| // Copyright 2015 The Chromium OS Authors. All rights reserved. |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #include "libprotobinder/binder_manager.h" |
| |
| #include <base/bind.h> |
| #include <base/logging.h> |
| #include <base/strings/stringprintf.h> |
| |
| #include "libprotobinder/binder_driver.h" |
| #include "libprotobinder/binder_host.h" |
| #include "libprotobinder/binder_proxy.h" |
| #include "libprotobinder/iinterface.h" |
| |
| // Generated IDL |
| #include "libprotobinder/binder.pb.h" |
| |
| namespace protobinder { |
| |
| namespace { |
| |
| BinderManagerInterface* g_binder_manager = nullptr; |
| |
| } // namespace |
| |
| // static |
| BinderManagerInterface* BinderManagerInterface::Get() { |
| if (!g_binder_manager) { |
| std::unique_ptr<BinderDriver> driver(new BinderDriver()); |
| driver->Init(); |
| g_binder_manager = new BinderManager(std::move(driver)); |
| } |
| return g_binder_manager; |
| } |
| |
| // static |
| void BinderManagerInterface::SetForTesting( |
| scoped_ptr<BinderManagerInterface> manager) { |
| if (g_binder_manager) |
| delete g_binder_manager; |
| g_binder_manager = manager.release(); |
| } |
| |
| void BinderManager::ReleaseBinderBuffer(const uint8_t* data) { |
| VLOG(1) << "Binder free"; |
| out_commands_.WriteInt32(BC_FREE_BUFFER); |
| out_commands_.WritePointer(reinterpret_cast<uintptr_t>(data)); |
| } |
| |
| void BinderManager::ReleaseParcel(Parcel* parcel) { |
| // TODO(leecam): Close FDs in Parcel. |
| ReleaseBinderBuffer(reinterpret_cast<const uint8_t*>(parcel->Data())); |
| } |
| |
| // TODO(leecam): Remove the DoBinderReadWriteIoctl |
| // to reduce number of calls to driver |
| void BinderManager::IncWeakHandle(uint32_t handle) { |
| out_commands_.WriteInt32(BC_INCREFS); |
| out_commands_.WriteInt32(handle); |
| DoBinderReadWriteIoctl(false); |
| } |
| |
| void BinderManager::DecWeakHandle(uint32_t handle) { |
| out_commands_.WriteInt32(BC_DECREFS); |
| out_commands_.WriteInt32(handle); |
| DoBinderReadWriteIoctl(false); |
| } |
| |
| void BinderManager::RequestDeathNotification(BinderProxy* proxy) { |
| DCHECK(proxy); |
| out_commands_.WriteInt32(BC_REQUEST_DEATH_NOTIFICATION); |
| out_commands_.WriteInt32(proxy->handle()); |
| out_commands_.WritePointer(reinterpret_cast<uintptr_t>(proxy)); |
| DoBinderReadWriteIoctl(false); |
| } |
| |
| void BinderManager::ClearDeathNotification(BinderProxy* proxy) { |
| DCHECK(proxy); |
| out_commands_.WriteInt32(BC_CLEAR_DEATH_NOTIFICATION); |
| out_commands_.WriteInt32(proxy->handle()); |
| out_commands_.WritePointer(reinterpret_cast<uintptr_t>(proxy)); |
| DoBinderReadWriteIoctl(false); |
| } |
| |
| IInterface* BinderManager::CreateTestInterface(const IBinder* binder) { |
| return nullptr; |
| } |
| |
| Status BinderManager::SendReply(const Parcel& reply, const Status& status) { |
| if (!status) { |
| Parcel status_reply; |
| status.AddToParcel(&status_reply); |
| SetUpTransaction(true, -1, 0, status_reply, TF_STATUS_CODE); |
