Binder 内存分配

Kernel 日志：

[240894.843088] (4)[23213:dumpsys]binder: 23213:23213 ioctl 40046210 7fd1741174 returned -22

[240894.989640] (5)[855:HwBinder:779_2]binder_alloc: 883: binder_alloc_buf size 213544 failed, no address space

[240894.989691] (5)[855:HwBinder:779_2]binder_alloc: allocated: 636304 (num: 5 largest: 212624), free: 404080 (num: 2 largest: 210648)

[240894.989732] (5)[855:HwBinder:779_2]binder: 779:855 transaction failed 29201/-28, size 84-16 line 4118

[240894.989830] (5)[855:HwBinder:779_2]binder: send failed reply for transaction 269678023 to 883:1325

779   855     1 4839696  10628 binder_ioctl_write_read 0 S 42 -20   2   1       5 android.hardware.graphics.composer@2.1-service HwBinder:779_2

proc 883

context hwbinder

  thread 883: l 00 need_return 1 tr 0

  thread 944: l 00 need_return 1 tr 0

  thread 945: l 00 need_return 1 tr 0

  thread 947: l 00 need_return 1 tr 0

  thread 949: l 12 need_return 0 tr 0

  thread 994: l 00 need_return 1 tr 0

  thread 1032: l 00 need_return 1 tr 0

  thread 1325: l 00 need_return 1 tr 0

  thread 1861: l 00 need_return 1 tr 0

  thread 5930: l 00 need_return 1 tr 0

  node 1097: ub4000078fd63aa00 cb4000078fd680460 pri 1:97 hs 1 hw 1 ls 0 lw 0 is 1 iw 1 tr 1 proc 779

  node 1189: ub4000078fd6e6680 cb4000078fd680a00 pri 0:120 hs 1 hw 1 ls 0 lw 0 is 1 iw 1 tr 1 proc 779

  node 1240: ub4000078fd6e6fa0 cb4000078fd680d20 pri 0:120 hs 1 hw 1 ls 0 lw 0 is 1 iw 1 tr 1 proc 779

  node 1616: ub4000078fd75a8e0 cb4000078fd681220 pri 0:120 hs 1 hw 1 ls 0 lw 0 is 1 iw 1 tr 1 proc 528

  ref 1033: desc 0 node 10 s 1 w 1 d 0000000000000000

  ref 1068: desc 1 node 819 s 1 w 1 d 0000000000000000

  ref 1091: desc 2 node 1090 s 1 w 1 d 0000000000000000

  ref 1184: desc 3 node 813 s 1 w 1 d 0000000000000000

  ref 1209: desc 4 node 539 s 1 w 1 d 0000000000000000

  ref 1554: desc 5 node 1548 s 1 w 1 d 0000000000000000

  buffer 269675250: 0000000000000000 size 96:16:16 delivered

  buffer 269562824: 0000000000000000 size 88:16:24 delivered

  buffer 269674617: 0000000000000000 size 84:16:212520 delivered

  buffer 269508795: 0000000000000000 size 84:16:211160 delivered

  buffer 269665964: 0000000000000000 size 84:16:212056 delivered

分配的多个binder 内存超过200+k  ，导致binder 内存被用完导致异常

binder_alloc_new_buf_locked

Binder kernel 基础方法 - 简书

列表、树、队列数据结构

https://www.cnblogs.com/wang_yb/p/3818517.html

1、binder_alloc初始化

binder_alloc 根据vma 来初始化：

binder_alloc->buffer =vma->vm_start

binder_alloc->buffer_size =vma->vm_start - vma->vm_end

第一个binder_buffer初始化：

binder_buffer->user_data = binder_alloc->buffer

大小是buffer_size,并建立下图链表关系。

binder_buffer加入到binder_alloc->free_buffers，这个rb_tree 是按照binder_buffer大小来按照根左右来链接的。

Binder_alloc->free_buffers 指向空闲binder_buffer的rb_node 指针.当需要分配一个binder_buffer时，就遍历free_buffers.rb_node 树，通过rb_node 节点地址，找到对应binder_buffer，再根据binder_buffer 大小和需要分配的大小对比，找到一个最小能满足分配大小的binder_buffer.

通过rb_node 分配50 大小遍历rb_node一个顺序，最后找到 D 最符合 50 大小。

分配一块binder_buffer，是从binder_alloc->free_buffers去取一块binder_buffer

binder_buffer 里面根据entry 地址，来确定binder_buffer地址，再根据当前binder_buffer->user_data跟下一个binder_buffer->user_data差值，就是当前binder_buffer大小，即binder_buffer是根据地址user_data来链接的列表。

binder_buffer 链接到binder_alloc->allocated_buffers rb_tree

根据binder_buffer->user_data 大小来插入rb_node到rb_root.

图解 Binder：内存管理-六虎 (6hu.cc)