//´´½¨miscÀàÐ͵ÄÇý¶¯
static struct miscdevice binder_miscdev = {
.minor = MISC_DYNAMIC_MINOR,
.name = "binder",
.fops = &binder_fops//°ó¶¨binderÇý¶¯²Ù×÷º¯Êý
};
//binderÇý¶¯³õʼ»¯
static int __init binder_init(void)
{
int ret;
binder_deferred_workqueue = create_singlethread_workqueue("binder");
if (!binder_deferred_workqueue)
return -ENOMEM;
//´´½¨Ä¿Â¼/binder
binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL);
if (binder_debugfs_dir_entry_root)
//´´½¨Ä¿Â¼/binder/proc
binder_debugfs_dir_entry_proc = debugfs_create_dir("proc",
binder_debugfs_dir_entry_root);
//×¢²ábinderÇý¶¯
ret = misc_register(&binder_miscdev);
//´´½¨ÆäËûÎļþ
if (binder_debugfs_dir_entry_root) {
//´´½¨Îļþ/binder/proc/state
debugfs_create_file("state",
S_IRUGO,
binder_debugfs_dir_entry_root,
NULL,
&binder_state_fops);
//´´½¨Îļþ/binder/proc/stats
debugfs_create_file("stats",
S_IRUGO,
binder_debugfs_dir_entry_root,
NULL,
&binder_stats_fops);
//´´½¨Îļþ/binder/proc/transactions
debugfs_create_file("transactions",
S_IRUGO,
binder_debugfs_dir_entry_root,
NULL,
&binder_transactions_fops);
//´´½¨Îļþ/binder/proc/transaction_log
debugfs_create_file("transaction_log",
S_IRUGO,
binder_debugfs_dir_entry_root,
&binder_transaction_log,
&binder_transaction_log_fops);
//´´½¨Îļþ/binder/proc/failed_transaction_log
debugfs_create_file("failed_transaction_log",
S_IRUGO,
binder_debugfs_dir_entry_root,
&binder_transaction_log_failed,
&binder_transaction_log_fops);
}
return ret;
}

void binder_send_reply (struct binder_state *bs,
struct binder_io *reply,
binder_uintptr_t buffer_to_free,
int status)
{
//ÄäÃû½á¹¹Ìå
struct {
uint32_t cmd_free;
binder_uintptr_t buffer;
uint32_t cmd_reply;
struct binder_transaction_data txn;
} __attribute__((packed)) data;
data.cmd_free = BC_FREE_BUFFER;
data.buffer = buffer_to_free;
data.cmd_reply = BC_REPLY;
data.txn.target.ptr = 0;
data.txn.cookie = 0;
data.txn.code = 0;
if (status) {
//ͨÐÅÖвúÉúÁË´íÎó
data.txn.flags = TF_STATUS_CODE;
data.txn.data_size = sizeof(int);
data.txn.offsets_size = 0;
data.txn.data.ptr.buffer = (uintptr_t)&status;
data.txn.data.ptr.offsets = 0;
} else {
//³É¹¦´¦ÀíµÄÒ»´ÎͨÐÅÇëÇó
data.txn.flags = 0;
data.txn.data_size = reply->data - reply->data0;
data.txn.offsets_size = ((char*) reply->offs) - ((char*) reply->offs0);
data.txn.data.ptr.buffer = (uintptr_t)reply->data0;
data.txn.data.ptr.offsets = (uintptr_t)reply->offs0;
}
//ÏòBinderÇý¶¯Ð´ÈëÊý¾Ý
binder_write(bs, &data, sizeof(data));
}

int binder_write (struct binder_state *bs, void *data, size_t len)
{
struct binder_write_read bwr;
int res;
bwr.write_size = len;
bwr.write_consumed = 0;
bwr.write_buffer = (uintptr_t) data;
bwr.read_size = 0;
bwr.read_consumed = 0;
bwr.read_buffer = 0;
res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
if (res < 0) {
fprintf (stderr,"binder_write: ioctl failed (%s)\n",
strerror(errno));
}
return res;
}

