You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
768 lines
29 KiB
768 lines
29 KiB
/*
|
|
* Copyright (C) 2020 The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
#define LOG_TAG "RpcState"
|
|
|
|
#include "RpcState.h"
|
|
|
|
#include <binder/BpBinder.h>
|
|
#include <binder/RpcServer.h>
|
|
|
|
#include "Debug.h"
|
|
#include "RpcWireFormat.h"
|
|
|
|
#include <inttypes.h>
|
|
|
|
namespace android {
|
|
|
|
RpcState::RpcState() {}
|
|
RpcState::~RpcState() {}
|
|
|
|
status_t RpcState::onBinderLeaving(const sp<RpcSession>& session, const sp<IBinder>& binder,
|
|
RpcAddress* outAddress) {
|
|
bool isRemote = binder->remoteBinder();
|
|
bool isRpc = isRemote && binder->remoteBinder()->isRpcBinder();
|
|
|
|
if (isRpc && binder->remoteBinder()->getPrivateAccessorForId().rpcSession() != session) {
|
|
// We need to be able to send instructions over the socket for how to
|
|
// connect to a different server, and we also need to let the host
|
|
// process know that this is happening.
|
|
ALOGE("Cannot send binder from unrelated binder RPC session.");
|
|
return INVALID_OPERATION;
|
|
}
|
|
|
|
if (isRemote && !isRpc) {
|
|
// Without additional work, this would have the effect of using this
|
|
// process to proxy calls from the socket over to the other process, and
|
|
// it would make those calls look like they come from us (not over the
|
|
// sockets). In order to make this work transparently like binder, we
|
|
// would instead need to send instructions over the socket for how to
|
|
// connect to the host process, and we also need to let the host process
|
|
// know this was happening.
|
|
ALOGE("Cannot send binder proxy %p over sockets", binder.get());
|
|
return INVALID_OPERATION;
|
|
}
|
|
|
|
std::lock_guard<std::mutex> _l(mNodeMutex);
|
|
|
|
// TODO(b/182939933): maybe move address out of BpBinder, and keep binder->address map
|
|
// in RpcState
|
|
for (auto& [addr, node] : mNodeForAddress) {
|
|
if (binder == node.binder) {
|
|
if (isRpc) {
|
|
const RpcAddress& actualAddr =
|
|
binder->remoteBinder()->getPrivateAccessorForId().rpcAddress();
|
|
// TODO(b/182939933): this is only checking integrity of data structure
|
|
// a different data structure doesn't need this
|
|
LOG_ALWAYS_FATAL_IF(addr < actualAddr, "Address mismatch");
|
|
LOG_ALWAYS_FATAL_IF(actualAddr < addr, "Address mismatch");
|
|
}
|
|
node.timesSent++;
|
|
node.sentRef = binder; // might already be set
|
|
*outAddress = addr;
|
|
return OK;
|
|
}
|
|
}
|
|
LOG_ALWAYS_FATAL_IF(isRpc, "RPC binder must have known address at this point");
|
|
|
|
auto&& [it, inserted] = mNodeForAddress.insert({RpcAddress::unique(),
|
|
BinderNode{
|
|
.binder = binder,
|
|
.timesSent = 1,
|
|
.sentRef = binder,
|
|
}});
|
|
// TODO(b/182939933): better organization could avoid needing this log
|
|
LOG_ALWAYS_FATAL_IF(!inserted);
|
|
|
|
*outAddress = it->first;
|
|
return OK;
|
|
}
|
|
|
|
sp<IBinder> RpcState::onBinderEntering(const sp<RpcSession>& session, const RpcAddress& address) {
|
|
std::unique_lock<std::mutex> _l(mNodeMutex);
|
|
|
|
if (auto it = mNodeForAddress.find(address); it != mNodeForAddress.end()) {
|
|
sp<IBinder> binder = it->second.binder.promote();
|
|
|
|
// implicitly have strong RPC refcount, since we received this binder
|
|
it->second.timesRecd++;
|
|
|
|
_l.unlock();
|
|
|
|
// We have timesRecd RPC refcounts, but we only need to hold on to one
|
|
// when we keep the object. All additional dec strongs are sent
|
|
// immediately, we wait to send the last one in BpBinder::onLastDecStrong.
