blob: d9b723108e12b570fd637f60d97dd9a604ffcf83 [file] [log] [blame]
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -08001/*
2 * Copyright (C) 2005 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#define LOG_TAG "BpBinder"
18//#define LOG_NDEBUG 0
19
Mathias Agopianc5b2c0b2009-05-19 19:08:10 -070020#include <binder/BpBinder.h>
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080021
Mathias Agopianc5b2c0b2009-05-19 19:08:10 -070022#include <binder/IPCThreadState.h>
Dianne Hackborn23eb1e22015-10-07 17:35:27 -070023#include <binder/IResultReceiver.h>
Steven Morelandbdb53ab2021-05-05 17:57:41 +000024#include <binder/RpcSession.h>
Steven Moreland6e5a7752019-08-05 20:30:14 -070025#include <binder/Stability.h>
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070026#include <cutils/compiler.h>
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080027#include <utils/Log.h>
28
29#include <stdio.h>
30
Steven Moreland32150282021-11-12 22:54:53 +000031#include "BuildFlags.h"
32
Steve Block6807e592011-10-20 11:56:00 +010033//#undef ALOGV
34//#define ALOGV(...) fprintf(stderr, __VA_ARGS__)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080035
36namespace android {
37
38// ---------------------------------------------------------------------------
39
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070040Mutex BpBinder::sTrackingLock;
Martijn Coenena8d509d2021-09-03 18:06:24 +020041std::unordered_map<int32_t, uint32_t> BpBinder::sTrackingMap;
42std::unordered_map<int32_t, uint32_t> BpBinder::sLastLimitCallbackMap;
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070043int BpBinder::sNumTrackedUids = 0;
44std::atomic_bool BpBinder::sCountByUidEnabled(false);
45binder_proxy_limit_callback BpBinder::sLimitCallback;
46bool BpBinder::sBinderProxyThrottleCreate = false;
47
48// Arbitrarily high value that probably distinguishes a bad behaving app
49uint32_t BpBinder::sBinderProxyCountHighWatermark = 2500;
50// Another arbitrary value a binder count needs to drop below before another callback will be called
51uint32_t BpBinder::sBinderProxyCountLowWatermark = 2000;
52
Martijn Coenen1cad19c2021-10-04 09:19:01 +020053// Log any transactions for which the data exceeds this size
54#define LOG_TRANSACTIONS_OVER_SIZE (300 * 1024)
55
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070056enum {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -070057 LIMIT_REACHED_MASK = 0x80000000, // A flag denoting that the limit has been reached
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070058 COUNTING_VALUE_MASK = 0x7FFFFFFF, // A mask of the remaining bits for the count value
59};
60
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080061BpBinder::ObjectManager::ObjectManager()
62{
63}
64
65BpBinder::ObjectManager::~ObjectManager()
66{
67 kill();
68}
69
Steven Moreland63a2d512021-06-25 01:10:15 +000070void* BpBinder::ObjectManager::attach(const void* objectID, void* object, void* cleanupCookie,
71 IBinder::object_cleanup_func func) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080072 entry_t e;
73 e.object = object;
74 e.cleanupCookie = cleanupCookie;
75 e.func = func;
76
Jiyong Park5970d0a2022-03-08 16:56:13 +090077 if (mObjects.find(objectID) != mObjects.end()) {
Steven Moreland63a2d512021-06-25 01:10:15 +000078 ALOGI("Trying to attach object ID %p to binder ObjectManager %p with object %p, but object "
79 "ID already in use",
80 objectID, this, object);
Jiyong Park5970d0a2022-03-08 16:56:13 +090081 return mObjects[objectID].object;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080082 }
83
Jiyong Park5970d0a2022-03-08 16:56:13 +090084 mObjects.insert({objectID, e});
Steven Moreland63a2d512021-06-25 01:10:15 +000085 return nullptr;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080086}
87
88void* BpBinder::ObjectManager::find(const void* objectID) const
89{
Jiyong Park5970d0a2022-03-08 16:56:13 +090090 auto i = mObjects.find(objectID);
91 if (i == mObjects.end()) return nullptr;
92 return i->second.object;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080093}
94
Steven Moreland63a2d512021-06-25 01:10:15 +000095void* BpBinder::ObjectManager::detach(const void* objectID) {
Jiyong Park5970d0a2022-03-08 16:56:13 +090096 auto i = mObjects.find(objectID);
97 if (i == mObjects.end()) return nullptr;
98 void* value = i->second.object;
99 mObjects.erase(i);
Steven Moreland63a2d512021-06-25 01:10:15 +0000100 return value;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800101}
102
Devin Moore3faaa002022-07-27 15:54:06 +0000103namespace {
104struct Tag {
105 wp<IBinder> binder;
106};
107} // namespace
108
109static void cleanWeak(const void* /* id */, void* obj, void* /* cookie */) {
110 delete static_cast<Tag*>(obj);
111}
112
