Home | History | Annotate | Download | only in binder
      1 /*
      2  * Copyright (C) 2005 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 
     17 #define LOG_TAG "IPCThreadState"
     18 
     19 #include <binder/IPCThreadState.h>
     20 
     21 #include <binder/Binder.h>
     22 #include <binder/BpBinder.h>
     23 #include <binder/TextOutput.h>
     24 
     25 #include <cutils/sched_policy.h>
     26 #include <utils/Debug.h>
     27 #include <utils/Log.h>
     28 #include <utils/threads.h>
     29 
     30 #include <private/binder/binder_module.h>
     31 #include <private/binder/Static.h>
     32 
     33 #include <sys/ioctl.h>
     34 #include <signal.h>
     35 #include <errno.h>
     36 #include <stdio.h>
     37 #include <unistd.h>
     38 
     39 #ifdef HAVE_PTHREADS
     40 #include <pthread.h>
     41 #include <sched.h>
     42 #include <sys/resource.h>
     43 #endif
     44 #ifdef HAVE_WIN32_THREADS
     45 #include <windows.h>
     46 #endif
     47 
     48 
     49 #if LOG_NDEBUG
     50 
     51 #define IF_LOG_TRANSACTIONS() if (false)
     52 #define IF_LOG_COMMANDS() if (false)
     53 #define LOG_REMOTEREFS(...)
     54 #define IF_LOG_REMOTEREFS() if (false)
     55 #define LOG_THREADPOOL(...)
     56 #define LOG_ONEWAY(...)
     57 
     58 #else
     59 
     60 #define IF_LOG_TRANSACTIONS() IF_ALOG(LOG_VERBOSE, "transact")
     61 #define IF_LOG_COMMANDS() IF_ALOG(LOG_VERBOSE, "ipc")
     62 #define LOG_REMOTEREFS(...) ALOG(LOG_DEBUG, "remoterefs", __VA_ARGS__)
     63 #define IF_LOG_REMOTEREFS() IF_ALOG(LOG_DEBUG, "remoterefs")
     64 #define LOG_THREADPOOL(...) ALOG(LOG_DEBUG, "threadpool", __VA_ARGS__)
     65 #define LOG_ONEWAY(...) ALOG(LOG_DEBUG, "ipc", __VA_ARGS__)
     66 
     67 #endif
     68 
     69 // ---------------------------------------------------------------------------
     70 
     71 namespace android {
     72 
     73 static const char* getReturnString(size_t idx);
     74 static const char* getCommandString(size_t idx);
     75 static const void* printReturnCommand(TextOutput& out, const void* _cmd);
     76 static const void* printCommand(TextOutput& out, const void* _cmd);
     77 
     78 // This will result in a missing symbol failure if the IF_LOG_COMMANDS()
     79 // conditionals don't get stripped...  but that is probably what we want.
     80 #if !LOG_NDEBUG
     81 static const char *kReturnStrings[] = {
     82     "BR_ERROR",
     83     "BR_OK",
     84     "BR_TRANSACTION",
     85     "BR_REPLY",
     86     "BR_ACQUIRE_RESULT",
     87     "BR_DEAD_REPLY",
     88     "BR_TRANSACTION_COMPLETE",
     89     "BR_INCREFS",
     90     "BR_ACQUIRE",
     91     "BR_RELEASE",
     92     "BR_DECREFS",
     93     "BR_ATTEMPT_ACQUIRE",
     94     "BR_NOOP",
     95     "BR_SPAWN_LOOPER",
     96     "BR_FINISHED",
     97     "BR_DEAD_BINDER",
     98     "BR_CLEAR_DEATH_NOTIFICATION_DONE",
     99     "BR_FAILED_REPLY"
    100 };
    101 
    102 static const char *kCommandStrings[] = {
    103     "BC_TRANSACTION",
    104     "BC_REPLY",
    105     "BC_ACQUIRE_RESULT",
    106     "BC_FREE_BUFFER",
    107     "BC_INCREFS",
    108     "BC_ACQUIRE",
    109     "BC_RELEASE",
    110     "BC_DECREFS",
    111     "BC_INCREFS_DONE",
    112     "BC_ACQUIRE_DONE",
    113     "BC_ATTEMPT_ACQUIRE",
    114     "BC_REGISTER_LOOPER",
    115     "BC_ENTER_LOOPER",
    116     "BC_EXIT_LOOPER",
    117     "BC_REQUEST_DEATH_NOTIFICATION",
    118     "BC_CLEAR_DEATH_NOTIFICATION",
    119     "BC_DEAD_BINDER_DONE"
    120 };
    121 
    122 static const char* getReturnString(size_t idx)
    123 {
    124     if (idx < sizeof(kReturnStrings) / sizeof(kReturnStrings[0]))
    125         return kReturnStrings[idx];
    126     else
    127         return "unknown";
    128 }
    129 
    130 static const char* getCommandString(size_t idx)
    131 {
    132     if (idx < sizeof(kCommandStrings) / sizeof(kCommandStrings[0]))
    133         return kCommandStrings[idx];
    134     else
    135         return "unknown";
    136 }
    137 
    138 static const void* printBinderTransactionData(TextOutput& out, const void* data)
    139 {
    140     const binder_transaction_data* btd =
    141         (const binder_transaction_data*)data;
    142     if (btd->target.handle < 1024) {
    143         /* want to print descriptors in decimal; guess based on value */
    144         out << "target.desc=" << btd->target.handle;
    145     } else {
    146         out << "target.ptr=" << btd->target.ptr;
    147     }
    148     out << " (cookie " << btd->cookie << ")" << endl
    149         << "code=" << TypeCode(btd->code) << ", flags=" << (void*)btd->flags << endl
    150         << "data=" << btd->data.ptr.buffer << " (" << (void*)btd->data_size
    151         << " bytes)" << endl
    152         << "offsets=" << btd->data.ptr.offsets << " (" << (void*)btd->offsets_size
    153         << " bytes)";
    154     return btd+1;
    155 }
    156 
    157 static const void* printReturnCommand(TextOutput& out, const void* _cmd)
    158 {
    159     static const size_t N = sizeof(kReturnStrings)/sizeof(kReturnStrings[0]);
    160     const int32_t* cmd = (const int32_t*)_cmd;
    161     int32_t code = *cmd++;
    162     size_t cmdIndex = code & 0xff;
    163     if (code == (int32_t) BR_ERROR) {
    164         out << "BR_ERROR: " << (void*)(*cmd++) << endl;
    165         return cmd;
    166     } else if (cmdIndex >= N) {
    167         out << "Unknown reply: " << code << endl;
    168         return cmd;
    169     }
    170     out << kReturnStrings[cmdIndex];
    171 
    172     switch (code) {
    173         case BR_TRANSACTION:
    174         case BR_REPLY: {
    175             out << ": " << indent;
