//platform\frameworks\native\cmds\servicemanager\main.cpp

int main(int argc, char** argv) {

    if (argc > 2) {

        LOG(FATAL) << "usage: " << argv[0] << " [binder driver]";

    }

	// 指定 driver 的名称，如果无参数，则使用默认驱动 /dev/binder

    const char* driver = argc == 2 ? argv[1] : "/dev/binder";

	/*

	每一个进程只能有一个 ProcessState 对象，service manager 通过 initWithDriver 方法

	实例化了一个 ProcessState 对象，并打开 binder 设备和进行 mmap 内存映射，这个过程中

	将会同时调用 binder 设备内部的函数 binder_open 和 binder_mmap

	*/

    sp<ProcessState> ps = ProcessState::initWithDriver(driver);

	// 设置可以同时存在的线程池的最大数量为 0, 即此时只能有 ServiceManager 这一个线程存在

    ps->setThreadPoolMaxThreadCount(0);

	// 在阻塞调用时中止进程

	//FATAL_IF_NOT_ONEWAY: ServiceManager 发起的 Binder 调用必须是单向，否则打印堆栈日志提示

    ps->setCallRestriction(ProcessState::CallRestriction::FATAL_IF_NOT_ONEWAY);

	// 实例化 ServiceManager, 初始化参数为 Access 对象的智能指针

    sp<ServiceManager> manager = sp<ServiceManager>::make(std::make_unique<Access>());

	//self register servicemanager,"manager" 将作为 servicemanager 的第一个服务被注册

	if (!manager->addService("manager", manager, false /*allowIsolated*/, IServiceManager::DUMP_FLAG_PRIORITY_DEFAULT).isOk()) {

        LOG(ERROR) << "Could not self register servicemanager";

    }

	// 将 "manager" 服务作为服务端 Bbinder 对象

    IPCThreadState::self()->setTheContextObject(manager);

	// 向 binder 驱动发送 ioctl BINDER_SET_CONTEXT_MGR_EXT 信号，将 servicemanager

	// 在 ProcessState::initWithDriver 中打开驱动设备 /dev/driver 所返回的文件描述符句柄

	// 作为整个 binder IPC 通信中的上下文管理者

    ps->becomeContextManager();

	// 准备 looper

    sp<Looper> looper = Looper::prepare(false /*allowNonCallbacks*/);

	// 监听 BC_ENTER_LOOPER 信号，收到该信号后回调处理 binder 调用

    BinderCallback::setupTo(looper);

	// 监听客户端回调

    ClientCallbackCallback::setupTo(looper, manager);

	// 阻塞等待和处理事件

    while(true) {

        looper->pollAll(-1);

    }

    // should not be reached

    return EXIT_FAILURE;

}

//platform\frameworks\native\libs\binder\ProcessState.cpp

sp<ProcessState> ProcessState::self()

{

    return init(kDefaultDriver, false /*requireDefault*/);

}

sp<ProcessState> ProcessState::initWithDriver(const char* driver)

{

    return init(driver, true /*requireDefault*/);

}

sp<ProcessState> ProcessState::init(const char *driver, bool requireDefault)

{

    [[clang::no_destroy]] static sp<ProcessState> gProcess;

    [[clang::no_destroy]] static std::mutex gProcessMutex;

    if (driver == nullptr) {

        std::lock_guard<std::mutex> l(gProcessMutex);

        return gProcess;

    }

	/*

	这里使用了单例模式的设计思想，通过 std::once_flag 和 std::call_once

	来保证只有一个线程可以进入初始化代码块，

	这保证了在一个线程中只能有一个 ProcessState 实例

	它的工作方式如下

	[-] 第一次调用 std::call_once 时，它会检查与 std::once_flag 关联的标记是否已被设置。

	如果标记尚未设置，它将执行传递给 std::call_once 的可调用对象，

	并设置标记，以标记初始化已完成。

	[-] 如果其他线程尝试再次调用 std::call_once 与相同的 std::once_flag，

	它会发现标记已经设置，因此不会再次执行可调用对象。

	*/

    [[clang::no_destroy]] static std::once_flag gProcessOnce;

    std::call_once(gProcessOnce, [&](){

		// 判断 binder 驱动是否存在

        if (access(driver, R_OK) == -1) {

            ALOGE("Binder driver %s is unavailable. Using /dev/binder instead.", driver);

            driver = "/dev/binder";

