blob: 82ebdd7b0f552e6165d14c27f399da21b60652dd [file] [log] [blame]
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -08001/*
2 * Copyright (C) 2005 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#define LOG_TAG "BpBinder"
18//#define LOG_NDEBUG 0
19
Mathias Agopianc5b2c0b2009-05-19 19:08:10 -070020#include <binder/BpBinder.h>
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080021
Mathias Agopianc5b2c0b2009-05-19 19:08:10 -070022#include <binder/IPCThreadState.h>
Dianne Hackborn23eb1e22015-10-07 17:35:27 -070023#include <binder/IResultReceiver.h>
Steven Morelandbdb53ab2021-05-05 17:57:41 +000024#include <binder/RpcSession.h>
Steven Moreland6e5a7752019-08-05 20:30:14 -070025#include <binder/Stability.h>
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070026#include <cutils/compiler.h>
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080027#include <utils/Log.h>
28
29#include <stdio.h>
30
Steven Moreland32150282021-11-12 22:54:53 +000031#include "BuildFlags.h"
32
Steve Block6807e592011-10-20 11:56:00 +010033//#undef ALOGV
34//#define ALOGV(...) fprintf(stderr, __VA_ARGS__)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080035
36namespace android {
37
38// ---------------------------------------------------------------------------
39
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070040Mutex BpBinder::sTrackingLock;
Martijn Coenena8d509d2021-09-03 18:06:24 +020041std::unordered_map<int32_t, uint32_t> BpBinder::sTrackingMap;
42std::unordered_map<int32_t, uint32_t> BpBinder::sLastLimitCallbackMap;
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070043int BpBinder::sNumTrackedUids = 0;
44std::atomic_bool BpBinder::sCountByUidEnabled(false);
45binder_proxy_limit_callback BpBinder::sLimitCallback;
46bool BpBinder::sBinderProxyThrottleCreate = false;
47
48// Arbitrarily high value that probably distinguishes a bad behaving app
49uint32_t BpBinder::sBinderProxyCountHighWatermark = 2500;
50// Another arbitrary value a binder count needs to drop below before another callback will be called
51uint32_t BpBinder::sBinderProxyCountLowWatermark = 2000;
52
Martijn Coenen1cad19c2021-10-04 09:19:01 +020053// Log any transactions for which the data exceeds this size
54#define LOG_TRANSACTIONS_OVER_SIZE (300 * 1024)
55
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070056enum {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -070057 LIMIT_REACHED_MASK = 0x80000000, // A flag denoting that the limit has been reached
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070058 COUNTING_VALUE_MASK = 0x7FFFFFFF, // A mask of the remaining bits for the count value
59};
60
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080061BpBinder::ObjectManager::ObjectManager()
62{
63}
64
65BpBinder::ObjectManager::~ObjectManager()
66{
67 kill();
68}
69
Steven Moreland63a2d512021-06-25 01:10:15 +000070void* BpBinder::ObjectManager::attach(const void* objectID, void* object, void* cleanupCookie,
71 IBinder::object_cleanup_func func) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080072 entry_t e;
73 e.object = object;
74 e.cleanupCookie = cleanupCookie;
75 e.func = func;
76
Jiyong Park5970d0a2022-03-08 16:56:13 +090077 if (mObjects.find(objectID) != mObjects.end()) {
Steven Moreland63a2d512021-06-25 01:10:15 +000078 ALOGI("Trying to attach object ID %p to binder ObjectManager %p with object %p, but object "
79 "ID already in use",
80 objectID, this, object);
Jiyong Park5970d0a2022-03-08 16:56:13 +090081 return mObjects[objectID].object;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080082 }
83
Jiyong Park5970d0a2022-03-08 16:56:13 +090084 mObjects.insert({objectID, e});
Steven Moreland63a2d512021-06-25 01:10:15 +000085 return nullptr;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080086}
87
88void* BpBinder::ObjectManager::find(const void* objectID) const
89{
Jiyong Park5970d0a2022-03-08 16:56:13 +090090 auto i = mObjects.find(objectID);
91 if (i == mObjects.end()) return nullptr;
92 return i->second.object;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080093}
94
Steven Moreland63a2d512021-06-25 01:10:15 +000095void* BpBinder::ObjectManager::detach(const void* objectID) {
Jiyong Park5970d0a2022-03-08 16:56:13 +090096 auto i = mObjects.find(objectID);
97 if (i == mObjects.end()) return nullptr;