113sp<IBinder> BpBinder::ObjectManager::lookupOrCreateWeak(const void* objectID, object_make_func make,
114 const void* makeArgs) {
115 entry_t& e = mObjects[objectID];
116 if (e.object != nullptr) {
117 if (auto attached = static_cast<Tag*>(e.object)->binder.promote()) {
118 return attached;
119 }
120 } else {
121 e.object = new Tag;
122 LOG_ALWAYS_FATAL_IF(!e.object, "no more memory");
123 }
124 sp<IBinder> newObj = make(makeArgs);
125
126 static_cast<Tag*>(e.object)->binder = newObj;
127 e.cleanupCookie = nullptr;
128 e.func = cleanWeak;
129
130 return newObj;
131}
132
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800133void BpBinder::ObjectManager::kill()
134{
135 const size_t N = mObjects.size();
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700136 ALOGV("Killing %zu objects in manager %p", N, this);
Jiyong Park5970d0a2022-03-08 16:56:13 +0900137 for (auto i : mObjects) {
138 const entry_t& e = i.second;
Yi Kongfdd8da92018-06-07 17:52:27 -0700139 if (e.func != nullptr) {
Jiyong Park5970d0a2022-03-08 16:56:13 +0900140 e.func(i.first, e.object, e.cleanupCookie);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800141 }
142 }
143
144 mObjects.clear();
145}
146
147// ---------------------------------------------------------------------------
148
Steven Moreland1a3a8ef2021-04-02 02:52:46 +0000149sp<BpBinder> BpBinder::create(int32_t handle) {
Steven Moreland32150282021-11-12 22:54:53 +0000150 if constexpr (!kEnableKernelIpc) {
151 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
152 return nullptr;
153 }
154
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700155 int32_t trackedUid = -1;
156 if (sCountByUidEnabled) {
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700157 trackedUid = IPCThreadState::self()->getCallingUid();
158 AutoMutex _l(sTrackingLock);
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700159 uint32_t trackedValue = sTrackingMap[trackedUid];
160 if (CC_UNLIKELY(trackedValue & LIMIT_REACHED_MASK)) {
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700161 if (sBinderProxyThrottleCreate) {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700162 return nullptr;
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700163 }
Martijn Coenena8d509d2021-09-03 18:06:24 +0200164 trackedValue = trackedValue & COUNTING_VALUE_MASK;
165 uint32_t lastLimitCallbackAt = sLastLimitCallbackMap[trackedUid];
166
167 if (trackedValue > lastLimitCallbackAt &&
Martijn Coenen6711b6d2021-09-23 09:44:29 +0200168 (trackedValue - lastLimitCallbackAt > sBinderProxyCountHighWatermark)) {
Martijn Coenena8d509d2021-09-03 18:06:24 +0200169 ALOGE("Still too many binder proxy objects sent to uid %d from uid %d (%d proxies "
170 "held)",
171 getuid(), trackedUid, trackedValue);
172 if (sLimitCallback) sLimitCallback(trackedUid);
173 sLastLimitCallbackMap[trackedUid] = trackedValue;
174 }
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700175 } else {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700176 if ((trackedValue & COUNTING_VALUE_MASK) >= sBinderProxyCountHighWatermark) {
177 ALOGE("Too many binder proxy objects sent to uid %d from uid %d (%d proxies held)",
178 getuid(), trackedUid, trackedValue);
179 sTrackingMap[trackedUid] |= LIMIT_REACHED_MASK;
180 if (sLimitCallback) sLimitCallback(trackedUid);
Martijn Coenena8d509d2021-09-03 18:06:24 +0200181 sLastLimitCallbackMap[trackedUid] = trackedValue & COUNTING_VALUE_MASK;
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700182 if (sBinderProxyThrottleCreate) {
183 ALOGI("Throttling binder proxy creates from uid %d in uid %d until binder proxy"
184 " count drops below %d",
185 trackedUid, getuid(), sBinderProxyCountLowWatermark);
186 return nullptr;
187 }
188 }
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700189 }
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700190 sTrackingMap[trackedUid]++;
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700191 }
Steven Moreland1a3a8ef2021-04-02 02:52:46 +0000192 return sp<BpBinder>::make(BinderHandle{handle}, trackedUid);
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700193}
194
Steven Moreland5623d1a2021-09-10 15:45:34 -0700195sp<BpBinder> BpBinder::create(const sp<RpcSession>& session, uint64_t address) {
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000196 LOG_ALWAYS_FATAL_IF(session == nullptr, "BpBinder::create null session");
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800197
Steven Moreland5553ac42020-11-11 02:14:45 +0000198 // These are not currently tracked, since there is no UID or other
199 // identifier to track them with. However, if similar functionality is
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000200 // needed, session objects keep track of all BpBinder objects on a
201 // per-session basis.
