1/* 2 * Copyright (C) 2008 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17#define LOG_TAG "IMemory" 18 19#include <atomic> 20#include <stdatomic.h> 21 22#include <fcntl.h> 23#include <stdint.h> 24#include <stdio.h> 25#include <stdlib.h> 26#include <sys/types.h> 27#include <sys/mman.h> 28#include <unistd.h> 29 30#include <binder/IMemory.h> 31#include <binder/Parcel.h> 32#include <log/log.h> 33 34#include <utils/CallStack.h> 35#include <utils/KeyedVector.h> 36#include <utils/threads.h> 37 38#define VERBOSE 0 39 40namespace android { 41// --------------------------------------------------------------------------- 42 43class HeapCache : public IBinder::DeathRecipient 44{ 45public: 46 HeapCache(); 47 virtual ~HeapCache(); 48 49 virtual void binderDied(const wp<IBinder>& who); 50 51 sp<IMemoryHeap> find_heap(const sp<IBinder>& binder); 52 void free_heap(const sp<IBinder>& binder); 53 sp<IMemoryHeap> get_heap(const sp<IBinder>& binder); 54 void dump_heaps(); 55 56private: 57 // For IMemory.cpp 58 struct heap_info_t { 59 sp<IMemoryHeap> heap; 60 int32_t count; 61 // Note that this cannot be meaningfully copied. 62 }; 63 64 void free_heap(const wp<IBinder>& binder); 65 66 Mutex mHeapCacheLock; // Protects entire vector below. 67 KeyedVector< wp<IBinder>, heap_info_t > mHeapCache; 68 // We do not use the copy-on-write capabilities of KeyedVector. 69 // TODO: Reimplemement based on standard C++ container? 70}; 71 72static sp<HeapCache> gHeapCache = new HeapCache(); 73 74/******************************************************************************/ 75 76enum { 77 HEAP_ID = IBinder::FIRST_CALL_TRANSACTION 78}; 79 80class BpMemoryHeap : public BpInterface<IMemoryHeap> 81{ 82public: 83 explicit BpMemoryHeap(const sp<IBinder>& impl); 84 virtual ~BpMemoryHeap(); 85 86 virtual int getHeapID() const; 87 virtual void* getBase() const; 88 virtual size_t getSize() const; 89 virtual uint32_t getFlags() const; 90 virtual uint32_t getOffset() const; 91 92private: 93 friend class IMemory; 94 friend class HeapCache; 95 96 // for debugging in this module 97 static inline sp<IMemoryHeap> find_heap(const sp<IBinder>& binder) { 98 return gHeapCache->find_heap(binder); 99 } 100 static inline void free_heap(const sp<IBinder>& binder) { 101 gHeapCache->free_heap(binder); 102 } 103 static inline sp<IMemoryHeap> get_heap(const sp<IBinder>& binder) { 104 return gHeapCache->get_heap(binder); 105 } 106 static inline void dump_heaps() { 107 gHeapCache->dump_heaps(); 108 } 109 110 void assertMapped() const; 111 void assertReallyMapped() const; 112 113 mutable std::atomic<int32_t> mHeapId; 114 mutable void* mBase; 115 mutable size_t mSize; 116 mutable uint32_t mFlags; 117 mutable uint32_t mOffset; 118 mutable bool mRealHeap; 119 mutable Mutex mLock; 120}; 121 122// ---------------------------------------------------------------------------- 123 124enum { 125 GET_MEMORY = IBinder::FIRST_CALL_TRANSACTION 126}; 127 128class BpMemory : public BpInterface<IMemory> 129{ 130public: 131 explicit BpMemory(const sp<IBinder>& impl); 132 virtual ~BpMemory(); 133 virtual sp<IMemoryHeap> getMemory(ssize_t* offset=0, size_t* size=0) const; 134 135private: 136 mutable sp<IMemoryHeap> mHeap; 137 mutable ssize_t mOffset; 138 mutable size_t mSize; 139}; 140 141/******************************************************************************/ 142 143void* IMemory::fastPointer(const sp<IBinder>& binder, ssize_t offset) const 144{ 145 sp<IMemoryHeap> realHeap = BpMemoryHeap::get_heap(binder); 146 void* const base = realHeap->base(); 147 if (base == MAP_FAILED) 148 return 0; 149 return static_cast<char*>(base) + offset; 150} 151 152void* IMemory::pointer() const { 153 ssize_t offset; 154 sp<IMemoryHeap> heap = getMemory(&offset); 155 void* const base = heap!