428 lines
13 KiB
C++
428 lines
13 KiB
C++
/*
|
|
* Copyright (C) 2005 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
#define LOG_TAG "ProcessState"
|
|
|
|
#include <binder/ProcessState.h>
|
|
|
|
#include <binder/BpBinder.h>
|
|
#include <binder/IPCThreadState.h>
|
|
#include <binder/IServiceManager.h>
|
|
#include <binder/Stability.h>
|
|
#include <cutils/atomic.h>
|
|
#include <utils/Log.h>
|
|
#include <utils/String8.h>
|
|
#include <utils/threads.h>
|
|
|
|
#include <private/binder/binder_module.h>
|
|
#include "Static.h"
|
|
|
|
#include <errno.h>
|
|
#include <fcntl.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <unistd.h>
|
|
#include <sys/ioctl.h>
|
|
#include <sys/mman.h>
|
|
#include <sys/stat.h>
|
|
#include <sys/types.h>
|
|
|
|
#define BINDER_VM_SIZE ((1 * 1024 * 1024) - sysconf(_SC_PAGE_SIZE) * 2)
|
|
#define DEFAULT_MAX_BINDER_THREADS 15
|
|
|
|
#ifdef __ANDROID_VNDK__
|
|
const char* kDefaultDriver = "/dev/vndbinder";
|
|
#else
|
|
const char* kDefaultDriver = "/dev/binder";
|
|
#endif
|
|
|
|
// -------------------------------------------------------------------------
|
|
|
|
namespace android {
|
|
|
|
class PoolThread : public Thread
|
|
{
|
|
public:
|
|
explicit PoolThread(bool isMain)
|
|
: mIsMain(isMain)
|
|
{
|
|
}
|
|
|
|
protected:
|
|
virtual bool threadLoop()
|
|
{
|
|
IPCThreadState::self()->joinThreadPool(mIsMain);
|
|
return false;
|
|
}
|
|
|
|
const bool mIsMain;
|
|
};
|
|
|
|
sp<ProcessState> ProcessState::self()
|
|
{
|
|
Mutex::Autolock _l(gProcessMutex);
|
|
if (gProcess != nullptr) {
|
|
return gProcess;
|
|
}
|
|
gProcess = new ProcessState(kDefaultDriver);
|
|
return gProcess;
|
|
}
|
|
|
|
sp<ProcessState> ProcessState::initWithDriver(const char* driver)
|
|
{
|
|
Mutex::Autolock _l(gProcessMutex);
|
|
if (gProcess != nullptr) {
|
|
// Allow for initWithDriver to be called repeatedly with the same
|
|
// driver.
|
|
if (!strcmp(gProcess->getDriverName().c_str(), driver)) {
|
|
return gProcess;
|
|
}
|
|
LOG_ALWAYS_FATAL("ProcessState was already initialized.");
|
|
}
|
|
|
|
if (access(driver, R_OK) == -1) {
|
|
ALOGE("Binder driver %s is unavailable. Using /dev/binder instead.", driver);
|
|
driver = "/dev/binder";
|
|
}
|
|
|
|
gProcess = new ProcessState(driver);
|
|
return gProcess;
|
|
}
|
|
|
|
sp<ProcessState> ProcessState::selfOrNull()
|
|
{
|
|
Mutex::Autolock _l(gProcessMutex);
|
|
return gProcess;
|
|
}
|
|
|
|
sp<IBinder> ProcessState::getContextObject(const sp<IBinder>& /*caller*/)
|
|
{
|
|
sp<IBinder> context = getStrongProxyForHandle(0);
|
|
|
|
if (context == nullptr) {
|
|
ALOGW("Not able to get context object on %s.", mDriverName.c_str());
|
|
}
|
|
|
|
// The root object is special since we get it directly from the driver, it is never
|
|
// written by Parcell::writeStrongBinder.