    176             cmd = (const int32_t *)printBinderTransactionData(out, cmd);
    177             out << dedent;
    178         } break;
    179 
    180         case BR_ACQUIRE_RESULT: {
    181             const int32_t res = *cmd++;
    182             out << ": " << res << (res ? " (SUCCESS)" : " (FAILURE)");
    183         } break;
    184 
    185         case BR_INCREFS:
    186         case BR_ACQUIRE:
    187         case BR_RELEASE:
    188         case BR_DECREFS: {
    189             const int32_t b = *cmd++;
    190             const int32_t c = *cmd++;
    191             out << ": target=" << (void*)b << " (cookie " << (void*)c << ")";
    192         } break;
    193 
    194         case BR_ATTEMPT_ACQUIRE: {
    195             const int32_t p = *cmd++;
    196             const int32_t b = *cmd++;
    197             const int32_t c = *cmd++;
    198             out << ": target=" << (void*)b << " (cookie " << (void*)c
    199                 << "), pri=" << p;
    200         } break;
    201 
    202         case BR_DEAD_BINDER:
    203         case BR_CLEAR_DEATH_NOTIFICATION_DONE: {
    204             const int32_t c = *cmd++;
    205             out << ": death cookie " << (void*)c;
    206         } break;
    207 
    208         default:
    209             // no details to show for: BR_OK, BR_DEAD_REPLY,
    210             // BR_TRANSACTION_COMPLETE, BR_FINISHED
    211             break;
    212     }
    213 
    214     out << endl;
    215     return cmd;
    216 }
    217 
    218 static const void* printCommand(TextOutput& out, const void* _cmd)
    219 {
    220     static const size_t N = sizeof(kCommandStrings)/sizeof(kCommandStrings[0]);
    221     const int32_t* cmd = (const int32_t*)_cmd;
    222     int32_t code = *cmd++;
    223     size_t cmdIndex = code & 0xff;
    224 
    225     if (cmdIndex >= N) {
    226         out << "Unknown command: " << code << endl;
    227         return cmd;
    228     }
    229     out << kCommandStrings[cmdIndex];
    230 
    231     switch (code) {
    232         case BC_TRANSACTION:
    233         case BC_REPLY: {
    234             out << ": " << indent;
    235             cmd = (const int32_t *)printBinderTransactionData(out, cmd);
    236             out << dedent;
    237         } break;
    238 
    239         case BC_ACQUIRE_RESULT: {
    240             const int32_t res = *cmd++;
    241             out << ": " << res << (res ? " (SUCCESS)" : " (FAILURE)");
    242         } break;
    243 
    244         case BC_FREE_BUFFER: {
    245             const int32_t buf = *cmd++;
    246             out << ": buffer=" << (void*)buf;
    247         } break;
    248 
    249         case BC_INCREFS:
    250         case BC_ACQUIRE:
    251         case BC_RELEASE:
    252         case BC_DECREFS: {
    253             const int32_t d = *cmd++;
    254             out << ": desc=" << d;
    255         } break;
    256 
    257         case BC_INCREFS_DONE:
    258         case BC_ACQUIRE_DONE: {
    259             const int32_t b = *cmd++;
    260             const int32_t c = *cmd++;
    261             out << ": target=" << (void*)b << " (cookie " << (void*)c << ")";
    262         } break;
    263 
    264         case BC_ATTEMPT_ACQUIRE: {
    265             const int32_t p = *cmd++;
    266             const int32_t d = *cmd++;
    267             out << ": desc=" << d << ", pri=" << p;
    268         } break;
    269 
    270         case BC_REQUEST_DEATH_NOTIFICATION:
    271         case BC_CLEAR_DEATH_NOTIFICATION: {
    272             const int32_t h = *cmd++;
    273             const int32_t c = *cmd++;
    274             out << ": handle=" << h << " (death cookie " << (void*)c << ")";
    275         } break;
    276 
    277         case BC_DEAD_BINDER_DONE: {
    278             const int32_t c = *cmd++;
    279             out << ": death cookie " << (void*)c;
    280         } break;
    281 
    282         default:
    283             // no details to show for: BC_REGISTER_LOOPER, BC_ENTER_LOOPER,
    284             // BC_EXIT_LOOPER
    285             break;
    286     }
    287 
    288     out << endl;
    289     return cmd;
    290 }
    291 #endif
    292 
    293 static pthread_mutex_t gTLSMutex = PTHREAD_MUTEX_INITIALIZER;
    294 static bool gHaveTLS = false;
    295 static pthread_key_t gTLS = 0;
    296 static bool gShutdown = false;
    297 static bool gDisableBackgroundScheduling = false;
    298 
    299 IPCThreadState* IPCThreadState::self()
    300 {
    301     if (gHaveTLS) {
    302 restart:
    303         const pthread_key_t k = gTLS;
    304         IPCThreadState* st = (IPCThreadState*)pthread_getspecific(k);
    305         if (st) return st;
    306         return new IPCThreadState;
    307     }
    308 
    309     if (gShutdown) return NULL;
    310 
    311     pthread_mutex_lock(&gTLSMutex);
    312     if (!gHaveTLS) {
    313         if (pthread_key_create(&gTLS, threadDestructor) != 0) {
    314             pthread_mutex_unlock(&gTLSMutex);
    315             return NULL;
    316         }
    317         gHaveTLS = true;
    318     }
    319     pthread_mutex_unlock(&gTLSMutex);
    320     goto restart;
    321 }
    322 
    323 IPCThreadState* IPCThreadState::selfOrNull()
    324 {
    325     if (gHaveTLS) {
    326         const pthread_key_t k = gTLS;
    327         IPCThreadState* st = (IPCThreadState*)pthread_getspecific(k);
    328         return st;
    329     }
    330     return NULL;
    331 }
    332 
    333 void IPCThreadState::shutdown()
    334 {
    335     gShutdown = true;
    336 
    337     if (gHaveTLS) {
    338         // XXX Need to wait for all thread pool threads to exit!