platform/drivers/staging/android/binder.c
static int binder_thread_write (struct binder_proc *proc,
struct binder_thread *thread,
binder_uintptr_t binder_buffer, size_t size,
binder_size_t *consumed)
{
uint32_t cmd;
void __user *buffer = (void __user *) (uintptr_t)binder_buffer;
void __user *ptr = buffer + *consumed;
void __user *end = buffer + size;
while (ptr < end && thread-> return_error == BR_OK) {
if (get_user(cmd, (uint32_t __user *)ptr))
return -EFAULT;
ptr += sizeof(uint32_t);
...
switch (cmd) {
...
case BC_TRANSACTION:
case BC_REPLY: {
struct binder_transaction_data tr;
if (copy_from_user(&tr, ptr, sizeof(tr)))
return -EFAULT;
ptr += sizeof(tr);
binder_transaction(proc, thread, &tr, cmd == BC_REPLY);
break;
}
...
}

static void binder_transaction(struct binder_proc *proc,
struct binder_thread *thread,
struct binder_transaction_data *tr, int reply)
{
...
struct binder_transaction *t;
struct binder_work *tcomplete;
binder_size_t *offp, *off_end;
binder_size_t off_min;
struct binder_proc *target_proc;
struct binder_thread *target_thread = NULL;
struct binder_node *target_node = NULL;
struct list_head *target_list;
wait_queue_head_t *target_wait;
struct binder_transaction *in_reply_to = NULL;
struct binder_transaction_log_entry *e;
uint32_t return_error;
...
if (reply) {
//Ñ°ÕÒÇëÇóͨÐŵÄthread
//´Ó֮ǰµÄthreadÖÐÈ¡³öͨÐŵÄbinder_transaction_data
in_reply_to = thread->transaction_stack;
if (in_reply_to == NULL) {
...
return_error = BR_FAILED_REPLY;
goto err_empty_call_stack;
}
//»Ö¸´Ïß³ÌÓÅÏȼ¶
binder_set_nice(in_reply_to->saved_priority);
if (in_reply_to->to_thread != thread) {
...
return_error = BR_FAILED_REPLY;
in_reply_to = NULL;
goto err_bad_call_stack;
}
thread->transaction_stack = in_reply_to->to_parent;
target_thread = in_reply_to->from;
if (target_thread == NULL) {
return_error = BR_DEAD_REPLY;
goto err_dead_binder;
}
if (target_thread->transaction_stack != in_reply_to) {
...
return_error = BR_FAILED_REPLY;
in_reply_to = NULL;
target_thread = NULL;
goto err_dead_binder;
}
//Ä¿±ê½ø³Ì
target_proc = target_thread->proc;
}else{
...
}
//ÓпÕÏÐÏ߳̾ÍÊÇÓÿռäÏ̵߳ĵȴý¶ÓÁУ¬·ñÔòʹÓýø³ÌµÄ
if (target_thread) {
...
target_list = &target_thread->todo;
target_wait = &target_thread->wait;
} else {
...
}
...
//´´½¨binder_transaction½á¹¹Ì壬BINDER_WORK_TRANSACTION
t = kzalloc(sizeof(*t), GFP_KERNEL);
...
//´´½¨binder_work½á¹¹Ìå,BINDER_STAT_TRANSACTION_COMPLETE
tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL);
...
//·ÖÅäÊÂÎñtµÄÒª½øÈëÄǸöÕ»
if (reply) {
BUG_ON(t->buffer->async_transaction != 0);
//½«ÊÂÎñµ¯³ötodoÕ»
binder_pop_transaction(target_thread, in_reply_to);
} else if (!(t->flags & TF_ONE_WAY)) {
...
}else{
...
}
//½«binder_transaction_dataÖ¸ÕëtµÄÀàÐÍÐÞ¸ÄΪBINDER_WORK_TRANSACTION
t->work.type = BINDER_WORK_TRANSACTION;
//Ìí¼Óµ½target_list¶ÓÁÐβ²¿
list_add_tail(&t->work.entry, target_list);
//½«binder_workÖ¸Õëtcomplete.typeÖÃΪBINDER_WORK_TRANSACTION_COMPLETE
tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
list_add_tail(&tcomplete->entry, &thread->todo);
//ÕâÀïÓÐÁ½¸öÖ´ÐзÖÖ§
//1.´¦ÀíÀàÐÍΪBINDER_WORK_TRANSACTIONµÄbinder_transaction_data
//2.´¦ÀíÀàÐÍΪBINDER_WORK_TRANSACTION_COMPLETEµÄbinder_work
if (target_wait)
wake_up_interruptible(target_wait);
return;
...
}