|
|
internal::Stability::tryMarkCompilationUnit(context.get());
|
|
|
|
return context;
|
|
}
|
|
|
|
void ProcessState::startThreadPool()
|
|
{
|
|
AutoMutex _l(mLock);
|
|
if (!mThreadPoolStarted) {
|
|
mThreadPoolStarted = true;
|
|
spawnPooledThread(true);
|
|
}
|
|
}
|
|
|
|
bool ProcessState::becomeContextManager(context_check_func checkFunc, void* userData)
|
|
{
|
|
AutoMutex _l(mLock);
|
|
mBinderContextCheckFunc = checkFunc;
|
|
mBinderContextUserData = userData;
|
|
|
|
flat_binder_object obj {
|
|
.flags = FLAT_BINDER_FLAG_TXN_SECURITY_CTX,
|
|
};
|
|
|
|
int result = ioctl(mDriverFD, BINDER_SET_CONTEXT_MGR_EXT, &obj);
|
|
|
|
// fallback to original method
|
|
if (result != 0) {
|
|
android_errorWriteLog(0x534e4554, "121035042");
|
|
|
|
int dummy = 0;
|
|
result = ioctl(mDriverFD, BINDER_SET_CONTEXT_MGR, &dummy);
|
|
}
|
|
|
|
if (result == -1) {
|
|
mBinderContextCheckFunc = nullptr;
|
|
mBinderContextUserData = nullptr;
|
|
ALOGE("Binder ioctl to become context manager failed: %s\n", strerror(errno));
|
|
}
|
|
|
|
return result == 0;
|
|
}
|
|
|
|
// Get references to userspace objects held by the kernel binder driver
|
|
// Writes up to count elements into buf, and returns the total number
|
|
// of references the kernel has, which may be larger than count.
|
|
// buf may be NULL if count is 0. The pointers returned by this method
|
|
// should only be used for debugging and not dereferenced, they may
|
|
// already be invalid.
|
|
ssize_t ProcessState::getKernelReferences(size_t buf_count, uintptr_t* buf)
|
|
{
|
|
binder_node_debug_info info = {};
|
|
|
|
uintptr_t* end = buf ? buf + buf_count : nullptr;
|
|
size_t count = 0;
|
|
|
|
do {
|
|
status_t result = ioctl(mDriverFD, BINDER_GET_NODE_DEBUG_INFO, &info);
|
|
if (result < 0) {
|
|
return -1;
|
|
}
|
|
if (info.ptr != 0) {
|
|
if (buf && buf < end)
|
|
*buf++ = info.ptr;
|
|
count++;
|
|
if (buf && buf < end)
|
|
*buf++ = info.cookie;
|
|
count++;
|
|
}
|
|
} while (info.ptr != 0);
|
|
|
|
return count;
|
|
}
|
|
|
|
// Queries the driver for the current strong reference count of the node
|
|
// that the handle points to. Can only be used by the servicemanager.
|
|
//
|
|
// Returns -1 in case of failure, otherwise the strong reference count.
|
|
ssize_t ProcessState::getStrongRefCountForNodeByHandle(int32_t handle) {
|
|
binder_node_info_for_ref info;
|
|
memset(&info, 0, sizeof(binder_node_info_for_ref));
|
|
|
|
info.handle = handle;
|
|
|
|
status_t result = ioctl(mDriverFD, BINDER_GET_NODE_INFO_FOR_REF, &info);
|
|
|
|
if (result != OK) {
|
|
static bool logged = false;
|
|
if (!logged) {
|
|
ALOGW("Kernel does not support BINDER_GET_NODE_INFO_FOR_REF.");
|
|
logged = true;
|
|
}
|
|
return -1;
|
|
}
|
|
|
|
return info.strong_count;
|
|
}
|
|
|
|
void ProcessState::setCallRestriction(CallRestriction restriction) {
|
|
LOG_ALWAYS_FATAL_IF(IPCThreadState::selfOrNull() != nullptr,
|
|
"Call restrictions must be set before the threadpool is started.");
|
|
|
|
mCallRestriction = restriction;
|
|
}
|
|
|
|
ProcessState::handle_entry* ProcessState::lookupHandleLocked(int32_t handle)
|
|
{
|
|
const size_t N=mHandleToObject.size();
|
|
if (N <= (size_t)handle) {
|
|
handle_entry e;
|
|
e.binder = nullptr;
|
|
e.refs = nullptr;
|
|
status_t err = mHandleToObject.insertAt(e, N, handle+1-N);
|
|
if (err < NO_ERROR) return nullptr;
|
|
}
|
|
return &mHandleToObject.editItemAt(handle);
|
|
}
|
|
|
|
sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle)
|
|
{
|
|
sp<IBinder> result;
|
|
|
|
AutoMutex _l(mLock);
|
|
|
|
handle_entry* e = lookupHandleLocked(handle);
|
|
|
|
if (e != nullptr) {
|
|
// We need to create a new BpBinder if there isn't currently one, OR we
|
|
// are unable to acquire a weak reference on this current one. The
|
|
// attemptIncWeak() is safe because we know the BpBinder destructor will always
|
|
// call expungeHandle(), which acquires the same lock we are holding now.
