blob: f35803c01d19aec34189b1fc1ee0269f8bb7aec7 [file] [log] [blame]
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -08001/*
2 * Copyright (C) 2005 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#define LOG_TAG "BpBinder"
18//#define LOG_NDEBUG 0
19
Mathias Agopianc5b2c0b2009-05-19 19:08:10 -070020#include <binder/BpBinder.h>
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080021
Mathias Agopianc5b2c0b2009-05-19 19:08:10 -070022#include <binder/IPCThreadState.h>
Dianne Hackborn23eb1e22015-10-07 17:35:27 -070023#include <binder/IResultReceiver.h>
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070024#include <cutils/compiler.h>
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080025#include <utils/Log.h>
26
27#include <stdio.h>
28
Steve Block6807e592011-10-20 11:56:00 +010029//#undef ALOGV
30//#define ALOGV(...) fprintf(stderr, __VA_ARGS__)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080031
32namespace android {
33
34// ---------------------------------------------------------------------------
35
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070036Mutex BpBinder::sTrackingLock;
37std::unordered_map<int32_t,uint32_t> BpBinder::sTrackingMap;
38int BpBinder::sNumTrackedUids = 0;
39std::atomic_bool BpBinder::sCountByUidEnabled(false);
40binder_proxy_limit_callback BpBinder::sLimitCallback;
41bool BpBinder::sBinderProxyThrottleCreate = false;
42
43// Arbitrarily high value that probably distinguishes a bad behaving app
44uint32_t BpBinder::sBinderProxyCountHighWatermark = 2500;
45// Another arbitrary value a binder count needs to drop below before another callback will be called
46uint32_t BpBinder::sBinderProxyCountLowWatermark = 2000;
47
48enum {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -070049 LIMIT_REACHED_MASK = 0x80000000, // A flag denoting that the limit has been reached
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070050 COUNTING_VALUE_MASK = 0x7FFFFFFF, // A mask of the remaining bits for the count value
51};
52
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080053BpBinder::ObjectManager::ObjectManager()
54{
55}
56
57BpBinder::ObjectManager::~ObjectManager()
58{
59 kill();
60}
61
62void BpBinder::ObjectManager::attach(
63 const void* objectID, void* object, void* cleanupCookie,
64 IBinder::object_cleanup_func func)
65{
66 entry_t e;
67 e.object = object;
68 e.cleanupCookie = cleanupCookie;
69 e.func = func;
70
71 if (mObjects.indexOfKey(objectID) >= 0) {
Steve Blocke6f43dd2012-01-06 19:20:56 +000072 ALOGE("Trying to attach object ID %p to binder ObjectManager %p with object %p, but object ID already in use",
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080073 objectID, this, object);
74 return;
75 }
76
77 mObjects.add(objectID, e);
78}
79
80void* BpBinder::ObjectManager::find(const void* objectID) const
81{
82 const ssize_t i = mObjects.indexOfKey(objectID);
Yi Kongfdd8da92018-06-07 17:52:27 -070083 if (i < 0) return nullptr;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080084 return mObjects.valueAt(i).object;
85}
86
87void BpBinder::ObjectManager::detach(const void* objectID)
88{
89 mObjects.removeItem(objectID);
90}
91
92void BpBinder::ObjectManager::kill()
93{
94 const size_t N = mObjects.size();
Mark Salyzynd4ecccf2014-05-30 16:35:57 -070095 ALOGV("Killing %zu objects in manager %p", N, this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080096 for (size_t i=0; i<N; i++) {
97 const entry_t& e = mObjects.valueAt(i);
Yi Kongfdd8da92018-06-07 17:52:27 -070098 if (e.func != nullptr) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080099 e.func(mObjects.keyAt(i), e.object, e.cleanupCookie);
100 }
101 }
102
103 mObjects.clear();
104}
105
106// ---------------------------------------------------------------------------
107
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700108
109BpBinder* BpBinder::create(int32_t handle) {
110 int32_t trackedUid = -1;
111 if (sCountByUidEnabled) {
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700112 trackedUid = IPCThreadState::self()->getCallingUid();
113 AutoMutex _l(sTrackingLock);
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700114 uint32_t trackedValue = sTrackingMap[trackedUid];
115 if (CC_UNLIKELY(trackedValue & LIMIT_REACHED_MASK)) {
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700116 if (sBinderProxyThrottleCreate) {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700117 return nullptr;
