History log of /frameworks/native/libs/binder/IPCThreadState.cpp
Revision Date Author Comments (<<< Hide modified files) (Show modified files >>>)
7c170bb1b1abf5a055ad8137e8531b5bcd0eb5ce 05-May-2018 Martijn Coenen <maco@google.com> Create temp refs on proxies.

Fixes the following scenario:
1) Thread T1 receives a binder proxy and adds a local strong/weak ref
2) Thread T1 queues BC_ACQUIRE/BC_INCREFS (but does not flush)
3) Thread T1 hands the binder proxy off to another thread T2, which
adds another strong ref
4) Thread T1 now drops its own ref to the proxy, but it doesn't get
destructed because T2 has its own ref to it
6) Thread T2 runs and drops its own ref to the proxy, which causes a
BC_RELEASE/BC_DECREFS to be queued to the driver.

Now, if T1 writes its command queue to the driver first, everything
is fine, because a BC_ACQUIRE/BC_INCREFS will be followed by a
BC_RELEASE/BC_DECREFS. However if T2 writes its command queue first,
BC_RELEASE/BC_DECREFS will be sent first, and the driver will delete
the reference prematurely.

Fix this by temporarily holding a weak/strong ref until the initial
BC_ACUIRE/BC_INCREFS is flushed to the driver.

Bug: 78437964
Test: sailfish builds, boots, no invalid ref messages on dumpsys
Change-Id: Ica5efaf9fa2785423c37abb1456575d97f1cd85f
/frameworks/native/libs/binder/IPCThreadState.cpp
ea0090a0392db2f3b7b047647d48b01885722cda 02-Nov-2017 Martijn Coenen <maco@google.com> Revert "binder: send BC_REPLY and BC_FREE_BUFFER together"

This reverts commit 0494d6ab6f4b85eb28eeb71737398ba0b862a822.

Change-Id: I115dd7cd3e11bb573e17b3859133e0cad1afef49
/frameworks/native/libs/binder/IPCThreadState.cpp
0494d6ab6f4b85eb28eeb71737398ba0b862a822 02-Nov-2017 Ganesh Mahendran <opensource.ganesh@gmail.com> binder: send BC_REPLY and BC_FREE_BUFFER together

In current BR_TRANSACTION handling logic, BC_REPLY and BC_FREE_BUFFER
are sent to kernel seperately which may introduce latency for freeing
buffer.

I think it's better to free buffer asap, this change fixes this
by putting BC_REPLY and BC_FREE_BUFFER in the same buffer. And then
call waitForResponse() to send them to kernel together.

After this, function sendReply() will not be called by anyone. So
sendReply() is also removed.

Below is the test result of "binderThroughputTest -w 100"
Env: android 7.1.2, 2G ram
---------------------
---> base:
iterations per sec: 31917.7
collecting results
average:2.83375ms worst:572.205ms best:0.054219ms
50%: 2.14844 90%: 5.27344 95%: 6.83594 99%: 12.3047

iterations per sec: 32142.3
collecting results
average:2.8186ms worst:550.884ms best:0.054948ms
50%: 2.53906 90%: 5.27344 95%: 6.83594 99%: 11.1328

iterations per sec: 31704.5
collecting results
average:2.85129ms worst:600.984ms best:0.053854ms
50%: 2.53906 90%: 5.27344 95%: 6.83594 99%: 12.3047

iterations per sec: 31932.3
collecting results
average:2.82549ms worst:563.098ms best:0.052396ms
50%: 2.53906 90%: 5.66406 95%: 6.83594 99%: 11.1328

---> patched:
iterations per sec: 32062.5
collecting results
average:2.85475ms worst:599.177ms best:0.054895ms
50%: 2.14844 90%: 5.27344 95%: 6.44531 99%: 12.6953

iterations per sec: 32241.7
collecting results
average:2.82851ms worst:634.984ms best:0.05651ms
50%: 2.53906 90%: 5.66406 95%: 6.83594 99%: 10.7422

iterations per sec: 31939
collecting results
average:2.86589ms worst:628.861ms best:0.058645ms
50%: 2.53906 90%: 5.66406 95%: 6.83594 99%: 11.1328

iterations per sec: 32149.4
collecting results
average:2.80785ms worst:658.889ms best:0.055573ms
50%: 2.53906 90%: 5.66406 95%: 6.83594 99%: 10.7422

It seems patched is better.

Change-Id: I0ef88864f4dbc63f3cdd2eba345b5dce6140b2d3
Suggested-by: Martijn Coenen <maco@google.com>
Signed-off-by: Ganesh Mahendran <opensource.ganesh@gmail.com>
/frameworks/native/libs/binder/IPCThreadState.cpp
58e5daaed8b446bdcf937a5eb368d6623d33f423 11-Oct-2017 Ganesh Mahendran <opensource.ganesh@gmail.com> binder: remove unnecessary err check

In function IPCThreadState::transact(), data.errorCheck() will
be executed twice. Since IPCThreadState::transact() is the
critical path for binder call, it is better to do data.errorCheck()
once.

