Loading libs/binder/Parcel.cpp +0 −108 Original line number Original line Diff line number Diff line Loading @@ -102,10 +102,6 @@ static void acquire_object(const sp<ProcessState>& proc, reinterpret_cast<IBinder*>(obj.cookie)->incStrong(who); reinterpret_cast<IBinder*>(obj.cookie)->incStrong(who); } } return; return; case BINDER_TYPE_WEAK_BINDER: if (obj.binder) reinterpret_cast<RefBase::weakref_type*>(obj.binder)->incWeak(who); return; case BINDER_TYPE_HANDLE: { case BINDER_TYPE_HANDLE: { const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle); const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle); if (b != nullptr) { if (b != nullptr) { Loading @@ -114,11 +110,6 @@ static void acquire_object(const sp<ProcessState>& proc, } } return; return; } } case BINDER_TYPE_WEAK_HANDLE: { const wp<IBinder> b = proc->getWeakProxyForHandle(obj.handle); if (b != nullptr) b.get_refs()->incWeak(who); return; } case BINDER_TYPE_FD: { case BINDER_TYPE_FD: { if ((obj.cookie != 0) && (outAshmemSize != nullptr) && ashmem_valid(obj.handle)) { if ((obj.cookie != 0) && (outAshmemSize != nullptr) && ashmem_valid(obj.handle)) { // If we own an ashmem fd, keep track of how much memory it refers to. // If we own an ashmem fd, keep track of how much memory it refers to. Loading @@ -144,10 +135,6 @@ static void release_object(const sp<ProcessState>& proc, reinterpret_cast<IBinder*>(obj.cookie)->decStrong(who); reinterpret_cast<IBinder*>(obj.cookie)->decStrong(who); } } return; return; case BINDER_TYPE_WEAK_BINDER: if (obj.binder) reinterpret_cast<RefBase::weakref_type*>(obj.binder)->decWeak(who); return; case BINDER_TYPE_HANDLE: { case BINDER_TYPE_HANDLE: { const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle); const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle); if (b != nullptr) { if (b != nullptr) { Loading @@ -156,11 +143,6 @@ static void release_object(const sp<ProcessState>& proc, } } return; return; } } case BINDER_TYPE_WEAK_HANDLE: { const wp<IBinder> b = proc->getWeakProxyForHandle(obj.handle); if (b != nullptr) b.get_refs()->decWeak(who); return; } case BINDER_TYPE_FD: { case BINDER_TYPE_FD: { if (obj.cookie != 0) { // owned if (obj.cookie != 0) { // owned if ((outAshmemSize != nullptr) && ashmem_valid(obj.handle)) { if ((outAshmemSize != nullptr) && ashmem_valid(obj.handle)) { Loading Loading @@ -230,55 +212,6 @@ static status_t flatten_binder(const sp<ProcessState>& /*proc*/, return finish_flatten_binder(binder, obj, out); return finish_flatten_binder(binder, obj, out); } } static status_t flatten_binder(const sp<ProcessState>& /*proc*/, const wp<IBinder>& binder, Parcel* out) { flat_binder_object obj; obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS; if (binder != nullptr) { sp<IBinder> real = binder.promote(); if (real != nullptr) { IBinder *local = real->localBinder(); if (!local) { BpBinder *proxy = real->remoteBinder(); if (proxy == nullptr) { ALOGE("null proxy"); } const int32_t handle = proxy ? proxy->handle() : 0; obj.hdr.type = BINDER_TYPE_WEAK_HANDLE; obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */ obj.handle = handle; obj.cookie = 0; } else { obj.hdr.type = BINDER_TYPE_WEAK_BINDER; obj.binder = reinterpret_cast<uintptr_t>(binder.get_refs()); obj.cookie = reinterpret_cast<uintptr_t>(binder.unsafe_get()); } return finish_flatten_binder(real, obj, out); } // XXX How to deal? In order to flatten the given binder, // we need to probe it for information, which requires a primary // reference... but we don't have one. // // The OpenBinder implementation uses a dynamic_cast<> here, // but we can't do that with the different reference counting // implementation