blob: d03326eb046a048eeec22c36e2695267325e3b96 [file] [log] [blame]
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -08001/*
2 * Copyright (C) 2005 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17#define LOG_TAG "BpBinder"
18//#define LOG_NDEBUG 0
19
Mathias Agopianc5b2c0b2009-05-19 19:08:10 -070020#include <binder/BpBinder.h>
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080021
Mathias Agopianc5b2c0b2009-05-19 19:08:10 -070022#include <binder/IPCThreadState.h>
Dianne Hackborn23eb1e22015-10-07 17:35:27 -070023#include <binder/IResultReceiver.h>
Steven Morelandbdb53ab2021-05-05 17:57:41 +000024#include <binder/RpcSession.h>
Steven Moreland6e5a7752019-08-05 20:30:14 -070025#include <binder/Stability.h>
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070026#include <cutils/compiler.h>
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080027#include <utils/Log.h>
28
29#include <stdio.h>
30
Steven Moreland32150282021-11-12 22:54:53 +000031#include "BuildFlags.h"
32
Sahil Somani2522b072022-08-08 14:07:47 -070033#include <android-base/file.h>
34
Steve Block6807e592011-10-20 11:56:00 +010035//#undef ALOGV
36//#define ALOGV(...) fprintf(stderr, __VA_ARGS__)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080037
38namespace android {
39
40// ---------------------------------------------------------------------------
41
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070042Mutex BpBinder::sTrackingLock;
Martijn Coenena8d509d2021-09-03 18:06:24 +020043std::unordered_map<int32_t, uint32_t> BpBinder::sTrackingMap;
44std::unordered_map<int32_t, uint32_t> BpBinder::sLastLimitCallbackMap;
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070045int BpBinder::sNumTrackedUids = 0;
46std::atomic_bool BpBinder::sCountByUidEnabled(false);
47binder_proxy_limit_callback BpBinder::sLimitCallback;
48bool BpBinder::sBinderProxyThrottleCreate = false;
49
Steven Morelandf2830fe2022-12-21 00:45:34 +000050static StaticString16 kDescriptorUninit(u"<uninit descriptor>");
51
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070052// Arbitrarily high value that probably distinguishes a bad behaving app
53uint32_t BpBinder::sBinderProxyCountHighWatermark = 2500;
54// Another arbitrary value a binder count needs to drop below before another callback will be called
55uint32_t BpBinder::sBinderProxyCountLowWatermark = 2000;
56
Martijn Coenen1cad19c2021-10-04 09:19:01 +020057// Log any transactions for which the data exceeds this size
58#define LOG_TRANSACTIONS_OVER_SIZE (300 * 1024)
59
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070060enum {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -070061 LIMIT_REACHED_MASK = 0x80000000, // A flag denoting that the limit has been reached
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -070062 COUNTING_VALUE_MASK = 0x7FFFFFFF, // A mask of the remaining bits for the count value
63};
64
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080065BpBinder::ObjectManager::ObjectManager()
66{
67}
68
69BpBinder::ObjectManager::~ObjectManager()
70{
71 kill();
72}
73
Steven Moreland63a2d512021-06-25 01:10:15 +000074void* BpBinder::ObjectManager::attach(const void* objectID, void* object, void* cleanupCookie,
75 IBinder::object_cleanup_func func) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080076 entry_t e;
77 e.object = object;
78 e.cleanupCookie = cleanupCookie;
79 e.func = func;
80
Jiyong Park5970d0a2022-03-08 16:56:13 +090081 if (mObjects.find(objectID) != mObjects.end()) {
Steven Moreland63a2d512021-06-25 01:10:15 +000082 ALOGI("Trying to attach object ID %p to binder ObjectManager %p with object %p, but object "
83 "ID already in use",
84 objectID, this, object);
Jiyong Park5970d0a2022-03-08 16:56:13 +090085 return mObjects[objectID].object;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080086 }
87
Jiyong Park5970d0a2022-03-08 16:56:13 +090088 mObjects.insert({objectID, e});
Steven Moreland63a2d512021-06-25 01:10:15 +000089 return nullptr;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080090}
91
92void* BpBinder::ObjectManager::find(const void* objectID) const
93{
Jiyong Park5970d0a2022-03-08 16:56:13 +090094 auto i = mObjects.find(objectID);
95 if (i == mObjects.end()) return nullptr;
96 return i->second.object;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -080097}
98
Steven Moreland63a2d512021-06-25 01:10:15 +000099void* BpBinder::ObjectManager::detach(const void* objectID) {
Jiyong Park5970d0a2022-03-08 16:56:13 +0900100 auto i = mObjects.find(objectID);
101 if (i == mObjects.end()) return nullptr;
102 void* value = i->second.object;
103 mObjects.erase(i);
Steven Moreland63a2d512021-06-25 01:10:15 +0000104 return value;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800105}
106
Devin Moore3faaa002022-07-27 15:54:06 +0000107namespace {
108struct Tag {
109 wp<IBinder> binder;
110};
111} // namespace
112