        }

        std::lock_guard<std::mutex> l(gProcessMutex);

		// 将 driver 作为参数实例化 ProcessState, 并赋值给 gProcess

        gProcess = sp<ProcessState>::make(driver);

    });

    if (requireDefault) {

        // Detect if we are trying to initialize with a different driver, and

        // consider that an error. ProcessState will only be initialized once above.

        LOG_ALWAYS_FATAL_IF(gProcess->getDriverName() != driver,

                            "ProcessState was already initialized with %s,"

                            " can't initialize with %s.",

                            gProcess->getDriverName().c_str(), driver);

    }

    return gProcess;

}

//platform\frameworks\native\libs\binder\ProcessState.cpp

ProcessState::ProcessState(const char *driver)

    : mDriverName(String8(driver))

    , mDriverFD(open_driver(driver))// 通过系统调用陷入内核，打开 /dev/binder 设备

    , mVMStart(MAP_FAILED)// 映射内存的起始地址

    , mThreadCountLock(PTHREAD_MUTEX_INITIALIZER)

    , mThreadCountDecrement(PTHREAD_COND_INITIALIZER)

    , mExecutingThreadsCount(0)

    , mWaitingForThreads(0)

    , mMaxThreads(DEFAULT_MAX_BINDER_THREADS)

    , mStarvationStartTimeMs(0)

    , mThreadPoolStarted(false)

    , mThreadPoolSeq(1)

    , mCallRestriction(CallRestriction::NONE)

{

    if (mDriverFD >= 0) {

        // mmap the binder, providing a chunk of virtual address space to receive transactions.

        // 调用内存映射函数 mmap, 此时 binder 驱动会在内核空间执行 binder_mmap, 来将一块物理内存同时映射到

        // 用户空间和内核空间，来帮助进行跨进程通信

        // #define BINDER_VM_SIZE ((1 * 1024 * 1024) - sysconf(_SC_PAGE_SIZE) * 2) = 1016KB

        // PAGE_SIZE 被定义为 4096

        mVMStart = mmap(nullptr, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);

        if (mVMStart == MAP_FAILED) {

            // *sigh*

            ALOGE("Using %s failed: unable to mmap transaction memory.\n", mDriverName.c_str());

            close(mDriverFD);

            mDriverFD = -1;

            mDriverName.clear();

        }

    }

#ifdef __ANDROID__

    LOG_ALWAYS_FATAL_IF(mDriverFD < 0, "Binder driver '%s' could not be opened.  Terminating.", driver);

#endif

}

//platform\frameworks\native\libs\binder\ProcessState.cpp

static int open_driver(const char *driver)

{

	// 以读写方式打开，并为该文件描述符添加 close-on-exec (执行时可关闭) 的标志，

	// 来防止该文件描述符被意外泄漏给了 fork 创建出来的子进程

    int fd = open(driver, O_RDWR | O_CLOEXEC);

    if (fd >= 0) {

        int vers = 0;

        status_t result = ioctl(fd, BINDER_VERSION, &vers);

        if (result == -1) {

            ALOGE("Binder ioctl to obtain version failed: %s", strerror(errno));

            close(fd);

            fd = -1;

        }

        if (result != 0 || vers != BINDER_CURRENT_PROTOCOL_VERSION) {

          ALOGE("Binder driver protocol(%d) does not match user space protocol(%d)! ioctl() return value: %d",

                vers, BINDER_CURRENT_PROTOCOL_VERSION, result);

            close(fd);

            fd = -1;

        }

		// 设置这个打开的 binder 对象的最大线程数为 15

        size_t maxThreads = DEFAULT_MAX_BINDER_THREADS;

        result = ioctl(fd, BINDER_SET_MAX_THREADS, &maxThreads);

        if (result == -1) {

            ALOGE("Binder ioctl to set max threads failed: %s", strerror(errno));

