Minibinder：自己动手写一个极简binder

1
2
3

#include <sys/mman.h>

void *mmap(void *addr, size_t len, int prot, int flags, int fd, off_t off);

1
2
3
4
5
6

struct binder_state *binder_open(const char* driver, size_t mapsize) {
    struct binder_state *bs;

    //省略一些代码
    bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);
    //省略一些代码

1
2

int main(int argc , char *argv[]) {
    struct binder_state *bs = binder_open(DRIVER, MMAP_LENGTH);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

struct binder_state *binder_open(const char* driver, size_t mapsize) {
    struct binder_state *bs;

    bs = malloc(sizeof(*bs));
    // 省略异常处理

    bs->fd = open(driver, O_RDWR | O_CLOEXEC);
    // 省略异常处理

    bs->mapsize = mapsize;
    bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);
    // 省略异常处理

    return bs;
//省略一些异常处理的goto
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

static struct file_operations dev_fops = {
    .owner          = THIS_MODULE,
    .open           = binder_open,
    .mmap           = binder_mmap,
    .unlocked_ioctl = binder_ioctl,
};

static struct miscdevice misc = {
    .minor = MISC_DYNAMIC_MINOR,
    .name  = DEVICE_NAME,
    .fops  = &dev_fops,
};

static int __init dev_init(void) {
    int ret;
    ret = misc_register(&misc);
    return ret;
}

static void __exit dev_exit(void) {
    misc_deregister(&misc);
}

module_init(dev_init);
module_exit(dev_exit);
MODULE_LICENSE("GPL");
MODULE_AUTHOR("rightsubtree@hotmail.com");

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

static int binder_open(struct inode *nodp, struct file *filp) {
    printk(KERN_DEBUG "%s(%d|%d): binder_open \n", current->comm, current->tgid, current->pid);

    struct binder_proc *proc;
    proc = kzalloc(sizeof(*proc), GFP_KERNEL);
    if (proc == NULL) return -100;
    filp->private_data = proc;
    INIT_LIST_HEAD(&proc->todo);              // 初始化todo列表，后续的待处理的"work"都添加到这里
    proc->pid = current->group_leader->pid;
    proc->alloc.pid = current->group_leader->pid;
    INIT_LIST_HEAD(&proc->alloc.buffers);     // 本例子里用list来管理所有的 binder_buffer 对象，先初始化之
    
    // 这里直接记录一下两个proc信息，方便后续找到target_proc，亦即，让驱动本身起到了类似servicemanager的作用
    if( !strncmp(current->comm, CLIENT_PROC_NAME, strlen(CLIENT_PROC_NAME)) )
        proc_client = proc;
    if( !strncmp(current->comm, SERVER_PROC_NAME, strlen(SERVER_PROC_NAME)) )
        proc_server = proc;
    
    // 保存进程名，打印日志时使用，主要用于打印对端进程名字时
    memcpy(proc->name, current->comm, strlen(current->comm));
    proc->name[strlen(proc->name)] = '\0';
    
    return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

static int binder_mmap(struct file *filp, struct vm_area_struct *vma) {
    printk(KERN_DEBUG "%s(%d|%d): binder_mmap PAGE_SIZE=%ld \n", current->comm, current->tgid, current->pid, PAGE_SIZE);
    int ret;
    struct binder_proc *proc = filp->private_data;
    const char *failure_string;

    printk(KERN_DEBUG "%s: %s: %d %lx-%lx (%ld K) vma=%llx \n",
            current->comm, __func__, proc->pid, vma->vm_start, vma->vm_end, (vma->vm_end - vma->vm_start) / SZ_1K, (u64)vma);
    
    // binder要求userspace不能写mmap的存储空间，否则报错，
    // 也就意味着用户空间程序只能用 copy_from_user 和 copy_to_user 的方式与驱动进行数据传输
    if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) {
        ret = -EPERM;
        failure_string = "bad vm_flags";
        pr_err("%s: %d %lx-%lx %s failed %d \n", __func__, proc->pid, vma->vm_start, vma->vm_end, failure_string, ret);
        return ret;
    }
    
    // VM_DONTCOPY：表示在 fork() 时，该虚拟内存区域（VMA）不会被复制到子进程中
    // VM_MIXEDMAP：表示该虚拟内存区域是一个混合映射，可能包含多种类型的页面（如匿名页面和文件映射页面）
    vma->vm_flags |= VM_DONTCOPY | VM_MIXEDMAP;
    // 将 VM_MAYWRITE 标志从 vma->vm_flags 中清除，禁止该虚拟内存区域被动态修改为可写
    vma->vm_flags &= ~VM_MAYWRITE;
    
    vma->vm_ops = &binder_vm_ops;
    vma->vm_private_data = proc;
    
    // 初始化当前binder_proc的binder_alloc，此乃记录每个binder_proc的buffer分配的一个结构体
    return binder_alloc_mmap_handler(&proc->alloc, vma);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

int binder_alloc_mmap_handler(struct binder_alloc *alloc, struct vm_area_struct *vma) {
    int ret;
    const char *failure_string;
    int page_count = (vma->vm_end - vma->vm_start) / PAGE_SIZE;   // 用户空间的虚拟内存对应多少个内核页面空间

    mutex_lock(&binder_alloc_mmap_lock);
    if (alloc->buffer) {
        ret = -EBUSY;
        failure_string = "already mapped";
        goto err_already_mapped;
    }
    // 永远指向mmap时vma的start位置，一旦mmap后就不变化了，后续会用alloc->buffer来计算相对页序号、页内偏移值等
    alloc->buffer = (void __user *)vma->vm_start;
    mutex_unlock(&binder_alloc_mmap_lock);

