int goodbye_service_handler(struct binder_state *bs,

                   struct binder_transaction_data *txn,

                   struct binder_io *msg,

                   struct binder_io *reply)

{

    /* 根据txn->code知道要调用哪一个函数

     * 如果需要参数, 可以从msg取出

     * 如果要返回结果, 可以把结果放入reply

     */

    /* saygoodbye

     * saygoodbye_to

     */

    uint16_t *s;

    char name[];

    size_t len;

    uint32_t handle;

    uint32_t strict_policy;

    int i;

    // Equivalent to Parcel::enforceInterface(), reading the RPC

    // header with the strict mode policy mask and the interface name.

    // Note that we ignore the strict_policy and don't propagate it

    // further (since we do no outbound RPCs anyway).

    strict_policy = bio_get_uint32(msg);

    switch(txn->code) {

    case GOODBYE_SVR_CMD_SAYGOODBYE:

        saygoodbye();

        bio_put_uint32(reply, ); /* no exception */

        return ;

    case GOODBYE_SVR_CMD_SAYGOODBYE_TO:

        /* 从msg里取出字符串（16位转8位） */

        s = bio_get_string16(msg, &len);  //"IGoodbyeService"

        s = bio_get_string16(msg, &len);  // name

        if (s == NULL) {

            return -;

        }

        for (i = ; i < len; i++)

            name[i] = s[i];

        name[i] = '\0';

        /* 处理 */

        i = saygoodbye_to(name);

        /* 把结果放入reply */

        bio_put_uint32(reply, ); /* no exception */

        bio_put_uint32(reply, i);

        break;

    default:

        fprintf(stderr, "unknown code %d\n", txn->code);

        return -;

    }

    return ;

}

    /* add service */

    ret = svcmgr_publish(bs, svcmgr, "hello", hello_service_handler);

    if (ret) {

        fprintf(stderr, "failed to publish hello service\n");

        return -;

    }

    ret = svcmgr_publish(bs, svcmgr, "goodbye", goodbye_service_handler);

    if (ret) {

        fprintf(stderr, "failed to publish goodbye service\n");

    }

......

　　

　　 binder_loop(bs, test_server_handler); //通过函数test_server_handler处理消息

int test_server_handler(struct binder_state *bs,

                   struct binder_transaction_data *txn,

                   struct binder_io *msg,

                   struct binder_io *reply)

{

    int (*handler)(struct binder_state *bs,

                   struct binder_transaction_data *txn,

                   struct binder_io *msg,

                   struct binder_io *reply);

    handler = (int (*)(struct binder_state *bs,

                   struct binder_transaction_data *txn,

                   struct binder_io *msg,

                   struct binder_io *reply))txn->target.ptr;

    return handler(bs, txn, msg, reply); // 根据txn->target.ptr转换成对应的处理函数

}

    /* get service */

    handle = svcmgr_lookup(bs, svcmgr, "goodbye");

    if (!handle) {

        fprintf(stderr, "failed to get goodbye service\n");

        return -;

    }

    g_goodbye_handle = handle;

    fprintf(stderr, "Handle for goodbye service = %d\n", g_goodbye_handle);

/* use service */

void saygoodbye(void)

{

    unsigned iodata[/];

    struct binder_io msg, reply;

    /* 构造binder_io */

    bio_init(&msg, iodata, sizeof(iodata), );

    bio_put_uint32(&msg, );  // strict mode header

    bio_put_string16_x(&msg, "IGoodbyeService");

    /* 放入参数 */

    /* 调用binder_call */

    if (binder_call(g_bs, &msg, &reply, g_goodbye_handle, GOODBYE_SVR_CMD_SAYGOODBYE))

        return ;

    /* 从reply中解析出返回值 */

    binder_done(g_bs, &msg, &reply);

}

    if (binder_call(g_bs, &msg, &reply, g_goodbye_handle, GOODBYE_SVR_CMD_SAYGOODBYE))

        return ;

/*

*@msg：提供的参数

*@reply：返回的数据

*@target：发送数据的目标（服务的引用）

*@code：调用函数

*/

int binder_call(struct binder_state *bs,

                struct binder_io *msg, struct binder_io *reply,

                uint32_t target, uint32_t code)

struct binder_ref {

    int debug_id;

    struct rb_node rb_node_desc;

    struct rb_node rb_node_node;

    struct hlist_node node_entry;

    struct binder_proc *proc;

    struct binder_node *node;

    uint32_t desc;

    int strong;

    int weak;

    struct binder_ref_death *death;

};

res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);

    struct {

        uint32_t cmd;  //头4个字节表示数据类型

        struct binder_transaction_data txn;

    } __attribute__((packed)) writebuf;

 ./service_manager &

[   32.566620] service_manager (, ), binder_thread_write : BC_ENTER_LOOPER

[   32.566712] service_manager (, ), binder_thread_read : BR_NOOP

（开始休眠，等待别的进程注册服务...）

./test_server &

[   38.320197] test_server (, ), binder_thread_write : BC_TRANSACTION

[   38.320284] binder: : BC_TRANSACTION  ->  - node , data beca6a5c-beca6a4c size -

[   38.320383] test_server (, ), binder_transaction , print data :

[   38.320454] :  .  .  .  . 1a .  .  .  .  a  . 6e n  .  d  .  r  .