        }

        uint32_t enable = DEFAULT_ENABLE_ONEWAY_SPAM_DETECTION;

        result = ioctl(fd, BINDER_ENABLE_ONEWAY_SPAM_DETECTION, &enable);

        if (result == -1) {

            ALOGD("Binder ioctl to enable oneway spam detection failed: %s", strerror(errno));

        }

    } else {

        ALOGW("Opening '%s' failed: %s\n", driver, strerror(errno));

    }

    return fd;

}

// 获取 BpServiceManager 对象

sp<IServiceManager> sm(defaultServiceManager());

//platform\frameworks\native\libs\binder\IServiceManager.cpp

sp<IServiceManager> defaultServiceManager()

{

    std::call_once(gSmOnce, []() {

        sp<AidlServiceManager> sm = nullptr;

        while (sm == nullptr) {

			// 获取 ServiceManager 的 BBinder 所对应的 BpBinder 对象，

			// 并将该对象通过 interface_cast 转换为 AidlServiceManager

            sm = interface_cast<AidlServiceManager>(ProcessState::self()->getContextObject(nullptr));

            if (sm == nullptr) {

                ALOGE("Waiting 1s on context object on %s.", ProcessState::self()->getDriverName().c_str());

                sleep(1);

            }

        }

		// 实例化 ServiceManagerShim

        gDefaultServiceManager = sp<ServiceManagerShim>::make(sm);

    });

    return gDefaultServiceManager;

}

using AidlServiceManager = android::os::IServiceManager;

//platform\frameworks\native\libs\binder\IServiceManager.cpp

// From the old libbinder IServiceManager interface to IServiceManager.

class ServiceManagerShim : public IServiceManager

{

public:

    explicit ServiceManagerShim (const sp<AidlServiceManager>& impl);

    sp<IBinder> getService(const String16& name) const override;

    sp<IBinder> checkService(const String16& name) const override;

    status_t addService(const String16& name, const sp<IBinder>& service,

                        bool allowIsolated, int dumpsysPriority) override;

    Vector<String16> listServices(int dumpsysPriority) override;

    sp<IBinder> waitForService(const String16& name16) override;

    bool isDeclared(const String16& name) override;

    Vector<String16> getDeclaredInstances(const String16& interface) override;

    std::optional<String16> updatableViaApex(const String16& name) override;

    // for legacy ABI

    const String16& getInterfaceDescriptor() const override {

        return mTheRealServiceManager->getInterfaceDescriptor();

    }

    IBinder* onAsBinder() override {

        return IInterface::asBinder(mTheRealServiceManager).get();

    }

private:

    sp<AidlServiceManager> mTheRealServiceManager;

};

//platform\frameworks\native\libs\binder\ProcessState.cpp

sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& /*caller*/)

{

	// 创建一个 BpBinder 对象，getStrongProxyForHandle 传入的参数 handle 的值为 0

	//,0 代表的就是 ServiceManager 所对应的 BBinder。

    sp<IBinder> context = getStrongProxyForHandle(0);

    if (context) {

        // The root object is special since we get it directly from the driver, it is never

        // written by Parcell::writeStrongBinder.

        internal::Stability::markCompilationUnit(context.get());

    } else {

        ALOGW("Not able to get context object on %s.", mDriverName.c_str());

    }

    return context;

}

//platform\frameworks\native\libs\binder\ProcessState.cpp

sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle)

{

    sp<IBinder> result;

    AutoMutex _l(mLock);

	// 根据索引查找对应资源。

    handle_entry* e = lookupHandleLocked(handle);

	// 如果 lookupHandleLocked 发现没有对应的资源项，则会创建一个新的项并返回。

    if (e != nullptr) {

        // We need to create a new BpBinder if there isn't currently one, OR we

        // are unable to acquire a weak reference on this current one.  The

        // attemptIncWeak() is safe because we know the BpBinder destructor will always

        // call expungeHandle(), which acquires the same lock we are holding now.