| } else { |
| SetUpTransaction(true, -1, 0, reply, 0); |
| } |
| |
| return WaitAndActionReply(NULL); |
| } |
| |
| // Process a single command from binder. |
| void BinderManager::ProcessCommand(uint32_t cmd) { |
| uintptr_t ptr = 0; |
| switch (cmd) { |
| case BR_NOOP: |
| break; |
| case BR_INCREFS: |
| VLOG(1) << "BR_INCREFS"; |
| in_commands_.ReadPointer(&ptr); |
| in_commands_.ReadPointer(&ptr); |
| break; |
| case BR_DECREFS: |
| VLOG(1) << "BR_DECREFS"; |
| in_commands_.ReadPointer(&ptr); |
| in_commands_.ReadPointer(&ptr); |
| break; |
| case BR_ACQUIRE: |
| VLOG(1) << "BR_ACQUIRE"; |
| in_commands_.ReadPointer(&ptr); |
| in_commands_.ReadPointer(&ptr); |
| break; |
| case BR_RELEASE: |
| VLOG(1) << "BR_RELEASE"; |
| in_commands_.ReadPointer(&ptr); |
| in_commands_.ReadPointer(&ptr); |
| break; |
| case BR_DEAD_BINDER: |
| VLOG(1) << "BR_DEAD_BINDER"; |
| in_commands_.ReadPointer(&ptr); |
| if (ptr) |
| reinterpret_cast<BinderProxy*>(ptr)->HandleDeathNotification(); |
| break; |
| case BR_CLEAR_DEATH_NOTIFICATION_DONE: |
| VLOG(1) << "BR_CLEAR_DEATH_NOTIFICATION_DONE"; |
| in_commands_.ReadPointer(&ptr); |
| break; |
| case BR_OK: |
| VLOG(1) << "BR_OK"; |
| break; |
| case BR_ERROR: { |
| VLOG(1) << "BR_ERROR"; |
| uint32_t error_code = 0; |
| in_commands_.ReadUInt32(&error_code); |
| LOG(ERROR) << "Received BR_ERROR code " << error_code; |
| } break; |
| case BR_TRANSACTION: { |
| VLOG(1) << "BR_TRANSACTION"; |
| binder_transaction_data tr; |
| if (!in_commands_.Read(&tr, sizeof(tr))) |
| LOG(FATAL) << "Binder Transaction contains no data"; |
| |
| Parcel data; |
| if (!data.InitFromBinderTransaction( |
| reinterpret_cast<void*>(tr.data.ptr.buffer), tr.data_size, |
| reinterpret_cast<binder_size_t*>(tr.data.ptr.offsets), |
| tr.offsets_size, base::Bind(&BinderManager::ReleaseParcel, |
| weak_ptr_factory_.GetWeakPtr()))) { |
| LOG(ERROR) << "Failed to create parcel from Transaction"; |
| break; |
| } |
| |
| Parcel reply; |
| // TODO(leecam): This code get refactored in memory CL, |
| // so leave the mess until then. |
| Status status = STATUS_OK(); |
| if (tr.target.ptr) { |
| BinderHost* binder(reinterpret_cast<BinderHost*>(tr.cookie)); |
| status = binder->Transact(tr.code, &data, &reply, tr.flags); |
| } |
| if ((tr.flags & TF_ONE_WAY) == 0) |
| SendReply(reply, status); |
| } break; |
| default: |
| LOG(FATAL) << "Unknown binder command " << cmd; |
| } |
| } |
| |
| Status BinderManager::HandleReply(const binder_transaction_data& tr, |
| Parcel* reply) { |
| DCHECK(reply); |
| |
| if ((tr.flags & TF_STATUS_CODE) == 0) { |
| // This is a successful reply. |
| if (!reply->InitFromBinderTransaction( |
| reinterpret_cast<void*>(tr.data.ptr.buffer), tr.data_size, |
| reinterpret_cast<binder_size_t*>(tr.data.ptr.offsets), |
| tr.offsets_size, base::Bind(&BinderManager::ReleaseParcel, |
| weak_ptr_factory_.GetWeakPtr()))) |
| return STATUS_BINDER_ERROR(Status::BAD_PARCEL); |
