blob: 53b36fffdc70322abaac9ee454ac7d80a2e29829 [file] [log] [blame]
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -08001/*
2 * Copyright (C) 2005 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#define LOG_TAG "BpBinder"
18//#define LOG_NDEBUG 0
19
Mathias Agopianc5b2c0b2009-05-19 19:08:10 -070020#include <binder/BpBinder.h>
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080021
Mathias Agopianc5b2c0b2009-05-19 19:08:10 -070022#include <binder/IPCThreadState.h>
Dianne Hackborn23eb1e22015-10-07 17:35:27 -070023#include <binder/IResultReceiver.h>
Steven Moreland5553ac42020-11-11 02:14:45 +000024#include <binder/RpcConnection.h>
Steven Moreland6e5a7752019-08-05 20:30:14 -070025#include <binder/Stability.h>
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070026#include <cutils/compiler.h>
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080027#include <utils/Log.h>
28
29#include <stdio.h>
30
Steve Block6807e592011-10-20 11:56:00 +010031//#undef ALOGV
32//#define ALOGV(...) fprintf(stderr, __VA_ARGS__)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080033
34namespace android {
35
36// ---------------------------------------------------------------------------
37
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070038Mutex BpBinder::sTrackingLock;
39std::unordered_map<int32_t,uint32_t> BpBinder::sTrackingMap;
40int BpBinder::sNumTrackedUids = 0;
41std::atomic_bool BpBinder::sCountByUidEnabled(false);
42binder_proxy_limit_callback BpBinder::sLimitCallback;
43bool BpBinder::sBinderProxyThrottleCreate = false;
44
45// Arbitrarily high value that probably distinguishes a bad behaving app
46uint32_t BpBinder::sBinderProxyCountHighWatermark = 2500;
47// Another arbitrary value a binder count needs to drop below before another callback will be called
48uint32_t BpBinder::sBinderProxyCountLowWatermark = 2000;
49
50enum {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -070051 LIMIT_REACHED_MASK = 0x80000000, // A flag denoting that the limit has been reached
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070052 COUNTING_VALUE_MASK = 0x7FFFFFFF, // A mask of the remaining bits for the count value
53};
54
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080055BpBinder::ObjectManager::ObjectManager()
56{
57}
58
59BpBinder::ObjectManager::~ObjectManager()
60{
61 kill();
62}
63
64void BpBinder::ObjectManager::attach(
65 const void* objectID, void* object, void* cleanupCookie,
66 IBinder::object_cleanup_func func)
67{
68 entry_t e;
69 e.object = object;
70 e.cleanupCookie = cleanupCookie;
71 e.func = func;
72
73 if (mObjects.indexOfKey(objectID) >= 0) {
Steve Blocke6f43dd2012-01-06 19:20:56 +000074 ALOGE("Trying to attach object ID %p to binder ObjectManager %p with object %p, but object ID already in use",
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080075 objectID, this, object);
76 return;
77 }
78
79 mObjects.add(objectID, e);
80}
81
82void* BpBinder::ObjectManager::find(const void* objectID) const
83{
84 const ssize_t i = mObjects.indexOfKey(objectID);
Yi Kongfdd8da92018-06-07 17:52:27 -070085 if (i < 0) return nullptr;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080086 return mObjects.valueAt(i).object;
87}
88
89void BpBinder::ObjectManager::detach(const void* objectID)
90{
91 mObjects.removeItem(objectID);
92}
93
94void BpBinder::ObjectManager::kill()
95{
96 const size_t N = mObjects.size();
Mark Salyzynd4ecccf2014-05-30 16:35:57 -070097 ALOGV("Killing %zu objects in manager %p", N, this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080098 for (size_t i=0; i<N; i++) {
99 const entry_t& e = mObjects.valueAt(i);
Yi Kongfdd8da92018-06-07 17:52:27 -0700100 if (e.func != nullptr) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800101 e.func(mObjects.keyAt(i), e.object, e.cleanupCookie);
102 }
103 }
104
105 mObjects.clear();
106}
107
108// ---------------------------------------------------------------------------
109
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700110
111BpBinder* BpBinder::create(int32_t handle) {
112 int32_t trackedUid = -1;
113 if (sCountByUidEnabled) {
