LazyServiceRegistrar: race w/ register & onClients

This is similar to a fix in HIDL. In AIDL, we have more control over
when a threadpool starts, so this race is only possible when someone
configures their services after starting the threadpool:
- a process has a threadpool of size > 1
- it calls register service (but hasn't recorded internally that the
  service is registered)
- another process gets ahold of the service
- servicemanager tells the service it has a client
- the service aborts, because it has no record of registering this
  service

In order to land on sc-dev, where the list of symbols is kept constant,
this also includes the following change:

    sed -i '/ClientCounterCallbackImpl/d' $(find . -name "*.map")

Bug: 191608065
Test: aidl_lazy_test
Change-Id: I9e61a1c958d82035d49eb84e6ae71dba00019c43
Merged-In: I9e61a1c958d82035d49eb84e6ae71dba00019c43
diff --git a/libs/binder/LazyServiceRegistrar.cpp b/libs/binder/LazyServiceRegistrar.cpp
index 6165911..f66993f 100644
--- a/libs/binder/LazyServiceRegistrar.cpp
+++ b/libs/binder/LazyServiceRegistrar.cpp
@@ -40,9 +40,9 @@
 
     void setActiveServicesCallback(const std::function<bool(bool)>& activeServicesCallback);
 
-    bool tryUnregister();
+    bool tryUnregisterLocked();
 
-    void reRegister();
+    void reRegisterLocked();
 
 protected:
     Status onClients(const sp<IBinder>& service, bool clients) override;
@@ -59,6 +59,9 @@
         bool registered = true;
     };
 
+    bool registerServiceLocked(const sp<IBinder>& service, const std::string& name,
+                               bool allowIsolated, int dumpFlags);
+
     /**
      * Looks up a service guaranteed to be registered (service from onClients).
      */
@@ -68,7 +71,7 @@
      * Unregisters all services that we can. If we can't unregister all, re-register other
      * services.
      */
-    void tryShutdown();
+    void tryShutdownLocked();
 
     /**
      * Try to shutdown the process, unless:
@@ -76,7 +79,10 @@
      * - The active services count callback returns 'true', or
      * - Some services have clients.
      */
-    void maybeTryShutdown();
+    void maybeTryShutdownLocked();
+
+    // for below
+    std::mutex mMutex;
 
     // count of services with clients
     size_t mNumConnectedServices;
@@ -117,6 +123,13 @@
 
 bool ClientCounterCallbackImpl::registerService(const sp<IBinder>& service, const std::string& name,
                                             bool allowIsolated, int dumpFlags) {
+    std::lock_guard<std::mutex> lock(mMutex);
+    return registerServiceLocked(service, name, allowIsolated, dumpFlags);
+}
+
+bool ClientCounterCallbackImpl::registerServiceLocked(const sp<IBinder>& service,
+                                                      const std::string& name, bool allowIsolated,
+                                                      int dumpFlags) {
     auto manager = interface_cast<AidlServiceManager>(asBinder(defaultServiceManager()));
 
     bool reRegister = mRegisteredServices.count(name) > 0;
@@ -164,14 +177,15 @@
 }
 
 void ClientCounterCallbackImpl::forcePersist(bool persist) {
+    std::lock_guard<std::mutex> lock(mMutex);
     mForcePersist = persist;
     if (!mForcePersist) {
         // Attempt a shutdown in case the number of clients hit 0 while the flag was on
-        maybeTryShutdown();
+        maybeTryShutdownLocked();
     }
 }
 
-bool ClientCounterCallbackImpl::tryUnregister() {
+bool ClientCounterCallbackImpl::tryUnregisterLocked() {
     auto manager = interface_cast<AidlServiceManager>(asBinder(defaultServiceManager()));
 
     for (auto& [name, entry] : mRegisteredServices) {
@@ -187,15 +201,14 @@
     return true;
 }
 
-void ClientCounterCallbackImpl::reRegister() {
+void ClientCounterCallbackImpl::reRegisterLocked() {
     for (auto& [name, entry] : mRegisteredServices) {
         // re-register entry if not already registered
         if (entry.registered) {
             continue;
         }
 
