Android Binder Architecture Introduction and Debugging Analysis.

1. Android Binder Architecture
Introduction and Debugging Analysis
Derek Fang
fang.comet@gmail.com

2. Binder transaction log
// sys/kernel/debug/binder/transactions
proc 7472 //android.process.media
pending async transaction 8896717: ffff8800104e7800 from 0:0 to 7472:0 code 25 flags 11 pri -
20 r0 node 4631132 size 124:8 data ffffc900078056bc
pending async transaction 8896728: ffff8800104e7f80 from 0:0 to 7472:0 code 25 flags 11 pri -
20 r0 node 4631132 size 124:8 data ffffc90007805790
…
proc 664 //system_server
thread 664: l 10
outgoing transaction 8898624: ffff8800381c7c80 from 664:664 to 7472:0 code 1 flags 10 pri -2
r1 node 4631408 size 248:4 data ffffc9000780668c
thread 676: l 11
outgoing transaction 8896300: ffff88000ab71780 from 664:676 to 7472:0 code 2b flags 10 pri -
20 r1 node 4631132 size 780:4 data ffffc90007804f28
…

3. Binder transaction log
// sys/kernel/debug/binder/stats
------ BINDER STATS (/sys/kernel/debug/binder/stats) ------
binder stats:
proc 1353
threads: 456 // 已join binder pool 的threads 個數
requested threads: 0+3/15
ready threads 5
free async space 520192
nodes: 993
refs: 478 s 478 w 478
buffers: 226 // 已分配的 buffers
pending transactions: 0
BC_TRANSACTION: 187672
BC_REPLY: 54812
…
BR_SPAWN_LOOPER: 3
BR_CLEAR_DEATH_NOTIFICATION_DONE: 87
BR_FAILED_REPLY: 10910
…

4. binder_proc
Process在binder
driver對應的struct
•struct rb_root
threads;
•struct rb_root
nodes;
•struct rb_node
refs_by_node
•struct list_head
todo;
binder_thread
Thread在binder
driver對應的struct
•strust
binder_proc
*proc;
•struct rb_node
rb_node;
•int pid;
•struct list_head
todo;
binder_node
用來描述binder實
體對象，對應每
一個service組件的
struct
•struct rb_node
rb_node;
•struct
binder_proc
*proc;
•struct hlist_head
refs;
•unsigned
has_asnc_transac
tion;
•struct list_head
async_todo;
binder_ref
用來描述binder引
用對象，對應每
一個client組件的
struct
•struct rb_node
rb_node_node;
•struct
binder_proc
*proc;
•struct
binder_node
*node;
Binder driver related structs

5. binder_transaction
•在kernel space裡描
述一個傳輸task的基
本struct
•struct binder_work
work;
•struct binder_thread
*from;
•struct binder_proc
*to_proc;
•struct binder_thread
*to_thread;
•unsigned need_reply;
•struct binder_buffer
*buffer;
binder_buffer
•Kernel buffer，用
來傳遞process之
間的data，每一
個使用binder的
process都有專屬
的binder_buffer
•struct
binder_transactio
n *transaction;
•struct
binder_node
*node;
•size_t data_size;
•size_t offsets_size;
binder_transaction_data
•在user space裡描述一個傳輸task
的基本struct
• pid_t sender_pid;
•size_t data_size;
•size_t offsets_size;
•union{
struct{
const void *buffer;
const void *offsets;
}ptr;
…
}data;
Binder driver related structs (cont.)

6. Binder codeflow (async transaction)
BpBinder::transact()
IPCThreadState::self()->transact(…)
waitForResponse(…)
talkWithDriver()
ioctl(mProcess->mDriveFD, BINDER_WRITE_READ, &bwr)
ioctl_open(…)
binder_transaction(…)
binder_thread_write(…)
binder_thread_read(…)
User space
Kernel space
copy_from_user(&bwr, ubuf, sizeof(bwr))

7. binder relation between client and
server (async transaction)
binder_ref
BBinder
binder_node
Process A Process B
binder_proc B
BpBinder
binder_proc A
Thread A1
binder_thread A1
rb_node
User space
Kernel space

8. binder relation between client and
server (async transaction)
BBinder
binder_node
Process A Process B
binder_proc B
BpBinder
Thread A1
binder_transaction t1
binder_transaction_d
ata tr1
binder_thread A1
binder_thread
*from
(2) copy_form_user(…)
binder_proc
*to_proc
rb_node
binder_work
User space
Kernel space
todo list
(1) last slide
(3)
(4)

9. binder_workbinder_work
Binder async todo list
binder_proc
list_head todo
binder_transaction
(async)
list_head
binder_transaction
(async)
list_head
binder_node
unsigned
has_async_transaction
list_head async_todo

10. Binder transaction dump flow
 // anr log 20141008_023114.txt
 proc 7472 //android.process.media
 pending async transaction 8896728: ffff8800104e7f80 from 0:0 to 7472:0 code 25
flags 11 pri -20 r0 node 4631132 size 124:8 data ffffc90007805790
 …
在binder driver裡找
binder_procs紀錄的
每一個binder_proc
dump出該
binder_proc裡proc
todo list裡串接的每
個binder_transaction
dump出該
binder_transaction對
應的binder_node
dump出該
binder_transaction連
接的binder_buffer
• 每一個async binder transaction都是由同一個target binder_node所記錄，而
binder driver會根據target proc是否已有binder thread專門處理async binder
transaction，有的話則將transaction串接到該thread的todo list；反之則串
接到target proc的todo list，等待binder driver指定binder thread執行
• Binder debug info path: /sys/kernel/debug/binder/