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700114 trackedUid = IPCThreadState::self()->getCallingUid();
115 AutoMutex _l(sTrackingLock);
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700116 uint32_t trackedValue = sTrackingMap[trackedUid];
117 if (CC_UNLIKELY(trackedValue & LIMIT_REACHED_MASK)) {
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700118 if (sBinderProxyThrottleCreate) {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700119 return nullptr;
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700120 }
121 } else {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700122 if ((trackedValue & COUNTING_VALUE_MASK) >= sBinderProxyCountHighWatermark) {
123 ALOGE("Too many binder proxy objects sent to uid %d from uid %d (%d proxies held)",
124 getuid(), trackedUid, trackedValue);
125 sTrackingMap[trackedUid] |= LIMIT_REACHED_MASK;
126 if (sLimitCallback) sLimitCallback(trackedUid);
127 if (sBinderProxyThrottleCreate) {
128 ALOGI("Throttling binder proxy creates from uid %d in uid %d until binder proxy"
129 " count drops below %d",
130 trackedUid, getuid(), sBinderProxyCountLowWatermark);
131 return nullptr;
132 }
133 }
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700134 }
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700135 sTrackingMap[trackedUid]++;
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700136 }
Steven Moreland5553ac42020-11-11 02:14:45 +0000137 return new BpBinder(BinderHandle{handle}, trackedUid);
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700138}
139
Steven Moreland5553ac42020-11-11 02:14:45 +0000140BpBinder* BpBinder::create(const sp<RpcConnection>& connection, const RpcAddress& address) {
141 LOG_ALWAYS_FATAL_IF(connection == nullptr, "BpBinder::create null connection");
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800142
Steven Moreland5553ac42020-11-11 02:14:45 +0000143 // These are not currently tracked, since there is no UID or other
144 // identifier to track them with. However, if similar functionality is
145 // needed, connection objects keep track of all BpBinder objects on a
146 // per-connection basis.
147
148 return new BpBinder(SocketHandle{connection, address});
149}
150
151BpBinder::BpBinder(Handle&& handle)
152 : mStability(0),
153 mHandle(handle),
154 mAlive(true),
155 mObitsSent(false),
156 mObituaries(nullptr),
157 mTrackedUid(-1) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800158 extendObjectLifetime(OBJECT_LIFETIME_WEAK);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800159}
160
Steven Moreland5553ac42020-11-11 02:14:45 +0000161BpBinder::BpBinder(BinderHandle&& handle, int32_t trackedUid) : BpBinder(Handle(handle)) {
162 mTrackedUid = trackedUid;
163
164 ALOGV("Creating BpBinder %p handle %d\n", this, this->binderHandle());
165
166 IPCThreadState::self()->incWeakHandle(this->binderHandle(), this);
167}
168
169BpBinder::BpBinder(SocketHandle&& handle) : BpBinder(Handle(handle)) {
170 LOG_ALWAYS_FATAL_IF(rpcConnection() == nullptr, "BpBinder created w/o connection object");
171}
172
173bool BpBinder::isRpcBinder() const {
174 return std::holds_alternative<SocketHandle>(mHandle);
175}
176
177const RpcAddress& BpBinder::rpcAddress() const {
178 return std::get<SocketHandle>(mHandle).address;
179}
180
181const sp<RpcConnection>& BpBinder::rpcConnection() const {
182 return std::get<SocketHandle>(mHandle).connection;
183}
184
185int32_t BpBinder::binderHandle() const {
186 return std::get<BinderHandle>(mHandle).handle;
Steven Moreland85180c02019-07-16 14:24:20 -0700187}
188
Mathias Agopian83c04462009-05-22 19:00:22 -0700189bool BpBinder::isDescriptorCached() const {
190 Mutex::Autolock _l(mLock);
191 return mDescriptorCache.size() ? true : false;
192}
193
194const String16& BpBinder::getInterfaceDescriptor() const
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800195{
Mathias Agopian83c04462009-05-22 19:00:22 -0700196 if (isDescriptorCached() == false) {
Steven Moreland4cf688f2021-03-31 01:48:58 +0000197 sp<BpBinder> thiz = const_cast<BpBinder*>(this);
198
199 Parcel data;
200 data.markForBinder(thiz);
201 Parcel reply;
Mathias Agopian83c04462009-05-22 19:00:22 -0700202 // do the IPC without a lock held.
