binder.c revision 217218f002a669905701cc0baa18a8d6ba1d5e21
1/* binder.c 2 * 3 * Android IPC Subsystem 4 * 5 * Copyright (C) 2007-2008 Google, Inc. 6 * 7 * This software is licensed under the terms of the GNU General Public 8 * License version 2, as published by the Free Software Foundation, and 9 * may be copied, distributed, and modified under those terms. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 */ 17 18#include <asm/cacheflush.h> 19#include <linux/fdtable.h> 20#include <linux/file.h> 21#include <linux/fs.h> 22#include <linux/list.h> 23#include <linux/miscdevice.h> 24#include <linux/mm.h> 25#include <linux/module.h> 26#include <linux/mutex.h> 27#include <linux/nsproxy.h> 28#include <linux/poll.h> 29#include <linux/debugfs.h> 30#include <linux/rbtree.h> 31#include <linux/sched.h> 32#include <linux/seq_file.h> 33#include <linux/uaccess.h> 34#include <linux/vmalloc.h> 35#include <linux/slab.h> 36 37#include "binder.h" 38 39static DEFINE_MUTEX(binder_lock); 40static DEFINE_MUTEX(binder_deferred_lock); 41 42static HLIST_HEAD(binder_procs); 43static HLIST_HEAD(binder_deferred_list); 44static HLIST_HEAD(binder_dead_nodes); 45 46static struct dentry *binder_debugfs_dir_entry_root; 47static struct dentry *binder_debugfs_dir_entry_proc; 48static struct binder_node *binder_context_mgr_node; 49static uid_t binder_context_mgr_uid = -1; 50static int binder_last_id; 51static struct workqueue_struct *binder_deferred_workqueue; 52 53#define BINDER_DEBUG_ENTRY(name) \ 54static int binder_##name##_open(struct inode *inode, struct file *file) \ 55{ \ 56 return single_open(file, binder_##name##_show, inode->i_private); \ 57} \ 58\ 59static const struct file_operations binder_##name##_fops = { \ 60 .owner = THIS_MODULE, \ 61 .open = binder_##name##_open, \ 62 .read = seq_read, \ 63 .llseek = seq_lseek, \ 64 .release = single_release, \ 65} 66 67static int binder_proc_show(struct seq_file *m, void *unused); 68BINDER_DEBUG_ENTRY(proc); 69 70/* This is only defined in include/asm-arm/sizes.h */ 71#ifndef SZ_1K 72#define SZ_1K 0x400 73#endif 74 75#ifndef SZ_4M 76#define SZ_4M 0x400000 77#endif 78 79#define FORBIDDEN_MMAP_FLAGS (VM_WRITE) 80 81#define BINDER_SMALL_BUF_SIZE (PAGE_SIZE * 64) 82 83enum { 84 BINDER_DEBUG_USER_ERROR = 1U << 0, 85 BINDER_DEBUG_FAILED_TRANSACTION = 1U << 1, 86 BINDER_DEBUG_DEAD_TRANSACTION = 1U << 2, 87 BINDER_DEBUG_OPEN_CLOSE = 1U << 3, 88 BINDER_DEBUG_DEAD_BINDER = 1U << 4, 89 BINDER_DEBUG_DEATH_NOTIFICATION = 1U << 5, 90 BINDER_DEBUG_READ_WRITE = 1U << 6, 91 BINDER_DEBUG_USER_REFS = 1U << 7, 92 BINDER_DEBUG_THREADS = 1U << 8, 93 BINDER_DEBUG_TRANSACTION = 1U << 9, 94 BINDER_DEBUG_TRANSACTION_COMPLETE = 1U << 10, 95 BINDER_DEBUG_FREE_BUFFER = 1U << 11, 96 BINDER_DEBUG_INTERNAL_REFS = 1U << 12, 97 BINDER_DEBUG_BUFFER_ALLOC = 1U << 13, 98 BINDER_DEBUG_PRIORITY_CAP = 1U << 14, 99 BINDER_DEBUG_BUFFER_ALLOC_ASYNC = 1U << 15, 100}; 101static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR | 102 BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION; 103module_param_named(debug_mask, binder_debug_mask, uint, S_IWUSR | S_IRUGO); 104 105static int binder_debug_no_lock; 106module_param_named(proc_no_lock, binder_debug_no_lock, bool, S_IWUSR | S_IRUGO); 107 108static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait); 109static int binder_stop_on_user_error; 110 111static int binder_set_stop_on_user_error(const char *val, 112 struct kernel_param *kp) 113{ 114 int ret; 115 ret = param_set_int(val, kp); 116 if (binder_stop_on_user_error < 2) 117 wake_up(&binder_user_error_wait); 118 return ret; 119} 120module_param_call(stop_on_user_error, binder_set_stop_on_user_error, 121 param_get_int, &binder_stop_on_user_error, S_IWUSR | S_IRUGO); 122 123#define binder_debug(mask, x...) \ 124 do { \ 125 if (binder_debug_mask & mask) \ 126 printk(KERN_INFO x); \ 127 } while (0) 128 129#define binder_user_error(x...) \ 130 do { \ 131 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \ 132 printk(KERN_INFO x); \ 133 if (binder_stop_on_user_error) \ 134 binder_stop_on_user_error = 2; \ 135 } while (0) 136 137enum binder_stat_types { 138 BINDER_STAT_PROC, 139 BINDER_STAT_THREAD, 140 BINDER_STAT_NODE, 141 BINDER_STAT_REF, 142 BINDER_STAT_DEATH, 143 BINDER_STAT_TRANSACTION, 144 BINDER_STAT_TRANSACTION_COMPLETE, 145 BINDER_STAT_COUNT 146}; 147 148struct binder_stats { 149 int br[_IOC_NR(BR_FAILED_REPLY) + 1]; 150 int bc[_IOC_NR(BC_DEAD_BINDER_DONE) + 1]; 151 int obj_created[BINDER_STAT_COUNT]; 152 int obj_deleted[BINDER_STAT_COUNT]; 153}; 154 155static struct binder_stats binder_stats; 156 157static inline void binder_stats_deleted(enum binder_stat_types type) 158{ 159 binder_stats.obj_deleted[type]++; 160} 161 162static inline void binder_stats_created(enum binder_stat_types type) 163{ 164 binder_stats.obj_created[type]++; 165} 166 167struct binder_transaction_log_entry { 168 int debug_id; 169 int call_type; 170 int from_proc; 171 int from_thread; 172 int target_handle; 173 int to_proc; 174 int to_thread; 175 int to_node; 176 int data_size; 177 int offsets_size; 178}; 179struct binder_transaction_log { 180 int next; 181 int full; 182 struct binder_transaction_log_entry entry[32]; 183}; 184static struct binder_transaction_log binder_transaction_log; 185static struct binder_transaction_log binder_transaction_log_failed; 186 187static struct binder_transaction_log_entry *binder_transaction_log_add( 188 struct binder_transaction_log *log) 189{ 190 struct binder_transaction_log_entry *e; 191 e = &log->entry[log->next]; 192 memset(e, 0, sizeof(*e)); 193 log->next++; 194 if (log->next == ARRAY_SIZE(log->entry)) { 195 log->next = 0; 196 log->full = 1; 197 } 198 return e; 199} 200 201struct binder_work { 202 struct list_head entry; 203 enum { 204 BINDER_WORK_TRANSACTION = 1, 205 BINDER_WORK_TRANSACTION_COMPLETE, 206 BINDER_WORK_NODE, 207 BINDER_WORK_DEAD_BINDER, 208 BINDER_WORK_DEAD_BINDER_AND_CLEAR, 209 BINDER_WORK_CLEAR_DEATH_NOTIFICATION, 210 } type; 211}; 212 213struct binder_node { 214 int debug_id; 215 struct binder_work work; 216 union { 217 struct rb_node rb_node; 218 struct hlist_node dead_node; 219 }; 220 struct binder_proc *proc; 221 struct hlist_head refs; 222 int internal_strong_refs; 223 int local_weak_refs; 224 int local_strong_refs; 225 void __user *ptr; 226 void __user *cookie; 227 unsigned has_strong_ref:1; 228 unsigned pending_strong_ref:1; 229 unsigned has_weak_ref:1; 230 unsigned pending_weak_ref:1; 231 unsigned has_async_transaction:1; 232 unsigned accept_fds:1; 233 unsigned min_priority:8; 234 struct list_head async_todo; 235}; 236 237struct binder_ref_death { 238 struct binder_work work; 239 void __user *cookie; 240}; 241 242struct binder_ref { 243 /* Lookups needed: */ 244 /* node + proc => ref (transaction) */ 245 /* desc + proc => ref (transaction, inc/dec ref) */ 246 /* node => refs + procs (proc exit) */ 247 int debug_id; 248 struct rb_node rb_node_desc; 249 struct rb_node rb_node_node; 250 struct hlist_node node_entry; 251 struct binder_proc *proc; 252 struct binder_node *node; 253 uint32_t desc; 254 int strong; 255 int weak; 256 struct binder_ref_death *death; 257}; 258 259struct binder_buffer { 260 struct list_head entry; /* free and allocated entries by address */ 261 struct rb_node rb_node; /* free entry by size or allocated entry */ 262 /* by address */ 263 unsigned free:1; 264 unsigned allow_user_free:1; 265 unsigned async_transaction:1; 266 unsigned debug_id:29; 267 268 struct binder_transaction *transaction; 269 270 struct binder_node *target_node; 271 size_t data_size; 272 size_t offsets_size; 273 uint8_t data[0]; 274}; 275 276enum binder_deferred_state { 277 BINDER_DEFERRED_PUT_FILES = 0x01, 278 BINDER_DEFERRED_FLUSH = 0x02, 279 BINDER_DEFERRED_RELEASE = 0x04, 280}; 281 282struct binder_proc { 283 struct hlist_node proc_node; 284 struct rb_root threads; 285 struct rb_root nodes; 286 struct rb_root refs_by_desc; 287 struct rb_root refs_by_node; 288 int pid; 289 struct vm_area_struct *vma; 290 struct task_struct *tsk; 291 struct files_struct *files; 292 struct hlist_node deferred_work_node; 293 int deferred_work; 294 void *buffer; 295 ptrdiff_t user_buffer_offset; 296 297 struct list_head buffers; 298 struct rb_root free_buffers; 299 struct rb_root allocated_buffers; 300 size_t free_async_space; 301 302 struct page **pages; 303 size_t buffer_size; 304 uint32_t buffer_free; 305 struct list_head todo; 306 wait_queue_head_t wait; 307 struct binder_stats stats; 308 struct list_head delivered_death; 309 int max_threads; 310 int requested_threads; 311 int requested_threads_started; 312 int ready_threads; 313 long default_priority; 314 struct dentry *debugfs_entry; 315}; 316 317enum { 318 BINDER_LOOPER_STATE_REGISTERED = 0x01, 319 BINDER_LOOPER_STATE_ENTERED = 0x02, 320 BINDER_LOOPER_STATE_EXITED = 0x04, 321 BINDER_LOOPER_STATE_INVALID = 0x08, 322 BINDER_LOOPER_STATE_WAITING = 0x10, 323 BINDER_LOOPER_STATE_NEED_RETURN = 0x20 324}; 325 326struct binder_thread { 327 struct binder_proc *proc; 328 struct rb_node rb_node; 329 int pid; 330 int looper; 331 struct binder_transaction *transaction_stack; 332 struct list_head todo; 333 uint32_t return_error; /* Write failed, return error code in read buf */ 334 uint32_t return_error2; /* Write failed, return error code in read */ 335 /* buffer. Used when sending a reply to a dead process that */ 336 /* we are also waiting on */ 337 wait_queue_head_t wait; 338 struct binder_stats stats; 339}; 340 341struct binder_transaction { 342 int debug_id; 343 struct binder_work work; 344 struct binder_thread *from; 345 struct binder_transaction *from_parent; 346 struct binder_proc *to_proc; 347 struct binder_thread *to_thread; 348 struct binder_transaction *to_parent; 349 unsigned need_reply:1; 350 /* unsigned is_dead:1; */ /* not used at the moment */ 351 352 struct binder_buffer *buffer; 353 unsigned int code; 354 unsigned int flags; 355 long priority; 356 long saved_priority; 357 uid_t sender_euid; 358}; 359 360static void 361binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer); 362 363/* 364 * copied from get_unused_fd_flags 365 */ 366int task_get_unused_fd_flags(struct binder_proc *proc, int flags) 367{ 368 struct files_struct *files = proc->files; 369 int fd, error; 370 struct fdtable *fdt; 371 unsigned long rlim_cur; 372 unsigned long irqs; 373 374 if (files == NULL) 375 return -ESRCH; 376 377 error = -EMFILE; 378 spin_lock(&files->file_lock); 379 380repeat: 381 fdt = files_fdtable(files); 382 fd = find_next_zero_bit(fdt->open_fds->fds_bits, fdt->max_fds, 383 files->next_fd); 384 385 /* 386 * N.B. For clone tasks sharing a files structure, this test 387 * will limit the total number of files that can be opened. 388 */ 389 rlim_cur = 0; 390 if (lock_task_sighand(proc->tsk, &irqs)) { 391 rlim_cur = proc->tsk->signal->rlim[RLIMIT_NOFILE].rlim_cur; 392 unlock_task_sighand(proc->tsk, &irqs); 393 } 394 if (fd >= rlim_cur) 395 goto out; 396 397 /* Do we need to expand the fd array or fd set? */ 398 error = expand_files(files, fd); 399 if (error < 0) 400 goto out; 401 402 if (error) { 403 /* 404 * If we needed to expand the fs array we 405 * might have blocked - try again. 406 */ 407 error = -EMFILE; 408 goto repeat; 409 } 410 411 FD_SET(fd, fdt->open_fds); 412 if (flags & O_CLOEXEC) 413 FD_SET(fd, fdt->close_on_exec); 414 else 415 FD_CLR(fd, fdt->close_on_exec); 416 files->next_fd = fd + 1; 417#if 1 418 /* Sanity check */ 419 if (fdt->fd[fd] != NULL) { 420 printk(KERN_WARNING "get_unused_fd: slot %d not NULL!\n", fd); 421 fdt->fd[fd] = NULL; 422 } 423#endif 424 error = fd; 425 426out: 427 spin_unlock(&files->file_lock); 428 return error; 429} 430 431/* 432 * copied from fd_install 433 */ 434static void task_fd_install( 435 struct binder_proc *proc, unsigned int fd, struct file *file) 436{ 437 struct files_struct *files = proc->files; 438 struct fdtable *fdt; 439 440 if (files == NULL) 441 return; 442 443 spin_lock(&files->file_lock); 444 fdt = files_fdtable(files); 445 BUG_ON(fdt->fd[fd] != NULL); 446 rcu_assign_pointer(fdt->fd[fd], file); 447 spin_unlock(&files->file_lock); 448} 449 450/* 451 * copied from __put_unused_fd in open.c 452 */ 453static void __put_unused_fd(struct files_struct *files, unsigned int fd) 454{ 455 struct fdtable *fdt = files_fdtable(files); 456 __FD_CLR(fd, fdt->open_fds); 457 if (fd < files->next_fd) 458 files->next_fd = fd; 459} 460 461/* 462 * copied from sys_close 463 */ 464static long task_close_fd(struct binder_proc *proc, unsigned int fd) 465{ 466 struct file *filp; 467 struct files_struct *files = proc->files; 468 struct fdtable *fdt; 469 int retval; 470 471 if (files == NULL) 472 return -ESRCH; 473 474 spin_lock(&files->file_lock); 475 fdt = files_fdtable(files); 476 if (fd >= fdt->max_fds) 477 goto out_unlock; 478 filp = fdt->fd[fd]; 479 if (!filp) 480 goto out_unlock; 481 rcu_assign_pointer(fdt->fd[fd], NULL); 482 FD_CLR(fd, fdt->close_on_exec); 483 __put_unused_fd(files, fd); 484 spin_unlock(&files->file_lock); 485 retval = filp_close(filp, files); 486 487 /* can't restart close syscall because file table entry was cleared */ 488 if (unlikely(retval == -ERESTARTSYS || 489 retval == -ERESTARTNOINTR || 490 retval == -ERESTARTNOHAND || 491 retval == -ERESTART_RESTARTBLOCK)) 492 retval = -EINTR; 493 494 return retval; 495 496out_unlock: 497 spin_unlock(&files->file_lock); 498 return -EBADF; 499} 500 501static void binder_set_nice(long nice) 502{ 503 long min_nice; 504 if (can_nice(current, nice)) { 505 set_user_nice(current, nice); 506 return; 507 } 508 min_nice = 20 - current->signal->rlim[RLIMIT_NICE].rlim_cur; 509 binder_debug(BINDER_DEBUG_PRIORITY_CAP, 510 "binder: %d: nice value %ld not allowed use " 511 "%ld