kernel/drivers/ (不同Linux分支路径略有不同)
  - staging/android/binder.c
  - android/binder.c 

static int __init binder_init(void)
{
    int ret;
    //创建名为binder的工作队列 binder_deferred_workqueue = create_singlethread_workqueue("binder"); ... binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL); if (binder_debugfs_dir_entry_root) binder_debugfs_dir_entry_proc = debugfs_create_dir("proc", binder_debugfs_dir_entry_root); // 注册misc设备【见小节2.1.1】 ret = misc_register(&binder_miscdev); if (binder_debugfs_dir_entry_root) { ... //在debugfs文件系统中创建一系列的文件 } return ret; } 

static struct miscdevice binder_miscdev = {
    .minor = MISC_DYNAMIC_MINOR, //次设备号 动态分配
    .name = "binder",     //设备名 .fops = &binder_fops //设备的文件操作结构，这是file_operations结构 }; 

static const struct file_operations binder_fops = {
    .owner = THIS_MODULE,
    .poll = binder_poll,
    .unlocked_ioctl = binder_ioctl,
    .compat_ioctl = binder_ioctl,
    .mmap = binder_mmap,
    .open = binder_open,
    .flush = binder_flush,
    .release = binder_release,
};

static int binder_open(struct inode *nodp, struct file *filp)
{
    struct binder_proc *proc; // binder进程 【见附录3.1】

    proc = kzalloc(sizeof(*proc), GFP_KERNEL); // 为binder_proc结构体在分配kernel内存空间
    if (proc == NULL) return -ENOMEM; get_task_struct(current); proc->tsk = current; //将当前线程的task保存到binder进程的tsk INIT_LIST_HEAD(&proc->todo); //初始化todo列表 init_waitqueue_head(&proc->wait); //初始化wait队列 proc->default_priority = task_nice(current); //将当前进程的nice值转换为进程优先级 binder_lock(__func__); //同步锁，因为binder支持多线程访问 binder_stats_created(BINDER_STAT_PROC); //BINDER_PROC对象创建数加1 hlist_add_head(&proc->proc_node, &binder_procs); //将proc_node节点添加到binder_procs为表头的队列 proc->pid = current->group_leader->pid; INIT_LIST_HEAD(&proc->delivered_death); //初始化已分发的死亡通知列表 filp->private_data = proc; //file文件指针的private_data变量指向binder_proc数据 binder_unlock(__func__); //释放同步锁 return 0; } 

static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
{
    int ret;
    struct vm_struct *area; //内核虚拟空间
    struct binder_proc *proc = filp->private_data;
    const char *failure_string;
    struct binder_buffer *buffer;  //【见附录3.9】

    if (proc->tsk != current) return -EINVAL; if ((vma->vm_end - vma->vm_start) > SZ_4M) vma->vm_end = vma->vm_start + SZ_4M; //保证映射内存大小不超过4M mutex_lock(&binder_mmap_lock); //同步锁 //采用IOREMAP方式，分配一个连续的内核虚拟空间，与进程虚拟空间大小一致 area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP); if (area == NULL) { ret = -ENOMEM; failure_string = "get_vm_area"; goto err_get_vm_area_failed; } proc->buffer = area->addr; //指向内核虚拟空间的地址 //地址偏移量 = 用户虚拟地址空间 - 内核虚拟地址空间 proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer; mutex_unlock(&binder_mmap_lock); //释放锁 ... //分配物理页的指针数组，数组大小为vma的等效page个数； proc->pages = kzalloc(sizeof(proc->pages[0]) * ((vma->vm_end - vma->vm_start) / PAGE_SIZE), GFP_KERNEL); if (proc->pages == NULL) { ret = -ENOMEM; failure_string = "alloc page array"; goto err_alloc_pages_failed; } proc->buffer_size = vma->vm_end - vma->vm_start; vma->vm_ops = &binder_vm_ops; vma->vm_private_data = proc; //分配物理页面，同时映射到内核空间和进程空间，先分配1个物理页 【见小节2.3.1】 if (binder_update_page_range(proc, 1, proc->buffer, proc->buffer + PAGE_SIZE, vma)) { ret = -ENOMEM; failure_string = "alloc small buf"; goto err_alloc_small_buf_failed; } buffer = proc->buffer; //binder_buffer对象 指向proc的buffer地址 INIT_LIST_HEAD(&proc->buffers); //创建进程的buffers链表头 list_add(&buffer->entry, &proc->buffers); //将binder_buffer地址 加入到所属进程的buffers队列 buffer->free = 1; //将空闲buffer放入proc->free_buffers中 binder_insert_free_buffer(proc, buffer); //异步可用空间大小为buffer总大小的一半。 proc->free_async_space = proc->buffer_size / 2; barrier(); proc->files = get_files_struct(current); proc->vma = vma; proc->vma_vm_mm = vma->vm_mm; return 0; ...// 错误flags跳转处，free释放内存之类的操作 return ret; } 