113static void cleanWeak(const void* /* id */, void* obj, void* /* cookie */) {
114 delete static_cast<Tag*>(obj);
115}
116
117sp<IBinder> BpBinder::ObjectManager::lookupOrCreateWeak(const void* objectID, object_make_func make,
118 const void* makeArgs) {
119 entry_t& e = mObjects[objectID];
120 if (e.object != nullptr) {
121 if (auto attached = static_cast<Tag*>(e.object)->binder.promote()) {
122 return attached;
123 }
124 } else {
125 e.object = new Tag;
126 LOG_ALWAYS_FATAL_IF(!e.object, "no more memory");
127 }
128 sp<IBinder> newObj = make(makeArgs);
129
130 static_cast<Tag*>(e.object)->binder = newObj;
131 e.cleanupCookie = nullptr;
132 e.func = cleanWeak;
133
134 return newObj;
135}
136
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800137void BpBinder::ObjectManager::kill()
138{
139 const size_t N = mObjects.size();
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700140 ALOGV("Killing %zu objects in manager %p", N, this);
Jiyong Park5970d0a2022-03-08 16:56:13 +0900141 for (auto i : mObjects) {
142 const entry_t& e = i.second;
Yi Kongfdd8da92018-06-07 17:52:27 -0700143 if (e.func != nullptr) {
Jiyong Park5970d0a2022-03-08 16:56:13 +0900144 e.func(i.first, e.object, e.cleanupCookie);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800145 }
146 }
147
148 mObjects.clear();
149}
150
151// ---------------------------------------------------------------------------
152
Steven Moreland1a3a8ef2021-04-02 02:52:46 +0000153sp<BpBinder> BpBinder::create(int32_t handle) {
Steven Moreland32150282021-11-12 22:54:53 +0000154 if constexpr (!kEnableKernelIpc) {
155 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
156 return nullptr;
157 }
158
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700159 int32_t trackedUid = -1;
160 if (sCountByUidEnabled) {
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700161 trackedUid = IPCThreadState::self()->getCallingUid();
162 AutoMutex _l(sTrackingLock);
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700163 uint32_t trackedValue = sTrackingMap[trackedUid];
164 if (CC_UNLIKELY(trackedValue & LIMIT_REACHED_MASK)) {
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700165 if (sBinderProxyThrottleCreate) {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700166 return nullptr;
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700167 }
Martijn Coenena8d509d2021-09-03 18:06:24 +0200168 trackedValue = trackedValue & COUNTING_VALUE_MASK;
169 uint32_t lastLimitCallbackAt = sLastLimitCallbackMap[trackedUid];
170
171 if (trackedValue > lastLimitCallbackAt &&
Martijn Coenen6711b6d2021-09-23 09:44:29 +0200172 (trackedValue - lastLimitCallbackAt > sBinderProxyCountHighWatermark)) {
Martijn Coenena8d509d2021-09-03 18:06:24 +0200173 ALOGE("Still too many binder proxy objects sent to uid %d from uid %d (%d proxies "
174 "held)",
175 getuid(), trackedUid, trackedValue);
176 if (sLimitCallback) sLimitCallback(trackedUid);
177 sLastLimitCallbackMap[trackedUid] = trackedValue;
178 }
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700179 } else {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700180 if ((trackedValue & COUNTING_VALUE_MASK) >= sBinderProxyCountHighWatermark) {
181 ALOGE("Too many binder proxy objects sent to uid %d from uid %d (%d proxies held)",
182 getuid(), trackedUid, trackedValue);
183 sTrackingMap[trackedUid] |= LIMIT_REACHED_MASK;
184 if (sLimitCallback) sLimitCallback(trackedUid);
Martijn Coenena8d509d2021-09-03 18:06:24 +0200185 sLastLimitCallbackMap[trackedUid] = trackedValue & COUNTING_VALUE_MASK;
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700186 if (sBinderProxyThrottleCreate) {
187 ALOGI("Throttling binder proxy creates from uid %d in uid %d until binder proxy"
188 " count drops below %d",
189 trackedUid, getuid(), sBinderProxyCountLowWatermark);
190 return nullptr;
191 }
192 }
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700193 }
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700194 sTrackingMap[trackedUid]++;
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700195 }
Steven Moreland1a3a8ef2021-04-02 02:52:46 +0000196 return sp<BpBinder>::make(BinderHandle{handle}, trackedUid);
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700197}
198
Steven Moreland5623d1a2021-09-10 15:45:34 -0700199sp<BpBinder> BpBinder::create(const sp<RpcSession>& session, uint64_t address) {
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000200 LOG_ALWAYS_FATAL_IF(session == nullptr, "BpBinder::create null session");
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800201
Steven Moreland5553ac42020-11-11 02:14:45 +0000202 // These are not currently tracked, since there is no UID or other
203 // identifier to track them with. However, if similar functionality is
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000204 // needed, session objects keep track of all BpBinder objects on a
205 // per-session basis.