98 void* value = i->second.object;
99 mObjects.erase(i);
Steven Moreland63a2d512021-06-25 01:10:15 +0000100 return value;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800101}
102
103void BpBinder::ObjectManager::kill()
104{
105 const size_t N = mObjects.size();
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700106 ALOGV("Killing %zu objects in manager %p", N, this);
Jiyong Park5970d0a2022-03-08 16:56:13 +0900107 for (auto i : mObjects) {
108 const entry_t& e = i.second;
Yi Kongfdd8da92018-06-07 17:52:27 -0700109 if (e.func != nullptr) {
Jiyong Park5970d0a2022-03-08 16:56:13 +0900110 e.func(i.first, e.object, e.cleanupCookie);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800111 }
112 }
113
114 mObjects.clear();
115}
116
117// ---------------------------------------------------------------------------
118
Steven Moreland1a3a8ef2021-04-02 02:52:46 +0000119sp<BpBinder> BpBinder::create(int32_t handle) {
Steven Moreland32150282021-11-12 22:54:53 +0000120 if constexpr (!kEnableKernelIpc) {
121 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
122 return nullptr;
123 }
124
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700125 int32_t trackedUid = -1;
126 if (sCountByUidEnabled) {
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700127 trackedUid = IPCThreadState::self()->getCallingUid();
128 AutoMutex _l(sTrackingLock);
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700129 uint32_t trackedValue = sTrackingMap[trackedUid];
130 if (CC_UNLIKELY(trackedValue & LIMIT_REACHED_MASK)) {
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700131 if (sBinderProxyThrottleCreate) {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700132 return nullptr;
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700133 }
Martijn Coenena8d509d2021-09-03 18:06:24 +0200134 trackedValue = trackedValue & COUNTING_VALUE_MASK;
135 uint32_t lastLimitCallbackAt = sLastLimitCallbackMap[trackedUid];
136
137 if (trackedValue > lastLimitCallbackAt &&
Martijn Coenen6711b6d2021-09-23 09:44:29 +0200138 (trackedValue - lastLimitCallbackAt > sBinderProxyCountHighWatermark)) {
Martijn Coenena8d509d2021-09-03 18:06:24 +0200139 ALOGE("Still too many binder proxy objects sent to uid %d from uid %d (%d proxies "
140 "held)",
141 getuid(), trackedUid, trackedValue);
142 if (sLimitCallback) sLimitCallback(trackedUid);
143 sLastLimitCallbackMap[trackedUid] = trackedValue;
144 }
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700145 } else {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700146 if ((trackedValue & COUNTING_VALUE_MASK) >= sBinderProxyCountHighWatermark) {
147 ALOGE("Too many binder proxy objects sent to uid %d from uid %d (%d proxies held)",
148 getuid(), trackedUid, trackedValue);
149 sTrackingMap[trackedUid] |= LIMIT_REACHED_MASK;
150 if (sLimitCallback) sLimitCallback(trackedUid);
Martijn Coenena8d509d2021-09-03 18:06:24 +0200151 sLastLimitCallbackMap[trackedUid] = trackedValue & COUNTING_VALUE_MASK;
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700152 if (sBinderProxyThrottleCreate) {
153 ALOGI("Throttling binder proxy creates from uid %d in uid %d until binder proxy"
154 " count drops below %d",
155 trackedUid, getuid(), sBinderProxyCountLowWatermark);
156 return nullptr;
157 }
158 }
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700159 }
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700160 sTrackingMap[trackedUid]++;
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700161 }
Steven Moreland1a3a8ef2021-04-02 02:52:46 +0000162 return sp<BpBinder>::make(BinderHandle{handle}, trackedUid);
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700163}
164
Steven Moreland5623d1a2021-09-10 15:45:34 -0700165sp<BpBinder> BpBinder::create(const sp<RpcSession>& session, uint64_t address) {
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000166 LOG_ALWAYS_FATAL_IF(session == nullptr, "BpBinder::create null session");
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800167
Steven Moreland5553ac42020-11-11 02:14:45 +0000168 // These are not currently tracked, since there is no UID or other
169 // identifier to track them with. However, if similar functionality is
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000170 // needed, session objects keep track of all BpBinder objects on a
171 // per-session basis.
