public class Book implements Parcelable {

    public int bookId;
    public String bookName;

    public Book(int bookId, String bookName) {
        this.bookId = bookId;
        this.bookName = bookName;
    }

    protected Book(Parcel in) {
        bookId = in.readInt();
        bookName = in.readString();
    }

    public static final Creator<Book> CREATOR = new Creator<Book>() {
        @Override
        public Book createFromParcel(Parcel in) {
            return new Book(in);
        }

        @Override
        public Book[] newArray(int size) {
            return new Book[size];
        }
    };

    @Override
    public int describeContents() {
        return 0;
    }

    @Override
    public void writeToParcel(Parcel dest, int flags) {
        dest.writeInt(bookId);
        dest.writeString(bookName);
    }
}

package com.tufusi.aidl;

parcelable Book;

package com.tufusi.aidl;

import com.tufusi.aidl.Book;

interface IBookManager {
    List<Book> getBookList();
    void addBook(in Book book);
}

/**
 * Base class for Binder interfaces.  When defining a new interface,
 * you must derive it from IInterface.
 */
public interface IInterface
{
    /**
     * Retrieve the Binder object associated with this interface.
     * You must use this instead of a plain cast, so that proxy objects
     * can return the correct result.
     */
    public IBinder asBinder();
}

public interface IBinder {
   
    public boolean transact(int code, @NonNull Parcel data, @Nullable Parcel reply, int flags)
        throws RemoteException;

    ... 省略
}

public class Binder implements IBinder {

    // 省略

    /**
     * Add the calling thread to the IPC thread pool.  This function does
     * not return until the current process is exiting.
     * 这里涉及到Binder线程池，后面分析
     */
    public static final void joinThreadPool() {
        BinderInternal.joinThreadPool();
    }

    /**
     * 判断传入的IInterface是否是代理对象
     * @hide
     */
    public static final boolean isProxy(IInterface iface) {
        return iface.asBinder() != iface;
    }

    // 省略

    /**
     * 默认构造器，仅仅是初始化该对象
     *
     * 如果正在创建一个Binder通信令牌 (一个Binder对象没有附加任何接口),就应该考虑使用这个替换
     */
    public Binder() {
        this(null);
    }

    /**
     * 用于创建原始Binder对象(令牌)和描述符的构造函数。
     */
    public Binder(@Nullable String descriptor)  {
        mObject = getNativeBBinderHolder();
        NoImagePreloadHolder.sRegistry.registerNativeAllocation(this, mObject);

        if (FIND_POTENTIAL_LEAKS) {
            final Class<? extends Binder> klass = getClass();
            if ((klass.isAnonymousClass() || klass.isMemberClass() || klass.isLocalClass()) &&
                    (klass.getModifiers() & Modifier.STATIC) == 0) {
                Log.w(TAG, "The following Binder class should be static or leaks might occur: " +
                    klass.getCanonicalName());
            }
        }
        mDescriptor = descriptor;
    }

    /**
     * 将特定接口与Binder做关联的简便方法
     * 在调用后, queryLocalInterface() 会帮我们实现: 当相应的描述符被请求时返回给定的 IInterface  owner 
     * attach进来的owner就是Stub
     */
    public void attachInterface(@Nullable IInterface owner, @Nullable String descriptor) {
        mOwner = owner;
        mDescriptor = descriptor;
    }

    /**
     * 如果描述符相匹配，则返回指定的 mOwner
     */
    public @Nullable IInterface queryLocalInterface(@NonNull String descriptor) {
        if (mDescriptor != null && mDescriptor.equals(descriptor)) {
            return mOwner;
        }
        return null;
    }

    /**
     * 代理执行监听器，这个接口用来通知每个代理端Binder的回调
     */
    @SystemApi
    public interface ProxyTransactListener {

        @Nullable
        default Object onTransactStarted(@NonNull IBinder binder, int transactionCode, int flags) {
            return onTransactStarted(binder, transactionCode);
        }

        @Nullable
        Object onTransactStarted(@NonNull IBinder binder, int transactionCode);

        void onTransactEnded(@Nullable Object session);
    }

    /**
     * 为代理端对象设置代理执行监听器，这个监听器是全局的。但是是隐藏的系统服务接口，客户端一般用不到
     */
    @SystemApi
    public static void setProxyTransactListener(@Nullable ProxyTransactListener listener) {
        BinderProxy.setTransactListener(listener);
    }