Steven Moreland5553ac42020-11-11 02:14:45 +0000206
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000207 return sp<BpBinder>::make(RpcHandle{session, address});
Steven Moreland5553ac42020-11-11 02:14:45 +0000208}
209
210BpBinder::BpBinder(Handle&& handle)
211 : mStability(0),
212 mHandle(handle),
213 mAlive(true),
214 mObitsSent(false),
215 mObituaries(nullptr),
Steven Morelandf2830fe2022-12-21 00:45:34 +0000216 mDescriptorCache(kDescriptorUninit),
Steven Moreland5553ac42020-11-11 02:14:45 +0000217 mTrackedUid(-1) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800218 extendObjectLifetime(OBJECT_LIFETIME_WEAK);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800219}
220
Steven Moreland5553ac42020-11-11 02:14:45 +0000221BpBinder::BpBinder(BinderHandle&& handle, int32_t trackedUid) : BpBinder(Handle(handle)) {
Steven Moreland32150282021-11-12 22:54:53 +0000222 if constexpr (!kEnableKernelIpc) {
223 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
224 return;
225 }
226
Steven Moreland5553ac42020-11-11 02:14:45 +0000227 mTrackedUid = trackedUid;
228
229 ALOGV("Creating BpBinder %p handle %d\n", this, this->binderHandle());
230
231 IPCThreadState::self()->incWeakHandle(this->binderHandle(), this);
232}
233
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000234BpBinder::BpBinder(RpcHandle&& handle) : BpBinder(Handle(handle)) {
235 LOG_ALWAYS_FATAL_IF(rpcSession() == nullptr, "BpBinder created w/o session object");
Steven Moreland5553ac42020-11-11 02:14:45 +0000236}
237
238bool BpBinder::isRpcBinder() const {
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000239 return std::holds_alternative<RpcHandle>(mHandle);
Steven Moreland5553ac42020-11-11 02:14:45 +0000240}
241
Steven Moreland5623d1a2021-09-10 15:45:34 -0700242uint64_t BpBinder::rpcAddress() const {
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000243 return std::get<RpcHandle>(mHandle).address;
Steven Moreland5553ac42020-11-11 02:14:45 +0000244}
245
Steven Morelandbdb53ab2021-05-05 17:57:41 +0000246const sp<RpcSession>& BpBinder::rpcSession() const {
247 return std::get<RpcHandle>(mHandle).session;
Steven Moreland5553ac42020-11-11 02:14:45 +0000248}
249
250int32_t BpBinder::binderHandle() const {
251 return std::get<BinderHandle>(mHandle).handle;
Steven Moreland85180c02019-07-16 14:24:20 -0700252}
253
Devin Mooref6f2e642021-08-05 19:03:47 +0000254std::optional<int32_t> BpBinder::getDebugBinderHandle() const {
255 if (!isRpcBinder()) {
256 return binderHandle();
257 } else {
258 return std::nullopt;
259 }
260}
261
Mathias Agopian83c04462009-05-22 19:00:22 -0700262bool BpBinder::isDescriptorCached() const {
263 Mutex::Autolock _l(mLock);
Steven Morelandf2830fe2022-12-21 00:45:34 +0000264 return mDescriptorCache.string() != kDescriptorUninit.string();
Mathias Agopian83c04462009-05-22 19:00:22 -0700265}
266
267const String16& BpBinder::getInterfaceDescriptor() const
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800268{
Steven Morelandf2830fe2022-12-21 00:45:34 +0000269 if (!isDescriptorCached()) {
Steven Moreland1a3a8ef2021-04-02 02:52:46 +0000270 sp<BpBinder> thiz = sp<BpBinder>::fromExisting(const_cast<BpBinder*>(this));
Steven Moreland4cf688f2021-03-31 01:48:58 +0000271
272 Parcel data;
273 data.markForBinder(thiz);
274 Parcel reply;
Mathias Agopian83c04462009-05-22 19:00:22 -0700275 // do the IPC without a lock held.
