| /* |
| * Copyright (C) 2005 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| #define LOG_TAG "ProcessState" |
| |
| #include <binder/ProcessState.h> |
| |
| #include <binder/BpBinder.h> |
| #include <binder/IPCThreadState.h> |
| #include <binder/IServiceManager.h> |
| #include <binder/Stability.h> |
| #include <cutils/atomic.h> |
| #include <utils/Log.h> |
| #include <utils/String8.h> |
| #include <utils/threads.h> |
| |
| #include <private/binder/binder_module.h> |
| #include "Static.h" |
| |
| #include <errno.h> |
| #include <fcntl.h> |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <unistd.h> |
| #include <sys/ioctl.h> |
| #include <sys/mman.h> |
| #include <sys/stat.h> |
| #include <sys/types.h> |
| |
| #define BINDER_VM_SIZE ((1 * 1024 * 1024) - sysconf(_SC_PAGE_SIZE) * 2) |
| #define DEFAULT_MAX_BINDER_THREADS 15 |
| |
| #ifdef __ANDROID_VNDK__ |
| const char* kDefaultDriver = "/dev/vndbinder"; |
| #else |
| const char* kDefaultDriver = "/dev/binder"; |
| #endif |
| |
| // ------------------------------------------------------------------------- |
| |
| namespace android { |
| |
| class PoolThread : public Thread |
| { |
| public: |
| explicit PoolThread(bool isMain) |
| : mIsMain(isMain) |
| { |
| } |
| |
| protected: |
| virtual bool threadLoop() |
| { |
| IPCThreadState::self()->joinThreadPool(mIsMain); |
| return false; |
| } |
| |
| const bool mIsMain; |
| }; |
| |
| sp<ProcessState> ProcessState::self() |
| { |
| Mutex::Autolock _l(gProcessMutex); |
| if (gProcess != nullptr) { |
| return gProcess; |
| } |
| gProcess = new ProcessState(kDefaultDriver); |
| return gProcess; |
| } |
| |
| sp<ProcessState> ProcessState::initWithDriver(const char* driver) |
| { |
| Mutex::Autolock _l(gProcessMutex); |
| if (gProcess != nullptr) { |
| // Allow for initWithDriver to be called repeatedly with the same |
| // driver. |
| if (!strcmp(gProcess->getDriverName().c_str(), driver)) { |
| return gProcess; |
| } |
| LOG_ALWAYS_FATAL("ProcessState was already initialized."); |
| } |
| |
| if (access(driver, R_OK) == -1) { |
| ALOGE("Binder driver %s is unavailable. Using /dev/binder instead.", driver); |
| driver = "/dev/binder"; |
| } |
| |
| gProcess = new ProcessState(driver); |
| return gProcess; |
| } |
| |
| sp<ProcessState> ProcessState::selfOrNull() |
| { |
| Mutex::Autolock _l(gProcessMutex); |
| return gProcess; |
| } |
| |
| sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& /*caller*/) |
| { |
| sp<IBinder> context = getStrongProxyForHandle(0); |
| |
| if (context == nullptr) { |
| ALOGW("Not able to get context object on %s.", mDriverName.c_str()); |
| } |
| |
| // The root object is special since we get it directly from the driver, it is never |
| // written by Parcell::writeStrongBinder. |
| internal::Stability::tryMarkCompilationUnit(context.get()); |
| |
| return context; |
| } |
| |
| void ProcessState::startThreadPool() |
| { |
| AutoMutex _l(mLock); |
| if (!mThreadPoolStarted) { |
| mThreadPoolStarted = true; |
| spawnPooledThread(true); |
| } |
| } |
| |
| bool ProcessState::becomeContextManager(context_check_func checkFunc, void* userData) |
| { |
| AutoMutex _l(mLock); |
| mBinderContextCheckFunc = checkFunc; |
| mBinderContextUserData = userData; |
| |
| flat_binder_object obj { |
| .flags = FLAT_BINDER_FLAG_TXN_SECURITY_CTX, |
| }; |
| |
| int result = ioctl(mDriverFD, BINDER_SET_CONTEXT_MGR_EXT, &obj); |
| |
| // fallback to original method |
| if (result != 0) { |
| android_errorWriteLog(0x534e4554, "121035042"); |
| |
| int dummy = 0; |
| result = ioctl(mDriverFD, BINDER_SET_CONTEXT_MGR, &dummy); |
| } |
| |
| if (result == -1) { |
| mBinderContextCheckFunc = nullptr; |
| mBinderContextUserData = nullptr; |
| ALOGE("Binder ioctl to become context manager failed: %s\n", strerror(errno)); |
| } |
| |
| return result == 0; |
| } |
| |
| // Get references to userspace objects held by the kernel binder driver |
| // Writes up to count elements into buf, and returns the total number |
| // of references the kernel has, which may be larger than count. |
| // buf may be NULL if count is 0. The pointers returned by this method |