we are using. ALOGE("Unable to unflatten Binder weak reference!"); obj.hdr.type = BINDER_TYPE_BINDER; obj.binder = 0; obj.cookie = 0; return finish_flatten_binder(nullptr, obj, out); } else { obj.hdr.type = BINDER_TYPE_BINDER; obj.binder = 0; obj.cookie = 0; return finish_flatten_binder(nullptr, obj, out); } } inline static status_t finish_unflatten_binder( inline static status_t finish_unflatten_binder( BpBinder* /*proxy*/, const flat_binder_object& /*flat*/, BpBinder* /*proxy*/, const flat_binder_object& /*flat*/, const Parcel& /*in*/) const Parcel& /*in*/) Loading @@ -305,35 +238,6 @@ static status_t unflatten_binder(const sp<ProcessState>& proc, return BAD_TYPE; return BAD_TYPE; } } static status_t unflatten_binder(const sp<ProcessState>& proc, const Parcel& in, wp<IBinder>* out) { const flat_binder_object* flat = in.readObject(false); if (flat) { switch (flat->hdr.type) { case BINDER_TYPE_BINDER: *out = reinterpret_cast<IBinder*>(flat->cookie); return finish_unflatten_binder(nullptr, *flat, in); case BINDER_TYPE_WEAK_BINDER: if (flat->binder != 0) { out->set_object_and_refs( reinterpret_cast<IBinder*>(flat->cookie), reinterpret_cast<RefBase::weakref_type*>(flat->binder)); } else { *out = nullptr; } return finish_unflatten_binder(nullptr, *flat, in); case BINDER_TYPE_HANDLE: case BINDER_TYPE_WEAK_HANDLE: *out = proc->getWeakProxyForHandle(flat->handle); return finish_unflatten_binder( static_cast<BpBinder*>(out->unsafe_get()), *flat, in); } } return BAD_TYPE; } // --------------------------------------------------------------------------- // --------------------------------------------------------------------------- Parcel::Parcel() Parcel::Parcel() Loading Loading @@ -1149,11 +1053,6 @@ status_t Parcel::readStrongBinderVector(std::vector<sp<IBinder>>* val) const { return readTypedVector(val, &Parcel::readStrongBinder); return readTypedVector(val, &Parcel::readStrongBinder); } } status_t Parcel::writeWeakBinder(const wp<IBinder>& val) { return flatten_binder(ProcessState::self(), val, this); } status_t Parcel::writeRawNullableParcelable(const Parcelable* parcelable) { status_t Parcel::writeRawNullableParcelable(const Parcelable* parcelable) { if (!parcelable) { if (!parcelable) { return writeInt32(0); return writeInt32(0); Loading Loading @@ -2092,13 +1991,6 @@ sp<IBinder> Parcel::readStrongBinder() const return val; return val; } } wp<IBinder> Parcel::readWeakBinder() const { wp<IBinder> val; unflatten_binder(ProcessState::self(), *this, &val); return val; } status_t Parcel::readParcelable(Parcelable* parcelable) const { status_t Parcel::readParcelable(Parcelable* parcelable) const { int32_t have_parcelable = 0; int32_t have_parcelable = 0; status_t status = readInt32(&have_parcelable); status_t status = readInt32(&have_parcelable); Loading libs/binder/ProcessState.cpp +6 −33 Original line number Original line Diff line number Diff line Loading @@ -210,8 +210,12 @@ sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle) if (e != nullptr) { if (e != nullptr) { // We need to create a new BpBinder if there isn't currently one, OR we // We need to create a new BpBinder if there isn't currently one, OR we // are unable to acquire a weak reference on this current one. See comment // are unable to acquire a weak reference on this current one. The // in getWeakProxyForHandle() for more info about this. // attemptIncWeak() is safe because we know the BpBinder destructor will always // call expungeHandle(), which acquires the same lock we are holding now. // We need to do this because there is a race condition between someone // releasing a reference on this BpBinder, and a new reference