blob: 825a821cc42365cd73e0196e7f7db7a584aeccf4 [file] [log] [blame]
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -08001/*
2 * Copyright (C) 2005 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#define LOG_TAG "BpBinder"
18//#define LOG_NDEBUG 0
19
Mathias Agopianc5b2c0b2009-05-19 19:08:10 -070020#include <binder/BpBinder.h>
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080021
Mathias Agopianc5b2c0b2009-05-19 19:08:10 -070022#include <binder/IPCThreadState.h>
Dianne Hackborn23eb1e22015-10-07 17:35:27 -070023#include <binder/IResultReceiver.h>
Steven Moreland5553ac42020-11-11 02:14:45 +000024#include <binder/RpcConnection.h>
Steven Moreland6e5a7752019-08-05 20:30:14 -070025#include <binder/Stability.h>
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070026#include <cutils/compiler.h>
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080027#include <utils/Log.h>
28
29#include <stdio.h>
30
Steve Block6807e592011-10-20 11:56:00 +010031//#undef ALOGV
32//#define ALOGV(...) fprintf(stderr, __VA_ARGS__)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080033
34namespace android {
35
36// ---------------------------------------------------------------------------
37
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070038Mutex BpBinder::sTrackingLock;
39std::unordered_map<int32_t,uint32_t> BpBinder::sTrackingMap;
40int BpBinder::sNumTrackedUids = 0;
41std::atomic_bool BpBinder::sCountByUidEnabled(false);
42binder_proxy_limit_callback BpBinder::sLimitCallback;
43bool BpBinder::sBinderProxyThrottleCreate = false;
44
45// Arbitrarily high value that probably distinguishes a bad behaving app
46uint32_t BpBinder::sBinderProxyCountHighWatermark = 2500;
47// Another arbitrary value a binder count needs to drop below before another callback will be called
48uint32_t BpBinder::sBinderProxyCountLowWatermark = 2000;
49
50enum {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -070051 LIMIT_REACHED_MASK = 0x80000000, // A flag denoting that the limit has been reached
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070052 COUNTING_VALUE_MASK = 0x7FFFFFFF, // A mask of the remaining bits for the count value
53};
54
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080055BpBinder::ObjectManager::ObjectManager()
56{
57}
58
59BpBinder::ObjectManager::~ObjectManager()
60{
61 kill();
62}
63
64void BpBinder::ObjectManager::attach(
65 const void* objectID, void* object, void* cleanupCookie,
66 IBinder::object_cleanup_func func)
67{
68 entry_t e;
69 e.object = object;
70 e.cleanupCookie = cleanupCookie;
71 e.func = func;
72
73 if (mObjects.indexOfKey(objectID) >= 0) {
Steve Blocke6f43dd2012-01-06 19:20:56 +000074 ALOGE("Trying to attach object ID %p to binder ObjectManager %p with object %p, but object ID already in use",
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080075 objectID, this, object);
76 return;
77 }
78
79 mObjects.add(objectID, e);
80}
81
82void* BpBinder::ObjectManager::find(const void* objectID) const
83{
84 const ssize_t i = mObjects.indexOfKey(objectID);
Yi Kongfdd8da92018-06-07 17:52:27 -070085 if (i < 0) return nullptr;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080086 return mObjects.valueAt(i).object;
87}
88
89void BpBinder::ObjectManager::detach(const void* objectID)
90{
91 mObjects.removeItem(objectID);
92}
93
94void BpBinder::ObjectManager::kill()
95{
96 const size_t N = mObjects.size();
Mark Salyzynd4ecccf2014-05-30 16:35:57 -070097 ALOGV("Killing %zu objects in manager %p", N, this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080098 for (size_t i=0; i<N; i++) {
99 const entry_t& e = mObjects.valueAt(i);
Yi Kongfdd8da92018-06-07 17:52:27 -0700100 if (e.func != nullptr) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800101 e.func(mObjects.keyAt(i), e.object, e.cleanupCookie);
102 }
103 }
104
105 mObjects.clear();
106}
107
108// ---------------------------------------------------------------------------
109
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700110
111BpBinder* BpBinder::create(int32_t handle) {