static int binder_thread_read(struct binder_proc *proc,
struct binder_thread *thread,
binder_uintptr_t binder_buffer, size_t size,
binder_size_t *consumed, int non_block)
{
void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
void __user *ptr = buffer + *consumed;
void __user *end = buffer + size;
int ret = 0;
...
//Ï̻߳½ÐÑ
while (1) {
uint32_t cmd;
struct binder_transaction_data tr;
struct binder_work *w;
struct binder_transaction *t = NULL;
//¼ì²é¹¤×÷¶ÓÁУ¬²¢½«´ý´¦ÀíÏֵ¸øw
if (!list_empty(&thread->todo)) {
w = list_first_entry(&thread->todo, struct binder_work,
entry);
} else if (!list_empty(&proc->todo) && wait_for_proc_work) {
w = list_first_entry(&proc->todo, struct binder_work,
entry);
} else {
...
}
...
switch (w->type) {
case BINDER_WORK_TRANSACTION: {
t = container_of(w, struct binder_transaction, work);
} break;
...
}
//·µ»ØЭÒéµÄ´¦Àí£¬ÏÖÔÚtarget_nodeÖ¸ÏòµÄÊÇbinder_context_mgr_node
if (t->buffer->target_node) {
...
}else{
tr.target.ptr = 0;
tr.cookie = 0;
cmd = BR_REPLY;
}

//BinderÇý¶¯³ÌÐò·ÖÅä¸ø½ø³ÌµÄÄں˻º³åÇøͬʱ£¬Ó³ÉäÁËÓû§µÄÄں˵ØÖ·¡¢Óû§¿Õ¼äµØÖ·
tr.data_size = t->buffer->data_size;
tr.offsets_size = t->buffer->offsets_size;
tr.data.ptr.buffer = (binder_uintptr_t)(
(uintptr_t)t->buffer->data +
proc->user_buffer_offset);
//Ö±½Ó²Ù×÷offsets
tr.data.ptr.offsets = tr.data.ptr.buffer +
ALIGN(t->buffer->data_size,
sizeof(void *));
//Ìṩһ¸ö·µ»ØЭÒéÊý¾ÝµÄ»º³åÇø
if (put_user(cmd, (uint32_t __user *)ptr))
return -EFAULT;
ptr += sizeof(uint32_t);
if (copy_to_user(ptr, &tr, sizeof(tr)))
return -EFAULT;
ptr += sizeof(tr);
...
//cmd = BR_TRANSACTION && ²»ÊÇÕýÔÚ´¦ÀíÒ첽ͨÐÅÇëÇó
//¾ÍÐèÒªµÈ´ý¸Ãͬ²½½ø³ÌͨÐÅÍêÒÔºóÔÙ½øÐÐÏÂÒ»²½µÄ²Ù×÷
if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) {
...
} else {
t->buffer->transaction = NULL;
kfree(t);
binder_stats_deleted(BINDER_STAT_TRANSACTION);
}
break;
}
...
}

status_t IPCThreadState::waitForResponse(Parcel *reply, status_t *acquireResult)
{
uint32_t cmd;
...
while (1) {
...
cmd = (uint32_t)mIn.readInt32();
...
switch (cmd) {
case BR_REPLY:
{
binder_transaction_data tr;
err = mIn.read(&tr, sizeof(tr));
...
if (reply) {
if ((tr.flags & TF_STATUS_CODE) == 0) {
//ÖØÖÃParcel¶ÔÏóÄÚ²¿Êý¾Ý»º³åÇø£¬²¢Ö¸¶¨Êͷź¯ÊýΪfreeBuffer
reply->ipcSetDataReference(
reinterpret_cast
<const uint8_t*>(tr.data.ptr.buffer),
tr.data_size,
reinterpret_cast
<const binder_size_t*>(tr.data.ptr.offsets),
tr.offsets_size/sizeof(binder_size_t),
freeBuffer, this);
} else {
...
} else {
...
}
}
goto finish;
...
}
}
...
}