Steven Moreland5553ac42020-11-11 02:14:45 +0000202
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000203 return sp<BpBinder>::make(RpcHandle{session, address});
Steven Moreland5553ac42020-11-11 02:14:45 +0000204}
205
206BpBinder::BpBinder(Handle&& handle)
207 : mStability(0),
208 mHandle(handle),
209 mAlive(true),
210 mObitsSent(false),
211 mObituaries(nullptr),
212 mTrackedUid(-1) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800213 extendObjectLifetime(OBJECT_LIFETIME_WEAK);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800214}
215
Steven Moreland5553ac42020-11-11 02:14:45 +0000216BpBinder::BpBinder(BinderHandle&& handle, int32_t trackedUid) : BpBinder(Handle(handle)) {
Steven Moreland32150282021-11-12 22:54:53 +0000217 if constexpr (!kEnableKernelIpc) {
218 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
219 return;
220 }
221
Steven Moreland5553ac42020-11-11 02:14:45 +0000222 mTrackedUid = trackedUid;
223
224 ALOGV("Creating BpBinder %p handle %d\n", this, this->binderHandle());
225
226 IPCThreadState::self()->incWeakHandle(this->binderHandle(), this);
227}
228
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000229BpBinder::BpBinder(RpcHandle&& handle) : BpBinder(Handle(handle)) {
230 LOG_ALWAYS_FATAL_IF(rpcSession() == nullptr, "BpBinder created w/o session object");
Steven Moreland5553ac42020-11-11 02:14:45 +0000231}
232
233bool BpBinder::isRpcBinder() const {
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000234 return std::holds_alternative<RpcHandle>(mHandle);
Steven Moreland5553ac42020-11-11 02:14:45 +0000235}
236
Steven Moreland5623d1a2021-09-10 15:45:34 -0700237uint64_t BpBinder::rpcAddress() const {
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000238 return std::get<RpcHandle>(mHandle).address;
Steven Moreland5553ac42020-11-11 02:14:45 +0000239}
240
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000241const sp<RpcSession>& BpBinder::rpcSession() const {
242 return std::get<RpcHandle>(mHandle).session;
Steven Moreland5553ac42020-11-11 02:14:45 +0000243}
244
245int32_t BpBinder::binderHandle() const {
246 return std::get<BinderHandle>(mHandle).handle;
Steven Moreland85180c02019-07-16 14:24:20 -0700247}
248
Devin Mooref6f2e642021-08-05 19:03:47 +0000249std::optional<int32_t> BpBinder::getDebugBinderHandle() const {
250 if (!isRpcBinder()) {
251 return binderHandle();
252 } else {
253 return std::nullopt;
254 }
255}
256
Mathias Agopian83c04462009-05-22 19:00:22 -0700257bool BpBinder::isDescriptorCached() const {
258 Mutex::Autolock _l(mLock);
259 return mDescriptorCache.size() ? true : false;
260}
261
262const String16& BpBinder::getInterfaceDescriptor() const
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800263{
Mathias Agopian83c04462009-05-22 19:00:22 -0700264 if (isDescriptorCached() == false) {
Steven Moreland1a3a8ef2021-04-02 02:52:46 +0000265 sp<BpBinder> thiz = sp<BpBinder>::fromExisting(const_cast<BpBinder*>(this));
Steven Moreland4cf688f2021-03-31 01:48:58 +0000266
267 Parcel data;
268 data.markForBinder(thiz);
269 Parcel reply;
Mathias Agopian83c04462009-05-22 19:00:22 -0700270 // do the IPC without a lock held.