static int binder_update_page_range(struct binder_proc *proc, int allocate,
            void *start, void *end, struct vm_area_struct *vma) { void *page_addr; unsigned long user_page_addr; struct page **page; struct mm_struct *mm; // 内存结构体 if (vma) mm = NULL; //binder_mmap过程vma不为空，其他情况都为空 else mm = get_task_mm(proc->tsk); //获取mm结构体 if (mm) { down_write(&mm->mmap_sem); //获取mm_struct的写信号量 vma = proc->vma; } //此处allocate为1，代表分配过程。如果为0则代表释放过程 if (allocate == 0) goto free_range; for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) { int ret; page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; //分配一个page的物理内存 *page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO); //物理空间映射到虚拟内核空间 ret = map_kernel_range_noflush((unsigned long)page_addr, PAGE_SIZE, PAGE_KERNEL, page); flush_cache_vmap((unsigned long)page_addr, (unsigned long)page_addr + PAGE_SIZE); user_page_addr = (uintptr_t)page_addr + proc->user_buffer_offset; //物理空间映射到虚拟进程空间 ret = vm_insert_page(vma, user_page_addr, page[0]); } if (mm) { up_write(&mm->mmap_sem); //释放内存的写信号量 mmput(mm); //减少mm->mm_users计数 } return 0; free_range: ... //释放内存的流程 return -ENOMEM; } 

struct mm_struct {
  struct vm_area_struct *mmap;  //VMA列表
  struct rb_root mm_rb;
  pgd_t * pgd; atomic_t mm_users; //使用该内存的进程个数 atomic_t mm_count; //结构体mm_struct的引用个数 struct rw_semaphore mmap_sem; //读写信号量，用于同步 unsigned long flags; ... }; 

static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc,
                          size_t data_size, size_t offsets_size, int is_async)
{
    struct rb_node *n = proc->free_buffers.rb_node; struct binder_buffer *buffer; size_t buffer_size; struct rb_node *best_fit = NULL; void *has_page_addr; void *end_page_addr; size_t size; if (proc->vma == NULL) { return NULL; //虚拟地址空间为空，直接返回 } size = ALIGN(data_size, sizeof(void *)) + ALIGN(offsets_size, sizeof(void *)); if (size < data_size || size < offsets_size) { return NULL; //非法的size } if (is_async && proc->free_async_space < size + sizeof(struct binder_buffer)) { return NULL; // 剩余可用的异步空间，小于所需的大小 } while (n) { //从binder_buffer的红黑树中查找大小相等的buffer块 buffer = rb_entry(n, struct binder_buffer, rb_node); buffer_size = binder_buffer_size(proc, buffer); if (size < buffer_size) { best_fit = n; n = n->rb_left; } else if (size > buffer_size) n = n->rb_right; else { best_fit = n; break; } } if (best_fit == NULL) { return NULL; //内存分配失败，地址空间为空 } if (n == NULL) { buffer = rb_entry(best_fit, struct binder_buffer, rb_node); buffer_size = binder_buffer_size(proc, buffer); } has_page_addr =(void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK); if (n == NULL) { if (size + sizeof(struct binder_buffer) + 4 >= buffer_size) buffer_size = size; else buffer_size = size + sizeof(struct binder_buffer); } end_page_addr = (void *)PAGE_ALIGN((uintptr_t)buffer->data + buffer_size); if (end_page_addr > has_page_addr) end_page_addr = has_page_addr; if (binder_update_page_range(proc, 1, (void *)PAGE_ALIGN((uintptr_t)buffer->data), end_page_addr, NULL)) return NULL; rb_erase(best_fit, &proc->free_buffers); buffer->free = 0; binder_insert_allocated_buffer(proc, buffer); if (buffer_size != size) { struct binder_buffer *new_buffer = (void *)buffer->data + size; list_add(&new_buffer->entry, &buffer->entry); new_buffer->free = 1; binder_insert_free_buffer(proc, new_buffer); } buffer->data_size = data_size; buffer->offsets_size = offsets_size; buffer->async_transaction = is_async; if (is_async) { proc->free_async_space -= size + sizeof(struct binder_buffer); } return buffer; } 

