blob: 8c232f0cd0dc2c6c935eda3f386a44632e08883c [file] [log] [blame]
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -08001/*
2 * Copyright (C) 2008 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
Elliott Hughes8e9aeb92017-11-10 10:22:07 -080017#include <cutils/ashmem.h>
18
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080019/*
20 * Implementation of the user-space ashmem API for devices, which have our
21 * ashmem-enabled kernel. See ashmem-sim.c for the "fake" tmp-based version,
22 * used by the simulator.
23 */
Mark Salyzyne37111d2016-02-02 09:19:39 -080024#define LOG_TAG "ashmem"
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080025
Mark Salyzync2d8aad2016-02-02 08:05:54 -080026#include <errno.h>
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080027#include <fcntl.h>
Mark Salyzyn23ed4c22016-09-28 13:33:27 -070028#include <linux/ashmem.h>
Joel Fernandes51944042018-12-18 13:32:31 -080029#include <linux/memfd.h>
30#include <log/log.h>
Mark Salyzyn1186f3a2016-02-02 08:21:32 -080031#include <pthread.h>
Joel Fernandes51944042018-12-18 13:32:31 -080032#include <stdio.h>
Mark Salyzync2d8aad2016-02-02 08:05:54 -080033#include <string.h>
34#include <sys/ioctl.h>
Joel Fernandes51944042018-12-18 13:32:31 -080035#include <sys/mman.h>
Mark Salyzync2d8aad2016-02-02 08:05:54 -080036#include <sys/stat.h>
Joel Fernandes51944042018-12-18 13:32:31 -080037#include <sys/syscall.h>
Elliott Hughesd77b5372017-05-17 11:36:51 -070038#include <sys/sysmacros.h>
Mark Salyzync2d8aad2016-02-02 08:05:54 -080039#include <sys/types.h>
40#include <unistd.h>
Joel Fernandes51944042018-12-18 13:32:31 -080041
Tri Vo92fd3ca2019-09-24 14:06:38 -070042#include <android-base/file.h>
Joel Fernandes51944042018-12-18 13:32:31 -080043#include <android-base/properties.h>
Tri Vo92fd3ca2019-09-24 14:06:38 -070044#include <android-base/strings.h>
Joel Fernandes51944042018-12-18 13:32:31 -080045#include <android-base/unique_fd.h>
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -080046
Joel Fernandes51944042018-12-18 13:32:31 -080047/* Will be added to UAPI once upstream change is merged */
48#define F_SEAL_FUTURE_WRITE 0x0010
49
50/*
51 * The minimum vendor API level at and after which it is safe to use memfd.
52 * This is to facilitate deprecation of ashmem.
53 */
54#define MIN_MEMFD_VENDOR_API_LEVEL 29
55#define MIN_MEMFD_VENDOR_API_LEVEL_CHAR 'Q'
56
Mark Salyzyn1186f3a2016-02-02 08:21:32 -080057/* ashmem identity */
58static dev_t __ashmem_rdev;
59/*
60 * If we trigger a signal handler in the middle of locked activity and the
61 * signal handler calls ashmem, we could get into a deadlock state.
62 */
63static pthread_mutex_t __ashmem_lock = PTHREAD_MUTEX_INITIALIZER;
64
Tri Vo2891ba02019-01-28 17:56:43 -080065/*
Joel Fernandes51944042018-12-18 13:32:31 -080066 * has_memfd_support() determines if the device can use memfd. memfd support
67 * has been there for long time, but certain things in it may be missing. We
68 * check for needed support in it. Also we check if the VNDK version of
69 * libcutils being used is new enough, if its not, then we cannot use memfd
70 * since the older copies may be using ashmem so we just use ashmem. Once all
71 * Android devices that are getting updates are new enough (ex, they were
72 * originally shipped with Android release > P), then we can just use memfd and
73 * delete all ashmem code from libcutils (while preserving the interface).
74 *
75 * NOTE:
76 * The sys.use_memfd property is set by default to false in Android
77 * to temporarily disable memfd, till vendor and apps are ready for it.
78 * The main issue: either apps or vendor processes can directly make ashmem
79 * IOCTLs on FDs they receive by assuming they are ashmem, without going
80 * through libcutils. Such fds could have very well be originally created with
81 * libcutils hence they could be memfd. Thus the IOCTLs will break.