Steven Moreland5553ac42020-11-11 02:14:45 +0000172
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000173 return sp<BpBinder>::make(RpcHandle{session, address});
Steven Moreland5553ac42020-11-11 02:14:45 +0000174}
175
176BpBinder::BpBinder(Handle&& handle)
177 : mStability(0),
178 mHandle(handle),
179 mAlive(true),
180 mObitsSent(false),
181 mObituaries(nullptr),
182 mTrackedUid(-1) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800183 extendObjectLifetime(OBJECT_LIFETIME_WEAK);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800184}
185
Steven Moreland5553ac42020-11-11 02:14:45 +0000186BpBinder::BpBinder(BinderHandle&& handle, int32_t trackedUid) : BpBinder(Handle(handle)) {
Steven Moreland32150282021-11-12 22:54:53 +0000187 if constexpr (!kEnableKernelIpc) {
188 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
189 return;
190 }
191
Steven Moreland5553ac42020-11-11 02:14:45 +0000192 mTrackedUid = trackedUid;
193
194 ALOGV("Creating BpBinder %p handle %d\n", this, this->binderHandle());
195
196 IPCThreadState::self()->incWeakHandle(this->binderHandle(), this);
197}
198
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000199BpBinder::BpBinder(RpcHandle&& handle) : BpBinder(Handle(handle)) {
200 LOG_ALWAYS_FATAL_IF(rpcSession() == nullptr, "BpBinder created w/o session object");
Steven Moreland5553ac42020-11-11 02:14:45 +0000201}
202
203bool BpBinder::isRpcBinder() const {
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000204 return std::holds_alternative<RpcHandle>(mHandle);
Steven Moreland5553ac42020-11-11 02:14:45 +0000205}
206
Steven Moreland5623d1a2021-09-10 15:45:34 -0700207uint64_t BpBinder::rpcAddress() const {
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000208 return std::get<RpcHandle>(mHandle).address;
Steven Moreland5553ac42020-11-11 02:14:45 +0000209}
210
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000211const sp<RpcSession>& BpBinder::rpcSession() const {
212 return std::get<RpcHandle>(mHandle).session;
Steven Moreland5553ac42020-11-11 02:14:45 +0000213}
214
215int32_t BpBinder::binderHandle() const {
216 return std::get<BinderHandle>(mHandle).handle;
Steven Moreland85180c02019-07-16 14:24:20 -0700217}
218
Devin Mooref6f2e642021-08-05 19:03:47 +0000219std::optional<int32_t> BpBinder::getDebugBinderHandle() const {
220 if (!isRpcBinder()) {
221 return binderHandle();
222 } else {
223 return std::nullopt;
224 }
225}
226
Mathias Agopian83c04462009-05-22 19:00:22 -0700227bool BpBinder::isDescriptorCached() const {
228 Mutex::Autolock _l(mLock);
229 return mDescriptorCache.size() ? true : false;
230}
231
232const String16& BpBinder::getInterfaceDescriptor() const
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800233{
Mathias Agopian83c04462009-05-22 19:00:22 -0700234 if (isDescriptorCached() == false) {
Steven Moreland1a3a8ef2021-04-02 02:52:46 +0000235 sp<BpBinder> thiz = sp<BpBinder>::fromExisting(const_cast<BpBinder*>(this));
Steven Moreland4cf688f2021-03-31 01:48:58 +0000236
237 Parcel data;
238 data.markForBinder(thiz);
239 Parcel reply;
Mathias Agopian83c04462009-05-22 19:00:22 -0700240 // do the IPC without a lock held.