This patch removes the first check at the beginning of
IPCThreadState::transact(), the effect of this change is that LOG_ONEWAY(...)
will be executed in error case("data.errorCheck() != NO_ERROR")

I think this is not a problem. As "data.errorCheck() == NO_ERROR" is the
normal case(which will execute LOG_ONEWAY()), and even in error case,
we print a log about src/dst pid is not a bad idea.

Change-Id: I7b892a2294774c55ce0df56edee6a820f82c6f13
Signed-off-by: Ganesh Mahendran <opensource.ganesh@gmail.com>
/frameworks/native/libs/binder/IPCThreadState.cpp
9cec85be1921a74e19cadd8b9b5a563eec6f82a5 20-Sep-2017 Manoj Gupta <manojgupta@google.com> Silence a false positive memory leak warning.

This silences a false positive memory leak warning:

frameworks/native/libs/binder/IPCThreadState.cpp:689:5: warning: Potential
memory leak [clang-analyzer-cplusplus.NewDeleteLeaks]

Bug: b/27101951
Test: The warning is gone.
Change-Id: I2d7bbb943521df86debb3a0e1b4b7457fa847098
/frameworks/native/libs/binder/IPCThreadState.cpp
3c4f8434fa5f719e465c88b23a0cc6cb7697e0ea 15-Aug-2017 Martijn Coenen <maco@google.com> Merge "Don't lose BR_RELEASE/BR_DECREFS commands."
am: 372bccede8

Change-Id: Ib3c41153b1c5640f9b9e938c1b4872d2fa441e9c
0791fbf85aef8f40cee0821223c46afddd3fa464 08-Aug-2017 Martijn Coenen <maco@google.com> Don't lose BR_RELEASE/BR_DECREFS commands.

BR_RELEASE/BR_DECREFS commands are stored in mPendingStrongDerefs
and mPendingWeakDerefs, respectively. During processPendingDerefs(),
we actually execute the corresponding decStrong()/decWeak() operations.

The problem is that when we're done, we clear() the mPending vectors
without checking if new entries have been added to them. This can
happen, because decStrong()/decWeak() might cause destructors to run,
which in turn can invoke outgoing transactions that may result in
a BR_RELEASE/BR_DECREFS being queued.

Bug: 63079216
Test: binderLibTest
Change-Id: Ib1deca3f317f8b5068b4b9eddfc4219b9ec87740
/frameworks/native/libs/binder/IPCThreadState.cpp
2b6317436d2035ce98331906aaaca87e6026c9c8 05-May-2017 Martijn Coenen <maco@google.com> Correctly set minimum priority on nodes.

It looks like libbinder has always set the minimum priority
for a node to 0x7f (127). This is an invalid value as far
as the kernel is concerned, since the current driver only
accepts positive nice values (0..19). The effect of using
0xf7 is that the nice value was clamped to MAX_NICE (19) -
so effectively the kernel never raised the priority
based on the min_priority setting of a node. Correct this
by just using MAX_NICE directly.

Additionally, a recent change removed the use of the
gDisableBackgroundScheduling flag, which system_server
used to make sure that incoming transactions were not
executed at a lower priority. That behavior is actually
still desired, so this change sets the min_priorirty
value to 0 for processes that have requested background
scheduling to be disabled. The effect of that is that
all transactions into those nodes will be executed with
a priority of at least nice 0 (and potentially higher,
depending on the priority of the caller).

Bug: 37677242
Test: verified /d/binder output
Change-Id: I7cbfd309d04cbd052f868fbfe0930529ff21a48a
/frameworks/native/libs/binder/IPCThreadState.cpp
d429f4a2d5cf2db093bb0e35cb651d764d1973c8 07-Mar-2017 Tim Murray <timmurray@google.com> binder: remove cgroup interactions

Having binder change cgroups on the fly is too expensive in the common case to be useful.

Test: builds

bug 34825105

Change-Id: Ia692c9d2ab261d852cb2fac8f27d6779d0e2b057
/frameworks/native/libs/binder/IPCThreadState.cpp
a43ee156098776698a39882bb00ecebc555948d0 25-Oct-2016 liangweikang <liangweikang900911@gmail.com> binder: print the bad cmd error to android log

https://code.google.com/p/android/issues/detail?id=226068

Signed-off-by: liangweikang <liangweikang900911@gmail.com>
/frameworks/native/libs/binder/IPCThreadState.cpp
73a7dde7c3e5c8437f396deeb200f250b3346be7 18-Oct-2016 songjinshi <songjinshi@xiaomi.com> [binder]: Correct the index for getReturnString

The cmd code can not as the index drectly.

Change-Id: Icddad46faef7a77acbd7edf118c081ac10501f47
Signed-off-by: songjinshi <songjinshi@xiaomi.com>
/frameworks/native/libs/binder/IPCThreadState.cpp
c734143ca5bf7acfea782b79cfd6700af206a9ca 19-Oct-2016 Wei Wang <wvw@google.com> Fix log function for potential overflow

On LP64 system, unsigned long can be 64bit
Also clean out unused static variables.