|
|
(void)session->sendDecStrong(address);
|
|
|
|
return binder;
|
|
}
|
|
|
|
auto&& [it, inserted] = mNodeForAddress.insert({address, BinderNode{}});
|
|
LOG_ALWAYS_FATAL_IF(!inserted, "Failed to insert binder when creating proxy");
|
|
|
|
// Currently, all binders are assumed to be part of the same session (no
|
|
// device global binders in the RPC world).
|
|
sp<IBinder> binder = BpBinder::create(session, it->first);
|
|
it->second.binder = binder;
|
|
it->second.timesRecd = 1;
|
|
return binder;
|
|
}
|
|
|
|
size_t RpcState::countBinders() {
|
|
std::lock_guard<std::mutex> _l(mNodeMutex);
|
|
return mNodeForAddress.size();
|
|
}
|
|
|
|
void RpcState::dump() {
|
|
std::lock_guard<std::mutex> _l(mNodeMutex);
|
|
ALOGE("DUMP OF RpcState %p", this);
|
|
ALOGE("DUMP OF RpcState (%zu nodes)", mNodeForAddress.size());
|
|
for (const auto& [address, node] : mNodeForAddress) {
|
|
sp<IBinder> binder = node.binder.promote();
|
|
|
|
const char* desc;
|
|
if (binder) {
|
|
if (binder->remoteBinder()) {
|
|
if (binder->remoteBinder()->isRpcBinder()) {
|
|
desc = "(rpc binder proxy)";
|
|
} else {
|
|
desc = "(binder proxy)";
|
|
}
|
|
} else {
|
|
desc = "(local binder)";
|
|
}
|
|
} else {
|
|
desc = "(null)";
|
|
}
|
|
|
|
ALOGE("- BINDER NODE: %p times sent:%zu times recd: %zu a:%s type:%s",
|
|
node.binder.unsafe_get(), node.timesSent, node.timesRecd, address.toString().c_str(),
|
|
desc);
|
|
}
|
|
ALOGE("END DUMP OF RpcState");
|
|
}
|
|
|
|
void RpcState::terminate() {
|
|
if (SHOULD_LOG_RPC_DETAIL) {
|
|
ALOGE("RpcState::terminate()");
|
|
dump();
|
|
}
|
|
|
|
// if the destructor of a binder object makes another RPC call, then calling
|
|
// decStrong could deadlock. So, we must hold onto these binders until
|
|
// mNodeMutex is no longer taken.
|
|
std::vector<sp<IBinder>> tempHoldBinder;
|
|
|
|
{
|
|
std::lock_guard<std::mutex> _l(mNodeMutex);
|
|
mTerminated = true;
|
|
for (auto& [address, node] : mNodeForAddress) {
|
|
sp<IBinder> binder = node.binder.promote();
|
|
LOG_ALWAYS_FATAL_IF(binder == nullptr, "Binder %p expected to be owned.", binder.get());
|
|
|
|
if (node.sentRef != nullptr) {
|
|
tempHoldBinder.push_back(node.sentRef);
|
|
}
|
|
}
|
|
|
|
mNodeForAddress.clear();
|
|
}
|
|
}
|
|
|
|
RpcState::CommandData::CommandData(size_t size) : mSize(size) {
|
|
// The maximum size for regular binder is 1MB for all concurrent
|
|
// transactions. A very small proportion of transactions are even
|
|
// larger than a page, but we need to avoid allocating too much
|
|
// data on behalf of an arbitrary client, or we could risk being in
|
|
// a position where a single additional allocation could run out of
|
|
// memory.
|
|
//
|
|
// Note, this limit may not reflect the total amount of data allocated for a
|
|
// transaction (in some cases, additional fixed size amounts are added),
|
|
// though for rough consistency, we should avoid cases where this data type
|
|
// is used for multiple dynamic allocations for a single transaction.