        // We need to do this because there is a race condition between someone

        // releasing a reference on this BpBinder, and a new reference on its handle

        // arriving from the driver.

        IBinder* b = e->binder;

        if (b == nullptr || !e->refs->attemptIncWeak(this)) {

            if (handle == 0) {

                // Special case for context manager...

                // The context manager is the only object for which we create

                // a BpBinder proxy without already holding a reference.

                // Perform a dummy transaction to ensure the context manager

                // is registered before we create the first local reference

                // to it (which will occur when creating the BpBinder).

                // If a local reference is created for the BpBinder when the

                // context manager is not present, the driver will fail to

                // provide a reference to the context manager, but the

                // driver API does not return status.

                //

                // Note that this is not race-free if the context manager

                // dies while this code runs.

                //

                // TODO: add a driver API to wait for context manager, or

                // stop special casing handle 0 for context manager and add

                // a driver API to get a handle to the context manager with

                // proper reference counting.

                IPCThreadState* ipc = IPCThreadState::self();

                CallRestriction originalCallRestriction = ipc->getCallRestriction();

                ipc->setCallRestriction(CallRestriction::NONE);

                Parcel data;

                status_t status = ipc->transact(

                        0, IBinder::PING_TRANSACTION, data, nullptr, 0);

                ipc->setCallRestriction(originalCallRestriction);

                if (status == DEAD_OBJECT)

                   return nullptr;

            }

			// 创建一个 BpBinder

            sp<BpBinder> b = BpBinder::create(handle);

            e->binder = b.get();

            if (b) e->refs = b->getWeakRefs();

            result = b;

        } else {

            // This little bit of nastyness is to allow us to add a primary

            // reference to the remote proxy when this team doesn't have one

            // but another team is sending the handle to us.

            result.force_set(b);

            e->refs->decWeak(this);

        }

    }

    return result;

}

//platform\frameworks\native\libs\binder\include\binder\IInterface.h

/**

 * If this is a local object and the descriptor matches, this will return the

 * actual local object which is implementing the interface. Otherwise, this will

 * return a proxy to the interface without checking the interface descriptor.

 * This means that subsequent calls may fail with BAD_TYPE.

 */

template<typename INTERFACE>

inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj)

{

    return INTERFACE::asInterface(obj);

