1/*
2 * Copyright (C) 2008 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#define LOG_TAG "IMemory"
18
19#include <atomic>
20#include <stdatomic.h>
21
22#include <fcntl.h>
23#include <stdint.h>
24#include <stdio.h>
25#include <stdlib.h>
26#include <sys/types.h>
27#include <sys/mman.h>
28#include <unistd.h>
29
30#include <binder/IMemory.h>
31#include <binder/Parcel.h>
32#include <log/log.h>
33
34#include <utils/CallStack.h>
35#include <utils/KeyedVector.h>
36#include <utils/threads.h>
37
38#define VERBOSE   0
39
40namespace android {
41// ---------------------------------------------------------------------------
42
43class HeapCache : public IBinder::DeathRecipient
44{
45public:
46    HeapCache();
47    virtual ~HeapCache();
48
49    virtual void binderDied(const wp<IBinder>& who);
50
51    sp<IMemoryHeap> find_heap(const sp<IBinder>& binder);
52    void free_heap(const sp<IBinder>& binder);
53    sp<IMemoryHeap> get_heap(const sp<IBinder>& binder);
54    void dump_heaps();
55
56private:
57    // For IMemory.cpp
58    struct heap_info_t {
59        sp<IMemoryHeap> heap;
60        int32_t         count;
61        // Note that this cannot be meaningfully copied.
62    };
63
64    void free_heap(const wp<IBinder>& binder);
65
66    Mutex mHeapCacheLock;  // Protects entire vector below.
67    KeyedVector< wp<IBinder>, heap_info_t > mHeapCache;
68    // We do not use the copy-on-write capabilities of KeyedVector.
69    // TODO: Reimplemement based on standard C++ container?
70};
71
72static sp<HeapCache> gHeapCache = new HeapCache();
73
74/******************************************************************************/
75
76enum {
77    HEAP_ID = IBinder::FIRST_CALL_TRANSACTION
78};
79
80class BpMemoryHeap : public BpInterface<IMemoryHeap>
81{
82public:
83    explicit BpMemoryHeap(const sp<IBinder>& impl);
84    virtual ~BpMemoryHeap();
85
86    virtual int getHeapID() const;
87    virtual void* getBase() const;
88    virtual size_t getSize() const;
89    virtual uint32_t getFlags() const;
90    virtual uint32_t getOffset() const;
91
92private:
93    friend class IMemory;
94    friend class HeapCache;
95
96    // for debugging in this module
97    static inline sp<IMemoryHeap> find_heap(const sp<IBinder>& binder) {
98        return gHeapCache->find_heap(binder);
99    }
100    static inline void free_heap(const sp<IBinder>& binder) {
101        gHeapCache->free_heap(binder);
102    }
103    static inline sp<IMemoryHeap> get_heap(const sp<IBinder>& binder) {
104        return gHeapCache->get_heap(binder);
105    }
106    static inline void dump_heaps() {
107        gHeapCache->dump_heaps();
108    }
109
110    void assertMapped() const;
111    void assertReallyMapped() const;
112
113    mutable std::atomic<int32_t> mHeapId;
114    mutable void*       mBase;
115    mutable size_t      mSize;
116    mutable uint32_t    mFlags;
117    mutable uint32_t    mOffset;
118    mutable bool        mRealHeap;
119    mutable Mutex       mLock;
120};
121
122// ----------------------------------------------------------------------------
123
124enum {
125    GET_MEMORY = IBinder::FIRST_CALL_TRANSACTION
126};
127
128class BpMemory : public BpInterface<IMemory>
129{
130public:
131    explicit BpMemory(const sp<IBinder>& impl);
132    virtual ~BpMemory();
133    virtual sp<IMemoryHeap> getMemory(ssize_t* offset=0, size_t* size=0) const;
134
135private:
136    mutable sp<IMemoryHeap> mHeap;
137    mutable ssize_t mOffset;
138    mutable size_t mSize;
139};
140
141/******************************************************************************/
142
143void* IMemory::fastPointer(const sp<IBinder>& binder, ssize_t offset) const
144{
145    sp<IMemoryHeap> realHeap = BpMemoryHeap::get_heap(binder);