on its handle // arriving from the driver. IBinder* b = e->binder; IBinder* b = e->binder; if (b == nullptr || !e->refs->attemptIncWeak(this)) { if (b == nullptr || !e->refs->attemptIncWeak(this)) { if (handle == 0) { if (handle == 0) { Loading Loading @@ -257,37 +261,6 @@ sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle) return result; return result; } } wp<IBinder> ProcessState::getWeakProxyForHandle(int32_t handle) { wp<IBinder> result; AutoMutex _l(mLock); handle_entry* e = lookupHandleLocked(handle); if (e != nullptr) { // We need to create a new BpBinder if there isn't currently one, OR we // are unable to acquire a weak reference on this current one. The // attemptIncWeak() is safe because we know the BpBinder destructor will always // call expungeHandle(), which acquires the same lock we are holding now. // We need to do this because there is a race condition between someone // releasing a reference on this BpBinder, and a new reference on its handle // arriving from the driver. IBinder* b = e->binder; if (b == nullptr || !e->refs->attemptIncWeak(this)) { b = BpBinder::create(handle); result = b; e->binder = b; if (b) e->refs = b->getWeakRefs(); } else { result = b; e->refs->decWeak(this); } } return result; } void ProcessState::expungeHandle(int32_t handle, IBinder* binder) void ProcessState::expungeHandle(int32_t handle, IBinder* binder) { { AutoMutex _l(mLock); AutoMutex _l(mLock); Loading libs/binder/include/binder/Parcel.h +0 −2 Original line number Original line Diff line number Diff line Loading @@ -117,7 +117,6 @@ public: status_t writeString16(const std::unique_ptr<String16>& str); status_t writeString16(const std::unique_ptr<String16>& str); status_t writeString16(const char16_t* str, size_t len); status_t writeString16(const char16_t* str, size_t len); status_t writeStrongBinder(const sp<IBinder>& val); status_t writeStrongBinder(const sp<IBinder>& val); status_t writeWeakBinder(const wp<IBinder>& val); status_t writeInt32Array(size_t len, const int32_t *val); status_t writeInt32Array(size_t len, const int32_t *val); status_t writeByteArray(size_t len, const uint8_t *val); status_t writeByteArray(size_t len, const uint8_t *val); status_t writeBool(bool val); status_t writeBool(bool val); Loading Loading @@ -273,7 +272,6 @@ public: sp<IBinder> readStrongBinder() const; sp<IBinder> readStrongBinder() const; status_t readStrongBinder(sp<IBinder>* val) const; status_t readStrongBinder(sp<IBinder>* val) const; status_t readNullableStrongBinder(sp<IBinder>* val) const; status_t readNullableStrongBinder(sp<IBinder>* val) const; wp<IBinder> readWeakBinder() const; template<typename T> template<typename T> status_t readParcelableVector( status_t readParcelableVector( Loading libs/binder/include/binder/ProcessState.h +0 −1 Original line number Original line Diff line number Diff line Loading @@ -58,7 +58,6 @@ public: void* userData); void* userData); sp<IBinder> getStrongProxyForHandle(int32_t handle); sp<IBinder> getStrongProxyForHandle(int32_t handle); wp<IBinder> getWeakProxyForHandle(int32_t handle); void expungeHandle(int32_t handle, IBinder* binder); void expungeHandle(int32_t handle, IBinder* binder); void spawnPooledThread(bool isMain); void spawnPooledThread(bool isMain); Loading libs/binder/tests/binderLibTest.cpp +3 −48 Original line number Original line Diff line number Diff line Loading @@ -66,7 +66,6 @@ enum BinderLibTestTranscationCode { BINDER_LIB_TEST_LINK_DEATH_TRANSACTION, BINDER_LIB_TEST_LINK_DEATH_TRANSACTION, BINDER_LIB_TEST_WRITE_FILE_TRANSACTION, BINDER_LIB_TEST_WRITE_FILE_TRANSACTION, BINDER_LIB_TEST_WRITE_PARCEL_FILE_DESCRIPTOR_TRANSACTION, BINDER_LIB_TEST_WRITE_PARCEL_FILE_DESCRIPTOR_TRANSACTION, BINDER_LIB_TEST_PROMOTE_WEAK_REF_TRANSACTION, BINDER_LIB_TEST_EXIT_TRANSACTION, BINDER_LIB_TEST_EXIT_TRANSACTION, BINDER_LIB_TEST_DELAYED_EXIT_TRANSACTION, BINDER_LIB_TEST_DELAYED_EXIT_TRANSACTION, BINDER_LIB_TEST_GET_PTR_SIZE_TRANSACTION, BINDER_LIB_TEST_GET_PTR_SIZE_TRANSACTION, Loading Loading @@ -770,22 +769,6 @@ TEST_F(BinderLibTest, PromoteLocal) { EXPECT_TRUE(strong_from_weak == nullptr); EXPECT_TRUE(strong_from_weak == nullptr); } } TEST_F(BinderLibTest, PromoteRemote) { int ret; Parcel data, reply; sp<IBinder> strong = new BBinder(); sp<IBinder> server = addServer(); ASSERT_TRUE(server != nullptr); ASSERT_TRUE(strong != nullptr); ret = data.writeWeakBinder(strong); EXPECT_EQ(NO_ERROR, ret); ret = server->transact(BINDER_LIB_TEST_PROMOTE_WEAK_REF_TRANSACTION, data, &reply); EXPECT_GE(ret, 0); } TEST_F(BinderLibTest, CheckHandleZeroBinderHighBitsZeroCookie) { TEST_F(BinderLibTest, CheckHandleZeroBinderHighBitsZeroCookie) { status_t ret; status_t ret; Parcel data, reply; Parcel data, reply; Loading @@ -811,7 +794,6 @@ TEST_F(BinderLibTest, FreedBinder) { wp<IBinder> keepFreedBinder; wp<IBinder> keepFreedBinder; { { Parcel data, reply; Parcel data, reply; data.writeBool(false); /* request weak reference */ ret = server->transact(BINDER_LIB_TEST_CREATE_BINDER_TRANSACTION, data, &reply); ret = server->transact(BINDER_LIB_TEST_CREATE_BINDER_TRANSACTION, data, &reply); ASSERT_EQ(NO_ERROR, ret); ASSERT_EQ(NO_ERROR, ret); struct flat_binder_object *freed = (struct flat_binder_object *)(reply.data()); struct flat_binder_object *freed = (struct flat_binder_object *)(reply.data()); Loading @@ -820,8 +802,9 @@ TEST_F(BinderLibTest, FreedBinder) { * delete its reference to it - otherwise the transaction * delete its reference to it - otherwise the transaction * fails regardless of whether the driver is fixed. * fails regardless of whether the driver is fixed. */ */ keepFreedBinder = reply.readWeakBinder(); keepFreedBinder = reply.readStrongBinder(); } } IPCThreadState::self()->flushCommands(); { { Parcel data, reply; Parcel data, reply; data.writeStrongBinder(server); data.writeStrongBinder(server); Loading Loading @@ -1280,29 +1263,6 @@ class BinderLibTestService : public BBinder if (ret != size) return UNKNOWN_ERROR; if (ret != size) return UNKNOWN_ERROR; return NO_ERROR; return NO_ERROR; } } case BINDER_LIB_TEST_PROMOTE_WEAK_REF_TRANSACTION: { int ret; wp<IBinder> weak; sp<IBinder> strong; Parcel data2, reply2; sp<IServiceManager> sm = defaultServiceManager(); sp<IBinder> server = sm->getService(binderLibTestServiceName); weak = data.readWeakBinder(); if (weak == nullptr) { return BAD_VALUE; } strong = weak.promote(); ret = server->transact(BINDER_LIB_TEST_NOP_TRANSACTION, data2, &reply2); if (ret != NO_ERROR) exit(EXIT_FAILURE); if (strong == nullptr) { reply->setError(1); } return NO_ERROR; } case BINDER_LIB_TEST_DELAYED_EXIT_TRANSACTION: case BINDER_LIB_TEST_DELAYED_EXIT_TRANSACTION: alarm(10); alarm(10); return NO_ERROR; return NO_ERROR; Loading @@ -1311,13 +1271,8 @@ class BinderLibTestService : public BBinder ; ; exit(EXIT_SUCCESS); exit(EXIT_SUCCESS); case BINDER_LIB_TEST_CREATE_BINDER_TRANSACTION: { case BINDER_LIB_TEST_CREATE_BINDER_TRANSACTION: { bool strongRef = data.readBool(); sp<IBinder> binder = new BBinder(); sp<IBinder> binder = new BBinder(); if (strongRef) { reply->writeStrongBinder(binder); reply->writeStrongBinder(binder); } else { reply->writeWeakBinder(binder); } return NO_ERROR; return NO_ERROR; } } case BINDER_LIB_TEST_GET_WORK_SOURCE_TRANSACTION: { case BINDER_LIB_TEST_GET_WORK_SOURCE_TRANSACTION: { Loading Loading
