struct file {
    union {
        struct llist_node   fu_llist;
        struct rcu_head     fu_rcuhead;
    } f_u;
    struct path     f_path;
#define f_dentry    f_path.dentry
    struct inode        *f_inode;   /* cached value */
    const struct file_operations    *f_op;
    // ... ...
}

struct ashmem_area {
    char name[ASHMEM_FULL_NAME_LEN];
    struct list_head unpinned_list;
    struct file *file;
    size_t size;
    unsigned long vm_start;
    unsigned long prot_mask;
};

struct ashmem_range {
    struct list_head lru;
    struct list_head unpinned;
    struct ashmem_area *asma;
    size_t pgstart;
    size_t pgend;
    unsigned int purged;
};

struct ashmem_pin {
    __u32 offset;
    __u32 len;
};

static int __init ashmem_init(void)
{
    int ret;
 
    ashmem_area_cachep = kmem_cache_create("ashmem_area_cache",
                      sizeof(struct ashmem_area),
                      0, 0, NULL);
    if (unlikely(!ashmem_area_cachep)) {
        pr_err("failed to create slab cache\n");
        return -ENOMEM;
    }
 
    ashmem_range_cachep = kmem_cache_create("ashmem_range_cache",
                      sizeof(struct ashmem_range),
                      0, 0, NULL);
    if (unlikely(!ashmem_range_cachep)) {
        pr_err("failed to create slab cache\n");
        return -ENOMEM;
    }
 
    // ......
}

static int __init ashmem_init(void)
{
    // ......
 
    ret = misc_register(&ashmem_misc);
    if (unlikely(ret)) {
        pr_err("failed to register misc device!\n");
        return ret;
    }
 
    // ......
}

static int __init ashmem_init(void)
{
    // ......
 
    register_shrinker(&ashmem_shrinker);
 
    pr_info("initialized\n");
 
    return 0;
}

/**
 * ashmem_open() - Opens an Anonymous Shared Memory structure
 * @inode:     The backing file's index node(?)
 * @file:      The backing file
 *
 * Please note that the ashmem_area is not returned by this function - It is
 * instead written to "file->private_data".
 *
 * Return: 0 if successful, or another code if unsuccessful.
 */
static int ashmem_open(struct inode *inode, struct file *file)
{
    struct ashmem_area *asma;
    int ret;
 
    ret = generic_file_open(inode, file);
    if (unlikely(ret))
        return ret;
 
    // ......
}

static int ashmem_open(struct inode *inode, struct file *file)
{
    // ......
    asma = kmem_cache_zalloc(ashmem_area_cachep, GFP_KERNEL);
    if (unlikely(!asma))
        return -ENOMEM;
 
    INIT_LIST_HEAD(&asma->unpinned_list);
    memcpy(asma->name, ASHMEM_NAME_PREFIX, ASHMEM_NAME_PREFIX_LEN);
    asma->prot_mask = PROT_MASK;
    file->private_data = asma;
 
    return 0;
}

static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
{
    struct ashmem_area *asma = file->private_data;
    int ret = 0;
 
    mutex_lock(&ashmem_mutex);
 
    /* user needs to SET_SIZE before mapping */
    if (unlikely(!asma->size)) {
        ret = -EINVAL;
        goto out;
    }
 
    /* requested protection bits must match our allowed protection mask */
    if (unlikely((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask)) &
             calc_vm_prot_bits(PROT_MASK))) {
        ret = -EPERM;
        goto out;
    }
    vma->vm_flags &= ~calc_vm_may_flags(~asma->prot_mask);
    // ......
}

static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
{
    // ......
    if (!asma->file) {
        char *name = ASHMEM_NAME_DEF;
        struct file *vmfile;
 
        if (asma->name[ASHMEM_NAME_PREFIX_LEN] != '\0')
            name = asma->name;
 
