Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 540dc55a authored by Sahil Somani's avatar Sahil Somani
Browse files

Binder Record/Replay implemented in BBinder 

Added the ability to record Binder transactions via a new
special transaction. BpBinder::startRecordingBinder(fd)
sends a file descriptor to its BBinder. BBinder then
records transactions to the fd until
BpBinder::endRecordingBinder() is called. A new class
RecordedTransaction was created that formats and writes
to the file descriptor.

Test: VtsHalLightTargetTest
Bug: 242226631
Change-Id: I89547bf4dfae6c328873f8a5e3be0b39ed862aa4
parent 3bb81137

libs/binder/Android.bp

+5 −1
Original line number Diff line number Diff line
@@ -76,6 +76,7 @@ cc_defaults { 


    srcs: [

        "Binder.cpp",

        "BinderRecordReplay.cpp",

        "BpBinder.cpp",

        "Debug.cpp",

        "FdTrigger.cpp",
@@ -147,7 +148,10 @@ cc_defaults { 
        },



        debuggable: {

            cflags: ["-DBINDER_RPC_DEV_SERVERS"],

            cflags: [

                "-DBINDER_RPC_DEV_SERVERS",

                "-DBINDER_ENABLE_RECORDING",

            ],

        },

    },

libs/binder/Binder.cpp

+92 −1
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ 


#include <android-base/logging.h>

#include <android-base/unique_fd.h>

#include <binder/BinderRecordReplay.h>

#include <binder/BpBinder.h>

#include <binder/IInterface.h>

#include <binder/IPCThreadState.h>
@@ -28,7 +29,9 @@ 
#include <binder/IShellCallback.h>

#include <binder/Parcel.h>

#include <binder/RpcServer.h>

#include <cutils/compiler.h>

#include <private/android_filesystem_config.h>

#include <pthread.h>

#include <utils/misc.h>



#include <inttypes.h>
@@ -60,6 +63,12 @@ bool kEnableRpcDevServers = true; 
bool kEnableRpcDevServers = false;

#endif



#ifdef BINDER_ENABLE_RECORDING

bool kEnableRecording = true;

#else

bool kEnableRecording = false;

#endif



// Log any reply transactions for which the data exceeds this size

#define LOG_REPLIES_OVER_SIZE (300 * 1024)

// ---------------------------------------------------------------------------
@@ -265,11 +274,13 @@ public: 
    Mutex mLock;

    std::set<sp<RpcServerLink>> mRpcServerLinks;

    BpBinder::ObjectManager mObjects;



    android::base::unique_fd mRecordingFd;

};



// ---------------------------------------------------------------------------



BBinder::BBinder() : mExtras(nullptr), mStability(0), mParceled(false) {}

BBinder::BBinder() : mExtras(nullptr), mStability(0), mParceled(false), mRecordingOn(false) {}



bool BBinder::isBinderAlive() const

{
@@ -281,6 +292,63 @@ status_t BBinder::pingBinder() 
    return NO_ERROR;

}



status_t BBinder::startRecordingTransactions(const Parcel& data) {

    if (!kEnableRecording) {

        ALOGW("Binder recording disallowed because recording is not enabled");

        return INVALID_OPERATION;

    }

    if (!kEnableKernelIpc) {

        ALOGW("Binder recording disallowed because kernel binder is not enabled");

        return INVALID_OPERATION;

    }

    uid_t uid = IPCThreadState::self()->getCallingUid();

    if (uid != AID_ROOT) {

        ALOGE("Binder recording not allowed because client %" PRIu32 " is not root", uid);

        return PERMISSION_DENIED;

    }

    Extras* e = getOrCreateExtras();

    AutoMutex lock(e->mLock);

    if (mRecordingOn) {

        LOG(INFO) << "Could not start Binder recording. Another is already in progress.";

        return INVALID_OPERATION;

    } else {

        status_t readStatus = data.readUniqueFileDescriptor(&(e->mRecordingFd));

        if (readStatus != OK) {

            return readStatus;

        }

        mRecordingOn = true;

        LOG(INFO) << "Started Binder recording.";

        return NO_ERROR;

    }

}



status_t BBinder::stopRecordingTransactions() {

    if (!kEnableRecording) {

        ALOGW("Binder recording disallowed because recording is not enabled");

        return INVALID_OPERATION;

    }

    if (!kEnableKernelIpc) {

        ALOGW("Binder recording disallowed because kernel binder is not enabled");

        return INVALID_OPERATION;

    }

    uid_t uid = IPCThreadState::self()->getCallingUid();

    if (uid != AID_ROOT) {

        ALOGE("Binder recording not allowed because client %" PRIu32 " is not root", uid);

        return PERMISSION_DENIED;

    }

    Extras* e = getOrCreateExtras();

    AutoMutex lock(e->mLock);

    if (mRecordingOn) {

        e->mRecordingFd.reset();

        mRecordingOn = false;

        LOG(INFO) << "Stopped Binder recording.";

        return NO_ERROR;

    } else {

        LOG(INFO) << "Could not stop Binder recording. One is not in progress.";

        return INVALID_OPERATION;

