分析Java层的ServiceManager，看看Binder在Java层是如何实现的。
public final class ServiceManager {
private static final String TAG = "ServiceManager";
private static IServiceManager sServiceManager;//IserviceManager是一个接口，定义了通用（公共）方法。
private static HashMap<String, IBinder> sCache = new HashMap<String, IBinder>();//缓存，其值是IBinder
...
public static IBinder getService(String name) {
try {
IBinder service = sCache.get(name);//先从缓存中查找
if (service != null) {
return service;
} else {
return getIServiceManager().getService(name);//生成新的IBinder
}
} catch (RemoteException e) {
Log.e(TAG, "error in getService", e);
}
return null;
}...
这里的ServiceManager仅仅是一种封装，其成员变量和方法都是static。从上面的sCache保存的键值对和getService的返回值类型为IBinder（与C++层的IBinder不同）可以看出，通过ServiceManager得到的是一个IBinder类型对象，通过后面的分析，实际可以看出它是BpBinder对象。
private static IServiceManager getIServiceManager() {
if (sServiceManager != null) {
return sServiceManager;
}
// Find the service manager
sServiceManager = ServiceManagerNative.asInterface(BinderInternal.getContextObject());//找到IServiceManager对象，并返回
return sServiceManager;
}
...
/**
* Return the global "context object" of the system. This is usually
* an implementation of IServiceManager, which you can use to find
* other services.
*/
public static final native IBinder getContextObject();//BinderInternale:调用native函数，返回IBinder对象
...
static public IServiceManager asInterface(IBinder obj)//传入的就是上面的那个IBinder对象，记住这是Java对象
{
if (obj == null) {
return null;
}
IServiceManager in =
(IServiceManager)obj.queryLocalInterface(descriptor);//从IBinder对象里查找，并转换为IServiceManager对象
if (in != null) {
return in;
}
return new ServiceManagerProxy(obj);//如果找不到，则使用传入的IBinder对象生成一个ServiceManagePorxy对象
}
上面绕了一圈，直接从ServiceManagerProxy来看，有两方面：1，得到native层的一个某对象，并转换为IBinder，即上面的native IBinder getContextObject()；2，使用获得的IBinder来生成一个ServiceManagerProxy对象。下面来看看ServiceManagerProxy的构造方法：
public ServiceManagerProxy(IBinder remote) {
mRemote = remote;//mRemote是IBinder类型，这里将传入的IBinder对象保存在mRemote
}
public IBinder getService(String name) throws RemoteException {
Parcel data = Parcel.obtain();
Parcel reply = Parcel.obtain();
data.writeInterfaceToken(IServiceManager.descriptor);
data.writeString(name);
mRemote.transact(GET_SERVICE_TRANSACTION, data, reply, 0);//最后使用IBinder的transact来传送数据
IBinder binder = reply.readStrongBinder();
reply.recycle();
data.recycle();
return binder;
}
小结：调用ServiceManager的getService()，会生成一个ServiceManagerProxy对象，该对象持有一个mRemote(IBinder)，通过该mRemote（它是BpBinder在Java层的代表）可以向下层发送数据。
getContextObject分析：
public static final native IBinder getContextObject();//BinderInternale:调用native函数，返回IBinder对象——对应为下面这个函数：
static jobject android_os_BinderInternal_getContextObject(JNIEnv* env, jobject clazz)
{
sp<IBinder> b = ProcessState::self()->getContextObject(NULL);//走到这里：b为一个BpBinder
return javaObjectForIBinder(env, b);//返回一个Java层的BinderProxy
到这里明白了，上面的mRemote持有的就是BinderProxy对象。而上面调用mRemote对象的transact()方法就是调用BinderProxy的transact方法：
public native boolean transact(int code, Parcel data, Parcel reply,
int flags) throws RemoteException;
...
static jboolean android_os_BinderProxy_transact(JNIEnv* env, jobject obj,
jint code, jobject dataObj, jobject replyObj, jint flags) // throws RemoteException
{
if (dataObj == NULL) {
jniThrowNullPointerException(env, NULL);
return JNI_FALSE;
}
Parcel* data = parcelForJavaObject(env, dataObj);
if (data == NULL) {
return JNI_FALSE;
}
Parcel* reply = parcelForJavaObject(env, replyObj);
if (reply == NULL && replyObj != NULL) {
return JNI_FALSE;
}
IBinder* target = (IBinder*)//将BinderProxy转换为BpBinder
env->GetIntField(obj, gBinderProxyOffsets.mObject);... status_t err = target->transact(code, *data, reply, flags);//调用BpBinder来与更下层通信
...
走到这里：Java层主要就是获取Native层的BpBinder，并使用它来与下层通信。