/*

 * Copyright (C) 2017 The Android Open Source Project

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 *      http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

#include "src/tracing/service/tracing_service_impl.h"

#include <limits.h>

#include <string.h>

#include <algorithm>

#include <cinttypes>

#include <cstdint>

#include <limits>

#include <optional>

#include <string>

#include <unordered_set>

#if !PERFETTO_BUILDFLAG(PERFETTO_OS_WIN) && \

    !PERFETTO_BUILDFLAG(PERFETTO_OS_NACL)

#include <sys/uio.h>

#include <sys/utsname.h>

#include <unistd.h>

#endif

#if PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID) && \

    PERFETTO_BUILDFLAG(PERFETTO_ANDROID_BUILD)

#include "src/android_internal/lazy_library_loader.h"    // nogncheck

#include "src/android_internal/tracing_service_proxy.h"  // nogncheck

#endif

#if PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID) || \

    PERFETTO_BUILDFLAG(PERFETTO_OS_LINUX) ||   \

    PERFETTO_BUILDFLAG(PERFETTO_OS_APPLE)

#define PERFETTO_HAS_CHMOD

#include <sys/stat.h>

#endif

#include "perfetto/base/build_config.h"

#include "perfetto/base/status.h"

#include "perfetto/base/task_runner.h"

#include "perfetto/ext/base/android_utils.h"

#include "perfetto/ext/base/clock_snapshots.h"

#include "perfetto/ext/base/file_utils.h"

#include "perfetto/ext/base/metatrace.h"

#include "perfetto/ext/base/string_utils.h"

#include "perfetto/ext/base/string_view.h"

#include "perfetto/ext/base/sys_types.h"

#include "perfetto/ext/base/utils.h"

#include "perfetto/ext/base/uuid.h"

#include "perfetto/ext/base/version.h"

#include "perfetto/ext/base/watchdog.h"

#include "perfetto/ext/tracing/core/basic_types.h"

#include "perfetto/ext/tracing/core/client_identity.h"

#include "perfetto/ext/tracing/core/consumer.h"

#include "perfetto/ext/tracing/core/observable_events.h"

#include "perfetto/ext/tracing/core/producer.h"

#include "perfetto/ext/tracing/core/shared_memory.h"

#include "perfetto/ext/tracing/core/shared_memory_abi.h"

#include "perfetto/ext/tracing/core/trace_packet.h"

#include "perfetto/ext/tracing/core/trace_writer.h"

#include "perfetto/protozero/scattered_heap_buffer.h"

#include "perfetto/protozero/static_buffer.h"

#include "perfetto/tracing/core/data_source_descriptor.h"

#include "perfetto/tracing/core/tracing_service_capabilities.h"

#include "perfetto/tracing/core/tracing_service_state.h"

#include "src/android_stats/statsd_logging_helper.h"

#include "src/protozero/filtering/message_filter.h"

#include "src/protozero/filtering/string_filter.h"

#include "src/tracing/core/shared_memory_arbiter_impl.h"

#include "src/tracing/service/packet_stream_validator.h"

#include "src/tracing/service/trace_buffer.h"

#include "protos/perfetto/common/builtin_clock.gen.h"

#include "protos/perfetto/common/builtin_clock.pbzero.h"

#include "protos/perfetto/common/trace_stats.pbzero.h"

#include "protos/perfetto/config/trace_config.pbzero.h"

#include "protos/perfetto/trace/clock_snapshot.pbzero.h"

#include "protos/perfetto/trace/perfetto/tracing_service_event.pbzero.h"

#include "protos/perfetto/trace/remote_clock_sync.pbzero.h"

#include "protos/perfetto/trace/system_info.pbzero.h"

#include "protos/perfetto/trace/trace_packet.pbzero.h"

#include "protos/perfetto/trace/trace_uuid.pbzero.h"

#include "protos/perfetto/trace/trigger.pbzero.h"

// General note: this class must assume that Producers are malicious and will

// try to crash / exploit this class. We can trust pointers because they come

// from the IPC layer, but we should never assume that that the producer calls

// come in the right order or their arguments are sane / within bounds.

// This is a macro because we want the call-site line number for the ELOG.

#define PERFETTO_SVC_ERR(...) \

  (PERFETTO_ELOG(__VA_ARGS__), ::perfetto::base::ErrStatus(__VA_ARGS__))

namespace perfetto {

namespace {

constexpr int kMaxBuffersPerConsumer = 128;

constexpr uint32_t kDefaultSnapshotsIntervalMs = 10 * 1000;

constexpr int kDefaultWriteIntoFilePeriodMs = 5000;

constexpr int kMinWriteIntoFilePeriodMs = 100;

constexpr uint32_t kAllDataSourceStartedTimeout = 20000;

constexpr int kMaxConcurrentTracingSessions = 15;

constexpr int kMaxConcurrentTracingSessionsPerUid = 5;

constexpr int kMaxConcurrentTracingSessionsForStatsdUid = 10;

constexpr int64_t kMinSecondsBetweenTracesGuardrail = 5 * 60;

constexpr uint32_t kMillisPerHour = 3600000;

constexpr uint32_t kMillisPerDay = kMillisPerHour * 24;

constexpr uint32_t kMaxTracingDurationMillis = 7 * 24 * kMillisPerHour;

// These apply only if enable_extra_guardrails is true.