    339         IPCThreadState* st = (IPCThreadState*)pthread_getspecific(gTLS);
    340         if (st) {
    341             delete st;
    342             pthread_setspecific(gTLS, NULL);
    343         }
    344         gHaveTLS = false;
    345     }
    346 }
    347 
    348 void IPCThreadState::disableBackgroundScheduling(bool disable)
    349 {
    350     gDisableBackgroundScheduling = disable;
    351 }
    352 
    353 sp<ProcessState> IPCThreadState::process()
    354 {
    355     return mProcess;
    356 }
    357 
    358 status_t IPCThreadState::clearLastError()
    359 {
    360     const status_t err = mLastError;
    361     mLastError = NO_ERROR;
    362     return err;
    363 }
    364 
    365 int IPCThreadState::getCallingPid() const
    366 {
    367     return mCallingPid;
    368 }
    369 
    370 int IPCThreadState::getCallingUid() const
    371 {
    372     return mCallingUid;
    373 }
    374 
    375 int64_t IPCThreadState::clearCallingIdentity()
    376 {
    377     int64_t token = ((int64_t)mCallingUid<<32) | mCallingPid;
    378     clearCaller();
    379     return token;
    380 }
    381 
    382 void IPCThreadState::setStrictModePolicy(int32_t policy)
    383 {
    384     mStrictModePolicy = policy;
    385 }
    386 
    387 int32_t IPCThreadState::getStrictModePolicy() const
    388 {
    389     return mStrictModePolicy;
    390 }
    391 
    392 void IPCThreadState::setLastTransactionBinderFlags(int32_t flags)
    393 {
    394     mLastTransactionBinderFlags = flags;
    395 }
    396 
    397 int32_t IPCThreadState::getLastTransactionBinderFlags() const
    398 {
    399     return mLastTransactionBinderFlags;
    400 }
    401 
    402 void IPCThreadState::restoreCallingIdentity(int64_t token)
    403 {
    404     mCallingUid = (int)(token>>32);
    405     mCallingPid = (int)token;
    406 }
    407 
    408 void IPCThreadState::clearCaller()
    409 {
    410     mCallingPid = getpid();
    411     mCallingUid = getuid();
    412 }
    413 
    414 void IPCThreadState::flushCommands()
    415 {
    416     if (mProcess->mDriverFD <= 0)
    417         return;
    418     talkWithDriver(false);
    419 }
    420 
    421 status_t IPCThreadState::getAndExecuteCommand()
    422 {
    423     status_t result;
    424     int32_t cmd;
    425 
    426     result = talkWithDriver();
    427     if (result >= NO_ERROR) {
    428         size_t IN = mIn.dataAvail();
    429         if (IN < sizeof(int32_t)) return result;
    430         cmd = mIn.readInt32();
    431         IF_LOG_COMMANDS() {
    432             alog << "Processing top-level Command: "
    433                  << getReturnString(cmd) << endl;
    434         }
    435 
    436         result = executeCommand(cmd);
    437 
    438         // After executing the command, ensure that the thread is returned to the
    439         // foreground cgroup before rejoining the pool.  The driver takes care of
    440         // restoring the priority, but doesn't do anything with cgroups so we
    441         // need to take care of that here in userspace.  Note that we do make
    442         // sure to go in the foreground after executing a transaction, but
    443         // there are other callbacks into user code that could have changed
    444         // our group so we want to make absolutely sure it is put back.
    445         set_sched_policy(mMyThreadId, SP_FOREGROUND);
    446     }
    447 
    448     return result;
    449 }
    450 
    451 // When we've cleared the incoming command queue, process any pending derefs
    452 void IPCThreadState::processPendingDerefs()
    453 {
    454     if (mIn.dataPosition() >= mIn.dataSize()) {
    455         size_t numPending = mPendingWeakDerefs.size();
    456         if (numPending > 0) {
    457             for (size_t i = 0; i < numPending; i++) {
    458                 RefBase::weakref_type* refs = mPendingWeakDerefs[i];
    459                 refs->decWeak(mProcess.get());
    460             }
    461             mPendingWeakDerefs.clear();
    462         }
    463 
    464         numPending = mPendingStrongDerefs.size();
    465         if (numPending > 0) {
    466             for (size_t i = 0; i < numPending; i++) {
    467                 BBinder* obj = mPendingStrongDerefs[i];
    468                 obj->decStrong(mProcess.get());
    469             }
    470             mPendingStrongDerefs.clear();
    471         }
    472     }
    473 }
    474 
    475 void IPCThreadState::joinThreadPool(bool isMain)
    476 {
    477     LOG_THREADPOOL("**** THREAD %p (PID %d) IS JOINING THE THREAD POOL\n", (void*)pthread_self(), getpid());
    478 
    479     mOut.writeInt32(isMain ? BC_ENTER_LOOPER : BC_REGISTER_LOOPER);
    480 
    481     // This thread may have been spawned by a thread that was in the background
    482     // scheduling group, so first we will make sure it is in the foreground
    483     // one to avoid performing an initial transaction in the background.