Steven Moreland4cf688f2021-03-31 01:48:58 +0000203 status_t err = thiz->transact(INTERFACE_TRANSACTION, data, &reply);
Mathias Agopian83c04462009-05-22 19:00:22 -0700204 if (err == NO_ERROR) {
205 String16 res(reply.readString16());
206 Mutex::Autolock _l(mLock);
207 // mDescriptorCache could have been assigned while the lock was
208 // released.
209 if (mDescriptorCache.size() == 0)
210 mDescriptorCache = res;
211 }
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800212 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700213
Mathias Agopian83c04462009-05-22 19:00:22 -0700214 // we're returning a reference to a non-static object here. Usually this
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700215 // is not something smart to do, however, with binder objects it is
Mathias Agopian83c04462009-05-22 19:00:22 -0700216 // (usually) safe because they are reference-counted.
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700217
Mathias Agopian83c04462009-05-22 19:00:22 -0700218 return mDescriptorCache;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800219}
220
221bool BpBinder::isBinderAlive() const
222{
Steven Moreland06074d82020-03-05 23:16:51 +0000223 return mAlive != 0;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800224}
225
226status_t BpBinder::pingBinder()
227{
Steven Moreland5553ac42020-11-11 02:14:45 +0000228 Parcel data;
229 data.markForBinder(this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800230 Parcel reply;
Steven Moreland5553ac42020-11-11 02:14:45 +0000231 return transact(PING_TRANSACTION, data, &reply);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800232}
233
234status_t BpBinder::dump(int fd, const Vector<String16>& args)
235{
236 Parcel send;
237 Parcel reply;
238 send.writeFileDescriptor(fd);
239 const size_t numArgs = args.size();
240 send.writeInt32(numArgs);
241 for (size_t i = 0; i < numArgs; i++) {
242 send.writeString16(args[i]);
243 }
244 status_t err = transact(DUMP_TRANSACTION, send, &reply);
245 return err;
246}
247
Jiyong Parkb86c8662018-10-29 23:01:57 +0900248// NOLINTNEXTLINE(google-default-arguments)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800249status_t BpBinder::transact(
250 uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
251{
252 // Once a binder has died, it will never come back to life.
253 if (mAlive) {
Steven Moreland46b5fea2019-10-15 11:22:18 -0700254 bool privateVendor = flags & FLAG_PRIVATE_VENDOR;
255 // don't send userspace flags to the kernel
256 flags = flags & ~FLAG_PRIVATE_VENDOR;
257
Steven Moreland6e5a7752019-08-05 20:30:14 -0700258 // user transactions require a given stability level
259 if (code >= FIRST_CALL_TRANSACTION && code <= LAST_CALL_TRANSACTION) {
260 using android::internal::Stability;
261
Steven Moreland89ddfc52020-11-13 02:39:26 +0000262 auto category = Stability::getCategory(this);
263 Stability::Level required = privateVendor ? Stability::VENDOR
264 : Stability::getLocalLevel();
Steven Moreland6e5a7752019-08-05 20:30:14 -0700265
Steven Moreland89ddfc52020-11-13 02:39:26 +0000266 if (CC_UNLIKELY(!Stability::check(category, required))) {
Steven Morelandb269b582021-02-10 17:09:11 +0000267 ALOGE("Cannot do a user transaction on a %s binder (%s) in a %s context.",
Steven Moreland89ddfc52020-11-13 02:39:26 +0000268 category.debugString().c_str(),
Steven Morelandb269b582021-02-10 17:09:11 +0000269 String8(getInterfaceDescriptor()).c_str(),
Steven Moreland89ddfc52020-11-13 02:39:26 +0000270 Stability::levelString(required).c_str());
Steven Moreland6e5a7752019-08-05 20:30:14 -0700271 return BAD_TYPE;
272 }
273 }
274
Steven Moreland5553ac42020-11-11 02:14:45 +0000275 status_t status;
276 if (CC_UNLIKELY(isRpcBinder())) {
277 status = rpcConnection()->transact(rpcAddress(), code, data, reply, flags);
278 } else {
279 status = IPCThreadState::self()->transact(binderHandle(), code, data, reply, flags);
280 }
281
Steven Moreland06074d82020-03-05 23:16:51 +0000282 if (status == DEAD_OBJECT) mAlive = 0;
Steven Morelanda86a3562019-08-01 23:28:34 +0000283