|
|
constexpr size_t kMaxTransactionAllocation = 100 * 1000;
|
|
if (size == 0) return;
|
|
if (size > kMaxTransactionAllocation) {
|
|
ALOGW("Transaction requested too much data allocation %zu", size);
|
|
return;
|
|
}
|
|
mData.reset(new (std::nothrow) uint8_t[size]);
|
|
}
|
|
|
|
bool RpcState::rpcSend(const base::unique_fd& fd, const char* what, const void* data, size_t size) {
|
|
LOG_RPC_DETAIL("Sending %s on fd %d: %s", what, fd.get(), hexString(data, size).c_str());
|
|
|
|
if (size > std::numeric_limits<ssize_t>::max()) {
|
|
ALOGE("Cannot send %s at size %zu (too big)", what, size);
|
|
terminate();
|
|
return false;
|
|
}
|
|
|
|
ssize_t sent = TEMP_FAILURE_RETRY(send(fd.get(), data, size, MSG_NOSIGNAL));
|
|
|
|
if (sent < 0 || sent != static_cast<ssize_t>(size)) {
|
|
ALOGE("Failed to send %s (sent %zd of %zu bytes) on fd %d, error: %s", what, sent, size,
|
|
fd.get(), strerror(errno));
|
|
|
|
terminate();
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
bool RpcState::rpcRec(const base::unique_fd& fd, const char* what, void* data, size_t size) {
|
|
if (size > std::numeric_limits<ssize_t>::max()) {
|
|
ALOGE("Cannot rec %s at size %zu (too big)", what, size);
|
|
terminate();
|
|
return false;
|
|
}
|
|
|
|
ssize_t recd = TEMP_FAILURE_RETRY(recv(fd.get(), data, size, MSG_WAITALL | MSG_NOSIGNAL));
|
|
|
|
if (recd < 0 || recd != static_cast<ssize_t>(size)) {
|
|
terminate();
|
|
|
|
if (recd == 0 && errno == 0) {
|
|
LOG_RPC_DETAIL("No more data when trying to read %s on fd %d", what, fd.get());
|
|
return false;
|
|
}
|
|
|
|
ALOGE("Failed to read %s (received %zd of %zu bytes) on fd %d, error: %s", what, recd, size,
|
|
fd.get(), strerror(errno));
|
|
return false;
|
|
} else {
|
|
LOG_RPC_DETAIL("Received %s on fd %d: %s", what, fd.get(), hexString(data, size).c_str());
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
sp<IBinder> RpcState::getRootObject(const base::unique_fd& fd, const sp<RpcSession>& session) {
|
|
Parcel data;
|
|
data.markForRpc(session);
|
|
Parcel reply;
|
|
|
|
status_t status = transact(fd, RpcAddress::zero(), RPC_SPECIAL_TRANSACT_GET_ROOT, data, session,
|
|
&reply, 0);
|
|
if (status != OK) {
|
|
ALOGE("Error getting root object: %s", statusToString(status).c_str());
|
|
return nullptr;
|
|
}
|
|
|
|
return reply.readStrongBinder();
|
|
}
|
|
|
|
status_t RpcState::getMaxThreads(const base::unique_fd& fd, const sp<RpcSession>& session,
|
|
size_t* maxThreadsOut) {
|
|
Parcel data;
|
|
data.markForRpc(session);
|
|
Parcel reply;
|
|
|
|
status_t status = transact(fd, RpcAddress::zero(), RPC_SPECIAL_TRANSACT_GET_MAX_THREADS, data,
|
|
session, &reply, 0);
|
|
if (status != OK) {
|
|
ALOGE("Error getting max threads: %s", statusToString(status).c_str());
|
|
return status;
|
|
}
|
|
|
|
int32_t maxThreads;
|
|
status = reply.readInt32(&maxThreads);
|
|
if (status != OK) return status;
|
|
if (maxThreads <= 0) {
|
|
ALOGE("Error invalid max maxThreads: %d", maxThreads);
|
|
return BAD_VALUE;
|
|
}
|
|
|
|
*maxThreadsOut = maxThreads;
|
|
return OK;
|
|
}
|
|
|
|
status_t RpcState::getSessionId(const base::unique_fd& fd, const sp<RpcSession>& session,
|