112 int32_t trackedUid = -1;
113 if (sCountByUidEnabled) {
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700114 trackedUid = IPCThreadState::self()->getCallingUid();
115 AutoMutex _l(sTrackingLock);
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700116 uint32_t trackedValue = sTrackingMap[trackedUid];
117 if (CC_UNLIKELY(trackedValue & LIMIT_REACHED_MASK)) {
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700118 if (sBinderProxyThrottleCreate) {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700119 return nullptr;
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700120 }
121 } else {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700122 if ((trackedValue & COUNTING_VALUE_MASK) >= sBinderProxyCountHighWatermark) {
123 ALOGE("Too many binder proxy objects sent to uid %d from uid %d (%d proxies held)",
124 getuid(), trackedUid, trackedValue);
125 sTrackingMap[trackedUid] |= LIMIT_REACHED_MASK;
126 if (sLimitCallback) sLimitCallback(trackedUid);
127 if (sBinderProxyThrottleCreate) {
128 ALOGI("Throttling binder proxy creates from uid %d in uid %d until binder proxy"
129 " count drops below %d",
130 trackedUid, getuid(), sBinderProxyCountLowWatermark);
131 return nullptr;
132 }
133 }
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700134 }
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700135 sTrackingMap[trackedUid]++;
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700136 }
Steven Moreland5553ac42020-11-11 02:14:45 +0000137 return new BpBinder(BinderHandle{handle}, trackedUid);
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700138}
139
Steven Moreland5553ac42020-11-11 02:14:45 +0000140BpBinder* BpBinder::create(const sp<RpcConnection>& connection, const RpcAddress& address) {
141 LOG_ALWAYS_FATAL_IF(connection == nullptr, "BpBinder::create null connection");
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800142
Steven Moreland5553ac42020-11-11 02:14:45 +0000143 // These are not currently tracked, since there is no UID or other
144 // identifier to track them with. However, if similar functionality is
145 // needed, connection objects keep track of all BpBinder objects on a
146 // per-connection basis.
147
148 return new BpBinder(SocketHandle{connection, address});
149}
150
151BpBinder::BpBinder(Handle&& handle)
152 : mStability(0),
153 mHandle(handle),
154 mAlive(true),
155 mObitsSent(false),
156 mObituaries(nullptr),
157 mTrackedUid(-1) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800158 extendObjectLifetime(OBJECT_LIFETIME_WEAK);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800159}
160
Steven Moreland5553ac42020-11-11 02:14:45 +0000161BpBinder::BpBinder(BinderHandle&& handle, int32_t trackedUid) : BpBinder(Handle(handle)) {
162 mTrackedUid = trackedUid;
163
164 ALOGV("Creating BpBinder %p handle %d\n", this, this->binderHandle());
165
166 IPCThreadState::self()->incWeakHandle(this->binderHandle(), this);
167}
168
169BpBinder::BpBinder(SocketHandle&& handle) : BpBinder(Handle(handle)) {
170 LOG_ALWAYS_FATAL_IF(rpcConnection() == nullptr, "BpBinder created w/o connection object");
171}
172
173bool BpBinder::isRpcBinder() const {
174 return std::holds_alternative<SocketHandle>(mHandle);
175}
176
177const RpcAddress& BpBinder::rpcAddress() const {
178 return std::get<SocketHandle>(mHandle).address;
179}
180
181const sp<RpcConnection>& BpBinder::rpcConnection() const {
182 return std::get<SocketHandle>(mHandle).connection;
183}
184
185int32_t BpBinder::binderHandle() const {
186 return std::get<BinderHandle>(mHandle).handle;
Steven Moreland85180c02019-07-16 14:24:20 -0700187}
188
Mathias Agopian83c04462009-05-22 19:00:22 -0700189bool BpBinder::isDescriptorCached() const {
190 Mutex::Autolock _l(mLock);
191 return mDescriptorCache.size() ? true : false;
192}
193
194const String16& BpBinder::getInterfaceDescriptor() const
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800195{
Mathias Agopian83c04462009-05-22 19:00:22 -0700196 if (isDescriptorCached() == false) {
197 Parcel send, reply;
198 // do the IPC without a lock held.