    }

}



const String16& BBinder::getInterfaceDescriptor() const

{

    static StaticString16 sBBinder(u"BBinder");
@@ -303,6 +371,12 @@ status_t BBinder::transact( 
        case PING_TRANSACTION:

            err = pingBinder();

            break;

        case START_RECORDING_TRANSACTION:

            err = startRecordingTransactions(data);

            break;

        case STOP_RECORDING_TRANSACTION:

            err = stopRecordingTransactions();

            break;

        case EXTENSION_TRANSACTION:

            CHECK(reply != nullptr);

            err = reply->writeStrongBinder(getExtension());
@@ -329,6 +403,23 @@ status_t BBinder::transact( 
        }

    }



    if (CC_UNLIKELY(kEnableKernelIpc && mRecordingOn && code != START_RECORDING_TRANSACTION)) {

        Extras* e = mExtras.load(std::memory_order_acquire);

        AutoMutex lock(e->mLock);

        if (mRecordingOn) {

            auto transaction =

                    android::binder::debug::RecordedTransaction::fromDetails(code, flags, data,

                                                                             *reply, err);

            if (transaction) {

                if (status_t err = transaction->dumpToFile(e->mRecordingFd); err != NO_ERROR) {

                    LOG(INFO) << "Failed to dump RecordedTransaction to file with error " << err;

                }

            } else {

                LOG(INFO) << "Failed to create RecordedTransaction object.";

            }

        }

    }



    return err;

}

libs/binder/BinderRecordReplay.cpp

0 → 100644
+185 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2022, The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *     http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */



#include <android-base/file.h>

#include <android-base/logging.h>

#include <binder/BinderRecordReplay.h>

#include <algorithm>



using android::Parcel;

using android::base::unique_fd;

using android::binder::debug::RecordedTransaction;



#define PADDING8(s) ((8 - (s) % 8) % 8)



static_assert(PADDING8(0) == 0);

static_assert(PADDING8(1) == 7);

static_assert(PADDING8(7) == 1);

static_assert(PADDING8(8) == 0);



// Transactions are sequentially recorded to the file descriptor in the following format:

//

// RecordedTransaction.TransactionHeader  (32 bytes)

// Sent Parcel data                       (getDataSize() bytes)

// padding                                (enough bytes to align the reply Parcel data to 8 bytes)

// Reply Parcel data                      (getReplySize() bytes)

// padding                                (enough bytes to align the next header to 8 bytes)

// [repeats with next transaction]

//

// Warning: This format is non-stable



RecordedTransaction::RecordedTransaction(RecordedTransaction&& t) noexcept {

    mHeader = {t.getCode(),      t.getFlags(),          t.getDataSize(),

               t.getReplySize(), t.getReturnedStatus(), t.getVersion()};

    mSent.setData(t.getDataParcel().data(), t.getDataSize());

    mReply.setData(t.getReplyParcel().data(), t.getReplySize());

}



std::optional<RecordedTransaction> RecordedTransaction::fromDetails(uint32_t code, uint32_t flags,

                                                                    const Parcel& dataParcel,

                                                                    const Parcel& replyParcel,

                                                                    status_t err) {

    RecordedTransaction t;

    t.mHeader = {code,

                 flags,

                 static_cast<uint64_t>(dataParcel.dataSize()),

                 static_cast<uint64_t>(replyParcel.dataSize()),

                 static_cast<int32_t>(err),

                 dataParcel.isForRpc() ? static_cast<uint32_t>(1) : static_cast<uint32_t>(0)};



    if (t.mSent.setData(dataParcel.data(), t.getDataSize()) != android::NO_ERROR) {

        LOG(INFO) << "Failed to set sent parcel data.";

        return std::nullopt;

    }



    if (t.mReply.setData(replyParcel.data(), t.getReplySize()) != android::NO_ERROR) {

        LOG(INFO) << "Failed to set reply parcel data.";

        return std::nullopt;

    }



    return std::optional<RecordedTransaction>(std::move(t));

}



std::optional<RecordedTransaction> RecordedTransaction::fromFile(const unique_fd& fd) {

    RecordedTransaction t;

    if (!android::base::ReadFully(fd, &t.mHeader, sizeof(mHeader))) {

        LOG(INFO) << "Failed to read transactionHeader from fd " << fd.get();

        return std::nullopt;

    }

    if (t.getVersion() != 0) {

        LOG(INFO) << "File corrupted: transaction version is not 0.";

        return std::nullopt;

    }



    std::vector<uint8_t> bytes;

    bytes.resize(t.getDataSize());

    if (!android::base::ReadFully(fd, bytes.data(), t.getDataSize())) {

        LOG(INFO) << "Failed to read sent parcel data from fd " << fd.get();

        return std::nullopt;

    }

    if (t.mSent.setData(bytes.data(), t.getDataSize()) != android::NO_ERROR) {

        LOG(INFO) << "Failed to set sent parcel data.";

        return std::nullopt;

    }



    uint8_t padding[7];

    if (!android::base::ReadFully(fd, padding, PADDING8(t.getDataSize()))) {

        LOG(INFO) << "Failed to read sent parcel padding from fd " << fd.get();

        return std::nullopt;

