当进程注册服务（addService）和获取服务（getService）时，都需要先调用defaultServiceManager()方法来获取ServiceManager服务
//资源路径：/frameworks/native/libs/binder/IServiceManager.cpp
sp<IServiceManager> defaultServiceManager()
{
//单例模式，不为空直接返回
if (gDefaultServiceManager != NULL) return gDefaultServiceManager;
{
AutoMutex _l(gDefaultServiceManagerLock);
//当尝试获取SM时，SM可能为准备就绪，这时通过sleep 1秒后，循环尝试获取直到成功
while (gDefaultServiceManager == NULL) {
//SM的创建过程，可以分为3个步骤
gDefaultServiceManager = interface_cast<IServiceManager>(
ProcessState::self()->getContextObject(NULL));
if (gDefaultServiceManager == NULL)
sleep(1);
}
}
return gDefaultServiceManager;
}
①ProcessState::self() 获取ProcessState对象
1）打开驱动；2）设置线程最大数15；3）mmap，分配大小为1M-8k内存地址空间
//资源路径：/frameworks/native/libs/binder/ProcessState.cpp
sp<ProcessState> ProcessState::self()
{
//单例模式，不为空直接返回
if (gProcess != NULL) {
return gProcess;
}
//实例化ProcessState
gProcess = new ProcessState;
return gProcess;
}
#define BINDER_VM_SIZE ((1*1024*1024) - (4096 *2))
#define DEFAULT_MAX_BINDER_THREADS 15
ProcessState::ProcessState()
: mDriverFD(open_driver())
{
// mmap the binder, providing a chunk of virtual address space to receive transactions.
//通过内存映射，给binder分配一块大小为（1M-8k）的虚拟地址空间，用来接收事务
mVMStart = mmap(0, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
}
static int open_driver()
{
//打开/dev/binder设备，建立与内核的Binder驱动的交互通道
int fd = open("/dev/binder", O_RDWR);
//设置最大能支持的线程数为15
size_t maxThreads = DEFAULT_MAX_BINDER_THREADS;
//通过ioctl设置binder驱动能支持的最大线程数
result = ioctl(fd, BINDER_SET_MAX_THREADS, &maxThreads);
}
②ProcessState::getContextObject 创建BpBinder对象
1）创建一个BpBinder（SM的代理对象）
//资源路径：/frameworks/native/libs/binder/ProcessState.cpp
sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& /*caller*/)
{
//参数为0，获取SM服务
return getStrongProxyForHandle(0);
}
sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle)
{
//查找handle对应的资源项
handle_entry* e = lookupHandleLocked(handle);
if (b == NULL || !e->refs->attemptIncWeak(this)) {
if (handle == 0) {
//handle为0时，通过PING_TRANSACTION看SM进程是否能访问(ping操作测试binder是否准备就绪)
status_t status = IPCThreadState::self()->transact(
0, IBinder::PING_TRANSACTION, data, NULL, 0);
}
//当handle值对应的IBinder不存在或弱引用无效时，创建BpBinder对象
b = new BpBinder(handle);
}
}
③interface_cast 获取BpServiceManager
//资源路径：/frameworks/native/include/binder/IInterface.h
template<typename INTERFACE>
inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj)
{
//泛型，等价于 IServiceManager::asInterface
//IServiceManager中找不到asInterface函数，是通过模板函数来定义的
return INTERFACE::asInterface(obj);
}
//资源路径：/frameworks/native/include/binder/IServiceManager.h
IMPLEMENT_META_INTERFACE(ServiceManager, "android.os.IServiceManager");
//资源路径：/frameworks/native/include/binder/IInterface.h
//INTERFACE替换成ServiceManager，NAME替换成"android.os.IServiceManager"
#define IMPLEMENT_META_INTERFACE(INTERFACE, NAME)
const android::String16 I##INTERFACE::descriptor(NAME);
const android::String16&
I##INTERFACE::getInterfaceDescriptor() const {
return I##INTERFACE::descriptor;
}
android::sp<I##INTERFACE> I##INTERFACE::asInterface(
//obj是传来的BpBinder
const android::sp<android::IBinder>& obj)
{
android::sp<I##INTERFACE> intr;
if (obj != NULL) {
intr = static_cast<I##INTERFACE*>(
obj->queryLocalInterface(
I##INTERFACE::descriptor).get());
if (intr == NULL) {
//等价于new BpServiceManager(BpBinder)
intr = new Bp##INTERFACE(obj);
}
}
return intr;
}
I##INTERFACE::I##INTERFACE() { }
I##INTERFACE::~I##INTERFACE() { }
BpServiceManager
//资源路径：/frameworks/native/libs/binder/IServiceManager.cpp
class BpServiceManager : public BpInterface<IServiceManager>
{
public:
BpServiceManager(const sp<IBinder>& impl)
: BpInterface<IServiceManager>(impl)
}
//资源路径：/frameworks/native/include/binder/IInterface.h
template<typename INTERFACE>
inline BpInterface<INTERFACE>::BpInterface(const sp<IBinder>& remote)
: BpRefBase(remote)
//资源路径：/frameworks/native/libs/binder/Binder.cpp
//mRemote指向new BpBinder(0),从而BpServiceManager能够利用Binder进行通信
BpRefBase::BpRefBase(const sp<IBinder>& o)
: mRemote(o.get()), mRefs(NULL), mState(0)
获取ServiceManager服务 => defaultServiceManager => new BpServiceManager(new BpBinder(0))
BpServiceManager为客户端代理对象，封装服务要用的接口和方法
BpBinder为ServiceManager代理对象，具有跨进程的能力