-        if (!registerService(entry.service, name, entry.allowIsolated,
-                             entry.dumpFlags)) {
+        if (!registerServiceLocked(entry.service, name, entry.allowIsolated, entry.dumpFlags)) {
             // Must restart. Otherwise, clients will never be able to get a hold of this service.
             LOG_ALWAYS_FATAL("Bad state: could not re-register services");
         }
@@ -204,7 +217,7 @@
     }
 }
 
-void ClientCounterCallbackImpl::maybeTryShutdown() {
+void ClientCounterCallbackImpl::maybeTryShutdownLocked() {
     if (mForcePersist) {
         ALOGI("Shutdown prevented by forcePersist override flag.");
         return;
@@ -223,15 +236,12 @@
     // client count change event, try to shutdown the process if its services
     // have no clients.
     if (!handledInCallback && mNumConnectedServices == 0) {
-        tryShutdown();
+        tryShutdownLocked();
     }
 }
 
-/**
- * onClients is oneway, so no need to worry about multi-threading. Note that this means multiple
- * invocations could occur on different threads however.
- */
 Status ClientCounterCallbackImpl::onClients(const sp<IBinder>& service, bool clients) {
+    std::lock_guard<std::mutex> lock(mMutex);
     auto & [name, registered] = *assertRegisteredService(service);
     if (registered.clients == clients) {
         LOG_ALWAYS_FATAL("Process already thought %s had clients: %d but servicemanager has "
@@ -252,23 +262,24 @@
     ALOGI("Process has %zu (of %zu available) client(s) in use after notification %s has clients: %d",
           mNumConnectedServices, mRegisteredServices.size(), name.c_str(), clients);
 
-    maybeTryShutdown();
+    maybeTryShutdownLocked();
     return Status::ok();
 }
 
- void ClientCounterCallbackImpl::tryShutdown() {
-     ALOGI("Trying to shut down the service. No clients in use for any service in process.");
+void ClientCounterCallbackImpl::tryShutdownLocked() {
+    ALOGI("Trying to shut down the service. No clients in use for any service in process.");
 
-    if (tryUnregister()) {
-         ALOGI("Unregistered all clients and exiting");
-         exit(EXIT_SUCCESS);
-     }
+    if (tryUnregisterLocked()) {
+        ALOGI("Unregistered all clients and exiting");
+        exit(EXIT_SUCCESS);
+    }
 
-    reRegister();
+    reRegisterLocked();
 }
 
 void ClientCounterCallbackImpl::setActiveServicesCallback(const std::function<bool(bool)>&
                                                           activeServicesCallback) {
+    std::lock_guard<std::mutex> lock(mMutex);
     mActiveServicesCallback = activeServicesCallback;
 }
 
@@ -291,11 +302,15 @@
 }
 
 bool ClientCounterCallback::tryUnregister() {
-    return mImpl->tryUnregister();
+    // see comments in header, this should only be called from the active
+    // services callback, see also b/191781736
+    return mImpl->tryUnregisterLocked();
 }
 
 void ClientCounterCallback::reRegister() {
-    mImpl->reRegister();
+    // see comments in header, this should only be called from the active
+    // services callback, see also b/191781736
+    mImpl->reRegisterLocked();
 }
 
 }  // namespace internal
diff --git a/libs/binder/include/binder/LazyServiceRegistrar.h b/libs/binder/include/binder/LazyServiceRegistrar.h
index f3ba830..2e22b84 100644
--- a/libs/binder/include/binder/LazyServiceRegistrar.h
+++ b/libs/binder/include/binder/LazyServiceRegistrar.h
@@ -79,9 +79,10 @@
       */
      void setActiveServicesCallback(const std::function<bool(bool)>& activeServicesCallback);
 