    // binder_alloc的buffer_size表示当前binder_proc能使用的最大缓冲区空间，也是mmap后就固定了，等于mmap时指定的参数大小
    alloc->buffer_size = vma->vm_end - vma->vm_start;

    // 本例中没有用binder_lru_page结构体，pages是二级指针（相当于指针的数组的起始地址），其每个元素都是一个指向内核page的指针
    alloc->pages = kzalloc(page_count * sizeof(alloc->pages[0]), GFP_KERNEL);
    if (alloc->pages == NULL) {
        ret = -ENOMEM;
        failure_string = "alloc page array";
        goto err_alloc_pages_failed;
    }

    // 为vma虚拟内存创建对应的 binder_buffer ，需要注意的是，此时并没有给binder_buffer分配内核内存页面
    // 为了简化，我们让每个binder_buffer的大小都正好是一个page，后续分配和释放，都以整个page为单位
    // 所以 binder_alloc的域buffers这个列表也有 page_count 个元素，即 alloc->pages 和 alloc->buffers 的元素一一对应
    for(int i = 0; i < page_count; i++) {
        struct binder_buffer *buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
        if (!buffer) {
            ret = -ENOMEM;
            failure_string = "alloc buffer struct";
            goto err_alloc_buf_struct_failed;
        }
        buffer->user_data = alloc->buffer + PAGE_SIZE * i;
        // 原生binder里面binder_alloc用红黑树管理buffers，这里简化为list
        list_add_tail(&buffer->entry, &alloc->buffers);
        buffer->free = 1;
    }

    // 打印一下看看，后面日志里可以跟这里的地址对照
    // 包括 binder_buffer 本身地址，后面寻找空闲buffer时可对照，TNND，为了让大家搞明白，我真是操碎了心啊
    struct binder_buffer *bb;
    int index = 0;
    list_for_each_entry(bb, &alloc->buffers, entry) {
        printk(KERN_DEBUG "%s: alloc->buffers <%d> binder_buffer(@ %llx user_data=%llx free=%d) \n",
                current->comm, index++, (u64)bb, (u64)bb->user_data, bb->free);
    }

    // 保存一个名字，主要是为了方便日志更易读
    memcpy(alloc->name, current->comm, strlen(current->comm));
    alloc->name[strlen(alloc->name)] = '\0';

    binder_alloc_set_vma(alloc, vma);
    alloc->vma_vm_mm = vma->vm_mm;
    mmgrab(alloc->vma_vm_mm);

    return 0;

//省略一些异常处理的goto
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

[  133.489037] server(2539|2539): binder_open 
[  133.489048] server(2539|2539): binder_mmap PAGE_SIZE=4096 
[  133.489050] server: binder_mmap: 2539 7f64a7715000-7f64a771f000 (40 K) vma=ffff8caf647725f0 
[  133.489054] server: alloc->buffers <0> binder_buffer(@ ffff8cb30bcbb000 user_data=7f64a7715000 free=1) 
[  133.489056] server: alloc->buffers <1> binder_buffer(@ ffff8cb30bcbb8a0 user_data=7f64a7716000 free=1) 
[  133.489057] server: alloc->buffers <2> binder_buffer(@ ffff8cb30bcbbb40 user_data=7f64a7717000 free=1) 
[  133.489058] server: alloc->buffers <3> binder_buffer(@ ffff8cb30bcbb660 user_data=7f64a7718000 free=1) 
[  133.489059] server: alloc->buffers <4> binder_buffer(@ ffff8cb30bcbbc60 user_data=7f64a7719000 free=1) 
[  133.489060] server: alloc->buffers <5> binder_buffer(@ ffff8cb30bcbb7e0 user_data=7f64a771a000 free=1) 
[  133.489061] server: alloc->buffers <6> binder_buffer(@ ffff8cb30bcbba20 user_data=7f64a771b000 free=1) 
[  133.489062] server: alloc->buffers <7> binder_buffer(@ ffff8cb30bcbb6c0 user_data=7f64a771c000 free=1) 
[  133.489063] server: alloc->buffers <8> binder_buffer(@ ffff8cb30bcbb4e0 user_data=7f64a771d000 free=1) 
[  133.489064] server: alloc->buffers <9> binder_buffer(@ ffff8cb30bcbb480 user_data=7f64a771e000 free=1) 

[  137.748406] client(2541|2541): binder_open 
[  137.748415] client(2541|2541): binder_mmap PAGE_SIZE=4096 
[  137.748416] client: binder_mmap: 2541 7fae812f3000-7fae812fd000 (40 K) vma=ffff8caf6449a688 
[  137.748420] client: alloc->buffers <0> binder_buffer(@ ffff8caf446fd0c0 user_data=7fae812f3000 free=1) 
[  137.748422] client: alloc->buffers <1> binder_buffer(@ ffff8caf446fd960 user_data=7fae812f4000 free=1) 
[  137.748423] client: alloc->buffers <2> binder_buffer(@ ffff8caf446fdae0 user_data=7fae812f5000 free=1) 
[  137.748423] client: alloc->buffers <3> binder_buffer(@ ffff8caf446fd660 user_data=7fae812f6000 free=1) 
[  137.748424] client: alloc->buffers <4> binder_buffer(@ ffff8caf446fdc00 user_data=7fae812f7000 free=1) 
[  137.748425] client: alloc->buffers <5> binder_buffer(@ ffff8caf446fd900 user_data=7fae812f8000 free=1) 
[  137.748426] client: alloc->buffers <6> binder_buffer(@ ffff8caf446fd840 user_data=7fae812f9000 free=1) 
[  137.748426] client: alloc->buffers <7> binder_buffer(@ ffff8caf446fd720 user_data=7fae812fa000 free=1) 
[  137.748427] client: alloc->buffers <8> binder_buffer(@ ffff8caf446fd600 user_data=7fae812fb000 free=1) 
[  137.748428] client: alloc->buffers <9> binder_buffer(@ ffff8caf446fda20 user_data=7fae812fc000 free=1) 