    /**
     * Stub存根类的一个默认实现（该类继承Binder，并实现AIDL接口），默认返回false，只有命中不同的分支语句才会返回true。
     * 我们要在这里进行覆写，从而对事务进行适当的数据编排。
     *
     * @param code 要执行的动作。这应该
     * 是一个介于{@link #FIRST_CALL_TRANSACTION}和 {@link # LAST_CALL_TRANSACTION}之间的数字 。
     *
     * @param data 从调用方接收的编组数据。
     * @param reply 如果调用者期待返回结果，需要在这里对其进行编组。
     * @param flags 额外的操作标志。 
     *
     * @return 成功调用时返回true;通常返回false表示你不明白这里的事务代码（下面就会知道为什么说返回false表示不懂这里的处理逻辑，因为只有同一进程才会返回false，而同一进程为何要使用Binder进行通信呢）
     */
    protected boolean onTransact(int code, @NonNull Parcel data, @Nullable Parcel reply,
            int flags) throws RemoteException {
        // 这里主要是针对code进行一些fd的写入写出，目的是为了通信，涉及到序列化
    }


    /**
     * 默认的反序列化的事务代码的实现.  在远程服务端，对Binder进行事务的调用以执行IPC
     */
    public final boolean transact(int code, @NonNull Parcel data, @Nullable Parcel reply,
            int flags) throws RemoteException {
        if (false) Log.v("Binder", "Transact: " + code + " to " + this);

        if (data != null) {
            data.setDataPosition(0);
        }
        boolean r = onTransact(code, data, reply, flags);
        if (reply != null) {
            reply.setDataPosition(0);
        }
        return r;
    }

     /**
     * 给Binder设置死亡代理
     */
    public void linkToDeath(@NonNull DeathRecipient recipient, int flags) {
    }

    /**
     * 解除死亡代理关联
     */
    public boolean unlinkToDeath(@NonNull DeathRecipient recipient, int flags) {
        return true;
    }

    // 省略
}

public final class BinderProxy implements IBinder {

    // 省略

    @GuardedBy("sProxyMap")
    private static final ProxyMap sProxyMap = new ProxyMap();

    /**
     * 统计当前进程中存活的代理接口数量
     */
    public static final class InterfaceCount {
        private final String mInterfaceName;
        private final int mCount;

        InterfaceCount(String interfaceName, int count) {
            mInterfaceName = interfaceName;
            mCount = count;
        }

        @Override
        public String toString() {
            return mInterfaceName + " x" + Integer.toString(mCount);
        }
    }

    /**
     * 检索一个本地接口——在代理的情况下始终为空
     */
    public IInterface queryLocalInterface(String descriptor) {
        return null;
    }

    /**
     * Perform a binder transaction on a proxy.
     *
     * @param code The action to perform.  This should
     * be a number between {@link #FIRST_CALL_TRANSACTION} and
     * {@link #LAST_CALL_TRANSACTION}.
     * @param data Marshalled data to send to the target.  Must not be null.
     * If you are not sending any data, you must create an empty Parcel
     * that is given here.
     * @param reply Marshalled data to be received from the target.  May be
     * null if you are not interested in the return value.
     * @param flags Additional operation flags.  Either 0 for a normal
     * RPC, or {@link #FLAG_ONEWAY} for a one-way RPC.
     *
     * @return
     * @throws RemoteException
     */
    public boolean transact(int code, Parcel data, Parcel reply, int flags) throws RemoteException {
        Binder.checkParcel(this, code, data, "Unreasonably large binder buffer");

        if (mWarnOnBlocking && ((flags & FLAG_ONEWAY) == 0)
                && Binder.sWarnOnBlockingOnCurrentThread.get()) {

            // For now, avoid spamming the log by disabling after we've logged
            // about this interface at least once
            mWarnOnBlocking = false;

            if (Build.IS_USERDEBUG) {
                // Log this as a WTF on userdebug builds.
                Log.wtf(Binder.TAG,
                        "Outgoing transactions from this process must be FLAG_ONEWAY",
                        new Throwable());
            } else {
                Log.w(Binder.TAG,
                        "Outgoing transactions from this process must be FLAG_ONEWAY",
                        new Throwable());
            }
        }

        final boolean tracingEnabled = Binder.isTracingEnabled();
        if (tracingEnabled) {
            final Throwable tr = new Throwable();
            Binder.getTransactionTracker().addTrace(tr);
            StackTraceElement stackTraceElement = tr.getStackTrace()[1];
            Trace.traceBegin(Trace.TRACE_TAG_ALWAYS,
                    stackTraceElement.getClassName() + "." + stackTraceElement.getMethodName());
        }

        // Make sure the listener won't change while processing a transaction.
        final Binder.ProxyTransactListener transactListener = sTransactListener;
        Object session = null;

        if (transactListener != null) {
            final int origWorkSourceUid = Binder.getCallingWorkSourceUid();
            session = transactListener.onTransactStarted(this, code, flags);

