# MemroyFile 是 ashmem java 层接口                                                                                        frameworks/base/core/java/os/Parcel.java                                                                                        frameworks/base/core/java/os/Parcelable.java                                                                                        frameworks/base/core/java/os/ParcelFileDescriptor.java                                                                                        frameworks/base/core/java/os/MemoryFile.java                                                                                        # jni 相关                                                                                        frameworks/base/core/jni/android_os_Parcel.h                                                                                        frameworks/base/core/jni/android_os_MemoryFile.cpp                                                                                        frameworks/base/core/jni/android_os_Parcel.cpp                                                                                        libnativehelper/JNIHelp.cpp                                                                                        # 封装了 ashmem 驱动的 c 接口                                                                                        system/core/include/cutils/ashmem.h                                                                                        system/core/libcutils/ashmem-dev.c                                                                                        # MemoryXx 是 ashmem 的 native 接口                                                                                        frameworks/native/include/binder/Parcel.h                                                                                        frameworks/native/include/binder/IMemory.h                                                                                        frameworks/native/include/binder/MemoryHeapBase.h                                                                                        frameworks/native/include/binder/MemoryBase.h                                                                                        frameworks/native/libs/binder/Parcel.cpp                                                                                        frameworks/native/libs/binder/Memory.cpp                                                                                        frameworks/native/libs/binder/MemoryHeapBase.cpp                                                                                        frameworks/native/libs/binder/MemoryBase.cpp                                                                                        # kernel binder 驱动                                                                                        kernel/drivers/staging/android/binder.h                                                                                        kernel/drivers/staging/android/binder.c                                                                                        # kernel ashmem 驱动                                                                                        kernel/include/linux/ashmem.h                                                                                        kernel/mm/ashmem.c                            

                                                            private FileDescriptor mFD;                                        // ashmem file descriptor                                                                                        private                                 int mAddress;                                   // address of ashmem memory                                                                                        private                                 int mLength;                                    // total length of our ashmem region                                                                                        private                                 boolean mAllowPurging =                                 false;                                  // true if our ashmem region is unpinned                                                                                        private                                 final                                 boolean mOwnsRegion;                                  // false if this is a ref to an existing ashmem region                                                                                        /*                                                                                         * Allocates a new ashmem region. The region is initially not purgable.                                                                                         *                                                                                         * @param name optional name for the file (can be null).                                                                                         * @param length of the memory file in bytes.                                                                                         * @throws IOException if the memory file could not be created.                                                                                         */                                                                                        public                                 MemoryFile(String name,                                 int length)                                 throws IOException {                                                                                            mLength = length;                                                                                            mFD = native_open(name, length);                                                                                            mAddress = native_mmap(mFD, length, PROT_READ | PROT_WRITE);                                                                                            mOwnsRegion =                                 true;                                                                                        }                            

                                                            static jobject android_os_MemoryFile_open(JNIEnv* env, jobject clazz, jstring name, jint length)                                                                                        {                                                                                            const                                 char* namestr = (name ? env->GetStringUTFChars(name, NULL) : NULL);                                                                                            int result = ashmem_create_region(namestr, length);                                                                                            if (name)                                                                                                env->ReleaseStringUTFChars(name, namestr);                                                                                            if (result <                                 0) {                                                                                                jniThrowException(env,                                 "java/io/IOException",                                 "ashmem_create_region failed");                                                                                                return NULL;                                                                                            }                                                                                            return jniCreateFileDescriptor(env, result);                                                                                        }                            

                                                            #define ASHMEM_DEVICE   "/dev/ashmem"                                                                                        /*                                                                                         * ashmem_create_region - creates a new ashmem region and returns the file                                                                                         * descriptor, or <0 on error                                                                                         *                                                                                         * `name' is an optional label to give the region (visible in /proc/pid/maps)                                                                                         * `size' is the size of the region, in page-aligned bytes                                                                                         */                                                                                        int ashmem_create_region(                                const                                 char *name, size_t size)                                                                                        {                                                                                            int fd, ret;                                                                                            fd = open(ASHMEM_DEVICE, O_RDWR);                                                                                            if (fd <                                 0)                                                                                                return fd;                                                                                            if (name) {                                                                                                char buf[ASHMEM_NAME_LEN];                                                                                                strlcpy(buf, name,                                 sizeof(buf));                                                                                                ret = ioctl(fd, ASHMEM_SET_NAME, buf);                                                                                                if (ret <                                 0)                                                                                                    goto error;                                                                                            }                                                                                            ret = ioctl(fd, ASHMEM_SET_SIZE, size);                                                                                            if (ret <                                 0)                                                                                                goto error;                                                                                            return fd;                                                                                        error:                                                                                            close(fd);                                                                                            return ret;                                                                                        }                            

                                                            jobject jniCreateFileDescriptor(C_JNIEnv* env,                                 int fd) {                                                                                            JNIEnv* e =                                 reinterpret_cast(env);                                                                                            static jmethodID ctor = e->GetMethodID(JniConstants::fileDescriptorClass,                                 "",                                 "()V");                                                                                            jobject fileDescriptor = (*env)->NewObject(e, JniConstants::fileDescriptorClass, ctor);                                                                                            jniSetFileDescriptorOfFD(env, fileDescriptor, fd);                                                                                            return fileDescriptor;                                                                                        }                                                                                        int jniGetFDFromFileDescriptor(C_JNIEnv* env, jobject fileDescriptor) {                                                                                            JNIEnv* e =                                 reinterpret_cast(env);                                                                                            static jfieldID fid = e->GetFieldID(JniConstants::fileDescriptorClass,                                 "descriptor",                                 "I");                                                                                            return (*env)->GetIntField(e, fileDescriptor, fid);                                                                                        }                                                                                        void jniSetFileDescriptorOfFD(C_JNIEnv* env, jobject fileDescriptor,                                 int value) {                                                                                            JNIEnv* e =                                 reinterpret_cast(env);                                                                                            static jfieldID fid = e->GetFieldID(JniConstants::fileDescriptorClass,                                 "descriptor",                                 "I");                                                                                            (*env)->SetIntField(e, fileDescriptor, fid, value);                                                                                        }                            

                                                            static jint android_os_MemoryFile_mmap(JNIEnv* env, jobject clazz, jobject fileDescriptor,                                                                                                jint length, jint prot)                                                                                        {                                                                                            int fd = jniGetFDFromFileDescriptor(env, fileDescriptor);                                                                                            jint result = (jint)mmap(NULL, length, prot, MAP_SHARED, fd,                                 0);                                                                                            if (!result)                                                                                                jniThrowException(env,                                 "java/io/IOException",                                 "mmap failed");                                                                                            return result;                                                                                        }                            

                                                            /*                                                                                         * Gets a ParcelFileDescriptor for the memory file. See {@link #getFileDescriptor()}                                                                                         * for caveats. This must be here to allow classes outside android.os                                                                                         * make ParcelFileDescriptors from MemoryFiles, as                                                                                         * {@link ParcelFileDescriptor#ParcelFileDescriptor(FileDescriptor)} is package private.                                                                                         *                                                                                          *                                                                                          * @return The file descriptor owned by this memory file object.                                                                                         *         The file descriptor is not duplicated.                                                                                         * @throws IOException If the memory file has been closed.                                                                                         *                                                                                          * @hide                                                                                         */                                                                                        public ParcelFileDescriptor                                 getParcelFileDescriptor()                                 throws IOException {                                                                                            FileDescriptor fd = getFileDescriptor();                                                                                            return fd !=                                 null ?                                 new ParcelFileDescriptor(fd) :                                 null;                                                                                        }                            

                                                            /*package */ParcelFileDescriptor(FileDescriptor descriptor) {                                                                                            super();                                                                                            if (descriptor ==                                 null) {                                                                                                throw                                 new NullPointerException(                                "descriptor must not be null");                                                                                            }                                                                                            mFileDescriptor = descriptor;                                                                                            mParcelDescriptor =                                 null;                                                                                        }                                                                                        /*                                                                                         * {@inheritDoc}                                                                                         * If {@link Parcelable#PARCELABLE_WRITE_RETURN_VALUE} is set in flags,                                                                                         * the file descriptor will be closed after a copy is written to the Parcel.                                                                                         */                                                                                        public                                 void                                 writeToParcel(Parcel out,                                 int flags) {                                                                                            out.writeFileDescriptor(mFileDescriptor);                                                                                            if ((flags&PARCELABLE_WRITE_RETURN_VALUE) !=                                 0 && !mClosed) {                                                                                                try {                                                                                                    close();                                                                                                }                                 catch (IOException e) {                                                                                                    // Empty                                                                                                }                                                                                            }                                                                                        }                                                                                        public                                 static                                 final Parcelable.Creator CREATOR                                                                                                =                                 new Parcelable.Creator() {                                                                                            public ParcelFileDescriptor                                 createFromParcel(Parcel in) {                                                                                                return in.readFileDescriptor();                                                                                            }                                                                                            public ParcelFileDescriptor[]                                 newArray(                                int size) {                                                                                                return                                 new ParcelFileDescriptor[size];                                                                                            }                                                                                        };                            