    484     set_sched_policy(mMyThreadId, SP_FOREGROUND);
    485 
    486     status_t result;
    487     do {
    488         processPendingDerefs();
    489         // now get the next command to be processed, waiting if necessary
    490         result = getAndExecuteCommand();
    491 
    492         if (result < NO_ERROR && result != TIMED_OUT && result != -ECONNREFUSED && result != -EBADF) {
    493             ALOGE("getAndExecuteCommand(fd=%d) returned unexpected error %d, aborting",
    494                   mProcess->mDriverFD, result);
    495             abort();
    496         }
    497 
    498         // Let this thread exit the thread pool if it is no longer
    499         // needed and it is not the main process thread.
    500         if(result == TIMED_OUT && !isMain) {
    501             break;
    502         }
    503     } while (result != -ECONNREFUSED && result != -EBADF);
    504 
    505     LOG_THREADPOOL("**** THREAD %p (PID %d) IS LEAVING THE THREAD POOL err=%p\n",
    506         (void*)pthread_self(), getpid(), (void*)result);
    507 
    508     mOut.writeInt32(BC_EXIT_LOOPER);
    509     talkWithDriver(false);
    510 }
    511 
    512 int IPCThreadState::setupPolling(int* fd)
    513 {
    514     if (mProcess->mDriverFD <= 0) {
    515         return -EBADF;
    516     }
    517 
    518     mOut.writeInt32(BC_ENTER_LOOPER);
    519     *fd = mProcess->mDriverFD;
    520     return 0;
    521 }
    522 
    523 status_t IPCThreadState::handlePolledCommands()
    524 {
    525     status_t result;
    526 
    527     do {
    528         result = getAndExecuteCommand();
    529     } while (mIn.dataPosition() < mIn.dataSize());
    530 
    531     processPendingDerefs();
    532     flushCommands();
    533     return result;
    534 }
    535 
    536 void IPCThreadState::stopProcess(bool immediate)
    537 {
    538     //ALOGI("**** STOPPING PROCESS");
    539     flushCommands();
    540     int fd = mProcess->mDriverFD;
    541     mProcess->mDriverFD = -1;
    542     close(fd);
    543     //kill(getpid(), SIGKILL);
    544 }
    545 
    546 status_t IPCThreadState::transact(int32_t handle,
    547                                   uint32_t code, const Parcel& data,
    548                                   Parcel* reply, uint32_t flags)
    549 {
    550     status_t err = data.errorCheck();
    551 
    552     flags |= TF_ACCEPT_FDS;
    553 
    554     IF_LOG_TRANSACTIONS() {
    555         TextOutput::Bundle _b(alog);
    556         alog << "BC_TRANSACTION thr " << (void*)pthread_self() << " / hand "
    557             << handle << " / code " << TypeCode(code) << ": "
    558             << indent << data << dedent << endl;
    559     }
    560 
    561     if (err == NO_ERROR) {
    562         LOG_ONEWAY(">>>> SEND from pid %d uid %d %s", getpid(), getuid(),
    563             (flags & TF_ONE_WAY) == 0 ? "READ REPLY" : "ONE WAY");
    564         err = writeTransactionData(BC_TRANSACTION, flags, handle, code, data, NULL);
    565     }
    566 
    567     if (err != NO_ERROR) {
    568         if (reply) reply->setError(err);
    569         return (mLastError = err);
    570     }
    571 
    572     if ((flags & TF_ONE_WAY) == 0) {
    573         #if 0
    574         if (code == 4) { // relayout
    575             ALOGI(">>>>>> CALLING transaction 4");
    576         } else {
    577             ALOGI(">>>>>> CALLING transaction %d", code);
    578         }
    579         #endif
    580         if (reply) {
    581             err = waitForResponse(reply);
    582         } else {
    583             Parcel fakeReply;
    584             err = waitForResponse(&fakeReply);
    585         }
    586         #if 0
    587         if (code == 4) { // relayout
    588             ALOGI("<<<<<< RETURNING transaction 4");
    589         } else {
    590             ALOGI("<<<<<< RETURNING transaction %d", code);
    591         }
    592         #endif
    593 
    594         IF_LOG_TRANSACTIONS() {
    595             TextOutput::Bundle _b(alog);
    596             alog << "BR_REPLY thr " << (void*)pthread_self() << " / hand "
    597                 << handle << ": ";
    598             if (reply) alog << indent << *reply << dedent << endl;
    599             else alog << "(none requested)" << endl;
    600         }
    601     } else {
    602         err = waitForResponse(NULL, NULL);
    603     }
    604 
    605     return err;
    606 }
    607 
    608 void IPCThreadState::incStrongHandle(int32_t handle)
    609 {
    610     LOG_REMOTEREFS("IPCThreadState::incStrongHandle(%d)\n", handle);
    611     mOut.writeInt32(BC_ACQUIRE);
    612     mOut.writeInt32(handle);
    613 }
    614 
    615 void IPCThreadState::decStrongHandle(int32_t handle)
    616 {
    617     LOG_REMOTEREFS("IPCThreadState::decStrongHandle(%d)\n", handle);
    618     mOut.writeInt32(BC_RELEASE);
    619     mOut.writeInt32(handle);
    620 }
    621 
    622 void IPCThreadState::incWeakHandle(int32_t handle)
    623 {
    624     LOG_REMOTEREFS("IPCThreadState::incWeakHandle(%d)\n", handle);
    625     mOut.writeInt32(BC_INCREFS);
    626     mOut.writeInt32(handle);
    627 }
    628 
    629 void IPCThreadState::decWeakHandle(int32_t handle)
    630 {
    631     LOG_REMOTEREFS("IPCThreadState::decWeakHandle(%d)\n", handle);
    632     mOut.writeInt32(BC_DECREFS);
    633     mOut.writeInt32(handle);
    634 }
    635 
    636 status_t IPCThreadState::attemptIncStrongHandle(int32_t handle)
    637 {
    638     LOG_REMOTEREFS("IPCThreadState::attemptIncStrongHandle(%d)\n", handle);
    639     mOut.writeInt32(BC_ATTEMPT_ACQUIRE);
    640     mOut.writeInt32(0); // xxx was thread priority
    641     mOut.writeInt32(handle);
    642     status_t result = UNKNOWN_ERROR;
    643 
    644     waitForResponse(NULL, &result);
    645 
    646 #if LOG_REFCOUNTS