instead\n", current->pid, nice, min_nice); 512 set_user_nice(current, min_nice); 513 if (min_nice < 20) 514 return; 515 binder_user_error("binder: %d RLIMIT_NICE not set\n", current->pid); 516} 517 518static size_t binder_buffer_size(struct binder_proc *proc, 519 struct binder_buffer *buffer) 520{ 521 if (list_is_last(&buffer->entry, &proc->buffers)) 522 return proc->buffer + proc->buffer_size - (void *)buffer->data; 523 else 524 return (size_t)list_entry(buffer->entry.next, 525 struct binder_buffer, entry) - (size_t)buffer->data; 526} 527 528static void binder_insert_free_buffer(struct binder_proc *proc, 529 struct binder_buffer *new_buffer) 530{ 531 struct rb_node **p = &proc->free_buffers.rb_node; 532 struct rb_node *parent = NULL; 533 struct binder_buffer *buffer; 534 size_t buffer_size; 535 size_t new_buffer_size; 536 537 BUG_ON(!new_buffer->free); 538 539 new_buffer_size = binder_buffer_size(proc, new_buffer); 540 541 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 542 "binder: %d: add free buffer, size %zd, " 543 "at %p\n", proc->pid, new_buffer_size, new_buffer); 544 545 while (*p) { 546 parent = *p; 547 buffer = rb_entry(parent, struct binder_buffer, rb_node); 548 BUG_ON(!buffer->free); 549 550 buffer_size = binder_buffer_size(proc, buffer); 551 552 if (new_buffer_size < buffer_size) 553 p = &parent->rb_left; 554 else 555 p = &parent->rb_right; 556 } 557 rb_link_node(&new_buffer->rb_node, parent, p); 558 rb_insert_color(&new_buffer->rb_node, &proc->free_buffers); 559} 560 561static void binder_insert_allocated_buffer(struct binder_proc *proc, 562 struct binder_buffer *new_buffer) 563{ 564 struct rb_node **p = &proc->allocated_buffers.rb_node; 565 struct rb_node *parent = NULL; 566 struct binder_buffer *buffer; 567 568 BUG_ON(new_buffer->free); 569 570 while (*p) { 571 parent = *p; 572 buffer = rb_entry(parent, struct binder_buffer, rb_node); 573 BUG_ON(buffer->free); 574 575 if (new_buffer < buffer) 576 p = &parent->rb_left; 577 else if (new_buffer > buffer) 578 p = &parent->rb_right; 579 else 580 BUG(); 581 } 582 rb_link_node(&new_buffer->rb_node, parent, p); 583 rb_insert_color(&new_buffer->rb_node, &proc->allocated_buffers); 584} 585 586static struct binder_buffer *binder_buffer_lookup(struct binder_proc *proc, 587 void __user *user_ptr) 588{ 589 struct rb_node *n = proc->allocated_buffers.rb_node; 590 struct binder_buffer *buffer; 591 struct binder_buffer *kern_ptr; 592 593 kern_ptr = user_ptr - proc->user_buffer_offset 594 - offsetof(struct binder_buffer, data); 595 596 while (n) { 597 buffer = rb_entry(n, struct binder_buffer, rb_node); 598 BUG_ON(buffer->free); 599 600 if (kern_ptr < buffer) 601 n = n->rb_left; 602 else if (kern_ptr > buffer) 603 n = n->rb_right; 604 else 605 return buffer; 606 } 607 return NULL; 608} 609 610static int binder_update_page_range(struct binder_proc *proc, int allocate, 611 void *start, void *end, 612 struct vm_area_struct *vma) 613{ 614 void *page_addr; 615 unsigned long user_page_addr; 616 struct vm_struct tmp_area; 617 struct page **page; 618 struct mm_struct *mm; 619 620 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 621 "binder: %d: %s pages %p-%p\n", proc->pid, 622 allocate ? "allocate" : "free", start, end); 623 624 if (end <= start) 625 return 0; 626 627 if (vma) 628 mm = NULL; 629 else 630 mm = get_task_mm(proc->tsk); 631 632 if (mm) { 633 down_write(&mm->mmap_sem); 634 vma = proc->vma; 635 } 636 637 if (allocate == 0) 638 goto free_range; 639 640 if (vma == NULL) { 641 printk(KERN_ERR "binder: %d: binder_alloc_buf failed to " 642 "map pages in userspace, no vma\n", proc->pid); 643 goto err_no_vma; 644 } 645 646 for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) { 647 int ret; 648 struct page **page_array_ptr; 649 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 650 651 BUG_ON(*page); 652 *page = alloc_page(GFP_KERNEL | __GFP_ZERO); 653 if (*page == NULL) { 654 printk(KERN_ERR "binder: %d: binder_alloc_buf failed " 655 "for page at %p\n", proc->pid, page_addr); 656 goto err_alloc_page_failed; 657 } 658 tmp_area.addr = page_addr; 659 tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */; 660 page_array_ptr = page; 661 ret = map_vm_area(&tmp_area, PAGE_KERNEL, &page_array_ptr); 662 if (ret) { 663 printk(KERN_ERR "binder: %d: binder_alloc_buf failed " 664 "to map page at %p in kernel\n", 665 proc->pid, page_addr); 666 goto err_map_kernel_failed; 667 } 668 user_page_addr = 669 (uintptr_t)page_addr + proc->user_buffer_offset; 670 ret = vm_insert_page(vma, user_page_addr, page[0]); 671 if (ret) { 672 printk(KERN_ERR "binder: %d: binder_alloc_buf failed " 673 "to map page at %lx in userspace\n", 674 proc->pid, user_page_addr); 675 goto err_vm_insert_page_failed; 676 } 677 /* vm_insert_page does not seem to increment the refcount */ 678 } 679 if (mm) { 680 up_write(&mm->mmap_sem); 681 mmput(mm); 682 } 683 return 0; 684 685free_range: 686 for (page_addr = end - PAGE_SIZE; page_addr >= start; 687 page_addr -= PAGE_SIZE) { 688 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 689 if (vma) 690 zap_page_range(vma, (uintptr_t)page_addr + 691 proc->user_buffer_offset, PAGE_SIZE, NULL); 692err_vm_insert_page_failed: 693 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE); 694err_map_kernel_failed: 695 __free_page(*page); 696 *page = NULL; 697err_alloc_page_failed: 698 ; 699 } 700err_no_vma: 701 if (mm) { 702 up_write(&mm->mmap_sem); 703 mmput(mm); 704 } 705 return -ENOMEM; 706} 707 708static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc, 709 size_t data_size, 710 size_t offsets_size, int is_async) 711{ 712 struct rb_node *n = proc->free_buffers.rb_node; 713 struct binder_buffer *buffer; 714 size_t buffer_size; 715 struct rb_node *best_fit = NULL; 716 void *has_page_addr; 717 void *end_page_addr; 718 size_t size; 719 720 if (proc->vma == NULL) { 721 printk(KERN_ERR "binder: %d: binder_alloc_buf, no vma\n", 722 proc->pid); 723 return NULL; 724 } 725 726 size = ALIGN(data_size, sizeof(void *)) + 727 ALIGN(offsets_size, sizeof(void *)); 728 729 if (size < data_size || size < offsets_size) { 730 binder_user_error("binder: %d: got transaction with invalid " 731 "size %zd-%zd\n", proc->pid, data_size, offsets_size); 732 return NULL; 733 } 734 735 if (is_async && 736 proc->free_async_space < size + sizeof(struct binder_buffer)) { 737 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 738 "binder: %d: binder_alloc_buf size %zd" 739 "failed, no async space left\n", proc->pid, size); 740 return NULL; 741 } 742 743 while (n) { 744 buffer = rb_entry(n, struct binder_buffer, rb_node); 745 BUG_ON(!buffer->free); 746 buffer_size = binder_buffer_size(proc, buffer); 747 748 if (size < buffer_size) { 749 best_fit = n; 750 n = n->rb_left; 751 } else if (size > buffer_size) 752 n = n->rb_right; 753 else { 754 best_fit = n; 755 break; 756 } 757 } 758 if (best_fit == NULL) { 759 printk(KERN_ERR "binder: %d: binder_alloc_buf size %zd failed, " 760 "no address space\n", proc->pid, size); 761 return NULL; 762 } 763 if (n == NULL) { 764 buffer = rb_entry(best_fit, struct binder_buffer, rb_node); 765 buffer_size = binder_buffer_size(proc, buffer); 766 } 767 768 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 769 "binder: %d: binder_alloc_buf size %zd got buff" 770 "er %p size %zd\n", proc->pid, size, buffer, buffer_size); 771 772 has_page_addr = 773 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK); 774 if (n == NULL) { 775 if (size + sizeof(struct binder_buffer) + 4 >= buffer_size) 776 buffer_size = size; /* no room for other buffers */ 777 else 778 buffer_size = size + sizeof(struct binder_buffer); 779 } 780 end_page_addr = 781 (void *)PAGE_ALIGN((uintptr_t)buffer->data + buffer_size); 782 if (end_page_addr > has_page_addr) 783 end_page_addr = has_page_addr; 784 if (binder_update_page_range(proc, 1, 785 (void *)PAGE_ALIGN((uintptr_t)buffer->data), end_page_addr, NULL)) 786 return NULL; 787 788 rb_erase(best_fit, &proc->free_buffers); 789 buffer->free = 0; 790 binder_insert_allocated_buffer(proc, buffer); 791 if (buffer_size != size) { 792 struct binder_buffer *new_buffer = (void *)buffer->data + size; 793 list_add(&new_buffer->entry, &buffer->entry); 794 new_buffer->free = 1; 795 binder_insert_free_buffer(proc, new_buffer); 796 } 797 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 798 "binder: %d: binder_alloc_buf size %zd got " 799 "%p\n", proc->pid, size, buffer); 800 buffer->data_size = data_size; 801 buffer->offsets_size = offsets_size; 802 buffer->async_transaction = is_async; 803 if (is_async) { 804 proc->free_async_space -= size + sizeof(struct binder_buffer); 805 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 806 "binder: %d: binder_alloc_buf size %zd " 807 "async free %zd\n", proc->pid, size, 808 proc->free_async_space); 809 } 810 811 return buffer; 812} 813 814static void *buffer_start_page(struct binder_buffer *buffer) 815{ 816 return (void *)((uintptr_t)buffer & PAGE_MASK); 817} 818 819static void *buffer_end_page(struct binder_buffer *buffer) 820{ 821 return (void *)(((uintptr_t)(buffer + 1) - 1) & PAGE_MASK); 822} 823 824static void binder_delete_free_buffer(struct binder_proc *proc, 825 struct binder_buffer *buffer) 826{ 827 struct binder_buffer *prev, *next = NULL; 828 int free_page_end = 1; 829 int free_page_start = 1; 830 831 BUG_ON(proc->buffers.next == &buffer->entry); 832 prev = list_entry(buffer->entry.prev, struct binder_buffer, entry); 833 BUG_ON(!prev->free); 834 if (buffer_end_page(prev) == buffer_start_page(buffer)) { 835 free_page_start = 0; 836 if (buffer_end_page(prev) == buffer_end_page(buffer)) 837 free_page_end = 0; 838 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 839 "binder: %d: merge free, buffer %p " 840 "share page with %p\n", proc->pid, buffer, prev); 841 } 842 843 if (!list_is_last(&buffer->entry, &proc->buffers)) { 844 next = list_entry(buffer->entry.next, 845 struct binder_buffer, entry); 846 if (buffer_start_page(next) == buffer_end_page(buffer)) { 847 free_page_end = 0; 848 if (buffer_start_page(next) == 849 buffer_start_page(buffer)) 850 free_page_start = 0; 851 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 852 "binder: %d: merge free, buffer" 853 " %p share page with %p\n", proc->pid, 854 buffer, prev); 855 } 856 } 857 list_del(&buffer->entry); 858 if (free_page_start || free_page_end) { 859 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 860 "binder: %d: merge free, buffer %p do " 861 "not share page%s%s with with %p or %p\n", 862 proc->pid, buffer, free_page_start ? "" : " end", 863 free_page_end ? "" : " start", prev, next); 864 binder_update_page_range(proc, 0, free_page_start ? 865 buffer_start_page(buffer) : buffer_end_page(buffer), 866 (free_page_end ? buffer_end_page(buffer) : 867 buffer_start_page(buffer)) + PAGE_SIZE, NULL); 868 } 869} 870 871static void binder_free_buf(struct binder_proc *proc, 872 struct binder_buffer *buffer) 873{ 874 size_t size, buffer_size; 875 876 buffer_size = binder_buffer_size(proc, buffer); 877 878 size = ALIGN(buffer->data_size, sizeof(void *)) + 879 ALIGN(buffer->offsets_size, sizeof(void *)); 880 881 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 882 "binder: %d: binder_free_buf %p size %zd buffer" 883 "_size %zd\n", proc->pid, buffer, size, buffer_size); 884 885 BUG_ON(buffer->free); 886 BUG_ON(size > buffer_size); 887 BUG_ON(buffer->transaction != NULL); 888 BUG_ON((void *)buffer < proc->buffer); 889 BUG_ON((void *)buffer > proc->buffer + proc->buffer_size); 890 891 if (buffer->async_transaction) { 892 proc->free_async_space += size + sizeof(struct binder_buffer); 893 894 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 895 "binder: %d: binder_free_buf size %zd " 896 "async free %zd\n", proc->pid, size, 897 proc->free_async_space); 898 } 899 900 binder_update_page_range(proc, 0, 901 (void *)PAGE_ALIGN((uintptr_t)buffer->data), 902 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK), 903 NULL); 904 rb_erase(&buffer->rb_node, &proc->allocated_buffers); 905 buffer->free = 1; 906 if (!list_is_last(&buffer->entry, &proc->buffers)) { 907 struct binder_buffer *next = list_entry(buffer->entry.next, 908 struct binder_buffer, entry); 909 if (next->free) { 910 rb_erase(&next->rb_node, &proc->free_buffers); 911 binder_delete_free_buffer(proc, next); 912 } 913 } 914 if (proc->buffers.next != &buffer->entry) { 915 struct binder_buffer *prev = list_entry(buffer->entry.prev, 916 struct binder_buffer, entry); 917 if (prev->free) { 918 binder_delete_free_buffer(proc, buffer); 919 rb_erase(&prev->rb_node, &proc->free_buffers); 920 buffer = prev; 921 } 922 } 923 binder_insert_free_buffer(proc, buffer); 924} 925 926static struct binder_node *binder_get_node(struct binder_proc *proc, 927 void __user *ptr) 928{ 929 struct rb_node *n = proc->nodes.rb_node; 930 struct binder_node *node; 931 932 while (n) { 933 node = rb_entry(n, struct binder_node, rb_node); 934 935 if (ptr < node->ptr) 936 n = n->rb_left; 937 else if (ptr > node->ptr) 938 n = n->rb_right; 939 else 940 return node; 941 } 942 return NULL; 943} 944 945static struct binder_node *binder_new_node(struct binder_proc *proc, 946 void __user *ptr, 947 void __user *cookie) 948{ 949 struct rb_node **p = &proc->nodes.rb_node; 950 struct rb_node *parent = NULL; 951 struct binder_node *node; 952 953 while (*p) { 954 parent = *p; 955 node = rb_entry(parent, struct binder_node, rb_node); 956 957 if (ptr < node->ptr) 958 p = &(*p)->rb_left; 959 else if (ptr > node->ptr) 960 p = &(*p)->rb_right; 961 else 962 return NULL; 963 } 964 965 node = kzalloc(sizeof(*node), GFP_KERNEL); 966 if (node == NULL) 967 return NULL; 968 binder_stats_created(BINDER_STAT_NODE); 969 rb_link_node(&node->rb_node, parent, p); 970 rb_insert_color(&node->rb_node, &proc->nodes); 971 node->debug_id = ++binder_last_id; 972 node->proc = proc; 973 node->ptr = ptr; 974 node->cookie = cookie; 975 node->work.type = BINDER_WORK_NODE; 976 INIT_LIST_HEAD(&node->work.entry); 977 INIT_LIST_HEAD(&node->async_todo); 978 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 979 "binder: %d:%d node %d u%p c%p created\n", 980 proc->pid, current->pid, node->debug_id, 981 node->ptr, node->cookie); 982 return node; 983} 984 985static int binder_inc_node(struct binder_node *node, int strong, int internal, 986 struct list_head *target_list) 987{ 988 if (strong) { 989 if (internal) { 990 if (target_list == NULL && 991 node->internal_strong_refs == 0 && 992 !