                                                            // java ================================                                                                                            /**                                                                                             * Write a FileDescriptor into the parcel at the current dataPosition(),                                                                                             * growing dataCapacity() if needed.                                                                                             *                                                                                              * 
The file descriptor will not be closed, which may                                                                                             * result in file descriptor leaks when objects are returned from Binder                                                                                             * calls.  Use {@link ParcelFileDescriptor#writeToParcel} instead, which                                                                                             * accepts contextual flags and will close the original file descriptor                                                                                             * if {@link Parcelable#PARCELABLE_WRITE_RETURN_VALUE} is set.                                                                                             */                                                                                            public final native                                 void writeFileDescriptor(FileDescriptor val);                                                                                            /**                                                                                             * Read a FileDescriptor from the parcel at the current dataPosition().                                                                                             */                                                                                            public final ParcelFileDescriptor readFileDescriptor() {                                                                                                FileDescriptor fd = internalReadFileDescriptor();                                                                                                return fd != null ?                                 new ParcelFileDescriptor(fd) : null;                                                                                            }                                                                                        // jni ================================                                                                                        static                                 void android_os_Parcel_writeFileDescriptor(JNIEnv* env, jobject clazz, jobject object)                                                                                        {                                                                                            Parcel* parcel = parcelForJavaObject(env, clazz);                                                                                            if (parcel != NULL) {                                                                                                const status_t err = parcel->writeDupFileDescriptor(                                                                                                        env->GetIntField(object, gFileDescriptorOffsets.mDescriptor));                                                                                                if (err != NO_ERROR) {                                                                                                    jniThrowException(env,                                 "java/lang/OutOfMemoryError", NULL);                                                                                                }                                                                                            }                                                                                        }                                                                                        // 这个在 jni 注册那里是叫 internalReadFileDescriptor -_-||                                                                                        static jobject android_os_Parcel_readFileDescriptor(JNIEnv* env, jobject clazz)                                                                                        {                                                                                            Parcel* parcel = parcelForJavaObject(env, clazz);                                                                                            if (parcel != NULL) {                                                                                                int fd = parcel->readFileDescriptor();                                                                                                if (fd <                                 0)                                 return NULL;                                                                                                fd = dup(fd);                                                                                                if (fd <                                 0)                                 return NULL;                                                                                                jobject object = env->NewObject(                                                                                                        gFileDescriptorOffsets.mClass, gFileDescriptorOffsets.mConstructor);                                                                                                if (object != NULL) {                                                                                                    //LOGI("Created new FileDescriptor %p with fd %d\n", object, fd);                                                                                                    env->SetIntField(object, gFileDescriptorOffsets.mDescriptor, fd);                                                                                                }                                                                                                return object;                                                                                            }                                                                                            return NULL;                                                                                        }                                                                                        // native ================================                                                                                        status_t Parcel::writeDupFileDescriptor(                                int fd)                                                                                        {                                                                                            flat_binder_object obj;                                                                                            obj.type = BINDER_TYPE_FD;                                                                                            obj.flags =                                 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS;                                                                                            obj.handle = dup(fd);                                                                                            obj.cookie = (                                void*)                                1;                                                                                            return writeObject(obj,                                 true);                                                                                        }                                                                                        int Parcel::readFileDescriptor()                                 const                                                                                        {                                                                                            const flat_binder_object* flat = readObject(                                true);                                                                                            if (flat) {                                                                                                switch (flat->type) {                                                                                                    case BINDER_TYPE_FD:                                                                                                                   //LOGI("Returning file descriptor %ld from parcel %p\n", flat->handle, this);                                                                                                        return flat->handle;                                                                                                }                                                                                                    }                                                                                            return BAD_TYPE;                                                                                        }                            

                                                            /*                                                                                         * Creates a reference to an existing memory file. Changes to the original file                                                                                         * will be available through this reference.                                                                                         * Calls to {@link #allowPurging(boolean)} on the returned MemoryFile will fail.                                                                                         *                                                                                          * @param fd File descriptor for an existing memory file, as returned by                                                                                         *        {@link #getFileDescriptor()}. This file descriptor will be closed                                                                                         *        by {@link #close()}.                                                                                         * @param length Length of the memory file in bytes.                                                                                         * @param mode File mode. Currently only "r" for read-only access is supported.                                                                                         * @throws NullPointerException if fd is null.                                                                                         * @throws IOException If fd does not refer to an existing memory file,                                                                                         *         or if the file mode of the existing memory file is more restrictive                                                                                         *         than mode.                                                                                         *                                                                                          * @hide                                                                                         */                                                                                        public                                 MemoryFile(FileDescriptor fd,                                 int length, String mode)                                 throws IOException {                                                                                            if (fd ==                                 null) {                                                                                                throw                                 new NullPointerException(                                "File descriptor is null.");                                                                                            }                                                                                            if (!isMemoryFile(fd)) {                                                                                                       throw                                 new IllegalArgumentException(                                "Not a memory file.");                                                                                            }                                                                                            mLength = length;                                                                                            mFD = fd;                                                                                            mAddress = native_mmap(mFD, length, modeToProt(mode));                                                                                            mOwnsRegion =                                 false;                                                                                        }                            

                                                            // java ================================                                                                                            /**                                                                                             * Reads bytes from the memory file.                                                                                             * Will throw an IOException if the file has been purged.                                                                                             *                                                                                             * @param buffer byte array to read bytes into.                                                                                             * @param srcOffset offset into the memory file to read from.                                                                                             * @param destOffset offset into the byte array buffer to read into.                                                                                             * @param count number of bytes to read.                                                                                             * @return number of bytes read.                                                                                             * @throws IOException if the memory file has been purged or deactivated.                                                                                             */                                                                                            public                                 int readBytes(byte[] buffer,                                 int srcOffset,                                 int destOffset,                                 int count)                                                                                                     throws IOException {                                                                                                           if (isDeactivated()) {                                                                                                    throw                                 new IOException(                                "Can't read from deactivated memory file.");                                                                                                }                                                                                                if (destOffset <                                 0 || destOffset > buffer.length || count <                                 0                                                                                                        || count > buffer.length - destOffset                                                                                                        || srcOffset <                                 0 || srcOffset > mLength                                                                                                        || count > mLength - srcOffset) {                                                                                                     throw                                 new IndexOutOfBoundsException();                                                                                                }                                                                                                return native_read(mFD, mAddress, buffer, srcOffset, destOffset, count, mAllowPurging);                                                                                            }                                                                                            /**                                                                                             * Write bytes to the memory file.                                                                                             * Will throw an IOException if the file has been purged.                                                                                             *                                                                                              * @param buffer byte array to write bytes from.                                                                                             * @param srcOffset offset into the byte array buffer to write from.                                                                                             * @param destOffset offset  into the memory file to write to.                                                                                             * @param count number of bytes to write.                                                                                             * @throws IOException if the memory file has been purged or deactivated.                                                                                             */                                                                                            public                                 void writeBytes(byte[] buffer,                                 int srcOffset,                                 int destOffset,                                 int count)                                                                                                    throws IOException {                                                                                                           if (isDeactivated()) {                                                                                                    throw                                 new IOException(                                "Can't write to deactivated memory file.");                                                                                                }                                                                                                if (srcOffset <                                 0 || srcOffset > buffer.length || count <                                 0                                                                                                        || count > buffer.length - srcOffset                                                                                                        || destOffset <                                 0 || destOffset > mLength                                                                                                        || count > mLength - destOffset) {                                                                                                    throw                                 new IndexOutOfBoundsException();                                                                                                }                                                                                                native_write(mFD, mAddress, buffer, srcOffset, destOffset, count, mAllowPurging);                                                                                            }                                                                                        // jni ================================                                                                                        static jint android_os_MemoryFile_read(JNIEnv* env, jobject clazz,                                                                                                jobject fileDescriptor, jint address, jbyteArray buffer, jint srcOffset, jint destOffset,                                                                                                jint count, jboolean unpinned)                                                                                        {                                                                                            int fd = jniGetFDFromFileDescriptor(env, fileDescriptor);                                                                                            if (unpinned && ashmem_pin_region(fd,                                 0,                                 0) == ASHMEM_WAS_PURGED) {                                                                                                ashmem_unpin_region(fd,                                 0,                                 0);                                                                                                jniThrowException(env,                                 "java/io/IOException",                                 "ashmem region was purged");                                                                                                return -                                1;                                                                                            }                                                                                            env->SetByteArrayRegion(buffer, destOffset, count, (                                const jbyte *)address + srcOffset);                                                                                            if (unpinned) {                                                                                                ashmem_unpin_region(fd,                                 0,                                 0);                                                                                            }                                                                                            return count;                                                                                        }                                                                                        static jint android_os_MemoryFile_write(JNIEnv* env, jobject clazz,                                                                                                jobject fileDescriptor, jint address, jbyteArray buffer, jint srcOffset, jint destOffset,                                                                                                jint count, jboolean unpinned)                                                                                        {                                                                                            int fd = jniGetFDFromFileDescriptor(env, fileDescriptor);                                                                                            if (unpinned && ashmem_pin_region(fd,                                 0,                                 0) == ASHMEM_WAS_PURGED) {                                                                                                ashmem_unpin_region(fd,                                 0,                                 0);                                                                                                jniThrowException(env,                                 "java/io/IOException",                                 "ashmem region was purged");                                                                                                return -                                1;                                                                                            }                                                                                            env->GetByteArrayRegion(buffer, srcOffset, count, (jbyte *)address + destOffset);                                                                                            if (unpinned) {                                                                                                ashmem_unpin_region(fd,                                 0,                                 0);                                                                                            }                                                                                            return count;                                                                                        }                            