199 status_t err = const_cast<BpBinder*>(this)->transact(
200 INTERFACE_TRANSACTION, send, &reply);
201 if (err == NO_ERROR) {
202 String16 res(reply.readString16());
203 Mutex::Autolock _l(mLock);
204 // mDescriptorCache could have been assigned while the lock was
205 // released.
206 if (mDescriptorCache.size() == 0)
207 mDescriptorCache = res;
208 }
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800209 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700210
Mathias Agopian83c04462009-05-22 19:00:22 -0700211 // we're returning a reference to a non-static object here. Usually this
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700212 // is not something smart to do, however, with binder objects it is
Mathias Agopian83c04462009-05-22 19:00:22 -0700213 // (usually) safe because they are reference-counted.
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700214
Mathias Agopian83c04462009-05-22 19:00:22 -0700215 return mDescriptorCache;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800216}
217
218bool BpBinder::isBinderAlive() const
219{
Steven Moreland06074d82020-03-05 23:16:51 +0000220 return mAlive != 0;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800221}
222
223status_t BpBinder::pingBinder()
224{
Steven Moreland5553ac42020-11-11 02:14:45 +0000225 Parcel data;
226 data.markForBinder(this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800227 Parcel reply;
Steven Moreland5553ac42020-11-11 02:14:45 +0000228 return transact(PING_TRANSACTION, data, &reply);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800229}
230
231status_t BpBinder::dump(int fd, const Vector<String16>& args)
232{
233 Parcel send;
234 Parcel reply;
235 send.writeFileDescriptor(fd);
236 const size_t numArgs = args.size();
237 send.writeInt32(numArgs);
238 for (size_t i = 0; i < numArgs; i++) {
239 send.writeString16(args[i]);
240 }
241 status_t err = transact(DUMP_TRANSACTION, send, &reply);
242 return err;
243}
244
Jiyong Parkb86c8662018-10-29 23:01:57 +0900245// NOLINTNEXTLINE(google-default-arguments)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800246status_t BpBinder::transact(
247 uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
248{
249 // Once a binder has died, it will never come back to life.
250 if (mAlive) {
Steven Moreland46b5fea2019-10-15 11:22:18 -0700251 bool privateVendor = flags & FLAG_PRIVATE_VENDOR;
252 // don't send userspace flags to the kernel
253 flags = flags & ~FLAG_PRIVATE_VENDOR;
254
Steven Moreland6e5a7752019-08-05 20:30:14 -0700255 // user transactions require a given stability level
256 if (code >= FIRST_CALL_TRANSACTION && code <= LAST_CALL_TRANSACTION) {
257 using android::internal::Stability;
258
Steven Moreland89ddfc52020-11-13 02:39:26 +0000259 auto category = Stability::getCategory(this);
260 Stability::Level required = privateVendor ? Stability::VENDOR
261 : Stability::getLocalLevel();
Steven Moreland6e5a7752019-08-05 20:30:14 -0700262
Steven Moreland89ddfc52020-11-13 02:39:26 +0000263 if (CC_UNLIKELY(!Stability::check(category, required))) {
Steven Morelandb269b582021-02-10 17:09:11 +0000264 ALOGE("Cannot do a user transaction on a %s binder (%s) in a %s context.",
Steven Moreland89ddfc52020-11-13 02:39:26 +0000265 category.debugString().c_str(),
Steven Morelandb269b582021-02-10 17:09:11 +0000266 String8(getInterfaceDescriptor()).c_str(),
Steven Moreland89ddfc52020-11-13 02:39:26 +0000267 Stability::levelString(required).c_str());
Steven Moreland6e5a7752019-08-05 20:30:14 -0700268 return BAD_TYPE;
269 }
270 }
271
Steven Moreland5553ac42020-11-11 02:14:45 +0000272 status_t status;
273 if (CC_UNLIKELY(isRpcBinder())) {
274 status = rpcConnection()->transact(rpcAddress(), code, data, reply, flags);
275 } else {
276 status = IPCThreadState::self()->transact(binderHandle(), code, data, reply, flags);
277 }
278
Steven Moreland06074d82020-03-05 23:16:51 +0000279 if (status == DEAD_OBJECT) mAlive = 0;
Steven Morelanda86a3562019-08-01 23:28:34 +0000280
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800281 return status;