| return STATUS_OK(); |
| } |
| // Else this reply contains a Status. |
| Parcel status_parcel; |
| if (!status_parcel.InitFromBinderTransaction( |
| reinterpret_cast<void*>(tr.data.ptr.buffer), tr.data_size, |
| reinterpret_cast<binder_size_t*>(tr.data.ptr.offsets), |
| tr.offsets_size, base::Bind(&BinderManager::ReleaseParcel, |
| weak_ptr_factory_.GetWeakPtr()))) |
| return STATUS_BINDER_ERROR(Status::BAD_PARCEL); |
| |
| return Status(&status_parcel); |
| } |
| |
| Status BinderManager::WaitAndActionReply(Parcel* reply) { |
| // Loop until: |
| // * On error and bail. |
| // * On Transaction Complete if we don't require a reply. |
| // * On reply. |
| while (1) { |
| DoBinderReadWriteIoctl(true); |
| uint32_t cmd = 0; |
| if (!in_commands_.ReadUInt32(&cmd)) { |
| LOG(FATAL) << "Binder Cmd contains no data"; |
| } |
| switch (cmd) { |
| case BR_TRANSACTION_COMPLETE: |
| VLOG(1) << "Cmd BR_TRANSACTION_COMPLETE"; |
| if (!reply) |
| return STATUS_OK(); |
| break; |
| case BR_DEAD_REPLY: |
| VLOG(1) << "Cmd BR_DEAD_REPLY"; |
| return STATUS_BINDER_ERROR(Status::DEAD_ENDPOINT); |
| case BR_FAILED_REPLY: |
| VLOG(1) << "Cmd BR_FAILED_REPLY"; |
| return STATUS_BINDER_ERROR(Status::FAILED_TRANSACTION); |
| case BR_REPLY: { |
| VLOG(1) << "Cmd BR_REPLY"; |
| binder_transaction_data tr; |
| if (!in_commands_.Read(&tr, sizeof(tr))) |
| LOG(FATAL) << "Binder Reply cmd contains no data"; |
| if (!reply) { |
| // We received an unexpected reply. This could be a reply |
| // left over from one-way call, where a reply was actually |
| // returned. Need to free it and continue to loop looking |
| // for a Transaction Complete. |
| ReleaseBinderBuffer( |
| reinterpret_cast<const uint8_t*>(tr.data.ptr.buffer)); |
| LOG(WARNING) << "Received unexpected reply"; |
| break; |
| } |
| return HandleReply(tr, reply); |
| } |
| default: |
| ProcessCommand(cmd); |
| } |
| } |
| NOTREACHED(); |
| } |
| |
| void BinderManager::SetUpTransaction(bool is_reply, |
| uint32_t handle, |
| uint32_t code, |
| const Parcel& data, |
| uint32_t flags) { |
| binder_transaction_data tr; |
| |
| tr.target.ptr = 0; |
| tr.target.handle = handle; |
| tr.code = code; |
| tr.flags = flags; |
| tr.cookie = 0; |
| |
| tr.sender_pid = 0; |
| tr.sender_euid = 0; |
| |
| tr.data_size = data.Len(); |
| tr.data.ptr.buffer = reinterpret_cast<binder_uintptr_t>(data.Data()); |
| tr.offsets_size = data.ObjectCount() * sizeof(binder_size_t); |
| tr.data.ptr.offsets = reinterpret_cast<binder_uintptr_t>(data.ObjectData()); |
| |
| const uint32_t command = is_reply ? BC_REPLY : BC_TRANSACTION; |
| if (!out_commands_.WriteInt32(command)) |
| LOG(FATAL) << "binder cmd parcel failure"; |
| if (!out_commands_.Write(&tr, sizeof(tr))) |
| LOG(FATAL) << "binder cmd parcel failure"; |
| } |
| |
| Status BinderManager::Transact(uint32_t handle, |
| uint32_t code, |
| const Parcel& data, |
| Parcel* reply, |
| bool one_way) { |
| int flags = TF_ACCEPT_FDS; |
| if (one_way) { |