    647     printf("IPCThreadState::attemptIncStrongHandle(%ld) = %s\n",
    648         handle, result == NO_ERROR ? "SUCCESS" : "FAILURE");
    649 #endif
    650 
    651     return result;
    652 }
    653 
    654 void IPCThreadState::expungeHandle(int32_t handle, IBinder* binder)
    655 {
    656 #if LOG_REFCOUNTS
    657     printf("IPCThreadState::expungeHandle(%ld)\n", handle);
    658 #endif
    659     self()->mProcess->expungeHandle(handle, binder);
    660 }
    661 
    662 status_t IPCThreadState::requestDeathNotification(int32_t handle, BpBinder* proxy)
    663 {
    664     mOut.writeInt32(BC_REQUEST_DEATH_NOTIFICATION);
    665     mOut.writeInt32((int32_t)handle);
    666     mOut.writeInt32((int32_t)proxy);
    667     return NO_ERROR;
    668 }
    669 
    670 status_t IPCThreadState::clearDeathNotification(int32_t handle, BpBinder* proxy)
    671 {
    672     mOut.writeInt32(BC_CLEAR_DEATH_NOTIFICATION);
    673     mOut.writeInt32((int32_t)handle);
    674     mOut.writeInt32((int32_t)proxy);
    675     return NO_ERROR;
    676 }
    677 
    678 IPCThreadState::IPCThreadState()
    679     : mProcess(ProcessState::self()),
    680       mMyThreadId(androidGetTid()),
    681       mStrictModePolicy(0),
    682       mLastTransactionBinderFlags(0)
    683 {
    684     pthread_setspecific(gTLS, this);
    685     clearCaller();
    686     mIn.setDataCapacity(256);
    687     mOut.setDataCapacity(256);
    688 }
    689 
    690 IPCThreadState::~IPCThreadState()
    691 {
    692 }
    693 
    694 status_t IPCThreadState::sendReply(const Parcel& reply, uint32_t flags)
    695 {
    696     status_t err;
    697     status_t statusBuffer;
    698     err = writeTransactionData(BC_REPLY, flags, -1, 0, reply, &statusBuffer);
    699     if (err < NO_ERROR) return err;
    700 
    701     return waitForResponse(NULL, NULL);
    702 }
    703 
    704 status_t IPCThreadState::waitForResponse(Parcel *reply, status_t *acquireResult)
    705 {
    706     int32_t cmd;
    707     int32_t err;
    708 
    709     while (1) {
    710         if ((err=talkWithDriver()) < NO_ERROR) break;
    711         err = mIn.errorCheck();
    712         if (err < NO_ERROR) break;
    713         if (mIn.dataAvail() == 0) continue;
    714 
    715         cmd = mIn.readInt32();
    716 
    717         IF_LOG_COMMANDS() {
    718             alog << "Processing waitForResponse Command: "
    719                 << getReturnString(cmd) << endl;
    720         }
    721 
    722         switch (cmd) {
    723         case BR_TRANSACTION_COMPLETE:
    724             if (!reply && !acquireResult) goto finish;
    725             break;
    726 
    727         case BR_DEAD_REPLY:
    728             err = DEAD_OBJECT;
    729             goto finish;
    730 
    731         case BR_FAILED_REPLY:
    732             err = FAILED_TRANSACTION;
    733             goto finish;
    734 
    735         case BR_ACQUIRE_RESULT:
    736             {
    737                 ALOG_ASSERT(acquireResult != NULL, "Unexpected brACQUIRE_RESULT");
    738                 const int32_t result = mIn.readInt32();
    739                 if (!acquireResult) continue;
    740                 *acquireResult = result ? NO_ERROR : INVALID_OPERATION;
    741             }
    742             goto finish;
    743 
    744         case BR_REPLY:
    745             {
    746                 binder_transaction_data tr;
    747                 err = mIn.read(&tr, sizeof(tr));
    748                 ALOG_ASSERT(err == NO_ERROR, "Not enough command data for brREPLY");
    749                 if (err != NO_ERROR) goto finish;
    750 
    751                 if (reply) {
    752                     if ((tr.flags & TF_STATUS_CODE) == 0) {
    753                         reply->ipcSetDataReference(
    754                             reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
    755                             tr.data_size,
    756                             reinterpret_cast<const size_t*>(tr.data.ptr.offsets),
    757                             tr.offsets_size/sizeof(size_t),
    758                             freeBuffer, this);
    759                     } else {
    760                         err = *static_cast<const status_t*>(tr.data.ptr.buffer);
    761                         freeBuffer(NULL,
    762                             reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
    763                             tr.data_size,
    764                             reinterpret_cast<const size_t*>(tr.data.ptr.offsets),
    765                             tr.offsets_size/sizeof(size_t), this);
    766                     }
    767                 } else {
    768                     freeBuffer(NULL,
    769                         reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
    770                         tr.data_size,
    771                         reinterpret_cast<const size_t*>(tr.data.ptr.offsets),
    772                         tr.offsets_size/sizeof(size_t), this);
    773                     continue;
    774                 }
    775             }
    776             goto finish;
    777 
    778         default:
    779             err = executeCommand(cmd);
    780             if (err != NO_ERROR) goto finish;
    781             break;
    782         }
    783     }
    784 
    785 finish:
    786     if (err != NO_ERROR) {
    787         if (acquireResult) *acquireResult = err;
    788         if (reply) reply->setError(err);
    789         mLastError = err;
    790     }
    791 
    792     return err;
    793 }
    794 
    795 status_t IPCThreadState::talkWithDriver(bool doReceive)
    796 {
    797     if (mProcess->mDriverFD <= 0) {
    798         return -EBADF;
    799     }
    800 
    801     binder_write_read bwr;
    802 
    803     // Is the read buffer empty?
