Android binder中的mmap到binder_mmap调用流程

framework/native/cmds/servicemanager/binder.c里的binder_open如何调用到binder_mmap

struct binder_state *binder_open(size_t mapsize)
{
    struct binder_state *bs;
    struct binder_version vers;

    bs = malloc(sizeof(*bs));
    if (!bs) {
        errno = ENOMEM;
        return NULL;
    }

    bs->fd = open("/dev/binder", O_RDWR);
    if (bs->fd < 0) {
        fprintf(stderr,"binder: cannot open device (%s)\n",
                strerror(errno));
        goto fail_open;
    }

    if ((ioctl(bs->fd, BINDER_VERSION, &vers) == -1) ||
        (vers.protocol_version != BINDER_CURRENT_PROTOCOL_VERSION)) {
        fprintf(stderr, "binder: driver version differs from user space\n");
        goto fail_open;
    }

    bs->mapsize = mapsize;
    bs->mapped = mmap(NULL, mapsize, PROT_READ, MAP_PRIVATE, bs->fd, 0);
    if (bs->mapped == MAP_FAILED) {
        fprintf(stderr,"binder: cannot map device (%s)\n",
                strerror(errno));
        goto fail_map;
    }

    return bs;

fail_map:
    close(bs->fd);
fail_open:
    free(bs);
    return NULL;
}

binder_open的mmap在bionic/libc/bionic/mmap.cpp

mmap调用当前文件的mmap64

mmap64调用__mmap2函数，

__mmap2在bionic/libc/arch-arm/syscalls/__mmap2.S

__mmap2通过__NR_mmap2调用common/arch/arm/kernel/entry-common.S的sys_mmap2

sys_mmap2调用common/mm/mmap.c的sys_mmap_pgoff实现为

SYSCALL_DEFINE6(mmap_pgoff, unsigned long, addr, unsigned long, len,
        unsigned long, prot, unsigned long, flags,
        unsigned long, fd, unsigned long, pgoff);

sys_mmap_pgoff继续调用common/mm/util.c的vm_mmap_pgoff

vm_mmap_pgoff继续调用common/mm/mmap.c的do_mmap_pgoff

do_mmap_pgoff继续调用当前文件的mmap_region

mmap_region通过下面语句调用到早已注册好的binder_mmap

error = file->f_op->mmap(file, vma);