Steven Moreland4cf688f2021-03-31 01:48:58 +0000241 status_t err = thiz->transact(INTERFACE_TRANSACTION, data, &reply);
Mathias Agopian83c04462009-05-22 19:00:22 -0700242 if (err == NO_ERROR) {
243 String16 res(reply.readString16());
244 Mutex::Autolock _l(mLock);
245 // mDescriptorCache could have been assigned while the lock was
246 // released.
247 if (mDescriptorCache.size() == 0)
248 mDescriptorCache = res;
249 }
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800250 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700251
Mathias Agopian83c04462009-05-22 19:00:22 -0700252 // we're returning a reference to a non-static object here. Usually this
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700253 // is not something smart to do, however, with binder objects it is
Mathias Agopian83c04462009-05-22 19:00:22 -0700254 // (usually) safe because they are reference-counted.
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700255
Mathias Agopian83c04462009-05-22 19:00:22 -0700256 return mDescriptorCache;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800257}
258
259bool BpBinder::isBinderAlive() const
260{
Steven Moreland06074d82020-03-05 23:16:51 +0000261 return mAlive != 0;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800262}
263
264status_t BpBinder::pingBinder()
265{
Steven Moreland5553ac42020-11-11 02:14:45 +0000266 Parcel data;
Steven Moreland1a3a8ef2021-04-02 02:52:46 +0000267 data.markForBinder(sp<BpBinder>::fromExisting(this));
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800268 Parcel reply;
Steven Moreland5553ac42020-11-11 02:14:45 +0000269 return transact(PING_TRANSACTION, data, &reply);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800270}
271
272status_t BpBinder::dump(int fd, const Vector<String16>& args)
273{
274 Parcel send;
275 Parcel reply;
276 send.writeFileDescriptor(fd);
277 const size_t numArgs = args.size();
278 send.writeInt32(numArgs);
279 for (size_t i = 0; i < numArgs; i++) {
280 send.writeString16(args[i]);
281 }
282 status_t err = transact(DUMP_TRANSACTION, send, &reply);
283 return err;
284}
285
Jiyong Parkb86c8662018-10-29 23:01:57 +0900286// NOLINTNEXTLINE(google-default-arguments)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800287status_t BpBinder::transact(
288 uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
289{
290 // Once a binder has died, it will never come back to life.
291 if (mAlive) {
Steven Moreland46b5fea2019-10-15 11:22:18 -0700292 bool privateVendor = flags & FLAG_PRIVATE_VENDOR;
293 // don't send userspace flags to the kernel
Andrei Homescu7cdf5c22022-04-30 03:41:16 +0000294 flags = flags & ~static_cast<uint32_t>(FLAG_PRIVATE_VENDOR);
Steven Moreland46b5fea2019-10-15 11:22:18 -0700295
Steven Moreland6e5a7752019-08-05 20:30:14 -0700296 // user transactions require a given stability level
297 if (code >= FIRST_CALL_TRANSACTION && code <= LAST_CALL_TRANSACTION) {
298 using android::internal::Stability;
299
Steven Moreland16a41062021-07-23 13:35:25 -0700300 int16_t stability = Stability::getRepr(this);
Steven Moreland89ddfc52020-11-13 02:39:26 +0000301 Stability::Level required = privateVendor ? Stability::VENDOR
302 : Stability::getLocalLevel();
Steven Moreland6e5a7752019-08-05 20:30:14 -0700303
Steven Moreland16a41062021-07-23 13:35:25 -0700304 if (CC_UNLIKELY(!Stability::check(stability, required))) {
Steven Morelandb269b582021-02-10 17:09:11 +0000305 ALOGE("Cannot do a user transaction on a %s binder (%s) in a %s context.",
Steven Moreland16a41062021-07-23 13:35:25 -0700306 Stability::levelString(stability).c_str(),
307 String8(getInterfaceDescriptor()).c_str(),
308 Stability::levelString(required).c_str());
Steven Moreland6e5a7752019-08-05 20:30:14 -0700309 return BAD_TYPE;
310 }
311 }
312
Steven Moreland5553ac42020-11-11 02:14:45 +0000313 status_t status;
314 if (CC_UNLIKELY(isRpcBinder())) {
Steven Morelandf5174272021-05-25 00:39:28 +0000315 status = rpcSession()->transact(sp<IBinder>::fromExisting(this), code, data, reply,
316 flags);