Steven Moreland4cf688f2021-03-31 01:48:58 +0000271 status_t err = thiz->transact(INTERFACE_TRANSACTION, data, &reply);
Mathias Agopian83c04462009-05-22 19:00:22 -0700272 if (err == NO_ERROR) {
273 String16 res(reply.readString16());
274 Mutex::Autolock _l(mLock);
275 // mDescriptorCache could have been assigned while the lock was
276 // released.
277 if (mDescriptorCache.size() == 0)
278 mDescriptorCache = res;
279 }
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800280 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700281
Mathias Agopian83c04462009-05-22 19:00:22 -0700282 // we're returning a reference to a non-static object here. Usually this
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700283 // is not something smart to do, however, with binder objects it is
Mathias Agopian83c04462009-05-22 19:00:22 -0700284 // (usually) safe because they are reference-counted.
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700285
Mathias Agopian83c04462009-05-22 19:00:22 -0700286 return mDescriptorCache;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800287}
288
289bool BpBinder::isBinderAlive() const
290{
Steven Moreland06074d82020-03-05 23:16:51 +0000291 return mAlive != 0;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800292}
293
294status_t BpBinder::pingBinder()
295{
Steven Moreland5553ac42020-11-11 02:14:45 +0000296 Parcel data;
Steven Moreland1a3a8ef2021-04-02 02:52:46 +0000297 data.markForBinder(sp<BpBinder>::fromExisting(this));
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800298 Parcel reply;
Steven Moreland5553ac42020-11-11 02:14:45 +0000299 return transact(PING_TRANSACTION, data, &reply);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800300}
301
302status_t BpBinder::dump(int fd, const Vector<String16>& args)
303{
304 Parcel send;
305 Parcel reply;
306 send.writeFileDescriptor(fd);
307 const size_t numArgs = args.size();
308 send.writeInt32(numArgs);
309 for (size_t i = 0; i < numArgs; i++) {
310 send.writeString16(args[i]);
311 }
312 status_t err = transact(DUMP_TRANSACTION, send, &reply);
313 return err;
314}
315
Jiyong Parkb86c8662018-10-29 23:01:57 +0900316// NOLINTNEXTLINE(google-default-arguments)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800317status_t BpBinder::transact(
318 uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
319{
320 // Once a binder has died, it will never come back to life.
321 if (mAlive) {
Steven Moreland46b5fea2019-10-15 11:22:18 -0700322 bool privateVendor = flags & FLAG_PRIVATE_VENDOR;
323 // don't send userspace flags to the kernel
Andrei Homescu7cdf5c22022-04-30 03:41:16 +0000324 flags = flags & ~static_cast<uint32_t>(FLAG_PRIVATE_VENDOR);
Steven Moreland46b5fea2019-10-15 11:22:18 -0700325
Steven Moreland6e5a7752019-08-05 20:30:14 -0700326 // user transactions require a given stability level
327 if (code >= FIRST_CALL_TRANSACTION && code <= LAST_CALL_TRANSACTION) {
328 using android::internal::Stability;
329
Steven Moreland16a41062021-07-23 13:35:25 -0700330 int16_t stability = Stability::getRepr(this);
Steven Moreland89ddfc52020-11-13 02:39:26 +0000331 Stability::Level required = privateVendor ? Stability::VENDOR
332 : Stability::getLocalLevel();
Steven Moreland6e5a7752019-08-05 20:30:14 -0700333
Steven Moreland16a41062021-07-23 13:35:25 -0700334 if (CC_UNLIKELY(!Stability::check(stability, required))) {
Steven Morelandb269b582021-02-10 17:09:11 +0000335 ALOGE("Cannot do a user transaction on a %s binder (%s) in a %s context.",
Steven Moreland16a41062021-07-23 13:35:25 -0700336 Stability::levelString(stability).c_str(),
337 String8(getInterfaceDescriptor()).c_str(),
338 Stability::levelString(required).c_str());
Steven Moreland6e5a7752019-08-05 20:30:14 -0700339 return BAD_TYPE;
340 }
341 }
342
Steven Moreland5553ac42020-11-11 02:14:45 +0000343 status_t status;
344 if (CC_UNLIKELY(isRpcBinder())) {
Steven Morelandf5174272021-05-25 00:39:28 +0000345 status = rpcSession()->transact(sp<IBinder>::fromExisting(this), code, data, reply,
346 flags);
Steven Moreland5553ac42020-11-11 02:14:45 +0000347 } else {