(node == binder_context_mgr_node && 993 node->has_strong_ref)) { 994 printk(KERN_ERR "binder: invalid inc strong " 995 "node for %d\n", node->debug_id); 996 return -EINVAL; 997 } 998 node->internal_strong_refs++; 999 } else 1000 node->local_strong_refs++; 1001 if (!node->has_strong_ref && target_list) { 1002 list_del_init(&node->work.entry); 1003 list_add_tail(&node->work.entry, target_list); 1004 } 1005 } else { 1006 if (!internal) 1007 node->local_weak_refs++; 1008 if (!node->has_weak_ref && list_empty(&node->work.entry)) { 1009 if (target_list == NULL) { 1010 printk(KERN_ERR "binder: invalid inc weak node " 1011 "for %d\n", node->debug_id); 1012 return -EINVAL; 1013 } 1014 list_add_tail(&node->work.entry, target_list); 1015 } 1016 } 1017 return 0; 1018} 1019 1020static int binder_dec_node(struct binder_node *node, int strong, int internal) 1021{ 1022 if (strong) { 1023 if (internal) 1024 node->internal_strong_refs--; 1025 else 1026 node->local_strong_refs--; 1027 if (node->local_strong_refs || node->internal_strong_refs) 1028 return 0; 1029 } else { 1030 if (!internal) 1031 node->local_weak_refs--; 1032 if (node->local_weak_refs || !hlist_empty(&node->refs)) 1033 return 0; 1034 } 1035 if (node->proc && (node->has_strong_ref || node->has_weak_ref)) { 1036 if (list_empty(&node->work.entry)) { 1037 list_add_tail(&node->work.entry, &node->proc->todo); 1038 wake_up_interruptible(&node->proc->wait); 1039 } 1040 } else { 1041 if (hlist_empty(&node->refs) && !node->local_strong_refs && 1042 !node->local_weak_refs) { 1043 list_del_init(&node->work.entry); 1044 if (node->proc) { 1045 rb_erase(&node->rb_node, &node->proc->nodes); 1046 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1047 "binder: refless node %d deleted\n", 1048 node->debug_id); 1049 } else { 1050 hlist_del(&node->dead_node); 1051 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1052 "binder: dead node %d deleted\n", 1053 node->debug_id); 1054 } 1055 kfree(node); 1056 binder_stats_deleted(BINDER_STAT_NODE); 1057 } 1058 } 1059 1060 return 0; 1061} 1062 1063 1064static struct binder_ref *binder_get_ref(struct binder_proc *proc, 1065 uint32_t desc) 1066{ 1067 struct rb_node *n = proc->refs_by_desc.rb_node; 1068 struct binder_ref *ref; 1069 1070 while (n) { 1071 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1072 1073 if (desc < ref->desc) 1074 n = n->rb_left; 1075 else if (desc > ref->desc) 1076 n = n->rb_right; 1077 else 1078 return ref; 1079 } 1080 return NULL; 1081} 1082 1083static struct binder_ref *binder_get_ref_for_node(struct binder_proc *proc, 1084 struct binder_node *node) 1085{ 1086 struct rb_node *n; 1087 struct rb_node **p = &proc->refs_by_node.rb_node; 1088 struct rb_node *parent = NULL; 1089 struct binder_ref *ref, *new_ref; 1090 1091 while (*p) { 1092 parent = *p; 1093 ref = rb_entry(parent, struct binder_ref, rb_node_node); 1094 1095 if (node < ref->node) 1096 p = &(*p)->rb_left; 1097 else if (node > ref->node) 1098 p = &(*p)->rb_right; 1099 else 1100 return ref; 1101 } 1102 new_ref = kzalloc(sizeof(*ref), GFP_KERNEL); 1103 if (new_ref == NULL) 1104 return NULL; 1105 binder_stats_created(BINDER_STAT_REF); 1106 new_ref->debug_id = ++binder_last_id; 1107 new_ref->proc = proc; 1108 new_ref->node = node; 1109 rb_link_node(&new_ref->rb_node_node, parent, p); 1110 rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node); 1111 1112 new_ref->desc = (node == binder_context_mgr_node) ? 0 : 1; 1113 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 1114 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1115 if (ref->desc > new_ref->desc) 1116 break; 1117 new_ref->desc = ref->desc + 1; 1118 } 1119 1120 p = &proc->refs_by_desc.rb_node; 1121 while (*p) { 1122 parent = *p; 1123 ref = rb_entry(parent, struct binder_ref, rb_node_desc); 1124 1125 if (new_ref->desc < ref->desc) 1126 p = &(*p)->rb_left; 1127 else if (new_ref->desc > ref->desc) 1128 p = &(*p)->rb_right; 1129 else 1130 BUG(); 1131 } 1132 rb_link_node(&new_ref->rb_node_desc, parent, p); 1133 rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc); 1134 if (node) { 1135 hlist_add_head(&new_ref->node_entry, &node->refs); 1136 1137 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1138 "binder: %d new ref %d desc %d for " 1139 "node %d\n", proc->pid, new_ref->debug_id, 1140 new_ref->desc, node->debug_id); 1141 } else { 1142 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1143 "binder: %d new ref %d desc %d for " 1144 "dead node\n", proc->pid, new_ref->debug_id, 1145 new_ref->desc); 1146 } 1147 return new_ref; 1148} 1149 1150static void binder_delete_ref(struct binder_ref *ref) 1151{ 1152 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1153 "binder: %d delete ref %d desc %d for " 1154 "node %d\n", ref->proc->pid, ref->debug_id, 1155 ref->desc, ref->node->debug_id); 1156 1157 rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc); 1158 rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node); 1159 if (ref->strong) 1160 binder_dec_node(ref->node, 1, 1); 1161 hlist_del(&ref->node_entry); 1162 binder_dec_node(ref->node, 0, 1); 1163 if (ref->death) { 1164 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1165 "binder: %d delete ref %d desc %d " 1166 "has death notification\n", ref->proc->pid, 1167 ref->debug_id, ref->desc); 1168 list_del(&ref->death->work.entry); 1169 kfree(ref->death); 1170 binder_stats_deleted(BINDER_STAT_DEATH); 1171 } 1172 kfree(ref); 1173 binder_stats_deleted(BINDER_STAT_REF); 1174} 1175 1176static int binder_inc_ref(struct binder_ref *ref, int strong, 1177 struct list_head *target_list) 1178{ 1179 int ret; 1180 if (strong) { 1181 if (ref->strong == 0) { 1182 ret = binder_inc_node(ref->node, 1, 1, target_list); 1183 if (ret) 1184 return ret; 1185 } 1186 ref->strong++; 1187 } else { 1188 if (ref->weak == 0) { 1189 ret = binder_inc_node(ref->node, 0, 1, target_list); 1190 if (ret) 1191 return ret; 1192 } 1193 ref->weak++; 1194 } 1195 return 0; 1196} 1197 1198 1199static int binder_dec_ref(struct binder_ref *ref, int strong) 1200{ 1201 if (strong) { 1202 if (ref->strong == 0) { 1203 binder_user_error("binder: %d invalid dec strong, " 1204 "ref %d desc %d s %d w %d\n", 1205 ref->proc->pid, ref->debug_id, 1206 ref->desc, ref->strong, ref->weak); 1207 return -EINVAL; 1208 } 1209 ref->strong--; 1210 if (ref->strong == 0) { 1211 int ret; 1212 ret = binder_dec_node(ref->node, strong, 1); 1213 if (ret) 1214 return ret; 1215 } 1216 } else { 1217 if (ref->weak == 0) { 1218 binder_user_error("binder: %d invalid dec weak, " 1219 "ref %d desc %d s %d w %d\n", 1220 ref->proc->pid, ref->debug_id, 1221 ref->desc, ref->strong, ref->weak); 1222 return -EINVAL; 1223 } 1224 ref->weak--; 1225 } 1226 if (ref->strong == 0 && ref->weak == 0) 1227 binder_delete_ref(ref); 1228 return 0; 1229} 1230 1231static void binder_pop_transaction(struct binder_thread *target_thread, 1232 struct binder_transaction *t) 1233{ 1234 if (target_thread) { 1235 BUG_ON(target_thread->transaction_stack != t); 1236 BUG_ON(target_thread->transaction_stack->from != target_thread); 1237 target_thread->transaction_stack = 1238 target_thread->transaction_stack->from_parent; 1239 t->from = NULL; 1240 } 1241 t->need_reply = 0; 1242 if (t->buffer) 1243 t->buffer->transaction = NULL; 1244 kfree(t); 1245 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1246} 1247 1248static void binder_send_failed_reply(struct binder_transaction *t, 1249 uint32_t error_code) 1250{ 1251 struct binder_thread *target_thread; 1252 BUG_ON(t->flags & TF_ONE_WAY); 1253 while (1) { 1254 target_thread = t->from; 1255 if (target_thread) { 1256 if (target_thread->return_error != BR_OK && 1257 target_thread->return_error2 == BR_OK) { 1258 target_thread->return_error2 = 1259 target_thread->return_error; 1260 target_thread->return_error = BR_OK; 1261 } 1262 if (target_thread->return_error == BR_OK) { 1263 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1264 "binder: send failed reply for " 1265 "transaction %d to %d:%d\n", 1266 t->debug_id, target_thread->proc->pid, 1267 target_thread->pid); 1268 1269 binder_pop_transaction(target_thread, t); 1270 target_thread->return_error = error_code; 1271 wake_up_interruptible(&target_thread->wait); 1272 } else { 1273 printk(KERN_ERR "binder: reply failed, target " 1274 "thread, %d:%d, has error code %d " 1275 "already\n", target_thread->proc->pid, 1276 target_thread->pid, 1277 target_thread->return_error); 1278 } 1279 return; 1280 } else { 1281 struct binder_transaction *next = t->from_parent; 1282 1283 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1284 "binder: send failed reply " 1285 "for transaction %d, target dead\n", 1286 t->debug_id); 1287 1288 binder_pop_transaction(target_thread, t); 1289 if (next == NULL) { 1290 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1291 "binder: reply failed," 1292 " no target thread at root\n"); 1293 return; 1294 } 1295 t = next; 1296 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1297 "binder: reply failed, no target " 1298 "thread -- retry %d\n", t->debug_id); 1299 } 1300 } 1301} 1302 1303static void binder_transaction_buffer_release(struct binder_proc *proc, 1304 struct binder_buffer *buffer, 1305 size_t *failed_at) 1306{ 1307 size_t *offp, *off_end; 1308 int debug_id = buffer->debug_id; 1309 1310 binder_debug(BINDER_DEBUG_TRANSACTION, 1311 "binder: %d buffer release %d, size %zd-%zd, failed at %p\n", 1312 proc->pid, buffer->debug_id, 1313 buffer->data_size, buffer->offsets_size, failed_at); 1314 1315 if (buffer->target_node) 1316 binder_dec_node(buffer->target_node, 1, 0); 1317 1318 offp = (size_t *)(buffer->data + ALIGN(buffer->data_size, sizeof(void *))); 1319 if (failed_at) 1320 off_end = failed_at; 1321 else 1322 off_end = (void *)offp + buffer->offsets_size; 1323 for (; offp < off_end; offp++) { 1324 struct flat_binder_object *fp; 1325 if (*offp > buffer->data_size - sizeof(*fp) || 1326 buffer->data_size < sizeof(*fp) || 1327 !IS_ALIGNED(*offp, sizeof(void *))) { 1328 printk(KERN_ERR "binder: transaction release %d bad" 1329 "offset %zd, size %zd\n", debug_id, 1330 *offp, buffer->data_size); 1331 continue; 1332 } 1333 fp = (struct flat_binder_object *)(buffer->data + *offp); 1334 switch (fp->type) { 1335 case BINDER_TYPE_BINDER: 1336 case BINDER_TYPE_WEAK_BINDER: { 1337 struct binder_node *node = binder_get_node(proc, fp->binder); 1338 if (node == NULL) { 1339 printk(KERN_ERR "binder: transaction release %d" 1340 " bad node %p\n", debug_id, fp->binder); 1341 break; 1342 } 1343 binder_debug(BINDER_DEBUG_TRANSACTION, 1344 " node %d u%p\n", 1345 node->debug_id, node->ptr); 1346 binder_dec_node(node, fp->type == BINDER_TYPE_BINDER, 0); 1347 } break; 1348 case BINDER_TYPE_HANDLE: 1349 case BINDER_TYPE_WEAK_HANDLE: { 1350 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1351 if (ref == NULL) { 1352 printk(KERN_ERR "binder: transaction release %d" 1353 " bad handle %ld\n", debug_id, 1354 fp->handle); 1355 break; 1356 } 1357 binder_debug(BINDER_DEBUG_TRANSACTION, 1358 " ref %d desc %d (node %d)\n", 1359 ref->debug_id, ref->desc, ref->node->debug_id); 1360 binder_dec_ref(ref, fp->type == BINDER_TYPE_HANDLE); 1361 } break; 1362 1363 case BINDER_TYPE_FD: 1364 binder_debug(BINDER_DEBUG_TRANSACTION, 1365 " fd %ld\n", fp->handle); 1366 if (failed_at) 1367 task_close_fd(proc, fp->handle); 1368 break; 1369 1370 default: 1371 printk(KERN_ERR "binder: transaction release %d bad " 1372 "object type %lx\n", debug_id, fp->type); 1373 break; 1374 } 1375 } 1376} 1377 1378static void binder_transaction(struct binder_proc *proc, 1379 struct binder_thread *thread, 1380 struct binder_transaction_data *tr, int reply) 1381{ 1382 struct binder_transaction *t; 1383 struct binder_work *tcomplete; 1384 size_t *offp, *off_end; 1385 struct binder_proc *target_proc; 1386 struct binder_thread *target_thread = NULL; 1387 struct binder_node *target_node = NULL; 1388 struct list_head *target_list; 1389 wait_queue_head_t *target_wait; 1390 struct binder_transaction *in_reply_to = NULL; 1391 struct binder_transaction_log_entry *e; 1392 uint32_t return_error; 1393 1394 e = binder_transaction_log_add(&binder_transaction_log); 1395 e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY); 1396 e->from_proc = proc->pid; 1397 e->from_thread = thread->pid; 1398 e->target_handle = tr->target.handle; 1399 e->data_size = tr->data_size; 1400 e->offsets_size = tr->offsets_size; 1401 1402 if (reply) { 1403 in_reply_to = thread->transaction_stack; 1404 if (in_reply_to == NULL) { 1405 binder_user_error("binder: %d:%d got reply transaction " 1406 "with no transaction stack\n", 1407 proc->pid, thread->pid); 1408 return_error = BR_FAILED_REPLY; 1409 goto err_empty_call_stack; 1410 } 1411 binder_set_nice(in_reply_to->saved_priority); 1412 if (in_reply_to->to_thread != thread) { 1413 binder_user_error("binder: %d:%d got reply transaction " 1414 "with bad transaction stack," 1415 " transaction %d has target %d:%d\n", 1416 proc->pid, thread->pid, in_reply_to->debug_id, 1417 in_reply_to->to_proc ? 