    }

    if (std::any_of(padding, padding + 7, [](uint8_t i) { return i != 0; })) {

        LOG(INFO) << "File corrupted: padding isn't 0.";

        return std::nullopt;

    }



    bytes.resize(t.getReplySize());

    if (!android::base::ReadFully(fd, bytes.data(), t.getReplySize())) {

        LOG(INFO) << "Failed to read reply parcel data from fd " << fd.get();

        return std::nullopt;

    }

    if (t.mReply.setData(bytes.data(), t.getReplySize()) != android::NO_ERROR) {

        LOG(INFO) << "Failed to set reply parcel data.";

        return std::nullopt;

    }



    if (!android::base::ReadFully(fd, padding, PADDING8(t.getReplySize()))) {

        LOG(INFO) << "Failed to read parcel padding from fd " << fd.get();

        return std::nullopt;

    }

    if (std::any_of(padding, padding + 7, [](uint8_t i) { return i != 0; })) {

        LOG(INFO) << "File corrupted: padding isn't 0.";

        return std::nullopt;

    }



    return std::optional<RecordedTransaction>(std::move(t));

}



android::status_t RecordedTransaction::dumpToFile(const unique_fd& fd) const {

    if (!android::base::WriteFully(fd, &mHeader, sizeof(mHeader))) {

        LOG(INFO) << "Failed to write transactionHeader to fd " << fd.get();

        return UNKNOWN_ERROR;

    }

    if (!android::base::WriteFully(fd, mSent.data(), getDataSize())) {

        LOG(INFO) << "Failed to write sent parcel data to fd " << fd.get();

        return UNKNOWN_ERROR;

    }

    const uint8_t zeros[7] = {0};

    if (!android::base::WriteFully(fd, zeros, PADDING8(getDataSize()))) {

        LOG(INFO) << "Failed to write sent parcel padding to fd " << fd.get();

        return UNKNOWN_ERROR;

    }

    if (!android::base::WriteFully(fd, mReply.data(), getReplySize())) {

        LOG(INFO) << "Failed to write reply parcel data to fd " << fd.get();

        return UNKNOWN_ERROR;

    }

    if (!android::base::WriteFully(fd, zeros, PADDING8(getReplySize()))) {

        LOG(INFO) << "Failed to write reply parcel padding to fd " << fd.get();

        return UNKNOWN_ERROR;

    }

    return NO_ERROR;

}



uint32_t RecordedTransaction::getCode() const {

    return mHeader.code;

}



uint32_t RecordedTransaction::getFlags() const {

    return mHeader.flags;

}



uint64_t RecordedTransaction::getDataSize() const {

    return mHeader.dataSize;

}



uint64_t RecordedTransaction::getReplySize() const {

    return mHeader.replySize;

}



int32_t RecordedTransaction::getReturnedStatus() const {

    return mHeader.statusReturned;

}



uint32_t RecordedTransaction::getVersion() const {

    return mHeader.version;

}



const Parcel& RecordedTransaction::getDataParcel() const {

    return mSent;

}



const Parcel& RecordedTransaction::getReplyParcel() const {

    return mReply;

}

libs/binder/BpBinder.cpp

+14 −0
Original line number Diff line number Diff line
@@ -30,6 +30,8 @@ 


#include "BuildFlags.h"



#include <android-base/file.h>



//#undef ALOGV

//#define ALOGV(...) fprintf(stderr, __VA_ARGS__)
@@ -299,6 +301,18 @@ status_t BpBinder::pingBinder() 
    return transact(PING_TRANSACTION, data, &reply);

}



status_t BpBinder::startRecordingBinder(const android::base::unique_fd& fd) {

    Parcel send, reply;

    send.writeUniqueFileDescriptor(fd);

    return transact(START_RECORDING_TRANSACTION, send, &reply);

}



status_t BpBinder::stopRecordingBinder() {

    Parcel data, reply;

    data.markForBinder(sp<BpBinder>::fromExisting(this));

    return transact(STOP_RECORDING_TRANSACTION, data, &reply);

}



status_t BpBinder::dump(int fd, const Vector<String16>& args)

{

    Parcel send;

libs/binder/include/binder/Binder.h

+7 −1
Original line number Diff line number Diff line
@@ -105,6 +105,12 @@ public: 
    [[nodiscard]] status_t setRpcClientDebug(android::base::unique_fd clientFd,

                                             const sp<IBinder>& keepAliveBinder);



    // Start recording transactions to the unique_fd in data.

    // See BinderRecordReplay.h for more details.

    [[nodiscard]] status_t startRecordingTransactions(const Parcel& data);

    // Stop the current recording.

    [[nodiscard]] status_t stopRecordingTransactions();



protected:

    virtual             ~BBinder();
@@ -131,7 +137,7 @@ private: 
    friend ::android::internal::Stability;

    int16_t mStability;

    bool mParceled;

    uint8_t mReserved0;

    bool mRecordingOn;



#ifdef __LP64__

    int32_t mReserved1;