libs/binder/Parcel.cpp +0 −108 Original line number Original line Diff line number Diff line Loading @@ -102,10 +102,6 @@ static void acquire_object(const sp<ProcessState>& proc, reinterpret_cast<IBinder*>(obj.cookie)->incStrong(who); reinterpret_cast<IBinder*>(obj.cookie)->incStrong(who); } } return; return; case BINDER_TYPE_WEAK_BINDER: if (obj.binder) reinterpret_cast<RefBase::weakref_type*>(obj.binder)->incWeak(who); return; case BINDER_TYPE_HANDLE: { case BINDER_TYPE_HANDLE: { const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle); const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle); if (b != nullptr) { if (b != nullptr) { Loading @@ -114,11 +110,6 @@ static void acquire_object(const sp<ProcessState>& proc, } } return; return; } } case BINDER_TYPE_WEAK_HANDLE: { const wp<IBinder> b = proc->getWeakProxyForHandle(obj.handle); if (b != nullptr) b.get_refs()->incWeak(who); return; } case BINDER_TYPE_FD: { case BINDER_TYPE_FD: { if ((obj.cookie != 0) && (outAshmemSize != nullptr) && ashmem_valid(obj.handle)) { if ((obj.cookie != 0) && (outAshmemSize != nullptr) && ashmem_valid(obj.handle)) { // If we own an ashmem fd, keep track of how much memory it refers to. // If we own an ashmem fd, keep track of how much memory it refers to. Loading @@ -144,10 +135,6 @@ static void release_object(const sp<ProcessState>& proc, reinterpret_cast<IBinder*>(obj.cookie)->decStrong(who); reinterpret_cast<IBinder*>(obj.cookie)->decStrong(who); } } return; return; case BINDER_TYPE_WEAK_BINDER: if (obj.binder) reinterpret_cast<RefBase::weakref_type*>(obj.binder)->decWeak(who); return; case BINDER_TYPE_HANDLE: { case BINDER_TYPE_HANDLE: { const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle); const sp<IBinder> b = proc->getStrongProxyForHandle(obj.handle); if (b != nullptr) { if (b != nullptr) { Loading @@ -156,11 +143,6 @@ static void release_object(const sp<ProcessState>& proc, } } return; return; } } case BINDER_TYPE_WEAK_HANDLE: { const wp<IBinder> b = proc->getWeakProxyForHandle(obj.handle); if (b != nullptr) b.get_refs()->decWeak(who); return; } case BINDER_TYPE_FD: { case BINDER_TYPE_FD: { if (obj.cookie != 0) { // owned if (obj.cookie != 0) { // owned if ((outAshmemSize != nullptr) && ashmem_valid(obj.handle)) { if ((outAshmemSize != nullptr) && ashmem_valid(obj.handle)) { Loading Loading @@ -230,55 +212,6 @@ static status_t flatten_binder(const sp<ProcessState>& /*proc*/, return finish_flatten_binder(binder, obj, out); return finish_flatten_binder(binder, obj, out); } } static status_t flatten_binder(const sp<ProcessState>& /*proc*/, const wp<IBinder>& binder, Parcel* out) { flat_binder_object obj; obj.flags = 0x7f | FLAT_BINDER_FLAG_ACCEPTS_FDS; if (binder != nullptr) { sp<IBinder> real = binder.promote(); if (real != nullptr) { IBinder *local = real->localBinder(); if (!local) { BpBinder *proxy = real->remoteBinder(); if (proxy == nullptr) { ALOGE("null proxy"); } const int32_t handle = proxy ? proxy->handle() : 0; obj.hdr.type = BINDER_TYPE_WEAK_HANDLE; obj.binder = 0; /* Don't pass uninitialized stack data to a remote process */ obj.handle = handle; obj.cookie = 0; } else { obj.hdr.type = BINDER_TYPE_WEAK_BINDER; obj.binder = reinterpret_cast<uintptr_t>(binder.get_refs()); obj.cookie = reinterpret_cast<uintptr_t>(binder.unsafe_get()); } return finish_flatten_binder(real, obj, out); } // XXX How to deal? In order to flatten the given binder, // we need to probe it for information, which requires a primary // reference... but we don't have one. // // The OpenBinder implementation uses a dynamic_cast<> here, // but we can't do that with the different reference counting // implementation