Understanding binder in android
1 like1,029 views
Binder is an inter-process communication system used in Android to allow processes to interact. It uses a client-server model where a client contacts a service via its binder handle. Data is packaged into a parcel and sent to the kernel binder driver via ioctl calls. The driver then delivers the transaction to the target service's thread to be processed by its stub and dispatched to the actual service code.
![Transaction in Binder –Client (2)
Target SpacedataCopyParcelParcelwrite_sizewrite_bufferread_sizeread_bufferbinder_write_readbufferdata_sizeoffsets... binder_transaction_datacodecookiehandleoffset 1offset 2... ... flat_binder_objectflat_binder_objectBC_TRANSACTIONBC_XXXXxxx data structmOut... headIPCThreadStateClientbufferpriorityoffsetssender_euidbinder_transactioncodeto_threadto_procdata... offsets_sizedata_sizetarget_nodebinder_bufferOffsets[] Copy](https://image.slidesharecdn.com/understandingbinderinandroid-140903210317-phpapp02/85/Understanding-binder-in-android-19-320.jpg)
![Transaction in Binder -- Server
1.Server thread wake up and get a binder_work(binder_transaction) from todo list
2.Build a binder_transaction_data from binder_transaction
3.Set priority of current thread of client.
4.The buffer and offsets will be virtual address
–Virtual address = kernel address + address offset
5.Copy binder_transaction_data to mIn
6.Return from kernel
7.IPCThreadState iternate the command and data.
–For BR_TRANSACTION, call stub’s onTransact function,
which will call server service function finally.
Target Spacedatabufferpriorityoffsetssender_euidbinder_transactioncodeto_threadto_procdata... offsets_sizedata_sizetarget_nodebinder_bufferOffsets[] bufferdata_sizeoffsets... binder_transaction_datacodecookiehandle Kernel Space write_sizewrite_bufferread_sizeread_bufferbinder_write_readParcelmInBR_NOOPDatabinder_transaction_dataBR_TRANSACTIONCopy to user User Space](https://image.slidesharecdn.com/understandingbinderinandroid-140903210317-phpapp02/85/Understanding-binder-in-android-20-320.jpg)
Understanding binder in android
- 1. Understanding Binder in Android Haifeng Li 2014-9-2
- 2. Outline •Background –What is Binder –Binder Communication Model –Terminology –Binder Software Stack •Client(user space) •Binder driver (Kernel Space) •Service(user space)
- 3. Background •What is Binder? –An Inter-process communication system for developing object-oriented OS services. clientserverData
- 4. Binder Communication Model User SpaceKernel SpaceCclientserviceBinder Driverioctl/open/...ioctl/open/... mInmOutioctl/open/... mInmOutmInmOutService Manager/system/bin/servicemanagerCGet ServiceAdd ServiceService 1 – handle 1Service 2 – handle 2...
- 5. Terminology •Service Handle •Remote Binder •Local Binder •Binder node •Binder reference •Service Manager(Context Manager) –It’s handle is 0 in all binder client and server. Binder DriverRemote Binder/HandleLocal BinderBinder NodeBinder ref.
- 6. IPC Software Stack App1 service Proxy(BpBinder) Stub(BnBinder) IPCThreadState IPCThreadState Binder Module User Space Kernel Space Client Server 1 2 3 4 5 6 1. BpBinder(n) -> transact(OP, data, &reply) 2. IPCThreadState::transact(handle, OP, data, reply) 3. ioctl(binder_fd, BINDER_OPERATION, &bwr) 4. IPCThreadState::getAndExecuteCommand() 5. Bnxxx::onTransact(OP, data, reply)
- 7. Client(user space) • Initialization – Call system call open(), which is binder_open in kernel. Open /dev/binder file and get a file description. Create some key data structures. – mmap 1MB-8KB virtual space for data transaction by binder_mmap in kernel. • Get handle of service from service manager • Sent request to Service by BpBinder(handle) • Data transact to kernel by IPCThreadState. App1 service Proxy(BpBinder) Stub(BnBinder) IPCThreadState IPCThreadState Binder Module User Space Kernel Space Client Server 1 2 3 4 5 6
- 8. Data Transaction in Client(1) •Package in Client 102 virtual void Client::Foo(int32_t push_data) { 103 Parcel data, reply; 104 data.writeInterfaceToken(IDemo::getInterfaceDescriptor()); 105 data.writeInt32(push_data);//writeStrongBinder(service) 109 110 remote()->transact(OP, data, &reply); Parcel...flat_binder_objectmDataflat_binder_objectmObjectsService
- 9. Data Transaction in Client(2) •Packaged to binder_transaction_data IPCThreadState::writeTransactionData(int32_t cmd, …, int32_t handle, uint32_t code, const Parcel& data…) •cmd will add to mData.(BC_TRANSACTION, BC_REPLY,… Binder Command) •Target: target handle •Cookie: will be define according to handle in binder driver •Code: Operation of client. •Offsets could help the binder driver to process binder object reference. Parcel...flat_binder_objectmDataflat_binder_objectmObjectstargetcookiecode... data.ptr.bufferdata.ptr.offsets... binder_transaction_data
