binder.c revision 282ca175d4c440ec4d74bc622ee497e5b3530ce5
1/* binder.c 2 * 3 * Android IPC Subsystem 4 * 5 * Copyright (C) 2007-2008 Google, Inc. 6 * 7 * This software is licensed under the terms of the GNU General Public 8 * License version 2, as published by the Free Software Foundation, and 9 * may be copied, distributed, and modified under those terms. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 */ 17 18#include <asm/cacheflush.h> 19#include <linux/fdtable.h> 20#include <linux/file.h> 21#include <linux/fs.h> 22#include <linux/list.h> 23#include <linux/miscdevice.h> 24#include <linux/mm.h> 25#include <linux/module.h> 26#include <linux/mutex.h> 27#include <linux/nsproxy.h> 28#include <linux/poll.h> 29#include <linux/proc_fs.h> 30#include <linux/rbtree.h> 31#include <linux/sched.h> 32#include <linux/uaccess.h> 33#include <linux/vmalloc.h> 34#include "binder.h" 35 36static DEFINE_MUTEX(binder_lock); 37static HLIST_HEAD(binder_procs); 38static struct binder_node *binder_context_mgr_node; 39static uid_t binder_context_mgr_uid = -1; 40static int binder_last_id; 41static struct proc_dir_entry *binder_proc_dir_entry_root; 42static struct proc_dir_entry *binder_proc_dir_entry_proc; 43static struct hlist_head binder_dead_nodes; 44static HLIST_HEAD(binder_release_files_list); 45static DEFINE_MUTEX(binder_release_files_lock); 46 47static int binder_read_proc_proc( 48 char *page, char **start, off_t off, int count, int *eof, void *data); 49 50/* This is only defined in include/asm-arm/sizes.h */ 51#ifndef SZ_1K 52#define SZ_1K 0x400 53#endif 54 55#ifndef SZ_4M 56#define SZ_4M 0x400000 57#endif 58 59#define FORBIDDEN_MMAP_FLAGS (VM_WRITE) 60 61#define BINDER_SMALL_BUF_SIZE (PAGE_SIZE * 64) 62 63enum { 64 BINDER_DEBUG_USER_ERROR = 1U << 0, 65 BINDER_DEBUG_FAILED_TRANSACTION = 1U << 1, 66 BINDER_DEBUG_DEAD_TRANSACTION = 1U << 2, 67 BINDER_DEBUG_OPEN_CLOSE = 1U << 3, 68 BINDER_DEBUG_DEAD_BINDER = 1U << 4, 69 BINDER_DEBUG_DEATH_NOTIFICATION = 1U << 5, 70 BINDER_DEBUG_READ_WRITE = 1U << 6, 71 BINDER_DEBUG_USER_REFS = 1U << 7, 72 BINDER_DEBUG_THREADS = 1U << 8, 73 BINDER_DEBUG_TRANSACTION = 1U << 9, 74 BINDER_DEBUG_TRANSACTION_COMPLETE = 1U << 10, 75 BINDER_DEBUG_FREE_BUFFER = 1U << 11, 76 BINDER_DEBUG_INTERNAL_REFS = 1U << 12, 77 BINDER_DEBUG_BUFFER_ALLOC = 1U << 13, 78 BINDER_DEBUG_PRIORITY_CAP = 1U << 14, 79 BINDER_DEBUG_BUFFER_ALLOC_ASYNC = 1U << 15, 80}; 81static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR | 82 BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION; 83module_param_named(debug_mask, binder_debug_mask, uint, S_IWUSR | S_IRUGO); 84static int binder_debug_no_lock; 85module_param_named(proc_no_lock, binder_debug_no_lock, bool, S_IWUSR | S_IRUGO); 86static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait); 87static int binder_stop_on_user_error; 88static int binder_set_stop_on_user_error( 89 const char *val, struct kernel_param *kp) 90{ 91 int ret; 92 ret = param_set_int(val, kp); 93 if (binder_stop_on_user_error < 2) 94 wake_up(&binder_user_error_wait); 95 return ret; 96} 97module_param_call(stop_on_user_error, binder_set_stop_on_user_error, 98 param_get_int, &binder_stop_on_user_error, S_IWUSR | S_IRUGO); 99 100#define binder_user_error(x...) \ 101 do { \ 102 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \ 103 printk(KERN_INFO x); \ 104 if (binder_stop_on_user_error) \ 105 binder_stop_on_user_error = 2; \ 106 } while (0) 107 108enum { 109 BINDER_STAT_PROC, 110 BINDER_STAT_THREAD, 111 BINDER_STAT_NODE, 112 