1
2
3
4
5
6

// user_public.h 中的定义：
#define DRIVER                    "/dev/minibinder"
#define MMAP_LENGTH               (4096 * 10)

// client.c 和 server.c 中的调用：
struct binder_state *bs = binder_open(DRIVER, MMAP_LENGTH);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

struct binder_transaction_data td;
td.code = CODE_REPLACE_AND_REPLY;
td.data_size = data_size;
td.offsets_size = offsets_size;
td.data.ptr.buffer = (binder_uintptr_t)buffer;
td.data.ptr.offsets = (binder_uintptr_t)offsets;

binder_size_t write_size = sizeof(__u32) + sizeof(struct binder_transaction_data);
__u32* write_buffer = (__u32 *)malloc(write_size);
*write_buffer = BC_TRANSACTION;
memcpy(write_buffer + 1, &td, sizeof(struct binder_transaction_data));

binder_write(bs, write_buffer, write_size);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

int binder_write(struct binder_state *bs, void *data, size_t len) {
    struct binder_write_read bwr;
    bwr.write_size = len;
    bwr.write_consumed = 0;
    bwr.write_buffer = (uintptr_t)data;
    bwr.read_size = 0;
    bwr.read_consumed = 0;
    bwr.read_buffer = 0;
    int res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
    if (res < 0) {
        fprintf(stderr,"binder_write: ioctl failed (%s)\n", strerror(errno));
    }
    return res;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) {
    int ret = 0;
    struct binder_proc *proc = filp->private_data;
    struct binder_thread *thread = binder_get_thread(proc);
    if (thread == NULL) {
        return -100;
    }
    switch (cmd) {
    case BINDER_WRITE_READ:
        ret = binder_ioctl_write_read(filp, cmd, arg, thread);
        if (ret) {
            printk(KERN_DEBUG "%s: ERROR binder_ioctl_write_read ret=%d \n", current->comm, ret);
        }
        break;
    default:
        printk(KERN_DEBUG "%s: binder_ioctl: currently do not support cmd=%d \n", current->comm, cmd);
        ret = -EINVAL;
    }
    return ret;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

static int binder_ioctl_write_read(struct file *filp, unsigned int cmd,
                        unsigned long arg, struct binder_thread *thread) {
    int ret = 0;
    struct binder_proc *proc = filp->private_data;
    void __user *ubuf = (void __user *)arg;
    struct binder_write_read bwr;
    if (copy_from_user(&bwr, ubuf, sizeof(bwr))) {
        printk(KERN_DEBUG "%s: binder_ioctl_write_read copy_from_user ERROR \n", current->comm);
        ret = -EFAULT;
    }

    if (bwr.write_size > 0) {
        ret = binder_thread_write(proc, thread, bwr.write_buffer, bwr.write_size, &bwr.write_consumed);
    }

    if (bwr.read_size > 0) {
        // 最后一个参数中 O_NONBLOCK 表示非阻塞的方式，即没有数据可读时，立即返回
        ret = binder_thread_read(proc, thread, bwr.read_buffer, bwr.read_size, &bwr.read_consumed,
                    filp->f_flags & O_NONBLOCK);
    }
    return ret;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

static int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread,
                    binder_uintptr_t write_buffer, size_t size, binder_size_t *consumed) {

    uint32_t cmd;
    void __user *buffer = (void __user *)(uintptr_t)write_buffer;
    void __user *ptr = buffer + *consumed;
    void __user *end = buffer + size;

    // 外层的while循环，是为了处理一个write写两个cmd的情况，
    // 例如server通过一个ioctl写了一个包含 BC_FREE_BUFFER+ BC_REPLY的两个数据
    while (ptr < end) {
        if (get_user(cmd, (uint32_t __user *)ptr)) {
            printk(KERN_DEBUG "%s: binder_thread_write get_user ERROR \n", current->comm);
            return -1;
        }
        ptr += sizeof(uint32_t);

        switch(cmd) {
        case BC_FREE_BUFFER: {
            // 这里省略很多行代码
            break;
        }
        case BC_TRANSACTION:
        case BC_REPLY: {
            char* cmd_str = cmd == BC_TRANSACTION ? "BC_TRANSACTION" : "BC_REPLY";
            printk(KERN_DEBUG "%s: binder_thread_write cmd=%s BEGIN { \n", current->comm, cmd_str);
            struct binder_transaction_data td;
            if (copy_from_user(&td, ptr, sizeof(td))) return -EFAULT;
            ptr += sizeof(td);
            binder_transaction(proc, thread, &td, cmd == BC_REPLY);
            printk(KERN_DEBUG "%s: binder_thread_write cmd=%s   END } \n", current->comm, cmd_str);
            break;
        }
        }
        *consumed = ptr - buffer;
    }
    return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

static void binder_transaction(struct binder_proc *proc, struct binder_thread *thread,
                        struct binder_transaction_data *td, int reply) {