constexpr uint32_t kGuardrailsMaxTracingBufferSizeKb = 128 * 1024;

constexpr uint32_t kGuardrailsMaxTracingDurationMillis = 24 * kMillisPerHour;

constexpr size_t kMaxLifecycleEventsListedDataSources = 32;

#if PERFETTO_BUILDFLAG(PERFETTO_OS_WIN) || PERFETTO_BUILDFLAG(PERFETTO_OS_NACL)

struct iovec {

  void* iov_base;  // Address

  size_t iov_len;  // Block size

};

// Simple implementation of writev. Note that this does not give the atomicity

// guarantees of a real writev, but we don't depend on these (we aren't writing

// to the same file from another thread).

ssize_t writev(int fd, const struct iovec* iov, int iovcnt) {

  ssize_t total_size = 0;

  for (int i = 0; i < iovcnt; ++i) {

    ssize_t current_size = base::WriteAll(fd, iov[i].iov_base, iov[i].iov_len);

    if (current_size != static_cast<ssize_t>(iov[i].iov_len))

      return -1;

    total_size += current_size;

  }

  return total_size;

}

#define IOV_MAX 1024  // Linux compatible limit.

#elif PERFETTO_BUILDFLAG(PERFETTO_OS_QNX)

#define IOV_MAX 1024  // Linux compatible limit.

#endif

// Partially encodes a CommitDataRequest in an int32 for the purposes of

// metatracing. Note that it encodes only the bottom 10 bits of the producer id

// (which is technically 16 bits wide).

//

// Format (by bit range):

// [   31 ][         30 ][             29:20 ][            19:10 ][        9:0]

// [unused][has flush id][num chunks to patch][num chunks to move][producer id]

int32_t EncodeCommitDataRequest(ProducerID producer_id,

                                const CommitDataRequest& req_untrusted) {

  uint32_t cmov = static_cast<uint32_t>(req_untrusted.chunks_to_move_size());

  uint32_t cpatch = static_cast<uint32_t>(req_untrusted.chunks_to_patch_size());

  uint32_t has_flush_id = req_untrusted.flush_request_id() != 0;

  uint32_t mask = (1 << 10) - 1;

  uint32_t acc = 0;

  acc |= has_flush_id << 30;

  acc |= (cpatch & mask) << 20;

  acc |= (cmov & mask) << 10;

  acc |= (producer_id & mask);

  return static_cast<int32_t>(acc);

}

void SerializeAndAppendPacket(std::vector<TracePacket>* packets,

                              std::vector<uint8_t> packet) {

  Slice slice = Slice::Allocate(packet.size());

  memcpy(slice.own_data(), packet.data(), packet.size());

  packets->emplace_back();

  packets->back().AddSlice(std::move(slice));

}

std::tuple<size_t /*shm_size*/, size_t /*page_size*/> EnsureValidShmSizes(

    size_t shm_size,

    size_t page_size) {

  // Theoretically the max page size supported by the ABI is 64KB.

  // However, the current implementation of TraceBuffer (the non-shared

  // userspace buffer where the service copies data) supports at most

  // 32K. Setting 64K "works" from the producer<>consumer viewpoint

  // but then causes the data to be discarded when copying it into

  // TraceBuffer.

  constexpr size_t kMaxPageSize = 32 * 1024;

  static_assert(kMaxPageSize <= SharedMemoryABI::kMaxPageSize, "");

  if (page_size == 0)

    page_size = TracingServiceImpl::kDefaultShmPageSize;

  if (shm_size == 0)

    shm_size = TracingServiceImpl::kDefaultShmSize;

  page_size = std::min<size_t>(page_size, kMaxPageSize);

  shm_size = std::min<size_t>(shm_size, TracingServiceImpl::kMaxShmSize);

  // The tracing page size has to be multiple of 4K. On some systems (e.g. Mac

  // on Arm64) the system page size can be larger (e.g., 16K). That doesn't

  // matter here, because the tracing page size is just a logical partitioning

  // and does not have any dependencies on kernel mm syscalls (read: it's fine

  // to have trace page sizes of 4K on a system where the kernel page size is

  // 16K).

  bool page_size_is_valid = page_size >= SharedMemoryABI::kMinPageSize;

  page_size_is_valid &= page_size % SharedMemoryABI::kMinPageSize == 0;

  // Only allow power of two numbers of pages, i.e. 1, 2, 4, 8 pages.

  size_t num_pages = page_size / SharedMemoryABI::kMinPageSize;

  page_size_is_valid &= (num_pages & (num_pages - 1)) == 0;

  if (!page_size_is_valid || shm_size < page_size ||

      shm_size % page_size != 0) {

    return std::make_tuple(TracingServiceImpl::kDefaultShmSize,

                           TracingServiceImpl::kDefaultShmPageSize);

  }

  return std::make_tuple(shm_size, page_size);

}

bool NameMatchesFilter(const std::string& name,

                       const std::vector<std::string>& name_filter,

                       const std::vector<std::string>& name_regex_filter) {

  bool filter_is_set = !name_filter.empty() || !name_regex_filter.empty();

  if (!filter_is_set)

    return true;

  bool filter_matches = std::find(name_filter.begin(), name_filter.end(),

                                  name) != name_filter.end();

  bool filter_regex_matches =

      std::find_if(name_regex_filter.begin(), name_regex_filter.end(),

                   [&](const std::string& regex) {

                     return std::regex_match(

                         name, std::regex(regex, std::regex::extended));

                   }) != name_regex_filter.end();

  return filter_matches || filter_regex_matches;

}

// Used when TraceConfig.write_into_file == true and output_path is not empty.

base::ScopedFile CreateTraceFile(const std::string& path, bool overwrite) {

#if PERFETTO_BUILDFLAG(PERFETTO_OS_ANDROID) && \

    PERFETTO_BUILDFLAG(PERFETTO_ANDROID_BUILD)

  // This is NOT trying to preserve any security property, SELinux does that.