146    void* const base = realHeap->base();
147    if (base == MAP_FAILED)
148        return 0;
149    return static_cast<char*>(base) + offset;
150}
151
152void* IMemory::pointer() const {
153    ssize_t offset;
154    sp<IMemoryHeap> heap = getMemory(&offset);
155    void* const base = heap!=0 ? heap->base() : MAP_FAILED;
156    if (base == MAP_FAILED)
157        return 0;
158    return static_cast<char*>(base) + offset;
159}
160
161size_t IMemory::size() const {
162    size_t size;
163    getMemory(NULL, &size);
164    return size;
165}
166
167ssize_t IMemory::offset() const {
168    ssize_t offset;
169    getMemory(&offset);
170    return offset;
171}
172
173/******************************************************************************/
174
175BpMemory::BpMemory(const sp<IBinder>& impl)
176    : BpInterface<IMemory>(impl), mOffset(0), mSize(0)
177{
178}
179
180BpMemory::~BpMemory()
181{
182}
183
184sp<IMemoryHeap> BpMemory::getMemory(ssize_t* offset, size_t* size) const
185{
186    if (mHeap == 0) {
187        Parcel data, reply;
188        data.writeInterfaceToken(IMemory::getInterfaceDescriptor());
189        if (remote()->transact(GET_MEMORY, data, &reply) == NO_ERROR) {
190            sp<IBinder> heap = reply.readStrongBinder();
191            ssize_t o = reply.readInt32();
192            size_t s = reply.readInt32();
193            if (heap != 0) {
194                mHeap = interface_cast<IMemoryHeap>(heap);
195                if (mHeap != 0) {
196                    size_t heapSize = mHeap->getSize();
197                    if (s <= heapSize
198                            && o >= 0
199                            && (static_cast<size_t>(o) <= heapSize - s)) {
200                        mOffset = o;
201                        mSize = s;
202                    } else {
203                        // Hm.
204                        android_errorWriteWithInfoLog(0x534e4554,
205                            "26877992", -1, NULL, 0);
206                        mOffset = 0;
207                        mSize = 0;
208                    }
209                }
210            }
211        }
212    }
213    if (offset) *offset = mOffset;
214    if (size) *size = mSize;
215    return (mSize > 0) ? mHeap : 0;
216}
217
218// ---------------------------------------------------------------------------
219
220IMPLEMENT_META_INTERFACE(Memory, "android.utils.IMemory");
221
222BnMemory::BnMemory() {
223}
224
225BnMemory::~BnMemory() {
226}
227
228status_t BnMemory::onTransact(
229    uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
230{
231    switch(code) {
232        case GET_MEMORY: {
233            CHECK_INTERFACE(IMemory, data, reply);
234            ssize_t offset;
235            size_t size;
236            reply->writeStrongBinder( IInterface::asBinder(getMemory(&offset, &size)) );
237            reply->writeInt32(offset);
238            reply->writeInt32(size);
239            return NO_ERROR;
240        } break;
241        default:
242            return BBinder::onTransact(code, data, reply, flags);
243    }
244}
245
246
247/******************************************************************************/
248
249BpMemoryHeap::BpMemoryHeap(const sp<IBinder>& impl)
250    : BpInterface<IMemoryHeap>(impl),
251        mHeapId(-1), mBase(MAP_FAILED), mSize(0), mFlags(0), mOffset(0), mRealHeap(false)
252{
253}
254
255BpMemoryHeap::~BpMemoryHeap() {
256    int32_t heapId = mHeapId.load(memory_order_relaxed);
257    if (heapId != -1) {
258        close(heapId);
259        if (mRealHeap) {
260            // by construction we're the last one
261            if (mBase != MAP_FAILED) {
262                sp<IBinder> binder = IInterface::asBinder(this);