    printk(KERN_DEBUG "%s: binder_transaction() BEGIN { \n", current->comm);

    char* cmd_str = reply ? "BC_REPLY" : "BC_TRANSACTION";
    struct binder_transaction *t;
    struct binder_work *tcomplete;
    // 用最简单的方法找到目标进程
    struct binder_proc *target_proc = (proc == proc_client ? proc_server : proc_client);

    printk(KERN_DEBUG
            "%s --> %s %s data.ptr.buffer=%llx data.ptr.offsets=%llx data_size=%lld offsets_size=%lld \n",
            current->comm, target_proc->name, cmd_str, (u64)td->data.ptr.buffer, (u64)td->data.ptr.offsets,
            (u64)td->data_size, (u64)td->offsets_size);

    t = kzalloc(sizeof(*t), GFP_KERNEL);
    tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL);

    // 用发起者（即通过ioctl向内核写入数据的进程）提供的 binder_transaction_data 数据，构造一个 binder_transaction
    t->to_proc = target_proc;
    t->from = thread;
    t->code = td->code;
    // 给binder_transaction分配一个 binder_buffer
    // 这里binder_alloc_new_buf返回的binder_buffer已经是关联了一页内核page的
    t->buffer = binder_alloc_new_buf(&target_proc->alloc, td->data_size, td->offsets_size, current->tgid);
    if(NULL == t->buffer) {
        pr_err("%s: binder_alloc_new_buf cannot find free binder_buffer \n", current->comm);
        return;
    }
    t->buffer->transaction = t;
    t->buffer->data_size = td->data_size;
    t->buffer->offsets_size = td->offsets_size;

    // 如果正在处理BC_TRANSACTION，则填充其buffer的target_node，
    // 后续会根据target_node是否为空决定下一个cmd是BR_TRANSACTION还是BR_REPLY；
    // 这里的逻辑保持与原生binder一致，但target_node的数据类型有差异，详见 binder_buffer 结构体定义里的注释
    if(!reply) {
        t->buffer->target_node = target_proc;
    }
    
    //省略后一半

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

// 从alloc->buffers列表中，找到一个空闲buffer，并将这个buffer与一页物理内存以及用户空间虚拟地址关联起来
struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc, size_t data_size, size_t offsets_size, int pid) {
    struct binder_buffer *buffer;

    // 从alloc的buffers列表中找一个空闲的出来使用，单线程环境下，找到的buffer应该是vma的start，
    // 然后调用binder_update_page_range时，相当于让vma->start关联到内核分配出的新的一个page的内存
    list_for_each_entry(buffer, &alloc->buffers, entry) {
        printk(KERN_DEBUG "%s: binder_alloc_new_buf list_for_each_entry binder_buffer(@ %llx user_data=%llx free=%d) \n",
                current->comm, (u64)buffer, (u64)buffer->user_data, buffer->free);
        if(buffer->free) {
            printk(KERN_DEBUG "%s: binder_alloc_new_buf: GOT free buffer \n", current->comm);

            binder_update_page_range(alloc, 1,
                (void __user *)PAGE_ALIGN((uintptr_t) buffer->user_data),
                (void __user *)PAGE_ALIGN((uintptr_t) buffer->user_data + PAGE_SIZE));

            buffer->data_size = data_size;
            buffer->offsets_size = offsets_size;
            buffer->pid = pid;  // 标记已经被某个进程占用
            buffer->free = 0;   // 标记一下已经占用

            return buffer;
        }
    }
    // 走完了list_for_each_entry，说明没有找到合适的
    return NULL;
}

1
2
3
4
5

[  219.316488] client: binder_thread_write cmd=BC_TRANSACTION BEGIN { 
[  219.316492] client: binder_transaction() BEGIN { 
[  219.316493] client --> server BC_TRANSACTION data.ptr.buffer=5569eb54e2f0 data.ptr.offsets=7ffe7a095210 data_size=22 offsets_size=24 
[  219.316496] client: binder_alloc_new_buf list_for_each_entry binder_buffer(@ ffff8cb30bcbb000 user_data=7f64a7715000 free=1) 
[  219.316497] client: binder_alloc_new_buf: GOT free buffer 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

// 原生binder的这个函数逻辑比较复杂，原因是要处理各种情况，包括但不限于：
// binder_buffer跨内存页、binder_buffer大小小于内存页、binder_buffer起始地址与内存页不对齐、
// 分配/释放 binder_buffer 时是否需要分配/释放内存页 等等；
// 本例子里简化为仅仅分配或者释放一页内存（亦即参数end实际没有使用），所以要求参数start是一个pagesize的起点
static int binder_update_page_range(struct binder_alloc *alloc, int allocate,
                                void __user *start, void __user *end) {
    printk(KERN_DEBUG "%s: binder_update_page_range: allocate=%d start=%llx end=%llx \n",
            current->comm, allocate, (u64)start, (u64)end);
    void __user *page_addr = start;
    struct vm_area_struct *vma = alloc->vma;
    size_t index = (page_addr - alloc->buffer) / PAGE_SIZE;

    if (end <= start) {
        printk(KERN_DEBUG "%s: binder_update_page_range ERROR: end <= start \n", current->comm);
        return 0;
    }
    printk(KERN_DEBUG "%s: %s(%d) %s pages for userspace %llx--%llx \n",
            current->comm, alloc->name, alloc->pid, allocate ? "allocate" : "free", (u64)start, (u64)end);