Steven Moreland4cf688f2021-03-31 01:48:58 +0000276 status_t err = thiz->transact(INTERFACE_TRANSACTION, data, &reply);
Mathias Agopian83c04462009-05-22 19:00:22 -0700277 if (err == NO_ERROR) {
278 String16 res(reply.readString16());
279 Mutex::Autolock _l(mLock);
280 // mDescriptorCache could have been assigned while the lock was
281 // released.
Steven Morelandf2830fe2022-12-21 00:45:34 +0000282 if (mDescriptorCache.string() == kDescriptorUninit.string()) mDescriptorCache = res;
Mathias Agopian83c04462009-05-22 19:00:22 -0700283 }
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800284 }
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700285
Mathias Agopian83c04462009-05-22 19:00:22 -0700286 // we're returning a reference to a non-static object here. Usually this
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700287 // is not something smart to do, however, with binder objects it is
Mathias Agopian83c04462009-05-22 19:00:22 -0700288 // (usually) safe because they are reference-counted.
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700289
Mathias Agopian83c04462009-05-22 19:00:22 -0700290 return mDescriptorCache;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800291}
292
293bool BpBinder::isBinderAlive() const
294{
Steven Moreland06074d82020-03-05 23:16:51 +0000295 return mAlive != 0;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800296}
297
298status_t BpBinder::pingBinder()
299{
Steven Moreland5553ac42020-11-11 02:14:45 +0000300 Parcel data;
Steven Moreland1a3a8ef2021-04-02 02:52:46 +0000301 data.markForBinder(sp<BpBinder>::fromExisting(this));
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800302 Parcel reply;
Steven Moreland5553ac42020-11-11 02:14:45 +0000303 return transact(PING_TRANSACTION, data, &reply);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800304}
305
Sahil Somani2522b072022-08-08 14:07:47 -0700306status_t BpBinder::startRecordingBinder(const android::base::unique_fd& fd) {
307 Parcel send, reply;
308 send.writeUniqueFileDescriptor(fd);
309 return transact(START_RECORDING_TRANSACTION, send, &reply);
310}
311
312status_t BpBinder::stopRecordingBinder() {
313 Parcel data, reply;
314 data.markForBinder(sp<BpBinder>::fromExisting(this));
315 return transact(STOP_RECORDING_TRANSACTION, data, &reply);
316}
317
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800318status_t BpBinder::dump(int fd, const Vector<String16>& args)
319{
320 Parcel send;
321 Parcel reply;
322 send.writeFileDescriptor(fd);
323 const size_t numArgs = args.size();
324 send.writeInt32(numArgs);
325 for (size_t i = 0; i < numArgs; i++) {
326 send.writeString16(args[i]);
327 }
328 status_t err = transact(DUMP_TRANSACTION, send, &reply);
329 return err;
330}
331
Jiyong Parkb86c8662018-10-29 23:01:57 +0900332// NOLINTNEXTLINE(google-default-arguments)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800333status_t BpBinder::transact(
334 uint32_t code, const Parcel& data, Parcel* reply, uint32_t flags)
335{
336 // Once a binder has died, it will never come back to life.
337 if (mAlive) {
Steven Moreland46b5fea2019-10-15 11:22:18 -0700338 bool privateVendor = flags & FLAG_PRIVATE_VENDOR;
339 // don't send userspace flags to the kernel
Andrei Homescu7cdf5c22022-04-30 03:41:16 +0000340 flags = flags & ~static_cast<uint32_t>(FLAG_PRIVATE_VENDOR);
Steven Moreland46b5fea2019-10-15 11:22:18 -0700341
Steven Moreland6e5a7752019-08-05 20:30:14 -0700342 // user transactions require a given stability level
343 if (code >= FIRST_CALL_TRANSACTION && code <= LAST_CALL_TRANSACTION) {
344 using android::internal::Stability;
345
Steven Moreland16a41062021-07-23 13:35:25 -0700346 int16_t stability = Stability::getRepr(this);
Steven Moreland89ddfc52020-11-13 02:39:26 +0000347 Stability::Level required = privateVendor ? Stability::VENDOR
348 : Stability::getLocalLevel();
Steven Moreland6e5a7752019-08-05 20:30:14 -0700349
Steven Moreland16a41062021-07-23 13:35:25 -0700350 if (CC_UNLIKELY(!Stability::check(stability, required))) {
Steven Morelandb269b582021-02-10 17:09:11 +0000351 ALOGE("Cannot do a user transaction on a %s binder (%s) in a %s context.",
Steven Moreland16a41062021-07-23 13:35:25 -0700352 Stability::levelString(stability).c_str(),