    804     const bool needRead = mIn.dataPosition() >= mIn.dataSize();
    805 
    806     // We don't want to write anything if we are still reading
    807     // from data left in the input buffer and the caller
    808     // has requested to read the next data.
    809     const size_t outAvail = (!doReceive || needRead) ? mOut.dataSize() : 0;
    810 
    811     bwr.write_size = outAvail;
    812     bwr.write_buffer = (long unsigned int)mOut.data();
    813 
    814     // This is what we'll read.
    815     if (doReceive && needRead) {
    816         bwr.read_size = mIn.dataCapacity();
    817         bwr.read_buffer = (long unsigned int)mIn.data();
    818     } else {
    819         bwr.read_size = 0;
    820         bwr.read_buffer = 0;
    821     }
    822 
    823     IF_LOG_COMMANDS() {
    824         TextOutput::Bundle _b(alog);
    825         if (outAvail != 0) {
    826             alog << "Sending commands to driver: " << indent;
    827             const void* cmds = (const void*)bwr.write_buffer;
    828             const void* end = ((const uint8_t*)cmds)+bwr.write_size;
    829             alog << HexDump(cmds, bwr.write_size) << endl;
    830             while (cmds < end) cmds = printCommand(alog, cmds);
    831             alog << dedent;
    832         }
    833         alog << "Size of receive buffer: " << bwr.read_size
    834             << ", needRead: " << needRead << ", doReceive: " << doReceive << endl;
    835     }
    836 
    837     // Return immediately if there is nothing to do.
    838     if ((bwr.write_size == 0) && (bwr.read_size == 0)) return NO_ERROR;
    839 
    840     bwr.write_consumed = 0;
    841     bwr.read_consumed = 0;
    842     status_t err;
    843     do {
    844         IF_LOG_COMMANDS() {
    845             alog << "About to read/write, write size = " << mOut.dataSize() << endl;
    846         }
    847 #if defined(HAVE_ANDROID_OS)
    848         if (ioctl(mProcess->mDriverFD, BINDER_WRITE_READ, &bwr) >= 0)
    849             err = NO_ERROR;
    850         else
    851             err = -errno;
    852 #else
    853         err = INVALID_OPERATION;
    854 #endif
    855         if (mProcess->mDriverFD <= 0) {
    856             err = -EBADF;
    857         }
    858         IF_LOG_COMMANDS() {
    859             alog << "Finished read/write, write size = " << mOut.dataSize() << endl;
    860         }
    861     } while (err == -EINTR);
    862 
    863     IF_LOG_COMMANDS() {
    864         alog << "Our err: " << (void*)err << ", write consumed: "
    865             << bwr.write_consumed << " (of " << mOut.dataSize()
    866                         << "), read consumed: " << bwr.read_consumed << endl;
    867     }
    868 
    869     if (err >= NO_ERROR) {
    870         if (bwr.write_consumed > 0) {
    871             if (bwr.write_consumed < (ssize_t)mOut.dataSize())
    872                 mOut.remove(0, bwr.write_consumed);
    873             else
    874                 mOut.setDataSize(0);
    875         }
    876         if (bwr.read_consumed > 0) {
    877             mIn.setDataSize(bwr.read_consumed);
    878             mIn.setDataPosition(0);
    879         }
    880         IF_LOG_COMMANDS() {
    881             TextOutput::Bundle _b(alog);
    882             alog << "Remaining data size: " << mOut.dataSize() << endl;
    883             alog << "Received commands from driver: " << indent;
    884             const void* cmds = mIn.data();
    885             const void* end = mIn.data() + mIn.dataSize();
    886             alog << HexDump(cmds, mIn.dataSize()) << endl;
    887             while (cmds < end) cmds = printReturnCommand(alog, cmds);
    888             alog << dedent;
    889         }
    890         return NO_ERROR;
    891     }
    892 
    893     return err;
    894 }
    895 
    896 status_t IPCThreadState::writeTransactionData(int32_t cmd, uint32_t binderFlags,
    897     int32_t handle, uint32_t code, const Parcel& data, status_t* statusBuffer)
    898 {
    899     binder_transaction_data tr;
    900 
    901     tr.target.handle = handle;
    902     tr.code = code;
    903     tr.flags = binderFlags;
    904     tr.cookie = 0;
    905     tr.sender_pid = 0;
    906     tr.sender_euid = 0;
    907 
    908     const status_t err = data.errorCheck();
    909     if (err == NO_ERROR) {
    910         tr.data_size = data.ipcDataSize();
    911         tr.data.ptr.buffer = data.ipcData();
    912         tr.offsets_size = data.ipcObjectsCount()*sizeof(size_t);
    913         tr.data.ptr.offsets = data.ipcObjects();
    914     } else if (statusBuffer) {
    915         tr.flags |= TF_STATUS_CODE;
    916         *statusBuffer = err;
    917         tr.data_size = sizeof(status_t);
    918         tr.data.ptr.buffer = statusBuffer;
    919         tr.offsets_size = 0;
    920         tr.data.ptr.offsets = NULL;
    921     } else {
    922         return (mLastError = err);
    923     }
    924 
    925     mOut.writeInt32(cmd);
    926     mOut.write(&tr, sizeof(tr));