Steven Moreland5553ac42020-11-11 02:14:45 +0000317 } else {
Steven Moreland32150282021-11-12 22:54:53 +0000318 if constexpr (!kEnableKernelIpc) {
319 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
320 return INVALID_OPERATION;
321 }
322
Steven Moreland5553ac42020-11-11 02:14:45 +0000323 status = IPCThreadState::self()->transact(binderHandle(), code, data, reply, flags);
324 }
Martijn Coenen1cad19c2021-10-04 09:19:01 +0200325 if (data.dataSize() > LOG_TRANSACTIONS_OVER_SIZE) {
326 Mutex::Autolock _l(mLock);
327 ALOGW("Large outgoing transaction of %zu bytes, interface descriptor %s, code %d",
328 data.dataSize(),
329 mDescriptorCache.size() ? String8(mDescriptorCache).c_str()
330 : "<uncached descriptor>",
331 code);
332 }
Steven Moreland5553ac42020-11-11 02:14:45 +0000333
Steven Moreland06074d82020-03-05 23:16:51 +0000334 if (status == DEAD_OBJECT) mAlive = 0;
Steven Morelanda86a3562019-08-01 23:28:34 +0000335
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800336 return status;
337 }
338
339 return DEAD_OBJECT;
340}
341
Jiyong Parkb86c8662018-10-29 23:01:57 +0900342// NOLINTNEXTLINE(google-default-arguments)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800343status_t BpBinder::linkToDeath(
344 const sp<DeathRecipient>& recipient, void* cookie, uint32_t flags)
345{
Steven Moreland5553ac42020-11-11 02:14:45 +0000346 if (isRpcBinder()) return UNKNOWN_TRANSACTION;
347
Steven Moreland32150282021-11-12 22:54:53 +0000348 if constexpr (!kEnableKernelIpc) {
349 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
350 return INVALID_OPERATION;
351 }
352
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800353 Obituary ob;
354 ob.recipient = recipient;
355 ob.cookie = cookie;
356 ob.flags = flags;
357
Yi Kongfdd8da92018-06-07 17:52:27 -0700358 LOG_ALWAYS_FATAL_IF(recipient == nullptr,
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800359 "linkToDeath(): recipient must be non-NULL");
360
Steven Moreland84859cb2022-07-13 00:48:56 +0000361 if (ProcessState::self()->getThreadPoolMaxTotalThreadCount() == 0) {
362 ALOGW("Linking to death on %s but there are no threads (yet?) listening to incoming "
363 "transactions. See ProcessState::startThreadPool and "
364 "ProcessState::setThreadPoolMaxThreadCount. Generally you should setup the binder "
365 "threadpool before other initialization steps.",
366 String8(getInterfaceDescriptor()).c_str());
367 }
368
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800369 {
370 AutoMutex _l(mLock);
371
372 if (!mObitsSent) {
373 if (!mObituaries) {
374 mObituaries = new Vector<Obituary>;
375 if (!mObituaries) {
376 return NO_MEMORY;
377 }
Steven Moreland5553ac42020-11-11 02:14:45 +0000378 ALOGV("Requesting death notification: %p handle %d\n", this, binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800379 getWeakRefs()->incWeak(this);
380 IPCThreadState* self = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000381 self->requestDeathNotification(binderHandle(), this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800382 self->flushCommands();
383 }
384 ssize_t res = mObituaries->add(ob);
385 return res >= (ssize_t)NO_ERROR ? (status_t)NO_ERROR : res;
386 }
387 }
388
389 return DEAD_OBJECT;
390}
391
Jiyong Parkb86c8662018-10-29 23:01:57 +0900392// NOLINTNEXTLINE(google-default-arguments)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800393status_t BpBinder::unlinkToDeath(
394 const wp<DeathRecipient>& recipient, void* cookie, uint32_t flags,
395 wp<DeathRecipient>* outRecipient)
396{
Steven Moreland5553ac42020-11-11 02:14:45 +0000397 if (isRpcBinder()) return UNKNOWN_TRANSACTION;
398
Steven Moreland32150282021-11-12 22:54:53 +0000399 if constexpr (!kEnableKernelIpc) {
400 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
401 return INVALID_OPERATION;
402 }
403
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800404 AutoMutex _l(mLock);
405
406 if (mObitsSent) {
407 return DEAD_OBJECT;
408 }
409
410 const size_t N = mObituaries ? mObituaries->size() : 0;