                                                            // java ================================                                                                                            /**                                                                                             * Closes the memory file. If there are no other open references to the memory                                                                                             * file, it will be deleted.                                                                                             */                                                                                            public                                 void close() {                                                                                                deactivate();                                                                                                if (!isClosed()) {                                                                                                    native_close(mFD);                                                                                                }                                                                                            }                                                                                            /**                                                                                             * Unmaps the memory file from the process's memory space, but does not close it.                                                                                             * After this method has been called, read and write operations through this object                                                                                             * will fail, but {@link #getFileDescriptor()} will still return a valid file descriptor.                                                                                             *                                                                                             * @hide                                                                                             */                                                                                            public                                 void deactivate() {                                                                                                if (!isDeactivated()) {                                                                                                            try {                                                                                                        native_munmap(mAddress, mLength);                                                                                                        mAddress =                                 0;                                                                                                    }                                 catch (IOException ex) {                                                                                                             Log.e(TAG, ex.toString());                                                                                                         }                                                                                                }                                                                                            }                                                                                            /**                                                                                             * Checks whether the memory file has been deactivated.                                                                                             */                                                                                            private boolean isDeactivated() {                                                                                                return mAddress ==                                 0;                                                                                            }                                                                                            /**                                                                                             * Checks whether the memory file has been closed.                                                                                             */                                                                                            private boolean isClosed() {                                                                                                return !mFD.valid();                                                                                            }                                                                                        // jni ================================                                                                                        static jint android_os_MemoryFile_mmap(JNIEnv* env, jobject clazz, jobject fileDescriptor,                                                                                                jint length, jint prot)                                                                                        {                                                                                            int fd = jniGetFDFromFileDescriptor(env, fileDescriptor);                                                                                            jint result = (jint)mmap(NULL, length, prot, MAP_SHARED, fd,                                 0);                                                                                            if (!result)                                                                                                jniThrowException(env,                                 "java/io/IOException",                                 "mmap failed");                                                                                            return result;                                                                                        }                                                                                                                                                    static                                 void android_os_MemoryFile_munmap(JNIEnv* env, jobject clazz, jint addr, jint length)                                                                                        {                                                                                            int result = munmap((                                void *)addr, length);                                                                                            if (result <                                 0)                                                                                                jniThrowException(env,                                 "java/io/IOException",                                 "munmap failed");                                                                                        }                                                                                                                                                            static                                 void android_os_MemoryFile_close(JNIEnv* env, jobject clazz, jobject fileDescriptor)                                                                                        {                                                                                            int fd = jniGetFDFromFileDescriptor(env, fileDescriptor);                                                                                            if (fd >=                                 0) {                                                                                                jniSetFileDescriptorOfFD(env, fileDescriptor, -                                1);                                                                                                close(fd);                                                                                            }                                                                                        }                            

                                                            MemoryHeapBase::MemoryHeapBase(size_t size, uint32_t flags,                                 char                                 const * name)                                                                                            : mFD(-                                1), mSize(                                0), mBase(MAP_FAILED), mFlags(flags),                                                                                              mDevice(                                0), mNeedUnmap(                                false), mOffset(                                0)                                                                                        {                                                                                            const size_t pagesize = getpagesize();                                                                                            // 页面字节对齐，native 层的就是讲究效率                                                                                            size = ((size + pagesize-                                1) & ~(pagesize-                                1));                                                                                            int fd = ashmem_create_region(name == NULL ?                                 "MemoryHeapBase" : name, size);                                                                                            ALOGE_IF(fd<                                0,                                 "error creating ashmem region: %s", strerror(errno));                                                                                            if (fd >=                                 0) {                                                                                                if (mapfd(fd, size) == NO_ERROR) {                                                                                                    if (flags & READ_ONLY) {                                                                                                               ashmem_set_prot_region(fd, PROT_READ);                                                                                                    }                                                                                                }                                                                                            }                                                                                        }                            

                                                            status_t MemoryHeapBase::mapfd(                                int fd, size_t size, uint32_t offset)                                                                                        {                                                                                            // 如果不指定大小，则尝试自动分配，不过一般使用者都会指定大小的                                                                                            if (size ==                                 0) {                                                                                                // try to figure out the size automatically                                                                                        #ifdef HAVE_ANDROID_OS                                                                                                // first try the PMEM ioctl                                                                                                    pmem_region reg;                                                                                                int err = ioctl(fd, PMEM_GET_TOTAL_SIZE, ®);                                                                                                if (err ==                                 0)                                                                                                    size = reg.len;                                                                                        #endif                                                                                                if (size ==                                 0) {                                 // try fstat                                                                                                      struct stat sb;                                                                                                    if (fstat(fd, &sb) ==                                 0)                                                                                                               size = sb.st_size;                                                                                                             }                                                                                                // if it didn't work, let mmap() fail.                                                                                            }                                                                                            // 一般也不会指定 DONT_MAP_LOCALLY 这个标志，这个标志就不会 mmap 内存了                                                                                            if ((mFlags & DONT_MAP_LOCALLY) ==                                 0) {                                                                                                void* base = (uint8_t*)mmap(                                0, size,                                                                                                         PROT_READ|PROT_WRITE, MAP_SHARED, fd, offset);                                                                                                if (base == MAP_FAILED) {                                                                                                          ALOGE(                                "mmap(fd=%d, size=%u) failed (%s)",                                                                                                            fd, uint32_t(size), strerror(errno));                                                                                                    close(fd);                                                                                                    return -errno;                                                                                                }                                                                                                //ALOGD("mmap(fd=%d, base=%p, size=%lu)", fd, base, size);                                                                                                mBase = base;                                                                                                mNeedUnmap =                                 true;                                                                                            }                                 else  {                                                                                                mBase =                                 0;                                 // not MAP_FAILED                                                                                                mNeedUnmap =                                 false;                                                                                            }                                                                                            mFD = fd;                                                                                            mSize = size;                                                                                            mOffset = offset;                                                                                            return NO_ERROR;                                                                                        }                            

                                                            // 我把相关代码贴全点，帮大家回想起 binder 相关的接口                                                                                        // IMemroy ================================                                                                                        class BnMemoryHeap :                                 public BnInterface                                                                                        {                                                                                        public:                                                                                            virtual status_t onTransact(                                                                                                     uint32_t code,                                                                                                    const Parcel& data,                                                                                                    Parcel* reply,                                                                                                    uint32_t flags =                                 0);                                                                                                                                                             BnMemoryHeap();                                                                                        protected:                                                                                            virtual ~BnMemoryHeap();                                                                                        };                                                                                        // MemroyHeapBase =========================                                                                                        class MemoryHeapBase :                                 public                                 virtual BnMemoryHeap                                                                                        {                                                                                        ... ...                                                                                        }                                                                                        // MemroyBase =============================                                                                                        class MemoryBase :                                 public BnMemory                                                                                         {                                                                                        public:                                                                                            MemoryBase(                                const sp& heap, ssize_t offset, size_t size);                                                                                            virtual ~MemoryBase();                                                                                            virtual sp getMemory(ssize_t* offset, size_t* size)                                 const;                                                                                        protected:                                                                                            size_t getSize()                                 const {                                 return mSize; }                                                                                            ssize_t getOffset()                                 const {                                 return mOffset; }                                                                                            const sp& getHeap()                                 const {                                 return mHeap; }                                                                                        private:                                                                                            size_t          mSize;                                                                                            ssize_t         mOffset;                                                                                            sp mHeap;                                                                                        };                                                                                        MemoryBase::MemoryBase(                                const sp& heap,                                                                                                ssize_t offset, size_t size)                                                                                            : mSize(size), mOffset(offset), mHeap(heap)                                                                                        {                                                                                        }                            

                                                            class ProcA :                                 public BinderService,                                                                                                             public BnProcA                                                                                        {                                                                                        public:                                                                                            static                                 char                                 const* getServiceName() {                                                                                                return                                 "ProcA";                                                                                            }                                                                                            ProcA();                                                                                            ~ProcA();                                                                                        private:                                                                                            virtual status_t onTransact(uint32_t code,                                 const Parcel& data,                                                                                                Parcel* reply, uint32_t flags);                                                                                            virtual sp getMemory();                                                                                            sp mMemory;                                                                                        };                                                                                        ProcA::K7Service()                                                                                            :   BnK7() {                                                                                            sp heap =                                 new MemoryHeapBase(                                2048,                                 0,                                 "K7Service");                                                                                            mMemory =                                 new MemoryBase(heap,                                 0,                                 2048);                                                                                        }                            

                                                            // IProcA =================================                                                                                        class BpProcA :                                 public BpInterface                                                                                        {                                                                                        public:                                                                                            virtual sp getMemory() {                                                                                                Parcel data, reply;                                                                                                data.writeInterfaceToken(IProcA::getInterfaceDescriptor());                                                                                                remote()->transact(BnProcA::GET_MEMORY, data, &reply);                                                                                                sp memory = interface_cast(reply.readStrongBinder());                                                                                                return memory;                                                                                            }                                                                                        }                                                                                        status_t BnProcA::onTransact(                                                                                            uint32_t code,                                 const Parcel& data, Parcel* reply, uint32_t flags)                                                                                        {                                                                                            switch(code) {                                                                                                case GET_MEMORY: {                                                                                                    CHECK_INTERFACE(IProcA, data, reply);                                                                                                    sp memory = getMemory();                                                                                                    reply->writeStrongBinder(memory->asBinder());                                                                                                }                                 break;                                                                                                default:                                                                                                    return BBinder::onTransact(code, data, reply, flags);                                                                                            }                                                                                            return NO_ERROR;                                                                                        }                                                                                        // ProcA ==================================                                                                                        sp K7Service::getMemory() {                                                                                             return mMemory;                                                                                        }                            