    // 分配一页
    if (allocate == 1) {
        // 获得一个page
        // 注意，这里 alloc_page 函数返回的是一个物理页面的地址，并不是虚拟地址，不能直接执行读写操作；
        // 执行读写前，需要用 kmap 做映射，参考本文件内的函数 binder_alloc_copy_user_to_buffer 的做法；
        struct page* page_ptr = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO);
        if (!page_ptr) {
            pr_err("%d: binder_update_page_range failed alloc_page at %pK\n", alloc->pid, page_addr);
            return 0;
        }
        alloc->pages[index] = page_ptr; // 记录到alloc的列表内，便于后续释放内存时检索
        printk(KERN_DEBUG "%s: allocate: alloc->pages[%ld] <--> kernel page_ptr=%llx <--> userspace page_addr=%llx \n",
                current->comm, index, (u64)page_ptr, (u64)page_addr);

        // 将page_ptr指向的一页内核内存空间和用户空间的 page_addr 关联起来，
        // 此后，用户空间就可以从 page_addr 读取到 page_ptr 所在页内存的数据
        if (vm_insert_page(vma, (unsigned long)page_addr, page_ptr)) {
            pr_err("%d: binder_update_page_range failed to map page at %llx in userspace\n", alloc->pid, (u64)page_addr);
            __free_page(page_ptr); // 避免内核page泄露
            return 0;
        }
        printk(KERN_DEBUG "%s: vm_insert_page(%llx, %llx, %llx) \n", current->comm, (u64)vma, (u64)page_addr, (u64)page_ptr);
        return 0;
    }
    // 释放一页
    else {
        // 省略
    }
}

1

int vm_insert_page(struct vm_area_struct *vma, unsigned long addr, struct page *page);

1
2
3
4
5
6
7

    t->buffer->transaction = t;
    t->buffer->data_size = td->data_size;
    t->buffer->offsets_size = td->offsets_size;

    if(!reply) {
        t->buffer->target_node = target_proc;
    }

1
2
3
4

[  219.316498] client: binder_update_page_range: allocate=1 start=7f64a7715000 end=7f64a7716000 
[  219.316499] client: server(2539) allocate pages for userspace 7f64a7715000--7f64a7716000 
[  219.316502] client: allocate: alloc->pages[0] <--> kernel page_ptr=ffffd09244695c80 <--> userspace page_addr=7f64a7715000 
[  219.316504] client: vm_insert_page(ffff8caf647725f0, 7f64a7715000, ffffd09244695c80) 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

    // 接下来会执行两次 copy_from_user，将 binder_transaction_data 里面指针data.ptr.buffer和data.ptr.offsets指向的数据
    // 拷贝到内核刚刚分配的 binder_buffer 里面；
    // 本质上，这个拷贝实际上就是将原来 binder_transaction_data 里面的“结构化数据”做“序列化”的过程；
    // 而到了对端进程（用户空间进程里），需要做“反序列化”，
    // 反序列化时的解析规则是由 data_size 和 offsets_size 决定的，详见用户空间的 binder_parse 函数；

    // binder_transaction_data 的 data.ptr.buffer 中存储了 data_size 个字节的数据，
    // 将它们拷贝到刚刚分配的binder_buffer的第0个offset的位置；
    if (binder_alloc_copy_user_to_buffer( &target_proc->alloc, t->buffer, 0,
                (const void __user *)(uintptr_t)td->data.ptr.buffer, td->data_size )) {
        printk(KERN_DEBUG "%d: got transaction with invalid data ptr \n", proc->pid);
    }

    // binder_transaction_data 的 data.ptr.offsets 其实是一个数组，存储了 offsets_size 个字节的数据
    // （在64位系统，offsets_size = data.ptr.buffer里面obj的个数 * 8 ），
    // 需要将它们拷贝到刚刚分配的binder_buffer的第 ALIGN(td->data_size, sizeof(void *)) 个offset的位置；
    // ALIGN(x, y) 的意思是，将x上对齐到y的整数倍；假如 data_size=9，则64位上 ALIGN(9, 8) 计算后的值是16；
    // ALIGN的主要目的还是为了加速数据读写速度
    if (binder_alloc_copy_user_to_buffer( &target_proc->alloc, t->buffer, ALIGN(td->data_size, sizeof(void *)),
                (const void __user *)(uintptr_t)td->data.ptr.offsets, td->offsets_size )) {
        printk(KERN_DEBUG "%d: got transaction with invalid offsets ptr \n", proc->pid);
    }

    // 将一个 BINDER_WORK_TRANSACTION 添加到 target_proc 的todo列表
    // 所有添加到todo列表的都是一个 binder_work ，所以这里添加的其实是 binder_transaction 的一个子域 t->work 的指针
    // 后续target_proc 执行到 binder_thread_read 收到binder_work后，通过 container_of 宏获得外层的 binder_transaction
    t->work.type = BINDER_WORK_TRANSACTION;
    list_add_tail(&t->work.entry, &target_proc->todo);
    printk(KERN_DEBUG
            "%s: --> %s BINDER_WORK_TRANSACTION (code=%d buffer=%llx data_size=%ld offsets_size=%ld) \n",
            current->comm, target_proc->name, t->code, (u64)t->buffer, t->buffer->data_size, t->buffer->offsets_size);