Test: flash on ARM64 device
Bug: 32181382
Change-Id: I44b7ea8a6588c475a3979d7bddeb08da7f54c27a
/frameworks/native/libs/binder/IPCThreadState.cpp
249f373defa993eb9c8358e4d2e0b620f2c10d57 16-Apr-2016 Colin Cross <ccross@android.com> Merge "Log when binder thread pool is starved" into nyc-dev
am: 43dcac7

* commit '43dcac7500833c465c417805adc4693c60c3bb5e':
Log when binder thread pool is starved

Change-Id: I420d31273aec69eab9d8e4faa10001ef48b17aa8
96e8322f4d11af8538d6d0db5f1a11338b8aee9d 15-Apr-2016 Colin Cross <ccross@android.com> Log when binder thread pool is starved

Log when the number of threads executing binder commands is equal to the
maximium size of the thread pool for >100ms.

Bug: 28201939
Change-Id: I892863d8a81c06e362d4ae18ab08485fdec3c0bb
/frameworks/native/libs/binder/IPCThreadState.cpp
7f0c6d6e19565e512fc42c2371bc99f4c5e3fe70 21-Mar-2016 Dianne Hackborn <hackbod@google.com> Merge "Fix issue #27252896: Security Vulnerability -- weak binder" into nyc-dev
am: b49576d

* commit 'b49576d5241859a3cf03c9f34b8030ad25d3806b':
Fix issue #27252896: Security Vulnerability -- weak binder
c11146106f94e07016e8e26e4f8628f9a0c73199 21-Mar-2016 Dianne Hackborn <hackbod@google.com> Fix issue #27252896: Security Vulnerability -- weak binder

Sending transaction to freed BBinder through weak handle
can cause use of a (mostly) freed object. We need to try to
safely promote to a strong reference first.

Change-Id: Ic9c6940fa824980472e94ed2dfeca52a6b0fd342
/frameworks/native/libs/binder/IPCThreadState.cpp
ff405785386ed8bdee50c4afdc4a4f9a73bcb81e 09-Mar-2016 zhongjie <zhongjie.shi@intel.com> Release resources when repeating dlopen-dlcose.

When the libbinder.so is dlopen and dlclose many
times, we need to delete the pthread_key and
munmap the memory mapping.

Otherwise, it will crash as the leakage causes
the pthread_key or memory mapping surpass their
limit.

Change-Id: Ice64d4ef685c1f665350286f9e5ddf790beac236
Signed-off-by: zhongjie <zhongjie.shi@intel.com>
/frameworks/native/libs/binder/IPCThreadState.cpp
f31a3eb3290c4154bd04113c8bb859a499f288b6 01-Feb-2016 Andreas Gampe <agampe@google.com> Binder: Add log output in IPCThreadState::self()

In the failure case, and on shutdown, add log output. It's highly
likely the client will crash when a null value is returned. Displaying
a possible root cause helps diagnosing issues.

Bug: 26865304
Change-Id: Ie5255ac50d6dcdf9f918dcef785788ea795a4791
/frameworks/native/libs/binder/IPCThreadState.cpp
30dddd6f49b04ac5160c1de702cafe09b42ce1d1 13-Aug-2015 Elliott Hughes <enh@google.com> am 6a846dd5: am 5f5a0e0f: Merge "Lose HAVE_ANDROID_OS from frameworks/native."

* commit '6a846dd51885df861f4e1e30fcca86b9dd2f4092':
Lose HAVE_ANDROID_OS from frameworks/native.
6071da7ef84c60645572654504813d492b8b21d5 13-Aug-2015 Elliott Hughes <enh@google.com> Lose HAVE_ANDROID_OS from frameworks/native.

Change-Id: I8e6af2a46a9d875192fc7957ada9b5f66d84bad6
/frameworks/native/libs/binder/IPCThreadState.cpp
a3206e690bcfe5c982a0d7fff7c845b83a3ed91f 21-Apr-2015 Wale Ogunwale <ogunwale@google.com> Fixed build error with clang/llvm.

Change-Id: Ideacdc974ebad542df724464ccba9fcfb2b7ea91
/frameworks/native/libs/binder/IPCThreadState.cpp
376b822728c582a9deb26ce339deb5204ae4d22e 14-Apr-2015 Wale Ogunwale <ogunwale@google.com> Added IPCThreadState::blockUntilThreadAvailable() method.

Will be used by the system_server watchdog to monitor the
availability of binder threads in the process to handle
incoming IPC requests.

Bug: 19297165
Change-Id: I39175f3869ad14da5620fddb47f454e6e4ee2b25
/frameworks/native/libs/binder/IPCThreadState.cpp
8fb2d25ff3e9ade7c03ebe52a89c671ee75ce484 27-Jan-2015 Yabin Cui <yabinc@google.com> Kill HAVE_PTHREADS.