Steven Moreland32150282021-11-12 22:54:53 +0000348 if constexpr (!kEnableKernelIpc) {
349 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
350 return INVALID_OPERATION;
351 }
352
Steven Moreland5553ac42020-11-11 02:14:45 +0000353 status = IPCThreadState::self()->transact(binderHandle(), code, data, reply, flags);
354 }
Martijn Coenen1cad19c2021-10-04 09:19:01 +0200355 if (data.dataSize() > LOG_TRANSACTIONS_OVER_SIZE) {
356 Mutex::Autolock _l(mLock);
357 ALOGW("Large outgoing transaction of %zu bytes, interface descriptor %s, code %d",
358 data.dataSize(),
359 mDescriptorCache.size() ? String8(mDescriptorCache).c_str()
360 : "<uncached descriptor>",
361 code);
362 }
Steven Moreland5553ac42020-11-11 02:14:45 +0000363
Steven Moreland06074d82020-03-05 23:16:51 +0000364 if (status == DEAD_OBJECT) mAlive = 0;
Steven Morelanda86a3562019-08-01 23:28:34 +0000365
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800366 return status;
367 }
368
369 return DEAD_OBJECT;
370}
371
Jiyong Parkb86c8662018-10-29 23:01:57 +0900372// NOLINTNEXTLINE(google-default-arguments)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800373status_t BpBinder::linkToDeath(
374 const sp<DeathRecipient>& recipient, void* cookie, uint32_t flags)
375{
Devin Moore66d5b7a2022-07-07 21:42:10 +0000376 if (isRpcBinder()) {
377 if (rpcSession()->getMaxIncomingThreads() < 1) {
378 LOG_ALWAYS_FATAL("Cannot register a DeathRecipient without any incoming connections.");
379 return INVALID_OPERATION;
380 }
381 } else if constexpr (!kEnableKernelIpc) {
Steven Moreland32150282021-11-12 22:54:53 +0000382 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
383 return INVALID_OPERATION;
Devin Moore66d5b7a2022-07-07 21:42:10 +0000384 } else {
385 if (ProcessState::self()->getThreadPoolMaxTotalThreadCount() == 0) {
386 ALOGW("Linking to death on %s but there are no threads (yet?) listening to incoming "
387 "transactions. See ProcessState::startThreadPool and "
388 "ProcessState::setThreadPoolMaxThreadCount. Generally you should setup the "
389 "binder "
390 "threadpool before other initialization steps.",
391 String8(getInterfaceDescriptor()).c_str());
392 }
Steven Moreland32150282021-11-12 22:54:53 +0000393 }
394
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800395 Obituary ob;
396 ob.recipient = recipient;
397 ob.cookie = cookie;
398 ob.flags = flags;
399
Yi Kongfdd8da92018-06-07 17:52:27 -0700400 LOG_ALWAYS_FATAL_IF(recipient == nullptr,
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800401 "linkToDeath(): recipient must be non-NULL");
402
403 {
404 AutoMutex _l(mLock);
405
406 if (!mObitsSent) {
407 if (!mObituaries) {
408 mObituaries = new Vector<Obituary>;
409 if (!mObituaries) {
410 return NO_MEMORY;
411 }
Steven Moreland5553ac42020-11-11 02:14:45 +0000412 ALOGV("Requesting death notification: %p handle %d\n", this, binderHandle());
Devin Moore66d5b7a2022-07-07 21:42:10 +0000413 if (!isRpcBinder()) {
414 if constexpr (kEnableKernelIpc) {
415 getWeakRefs()->incWeak(this);
416 IPCThreadState* self = IPCThreadState::self();
417 self->requestDeathNotification(binderHandle(), this);
418 self->flushCommands();
419 }
420 }
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800421 }
422 ssize_t res = mObituaries->add(ob);
423 return res >= (ssize_t)NO_ERROR ? (status_t)NO_ERROR : res;
424 }
425 }
426
427 return DEAD_OBJECT;
428}
429
Jiyong Parkb86c8662018-10-29 23:01:57 +0900430// NOLINTNEXTLINE(google-default-arguments)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800431status_t BpBinder::unlinkToDeath(
432 const wp<DeathRecipient>& recipient, void* cookie, uint32_t flags,
433 wp<DeathRecipient>* outRecipient)
434{
Devin Moore66d5b7a2022-07-07 21:42:10 +0000435 if (!kEnableKernelIpc && !isRpcBinder()) {
Steven Moreland32150282021-11-12 22:54:53 +0000436 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
437 return INVALID_OPERATION;
438 }
439
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800440 AutoMutex _l(mLock);
441
442 if (mObitsSent) {
443 return DEAD_OBJECT;
444 }
445
446 const size_t N = mObituaries ? mObituaries->size() : 0;