- 10. Data Transaction in Client(3) •Binder Command(User->Driver) –Binder Thread Support: BC_REGISTER_LOOPER, BC_ENTER LOOPER,BC_EXIT_LOOPER –Binder Transactions: BC_TRANSACTION, BC_REPLY –Further Mechanism: BC_INCREFS, BC_RELEASE , BC_DECREFS, BC_REQUEST_DEATH_NOTIFICIATION, BC_CLEAR_DEATH_NOTIFICATION, BC_DEAD_BINDER_DONE,… •Binder Return Command (Driver -> User) –Binder Thread Support: BR_SPAWN_LOOPER –Binder Transactions: BR_TRANSACTION, BR_REPLY –Further Mechanism: BR_INCREFS,BR_ACQUIRE, BR_RELEASE , BR_DECREFS, BR_CLEAR_DEATH_NOTIFICATION_DONE, … ClientServerDriverBC_TRANSACTIONBR_TRANSACTIONBC_REPLYBR_REPLYBC_FREE_BUFFERBC_FREE_BUFFER
- 11. Data Transaction in Client(4) •Repackage to Parcel(mOut) •Each working thread has two parcel: mOut and mIn. mOut is for write buffer, mIn for read buffer. Parcelcmdbinder_transactin_datamDatawrite_sizeWrite_bufferRead_sizeRead_bufferbinder_write_read
- 12. Outline •Background •Client(user space) •Binder driver (Kernel Space) •Service(user space) App1 service Proxy(BpBinder) Stub(BnBinder) IPCThreadState IPCThreadState Binder Module User Space Kernel Space Client Server 1 2 3 4 5 6
- 13. Binder Driver:Binder Protocol •The protocol used for ioctl() system call. –BINDER_WRITE_READ –BINDER_SET_MAX_THREADS –BINDER_SET_CONTEXT_MGR –BINDER_THREAD_EXIT –BINDER_VERSION –BINDER_SET_IDLE_TIMEOUT
- 14. Key Data Structure (1) Binder Driver Process 1 Process 2 Process 3 binder_proc binder_proc binder_proc threads node refs_by_desc refs_by_node • The binder_proc is mapped to process by 1:1. It is created on binder_open(). • All binder_proc are listed in binder_procs. • The binder_proc has 4 red-black tree. • The binder_thread represents a working thread, inserted into threads rbtree. • The binder_node represents a service, inserted into node rbtree. • refs_by_desc and refs_by_node represent reference to a proc_node.
- 15. Key Data Structure (2) User spaceKernel spaceBpBinderRemote BinderBBinderLocal Binderbinder_procnoderefs_by_nodebinder_procnoderefs_by_nodebinder_refbinder_node
- 16. Key Data Structure (3) ... todothreadbinder_procbinder_threadtodobinder_workbinder_workbinder_workbinder_work... ... binder_transactionbinder_transaction
- 17. Input Data Format ParcelParcelwrite_sizewrite_bufferread_sizeread_bufferbinder_write_readbufferdata_sizeoffsets... binder_transaction_datacodecookiehandleoffset 1offset 2... ... flat_binder_objectflat_binder_objectBC_TRANSACTIONBC_XXXXxxx data structmOut... headIPCThreadStateClient
- 18. Transaction in Binder – Client (1) 1. Copy binder_write_read from user space 2. Copy xxx data to kernel space. Iterate the items: ① Get Binder command from write_buffer(BC_XXX). ② Get target thread/proc/node by handle. ③ Allocate binder_buffer from target space, and copy effective data. ④ Build a session(build_transaction). ⑤ Mount the session to target_thread’s todo list. ⑥ Mount a BINDER_WORK_TRANSACTION_COMPLETE binder_work to source thread ⑦ Wake up corresponding thread. Parcel Parcel write_size write_buffer read_size read_buffer binder_write_read buffer data_size offsets ... binder_transaction_data code cookie handle offset 1 offset 2 ... ... flat_binder_object flat_binder_object BC_TRANSACTION BC_XXX Xxxx data struct mOut ... head IPCThreadState Client 1 2 ① ② ③
- 19. Transaction in Binder –Client (2) Target SpacedataCopyParcelParcelwrite_sizewrite_bufferread_sizeread_bufferbinder_write_readbufferdata_sizeoffsets... binder_transaction_datacodecookiehandleoffset 1offset 2... ... flat_binder_objectflat_binder_objectBC_TRANSACTIONBC_XXXXxxx data structmOut... headIPCThreadStateClientbufferpriorityoffsetssender_euidbinder_transactioncodeto_threadto_procdata... offsets_sizedata_sizetarget_nodebinder_bufferOffsets[] Copy
- 20. Transaction in Binder -- Server 1.Server thread wake up and get a binder_work(binder_transaction) from todo list 2.Build a binder_transaction_data from binder_transaction 3.Set priority of current thread of client. 4.The buffer and offsets will be virtual address –Virtual address = kernel address + address offset 5.Copy binder_transaction_data to mIn 6.Return from kernel 7.IPCThreadState iternate the command and data. –For BR_TRANSACTION, call stub’s onTransact function, which will call server service function finally. Target Spacedatabufferpriorityoffsetssender_euidbinder_transactioncodeto_threadto_procdata... offsets_sizedata_sizetarget_nodebinder_bufferOffsets[] bufferdata_sizeoffsets... binder_transaction_datacodecookiehandle Kernel Space write_sizewrite_bufferread_sizeread_bufferbinder_write_readParcelmInBR_NOOPDatabinder_transaction_dataBR_TRANSACTIONCopy to user User Space
- 21. Transaction stack(1) •The stack is for recording transaction session. •Commonly, to_parent and from_parent is null. But, when the transaction rely on other session, what will happen? –The session in B will lost. A(list_head)todoBinder_thread BBinder_thread transaction_stackwait queue... (list_head)todotransaction_stackwait queue... to_parentfrom_parent... sender_euidbinder_transaction... to_threadtodo
- 22. Transaction stack(2) •For example, A -> B, B->C, C->A
- 23. Binder Workflow