1418 in_reply_to->to_proc->pid : 0, 1419 in_reply_to->to_thread ? 1420 in_reply_to->to_thread->pid : 0); 1421 return_error = BR_FAILED_REPLY; 1422 in_reply_to = NULL; 1423 goto err_bad_call_stack; 1424 } 1425 thread->transaction_stack = in_reply_to->to_parent; 1426 target_thread = in_reply_to->from; 1427 if (target_thread == NULL) { 1428 return_error = BR_DEAD_REPLY; 1429 goto err_dead_binder; 1430 } 1431 if (target_thread->transaction_stack != in_reply_to) { 1432 binder_user_error("binder: %d:%d got reply transaction " 1433 "with bad target transaction stack %d, " 1434 "expected %d\n", 1435 proc->pid, thread->pid, 1436 target_thread->transaction_stack ? 1437 target_thread->transaction_stack->debug_id : 0, 1438 in_reply_to->debug_id); 1439 return_error = BR_FAILED_REPLY; 1440 in_reply_to = NULL; 1441 target_thread = NULL; 1442 goto err_dead_binder; 1443 } 1444 target_proc = target_thread->proc; 1445 } else { 1446 if (tr->target.handle) { 1447 struct binder_ref *ref; 1448 ref = binder_get_ref(proc, tr->target.handle); 1449 if (ref == NULL) { 1450 binder_user_error("binder: %d:%d got " 1451 "transaction to invalid handle\n", 1452 proc->pid, thread->pid); 1453 return_error = BR_FAILED_REPLY; 1454 goto err_invalid_target_handle; 1455 } 1456 target_node = ref->node; 1457 } else { 1458 target_node = binder_context_mgr_node; 1459 if (target_node == NULL) { 1460 return_error = BR_DEAD_REPLY; 1461 goto err_no_context_mgr_node; 1462 } 1463 } 1464 e->to_node = target_node->debug_id; 1465 target_proc = target_node->proc; 1466 if (target_proc == NULL) { 1467 return_error = BR_DEAD_REPLY; 1468 goto err_dead_binder; 1469 } 1470 if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) { 1471 struct binder_transaction *tmp; 1472 tmp = thread->transaction_stack; 1473 if (tmp->to_thread != thread) { 1474 binder_user_error("binder: %d:%d got new " 1475 "transaction with bad transaction stack" 1476 ", transaction %d has target %d:%d\n", 1477 proc->pid, thread->pid, tmp->debug_id, 1478 tmp->to_proc ? tmp->to_proc->pid : 0, 1479 tmp->to_thread ? 1480 tmp->to_thread->pid : 0); 1481 return_error = BR_FAILED_REPLY; 1482 goto err_bad_call_stack; 1483 } 1484 while (tmp) { 1485 if (tmp->from && tmp->from->proc == target_proc) 1486 target_thread = tmp->from; 1487 tmp = tmp->from_parent; 1488 } 1489 } 1490 } 1491 if (target_thread) { 1492 e->to_thread = target_thread->pid; 1493 target_list = &target_thread->todo; 1494 target_wait = &target_thread->wait; 1495 } else { 1496 target_list = &target_proc->todo; 1497 target_wait = &target_proc->wait; 1498 } 1499 e->to_proc = target_proc->pid; 1500 1501 /* TODO: reuse incoming transaction for reply */ 1502 t = kzalloc(sizeof(*t), GFP_KERNEL); 1503 if (t == NULL) { 1504 return_error = BR_FAILED_REPLY; 1505 goto err_alloc_t_failed; 1506 } 1507 binder_stats_created(BINDER_STAT_TRANSACTION); 1508 1509 tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL); 1510 if (tcomplete == NULL) { 1511 return_error = BR_FAILED_REPLY; 1512 goto err_alloc_tcomplete_failed; 1513 } 1514 binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE); 1515 1516 t->debug_id = ++binder_last_id; 1517 e->debug_id = t->debug_id; 1518 1519 if (reply) 1520 binder_debug(BINDER_DEBUG_TRANSACTION, 1521 "binder: %d:%d BC_REPLY %d -> %d:%d, " 1522 "data %p-%p size %zd-%zd\n", 1523 proc->pid, thread->pid, t->debug_id, 1524 target_proc->pid, target_thread->pid, 1525 tr->data.ptr.buffer, tr->data.ptr.offsets, 1526 tr->data_size, tr->offsets_size); 1527 else 1528 binder_debug(BINDER_DEBUG_TRANSACTION, 1529 "binder: %d:%d BC_TRANSACTION %d -> " 1530 "%d - node %d, data %p-%p size %zd-%zd\n", 1531 proc->pid, thread->pid, t->debug_id, 1532 target_proc->pid, target_node->debug_id, 1533 tr->data.ptr.buffer, tr->data.ptr.offsets, 1534 tr->data_size, tr->offsets_size); 1535 1536 if (!reply && !(tr->flags & TF_ONE_WAY)) 1537 t->from = thread; 1538 else 1539 t->from = NULL; 1540 t->sender_euid = proc->tsk->cred->euid; 1541 t->to_proc = target_proc; 1542 t->to_thread = target_thread; 1543 t->code = tr->code; 1544 t->flags = tr->flags; 1545 t->priority = task_nice(current); 1546 t->buffer = binder_alloc_buf(target_proc, tr->data_size, 1547 tr->offsets_size, !reply && (t->flags & TF_ONE_WAY)); 1548 if (t->buffer == NULL) { 1549 return_error = BR_FAILED_REPLY; 1550 goto err_binder_alloc_buf_failed; 1551 } 1552 t->buffer->allow_user_free = 0; 1553 t->buffer->debug_id = t->debug_id; 1554 t->buffer->transaction = t; 1555 t->buffer->target_node = target_node; 1556 if (target_node) 1557 binder_inc_node(target_node, 1, 0, NULL); 1558 1559 offp = (size_t *)(t->buffer->data + ALIGN(tr->data_size, sizeof(void *))); 1560 1561 if (copy_from_user(t->buffer->data, tr->data.ptr.buffer, tr->data_size)) { 1562 binder_user_error("binder: %d:%d got transaction with invalid " 1563 "data ptr\n", proc->pid, thread->pid); 1564 return_error = BR_FAILED_REPLY; 1565 goto err_copy_data_failed; 1566 } 1567 if (copy_from_user(offp, tr->data.ptr.offsets, tr->offsets_size)) { 1568 binder_user_error("binder: %d:%d got transaction with invalid " 1569 "offsets ptr\n", proc->pid, thread->pid); 1570 return_error = BR_FAILED_REPLY; 1571 goto err_copy_data_failed; 1572 } 1573 if (!IS_ALIGNED(tr->offsets_size, sizeof(size_t))) { 1574 binder_user_error("binder: %d:%d got transaction with " 1575 "invalid offsets size, %zd\n", 1576 proc->pid, thread->pid, tr->offsets_size); 1577 return_error = BR_FAILED_REPLY; 1578 goto err_bad_offset; 1579 } 1580 off_end = (void *)offp + tr->offsets_size; 1581 for (; offp < off_end; offp++) { 1582 struct flat_binder_object *fp; 1583 if (*offp > t->buffer->data_size - sizeof(*fp) || 1584 t->buffer->data_size < sizeof(*fp) || 1585 !IS_ALIGNED(*offp, sizeof(void *))) { 1586 binder_user_error("binder: %d:%d got transaction with " 1587 "invalid offset, %zd\n", 1588 proc->pid, thread->pid, *offp); 1589 return_error = BR_FAILED_REPLY; 1590 goto err_bad_offset; 1591 } 1592 fp = (struct flat_binder_object *)(t->buffer->data + *offp); 1593 switch (fp->type) { 1594 case BINDER_TYPE_BINDER: 1595 case BINDER_TYPE_WEAK_BINDER: { 1596 struct binder_ref *ref; 1597 struct binder_node *node = binder_get_node(proc, fp->binder); 1598 if (node == NULL) { 1599 node = binder_new_node(proc, fp->binder, fp->cookie); 1600 if (node == NULL) { 1601 return_error = BR_FAILED_REPLY; 1602 goto err_binder_new_node_failed; 1603 } 1604 node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK; 1605 node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS); 1606 } 1607 if (fp->cookie != node->cookie) { 1608 binder_user_error("binder: %d:%d sending u%p " 1609 "node %d, cookie mismatch %p != %p\n", 1610 proc->pid, thread->pid, 1611 fp->binder, node->debug_id, 1612 fp->cookie, node->cookie); 1613 goto err_binder_get_ref_for_node_failed; 1614 } 1615 ref = binder_get_ref_for_node(target_proc, node); 1616 if (ref == NULL) { 1617 return_error = BR_FAILED_REPLY; 1618 goto err_binder_get_ref_for_node_failed; 1619 } 1620 if (fp->type == BINDER_TYPE_BINDER) 1621 fp->type = BINDER_TYPE_HANDLE; 1622 else 1623 fp->type = BINDER_TYPE_WEAK_HANDLE; 1624 fp->handle = ref->desc; 1625 binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE, 1626 &thread->todo); 1627 1628 binder_debug(BINDER_DEBUG_TRANSACTION, 1629 " node %d u%p -> ref %d desc %d\n", 1630 node->debug_id, node->ptr, ref->debug_id, 1631 ref->desc); 1632 } break; 1633 case BINDER_TYPE_HANDLE: 1634 case BINDER_TYPE_WEAK_HANDLE: { 1635 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1636 if (ref == NULL) { 1637 binder_user_error("binder: %d:%d got " 1638 "transaction with invalid " 1639 "handle, %ld\n", proc->pid, 1640 thread->pid, fp->handle); 1641 return_error = BR_FAILED_REPLY; 1642 goto err_binder_get_ref_failed; 1643 } 1644 if (ref->node->proc == target_proc) { 1645 if (fp->type == BINDER_TYPE_HANDLE) 1646 fp->type = BINDER_TYPE_BINDER; 1647 else 1648 fp->type = BINDER_TYPE_WEAK_BINDER; 1649 fp->binder = ref->node->ptr; 1650 fp->cookie = ref->node->cookie; 1651 binder_inc_node(ref->node, fp->type == BINDER_TYPE_BINDER, 0, NULL); 1652 binder_debug(BINDER_DEBUG_TRANSACTION, 1653 " ref %d desc %d -> node %d u%p\n", 1654 ref->debug_id, ref->desc, ref->node->debug_id, 1655 ref->node->ptr); 1656 } else { 1657 struct binder_ref *new_ref; 1658 new_ref = binder_get_ref_for_node(target_proc, ref->node); 1659 if (new_ref == NULL) { 1660 return_error = BR_FAILED_REPLY; 1661 goto err_binder_get_ref_for_node_failed; 1662 } 1663 fp->handle = new_ref->desc; 1664 binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL); 1665 binder_debug(BINDER_DEBUG_TRANSACTION, 1666 " ref %d desc %d -> ref %d desc %d (node %d)\n", 1667 ref->debug_id, ref->desc, new_ref->debug_id, 1668 new_ref->desc, ref->node->debug_id); 1669 } 1670 } break; 1671 1672 case BINDER_TYPE_FD: { 1673 int target_fd; 1674 struct file *file; 1675 1676 if (reply) { 1677 if (!(in_reply_to->flags & TF_ACCEPT_FDS)) { 1678 binder_user_error("binder: %d:%d got reply with fd, %ld, but target does not allow fds\n", 1679 proc->pid, thread->pid, fp->handle); 1680 return_error = BR_FAILED_REPLY; 1681 goto err_fd_not_allowed; 1682 } 1683 } else if (!target_node->accept_fds) { 1684 binder_user_error("binder: %d:%d got transaction with fd, %ld, but target does not allow fds\n", 1685 proc->pid, thread->pid, fp->handle); 1686 return_error = BR_FAILED_REPLY; 1687 goto err_fd_not_allowed; 1688 } 1689 1690 file = fget(fp->handle); 1691 if (file == NULL) { 1692 binder_user_error("binder: %d:%d got transaction with invalid fd, %ld\n", 1693 proc->pid, thread->pid, fp->handle); 1694 return_error = BR_FAILED_REPLY; 1695 goto err_fget_failed; 1696 } 1697 target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC); 1698 if (target_fd < 0) { 1699 fput(file); 1700 return_error = BR_FAILED_REPLY; 1701 goto err_get_unused_fd_failed; 1702 } 1703 task_fd_install(target_proc, target_fd, file); 1704 binder_debug(BINDER_DEBUG_TRANSACTION, 1705 " fd %ld -> %d\n", fp->handle, target_fd); 1706 /* TODO: fput? */ 1707 fp->handle = target_fd; 1708 } break; 1709 1710 default: 1711 binder_user_error("binder: %d:%d got transactio" 1712 "n with invalid object type, %lx\n", 1713 proc->pid, thread->pid, fp->type); 1714 return_error = BR_FAILED_REPLY; 1715 goto err_bad_object_type; 1716 } 1717 } 1718 if (reply) { 1719 BUG_ON(t->buffer->async_transaction != 0); 1720 binder_pop_transaction(target_thread, in_reply_to); 1721 } else if (!(t->flags & TF_ONE_WAY)) { 1722 BUG_ON(t->buffer->async_transaction != 0); 1723 t->need_reply = 1; 1724 t->from_parent = thread->transaction_stack; 1725 thread->transaction_stack = t; 1726 } else { 1727 BUG_ON(target_node == NULL); 1728 BUG_ON(t->buffer->async_transaction != 1); 1729 if (target_node->has_async_transaction) { 1730 target_list = &target_node->async_todo; 1731 target_wait = NULL; 1732 } else 1733 target_node->has_async_transaction = 1; 1734 } 1735 t->work.type = BINDER_WORK_TRANSACTION; 1736 list_add_tail(&t->work.entry, target_list); 1737 tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE; 1738 list_add_tail(&tcomplete->entry, &thread->todo); 1739 if (target_wait) 1740 wake_up_interruptible(target_wait); 1741 return; 1742 1743err_get_unused_fd_failed: 1744err_fget_failed: 1745err_fd_not_allowed: 1746err_binder_get_ref_for_node_failed: 1747err_binder_get_ref_failed: 1748err_binder_new_node_failed: 1749err_bad_object_type: 1750err_bad_offset: 1751err_copy_data_failed: 1752 binder_transaction_buffer_release(target_proc, t->buffer, offp); 1753 t->buffer->transaction = NULL; 1754 binder_free_buf(target_proc, t->buffer); 1755err_binder_alloc_buf_failed: 1756 kfree(tcomplete); 1757 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 1758err_alloc_tcomplete_failed: 1759 kfree(t); 1760 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1761err_alloc_t_failed: 1762err_bad_call_stack: 1763err_empty_call_stack: 1764err_dead_binder: 1765err_invalid_target_handle: 1766err_no_context_mgr_node: 1767 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1768 "binder: %d:%d transaction failed %d, size %zd-%zd\n", 1769 proc->pid, thread->pid, return_error, 1770 tr->data_size, tr->offsets_size); 1771 1772 { 1773 struct binder_transaction_log_entry *fe; 1774 fe = binder_transaction_log_add(&binder_transaction_log_failed); 1775 *fe = *e; 1776 } 1777 1778 BUG_ON(thread->return_error != BR_OK); 1779 if (in_reply_to) { 1780 thread->return_error = BR_TRANSACTION_COMPLETE; 1781 binder_send_failed_reply(in_reply_to, return_error); 1782 } else 1783 thread->return_error = return_error; 1784} 1785 1786int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread, 1787 void __user *buffer, int size, signed long *consumed) 1788{ 1789 uint32_t cmd; 1790 void __user *ptr = buffer + *consumed; 1791 void __user *end = buffer + size; 1792 1793 while (ptr < end && thread->return_error == BR_OK) { 1794 if (get_user(cmd, (uint32_t __user *)ptr)) 1795 return -EFAULT; 1796 ptr += sizeof(uint32_t); 1797 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) { 1798 binder_stats.bc[_IOC_NR(cmd)]++; 1799 proc->stats.bc[_IOC_NR(cmd)]++; 1800 thread->stats.bc[_IOC_NR(cmd)]++; 1801 } 1802 switch (cmd) { 1803 case BC_INCREFS: 1804 case BC_ACQUIRE: 1805 case BC_RELEASE: 1806 case BC_DECREFS: { 1807 uint32_t target; 1808 struct binder_ref *ref; 1809 const char *debug_string; 1810 1811 if (get_user(target, (uint32_t __user *)ptr)) 1812 return -EFAULT; 1813 ptr += sizeof(uint32_t); 1814 if (target == 0 && binder_context_mgr_node && 1815 (cmd == BC_INCREFS || cmd == BC_ACQUIRE)) { 1816 ref = binder_get_ref_for_node(proc, 1817 binder_context_mgr_node); 1818 if (ref->desc != target) { 1819 binder_user_error("binder: %d:" 1820 "%d tried to acquire " 1821 "reference to desc 0, " 1822 "got %d instead\n", 1823 proc->pid, thread->pid, 1824 ref->desc); 1825 } 1826 } else 1827 ref = binder_get_ref(proc, target); 1828 if (ref == NULL) { 1829 binder_user_error("binder: %d:%d refcou" 1830 "nt change on invalid ref %d\n", 1831 proc->pid, thread->pid, target); 1832 break; 1833 } 1834 switch (cmd) { 1835 case BC_INCREFS: 1836 debug_string = "IncRefs"; 1837 binder_inc_ref(ref, 0, NULL); 1838 break; 1839 case BC_ACQUIRE: 1840 debug_string = "Acquire"; 1841 binder_inc_ref(ref, 1, NULL); 1842 break; 1843 case BC_RELEASE: 1844 debug_string = "Release"; 1845 binder_dec_ref(ref, 1); 1846 break; 1847 case BC_DECREFS: 1848 default: 1849 debug_string = "DecRefs"; 1850 binder_dec_ref(ref, 0); 1851 break; 1852 } 1853 binder_debug(BINDER_DEBUG_USER_REFS, 1854 "binder: %d:%d %s ref %d desc %d s %d w %d for node %d\n", 1855 proc->pid, thread->pid, debug_string, ref->debug_id, 1856 ref->desc, ref->strong, ref->weak, ref->node->debug_id); 1857 break; 1858 } 1859 case BC_INCREFS_DONE: 1860 case BC_ACQUIRE_DONE: { 1861 void __user *node_ptr; 1862 void *cookie; 1863 struct binder_node *node; 1864 1865 if (get_user(node_ptr, (void * __user *)ptr)) 1866 return -EFAULT; 1867 ptr += sizeof(void *); 1868 if (get_user(cookie, (void * __user *)ptr)) 1869 return -EFAULT; 1870 ptr += sizeof(void *); 1871 node = binder_get_node(proc, node_ptr); 1872 if (node == NULL) { 1873 binder_user_error("binder: %d:%d " 1874 "%s u%p no match\n", 1875 proc->pid, thread->pid, 1876 cmd == BC_INCREFS_DONE ? 