    // 将一个 BINDER_WORK_TRANSACTION_COMPLETE 添加到源进程的todo列表，会被源进程在执行 binder_thread_read 时获取
    tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
    list_add_tail(&tcomplete->entry, &thread->proc->todo);
    printk(KERN_DEBUG "%s: --> %s BINDER_WORK_TRANSACTION_COMPLETE \n", current->comm, thread->proc->name);

    printk(KERN_DEBUG "%s: binder_transaction()   END } \n", current->comm);
}

1
2
3
4

    // binder_transaction_data 的 data.ptr.buffer 中存储了 data_size 个字节的数据，
    // 将它们拷贝到刚刚分配的binder_buffer的第0个offset的位置；
    if (binder_alloc_copy_user_to_buffer( &target_proc->alloc, t->buffer, 0,
                (const void __user *)(uintptr_t)td->data.ptr.buffer, td->data_size ))

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

// 从参数 from 所指向的用户空间，拷贝 bytes 个字节内容，
// 到指定的 buffer + buffer_offset 的位置（这两个地址相加后，可能跨越了PAGE_SIZE）；
unsigned long binder_alloc_copy_user_to_buffer(struct binder_alloc *alloc, struct binder_buffer *buffer,
                                binder_size_t buffer_offset, const void __user *from, size_t bytes) {
    while (bytes) {
        unsigned long size;
        unsigned long ret;
        struct page *page;
        pgoff_t pgoff;
        void *kptr;
        void* kptr_page;

        // 获得页面物理地址
        page = binder_alloc_get_page(alloc, buffer, buffer_offset, &pgoff);

        // min_t(type, x, y) 用于从type类型的两个数x和y中找到一个较小的
        // 这个比较的意思是，如果需要copy的字节数bytes未达到本page的最后（即不跨页）则直接写bytes个；
        // 如果跨页了，则先copy本页内剩余部分，后面的部分留到while循环的下一轮copy；
        // 原生binder这样做，是为了能充分利用每一个字节的空间，做得还是很细致的，不服不行！
        // 当然，本例子里肯定不存在跨页的情况；
        size = min_t(size_t, bytes, PAGE_SIZE - pgoff);

        // kmap函数将物理页面映射到内核的虚拟地址空间中，返回一个虚拟地址，通过这个虚拟地址，内核可以访问物理内存；
        // kmap()是与 kunmap()配对使用的；kmap()映射内存，kunmap()释放映射；
        // kptr = kmap(page) + pgoff;  // 本例子把原生的这行拆成下面两行，目标是为了打印出来kmap(page)的结果
        kptr_page = kmap(page);
        kptr = kptr_page + pgoff;
        printk(KERN_DEBUG "%s: binder_alloc_copy_user_to_buffer: kmap(%llx) got kernel virtual addr %llx \n",
                current->comm, (u64)page, (u64)kptr_page);

        // 忙活了半天，终于可以做正儿八经的copy了
        ret = copy_from_user(kptr, from, size);

        printk(KERN_DEBUG "%s: binder_alloc_copy_user_to_buffer: copy_from_user(%llx, %llx, %ld) \n",
                current->comm, (u64)kptr, (u64)from, size);

        // 释放本页映射
        kunmap(page);

        // copy_from_user 的返回值是“未能成功复制的字节数”，
        // 所以这里return的值含义是整体上剩余未copy的字节数；当然，一般走不到这里；
        if (ret) return bytes - size + ret;

        bytes -= size;
        from += size;
        buffer_offset += size;
    }
    return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

// 查询指定的 binder_buffer地址 + buffer_offset 偏移后（注意，二者相加后可能大于PAGE_SIZE）， 对应的内核page物理地址，
// 物理地址数据来自当前进程的 binder_alloc 的 pages 的某个下标里，
// 这个 binder_alloc->pages[index] 是在 binder_alloc_free_buf --> binder_update_page_range 过程中设置的；
static struct page *binder_alloc_get_page(struct binder_alloc *alloc, struct binder_buffer *buffer,
            binder_size_t buffer_offset, pgoff_t *pgoffp) {
    printk(KERN_DEBUG "%s: binder_alloc_get_page: alloc->buffer=%llx binder_buffer(@ %llx user_data=%llx free=%d) buffer_offset=%llx \n",
            current->comm, (u64)alloc->buffer, (u64)buffer, (u64)buffer->user_data, buffer->free, (u64)buffer_offset);

    // alloc->buffer永远等于虚拟内存的vma->vm_start，而 buffer->user_data 是某个已经分配空间的 binder_buffer 的起始地址，
    // (buffer->user_data - alloc->buffer) 就是某个 binder_buffer 相对vma_start的偏移，
    // 再加上buffer_offset（即buffer内的offset），就是某个地址相对vma_start的偏移；
    // 另外，这些参与计算的地址都是用户空间的虚拟地址
    binder_size_t buffer_space_offset = buffer_offset + (buffer->user_data - alloc->buffer);

    // 求buffer_space_offset相对自己所在页的页首的偏移
    pgoff_t pgoff = buffer_space_offset & ~PAGE_MASK;

    // PAGE_SIZE=4k时，PAGE_SHIFT=12，所以 >> PAGE_SHIFT 相当于除以PAGE_SIZE，结果是获取相对页序号（编号从0开始）
    size_t index = buffer_space_offset >> PAGE_SHIFT;  // 获取相对于vma->vm_start的页序号
    printk(KERN_DEBUG "%s: binder_alloc_get_page: index=%ld pgoff=%llx page=%llx \n",
            current->comm, index, (u64)pgoff, (u64)alloc->pages[index]);