                                                            // IMemroy.h ==================================                                                                                        class IMemory :                                 public IInterface                                                                                        {                                                                                        public:                                                                                            DECLARE_META_INTERFACE(Memory);                                                                                            virtual sp getMemory(ssize_t* offset=                                0, size_t* size=                                0)                                 const =                                 0;                                                                                            // helpers                                                                                            void* fastPointer(                                const sp& heap, ssize_t offset)                                 const;                                                                                            void* pointer()                                 const;                                                                                            size_t size()                                 const;                                                                                            ssize_t offset()                                 const;                                                                                        };                                                                                        class BnMemory :                                 public BnInterface                                                                                        {                                                                                        public:                                                                                            virtual status_t onTransact(                                                                                                    uint32_t code,                                                                                                    const Parcel& data,                                                                                                                Parcel* reply,                                                                                                    uint32_t flags =                                 0);                                                                                            BnMemory();                                                                                        protected:                                                                                            virtual ~BnMemory();                                                                                        };                                                                                        // IMemroy.cpp ==================================                                                                                        void* IMemory::pointer()                                 const {                                                                                            ssize_t offset;                                                                                            sp heap = getMemory(&offset);                                                                                            void*                                 const base = heap!=                                0 ? heap->base() : MAP_FAILED;                                                                                            if (base == MAP_FAILED)                                                                                                return                                 0;                                                                                            return                                 static_cast<                                char*>(base) + offset;                                                                                        }                                                                                        size_t IMemory::size()                                 const {                                                                                            size_t size;                                                                                            getMemory(NULL, &size);                                                                                            return size;                                                                                        }                                                                                        ssize_t IMemory::offset()                                 const {                                                                                            ssize_t offset;                                                                                            getMemory(&offset);                                                                                            return offset;                                                                                        }                            

                                                            // MemroyBase ===============================                                                                                        sp MemoryBase::getMemory(ssize_t* offset, size_t* size)                                 const                                                                                        {                                                                                            if (offset) *offset = mOffset;                                                                                            if (size)   *size = mSize;                                                                                            return mHeap;                                                                                        }                                                                                        // IMemroy ==================================                                                                                        sp BpMemory::getMemory(ssize_t* offset, size_t* size)                                 const                                                                                        {                                                                                            if (mHeap ==                                 0) {                                                                                                Parcel data, reply;                                                                                                data.writeInterfaceToken(IMemory::getInterfaceDescriptor());                                                                                                if (remote()->transact(GET_MEMORY, data, &reply) == NO_ERROR) {                                                                                                    sp heap = reply.readStrongBinder();                                                                                                    ssize_t o = reply.readInt32();                                                                                                     size_t s = reply.readInt32();                                                                                                      if (heap !=                                 0) {                                                                                                        mHeap = interface_cast(heap);                                                                                                        if (mHeap !=                                 0) {                                                                                                                          mOffset = o;                                                                                                                               mSize = s;                                                                                                        }                                                                                                    }                                                                                                }                                                                                            }                                                                                            if (offset) *offset = mOffset;                                                                                             if (size) *size = mSize;                                                                                            return mHeap;                                                                                        }                                                                                        status_t BnMemory::onTransact(                                                                                            uint32_t code,                                 const Parcel& data, Parcel* reply, uint32_t flags)                                                                                         {                                                                                            switch(code) {                                                                                                case GET_MEMORY: {                                                                                                    CHECK_INTERFACE(IMemory, data, reply);                                                                                                    ssize_t offset;                                                                                                    size_t size;                                                                                                    reply->writeStrongBinder( getMemory(&offset, &size)->asBinder() );                                                                                                    reply->writeInt32(offset);                                                                                                         reply->writeInt32(size);                                                                                                           return NO_ERROR;                                                                                                }                                 break;                                                                                                default:                                                                                                    return BBinder::onTransact(code, data, reply, flags);                                                                                            }                                                                                        }                            

                                                            // MemroyHeapBase ============================                                                                                        int MemoryHeapBase::getHeapID()                                 const {                                                                                            return mFD;                                                                                        }                                                                                        // IMemroy.h ==================================                                                                                        class IMemoryHeap :                                 public IInterface                                                                                        {                                                                                        public:                                                                                            DECLARE_META_INTERFACE(MemoryHeap);                                                                                            // flags returned by getFlags()                                                                                            enum {                                                                                                READ_ONLY   =                                 0x00000001                                                                                                   };                                                                                            virtual                                 int         getHeapID()                                 const =                                 0;                                                                                            virtual                                 void*       getBase()                                 const =                                 0;                                                                                            virtual size_t      getSize()                                 const =                                 0;                                                                                            virtual uint32_t    getFlags()                                 const =                                 0;                                                                                            virtual uint32_t    getOffset()                                 const =                                 0;                                                                                            // these are there just for backward source compatibility                                                                                            int32_t heapID()                                 const {                                 return getHeapID(); }                                                                                            void*   base()                                 const  {                                 return getBase(); }                                                                                            size_t  virtualSize()                                 const {                                 return getSize(); }                                                                                        };                                                                                        class BnMemoryHeap :                                 public BnInterface                                                                                        {                                                                                        public:                                                                                            virtual status_t onTransact(                                                                                                    uint32_t code,                                                                                                    const Parcel& data,                                                                                                                Parcel* reply,                                                                                                    uint32_t flags =                                 0);                                                                                                                                                                   BnMemoryHeap();                                                                                        protected:                                                                                            virtual ~BnMemoryHeap();                                                                                        };                                                                                        // IMemroy.cpp ==================================                                                                                        int BpMemoryHeap::getHeapID()                                 const {                                                                                            assertMapped();                                                                                            return mHeapId;                                                                                        }                                                                                        void* BpMemoryHeap::getBase()                                 const {                                                                                            assertMapped();                                                                                            return mBase;                                                                                        }                                                                                        size_t BpMemoryHeap::getSize()                                 const {                                                                                            assertMapped();                                                                                            return mSize;                                                                                        }                                                                                        uint32_t BpMemoryHeap::getFlags()                                 const {                                                                                            assertMapped();                                                                                            return mFlags;                                                                                        }                                                                                        uint32_t BpMemoryHeap::getOffset()                                 const {                                                                                            assertMapped();                                                                                            return mOffset;                                                                                        }                                                                                        status_t BnMemoryHeap::onTransact(                                                                                                uint32_t code,                                 const Parcel& data, Parcel* reply, uint32_t flags)                                                                                         {                                                                                            switch(code) {                                                                                               case HEAP_ID: {                                                                                                    CHECK_INTERFACE(IMemoryHeap, data, reply);                                                                                                    reply->writeFileDescriptor(getHeapID());                                                                                                    reply->writeInt32(getSize());                                                                                                      reply->writeInt32(getFlags());                                                                                                     reply->writeInt32(getOffset());                                                                                                    return NO_ERROR;                                                                                                  }                                 break;                                                                                                default:                                                                                                    return BBinder::onTransact(code, data, reply, flags);                                                                                            }                                                                                        }                            

                                                            void BpMemoryHeap::assertMapped()                                 const                                                                                        {                                                                                            if (mHeapId == -                                1) {                                                                                                sp binder(                                const_cast(                                this)->asBinder());                                                                                                sp heap(                                static_cast(find_heap(binder).get()));                                                                                                heap->assertReallyMapped();                                                                                                    if (heap->mBase != MAP_FAILED) {                                                                                                    Mutex::Autolock _l(mLock);                                                                                                         if (mHeapId == -                                1) {                                                                                                                   mBase   = heap->mBase;                                                                                                                 mSize   = heap->mSize;                                                                                                                 mOffset = heap->mOffset;                                                                                                               android_atomic_write( dup( heap->mHeapId ), &mHeapId );                                                                                                    }                                                                                                }                                 else {                                                                                                    // something went wrong                                                                                                            free_heap(binder);                                                                                                }                                                                                            }                                                                                        }                                                                                        void BpMemoryHeap::assertReallyMapped()                                 const                                                                                        {                                                                                            if (mHeapId == -                                1) {                                                                                                // 注释好像是说为了性能，不在 transact 远程调用加锁，只在后面 mmap 那里加锁                                                                                                // remote call without mLock held, worse case scenario, we end up                                                                                                // calling transact() from multiple threads, but that's not a problem,                                                                                                // only mmap below must be in the critical section.                                                                                                Parcel data, reply;                                                                                                data.writeInterfaceToken(IMemoryHeap::getInterfaceDescriptor());                                                                                                status_t err = remote()->transact(HEAP_ID, data, &reply);                                                                                                int parcel_fd = reply.readFileDescriptor();                                                                                                ssize_t size = reply.readInt32();                                                                                                uint32_t flags = reply.readInt32();                                                                                                uint32_t offset = reply.readInt32();                                                                                                ALOGE_IF(err,                                 "binder=%p transaction failed fd=%d, size=%ld, err=%d (%s)",                                                                                                        asBinder().get(), parcel_fd, size, err, strerror(-err));                                                                                                int fd = dup( parcel_fd );                                                                                                ALOGE_IF(fd==-                                1,                                 "cannot dup fd=%d, size=%ld, err=%d (%s)",                                                                                                        parcel_fd, size, err, strerror(errno));                                                                                                int access = PROT_READ;                                                                                                if (!(flags & READ_ONLY)) {                                                                                                    access |= PROT_WRITE;                                                                                                }                                                                                                Mutex::Autolock _l(mLock);                                                                                                if (mHeapId == -                                1) {                                                                                                    mRealHeap =                                 true;                                                                                                    mBase = mmap(                                0, size, access, MAP_SHARED, fd, offset);                                                                                                    if (mBase == MAP_FAILED) {                                                                                                        ALOGE(                                "cannot map BpMemoryHeap (binder=%p), size=%ld, fd=%d (%s)",                                                                                                                asBinder().get(), size, fd, strerror(errno));                                                                                                        close(fd);                                                                                                    }                                 else {                                                                                                        mSize = size;                                                                                                        mFlags = flags;                                                                                                        mOffset = offset;                                                                                                        // mHeapId 就是 fd 啊                                                                                                        android_atomic_write(fd, &mHeapId);                                                                                                    }                                                                                                }                                                                                            }                                                                                        }                            

