binder 进程间通讯关于handle一点疑问？（自己已经弄明白了一点）

疑问的提出：

每个服务通过调用ServiceManger的接口addService会将自己的名字和handle加入到servcemanger进程的svrlist列表里，但是这个handle是怎么来的呢？？？
我只知道servcemanger是固定死了是0，其他的服务呢？


以CameraService为例

mediaserver启动,创建Camera服务端
CameraService::instantiate();
         --> defaultServiceManager()->addService("media.camera",new CamraService)
                --> IServiceManger::addService
                     {
                             Parcel data
                             data.writeString16("android.os.IServiceManger");
                             data.writeString16(name);
                             data.writeStrongBinder(service);
                                       -->flatten_binder(ProcessState::self(), service, this); //就在这个函数里有点疑问                
                              IPCThreadState::transact(data);
                   }

flatten_binder函数源码：
status_t flatten_binder(const sp<ProcessState>& proc,
    const sp<IBinder>& binder, Parcel* out)
{
    flat_binder_object obj;
   
    obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;
    if (binder != NULL) { //执行这个分支
        IBinder *local = binder->localBinder(); //由于CameraService是继承于BBinder，所以local返回对象实列，local是不空的
        if (!local) {
            BpBinder *proxy = binder->remoteBinder();
            if (proxy == NULL) {
                LOGE("null proxy");
            }
            const int32_t handle = proxy ? proxy->handle() : 0;
            obj.type = BINDER_TYPE_HANDLE;
            obj.handle = handle;
            obj.cookie = NULL;
        } else { //执行这个分支
            obj.type = BINDER_TYPE_BINDER;
            obj.binder = local->getWeakRefs();
            obj.cookie = local;
        }
    } else {
        obj.type = BINDER_TYPE_BINDER;
        obj.binder = NULL;
        obj.cookie = NULL;
    }
   
    return finish_flatten_binder(binder, obj, out);
}
将这个 flat_b