82 *
83 * Set default value of sys.use_memfd property to true once the issue is
84 * resolved, so that the code can then self-detect if kernel support is present
85 * on the device. The property can also set to true from adb shell, for
86 * debugging.
87 */
88
89static bool debug_log = false; /* set to true for verbose logging and other debug */
90static bool pin_deprecation_warn = true; /* Log the pin deprecation warning only once */
91
92/* Determine if vendor processes would be ok with memfd in the system:
93 *
94 * If VNDK is using older libcutils, don't use memfd. This is so that the
95 * same shared memory mechanism is used across binder transactions between
96 * vendor partition processes and system partition processes.
97 */
98static bool check_vendor_memfd_allowed() {
99 std::string vndk_version = android::base::GetProperty("ro.vndk.version", "");
100
101 if (vndk_version == "") {
102 ALOGE("memfd: ro.vndk.version not defined or invalid (%s), this is mandated since P.\n",
103 vndk_version.c_str());
104 return false;
105 }
106
107 /* No issues if vendor is targetting current Dessert */
108 if (vndk_version == "current") {
109 return false;
110 }
111
112 /* Check if VNDK version is a number and act on it */
113 char* p;
114 long int vers = strtol(vndk_version.c_str(), &p, 10);
115 if (*p == 0) {
116 if (vers < MIN_MEMFD_VENDOR_API_LEVEL) {
117 ALOGI("memfd: device VNDK version (%s) is < Q so using ashmem.\n",
118 vndk_version.c_str());
119 return false;
120 }
121
122 return true;
123 }
124
125 /* If its not a number, assume string, but check if its a sane string */
126 if (tolower(vndk_version[0]) < 'a' || tolower(vndk_version[0]) > 'z') {
127 ALOGE("memfd: ro.vndk.version not defined or invalid (%s), this is mandated since P.\n",
128 vndk_version.c_str());
129 return false;
130 }
131
132 if (tolower(vndk_version[0]) < tolower(MIN_MEMFD_VENDOR_API_LEVEL_CHAR)) {
133 ALOGI("memfd: device is using VNDK version (%s) which is less than Q. Use ashmem only.\n",
134 vndk_version.c_str());
135 return false;
136 }
137
138 return true;
139}
140
141
142/* Determine if memfd can be supported. This is just one-time hardwork
143 * which will be cached by the caller.
144 */
145static bool __has_memfd_support() {
146 if (check_vendor_memfd_allowed() == false) {
147 return false;
148 }
149
150 /* Used to turn on/off the detection at runtime, in the future this
151 * property will be removed once we switch everything over to ashmem.
152 * Currently it is used only for debugging to switch the system over.
153 */
154 if (!android::base::GetBoolProperty("sys.use_memfd", false)) {
155 if (debug_log) {
156 ALOGD("sys.use_memfd=false so memfd disabled\n");
157 }
158 return false;
159 }
160
161 /* Check if kernel support exists, otherwise fall back to ashmem */
162 android::base::unique_fd fd(
163 syscall(__NR_memfd_create, "test_android_memfd", MFD_ALLOW_SEALING));
164 if (fd == -1) {
165 ALOGE("memfd_create failed: %s, no memfd support.\n", strerror(errno));
166 return false;
167 }
168
169 if (fcntl(fd, F_ADD_SEALS, F_SEAL_FUTURE_WRITE) == -1) {
170 ALOGE("fcntl(F_ADD_SEALS) failed: %s, no memfd support.\n", strerror(errno));
171 return false;
172 }
173
174 if (debug_log) {
175 ALOGD("memfd: device has memfd support, using it\n");
176 }
177 return true;
178}
179
180static bool has_memfd_support() {
181 /* memfd_supported is the initial global per-process state of what is known
182 * about memfd.