-    /**
+     /**
       * Try to unregister all services previously registered with 'registerService'.
-      * Returns 'true' if successful.
+      * Returns 'true' if successful. This should only be called within the callback registered by
+      * setActiveServicesCallback.
       */
      bool tryUnregister();
 
diff --git a/libs/binder/libbinder.arm32.map b/libs/binder/libbinder.arm32.map
index 64fdd91..c8aebb3 100644
--- a/libs/binder/libbinder.arm32.map
+++ b/libs/binder/libbinder.arm32.map
@@ -389,15 +389,6 @@
     _ZN7android6binder8internal21ClientCounterCallback25setActiveServicesCallbackERKNSt3__18functionIFbbEEE;
     _ZN7android6binder8internal21ClientCounterCallbackC1Ev;
     _ZN7android6binder8internal21ClientCounterCallbackC2Ev;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl10reRegisterEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl11tryShutdownEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl12forcePersistEb;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl13tryUnregisterEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl15registerServiceERKNS_2spINS_7IBinderEEERKNSt3__112basic_stringIcNS8_11char_traitsIcEENS8_9allocatorIcEEEEbi;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl16maybeTryShutdownEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl23assertRegisteredServiceERKNS_2spINS_7IBinderEEE;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl25setActiveServicesCallbackERKNSt3__18functionIFbbEEE;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl9onClientsERKNS_2spINS_7IBinderEEEb;
     _ZN7android6Parcel10appendFromEPKS0_jj;
     _ZN7android6Parcel10markForRpcERKNS_2spINS_10RpcSessionEEE;
     _ZN7android6Parcel10writeFloatEf;
@@ -1076,7 +1067,6 @@
     _ZNKSt3__16__treeINS_12__value_typeIN7android8String16ENS_6vectorIxNS_9allocatorIxEEEEEENS_19__map_value_compareIS3_S8_NS_4lessIS3_EELb1EEENS5_IS8_EEE4findIS3_EENS_21__tree_const_iteratorIS8_PNS_11__tree_nodeIS8_PvEEiEERKT_;
     _ZNKSt3__16__treeINS_12__value_typeIN7android8String16ES3_EENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE4findIS3_EENS_21__tree_const_iteratorIS4_PNS_11__tree_nodeIS4_PvEEiEERKT_;
     _ZNKSt3__16__treeINS_12__value_typeIN7android8String16ExEENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE4findIS3_EENS_21__tree_const_iteratorIS4_PNS_11__tree_nodeIS4_PvEEiEERKT_;
-    _ZNKSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE14__count_uniqueIS7_EEjRKT_;
     _ZNSt3__111__sift_downIRNS_4lessIN7android8RpcState10BinderNode9AsyncTodoEEENS_11__wrap_iterIPS5_EEEEvT0_SB_T_NS_15iterator_traitsISB_E15difference_typeESB_;
     _ZNSt3__111unique_lockINS_5mutexEE6unlockEv;
     _ZNSt3__112__hash_tableINS_17__hash_value_typeIijEENS_22__unordered_map_hasherIiS2_NS_4hashIiEELb1EEENS_21__unordered_map_equalIiS2_NS_8equal_toIiEELb1EEENS_9allocatorIS2_EEE14__erase_uniqueIiEEjRKT_;
@@ -1223,9 +1213,6 @@
     _ZNSt3__16__treeINS_12__value_typeIN7android8String16ExEENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE4findIS3_EENS_15__tree_iteratorIS4_PNS_11__tree_nodeIS4_PvEEiEERKT_;
     _ZNSt3__16__treeINS_12__value_typeIN7android8String16ExEENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE7destroyEPNS_11__tree_nodeIS4_PvEE;