  // It just improves the actionability of the error when people try to save the

  // trace in a location that is not SELinux-allowed (a generic "permission

  // denied" vs "don't put it here, put it there").

  // These are the only SELinux approved dir for trace files that are created

  // directly by traced.

  static const char* kTraceDirBasePath = "/data/misc/perfetto-traces/";

  if (!base::StartsWith(path, kTraceDirBasePath)) {

    PERFETTO_ELOG("Invalid output_path %s. On Android it must be within %s.",

                  path.c_str(), kTraceDirBasePath);

    return base::ScopedFile();

  }

#endif

  // O_CREAT | O_EXCL will fail if the file exists already.

  const int flags = O_RDWR | O_CREAT | (overwrite ? O_TRUNC : O_EXCL);

  auto fd = base::OpenFile(path, flags, 0600);

  if (fd) {

#if defined(PERFETTO_HAS_CHMOD)

    // Passing 0644 directly above won't work because of umask.

    PERFETTO_CHECK(fchmod(*fd, 0644) == 0);

#endif

  } else {

    PERFETTO_PLOG("Failed to create %s", path.c_str());

  }

  return fd;

}

bool ShouldLogEvent(const TraceConfig& cfg) {

  switch (cfg.statsd_logging()) {

    case TraceConfig::STATSD_LOGGING_ENABLED:

      return true;

    case TraceConfig::STATSD_LOGGING_DISABLED:

      return false;

    case TraceConfig::STATSD_LOGGING_UNSPECIFIED:

      break;

  }

  // For backward compatibility with older versions of perfetto_cmd.

  return cfg.enable_extra_guardrails();

}

// Appends `data` (which has `size` bytes), to `*packet`. Splits the data in

// slices no larger than `max_slice_size`.

void AppendOwnedSlicesToPacket(std::unique_ptr<uint8_t[]> data,

                               size_t size,

                               size_t max_slice_size,

                               perfetto::TracePacket* packet) {

  if (size <= max_slice_size) {

    packet->AddSlice(Slice::TakeOwnership(std::move(data), size));

    return;

  }

  uint8_t* src_ptr = data.get();

  for (size_t size_left = size; size_left > 0;) {

    const size_t slice_size = std::min(size_left, max_slice_size);

    Slice slice = Slice::Allocate(slice_size);

    memcpy(slice.own_data(), src_ptr, slice_size);

    packet->AddSlice(std::move(slice));

    src_ptr += slice_size;

    size_left -= slice_size;

  }

}

using TraceFilter = protos::gen::TraceConfig::TraceFilter;

std::optional<protozero::StringFilter::Policy> ConvertPolicy(

    TraceFilter::StringFilterPolicy policy) {

  switch (policy) {

    case TraceFilter::SFP_UNSPECIFIED:

      return std::nullopt;

    case TraceFilter::SFP_MATCH_REDACT_GROUPS:

      return protozero::StringFilter::Policy::kMatchRedactGroups;

    case TraceFilter::SFP_ATRACE_MATCH_REDACT_GROUPS:

      return protozero::StringFilter::Policy::kAtraceMatchRedactGroups;

    case TraceFilter::SFP_MATCH_BREAK:

      return protozero::StringFilter::Policy::kMatchBreak;

    case TraceFilter::SFP_ATRACE_MATCH_BREAK:

      return protozero::StringFilter::Policy::kAtraceMatchBreak;

    case TraceFilter::SFP_ATRACE_REPEATED_SEARCH_REDACT_GROUPS:

      return protozero::StringFilter::Policy::kAtraceRepeatedSearchRedactGroups;

  }

  return std::nullopt;

}

}  // namespace

// static

std::unique_ptr<TracingService> TracingService::CreateInstance(

    std::unique_ptr<SharedMemory::Factory> shm_factory,

    base::TaskRunner* task_runner,

    InitOpts init_opts) {

  tracing_service::Dependencies deps;

  deps.clock = std::make_unique<tracing_service::ClockImpl>();

  uint32_t seed = static_cast<uint32_t>(deps.clock->GetWallTimeMs().count());

  deps.random = std::make_unique<tracing_service::RandomImpl>(seed);

  return std::unique_ptr<TracingService>(new TracingServiceImpl(

      std::move(shm_factory), task_runner, std::move(deps), init_opts));

}

TracingServiceImpl::TracingServiceImpl(

    std::unique_ptr<SharedMemory::Factory> shm_factory,

    base::TaskRunner* task_runner,

    tracing_service::Dependencies deps,

    InitOpts init_opts)

    : clock_(std::move(deps.clock)),

      random_(std::move(deps.random)),

      init_opts_(init_opts),

      shm_factory_(std::move(shm_factory)),

      uid_(base::GetCurrentUserId()),

      buffer_ids_(kMaxTraceBufferID),

      weak_runner_(task_runner) {

  PERFETTO_DCHECK(task_runner);

}

TracingServiceImpl::~TracingServiceImpl() {

  // TODO(fmayer): handle teardown of all Producer.