|
int32_t* sessionIdOut) {
|
|
Parcel data;
|
|
data.markForRpc(session);
|
|
Parcel reply;
|
|
|
|
status_t status = transact(fd, RpcAddress::zero(), RPC_SPECIAL_TRANSACT_GET_SESSION_ID, data,
|
|
session, &reply, 0);
|
|
if (status != OK) {
|
|
ALOGE("Error getting session ID: %s", statusToString(status).c_str());
|
|
return status;
|
|
}
|
|
|
|
int32_t sessionId;
|
|
status = reply.readInt32(&sessionId);
|
|
if (status != OK) return status;
|
|
|
|
*sessionIdOut = sessionId;
|
|
return OK;
|
|
}
|
|
|
|
status_t RpcState::transact(const base::unique_fd& fd, const RpcAddress& address, uint32_t code,
|
|
const Parcel& data, const sp<RpcSession>& session, Parcel* reply,
|
|
uint32_t flags) {
|
|
uint64_t asyncNumber = 0;
|
|
|
|
if (!address.isZero()) {
|
|
std::lock_guard<std::mutex> _l(mNodeMutex);
|
|
if (mTerminated) return DEAD_OBJECT; // avoid fatal only, otherwise races
|
|
auto it = mNodeForAddress.find(address);
|
|
LOG_ALWAYS_FATAL_IF(it == mNodeForAddress.end(), "Sending transact on unknown address %s",
|
|
address.toString().c_str());
|
|
|
|
if (flags & IBinder::FLAG_ONEWAY) {
|
|
asyncNumber = it->second.asyncNumber++;
|
|
}
|
|
}
|
|
|
|
if (!data.isForRpc()) {
|
|
ALOGE("Refusing to send RPC with parcel not crafted for RPC");
|
|
return BAD_TYPE;
|
|
}
|
|
|
|
if (data.objectsCount() != 0) {
|
|
ALOGE("Parcel at %p has attached objects but is being used in an RPC call", &data);
|
|
return BAD_TYPE;
|
|
}
|
|
|
|
RpcWireTransaction transaction{
|
|
.address = address.viewRawEmbedded(),
|
|
.code = code,
|
|
.flags = flags,
|
|
.asyncNumber = asyncNumber,
|
|
};
|
|
|
|
CommandData transactionData(sizeof(RpcWireTransaction) + data.dataSize());
|
|
if (!transactionData.valid()) {
|
|
return NO_MEMORY;
|
|
}
|
|
|
|
memcpy(transactionData.data() + 0, &transaction, sizeof(RpcWireTransaction));
|
|
memcpy(transactionData.data() + sizeof(RpcWireTransaction), data.data(), data.dataSize());
|
|
|
|
if (transactionData.size() > std::numeric_limits<uint32_t>::max()) {
|
|
ALOGE("Transaction size too big %zu", transactionData.size());
|
|
return BAD_VALUE;
|
|
}
|
|
|
|
RpcWireHeader command{
|
|
.command = RPC_COMMAND_TRANSACT,
|
|
.bodySize = static_cast<uint32_t>(transactionData.size()),
|
|
};
|
|
|
|
if (!rpcSend(fd, "transact header", &command, sizeof(command))) {
|
|
return DEAD_OBJECT;
|
|
}
|
|
if (!rpcSend(fd, "command body", transactionData.data(), transactionData.size())) {
|
|
return DEAD_OBJECT;
|
|
}
|
|
|
|
if (flags & IBinder::FLAG_ONEWAY) {
|
|
return OK; // do not wait for result
|
|
}
|
|
|
|
LOG_ALWAYS_FATAL_IF(reply == nullptr, "Reply parcel must be used for synchronous transaction.");
|
|
|
|
return waitForReply(fd, session, reply);
|
|
}
|
|
|
|
static void cleanup_reply_data(Parcel* p, const uint8_t* data, size_t dataSize,
|
|
const binder_size_t* objects, size_t objectsCount) {
|
|
(void)p;
|
|
delete[] const_cast<uint8_t*>(data - offsetof(RpcWireReply, data));
|
|
(void)dataSize;
|
|
LOG_ALWAYS_FATAL_IF(objects != nullptr);
|
|
LOG_ALWAYS_FATAL_IF(objectsCount, 0);
|
|
}
|
|
|
|
status_t RpcState::waitForReply(const base::unique_fd& fd, const sp<RpcSession>& session,
|
|