                                                            // 因为主要 open、mmap 都是 MemoryHeapBase 做的，MemoryBase 只是把地址、偏移设置了下，                                                                                        // 所以 close、munmap 都只要 MemoryHeapBase 来做就行了，MemoryBase 不用做什么清理的。                                                                                        // Bn 端（Proc A）的关闭                                                                                        // MemroyHeapBase ==================================                                                                                        MemoryHeapBase::~MemoryHeapBase()                                                                                        {                                                                                            dispose();                                                                                        }                                                                                        void MemoryHeapBase::dispose()                                                                                        {                                                                                            int fd = android_atomic_or(-                                1, &mFD);                                                                                             if (fd >=                                 0) {                                                                                                if (mNeedUnmap) {                                                                                                    //ALOGD("munmap(fd=%d, base=%p, size=%lu)", fd, mBase, mSize);                                                                                                    munmap(mBase, mSize);                                                                                                          }                                                                                                mBase =                                 0;                                                                                                mSize =                                 0;                                                                                                close(fd);                                                                                            }                                                                                        }                                                                                        // Bp 端（Proc B）的关闭                                                                                         // IMemroy ==================================                                                                                        BpMemoryHeap::~BpMemoryHeap() {                                                                                            if (mHeapId != -                                1) {                                                                                                close(mHeapId);                                                                                                if (mRealHeap) {                                                                                                    // by construction we're the last one                                                                                                    if (mBase != MAP_FAILED) {                                                                                                        sp binder =                                 const_cast(                                this)->asBinder();                                                                                                                                                                    if (VERBOSE) {                                                                                                            ALOGD(                                "UNMAPPING binder=%p, heap=%p, size=%d, fd=%d",                                                                                                                    binder.get(),                                 this, mSize, mHeapId);                                                                                                            CallStack                                 stack(LOG_TAG);                                                                                                        }                                                                                                                                                                    munmap(mBase, mSize);                                                                                                    }                                                                                                }                                 else {                                                                                                    // remove from list only if it was mapped before                                                                                                    sp binder =                                 const_cast(                                this)->asBinder();                                                                                                    free_heap(binder);                                                                                                }                                                                                            }                                                                                        }                            

                                                            /*                                                                                         * ashmem_area - anonymous shared memory area                                                                                         * Lifecycle: From our parent file's open() until its release()                                                                                         * Locking: Protected by `ashmem_mutex'                                                                                         * Big Note: Mappings do NOT pin this structure; it dies on close()                                                                                         */                                                                                        struct ashmem_area {                                                                                            char name[ASHMEM_FULL_NAME_LEN];                                /* optional name for /proc/pid/maps */                                                                                            struct list_head unpinned_list;                                 /* list of all ashmem areas */                                                                                             struct file *file;                                      /* the shmem-based backing file */                                                                                            size_t size;                                            /* size of the mapping, in bytes */                                                                                            unsigned                                 long prot_mask;                                    /* allowed prot bits, as vm_flags */                                                                                        };                                                                                        static                                 struct kmem_cache *ashmem_area_cachep __read_mostly;                                                                                        static                                 struct kmem_cache *ashmem_range_cachep __read_mostly;                                                                                        static                                 int __init ashmem_init(                                void)                                                                                        {                                                                                            int ret;                                                                                            // 为 ashmem 驱动的数据结构创建一块后备高速缓存                                                                                            ashmem_area_cachep = kmem_cache_create(                                "ashmem_area_cache",                                                                                                              sizeof(                                struct ashmem_area),                                                                                                              0,                                 0, NULL);                                                                                            if (unlikely(!ashmem_area_cachep)) {                                                                                                printk(KERN_ERR                                 "ashmem: failed to create slab cache\n");                                                                                                return -ENOMEM;                                                                                            }                                                                                            // 这块数据结构是 pin/unpin 相关的，无视 ... ...                                                                                            ashmem_range_cachep = kmem_cache_create(                                "ashmem_range_cache",                                                                                                              sizeof(                                struct ashmem_range),                                                                                                              0,                                 0, NULL);                                                                                            if (unlikely(!ashmem_range_cachep)) {                                                                                                printk(KERN_ERR                                 "ashmem: failed to create slab cache\n");                                                                                                return -ENOMEM;                                                                                            }                                                                                            // 注册驱动操作相关函数                                                                                            ret = misc_register(&ashmem_misc);                                                                                            if (unlikely(ret)) {                                                                                                printk(KERN_ERR                                 "ashmem: failed to register misc device!\n");                                                                                                return ret;                                                                                            }                                                                                            // 注册内存回收扫描算法，继续无视 ... ...                                                                                            register_shrinker(&ashmem_shrinker);                                                                                            printk(KERN_INFO                                 "ashmem: initialized\n");                                                                                            return                                 0;                                                                                        }                                                                                        // exit 函数很多对应上面 init 的注销、销毁操作                                                                                        static                                 void __exit ashmem_exit(                                void)                                                                                        {                                                                                            int ret;                                                                                            unregister_shrinker(&ashmem_shrinker);                                                                                            ret = misc_deregister(&ashmem_misc);                                                                                            if (unlikely(ret))                                                                                                printk(KERN_ERR                                 "ashmem: failed to unregister misc device!\n");                                                                                            kmem_cache_destroy(ashmem_range_cachep);                                                                                            kmem_cache_destroy(ashmem_area_cachep);                                                                                            printk(KERN_INFO                                 "ashmem: unloaded\n");                                                                                        }                                                                                        module_init(ashmem_init);                                                                                        module_exit(ashmem_exit);                            

                                                            static                                 struct file_operations ashmem_fops = {                                                                                            .owner = THIS_MODULE,                                                                                            .open = ashmem_open,                                                                                            .release = ashmem_release,                                                                                                .read = ashmem_read,                                                                                                  .llseek = ashmem_llseek,                                                                                                   .mmap = ashmem_mmap,                                                                                            .unlocked_ioctl = ashmem_ioctl,                                                                                            .compat_ioctl = ashmem_ioctl,                                                                                        };                                                                                        static                                 struct miscdevice ashmem_misc = {                                                                                            .minor = MISC_DYNAMIC_MINOR,                                                                                            .name =                                 "ashmem",                                                                                            .fops = &ashmem_fops,                                                                                        };                            

                                                            static                                 int ashmem_open(                                struct inode *inode,                                 struct file *file)                                                                                        {                                                                                            struct ashmem_area *asma;                                                                                            int ret;                                                                                            // 调用系统方法打开文件                                                                                            ret = generic_file_open(inode, file);                                                                                            if (unlikely(ret))                                                                                                return ret;                                                                                            // 在 init 创建的高速缓存区，申请 struct ashmem_area 变量                                                                                            asma = kmem_cache_zalloc(ashmem_area_cachep, GFP_KERNEL);                                                                                            if (unlikely(!asma))                                                                                                return -ENOMEM;                                                                                            INIT_LIST_HEAD(&asma->unpinned_list);                                                                                            // 保持打开的文件的名字                                                                                            memcpy(asma->name, ASHMEM_NAME_PREFIX, ASHMEM_NAME_PREFIX_LEN);                                                                                            asma->prot_mask = PROT_MASK;                                                                                            // 保持驱动私有变量                                                                                            file->private_data = asma;                                                                                            return                                 0;                                                                                        }                            