we are using. ALOGE("Unable to unflatten Binder weak reference!"); obj.hdr.type = BINDER_TYPE_BINDER; obj.binder = 0; obj.cookie = 0; return finish_flatten_binder(nullptr, obj, out); } else { obj.hdr.type = BINDER_TYPE_BINDER; obj.binder = 0; obj.cookie = 0; return finish_flatten_binder(nullptr, obj, out); } } inline static status_t finish_unflatten_binder( inline static status_t finish_unflatten_binder( BpBinder* /*proxy*/, const flat_binder_object& /*flat*/, BpBinder* /*proxy*/, const flat_binder_object& /*flat*/, const Parcel& /*in*/) const Parcel& /*in*/) Loading @@ -305,35 +238,6 @@ static status_t unflatten_binder(const sp<ProcessState>& proc, return BAD_TYPE; return BAD_TYPE; } } static status_t unflatten_binder(const sp<ProcessState>& proc, const Parcel& in, wp<IBinder>* out) { const flat_binder_object* flat = in.readObject(false); if (flat) { switch (flat->hdr.type) { case BINDER_TYPE_BINDER: *out = reinterpret_cast<IBinder*>(flat->cookie); return finish_unflatten_binder(nullptr, *flat, in); case BINDER_TYPE_WEAK_BINDER: if (flat->binder != 0) { out->set_object_and_refs( reinterpret_cast<IBinder*>(flat->cookie), reinterpret_cast<RefBase::weakref_type*>(flat->binder)); } else { *out = nullptr; } return finish_unflatten_binder(nullptr, *flat, in); case BINDER_TYPE_HANDLE: case BINDER_TYPE_WEAK_HANDLE: *out = proc->getWeakProxyForHandle(flat->handle); return finish_unflatten_binder( static_cast<BpBinder*>(out->unsafe_get()), *flat, in); } } return BAD_TYPE; } // --------------------------------------------------------------------------- // --------------------------------------------------------------------------- Parcel::Parcel() Parcel::Parcel() Loading Loading @@ -1149,11 +1053,6 @@ status_t Parcel::readStrongBinderVector(std::vector<sp<IBinder>>* val) const { return readTypedVector(val, &Parcel::readStrongBinder); return readTypedVector(val, &Parcel::readStrongBinder); } } status_t Parcel::writeWeakBinder(const wp<IBinder>& val) { return flatten_binder(ProcessState::self(), val, this); } status_t Parcel::writeRawNullableParcelable(const Parcelable* parcelable) { status_t Parcel::writeRawNullableParcelable(const Parcelable* parcelable) { if (!parcelable) { if (!parcelable) { return writeInt32(0); return writeInt32(0); Loading Loading @@ -2092,13 +1991,6 @@ sp<IBinder> Parcel::readStrongBinder() const return val; return val; } } wp<IBinder> Parcel::readWeakBinder() const { wp<IBinder> val; unflatten_binder(ProcessState::self(), *this, &val); return val; } status_t Parcel::readParcelable(Parcelable* parcelable) const { status_t Parcel::readParcelable(Parcelable* parcelable) const { int32_t have_parcelable = 0; int32_t have_parcelable = 0; status_t status = readInt32(&have_parcelable); status_t status = readInt32(&have_parcelable); Loading
libs/binder/ProcessState.cpp +6 −33 Original line number Original line Diff line number Diff line Loading @@ -210,8 +210,12 @@ sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle) if (e != nullptr) { if (e != nullptr) { // We need to create a new BpBinder if there isn't currently one, OR we // We need to create a new BpBinder if there isn't currently one, OR we // are unable to acquire a weak reference on this current one. See comment // are unable to acquire a weak reference on this current one. The // in getWeakProxyForHandle() for more info about this. // attemptIncWeak() is safe because we know the BpBinder destructor will always // call expungeHandle(), which acquires the same lock we are holding now. // We need to do this because there is a race condition between someone // releasing a reference on this BpBinder, and a new reference