Bug: 19083585
Change-Id: I355491de945590f43c82bdcb7968b01b4bff6e06
/frameworks/native/libs/binder/IPCThreadState.cpp
9c634fd2d13722106d475b000b05babcce1f65be 26-Nov-2014 Dan Stoza <stoza@google.com> binder: Return pid_t/uid_t instead of int

Makes IPCThreadState::getCalling{Pid,Uid} return a more
appropriate type.

Change-Id: I97f8a83c1c0722bc1afbf8a6df1a288f8f1f0d2c
/frameworks/native/libs/binder/IPCThreadState.cpp
74debb0b8fc47d443aaf7fe79f7b67f53f735f7f 25-Nov-2014 Bernhard Rosenkränzer <Bernhard.Rosenkranzer@linaro.org> Fix build with clang in C++11 mode

Now that we're in C++11 mode by default, clang complains about switch
statements with case values not matching the type -- since some
binder_driver_return_protocol values are > 0x7fffffff, we need to make
the switch statements operate on uint32_t rather than int32_t.

BUG: 18466763
Change-Id: Iedbfd5c7a3d3d9f087d2eab4ff21343ad7a2a448
Signed-off-by: Bernhard Rosenkränzer <Bernhard.Rosenkranzer@linaro.org>
/frameworks/native/libs/binder/IPCThreadState.cpp
0b53b5c0b34ff0e14e05e7a4613c7364136f47a5 24-Nov-2014 Andreas Gampe <agampe@google.com> Binder: Remove unused functions & variables

For build-system CFLAGS clean-up, remove unused functions and
variables.

Change-Id: I88abc2bc99e6b91c7aa56470ff9671bf8bf29f8d
/frameworks/native/libs/binder/IPCThreadState.cpp
ac5cd96fe24690d9e0ae823c77334b8579139aa2 04-Nov-2014 Chih-Hung Hsieh <chh@google.com> am dbab409c: Merge "Avoid two warnings from clang."

* commit 'dbab409c49ca5dd6686912d0b3eeb19ef1c37a3e':
Avoid two warnings from clang.
8e5337de2c67c24f1e5c6144512e2a9ba9fefe12 24-Oct-2014 Chih-Hung Hsieh <chh@google.com> Avoid two warnings from clang.

Clang compiler warns about undefined static functions like getReturnString
before all references are removed inside IF_LOG_COMMANDS.
To remove such warnings, we can leave those static functions defined
and the compiler will remove them at the end when they are not used.

Add a cast to long before converting from int to void*,
to avoid type cast warnings on 64 bit targets.

BUG: 17043248
Change-Id: Ica31101522279d2c8eacc90e2939767002fb827b
/frameworks/native/libs/binder/IPCThreadState.cpp
e4499526eee52a6584aba9382783e9fba327a9bc 30-Sep-2014 Dianne Hackborn <hackbod@google.com> am 5ee2c9d2: Work on issue #17656716: Unhandled exception in Window Manager

* commit '5ee2c9d20c0fbecf6b4a482eb8d8bfdf85d0d424':
Work on issue #17656716: Unhandled exception in Window Manager
5ee2c9d20c0fbecf6b4a482eb8d8bfdf85d0d424 30-Sep-2014 Dianne Hackborn <hackbod@google.com> Work on issue #17656716: Unhandled exception in Window Manager

Try to clean up the code paths coming in and out of binder IPCs to
plug any places where we could disrupt the gather flag of a thread,
causing it to keep gathering stack crawls (which is the thing that
is causing our strict mode data to become so large).

We now take care of saving and restoring this state in the core
IPC code path, not at the Java layer.

Change-Id: I73d564778da127bdce00f304225930e7f2318293
/frameworks/native/libs/binder/IPCThreadState.cpp
fa6ad07c4ed44244f5220a422819919bc37528ba 18-Aug-2014 Elliott Hughes <enh@google.com> Use gettid directly in binder.

Bug: 17048545
Change-Id: I1df378135961e085a52f6cc5694ad74cd73aac19
/frameworks/native/libs/binder/IPCThreadState.cpp
317ff37cf79d31170fa7320f0ba5ded1ec043e4c 29-May-2014 Mark Salyzyn <salyzyn@google.com> binder: rm utils/Debug.h

Change-Id: I16931919a26c16a0d701771c93fa7fe1c6f60ef8
/frameworks/native/libs/binder/IPCThreadState.cpp
07fd0f195db6d341cab4e54257f508d802c98832 19-Feb-2014 Arve Hjønnevåg <arve@android.com> Binder: Fix some valgrind errors.

When using 64 bit binder pointers, only initializing the 32 bit
handle, in a stack allocated struct, will pass uninitialized stack
data to the kernel and other processes.