| flags |= TF_ONE_WAY; |
| reply = nullptr; |
| } |
| SetUpTransaction(false, handle, code, data, flags); |
| return WaitAndActionReply(reply); |
| } |
| |
| void BinderManager::DoBinderReadWriteIoctl(bool do_read) { |
| // Create a binder_write_read command and send it to binder |
| struct binder_write_read bwr; |
| |
| // Are there commands from binder we still havent processed? |
| const bool outstanding_unprocessed_cmds = !in_commands_.IsEmpty(); |
| |
| // Setup read params |
| if (do_read && !outstanding_unprocessed_cmds) { |
| // Caller requested a read and there is no outstanding data. |
| bwr.read_size = in_commands_.Capacity(); |
| bwr.read_buffer = reinterpret_cast<uintptr_t>(in_commands_.Data()); |
| } else { |
| // If there are unprocessed commands, dont get anymore. |
| bwr.read_size = 0; |
| bwr.read_buffer = 0; |
| } |
| |
| // Setup write params |
| if (do_read && outstanding_unprocessed_cmds) { |
| bwr.write_size = 0; |
| } else { |
| bwr.write_size = out_commands_.Len(); |
| } |
| bwr.write_buffer = reinterpret_cast<uintptr_t>(out_commands_.Data()); |
| |
| bwr.write_consumed = 0; |
| bwr.read_consumed = 0; |
| |
| if ((bwr.write_size == 0) && (bwr.read_size == 0)) { |
| // Nothing to do. |
| return; |
| } |
| if (driver_->ReadWrite(&bwr) < 0) { |
| LOG(FATAL) << "Driver ReadWrite failed"; |
| } |
| VLOG(1) << base::StringPrintf("Binder data R:%lld/%lld W:%lld/%lld", |
| bwr.read_consumed, bwr.read_size, |
| bwr.write_consumed, bwr.write_size); |
| if (bwr.read_consumed > 0) { |
| in_commands_.SetLen(bwr.read_consumed); |
| in_commands_.SetPos(0); |
| } |
| if (bwr.write_consumed > 0) { |
| if (bwr.write_consumed < out_commands_.Len()) { |
| // Didn't take all of our data |
| LOG(FATAL) << "Binder did not consume all data"; |
| } else { |
| out_commands_.SetLen(0); |
| out_commands_.SetPos(0); |
| } |
| in_commands_.SetLen(bwr.read_consumed); |
| in_commands_.SetPos(0); |
| } |
| } |
| |
| bool BinderManager::GetFdForPolling(int* fd) { |
| driver_->SetMaxThreads(0); |
| out_commands_.WriteInt32(BC_ENTER_LOOPER); |
| *fd = driver_->GetFdForPolling(); |
| return true; |
| } |
| |
| void BinderManager::GetNextCommandAndProcess() { |
| DoBinderReadWriteIoctl(true); |
| uint32_t cmd = 0; |
| if (!in_commands_.ReadUInt32(&cmd)) |
| LOG(FATAL) << "Binder driver failed to provide a cmd code"; |
| ProcessCommand(cmd); |
| } |
| |
| void BinderManager::HandleEvent() { |
| // Process all the commands |
| do { |
| GetNextCommandAndProcess(); |
| } while (!in_commands_.IsEmpty()); |
| |
| DoBinderReadWriteIoctl(false); |
| } |
| |
| BinderManager::BinderManager(std::unique_ptr<BinderDriverInterface> driver) |
| : driver_(std::move(driver)), weak_ptr_factory_(this) { |
| VLOG(1) << "BinderManager created"; |
| in_commands_.SetCapacity(256); |
| out_commands_.SetCapacity(256); |
| } |
| |
| BinderManager::~BinderManager() { |
| DoBinderReadWriteIoctl(false); |
| } |
| |
| } // namespace protobinder |