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700118 }
119 } else {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700120 if ((trackedValue & COUNTING_VALUE_MASK) >= sBinderProxyCountHighWatermark) {
121 ALOGE("Too many binder proxy objects sent to uid %d from uid %d (%d proxies held)",
122 getuid(), trackedUid, trackedValue);
123 sTrackingMap[trackedUid] |= LIMIT_REACHED_MASK;
124 if (sLimitCallback) sLimitCallback(trackedUid);
125 if (sBinderProxyThrottleCreate) {
126 ALOGI("Throttling binder proxy creates from uid %d in uid %d until binder proxy"
127 " count drops below %d",
128 trackedUid, getuid(), sBinderProxyCountLowWatermark);
129 return nullptr;
130 }
131 }
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700132 }
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700133 sTrackingMap[trackedUid]++;
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700134 }
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700135 return new BpBinder(handle, trackedUid);
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700136}
137
138BpBinder::BpBinder(int32_t handle, int32_t trackedUid)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800139 : mHandle(handle)
140 , mAlive(1)
141 , mObitsSent(0)
Yi Kongfdd8da92018-06-07 17:52:27 -0700142 , mObituaries(nullptr)
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700143 , mTrackedUid(trackedUid)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800144{
Steve Block6807e592011-10-20 11:56:00 +0100145 ALOGV("Creating BpBinder %p handle %d\n", this, mHandle);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800146
147 extendObjectLifetime(OBJECT_LIFETIME_WEAK);
Martijn Coenen7c170bb2018-05-04 17:28:55 -0700148 IPCThreadState::self()->incWeakHandle(handle, this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800149}
150
Mathias Agopian83c04462009-05-22 19:00:22 -0700151bool BpBinder::isDescriptorCached() const {
152 Mutex::Autolock _l(mLock);
153 return mDescriptorCache.size() ? true : false;
154}
155
156const String16& BpBinder::getInterfaceDescriptor() const
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800157{
Mathias Agopian83c04462009-05-22 19:00:22 -0700158 if (isDescriptorCached() == false) {
159 Parcel send, reply;
160 // do the IPC without a lock held.
161 status_t err = const_cast<BpBinder*>(this)->transact(
162 INTERFACE_TRANSACTION, send, &reply);
163 if (err == NO_ERROR) {
164 String16 res(reply.readString16());
165 Mutex::Autolock _l(mLock);
166 // mDescriptorCache could have been assigned while the lock was
167 // released.
168 if (mDescriptorCache.size() == 0)
169 mDescriptorCache = res;
170 }
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800171 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700172
Mathias Agopian83c04462009-05-22 19:00:22 -0700173 // we're returning a reference to a non-static object here. Usually this
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700174 // is not something smart to do, however, with binder objects it is
Mathias Agopian83c04462009-05-22 19:00:22 -0700175 // (usually) safe because they are reference-counted.
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700176
Mathias Agopian83c04462009-05-22 19:00:22 -0700177 return mDescriptorCache;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800178}
179
180bool BpBinder::isBinderAlive() const
181{
182 return mAlive != 0;
183}
184
185status_t BpBinder::pingBinder()
186{
187 Parcel send;
188 Parcel reply;
Steven Moreland6e69d652019-07-10 14:17:55 -0700189 return transact(PING_TRANSACTION, send, &reply);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800190}
191
192status_t BpBinder::dump(int fd, const Vector<String16>& args)
193{
194 Parcel send;
195 Parcel reply;
196 send.writeFileDescriptor(fd);
197 const size_t numArgs = args.size();
198 send.writeInt32(numArgs);
199 for (size_t i = 0; i < numArgs; i++) {
200 send.writeString16(args[i]);
201 }
202 status_t err = transact(DUMP_TRANSACTION, send, &reply);
203 return err;
204}
205
Jiyong Parkb86c8662018-10-29 23:01:57 +0900206// NOLINTNEXTLINE(google-default-arguments)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800207status_t BpBinder::transact(
208 uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
209{
210 // Once a binder has died, it will never come back to life.