411 for (size_t i=0; i<N; i++) {
412 const Obituary& obit = mObituaries->itemAt(i);
413 if ((obit.recipient == recipient
Yi Kongfdd8da92018-06-07 17:52:27 -0700414 || (recipient == nullptr && obit.cookie == cookie))
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800415 && obit.flags == flags) {
Yi Kongfdd8da92018-06-07 17:52:27 -0700416 if (outRecipient != nullptr) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800417 *outRecipient = mObituaries->itemAt(i).recipient;
418 }
419 mObituaries->removeAt(i);
420 if (mObituaries->size() == 0) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000421 ALOGV("Clearing death notification: %p handle %d\n", this, binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800422 IPCThreadState* self = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000423 self->clearDeathNotification(binderHandle(), this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800424 self->flushCommands();
425 delete mObituaries;
Yi Kongfdd8da92018-06-07 17:52:27 -0700426 mObituaries = nullptr;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800427 }
428 return NO_ERROR;
429 }
430 }
431
432 return NAME_NOT_FOUND;
433}
434
435void BpBinder::sendObituary()
436{
Steven Moreland5553ac42020-11-11 02:14:45 +0000437 LOG_ALWAYS_FATAL_IF(isRpcBinder(), "Cannot send obituary for remote binder.");
438
Steven Moreland32150282021-11-12 22:54:53 +0000439 if constexpr (!kEnableKernelIpc) {
440 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
441 return;
442 }
443
Steven Moreland5553ac42020-11-11 02:14:45 +0000444 ALOGV("Sending obituary for proxy %p handle %d, mObitsSent=%s\n", this, binderHandle(),
445 mObitsSent ? "true" : "false");
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800446
Steven Moreland06074d82020-03-05 23:16:51 +0000447 mAlive = 0;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800448 if (mObitsSent) return;
449
450 mLock.lock();
451 Vector<Obituary>* obits = mObituaries;
Yi Kongfdd8da92018-06-07 17:52:27 -0700452 if(obits != nullptr) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000453 ALOGV("Clearing sent death notification: %p handle %d\n", this, binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800454 IPCThreadState* self = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000455 self->clearDeathNotification(binderHandle(), this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800456 self->flushCommands();
Yi Kongfdd8da92018-06-07 17:52:27 -0700457 mObituaries = nullptr;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800458 }
Steven Moreland06074d82020-03-05 23:16:51 +0000459 mObitsSent = 1;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800460 mLock.unlock();
461
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700462 ALOGV("Reporting death of proxy %p for %zu recipients\n",
463 this, obits ? obits->size() : 0U);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800464
Yi Kongfdd8da92018-06-07 17:52:27 -0700465 if (obits != nullptr) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800466 const size_t N = obits->size();
467 for (size_t i=0; i<N; i++) {
468 reportOneDeath(obits->itemAt(i));
469 }
470
471 delete obits;
472 }
473}
474
475void BpBinder::reportOneDeath(const Obituary& obit)
476{
477 sp<DeathRecipient> recipient = obit.recipient.promote();
Steve Block6807e592011-10-20 11:56:00 +0100478 ALOGV("Reporting death to recipient: %p\n", recipient.get());
Yi Kongfdd8da92018-06-07 17:52:27 -0700479 if (recipient == nullptr) return;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800480
Steven Moreland1a3a8ef2021-04-02 02:52:46 +0000481 recipient->binderDied(wp<BpBinder>::fromExisting(this));
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800482}
483
Steven Moreland63a2d512021-06-25 01:10:15 +0000484void* BpBinder::attachObject(const void* objectID, void* object, void* cleanupCookie,
485 object_cleanup_func func) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800486 AutoMutex _l(mLock);