     _ZNSt3__16__treeINS_12__value_typeINS_11__thread_idENS_6threadEEENS_19__map_value_compareIS2_S4_NS_4lessIS2_EELb1EEENS_9allocatorIS4_EEE7destroyEPNS_11__tree_nodeIS4_PvEE;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE12__find_equalIS7_EERPNS_16__tree_node_baseIPvEERPNS_15__tree_end_nodeISO_EERKT_;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE25__emplace_unique_key_argsIS7_JRKNS_21piecewise_construct_tENS_5tupleIJRKS7_EEENSO_IJEEEEEENS_4pairINS_15__tree_iteratorISD_PNS_11__tree_nodeISD_PvEEiEEbEERKT_DpOT0_;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE7destroyEPNS_11__tree_nodeISD_PvEE;
     _ZNSt3__16vectorIaNS_9allocatorIaEEE6insertIPKaEENS_9enable_ifIXaasr21__is_forward_iteratorIT_EE5valuesr16is_constructibleIaNS_15iterator_traitsIS8_E9referenceEEE5valueENS_11__wrap_iterIPaEEE4typeENSC_IS6_EES8_S8_;
     _ZNSt3__16vectorIbNS_9allocatorIbEEE18__construct_at_endINS_14__bit_iteratorIS3_Lb0ELj0EEEEENS_9enable_ifIXsr21__is_forward_iteratorIT_EE5valueEvE4typeES8_S8_;
     _ZNSt3__16vectorIbNS_9allocatorIbEEE18__construct_at_endINS_14__bit_iteratorIS3_Lb1ELj0EEEEENS_9enable_ifIXsr21__is_forward_iteratorIT_EE5valueEvE4typeES8_S8_;
@@ -1353,12 +1340,6 @@
     _ZTCN7android2os17BpServiceCallbackE0_NS_10IInterfaceE;
     _ZTCN7android2os17BpServiceCallbackE0_NS_11BpInterfaceINS0_16IServiceCallbackEEE;
     _ZTCN7android2os17BpServiceCallbackE4_NS_9BpRefBaseE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_10IInterfaceE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_11BnInterfaceINS_2os15IClientCallbackEEE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_2os15IClientCallbackE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_2os16BnClientCallbackE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE4_NS_7BBinderE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE4_NS_7IBinderE;
     _ZTCN7android7BBinderE0_NS_7IBinderE;
     _ZTCN7android7content2pm21IPackageManagerNativeE0_NS_10IInterfaceE;
     _ZTCN7android7content2pm22BnPackageManagerNativeE0_NS_10IInterfaceE;
@@ -1447,7 +1428,6 @@
     _ZTTN7android2os16IServiceCallbackE;
     _ZTTN7android2os17BnServiceCallbackE;
     _ZTTN7android2os17BpServiceCallbackE;
-    _ZTTN7android6binder8internal25ClientCounterCallbackImplE;
     _ZTTN7android7BBinderE;
     _ZTTN7android7content2pm21IPackageManagerNativeE;
     _ZTTN7android7content2pm22BnPackageManagerNativeE;
@@ -1581,7 +1561,6 @@
     _ZTVN7android2os17BpServiceCallbackE;
     _ZTVN7android2os17PersistableBundleE;
     _ZTVN7android2os20ParcelFileDescriptorE;
-    _ZTVN7android6binder8internal25ClientCounterCallbackImplE;
     _ZTVN7android6VectorIiEE;
     _ZTVN7android6VectorINS_12ProcessState12handle_entryEEE;
     _ZTVN7android6VectorINS_2spINS_18BufferedTextOutput11BufferStateEEEEE;
diff --git a/libs/binder/libbinder.arm32.vendor.map b/libs/binder/libbinder.arm32.vendor.map
index 8d5a323..2aa65de 100644
--- a/libs/binder/libbinder.arm32.vendor.map
+++ b/libs/binder/libbinder.arm32.vendor.map
@@ -359,15 +359,6 @@
     _ZN7android6binder8internal21ClientCounterCallback25setActiveServicesCallbackERKNSt3__18functionIFbbEEE;
     _ZN7android6binder8internal21ClientCounterCallbackC1Ev;
     _ZN7android6binder8internal21ClientCounterCallbackC2Ev;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl10reRegisterEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl11tryShutdownEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl12forcePersistEb;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl13tryUnregisterEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl15registerServiceERKNS_2spINS_7IBinderEEERKNSt3__112basic_stringIcNS8_11char_traitsIcEENS8_9allocatorIcEEEEbi;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl16maybeTryShutdownEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl23assertRegisteredServiceERKNS_2spINS_7IBinderEEE;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl25setActiveServicesCallbackERKNSt3__18functionIFbbEEE;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl9onClientsERKNS_2spINS_7IBinderEEEb;
