主要參考資料：
Android系統(tǒng)源代碼情景分析

RefBase

可以通過(guò)強(qiáng)弱引用控制對(duì)象的生命周期（weakref_type）

class RefBase
{
public:
            void            incStrong(const void* id) const;
            void            decStrong(const void* id) const;

            void            forceIncStrong(const void* id) const;

            //! DEBUGGING ONLY: Get current strong ref count.
            int32_t         getStrongCount() const;

    class weakref_type
    {
    public:
        RefBase*            refBase() const;

        void                incWeak(const void* id);
        void                decWeak(const void* id);

sp強(qiáng)指針（控制對(duì)象生命周期），wp弱指針（輔助）

private:
    template<typename Y> friend class sp;
    template<typename Y> friend class wp;

IBinder

這是Binder進(jìn)程間通信的抽象基類(lèi)，定義接口

//D:\BaiduNetdiskDownload\android11源碼\android-11.0.0_r1\frameworks\native\libs\binder\include\binder
class IBinder : public virtual RefBase//虛繼承，派生類(lèi)只有一份RefBase實(shí)例
    //Binder死亡回調(diào)通知
    class DeathRecipient : public virtual RefBase
    {
    public:
        virtual void binderDied(const wp<IBinder>& who) = 0;
    };//如下

    virtual status_t        linkToDeath(const sp<DeathRecipient>& recipient,
                                        void* cookie = nullptr,
                                        uint32_t flags = 0) = 0;

    /**
     * Check if this IBinder implements the interface named by
     * @a descriptor.  If it does, the base pointer to it is returned,
     * which you can safely static_cast<> to the concrete C++ interface.
     */
    virtual sp<IInterface>  queryLocalInterface(const String16& descriptor);

    /**
     * Return the canonical name of the interface provided by this IBinder
     * object.
     */
    virtual const String16& getInterfaceDescriptor() const = 0;

    virtual BBinder*        localBinder();//Binder本地對(duì)象
    virtual BpBinder*       remoteBinder();//Binder代理對(duì)象

BBinder

BBinder， Binder本地對(duì)象的基類(lèi)，繼承于IBinder，需要重寫(xiě)IBinder的方法，新增一個(gè)重要的方法onTransact，負(fù)責(zé)分發(fā)與進(jìn)程間通信有關(guān)的請(qǐng)求，需要子類(lèi)重寫(xiě)

BpRefBase，Binder代理對(duì)象接口的基類(lèi)，remote()方法，返回mRemote，其指向Bpinder代理對(duì)象

//D:\BaiduNetdiskDownload\android11源碼\android-11.0.0_r1\frameworks\native\libs\binder\include\binder
class BBinder : public IBinder
//內(nèi)部類(lèi)
class BpRefBase : public virtual RefBase//
{
    inline  IBinder*        remote()                { return mRemote; }
    IBinder* const          mRemote;
    RefBase::weakref_type*  mRefs;
}

    //Transact調(diào)用onTransact方法，沒(méi)有具體的實(shí)現(xiàn)，需要子類(lèi)覆寫(xiě)
virtual status_t    onTransact( uint32_t code,
                                    const Parcel& data,
                                    Parcel* reply,
                                    uint32_t flags = 0);

localBinder是它本身

BBinder* BBinder::localBinder()
{
    return this;
}

BpBinder

Binder代理對(duì)象的基類(lèi)

class BpBinder : public IBinder
    //服務(wù)死亡，調(diào)用的結(jié)構(gòu)體
        struct Obituary {
        wp<DeathRecipient> recipient;
        void* cookie;
        uint32_t flags;
    };

   //trackedUid = IPCThreadState::self()->getCallingUid();
    static BpBinder*    create(int32_t handle);//handle句柄，Binder驅(qū)動(dòng)的Binder引用對(duì)象持有

    int32_t             handle() const;

    const   int32_t             mHandle;//進(jìn)程內(nèi)唯一標(biāo)識(shí)，Client組件句柄值

getInterfaceDescriptor

 const String16& BpBinder::getInterfaceDescriptor() const{
    status_t err = const_cast<BpBinder*>(this)->transact(
                INTERFACE_TRANSACTION, send, &reply);

transact

調(diào)用該方法與服務(wù)端通信

status_t BpBinder::transact(
    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
{
    //IPCThreadState由它打開(kāi)Binder驅(qū)動(dòng)
            status_t status = IPCThreadState::self()->transact(
            mHandle, code, data, reply, flags);

IInterface

class IInterface : public virtual RefBase

            static sp<IBinder>  asBinder(const IInterface*);//實(shí)參為指針
            static sp<IBinder>  asBinder(const sp<IInterface>&);//實(shí)參為引用

INTERFACE

服務(wù)接口基類(lèi)，需要自實(shí)現(xiàn)的服務(wù)接口

template<typename INTERFACE>
inline sp<INTERFACE> interface_cast(const sp<IBinder>& obj)
{
    return INTERFACE::asInterface(obj);
}

//#define DECLARE_META_INTERFACE(INTERFACE)
//#define IMPLEMENT_META_INTERFACE(INTERFACE, NAME)

BnInterface

本地服務(wù)接口基類(lèi)

template<typename INTERFACE>
class BnInterface : public INTERFACE, public BBinder
    public:
    virtual sp<IInterface>      queryLocalInterface(const String16& _descriptor);
    virtual const String16&     getInterfaceDescriptor() const;

BpInterface

本地服務(wù)代理接口基類(lèi)

template<typename INTERFACE>
class BpInterface : public INTERFACE, public BpRefBase
        explicit                    BpInterface(const sp<IBinder>& remote);

SafeBpInterface

template <typename Interface>
class SafeBpInterface : public BpInterface<Interface> {

ProcessState

class ProcessState : public virtual RefBase
    public:
    static  sp<ProcessState>    self();
    void                startThreadPool();
    String8             mDriverName;//可以打開(kāi)驅(qū)動(dòng)
    //const char* kDefaultDriver = "/dev/binder";
    int                 mDriverFD;

IPCThreadState

const   sp<ProcessState>    mProcess;
Parcel              mIn;
Parcel              mOut;

pid_t               getCallingPid() const;
uid_t               getCallingUid() const;//typedef  int  uid_t;
int64_t             clearCallingIdentity();//return token;
// Restores PID/UID (not SID)
void                restoreCallingIdentity(int64_t token);//mCallingPid = (int)token;
void                joinThreadPool(bool isMain = true);

status_t            transact(int32_t handle,uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags);

Binder驅(qū)動(dòng)的三個(gè)主要函數(shù)

            status_t            waitForResponse(Parcel *reply,
                                                status_t *acquireResult=nullptr);
            status_t            talkWithDriver(bool doReceive=true);
            status_t            writeTransactionData(int32_t cmd,
                                                     uint32_t binderFlags,
                                                     int32_t handle,
                                                     uint32_t code,
                                                     const Parcel& data,
                                                     status_t* statusBuffer);

status_t IPCThreadState::transact(int32_t handle,
                                  uint32_t code, const Parcel& data,
                                  Parcel* reply, uint32_t flags){
    //1
    err = writeTransactionData(BC_TRANSACTION, flags, handle, code, data, nullptr);
    //2
    err = waitForResponse(reply);
}