1877 "BC_INCREFS_DONE" : 1878 "BC_ACQUIRE_DONE", 1879 node_ptr); 1880 break; 1881 } 1882 if (cookie != node->cookie) { 1883 binder_user_error("binder: %d:%d %s u%p node %d" 1884 " cookie mismatch %p != %p\n", 1885 proc->pid, thread->pid, 1886 cmd == BC_INCREFS_DONE ? 1887 "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1888 node_ptr, node->debug_id, 1889 cookie, node->cookie); 1890 break; 1891 } 1892 if (cmd == BC_ACQUIRE_DONE) { 1893 if (node->pending_strong_ref == 0) { 1894 binder_user_error("binder: %d:%d " 1895 "BC_ACQUIRE_DONE node %d has " 1896 "no pending acquire request\n", 1897 proc->pid, thread->pid, 1898 node->debug_id); 1899 break; 1900 } 1901 node->pending_strong_ref = 0; 1902 } else { 1903 if (node->pending_weak_ref == 0) { 1904 binder_user_error("binder: %d:%d " 1905 "BC_INCREFS_DONE node %d has " 1906 "no pending increfs request\n", 1907 proc->pid, thread->pid, 1908 node->debug_id); 1909 break; 1910 } 1911 node->pending_weak_ref = 0; 1912 } 1913 binder_dec_node(node, cmd == BC_ACQUIRE_DONE, 0); 1914 binder_debug(BINDER_DEBUG_USER_REFS, 1915 "binder: %d:%d %s node %d ls %d lw %d\n", 1916 proc->pid, thread->pid, 1917 cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1918 node->debug_id, node->local_strong_refs, node->local_weak_refs); 1919 break; 1920 } 1921 case BC_ATTEMPT_ACQUIRE: 1922 printk(KERN_ERR "binder: BC_ATTEMPT_ACQUIRE not supported\n"); 1923 return -EINVAL; 1924 case BC_ACQUIRE_RESULT: 1925 printk(KERN_ERR "binder: BC_ACQUIRE_RESULT not supported\n"); 1926 return -EINVAL; 1927 1928 case BC_FREE_BUFFER: { 1929 void __user *data_ptr; 1930 struct binder_buffer *buffer; 1931 1932 if (get_user(data_ptr, (void * __user *)ptr)) 1933 return -EFAULT; 1934 ptr += sizeof(void *); 1935 1936 buffer = binder_buffer_lookup(proc, data_ptr); 1937 if (buffer == NULL) { 1938 binder_user_error("binder: %d:%d " 1939 "BC_FREE_BUFFER u%p no match\n", 1940 proc->pid, thread->pid, data_ptr); 1941 break; 1942 } 1943 if (!buffer->allow_user_free) { 1944 binder_user_error("binder: %d:%d " 1945 "BC_FREE_BUFFER u%p matched " 1946 "unreturned buffer\n", 1947 proc->pid, thread->pid, data_ptr); 1948 break; 1949 } 1950 binder_debug(BINDER_DEBUG_FREE_BUFFER, 1951 "binder: %d:%d BC_FREE_BUFFER u%p found buffer %d for %s transaction\n", 1952 proc->pid, thread->pid, data_ptr, buffer->debug_id, 1953 buffer->transaction ? "active" : "finished"); 1954 1955 if (buffer->transaction) { 1956 buffer->transaction->buffer = NULL; 1957 buffer->transaction = NULL; 1958 } 1959 if (buffer->async_transaction && buffer->target_node) { 1960 BUG_ON(!buffer->target_node->has_async_transaction); 1961 if (list_empty(&buffer->target_node->async_todo)) 1962 buffer->target_node->has_async_transaction = 0; 1963 else 1964 list_move_tail(buffer->target_node->async_todo.next, &thread->todo); 1965 } 1966 binder_transaction_buffer_release(proc, buffer, NULL); 1967 binder_free_buf(proc, buffer); 1968 break; 1969 } 1970 1971 case BC_TRANSACTION: 1972 case BC_REPLY: { 1973 struct binder_transaction_data tr; 1974 1975 if (copy_from_user(&tr, ptr, sizeof(tr))) 1976 return -EFAULT; 1977 ptr += sizeof(tr); 1978 binder_transaction(proc, thread, &tr, cmd == BC_REPLY); 1979 break; 1980 } 1981 1982 case BC_REGISTER_LOOPER: 1983 binder_debug(BINDER_DEBUG_THREADS, 1984 "binder: %d:%d BC_REGISTER_LOOPER\n", 1985 proc->pid, thread->pid); 1986 if (thread->looper & BINDER_LOOPER_STATE_ENTERED) { 1987 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1988 binder_user_error("binder: %d:%d ERROR:" 1989 " BC_REGISTER_LOOPER called " 1990 "after BC_ENTER_LOOPER\n", 1991 proc->pid, thread->pid); 1992 } else if (proc->requested_threads == 0) { 1993 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1994 binder_user_error("binder: %d:%d ERROR:" 1995 " BC_REGISTER_LOOPER called " 1996 "without request\n", 1997 proc->pid, thread->pid); 1998 } else { 1999 proc->requested_threads--; 2000 proc->requested_threads_started++; 2001 } 2002 thread->looper |= BINDER_LOOPER_STATE_REGISTERED; 2003 break; 2004 case BC_ENTER_LOOPER: 2005 binder_debug(BINDER_DEBUG_THREADS, 2006 "binder: %d:%d BC_ENTER_LOOPER\n", 2007 proc->pid, thread->pid); 2008 if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) { 2009 thread->looper |= BINDER_LOOPER_STATE_INVALID; 2010 binder_user_error("binder: %d:%d ERROR:" 2011 " BC_ENTER_LOOPER called after " 2012 "BC_REGISTER_LOOPER\n", 2013 proc->pid, thread->pid); 2014 } 2015 thread->looper |= BINDER_LOOPER_STATE_ENTERED; 2016 break; 2017 case BC_EXIT_LOOPER: 2018 binder_debug(BINDER_DEBUG_THREADS, 2019 "binder: %d:%d BC_EXIT_LOOPER\n", 2020 proc->pid, thread->pid); 2021 thread->looper |= BINDER_LOOPER_STATE_EXITED; 2022 break; 2023 2024 case BC_REQUEST_DEATH_NOTIFICATION: 2025 case BC_CLEAR_DEATH_NOTIFICATION: { 2026 uint32_t target; 2027 void __user *cookie; 2028 struct binder_ref *ref; 2029 struct binder_ref_death *death; 2030 2031 if (get_user(target, (uint32_t __user *)ptr)) 2032 return -EFAULT; 2033 ptr += sizeof(uint32_t); 2034 if (get_user(cookie, (void __user * __user *)ptr)) 2035 return -EFAULT; 2036 ptr += sizeof(void *); 2037 ref = binder_get_ref(proc, target); 2038 if (ref == NULL) { 2039 binder_user_error("binder: %d:%d %s " 2040 "invalid ref %d\n", 2041 proc->pid, thread->pid, 2042 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 2043 "BC_REQUEST_DEATH_NOTIFICATION" : 2044 "BC_CLEAR_DEATH_NOTIFICATION", 2045 target); 2046 break; 2047 } 2048 2049 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 2050 "binder: %d:%d %s %p ref %d desc %d s %d w %d for node %d\n", 2051 proc->pid, thread->pid, 2052 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 2053 "BC_REQUEST_DEATH_NOTIFICATION" : 2054 "BC_CLEAR_DEATH_NOTIFICATION", 2055 cookie, ref->debug_id, ref->desc, 2056 ref->strong, ref->weak, ref->node->debug_id); 2057 2058 if (cmd == BC_REQUEST_DEATH_NOTIFICATION) { 2059 if (ref->death) { 2060 binder_user_error("binder: %d:%" 2061 "d BC_REQUEST_DEATH_NOTI" 2062 "FICATION death notific" 2063 "ation already set\n", 2064 proc->pid, thread->pid); 2065 break; 2066 } 2067 death = kzalloc(sizeof(*death), GFP_KERNEL); 2068 if (death == NULL) { 2069 thread->return_error = BR_ERROR; 2070 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 2071 "binder: %d:%d " 2072 "BC_REQUEST_DEATH_NOTIFICATION failed\n", 2073 proc->pid, thread->pid); 2074 break; 2075 } 2076 binder_stats_created(BINDER_STAT_DEATH); 2077 INIT_LIST_HEAD(&death->work.entry); 2078 death->cookie = cookie; 2079 ref->death = death; 2080 if (ref->node->proc == NULL) { 2081 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 2082 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2083 list_add_tail(&ref->death->work.entry, &thread->todo); 2084 } else { 2085 list_add_tail(&ref->death->work.entry, &proc->todo); 2086 wake_up_interruptible(&proc->wait); 2087 } 2088 } 2089 } else { 2090 if (ref->death == NULL) { 2091 binder_user_error("binder: %d:%" 2092 "d BC_CLEAR_DEATH_NOTIFI" 2093 "CATION death notificat" 2094 "ion not active\n", 2095 proc->pid, thread->pid); 2096 break; 2097 } 2098 death = ref->death; 2099 if (death->cookie != cookie) { 2100 binder_user_error("binder: %d:%" 2101 "d BC_CLEAR_DEATH_NOTIFI" 2102 "CATION death notificat" 2103 "ion cookie mismatch " 2104 "%p != %p\n", 2105 proc->pid, thread->pid, 2106 death->cookie, cookie); 2107 break; 2108 } 2109 ref->death = NULL; 2110 if (list_empty(&death->work.entry)) { 2111 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2112 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2113 list_add_tail(&death->work.entry, &thread->todo); 2114 } else { 2115 list_add_tail(&death->work.entry, &proc->todo); 2116 wake_up_interruptible(&proc->wait); 2117 } 2118 } else { 2119 BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER); 2120 death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR; 2121 } 2122 } 2123 } break; 2124 case BC_DEAD_BINDER_DONE: { 2125 struct binder_work *w; 2126 void __user *cookie; 2127 struct binder_ref_death *death = NULL; 2128 if (get_user(cookie, (void __user * __user *)ptr)) 2129 return -EFAULT; 2130 2131 ptr += sizeof(void *); 2132 list_for_each_entry(w, &proc->delivered_death, entry) { 2133 struct binder_ref_death *tmp_death = container_of(w, struct binder_ref_death, work); 2134 if (tmp_death->cookie == cookie) { 2135 death = tmp_death; 2136 break; 2137 } 2138 } 2139 binder_debug(BINDER_DEBUG_DEAD_BINDER, 2140 "binder: %d:%d BC_DEAD_BINDER_DONE %p found %p\n", 2141 proc->pid, thread->pid, cookie, death); 2142 if (death == NULL) { 2143 binder_user_error("binder: %d:%d BC_DEAD" 2144 "_BINDER_DONE %p not found\n", 2145 proc->pid, thread->pid, cookie); 2146 break; 2147 } 2148 2149 list_del_init(&death->work.entry); 2150 if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) { 2151 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2152 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2153 list_add_tail(&death->work.entry, &thread->todo); 2154 } else { 2155 list_add_tail(&death->work.entry, &proc->todo); 2156 wake_up_interruptible(&proc->wait); 2157 } 2158 } 2159 } break; 2160 2161 default: 2162 printk(KERN_ERR "binder: %d:%d unknown command %d\n", 2163 proc->pid, thread->pid, cmd); 2164 return -EINVAL; 2165 } 2166 *consumed = ptr - buffer; 2167 } 2168 return 0; 2169} 2170 2171void binder_stat_br(struct binder_proc *proc, struct binder_thread *thread, 2172 uint32_t cmd) 2173{ 2174 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) { 2175 binder_stats.br[_IOC_NR(cmd)]++; 2176 proc->stats.br[_IOC_NR(cmd)]++; 2177 thread->stats.br[_IOC_NR(cmd)]++; 2178 } 2179} 2180 2181static int binder_has_proc_work(struct binder_proc *proc, 2182 struct binder_thread *thread) 2183{ 2184 return !list_empty(&proc->todo) || 2185 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2186} 2187 2188static int binder_has_thread_work(struct binder_thread *thread) 2189{ 2190 return !list_empty(&thread->todo) || thread->return_error != BR_OK || 2191 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2192} 2193 2194static int binder_thread_read(struct binder_proc *proc, 2195 struct binder_thread *thread, 2196 void __user *buffer, int size, 2197 signed long *consumed, int non_block) 2198{ 2199 void __user *ptr = buffer + *consumed; 2200 void __user *end = buffer + size; 2201 2202 int ret = 0; 2203 int wait_for_proc_work; 2204 2205 if (*consumed == 0) { 2206 if (put_user(BR_NOOP, (uint32_t __user *)ptr)) 2207 return -EFAULT; 2208 ptr += sizeof(uint32_t); 2209 } 2210 2211retry: 2212 wait_for_proc_work = thread->transaction_stack == NULL && 2213 list_empty(&thread->todo); 2214 2215 if (thread->return_error != BR_OK && ptr < end) { 2216 if (thread->return_error2 != BR_OK) { 2217 if (put_user(thread->return_error2, (uint32_t __user *)ptr)) 2218 return -EFAULT; 2219 ptr += sizeof(uint32_t); 2220 if (ptr == end) 2221 goto done; 2222 thread->return_error2 = BR_OK; 2223 } 2224 if (put_user(thread->return_error, (uint32_t __user *)ptr)) 2225 return -EFAULT; 2226 ptr += sizeof(uint32_t); 2227 thread->return_error = BR_OK; 2228 goto done; 2229 } 2230 2231 2232 thread->looper |= BINDER_LOOPER_STATE_WAITING; 2233 if (wait_for_proc_work) 2234 proc->ready_threads++; 2235 mutex_unlock(&binder_lock); 2236 if (wait_for_proc_work) { 2237 if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2238 BINDER_LOOPER_STATE_ENTERED))) { 2239 binder_user_error("binder: %d:%d ERROR: Thread waiting " 2240 "for process work before calling BC_REGISTER_" 2241 "LOOPER or BC_ENTER_LOOPER (state %x)\n", 2242 proc->pid, thread->pid, thread->looper); 2243 wait_event_interruptible(binder_user_error_wait, 2244 binder_stop_on_user_error < 2); 2245 } 2246 binder_set_nice(proc->default_priority); 2247 if (non_block) { 2248 if (!binder_has_proc_work(proc, thread)) 2249 ret = -EAGAIN; 2250 } else 2251 ret = wait_event_interruptible_exclusive(proc->wait, binder_has_proc_work(proc, thread)); 2252 } else { 2253 if (non_block) { 2254 if (!binder_has_thread_work(thread)) 2255 ret = -EAGAIN; 2256 } else 2257 ret = wait_event_interruptible(thread->wait, binder_has_thread_work(thread)); 2258 } 2259 mutex_lock(&binder_lock); 2260 if (wait_for_proc_work) 2261 proc->ready_threads--; 2262 thread->looper &= ~BINDER_LOOPER_STATE_WAITING; 2263 2264 if (ret) 2265 return ret; 2266 2267 while (1) { 2268 uint32_t cmd; 2269 struct binder_transaction_data tr; 2270 struct binder_work *w; 2271 struct binder_transaction *t = NULL; 2272 2273 if (!list_empty(&thread->todo)) 2274 w = list_first_entry(&thread->todo, struct binder_work, entry); 2275 else if (!list_empty(&proc->todo) && wait_for_proc_work) 2276 w = list_first_entry(&proc->todo, struct binder_work, entry); 2277 else { 2278 if (ptr - buffer == 4 && !