263
264                if (VERBOSE) {
265                    ALOGD("UNMAPPING binder=%p, heap=%p, size=%zu, fd=%d",
266                            binder.get(), this, mSize, heapId);
267                    CallStack stack(LOG_TAG);
268                }
269
270                munmap(mBase, mSize);
271            }
272        } else {
273            // remove from list only if it was mapped before
274            sp<IBinder> binder = IInterface::asBinder(this);
275            free_heap(binder);
276        }
277    }
278}
279
280void BpMemoryHeap::assertMapped() const
281{
282    int32_t heapId = mHeapId.load(memory_order_acquire);
283    if (heapId == -1) {
284        sp<IBinder> binder(IInterface::asBinder(const_cast<BpMemoryHeap*>(this)));
285        sp<BpMemoryHeap> heap(static_cast<BpMemoryHeap*>(find_heap(binder).get()));
286        heap->assertReallyMapped();
287        if (heap->mBase != MAP_FAILED) {
288            Mutex::Autolock _l(mLock);
289            if (mHeapId.load(memory_order_relaxed) == -1) {
290                mBase   = heap->mBase;
291                mSize   = heap->mSize;
292                mOffset = heap->mOffset;
293                int fd = fcntl(heap->mHeapId.load(memory_order_relaxed), F_DUPFD_CLOEXEC, 0);
294                ALOGE_IF(fd==-1, "cannot dup fd=%d",
295                        heap->mHeapId.load(memory_order_relaxed));
296                mHeapId.store(fd, memory_order_release);
297            }
298        } else {
299            // something went wrong
300            free_heap(binder);
301        }
302    }
303}
304
305void BpMemoryHeap::assertReallyMapped() const
306{
307    int32_t heapId = mHeapId.load(memory_order_acquire);
308    if (heapId == -1) {
309
310        // remote call without mLock held, worse case scenario, we end up
311        // calling transact() from multiple threads, but that's not a problem,
312        // only mmap below must be in the critical section.
313
314        Parcel data, reply;
315        data.writeInterfaceToken(IMemoryHeap::getInterfaceDescriptor());
316        status_t err = remote()->transact(HEAP_ID, data, &reply);
317        int parcel_fd = reply.readFileDescriptor();
318        ssize_t size = reply.readInt32();
319        uint32_t flags = reply.readInt32();
320        uint32_t offset = reply.readInt32();
321
322        ALOGE_IF(err, "binder=%p transaction failed fd=%d, size=%zd, err=%d (%s)",
323                IInterface::asBinder(this).get(),
324                parcel_fd, size, err, strerror(-err));
325
326        Mutex::Autolock _l(mLock);
327        if (mHeapId.load(memory_order_relaxed) == -1) {
328            int fd = fcntl(parcel_fd, F_DUPFD_CLOEXEC, 0);
329            ALOGE_IF(fd==-1, "cannot dup fd=%d, size=%zd, err=%d (%s)",
330                    parcel_fd, size, err, strerror(errno));
331
332            int access = PROT_READ;
333            if (!(flags & READ_ONLY)) {
334                access |= PROT_WRITE;
335            }
336            mRealHeap = true;
337            mBase = mmap(0, size, access, MAP_SHARED, fd, offset);
338            if (mBase == MAP_FAILED) {
339                ALOGE("cannot map BpMemoryHeap (binder=%p), size=%zd, fd=%d (%s)",
340                        IInterface::asBinder(this).get(), size, fd, strerror(errno));
341                close(fd);
342            } else {
343                mSize = size;
344                mFlags = flags;
345                mOffset = offset;
346                mHeapId.store(fd, memory_order_release);
347            }
348        }
349    }
350}
351
352int BpMemoryHeap::getHeapID() const {
353    assertMapped();
354    // We either stored mHeapId ourselves, or loaded it with acquire semantics.