447 for (size_t i=0; i<N; i++) {
448 const Obituary& obit = mObituaries->itemAt(i);
449 if ((obit.recipient == recipient
Yi Kongfdd8da92018-06-07 17:52:27 -0700450 || (recipient == nullptr && obit.cookie == cookie))
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800451 && obit.flags == flags) {
Yi Kongfdd8da92018-06-07 17:52:27 -0700452 if (outRecipient != nullptr) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800453 *outRecipient = mObituaries->itemAt(i).recipient;
454 }
455 mObituaries->removeAt(i);
456 if (mObituaries->size() == 0) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000457 ALOGV("Clearing death notification: %p handle %d\n", this, binderHandle());
Devin Moore66d5b7a2022-07-07 21:42:10 +0000458 if (!isRpcBinder()) {
459 if constexpr (kEnableKernelIpc) {
460 IPCThreadState* self = IPCThreadState::self();
461 self->clearDeathNotification(binderHandle(), this);
462 self->flushCommands();
463 }
464 }
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800465 delete mObituaries;
Yi Kongfdd8da92018-06-07 17:52:27 -0700466 mObituaries = nullptr;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800467 }
468 return NO_ERROR;
469 }
470 }
471
472 return NAME_NOT_FOUND;
473}
474
475void BpBinder::sendObituary()
476{
Devin Moore66d5b7a2022-07-07 21:42:10 +0000477 if (!kEnableKernelIpc && !isRpcBinder()) {
Steven Moreland32150282021-11-12 22:54:53 +0000478 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
479 return;
480 }
481
Steven Moreland5553ac42020-11-11 02:14:45 +0000482 ALOGV("Sending obituary for proxy %p handle %d, mObitsSent=%s\n", this, binderHandle(),
483 mObitsSent ? "true" : "false");
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800484
Steven Moreland06074d82020-03-05 23:16:51 +0000485 mAlive = 0;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800486 if (mObitsSent) return;
487
488 mLock.lock();
489 Vector<Obituary>* obits = mObituaries;
Yi Kongfdd8da92018-06-07 17:52:27 -0700490 if(obits != nullptr) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000491 ALOGV("Clearing sent death notification: %p handle %d\n", this, binderHandle());
Devin Moore66d5b7a2022-07-07 21:42:10 +0000492 if (!isRpcBinder()) {
493 if constexpr (kEnableKernelIpc) {
494 IPCThreadState* self = IPCThreadState::self();
495 self->clearDeathNotification(binderHandle(), this);
496 self->flushCommands();
497 }
498 }
Yi Kongfdd8da92018-06-07 17:52:27 -0700499 mObituaries = nullptr;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800500 }
Steven Moreland06074d82020-03-05 23:16:51 +0000501 mObitsSent = 1;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800502 mLock.unlock();
503
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700504 ALOGV("Reporting death of proxy %p for %zu recipients\n",
505 this, obits ? obits->size() : 0U);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800506
Yi Kongfdd8da92018-06-07 17:52:27 -0700507 if (obits != nullptr) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800508 const size_t N = obits->size();
509 for (size_t i=0; i<N; i++) {
510 reportOneDeath(obits->itemAt(i));
511 }
512
513 delete obits;
514 }
515}
516
517void BpBinder::reportOneDeath(const Obituary& obit)
518{
519 sp<DeathRecipient> recipient = obit.recipient.promote();
Steve Block6807e592011-10-20 11:56:00 +0100520 ALOGV("Reporting death to recipient: %p\n", recipient.get());
Yi Kongfdd8da92018-06-07 17:52:27 -0700521 if (recipient == nullptr) return;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800522
Steven Moreland1a3a8ef2021-04-02 02:52:46 +0000523 recipient->binderDied(wp<BpBinder>::fromExisting(this));
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800524}
525
Steven Moreland63a2d512021-06-25 01:10:15 +0000526void* BpBinder::attachObject(const void* objectID, void* object, void* cleanupCookie,
527 object_cleanup_func func) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800528 AutoMutex _l(mLock);
Steve Block6807e592011-10-20 11:56:00 +0100529 ALOGV("Attaching object %p to binder %p (manager=%p)", object, this, &mObjects);