Change-Id: I3432d9d36bb251d8ddb0a863661aeb80aabb3d92
/frameworks/native/libs/binder/IPCThreadState.cpp
87b30d0447829167b2d83f4f61f702638d937524 19-Feb-2014 Arve Hjønnevåg <arve@android.com> Binder: Don't cast directly from a pointer to binder_uintptr_t

When using the 64 bit binder interface from a 32 bit process the
pointer may get sign extended and cause the kernel to fail to read
from it.

Change-Id: I90fcf53880e2aa92e230a9723f9b3f7696170e32
/frameworks/native/libs/binder/IPCThreadState.cpp
11cfdccfd3cfceb08732909a1489419ff0229694 15-Feb-2014 Arve Hjønnevåg <arve@android.com> Binder: Disable attemptIncStrongHandle

The driver does not support BC_ATTEMPT_ACQUIRE and will return an error.
IPCThreadState does not handle driver errors, and will resend the failed
command blocking all other commands.

Change-Id: I643986037341821b27b62dc82df933844f4842b8
/frameworks/native/libs/binder/IPCThreadState.cpp
6f4f3ab36c5ed1df84eb3a9f7475f0ac42952f58 06-Feb-2014 Colin Cross <ccross@android.com> binder: fix all warnings

Fix warnings related to casting pointers to ints, using %d or %ld to
print size_t/ssize_t, and unused parameters.

Change-Id: I7a13ba83d402952989c1f795cd9e880a95b98d9e
/frameworks/native/libs/binder/IPCThreadState.cpp
84e625ac1e01f5a9c3ed16664da6498212ed662b 29-Jan-2014 Arve Hjønnevåg <arve@android.com> Binder: Use 64 bit pointers in 32 processes if selected by the target

Uses new kernel header where void * has been replaced by binder_uintptr_t

Change-Id: Icfc67c2a279269f700343bd9246fd7cb94efe2c1
/frameworks/native/libs/binder/IPCThreadState.cpp
f683e0163a84d93448b9388126902242367cd961 05-Nov-2013 Serban Constantinescu <serban.constantinescu@arm.com> Binder: Make binder portable

Changes include
- Binder attempts to cast pointers to a int datatype
which is not sufficient on a 64-bit platform.

- This patch introduces new read/write functions into
Parcel that allow pointers to be written using the
uintptr_t datatype for compile-time data type size
selection.

- Change access specifier for the methods above.

- Binder uses the 64bit android_atomic_release_cas64
(aka cmpxchg)

Change-Id: I595280541e0ba1d19c94b2ca2127bf9d96efabf1
Signed-off-by: Matthew Leach <matthew.leach@arm.com>
Signed-off-by: Serban Constantinescu <serban.constantinescu@arm.com>
/frameworks/native/libs/binder/IPCThreadState.cpp
ada11c5e67cf8587ad3b53dd99c27455ef26291f 13-Jul-2013 Jeff Brown <jeffbrown@google.com> Make getCallingUid/Pid const.

Change-Id: I1853b21eaa45d85274189dfd72f73fec48d0d6b7
/frameworks/native/libs/binder/IPCThreadState.cpp
8d96cab8bfc1b40a8e05c6f43b485750a5ae0a52 26-Jun-2013 Todd Poynor <toddpoynor@google.com> binder: add polling / single-threaded operation

This is currently safe to do only for processes that disallow any binder
threads to be created: setThreadPoolMaxThreadCount(0).

Change-Id: I8a27f3cf26f4d51edb7f222af487ac256cbcab65
/frameworks/native/libs/binder/IPCThreadState.cpp
fc1f308ca1d679f9e9823a848e6396a23513f2fb 12-Jun-2013 Jeff Tinker <jtinker@google.com> am de836890: am ef07386e: Prevent IPCThreadState::joinThreadPool from spinning on unexpected error

* commit 'de836890abc7b5381e285833052375cbb85730cb':
Prevent IPCThreadState::joinThreadPool from spinning on unexpected error
ef07386e2fca73680214ececc3c9c0ecbb0f6d88 11-Jun-2013 Jeff Tinker <jtinker@google.com> Prevent IPCThreadState::joinThreadPool from spinning on unexpected error

Adds logging to help determine what is happening to the /dev/binder
fd and dump the process state when it happens.

bug: 8912673
Change-Id: I2aa0c66fc499e91e0bf9ee4ae20404bec35adc82
/frameworks/native/libs/binder/IPCThreadState.cpp
002e1e58dfe19dd3e49a59c6827cbf51573941a2 07-May-2013 Mathias Agopian <mathias@google.com> libutils clean-up

Change-Id: I6ff4cfc736751de2912c697f954e45e275f2d386
/frameworks/native/libs/binder/IPCThreadState.cpp
0bed1f541d5a8284691d2296754604cde0723787 07-Oct-2012 Dave Burke <daveburke@google.com> Revert "ugly, temporary, workaroung for a problem where a binder thread spins forever"

This reverts commit 0845d0245e09548110cacb0f20e9934753388aab

Change-Id: I395037cb9427cd11f7de6bb78fbdfa917fc6263a
/frameworks/native/libs/binder/IPCThreadState.cpp
0845d0245e09548110cacb0f20e9934753388aab 06-Oct-2012 Mathias Agopian <mathias@google.com> ugly, temporary, workaroung for a problem where a binder thread spins forever

Bug: 7289992
Change-Id: I0c3d482a1af57e5f444be2ba7f2751ac3e954af2
/frameworks/native/libs/binder/IPCThreadState.cpp
8210185fe337ca9d5b01f2bff8590ea60984c31e 31-Aug-2012 Dianne Hackborn <hackbod@google.com> No longer need "original calling uid".