Parcel* reply) {
|
|
RpcWireHeader command;
|
|
while (true) {
|
|
if (!rpcRec(fd, "command header", &command, sizeof(command))) {
|
|
return DEAD_OBJECT;
|
|
}
|
|
|
|
if (command.command == RPC_COMMAND_REPLY) break;
|
|
|
|
status_t status = processServerCommand(fd, session, command);
|
|
if (status != OK) return status;
|
|
}
|
|
|
|
CommandData data(command.bodySize);
|
|
if (!data.valid()) {
|
|
return NO_MEMORY;
|
|
}
|
|
|
|
if (!rpcRec(fd, "reply body", data.data(), command.bodySize)) {
|
|
return DEAD_OBJECT;
|
|
}
|
|
|
|
if (command.bodySize < sizeof(RpcWireReply)) {
|
|
ALOGE("Expecting %zu but got %" PRId32 " bytes for RpcWireReply. Terminating!",
|
|
sizeof(RpcWireReply), command.bodySize);
|
|
terminate();
|
|
return BAD_VALUE;
|
|
}
|
|
RpcWireReply* rpcReply = reinterpret_cast<RpcWireReply*>(data.data());
|
|
if (rpcReply->status != OK) return rpcReply->status;
|
|
|
|
data.release();
|
|
reply->ipcSetDataReference(rpcReply->data, command.bodySize - offsetof(RpcWireReply, data),
|
|
nullptr, 0, cleanup_reply_data);
|
|
|
|
reply->markForRpc(session);
|
|
|
|
return OK;
|
|
}
|
|
|
|
status_t RpcState::sendDecStrong(const base::unique_fd& fd, const RpcAddress& addr) {
|
|
{
|
|
std::lock_guard<std::mutex> _l(mNodeMutex);
|
|
if (mTerminated) return DEAD_OBJECT; // avoid fatal only, otherwise races
|
|
auto it = mNodeForAddress.find(addr);
|
|
LOG_ALWAYS_FATAL_IF(it == mNodeForAddress.end(), "Sending dec strong on unknown address %s",
|
|
addr.toString().c_str());
|
|
LOG_ALWAYS_FATAL_IF(it->second.timesRecd <= 0, "Bad dec strong %s",
|
|
addr.toString().c_str());
|
|
|
|
it->second.timesRecd--;
|
|
if (it->second.timesRecd == 0 && it->second.timesSent == 0) {
|
|
mNodeForAddress.erase(it);
|
|
}
|
|
}
|
|
|
|
RpcWireHeader cmd = {
|
|
.command = RPC_COMMAND_DEC_STRONG,
|
|
.bodySize = sizeof(RpcWireAddress),
|
|
};
|
|
if (!rpcSend(fd, "dec ref header", &cmd, sizeof(cmd))) return DEAD_OBJECT;
|
|
if (!rpcSend(fd, "dec ref body", &addr.viewRawEmbedded(), sizeof(RpcWireAddress)))
|
|
return DEAD_OBJECT;
|
|
return OK;
|
|
}
|
|
|
|
status_t RpcState::getAndExecuteCommand(const base::unique_fd& fd, const sp<RpcSession>& session) {
|
|
LOG_RPC_DETAIL("getAndExecuteCommand on fd %d", fd.get());
|
|
|
|
RpcWireHeader command;
|
|
if (!rpcRec(fd, "command header", &command, sizeof(command))) {
|
|
return DEAD_OBJECT;
|
|
}
|
|
|
|
return processServerCommand(fd, session, command);
|
|
}
|
|
|
|
status_t RpcState::processServerCommand(const base::unique_fd& fd, const sp<RpcSession>& session,
|
|
const RpcWireHeader& command) {
|
|
switch (command.command) {
|
|
case RPC_COMMAND_TRANSACT:
|
|
return processTransact(fd, session, command);
|
|
case RPC_COMMAND_DEC_STRONG:
|
|
return processDecStrong(fd, command);
|
|
}
|
|
|
|
// We should always know the version of the opposing side, and since the
|
|
// RPC-binder-level wire protocol is not self synchronizing, we have no way
|
|
// to understand where the current command ends and the next one begins. We
|
|
// also can't consider it a fatal error because this would allow any client
|
|
// to kill us, so ending the session for misbehaving client.