353 String8(getInterfaceDescriptor()).c_str(),
354 Stability::levelString(required).c_str());
Steven Moreland6e5a7752019-08-05 20:30:14 -0700355 return BAD_TYPE;
356 }
357 }
358
Steven Moreland5553ac42020-11-11 02:14:45 +0000359 status_t status;
360 if (CC_UNLIKELY(isRpcBinder())) {
Steven Morelandf5174272021-05-25 00:39:28 +0000361 status = rpcSession()->transact(sp<IBinder>::fromExisting(this), code, data, reply,
362 flags);
Steven Moreland5553ac42020-11-11 02:14:45 +0000363 } else {
Steven Moreland32150282021-11-12 22:54:53 +0000364 if constexpr (!kEnableKernelIpc) {
365 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
366 return INVALID_OPERATION;
367 }
368
Steven Moreland5553ac42020-11-11 02:14:45 +0000369 status = IPCThreadState::self()->transact(binderHandle(), code, data, reply, flags);
370 }
Martijn Coenen1cad19c2021-10-04 09:19:01 +0200371 if (data.dataSize() > LOG_TRANSACTIONS_OVER_SIZE) {
372 Mutex::Autolock _l(mLock);
373 ALOGW("Large outgoing transaction of %zu bytes, interface descriptor %s, code %d",
Steven Morelandf2830fe2022-12-21 00:45:34 +0000374 data.dataSize(), String8(mDescriptorCache).c_str(), code);
Martijn Coenen1cad19c2021-10-04 09:19:01 +0200375 }
Steven Moreland5553ac42020-11-11 02:14:45 +0000376
Steven Moreland06074d82020-03-05 23:16:51 +0000377 if (status == DEAD_OBJECT) mAlive = 0;
Steven Morelanda86a3562019-08-01 23:28:34 +0000378
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800379 return status;
380 }
381
382 return DEAD_OBJECT;
383}
384
Jiyong Parkb86c8662018-10-29 23:01:57 +0900385// NOLINTNEXTLINE(google-default-arguments)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800386status_t BpBinder::linkToDeath(
387 const sp<DeathRecipient>& recipient, void* cookie, uint32_t flags)
388{
Devin Moore66d5b7a2022-07-07 21:42:10 +0000389 if (isRpcBinder()) {
390 if (rpcSession()->getMaxIncomingThreads() < 1) {
Steven Moreland5ec743f2023-01-18 01:02:06 +0000391 ALOGE("Cannot register a DeathRecipient without any incoming connections.");
Devin Moore66d5b7a2022-07-07 21:42:10 +0000392 return INVALID_OPERATION;
393 }
394 } else if constexpr (!kEnableKernelIpc) {
Steven Moreland32150282021-11-12 22:54:53 +0000395 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
396 return INVALID_OPERATION;
Devin Moore66d5b7a2022-07-07 21:42:10 +0000397 } else {
398 if (ProcessState::self()->getThreadPoolMaxTotalThreadCount() == 0) {
399 ALOGW("Linking to death on %s but there are no threads (yet?) listening to incoming "
400 "transactions. See ProcessState::startThreadPool and "
401 "ProcessState::setThreadPoolMaxThreadCount. Generally you should setup the "
402 "binder "
403 "threadpool before other initialization steps.",
404 String8(getInterfaceDescriptor()).c_str());
405 }
Steven Moreland32150282021-11-12 22:54:53 +0000406 }
407
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800408 Obituary ob;
409 ob.recipient = recipient;
410 ob.cookie = cookie;
411 ob.flags = flags;
412
Yi Kongfdd8da92018-06-07 17:52:27 -0700413 LOG_ALWAYS_FATAL_IF(recipient == nullptr,
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800414 "linkToDeath(): recipient must be non-NULL");
415
416 {
417 AutoMutex _l(mLock);
418
419 if (!mObitsSent) {
420 if (!mObituaries) {
421 mObituaries = new Vector<Obituary>;
422 if (!mObituaries) {
423 return NO_MEMORY;
424 }
Steven Moreland5553ac42020-11-11 02:14:45 +0000425 ALOGV("Requesting death notification: %p handle %d\n", this, binderHandle());
Devin Moore66d5b7a2022-07-07 21:42:10 +0000426 if (!isRpcBinder()) {
427 if constexpr (kEnableKernelIpc) {
428 getWeakRefs()->incWeak(this);
429 IPCThreadState* self = IPCThreadState::self();
430 self->requestDeathNotification(binderHandle(), this);
431 self->flushCommands();
432 }
433 }
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800434 }
435 ssize_t res = mObituaries->add(ob);
436 return res >= (ssize_t)NO_ERROR ? (status_t)NO_ERROR : res;
437 }
438 }
439
440 return DEAD_OBJECT;
441}
442
Jiyong Parkb86c8662018-10-29 23:01:57 +0900443// NOLINTNEXTLINE(google-default-arguments)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800444status_t BpBinder::unlinkToDeath(
445 const wp<DeathRecipient>& recipient, void* cookie, uint32_t flags,
446 wp<DeathRecipient>* outRecipient)
447{