211 if (mAlive) {
212 status_t status = IPCThreadState::self()->transact(
213 mHandle, code, data, reply, flags);
214 if (status == DEAD_OBJECT) mAlive = 0;
215 return status;
216 }
217
218 return DEAD_OBJECT;
219}
220
Jiyong Parkb86c8662018-10-29 23:01:57 +0900221// NOLINTNEXTLINE(google-default-arguments)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800222status_t BpBinder::linkToDeath(
223 const sp<DeathRecipient>& recipient, void* cookie, uint32_t flags)
224{
225 Obituary ob;
226 ob.recipient = recipient;
227 ob.cookie = cookie;
228 ob.flags = flags;
229
Yi Kongfdd8da92018-06-07 17:52:27 -0700230 LOG_ALWAYS_FATAL_IF(recipient == nullptr,
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800231 "linkToDeath(): recipient must be non-NULL");
232
233 {
234 AutoMutex _l(mLock);
235
236 if (!mObitsSent) {
237 if (!mObituaries) {
238 mObituaries = new Vector<Obituary>;
239 if (!mObituaries) {
240 return NO_MEMORY;
241 }
Steve Block6807e592011-10-20 11:56:00 +0100242 ALOGV("Requesting death notification: %p handle %d\n", this, mHandle);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800243 getWeakRefs()->incWeak(this);
244 IPCThreadState* self = IPCThreadState::self();
245 self->requestDeathNotification(mHandle, this);
246 self->flushCommands();
247 }
248 ssize_t res = mObituaries->add(ob);
249 return res >= (ssize_t)NO_ERROR ? (status_t)NO_ERROR : res;
250 }
251 }
252
253 return DEAD_OBJECT;
254}
255
Jiyong Parkb86c8662018-10-29 23:01:57 +0900256// NOLINTNEXTLINE(google-default-arguments)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800257status_t BpBinder::unlinkToDeath(
258 const wp<DeathRecipient>& recipient, void* cookie, uint32_t flags,
259 wp<DeathRecipient>* outRecipient)
260{
261 AutoMutex _l(mLock);
262
263 if (mObitsSent) {
264 return DEAD_OBJECT;
265 }
266
267 const size_t N = mObituaries ? mObituaries->size() : 0;
268 for (size_t i=0; i<N; i++) {
269 const Obituary& obit = mObituaries->itemAt(i);
270 if ((obit.recipient == recipient
Yi Kongfdd8da92018-06-07 17:52:27 -0700271 || (recipient == nullptr && obit.cookie == cookie))
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800272 && obit.flags == flags) {
Yi Kongfdd8da92018-06-07 17:52:27 -0700273 if (outRecipient != nullptr) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800274 *outRecipient = mObituaries->itemAt(i).recipient;
275 }
276 mObituaries->removeAt(i);
277 if (mObituaries->size() == 0) {
Steve Block6807e592011-10-20 11:56:00 +0100278 ALOGV("Clearing death notification: %p handle %d\n", this, mHandle);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800279 IPCThreadState* self = IPCThreadState::self();
280 self->clearDeathNotification(mHandle, this);
281 self->flushCommands();
282 delete mObituaries;
Yi Kongfdd8da92018-06-07 17:52:27 -0700283 mObituaries = nullptr;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800284 }
285 return NO_ERROR;
286 }
287 }
288
289 return NAME_NOT_FOUND;
290}
291
292void BpBinder::sendObituary()
293{
Steve Block6807e592011-10-20 11:56:00 +0100294 ALOGV("Sending obituary for proxy %p handle %d, mObitsSent=%s\n",
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800295 this, mHandle, mObitsSent ? "true" : "false");
296
297 mAlive = 0;
298 if (mObitsSent) return;
299
300 mLock.lock();
301 Vector<Obituary>* obits = mObituaries;
Yi Kongfdd8da92018-06-07 17:52:27 -0700302 if(obits != nullptr) {
