binder 3 驱动层数据结构

当一个进程调用open("dev/binder")时：驱动层对应的处理函数会创建

struct binder_proc {
	struct hlist_node proc_node;
	struct rb_root threads;
	struct rb_root nodes;
	struct rb_root refs_by_desc;
	struct rb_root refs_by_node;
	int pid;
	struct vm_area_struct *vma;
	struct mm_struct *vma_vm_mm;
	struct task_struct *tsk;
	struct files_struct *files;
};

binder_proc有４棵红黑树，这里关心表示Binder实体的nodes,Binder代理的refs_by_desc

struct binder_ref {
	struct binder_node *node;
	uint32_t desc;

};

通过来自用户空间的handle,可以找到对应的binder_ref, 通过binder_ref可以找到对应的binder_node, binder_node中包含binder_node所在进程的服务指针

binder_node和binder_ref的创建

binder_node和binder_ref的创建来着数据传输过程，根据数据的类型创建的。

static void binder_transaction(struct binder_proc *proc,
      struct binder_thread *thread,
      struct binder_transaction_data *tr, int reply)
{
struct flat_binder_object *fp;
fp = (struct flat_binder_object *)(t->buffer->data + *offp);
switch (fp->type) {
case BINDER_TYPE_BINDER:
case BINDER_TYPE_WEAK_BINDER: {
struct binder_ref *ref;
struct binder_node *node = binder_get_node(proc, fp->binder);


if (node == NULL) {
node = binder_new_node(proc, fp->binder, fp->cookie);
if (node == NULL) {
return_error = BR_FAILED_REPLY;
goto err_binder_new_node_failed;
}
node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK;
node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS);
}


case BINDER_TYPE_HANDLE:
case BINDER_TYPE_WEAK_HANDLE: 
struct binder_ref *ref = binder_get_ref(proc, fp->handle,
fp->type == BINDER_TYPE_HANDLE);
new_ref = binder_get_ref_for_node(target_proc, ref->node);
if (new_ref == NULL) {
return_error = BR_FAILED_REPLY;
goto err_binder_get_ref_for_node_failed;
}
fp->binder = 0;
fp->handle = new_ref->desc;
fp->cookie = 0;
binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL);
}

当Server端调用addService后，驱动会在ServiceManager的refs_by_desc红黑树中挂上Service的binder_ref节点；在Server的nodes红黑树中挂上Service的binder_node节点。
因此，在ServiceManager的refs_bbinder_get_ref(proc, fp->handle,fp->type == BINDER_TYPE_HANDLE)y_desc红黑树上可以找到到handle对应的binder_ref节点。ref->node是binder的实体，该实体是由Server创建的, 这样就关联了binder_ref和binder_node.