Devin Moore66d5b7a2022-07-07 21:42:10 +0000448 if (!kEnableKernelIpc && !isRpcBinder()) {
Steven Moreland32150282021-11-12 22:54:53 +0000449 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
450 return INVALID_OPERATION;
451 }
452
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800453 AutoMutex _l(mLock);
454
455 if (mObitsSent) {
456 return DEAD_OBJECT;
457 }
458
459 const size_t N = mObituaries ? mObituaries->size() : 0;
460 for (size_t i=0; i<N; i++) {
461 const Obituary& obit = mObituaries->itemAt(i);
462 if ((obit.recipient == recipient
Yi Kongfdd8da92018-06-07 17:52:27 -0700463 || (recipient == nullptr && obit.cookie == cookie))
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800464 && obit.flags == flags) {
Yi Kongfdd8da92018-06-07 17:52:27 -0700465 if (outRecipient != nullptr) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800466 *outRecipient = mObituaries->itemAt(i).recipient;
467 }
468 mObituaries->removeAt(i);
469 if (mObituaries->size() == 0) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000470 ALOGV("Clearing death notification: %p handle %d\n", this, binderHandle());
Devin Moore66d5b7a2022-07-07 21:42:10 +0000471 if (!isRpcBinder()) {
472 if constexpr (kEnableKernelIpc) {
473 IPCThreadState* self = IPCThreadState::self();
474 self->clearDeathNotification(binderHandle(), this);
475 self->flushCommands();
476 }
477 }
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800478 delete mObituaries;
Yi Kongfdd8da92018-06-07 17:52:27 -0700479 mObituaries = nullptr;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800480 }
481 return NO_ERROR;
482 }
483 }
484
485 return NAME_NOT_FOUND;
486}
487
488void BpBinder::sendObituary()
489{
Devin Moore66d5b7a2022-07-07 21:42:10 +0000490 if (!kEnableKernelIpc && !isRpcBinder()) {
Steven Moreland32150282021-11-12 22:54:53 +0000491 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
492 return;
493 }
494
Steven Moreland5553ac42020-11-11 02:14:45 +0000495 ALOGV("Sending obituary for proxy %p handle %d, mObitsSent=%s\n", this, binderHandle(),
496 mObitsSent ? "true" : "false");
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800497
Steven Moreland06074d82020-03-05 23:16:51 +0000498 mAlive = 0;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800499 if (mObitsSent) return;
500
501 mLock.lock();
502 Vector<Obituary>* obits = mObituaries;
Yi Kongfdd8da92018-06-07 17:52:27 -0700503 if(obits != nullptr) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000504 ALOGV("Clearing sent death notification: %p handle %d\n", this, binderHandle());
Devin Moore66d5b7a2022-07-07 21:42:10 +0000505 if (!isRpcBinder()) {
506 if constexpr (kEnableKernelIpc) {
507 IPCThreadState* self = IPCThreadState::self();
508 self->clearDeathNotification(binderHandle(), this);
509 self->flushCommands();
510 }
511 }
Yi Kongfdd8da92018-06-07 17:52:27 -0700512 mObituaries = nullptr;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800513 }
Steven Moreland06074d82020-03-05 23:16:51 +0000514 mObitsSent = 1;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800515 mLock.unlock();
516
Mark Salyzynd4ecccf2014-05-30 16:35:57 -0700517 ALOGV("Reporting death of proxy %p for %zu recipients\n",
518 this, obits ? obits->size() : 0U);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800519
Yi Kongfdd8da92018-06-07 17:52:27 -0700520 if (obits != nullptr) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800521 const size_t N = obits->size();
522 for (size_t i=0; i<N; i++) {
523 reportOneDeath(obits->itemAt(i));
524 }
525
526 delete obits;
527 }
528}
529
530void BpBinder::reportOneDeath(const Obituary& obit)
531{
532 sp<DeathRecipient> recipient = obit.recipient.promote();
Steve Block6807e592011-10-20 11:56:00 +0100533 ALOGV("Reporting death to recipient: %p\n", recipient.get());
Yi Kongfdd8da92018-06-07 17:52:27 -0700534 if (recipient == nullptr) return;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800535
Steven Moreland1a3a8ef2021-04-02 02:52:46 +0000536 recipient->binderDied(wp<BpBinder>::fromExisting(this));
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800537}
538
Steven Moreland63a2d512021-06-25 01:10:15 +0000539void* BpBinder::attachObject(const void* objectID, void* object, void* cleanupCookie,