    927 
    928     return NO_ERROR;
    929 }
    930 
    931 sp<BBinder> the_context_object;
    932 
    933 void setTheContextObject(sp<BBinder> obj)
    934 {
    935     the_context_object = obj;
    936 }
    937 
    938 status_t IPCThreadState::executeCommand(int32_t cmd)
    939 {
    940     BBinder* obj;
    941     RefBase::weakref_type* refs;
    942     status_t result = NO_ERROR;
    943 
    944     switch (cmd) {
    945     case BR_ERROR:
    946         result = mIn.readInt32();
    947         break;
    948 
    949     case BR_OK:
    950         break;
    951 
    952     case BR_ACQUIRE:
    953         refs = (RefBase::weakref_type*)mIn.readInt32();
    954         obj = (BBinder*)mIn.readInt32();
    955         ALOG_ASSERT(refs->refBase() == obj,
    956                    "BR_ACQUIRE: object %p does not match cookie %p (expected %p)",
    957                    refs, obj, refs->refBase());
    958         obj->incStrong(mProcess.get());
    959         IF_LOG_REMOTEREFS() {
    960             LOG_REMOTEREFS("BR_ACQUIRE from driver on %p", obj);
    961             obj->printRefs();
    962         }
    963         mOut.writeInt32(BC_ACQUIRE_DONE);
    964         mOut.writeInt32((int32_t)refs);
    965         mOut.writeInt32((int32_t)obj);
    966         break;
    967 
    968     case BR_RELEASE:
    969         refs = (RefBase::weakref_type*)mIn.readInt32();
    970         obj = (BBinder*)mIn.readInt32();
    971         ALOG_ASSERT(refs->refBase() == obj,
    972                    "BR_RELEASE: object %p does not match cookie %p (expected %p)",
    973                    refs, obj, refs->refBase());
    974         IF_LOG_REMOTEREFS() {
    975             LOG_REMOTEREFS("BR_RELEASE from driver on %p", obj);
    976             obj->printRefs();
    977         }
    978         mPendingStrongDerefs.push(obj);
    979         break;
    980 
    981     case BR_INCREFS:
    982         refs = (RefBase::weakref_type*)mIn.readInt32();
    983         obj = (BBinder*)mIn.readInt32();
    984         refs->incWeak(mProcess.get());
    985         mOut.writeInt32(BC_INCREFS_DONE);
    986         mOut.writeInt32((int32_t)refs);
    987         mOut.writeInt32((int32_t)obj);
    988         break;
    989 
    990     case BR_DECREFS:
    991         refs = (RefBase::weakref_type*)mIn.readInt32();
    992         obj = (BBinder*)mIn.readInt32();
    993         // NOTE: This assertion is not valid, because the object may no
    994         // longer exist (thus the (BBinder*)cast above resulting in a different
    995         // memory address).
    996         //ALOG_ASSERT(refs->refBase() == obj,
    997         //           "BR_DECREFS: object %p does not match cookie %p (expected %p)",
    998         //           refs, obj, refs->refBase());
    999         mPendingWeakDerefs.push(refs);
   1000         break;
   1001 
   1002     case BR_ATTEMPT_ACQUIRE:
   1003         refs = (RefBase::weakref_type*)mIn.readInt32();
   1004         obj = (BBinder*)mIn.readInt32();
   1005 
   1006         {
   1007             const bool success = refs->attemptIncStrong(mProcess.get());
   1008             ALOG_ASSERT(success && refs->refBase() == obj,
   1009                        "BR_ATTEMPT_ACQUIRE: object %p does not match cookie %p (expected %p)",
   1010                        refs, obj, refs->refBase());
   1011 
   1012             mOut.writeInt32(BC_ACQUIRE_RESULT);
   1013             mOut.writeInt32((int32_t)success);
   1014         }
   1015         break;
   1016 
   1017     case BR_TRANSACTION:
   1018         {
   1019             binder_transaction_data tr;
   1020             result = mIn.read(&tr, sizeof(tr));
   1021             ALOG_ASSERT(result == NO_ERROR,
   1022                 "Not enough command data for brTRANSACTION");
   1023             if (result != NO_ERROR) break;
   1024 
   1025             Parcel buffer;
   1026             buffer.ipcSetDataReference(
   1027                 reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer),
   1028                 tr.data_size,
   1029                 reinterpret_cast<const size_t*>(tr.data.ptr.offsets),
   1030                 tr.offsets_size/sizeof(size_t), freeBuffer, this);
   1031 
   1032             const pid_t origPid = mCallingPid;
   1033             const uid_t origUid = mCallingUid;
   1034 
   1035             mCallingPid = tr.sender_pid;
   1036             mCallingUid = tr.sender_euid;
   1037 
   1038             int curPrio = getpriority(PRIO_PROCESS, mMyThreadId);
   1039             if (gDisableBackgroundScheduling) {
   1040                 if (curPrio > ANDROID_PRIORITY_NORMAL) {
   1041                     // We have inherited a reduced priority from the caller, but do not
   1042                     // want to run in that state in this process.  The driver set our
   1043                     // priority already (though not our scheduling class), so bounce
   1044                     // it back to the default before invoking the transaction.