            // Allow the listener to update the work source uid. We need to update the request
            // header if the uid is updated.
            final int updatedWorkSourceUid = Binder.getCallingWorkSourceUid();
            if (origWorkSourceUid != updatedWorkSourceUid) {
                data.replaceCallingWorkSourceUid(updatedWorkSourceUid);
            }
        }

        final AppOpsManager.PausedNotedAppOpsCollection prevCollection =
                AppOpsManager.pauseNotedAppOpsCollection();

        if ((flags & FLAG_ONEWAY) == 0 && AppOpsManager.isListeningForOpNoted()) {
            flags |= FLAG_COLLECT_NOTED_APP_OPS;
        }

        try {
            return transactNative(code, data, reply, flags);
        } finally {
            AppOpsManager.resumeNotedAppOpsCollection(prevCollection);

            if (transactListener != null) {
                transactListener.onTransactEnded(session);
            }

            if (tracingEnabled) {
                Trace.traceEnd(Trace.TRACE_TAG_ALWAYS);
            }
        }
    }

    // 省略
}

// 继承IInterface接口，Default实现了这个自定义接口，必须实现 asBinder 方法
public interface IBookManager extends android.os.IInterface {
    /**
     * 默认空实现
     */
    public static class Default implements com.tufusi.aidl.IBookManager {
        @Override
        public java.util.List<com.tufusi.aidl.Book> getBookList() throws android.os.RemoteException {
            return null;
        }

        @Override
        public void addBook(com.tufusi.aidl.Book book) throws android.os.RemoteException {
        }

        @Override
        public android.os.IBinder asBinder() {
            // 返回当前的Binder对象
            return null;
        }
    }

    /**
     * 本地端的IPC实现类
     */
    public static abstract class Stub extends android.os.Binder implements com.tufusi.aidl.IBookManager {

        // Binder的唯一标识，一般是当前 Binder的全类名表示
        private static final java.lang.String DESCRIPTOR = "com.tufusi.aidl.IBookManager";

        /**
         * 构造Stub类并依附 IBookManager 接口，同时传入描述符
         */
        public Stub() {
            this.attachInterface(this, DESCRIPTOR);
        }

        /**
         * 将 IBinder对象转换成到 com.tufusi.aidl.IBookManager接口类对象,
         * 如果需要，生成代理类.
         */
        public static com.tufusi.aidl.IBookManager asInterface(android.os.IBinder obj) {
            if ((obj == null)) {
                return null;
            }
            // 根据描述符，查询本地接口组，是否有匹配的AIDL接口类型的对象，如果有，则直接走本地通信，不会走跨进程通信
            android.os.IInterface iin = obj.queryLocalInterface(DESCRIPTOR);
            if (((iin != null) && (iin instanceof com.tufusi.aidl.IBookManager))) {
                // 返回的是服务端的Stub对象
                return ((com.tufusi.aidl.IBookManager) iin);
            }
            // 包装传入的IBinder对象，返回服务端代理对象 Stub.Proxy对象
            return new com.tufusi.aidl.IBookManager.Stub.Proxy(obj);
        }

        @Override
        public android.os.IBinder asBinder() {
            // 将当前类对象转为IBinder对象，Stub返回的是本地端对象 & Proxy那边返回的是服务端代理对象（其实Stub也是本地端的一个代理对象）
            return this;
        }

        // 事务执行，运行在服务端中的Binder线程池中，当客户端发起跨进程请求时，远程请求会通过系统底层封装后交由此方法处理。
        @Override
        public boolean onTransact(int code, android.os.Parcel data, android.os.Parcel reply, int flags)
                throws android.os.RemoteException {
            java.lang.String descriptor = DESCRIPTOR;
            // 分发请求的目标方法的code
            switch (code) {
                case INTERFACE_TRANSACTION: {
                    reply.writeString(descriptor);
                    return true;
                }
                case TRANSACTION_getBookList: {
                    data.enforceInterface(descriptor);
                    java.util.List<com.tufusi.aidl.Book> _result = this.getBookList();
                    // 当目标方法执行完毕，向reply中写入返回值
                    reply.writeNoException();
                    reply.writeTypedList(_result);
                    return true;
                }
                case TRANSACTION_addBook: {
                    data.enforceInterface(descriptor);
                    com.tufusi.aidl.Book _arg0;
                    if ((0 != data.readInt())) {
                        _arg0 = com.tufusi.aidl.Book.CREATOR.createFromParcel(data);
                    } else {
                        _arg0 = null;
                    }
                    this.addBook(_arg0);
                    reply.writeNoException();
                    return true;
                }
                // 如果客户端的请求返回false，就表明没有权限进行远程调用
                default: {
                    return super.onTransact(code, data, reply, flags);
                }
            }
        }

