主要参考资料：
Android系统源代码情景分析
RefBase
可以通过强弱引用控制对象的生命周期（weakref_type）
class RefBase
{
public:
void incStrong(const void* id) const;
void decStrong(const void* id) const;
void forceIncStrong(const void* id) const;
//! DEBUGGING ONLY: Get current strong ref count.
int32_t getStrongCount() const;
class weakref_type
{
public:
RefBase* refBase() const;
void incWeak(const void* id);
void decWeak(const void* id);
sp强指针（控制对象生命周期），wp弱指针（辅助）
private:
template<typename Y> friend class sp;
template<typename Y> friend class wp;
IBinder
这是Binder进程间通信的抽象基类，定义接口
//D:\BaiduNetdiskDownload\android11源码\android-11.0.0_r1\frameworks\native\libs\binder\include\binder
class IBinder : public virtual RefBase//虚继承，派生类只有一份RefBase实例
//Binder死亡回调通知
class DeathRecipient : public virtual RefBase
{
public:
virtual void binderDied(const wp<IBinder>& who) = 0;
};//如下
virtual status_t linkToDeath(const sp<DeathRecipient>& recipient,
void* cookie = nullptr,
uint32_t flags = 0) = 0;
/**
* Check if this IBinder implements the interface named by
* @a descriptor. If it does, the base pointer to it is returned,
* which you can safely static_cast<> to the concrete C++ interface.
*/
virtual sp<IInterface> queryLocalInterface(const String16& descriptor);
/**
* Return the canonical name of the interface provided by this IBinder
* object.
*/
virtual const String16& getInterfaceDescriptor() const = 0;
virtual BBinder* localBinder();//Binder本地对象
virtual BpBinder* remoteBinder();//Binder代理对象
BBinder
BBinder， Binder本地对象的基类，继承于IBinder，需要重写IBinder的方法，新增一个重要的方法onTransact，负责分发与进程间通信有关的请求，需要子类重写
BpRefBase，Binder代理对象接口的基类，remote()方法，返回mRemote，其指向Bpinder代理对象
//D:\BaiduNetdiskDownload\android11源码\android-11.0.0_r1\frameworks\native\libs\binder\include\binder
class BBinder : public IBinder
//内部类
class BpRefBase : public virtual RefBase//
{
inline IBinder* remote() { return mRemote; }
IBinder* const mRemote;
RefBase::weakref_type* mRefs;
}
//Transact调用onTransact方法，没有具体的实现，需要子类覆写
virtual status_t onTransact( uint32_t code,
const Parcel& data,
Parcel* reply,
uint32_t flags = 0);
localBinder是它本身
BBinder* BBinder::localBinder()
{
return this;
}
BpBinder
Binder代理对象的基类
class BpBinder : public IBinder
//服务死亡，调用的结构体
struct Obituary {
wp<DeathRecipient> recipient;
void* cookie;
uint32_t flags;
};
//trackedUid = IPCThreadState::self()->getCallingUid();
static BpBinder* create(int32_t handle);//handle句柄，Binder驱动的Binder引用对象持有
int32_t handle() const;
const int32_t mHandle;//进程内唯一标识，Client组件句柄值
getInterfaceDescriptor
const String16& BpBinder::getInterfaceDescriptor() const{
status_t err = const_cast<BpBinder*>(this)->transact(
INTERFACE_TRANSACTION, send, &reply);
transact
调用该方法与服务端通信
status_t BpBinder::transact(
uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
//IPCThreadState由它打开Binder驱动
status_t status = IPCThreadState::self()->transact(
mHandle, code, data, reply, flags);
IInterface
class IInterface : public virtual RefBase
static sp<IBinder> asBinder(const IInterface*);//实参为指针
static sp<IBinder> asBinder(const sp<IInterface>&);//实参为引用
INTERFACE
服务接口基类，需要自实现的服务接口
template<typename INTERFACE>
inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj)
{
return INTERFACE::asInterface(obj);
}
//#define DECLARE_META_INTERFACE(INTERFACE)
//#define IMPLEMENT_META_INTERFACE(INTERFACE, NAME)
BnInterface
本地服务接口基类
template<typename INTERFACE>
class BnInterface : public INTERFACE, public BBinder
public:
virtual sp<IInterface> queryLocalInterface(const String16& _descriptor);
virtual const String16& getInterfaceDescriptor() const;
BpInterface
本地服务代理接口基类
template<typename INTERFACE>
class BpInterface : public INTERFACE, public BpRefBase
explicit BpInterface(const sp<IBinder>& remote);
SafeBpInterface
template <typename Interface>
class SafeBpInterface : public BpInterface<Interface> {
ProcessState
class ProcessState : public virtual RefBase
public:
static sp<ProcessState> self();
void startThreadPool();
String8 mDriverName;//可以打开驱动
//const char* kDefaultDriver = "/dev/binder";
int mDriverFD;
IPCThreadState
const sp<ProcessState> mProcess;
Parcel mIn;
Parcel mOut;
pid_t getCallingPid() const;
uid_t getCallingUid() const;//typedef int uid_t;
int64_t clearCallingIdentity();//return token;
// Restores PID/UID (not SID)
void restoreCallingIdentity(int64_t token);//mCallingPid = (int)token;
void joinThreadPool(bool isMain = true);
status_t transact(int32_t handle,uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags);
Binder驱动的三个主要函数
status_t waitForResponse(Parcel *reply,
status_t *acquireResult=nullptr);
status_t talkWithDriver(bool doReceive=true);
status_t writeTransactionData(int32_t cmd,
uint32_t binderFlags,
int32_t handle,
uint32_t code,
const Parcel& data,
status_t* statusBuffer);
status_t IPCThreadState::transact(int32_t handle,
uint32_t code, const Parcel& data,
Parcel* reply, uint32_t flags){
//1
err = writeTransactionData(BC_TRANSACTION, flags, handle, code, data, nullptr);
//2
err = waitForResponse(reply);
}