355    return mHeapId.load(memory_order_relaxed);
356}
357
358void* BpMemoryHeap::getBase() const {
359    assertMapped();
360    return mBase;
361}
362
363size_t BpMemoryHeap::getSize() const {
364    assertMapped();
365    return mSize;
366}
367
368uint32_t BpMemoryHeap::getFlags() const {
369    assertMapped();
370    return mFlags;
371}
372
373uint32_t BpMemoryHeap::getOffset() const {
374    assertMapped();
375    return mOffset;
376}
377
378// ---------------------------------------------------------------------------
379
380IMPLEMENT_META_INTERFACE(MemoryHeap, "android.utils.IMemoryHeap");
381
382BnMemoryHeap::BnMemoryHeap() {
383}
384
385BnMemoryHeap::~BnMemoryHeap() {
386}
387
388status_t BnMemoryHeap::onTransact(
389        uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
390{
391    switch(code) {
392       case HEAP_ID: {
393            CHECK_INTERFACE(IMemoryHeap, data, reply);
394            reply->writeFileDescriptor(getHeapID());
395            reply->writeInt32(getSize());
396            reply->writeInt32(getFlags());
397            reply->writeInt32(getOffset());
398            return NO_ERROR;
399        } break;
400        default:
401            return BBinder::onTransact(code, data, reply, flags);
402    }
403}
404
405/*****************************************************************************/
406
407HeapCache::HeapCache()
408    : DeathRecipient()
409{
410}
411
412HeapCache::~HeapCache()
413{
414}
415
416void HeapCache::binderDied(const wp<IBinder>& binder)
417{
418    //ALOGD("binderDied binder=%p", binder.unsafe_get());
419    free_heap(binder);
420}
421
422sp<IMemoryHeap> HeapCache::find_heap(const sp<IBinder>& binder)
423{
424    Mutex::Autolock _l(mHeapCacheLock);
425    ssize_t i = mHeapCache.indexOfKey(binder);
426    if (i>=0) {
427        heap_info_t& info = mHeapCache.editValueAt(i);
428        ALOGD_IF(VERBOSE,
429                "found binder=%p, heap=%p, size=%zu, fd=%d, count=%d",
430                binder.get(), info.heap.get(),
431                static_cast<BpMemoryHeap*>(info.heap.get())->mSize,
432                static_cast<BpMemoryHeap*>(info.heap.get())
433                    ->mHeapId.load(memory_order_relaxed),
434                info.count);
435        ++info.count;
436        return info.heap;
437    } else {
438        heap_info_t info;
439        info.heap = interface_cast<IMemoryHeap>(binder);
440        info.count = 1;
441        //ALOGD("adding binder=%p, heap=%p, count=%d",
442        //      binder.get(), info.heap.get(), info.count);
443        mHeapCache.add(binder, info);
444        return info.heap;
445    }
446}
447
448void HeapCache::free_heap(const sp<IBinder>& binder)  {
449    free_heap( wp<IBinder>(binder) );
450}
451
452void HeapCache::free_heap(const wp<IBinder>& binder)
453{
454    sp<IMemoryHeap> rel;
455    {
456        Mutex::Autolock _l(mHeapCacheLock);
457        ssize_t i = mHeapCache.indexOfKey(binder);
458        if (i>=0) {
459            heap_info_t& info(mHeapCache.editValueAt(i));
460            if (--info.count == 0) {
461                ALOGD_IF(VERBOSE,
462                        "removing binder=%p, heap=%p, size=%zu, fd=%d, count=%d",
463                        binder.unsafe_get(), info.heap.get(),
464                        static_cast<BpMemoryHeap*>(info.heap.get())->mSize,
465                        static_cast<BpMemoryHeap*>(info.heap.get())
466                            ->mHeapId.load(memory_order_relaxed),
467                        info.count);
468                rel = mHeapCache.valueAt(i).heap;
469                mHeapCache.removeItemsAt(i);
470            }
471        } else {
472            ALOGE("free_heap binder=%p not found!!!", binder.unsafe_get());
473        }
474    }
475}
476
477sp<IMemoryHeap> HeapCache::get_heap(const sp<IBinder>& binder)
478{
479    sp<IMemoryHeap> realHeap;
480    Mutex::Autolock _l(mHeapCacheLock);
481    ssize_t i = mHeapCache.indexOfKey(binder);
482    if (i>=0)   realHeap = mHeapCache.valueAt(i).heap;
483    else        realHeap = interface_cast<IMemoryHeap>(binder);
484    return realHeap;
485}
486
487void HeapCache::dump_heaps()
488{
489    Mutex::Autolock _l(mHeapCacheLock);
490    int c = mHeapCache.size();
491    for (int i=0 ; i<c ; i++) {
492        const heap_info_t& info = mHeapCache.valueAt(i);
493        BpMemoryHeap const* h(static_cast<BpMemoryHeap const *>(info.heap.get()));
494        ALOGD("hey=%p, heap=%p, count=%d, (fd=%d, base=%p, size=%zu)",
495                mHeapCache.keyAt(i).unsafe_get(),
496                info.heap.get(), info.count,
497                h->mHeapId.load(memory_order_relaxed), h->mBase, h->mSize);
498    }
499}
500
501
502// ---------------------------------------------------------------------------
503}; // namespace android
504