|
|
// We need to do this because there is a race condition between someone
|
|
// releasing a reference on this BpBinder, and a new reference on its handle
|
|
// arriving from the driver.
|
|
IBinder* b = e->binder;
|
|
if (b == nullptr || !e->refs->attemptIncWeak(this)) {
|
|
if (handle == 0) {
|
|
// Special case for context manager...
|
|
// The context manager is the only object for which we create
|
|
// a BpBinder proxy without already holding a reference.
|
|
// Perform a dummy transaction to ensure the context manager
|
|
// is registered before we create the first local reference
|
|
// to it (which will occur when creating the BpBinder).
|
|
// If a local reference is created for the BpBinder when the
|
|
// context manager is not present, the driver will fail to
|
|
// provide a reference to the context manager, but the
|
|
// driver API does not return status.
|
|
//
|
|
// Note that this is not race-free if the context manager
|
|
// dies while this code runs.
|
|
//
|
|
// TODO: add a driver API to wait for context manager, or
|
|
// stop special casing handle 0 for context manager and add
|
|
// a driver API to get a handle to the context manager with
|
|
// proper reference counting.
|
|
|
|
Parcel data;
|
|
status_t status = IPCThreadState::self()->transact(
|
|
0, IBinder::PING_TRANSACTION, data, nullptr, 0);
|
|
if (status == DEAD_OBJECT)
|
|
return nullptr;
|
|
}
|
|
|
|
b = BpBinder::create(handle);
|
|
e->binder = b;
|
|
if (b) e->refs = b->getWeakRefs();
|
|
result = b;
|
|
} else {
|
|
// This little bit of nastyness is to allow us to add a primary
|
|
// reference to the remote proxy when this team doesn't have one
|
|
// but another team is sending the handle to us.
|
|
result.force_set(b);
|
|
e->refs->decWeak(this);
|
|
}
|
|
}
|
|
|
|
return result;
|
|
}
|
|
|
|
void ProcessState::expungeHandle(int32_t handle, IBinder* binder)
|
|
{
|
|
AutoMutex _l(mLock);
|
|
|
|
handle_entry* e = lookupHandleLocked(handle);
|
|
|
|
// This handle may have already been replaced with a new BpBinder
|
|
// (if someone failed the AttemptIncWeak() above); we don't want
|
|
// to overwrite it.
|
|
if (e && e->binder == binder) e->binder = nullptr;
|
|
}
|
|
|
|
String8 ProcessState::makeBinderThreadName() {
|
|
int32_t s = android_atomic_add(1, &mThreadPoolSeq);
|
|
pid_t pid = getpid();
|
|
String8 name;
|
|
name.appendFormat("Binder:%d_%X", pid, s);
|
|
return name;
|
|
}
|
|
|
|
void ProcessState::spawnPooledThread(bool isMain)
|
|
{
|
|
if (mThreadPoolStarted) {
|
|
String8 name = makeBinderThreadName();
|
|
ALOGV("Spawning new pooled thread, name=%s\n", name.string());
|
|
sp<Thread> t = new PoolThread(isMain);
|
|
t->run(name.string());
|
|
}
|
|
}
|
|
|
|
status_t ProcessState::setThreadPoolMaxThreadCount(size_t maxThreads) {
|
|
LOG_ALWAYS_FATAL_IF(mThreadPoolStarted && maxThreads < mMaxThreads,
|
|
"Binder threadpool cannot be shrunk after starting");
|
|
