一. 概述

众所周知AIDL并不是所有的数据类型都可以传输。

可以传输的类型包括：

1.原生类型 2.String 3. CharSequence 4. List 5.Map 6. Binder 7. Parcelable

容器类 parcelable传输的时候会分解成成员，数组item的方式，传输完成后再进行组装。那Binder类数据是怎么传输的呢？

二. 接口定义

interface IMyAidlInterface {

    void testBinder(IBinder binderData);
}

public interface IMyAidlInterface extends android.os.IInterface{

        private static class Proxy implements com.zxx.sample.IMyAidlInterface{
 
            public void testBinder(android.os.IBinder binderData) throws             android.os.RemoteException
              {
                android.os.Parcel _data = android.os.Parcel.obtain();
                android.os.Parcel _reply = android.os.Parcel.obtain();
                try {
                  _data.writeInterfaceToken(DESCRIPTOR);
                  _data.writeStrongBinder(binderData);
                  boolean _status = mRemote.transact(Stub.TRANSACTION_testBinder, _data, _reply, 0);
                  _reply.readException();
                }
                finally {
                  _reply.recycle();
                  _data.recycle();
                }
              }
        }

}

 三. 数据传输流程

总结：通过aidl传递binder对象的时候，binder对象会被包装成flat_binder_object对象然后序列化到parcel类中，当调用IPCThreadState::transact后数据会被写入到binder_transaction_data中，随后调用IPCThreadState::talkwithdriver，binder_transaction_data被写入到binder_write_read后发送到binder驱动

四. binder层数据传输

拿到传输的数据后会依次读取出传输的binder对象，并进行转换如果是bbinder对象（BINDER_TYPE_BINDER），则转换成bpbinder

binder.c

static void binder_transaction(struct binder_proc *proc,
			       struct binder_thread *thread,
			       struct binder_transaction_data *tr, int reply,
			       binder_size_t extra_buffers_size){
.
.
.	
for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
	     buffer_offset += sizeof(binder_size_t)) {
		struct binder_object_header *hdr;
		size_t object_size;
		struct binder_object object;
		binder_size_t object_offset;
		binder_size_t copy_size;


.
.
.
hdr = &object.hdr;
		off_min = object_offset + object_size;
		switch (hdr->type) {
		case BINDER_TYPE_BINDER:
		case BINDER_TYPE_WEAK_BINDER: {
			struct flat_binder_object *fp;

			fp = to_flat_binder_object(hdr);
			ret = binder_translate_binder(fp, t, thread);
        ...
		case BINDER_TYPE_HANDLE:
		case BINDER_TYPE_WEAK_HANDLE: {
			struct flat_binder_object *fp;

			fp = to_flat_binder_object(hdr);
			ret = binder_translate_handle(fp, t, thread);
			if (ret < 0 ||
       ...

}

binder_translate_binder会调用到 binder_get_ref_for_node_olocked，如果binder没有对应的binder_ref节点则会 在红黑树（根据desc排序）分配一个空闲的节点（如果有的话，如果没有则插入到红黑树的尾端）并分配值给desc，这个desc就是我们在framework层获取到的bpBinder的handle值

binder.c

static struct binder_ref *binder_get_ref_for_node_olocked(
					struct binder_proc *proc,
					struct binder_node *node,
					struct binder_ref *new_ref)	
{

    .
    .
    .
    new_ref->data.desc = (node == context->binder_context_mgr_node) ? 0 : 1;
	for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) {
		ref = rb_entry(n, struct binder_ref, rb_node_desc);
		if (ref->data.desc > new_ref->data.desc)
			break;
		new_ref->data.desc = ref->data.desc + 1;
	}

}