=0 ? heap->base() : MAP_FAILED; 156 if (base == MAP_FAILED) 157 return 0; 158 return static_cast<char*>(base) + offset; 159} 160 161size_t IMemory::size() const { 162 size_t size; 163 getMemory(NULL, &size); 164 return size; 165} 166 167ssize_t IMemory::offset() const { 168 ssize_t offset; 169 getMemory(&offset); 170 return offset; 171} 172 173/******************************************************************************/ 174 175BpMemory::BpMemory(const sp<IBinder>& impl) 176 : BpInterface<IMemory>(impl), mOffset(0), mSize(0) 177{ 178} 179 180BpMemory::~BpMemory() 181{ 182} 183 184sp<IMemoryHeap> BpMemory::getMemory(ssize_t* offset, size_t* size) const 185{ 186 if (mHeap == 0) { 187 Parcel data, reply; 188 data.writeInterfaceToken(IMemory::getInterfaceDescriptor()); 189 if (remote()->transact(GET_MEMORY, data, &reply) == NO_ERROR) { 190 sp<IBinder> heap = reply.readStrongBinder(); 191 ssize_t o = reply.readInt32(); 192 size_t s = reply.readInt32(); 193 if (heap != 0) { 194 mHeap = interface_cast<IMemoryHeap>(heap); 195 if (mHeap != 0) { 196 size_t heapSize = mHeap->getSize(); 197 if (s <= heapSize 198 && o >= 0 199 && (static_cast<size_t>(o) <= heapSize - s)) { 200 mOffset = o; 201 mSize = s; 202 } else { 203 // Hm. 204 android_errorWriteWithInfoLog(0x534e4554, 205 "26877992", -1, NULL, 0); 206 mOffset = 0; 207 mSize = 0; 208 } 209 } 210 } 211 } 212 } 213 if (offset) *offset = mOffset; 214 if (size) *size = mSize; 215 return (mSize > 0) ? mHeap : 0; 216} 217 218// --------------------------------------------------------------------------- 219 220IMPLEMENT_META_INTERFACE(Memory, "android.utils.IMemory"); 221 222BnMemory::BnMemory() { 223} 224 225BnMemory::~BnMemory() { 226} 227 228status_t BnMemory::onTransact( 229 uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags) 230{ 231 switch(code) { 232 case GET_MEMORY: { 233 CHECK_INTERFACE(IMemory, data, reply); 234 ssize_t offset; 235 size_t size; 236 reply->writeStrongBinder( IInterface::asBinder(getMemory(&offset, &size)) ); 237 reply->writeInt32(offset); 238 reply->writeInt32(size); 239 return NO_ERROR; 240 } break; 241 default: 242 return BBinder::onTransact(code, data, reply, flags); 243 } 244} 245 246 247/******************************************************************************/ 248 249BpMemoryHeap::BpMemoryHeap(const sp<IBinder>& impl) 250 : BpInterface<IMemoryHeap>(impl), 251 mHeapId(-1), mBase(MAP_FAILED), mSize(0), mFlags(0), mOffset(0), mRealHeap(false) 252{ 253} 254 255BpMemoryHeap::~BpMemoryHeap() { 256 int32_t heapId = mHeapId.load(memory_order_relaxed); 257 if (heapId != -1) { 258 close(heapId); 259 if (mRealHeap) { 260 // by construction we're the last one 261 if (mBase != MAP_FAILED) { 262 sp<IBinder> binder = IInterface::asBinder(this); 263 264 if (VERBOSE) { 265 ALOGD("UNMAPPING binder=%p, heap=%p, size=%zu, fd=%d", 266 binder.get(), this, mSize, heapId); 267 CallStack stack(LOG_TAG); 268 } 269 270 munmap(mBase, mSize); 271 } 272 } else { 273 // remove from