on its handle // arriving from the driver. IBinder* b = e->binder; IBinder* b = e->binder; if (b == nullptr || !e->refs->attemptIncWeak(this)) { if (b == nullptr || !e->refs->attemptIncWeak(this)) { if (handle == 0) { if (handle == 0) { Loading Loading @@ -257,37 +261,6 @@ sp<IBinder> ProcessState::getStrongProxyForHandle(int32_t handle) return result; return result; } } wp<IBinder> ProcessState::getWeakProxyForHandle(int32_t handle) { wp<IBinder> result; AutoMutex _l(mLock); handle_entry* e = lookupHandleLocked(handle); if (e != nullptr) { // We need to create a new BpBinder if there isn't currently one, OR we // are unable to acquire a weak reference on this current one. The // attemptIncWeak() is safe because we know the BpBinder destructor will always // call expungeHandle(), which acquires the same lock we are holding now. // We need to do this because there is a race condition between someone // releasing a reference on this BpBinder, and a new reference on its handle // arriving from the driver. IBinder* b = e->binder; if (b == nullptr || !e->refs->attemptIncWeak(this)) { b = BpBinder::create(handle); result = b; e->binder = b; if (b) e->refs = b->getWeakRefs(); } else { result = b; e->refs->decWeak(this); } } return result; } void ProcessState::expungeHandle(int32_t handle, IBinder* binder) void ProcessState::expungeHandle(int32_t handle, IBinder* binder) { { AutoMutex _l(mLock); AutoMutex _l(mLock); Loading
libs/binder/include/binder/Parcel.h +0 −2 Original line number Original line Diff line number Diff line Loading @@ -117,7 +117,6 @@ public: status_t writeString16(const std::unique_ptr<String16>& str); status_t writeString16(const std::unique_ptr<String16>& str); status_t writeString16(const char16_t* str, size_t len); status_t writeString16(const char16_t* str, size_t len); status_t writeStrongBinder(const sp<IBinder>& val); status_t writeStrongBinder(const sp<IBinder>& val); status_t writeWeakBinder(const wp<IBinder>& val); status_t writeInt32Array(size_t len, const int32_t *val); status_t writeInt32Array(size_t len, const int32_t *val); status_t writeByteArray(size_t len, const uint8_t *val); status_t writeByteArray(size_t len, const uint8_t *val); status_t writeBool(bool val); status_t writeBool(bool val); Loading Loading @@ -273,7 +272,6 @@ public: sp<IBinder> readStrongBinder() const; sp<IBinder> readStrongBinder() const; status_t readStrongBinder(sp<IBinder>* val) const; status_t readStrongBinder(sp<IBinder>* val) const; status_t readNullableStrongBinder(sp<IBinder>* val) const; status_t readNullableStrongBinder(sp<IBinder>* val) const; wp<IBinder> readWeakBinder() const; template<typename T> template<typename T> status_t readParcelableVector( status_t readParcelableVector( Loading
libs/binder/include/binder/ProcessState.h +0 −1 Original line number Original line Diff line number Diff line Loading @@ -58,7 +58,6 @@ public: void* userData); void* userData); sp<IBinder> getStrongProxyForHandle(int32_t handle); sp<IBinder> getStrongProxyForHandle(int32_t handle); wp<IBinder> getWeakProxyForHandle(int32_t handle); void expungeHandle(int32_t handle, IBinder* binder); void expungeHandle(int32_t handle, IBinder* binder); void spawnPooledThread(bool isMain); void spawnPooledThread(bool isMain); Loading