(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN)) /* no data added */ 2279 goto retry; 2280 break; 2281 } 2282 2283 if (end - ptr < sizeof(tr) + 4) 2284 break; 2285 2286 switch (w->type) { 2287 case BINDER_WORK_TRANSACTION: { 2288 t = container_of(w, struct binder_transaction, work); 2289 } break; 2290 case BINDER_WORK_TRANSACTION_COMPLETE: { 2291 cmd = BR_TRANSACTION_COMPLETE; 2292 if (put_user(cmd, (uint32_t __user *)ptr)) 2293 return -EFAULT; 2294 ptr += sizeof(uint32_t); 2295 2296 binder_stat_br(proc, thread, cmd); 2297 binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE, 2298 "binder: %d:%d BR_TRANSACTION_COMPLETE\n", 2299 proc->pid, thread->pid); 2300 2301 list_del(&w->entry); 2302 kfree(w); 2303 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2304 } break; 2305 case BINDER_WORK_NODE: { 2306 struct binder_node *node = container_of(w, struct binder_node, work); 2307 uint32_t cmd = BR_NOOP; 2308 const char *cmd_name; 2309 int strong = node->internal_strong_refs || node->local_strong_refs; 2310 int weak = !hlist_empty(&node->refs) || node->local_weak_refs || strong; 2311 if (weak && !node->has_weak_ref) { 2312 cmd = BR_INCREFS; 2313 cmd_name = "BR_INCREFS"; 2314 node->has_weak_ref = 1; 2315 node->pending_weak_ref = 1; 2316 node->local_weak_refs++; 2317 } else if (strong && !node->has_strong_ref) { 2318 cmd = BR_ACQUIRE; 2319 cmd_name = "BR_ACQUIRE"; 2320 node->has_strong_ref = 1; 2321 node->pending_strong_ref = 1; 2322 node->local_strong_refs++; 2323 } else if (!strong && node->has_strong_ref) { 2324 cmd = BR_RELEASE; 2325 cmd_name = "BR_RELEASE"; 2326 node->has_strong_ref = 0; 2327 } else if (!weak && node->has_weak_ref) { 2328 cmd = BR_DECREFS; 2329 cmd_name = "BR_DECREFS"; 2330 node->has_weak_ref = 0; 2331 } 2332 if (cmd != BR_NOOP) { 2333 if (put_user(cmd, (uint32_t __user *)ptr)) 2334 return -EFAULT; 2335 ptr += sizeof(uint32_t); 2336 if (put_user(node->ptr, (void * __user *)ptr)) 2337 return -EFAULT; 2338 ptr += sizeof(void *); 2339 if (put_user(node->cookie, (void * __user *)ptr)) 2340 return -EFAULT; 2341 ptr += sizeof(void *); 2342 2343 binder_stat_br(proc, thread, cmd); 2344 binder_debug(BINDER_DEBUG_USER_REFS, 2345 "binder: %d:%d %s %d u%p c%p\n", 2346 proc->pid, thread->pid, cmd_name, node->debug_id, node->ptr, node->cookie); 2347 } else { 2348 list_del_init(&w->entry); 2349 if (!weak && !strong) { 2350 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2351 "binder: %d:%d node %d u%p c%p deleted\n", 2352 proc->pid, thread->pid, node->debug_id, 2353 node->ptr, node->cookie); 2354 rb_erase(&node->rb_node, &proc->nodes); 2355 kfree(node); 2356 binder_stats_deleted(BINDER_STAT_NODE); 2357 } else { 2358 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2359 "binder: %d:%d node %d u%p c%p state unchanged\n", 2360 proc->pid, thread->pid, node->debug_id, node->ptr, 2361 node->cookie); 2362 } 2363 } 2364 } break; 2365 case BINDER_WORK_DEAD_BINDER: 2366 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 2367 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 2368 struct binder_ref_death *death; 2369 uint32_t cmd; 2370 2371 death = container_of(w, struct binder_ref_death, work); 2372 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) 2373 cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE; 2374 else 2375 cmd = BR_DEAD_BINDER; 2376 if (put_user(cmd, (uint32_t __user *)ptr)) 2377 return -EFAULT; 2378 ptr += sizeof(uint32_t); 2379 if (put_user(death->cookie, (void * __user *)ptr)) 2380 return -EFAULT; 2381 ptr += sizeof(void *); 2382 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 2383 "binder: %d:%d %s %p\n", 2384 proc->pid, thread->pid, 2385 cmd == BR_DEAD_BINDER ? 2386 "BR_DEAD_BINDER" : 2387 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 2388 death->cookie); 2389 2390 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) { 2391 list_del(&w->entry); 2392 kfree(death); 2393 binder_stats_deleted(BINDER_STAT_DEATH); 2394 } else 2395 list_move(&w->entry, &proc->delivered_death); 2396 if (cmd == BR_DEAD_BINDER) 2397 goto done; /* DEAD_BINDER notifications can cause transactions */ 2398 } break; 2399 } 2400 2401 if (!t) 2402 continue; 2403 2404 BUG_ON(t->buffer == NULL); 2405 if (t->buffer->target_node) { 2406 struct binder_node *target_node = t->buffer->target_node; 2407 tr.target.ptr = target_node->ptr; 2408 tr.cookie = target_node->cookie; 2409 t->saved_priority = task_nice(current); 2410 if (t->priority < target_node->min_priority && 2411 !(t->flags & TF_ONE_WAY)) 2412 binder_set_nice(t->priority); 2413 else if (!(t->flags & TF_ONE_WAY) || 2414 t->saved_priority > target_node->min_priority) 2415 binder_set_nice(target_node->min_priority); 2416 cmd = BR_TRANSACTION; 2417 } else { 2418 tr.target.ptr = NULL; 2419 tr.cookie = NULL; 2420 cmd = BR_REPLY; 2421 } 2422 tr.code = t->code; 2423 tr.flags = t->flags; 2424 tr.sender_euid = t->sender_euid; 2425 2426 if (t->from) { 2427 struct task_struct *sender = t->from->proc->tsk; 2428 tr.sender_pid = task_tgid_nr_ns(sender, 2429 current->nsproxy->pid_ns); 2430 } else { 2431 tr.sender_pid = 0; 2432 } 2433 2434 tr.data_size = t->buffer->data_size; 2435 tr.offsets_size = t->buffer->offsets_size; 2436 tr.data.ptr.buffer = (void *)t->buffer->data + 2437 proc->user_buffer_offset; 2438 tr.data.ptr.offsets = tr.data.ptr.buffer + 2439 ALIGN(t->buffer->data_size, 2440 sizeof(void *)); 2441 2442 if (put_user(cmd, (uint32_t __user *)ptr)) 2443 return -EFAULT; 2444 ptr += sizeof(uint32_t); 2445 if (copy_to_user(ptr, &tr, sizeof(tr))) 2446 return -EFAULT; 2447 ptr += sizeof(tr); 2448 2449 binder_stat_br(proc, thread, cmd); 2450 binder_debug(BINDER_DEBUG_TRANSACTION, 2451 "binder: %d:%d %s %d %d:%d, cmd %d" 2452 "size %zd-%zd ptr %p-%p\n", 2453 proc->pid, thread->pid, 2454 (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" : 2455 "BR_REPLY", 2456 t->debug_id, t->from ? t->from->proc->pid : 0, 2457 t->from ? t->from->pid : 0, cmd, 2458 t->buffer->data_size, t->buffer->offsets_size, 2459 tr.data.ptr.buffer, tr.data.ptr.offsets); 2460 2461 list_del(&t->work.entry); 2462 t->buffer->allow_user_free = 1; 2463 if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) { 2464 t->to_parent = thread->transaction_stack; 2465 t->to_thread = thread; 2466 thread->transaction_stack = t; 2467 } else { 2468 t->buffer->transaction = NULL; 2469 kfree(t); 2470 binder_stats_deleted(BINDER_STAT_TRANSACTION); 2471 } 2472 break; 2473 } 2474 2475done: 2476 2477 *consumed = ptr - buffer; 2478 if (proc->requested_threads + proc->ready_threads == 0 && 2479 proc->requested_threads_started < proc->max_threads && 2480 (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2481 BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */ 2482 /*spawn a new thread if we leave this out */) { 2483 proc->requested_threads++; 2484 binder_debug(BINDER_DEBUG_THREADS, 2485 "binder: %d:%d BR_SPAWN_LOOPER\n", 2486 proc->pid, thread->pid); 2487 if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer)) 2488 return -EFAULT; 2489 } 2490 return 0; 2491} 2492 2493static void binder_release_work(struct list_head *list) 2494{ 2495 struct binder_work *w; 2496 while (!list_empty(list)) { 2497 w = list_first_entry(list, struct binder_work, entry); 2498 list_del_init(&w->entry); 2499 switch (w->type) { 2500 case BINDER_WORK_TRANSACTION: { 2501 struct binder_transaction *t; 2502 2503 t = container_of(w, struct binder_transaction, work); 2504 if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) 2505 binder_send_failed_reply(t, BR_DEAD_REPLY); 2506 } break; 2507 case BINDER_WORK_TRANSACTION_COMPLETE: { 2508 kfree(w); 2509 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2510 } break; 2511 default: 2512 break; 2513 } 2514 } 2515 2516} 2517 2518static struct binder_thread *binder_get_thread(struct binder_proc *proc) 2519{ 2520 struct binder_thread *thread = NULL; 2521 struct rb_node *parent = NULL; 2522 struct rb_node **p = &proc->threads.rb_node; 2523 2524 while (*p) { 2525 parent = *p; 2526 thread = rb_entry(parent, struct binder_thread, rb_node); 2527 2528 if (current->pid < thread->pid) 2529 p = &(*p)->rb_left; 2530 else if (current->pid > thread->pid) 2531 p = &(*p)->rb_right; 2532 else 2533 break; 2534 } 2535 if (*p == NULL) { 2536 thread = kzalloc(sizeof(*thread), GFP_KERNEL); 2537 if (thread == NULL) 2538 return NULL; 2539 binder_stats_created(BINDER_STAT_THREAD); 2540 thread->proc = proc; 2541 thread->pid = current->pid; 2542 init_waitqueue_head(&thread->wait); 2543 INIT_LIST_HEAD(&thread->todo); 2544 rb_link_node(&thread->rb_node, parent, p); 2545 rb_insert_color(&thread->rb_node, &proc->threads); 2546 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2547 thread->return_error = BR_OK; 2548 thread->return_error2 = BR_OK; 2549 } 2550 return thread; 2551} 2552 2553static int binder_free_thread(struct binder_proc *proc, 2554 struct binder_thread *thread) 2555{ 2556 struct binder_transaction *t; 2557 struct binder_transaction *send_reply = NULL; 2558 int active_transactions = 0; 2559 2560 rb_erase(&thread->rb_node, &proc->threads); 2561 t = thread->transaction_stack; 2562 if (t && t->to_thread == thread) 2563 send_reply = t; 2564 while (t) { 2565 active_transactions++; 2566 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2567 "binder: release %d:%d transaction %d " 2568 "%s, still active\n", proc->pid, thread->pid, 2569 t->debug_id, 2570 (t->to_thread == thread) ? "in" : "out"); 2571 2572 if (t->to_thread == thread) { 2573 t->to_proc = NULL; 2574 t->to_thread = NULL; 2575 if (t->buffer) { 2576 t->buffer->transaction = NULL; 2577 t->buffer = NULL; 2578 } 2579 t = t->to_parent; 2580 } else if (t->from == thread) { 2581 t->from = NULL; 2582 t = t->from_parent; 2583 } else 2584 BUG(); 2585 } 2586 if (send_reply) 2587 binder_send_failed_reply(send_reply, BR_DEAD_REPLY); 2588 binder_release_work(&thread->todo); 2589 kfree(thread); 2590 binder_stats_deleted(BINDER_STAT_THREAD); 2591 return active_transactions; 2592} 2593 2594static unsigned int binder_poll(struct file *filp, 2595 struct poll_table_struct *wait) 2596{ 2597 struct binder_proc *proc = filp->private_data; 2598 struct binder_thread *thread = NULL; 2599 int wait_for_proc_work; 2600 2601 mutex_lock(&binder_lock); 2602 thread = binder_get_thread(proc); 2603 2604 wait_for_proc_work = thread->transaction_stack == NULL && 2605 list_empty(&thread->todo) && thread->return_error == BR_OK; 2606 mutex_unlock(&binder_lock); 2607 2608 if (wait_for_proc_work) { 2609 if (binder_has_proc_work(proc, thread)) 2610 return POLLIN; 2611 poll_wait(filp, &proc->wait, wait); 2612 if (binder_has_proc_work(proc, thread)) 2613 return POLLIN; 2614 } else { 2615 if (binder_has_thread_work(thread)) 2616 return POLLIN; 2617 poll_wait(filp, &thread->wait, wait); 2618 if (binder_has_thread_work(thread)) 2619 return POLLIN; 2620 } 2621 return 0; 2622} 2623 2624static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 2625{ 2626 int ret; 2627 struct binder_proc *proc = filp->private_data; 2628 struct binder_thread *thread; 2629 unsigned int size = _IOC_SIZE(cmd); 2630 void __user *ubuf = (void __user *)arg; 2631 2632 /*printk(KERN_INFO "binder_ioctl: %d:%d %x %lx\n", proc->pid, current->pid, cmd, arg);*/ 2633 2634 ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2635 if (ret) 2636 return ret; 2637 2638 mutex_lock(&binder_lock); 2639 thread = binder_get_thread(proc); 2640 if (thread == NULL) { 2641 ret = -ENOMEM; 2642 goto err; 2643 } 2644 2645 switch (cmd) { 2646 case BINDER_WRITE_READ: { 2647 struct binder_write_read bwr; 2648 if (size != sizeof(struct binder_write_read)) { 2649 ret = -EINVAL; 2650 goto err; 2651 } 2652 if (copy_from_user(&bwr, ubuf, sizeof(bwr))) { 2653 ret = -EFAULT; 2654 goto err; 2655 } 2656 binder_debug(BINDER_DEBUG_READ_WRITE, 2657 "binder: %d:%d write %ld at %08lx, read %ld at %08lx\n", 2658 proc->pid, thread->pid, bwr.write_size, bwr.write_buffer, 2659 bwr.read_size, bwr.read_buffer); 2660 2661 if (bwr.write_size > 0) { 2662 ret = binder_thread_write(proc, thread, (void __user *)bwr.write_buffer, bwr.write_size, &bwr.write_consumed); 2663 if (ret < 0) { 2664 bwr.read_consumed = 0; 2665 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2666 ret = -EFAULT; 2667 goto err; 2668 } 2669 } 2670 if (bwr.read_size > 0) { 2671 ret = binder_thread_read(proc, thread, (void __user *)bwr.read_buffer, bwr.read_size, &bwr.read_consumed, filp->f_flags & O_NONBLOCK); 2672 if (!list_empty(&proc->todo)) 2673 wake_up_interruptible(&proc->wait); 2674 if (ret < 0) { 2675 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2676 ret = -EFAULT; 2677 goto err; 2678 } 2679 } 2680 binder_debug(BINDER_DEBUG_READ_WRITE, 2681 "binder: %d:%d wrote %ld of %ld, read return %ld of %ld\n", 2682 proc->pid, thread->pid, bwr.write_consumed, bwr.write_size, 2683 bwr.read_consumed, bwr.read_size); 2684 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) { 2685 ret = -EFAULT; 2686 goto err; 2687 } 2688 break; 2689 } 2690 case BINDER_SET_MAX_THREADS: 2691 if (copy_from_user(&proc->max_threads, ubuf, sizeof(proc->max_threads))) { 2692 ret = -EINVAL; 2693 goto err; 2694 } 2695 break; 2696 case BINDER_SET_CONTEXT_MGR: 2697 if (binder_context_mgr_node != NULL) { 2698 printk(KERN_ERR "binder: BINDER_SET_CONTEXT_MGR already set\n"); 2699 ret = -EBUSY; 2700 goto err; 2701 } 2702 if (binder_context_mgr_uid != -1) { 2703 if (binder_context_mgr_uid != current->cred->euid) { 2704 printk(KERN_ERR "binder: BINDER_SET_" 2705 "CONTEXT_MGR bad uid %d != %d\n", 2706 current->cred->euid, 2707 binder_context_mgr_uid); 2708 ret = -EPERM; 2709 goto err; 2710 } 2711 } else 2712 binder_context_mgr_uid = current->cred->euid; 2713 binder_context_mgr_node = binder_new_node(proc, NULL, NULL); 2714 if (binder_context_mgr_node == NULL) { 2715 ret = -ENOMEM; 2716 goto err; 2717 } 2718 binder_context_mgr_node->local_weak_refs++; 2719 binder_context_mgr_node->local_strong_refs++; 2720 binder_context_mgr_node->has_strong_ref = 1; 2721 binder_context_mgr_node->has_weak_ref = 1; 2722 break; 2723 case BINDER_THREAD_EXIT: 2724 binder_debug(BINDER_DEBUG_THREADS, "binder: %d:%d exit\n", 2725 proc->pid, thread->pid); 2726 binder_free_thread(proc, thread); 2727 thread = NULL; 2728 break; 2729 case BINDER_VERSION: 2730 if (size != sizeof(struct binder_version)) { 2731 ret = -EINVAL; 2732 goto err; 2733 } 2734 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION, &((struct binder_version *)ubuf)->protocol_version)) { 2735 ret = -EINVAL; 2736 goto err; 2737 } 2738 break; 2739 default: 2740 ret = -EINVAL; 2741 goto err; 2742 } 2743 ret = 0; 2744err: 2745 if (thread) 2746 thread->looper &= ~BINDER_LOOPER_STATE_NEED_RETURN; 2747 mutex_unlock(&binder_lock); 2748 wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2749 if (ret && ret != -ERESTARTSYS) 2750 printk(KERN_INFO "binder: %d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret); 2751 return ret; 2752} 2753 2754static void binder_vma_open(struct vm_area_struct *vma) 2755{ 2756 struct binder_proc *proc = vma->vm_private_data; 2757 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2758 "binder: %d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2759 proc->pid, vma->vm_start, vma->vm_end, 2760 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2761 (unsigned long)pgprot_val(vma->vm_page_prot)); 2762 dump_stack(); 2763} 2764 2765static void binder_vma_close(struct vm_area_struct *vma) 2766{ 2767 struct binder_proc *proc = vma->vm_private_data; 2768 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2769 "binder: %d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2770 proc->pid, vma->vm_start, vma->vm_end, 2771 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2772 (unsigned long)pgprot_val(vma->vm_page_prot)); 2773 proc->vma = NULL; 2774 binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES); 2775} 2776 2777static struct vm_operations_struct binder_vm_ops = { 2778 .open = binder_vma_open, 2779 .close = binder_vma_close, 2780}; 2781 2782static int binder_mmap(struct file *filp, struct vm_area_struct *vma) 2783{ 2784 int ret; 2785 struct vm_struct *area; 2786 struct binder_proc *proc = filp->private_data; 2787 const char *failure_string; 2788 struct binder_buffer *buffer; 2789 2790 if ((vma->vm_end - vma->vm_start) > SZ_4M) 2791 vma->vm_end = vma->vm_start + SZ_4M; 2792 2793 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2794 "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n", 2795 proc->pid, vma->vm_start, vma->vm_end, 2796 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2797 (unsigned long)pgprot_val(vma->vm_page_prot)); 2798 2799 if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) { 2800 ret = -EPERM; 2801 failure_string = "bad vm_flags"; 2802 goto err_bad_arg; 2803 } 2804 vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE; 2805 2806 if (proc->buffer) { 2807 ret = -EBUSY; 2808 failure_string = "already mapped"; 2809 goto err_already_mapped; 2810 } 2811 2812 area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP); 2813 if (area == NULL) { 2814 ret = -ENOMEM; 2815 failure_string = "get_vm_area"; 2816 goto err_get_vm_area_failed; 2817 } 2818 proc->buffer = area->addr; 2819 proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer; 2820 2821#ifdef CONFIG_CPU_CACHE_VIPT 2822 if (cache_is_vipt_aliasing()) { 2823 while (CACHE_COLOUR((vma->vm_start ^ (uint32_t)proc->buffer))) { 2824 printk(KERN_INFO "binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer); 2825 vma->vm_start += PAGE_SIZE; 2826 } 2827 } 2828#endif 2829 proc->pages = kzalloc(sizeof(proc->pages[0]) * ((vma->vm_end - vma->vm_start) / PAGE_SIZE), GFP_KERNEL); 2830 if (proc->pages == NULL) { 2831 ret = -ENOMEM; 2832 failure_string = "alloc page array"; 2833 goto err_alloc_pages_failed; 2834 } 2835 proc->buffer_size = vma->vm_end - vma->vm_start; 2836 2837 vma->vm_ops = &binder_vm_ops; 2838 vma->vm_private_data = proc; 2839 2840 if (binder_update_page_range(proc, 1, proc->buffer, proc->buffer + PAGE_SIZE, vma)) { 2841 ret = -ENOMEM; 2842 failure_string = "alloc small buf"; 2843 goto err_alloc_small_buf_failed; 2844 } 2845 buffer = proc->buffer; 2846 INIT_LIST_HEAD(&proc->buffers); 2847 list_add(&buffer->entry, &proc->buffers); 2848 buffer->free = 1; 2849 binder_insert_free_buffer(proc, buffer); 2850 proc->free_async_space = proc->buffer_size / 2; 2851 barrier(); 2852 proc->files = get_files_struct(current); 2853 proc->vma = vma; 2854 2855 /*printk(KERN_INFO "binder_mmap: %d %lx-%lx maps %p\n", 2856 proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/ 2857 return 0; 2858 2859err_alloc_small_buf_failed: 2860 kfree(proc->pages); 2861 proc->pages = NULL; 2862err_alloc_pages_failed: 2863 vfree(proc->buffer); 2864 proc->buffer = NULL; 2865err_get_vm_area_failed: 2866err_already_mapped: 2867err_bad_arg: 2868 printk(KERN_ERR "binder_mmap: %d %lx-%lx %s failed %d\n", 2869 proc->pid, vma->vm_start, vma->vm_end, failure_string, ret); 2870 return ret; 2871} 2872 2873static int binder_open(struct inode *nodp, struct file *filp) 2874{ 2875 struct binder_proc *proc; 2876 2877 binder_debug(BINDER_DEBUG_OPEN_CLOSE, "binder_open: %d:%d\n", 2878 current->group_leader->pid, current->pid); 2879 2880 proc = kzalloc(sizeof(*proc), GFP_KERNEL); 2881 if (proc == NULL) 2882 return -ENOMEM; 2883 get_task_struct(current); 2884 proc->tsk = current; 2885 INIT_LIST_HEAD(&proc->todo); 2886 init_waitqueue_head(&proc->wait); 2887 proc->default_priority = task_nice(current); 2888 mutex_lock(&binder_lock); 2889 binder_stats_created(BINDER_STAT_PROC); 2890 hlist_add_head(&proc->proc_node, &binder_procs); 2891 proc->pid = current->group_leader->pid; 2892 INIT_LIST_HEAD(&proc->delivered_death); 2893 filp->private_data = proc; 2894 mutex_unlock(&binder_lock); 2895 2896 if (binder_debugfs_dir_entry_proc) { 2897 char strbuf[11]; 2898 snprintf(strbuf, sizeof(strbuf), "%u", proc->pid); 2899 proc->debugfs_entry = debugfs_create_file(strbuf, S_IRUGO, 2900 binder_debugfs_dir_entry_proc, proc, &binder_proc_fops); 2901 } 2902 2903 return 0; 2904} 2905 2906static int binder_flush(struct file *filp, fl_owner_t id) 2907{ 2908 struct binder_proc *proc = filp->private_data; 2909 2910 binder_defer_work(proc, BINDER_DEFERRED_FLUSH); 2911 2912 return 0; 2913} 2914 2915static void binder_deferred_flush(struct binder_proc *proc) 2916{ 2917 struct rb_node *n; 2918 int wake_count = 0; 2919 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) { 2920 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node); 2921 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2922 if (thread->looper & BINDER_LOOPER_STATE_WAITING) { 2923 wake_up_interruptible(&thread->wait); 2924 wake_count++; 2925 } 2926 } 2927 wake_up_interruptible_all(&proc->wait); 2928 2929 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2930 "binder_flush: %d woke %d threads\n", proc->pid, 2931 wake_count); 2932} 2933 2934static int binder_release(struct inode *nodp, struct file *filp) 2935{ 2936 struct binder_proc *proc = filp->private_data; 2937 debugfs_remove(proc->debugfs_entry); 2938 binder_defer_work(proc, BINDER_DEFERRED_RELEASE); 2939 2940 return 0; 2941} 2942 2943static void binder_deferred_release(struct binder_proc *proc) 2944{ 2945 struct hlist_node *pos; 2946 struct binder_transaction *t; 2947 struct rb_node *n; 2948 int threads, nodes, incoming_refs, outgoing_refs, buffers, active_transactions, page_count; 2949 2950 BUG_ON(proc->vma); 2951 BUG_ON(proc->files); 2952 2953 hlist_del(&proc->proc_node); 2954 if (binder_context_mgr_node && binder_context_mgr_node->proc == proc) { 2955 binder_debug(BINDER_DEBUG_DEAD_BINDER, 2956 "binder_release: %d context_mgr_node gone\n", 2957 proc->pid); 2958 binder_context_mgr_node = NULL; 2959 } 2960 2961 threads = 0; 2962 active_transactions = 0; 2963 while ((n = rb_first(&proc->threads))) { 2964 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node); 2965 threads++; 2966 active_transactions += binder_free_thread(proc, thread); 2967 } 2968 nodes = 0; 2969 incoming_refs = 0; 2970 while ((n = rb_first(&proc->nodes))) { 2971 struct binder_node *node = rb_entry(n, struct binder_node, rb_node); 2972 2973 nodes++; 2974 rb_erase(&node->rb_node, &proc->nodes); 2975 list_del_init(&node->work.entry); 2976 if (hlist_empty(&node->refs)) { 2977 kfree(node); 2978 binder_stats_deleted(BINDER_STAT_NODE); 2979 } else { 2980 struct binder_ref *ref; 2981 int death = 0; 2982 2983 node->proc = NULL; 2984 node->local_strong_refs = 0; 2985 node->local_weak_refs = 0; 2986 hlist_add_head(&node->dead_node, &binder_dead_nodes); 2987 2988 hlist_for_each_entry(ref, pos, &node->refs, node_entry) { 2989 incoming_refs++; 2990 if (ref->death) { 2991 death++; 2992 if (list_empty(&ref->death->work.entry)) { 2993 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 2994 list_add_tail(&ref->death->work.entry, &ref->proc->todo); 2995 wake_up_interruptible(&ref->proc->wait); 2996 } else 2997 BUG(); 2998 } 2999 } 3000 binder_debug(BINDER_DEBUG_DEAD_BINDER, 3001 "binder: node %d now dead, " 3002 "refs %d, death %d\n", node->debug_id, 3003 incoming_refs, death); 3004 } 3005 } 3006 outgoing_refs = 0; 3007 while ((n = rb_first(&proc->refs_by_desc))) { 3008 struct binder_ref *ref = rb_entry(n, struct binder_ref, 3009 rb_node_desc); 3010 outgoing_refs++; 3011 binder_delete_ref(ref); 3012 } 3013 binder_release_work(&proc->todo); 3014 buffers = 0; 3015 3016 while ((n = rb_first(&proc->allocated_buffers))) { 3017 struct binder_buffer *buffer = rb_entry(n, struct binder_buffer, 3018 rb_node); 3019 t = buffer->transaction; 3020 if (t) { 3021 t->buffer = NULL; 3022 buffer->transaction = NULL; 3023 printk(KERN_ERR "binder: release proc %d, " 3024 "transaction %d, not freed\n", 3025 proc->pid, t->debug_id); 3026 /*BUG();*/ 3027 } 3028 binder_free_buf(proc, buffer); 3029 buffers++; 3030 } 3031 3032 binder_stats_deleted(BINDER_STAT_PROC); 3033 3034 page_count = 0; 3035 if (proc->pages) { 3036 int i; 3037 for (i = 0; i < proc->buffer_size / PAGE_SIZE; i++) { 3038 if (proc->pages[i]) { 3039 void *page_addr = proc->buffer + i * PAGE_SIZE; 3040 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 3041 "binder_release: %d: " 3042 "page %d at %p not freed\n", 3043 proc->pid, i, 3044 page_addr); 3045 unmap_kernel_range((unsigned long)page_addr, 3046 PAGE_SIZE); 3047 __free_page(proc->pages[i]); 3048 page_count++; 3049 } 3050 } 3051 kfree(proc->pages); 3052 vfree(proc->buffer); 3053 } 3054 3055 put_task_struct(proc->tsk); 3056 3057 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 3058 "binder_release: %d threads %d, nodes %d (ref %d), " 3059 "refs %d, active transactions %d, buffers %d, " 3060 "pages %d\n", 3061 proc->pid, threads, nodes, incoming_refs, outgoing_refs, 3062 active_transactions, buffers, page_count); 3063 3064 kfree(proc); 3065} 3066 3067static void binder_deferred_func(struct work_struct *work) 3068{ 3069 struct binder_proc *proc; 3070 struct files_struct *files; 3071 3072 int defer; 3073 do { 3074 mutex_lock(&binder_lock); 3075 mutex_lock(&binder_deferred_lock); 3076 if (!hlist_empty(&binder_deferred_list)) { 3077 proc = hlist_entry(binder_deferred_list.first, 3078 struct binder_proc, deferred_work_node); 3079 hlist_del_init(&proc->deferred_work_node); 3080 defer = proc->deferred_work; 3081 proc->deferred_work = 0; 3082 } else { 3083 proc = NULL; 3084 defer = 0; 3085 } 3086 mutex_unlock(&binder_deferred_lock); 3087 3088 files = NULL; 3089 if (defer & BINDER_DEFERRED_PUT_FILES) { 3090 files = proc->files; 3091 if (files) 3092 proc->files = NULL; 3093 } 3094 3095 if (defer & BINDER_DEFERRED_FLUSH) 3096 binder_deferred_flush(proc); 3097 3098 if (defer & BINDER_DEFERRED_RELEASE) 3099 binder_deferred_release(proc); /* frees proc */ 3100 3101 mutex_unlock(&binder_lock); 3102 if (files) 3103 put_files_struct(files); 3104 } while (proc); 3105} 3106static DECLARE_WORK(binder_deferred_work, binder_deferred_func); 3107 3108static void 3109binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer) 3110{ 3111 mutex_lock(&binder_deferred_lock); 3112 proc->deferred_work |= defer; 3113 if (hlist_unhashed(&proc->deferred_work_node)) { 3114 hlist_add_head(&proc->deferred_work_node, 3115 &binder_deferred_list); 3116 queue_work(binder_deferred_workqueue, &binder_deferred_work); 3117 } 3118 mutex_unlock(&binder_deferred_lock); 3119} 3120 3121static void print_binder_transaction(struct seq_file *m, const char *prefix, 3122 struct binder_transaction *t) 3123{ 3124 seq_printf(m, 3125 "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d", 3126 prefix, t->debug_id, t, 3127 t->from ? t->from->proc->pid : 0, 3128 t->from ? t->from->pid : 0, 3129 t->to_proc ? t->to_proc->pid : 0, 3130 t->to_thread ? t->to_thread->pid : 0, 3131 t->code, t->flags, t->priority, t->need_reply); 3132 if (t->buffer == NULL) { 3133 seq_puts(m, " buffer free\n"); 3134 return; 3135 } 3136 if (t->buffer->target_node) 3137 seq_printf(m, " node %d", 3138 