = rb_first(&proc->threads);
    while (n) {
        thread = rb_entry(n, struct binder_thread, rb_node);
        if (thread->looper & BINDER_LOOPER_STATE_WAITING) {
            wake_up_interruptible(&thread->wait);
            break;
        }
        n = rb_next(n);
    }
}