11. binder_workbinder_work
Binder transaction linked list
binder_proc
list_head todo
binder_transaction
list_head
binder_transaction
list_head
binder_workbinder_work
binder_thread
list_head todo
binder_transaction
list_head
binder_transaction
list_head
*proc

12. Proc2
Binder driver sync transaction example
T
binder_transaction_stack
NULL
from_parent
TODO T
th1 TODO complete
binder_thread_read()binder_thread_write()
thread 1
thread 2
add list tail
add list tail
th1 stack
th1->SP
T_D
copy to user
Proc2
TODO T
Wakeup a sleep thread of Proc2
th1 TODO complete
proc 14054
thread 14073: l 10
transaction complete
pending transaction 39997494: ffffffc09a69ec00 from 0:0 to 14054:14073 code 0 flags 0 pri 0 r0 size 48:8 d
ata ffffff8004700050

13. Binder driver sync transaction example
(cont.)
binder_thread_write()binder_thread_read()
thread 1
thread 2
T
th1 stack
th2 stack
pop
T_reply
th1 TODO T_reply
th2 TODO complete
Proc2
TODO T
T
NULL
to_parent
push
th2 stack
th2->SP
add list tail
add list tail
Wait for thread2’s reply
Create a reply transaction

14. Binder driver sync transaction example
(cont.)
binder_thread_read()
thread 1
thread 2
th2 TODO complete
th1 TODO T_reply
T_D
copy to user
T_replyth1 TODO

15. Binder driver transaction stack :
3 threads
T1
NULL
from_parent
thread 1 thread 3
th1 stack
th1->SP
thread 2
T1
T2
T2
NULL
to_parent
th2->SP
th2 stack th3 stack
th3->SP
// EX: 15685(gms ui), 1475(SS), 311(SF)
proc 1475
thread 3235: l 11
outgoing transaction 849159: e3e87100 from 1475:3235 to 311:3944 code 1 flags 10 pri -6 r1 node 811656 size 188:0 data f9700028
incoming transaction 849155: e97d8a00 from 15685:15685 to 1475:3235 code 6 flags 10 pri -6 r1 node 811602 size 104:4 data f2d000b4
buffer 16570: f2d00028 size 16:4 delivered
buffer 4065: f2d00064 size 0:0 delivered
from_parent
NULL
to_parent
T1 transaction T2 transaction
1 2

16. Binder driver transaction stack :
2 threads
T1
NULL
from_parent
thread 1
th1 stack
thread 2
T1
T2th2->SP
th2 stack
to_parent
NULL
to_parent
T2
from_parent
th1->SP
T1 transaction
T2 transaction
1
2

17. Binder系統中3種threads
 Binder main thread
 此thread創建過程中會調用startThreadPool() -> spawnPooledThread(true //
boolean isMain), 命名規則為 “Binder:<PID>_1”, binder main thread不會退出
 Binder normal threads
 由binder driver判斷是否有空閒的binder thread來決定是否調用->
spawnPooledThread(false), 命名規則為 “Binder:<PID>_X”, 空閒不用時, 此
thread可以退出
 調用ProcessState::self()->setThreadPoolMaxThreadCount(int Y); 限制可spawn
的thread個數, Ex: X = (2~Y+1)
 Default Y=15, Android N之後新增JNI method可從Java層設定
 Binder other threads
 指並沒有調用上述的spawnPooledThread()，而是直接調用
IPC.joinThreadPool()，將當前thread直接加入binder thread pool，沒有命名
規則。EX: mediaserver、audioserver、servicemanager的main thread都是
binder thread，但system_server的main thread並非binder thread。

18. User buffer
1. 從ptr取資料放到binder_transaction_data
2. 執行binder_transaction()時, cmd != BC_REPLY
3. tr有target.handle值 -> 取得ref (有handle值一定存在相對應的ref) ->
取得對應的node 和 proc
4. For ONEWAY的binder_transaction, target_thread為NULL, 會將此
binder_transaction加入target_proc的todo list
5. 設定binder_transaction的內部參數, 設定binder_transaction的buffer
buffer ptr
consumed
size

19. User buffer (cont.)
5. copy_from_user(): loop讀取buffer裡所有的資料(data, node, ref), 並執
行相對應的動作(建立node, ref , …etc)
6. 假如target_node已經在處理async transaction, 新加入的async
transaction會被放到該target_node的async todo list; 否則放到proc的
todo list, 並喚醒在proc裡(thread pool)空閒的thread去執行
7. 在from thread的todo list 加入一個
BINDER_WORK_TRANSACTION_COMPLETE type的binder work, 表示完
成這一次的binder transaction
 當該binder transaction不需reply或屬於TF_ONE_WAY, 則該
binder_transaction裡的(binder_thread *)from會指向null, binder.c +1484
buffer ptr
consumed
size