Binder学习总结

亚瑟-小郎

已于 2024-12-25 18:18:47 修改

阅读量453

点赞数 4

CC 4.0 BY-SA版权

分类专栏： framework 文章标签： binder linux 运维

于 2024-12-11 22:47:06 首次发布

本文链接：https://blog.csdn.net/langjian2012/article/details/144412039

framework 专栏收录该内容

12 篇文章

订阅专栏

基本数据结构：

// 用于描述内核缓冲区的结构体，Binder 通信的基本缓冲单元

struct binder_buffer *buffer;

#Binder导致crash# kill crash原因分析-CSDN博客

#Binder风暴导致binder失败#

E IPCThreadState: Process seems to be sending too many oneway calls.

E JavaBinder: !!! FAILED BINDER TRANSACTION !!!

（当前进程发送的oneway binder调用太多，binder线程快不够用了，紧接着马上要binder fail了）源码如下：defaultServiceManager介绍-腾讯云开发者社区-腾讯云

关键字：JavaBinder

#binder线程数量判断#

“binder thread pool”搜索：

E IPCThreadState: binder thread pool (15 threads) starved for （appbinder线程被用光，

E IPCThreadState: binder thread pool (31 threads) starved for 108 ms （SystemServer binder线程被用光，等待了108ms "Waiting for thread to be free"

统计Binder线程数量方法：

adb shell debuggerd -b pid //统计binder开头的
trace：binder开头的线程数量（perfetto和simpleperf，profiler都可实现）

#binder 泄露#

LocalBinders

本地创建的bindercallback对象，传给Server对端回调我用的

表示我向外发了多少张名片

复现场景：新建callback（binder对象）给对端

Proxy Binders

本地持有Server的remote binder对象:（向外发1次binder请求，新建1个Proxy Binders对象）表示我有多少人联系方式

Binder ProxyMap has too many entries: 25710 (total), 25709 (uncleared), 25677 (uncleared after GC). BinderProxy leak
Too many Binders sent to SYSTEM （Android能创建的Binder数量的最大值超过6000，非systemuid的binder调用会被kill掉，如果没等到binder调用返回，就不断发起新的binder调用就会抛出Proxy Binders异常
对端向我注册的Callback太多，导致无法释放 RemoteCallbackList导致Death Recipients 暴涨如何找到哪个binder调用多？
搜索“real execute” 查看是哪个进程在疯狂订阅capservice的binder调用
BinderProxy descriptor histogram (top 10)ActivityManager: Killing 4494:com.jidu.media.service/u0a35 (adj 100): Too many Binders sent to SYSTEM
am_kill : [0,4494,com.jidu.media.service,100,Too many Binders sent to SYSTEM]Android能创建的Binder数量的最大值超过6000，非systemuid的binder调用会被kill掉
Binder : BinderProxy descriptor histogram (top 10):
Binder : #1: android.app.IServiceConnection x3110
Binder : #2: android.bluetooth.IBluetoothStateChangeCallback x2991
Binder : #3: android.content.IIntentReceiver x234
Binder : #4: android.content.IContentProvider x147
Binder : #5: android.app.IApplicationThread x64
Binder : #6: x58
Binder : #7: android.database.IContentObserver x42
Binder : #8: android.os.IPullAtomCallback x31
Binder : #9: android.view.IWindow x29
Binder : #10: android.os.IMessenger x26

Death Recipients

从dump meminfo结果发现Death Recipients对象超过1000个，从业务代码没有找到Death Recipients注册，从RemoteCallbackList源码发现默认注册了Death Recipients，原因是每次传过来1个aidlCallback都要new一个RemoteCallbackList来保存