當(dāng)進(jìn)程注冊(cè)服務(wù)（addService）和獲取服務(wù)（getService）時(shí)，都需要先調(diào)用defaultServiceManager()方法來(lái)獲取ServiceManager服務(wù)

//資源路徑：/frameworks/native/libs/binder/IServiceManager.cpp
sp<IServiceManager> defaultServiceManager()
{
  //單例模式，不為空直接返回
  if (gDefaultServiceManager != NULL) return gDefaultServiceManager;
  {
    AutoMutex _l(gDefaultServiceManagerLock);
    //當(dāng)嘗試獲取SM時(shí)，SM可能為準(zhǔn)備就緒，這時(shí)通過(guò)sleep 1秒后，循環(huán)嘗試獲取直到成功
    while (gDefaultServiceManager == NULL) {
      //SM的創(chuàng)建過(guò)程，可以分為3個(gè)步驟
      gDefaultServiceManager = interface_cast<IServiceManager>(
        ProcessState::self()->getContextObject(NULL));
      if (gDefaultServiceManager == NULL)
        sleep(1);
    }
  }
  return gDefaultServiceManager;
}

①ProcessState::self() 獲取ProcessState對(duì)象

1）打開(kāi)驅(qū)動(dòng)；2）設(shè)置線程最大數(shù)15；3）mmap，分配大小為1M-8k內(nèi)存地址空間

//資源路徑：/frameworks/native/libs/binder/ProcessState.cpp
sp<ProcessState> ProcessState::self()
{
  //單例模式，不為空直接返回
  if (gProcess != NULL) {
    return gProcess;
  }
  //實(shí)例化ProcessState
  gProcess = new ProcessState;
  return gProcess;
}

#define BINDER_VM_SIZE ((1*1024*1024) - (4096 *2))
#define DEFAULT_MAX_BINDER_THREADS 15

ProcessState::ProcessState()
  : mDriverFD(open_driver())
{
    // mmap the binder, providing a chunk of virtual address space to receive transactions.
    //通過(guò)內(nèi)存映射，給binder分配一塊大小為（1M-8k）的虛擬地址空間，用來(lái)接收事務(wù)
    mVMStart = mmap(0, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
}

static int open_driver()
{
  //打開(kāi)/dev/binder設(shè)備，建立與內(nèi)核的Binder驅(qū)動(dòng)的交互通道
  int fd = open("/dev/binder", O_RDWR);
  //設(shè)置最大能支持的線程數(shù)為15
  size_t maxThreads = DEFAULT_MAX_BINDER_THREADS;
  //通過(guò)ioctl設(shè)置binder驅(qū)動(dòng)能支持的最大線程數(shù)
  result = ioctl(fd, BINDER_SET_MAX_THREADS, &maxThreads);
}

②ProcessState::getContextObject 創(chuàng)建BpBinder對(duì)象

1）創(chuàng)建一個(gè)BpBinder（SM的代理對(duì)象）

//資源路徑：/frameworks/native/libs/binder/ProcessState.cpp
sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& /*caller*/)
{
  //參數(shù)為0，獲取SM服務(wù)
  return getStrongProxyForHandle(0);
}

sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle)
{
  //查找handle對(duì)應(yīng)的資源項(xiàng)
  handle_entry* e = lookupHandleLocked(handle);
  if (b == NULL || !e->refs->attemptIncWeak(this)) {
    if (handle == 0) {
      //handle為0時(shí)，通過(guò)PING_TRANSACTION看SM進(jìn)程是否能訪問(wèn)(ping操作測(cè)試binder是否準(zhǔn)備就緒)
      status_t status = IPCThreadState::self()->transact(
                        0, IBinder::PING_TRANSACTION, data, NULL, 0);
    }
    //當(dāng)handle值對(duì)應(yīng)的IBinder不存在或弱引用無(wú)效時(shí)，創(chuàng)建BpBinder對(duì)象
    b = new BpBinder(handle);
  }
}

③interface_cast 獲取BpServiceManager

//資源路徑：/frameworks/native/include/binder/IInterface.h
template<typename INTERFACE>
inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj)
{
  //泛型，等價(jià)于 IServiceManager::asInterface
  //IServiceManager中找不到asInterface函數(shù)，是通過(guò)模板函數(shù)來(lái)定義的
  return INTERFACE::asInterface(obj);
}

//資源路徑：/frameworks/native/include/binder/IServiceManager.h
IMPLEMENT_META_INTERFACE(ServiceManager, "android.os.IServiceManager");

//資源路徑：/frameworks/native/include/binder/IInterface.h
//INTERFACE替換成ServiceManager，NAME替換成"android.os.IServiceManager"
#define IMPLEMENT_META_INTERFACE(INTERFACE, NAME)                       
    const android::String16 I##INTERFACE::descriptor(NAME);             
    const android::String16&                                            
            I##INTERFACE::getInterfaceDescriptor() const {              
        return I##INTERFACE::descriptor;                               
    }                                                                   
    android::sp<I##INTERFACE> I##INTERFACE::asInterface(   
                //obj是傳來(lái)的BpBinder
            const android::sp<android::IBinder>& obj)                   
    {                                                                   
        android::sp<I##INTERFACE> intr;                                 
        if (obj != NULL) {                                              
            intr = static_cast<I##INTERFACE*>(                          
                obj->queryLocalInterface(                               
                        I##INTERFACE::descriptor).get());               
            if (intr == NULL) {     
                //等價(jià)于new BpServiceManager(BpBinder)
                intr = new Bp##INTERFACE(obj);                          
            }                                                           
        }                                                               
        return intr;                                                    
    }                                                                   
    I##INTERFACE::I##INTERFACE() { }                                    
    I##INTERFACE::~I##INTERFACE() { }

BpServiceManager

//資源路徑：/frameworks/native/libs/binder/IServiceManager.cpp
class BpServiceManager : public BpInterface<IServiceManager>
{
  public:
    BpServiceManager(const sp<IBinder>& impl)
        : BpInterface<IServiceManager>(impl)
}

//資源路徑：/frameworks/native/include/binder/IInterface.h
template<typename INTERFACE>
inline BpInterface<INTERFACE>::BpInterface(const sp<IBinder>& remote)
    : BpRefBase(remote)

//資源路徑：/frameworks/native/libs/binder/Binder.cpp
//mRemote指向new BpBinder(0),從而B(niǎo)pServiceManager能夠利用Binder進(jìn)行通信
BpRefBase::BpRefBase(const sp<IBinder>& o)
   : mRemote(o.get()), mRefs(NULL), mState(0)

獲取ServiceManager服務(wù) => defaultServiceManager => new BpServiceManager(new BpBinder(0))
BpServiceManager為客戶端代理對(duì)象，封裝服務(wù)要用的接口和方法
BpBinder為ServiceManager代理對(duì)象，具有跨進(jìn)程的能力