Binder机制中的机构体对象:
Binder对象:在进程之间的数据传递,位于binder.h中,Binder可以在数据包的有效数据中越过进程边界从一个进程传递给另一个进程,这些传输中的Binder用 flat_binder_object结构来表示。
struct flat_binder_object {
unsigned long type;//binder对象的类型
unsigned long flags;//改域只对第一次传递binder实体有效
union {
void *binder;//指向binder实体的地址
signed long handle;//存放binder的引用号
};
void *cookie;//改域只对binder实体有效,存放binder附加信息
};
//binder 对象的类型
enum transaction_flags {
TF_ONE_WAY = 0x01, //单向传递,异步,不需要返回值
TF_ROOT_OBJECT = 0x04, //组件的根对象,对应本地对象binder
TF_STATUS_CODE = 0x08, //状态码,对应远程对象
TF_ACCEPT_FDS = 0x10, //对应的文件类型
};
Binder的类型
#define B_PACK_CHARS(c1, c2, c3, c4) \
((((c1)<<24)) | (((c2)<<16)) | (((c3)<<8)) | (c4))
#define B_TYPE_LARGE 0x85
enum {
BINDER_TYPE_BINDER = B_PACK_CHARS('s', 'b', '*', B_TYPE_LARGE),
//binder 实体强类型
BINDER_TYPE_WEAK_BINDER = B_PACK_CHARS('w', 'b', '*', B_TYPE_LARGE),
//binder 实体 弱类型
BINDER_TYPE_HANDLE = B_PACK_CHARS('s', 'h', '*', B_TYPE_LARGE),
//binder 引用强类型
BINDER_TYPE_WEAK_HANDLE = B_PACK_CHARS('w', 'h', '*', B_TYPE_LARGE),
//binder 引用 弱类型
BINDER_TYPE_FD = B_PACK_CHARS('f', 'd', '*', B_TYPE_LARGE),
};
Binder数据传递结构体
struct binder_transaction_data {
union {
size_t handle;//要处理对象的句柄
void *ptr; //寻址
} target;
void *cookie; //对象附加的额外数据
unsigned int code; //对象执行的操作
unsigned int flags;//对象的类型
pid_t sender_pid;//进程PID
uid_t sender_euid;//进程的EID
size_t data_size; //数据的大小字节
size_t offsets_size; //数据的偏移量字节
union {
struct {
const void *buffer;//数据
const void *offsets;//偏移量
} ptr;
uint8_t buf[8];
} data;
};
Binder的实体也叫binder的结点,binder的节点信息结构体,包括了binder_work, binder_proc
struct binder_node {
int debug_id;
struct binder_work work;
union {
struct rb_node rb_node;//红黑树结点
struct hlist_node dead_node;
};
struct binder_proc *proc;//binder info
struct hlist_head refs;//binder 计数
int internal_strong_refs;
int local_weak_refs;
int local_strong_refs;
void __user *ptr;
void __user *cookie;
unsigned has_strong_ref:1;
unsigned pending_strong_ref:1;
unsigned has_weak_ref:1;
unsigned pending_weak_ref:1;
unsigned has_async_transaction:1;
unsigned accept_fds:1;
unsigned min_priority:8;
struct list_head async_todo;
};
要C/S即请求进程和服务进程的相关信息,方便进程间通信,以及信息的调用。该结构体包括了binder_work以及进程/线程结构体信息,以及binder状态结构体
struct binder_transaction {
int debug_id;
struct binder_work work;
struct binder_thread *from;
struct binder_transaction *from_parent;
struct binder_proc *to_proc;
struct binder_thread *to_thread;
struct binder_transaction *to_parent;
unsigned need_reply:1;
/* unsigned is_dead:1; */ /* not used at the moment */
struct binder_buffer *buffer;
unsigned int code;
unsigned int flags;
long priority;
long saved_priority;
uid_t sender_euid;
};
每打开一个binder驱动(系统允许多个进程打开binder驱动),都会有一个专门的binder_proc管理 当前进程的信息,包括:进程的ID、当前进程由mmap所映射出的buffer信息、以及当前进程所允许 的最大线程量。同时这个binder_proc会加入到系统的全局链表binder_procs中去,方便在不同进程之 间可以查找信息。
struct binder_proc {
struct hlist_node proc_node;
struct rb_root threads;
struct rb_root nodes;
struct rb_root refs_by_desc;
struct rb_root refs_by_node;
int pid;
struct vm_area_struct *vma;
struct task_struct *tsk;
struct files_struct *files;
struct hlist_node deferred_work_node;
int deferred_work;
void *buffer;
ptrdiff_t user_buffer_offset;
struct list_head buffers;
struct rb_root free_buffers;
struct rb_root allocated_buffers;
size_t free_async_space;
struct page **pages;
size_t buffer_size;
uint32_t buffer_free;
struct list_head todo;
wait_queue_head_t wait;
struct binder_stats stats;
struct list_head delivered_death;
int max_threads;
int requested_threads;
int requested_threads_started;
int ready_threads;
long default_priority;//默认优先级
struct dentry *debugfs_entry;
};
线程信息结构体。在进程下存在一个或多个线程,因此binder驱动使用binder_thread来管理对应的线 程信息,主要包括线程所属的binder_proc、当前状态looper以及一个binder_transaction结构的 transaction_stack.
struct binder_thread {
struct binder_proc *proc;
struct rb_node rb_node;
int pid;
int looper;
struct binder_transaction *transaction_stack;
struct list_head todo;
uint32_t return_error; /* Write failed, return error code in read buf */
uint32_t return_error2; /* Write failed, return error code in read */
/* buffer. Used when sending a reply to a dead process that */
/* we are also waiting on */
wait_queue_head_t wait;
struct binder_stats stats;
};
本文详细介绍了Android系统中的Binder机制,包括Binder对象的结构、类型及数据传递过程。通过讲解Binder的数据结构,如flat_binder_object、binder_transaction_data等,帮助读者理解进程间通信的核心原理。

被折叠的 条评论
为什么被折叠?