        /* ... and allocate the backing shmem file */
        vmfile = shmem_file_setup(name, asma->size, vma->vm_flags);
        if (unlikely(IS_ERR(vmfile))) {
            ret = PTR_ERR(vmfile);
            goto out;
        }
        asma->file = vmfile;
    }
    get_file(asma->file);
    // ......
}

static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
{
    // ......
    if (vma->vm_flags & VM_SHARED)
        shmem_set_file(vma, asma->file);
    else {
        if (vma->vm_file)
            fput(vma->vm_file);
        vma->vm_file = asma->file;
    }
    asma->vm_start = vma->vm_start;
 
out:
    mutex_unlock(&ashmem_mutex);
    return ret;
}

/*
 * ashmem_pin - pin the given ashmem region, returning whether it was
 * previously purged (ASHMEM_WAS_PURGED) or not (ASHMEM_NOT_PURGED).
 *
 * Caller must hold ashmem_mutex.
 */
static int ashmem_pin(struct ashmem_area *asma, size_t pgstart, size_t pgend)

/*
 * ashmem_unpin - unpin the given range of pages. Returns zero on success.
 *
 * Caller must hold ashmem_mutex.
 */
static int ashmem_unpin(struct ashmem_area *asma, size_t pgstart, size_t pgend)

/*
 * ashmem_shrink - our cache shrinker, called from mm/vmscan.c :: shrink_slab
 *
 * 'nr_to_scan' is the number of objects to scan for freeing.
 *
 * 'gfp_mask' is the mask of the allocation that got us into this mess.
 *
 * Return value is the number of objects freed or -1 if we cannot
 * proceed without risk of deadlock (due to gfp_mask).
 *
 * We approximate LRU via least-recently-unpinned, jettisoning unpinned partial
 * chunks of ashmem regions LRU-wise one-at-a-time until we hit 'nr_to_scan'
 * pages freed.
 */
static unsigned long
ashmem_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)

static void binder_transaction(struct binder_proc *proc,
               struct binder_thread *thread,
               struct binder_transaction_data *tr, int reply)
{
    // ......
    fp = (struct flat_binder_object *)(t->buffer->data + *offp);
    // ......
    switch (fp->type) {
    // ......
    case BINDER_TYPE_FD: {
        int target_fd;
        struct file *file;
 
        // ... ...
        file = fget(fp->handle);
        // ... ...
        target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC);
        // ... ...
        task_fd_install(target_proc, target_fd, file);
        trace_binder_transaction_fd(t, fp->handle, target_fd);
        // ... ...
        fp->binder = 0;
        fp->handle = target_fd;
    } break;
    // ... ...
}

fp = (struct flat_binder_object *)(t->buffer->data + *offp);

struct flat_binder_object {
    /* 8 bytes for large_flat_header. */
    __u32       type;
    __u32       flags;
    //......
};

target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC);

task_fd_install(target_proc, target_fd, file);

fp->handle = target_fd;

/*
 * ashmem_create_region - creates a new ashmem region and returns the file
 * descriptor, or <0 on error
 *
 * `name' is an optional label to give the region (visible in /proc/pid/maps)
 * `size' is the size of the region, in page-aligned bytes
 */
int ashmem_create_region(const char *name, size_t size)

int ashmem_pin_region(int fd, size_t offset, size_t len)

int ashmem_unpin_region(int fd, size_t offset, size_t len)

int ashmem_set_prot_region(int fd, int prot)

int ashmem_get_size_region(int fd)

/**
 * Allocates a new ashmem region. The region is initially not purgable.
 *
 * @param name optional name for the file (can be null).
 * @param length of the memory file in bytes, must be non-negative.
 * @throws IOException if the memory file could not be created.
 */
public MemoryFile(String name, int length) throws IOException {
    // ... ...
}

/**
 * Creates a reference to an existing memory file. Changes to the original file
 * will be available through this reference.
 * Calls to {@link #allowPurging(boolean)} on the returned MemoryFile will fail.
 *
 * @param fd File descriptor for an existing memory file, as returned by
 *        {@link #getFileDescriptor()}. This file descriptor will be closed
 *        by {@link #close()}.
 * @param length Length of the memory file in bytes.
 * @param mode File mode. Currently only "r" for read-only access is supported.
 * @throws NullPointerException if <code>fd</code> is null.
 * @throws IOException If <code>fd</code> does not refer to an existing memory file,
 *         or if the file mode of the existing memory file is more restrictive
 *         than <code>mode</code>.
 *
 * @hide
 */
public MemoryFile(FileDescriptor fd, int length, String mode) throws IOException {
    // ... ...
}