Steven Moreland63a2d512021-06-25 01:10:15 +0000530 return mObjects.attach(objectID, object, cleanupCookie, func);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800531}
532
533void* BpBinder::findObject(const void* objectID) const
534{
535 AutoMutex _l(mLock);
536 return mObjects.find(objectID);
537}
538
Steven Moreland63a2d512021-06-25 01:10:15 +0000539void* BpBinder::detachObject(const void* objectID) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800540 AutoMutex _l(mLock);
Steven Moreland63a2d512021-06-25 01:10:15 +0000541 return mObjects.detach(objectID);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800542}
543
Steven Moreland9e759e82021-06-25 21:30:23 +0000544void BpBinder::withLock(const std::function<void()>& doWithLock) {
545 AutoMutex _l(mLock);
546 doWithLock();
547}
548
Devin Moore3faaa002022-07-27 15:54:06 +0000549sp<IBinder> BpBinder::lookupOrCreateWeak(const void* objectID, object_make_func make,
550 const void* makeArgs) {
551 AutoMutex _l(mLock);
552 return mObjects.lookupOrCreateWeak(objectID, make, makeArgs);
553}
554
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800555BpBinder* BpBinder::remoteBinder()
556{
557 return this;
558}
559
Steven Moreland32150282021-11-12 22:54:53 +0000560BpBinder::~BpBinder() {
Steven Moreland5553ac42020-11-11 02:14:45 +0000561 if (CC_UNLIKELY(isRpcBinder())) return;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800562
Steven Moreland32150282021-11-12 22:54:53 +0000563 if constexpr (!kEnableKernelIpc) {
564 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
565 return;
566 }
567
568 ALOGV("Destroying BpBinder %p handle %d\n", this, binderHandle());
569
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800570 IPCThreadState* ipc = IPCThreadState::self();
571
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700572 if (mTrackedUid >= 0) {
573 AutoMutex _l(sTrackingLock);
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700574 uint32_t trackedValue = sTrackingMap[mTrackedUid];
575 if (CC_UNLIKELY((trackedValue & COUNTING_VALUE_MASK) == 0)) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000576 ALOGE("Unexpected Binder Proxy tracking decrement in %p handle %d\n", this,
577 binderHandle());
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700578 } else {
579 if (CC_UNLIKELY(
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700580 (trackedValue & LIMIT_REACHED_MASK) &&
581 ((trackedValue & COUNTING_VALUE_MASK) <= sBinderProxyCountLowWatermark)
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700582 )) {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700583 ALOGI("Limit reached bit reset for uid %d (fewer than %d proxies from uid %d held)",
Martijn Coenena8d509d2021-09-03 18:06:24 +0200584 getuid(), sBinderProxyCountLowWatermark, mTrackedUid);
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700585 sTrackingMap[mTrackedUid] &= ~LIMIT_REACHED_MASK;
Martijn Coenena8d509d2021-09-03 18:06:24 +0200586 sLastLimitCallbackMap.erase(mTrackedUid);
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700587 }
588 if (--sTrackingMap[mTrackedUid] == 0) {
589 sTrackingMap.erase(mTrackedUid);
590 }
591 }
592 }
593
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800594 if (ipc) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000595 ipc->expungeHandle(binderHandle(), this);
596 ipc->decWeakHandle(binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800597 }
598}
599
Steven Moreland32150282021-11-12 22:54:53 +0000600void BpBinder::onFirstRef() {
Steven Moreland5553ac42020-11-11 02:14:45 +0000601 if (CC_UNLIKELY(isRpcBinder())) return;
Steven Moreland32150282021-11-12 22:54:53 +0000602
603 if constexpr (!kEnableKernelIpc) {
604 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
605 return;
606 }
607
608 ALOGV("onFirstRef BpBinder %p handle %d\n", this, binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800609 IPCThreadState* ipc = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000610 if (ipc) ipc->incStrongHandle(binderHandle(), this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800611}
612