    *pgoffp = pgoff;
    return alloc->pages[index];
}

1
2
3
4

[  219.316506] client: binder_alloc_get_page: alloc->buffer=7f64a7715000 binder_buffer(@ ffff8cb30bcbb000 user_data=7f64a7715000 free=0) buffer_offset=0 
[  219.316507] client: binder_alloc_get_page: index=0 pgoff=0 page=ffffd09244695c80 
[  219.316508] client: binder_alloc_copy_user_to_buffer: kmap(ffffd09244695c80) got kernel virtual addr ffff8caf5a572000 
[  219.316509] client: binder_alloc_copy_user_to_buffer: copy_from_user(ffff8caf5a572000, 5569eb54e2f0, 22) 

1
2
3
4
5
6
7
8
9

    // binder_transaction_data 的 data.ptr.offsets 其实是一个数组，存储了 offsets_size 个字节的数据
    // （在64位系统，offsets_size = data.ptr.buffer里面obj的个数 * 8 ），
    // 需要将它们拷贝到刚刚分配的binder_buffer的第 ALIGN(td->data_size, sizeof(void *)) 个offset的位置；
    // ALIGN(x, y) 的意思是，将x上对齐到y的整数倍；假如 data_size=9，则64位上 ALIGN(9, 8) 计算后的值是16；
    // ALIGN的主要目的还是为了加速数据读写速度
    if (binder_alloc_copy_user_to_buffer( &target_proc->alloc, t->buffer, ALIGN(td->data_size, sizeof(void *)),
                (const void __user *)(uintptr_t)td->data.ptr.offsets, td->offsets_size )) {
        printk(KERN_DEBUG "%d: got transaction with invalid offsets ptr \n", proc->pid);
    }

1
2
3
4

[  219.316510] client: binder_alloc_get_page: alloc->buffer=7f64a7715000 binder_buffer(@ ffff8cb30bcbb000 user_data=7f64a7715000 free=0) buffer_offset=18 
[  219.316511] client: binder_alloc_get_page: index=0 pgoff=18 page=ffffd09244695c80 
[  219.316512] client: binder_alloc_copy_user_to_buffer: kmap(ffffd09244695c80) got kernel virtual addr ffff8caf5a572000 
[  219.316513] client: binder_alloc_copy_user_to_buffer: copy_from_user(ffff8caf5a572018, 7ffe7a095210, 24) 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

    // 将一个 BINDER_WORK_TRANSACTION 添加到 target_proc 的todo列表
    // 所有添加到todo列表的都是一个 binder_work ，所以这里添加的其实是 binder_transaction 的一个子域 t->work 的指针
    // 后续target_proc 执行到 binder_thread_read 收到binder_work后，通过 container_of 宏获得外层的 binder_transaction
    t->work.type = BINDER_WORK_TRANSACTION;
    list_add_tail(&t->work.entry, &target_proc->todo);
    printk(KERN_DEBUG
            "%s: --> %s BINDER_WORK_TRANSACTION (code=%d buffer=%llx data_size=%ld offsets_size=%ld) \n",
            current->comm, target_proc->name, t->code, (u64)t->buffer, t->buffer->data_size, t->buffer->offsets_size);

    // 将一个 BINDER_WORK_TRANSACTION_COMPLETE 添加到源进程的todo列表，会被源进程在执行 binder_thread_read 时获取
    tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
    list_add_tail(&tcomplete->entry, &thread->proc->todo);
    printk(KERN_DEBUG "%s: --> %s BINDER_WORK_TRANSACTION_COMPLETE \n", current->comm, thread->proc->name);

    printk(KERN_DEBUG "%s: binder_transaction()   END } \n", current->comm);
}

1
2
3
4

[  219.316514] client: --> server BINDER_WORK_TRANSACTION (code=1 buffer=ffff8cb30bcbb000 data_size=22 offsets_size=24) 
[  219.316515] client: --> client BINDER_WORK_TRANSACTION_COMPLETE 
[  219.316515] client: binder_transaction()   END } 
[  219.316516] client: binder_thread_write cmd=BC_TRANSACTION   END } 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

int main(int argc , char *argv[]) {
    struct binder_state *bs = binder_open(DRIVER, MMAP_LENGTH);

    print_maps();

    binder_size_t read_size = sizeof(__u32) + sizeof(struct binder_transaction_data);
    __u32* read_buffer = (__u32 *)malloc(read_size);

    // 循环等待
    while(1) {
        // 休息200ms，否则可能导致进程长期占用CPU，作为一个演示程序，我们不关心进程的休眠唤醒等细节
        usleep(200);
        // 先读一下看有没有驱动传递来的命令
        binder_read(bs, read_buffer, read_size); // binder_read内部每次都会先将read_buffer置空
        // 然后解析，没有读到也无所谓，对于空数据，binder_parse内部会啥也不干直接退出
        binder_parse(bs, read_buffer);
    }
    return 0;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