Steve Block6807e592011-10-20 11:56:00 +0100487 ALOGV("Attaching object %p to binder %p (manager=%p)", object, this, &mObjects);
Steven Moreland63a2d512021-06-25 01:10:15 +0000488 return mObjects.attach(objectID, object, cleanupCookie, func);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800489}
490
491void* BpBinder::findObject(const void* objectID) const
492{
493 AutoMutex _l(mLock);
494 return mObjects.find(objectID);
495}
496
Steven Moreland63a2d512021-06-25 01:10:15 +0000497void* BpBinder::detachObject(const void* objectID) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800498 AutoMutex _l(mLock);
Steven Moreland63a2d512021-06-25 01:10:15 +0000499 return mObjects.detach(objectID);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800500}
501
Steven Moreland9e759e82021-06-25 21:30:23 +0000502void BpBinder::withLock(const std::function<void()>& doWithLock) {
503 AutoMutex _l(mLock);
504 doWithLock();
505}
506
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800507BpBinder* BpBinder::remoteBinder()
508{
509 return this;
510}
511
Steven Moreland32150282021-11-12 22:54:53 +0000512BpBinder::~BpBinder() {
Steven Moreland5553ac42020-11-11 02:14:45 +0000513 if (CC_UNLIKELY(isRpcBinder())) return;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800514
Steven Moreland32150282021-11-12 22:54:53 +0000515 if constexpr (!kEnableKernelIpc) {
516 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
517 return;
518 }
519
520 ALOGV("Destroying BpBinder %p handle %d\n", this, binderHandle());
521
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800522 IPCThreadState* ipc = IPCThreadState::self();
523
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700524 if (mTrackedUid >= 0) {
525 AutoMutex _l(sTrackingLock);
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700526 uint32_t trackedValue = sTrackingMap[mTrackedUid];
527 if (CC_UNLIKELY((trackedValue & COUNTING_VALUE_MASK) == 0)) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000528 ALOGE("Unexpected Binder Proxy tracking decrement in %p handle %d\n", this,
529 binderHandle());
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700530 } else {
531 if (CC_UNLIKELY(
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700532 (trackedValue & LIMIT_REACHED_MASK) &&
533 ((trackedValue & COUNTING_VALUE_MASK) <= sBinderProxyCountLowWatermark)
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700534 )) {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700535 ALOGI("Limit reached bit reset for uid %d (fewer than %d proxies from uid %d held)",
Martijn Coenena8d509d2021-09-03 18:06:24 +0200536 getuid(), sBinderProxyCountLowWatermark, mTrackedUid);
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700537 sTrackingMap[mTrackedUid] &= ~LIMIT_REACHED_MASK;
Martijn Coenena8d509d2021-09-03 18:06:24 +0200538 sLastLimitCallbackMap.erase(mTrackedUid);
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700539 }
540 if (--sTrackingMap[mTrackedUid] == 0) {
541 sTrackingMap.erase(mTrackedUid);
542 }
543 }
544 }
545
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800546 if (ipc) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000547 ipc->expungeHandle(binderHandle(), this);
548 ipc->decWeakHandle(binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800549 }
550}
551
Steven Moreland32150282021-11-12 22:54:53 +0000552void BpBinder::onFirstRef() {
Steven Moreland5553ac42020-11-11 02:14:45 +0000553 if (CC_UNLIKELY(isRpcBinder())) return;
Steven Moreland32150282021-11-12 22:54:53 +0000554
555 if constexpr (!kEnableKernelIpc) {
556 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
557 return;
558 }
559
560 ALOGV("onFirstRef BpBinder %p handle %d\n", this, binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800561 IPCThreadState* ipc = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000562 if (ipc) ipc->incStrongHandle(binderHandle(), this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800563}
564
Steven Moreland32150282021-11-12 22:54:53 +0000565void BpBinder::onLastStrongRef(const void* /*id*/) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000566 if (CC_UNLIKELY(isRpcBinder())) {