libs/binder/tests/binderLibTest.cpp +3 −48 Original line number Original line Diff line number Diff line Loading @@ -66,7 +66,6 @@ enum BinderLibTestTranscationCode { BINDER_LIB_TEST_LINK_DEATH_TRANSACTION, BINDER_LIB_TEST_LINK_DEATH_TRANSACTION, BINDER_LIB_TEST_WRITE_FILE_TRANSACTION, BINDER_LIB_TEST_WRITE_FILE_TRANSACTION, BINDER_LIB_TEST_WRITE_PARCEL_FILE_DESCRIPTOR_TRANSACTION, BINDER_LIB_TEST_WRITE_PARCEL_FILE_DESCRIPTOR_TRANSACTION, BINDER_LIB_TEST_PROMOTE_WEAK_REF_TRANSACTION, BINDER_LIB_TEST_EXIT_TRANSACTION, BINDER_LIB_TEST_EXIT_TRANSACTION, BINDER_LIB_TEST_DELAYED_EXIT_TRANSACTION, BINDER_LIB_TEST_DELAYED_EXIT_TRANSACTION, BINDER_LIB_TEST_GET_PTR_SIZE_TRANSACTION, BINDER_LIB_TEST_GET_PTR_SIZE_TRANSACTION, Loading Loading @@ -770,22 +769,6 @@ TEST_F(BinderLibTest, PromoteLocal) { EXPECT_TRUE(strong_from_weak == nullptr); EXPECT_TRUE(strong_from_weak == nullptr); } } TEST_F(BinderLibTest, PromoteRemote) { int ret; Parcel data, reply; sp<IBinder> strong = new BBinder(); sp<IBinder> server = addServer(); ASSERT_TRUE(server != nullptr); ASSERT_TRUE(strong != nullptr); ret = data.writeWeakBinder(strong); EXPECT_EQ(NO_ERROR, ret); ret = server->transact(BINDER_LIB_TEST_PROMOTE_WEAK_REF_TRANSACTION, data, &reply); EXPECT_GE(ret, 0); } TEST_F(BinderLibTest, CheckHandleZeroBinderHighBitsZeroCookie) { TEST_F(BinderLibTest, CheckHandleZeroBinderHighBitsZeroCookie) { status_t ret; status_t ret; Parcel data, reply; Parcel data, reply; Loading @@ -811,7 +794,6 @@ TEST_F(BinderLibTest, FreedBinder) { wp<IBinder> keepFreedBinder; wp<IBinder> keepFreedBinder; { { Parcel data, reply; Parcel data, reply; data.writeBool(false); /* request weak reference */ ret = server->transact(BINDER_LIB_TEST_CREATE_BINDER_TRANSACTION, data, &reply); ret = server->transact(BINDER_LIB_TEST_CREATE_BINDER_TRANSACTION, data, &reply); ASSERT_EQ(NO_ERROR, ret); ASSERT_EQ(NO_ERROR, ret); struct flat_binder_object *freed = (struct flat_binder_object *)(reply.data()); struct flat_binder_object *freed = (struct flat_binder_object *)(reply.data()); Loading @@ -820,8 +802,9 @@ TEST_F(BinderLibTest, FreedBinder) { * delete its reference to it - otherwise the transaction * delete its reference to it - otherwise the transaction * fails regardless of whether the driver is fixed. * fails regardless of whether the driver is fixed. */ */ keepFreedBinder = reply.readWeakBinder(); keepFreedBinder = reply.readStrongBinder(); } } IPCThreadState::self()->flushCommands(); { { Parcel data, reply; Parcel data, reply; data.writeStrongBinder(server); data.writeStrongBinder(server); Loading Loading @@ -1280,29 +1263,6 @@ class BinderLibTestService : public BBinder if (ret != size) return UNKNOWN_ERROR; if (ret != size) return UNKNOWN_ERROR; return NO_ERROR; return NO_ERROR; } } case BINDER_LIB_TEST_PROMOTE_WEAK_REF_TRANSACTION: { int ret; wp<IBinder> weak; sp<IBinder> strong; Parcel data2, reply2; sp<IServiceManager> sm = defaultServiceManager(); sp<IBinder> server = sm->getService(binderLibTestServiceName); weak = data.readWeakBinder(); if (weak == nullptr) { return BAD_VALUE; } strong = weak.promote(); ret = server->transact(BINDER_LIB_TEST_NOP_TRANSACTION, data2, &reply2); if (ret != NO_ERROR) exit(EXIT_FAILURE); if (strong == nullptr) { reply->setError(1); } return NO_ERROR; } case BINDER_LIB_TEST_DELAYED_EXIT_TRANSACTION: case BINDER_LIB_TEST_DELAYED_EXIT_TRANSACTION: alarm(10); alarm(10); return NO_ERROR; return NO_ERROR; Loading @@ -1311,13 +1271,8 @@ class BinderLibTestService : public BBinder ; ; exit(EXIT_SUCCESS); exit(EXIT_SUCCESS); case BINDER_LIB_TEST_CREATE_BINDER_TRANSACTION: { case BINDER_LIB_TEST_CREATE_BINDER_TRANSACTION: { bool strongRef = data.readBool(); sp<IBinder> binder = new BBinder(); sp<IBinder> binder = new BBinder(); if (strongRef) { reply->writeStrongBinder(binder); reply->writeStrongBinder(binder); } else { reply->writeWeakBinder(binder); } return NO_ERROR; return NO_ERROR; } } case BINDER_LIB_TEST_GET_WORK_SOURCE_TRANSACTION: { case BINDER_LIB_TEST_GET_WORK_SOURCE_TRANSACTION: { Loading