android: binder driver

http://blog.chinaunix.net/u1/38994/showart_1931648.html
http://blog.chinaunix.net/u2/66024/showart_1889005.html
http://tech.it168.com/a2009/0331/270/000000270388.shtml

kernel/drivers/staging/android/binder.c

When binder_open(), driver will create binder_proc and keep in binder_procs. When binder_mmap(), driver allocate buffer, and keep user_buffer_offset in kernel.
When process want send something, it first setup buffer(flat_binder_object), and do BINDER_WRITE_READ ioctl with binder_write_read param. This will further call into binder_transaction() to copy data into target buffer and add todo into target, then wake up it to read.
The reader will call binder_thread_read() to get the binder_transaction_data back, and just using the buffer in user space.