282 }
283
284 return DEAD_OBJECT;
285}
286
Jiyong Parkb86c8662018-10-29 23:01:57 +0900287// NOLINTNEXTLINE(google-default-arguments)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800288status_t BpBinder::linkToDeath(
289 const sp<DeathRecipient>& recipient, void* cookie, uint32_t flags)
290{
Steven Moreland5553ac42020-11-11 02:14:45 +0000291 if (isRpcBinder()) return UNKNOWN_TRANSACTION;
292
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800293 Obituary ob;
294 ob.recipient = recipient;
295 ob.cookie = cookie;
296 ob.flags = flags;
297
Yi Kongfdd8da92018-06-07 17:52:27 -0700298 LOG_ALWAYS_FATAL_IF(recipient == nullptr,
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800299 "linkToDeath(): recipient must be non-NULL");
300
301 {
302 AutoMutex _l(mLock);
303
304 if (!mObitsSent) {
305 if (!mObituaries) {
306 mObituaries = new Vector<Obituary>;
307 if (!mObituaries) {
308 return NO_MEMORY;
309 }
Steven Moreland5553ac42020-11-11 02:14:45 +0000310 ALOGV("Requesting death notification: %p handle %d\n", this, binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800311 getWeakRefs()->incWeak(this);
312 IPCThreadState* self = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000313 self->requestDeathNotification(binderHandle(), this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800314 self->flushCommands();
315 }
316 ssize_t res = mObituaries->add(ob);
317 return res >= (ssize_t)NO_ERROR ? (status_t)NO_ERROR : res;
318 }
319 }
320
321 return DEAD_OBJECT;
322}
323
Jiyong Parkb86c8662018-10-29 23:01:57 +0900324// NOLINTNEXTLINE(google-default-arguments)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800325status_t BpBinder::unlinkToDeath(
326 const wp<DeathRecipient>& recipient, void* cookie, uint32_t flags,
327 wp<DeathRecipient>* outRecipient)
328{
Steven Moreland5553ac42020-11-11 02:14:45 +0000329 if (isRpcBinder()) return UNKNOWN_TRANSACTION;
330
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800331 AutoMutex _l(mLock);
332
333 if (mObitsSent) {
334 return DEAD_OBJECT;
335 }
336
337 const size_t N = mObituaries ? mObituaries->size() : 0;
338 for (size_t i=0; i<N; i++) {
339 const Obituary& obit = mObituaries->itemAt(i);
340 if ((obit.recipient == recipient
Yi Kongfdd8da92018-06-07 17:52:27 -0700341 || (recipient == nullptr && obit.cookie == cookie))
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800342 && obit.flags == flags) {
Yi Kongfdd8da92018-06-07 17:52:27 -0700343 if (outRecipient != nullptr) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800344 *outRecipient = mObituaries->itemAt(i).recipient;
345 }
346 mObituaries->removeAt(i);
347 if (mObituaries->size() == 0) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000348 ALOGV("Clearing death notification: %p handle %d\n", this, binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800349 IPCThreadState* self = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000350 self->clearDeathNotification(binderHandle(), this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800351 self->flushCommands();
352 delete mObituaries;
Yi Kongfdd8da92018-06-07 17:52:27 -0700353 mObituaries = nullptr;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800354 }
355 return NO_ERROR;
356 }
357 }
358
359 return NAME_NOT_FOUND;
360}
361
362void BpBinder::sendObituary()
363{
Steven Moreland5553ac42020-11-11 02:14:45 +0000364 LOG_ALWAYS_FATAL_IF(isRpcBinder(), "Cannot send obituary for remote binder.");
365
366 ALOGV("Sending obituary for proxy %p handle %d, mObitsSent=%s\n", this, binderHandle(),
367 mObitsSent ? "true" : "false");
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800368
Steven Moreland06074d82020-03-05 23:16:51 +0000369 mAlive = 0;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800370 if (mObitsSent) return;
371
372 mLock.lock();
373 Vector<Obituary>* obits = mObituaries;