}

std::unique_ptr<TracingService::ProducerEndpoint>

TracingServiceImpl::ConnectProducer(Producer* producer,

                                    const ClientIdentity& client_identity,

                                    const std::string& producer_name,

                                    size_t shared_memory_size_hint_bytes,

                                    bool in_process,

                                    ProducerSMBScrapingMode smb_scraping_mode,

                                    size_t shared_memory_page_size_hint_bytes,

                                    std::unique_ptr<SharedMemory> shm,

                                    const std::string& sdk_version) {

  PERFETTO_DCHECK_THREAD(thread_checker_);

  auto uid = client_identity.uid();

  if (lockdown_mode_ && uid != base::GetCurrentUserId()) {

    PERFETTO_DLOG("Lockdown mode. Rejecting producer with UID %ld",

                  static_cast<unsigned long>(uid));

    return nullptr;

  }

  if (producers_.size() >= kMaxProducerID) {

    PERFETTO_DFATAL("Too many producers.");

    return nullptr;

  }

  const ProducerID id = GetNextProducerID();

  PERFETTO_DLOG("Producer %" PRIu16 " connected, uid=%d", id,

                static_cast<int>(uid));

  bool smb_scraping_enabled = smb_scraping_enabled_;

  switch (smb_scraping_mode) {

    case ProducerSMBScrapingMode::kDefault:

      break;

    case ProducerSMBScrapingMode::kEnabled:

      smb_scraping_enabled = true;

      break;

    case ProducerSMBScrapingMode::kDisabled:

      smb_scraping_enabled = false;

      break;

  }

  std::unique_ptr<ProducerEndpointImpl> endpoint(new ProducerEndpointImpl(

      id, client_identity, this, weak_runner_.task_runner(), producer,

      producer_name, sdk_version, in_process, smb_scraping_enabled));

  auto it_and_inserted = producers_.emplace(id, endpoint.get());

  PERFETTO_DCHECK(it_and_inserted.second);

  endpoint->shmem_size_hint_bytes_ = shared_memory_size_hint_bytes;

  endpoint->shmem_page_size_hint_bytes_ = shared_memory_page_size_hint_bytes;

  // Producer::OnConnect() should run before Producer::OnTracingSetup(). The

  // latter may be posted by SetupSharedMemory() below, so post OnConnect() now.

  endpoint->weak_runner_.PostTask(

      [endpoint = endpoint.get()] { endpoint->producer_->OnConnect(); });

  if (shm) {

    // The producer supplied an SMB. This is used only by Chrome; in the most

    // common cases the SMB is created by the service and passed via

    // OnTracingSetup(). Verify that it is correctly sized before we attempt to

    // use it. The transport layer has to verify the integrity of the SMB (e.g.

    // ensure that the producer can't resize if after the fact).

    size_t shm_size, page_size;

    std::tie(shm_size, page_size) =

        EnsureValidShmSizes(shm->size(), endpoint->shmem_page_size_hint_bytes_);

    if (shm_size == shm->size() &&

        page_size == endpoint->shmem_page_size_hint_bytes_) {

      PERFETTO_DLOG(

          "Adopting producer-provided SMB of %zu kB for producer \"%s\"",

          shm_size / 1024, endpoint->name_.c_str());

      endpoint->SetupSharedMemory(std::move(shm), page_size,

                                  /*provided_by_producer=*/true);

    } else {

      PERFETTO_LOG(

          "Discarding incorrectly sized producer-provided SMB for producer "

          "\"%s\", falling back to service-provided SMB. Requested sizes: %zu "

          "B total, %zu B page size; suggested corrected sizes: %zu B total, "

          "%zu B page size",

          endpoint->name_.c_str(), shm->size(),

          endpoint->shmem_page_size_hint_bytes_, shm_size, page_size);

      shm.reset();

    }

  }

  return std::unique_ptr<ProducerEndpoint>(std::move(endpoint));

}

void TracingServiceImpl::DisconnectProducer(ProducerID id) {

  PERFETTO_DCHECK_THREAD(thread_checker_);

  PERFETTO_DLOG("Producer %" PRIu16 " disconnected", id);

  PERFETTO_DCHECK(producers_.count(id));

  // Scrape remaining chunks for this producer to ensure we don't lose data.

  if (auto* producer = GetProducer(id)) {

    for (auto& session_id_and_session : tracing_sessions_)

      ScrapeSharedMemoryBuffers(&session_id_and_session.second, producer);

  }

  for (auto it = data_sources_.begin(); it != data_sources_.end();) {

    auto next = it;

    next++;

    if (it->second.producer_id == id)

      UnregisterDataSource(id, it->second.descriptor.name());

    it = next;

  }

  producers_.erase(id);

  UpdateMemoryGuardrail();

}

TracingServiceImpl::ProducerEndpointImpl* TracingServiceImpl::GetProducer(

    ProducerID id) const {

  PERFETTO_DCHECK_THREAD(thread_checker_);

  auto it = producers_.find(id);

  if (it == producers_.end())

    return nullptr;

  return it->second;

}

std::unique_ptr<TracingService::ConsumerEndpoint>

TracingServiceImpl::ConnectConsumer(Consumer* consumer, uid_t uid) {

  PERFETTO_DCHECK_THREAD(thread_checker_);

  PERFETTO_DLOG("Consumer %p connected from UID %" PRIu64,

                reinterpret_cast<void*>(consumer), static_cast<uint64_t>(uid));

  std::unique_ptr<ConsumerEndpointImpl> endpoint(new ConsumerEndpointImpl(

      this, weak_runner_.task_runner(), consumer, uid));

