How does Android Binder achieve IPC copy only once? A complete explanation of mmap mechanism!

In Android inter-process communication (IPC), Binder is more efficient than traditional sockets, pipes, and shared memory mainly due to its "one copy" mechanism. Compared with the traditional two copies (user state ⇄ kernel state ⇄ user state), Binder reduces one data copy through memory mapping (mmap) technology, thereby improving IPC transmission efficiency.

So, how does Binder achieve "one copy"? This article will combine flowchart + code analysis to help you thoroughly understand this key technology! 🚀

1. Binder communication data copy process

Usually, inter-process communication needs to go through a transmission link from sending process to kernel to receiving process. Let's first look at the common two-copy method, and then see how Binder optimizes it to "one copy".

(1) Traditional IPC "double copy"

In traditional IPC methods such as sockets or pipes, data needs to be copied twice:

1️⃣ Sending process → kernel buffer (first copy)

2️⃣ Kernel buffer → target process (second copy)

📌 Data transfer flow chart (two copies)

picture

Disadvantages: Data needs to be copied twice, which will generate additional CPU and memory overhead

Question: How to reduce one copy and improve IPC transmission efficiency?

(2) Binder’s “one copy” optimization

The Binder sending process (Client) sends data to the receiving process (Server), and the data is only copied once, avoiding the double copying of traditional IPC (user state ⇄ kernel state ⇄ user state).

📍Step 1: Send process mmap shared memory

The sending process (Client) creates a Binder Buffer in its own user space through mmap(). This memory is managed by the Binder driver.

📍Step 2: The sending process initiates a request to the Binder driver

📌 The sending process (Client) submits data to the Binder driver:

Data is written to mmap shared memory

Binder driver resolves the target process

The Binder driver searches for the mmap shared area of ​​the Server

📍Step 3: Binder driver copies data to the target process's mmap shared area

📌 Key Points:

The Binder driver searches for the mmap shared memory of the Server process

Binder directly copies the data to the shared Buffer of the Server process

The server process directly reads the shared buffer

📌 Diagram:

picture

💡 Optimization points:

Only copy once (Client → Server mmap), avoiding the need for two copies in traditional IPC

The server process does not need additional copying and can directly read data from the mmap shared memory

📍Step 4: Server reads data

📌 The server process directly reads the mmap shared buffer without the need for additional copying:

2. Key technology of one-time copy: Binder Buffer

The key to Binder's "one copy" is the Binder Buffer mechanism.

📌 Core technical points:

✅ mmap maps shared memory: Binder allocates a shared buffer (Binder Buffer) in user space in advance through mmap, so that data can be copied directly between processes.

✅ Physical page sharing: The Binder driver manages physical pages in the kernel and maps this buffer to the address space of different processes to achieve cross-process access.

✅ User-mode data copying: Data is copied directly from the sending process to the mapping buffer of the receiving process without passing through the kernel buffer.

mmap shared buffer diagram

picture

Function: This mmap shared memory allows multiple processes to share the same physical memory page, avoiding unnecessary data copying

Key point: Data does not enter the kernel buffer, but is copied directly from the sending process to the receiving process

3. Core implementation of one copy (code analysis)

The implementation of Binder Buffer mainly involves mmap shared memory mapping + copy_from_user() data copying.

📌 (1) Sending process: Applying for Binder Buffer

 int binder_fd = open("/dev/binder", O_RDWR); size_t buffer_size = 128 * 1024; // 128 KB mmap(NULL, buffer_size, PROT_READ | PROT_WRITE, MAP_SHARED, binder_fd, 0);

A shared buffer is allocated through mmap(), which is managed by the Binder driver.

📌 (2) When sending data: the data is directly copied to the mapped memory of the target process

 void binder_transact(int binder_fd, void* data, size_t len) { struct binder_write_read bwr; bwr.write_size = len; bwr.write_buffer = (uintptr_t)data; ioctl(binder_fd, BINDER_WRITE_READ, &bwr); }

The binder_write_read structure is used to point to the shared buffer, and the kernel directly operates this address for data transmission

📌 (3) The kernel copies data to the target process (one-time copy implementation)

 copy_from_user(mapped_buffer, user_buffer, size);

copy_from_user() copies data directly to the mapped area of ​​the target process

4. Summary: Why is Binder more efficient than traditional IPC?

✅ Binder shares memory through mmap to avoid double copying and improve IPC speed

✅ Binder uses physical page mapping to share data directly in user space

✅ Compared with traditional IPC (Socket, pipeline), Binder is more efficient when transmitting large blocks of data

This article is reprinted from the WeChat public account "Happy Programmer". You can follow it through the QR code below. To reprint this article, please contact the Happy Programmer public account.