   1045                     setpriority(PRIO_PROCESS, mMyThreadId, ANDROID_PRIORITY_NORMAL);
   1046                 }
   1047             } else {
   1048                 if (curPrio >= ANDROID_PRIORITY_BACKGROUND) {
   1049                     // We want to use the inherited priority from the caller.
   1050                     // Ensure this thread is in the background scheduling class,
   1051                     // since the driver won't modify scheduling classes for us.
   1052                     // The scheduling group is reset to default by the caller
   1053                     // once this method returns after the transaction is complete.
   1054                     set_sched_policy(mMyThreadId, SP_BACKGROUND);
   1055                 }
   1056             }
   1057 
   1058             //ALOGI(">>>> TRANSACT from pid %d uid %d\n", mCallingPid, mCallingUid);
   1059 
   1060             Parcel reply;
   1061             IF_LOG_TRANSACTIONS() {
   1062                 TextOutput::Bundle _b(alog);
   1063                 alog << "BR_TRANSACTION thr " << (void*)pthread_self()
   1064                     << " / obj " << tr.target.ptr << " / code "
   1065                     << TypeCode(tr.code) << ": " << indent << buffer
   1066                     << dedent << endl
   1067                     << "Data addr = "
   1068                     << reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer)
   1069                     << ", offsets addr="
   1070                     << reinterpret_cast<const size_t*>(tr.data.ptr.offsets) << endl;
   1071             }
   1072             if (tr.target.ptr) {
   1073                 sp<BBinder> b((BBinder*)tr.cookie);
   1074                 const status_t error = b->transact(tr.code, buffer, &reply, tr.flags);
   1075                 if (error < NO_ERROR) reply.setError(error);
   1076 
   1077             } else {
   1078                 const status_t error = the_context_object->transact(tr.code, buffer, &reply, tr.flags);
   1079                 if (error < NO_ERROR) reply.setError(error);
   1080             }
   1081 
   1082             //ALOGI("<<<< TRANSACT from pid %d restore pid %d uid %d\n",
   1083             //     mCallingPid, origPid, origUid);
   1084 
   1085             if ((tr.flags & TF_ONE_WAY) == 0) {
   1086                 LOG_ONEWAY("Sending reply to %d!", mCallingPid);
   1087                 sendReply(reply, 0);
   1088             } else {
   1089                 LOG_ONEWAY("NOT sending reply to %d!", mCallingPid);
   1090             }
   1091 
   1092             mCallingPid = origPid;
   1093             mCallingUid = origUid;
   1094 
   1095             IF_LOG_TRANSACTIONS() {
   1096                 TextOutput::Bundle _b(alog);
   1097                 alog << "BC_REPLY thr " << (void*)pthread_self() << " / obj "
   1098                     << tr.target.ptr << ": " << indent << reply << dedent << endl;
   1099             }
   1100 
   1101         }
   1102         break;
   1103 
   1104     case BR_DEAD_BINDER:
   1105         {
   1106             BpBinder *proxy = (BpBinder*)mIn.readInt32();
   1107             proxy->sendObituary();
   1108             mOut.writeInt32(BC_DEAD_BINDER_DONE);
   1109             mOut.writeInt32((int32_t)proxy);
   1110         } break;
   1111 
   1112     case BR_CLEAR_DEATH_NOTIFICATION_DONE:
   1113         {
   1114             BpBinder *proxy = (BpBinder*)mIn.readInt32();
   1115             proxy->getWeakRefs()->decWeak(proxy);
   1116         } break;
   1117 
   1118     case BR_FINISHED:
   1119         result = TIMED_OUT;
   1120         break;
   1121 
   1122     case BR_NOOP:
   1123         break;
   1124 
   1125     case BR_SPAWN_LOOPER:
   1126         mProcess->spawnPooledThread(false);
   1127         break;
   1128 
   1129     default:
   1130         printf("*** BAD COMMAND %d received from Binder driver\n", cmd);
   1131         result = UNKNOWN_ERROR;
   1132         break;
   1133     }
   1134 
   1135     if (result != NO_ERROR) {
   1136         mLastError = result;
   1137     }
   1138 
   1139     return result;
   1140 }
   1141 
   1142 void IPCThreadState::threadDestructor(void *st)
   1143 {
   1144         IPCThreadState* const self = static_cast<IPCThreadState*>(st);
   1145         if (self) {
   1146                 self->flushCommands();
   1147 #if defined(HAVE_ANDROID_OS)
   1148         if (self->mProcess->mDriverFD > 0) {
   1149             ioctl(self->mProcess->mDriverFD, BINDER_THREAD_EXIT, 0);
   1150         }
   1151 #endif
   1152                 delete self;
   1153         }
   1154 }
   1155 
   1156 
   1157 void IPCThreadState::freeBuffer(Parcel* parcel, const uint8_t* data, size_t dataSize,
   1158                                 const size_t* objects, size_t objectsSize,
   1159                                 void* cookie)
   1160 {
   1161     //ALOGI("Freeing parcel %p", &parcel);
   1162     IF_LOG_COMMANDS() {
   1163         alog << "Writing BC_FREE_BUFFER for " << data << endl;
   1164     }
   1165     ALOG_ASSERT(data != NULL, "Called with NULL data");
   1166     if (parcel != NULL) parcel->closeFileDescriptors();
   1167     IPCThreadState* state = self();
   1168     state->mOut.writeInt32(BC_FREE_BUFFER);
   1169     state->mOut.writeInt32((int32_t)data);
   1170 }
   1171 
   1172 }; // namespace android
   1173