  // Consumer might go away before we're able to send the connect notification,

  // if that is the case just bail out.

  auto weak_ptr = endpoint->weak_ptr_factory_.GetWeakPtr();

  weak_runner_.task_runner()->PostTask([weak_ptr = std::move(weak_ptr)] {

    if (weak_ptr)

      weak_ptr->consumer_->OnConnect();

  });

  return std::unique_ptr<ConsumerEndpoint>(std::move(endpoint));

}

void TracingServiceImpl::DisconnectConsumer(ConsumerEndpointImpl* consumer) {

  PERFETTO_DCHECK_THREAD(thread_checker_);

  PERFETTO_DLOG("Consumer %p disconnected", reinterpret_cast<void*>(consumer));

  if (consumer->tracing_session_id_)

    FreeBuffers(consumer->tracing_session_id_);  // Will also DisableTracing().

  // At this point no more pointers to |consumer| should be around.

  PERFETTO_DCHECK(!std::any_of(

      tracing_sessions_.begin(), tracing_sessions_.end(),

      [consumer](const std::pair<const TracingSessionID, TracingSession>& kv) {

        return kv.second.consumer_maybe_null == consumer;

      }));

}

bool TracingServiceImpl::DetachConsumer(ConsumerEndpointImpl* consumer,

                                        const std::string& key) {

  PERFETTO_DCHECK_THREAD(thread_checker_);

  PERFETTO_DLOG("Consumer %p detached", reinterpret_cast<void*>(consumer));

  TracingSessionID tsid = consumer->tracing_session_id_;

  TracingSession* tracing_session;

  if (!tsid || !(tracing_session = GetTracingSession(tsid)))

    return false;

  if (GetDetachedSession(consumer->uid_, key)) {

    PERFETTO_ELOG("Another session has been detached with the same key \"%s\"",

                  key.c_str());

    return false;

  }

  PERFETTO_DCHECK(tracing_session->consumer_maybe_null == consumer);

  tracing_session->consumer_maybe_null = nullptr;

  tracing_session->detach_key = key;

  consumer->tracing_session_id_ = 0;

  return true;

}

std::unique_ptr<TracingService::RelayEndpoint>

TracingServiceImpl::ConnectRelayClient(RelayClientID relay_client_id) {

  PERFETTO_DCHECK_THREAD(thread_checker_);

  auto endpoint = std::make_unique<RelayEndpointImpl>(relay_client_id, this);

  relay_clients_[relay_client_id] = endpoint.get();

  return std::move(endpoint);

}

void TracingServiceImpl::DisconnectRelayClient(RelayClientID relay_client_id) {

  PERFETTO_DCHECK_THREAD(thread_checker_);

  if (relay_clients_.find(relay_client_id) == relay_clients_.end())

    return;

  relay_clients_.erase(relay_client_id);

}

bool TracingServiceImpl::AttachConsumer(ConsumerEndpointImpl* consumer,

                                        const std::string& key) {

  PERFETTO_DCHECK_THREAD(thread_checker_);

  PERFETTO_DLOG("Consumer %p attaching to session %s",

                reinterpret_cast<void*>(consumer), key.c_str());

  if (consumer->tracing_session_id_) {

    PERFETTO_ELOG(

        "Cannot reattach consumer to session %s"

        " while it already attached tracing session ID %" PRIu64,

        key.c_str(), consumer->tracing_session_id_);

    return false;

  }

  auto* tracing_session = GetDetachedSession(consumer->uid_, key);

  if (!tracing_session) {

    PERFETTO_ELOG(

        "Failed to attach consumer, session '%s' not found for uid %d",

        key.c_str(), static_cast<int>(consumer->uid_));

    return false;

  }

  consumer->tracing_session_id_ = tracing_session->id;

  tracing_session->consumer_maybe_null = consumer;

  tracing_session->detach_key.clear();

  return true;

}

base::Status TracingServiceImpl::EnableTracing(ConsumerEndpointImpl* consumer,

                                               const TraceConfig& cfg,

                                               base::ScopedFile fd) {

  PERFETTO_DCHECK_THREAD(thread_checker_);

  // If the producer is specifying a UUID, respect that (at least for the first

  // snapshot). Otherwise generate a new UUID.

  base::Uuid uuid(cfg.trace_uuid_lsb(), cfg.trace_uuid_msb());

  if (!uuid)

    uuid = base::Uuidv4();

  PERFETTO_DLOG("Enabling tracing for consumer %p, UUID: %s",

                reinterpret_cast<void*>(consumer),

                uuid.ToPrettyString().c_str());

  MaybeLogUploadEvent(cfg, uuid, PerfettoStatsdAtom::kTracedEnableTracing);

  if (cfg.lockdown_mode() == TraceConfig::LOCKDOWN_SET)

    lockdown_mode_ = true;

  if (cfg.lockdown_mode() == TraceConfig::LOCKDOWN_CLEAR)

    lockdown_mode_ = false;

  // Scope |tracing_session| to this block to prevent accidental use of a null

  // pointer later in this function.