Change-Id: Ifc4a89dd088609a5a8553f6ac6553174e09e8222
/frameworks/native/libs/binder/IPCThreadState.cpp
db1597a98958b78dc0d8eced19ae1406382b70d6 17-Feb-2011 Johannes Carlsson <johannes.carlsson.x@sonyericsson.com> Fix shutdown sequence to avoid SIGSEGV when running am command

When the app_process is shutting down the main thread will close the
binder fd while pool threads are executing an ioctl (in
IPCThreadState::stopProcess called by AppRuntime::onStarted in
app_main.c).

The binder driver will then return all pending calls in ioctl
without any error and with a command. One of the threads gets a
BR_SPAWN_LOOPER which will create a new thread (the other thread
gets a BR_NOOP). This new thread then calls
vm->AttachCurrentThread. Usually this results in a log entry with
"AndroidRuntime: NOTE: attach of thread 'Binder Thread #3' failed",
but sometimes it also causes a SIGSEGV. This depends on the timing
between the new thread an the main thread that calls DestroyJavaVM
(in AndroidRuntime::start).

If IPCThreadState.cpp is compiled with "#define LOG_NDEBUG 0" the
pool thread will loop and hit the
ALOG_ASSERT(mProcess->mDriverFD >= 0) in
IPCThreadState::talkWithDriver.

Crashes like this has been seen when running the am command and
other commands that use the app_process.

This fix makes sure that any command that is received when the driver
fd is closed are ignored and IPCThreadState::talkWithDriver instead
returns an error which will cause the pool thread to exit and detach
itself from the vm. A check to avoid calling ioctl to a fd with -1
was also added in IPCThreadState::threadDestructor.

Another solution might be to change the binder driver so that it
returns an error when the fd is closed (or atleast not a
BR_SPAWN_LOOPER command). It might also be possible to call exit(0)
which is done when System.exit(0) is called from java.

Change-Id: I3d1f0ff64896c44be2a5994b3a90f7a06d27f429
/frameworks/native/libs/binder/IPCThreadState.cpp
a26e1cfbbcb7dc5e0b1cd79a815362d6a048ef26 16-Mar-2012 Glenn Kasten <gkasten@google.com> Scheduling group cleanup

Remove C++ APIs androidSetThreadSchedulingGroup and
androidGetThreadSchedulingGroup, and the ANDROID_TGROUP_* constants.

Former callers of these should now use the C APIs set_sched_policy and
get_sched_policy, and the SP_* constants.

Note: debug.sys.noschedgroups is not supported by the C APIs,
this needs to be discussed.

Change-Id: I32bbfc539ef4090faf9ef0320380e8cca9eae07c
/frameworks/native/libs/binder/IPCThreadState.cpp
4bcb57502c5a7da53ef84228aceeffb54d36e06b 06-Mar-2012 Glenn Kasten <gkasten@google.com> Remove obsolete references to sched_policy.h

As part of scheduling policy cleanup, remove or isolate
all references to the scheduling policy APIs.

Change-Id: Ia1ea2fe711a399039f25217309e061267744b856
/frameworks/native/libs/binder/IPCThreadState.cpp
4e975bb488bb3947703e95cb33a4838adda680f7 04-May-2011 Amith Yamasani <yamasani@google.com> Multi-user - 1st major checkin

Switching activity stacks
Cache ContentProvider per user
Long-press power to switch users (on phone)

Added ServiceMap for separating services by user
Launch PendingIntents on the correct user's uid
Fix task switching from Recents list
AppWidgetService is mostly working.

Commands added to pm and am to allow creating and switching profiles.

Change-Id: I15810e8cfbe50a04bd3323a7ef5a8ff4230870ed
/frameworks/native/libs/binder/IPCThreadState.cpp
6726347e8950d34ae162fb8d6a3680a871d359e2 09-Jan-2012 Steve Block <steveblock@google.com> Rename LOG_ASSERT to ALOG_ASSERT DO NOT MERGE

See https://android-git.corp.google.com/g/157519

Bug: 5449033
Change-Id: I8ceb2dba1b031a0fd68d15d146960d9ced62bbf3
/frameworks/native/libs/binder/IPCThreadState.cpp
a19954ab377b46dbcb9cbe8a6ab6d458f2e32bca 04-Jan-2012 Steve Block <steveblock@google.com> Rename (IF_)LOGI(_IF) to (IF_)ALOGI(_IF) DO NOT MERGE