list only if it was mapped before 274 sp<IBinder> binder = IInterface::asBinder(this); 275 free_heap(binder); 276 } 277 } 278} 279 280void BpMemoryHeap::assertMapped() const 281{ 282 int32_t heapId = mHeapId.load(memory_order_acquire); 283 if (heapId == -1) { 284 sp<IBinder> binder(IInterface::asBinder(const_cast<BpMemoryHeap*>(this))); 285 sp<BpMemoryHeap> heap(static_cast<BpMemoryHeap*>(find_heap(binder).get())); 286 heap->assertReallyMapped(); 287 if (heap->mBase != MAP_FAILED) { 288 Mutex::Autolock _l(mLock); 289 if (mHeapId.load(memory_order_relaxed) == -1) { 290 mBase = heap->mBase; 291 mSize = heap->mSize; 292 mOffset = heap->mOffset; 293 int fd = fcntl(heap->mHeapId.load(memory_order_relaxed), F_DUPFD_CLOEXEC, 0); 294 ALOGE_IF(fd==-1, "cannot dup fd=%d", 295 heap->mHeapId.load(memory_order_relaxed)); 296 mHeapId.store(fd, memory_order_release); 297 } 298 } else { 299 // something went wrong 300 free_heap(binder); 301 } 302 } 303} 304 305void BpMemoryHeap::assertReallyMapped() const 306{ 307 int32_t heapId = mHeapId.load(memory_order_acquire); 308 if (heapId == -1) { 309 310 // remote call without mLock held, worse case scenario, we end up 311 // calling transact() from multiple threads, but that's not a problem, 312 // only mmap below must be in the critical section. 313 314 Parcel data, reply; 315 data.writeInterfaceToken(IMemoryHeap::getInterfaceDescriptor()); 316 status_t err = remote()->transact(HEAP_ID, data, &reply); 317 int parcel_fd = reply.readFileDescriptor(); 318 ssize_t size = reply.readInt32(); 319 uint32_t flags = reply.readInt32(); 320 uint32_t offset = reply.readInt32(); 321 322 ALOGE_IF(err, "binder=%p transaction failed fd=%d, size=%zd, err=%d (%s)", 323 IInterface::asBinder(this).get(), 324 parcel_fd, size, err, strerror(-err)); 325 326 Mutex::Autolock _l(mLock); 327 if (mHeapId.load(memory_order_relaxed) == -1) { 328 int fd = fcntl(parcel_fd, F_DUPFD_CLOEXEC, 0); 329 ALOGE_IF(fd==-1, "cannot dup fd=%d, size=%zd, err=%d (%s)", 330 parcel_fd, size, err, strerror(errno)); 331 332 int access = PROT_READ; 333 if (!(flags & READ_ONLY)) { 334 access |= PROT_WRITE; 335 } 336 mRealHeap = true; 337 mBase = mmap(0, size, access, MAP_SHARED, fd, offset); 338 if (mBase == MAP_FAILED) { 339 ALOGE("cannot map BpMemoryHeap (binder=%p), size=%zd, fd=%d (%s)", 340 IInterface::asBinder(this).get(), size, fd, strerror(errno)); 341 close(fd); 342 } else { 343 mSize = size; 344 mFlags = flags; 345 mOffset = offset; 346 mHeapId.store(fd, memory_order_release); 347 } 348 } 349 } 350} 351 352int BpMemoryHeap::getHeapID() const { 353 assertMapped(); 354 // We either stored mHeapId ourselves, or loaded it with acquire semantics. 355 return mHeapId.load(memory_order_relaxed); 356} 357 358void* BpMemoryHeap::getBase() const { 359 assertMapped(); 360 return mBase; 361} 362 363size_t BpMemoryHeap::getSize() const { 364 assertMapped(); 365 return mSize; 366} 367 368uint32_t BpMemoryHeap::getFlags() const { 369 assertMapped(); 370 return mFlags; 371} 372 373uint32_t BpMemoryHeap::getOffset() const { 374 assertMapped(); 375 return mOffset; 376} 377 378// --------------------------------------------------------------------------- 379 380IMPLEMENT_META_INTERFACE(MemoryHeap, "android.utils.IMemoryHeap"); 381 382BnMemoryHeap::BnMemoryHeap() { 383} 384 385BnMemoryHeap::~BnMemoryHeap() { 386} 387 388status_t BnMemoryHeap::onTransact( 