[   38.329064] : 6f o  .  i  .  d  . 2e .  . 6f o  .  s  . 2e .  .  I  .

[   38.337917] :  S  .  e  .  r  .  v  .  i  .  c  .  e  . 4d M  .

[   38.346771] :  a  . 6e n  .  a  .  g  .  e  .  r  .  .  .  .  .

[   38.355646] :  .  .  .  .  h  .  e  . 6c l  . 6c l  . 6f o  .  .  .

[   38.364475] :  . 2a *  b  s 7f .  .  .  . e0 .  .  .  .  .  .  .  .

[   38.373350] test_server (, ), binder_thread_read : BR_NOOP

[   38.379521] service_manager (, ), binder_thread_read : BR_TRANSACTION

[   38.386633] service_manager (, ), binder_thread_read , print data :

[   38.393567] :  .  .  .  . 1a .  .  .  .  a  . 6e n  .  d  .  r  .

[   38.402410] : 6f o  .  i  .  d  . 2e .  . 6f o  .  s  . 2e .  .  I  .

[   38.411263] :  S  .  e  .  r  .  v  .  i  .  c  .  e  . 4d M  .

[   38.420127] :  a  . 6e n  .  a  .  g  .  e  .  r  .  .  .  .  .

[   38.428971] :  .  .  .  .  h  .  e  . 6c l  . 6c l  . 6f o  .  .  .

[   38.437824] :  . 2a *  h  s 7f .  .  .  .  .  .  .  .  .  .  .  .

[   38.447188] test_server (, ), binder_thread_read : BR_INCREFS

[   38.453114] test_server (, ), binder_thread_read : BR_ACQUIRE

[   38.459748] test_server (, ), binder_thread_read : BR_TRANSACTION_COMPLETE

[   38.467270] service_manager (, ), binder_thread_write : BC_ACQUIRE

[   38.474004] test_server (, ), binder_thread_read : BR_NOOP

[   38.480122] service_manager (, ), binder_thread_write : BC_REQUEST_DEATH_NOTIFICATION

[   38.488626] service_manager (, ), binder_thread_write : BC_FREE_BUFFER

[   38.495828] service_manager (, ), binder_thread_write : BC_REPLY

[   38.502538] binder: : BC_REPLY  -> :, data bed9fa4c-bed9fa3c size -

[   38.510404] service_manager (, ), binder_transaction , print data :

[   38.517345] :  .  .  .  .

[   38.520994] test_server (, ), binder_thread_read : BR_REPLY

[   38.527250] test_server (, ), binder_thread_read , print data :

[   38.540003] :  .  .  .  .

[   38.543642] service_manager (, ), binder_thread_read : BR_NOOP

[   38.550253] test_server (, ), binder_thread_write : BC_FREE_BUFFER

[   38.557063] service_manager (, ), binder_thread_read : BR_TRANSACTION_COMPLETE

[   38.566481] service_manager (, ), binder_thread_read : BR_NOOP

[   38.571459] test_server (, ), binder_thread_write : BC_ENTER_LOOPER

[   38.578368] test_server (, ), binder_thread_read : BR_NOOP

svcmgr: add_service('hello'), handle = 

struct binder_node {

    int debug_id;              //kernel内部标识node的id

    struct binder_work work;

    union {

        struct rb_node rb_node;

        struct hlist_node dead_node;

    };

    struct binder_proc *proc;  //Service所在进程的结构体

    struct hlist_head refs;    //双向链表头，链表里存放一系列指针，指向引用该Service的binder_ref对象，

    int internal_strong_refs;  //内部强引用计数

    int local_weak_refs;       //弱引用计数

    int local_strong_refs;     //强引用计数

    binder_ptr __user ptr;     //Service对象地址

    binder_ptr __user cookie;

    unsigned has_strong_ref:1;

    unsigned pending_strong_ref:1;

    unsigned has_weak_ref:1;

    unsigned pending_weak_ref:1;

    unsigned has_async_transaction:1;

    unsigned accept_fds:1;

    unsigned min_priority:8;

    struct list_head async_todo;

