android binder代码细节剖析（Binder驱动中的基本结构体）

  参见： http://m.oschina.net/blog/152233
  现代操作系统中，一个进程的地址空间是确定的，地址没有二义性：进程里的一个指针就对应一个内存地址，不可能同事对应到多个地址。但跨进程的情形下，事情就不一样了，不同进程的线性地址空间都是一样的，一个进程里的指针放到另一个进程里，就是完全不同的东西。要实现跨进程的指针，就必须通过操作系统层，只有在系统底层才能将一个进程里的地址映射到另一个进程里的地址，这也就是Binder驱动所做的事情。
  
  参见这里，非常详细：https://code.google.com/p/sunwayconf/source/browse/trunk/.elisp/dotemacs/org/main.org?r=341
  binder_node stands for a server-side binder stub, while binder_ref stands for a client-side binder proxy.
  
  1. struct binder_node: 驱动里用“进程”和“进程中的指针”两个参数唯一代表一个Binder实体，Binder驱动中用struct binder_node结构指向Binder实体
struct binder_node {
	int debug_id;
	struct binder_work work;
	union {
		struct rb_node rb_node;
		struct hlist_node dead_node;
	};
	struct binder_proc *proc;	//binder_proc that the binder_node is in
	struct hlist_head refs;
	int internal_strong_refs;
	int local_weak_refs;
	int local_strong_refs;
	binder_uintptr_t ptr;
	binder_uintptr_t cookie;	//the *user-mode* address of the corresponding BBinder object
	unsigned has_strong_ref:1;
	unsigned pending_strong_ref:1;
	unsigned has_weak_ref:1;
	unsigned pending_weak_ref:1;
	unsigned has_async_transaction:1;
	unsigned accept_fds:1;
	unsigned min_priority:8;
	struct list_head async_todo;
};
  
  2. struct binder_ref: Binder驱动中用struct binder_ref结构体表示在远程进程中的Binder
  			binder_ref stands for a BpBinder.
struct binder_ref {
	/* Lookups needed: */
	/*   node + proc => ref (transaction) */
	/*   desc + proc => ref (transaction, inc/dec ref) */
	/*   node => refs + procs (proc exit) */
	int debug_id;
	struct rb_node rb_node_desc;
	struct rb_node rb_node_node;
	struct hlist_node node_entry;
	struct binder_proc *proc;	//the binder_proc that the binder_ref resides
	struct binder_node *node;	//the binder_node that the binder_ref 'refers'
	uint32_t desc;	//the desc/handle of the binder_ref
	int strong;
	int weak;
	struct binder_ref_death *death;
};
  
  3. struct binder_proc: 	binder_proc is the top-most structure in binder driver, it represents a user process interacting with the driver, every process, both for the sender & receiver, will have one and only one corresponding binder_proc struct in the binder driver.
  			进程在调用binder_open()之后将会在驱动中各有一个binder_proc结构体与之对应
  			
struct binder_proc {
	struct hlist_node proc_node;
	struct rb_root threads;		//all the binder_thread in the process
	struct rb_root nodes;		//all the binder_node registered in the process
	
	//used to find binder_ref according to ref.desc/binder_node
	struct rb_root refs_by_desc;
	struct rb_root refs_by_node;
	
	int pid;
	struct vm_area_struct *vma;
	struct mm_struct *vma_vm_mm;
	struct task_struct *tsk;
	struct files_struct *files;
	struct hlist_node deferred_work_node;
	int deferred_work;
	void *buffer;
	ptrdiff_t user_buffer_offset;

	//buffers & free_buffers & allocated_buffers: memory used for transaction_data to hold request/reply data
	struct list_head buffers;
	struct rb_root free_buffers;
	struct rb_root allocated_buffers;
	size_t free_async_space;

	struct page **pages;
	size_t buffer_size;
	uint32_t buffer_free;
	struct list_head todo;
	wait_queue_head_t wait;
	struct binder_stats stats;
	struct list_head delivered_death;
	int max_threads;
	int requested_threads;
	int requested_threads_started;
	int ready_threads;
	long default_priority;
	struct dentry *debugfs_entry;
};