status_t result = NO_ERROR;
|
|
if (ioctl(mDriverFD, BINDER_SET_MAX_THREADS, &maxThreads) != -1) {
|
|
mMaxThreads = maxThreads;
|
|
} else {
|
|
result = -errno;
|
|
ALOGE("Binder ioctl to set max threads failed: %s", strerror(-result));
|
|
}
|
|
return result;
|
|
}
|
|
|
|
void ProcessState::giveThreadPoolName() {
|
|
androidSetThreadName( makeBinderThreadName().string() );
|
|
}
|
|
|
|
String8 ProcessState::getDriverName() {
|
|
return mDriverName;
|
|
}
|
|
|
|
static int open_driver(const char *driver)
|
|
{
|
|
int fd = open(driver, O_RDWR | O_CLOEXEC);
|
|
if (fd >= 0) {
|
|
int vers = 0;
|
|
status_t result = ioctl(fd, BINDER_VERSION, &vers);
|
|
if (result == -1) {
|
|
ALOGE("Binder ioctl to obtain version failed: %s", strerror(errno));
|
|
close(fd);
|
|
fd = -1;
|
|
}
|
|
if (result != 0 || vers != BINDER_CURRENT_PROTOCOL_VERSION) {
|
|
ALOGE("Binder driver protocol(%d) does not match user space protocol(%d)! ioctl() return value: %d",
|
|
vers, BINDER_CURRENT_PROTOCOL_VERSION, result);
|
|
close(fd);
|
|
fd = -1;
|
|
}
|
|
size_t maxThreads = DEFAULT_MAX_BINDER_THREADS;
|
|
result = ioctl(fd, BINDER_SET_MAX_THREADS, &maxThreads);
|
|
if (result == -1) {
|
|
ALOGE("Binder ioctl to set max threads failed: %s", strerror(errno));
|
|
}
|
|
} else {
|
|
ALOGW("Opening '%s' failed: %s\n", driver, strerror(errno));
|
|
}
|
|
return fd;
|
|
}
|
|
|
|
ProcessState::ProcessState(const char *driver)
|
|
: mDriverName(String8(driver))
|
|
, mDriverFD(open_driver(driver))
|
|
, mVMStart(MAP_FAILED)
|
|
, mThreadCountLock(PTHREAD_MUTEX_INITIALIZER)
|
|
, mThreadCountDecrement(PTHREAD_COND_INITIALIZER)
|
|
, mExecutingThreadsCount(0)
|
|
, mMaxThreads(DEFAULT_MAX_BINDER_THREADS)
|
|
, mStarvationStartTimeMs(0)
|
|
, mBinderContextCheckFunc(nullptr)
|
|
, mBinderContextUserData(nullptr)
|
|
, mThreadPoolStarted(false)
|
|
, mThreadPoolSeq(1)
|
|
, mCallRestriction(CallRestriction::NONE)
|
|
{
|
|
|
|
// TODO(b/139016109): enforce in build system
|
|
#if defined(__ANDROID_APEX__)
|
|
LOG_ALWAYS_FATAL("Cannot use libbinder in APEX (only system.img libbinder) since it is not stable.");
|
|
#endif
|
|
|
|
if (mDriverFD >= 0) {
|
|
// mmap the binder, providing a chunk of virtual address space to receive transactions.
|
|
mVMStart = mmap(nullptr, BINDER_VM_SIZE, PROT_READ, MAP_PRIVATE | MAP_NORESERVE, mDriverFD, 0);
|
|
if (mVMStart == MAP_FAILED) {
|
|
// *sigh*
|
|
ALOGE("Using %s failed: unable to mmap transaction memory.\n", mDriverName.c_str());
|
|
close(mDriverFD);
|
|
mDriverFD = -1;
|
|
mDriverName.clear();
|
|
}
|
|
}
|
|
|
|
#ifdef __ANDROID__
|
|
LOG_ALWAYS_FATAL_IF(mDriverFD < 0, "Binder driver '%s' could not be opened. Terminating.", driver);
|
|
#endif
|
|
}
|
|
|
|
ProcessState::~ProcessState()
|
|
{
|
|
if (mDriverFD >= 0) {
|
|
if (mVMStart != MAP_FAILED) {
|
|
munmap(mVMStart, BINDER_VM_SIZE);
|
|
}
|
|
close(mDriverFD);
|
|
}
|
|
mDriverFD = -1;
|
|
}
|
|
|
|
} // namespace android
|