};

struct binder_ref {

    /* Lookups needed: */

    /*   node + proc => ref (transaction) */

    /*   desc + proc => ref (transaction, inc/dec ref) */

    /*   node => refs + procs (proc exit) */

    int debug_id;

    struct rb_node rb_node_desc;

    struct rb_node rb_node_node;

    struct hlist_node node_entry;

    struct binder_proc *proc;           //应用进程

    struct binder_node *node;

    uint32_t desc;

    int strong;

    int weak;

    struct binder_ref_death *death;  //如果不为空，则client想获知binder的死亡

};

struct binder_proc {

    struct hlist_node proc_node; //全局链表 binder_procs 的node之一

    struct rb_root threads; //binder_thread红黑树，存放指针，指向进程所有的binder_thread, 用于Server端

    struct rb_root nodes;   //binder_node红黑树，存放指针，指向进程所有的binder 对象

    struct rb_root refs_by_desc; //binder_ref 红黑树，根据desc(service No) 查找对应的引用

    struct rb_root refs_by_node; //binder_ref 红黑树，根据binder_node 指针查找对应的引用

    int pid;

    struct vm_area_struct *vma;

    struct mm_struct *vma_vm_mm;

    struct task_struct *tsk;

    struct files_struct *files;

    struct hlist_node deferred_work_node;

    int deferred_work;

    void *buffer;

    ptrdiff_t user_buffer_offset;

    struct list_head buffers;

    struct rb_root free_buffers;

    struct rb_root allocated_buffers;

    size_t free_async_space;

    struct page **pages;

    size_t buffer_size;

    uint32_t buffer_free;

    struct list_head todo; //task_list, binder_work链表，存放指针最终指向某个binder_transaction对象

    wait_queue_head_t wait;

    struct binder_stats stats;

    struct list_head delivered_death;

    int max_threads;

    int requested_threads;

    int requested_threads_started;

    int ready_threads;

    long default_priority;

    struct dentry *debugfs_entry;

};

struct binder_transaction {

    int debug_id;             //一个全局唯一的ID

    struct binder_work work; // 用于存放在todo链表里

    struct binder_thread *from; //transaction 发起的线程。如果BC_TRANSACTION, 则为客户端线程，如果是BC_REPLY, 则为服务端线程。

    struct binder_transaction *from_parent; //上一个binder_transaction. 用于client端

    struct binder_proc *to_proc; //目标进程

    struct binder_thread *to_thread; //目标线程

    struct binder_transaction *to_parent; //上一个binder_transaction, 用于server端

    unsigned need_reply:1;

    /* unsigned is_dead:1; */    /* not used at the moment */

    struct binder_buffer *buffer;

    unsigned int    code;

    unsigned int    flags;

    long    priority;

    long    saved_priority;

    kuid_t    sender_euid;

};

struct binder_thread {

    struct binder_proc *proc;

    struct rb_node rb_node; //红黑树节点

    int pid;

    int looper;  //

    struct binder_transaction *transaction_stack; //transaction栈

    struct list_head todo;

    uint32_t return_error;

    uint32_t return_error2;

    wait_queue_head_t wait; //等待队列，用于阻塞等待

    struct binder_stats stats;

};

struct binder_ref_death {

    struct binder_work work;

    binder_ptr __user cookie;

};

struct binder_work {

    struct list_head entry;

    enum {

        BINDER_WORK_TRANSACTION = 1,

        BINDER_WORK_TRANSACTION_COMPLETE,

        BINDER_WORK_NODE,

        BINDER_WORK_DEAD_BINDER,

        BINDER_WORK_DEAD_BINDER_AND_CLEAR,

        BINDER_WORK_CLEAR_DEATH_NOTIFICATION,

    } type;

};

struct flat_binder_object {

 unsigned long type;  //见下面定义

 unsigned long flags;

 union {

 void *binder;            //BBinder，通过它driver可以找到对应的node

 signed long handle; //BpBinder，根据它driver可以找到对应的ref

 };

 void *cookie;

};

enum {

 BINDER_TYPE_BINDER = B_PACK_CHARS('s', 'b', '*', B_TYPE_LARGE),

 BINDER_TYPE_WEAK_BINDER = B_PACK_CHARS('w', 'b', '*', B_TYPE_LARGE),

 BINDER_TYPE_HANDLE = B_PACK_CHARS('s', 'h', '*', B_TYPE_LARGE),

 BINDER_TYPE_WEAK_HANDLE = B_PACK_CHARS('w', 'h', '*', B_TYPE_LARGE),

 BINDER_TYPE_FD = B_PACK_CHARS('f', 'd', '*', B_TYPE_LARGE),

};