static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) { int ret; struct binder_proc *proc = filp->private_data; struct binder_thread *thread; // binder线程 unsigned int size = _IOC_SIZE(cmd); void __user *ubuf = (void __user *)arg; //进入休眠状态，直到中断唤醒 ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); if (ret) goto err_unlocked; binder_lock(__func__); //获取binder_thread【见2.4.1】 thread = binder_get_thread(proc); if (thread == NULL) { ret = -ENOMEM; goto err; } switch (cmd) { case BINDER_WRITE_READ: //进行binder的读写操作 ret = binder_ioctl_write_read(filp, cmd, arg, thread); //【见2.4.2】 if (ret) goto err; break; case BINDER_SET_MAX_THREADS: //设置binder最大支持的线程数 if (copy_from_user(&proc->max_threads, ubuf, sizeof(proc->max_threads))) { ret = -EINVAL; goto err; } break; case BINDER_SET_CONTEXT_MGR: //成为binder的上下文管理者，也就是ServiceManager成为守护进程 ret = binder_ioctl_set_ctx_mgr(filp); if (ret) goto err; break; case BINDER_THREAD_EXIT: //当binder线程退出，释放binder线程 binder_free_thread(proc, thread); thread = NULL; break; case BINDER_VERSION: { //获取binder的版本号 struct binder_version __user *ver = ubuf; if (size != sizeof(struct binder_version)) { ret = -EINVAL; goto err; } if (put_user(BINDER_CURRENT_PROTOCOL_VERSION, &ver->protocol_version)) { ret = -EINVAL; goto err; } break; } default: ret = -EINVAL; goto err; } ret = 0; err: if (thread) thread->looper &= ~BINDER_LOOPER_STATE_NEED_RETURN; binder_unlock(__func__); wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); err_unlocked: trace_binder_ioctl_done(ret); return ret; } 

static struct binder_thread *binder_get_thread(struct binder_proc *proc)
{
    struct binder_thread *thread = NULL;
    struct rb_node *parent = NULL;
    struct rb_node **p = &proc->threads.rb_node;
    while (*p) { //根据当前进程的pid，从binder_proc中查找相应的binder_thread parent = *p; thread = rb_entry(parent, struct binder_thread, rb_node); if (current->pid < thread->pid) p = &(*p)->rb_left; else if (current->pid > thread->pid) p = &(*p)->rb_right; else break; } if (*p == NULL) { thread = kzalloc(sizeof(*thread), GFP_KERNEL); //新建binder_thread结构体 if (thread == NULL) return NULL; binder_stats_created(BINDER_STAT_THREAD); thread->proc = proc; thread->pid = current->pid; //保存当前进程(线程)的pid init_waitqueue_head(&thread->wait); INIT_LIST_HEAD(&thread->todo); rb_link_node(&thread->rb_node, parent, p); rb_insert_color(&thread->rb_node, &proc->threads); thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; thread->return_error = BR_OK; thread->return_error2 = BR_OK; } return thread; } 