See https://android-git.corp.google.com/g/156801

Bug: 5449033
Change-Id: Ib08fe86d23db91ee153e9f91a99a35c42b9208ea
/frameworks/native/libs/binder/IPCThreadState.cpp
a63ee4c2fdc4869fd1169d22e79ae9f1220c5bdb 02-Dec-2011 Ben Cheng <bccheng@google.com> am f1a4c48b: am e21dabf6: Merge "Initialize bwr.read_buffer in IPCThreadState::talkWithDriver." into ics-mr1

* commit 'f1a4c48b886d53e2afceb0620215e3792af79fd5':
Initialize bwr.read_buffer in IPCThreadState::talkWithDriver.
d640f89205e17d9f19b11c2954862f0945a40e7b 02-Dec-2011 Ben Cheng <bccheng@google.com> Initialize bwr.read_buffer in IPCThreadState::talkWithDriver.

I/valgrind( 1309): ==1310== Syscall param
ioctl(BINDER_WRITE_READ).read_buffer points to uninitialised byte(s)
I/valgrind( 1309): ==1310== at 0x480E670: __ioctl (__ioctl.S:10)
I/valgrind( 1309): ==1310== Address 0xbda651b4 is on thread 1's stack

Change-Id: I02893df7b5786b6b2dbd9659f5706d7171295ab2
/frameworks/native/libs/binder/IPCThreadState.cpp
9f760150f6e0f39b9923cfdc875373606839ee00 12-Oct-2011 Steve Block <steveblock@google.com> Rename (IF_)LOG() to (IF_)ALOG() DO NOT MERGE

See https://android-git.corp.google.com/g/#/c/141576

Bug: 5449033
Change-Id: I42575e7c29cf1c0f465c357a5c97ab118df6f473
/frameworks/native/libs/binder/IPCThreadState.cpp
aefc9cda45adb00ec1cb2c8fbd03c50fd48499fb 31-Aug-2011 Andy McFadden <fadden@android.com> Resurrect verbose binder logging

Updated the command name lists, and masked off the additional bits in
the command word when doing the name lookup.

Made descriptor values easier to grep for and consistent with kernel
output (i.e. decimal rather than hex). Attempt to show transaction
descriptors as such (they're in a union with a pointer).

Also, the writeLines() function in Static was using a no-op
logging call to write an iovec. It looks like all callers are using
N=1, so I just added a log for the first string.

Bug 5155269

Change-Id: I417b8d77da3eb6ee1d2069ba94047210f75738bc
/frameworks/native/libs/binder/IPCThreadState.cpp
d547432f98889d57a8c37e91090664efe63da436 21-Apr-2011 Evgeniy Stepanov <eugenis@google.com> Make sure binder ioctl structs don't contain uninitialized values.

Change-Id: I8a678f91262417bb120e65e32c244ce1512b46c2
/frameworks/native/libs/binder/IPCThreadState.cpp
1b6084354710ca52c04ea361d751d19174802d57 14-Dec-2010 Brad Fitzpatrick <bradfitz@android.com> Framework-side support for Dalvik "isSensitiveThread" hook.

Used in lock contention stats.

Bug: 3226270
Change-Id: Ie6f58d130a29079a59bdefad40b80304d9bc3623
/frameworks/native/libs/binder/IPCThreadState.cpp
67f78c4fe8f89b52199f509f36e42df0b1cdfe2d 24-Sep-2010 Dianne Hackborn <hackbod@google.com> Some debugging support.

- New feature to "am monitor" to have it automatically launch
gdbserv for you when a crash/ANR happens, and tell you how to
run the client.

- Update dumpstate to match new location of binder debug logs

- Various commented out logs that are being used to track down
issues.

Change-Id: Ia5dd0cd2df983a1fc6be697642a4590aa02a26a5
/frameworks/native/libs/binder/IPCThreadState.cpp
5273603e98d2db3bac656b7bcf5352c04c86d62f 31-Aug-2010 Brad Fitzpatrick <bradfitz@android.com> Don't propagate StrictMode over one-way Binder calls.

This was causing stack stitching problems where a one-way call with
violations followed by a two-way call without violations was getting
the previous one-way call's violation stack stitched on to the second
caller's stack.

The solution is a little more indirect than I would've liked
(preserving the binder's onTransact flags until enforceInterface) but
was seemingly necessary to work without changing the AIDL compiler.
It should also be sufficiently cheap, since no new calls to
thread-local IPCThreadState lookups were required. The additional
work is just same-thread getter/setters on the existing
IPCThreadState.

Change-Id: I4b6db1d445c56e868e6d0d7be3ba6849f4ef23ae
/frameworks/native/libs/binder/IPCThreadState.cpp
a877cd85b5a026384542e3271fc310d6a8fe24c6 08-Jul-2010 Brad Fitzpatrick <bradfitz@android.com> More StrictMode work, keeping Binder & BlockGuard's thread-locals in-sync.

