AMS如何注册到SM中（以下是源码中调用流程，需结合源码查看）

    public static void main(String[] args) {
        new SystemServer().run();
    }
    run()
      startBootstrapServices()
        //对mActivityManagerService 赋值
        mActivityManagerService = ActivityManagerService.Lifecycle.startService(
                mSystemServiceManager, atm);//SystemServiceManager中的方法，获取AMS
          mServices.add(service) service== ActivityManagerService
          service.onStart()
            mService.start() //mService== ActivityManagerService
      
        mActivityManagerService.setSystemProcess();
          ServiceManager.addService(Context.ACTIVITY_SERVICE, this, true,
                    DUMP_FLAG_PRIORITY_CRITICAL | DUMP_FLAG_PRIORITY_NORMAL | DUMP_FLAG_PROTO);//将服务添加到SM中去
            getIServiceManager().addService(name, service, allowIsolated, dumpPriority);//getIServiceManager（）==ServiceManagerProxy
              data.writeStrongBinder(service)//service==AMS 将AMS放入data中
                会调用android_os_Parcel.cpp
                  Parcel.cpp的writeStrongBinder

              mRemote.transact() //mRemote ==BinderProxy
                transactNative()---android_os_BinderProxy_transact()
                  IBinder* target = (IBinder*)//获取到BpBinder
                    BpBinder::transact()
                      IPCThreadState::transact()*
                        IPCThreadState::writeTransactionData()
                        
                        IPCThreadState::waitForResponse()
                          IPCThreadState::talkWithDriver()//这里是一个循环调用
                            ioctl(BINDER_WRITE_READ)
                              binder_transact()//唤醒sm，挂起client，这里完成一次拷贝
                                binder_thread_read()
                          IPCThreadState::talkWithDriver()再次调用
                            
                            

getIServiceManager()//返回一个new ServiceManagerProxy(返回BinderProxy对象)
  ServiceManagerNative.asInterface(BinderInternal.getContextObject())

ServiceManagerNative.asInterface()
  new ServiceManagerProxy(返回BinderProxy对象)

BinderInternal.getContextObject() //返回BinderProxy对象
  android_os_BinderInternal_getContextObject()
    ProcessState::self()->getContextObject(NULL)//创建一个BpBinder
    return javaObjectForIBinder  //BinderProxy和BpBinder互相绑定
      

SM唤醒之后

binder_parse
  res=func(bs,txn,) //func==svcsgr_handle 
    do_add_service()
      find_svc() //获取添加所有服务
  binder_send_reply()
    binder_write()
     binder_thread_write()
      binder_transaction()//唤醒client，挂起sm
        wake_up_interruptible()
          IPCThreadState::executeCommand   //case : BR_TRANSACTION
            BBinder.transact()
              onTransact()//cpp中 
                Binder.execTransact//java

image.png

image.png