     _ZN7android6Parcel10appendFromEPKS0_jj;
     _ZN7android6Parcel10markForRpcERKNS_2spINS_10RpcSessionEEE;
     _ZN7android6Parcel10writeFloatEf;
@@ -1022,7 +1013,6 @@
     _ZNKSt3__16__treeINS_12__value_typeIN7android8String16ENS_6vectorIxNS_9allocatorIxEEEEEENS_19__map_value_compareIS3_S8_NS_4lessIS3_EELb1EEENS5_IS8_EEE4findIS3_EENS_21__tree_const_iteratorIS8_PNS_11__tree_nodeIS8_PvEEiEERKT_;
     _ZNKSt3__16__treeINS_12__value_typeIN7android8String16ES3_EENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE4findIS3_EENS_21__tree_const_iteratorIS4_PNS_11__tree_nodeIS4_PvEEiEERKT_;
     _ZNKSt3__16__treeINS_12__value_typeIN7android8String16ExEENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE4findIS3_EENS_21__tree_const_iteratorIS4_PNS_11__tree_nodeIS4_PvEEiEERKT_;
-    _ZNKSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE14__count_uniqueIS7_EEjRKT_;
     _ZNSt3__111__sift_downIRNS_4lessIN7android8RpcState10BinderNode9AsyncTodoEEENS_11__wrap_iterIPS5_EEEEvT0_SB_T_NS_15iterator_traitsISB_E15difference_typeESB_;
     _ZNSt3__111unique_lockINS_5mutexEE6unlockEv;
     _ZNSt3__112__hash_tableINS_17__hash_value_typeIijEENS_22__unordered_map_hasherIiS2_NS_4hashIiEELb1EEENS_21__unordered_map_equalIiS2_NS_8equal_toIiEELb1EEENS_9allocatorIS2_EEE14__erase_uniqueIiEEjRKT_;
@@ -1169,9 +1159,6 @@
     _ZNSt3__16__treeINS_12__value_typeIN7android8String16ExEENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE4findIS3_EENS_15__tree_iteratorIS4_PNS_11__tree_nodeIS4_PvEEiEERKT_;
     _ZNSt3__16__treeINS_12__value_typeIN7android8String16ExEENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE7destroyEPNS_11__tree_nodeIS4_PvEE;
     _ZNSt3__16__treeINS_12__value_typeINS_11__thread_idENS_6threadEEENS_19__map_value_compareIS2_S4_NS_4lessIS2_EELb1EEENS_9allocatorIS4_EEE7destroyEPNS_11__tree_nodeIS4_PvEE;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE12__find_equalIS7_EERPNS_16__tree_node_baseIPvEERPNS_15__tree_end_nodeISO_EERKT_;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE25__emplace_unique_key_argsIS7_JRKNS_21piecewise_construct_tENS_5tupleIJRKS7_EEENSO_IJEEEEEENS_4pairINS_15__tree_iteratorISD_PNS_11__tree_nodeISD_PvEEiEEbEERKT_DpOT0_;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE7destroyEPNS_11__tree_nodeISD_PvEE;
     _ZNSt3__16vectorIaNS_9allocatorIaEEE6insertIPKaEENS_9enable_ifIXaasr21__is_forward_iteratorIT_EE5valuesr16is_constructibleIaNS_15iterator_traitsIS8_E9referenceEEE5valueENS_11__wrap_iterIPaEEE4typeENSC_IS6_EES8_S8_;
     _ZNSt3__16vectorIbNS_9allocatorIbEEE18__construct_at_endINS_14__bit_iteratorIS3_Lb0ELj0EEEEENS_9enable_ifIXsr21__is_forward_iteratorIT_EE5valueEvE4typeES8_S8_;
     _ZNSt3__16vectorIbNS_9allocatorIbEEE18__construct_at_endINS_14__bit_iteratorIS3_Lb1ELj0EEEEENS_9enable_ifIXsr21__is_forward_iteratorIT_EE5valueEvE4typeES8_S8_;
@@ -1289,12 +1276,6 @@
     _ZTCN7android2os17BpServiceCallbackE0_NS_10IInterfaceE;
     _ZTCN7android2os17BpServiceCallbackE0_NS_11BpInterfaceINS0_16IServiceCallbackEEE;