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800284 return status;
285 }
286
287 return DEAD_OBJECT;
288}
289
Jiyong Parkb86c8662018-10-29 23:01:57 +0900290// NOLINTNEXTLINE(google-default-arguments)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800291status_t BpBinder::linkToDeath(
292 const sp<DeathRecipient>& recipient, void* cookie, uint32_t flags)
293{
Steven Moreland5553ac42020-11-11 02:14:45 +0000294 if (isRpcBinder()) return UNKNOWN_TRANSACTION;
295
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800296 Obituary ob;
297 ob.recipient = recipient;
298 ob.cookie = cookie;
299 ob.flags = flags;
300
Yi Kongfdd8da92018-06-07 17:52:27 -0700301 LOG_ALWAYS_FATAL_IF(recipient == nullptr,
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800302 "linkToDeath(): recipient must be non-NULL");
303
304 {
305 AutoMutex _l(mLock);
306
307 if (!mObitsSent) {
308 if (!mObituaries) {
309 mObituaries = new Vector<Obituary>;
310 if (!mObituaries) {
311 return NO_MEMORY;
312 }
Steven Moreland5553ac42020-11-11 02:14:45 +0000313 ALOGV("Requesting death notification: %p handle %d\n", this, binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800314 getWeakRefs()->incWeak(this);
315 IPCThreadState* self = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000316 self->requestDeathNotification(binderHandle(), this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800317 self->flushCommands();
318 }
319 ssize_t res = mObituaries->add(ob);
320 return res >= (ssize_t)NO_ERROR ? (status_t)NO_ERROR : res;
321 }
322 }
323
324 return DEAD_OBJECT;
325}
326
Jiyong Parkb86c8662018-10-29 23:01:57 +0900327// NOLINTNEXTLINE(google-default-arguments)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800328status_t BpBinder::unlinkToDeath(
329 const wp<DeathRecipient>& recipient, void* cookie, uint32_t flags,
330 wp<DeathRecipient>* outRecipient)
331{
Steven Moreland5553ac42020-11-11 02:14:45 +0000332 if (isRpcBinder()) return UNKNOWN_TRANSACTION;
333
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800334 AutoMutex _l(mLock);
335
336 if (mObitsSent) {
337 return DEAD_OBJECT;
338 }
339
340 const size_t N = mObituaries ? mObituaries->size() : 0;
341 for (size_t i=0; i<N; i++) {
342 const Obituary& obit = mObituaries->itemAt(i);
343 if ((obit.recipient == recipient
Yi Kongfdd8da92018-06-07 17:52:27 -0700344 || (recipient == nullptr && obit.cookie == cookie))
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800345 && obit.flags == flags) {
Yi Kongfdd8da92018-06-07 17:52:27 -0700346 if (outRecipient != nullptr) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800347 *outRecipient = mObituaries->itemAt(i).recipient;
348 }
349 mObituaries->removeAt(i);
350 if (mObituaries->size() == 0) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000351 ALOGV("Clearing death notification: %p handle %d\n", this, binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800352 IPCThreadState* self = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000353 self->clearDeathNotification(binderHandle(), this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800354 self->flushCommands();
355 delete mObituaries;
Yi Kongfdd8da92018-06-07 17:52:27 -0700356 mObituaries = nullptr;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800357 }
358 return NO_ERROR;
359 }
360 }
361
362 return NAME_NOT_FOUND;
363}
364
365void BpBinder::sendObituary()
366{
Steven Moreland5553ac42020-11-11 02:14:45 +0000367 LOG_ALWAYS_FATAL_IF(isRpcBinder(), "Cannot send obituary for remote binder.");
368
369 ALOGV("Sending obituary for proxy %p handle %d, mObitsSent=%s\n", this, binderHandle(),
370 mObitsSent ? "true" : "false");
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800371
Steven Moreland06074d82020-03-05 23:16:51 +0000372 mAlive = 0;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800373 if (mObitsSent) return;
374
375 mLock.lock();
376 Vector<Obituary>* obits = mObituaries;