389 uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags) 390{ 391 switch(code) { 392 case HEAP_ID: { 393 CHECK_INTERFACE(IMemoryHeap, data, reply); 394 reply->writeFileDescriptor(getHeapID()); 395 reply->writeInt32(getSize()); 396 reply->writeInt32(getFlags()); 397 reply->writeInt32(getOffset()); 398 return NO_ERROR; 399 } break; 400 default: 401 return BBinder::onTransact(code, data, reply, flags); 402 } 403} 404 405/*****************************************************************************/ 406 407HeapCache::HeapCache() 408 : DeathRecipient() 409{ 410} 411 412HeapCache::~HeapCache() 413{ 414} 415 416void HeapCache::binderDied(const wp<IBinder>& binder) 417{ 418 //ALOGD("binderDied binder=%p", binder.unsafe_get()); 419 free_heap(binder); 420} 421 422sp<IMemoryHeap> HeapCache::find_heap(const sp<IBinder>& binder) 423{ 424 Mutex::Autolock _l(mHeapCacheLock); 425 ssize_t i = mHeapCache.indexOfKey(binder); 426 if (i>=0) { 427 heap_info_t& info = mHeapCache.editValueAt(i); 428 ALOGD_IF(VERBOSE, 429 "found binder=%p, heap=%p, size=%zu, fd=%d, count=%d", 430 binder.get(), info.heap.get(), 431 static_cast<BpMemoryHeap*>(info.heap.get())->mSize, 432 static_cast<BpMemoryHeap*>(info.heap.get()) 433 ->mHeapId.load(memory_order_relaxed), 434 info.count); 435 ++info.count; 436 return info.heap; 437 } else { 438 heap_info_t info; 439 info.heap = interface_cast<IMemoryHeap>(binder); 440 info.count = 1; 441 //ALOGD("adding binder=%p, heap=%p, count=%d", 442 // binder.get(), info.heap.get(), info.count); 443 mHeapCache.add(binder, info); 444 return info.heap; 445 } 446} 447 448void HeapCache::free_heap(const sp<IBinder>& binder) { 449 free_heap( wp<IBinder>(binder) ); 450} 451 452void HeapCache::free_heap(const wp<IBinder>& binder) 453{ 454 sp<IMemoryHeap> rel; 455 { 456 Mutex::Autolock _l(mHeapCacheLock); 457 ssize_t i = mHeapCache.indexOfKey(binder); 458 if (i>=0) { 459 heap_info_t& info(mHeapCache.editValueAt(i)); 460 if (--info.count == 0) { 461 ALOGD_IF(VERBOSE, 462 "removing binder=%p, heap=%p, size=%zu, fd=%d, count=%d", 463 binder.unsafe_get(), info.heap.get(), 464 static_cast<BpMemoryHeap*>(info.heap.get())->mSize, 465 static_cast<BpMemoryHeap*>(info.heap.get()) 466 ->mHeapId.load(memory_order_relaxed), 467 info.count); 468 rel = mHeapCache.valueAt(i).heap; 469 mHeapCache.removeItemsAt(i); 470 } 471 } else { 472 ALOGE("free_heap binder=%p not found!!!", binder.unsafe_get()); 473 } 474 } 475} 476 477sp<IMemoryHeap> HeapCache::get_heap(const sp<IBinder>& binder) 478{ 479 sp<IMemoryHeap> realHeap; 480 Mutex::Autolock _l(mHeapCacheLock); 481 ssize_t i = mHeapCache.indexOfKey(binder); 482 if (i>=0) realHeap = mHeapCache.valueAt(i).heap; 483 else realHeap = interface_cast<IMemoryHeap>(binder); 484 return realHeap; 485} 486 487void HeapCache::dump_heaps() 488{ 489 Mutex::Autolock _l(mHeapCacheLock); 490 int c = mHeapCache.size(); 491 for (int i=0 ; i<c ; i++) { 492 const heap_info_t& info = mHeapCache.valueAt(i); 493 BpMemoryHeap const* h(static_cast<BpMemoryHeap const *>(info.heap.get())); 494 ALOGD("hey=%p, heap=%p, count=%d, (fd=%d, base=%p, size=%zu)", 495 mHeapCache.keyAt(i).unsafe_get(), 496 info.heap.get(), info.count, 497 h->mHeapId.load(memory_order_relaxed), h->mBase, h->mSize); 498 } 499} 500 501 502// --------------------------------------------------------------------------- 503}; // namespace android 504