想掌握Android面试官必问的 Binder 机制？那别想绕开 Binder 驱动源码分析！

ProcessState::ProcessState()
    : mDriverFD(open_driver()) //打开 binder 设备，binder_open()
    , mVMStart(MAP_FAILED)
    ...
    , mMaxThreads(DEFAULT_MAX_binder_THREADS)
    , mThreadPoolSeq(1){
       if (mDriverFD >= 0) {
           // 将应用进程虚拟内存空间与 binder 驱动映射，binder_mmap()
           mVMStart = mmap(0, binder_VM_SIZE, PROT_READ,
                            MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
           if (mVMStart == MAP_FAILED) {
               close(mDriverFD);
               mDriverFD = -1;
           }
       }
}

// binder_ioctl
ioctl(mProcess->mDriverFD, binder_WRITE_READ, &bwr)

//drivers/staging/android/Binder.c
static init __init binder_init(void){
    ...
    ret = misc_register(&binder_miscdev); //注册为 misc 驱动
}

static struct miscdevice binder_miscdev = {
    .minor = MISC_DYNAMIC_MINOR, //自动分配次设备号
    .name = "binder", //驱动名称
    .fops = &binder_fops //binder 驱动支持的文件操作
}

static const struct file_operations binder_fops = {
    .owner = THIS_MODULE,
    .poll = binder_poll,
    .unlocked_ioctl = binder_ioctl,
    .mmap = binder_mmap,
    .open = binder_open,
    .flush = binder_flush,
    .release = binder_release,
};

//binder.c
static int binder_open(struct inode *nodp, struct file *filp)
{
    struct binder_proc *proc;
    ...
    proc = kzalloc(sizeof(*proc), GFP_KERNEL); //创建 binder_proc
    if (proc == NULL)
        return -ENOMEM;
    get_task_struct(current);
    proc->tsk = current;
    INIT_LIST_HEAD(&proc->todo); //初始化 todo 队列
    init_waitqueue_head(&proc->wait); //初始化 todo 队列
    proc->default_priority = task_nice(current);

    binder_lock(__func__);
    binder_stats_created(BINDER_STAT_PROC);
    hlist_add_head(&proc->proc_node, &binder_procs);
    proc->pid = current->group_leader->pid;
    INIT_LIST_HEAD(&proc->delivered_death);
    filp->private_data = proc;
    binder_unlock(__func__);
    ...
}

static int binder_mmap(struct file *filp, struct vm_area_struct *vma){
    struct vm_struct *area;
    struct binder_proc *proc = filp->private_data;
    const char *failure_string;
    struct binder_buffer *buffer;
    //映射空间至多 4M
    if ((vma->vm_end - vma->vm_start) > SZ_4M)
          vma->vm_end = vma->vm_start + SZ_4M;
    //检查 vma 是否被禁用
    if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) {
          ret = -EPERM;
          failure_string = "bad vm_flags";
          goto err_bad_arg;
    }

     mutex_lock(&binder_mmap_lock);
    //检查是否已执行过 binder_mmap 映射过
    if (proc->buffer) {
          ret = -EBUSY;
          failure_string = "already mapped";
          goto err_already_mapped;
    }
    //申请内核虚拟内存地址空间
    area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP);
    if (area == NULL) {
          ret = -ENOMEM;
          failure_string = "get_vm_area";
          goto err_get_vm_area_failed;
    }
    //将内核虚拟内存地址记录在 proc 中
    proc->buffer = area->addr;
    //记录用户态虚拟内存地址和内核态虚拟内存地址的偏移量
    proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer;
    mutex_unlock(&binder_mmap_lock);

    //分配存放物理页地址的数组
    proc->pages = kzalloc(sizeof(proc->pages[0]) * ((vma->vm_end - vma->vm_start) / PAGE_SIZE), GFP_KERNEL);
    proc->buffer_size = vma->vm_end - vma->vm_start;
    //申请一页物理内存
    if (binder_update_page_range(proc, 1, proc->buffer, proc->buffer + PAGE_SIZE, vma)) {
          ret = -ENOMEM;
          failure_string = "alloc small buf";
          goto err_alloc_small_buf_failed;
    }
    //最后的收尾工作：将内存记录到相应链表中，设置状态等
    INIT_LIST_HEAD(&proc->buffers);
    list_add(&buffer->entry, &proc->buffers);
    buffer->free = 1;
    binder_insert_free_buffer(proc, buffer);
    proc->free_async_space = proc->buffer_size / 2;
    proc->files = get_files_struct(current);
    proc->vma = vma;

static int binder_update_page_range(struct binder_proc *proc, int allocate,
                    void *start, void *end,
                    struct vm_area_struct *vma){
    if (allocate == 0)  //区分是申请还是释放
         goto free_range;
    //依据 start、end 循环分配物理页
    for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) {
          //每次分配 1 个页框*/
         *page = **alloc_page**(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO);
         //将页框映射到内核态虚拟内存地址
         ret = **map_kernel_range_noflush**((unsigned long)page_addr, PAGE_SIZE, PAGE_KERNEL, page);
         //根据 binder_mmap 方法中记录的偏移量计算出用户态虚拟内存地址
         user_page_addr = (uintptr_t)page_addr + proc->user_buffer_offset;
         //将页框映射到用户态虚拟内存地址
         ret = vm_insert_page(vma, user_page_addr, page[0]);
     }
     return 0;

free_range:
    //依据 start、end 从后往前遍历
    for (page_addr = end - PAGE_SIZE; page_addr >= start; page_addr -= PAGE_SIZE) {
        page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE];
        if (vma)
            //解除用户态虚拟地址和物理页框的映射
            zap_page_range(vma, (uintptr_t)page_addr + proc->user_buffer_offset, PAGE_SIZE, NULL);
err_vm_insert_page_failed:
        //解除内核态虚拟地址和物理页框的映射
        unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE);
err_map_kernel_failed:
        //释放页框物理内存
        __free_page(*page);
        *page = NULL;
}