Steve Block6807e592011-10-20 11:56:00 +0100303 ALOGV("Clearing sent death notification: %p handle %d\n", this, mHandle);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800304 IPCThreadState* self = IPCThreadState::self();
305 self->clearDeathNotification(mHandle, this);
306 self->flushCommands();
Yi Kongfdd8da92018-06-07 17:52:27 -0700307 mObituaries = nullptr;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800308 }
309 mObitsSent = 1;
310 mLock.unlock();
311
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700312 ALOGV("Reporting death of proxy %p for %zu recipients\n",
313 this, obits ? obits->size() : 0U);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800314
Yi Kongfdd8da92018-06-07 17:52:27 -0700315 if (obits != nullptr) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800316 const size_t N = obits->size();
317 for (size_t i=0; i<N; i++) {
318 reportOneDeath(obits->itemAt(i));
319 }
320
321 delete obits;
322 }
323}
324
325void BpBinder::reportOneDeath(const Obituary& obit)
326{
327 sp<DeathRecipient> recipient = obit.recipient.promote();
Steve Block6807e592011-10-20 11:56:00 +0100328 ALOGV("Reporting death to recipient: %p\n", recipient.get());
Yi Kongfdd8da92018-06-07 17:52:27 -0700329 if (recipient == nullptr) return;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800330
331 recipient->binderDied(this);
332}
333
334
335void BpBinder::attachObject(
336 const void* objectID, void* object, void* cleanupCookie,
337 object_cleanup_func func)
338{
339 AutoMutex _l(mLock);
Steve Block6807e592011-10-20 11:56:00 +0100340 ALOGV("Attaching object %p to binder %p (manager=%p)", object, this, &mObjects);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800341 mObjects.attach(objectID, object, cleanupCookie, func);
342}
343
344void* BpBinder::findObject(const void* objectID) const
345{
346 AutoMutex _l(mLock);
347 return mObjects.find(objectID);
348}
349
350void BpBinder::detachObject(const void* objectID)
351{
352 AutoMutex _l(mLock);
353 mObjects.detach(objectID);
354}
355
356BpBinder* BpBinder::remoteBinder()
357{
358 return this;
359}
360
361BpBinder::~BpBinder()
362{
Steve Block6807e592011-10-20 11:56:00 +0100363 ALOGV("Destroying BpBinder %p handle %d\n", this, mHandle);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800364
365 IPCThreadState* ipc = IPCThreadState::self();
366
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700367 if (mTrackedUid >= 0) {
368 AutoMutex _l(sTrackingLock);
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700369 uint32_t trackedValue = sTrackingMap[mTrackedUid];
370 if (CC_UNLIKELY((trackedValue & COUNTING_VALUE_MASK) == 0)) {
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700371 ALOGE("Unexpected Binder Proxy tracking decrement in %p handle %d\n", this, mHandle);
372 } else {
373 if (CC_UNLIKELY(
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700374 (trackedValue & LIMIT_REACHED_MASK) &&
375 ((trackedValue & COUNTING_VALUE_MASK) <= sBinderProxyCountLowWatermark)
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700376 )) {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700377 ALOGI("Limit reached bit reset for uid %d (fewer than %d proxies from uid %d held)",
378 getuid(), mTrackedUid, sBinderProxyCountLowWatermark);
379 sTrackingMap[mTrackedUid] &= ~LIMIT_REACHED_MASK;
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700380 }
381 if (--sTrackingMap[mTrackedUid] == 0) {
382 sTrackingMap.erase(mTrackedUid);
383 }
384 }
385 }
386
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800387 if (ipc) {