  {

    TracingSession* tracing_session =

        GetTracingSession(consumer->tracing_session_id_);

    if (tracing_session) {

      MaybeLogUploadEvent(

          cfg, uuid,

          PerfettoStatsdAtom::kTracedEnableTracingExistingTraceSession);

      return PERFETTO_SVC_ERR(

          "A Consumer is trying to EnableTracing() but another tracing "

          "session is already active (forgot a call to FreeBuffers() ?)");

    }

  }

  const uint32_t max_duration_ms = cfg.enable_extra_guardrails()

                                       ? kGuardrailsMaxTracingDurationMillis

                                       : kMaxTracingDurationMillis;

  if (cfg.duration_ms() > max_duration_ms) {

    MaybeLogUploadEvent(cfg, uuid,

                        PerfettoStatsdAtom::kTracedEnableTracingTooLongTrace);

    return PERFETTO_SVC_ERR("Requested too long trace (%" PRIu32

                            "ms  > %" PRIu32 " ms)",

                            cfg.duration_ms(), max_duration_ms);

  }

  const bool has_trigger_config =

      GetTriggerMode(cfg) != TraceConfig::TriggerConfig::UNSPECIFIED;

  if (has_trigger_config &&

      (cfg.trigger_config().trigger_timeout_ms() == 0 ||

       cfg.trigger_config().trigger_timeout_ms() > max_duration_ms)) {

    MaybeLogUploadEvent(

        cfg, uuid,

        PerfettoStatsdAtom::kTracedEnableTracingInvalidTriggerTimeout);

    return PERFETTO_SVC_ERR(

        "Traces with START_TRACING triggers must provide a positive "

        "trigger_timeout_ms < 7 days (received %" PRIu32 "ms)",

        cfg.trigger_config().trigger_timeout_ms());

  }

  // This check has been introduced in May 2023 after finding b/274931668.

  if (static_cast<int>(cfg.trigger_config().trigger_mode()) >

      TraceConfig::TriggerConfig::TriggerMode_MAX) {

    MaybeLogUploadEvent(

        cfg, uuid, PerfettoStatsdAtom::kTracedEnableTracingInvalidTriggerMode);

    return PERFETTO_SVC_ERR(

        "The trace config specified an invalid trigger_mode");

  }

  if (cfg.trigger_config().use_clone_snapshot_if_available() &&

      cfg.trigger_config().trigger_mode() !=

          TraceConfig::TriggerConfig::STOP_TRACING) {

    MaybeLogUploadEvent(

        cfg, uuid, PerfettoStatsdAtom::kTracedEnableTracingInvalidTriggerMode);

    return PERFETTO_SVC_ERR(

        "trigger_mode must be STOP_TRACING when "

        "use_clone_snapshot_if_available=true");

  }

  if (has_trigger_config && cfg.duration_ms() != 0) {

    MaybeLogUploadEvent(

        cfg, uuid, PerfettoStatsdAtom::kTracedEnableTracingDurationWithTrigger);

    return PERFETTO_SVC_ERR(

        "duration_ms was set, this must not be set for traces with triggers.");

  }

  for (char c : cfg.bugreport_filename()) {

    if (!((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') ||

          (c >= '0' && c <= '9') || c == '-' || c == '_' || c == '.')) {

      MaybeLogUploadEvent(

          cfg, uuid, PerfettoStatsdAtom::kTracedEnableTracingInvalidBrFilename);

      return PERFETTO_SVC_ERR(

          "bugreport_filename contains invalid chars. Use [a-zA-Z0-9-_.]+");

    }

  }

  if ((GetTriggerMode(cfg) == TraceConfig::TriggerConfig::STOP_TRACING ||

       GetTriggerMode(cfg) == TraceConfig::TriggerConfig::CLONE_SNAPSHOT) &&

      cfg.write_into_file()) {

    // We don't support this usecase because there are subtle assumptions which

    // break around TracingServiceEvents and windowed sorting (i.e. if we don't

    // drain the events in ReadBuffersIntoFile because we are waiting for

    // STOP_TRACING, we can end up queueing up a lot of TracingServiceEvents and

    // emitting them wildy out of order breaking windowed sorting in trace

    // processor).

    MaybeLogUploadEvent(

        cfg, uuid,

        PerfettoStatsdAtom::kTracedEnableTracingStopTracingWriteIntoFile);

    return PERFETTO_SVC_ERR(

        "Specifying trigger mode STOP_TRACING/CLONE_SNAPSHOT and "

        "write_into_file together is unsupported");

  }

  std::unordered_set<std::string> triggers;

  for (const auto& trigger : cfg.trigger_config().triggers()) {

    if (!triggers.insert(trigger.name()).second) {

      MaybeLogUploadEvent(

          cfg, uuid,

          PerfettoStatsdAtom::kTracedEnableTracingDuplicateTriggerName);

      return PERFETTO_SVC_ERR("Duplicate trigger name: %s",

                              trigger.name().c_str());

    }

  }

  if (cfg.enable_extra_guardrails()) {

    if (cfg.deferred_start()) {

      MaybeLogUploadEvent(

          cfg, uuid,

          PerfettoStatsdAtom::kTracedEnableTracingInvalidDeferredStart);

      return PERFETTO_SVC_ERR(

          "deferred_start=true is not supported in unsupervised traces");

    }

    uint64_t buf_size_sum = 0;

    for (const auto& buf : cfg.buffers()) {

      if (buf.size_kb() % 4 != 0) {

        MaybeLogUploadEvent(

            cfg, uuid,

            PerfettoStatsdAtom::kTracedEnableTracingInvalidBufferSize);

        return PERFETTO_SVC_ERR(

            "buffers.size_kb must be a multiple of 4, got %" PRIu32,

            buf.size_kb());