Yi Kongfdd8da92018-06-07 17:52:27 -0700377 if(obits != nullptr) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000378 ALOGV("Clearing sent death notification: %p handle %d\n", this, binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800379 IPCThreadState* self = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000380 self->clearDeathNotification(binderHandle(), this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800381 self->flushCommands();
Yi Kongfdd8da92018-06-07 17:52:27 -0700382 mObituaries = nullptr;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800383 }
Steven Moreland06074d82020-03-05 23:16:51 +0000384 mObitsSent = 1;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800385 mLock.unlock();
386
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700387 ALOGV("Reporting death of proxy %p for %zu recipients\n",
388 this, obits ? obits->size() : 0U);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800389
Yi Kongfdd8da92018-06-07 17:52:27 -0700390 if (obits != nullptr) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800391 const size_t N = obits->size();
392 for (size_t i=0; i<N; i++) {
393 reportOneDeath(obits->itemAt(i));
394 }
395
396 delete obits;
397 }
398}
399
400void BpBinder::reportOneDeath(const Obituary& obit)
401{
402 sp<DeathRecipient> recipient = obit.recipient.promote();
Steve Block6807e592011-10-20 11:56:00 +0100403 ALOGV("Reporting death to recipient: %p\n", recipient.get());
Yi Kongfdd8da92018-06-07 17:52:27 -0700404 if (recipient == nullptr) return;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800405
406 recipient->binderDied(this);
407}
408
409
410void BpBinder::attachObject(
411 const void* objectID, void* object, void* cleanupCookie,
412 object_cleanup_func func)
413{
414 AutoMutex _l(mLock);
Steve Block6807e592011-10-20 11:56:00 +0100415 ALOGV("Attaching object %p to binder %p (manager=%p)", object, this, &mObjects);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800416 mObjects.attach(objectID, object, cleanupCookie, func);
417}
418
419void* BpBinder::findObject(const void* objectID) const
420{
421 AutoMutex _l(mLock);
422 return mObjects.find(objectID);
423}
424
425void BpBinder::detachObject(const void* objectID)
426{
427 AutoMutex _l(mLock);
428 mObjects.detach(objectID);
429}
430
431BpBinder* BpBinder::remoteBinder()
432{
433 return this;
434}
435
436BpBinder::~BpBinder()
437{
Steven Moreland5553ac42020-11-11 02:14:45 +0000438 ALOGV("Destroying BpBinder %p handle %d\n", this, binderHandle());
439
440 if (CC_UNLIKELY(isRpcBinder())) return;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800441
442 IPCThreadState* ipc = IPCThreadState::self();
443
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700444 if (mTrackedUid >= 0) {
445 AutoMutex _l(sTrackingLock);
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700446 uint32_t trackedValue = sTrackingMap[mTrackedUid];
447 if (CC_UNLIKELY((trackedValue & COUNTING_VALUE_MASK) == 0)) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000448 ALOGE("Unexpected Binder Proxy tracking decrement in %p handle %d\n", this,
449 binderHandle());
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700450 } else {
451 if (CC_UNLIKELY(
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700452 (trackedValue & LIMIT_REACHED_MASK) &&
453 ((trackedValue & COUNTING_VALUE_MASK) <= sBinderProxyCountLowWatermark)
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700454 )) {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700455 ALOGI("Limit reached bit reset for uid %d (fewer than %d proxies from uid %d held)",
456 getuid(), mTrackedUid, sBinderProxyCountLowWatermark);
457 sTrackingMap[mTrackedUid] &= ~LIMIT_REACHED_MASK;
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700458 }
459 if (--sTrackingMap[mTrackedUid] == 0) {
460 sTrackingMap.erase(mTrackedUid);
461 }
462 }
463 }
464
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800465 if (ipc) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000466 ipc->expungeHandle(binderHandle(), this);
467 ipc->decWeakHandle(binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800468 }
469}
470
471void BpBinder::onFirstRef()
472{
Steven Moreland5553ac42020-11-11 02:14:45 +0000473 ALOGV("onFirstRef BpBinder %p handle %d\n", this, binderHandle());