388 ipc->expungeHandle(mHandle, this);
389 ipc->decWeakHandle(mHandle);
390 }
391}
392
393void BpBinder::onFirstRef()
394{
Steve Block6807e592011-10-20 11:56:00 +0100395 ALOGV("onFirstRef BpBinder %p handle %d\n", this, mHandle);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800396 IPCThreadState* ipc = IPCThreadState::self();
Martijn Coenen7c170bb2018-05-04 17:28:55 -0700397 if (ipc) ipc->incStrongHandle(mHandle, this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800398}
399
Colin Cross6f4f3ab2014-02-05 17:42:44 -0800400void BpBinder::onLastStrongRef(const void* /*id*/)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800401{
Steve Block6807e592011-10-20 11:56:00 +0100402 ALOGV("onLastStrongRef BpBinder %p handle %d\n", this, mHandle);
403 IF_ALOGV() {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800404 printRefs();
405 }
406 IPCThreadState* ipc = IPCThreadState::self();
407 if (ipc) ipc->decStrongHandle(mHandle);
Steven Moreland80d23932019-06-07 12:43:27 -0700408
409 mLock.lock();
410 Vector<Obituary>* obits = mObituaries;
411 if(obits != nullptr) {
412 if (!obits->isEmpty()) {
413 ALOGI("onLastStrongRef automatically unlinking death recipients");
414 }
415
416 if (ipc) ipc->clearDeathNotification(mHandle, this);
417 mObituaries = nullptr;
418 }
419 mLock.unlock();
420
421 if (obits != nullptr) {
422 // XXX Should we tell any remaining DeathRecipient
423 // objects that the last strong ref has gone away, so they
424 // are no longer linked?
425 delete obits;
426 }
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800427}
428
Colin Cross6f4f3ab2014-02-05 17:42:44 -0800429bool BpBinder::onIncStrongAttempted(uint32_t /*flags*/, const void* /*id*/)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800430{
Steve Block6807e592011-10-20 11:56:00 +0100431 ALOGV("onIncStrongAttempted BpBinder %p handle %d\n", this, mHandle);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800432 IPCThreadState* ipc = IPCThreadState::self();
433 return ipc ? ipc->attemptIncStrongHandle(mHandle) == NO_ERROR : false;
434}
435
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700436uint32_t BpBinder::getBinderProxyCount(uint32_t uid)
437{
438 AutoMutex _l(sTrackingLock);
439 auto it = sTrackingMap.find(uid);
440 if (it != sTrackingMap.end()) {
441 return it->second & COUNTING_VALUE_MASK;
442 }
443 return 0;
444}
445
446void BpBinder::getCountByUid(Vector<uint32_t>& uids, Vector<uint32_t>& counts)
447{
448 AutoMutex _l(sTrackingLock);
449 uids.setCapacity(sTrackingMap.size());
450 counts.setCapacity(sTrackingMap.size());
451 for (const auto& it : sTrackingMap) {
452 uids.push_back(it.first);
453 counts.push_back(it.second & COUNTING_VALUE_MASK);
454 }
455}
456
457void BpBinder::enableCountByUid() { sCountByUidEnabled.store(true); }
458void BpBinder::disableCountByUid() { sCountByUidEnabled.store(false); }
459void BpBinder::setCountByUidEnabled(bool enable) { sCountByUidEnabled.store(enable); }
460
461void BpBinder::setLimitCallback(binder_proxy_limit_callback cb) {
462 AutoMutex _l(sTrackingLock);
463 sLimitCallback = cb;
464}
465
466void BpBinder::setBinderProxyCountWatermarks(int high, int low) {
467 AutoMutex _l(sTrackingLock);
468 sBinderProxyCountHighWatermark = high;
469 sBinderProxyCountLowWatermark = low;
470}
471
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800472// ---------------------------------------------------------------------------
473
474}; // namespace android