      }

      buf_size_sum += buf.size_kb();

    }

    uint32_t max_tracing_buffer_size_kb =

        std::max(kGuardrailsMaxTracingBufferSizeKb,

                 cfg.guardrail_overrides().max_tracing_buffer_size_kb());

    if (buf_size_sum > max_tracing_buffer_size_kb) {

      MaybeLogUploadEvent(

          cfg, uuid,

          PerfettoStatsdAtom::kTracedEnableTracingBufferSizeTooLarge);

      return PERFETTO_SVC_ERR("Requested too large trace buffer (%" PRIu64

                              "kB  > %" PRIu32 " kB)",

                              buf_size_sum, max_tracing_buffer_size_kb);

    }

  }

  if (cfg.buffers_size() > kMaxBuffersPerConsumer) {

    MaybeLogUploadEvent(cfg, uuid,

                        PerfettoStatsdAtom::kTracedEnableTracingTooManyBuffers);

    return PERFETTO_SVC_ERR("Too many buffers configured (%d)",

                            cfg.buffers_size());

  }

  // Check that the config specifies all buffers for its data sources. This

  // is also checked in SetupDataSource, but it is simpler to return a proper

  // error to the consumer from here (and there will be less state to undo).

  for (const TraceConfig::DataSource& cfg_data_source : cfg.data_sources()) {

    size_t num_buffers = static_cast<size_t>(cfg.buffers_size());

    size_t target_buffer = cfg_data_source.config().target_buffer();

    if (target_buffer >= num_buffers) {

      MaybeLogUploadEvent(

          cfg, uuid, PerfettoStatsdAtom::kTracedEnableTracingOobTargetBuffer);

      return PERFETTO_SVC_ERR(

          "Data source \"%s\" specified an out of bounds target_buffer (%zu >= "

          "%zu)",

          cfg_data_source.config().name().c_str(), target_buffer, num_buffers);

    }

  }

  if (!cfg.unique_session_name().empty()) {

    const std::string& name = cfg.unique_session_name();

    for (auto& kv : tracing_sessions_) {

      if (kv.second.state == TracingSession::CLONED_READ_ONLY)

        continue;  // Don't consider cloned sessions in uniqueness checks.

      if (kv.second.config.unique_session_name() == name) {

        MaybeLogUploadEvent(

            cfg, uuid,

            PerfettoStatsdAtom::kTracedEnableTracingDuplicateSessionName);

        static const char fmt[] =

            "A trace with this unique session name (%s) already exists";

        // This happens frequently, don't make it an "E"LOG.

        PERFETTO_LOG(fmt, name.c_str());

        return base::ErrStatus(fmt, name.c_str());

      }

    }

  }

  if (!cfg.session_semaphores().empty()) {

    struct SemaphoreSessionsState {

      uint64_t smallest_max_other_session_count =

          std::numeric_limits<uint64_t>::max();

      uint64_t session_count = 0;

    };

    // For each semaphore, compute the number of active sessions and the

    // MIN(limit).

    std::unordered_map<std::string, SemaphoreSessionsState>

        sem_to_sessions_state;

    for (const auto& id_and_session : tracing_sessions_) {

      const auto& session = id_and_session.second;

      if (session.state == TracingSession::CLONED_READ_ONLY ||

          session.state == TracingSession::DISABLED) {

        // Don't consider cloned or disabled sessions in checks.

        continue;

      }

      for (const auto& sem : session.config.session_semaphores()) {

        auto& sessions_state = sem_to_sessions_state[sem.name()];

        sessions_state.smallest_max_other_session_count =

            std::min(sessions_state.smallest_max_other_session_count,

                     sem.max_other_session_count());

        sessions_state.session_count++;

      }

    }

    // Check if any of the semaphores declared by the config clashes with any of

    // the currently active semaphores.

    for (const auto& semaphore : cfg.session_semaphores()) {

      auto it = sem_to_sessions_state.find(semaphore.name());

      if (it == sem_to_sessions_state.end()) {

        continue;

      }

      uint64_t max_other_session_count =

          std::min(semaphore.max_other_session_count(),

                   it->second.smallest_max_other_session_count);

      if (it->second.session_count > max_other_session_count) {

        MaybeLogUploadEvent(

            cfg, uuid,

            PerfettoStatsdAtom::

                kTracedEnableTracingFailedSessionSemaphoreCheck);

        return PERFETTO_SVC_ERR(

            "Semaphore \"%s\" exceeds maximum allowed other session count "

            "(%" PRIu64 " > min(%" PRIu64 ", %" PRIu64 "))",

            semaphore.name().c_str(), it->second.session_count,

            semaphore.max_other_session_count(),

            it->second.smallest_max_other_session_count);

      }

    }

  }

  if (cfg.enable_extra_guardrails()) {

    // unique_session_name can be empty

    const std::string& name = cfg.unique_session_name();

    int64_t now_s = clock_->GetBootTimeS().count();

    // Remove any entries where the time limit has passed so this map doesn't

    // grow indefinitely:

    std::map<std::string, int64_t>& sessions = session_to_last_trace_s_;

    for (auto it = sessions.cbegin(); it != sessions.cend();) {

      if (now_s - it->second > kMinSecondsBetweenTracesGuardrail) {

        it = sessions.erase(it);

      } else {

        ++it;