540 object_cleanup_func func) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800541 AutoMutex _l(mLock);
Steve Block6807e592011-10-20 11:56:00 +0100542 ALOGV("Attaching object %p to binder %p (manager=%p)", object, this, &mObjects);
Steven Moreland63a2d512021-06-25 01:10:15 +0000543 return mObjects.attach(objectID, object, cleanupCookie, func);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800544}
545
546void* BpBinder::findObject(const void* objectID) const
547{
548 AutoMutex _l(mLock);
549 return mObjects.find(objectID);
550}
551
Steven Moreland63a2d512021-06-25 01:10:15 +0000552void* BpBinder::detachObject(const void* objectID) {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800553 AutoMutex _l(mLock);
Steven Moreland63a2d512021-06-25 01:10:15 +0000554 return mObjects.detach(objectID);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800555}
556
Steven Moreland9e759e82021-06-25 21:30:23 +0000557void BpBinder::withLock(const std::function<void()>& doWithLock) {
558 AutoMutex _l(mLock);
559 doWithLock();
560}
561
Devin Moore3faaa002022-07-27 15:54:06 +0000562sp<IBinder> BpBinder::lookupOrCreateWeak(const void* objectID, object_make_func make,
563 const void* makeArgs) {
564 AutoMutex _l(mLock);
565 return mObjects.lookupOrCreateWeak(objectID, make, makeArgs);
566}
567
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800568BpBinder* BpBinder::remoteBinder()
569{
570 return this;
571}
572
Steven Moreland32150282021-11-12 22:54:53 +0000573BpBinder::~BpBinder() {
Steven Moreland5553ac42020-11-11 02:14:45 +0000574 if (CC_UNLIKELY(isRpcBinder())) return;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800575
Steven Moreland32150282021-11-12 22:54:53 +0000576 if constexpr (!kEnableKernelIpc) {
577 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
578 return;
579 }
580
581 ALOGV("Destroying BpBinder %p handle %d\n", this, binderHandle());
582
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800583 IPCThreadState* ipc = IPCThreadState::self();
584
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700585 if (mTrackedUid >= 0) {
586 AutoMutex _l(sTrackingLock);
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700587 uint32_t trackedValue = sTrackingMap[mTrackedUid];
588 if (CC_UNLIKELY((trackedValue & COUNTING_VALUE_MASK) == 0)) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000589 ALOGE("Unexpected Binder Proxy tracking decrement in %p handle %d\n", this,
590 binderHandle());
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700591 } else {
592 if (CC_UNLIKELY(
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700593 (trackedValue & LIMIT_REACHED_MASK) &&
594 ((trackedValue & COUNTING_VALUE_MASK) <= sBinderProxyCountLowWatermark)
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700595 )) {
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700596 ALOGI("Limit reached bit reset for uid %d (fewer than %d proxies from uid %d held)",
Martijn Coenena8d509d2021-09-03 18:06:24 +0200597 getuid(), sBinderProxyCountLowWatermark, mTrackedUid);
Michael Wachenschwanz74d967a2018-05-15 15:03:57 -0700598 sTrackingMap[mTrackedUid] &= ~LIMIT_REACHED_MASK;
Martijn Coenena8d509d2021-09-03 18:06:24 +0200599 sLastLimitCallbackMap.erase(mTrackedUid);
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700600 }
601 if (--sTrackingMap[mTrackedUid] == 0) {
602 sTrackingMap.erase(mTrackedUid);
603 }
604 }
605 }
606
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800607 if (ipc) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000608 ipc->expungeHandle(binderHandle(), this);
609 ipc->decWeakHandle(binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800610 }
611}
612
Steven Moreland32150282021-11-12 22:54:53 +0000613void BpBinder::onFirstRef() {
Steven Moreland5553ac42020-11-11 02:14:45 +0000614 if (CC_UNLIKELY(isRpcBinder())) return;
Steven Moreland32150282021-11-12 22:54:53 +0000615
616 if constexpr (!kEnableKernelIpc) {
617 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
618 return;
619 }
620
621 ALOGV("onFirstRef BpBinder %p handle %d\n", this, binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800622 IPCThreadState* ipc = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000623 if (ipc) ipc->incStrongHandle(binderHandle(), this);