static int binder_ioctl_write_read(struct file *filp,
                unsigned int cmd, unsigned long arg, struct binder_thread *thread) { int ret = 0; struct binder_proc *proc = filp->private_data; unsigned int size = _IOC_SIZE(cmd); void __user *ubuf = (void __user *)arg; struct binder_write_read bwr; if (size != sizeof(struct binder_write_read)) { ret = -EINVAL; goto out; } if (copy_from_user(&bwr, ubuf, sizeof(bwr))) { //把用户空间数据ubuf拷贝到bwr ret = -EFAULT; goto out; } if (bwr.write_size > 0) { //当写缓存中有数据，则执行binder写操作 ret = binder_thread_write(proc, thread, bwr.write_buffer, bwr.write_size, &bwr.write_consumed); trace_binder_write_done(ret); if (ret < 0) { //当写失败，再将bwr数据写回用户空间，并返回 bwr.read_consumed = 0; if (copy_to_user(ubuf, &bwr, sizeof(bwr))) ret = -EFAULT; goto out; } } if (bwr.read_size > 0) { //当读缓存中有数据，则执行binder读操作 ret = binder_thread_read(proc, thread, bwr.read_buffer, bwr.read_size, &bwr.read_consumed, filp->f_flags & O_NONBLOCK); trace_binder_read_done(ret); if (!list_empty(&proc->todo)) wake_up_interruptible(&proc->wait); //唤醒等待状态的线程 if (ret < 0) { //当读失败，再将bwr数据写回用户空间，并返回 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) ret = -EFAULT; goto out; } } if (copy_to_user(ubuf, &bwr, sizeof(bwr))) { //将内核数据bwr拷贝到用户空间ubuf ret = -EFAULT; goto out; } out: return ret; } 

enum {
    BINDER_LOOPER_STATE_REGISTERED  = 0x01, // 创建注册线程BC_REGISTER_LOOPER
    BINDER_LOOPER_STATE_ENTERED     = 0x02, // 创建主线程BC_ENTER_LOOPER BINDER_LOOPER_STATE_EXITED = 0x04, // 已退出 BINDER_LOOPER_STATE_INVALID = 0x08, // 非法 BINDER_LOOPER_STATE_WAITING = 0x10, // 等待中 BINDER_LOOPER_STATE_NEED_RETURN = 0x20, // 需要返回 }; 

union {
        struct rb_node rb_node;
        struct hlist_node dead_node;
    };

struct binder_ref_death {
    struct binder_work work;
    binder_uintptr_t cookie;
};

struct binder_transaction_data {
    union {
        __u32    handle;       //binder_ref（即handle）
        binder_uintptr_t ptr;     //Binder_node的内存地址 } target; //RPC目标 binder_uintptr_t cookie; //BBinder指针 __u32 code; //RPC代码，代表Client与Server双方约定的命令码 __u32 flags; //标志位，比如TF_ONE_WAY代表异步，即不等待Server端回复 pid_t sender_pid; //发送端进程的pid uid_t sender_euid; //发送端进程的uid binder_size_t data_size; //data数据的总大小 binder_size_t offsets_size; //IPC对象的大小 union { struct { binder_uintptr_t buffer; //数据区起始地址 binder_uintptr_t offsets; //数据区IPC对象偏移量 } ptr; __u8 buf[8]; } data; //RPC数据 }; 

struct binder_work {
    struct list_head entry;
    enum {
        BINDER_WORK_TRANSACTION = 1, BINDER_WORK_TRANSACTION_COMPLETE, BINDER_WORK_NODE, BINDER_WORK_DEAD_BINDER, BINDER_WORK_DEAD_BINDER_AND_CLEAR, BINDER_WORK_CLEAR_DEATH_NOTIFICATION, } type; };