Change-Id: Ia67cabcc17a73a0f15907ffea683d06bc41b90e5
/frameworks/native/libs/binder/IPCThreadState.cpp
702ea9d42f52fc145090c0f0bfbe64993e4b8b33 18-Jun-2010 Brad Fitzpatrick <bradfitz@android.com> Start of work on passing around StrictMode policy over Binder calls.

This is (intendend to be) a no-op change.

At this stage, Binder RPCs just have an additional uint32 passed around
in the header, right before the interface name. But nothing is actually
done with them yet. That value should right now always be 0.

This now boots and seems to work.

Change-Id: I135b7c84f07575e6b9717fef2424d301a450df7b
/frameworks/native/libs/binder/IPCThreadState.cpp
440fd870b20b4720e11c9ea71d2a3284f8cf2f59 19-Mar-2010 Christopher Tate <ctate@google.com> Ensure that binder incalls to the system process keep the fg cgroup

On binder incalls, the handler thread is given the caller's priority by the
driver, but not the caller's cgroup. We have explicit code that sets the
handler's cgroup to match the caller's, *except* that the system process
explicitly disables this behavior. This led to a siuation in which we were
running binder incalls to the system process at nice=10 but cgroup=fg.

That's fine as far as it goes, except that if a GC happened in the handler
thread, it would be promoted to foreground priority and cgroup both, to avoid
having the GC take forever. Then, when GC finished, the original priority
is reset, and the cgroup set *based on that priority*. This would push the
handler thread into nice=10 cgroup=bg_non_interactive -- which matches the
caller, but is supposed to be impossible in the system process.

The end result of this was that we could be running "lengthy" operations in
the system process in the background. Unfortunately, some of the operations
that wound up like this would hold important global system locks for up to
twenty seconds as a result, making the entire device unresponsive to input
for that period.

This CL fixes the binder incall setup to ensure that within the system process,
a binder incall is always begun from the normal foreground priority as well
as cgroup. In practice now the device still becomes laggy/sluggish when the
offending lock-holding time-consuming incall occurs, but since it still runs
as a foreground task it is able to proceed to completion within a short time
rather than taking 20 seconds.

Fixes bug #2403717

Change-Id: Id046aeabd0e80c48eef94accc37842835eab308d
/frameworks/native/libs/binder/IPCThreadState.cpp
8c6cedc9bc9a4b69616a79a95449f6f6b08c7bf1 08-Dec-2009 Dianne Hackborn <hackbod@google.com> Propagate background scheduling class across processes.

This is a very simply implementation: upon receiving an IPC, if the handling
thread is at a background priority (the driver will have taken care of
propagating this from the calling thread), then stick it in to the background
scheduling group. Plus an API to turn this off for the process, which is
used by the system process.

This also pulls some of the code for managing scheduling classes out of
the Process JNI wrappers and in to some convenience methods in thread.h.
/frameworks/native/libs/binder/IPCThreadState.cpp
07d69893e1677bd59a3461a0c4fcd3541563144d 08-Nov-2009 Christopher Tate <ctate@android.com> Reset binder service threads' cgroup/priority after command completion

To prevent buggy command implementations from poisoning binder threads'
scheduling class & priority for future command execution, we now reset the
cgroup and thread priority to foreground/normal when a binder service thread
finishes executing the designated command.

Change-Id: Ibc0ab2485751453f6dc96fdb4eb877fd02796e3f
/frameworks/native/libs/binder/IPCThreadState.cpp
6dfe8f1ffad455363fff4fe69ced6da386970fbc 06-Nov-2009 Evan Millar <emillar@google.com> Revert jparks code from IPCThreadState.
/frameworks/native/libs/binder/IPCThreadState.cpp
b5c41353337b3db2dc0ca0df163d5294af8281bc 04-Nov-2009 Jason Parks <jparks@google.com> When a thread is about to be put back onto the thread pool ensure that it is in the foreground cgroup.
/frameworks/native/libs/binder/IPCThreadState.cpp
dcd3958c5086f757dc09472700ae7384efea7fc8 03-Nov-2009 Jason Parks <jparks@google.com> Add a warning when we leave threads in the binder thread pool in the background scheduling group.
/frameworks/native/libs/binder/IPCThreadState.cpp
d43b194b69fca6c81023effc921fcc7576bad496 17-Jul-2009 Marco Nelissen <marcone@google.com> Instead of using -1 for pid and uid in the simulator, and then having
to special-case the simulator case all over the framework, just use
getuid and getpid, and intercept those in the simulator wrapper.
/frameworks/native/libs/binder/IPCThreadState.cpp
c5b2c0bf8007562536b822eb060fc54a01f8e08b 20-May-2009 Mathias Agopian <mathias@google.com> move libbinder's header files under includes/binder
/frameworks/native/libs/binder/IPCThreadState.cpp
208059f67ed2dd9fa025e07fcb6954d3cb61c79e 19-May-2009 Mathias Agopian <mathias@google.com> checkpoint: split libutils into libutils + libbinder
/frameworks/native/libs/binder/IPCThreadState.cpp