183 */
184 static bool memfd_supported = __has_memfd_support();
185
186 return memfd_supported;
187}
188
Tri Vo92fd3ca2019-09-24 14:06:38 -0700189static std::string get_ashmem_device_path() {
190 static const std::string boot_id_path = "/proc/sys/kernel/random/boot_id";
191 std::string boot_id;
192 if (!android::base::ReadFileToString(boot_id_path, &boot_id)) {
193 ALOGE("Failed to read %s: %s.\n", boot_id_path.c_str(), strerror(errno));
194 return "";
195 };
196 boot_id = android::base::Trim(boot_id);
197
198 return "/dev/ashmem" + boot_id;
199}
200
Mark Salyzyn1186f3a2016-02-02 08:21:32 -0800201/* logistics of getting file descriptor for ashmem */
202static int __ashmem_open_locked()
203{
Tri Vo92fd3ca2019-09-24 14:06:38 -0700204 static const std::string ashmem_device_path = get_ashmem_device_path();
205
Tri Vo92fd3ca2019-09-24 14:06:38 -0700206 if (ashmem_device_path.empty()) {
207 return -1;
Tim Murray8879ed72019-04-04 09:16:32 -0700208 }
209
Tri Vo92fd3ca2019-09-24 14:06:38 -0700210 int fd = TEMP_FAILURE_RETRY(open(ashmem_device_path.c_str(), O_RDWR | O_CLOEXEC));
Steven Moreland4f99dd32020-01-09 14:42:32 -0800211
212 // fallback for APEX w/ use_vendor on Q, which would have still used /dev/ashmem
213 if (fd < 0) {
214 fd = TEMP_FAILURE_RETRY(open("/dev/ashmem", O_RDWR | O_CLOEXEC));
215 }
216
Mark Salyzyn1186f3a2016-02-02 08:21:32 -0800217 if (fd < 0) {
218 return fd;
219 }
220
Steven Moreland4f99dd32020-01-09 14:42:32 -0800221 struct stat st;
222 int ret = TEMP_FAILURE_RETRY(fstat(fd, &st));
Mark Salyzyn1186f3a2016-02-02 08:21:32 -0800223 if (ret < 0) {
224 int save_errno = errno;
225 close(fd);
226 errno = save_errno;
227 return ret;
228 }
229 if (!S_ISCHR(st.st_mode) || !st.st_rdev) {
230 close(fd);
231 errno = ENOTTY;
232 return -1;
233 }
234
235 __ashmem_rdev = st.st_rdev;
236 return fd;
237}
238
239static int __ashmem_open()
240{
241 int fd;
242
243 pthread_mutex_lock(&__ashmem_lock);
244 fd = __ashmem_open_locked();
245 pthread_mutex_unlock(&__ashmem_lock);
246
247 return fd;
248}
249
250/* Make sure file descriptor references ashmem, negative number means false */
Mark Salyzynee431112016-08-23 13:58:37 -0700251static int __ashmem_is_ashmem(int fd, int fatal)
Mark Salyzyn1186f3a2016-02-02 08:21:32 -0800252{
253 dev_t rdev;
254 struct stat st;
255
Joel Fernandes56cd6512018-07-17 13:00:17 -0700256 if (fstat(fd, &st) < 0) {
Mark Salyzyn1186f3a2016-02-02 08:21:32 -0800257 return -1;
258 }
259
Mark Salyzyne37111d2016-02-02 09:19:39 -0800260 rdev = 0; /* Too much complexity to sniff __ashmem_rdev */
Mark Salyzyn1186f3a2016-02-02 08:21:32 -0800261 if (S_ISCHR(st.st_mode) && st.st_rdev) {
262 pthread_mutex_lock(&__ashmem_lock);
263 rdev = __ashmem_rdev;
264 if (rdev) {
265 pthread_mutex_unlock(&__ashmem_lock);
266 } else {
267 int fd = __ashmem_open_locked();
268 if (fd < 0) {
269 pthread_mutex_unlock(&__ashmem_lock);
270 return -1;
271 }
272 rdev = __ashmem_rdev;
273 pthread_mutex_unlock(&__ashmem_lock);
274
275 close(fd);
276 }
277
278 if (st.st_rdev == rdev) {
279 return 0;
280 }
281 }
282
Mark Salyzynee431112016-08-23 13:58:37 -0700283 if (fatal) {
284 if (rdev) {
285 LOG_ALWAYS_FATAL("illegal fd=%d mode=0%o rdev=%d:%d expected 0%o %d:%d",
286 fd, st.st_mode, major(st.st_rdev), minor(st.st_rdev),
287 S_IFCHR | S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IRGRP,
288 major(rdev), minor(rdev));
289 } else {