Yi Kongfdd8da92018-06-07 17:52:27 -0700374 if(obits != nullptr) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000375 ALOGV("Clearing sent death notification: %p handle %d\n", this, binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800376 IPCThreadState* self = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000377 self->clearDeathNotification(binderHandle(), this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800378 self->flushCommands();
Yi Kongfdd8da92018-06-07 17:52:27 -0700379 mObituaries = nullptr;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800380 }
Steven Moreland06074d82020-03-05 23:16:51 +0000381 mObitsSent = 1;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800382 mLock.unlock();
383
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700384 ALOGV("Reporting death of proxy %p for %zu recipients\n",
385 this, obits ? obits->size() : 0U);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800386
Yi Kongfdd8da92018-06-07 17:52:27 -0700387 if (obits != nullptr) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800388 const size_t N = obits->size();
389 for (size_t i=0; i<N; i++) {
390 reportOneDeath(obits->itemAt(i));
391 }
392
393 delete obits;
394 }
395}
396
397void BpBinder::reportOneDeath(const Obituary& obit)
398{
399 sp<DeathRecipient> recipient = obit.recipient.promote();
Steve Block6807e592011-10-20 11:56:00 +0100400 ALOGV("Reporting death to recipient: %p\n", recipient.get());
Yi Kongfdd8da92018-06-07 17:52:27 -0700401 if (recipient == nullptr) return;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800402
403 recipient->binderDied(this);
404}
405
406
407void BpBinder::attachObject(
408 const void* objectID, void* object, void* cleanupCookie,
409 object_cleanup_func func)
410{
411 AutoMutex _l(mLock);
Steve Block6807e592011-10-20 11:56:00 +0100412 ALOGV("Attaching object %p to binder %p (manager=%p)", object, this, &mObjects);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800413 mObjects.attach(objectID, object, cleanupCookie, func);
414}
415
416void* BpBinder::findObject(const void* objectID) const
417{
418 AutoMutex _l(mLock);
419 return mObjects.find(objectID);
420}
421
422void BpBinder::detachObject(const void* objectID)
423{
424 AutoMutex _l(mLock);
425 mObjects.detach(objectID);
426}
427
428BpBinder* BpBinder::remoteBinder()
429{
430 return this;
431}
432
433BpBinder::~BpBinder()
434{
Steven Moreland5553ac42020-11-11 02:14:45 +0000435 ALOGV("Destroying BpBinder %p handle %d\n", this, binderHandle());
436
437 if (CC_UNLIKELY(isRpcBinder())) return;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800438
439 IPCThreadState* ipc = IPCThreadState::self();
440
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700441 if (mTrackedUid >= 0) {
442 AutoMutex _l(sTrackingLock);
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700443 uint32_t trackedValue = sTrackingMap[mTrackedUid];
444 if (CC_UNLIKELY((trackedValue & COUNTING_VALUE_MASK) == 0)) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000445 ALOGE("Unexpected Binder Proxy tracking decrement in %p handle %d\n", this,
446 binderHandle());
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700447 } else {
448 if (CC_UNLIKELY(
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700449 (trackedValue & LIMIT_REACHED_MASK) &&
450 ((trackedValue & COUNTING_VALUE_MASK) <= sBinderProxyCountLowWatermark)
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700451 )) {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700452 ALOGI("Limit reached bit reset for uid %d (fewer than %d proxies from uid %d held)",
453 getuid(), mTrackedUid, sBinderProxyCountLowWatermark);
454 sTrackingMap[mTrackedUid] &= ~LIMIT_REACHED_MASK;
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700455 }
456 if (--sTrackingMap[mTrackedUid] == 0) {
457 sTrackingMap.erase(mTrackedUid);
458 }
459 }
460 }
461
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800462 if (ipc) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000463 ipc->expungeHandle(binderHandle(), this);
464 ipc->decWeakHandle(binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800465 }
466}
467
468void BpBinder::onFirstRef()
469{
Steven Moreland5553ac42020-11-11 02:14:45 +0000470 ALOGV("onFirstRef BpBinder %p handle %d\n", this, binderHandle());