| // should only be used for debugging and not dereferenced, they may |
| // already be invalid. |
| ssize_t ProcessState::getKernelReferences(size_t buf_count, uintptr_t* buf) |
| { |
| binder_node_debug_info info = {}; |
| |
| uintptr_t* end = buf ? buf + buf_count : nullptr; |
| size_t count = 0; |
| |
| do { |
| status_t result = ioctl(mDriverFD, BINDER_GET_NODE_DEBUG_INFO, &info); |
| if (result < 0) { |
| return -1; |
| } |
| if (info.ptr != 0) { |
| if (buf && buf < end) |
| *buf++ = info.ptr; |
| count++; |
| if (buf && buf < end) |
| *buf++ = info.cookie; |
| count++; |
| } |
| } while (info.ptr != 0); |
| |
| return count; |
| } |
| |
| // Queries the driver for the current strong reference count of the node |
| // that the handle points to. Can only be used by the servicemanager. |
| // |
| // Returns -1 in case of failure, otherwise the strong reference count. |
| ssize_t ProcessState::getStrongRefCountForNodeByHandle(int32_t handle) { |
| binder_node_info_for_ref info; |
| memset(&info, 0, sizeof(binder_node_info_for_ref)); |
| |
| info.handle = handle; |
| |
| status_t result = ioctl(mDriverFD, BINDER_GET_NODE_INFO_FOR_REF, &info); |
| |
| if (result != OK) { |
| static bool logged = false; |
| if (!logged) { |
| ALOGW("Kernel does not support BINDER_GET_NODE_INFO_FOR_REF."); |
| logged = true; |
| } |
| return -1; |
| } |
| |
| return info.strong_count; |
| } |
| |
| void ProcessState::setCallRestriction(CallRestriction restriction) { |
| LOG_ALWAYS_FATAL_IF(IPCThreadState::selfOrNull() != nullptr, |
| "Call restrictions must be set before the threadpool is started."); |
| |
| mCallRestriction = restriction; |
| } |
| |
| ProcessState::handle_entry* ProcessState::lookupHandleLocked(int32_t handle) |
| { |
| const size_t N=mHandleToObject.size(); |
| if (N <= (size_t)handle) { |
| handle_entry e; |
| e.binder = nullptr; |
| e.refs = nullptr; |
| status_t err = mHandleToObject.insertAt(e, N, handle+1-N); |
| if (err < NO_ERROR) return nullptr; |
| } |
| return &mHandleToObject.editItemAt(handle); |
| } |
| |
| sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle) |
| { |
| sp<IBinder> result; |
| |
| AutoMutex _l(mLock); |
| |
| handle_entry* e = lookupHandleLocked(handle); |
| |
| if (e != nullptr) { |
| // We need to create a new BpBinder if there isn't currently one, OR we |
| // are unable to acquire a weak reference on this current one. The |
| // attemptIncWeak() is safe because we know the BpBinder destructor will always |
| // call expungeHandle(), which acquires the same lock we are holding now. |
| // We need to do this because there is a race condition between someone |
| // releasing a reference on this BpBinder, and a new reference on its handle |
| // arriving from the driver. |
| IBinder* b = e->binder; |
| if (b == nullptr || !e->refs->attemptIncWeak(this)) { |
| if (handle == 0) { |
| // Special case for context manager... |
| // The context manager is the only object for which we create |
| // a BpBinder proxy without already holding a reference. |
| // Perform a dummy transaction to ensure the context manager |
| // is registered before we create the first local reference |
| // to it (which will occur when creating the BpBinder). |
| // If a local reference is created for the BpBinder when the |
| // context manager is not present, the driver will fail to |
| // provide a reference to the context manager, but the |
| // driver API does not return status. |
| // |
| // Note that this is not race-free if the context manager |
| // dies while this code runs. |
| // |
| // TODO: add a driver API to wait for context manager, or |
| // stop special casing handle 0 for context manager and add |
| // a driver API to get a handle to the context manager with |
| // proper reference counting. |
| |
| Parcel data; |
| status_t status = IPCThreadState::self()->transact( |
| 0, IBinder::PING_TRANSACTION, data, nullptr, 0); |
| if (status == DEAD_OBJECT) |
| return nullptr; |
| } |
| |
| b = BpBinder::create(handle); |
| e->binder = b; |
| if (b) e->refs = b->getWeakRefs(); |
| result = b; |
| } else { |
| // This little bit of nastyness is to allow us to add a primary |