Steven Moreland4f622fe2021-09-13 17:38:09 -0700567 (void)rpcSession()->sendDecStrong(this);
Steven Moreland5553ac42020-11-11 02:14:45 +0000568 return;
569 }
Steven Moreland32150282021-11-12 22:54:53 +0000570
571 if constexpr (!kEnableKernelIpc) {
572 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
573 return;
574 }
575
576 ALOGV("onLastStrongRef BpBinder %p handle %d\n", this, binderHandle());
Steve Block6807e592011-10-20 11:56:00 +0100577 IF_ALOGV() {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800578 printRefs();
579 }
580 IPCThreadState* ipc = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000581 if (ipc) ipc->decStrongHandle(binderHandle());
Steven Moreland80d23932019-06-07 12:43:27 -0700582
583 mLock.lock();
584 Vector<Obituary>* obits = mObituaries;
585 if(obits != nullptr) {
586 if (!obits->isEmpty()) {
Steven Moreland70fcb4e2019-12-13 17:28:58 -0800587 ALOGI("onLastStrongRef automatically unlinking death recipients: %s",
588 mDescriptorCache.size() ? String8(mDescriptorCache).c_str() : "<uncached descriptor>");
Steven Moreland80d23932019-06-07 12:43:27 -0700589 }
590
Steven Moreland5553ac42020-11-11 02:14:45 +0000591 if (ipc) ipc->clearDeathNotification(binderHandle(), this);
Steven Moreland80d23932019-06-07 12:43:27 -0700592 mObituaries = nullptr;
593 }
594 mLock.unlock();
595
596 if (obits != nullptr) {
597 // XXX Should we tell any remaining DeathRecipient
598 // objects that the last strong ref has gone away, so they
599 // are no longer linked?
600 delete obits;
601 }
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800602}
603
Colin Cross6f4f3ab2014-02-05 17:42:44 -0800604bool BpBinder::onIncStrongAttempted(uint32_t /*flags*/, const void* /*id*/)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800605{
Steven Moreland5553ac42020-11-11 02:14:45 +0000606 // RPC binder doesn't currently support inc from weak binders
607 if (CC_UNLIKELY(isRpcBinder())) return false;
608
Steven Moreland32150282021-11-12 22:54:53 +0000609 if constexpr (!kEnableKernelIpc) {
610 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
611 return false;
612 }
613
Steven Moreland5553ac42020-11-11 02:14:45 +0000614 ALOGV("onIncStrongAttempted BpBinder %p handle %d\n", this, binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800615 IPCThreadState* ipc = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000616 return ipc ? ipc->attemptIncStrongHandle(binderHandle()) == NO_ERROR : false;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800617}
618
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700619uint32_t BpBinder::getBinderProxyCount(uint32_t uid)
620{
621 AutoMutex _l(sTrackingLock);
622 auto it = sTrackingMap.find(uid);
623 if (it != sTrackingMap.end()) {
624 return it->second & COUNTING_VALUE_MASK;
625 }
626 return 0;
627}
628
629void BpBinder::getCountByUid(Vector<uint32_t>& uids, Vector<uint32_t>& counts)
630{
631 AutoMutex _l(sTrackingLock);
632 uids.setCapacity(sTrackingMap.size());
633 counts.setCapacity(sTrackingMap.size());
634 for (const auto& it : sTrackingMap) {
635 uids.push_back(it.first);
636 counts.push_back(it.second & COUNTING_VALUE_MASK);
637 }
638}
639
640void BpBinder::enableCountByUid() { sCountByUidEnabled.store(true); }
641void BpBinder::disableCountByUid() { sCountByUidEnabled.store(false); }
642void BpBinder::setCountByUidEnabled(bool enable) { sCountByUidEnabled.store(enable); }
643
644void BpBinder::setLimitCallback(binder_proxy_limit_callback cb) {
645 AutoMutex _l(sTrackingLock);
646 sLimitCallback = cb;
647}
648
649void BpBinder::setBinderProxyCountWatermarks(int high, int low) {
650 AutoMutex _l(sTrackingLock);
651 sBinderProxyCountHighWatermark = high;
652 sBinderProxyCountLowWatermark = low;
653}
654
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800655// ---------------------------------------------------------------------------
656
Steven Moreland61ff8492019-09-26 16:05:45 -0700657} // namespace android