     _ZTCN7android2os17BpServiceCallbackE4_NS_9BpRefBaseE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_10IInterfaceE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_11BnInterfaceINS_2os15IClientCallbackEEE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_2os15IClientCallbackE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_2os16BnClientCallbackE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE4_NS_7BBinderE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE4_NS_7IBinderE;
     _ZTCN7android7BBinderE0_NS_7IBinderE;
     _ZTCN7android7content2pm21IPackageManagerNativeE0_NS_10IInterfaceE;
     _ZTCN7android7content2pm22BnPackageManagerNativeE0_NS_10IInterfaceE;
@@ -1379,7 +1360,6 @@
     _ZTTN7android2os16IServiceCallbackE;
     _ZTTN7android2os17BnServiceCallbackE;
     _ZTTN7android2os17BpServiceCallbackE;
-    _ZTTN7android6binder8internal25ClientCounterCallbackImplE;
     _ZTTN7android7BBinderE;
     _ZTTN7android7content2pm21IPackageManagerNativeE;
     _ZTTN7android7content2pm22BnPackageManagerNativeE;
@@ -1506,7 +1486,6 @@
     _ZTVN7android2os17BpServiceCallbackE;
     _ZTVN7android2os17PersistableBundleE;
     _ZTVN7android2os20ParcelFileDescriptorE;
-    _ZTVN7android6binder8internal25ClientCounterCallbackImplE;
     _ZTVN7android6VectorIiEE;
     _ZTVN7android6VectorINS_12ProcessState12handle_entryEEE;
     _ZTVN7android6VectorINS_2spINS_18BufferedTextOutput11BufferStateEEEEE;
diff --git a/libs/binder/libbinder.arm64.map b/libs/binder/libbinder.arm64.map
index dc34de8..538fc1f 100644
--- a/libs/binder/libbinder.arm64.map
+++ b/libs/binder/libbinder.arm64.map
@@ -390,15 +390,6 @@
     _ZN7android6binder8internal21ClientCounterCallback25setActiveServicesCallbackERKNSt3__18functionIFbbEEE;
     _ZN7android6binder8internal21ClientCounterCallbackC1Ev;
     _ZN7android6binder8internal21ClientCounterCallbackC2Ev;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl10reRegisterEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl11tryShutdownEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl12forcePersistEb;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl13tryUnregisterEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl15registerServiceERKNS_2spINS_7IBinderEEERKNSt3__112basic_stringIcNS8_11char_traitsIcEENS8_9allocatorIcEEEEbi;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl16maybeTryShutdownEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl23assertRegisteredServiceERKNS_2spINS_7IBinderEEE;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl25setActiveServicesCallbackERKNSt3__18functionIFbbEEE;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl9onClientsERKNS_2spINS_7IBinderEEEb;
     _ZN7android6Parcel10appendFromEPKS0_mm;
     _ZN7android6Parcel10markForRpcERKNS_2spINS_10RpcSessionEEE;
     _ZN7android6Parcel10writeFloatEf;
@@ -1213,9 +1204,6 @@
     _ZNSt3__16__treeINS_12__value_typeIN7android8String16ES3_EENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE5eraseENS_21__tree_const_iteratorIS4_PNS_11__tree_nodeIS4_PvEElEE;
     _ZNSt3__16__treeINS_12__value_typeIN7android8String16ES3_EENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE7destroyEPNS_11__tree_nodeIS4_PvEE;
     _ZNSt3__16__treeINS_12__value_typeINS_11__thread_idENS_6threadEEENS_19__map_value_compareIS2_S4_NS_4lessIS2_EELb1EEENS_9allocatorIS4_EEE7destroyEPNS_11__tree_nodeIS4_PvEE;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE12__find_equalIS7_EERPNS_16__tree_node_baseIPvEERPNS_15__tree_end_nodeISO_EERKT_;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE25__emplace_unique_key_argsIS7_JRKNS_21piecewise_construct_tENS_5tupleIJRKS7_EEENSO_IJEEEEEENS_4pairINS_15__tree_iteratorISD_PNS_11__tree_nodeISD_PvEElEEbEERKT_DpOT0_;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE7destroyEPNS_11__tree_nodeISD_PvEE;