290 LOG_ALWAYS_FATAL("illegal fd=%d mode=0%o rdev=%d:%d expected 0%o",
291 fd, st.st_mode, major(st.st_rdev), minor(st.st_rdev),
292 S_IFCHR | S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IRGRP);
293 }
294 /* NOTREACHED */
Mark Salyzyne37111d2016-02-02 09:19:39 -0800295 }
296
Mark Salyzyn1186f3a2016-02-02 08:21:32 -0800297 errno = ENOTTY;
298 return -1;
299}
300
Joel Fernandes56cd6512018-07-17 13:00:17 -0700301static int __ashmem_check_failure(int fd, int result)
302{
303 if (result == -1 && errno == ENOTTY) __ashmem_is_ashmem(fd, 1);
304 return result;
305}
306
Joel Fernandes51944042018-12-18 13:32:31 -0800307static bool memfd_is_ashmem(int fd) {
308 static bool fd_check_error_once = false;
309
310 if (__ashmem_is_ashmem(fd, 0) == 0) {
311 if (!fd_check_error_once) {
312 ALOGE("memfd: memfd expected but ashmem fd used - please use libcutils.\n");
313 fd_check_error_once = true;
314 }
315
316 return true;
317 }
318
319 return false;
320}
321
Mark Salyzynee431112016-08-23 13:58:37 -0700322int ashmem_valid(int fd)
323{
Joel Fernandes51944042018-12-18 13:32:31 -0800324 if (has_memfd_support() && !memfd_is_ashmem(fd)) {
325 return 1;
326 }
327
Mark Salyzynee431112016-08-23 13:58:37 -0700328 return __ashmem_is_ashmem(fd, 0) >= 0;
329}
330
Joel Fernandes51944042018-12-18 13:32:31 -0800331static int memfd_create_region(const char* name, size_t size) {
332 android::base::unique_fd fd(syscall(__NR_memfd_create, name, MFD_ALLOW_SEALING));
333
334 if (fd == -1) {
335 ALOGE("memfd_create(%s, %zd) failed: %s\n", name, size, strerror(errno));
336 return -1;
337 }
338
339 if (ftruncate(fd, size) == -1) {
340 ALOGE("ftruncate(%s, %zd) failed for memfd creation: %s\n", name, size, strerror(errno));
341 return -1;
342 }
343
344 if (debug_log) {
345 ALOGE("memfd_create(%s, %zd) success. fd=%d\n", name, size, fd.get());
346 }
347 return fd.release();
348}
349
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800350/*
351 * ashmem_create_region - creates a new ashmem region and returns the file
352 * descriptor, or <0 on error
353 *
354 * `name' is an optional label to give the region (visible in /proc/pid/maps)
355 * `size' is the size of the region, in page-aligned bytes
356 */
357int ashmem_create_region(const char *name, size_t size)
358{
Mark Salyzync2d8aad2016-02-02 08:05:54 -0800359 int ret, save_errno;
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800360
Joel Fernandes51944042018-12-18 13:32:31 -0800361 if (has_memfd_support()) {
362 return memfd_create_region(name ? name : "none", size);
363 }
364
Mark Salyzyn1186f3a2016-02-02 08:21:32 -0800365 int fd = __ashmem_open();
Mark Salyzync2d8aad2016-02-02 08:05:54 -0800366 if (fd < 0) {
367 return fd;
368 }
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800369
Mark Salyzync2d8aad2016-02-02 08:05:54 -0800370 if (name) {
371 char buf[ASHMEM_NAME_LEN] = {0};
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800372
Mark Salyzync2d8aad2016-02-02 08:05:54 -0800373 strlcpy(buf, name, sizeof(buf));
374 ret = TEMP_FAILURE_RETRY(ioctl(fd, ASHMEM_SET_NAME, buf));
375 if (ret < 0) {
376 goto error;
377 }
378 }
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800379
Mark Salyzync2d8aad2016-02-02 08:05:54 -0800380 ret = TEMP_FAILURE_RETRY(ioctl(fd, ASHMEM_SET_SIZE, size));
381 if (ret < 0) {
382 goto error;
383 }
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800384