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800624}
625
Steven Moreland32150282021-11-12 22:54:53 +0000626void BpBinder::onLastStrongRef(const void* /*id*/) {
Steven Moreland5553ac42020-11-11 02:14:45 +0000627 if (CC_UNLIKELY(isRpcBinder())) {
Steven Moreland4f622fe2021-09-13 17:38:09 -0700628 (void)rpcSession()->sendDecStrong(this);
Steven Moreland5553ac42020-11-11 02:14:45 +0000629 return;
630 }
Steven Moreland32150282021-11-12 22:54:53 +0000631
632 if constexpr (!kEnableKernelIpc) {
633 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
634 return;
635 }
636
637 ALOGV("onLastStrongRef BpBinder %p handle %d\n", this, binderHandle());
Steve Block6807e592011-10-20 11:56:00 +0100638 IF_ALOGV() {
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800639 printRefs();
640 }
641 IPCThreadState* ipc = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000642 if (ipc) ipc->decStrongHandle(binderHandle());
Steven Moreland80d23932019-06-07 12:43:27 -0700643
644 mLock.lock();
645 Vector<Obituary>* obits = mObituaries;
646 if(obits != nullptr) {
647 if (!obits->isEmpty()) {
Steven Moreland70fcb4e2019-12-13 17:28:58 -0800648 ALOGI("onLastStrongRef automatically unlinking death recipients: %s",
Steven Morelandf2830fe2022-12-21 00:45:34 +0000649 String8(mDescriptorCache).c_str());
Steven Moreland80d23932019-06-07 12:43:27 -0700650 }
651
Steven Moreland5553ac42020-11-11 02:14:45 +0000652 if (ipc) ipc->clearDeathNotification(binderHandle(), this);
Steven Moreland80d23932019-06-07 12:43:27 -0700653 mObituaries = nullptr;
654 }
655 mLock.unlock();
656
657 if (obits != nullptr) {
658 // XXX Should we tell any remaining DeathRecipient
659 // objects that the last strong ref has gone away, so they
660 // are no longer linked?
661 delete obits;
662 }
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800663}
664
Colin Cross6f4f3ab2014-02-05 17:42:44 -0800665bool BpBinder::onIncStrongAttempted(uint32_t /*flags*/, const void* /*id*/)
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800666{
Steven Moreland5553ac42020-11-11 02:14:45 +0000667 // RPC binder doesn't currently support inc from weak binders
668 if (CC_UNLIKELY(isRpcBinder())) return false;
669
Steven Moreland32150282021-11-12 22:54:53 +0000670 if constexpr (!kEnableKernelIpc) {
671 LOG_ALWAYS_FATAL("Binder kernel driver disabled at build time");
672 return false;
673 }
674
Steven Moreland5553ac42020-11-11 02:14:45 +0000675 ALOGV("onIncStrongAttempted BpBinder %p handle %d\n", this, binderHandle());
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800676 IPCThreadState* ipc = IPCThreadState::self();
Steven Moreland5553ac42020-11-11 02:14:45 +0000677 return ipc ? ipc->attemptIncStrongHandle(binderHandle()) == NO_ERROR : false;
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800678}
679
Michael Wachenschwanzd296d0c2017-08-15 00:57:14 -0700680uint32_t BpBinder::getBinderProxyCount(uint32_t uid)
681{
682 AutoMutex _l(sTrackingLock);
683 auto it = sTrackingMap.find(uid);
684 if (it != sTrackingMap.end()) {
685 return it->second & COUNTING_VALUE_MASK;
686 }
687 return 0;
688}
689
690void BpBinder::getCountByUid(Vector<uint32_t>& uids, Vector<uint32_t>& counts)
691{
692 AutoMutex _l(sTrackingLock);
693 uids.setCapacity(sTrackingMap.size());
694 counts.setCapacity(sTrackingMap.size());
695 for (const auto& it : sTrackingMap) {
696 uids.push_back(it.first);
697 counts.push_back(it.second & COUNTING_VALUE_MASK);
698 }
699}
700
701void BpBinder::enableCountByUid() { sCountByUidEnabled.store(true); }
702void BpBinder::disableCountByUid() { sCountByUidEnabled.store(false); }
703void BpBinder::setCountByUidEnabled(bool enable) { sCountByUidEnabled.store(enable); }
704
705void BpBinder::setLimitCallback(binder_proxy_limit_callback cb) {
706 AutoMutex _l(sTrackingLock);
707 sLimitCallback = cb;
708}
709
710void BpBinder::setBinderProxyCountWatermarks(int high, int low) {
711 AutoMutex _l(sTrackingLock);
712 sBinderProxyCountHighWatermark = high;
713 sBinderProxyCountLowWatermark = low;
714}
715
The Android Open Source Projectedbf3b62009-03-03 19:31:44 -0800716// ---------------------------------------------------------------------------
717
Steven Moreland61ff8492019-09-26 16:05:45 -0700718} // namespace android