Steven Moreland32150282021-11-12 22:54:53 +0000613void BpBinder::onLastStrongRef(const void* /*id*/) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000614 if (CC_UNLIKELY(isRpcBinder())) {
Steven Moreland4f622fe2021-09-13 17:38:09 -0700615 (void)rpcSession()->sendDecStrong(this);
Steven Moreland5553ac42020-11-11 02:14:45 +0000616 return;
617 }
Steven Moreland32150282021-11-12 22:54:53 +0000618
619 if constexpr (!kEnableKernelIpc) {
620 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
621 return;
622 }
623
624 ALOGV("onLastStrongRef BpBinder %p handle %d\n", this, binderHandle());
Steve Block6807e592011-10-20 11:56:00 +0100625 IF_ALOGV() {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800626 printRefs();
627 }
628 IPCThreadState* ipc = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000629 if (ipc) ipc->decStrongHandle(binderHandle());
Steven Moreland80d23932019-06-07 12:43:27 -0700630
631 mLock.lock();
632 Vector<Obituary>* obits = mObituaries;
633 if(obits != nullptr) {
634 if (!obits->isEmpty()) {
Steven Moreland70fcb4e2019-12-13 17:28:58 -0800635 ALOGI("onLastStrongRef automatically unlinking death recipients: %s",
636 mDescriptorCache.size() ? String8(mDescriptorCache).c_str() : "<uncached descriptor>");
Steven Moreland80d23932019-06-07 12:43:27 -0700637 }
638
Steven Moreland5553ac42020-11-11 02:14:45 +0000639 if (ipc) ipc->clearDeathNotification(binderHandle(), this);
Steven Moreland80d23932019-06-07 12:43:27 -0700640 mObituaries = nullptr;
641 }
642 mLock.unlock();
643
644 if (obits != nullptr) {
645 // XXX Should we tell any remaining DeathRecipient
646 // objects that the last strong ref has gone away, so they
647 // are no longer linked?
648 delete obits;
649 }
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800650}
651
Colin Cross6f4f3ab2014-02-05 17:42:44 -0800652bool BpBinder::onIncStrongAttempted(uint32_t /*flags*/, const void* /*id*/)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800653{
Steven Moreland5553ac42020-11-11 02:14:45 +0000654 // RPC binder doesn't currently support inc from weak binders
655 if (CC_UNLIKELY(isRpcBinder())) return false;
656
Steven Moreland32150282021-11-12 22:54:53 +0000657 if constexpr (!kEnableKernelIpc) {
658 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
659 return false;
660 }
661
Steven Moreland5553ac42020-11-11 02:14:45 +0000662 ALOGV("onIncStrongAttempted BpBinder %p handle %d\n", this, binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800663 IPCThreadState* ipc = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000664 return ipc ? ipc->attemptIncStrongHandle(binderHandle()) == NO_ERROR : false;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800665}
666
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700667uint32_t BpBinder::getBinderProxyCount(uint32_t uid)
668{
669 AutoMutex _l(sTrackingLock);
670 auto it = sTrackingMap.find(uid);
671 if (it != sTrackingMap.end()) {
672 return it->second & COUNTING_VALUE_MASK;
673 }
674 return 0;
675}
676
677void BpBinder::getCountByUid(Vector<uint32_t>& uids, Vector<uint32_t>& counts)
678{
679 AutoMutex _l(sTrackingLock);
680 uids.setCapacity(sTrackingMap.size());
681 counts.setCapacity(sTrackingMap.size());
682 for (const auto& it : sTrackingMap) {
683 uids.push_back(it.first);
684 counts.push_back(it.second & COUNTING_VALUE_MASK);
685 }
686}
687
688void BpBinder::enableCountByUid() { sCountByUidEnabled.store(true); }
689void BpBinder::disableCountByUid() { sCountByUidEnabled.store(false); }
690void BpBinder::setCountByUidEnabled(bool enable) { sCountByUidEnabled.store(enable); }
691
692void BpBinder::setLimitCallback(binder_proxy_limit_callback cb) {
693 AutoMutex _l(sTrackingLock);
694 sLimitCallback = cb;
695}
696
697void BpBinder::setBinderProxyCountWatermarks(int high, int low) {
698 AutoMutex _l(sTrackingLock);
699 sBinderProxyCountHighWatermark = high;
700 sBinderProxyCountLowWatermark = low;
701}
702
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800703// ---------------------------------------------------------------------------
704
Steven Moreland61ff8492019-09-26 16:05:45 -0700705} // namespace android