Mark Salyzync2d8aad2016-02-02 08:05:54 -0800385 return fd;
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800386
387error:
Mark Salyzync2d8aad2016-02-02 08:05:54 -0800388 save_errno = errno;
389 close(fd);
390 errno = save_errno;
391 return ret;
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800392}
393
Joel Fernandes51944042018-12-18 13:32:31 -0800394static int memfd_set_prot_region(int fd, int prot) {
395 /* Only proceed if an fd needs to be write-protected */
396 if (prot & PROT_WRITE) {
397 return 0;
398 }
399
400 if (fcntl(fd, F_ADD_SEALS, F_SEAL_FUTURE_WRITE) == -1) {
401 ALOGE("memfd_set_prot_region(%d, %d): F_SEAL_FUTURE_WRITE seal failed: %s\n", fd, prot,
402 strerror(errno));
403 return -1;
404 }
405
406 return 0;
407}
408
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800409int ashmem_set_prot_region(int fd, int prot)
410{
Joel Fernandes51944042018-12-18 13:32:31 -0800411 if (has_memfd_support() && !memfd_is_ashmem(fd)) {
412 return memfd_set_prot_region(fd, prot);
413 }
414
Joel Fernandes56cd6512018-07-17 13:00:17 -0700415 return __ashmem_check_failure(fd, TEMP_FAILURE_RETRY(ioctl(fd, ASHMEM_SET_PROT_MASK, prot)));
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800416}
417
418int ashmem_pin_region(int fd, size_t offset, size_t len)
419{
Joel Fernandes51944042018-12-18 13:32:31 -0800420 if (!pin_deprecation_warn || debug_log) {
421 ALOGE("Pinning is deprecated since Android Q. Please use trim or other methods.\n");
422 pin_deprecation_warn = true;
423 }
424
425 if (has_memfd_support() && !memfd_is_ashmem(fd)) {
426 return 0;
427 }
428
Elliott Hughes8e9aeb92017-11-10 10:22:07 -0800429 // TODO: should LP64 reject too-large offset/len?
430 ashmem_pin pin = { static_cast<uint32_t>(offset), static_cast<uint32_t>(len) };
Joel Fernandes56cd6512018-07-17 13:00:17 -0700431 return __ashmem_check_failure(fd, TEMP_FAILURE_RETRY(ioctl(fd, ASHMEM_PIN, &pin)));
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800432}
433
434int ashmem_unpin_region(int fd, size_t offset, size_t len)
435{
Joel Fernandes51944042018-12-18 13:32:31 -0800436 if (!pin_deprecation_warn || debug_log) {
437 ALOGE("Pinning is deprecated since Android Q. Please use trim or other methods.\n");
438 pin_deprecation_warn = true;
439 }
440
441 if (has_memfd_support() && !memfd_is_ashmem(fd)) {
442 return 0;
443 }
444
Elliott Hughes8e9aeb92017-11-10 10:22:07 -0800445 // TODO: should LP64 reject too-large offset/len?
446 ashmem_pin pin = { static_cast<uint32_t>(offset), static_cast<uint32_t>(len) };
Joel Fernandes56cd6512018-07-17 13:00:17 -0700447 return __ashmem_check_failure(fd, TEMP_FAILURE_RETRY(ioctl(fd, ASHMEM_UNPIN, &pin)));
The Android Open Source Projectdd7bc332009-03-03 19:32:55 -0800448}
Bjorn Bringert7be52b12009-06-02 00:41:09 +0100449
450int ashmem_get_size_region(int fd)
451{
Joel Fernandes51944042018-12-18 13:32:31 -0800452 if (has_memfd_support() && !memfd_is_ashmem(fd)) {
453 struct stat sb;
454
455 if (fstat(fd, &sb) == -1) {
456 ALOGE("ashmem_get_size_region(%d): fstat failed: %s\n", fd, strerror(errno));
457 return -1;
458 }
459
460 if (debug_log) {
461 ALOGD("ashmem_get_size_region(%d): %d\n", fd, static_cast<int>(sb.st_size));
462 }
463
464 return sb.st_size;
465 }
466
Joel Fernandes56cd6512018-07-17 13:00:17 -0700467 return __ashmem_check_failure(fd, TEMP_FAILURE_RETRY(ioctl(fd, ASHMEM_GET_SIZE, NULL)));
Bjorn Bringert7be52b12009-06-02 00:41:09 +0100468}