|
|
ALOGE("Unknown RPC command %d - terminating session", command.command);
|
|
terminate();
|
|
return DEAD_OBJECT;
|
|
}
|
|
status_t RpcState::processTransact(const base::unique_fd& fd, const sp<RpcSession>& session,
|
|
const RpcWireHeader& command) {
|
|
LOG_ALWAYS_FATAL_IF(command.command != RPC_COMMAND_TRANSACT, "command: %d", command.command);
|
|
|
|
CommandData transactionData(command.bodySize);
|
|
if (!transactionData.valid()) {
|
|
return NO_MEMORY;
|
|
}
|
|
if (!rpcRec(fd, "transaction body", transactionData.data(), transactionData.size())) {
|
|
return DEAD_OBJECT;
|
|
}
|
|
|
|
return processTransactInternal(fd, session, std::move(transactionData));
|
|
}
|
|
|
|
static void do_nothing_to_transact_data(Parcel* p, const uint8_t* data, size_t dataSize,
|
|
const binder_size_t* objects, size_t objectsCount) {
|
|
(void)p;
|
|
(void)data;
|
|
(void)dataSize;
|
|
(void)objects;
|
|
(void)objectsCount;
|
|
}
|
|
|
|
status_t RpcState::processTransactInternal(const base::unique_fd& fd, const sp<RpcSession>& session,
|
|
CommandData transactionData) {
|
|
if (transactionData.size() < sizeof(RpcWireTransaction)) {
|
|
ALOGE("Expecting %zu but got %zu bytes for RpcWireTransaction. Terminating!",
|
|
sizeof(RpcWireTransaction), transactionData.size());
|
|
terminate();
|
|
return BAD_VALUE;
|
|
}
|
|
RpcWireTransaction* transaction = reinterpret_cast<RpcWireTransaction*>(transactionData.data());
|
|
|
|
// TODO(b/182939933): heap allocation just for lookup in mNodeForAddress,
|
|
// maybe add an RpcAddress 'view' if the type remains 'heavy'
|
|
auto addr = RpcAddress::fromRawEmbedded(&transaction->address);
|
|
|
|
status_t replyStatus = OK;
|
|
sp<IBinder> target;
|
|
if (!addr.isZero()) {
|
|
std::lock_guard<std::mutex> _l(mNodeMutex);
|
|
|
|
auto it = mNodeForAddress.find(addr);
|
|
if (it == mNodeForAddress.end()) {
|
|
ALOGE("Unknown binder address %s.", addr.toString().c_str());
|
|
replyStatus = BAD_VALUE;
|
|
} else {
|
|
target = it->second.binder.promote();
|
|
if (target == nullptr) {
|
|
// This can happen if the binder is remote in this process, and
|
|
// another thread has called the last decStrong on this binder.
|
|
// However, for local binders, it indicates a misbehaving client
|
|
// (any binder which is being transacted on should be holding a
|
|
// strong ref count), so in either case, terminating the
|
|
// session.
|
|
ALOGE("While transacting, binder has been deleted at address %s. Terminating!",
|
|
addr.toString().c_str());
|
|
terminate();
|
|
replyStatus = BAD_VALUE;
|
|
} else if (target->localBinder() == nullptr) {
|
|
ALOGE("Transactions can only go to local binders, not address %s. Terminating!",
|
|
addr.toString().c_str());
|
|
terminate();
|
|
replyStatus = BAD_VALUE;
|
|
} else if (transaction->flags & IBinder::FLAG_ONEWAY) {
|
|
if (transaction->asyncNumber != it->second.asyncNumber) {
|
|
// we need to process some other asynchronous transaction
|
|
// first
|
|
// TODO(b/183140903): limit enqueues/detect overfill for bad client
|
|
// TODO(b/183140903): detect when an object is deleted when it still has
|
|
// pending async transactions
|
|
it->second.asyncTodo.push(BinderNode::AsyncTodo{
|
|
.data = std::move(transactionData),
|
|
.asyncNumber = transaction->asyncNumber,
|
|
});
|
|
LOG_RPC_DETAIL("Enqueuing %" PRId64 " on %s", transaction->asyncNumber,
|
|
addr.toString().c_str());
|
|
return OK;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
Parcel reply;
|
|
reply.markForRpc(session);
|
|
|
|
if (replyStatus == OK) {
|
|
Parcel data;
|
|
// transaction->data is owned by this function. Parcel borrows this data and
|
|
// only holds onto it for the duration of this function call. Parcel will be
|
|
// deleted before the 'transactionData' object.