      }

    }

    int64_t& previous_s = session_to_last_trace_s_[name];

    if (previous_s == 0) {

      previous_s = now_s;

    } else {

      MaybeLogUploadEvent(

          cfg, uuid,

          PerfettoStatsdAtom::kTracedEnableTracingSessionNameTooRecent);

      return PERFETTO_SVC_ERR(

          "A trace with unique session name \"%s\" began less than %" PRId64

          "s ago (%" PRId64 "s)",

          name.c_str(), kMinSecondsBetweenTracesGuardrail, now_s - previous_s);

    }

  }

  const int sessions_for_uid = static_cast<int>(std::count_if(

      tracing_sessions_.begin(), tracing_sessions_.end(),

      [consumer](const decltype(tracing_sessions_)::value_type& s) {

        return s.second.consumer_uid == consumer->uid_;

      }));

  int per_uid_limit = kMaxConcurrentTracingSessionsPerUid;

  if (consumer->uid_ == 1066 /* AID_STATSD*/) {

    per_uid_limit = kMaxConcurrentTracingSessionsForStatsdUid;

  }

  if (sessions_for_uid >= per_uid_limit) {

    MaybeLogUploadEvent(

        cfg, uuid,

        PerfettoStatsdAtom::kTracedEnableTracingTooManySessionsForUid);

    return PERFETTO_SVC_ERR(

        "Too many concurrent tracing sesions (%d) for uid %d limit is %d",

        sessions_for_uid, static_cast<int>(consumer->uid_), per_uid_limit);

  }

  // TODO(primiano): This is a workaround to prevent that a producer gets stuck

  // in a state where it stalls by design by having more TraceWriterImpl

  // instances than free pages in the buffer. This is really a bug in

  // trace_probes and the way it handles stalls in the shmem buffer.

  if (tracing_sessions_.size() >= kMaxConcurrentTracingSessions) {

    MaybeLogUploadEvent(

        cfg, uuid,

        PerfettoStatsdAtom::kTracedEnableTracingTooManyConcurrentSessions);

    return PERFETTO_SVC_ERR("Too many concurrent tracing sesions (%zu)",

                            tracing_sessions_.size());

  }

  // If the trace config provides a filter bytecode, setup the filter now.

  // If the filter loading fails, abort the tracing session rather than running

  // unfiltered.

  std::unique_ptr<protozero::MessageFilter> trace_filter;

  if (cfg.has_trace_filter()) {

    const auto& filt = cfg.trace_filter();

    trace_filter.reset(new protozero::MessageFilter());

    protozero::StringFilter& string_filter = trace_filter->string_filter();

    for (const auto& rule : filt.string_filter_chain().rules()) {

      auto opt_policy = ConvertPolicy(rule.policy());

      if (!opt_policy.has_value()) {

        MaybeLogUploadEvent(

            cfg, uuid, PerfettoStatsdAtom::kTracedEnableTracingInvalidFilter);

        return PERFETTO_SVC_ERR(

            "Trace filter has invalid string filtering rules, aborting");

      }

      string_filter.AddRule(*opt_policy, rule.regex_pattern(),

                            rule.atrace_payload_starts_with());

    }

    const std::string& bytecode_v1 = filt.bytecode();

    const std::string& bytecode_v2 = filt.bytecode_v2();

    const std::string& bytecode =

        bytecode_v2.empty() ? bytecode_v1 : bytecode_v2;

    if (!trace_filter->LoadFilterBytecode(bytecode.data(), bytecode.size())) {

      MaybeLogUploadEvent(

          cfg, uuid, PerfettoStatsdAtom::kTracedEnableTracingInvalidFilter);

      return PERFETTO_SVC_ERR("Trace filter bytecode invalid, aborting");

    }

    // The filter is created using perfetto.protos.Trace as root message

    // (because that makes it possible to play around with the `proto_filter`

    // tool on actual traces). Here in the service, however, we deal with

    // perfetto.protos.TracePacket(s), which are one level down (Trace.packet).

    // The IPC client (or the write_into_filte logic in here) are responsible

    // for pre-pending the packet preamble (See GetProtoPreamble() calls), but

    // the preamble is not there at ReadBuffer time. Hence we change the root of

    // the filtering to start at the Trace.packet level.

    if (!trace_filter->SetFilterRoot({TracePacket::kPacketFieldNumber})) {

      MaybeLogUploadEvent(

          cfg, uuid, PerfettoStatsdAtom::kTracedEnableTracingInvalidFilter);

      return PERFETTO_SVC_ERR("Failed to set filter root.");

    }

  }

  const TracingSessionID tsid = ++last_tracing_session_id_;

  TracingSession* tracing_session =

      &tracing_sessions_

           .emplace(std::piecewise_construct, std::forward_as_tuple(tsid),

                    std::forward_as_tuple(tsid, consumer, cfg,

                                          weak_runner_.task_runner()))

           .first->second;

  tracing_session->trace_uuid = uuid;

  if (trace_filter)

    tracing_session->trace_filter = std::move(trace_filter);

  if (cfg.write_into_file()) {

    if (!fd ^ !cfg.output_path().empty()) {

      MaybeLogUploadEvent(

          tracing_session->config, uuid,

          PerfettoStatsdAtom::kTracedEnableTracingInvalidFdOutputFile);

      tracing_sessions_.erase(tsid);

      return PERFETTO_SVC_ERR(

          "When write_into_file==true either a FD needs to be passed or "

          "output_path must be populated (but not both)");