        // 服务端代理类，当客户端和服务端位于同一进程，则不会进行跨进程的transact过程。
        private static class Proxy implements com.tufusi.aidl.IBookManager {
            private android.os.IBinder mRemote;

            Proxy(android.os.IBinder remote) {
                mRemote = remote;
            }

            @Override
            public android.os.IBinder asBinder() {
                return mRemote;
            }

            public java.lang.String getInterfaceDescriptor() {
                return DESCRIPTOR;
            }

            // 这个方法运行在客户端，当客户端进行远程调用此方法时，内部是这样实现的：
            // 1）创建该方法所需的输入型 Parcel 对象 _data、输出型 Parcel 对象 _reply 和返回值对象 _result
            // 2）把该方法的参数信息写入 _data 中（如果有参数）
            // 3）调用transact方法发起 RPC(远程过程调用)请求，同时当前线程挂起
            // 4）服务端 onTransact方法会被调用，直到 RPC 过程返回后，当前线程继续执行，并从 _reply 中取出 RPC 过程的返回结果
            // 5）返回 _reply 中的数据
            @Override
            public java.util.List<com.tufusi.aidl.Book> getBookList() throws android.os.RemoteException {
                android.os.Parcel _data = android.os.Parcel.obtain();
                android.os.Parcel _reply = android.os.Parcel.obtain();
                java.util.List<com.tufusi.aidl.Book> _result;
                try {
                    _data.writeInterfaceToken(DESCRIPTOR);
                    boolean _status = mRemote.transact(Stub.TRANSACTION_getBookList, _data, _reply, 0);
                    // ☆☆☆☆☆☆ 通过返回状态，判断是否执行本地调用 ☆☆☆☆☆☆☆
                    if (!_status && getDefaultImpl() != null) {
                        return getDefaultImpl().getBookList();
                    }
                    _reply.readException();
                    _result = _reply.createTypedArrayList(com.tufusi.aidl.Book.CREATOR);
                } finally {
                    _reply.recycle();
                    _data.recycle();
                }
                return _result;
            }

            @Override
            public void addBook(com.tufusi.aidl.Book book) throws android.os.RemoteException {
                android.os.Parcel _data = android.os.Parcel.obtain();
                android.os.Parcel _reply = android.os.Parcel.obtain();
                try {
                    _data.writeInterfaceToken(DESCRIPTOR);
                    if ((book != null)) {
                        _data.writeInt(1);
                        book.writeToParcel(_data, 0);
                    } else {
                        _data.writeInt(0);
                    }
                    boolean _status = mRemote.transact(Stub.TRANSACTION_addBook, _data, _reply, 0);
                    if (!_status && getDefaultImpl() != null) {
                        getDefaultImpl().addBook(book);
                        return;
                    }
                    _reply.readException();
                } finally {
                    _reply.recycle();
                    _data.recycle();
                }
            }

            public static com.tufusi.aidl.IBookManager sDefaultImpl;
        }

        // 这两个整型ID跟aidl中定义的方法有关，都会在IBinder的两个常量值上实现递增 0x00000001 ~ 0x00ffffff（给vpn用的）
        // 这两个值能确保手机系统中所有用到的aidl方法的id唯一。
        // 这两个id用于标识在transact过程中客户端所请求的到底是哪个方法，进行不同命中
        static final int TRANSACTION_getBookList = (android.os.IBinder.FIRST_CALL_TRANSACTION + 0);
        static final int TRANSACTION_addBook = (android.os.IBinder.FIRST_CALL_TRANSACTION + 1);

        public static boolean setDefaultImpl(com.tufusi.aidl.IBookManager impl) {
            // Only one user of this interface can use this function
            // at a time. This is a heuristic to detect if two different
            // users in the same process use this function.
            if (Stub.Proxy.sDefaultImpl != null) {
                throw new IllegalStateException("setDefaultImpl() called twice");
            }
            if (impl != null) {
                Stub.Proxy.sDefaultImpl = impl;
                return true;
            }
            return false;
        }

        public static com.tufusi.aidl.IBookManager getDefaultImpl() {
            return Stub.Proxy.sDefaultImpl;
        }
    }

    public java.util.List<com.tufusi.aidl.Book> getBookList() throws android.os.RemoteException;

    public void addBook(com.tufusi.aidl.Book book) throws android.os.RemoteException;
}