474 if (CC_UNLIKELY(isRpcBinder())) return;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800475 IPCThreadState* ipc = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000476 if (ipc) ipc->incStrongHandle(binderHandle(), this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800477}
478
Colin Cross6f4f3ab2014-02-05 17:42:44 -0800479void BpBinder::onLastStrongRef(const void* /*id*/)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800480{
Steven Moreland5553ac42020-11-11 02:14:45 +0000481 ALOGV("onLastStrongRef BpBinder %p handle %d\n", this, binderHandle());
482 if (CC_UNLIKELY(isRpcBinder())) {
483 (void)rpcConnection()->sendDecStrong(rpcAddress());
484 return;
485 }
Steve Block6807e592011-10-20 11:56:00 +0100486 IF_ALOGV() {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800487 printRefs();
488 }
489 IPCThreadState* ipc = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000490 if (ipc) ipc->decStrongHandle(binderHandle());
Steven Moreland80d23932019-06-07 12:43:27 -0700491
492 mLock.lock();
493 Vector<Obituary>* obits = mObituaries;
494 if(obits != nullptr) {
495 if (!obits->isEmpty()) {
Steven Moreland70fcb4e2019-12-13 17:28:58 -0800496 ALOGI("onLastStrongRef automatically unlinking death recipients: %s",
497 mDescriptorCache.size() ? String8(mDescriptorCache).c_str() : "<uncached descriptor>");
Steven Moreland80d23932019-06-07 12:43:27 -0700498 }
499
Steven Moreland5553ac42020-11-11 02:14:45 +0000500 if (ipc) ipc->clearDeathNotification(binderHandle(), this);
Steven Moreland80d23932019-06-07 12:43:27 -0700501 mObituaries = nullptr;
502 }
503 mLock.unlock();
504
505 if (obits != nullptr) {
506 // XXX Should we tell any remaining DeathRecipient
507 // objects that the last strong ref has gone away, so they
508 // are no longer linked?
509 delete obits;
510 }
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800511}
512
Colin Cross6f4f3ab2014-02-05 17:42:44 -0800513bool BpBinder::onIncStrongAttempted(uint32_t /*flags*/, const void* /*id*/)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800514{
Steven Moreland5553ac42020-11-11 02:14:45 +0000515 // RPC binder doesn't currently support inc from weak binders
516 if (CC_UNLIKELY(isRpcBinder())) return false;
517
518 ALOGV("onIncStrongAttempted BpBinder %p handle %d\n", this, binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800519 IPCThreadState* ipc = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000520 return ipc ? ipc->attemptIncStrongHandle(binderHandle()) == NO_ERROR : false;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800521}
522
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700523uint32_t BpBinder::getBinderProxyCount(uint32_t uid)
524{
525 AutoMutex _l(sTrackingLock);
526 auto it = sTrackingMap.find(uid);
527 if (it != sTrackingMap.end()) {
528 return it->second & COUNTING_VALUE_MASK;
529 }
530 return 0;
531}
532
533void BpBinder::getCountByUid(Vector<uint32_t>& uids, Vector<uint32_t>& counts)
534{
535 AutoMutex _l(sTrackingLock);
536 uids.setCapacity(sTrackingMap.size());
537 counts.setCapacity(sTrackingMap.size());
538 for (const auto& it : sTrackingMap) {
539 uids.push_back(it.first);
540 counts.push_back(it.second & COUNTING_VALUE_MASK);
541 }
542}
543
544void BpBinder::enableCountByUid() { sCountByUidEnabled.store(true); }
545void BpBinder::disableCountByUid() { sCountByUidEnabled.store(false); }
546void BpBinder::setCountByUidEnabled(bool enable) { sCountByUidEnabled.store(enable); }
547
548void BpBinder::setLimitCallback(binder_proxy_limit_callback cb) {
549 AutoMutex _l(sTrackingLock);
550 sLimitCallback = cb;
551}
552
553void BpBinder::setBinderProxyCountWatermarks(int high, int low) {
554 AutoMutex _l(sTrackingLock);
555 sBinderProxyCountHighWatermark = high;
556 sBinderProxyCountLowWatermark = low;
557}
558
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800559// ---------------------------------------------------------------------------
560
Steven Moreland61ff8492019-09-26 16:05:45 -0700561} // namespace android