|
|
data.ipcSetDataReference(transaction->data,
|
|
transactionData.size() - offsetof(RpcWireTransaction, data),
|
|
nullptr /*object*/, 0 /*objectCount*/,
|
|
do_nothing_to_transact_data);
|
|
data.markForRpc(session);
|
|
|
|
if (target) {
|
|
replyStatus = target->transact(transaction->code, data, &reply, transaction->flags);
|
|
} else {
|
|
LOG_RPC_DETAIL("Got special transaction %u", transaction->code);
|
|
|
|
sp<RpcServer> server = session->server().promote();
|
|
if (server) {
|
|
// special case for 'zero' address (special server commands)
|
|
switch (transaction->code) {
|
|
case RPC_SPECIAL_TRANSACT_GET_ROOT: {
|
|
replyStatus = reply.writeStrongBinder(server->getRootObject());
|
|
break;
|
|
}
|
|
case RPC_SPECIAL_TRANSACT_GET_MAX_THREADS: {
|
|
replyStatus = reply.writeInt32(server->getMaxThreads());
|
|
break;
|
|
}
|
|
case RPC_SPECIAL_TRANSACT_GET_SESSION_ID: {
|
|
// only sessions w/ services can be the source of a
|
|
// session ID (so still guarded by non-null server)
|
|
//
|
|
// sessions associated with servers must have an ID
|
|
// (hence abort)
|
|
int32_t id = session->getPrivateAccessorForId().get().value();
|
|
replyStatus = reply.writeInt32(id);
|
|
break;
|
|
}
|
|
default: {
|
|
replyStatus = UNKNOWN_TRANSACTION;
|
|
}
|
|
}
|
|
} else {
|
|
ALOGE("Special command sent, but no server object attached.");
|
|
}
|
|
}
|
|
}
|
|
|
|
if (transaction->flags & IBinder::FLAG_ONEWAY) {
|
|
if (replyStatus != OK) {
|
|
ALOGW("Oneway call failed with error: %d", replyStatus);
|
|
}
|
|
|
|
LOG_RPC_DETAIL("Processed async transaction %" PRId64 " on %s", transaction->asyncNumber,
|
|
addr.toString().c_str());
|
|
|
|
// Check to see if there is another asynchronous transaction to process.
|
|
// This behavior differs from binder behavior, since in the binder
|
|
// driver, asynchronous transactions will be processed after existing
|
|
// pending binder transactions on the queue. The downside of this is
|
|
// that asynchronous transactions can be drowned out by synchronous
|
|
// transactions. However, we have no easy way to queue these
|
|
// transactions after the synchronous transactions we may want to read
|
|
// from the wire. So, in socket binder here, we have the opposite
|
|
// downside: asynchronous transactions may drown out synchronous
|
|
// transactions.
|
|
{
|
|
std::unique_lock<std::mutex> _l(mNodeMutex);
|
|
auto it = mNodeForAddress.find(addr);
|
|
// last refcount dropped after this transaction happened
|
|
if (it == mNodeForAddress.end()) return OK;
|
|
|
|
// note - only updated now, instead of later, so that other threads
|
|
// will queue any later transactions
|
|
|
|
// TODO(b/183140903): support > 2**64 async transactions
|
|
// (we can do this by allowing asyncNumber to wrap, since we
|
|
// don't expect more than 2**64 simultaneous transactions)
|
|
it->second.asyncNumber++;
|
|
|
|
if (it->second.asyncTodo.size() == 0) return OK;
|
|
if (it->second.asyncTodo.top().asyncNumber == it->second.asyncNumber) {
|
|
LOG_RPC_DETAIL("Found next async transaction %" PRId64 " on %s",
|
|
it->second.asyncNumber, addr.toString().c_str());
|
|
|
|
// justification for const_cast (consider avoiding priority_queue):
|
|
