1. 同步binder传输trace
(1) 以.txt格式显示的trace
//发送和对端接收到 android.traceur 8705-8705 ( 12073) [005] .... 2539.489020: binder_transaction: transaction=981438 dest_node=1347 dest_proc=1602 dest_thread=0 reply=0 flags=0x10 code=0x40 performance@1.0 1602-1602 ( 1602) [005] .... 2539.489058: binder_transaction_received: transaction=981438 //reply和发送端接收到 performance@1.0 1602-1602 ( 1602) [005] .... 2539.489475: binder_transaction: transaction=981440 dest_node=0 dest_proc=12073 dest_thread=8705 reply=1 flags=0x0 code=0x0 android.traceur 8705-8705 ( 12073) [005] .... 2539.489498: binder_transaction_received: transaction=981440
整理出执行耗时：
2539.489020 - 2539.489058 = 38us 发送端传到接收端耗时38us 2539.489475 - 2539.489058 = 417us binder reply执行耗时417us 2539.489498 - 2539.489475 = 23us reply到传到发送端耗时23us 2539.489498 - 2539.489020 = 478us binder transaction执行耗时478us
(2) 选中"binder transaction"标签后显示:
Name binder transaction Category binder Start time 6s 884ms 598us 100ns Duration 478us //表示binder transaction执行总时长(包括transaction内的休眠和runable) Thread IntentService[T 8705 //binder发送端线程名和TID Process 12073 //binder发送端进程PID Slice ID 129282 //这个是perfetto的，打印的trace里面没有这个域 Arguments flags 0x10 allow replies with file descriptors; code 0x40 Java Layer Dependent transaction id 981438 //trace打印出来的transaction id destination node 1347 //trace打印出来的dest_node destination process 1602 //目标进程 destination thread 1602 //目标线程 destination name performance@1.0 1602 //目标线程名 reply transaction? false //表示是reply还是transaction calling tid 8705 //发送端线程PID data size 56 offsets size 0
(3) 接收的服务端 performance@1.0 自动图形显示：
binder reply -------------------------------------------- HIDL::IPerformance::enableDebug::server //这里显示的是服务端提供服务的是哪个函数
注：发送端看不到是哪个函数执行的transaction.
(4) 选中"binder reply"标签后显示：
Name binder reply //表明这次一次binder reply Category binder Start time 6s 884ms 636us 100ns Duration 417us //binder reply执行总时长(包括reply内的休眠和runable) Thread performance@1.0 1602 //执行reply的进程名和PID Process 1602 //执行reply的进程PID Slice ID 129290 Preceding flows Slice binder transaction Delay 0s Thread IntentService[T 8705 (NULL) //要reply给谁的线程名和TID Arguments flags 0x00 No Flags Set code 0x0 Java Layer Dependent transaction id 981440 destination node 0 //reply传输trace打印出来的dest_node=0 destination process 12073 //要reply给的进程PID destination thread 8705 //要reply给的进程的线程的TID destination name IntentService[T //要reply给的线程的名字 reply transaction? true //true表示是reply传输 calling tid 1602 //进程reply的线程id
2. 异步binder传输trace
(1) 异步binder发送端显示：
Name binder transaction async Category binder Start time 17s 455ms 421us 82ns Duration 0s Thread surfaceflinger 2731 Process /system/bin/surfaceflinger 1606 User ID 1000 Slice ID 286208 flags 0x11 this is a one-way call: async, no return; allow replies with file descriptors; code 0x01 Java Layer Dependent transaction id 7414482 destination node 56653 destination process 3713 reply transaction? false calling tid 2731 type internal_slice depth 0 stack_id 8598901110785906 parent_stack_id 0 parent_id null arg_set_id 373693
(2) 异步binder接收端显示：
Name binder async rcv Category binder Start time 17s 483ms 700us 666ns Duration 0s Thread binder:4128_3 4209 Process com.android.launcher 4128 User ID 10178 Slice ID 288578 flags 0x11 this is a one-way call: async, no return; allow replies with file descriptors; code 0x01 Java Layer Dependent transaction id 7414483 destination node 36400 destination process 4128 reply transaction? false calling tid 2731 type internal_slice depth 0 stack_id 1717227819666250 parent_stack_id 0 parent_id null arg_set_id 373985
(3) 根据 "transaction id 7414483" 找到对应trace：
surfaceflinger-2731 ( 1606) [000] .... 69136.712199: binder_transaction: transaction=7414483 dest_node=36400 dest_proc=4128 dest_thread=0 reply=0 flags=0x11 code=0x1 binder:4128_3-4209 ( 4128) [005] .... 69136.740323: binder_transaction_received: transaction=7414483
(4) trace代码位置
binder_transaction trace_binder_transaction(reply, t, target_node); //运行在异步binder发送端进程上下文 binder_thread_read trace_binder_transaction_received(t); //运行在异步binder接收端进程上下文
(5) 按"{" "}" 键在异步binder的发送端和接收端跳转。选中"binder transaction"/"binder reply"后窗口中的箭头，也可以在发送端和接收端之间跳转。