| // reference to the remote proxy when this team doesn't have one |
| // but another team is sending the handle to us. |
| result.force_set(b); |
| e->refs->decWeak(this); |
| } |
| } |
| |
| return result; |
| } |
| |
| void ProcessState::expungeHandle(int32_t handle, IBinder* binder) |
| { |
| AutoMutex _l(mLock); |
| |
| handle_entry* e = lookupHandleLocked(handle); |
| |
| // This handle may have already been replaced with a new BpBinder |
| // (if someone failed the AttemptIncWeak() above); we don't want |
| // to overwrite it. |
| if (e && e->binder == binder) e->binder = nullptr; |
| } |
| |
| String8 ProcessState::makeBinderThreadName() { |
| int32_t s = android_atomic_add(1, &mThreadPoolSeq); |
| pid_t pid = getpid(); |
| String8 name; |
| name.appendFormat("Binder:%d_%X", pid, s); |
| return name; |
| } |
| |
| void ProcessState::spawnPooledThread(bool isMain) |
| { |
| if (mThreadPoolStarted) { |
| String8 name = makeBinderThreadName(); |
| ALOGV("Spawning new pooled thread, name=%s\n", name.string()); |
| sp<Thread> t = new PoolThread(isMain); |
| t->run(name.string()); |
| } |
| } |
| |
| status_t ProcessState::setThreadPoolMaxThreadCount(size_t maxThreads) { |
| status_t result = NO_ERROR; |
| if (ioctl(mDriverFD, BINDER_SET_MAX_THREADS, &maxThreads) != -1) { |
| mMaxThreads = maxThreads; |
| } else { |
| result = -errno; |
| ALOGE("Binder ioctl to set max threads failed: %s", strerror(-result)); |
| } |
| return result; |
| } |
| |
| void ProcessState::giveThreadPoolName() { |
| androidSetThreadName( makeBinderThreadName().string() ); |
| } |
| |
| String8 ProcessState::getDriverName() { |
| return mDriverName; |
| } |
| |
| static int open_driver(const char *driver) |
| { |
| int fd = open(driver, O_RDWR | O_CLOEXEC); |
| if (fd >= 0) { |
| int vers = 0; |
| status_t result = ioctl(fd, BINDER_VERSION, &vers); |
| if (result == -1) { |
| ALOGE("Binder ioctl to obtain version failed: %s", strerror(errno)); |
| close(fd); |
| fd = -1; |
| } |
| if (result != 0 || vers != BINDER_CURRENT_PROTOCOL_VERSION) { |
| ALOGE("Binder driver protocol(%d) does not match user space protocol(%d)! ioctl() return value: %d", |
| vers, BINDER_CURRENT_PROTOCOL_VERSION, result); |
| close(fd); |
| fd = -1; |
| } |
| size_t maxThreads = DEFAULT_MAX_BINDER_THREADS; |
| result = ioctl(fd, BINDER_SET_MAX_THREADS, &maxThreads); |
| if (result == -1) { |
| ALOGE("Binder ioctl to set max threads failed: %s", strerror(errno)); |
| } |
| } else { |
| ALOGW("Opening '%s' failed: %s\n", driver, strerror(errno)); |
| } |
| return fd; |
| } |
| |
| ProcessState::ProcessState(const char *driver) |
| : mDriverName(String8(driver)) |
| , mDriverFD(open_driver(driver)) |
| , mVMStart(MAP_FAILED) |
| , mThreadCountLock(PTHREAD_MUTEX_INITIALIZER) |
| , mThreadCountDecrement(PTHREAD_COND_INITIALIZER) |
| , mExecutingThreadsCount(0) |
| , mMaxThreads(DEFAULT_MAX_BINDER_THREADS) |
| , mStarvationStartTimeMs(0) |
| , mBinderContextCheckFunc(nullptr) |
| , mBinderContextUserData(nullptr) |
| , mThreadPoolStarted(false) |
| , mThreadPoolSeq(1) |
| , mCallRestriction(CallRestriction::NONE) |
| { |
| |
| // TODO(b/139016109): enforce in build system |
| #if defined(__ANDROID_APEX__) |
| LOG_ALWAYS_FATAL("Cannot use libbinder in APEX (only system.img libbinder) since it is not stable."); |
| #endif |
| |
| if (mDriverFD >= 0) { |
| // mmap the binder, providing a chunk of virtual address space to receive transactions. |
| mVMStart = mmap(nullptr, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0); |
| if (mVMStart == MAP_FAILED) { |
| // *sigh* |
| ALOGE("Using %s failed: unable to mmap transaction memory.\n", mDriverName.c_str()); |
| close(mDriverFD); |
| mDriverFD = -1; |
| mDriverName.clear(); |
| } |
| } |
| |
| #ifdef __ANDROID__ |
| LOG_ALWAYS_FATAL_IF(mDriverFD < 0, "Binder driver '%s' could not be opened. Terminating.", driver); |
| #endif |
| } |
| |
| ProcessState::~ProcessState() |
| { |
| if (mDriverFD >= 0) { |
| if (mVMStart != MAP_FAILED) { |
| munmap(mVMStart, BINDER_VM_SIZE); |
| } |
| close(mDriverFD); |
| } |
| mDriverFD = -1; |
| } |
| |
| } // namespace android |