// 通过ioctl从binder驱动读取长度len的数据，将读取到的内容写入data内
int binder_read(struct binder_state *bs, void *data, size_t len) {
    memset(data, 0, len);   // data将来要存储新的数据，所以先清空一下，好习惯
    struct binder_write_read bwr;
    bwr.write_size = 0;
    bwr.write_consumed = 0;
    bwr.write_buffer = 0;
    bwr.read_size = len;
    bwr.read_consumed = 0;
    bwr.read_buffer = (uintptr_t)data;
    int res = ioctl(bs->fd, BINDER_WRITE_READ, &bwr);
    if (res < 0) {
        fprintf(stderr,"binder_read: ioctl failed (%s)\n", strerror(errno));
    }
    return res;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

static int binder_thread_read(struct binder_proc *proc, struct binder_thread *thread,
                binder_uintptr_t read_buffer, size_t size, binder_size_t *consumed, int non_block) {

    void __user *buffer = (void __user *)(uintptr_t)read_buffer;
    void __user *ptr = buffer + *consumed;

    uint32_t cmd;
    struct binder_transaction_data td;
    struct binder_work *w;
    struct binder_transaction *t = NULL;

    if(!list_empty(&proc->todo)) {
        // 获取binder_work结构体并，将list内该元素删除掉
        w = binder_dequeue_work_head_ilocked(&proc->todo);
        switch (w->type) {
        case BINDER_WORK_TRANSACTION: {
            printk(KERN_DEBUG "%s: binder_thread_read BINDER_WORK_TRANSACTION BEGIN { \n", current->comm);

            // container_of 是linux里面一个很巧妙的宏定义，这里不多展开了
            t = container_of(w, struct binder_transaction, work);
            printk(KERN_DEBUG 
                "%s: binder_transaction(code=%d, data_size=%ld, offsets_size=%ld buffer->user_data=%llx) \n",
                current->comm, t->code, t->buffer->data_size, t->buffer->offsets_size, (u64)t->buffer->user_data);

            // 如果是整个流程的前半程，则驱动将BR_TRANSACTION写给server端；如果是后半程，则驱动使用BR_REPLY将结果写给client端
            cmd = t->buffer->target_node ? BR_TRANSACTION : BR_REPLY;
            char* cmd_str = (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" : "BR_REPLY";

            // 根据 binder_buffer 中的 userdata 重新构造出一个 binder_transaction_data；
            td.code = t->code;
            td.data_size = t->buffer->data_size;
            td.offsets_size = t->buffer->offsets_size;
            td.data.ptr.buffer  = (uintptr_t)t->buffer->user_data;
            td.data.ptr.offsets = (uintptr_t)t->buffer->user_data + ALIGN(t->buffer->data_size, sizeof(void *));

            // 将 binder_transaction_data 写到binder_thread_read的入参指定的地址里，用户进程在 ioctl 执行完毕后就能用了
            if (put_user(cmd, (uint32_t __user *)ptr)) return -EFAULT;
            ptr += sizeof(uint32_t);
            printk(KERN_DEBUG "%s: put_user: cmd=%s \n", current->comm, cmd_str);

            if (copy_to_user(ptr, &td, sizeof(td))) return -EFAULT;
            ptr += sizeof(td);
            printk(KERN_DEBUG "%s: copy_to_user: binder_transaction_data "
                "(code=%d data_size=%lld offsets_size=%lld data.ptr.buffer=%llx data.ptr.offsets=%llx) \n",
                current->comm, td.code, td.data_size, td.offsets_size, (u64)td.data.ptr.buffer, (u64)td.data.ptr.offsets);

            printk(KERN_DEBUG "%s: binder_thread_read BINDER_WORK_TRANSACTION   END } \n", current->comm);
            break;
        }
        case BINDER_WORK_TRANSACTION_COMPLETE: {
            // 省略
        }
        }

    }
    return 0;
}

1
2
3
4
5
6
7

// 从list前端取出来一个元素，如果元素非空则将其从list删除掉；
static struct binder_work *binder_dequeue_work_head_ilocked(struct list_head *list) {
    struct binder_work *w;
    w = list_first_entry_or_null(list, struct binder_work, entry);
    if (w) list_del_init(&w->entry);
    return w;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

struct binder_transaction {
    struct binder_work work;
    struct binder_thread *from;
    struct binder_proc *to_proc;
    struct binder_thread *to_thread;
    unsigned need_reply;
    struct binder_buffer *buffer;
    unsigned int code;
    unsigned int flags;
};

1
2
3

#define container_of(ptr, type, member) ({                      \
    const typeof(((type *)0)->member) *__mptr = (ptr);           \
    (type *)((char *)__mptr - offsetof(type, member)); })

1

#define offsetof(type, member) ((size_t)&(((type *)0)->member))

1

const typeof(((type *)0)->member) *__mptr = (ptr);

1

(type *)((char *)__mptr - offsetof(type, member)); 

1
2
3
4
5

td.code = t->code;
td.data_size = t->buffer->data_size;
td.offsets_size = t->buffer->offsets_size;
td.data.ptr.buffer  = (uintptr_t)t->buffer->user_data;
td.data.ptr.offsets = (uintptr_t)t->buffer->user_data + ALIGN(t->buffer->data_size, sizeof(void *));

1
2

[  219.316707] server: binder_thread_read BINDER_WORK_TRANSACTION BEGIN { 
[  219.316709] server: binder_transaction(code=1, data_size=22, offsets_size=24 buffer->user_data=7f64a7715000) 

1
2
3
4
5

    if (put_user(cmd, (uint32_t __user *)ptr)) return -EFAULT;
    ptr += sizeof(uint32_t);
    printk(KERN_DEBUG "%s: put_user: cmd=%s \n", current->comm, cmd_str);

    if (copy_to_user(ptr, &td, sizeof(td))) return -EFAULT;

1
2
3

[  219.316712] server: put_user: cmd=BR_TRANSACTION 
[  219.316713] server: copy_to_user: binder_transaction_data (code=1 data_size=22 offsets_size=24 data.ptr.buffer=7f64a7715000 data.ptr.offsets=7f64a7715018) 
[  219.316714] server: binder_thread_read BINDER_WORK_TRANSACTION   END }