}

//platform\frameworks\native\include\binder\IInterface.h

//## 的作用是将前后两个标识符或符号连接在一起，以形成一个单独的标识符或符号。

// 如 #define CONCATENATE (x, y) x##y

// 如果调用 CONCATENATE (a, b)，它将被展开为 ab

#define DECLARE_META_INTERFACE(INTERFACE)                               \

public:                                                                 \

    static const ::android::String16 descriptor;                        \

    static ::android::sp<I##INTERFACE> asInterface(                     \

            const ::android::sp<::android::IBinder>& obj);              \

    virtual const ::android::String16& getInterfaceDescriptor() const;  \

    I##INTERFACE();                                                     \

    virtual ~I##INTERFACE();                                            \

    static bool setDefaultImpl(std::unique_ptr<I##INTERFACE> impl);     \

    static const std::unique_ptr<I##INTERFACE>& getDefaultImpl();       \

private:                                                                \

    static std::unique_ptr<I##INTERFACE> default_impl;                  \

public:                                                                 \

#define IMPLEMENT_META_INTERFACE(INTERFACE, NAME)                       \

    DO_NOT_DIRECTLY_USE_ME_IMPLEMENT_META_INTERFACE(INTERFACE, NAME)    \

#define DO_NOT_DIRECTLY_USE_ME_IMPLEMENT_META_INTERFACE(INTERFACE, NAME)\

    const ::android::StaticString16                                     \

        I##INTERFACE##_descriptor_static_str16(__IINTF_CONCAT(u, NAME));\

    const ::android::String16 I##INTERFACE::descriptor(                 \

        I##INTERFACE##_descriptor_static_str16);                        \

    const ::android::String16&                                          \

            I##INTERFACE::getInterfaceDescriptor() const {              \

        return I##INTERFACE::descriptor;                                \

    }                                                                   \

    ::android::sp<I##INTERFACE> I##INTERFACE::asInterface(              \

            const ::android::sp<::android::IBinder>& obj)               \

    {                                                                   \

        ::android::sp<I##INTERFACE> intr;                               \

        if (obj != nullptr) {                                           \

            intr = ::android::sp<I##INTERFACE>::cast(                   \

                obj->queryLocalInterface(I##INTERFACE::descriptor));    \

            if (intr == nullptr) {                                      \

                intr = ::android::sp<Bp##INTERFACE>::make(obj);         \

            }                                                           \

        }                                                               \

        return intr;                                                    \

    }                                                                   \

    std::unique_ptr<I##INTERFACE> I##INTERFACE::default_impl;           \

    bool I##INTERFACE::setDefaultImpl(std::unique_ptr<I##INTERFACE> impl)\

    {                                                                   \

        /* Only one user of this interface can use this function     */ \

        /* at a time. This is a heuristic to detect if two different */ \

        /* users in the same process use this function.              */ \

        assert(!I##INTERFACE::default_impl);                            \

        if (impl) {                                                     \

            I##INTERFACE::default_impl = std::move(impl);               \

            return true;                                                \

        }                                                               \

        return false;                                                   \

    }                                                                   \

    const std::unique_ptr<I##INTERFACE>& I##INTERFACE::getDefaultImpl() \

    {                                                                   \

        return I##INTERFACE::default_impl;                              \

    }                                                                   \

    I##INTERFACE::I##INTERFACE() { }                                    \

    I##INTERFACE::~I##INTERFACE() { }                                   \

public:

static const ::android::String16 descriptor;

static ::android::sp<IServiceManager> asInterface(

    const ::android::sp<::android::IBinder>& obj);

virtual const ::android::String16& getInterfaceDescriptor() const;

IServiceManager();

virtual ~IServiceManager();

static bool setDefaultImpl(std::unique_ptr<IServiceManager> impl);

static const std::unique_ptr<IServiceManager>& getDefaultImpl();

private:

static std::unique_ptr<IServiceManager> default_impl;

public:

const ::android::StaticString16

    IServiceManager_descriptor_static_str16(__IINTF_CONCAT(u, android.os.IServiceManager));

const ::android::String16 IServiceManager::descriptor(

    IServiceManager_descriptor_static_str16);

const ::android::String16&

    IServiceManager::getInterfaceDescriptor() const {

    return IServiceManager::descriptor;

}

// 在这里终于出现了 asInterface 函数的定义，我们也找到了 BpServiceManager 这个类

::android::sp<IServiceManager> IServiceManager::asInterface(

    const ::android::sp<::android::IBinder>& obj)

{

    ::android::sp<IServiceManager> intr;

    if (obj != nullptr) {

        intr = ::android::sp<IServiceManager>::cast(

            obj->queryLocalInterface(IServiceManager::descriptor));

        if (intr == nullptr) {

            intr = ::android::sp<BpServiceManager>::make(obj);

        }

    }

    return intr;

}

std::unique_ptr<IServiceManager> IServiceManager::default_impl;

bool IServiceManager::setDefaultImpl(std::unique_ptr<IServiceManager> impl)

{

    /* Only one user of this interface can use this function     */

    /* at a time. This is a heuristic to detect if two different */

    /* users in the same process use this function.              */

    assert(!IServiceManager::default_impl);

    if (impl) {

        IServiceManager::default_impl = std::move(impl);

        return true;

    }

    return false;

}

const std::unique_ptr<IServiceManager>& IServiceManager::getDefaultImpl()

{

    return IServiceManager::default_impl;

}

IServiceManager::IServiceManager() { }

IServiceManager::~IServiceManager() { }

//platform\frameworks\av\media\mediaserver\main_mediaserver.cpp

int main(int argc __unused, char **argv __unused)

{

    signal(SIGPIPE, SIG_IGN);

