一、簡介

用戶空間中 binder_open(), binder_mmap(), binder_ioctl() 這些方法通過 system call 來調(diào)用內(nèi)核空間 Binder 驅(qū)動中的方法。內(nèi)核空間與用戶空間共享內(nèi)存通過 copy_from_user(), copy_to_user() 內(nèi)核方法來完成用戶空間與內(nèi)核空間內(nèi)存的數(shù)據(jù)傳輸。 Binder驅(qū)動中有一個全局的 binder_procs 鏈表保存了服務端的進程信息。

1.1、用戶空間/內(nèi)核空間

Kernel space 是 Linux 內(nèi)核的運行空間，User space 是用戶程序的運行空間。為了安全，它們是隔離的，即使用戶的程序崩潰了，內(nèi)核也不受影響。
Kernel space 可以執(zhí)行任意命令，調(diào)用系統(tǒng)的一切資源； User space 只能執(zhí)行簡單的運算，不能直接調(diào)用系統(tǒng)資源，必須通過系統(tǒng)接口（又稱 system call），才能向內(nèi)核發(fā)出指令。

二、binder_init

Kconfig 配置文件

menu "Android"

config ANDROID
    bool "Android Drivers"
    ---help---
      Enable support for various drivers needed on the Android platform

if ANDROID

config ANDROID_BINDER_IPC
    bool "Android Binder IPC Driver"
    depends on MMU
    default n
    ---help---
      Binder is used in Android for both communication between processes,
      and remote method invocation.

      This means one Android process can call a method/routine in another
      Android process, using Binder to identify, invoke and pass arguments
      between said processes.

//binder 配置信息 
config ANDROID_BINDER_DEVICES
    string "Android Binder devices"
    depends on ANDROID_BINDER_IPC
    default "binder"
    ---help---
      Default value for the binder.devices parameter.

      The binder.devices parameter is a comma-separated list of strings
      that specifies the names of the binder device nodes that will be
      created. Each binder device has its own context manager, and is
      therefore logically separated from the other devices.

config ANDROID_BINDER_IPC_32BIT
    bool
    depends on !64BIT && ANDROID_BINDER_IPC
    default y
    ---help---
      The Binder API has been changed to support both 32 and 64bit
      applications in a mixed environment.

      Enable this to support an old 32-bit Android user-space (v4.4 and
      earlier).

      Note that enabling this will break newer Android user-space.

endif # if ANDROID

endmenu

kernel/drivers/staging/android/binder.c

//結(jié)構(gòu)體中記錄把 native層的方法對應驅(qū)動層的方法
static const struct file_operations binder_fops = {
        //native層 <==> 驅(qū)動層
    .owner = THIS_MODULE,
    .poll = binder_poll,
    .unlocked_ioctl = binder_ioctl,
    .compat_ioctl = binder_ioctl,
    .mmap = binder_mmap,
    .open = binder_open,
    .flush = binder_flush,
    .release = binder_release,
};

static int __init init_binder_device(const char *name){
    int ret;
    struct binder_device *binder_device;
    //為binder設備分配內(nèi)存
    binder_device = kzalloc(sizeof(*binder_device), GFP_KERNEL);
    //初始化設備
    // 設備的文件操作結(jié)構(gòu)，這是file_operations結(jié)構(gòu)
    binder_device->miscdev.fops = &binder_fops; 
    // 次設備號 動態(tài)分配
    binder_device->miscdev.minor = MISC_DYNAMIC_MINOR; 
    // 設備名,"binder"
    binder_device->miscdev.name = name; 
    //INVALID_UID是無效的，主要保存AMS傳過來的 UID
    binder_device->context.binder_context_mgr_uid = INVALID_UID;
    binder_device->context.name = name;
    //misc驅(qū)動注冊
    ret = misc_register(&binder_device->miscdev);
    //將hlist節(jié)點添加到binder_devices為表頭的設備鏈表
    hlist_add_head(&binder_device->hlist, &binder_devices);
    return ret;
}