     _ZNSt3__16vectorIaNS_9allocatorIaEEE6insertIPKaEENS_9enable_ifIXaasr21__is_forward_iteratorIT_EE5valuesr16is_constructibleIaNS_15iterator_traitsIS8_E9referenceEEE5valueENS_11__wrap_iterIPaEEE4typeENSC_IS6_EES8_S8_;
     _ZNSt3__16vectorIbNS_9allocatorIbEEE18__construct_at_endINS_14__bit_iteratorIS3_Lb0ELm0EEEEENS_9enable_ifIXsr21__is_forward_iteratorIT_EE5valueEvE4typeES8_S8_;
     _ZNSt3__16vectorIbNS_9allocatorIbEEE18__construct_at_endINS_14__bit_iteratorIS3_Lb1ELm0EEEEENS_9enable_ifIXsr21__is_forward_iteratorIT_EE5valueEvE4typeES8_S8_;
@@ -1339,12 +1327,6 @@
     _ZTCN7android2os17BpServiceCallbackE0_NS_10IInterfaceE;
     _ZTCN7android2os17BpServiceCallbackE0_NS_11BpInterfaceINS0_16IServiceCallbackEEE;
     _ZTCN7android2os17BpServiceCallbackE8_NS_9BpRefBaseE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_10IInterfaceE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_11BnInterfaceINS_2os15IClientCallbackEEE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_2os15IClientCallbackE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_2os16BnClientCallbackE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE8_NS_7BBinderE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE8_NS_7IBinderE;
     _ZTCN7android7BBinderE0_NS_7IBinderE;
     _ZTCN7android7content2pm21IPackageManagerNativeE0_NS_10IInterfaceE;
     _ZTCN7android7content2pm22BnPackageManagerNativeE0_NS_10IInterfaceE;
@@ -1433,7 +1415,6 @@
     _ZTTN7android2os16IServiceCallbackE;
     _ZTTN7android2os17BnServiceCallbackE;
     _ZTTN7android2os17BpServiceCallbackE;
-    _ZTTN7android6binder8internal25ClientCounterCallbackImplE;
     _ZTTN7android7BBinderE;
     _ZTTN7android7content2pm21IPackageManagerNativeE;
     _ZTTN7android7content2pm22BnPackageManagerNativeE;
@@ -1565,7 +1546,6 @@
     _ZTVN7android2os17BpServiceCallbackE;
     _ZTVN7android2os17PersistableBundleE;
     _ZTVN7android2os20ParcelFileDescriptorE;
-    _ZTVN7android6binder8internal25ClientCounterCallbackImplE;
     _ZTVN7android6VectorIiEE;
     _ZTVN7android6VectorINS_12ProcessState12handle_entryEEE;
     _ZTVN7android6VectorINS_2spINS_18BufferedTextOutput11BufferStateEEEEE;
diff --git a/libs/binder/libbinder.arm64.vendor.map b/libs/binder/libbinder.arm64.vendor.map
index 971ba92..044cc82 100644
--- a/libs/binder/libbinder.arm64.vendor.map
+++ b/libs/binder/libbinder.arm64.vendor.map
@@ -359,15 +359,6 @@
     _ZN7android6binder8internal21ClientCounterCallback25setActiveServicesCallbackERKNSt3__18functionIFbbEEE;
     _ZN7android6binder8internal21ClientCounterCallbackC1Ev;
     _ZN7android6binder8internal21ClientCounterCallbackC2Ev;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl10reRegisterEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl11tryShutdownEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl12forcePersistEb;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl13tryUnregisterEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl15registerServiceERKNS_2spINS_7IBinderEEERKNSt3__112basic_stringIcNS8_11char_traitsIcEENS8_9allocatorIcEEEEbi;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl16maybeTryShutdownEv;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl23assertRegisteredServiceERKNS_2spINS_7IBinderEEE;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl25setActiveServicesCallbackERKNSt3__18functionIFbbEEE;
-    _ZN7android6binder8internal25ClientCounterCallbackImpl9onClientsERKNS_2spINS_7IBinderEEEb;