// - AsyncTodo operator< doesn't depend on 'data' object
|
|
// - gotta go fast
|
|
CommandData data = std::move(
|
|
const_cast<BinderNode::AsyncTodo&>(it->second.asyncTodo.top()).data);
|
|
it->second.asyncTodo.pop();
|
|
_l.unlock();
|
|
return processTransactInternal(fd, session, std::move(data));
|
|
}
|
|
}
|
|
return OK;
|
|
}
|
|
|
|
RpcWireReply rpcReply{
|
|
.status = replyStatus,
|
|
};
|
|
|
|
CommandData replyData(sizeof(RpcWireReply) + reply.dataSize());
|
|
if (!replyData.valid()) {
|
|
return NO_MEMORY;
|
|
}
|
|
memcpy(replyData.data() + 0, &rpcReply, sizeof(RpcWireReply));
|
|
memcpy(replyData.data() + sizeof(RpcWireReply), reply.data(), reply.dataSize());
|
|
|
|
if (replyData.size() > std::numeric_limits<uint32_t>::max()) {
|
|
ALOGE("Reply size too big %zu", transactionData.size());
|
|
terminate();
|
|
return BAD_VALUE;
|
|
}
|
|
|
|
RpcWireHeader cmdReply{
|
|
.command = RPC_COMMAND_REPLY,
|
|
.bodySize = static_cast<uint32_t>(replyData.size()),
|
|
};
|
|
|
|
if (!rpcSend(fd, "reply header", &cmdReply, sizeof(RpcWireHeader))) {
|
|
return DEAD_OBJECT;
|
|
}
|
|
if (!rpcSend(fd, "reply body", replyData.data(), replyData.size())) {
|
|
return DEAD_OBJECT;
|
|
}
|
|
return OK;
|
|
}
|
|
|
|
status_t RpcState::processDecStrong(const base::unique_fd& fd, const RpcWireHeader& command) {
|
|
LOG_ALWAYS_FATAL_IF(command.command != RPC_COMMAND_DEC_STRONG, "command: %d", command.command);
|
|
|
|
CommandData commandData(command.bodySize);
|
|
if (!commandData.valid()) {
|
|
return NO_MEMORY;
|
|
}
|
|
if (!rpcRec(fd, "dec ref body", commandData.data(), commandData.size())) {
|
|
return DEAD_OBJECT;
|
|
}
|
|
|
|
if (command.bodySize < sizeof(RpcWireAddress)) {
|
|
ALOGE("Expecting %zu but got %" PRId32 " bytes for RpcWireAddress. Terminating!",
|
|
sizeof(RpcWireAddress), command.bodySize);
|
|
terminate();
|
|
return BAD_VALUE;
|
|
}
|
|
RpcWireAddress* address = reinterpret_cast<RpcWireAddress*>(commandData.data());
|
|
|
|
// TODO(b/182939933): heap allocation just for lookup
|
|
auto addr = RpcAddress::fromRawEmbedded(address);
|
|
std::unique_lock<std::mutex> _l(mNodeMutex);
|
|
auto it = mNodeForAddress.find(addr);
|
|
if (it == mNodeForAddress.end()) {
|
|
ALOGE("Unknown binder address %s for dec strong.", addr.toString().c_str());
|
|
return OK;
|
|
}
|
|
|
|
sp<IBinder> target = it->second.binder.promote();
|
|
if (target == nullptr) {
|
|
ALOGE("While requesting dec strong, binder has been deleted at address %s. Terminating!",
|
|
addr.toString().c_str());
|
|
terminate();
|
|
return BAD_VALUE;
|
|
}
|
|
|
|
if (it->second.timesSent == 0) {
|
|
ALOGE("No record of sending binder, but requested decStrong: %s", addr.toString().c_str());
|
|
return OK;
|
|
}
|
|
|
|
LOG_ALWAYS_FATAL_IF(it->second.sentRef == nullptr, "Inconsistent state, lost ref for %s",
|
|
addr.toString().c_str());
|
|
|
|
sp<IBinder> tempHold;
|
|
|
|
it->second.timesSent--;
|
|
if (it->second.timesSent == 0) {
|
|
tempHold = it->second.sentRef;
|
|
it->second.sentRef = nullptr;
|
|
|
|
if (it->second.timesRecd == 0) {
|
|
mNodeForAddress.erase(it);
|
|
}
|
|
}
|
|
|
|
_l.unlock();
|
|
tempHold = nullptr; // destructor may make binder calls on this session
|
|
|
|
return OK;
|
|
}
|
|
|
|
} // namespace android
|