	// 创建一个 ProcessState 实例，打开默认驱动 /dev/binder 并进行 mmap 内存映射

	// 此方法的详细分析请参见右侧目录 ServiceManager 的启动过程 ->ProcessState::init

    sp<ProcessState> proc(ProcessState::self());

	// 客户端获取 ServiceManagerShim 对象

	// 此方法的详细分析请参见右侧目录 ServiceManager 的获取过程

    sp<IServiceManager> sm(defaultServiceManager());

    ALOGI("ServiceManager: %p", sm.get());

	// 注册 media.player 服务

    MediaPlayerService::instantiate();

    ResourceManagerService::instantiate();

    registerExtensions();

    ::android::hardware::configureRpcThreadpool(16, false);

	// 启动线程池

    ProcessState::self()->startThreadPool();

	// 将线程加入线程池

    IPCThreadState::self()->joinThreadPool();

    ::android::hardware::joinRpcThreadpool();

}

//platform\frameworks\av\media\libmediaplayerservice\MediaPlayerService.cpp

void MediaPlayerService::instantiate() {

    defaultServiceManager()->addService(

        String16("media.player"), new MediaPlayerService());

}

//platform\frameworks\native\libs\binder\IServiceManager.cpp

status_t ServiceManagerShim::addService(const String16& name, const sp<IBinder>& service,

                                        bool allowIsolated, int dumpsysPriority)

{

    Status status = mTheRealServiceManager->addService(

        String8(name).c_str(), service, allowIsolated, dumpsysPriority);

    return status.exceptionCode();

}

//platform\frameworks\native\libs\binder\IServiceManager.cpp

using AidlServiceManager = android::os::IServiceManager;

// From the old libbinder IServiceManager interface to IServiceManager.

class ServiceManagerShim : public IServiceManager

{

public:

    ...

private:

    sp<AidlServiceManager> mTheRealServiceManager;

};

ServiceManagerShim::ServiceManagerShim(const sp<AidlServiceManager>& impl)

 : mTheRealServiceManager(impl)

{}

//platform\frameworks\native\libs\binder\IServiceManager.cpp

sp<IServiceManager> defaultServiceManager()

{

    std::call_once(gSmOnce, []() {

        sp<AidlServiceManager> sm = nullptr;

        while (sm == nullptr) {

			// 获取 ServiceManager 的 BBinder 所对应的 BpBinder 对象，

			// 并将该对象通过 interface_cast 转换为 AidlServiceManager

            sm = interface_cast<AidlServiceManager>(ProcessState::self()->getContextObject(nullptr));

            if (sm == nullptr) {

                ALOGE("Waiting 1s on context object on %s.", ProcessState::self()->getDriverName().c_str());

                sleep(1);

            }

        }

		// 实例化 ServiceManagerShim

        gDefaultServiceManager = sp<ServiceManagerShim>::make(sm);

    });

    return gDefaultServiceManager;

}

//platform/out/soong/.intermediates/frameworks/native/libs/binder/libbinder/android_arm_armv8-a_shared/gen/aidl/android/os/IServiceManager.cpp

namespace android {

namespace os {

BpServiceManager::BpServiceManager(const ::android::sp<::android::IBinder>& _aidl_impl)

    : BpInterface<IServiceManager>(_aidl_impl){//_aidl_impl 就是 BpBinder (0) 实例

}

--------------------------------------------------

    ::android::binder::Status BpServiceManager::addService(const ::std::string& name, const ::android::sp<::android::IBinder>& service, bool allowIsolated, int32_t dumpPriority) {

  ::android::Parcel _aidl_data;

  _aidl_data.markForBinder(remoteStrong());//0、和 Rpc Binder 有关

  ::android::Parcel _aidl_reply;

  ::android::status_t _aidl_ret_status = ::android::OK;

  ::android::binder::Status _aidl_status;

  //1、写 interface

  _aidl_ret_status = _aidl_data.writeInterfaceToken(getInterfaceDescriptor());

  if (((_aidl_ret_status) != (::android::OK))) {