Kernel 日志:
[240894.843088] (4)[23213:dumpsys]binder: 23213:23213 ioctl 40046210 7fd1741174 returned -22
[240894.989640] (5)[855:HwBinder:779_2]binder_alloc: 883: binder_alloc_buf size 213544 failed, no address space
[240894.989691] (5)[855:HwBinder:779_2]binder_alloc: allocated: 636304 (num: 5 largest: 212624), free: 404080 (num: 2 largest: 210648)
[240894.989732] (5)[855:HwBinder:779_2]binder: 779:855 transaction failed 29201/-28, size 84-16 line 4118
[240894.989830] (5)[855:HwBinder:779_2]binder: send failed reply for transaction 269678023 to 883:1325
779 855 1 4839696 10628 binder_ioctl_write_read 0 S 42 -20 2 1 5 android.hardware.graphics.composer@2.1-service HwBinder:779_2
proc 883
context hwbinder
thread 883: l 00 need_return 1 tr 0
thread 944: l 00 need_return 1 tr 0
thread 945: l 00 need_return 1 tr 0
thread 947: l 00 need_return 1 tr 0
thread 949: l 12 need_return 0 tr 0
thread 994: l 00 need_return 1 tr 0
thread 1032: l 00 need_return 1 tr 0
thread 1325: l 00 need_return 1 tr 0
thread 1861: l 00 need_return 1 tr 0
thread 5930: l 00 need_return 1 tr 0
node 1097: ub4000078fd63aa00 cb4000078fd680460 pri 1:97 hs 1 hw 1 ls 0 lw 0 is 1 iw 1 tr 1 proc 779
node 1189: ub4000078fd6e6680 cb4000078fd680a00 pri 0:120 hs 1 hw 1 ls 0 lw 0 is 1 iw 1 tr 1 proc 779
node 1240: ub4000078fd6e6fa0 cb4000078fd680d20 pri 0:120 hs 1 hw 1 ls 0 lw 0 is 1 iw 1 tr 1 proc 779
node 1616: ub4000078fd75a8e0 cb4000078fd681220 pri 0:120 hs 1 hw 1 ls 0 lw 0 is 1 iw 1 tr 1 proc 528
ref 1033: desc 0 node 10 s 1 w 1 d 0000000000000000
ref 1068: desc 1 node 819 s 1 w 1 d 0000000000000000
ref 1091: desc 2 node 1090 s 1 w 1 d 0000000000000000
ref 1184: desc 3 node 813 s 1 w 1 d 0000000000000000
ref 1209: desc 4 node 539 s 1 w 1 d 0000000000000000
ref 1554: desc 5 node 1548 s 1 w 1 d 0000000000000000
buffer 269675250: 0000000000000000 size 96:16:16 delivered
buffer 269562824: 0000000000000000 size 88:16:24 delivered
buffer 269674617: 0000000000000000 size 84:16:212520 delivered
buffer 269508795: 0000000000000000 size 84:16:211160 delivered
buffer 269665964: 0000000000000000 size 84:16:212056 delivered
分配的多个binder 内存超过200+k ,导致binder 内存被用完导致异常
binder_alloc_new_buf_locked
列表、树、队列数据结构
https://www.cnblogs.com/wang_yb/p/3818517.html
1、binder_alloc初始化
binder_alloc 根据vma 来初始化:
binder_alloc->buffer =vma->vm_start
binder_alloc->buffer_size =vma->vm_start - vma->vm_end
第一个binder_buffer初始化:
binder_buffer->user_data = binder_alloc->buffer
大小是buffer_size,并建立下图链表关系。
binder_buffer加入到binder_alloc->free_buffers,这个rb_tree 是按照binder_buffer大小来按照根左右来链接的。
Binder_alloc->free_buffers 指向空闲binder_buffer的rb_node 指针.当需要分配一个binder_buffer时,就遍历free_buffers.rb_node 树,通过rb_node 节点地址,找到对应binder_buffer,再根据binder_buffer 大小和需要分配的大小对比,找到一个最小能满足分配大小的binder_buffer.
通过rb_node 分配50 大小遍历rb_node一个顺序,最后找到 D 最符合 50 大小。
分配一块binder_buffer,是从binder_alloc->free_buffers去取一块binder_buffer
binder_buffer 里面根据entry 地址,来确定binder_buffer地址,再根据当前binder_buffer->user_data跟下一个binder_buffer->user_data差值,就是当前binder_buffer大小,即binder_buffer是根据地址user_data来链接的列表。
binder_buffer 链接到binder_alloc->allocated_buffers rb_tree
根据binder_buffer->user_data 大小来插入rb_node到rb_root.