                                                            static                                 int ashmem_mmap(                                struct file *file,                                 struct vm_area_struct *vma)                                                                                        {                                                                                            struct ashmem_area *asma = file->private_data;                                                                                            int ret =                                 0;                                                                                            mutex_lock(&ashmem_mutex);                                                                                            // 在调用 mmap 之前必须调用 ioctl SET_SIZE -_-||                                                                                            /* user needs to SET_SIZE before mapping */                                                                                            if (unlikely(!asma->size)) {                                                                                                ret = -EINVAL;                                                                                                        goto out;                                                                                            }                                                                                            /* requested protection bits must match our allowed protection mask */                                                                                            if (unlikely((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask)) &                                                                                                                calc_vm_prot_bits(PROT_MASK))) {                                                                                                ret = -EPERM;                                                                                                         goto out;                                                                                                         }                                                                                            vma->vm_flags &= ~calc_vm_may_flags(~asma->prot_mask);                                                                                            // 还没创建共享内存文件，则创建                                                                                            if (!asma->file) {                                                                                                char *name = ASHMEM_NAME_DEF;                                                                                                  struct file *vmfile;                                                                                                  if (asma->name[ASHMEM_NAME_PREFIX_LEN] !=                                 '\0')                                                                                                    name = asma->name;                                                                                                // 在 tmpfs 文件系统上创建共享内存文件                                                                                                /* ... and allocate the backing shmem file */                                                                                                vmfile = shmem_file_setup(name, asma->size, vma->vm_flags);                                                                                                if (unlikely(IS_ERR(vmfile))) {                                                                                                    ret = PTR_ERR(vmfile);                                                                                                    goto out;                                                                                                }                                                                                                asma->file = vmfile;                                                                                            }                                                                                            get_file(asma->file);                                                                                            if (vma->vm_flags & VM_SHARED)                                                                                                shmem_set_file(vma, asma->file);                                                                                            else {                                                                                                if (vma->vm_file)                                                                                                    fput(vma->vm_file);                                                                                                vma->vm_file = asma->file;                                                                                            }                                                                                            vma->vm_flags |= VM_CAN_NONLINEAR;                                                                                        out:                                                                                            mutex_unlock(&ashmem_mutex);                                                                                            return ret;                                                                                        }                                                                                        static                                 long ashmem_ioctl(                                struct file *file,                                 unsigned                                 int cmd,                                 unsigned                                 long arg)                                                                                        {                                                                                            struct ashmem_area *asma = file->private_data;                                                                                            long ret = -ENOTTY;                                                                                            switch (cmd) {                                                                                            case ASHMEM_SET_NAME:                                                                                                ret = set_name(asma, (                                void __user *) arg);                                                                                                break;                                                                                            case ASHMEM_GET_NAME:                                                                                                ret = get_name(asma, (                                void __user *) arg);                                                                                                break;                                                                                            case ASHMEM_SET_SIZE:                                                                                                ret = -EINVAL;                                                                                                if (!asma->file) {                                                                                                    ret =                                 0;                                                                                                    asma->size = (size_t) arg;                                                                                                     }                                                                                                break;                                                                                            case ASHMEM_GET_SIZE:                                                                                                ret = asma->size;                                                                                                break;                                                                                            case ASHMEM_SET_PROT_MASK:                                                                                                ret = set_prot_mask(asma, arg);                                                                                                break;                                                                                            case ASHMEM_GET_PROT_MASK:                                                                                                ret = asma->prot_mask;                                                                                                break;                                                                                            case ASHMEM_PIN:                                                                                            case ASHMEM_UNPIN:                                                                                            case ASHMEM_GET_PIN_STATUS:                                                                                                ret = ashmem_pin_unpin(asma, cmd, (                                void __user *) arg);                                                                                                break;                                                                                            case ASHMEM_PURGE_ALL_CACHES:                                                                                                ret = -EPERM;                                                                                                if (capable(CAP_SYS_ADMIN)) {                                                                                                    struct shrink_control sc = {                                                                                                        .gfp_mask = GFP_KERNEL,                                                                                                        .nr_to_scan =                                 0,                                                                                                    };                                                                                                    ret = ashmem_shrink(&ashmem_shrinker, &sc);                                                                                                    sc.nr_to_scan = ret;                                                                                                    ashmem_shrink(&ashmem_shrinker, &sc);                                                                                                }                                                                                                break;                                                                                            }                                                                                            return ret;                                                                                        }                            

                                                            static                                 void binder_transaction(                                struct binder_proc *proc,                                                                                                           struct binder_thread *thread,                                                                                                           struct binder_transaction_data *tr,                                 int reply)                                                                                        {                                                                                            struct binder_transaction *t;                                                                                            struct binder_work *tcomplete;                                                                                            size_t *offp, *off_end;                                                                                            struct binder_proc *target_proc;                                                                                            struct binder_thread *target_thread = NULL;                                                                                            struct binder_node *target_node = NULL;                                                                                            struct list_head *target_list;                                                                                            wait_queue_head_t *target_wait;                                                                                            struct binder_transaction *in_reply_to = NULL;                                                                                            struct binder_transaction_log_entry *e;                                                                                            uint32_t return_error;                                                                                        ... ...                                                                                            offp = (size_t *)(t->buffer->data + ALIGN(tr->data_size,                                 sizeof(                                void *)));                                                                                            if (copy_from_user(t->buffer->data, tr->data.ptr.buffer, tr->data_size)) {                                                                                                binder_user_error(                                "binder: %d:%d got transaction with invalid "                                                                                                    "data ptr\n", proc->pid, thread->pid);                                                                                                return_error = BR_FAILED_REPLY;                                                                                                goto err_copy_data_failed;                                                                                            }                                                                                            if (copy_from_user(offp, tr->data.ptr.offsets, tr->offsets_size)) {                                                                                                binder_user_error(                                "binder: %d:%d got transaction with invalid "                                                                                                    "offsets ptr\n", proc->pid, thread->pid);                                                                                                return_error = BR_FAILED_REPLY;                                                                                                goto err_copy_data_failed;                                                                                            }                                                                                            if (!IS_ALIGNED(tr->offsets_size,                                 sizeof(size_t))) {                                                                                                binder_user_error(                                "binder: %d:%d got transaction with "                                                                                                    "invalid offsets size, %zd\n",                                                                                                    proc->pid, thread->pid, tr->offsets_size);                                                                                                return_error = BR_FAILED_REPLY;                                                                                                goto err_bad_offset;                                                                                            }                                                                                            off_end = (                                void *)offp + tr->offsets_size;                                                                                            for (; offp < off_end; offp++) {                                                                                                struct flat_binder_object *fp;                                                                                                if (*offp > t->buffer->data_size -                                 sizeof(*fp) ||                                                                                                    t->buffer->data_size <                                 sizeof(*fp) ||                                                                                                    !IS_ALIGNED(*offp,                                 sizeof(                                void *))) {                                                                                                    binder_user_error(                                "binder: %d:%d got transaction with "                                                                                                        "invalid offset, %zd\n",                                                                                                        proc->pid, thread->pid, *offp);                                                                                                    return_error = BR_FAILED_REPLY;                                                                                                    goto err_bad_offset;                                                                                                }                                                                                                fp = (                                struct flat_binder_object *)(t->buffer->data + *offp);                                                                                                switch (fp->type) {                                                                                                ... ...                                                                                                case BINDER_TYPE_FD: {                                                                                                    int target_fd;                                                                                                    struct file *file;                                                                                                    if (reply) {                                                                                                        // 如果目标对象不接受 fd 的话则报错，前面 Parcel 调用那个相关接口的时候设置了这个标志的                                                                                                        if (!(in_reply_to->flags & TF_ACCEPT_FDS)) {                                                                                                            binder_user_error(                                "binder: %d:%d got reply with fd, %ld, but target does not allow fds\n",                                                                                                                proc->pid, thread->pid, fp->handle);                                                                                                            return_error = BR_FAILED_REPLY;                                                                                                            goto err_fd_not_allowed;                                                                                                        }                                                                                                    }                                 else                                 if (!target_node->accept_fds) {                                                                                                        binder_user_error(                                "binder: %d:%d got transaction with fd, %ld, but target does not allow fds\n",                                                                                                            proc->pid, thread->pid, fp->handle);                                                                                                        return_error = BR_FAILED_REPLY;                                                                                                        goto err_fd_not_allowed;                                                                                                    }                                                                                                    // 这个 fp->handle 就是前面的 fd                                                                                                    // 通过 fd 取得 file 文件指针                                                                                                    file = fget(fp->handle);                                                                                                    if (file == NULL) {                                                                                                        binder_user_error(                                "binder: %d:%d got transaction with invalid fd, %ld\n",                                                                                                            proc->pid, thread->pid, fp->handle);                                                                                                        return_error = BR_FAILED_REPLY;                                                                                                        goto err_fget_failed;                                                                                                    }                                                                                                    // 寻找目标进程（target_proc: Proc B）中空闲的 fd                                                                                                    target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC);                                                                                                    if (target_fd <                                 0) {                                                                                                        fput(file);                                                                                                        return_error = BR_FAILED_REPLY;                                                                                                        goto err_get_unused_fd_failed;                                                                                                    }                                                                                                    // 在目标进程空闲的 fd 中安装 file 文件指针                                                                                                    task_fd_install(target_proc, target_fd, file);                                                                                                    binder_debug(BINDER_DEBUG_TRANSACTION,                                                                                                             "        fd %ld -> %d\n", fp->handle, target_fd);                                                                                                    // 把转化好的目标进程的 fd 设回 flat_binder_object 传递给上层应用                                                                                                    /* TODO: fput? */                                                                                                    fp->handle = target_fd;                                                                                                }                                 break;                                                                                                default:                                                                                                    binder_user_error(                                "binder: %d:%d got transactio"                                                                                                        "n with invalid object type, %lx\n",                                                                                                        proc->pid, thread->pid, fp->type);                                                                                                    return_error = BR_FAILED_REPLY;                                                                                                    goto err_bad_object_type;                                                                                                }                                                                                            }                                                                                            ... ...                                                                                        }                            