471 if (CC_UNLIKELY(isRpcBinder())) return;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800472 IPCThreadState* ipc = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000473 if (ipc) ipc->incStrongHandle(binderHandle(), this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800474}
475
Colin Cross6f4f3ab2014-02-05 17:42:44 -0800476void BpBinder::onLastStrongRef(const void* /*id*/)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800477{
Steven Moreland5553ac42020-11-11 02:14:45 +0000478 ALOGV("onLastStrongRef BpBinder %p handle %d\n", this, binderHandle());
479 if (CC_UNLIKELY(isRpcBinder())) {
480 (void)rpcConnection()->sendDecStrong(rpcAddress());
481 return;
482 }
Steve Block6807e592011-10-20 11:56:00 +0100483 IF_ALOGV() {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800484 printRefs();
485 }
486 IPCThreadState* ipc = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000487 if (ipc) ipc->decStrongHandle(binderHandle());
Steven Moreland80d23932019-06-07 12:43:27 -0700488
489 mLock.lock();
490 Vector<Obituary>* obits = mObituaries;
491 if(obits != nullptr) {
492 if (!obits->isEmpty()) {
Steven Moreland70fcb4e2019-12-13 17:28:58 -0800493 ALOGI("onLastStrongRef automatically unlinking death recipients: %s",
494 mDescriptorCache.size() ? String8(mDescriptorCache).c_str() : "<uncached descriptor>");
Steven Moreland80d23932019-06-07 12:43:27 -0700495 }
496
Steven Moreland5553ac42020-11-11 02:14:45 +0000497 if (ipc) ipc->clearDeathNotification(binderHandle(), this);
Steven Moreland80d23932019-06-07 12:43:27 -0700498 mObituaries = nullptr;
499 }
500 mLock.unlock();
501
502 if (obits != nullptr) {
503 // XXX Should we tell any remaining DeathRecipient
504 // objects that the last strong ref has gone away, so they
505 // are no longer linked?
506 delete obits;
507 }
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800508}
509
Colin Cross6f4f3ab2014-02-05 17:42:44 -0800510bool BpBinder::onIncStrongAttempted(uint32_t /*flags*/, const void* /*id*/)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800511{
Steven Moreland5553ac42020-11-11 02:14:45 +0000512 // RPC binder doesn't currently support inc from weak binders
513 if (CC_UNLIKELY(isRpcBinder())) return false;
514
515 ALOGV("onIncStrongAttempted BpBinder %p handle %d\n", this, binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800516 IPCThreadState* ipc = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000517 return ipc ? ipc->attemptIncStrongHandle(binderHandle()) == NO_ERROR : false;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800518}
519
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700520uint32_t BpBinder::getBinderProxyCount(uint32_t uid)
521{
522 AutoMutex _l(sTrackingLock);
523 auto it = sTrackingMap.find(uid);
524 if (it != sTrackingMap.end()) {
525 return it->second & COUNTING_VALUE_MASK;
526 }
527 return 0;
528}
529
530void BpBinder::getCountByUid(Vector<uint32_t>& uids, Vector<uint32_t>& counts)
531{
532 AutoMutex _l(sTrackingLock);
533 uids.setCapacity(sTrackingMap.size());
534 counts.setCapacity(sTrackingMap.size());
535 for (const auto& it : sTrackingMap) {
536 uids.push_back(it.first);
537 counts.push_back(it.second & COUNTING_VALUE_MASK);
538 }
539}
540
541void BpBinder::enableCountByUid() { sCountByUidEnabled.store(true); }
542void BpBinder::disableCountByUid() { sCountByUidEnabled.store(false); }
543void BpBinder::setCountByUidEnabled(bool enable) { sCountByUidEnabled.store(enable); }
544
545void BpBinder::setLimitCallback(binder_proxy_limit_callback cb) {
546 AutoMutex _l(sTrackingLock);
547 sLimitCallback = cb;
548}
549
550void BpBinder::setBinderProxyCountWatermarks(int high, int low) {
551 AutoMutex _l(sTrackingLock);
552 sBinderProxyCountHighWatermark = high;
553 sBinderProxyCountLowWatermark = low;
554}
555
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800556// ---------------------------------------------------------------------------
557
Steven Moreland61ff8492019-09-26 16:05:45 -0700558} // namespace android