t->buffer->target_node->debug_id); 3139 seq_printf(m, " size %zd:%zd data %p\n", 3140 t->buffer->data_size, t->buffer->offsets_size, 3141 t->buffer->data); 3142} 3143 3144static void print_binder_buffer(struct seq_file *m, const char *prefix, 3145 struct binder_buffer *buffer) 3146{ 3147 seq_printf(m, "%s %d: %p size %zd:%zd %s\n", 3148 prefix, buffer->debug_id, buffer->data, 3149 buffer->data_size, buffer->offsets_size, 3150 buffer->transaction ? "active" : "delivered"); 3151} 3152 3153static void print_binder_work(struct seq_file *m, const char *prefix, 3154 const char *transaction_prefix, 3155 struct binder_work *w) 3156{ 3157 struct binder_node *node; 3158 struct binder_transaction *t; 3159 3160 switch (w->type) { 3161 case BINDER_WORK_TRANSACTION: 3162 t = container_of(w, struct binder_transaction, work); 3163 print_binder_transaction(m, transaction_prefix, t); 3164 break; 3165 case BINDER_WORK_TRANSACTION_COMPLETE: 3166 seq_printf(m, "%stransaction complete\n", prefix); 3167 break; 3168 case BINDER_WORK_NODE: 3169 node = container_of(w, struct binder_node, work); 3170 seq_printf(m, "%snode work %d: u%p c%p\n", 3171 prefix, node->debug_id, node->ptr, node->cookie); 3172 break; 3173 case BINDER_WORK_DEAD_BINDER: 3174 seq_printf(m, "%shas dead binder\n", prefix); 3175 break; 3176 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 3177 seq_printf(m, "%shas cleared dead binder\n", prefix); 3178 break; 3179 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: 3180 seq_printf(m, "%shas cleared death notification\n", prefix); 3181 break; 3182 default: 3183 seq_printf(m, "%sunknown work: type %d\n", prefix, w->type); 3184 break; 3185 } 3186} 3187 3188static void print_binder_thread(struct seq_file *m, 3189 struct binder_thread *thread, 3190 int print_always) 3191{ 3192 struct binder_transaction *t; 3193 struct binder_work *w; 3194 size_t start_pos = m->count; 3195 size_t header_pos; 3196 3197 seq_printf(m, " thread %d: l %02x\n", thread->pid, thread->looper); 3198 header_pos = m->count; 3199 t = thread->transaction_stack; 3200 while (t) { 3201 if (t->from == thread) { 3202 print_binder_transaction(m, 3203 " outgoing transaction", t); 3204 t = t->from_parent; 3205 } else if (t->to_thread == thread) { 3206 print_binder_transaction(m, 3207 " incoming transaction", t); 3208 t = t->to_parent; 3209 } else { 3210 print_binder_transaction(m, " bad transaction", t); 3211 t = NULL; 3212 } 3213 } 3214 list_for_each_entry(w, &thread->todo, entry) { 3215 print_binder_work(m, " ", " pending transaction", w); 3216 } 3217 if (!print_always && m->count == header_pos) 3218 m->count = start_pos; 3219} 3220 3221static void print_binder_node(struct seq_file *m, struct binder_node *node) 3222{ 3223 struct binder_ref *ref; 3224 struct hlist_node *pos; 3225 struct binder_work *w; 3226 int count; 3227 3228 count = 0; 3229 hlist_for_each_entry(ref, pos, &node->refs, node_entry) 3230 count++; 3231 3232 seq_printf(m, " node %d: u%p c%p hs %d hw %d ls %d lw %d is %d iw %d", 3233 node->debug_id, node->ptr, node->cookie, 3234 node->has_strong_ref, node->has_weak_ref, 3235 node->local_strong_refs, node->local_weak_refs, 3236 node->internal_strong_refs, count); 3237 if (count) { 3238 seq_puts(m, " proc"); 3239 hlist_for_each_entry(ref, pos, &node->refs, node_entry) 3240 seq_printf(m, " %d", ref->proc->pid); 3241 } 3242 seq_puts(m, "\n"); 3243 list_for_each_entry(w, &node->async_todo, entry) 3244 print_binder_work(m, " ", 3245 " pending async transaction", w); 3246} 3247 3248static void print_binder_ref(struct seq_file *m, struct binder_ref *ref) 3249{ 3250 seq_printf(m, " ref %d: desc %d %snode %d s %d w %d d %p\n", 3251 ref->debug_id, ref->desc, ref->node->proc ? "" : "dead ", 3252 ref->node->debug_id, ref->strong, ref->weak, ref->death); 3253} 3254 3255static void print_binder_proc(struct seq_file *m, 3256 struct binder_proc *proc, int print_all) 3257{ 3258 struct binder_work *w; 3259 struct rb_node *n; 3260 size_t start_pos = m->count; 3261 size_t header_pos; 3262 3263 seq_printf(m, "proc %d\n", proc->pid); 3264 header_pos = m->count; 3265 3266 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3267 print_binder_thread(m, rb_entry(n, struct binder_thread, 3268 rb_node), print_all); 3269 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) { 3270 struct binder_node *node = rb_entry(n, struct binder_node, 3271 rb_node); 3272 if (print_all || node->has_async_transaction) 3273 print_binder_node(m, node); 3274 } 3275 if (print_all) { 3276 for (n = rb_first(&proc->refs_by_desc); 3277 n != NULL; 3278 n = rb_next(n)) 3279 print_binder_ref(m, rb_entry(n, struct binder_ref, 3280 rb_node_desc)); 3281 } 3282 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3283 print_binder_buffer(m, " buffer", 3284 rb_entry(n, struct binder_buffer, rb_node)); 3285 list_for_each_entry(w, &proc->todo, entry) 3286 print_binder_work(m, " ", " pending transaction", w); 3287 list_for_each_entry(w, &proc->delivered_death, entry) { 3288 seq_puts(m, " has delivered dead binder\n"); 3289 break; 3290 } 3291 if (!print_all && m->count == header_pos) 3292 m->count = start_pos; 3293} 3294 3295static const char *binder_return_strings[] = { 3296 "BR_ERROR", 3297 "BR_OK", 3298 "BR_TRANSACTION", 3299 "BR_REPLY", 3300 "BR_ACQUIRE_RESULT", 3301 "BR_DEAD_REPLY", 3302 "BR_TRANSACTION_COMPLETE", 3303 "BR_INCREFS", 3304 "BR_ACQUIRE", 3305 "BR_RELEASE", 3306 "BR_DECREFS", 3307 "BR_ATTEMPT_ACQUIRE", 3308 "BR_NOOP", 3309 "BR_SPAWN_LOOPER", 3310 "BR_FINISHED", 3311 "BR_DEAD_BINDER", 3312 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 3313 "BR_FAILED_REPLY" 3314}; 3315 3316static const char *binder_command_strings[] = { 3317 "BC_TRANSACTION", 3318 "BC_REPLY", 3319 "BC_ACQUIRE_RESULT", 3320 "BC_FREE_BUFFER", 3321 "BC_INCREFS", 3322 "BC_ACQUIRE", 3323 "BC_RELEASE", 3324 "BC_DECREFS", 3325 "BC_INCREFS_DONE", 3326 "BC_ACQUIRE_DONE", 3327 "BC_ATTEMPT_ACQUIRE", 3328 "BC_REGISTER_LOOPER", 3329 "BC_ENTER_LOOPER", 3330 "BC_EXIT_LOOPER", 3331 "BC_REQUEST_DEATH_NOTIFICATION", 3332 "BC_CLEAR_DEATH_NOTIFICATION", 3333 "BC_DEAD_BINDER_DONE" 3334}; 3335 3336static const char *binder_objstat_strings[] = { 3337 "proc", 3338 "thread", 3339 "node", 3340 "ref", 3341 "death", 3342 "transaction", 3343 "transaction_complete" 3344}; 3345 3346static void print_binder_stats(struct seq_file *m, const char *prefix, 3347 struct binder_stats *stats) 3348{ 3349 int i; 3350 3351 BUILD_BUG_ON(ARRAY_SIZE(stats->bc) != 3352 ARRAY_SIZE(binder_command_strings)); 3353 for (i = 0; i < ARRAY_SIZE(stats->bc); i++) { 3354 if (stats->bc[i]) 3355 seq_printf(m, "%s%s: %d\n", prefix, 3356 binder_command_strings[i], stats->bc[i]); 3357 } 3358 3359 BUILD_BUG_ON(ARRAY_SIZE(stats->br) != 3360 ARRAY_SIZE(binder_return_strings)); 3361 for (i = 0; i < ARRAY_SIZE(stats->br); i++) { 3362 if (stats->br[i]) 3363 seq_printf(m, "%s%s: %d\n", prefix, 3364 binder_return_strings[i], stats->br[i]); 3365 } 3366 3367 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 3368 ARRAY_SIZE(binder_objstat_strings)); 3369 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 3370 ARRAY_SIZE(stats->obj_deleted)); 3371 for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) { 3372 if (stats->obj_created[i] || stats->obj_deleted[i]) 3373 seq_printf(m, "%s%s: active %d total %d\n", prefix, 3374 binder_objstat_strings[i], 3375 stats->obj_created[i] - stats->obj_deleted[i], 3376 stats->obj_created[i]); 3377 } 3378} 3379 3380static void print_binder_proc_stats(struct seq_file *m, 3381 struct binder_proc *proc) 3382{ 3383 struct binder_work *w; 3384 struct rb_node *n; 3385 int count, strong, weak; 3386 3387 seq_printf(m, "proc %d\n", proc->pid); 3388 count = 0; 3389 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3390 count++; 3391 seq_printf(m, " threads: %d\n", count); 3392 seq_printf(m, " requested threads: %d+%d/%d\n" 3393 " ready threads %d\n" 3394 " free async space %zd\n", proc->requested_threads, 3395 proc->requested_threads_started, proc->max_threads, 3396 proc->ready_threads, proc->free_async_space); 3397 count = 0; 3398 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) 3399 count++; 3400 seq_printf(m, " nodes: %d\n", count); 3401 count = 0; 3402 strong = 0; 3403 weak = 0; 3404 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 3405 struct binder_ref *ref = rb_entry(n, struct binder_ref, 3406 rb_node_desc); 3407 count++; 3408 strong += ref->strong; 3409 weak += ref->weak; 3410 } 3411 seq_printf(m, " refs: %d s %d w %d\n", count, strong, weak); 3412 3413 count = 0; 3414 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3415 count++; 3416 seq_printf(m, " buffers: %d\n", count); 3417 3418 count = 0; 3419 list_for_each_entry(w, &proc->todo, entry) { 3420 switch (w->type) { 3421 case BINDER_WORK_TRANSACTION: 3422 count++; 3423 break; 3424 default: 3425 break; 3426 } 3427 } 3428 seq_printf(m, " pending transactions: %d\n", count); 3429 3430 print_binder_stats(m, " ", &proc->stats); 3431} 3432 3433 3434static int binder_state_show(struct seq_file *m, void *unused) 3435{ 3436 struct binder_proc *proc; 3437 struct hlist_node *pos; 3438 struct binder_node *node; 3439 int do_lock = !binder_debug_no_lock; 3440 3441 if (do_lock) 3442 mutex_lock(&binder_lock); 3443 3444 seq_puts(m, "binder state:\n"); 3445 3446 if (!hlist_empty(&binder_dead_nodes)) 3447 seq_puts(m, "dead nodes:\n"); 3448 hlist_for_each_entry(node, pos, &binder_dead_nodes, dead_node) 3449 print_binder_node(m, node); 3450 3451 hlist_for_each_entry(proc, pos, &binder_procs, proc_node) 3452 print_binder_proc(m, proc, 1); 3453 if (do_lock) 3454 mutex_unlock(&binder_lock); 3455 return 0; 3456} 3457 3458static int binder_stats_show(struct seq_file *m, void *unused) 3459{ 3460 struct binder_proc *proc; 3461 struct hlist_node *pos; 3462 int do_lock = !binder_debug_no_lock; 3463 3464 if (do_lock) 3465 mutex_lock(&binder_lock); 3466 3467 seq_puts(m, "binder stats:\n"); 3468 3469 print_binder_stats(m, "", &binder_stats); 3470 3471 hlist_for_each_entry(proc, pos, &binder_procs, proc_node) 3472 print_binder_proc_stats(m, proc); 3473 if (do_lock) 3474 mutex_unlock(&binder_lock); 3475 return 0; 3476} 3477 3478static int binder_transactions_show(struct seq_file *m, void *unused) 3479{ 3480 struct binder_proc *proc; 3481 struct hlist_node *pos; 3482 int do_lock = !binder_debug_no_lock; 3483 3484 if (do_lock) 3485 mutex_lock(&binder_lock); 3486 3487 seq_puts(m, "binder transactions:\n"); 3488 hlist_for_each_entry(proc, pos, &binder_procs, proc_node) 3489 print_binder_proc(m, proc, 0); 3490 if (do_lock) 3491 mutex_unlock(&binder_lock); 3492 return 0; 3493} 3494 3495static int binder_proc_show(struct seq_file *m, void *unused) 3496{ 3497 struct binder_proc *proc = m->private; 3498 int do_lock = !binder_debug_no_lock; 3499 3500 if (do_lock) 3501 mutex_lock(&binder_lock); 3502 seq_puts(m, "binder proc state:\n"); 3503 print_binder_proc(m, proc, 1); 3504 if (do_lock) 3505 mutex_unlock(&binder_lock); 3506 return 0; 3507} 3508 3509static void print_binder_transaction_log_entry(struct seq_file *m, 3510 struct binder_transaction_log_entry *e) 3511{ 3512 seq_printf(m, 3513 "%d: %s from %d:%d to %d:%d node %d handle %d size %d:%d\n", 3514 e->debug_id, (e->call_type == 2) ? "reply" : 3515 ((e->call_type == 1) ? "async" : "call "), e->from_proc, 3516 e->from_thread, e->to_proc, e->to_thread, e->to_node, 3517 e->target_handle, e->data_size, e->offsets_size); 3518} 3519 3520static int binder_transaction_log_show(struct seq_file *m, void *unused) 3521{ 3522 struct binder_transaction_log *log = m->private; 3523 int i; 3524 3525 if (log->full) { 3526 for (i = log->next; i < ARRAY_SIZE(log->entry); i++) 3527 print_binder_transaction_log_entry(m, &log->entry[i]); 3528 } 3529 for (i = 0; i < log->next; i++) 3530 print_binder_transaction_log_entry(m, &log->entry[i]); 3531 return 0; 3532} 3533 3534static const struct file_operations binder_fops = { 3535 .owner = THIS_MODULE, 3536 .poll = binder_poll, 3537 .unlocked_ioctl = binder_ioctl, 3538 .mmap = binder_mmap, 3539 .open = binder_open, 3540 .flush = binder_flush, 3541 .release = binder_release, 3542}; 3543 3544static struct miscdevice binder_miscdev = { 3545 .minor = MISC_DYNAMIC_MINOR, 3546 .name = "binder", 3547 .fops = &binder_fops 3548}; 3549 3550BINDER_DEBUG_ENTRY(state); 3551BINDER_DEBUG_ENTRY(stats); 3552BINDER_DEBUG_ENTRY(transactions); 3553BINDER_DEBUG_ENTRY(transaction_log); 3554 3555static int __init binder_init(void) 3556{ 3557 int ret; 3558 3559 binder_deferred_workqueue = create_singlethread_workqueue("binder"); 3560 if (!binder_deferred_workqueue) 3561 return -ENOMEM; 3562 3563 binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL); 3564 if (binder_debugfs_dir_entry_root) 3565 binder_debugfs_dir_entry_proc = debugfs_create_dir("proc", 3566 binder_debugfs_dir_entry_root); 3567 ret = misc_register(&binder_miscdev); 3568 if (binder_debugfs_dir_entry_root) { 3569 debugfs_create_file("state", 3570 S_IRUGO, 3571 binder_debugfs_dir_entry_root, 3572 NULL, 3573 &binder_state_fops); 3574 debugfs_create_file("stats", 3575 S_IRUGO, 3576 binder_debugfs_dir_entry_root, 3577 NULL, 3578 &binder_stats_fops); 3579 debugfs_create_file("transactions", 3580 S_IRUGO, 3581 binder_debugfs_dir_entry_root, 3582 NULL, 3583 &binder_transactions_fops); 3584 debugfs_create_file("transaction_log", 3585 S_IRUGO, 3586 binder_debugfs_dir_entry_root, 3587 &binder_transaction_log, 3588 &binder_transaction_log_fops); 3589 debugfs_create_file("failed_transaction_log", 3590 S_IRUGO, 3591 binder_debugfs_dir_entry_root, 3592 &binder_transaction_log_failed, 3593 &binder_transaction_log_fops); 3594 } 3595 return ret; 3596} 3597 3598device_initcall(binder_init); 3599 3600MODULE_LICENSE("GPL v2"); 3601