                                                            /*                                                                                         * copied from get_unused_fd_flags                                                                                         */                                                                                        int task_get_unused_fd_flags(                                struct binder_proc *proc,                                 int flags)                                                                                        {                                                                                            struct files_struct *files = proc->files;                                                                                            int fd, error;                                                                                            struct fdtable *fdt;                                                                                            unsigned                                 long rlim_cur;                                                                                            unsigned                                 long irqs;                                                                                            if (files == NULL)                                                                                                return -ESRCH;                                                                                            error = -EMFILE;                                                                                            spin_lock(&files->file_lock);                                                                                        repeat:                                                                                            fdt = files_fdtable(files);                                                                                            fd = find_next_zero_bit(fdt->open_fds->fds_bits, fdt->max_fds,                                                                                                        files->next_fd);                                                                                            /*                                                                                             * N.B. For clone tasks sharing a files structure, this test                                                                                             * will limit the total number of files that can be opened.                                                                                             */                                                                                            rlim_cur =                                 0;                                                                                            if (lock_task_sighand(proc->tsk, &irqs)) {                                                                                                rlim_cur = proc->tsk->signal->rlim[RLIMIT_NOFILE].rlim_cur;                                                                                                unlock_task_sighand(proc->tsk, &irqs);                                                                                            }                                                                                            if (fd >= rlim_cur)                                                                                                goto out;                                                                                            /* Do we need to expand the fd array or fd set?  */                                                                                            error = expand_files(files, fd);                                                                                            if (error <                                 0)                                                                                                goto out;                                                                                            if (error) {                                                                                                /*                                                                                                 * If we needed to expand the fs array we                                                                                                 * might have blocked - try again.                                                                                                 */                                                                                                error = -EMFILE;                                                                                                goto repeat;                                                                                            }                                                                                            FD_SET(fd, fdt->open_fds);                                                                                            if (flags & O_CLOEXEC)                                                                                                FD_SET(fd, fdt->close_on_exec);                                                                                            else                                                                                                FD_CLR(fd, fdt->close_on_exec);                                                                                            files->next_fd = fd +                                 1;                                                                                        #if 1                                                                                            /* Sanity check */                                                                                            if (fdt->fd[fd] != NULL) {                                                                                                printk(KERN_WARNING                                 "get_unused_fd: slot %d not NULL!\n", fd);                                                                                                fdt->fd[fd] = NULL;                                                                                            }                                                                                        #endif                                                                                            error = fd;                                                                                        out:                                                                                            spin_unlock(&files->file_lock);                                                                                            return error;                                                                                        }                                                                                        /*                                                                                         * copied from fd_install                                                                                         */                                                                                        static                                 void task_fd_install(                                                                                            struct binder_proc *proc,                                 unsigned                                 int fd,                                 struct file *file)                                                                                        {                                                                                            struct files_struct *files = proc->files;                                                                                            struct fdtable *fdt;                                                                                            if (files == NULL)                                                                                                return;                                                                                            spin_lock(&files->file_lock);                                                                                            fdt = files_fdtable(files);                                                                                            BUG_ON(fdt->fd[fd] != NULL);                                                                                            rcu_assign_pointer(fdt->fd[fd], file);                                                                                            spin_unlock(&files->file_lock);                                                                                        }                            

                                                            static                                 int ashmem_release(                                struct inode *ignored,                                 struct file *file)                                                                                        {                                                                                            struct ashmem_area *asma = file->private_data;                                                                                            struct ashmem_range *range, *next;                                                                                            mutex_lock(&ashmem_mutex);                                                                                            list_for_each_entry_safe(range, next, &asma->unpinned_list, unpinned)                                                                                                range_del(range);                                                                                            mutex_unlock(&ashmem_mutex);                                                                                            if (asma->file)                                                                                                fput(asma->file);                                                                                            kmem_cache_free(ashmem_area_cachep, asma);                                                                                            return                                 0;                                                                                        }                            

                                                            public                                 static                                 final Parcelable.Creator CREATOR                                                                                                =                                 new Parcelable.Creator() {                                                                                            /**                                                                                               * Rebuilds a bitmap previously stored with writeToParcel().                                                                                             *                                                                                             * @param p    Parcel object to read the bitmap from                                                                                             * @return a new bitmap created from the data in the parcel                                                                                             */                                                                                            public Bitmap                                 createFromParcel(Parcel p) {                                                                                                 Bitmap bm = nativeCreateFromParcel(p);                                                                                                if (bm ==                                 null) {                                                                                                    throw                                 new RuntimeException(                                "Failed to unparcel Bitmap");                                                                                                }                                                                                                    return bm;                                                                                            }                                                                                                public Bitmap[]                                 newArray(                                int size) {                                                                                                return                                 new Bitmap[size];                                                                                            }                                                                                            };                                                                                        /*                                                                                         * No special parcel contents.                                                                                         */                                                                                        public                                 int                                 describeContents() {                                                                                            return                                 0;                                                                                        }                                                                                        /*                                                                                         * Write the bitmap and its pixels to the parcel. The bitmap can be                                                                                         * rebuilt from the parcel by calling CREATOR.createFromParcel().                                                                                         * @param p    Parcel object to write the bitmap data into                                                                                         */                                                                                        public                                 void                                 writeToParcel(Parcel p,                                 int flags) {                                                                                            checkRecycled(                                "Can't parcel a recycled bitmap");                                                                                            if (!nativeWriteToParcel(mNativeBitmap, mIsMutable, mDensity, p)) {                                                                                                throw                                 new RuntimeException(                                "native writeToParcel failed");                                                                                            }                                                                                            }                            

                                                            static jboolean Bitmap_writeToParcel(JNIEnv* env, jobject,                                                                                                                             const SkBitmap* bitmap,                                                                                                                             jboolean isMutable, jint density,                                                                                                                             jobject parcel) {                                                                                            if (parcel == NULL) {                                                                                                SkDebugf(                                "------- writeToParcel null parcel\n");                                                                                                return                                 false;                                                                                            }                                                                                                                                                        // 通过 java 的 Parcel 对象获取 native 层的 parcel 对象                                                                                            android::Parcel* p = android::parcelForJavaObject(env, parcel);                                                                                            // 把 bitmap 的一些配置信息写进去                                                                                            p->writeInt32(isMutable);                                                                                            p->writeInt32(bitmap->config());                                                                                            p->writeInt32(bitmap->width());                                                                                            p->writeInt32(bitmap->height());                                                                                            p->writeInt32(bitmap->rowBytes());                                                                                            p->writeInt32(density);                                                                                            // 如果是 index 格式，不使用 ashmem，直接拿 Parcel 申请普通内存传递                                                                                            // 颜色索引格式的图片占用资源一般都不大                                                                                            if (bitmap->getConfig() == SkBitmap::kIndex8_Config) {                                                                                                SkColorTable* ctable = bitmap->getColorTable();                                                                                                if (ctable != NULL) {                                                                                                    int count = ctable->count();                                                                                                    p->writeInt32(count);                                                                                                    memcpy(p->writeInplace(count *                                 sizeof(SkPMColor)),                                                                                                           ctable->lockColors(), count *                                 sizeof(SkPMColor));                                                                                                    ctable->unlockColors(                                false);                                                                                                }                                 else {                                                                                                    p->writeInt32(                                0);                                   // indicate no ctable                                                                                                }                                                                                            }                                                                                            size_t size = bitmap->getSize();                                                                                            // 其它格式（最常见的 ARGB）是用 ashmem                                                                                            // 这个 Blob 是 Parcel 的一个简单的封装类                                                                                            android::Parcel::WritableBlob blob;                                                                                            // writeBlob 就是创建 size 大小的 ashmem                                                                                            android::status_t status = p->writeBlob(size, &blob);                                                                                            if (status) {                                                                                                doThrowRE(env,                                 "Could not write bitmap to parcel blob.");                                                                                                return                                 false;                                                                                            }                                                                                            bitmap->lockPixels();                                                                                            const                                 void* pSrc =  bitmap->getPixels();                                                                                            if (pSrc == NULL) {                                                                                                memset(blob.data(),                                 0, size);                                                                                            }                                 else {                                                                                                // memcpy， 这里需要 copy 一次                                                                                                memcpy(blob.data(), pSrc, size);                                                                                            }                                                                                            bitmap->unlockPixels();                                                                                            // 图片 pixels 复制完了可以 munmap 了                                                                                            blob.release();                                                                                            return                                 true;                                                                                        }                            

                                                            // Parcel.h ==================================                                                                                            class Blob {                                                                                            public:                                                                                                Blob();                                                                                                ~Blob();                                                                                                void release();                                                                                                inline size_t size()                                 const {                                 return mSize; }                                                                                             protected:                                                                                                void init(                                bool mapped,                                 void* data, size_t size);                                                                                                void clear();                                                                                                // true 表示 mmap 过，release 的时候需要 munmap                                                                                                bool mMapped;                                                                                                // mmap 的内存地址                                                                                                void* mData;                                                                                                    // mmap 的内存大小                                                                                                      size_t mSize;                                                                                            };                                                                                        // Parcel.cpp ==================================                                                                                        Parcel::Blob::Blob() :                                                                                                mMapped(                                false), mData(NULL), mSize(                                0) {                                                                                        }                                                                                        Parcel::Blob::~Blob() {                                                                                            release();                                                                                        }                                                                                        void Parcel::Blob::release() {                                                                                            if (mMapped && mData) {                                                                                                ::munmap(mData, mSize);                                                                                                    }                                                                                            clear();                                                                                        }                                                                                        void Parcel::Blob::init(                                bool mapped,                                 void* data, size_t size) {                                                                                            mMapped = mapped;                                                                                            mData = data;                                                                                            mSize = size;                                                                                        }                                                                                        void Parcel::Blob::clear() {                                                                                            mMapped =                                 false;                                                                                            mData = NULL;                                                                                            mSize =                                 0;                                                                                        }                            