     _ZN7android6Parcel10appendFromEPKS0_mm;
     _ZN7android6Parcel10markForRpcERKNS_2spINS_10RpcSessionEEE;
     _ZN7android6Parcel10writeFloatEf;
@@ -1158,9 +1149,6 @@
     _ZNSt3__16__treeINS_12__value_typeIN7android8String16ES3_EENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE5eraseENS_21__tree_const_iteratorIS4_PNS_11__tree_nodeIS4_PvEElEE;
     _ZNSt3__16__treeINS_12__value_typeIN7android8String16ES3_EENS_19__map_value_compareIS3_S4_NS_4lessIS3_EELb1EEENS_9allocatorIS4_EEE7destroyEPNS_11__tree_nodeIS4_PvEE;
     _ZNSt3__16__treeINS_12__value_typeINS_11__thread_idENS_6threadEEENS_19__map_value_compareIS2_S4_NS_4lessIS2_EELb1EEENS_9allocatorIS4_EEE7destroyEPNS_11__tree_nodeIS4_PvEE;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE12__find_equalIS7_EERPNS_16__tree_node_baseIPvEERPNS_15__tree_end_nodeISO_EERKT_;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE25__emplace_unique_key_argsIS7_JRKNS_21piecewise_construct_tENS_5tupleIJRKS7_EEENSO_IJEEEEEENS_4pairINS_15__tree_iteratorISD_PNS_11__tree_nodeISD_PvEElEEbEERKT_DpOT0_;
-    _ZNSt3__16__treeINS_12__value_typeINS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEN7android6binder8internal25ClientCounterCallbackImpl7ServiceEEENS_19__map_value_compareIS7_SD_NS_4lessIS7_EELb1EEENS5_ISD_EEE7destroyEPNS_11__tree_nodeISD_PvEE;
     _ZNSt3__16vectorIaNS_9allocatorIaEEE6insertIPKaEENS_9enable_ifIXaasr21__is_forward_iteratorIT_EE5valuesr16is_constructibleIaNS_15iterator_traitsIS8_E9referenceEEE5valueENS_11__wrap_iterIPaEEE4typeENSC_IS6_EES8_S8_;
     _ZNSt3__16vectorIbNS_9allocatorIbEEE18__construct_at_endINS_14__bit_iteratorIS3_Lb0ELm0EEEEENS_9enable_ifIXsr21__is_forward_iteratorIT_EE5valueEvE4typeES8_S8_;
     _ZNSt3__16vectorIbNS_9allocatorIbEEE18__construct_at_endINS_14__bit_iteratorIS3_Lb1ELm0EEEEENS_9enable_ifIXsr21__is_forward_iteratorIT_EE5valueEvE4typeES8_S8_;
@@ -1274,12 +1262,6 @@
     _ZTCN7android2os17BpServiceCallbackE0_NS_10IInterfaceE;
     _ZTCN7android2os17BpServiceCallbackE0_NS_11BpInterfaceINS0_16IServiceCallbackEEE;
     _ZTCN7android2os17BpServiceCallbackE8_NS_9BpRefBaseE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_10IInterfaceE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_11BnInterfaceINS_2os15IClientCallbackEEE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_2os15IClientCallbackE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE0_NS_2os16BnClientCallbackE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE8_NS_7BBinderE;
-    _ZTCN7android6binder8internal25ClientCounterCallbackImplE8_NS_7IBinderE;
     _ZTCN7android7BBinderE0_NS_7IBinderE;
     _ZTCN7android7content2pm21IPackageManagerNativeE0_NS_10IInterfaceE;
     _ZTCN7android7content2pm22BnPackageManagerNativeE0_NS_10IInterfaceE;
@@ -1364,7 +1346,6 @@
     _ZTTN7android2os16IServiceCallbackE;
     _ZTTN7android2os17BnServiceCallbackE;
     _ZTTN7android2os17BpServiceCallbackE;
-    _ZTTN7android6binder8internal25ClientCounterCallbackImplE;
     _ZTTN7android7BBinderE;
     _ZTTN7android7content2pm21IPackageManagerNativeE;
     _ZTTN7android7content2pm22BnPackageManagerNativeE;
@@ -1489,7 +1470,6 @@
     _ZTVN7android2os17BpServiceCallbackE;
     _ZTVN7android2os17PersistableBundleE;
     _ZTVN7android2os20ParcelFileDescriptorE;
-    _ZTVN7android6binder8internal25ClientCounterCallbackImplE;
     _ZTVN7android6VectorIiEE;
     _ZTVN7android6VectorINS_12ProcessState12handle_entryEEE;
     _ZTVN7android6VectorINS_2spINS_18BufferedTextOutput11BufferStateEEEEE;