                                                            status_t Parcel::writeBlob(size_t len, WritableBlob* outBlob)                                                                                        {                                                                                            status_t status;                                                                                            // 这里判断下，如果禁用 ashmem 或是要创建的 ashmem 不够大，不让使用                                                                                            // 直接用普通内存代替，果然前面 bitmap 判断小空间不用是正确的                                                                                            if (!mAllowFds || len <= IN_PLACE_BLOB_LIMIT) {                                                                                                ALOGV(                                "writeBlob: write in place");                                                                                                status = writeInt32(                                0);                                                                                                        if (status)                                 return status;                                                                                                     void* ptr = writeInplace(len);                                                                                                 if (!ptr)                                 return NO_MEMORY;                                                                                                    outBlob->init(                                false                                 /*mapped*/, ptr, len);                                                                                                return NO_ERROR;                                                                                            }                                                                                            // 调用 libcutils 的接口创建 ashmem                                                                                            ALOGV(                                "writeBlob: write to ashmem");                                                                                            int fd = ashmem_create_region(                                "Parcel Blob", len);                                                                                            if (fd <                                 0)                                 return NO_MEMORY;                                                                                            // 设置下 ashmem 的读、写权限                                                                                            int result = ashmem_set_prot_region(fd, PROT_READ | PROT_WRITE);                                                                                            if (result <                                 0) {                                                                                                status = result;                                                                                            }                                 else {                                                                                                // 记起我们的例子：创建完之后，Proc A mmap 内存到本进程空间                                                                                                void* ptr = ::mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED, fd,                                 0);                                                                                                if (ptr == MAP_FAILED) {                                                                                                           status = -errno;                                                                                                }                                 else {                                                                                                    // 这里这么又把端口设成只读的啦？？                                                                                                    result = ashmem_set_prot_region(fd, PROT_READ);                                                                                                    if (result <                                 0) {                                                                                                        status = result;                                                                                                    }                                 else {                                                                                                        // 1 标志是用 ashmem 的                                                                                                        status = writeInt32(                                1);                                                                                                        if (!status) {                                                                                                            // 前面分析的，用 flat_binder_object` 传 fd                                                                                                            // 注意下后面的 takeOwnership 是 true                                                                                                            status = writeFileDescriptor(fd,                                 true                                 /*takeOwnership*/);                                                                                                            if (!status) {                                                                                                                // 不错误的把地址保存在 Blob 中                                                                                                                outBlob->init(                                true                                 /*mapped*/, ptr, len);                                                                                                                return NO_ERROR;                                                                                                            }                                                                                                        }                                                                                                    }                                                                                                }                                                                                                ::munmap(ptr, len);                                                                                            }                                                                                            ::close(fd);                                                                                            return status;                                                                                        }                            

                                                            static jobject Bitmap_createFromParcel(JNIEnv* env, jobject, jobject parcel) {                                                                                            if (parcel == NULL) {                                                                                                SkDebugf(                                "-------- unparcel parcel is NULL\n");                                                                                                return NULL;                                                                                            }                                                                                            // 继续先获取 native Parcel 对象                                                                                            android::Parcel* p = android::parcelForJavaObject(env, parcel);                                                                                            // 把之前写的配置读出来                                                                                            const                                 bool              isMutable = p->readInt32() !=                                 0;                                                                                            const SkBitmap::Config  config = (SkBitmap::Config)p->readInt32();                                                                                            const                                 int               width = p->readInt32();                                                                                            const                                 int               height = p->readInt32();                                                                                            const                                 int               rowBytes = p->readInt32();                                                                                            const                                 int               density = p->readInt32();                                                                                            if (SkBitmap::kARGB_8888_Config != config &&                                                                                                     SkBitmap::kRGB_565_Config != config &&                                                                                                    SkBitmap::kARGB_4444_Config != config &&                                                                                                    SkBitmap::kIndex8_Config != config &&                                                                                                    SkBitmap::kA8_Config != config) {                                                                                                SkDebugf(                                "Bitmap_createFromParcel unknown config: %d\n", config);                                                                                                return NULL;                                                                                            }                                                                                            SkBitmap* bitmap =                                 new SkBitmap;                                                                                            bitmap->setConfig(config, width, height, rowBytes);                                                                                            // 索引格式直接使用普通内存                                                                                            SkColorTable* ctable = NULL;                                                                                            if (config == SkBitmap::kIndex8_Config) {                                                                                                int count = p->readInt32();                                                                                                if (count >                                 0) {                                                                                                    size_t size = count *                                 sizeof(SkPMColor);                                                                                                    const SkPMColor* src = (                                const SkPMColor*)p->readInplace(size);                                                                                                    ctable =                                 new SkColorTable(src, count);                                                                                                }                                                                                            }                                                                                            // 根据图片的大小申请内存空间                                                                                            jbyteArray buffer = GraphicsJNI::allocateJavaPixelRef(env, bitmap, ctable);                                                                                            if (NULL == buffer) {                                                                                                SkSafeUnref(ctable);                                                                                                delete bitmap;                                                                                                return NULL;                                                                                            }                                                                                            SkSafeUnref(ctable);                                                                                            size_t size = bitmap->getSize();                                                                                            // 在传过来的 Parcel 中通过 Blob 读取 ashmem 的内容                                                                                            android::Parcel::ReadableBlob blob;                                                                                            android::status_t status = p->readBlob(size, &blob);                                                                                            if (status) {                                                                                                doThrowRE(env,                                 "Could not read bitmap from parcel blob.");                                                                                                delete bitmap;                                                                                                return NULL;                                                                                            }                                                                                            bitmap->lockPixels();                                                                                            // 把 Proc A ashmem 里的内容（bitmap 的 pixels 数据）                                                                                            // copy 到刚刚申请的内存中，这里算第二次了吧                                                                                            memcpy(bitmap->getPixels(), blob.data(), size);                                                                                            bitmap->unlockPixels();                                                                                            // 用完了释放下                                                                                            blob.release();                                                                                            // 拿之前申请的内存（已经 copy 了 Proc A 的pixels）创建一个 Bitmap 对象                                                                                            return GraphicsJNI::createBitmap(env, bitmap, buffer, getPremulBitmapCreateFlags(isMutable),                                                                                                    NULL, NULL, density);                                                                                        }                            

                                                            status_t Parcel::readBlob(size_t len, ReadableBlob* outBlob)                                 const                                                                                        {                                                                                            // 前面 writeBlob 的时候，第一个 int 是 1 来着                                                                                            int32_t useAshmem;                                                                                            status_t status = readInt32(&useAshmem);                                                                                            if (status)                                 return status;                                                                                            // 第一个 int 不是 1 就表示是普通的内存                                                                                            if (!useAshmem) {                                                                                                ALOGV(                                "readBlob: read in place");                                                                                                const                                 void* ptr = readInplace(len);                                                                                                if (!ptr)                                 return BAD_VALUE;                                                                                                    outBlob->init(                                false                                 /*mapped*/,                                 const_cast<                                void*>(ptr), len);                                                                                                return NO_ERROR;                                                                                            }                                                                                            // readFileDescriptor 和 writeFileDescriptor 对应                                                                                            // Proc B 得到经过倒腾的 fd                                                                                            ALOGV(                                "readBlob: read from ashmem");                                                                                            int fd = readFileDescriptor();                                                                                             if (fd ==                                 int(BAD_TYPE))                                 return BAD_VALUE;                                                                                            // Proc B mmap 内存到本进程                                                                                            void* ptr = ::mmap(NULL, len, PROT_READ, MAP_SHARED, fd,                                 0);                                                                                             if (!ptr)                                 return NO_MEMORY;                                                                                            // 把 mmap 到的地址、大小保存在 Blob 中                                                                                            outBlob->init(                                true                                 /*mapped*/, ptr, len);                                                                                            return NO_ERROR;                                                                                        }                            

                                                            void Parcel::freeDataNoInit()                                                                                        {                                                                                            if (mOwner) {                                                                                                //ALOGI("Freeing data ref of %p (pid=%d)\n", this, getpid());                                                                                                mOwner(                                this, mData, mDataSize, mObjects, mObjectsSize, mOwnerCookie);                                                                                            }                                 else {                                                                                                releaseObjects();                                                                                                if (mData)                                 free(mData);                                                                                                        if (mObjects)                                 free(mObjects);                                                                                              }                                                                                        }                            

                                                            void Parcel::releaseObjects()                                                                                         {                                                                                            const sp proc(ProcessState::self());                                                                                            size_t i = mObjectsSize;                                                                                            uint8_t*                                 const data = mData;                                                                                            size_t*                                 const objects = mObjects;                                                                                            while (i >                                 0) {                                                                                                i--;                                                                                                const flat_binder_object* flat                                                                                                     =                                 reinterpret_cast(data+objects[i]);                                                                                                release_object(proc, *flat,                                 this);                                                                                            }                                                                                        }                                                                                        void release_object(                                const sp& proc,                                                                                            const flat_binder_object& obj,                                 const                                 void* who)                                                                                        {                                                                                            switch (obj.type) {                                                                                                ... ...                                                                                                case BINDER_TYPE_FD: {                                                                                                    // 前面设置了 takeOwnership 是 true 的话，cookie 就是 1                                                                                                    if (obj.cookie != (                                void*)                                0) close(obj.handle);                                                                                                    return;                                                                                                }                                                                                            }                                                                                            ALOGE(                                "Invalid object type 0x%08lx", obj.type);                                                                                        }