BINDER_STAT_REF, 113 BINDER_STAT_DEATH, 114 BINDER_STAT_TRANSACTION, 115 BINDER_STAT_TRANSACTION_COMPLETE, 116 BINDER_STAT_COUNT 117}; 118 119struct binder_stats { 120 int br[_IOC_NR(BR_FAILED_REPLY) + 1]; 121 int bc[_IOC_NR(BC_DEAD_BINDER_DONE) + 1]; 122 int obj_created[BINDER_STAT_COUNT]; 123 int obj_deleted[BINDER_STAT_COUNT]; 124}; 125 126static struct binder_stats binder_stats; 127 128struct binder_transaction_log_entry { 129 int debug_id; 130 int call_type; 131 int from_proc; 132 int from_thread; 133 int target_handle; 134 int to_proc; 135 int to_thread; 136 int to_node; 137 int data_size; 138 int offsets_size; 139}; 140struct binder_transaction_log { 141 int next; 142 int full; 143 struct binder_transaction_log_entry entry[32]; 144}; 145struct binder_transaction_log binder_transaction_log; 146struct binder_transaction_log binder_transaction_log_failed; 147 148static struct binder_transaction_log_entry *binder_transaction_log_add( 149 struct binder_transaction_log *log) 150{ 151 struct binder_transaction_log_entry *e; 152 e = &log->entry[log->next]; 153 memset(e, 0, sizeof(*e)); 154 log->next++; 155 if (log->next == ARRAY_SIZE(log->entry)) { 156 log->next = 0; 157 log->full = 1; 158 } 159 return e; 160} 161 162struct binder_work { 163 struct list_head entry; 164 enum { 165 BINDER_WORK_TRANSACTION = 1, 166 BINDER_WORK_TRANSACTION_COMPLETE, 167 BINDER_WORK_NODE, 168 BINDER_WORK_DEAD_BINDER, 169 BINDER_WORK_DEAD_BINDER_AND_CLEAR, 170 BINDER_WORK_CLEAR_DEATH_NOTIFICATION, 171 } type; 172}; 173 174struct binder_node { 175 int debug_id; 176 struct binder_work work; 177 union { 178 struct rb_node rb_node; 179 struct hlist_node dead_node; 180 }; 181 struct binder_proc *proc; 182 struct hlist_head refs; 183 int internal_strong_refs; 184 int local_weak_refs; 185 int local_strong_refs; 186 void __user *ptr; 187 void __user *cookie; 188 unsigned has_strong_ref : 1; 189 unsigned pending_strong_ref : 1; 190 unsigned has_weak_ref : 1; 191 unsigned pending_weak_ref : 1; 192 unsigned has_async_transaction : 1; 193 unsigned accept_fds : 1; 194 int min_priority : 8; 195 struct list_head async_todo; 196}; 197 198struct binder_ref_death { 199 struct binder_work work; 200 void __user *cookie; 201}; 202 203struct binder_ref { 204 /* Lookups needed: */ 205 /* node + proc => ref (transaction) */ 206 /* desc + proc => ref (transaction, inc/dec ref) */ 207 /* node => refs + procs (proc exit) */ 208 int debug_id; 209 struct rb_node rb_node_desc; 210 struct rb_node rb_node_node; 211 struct hlist_node node_entry; 212 struct binder_proc *proc; 213 struct binder_node *node; 214 uint32_t desc; 215 int strong; 216 int weak; 217 struct binder_ref_death *death; 218}; 219 220struct binder_buffer { 221 struct list_head entry; /* free and allocated entries by addesss */ 222 struct rb_node rb_node; /* free entry by size or allocated entry */ 223 /* by address */ 224 unsigned free : 1; 225 unsigned allow_user_free : 1; 226 unsigned async_transaction : 1; 227 unsigned debug_id : 29; 228 229 struct binder_transaction *transaction; 230 231 struct binder_node *target_node; 232 size_t data_size; 233 size_t offsets_size; 234 uint8_t data[0]; 235}; 236 237struct binder_proc { 238 struct hlist_node proc_node; 239 struct rb_root threads; 240 struct rb_root nodes; 241 struct rb_root refs_by_desc; 242 struct rb_root refs_by_node; 243 int pid; 244 struct vm_area_struct *vma; 245 struct task_struct *tsk; 246 struct files_struct *files; 247 struct hlist_node release_files_node; 248 void *buffer; 249 size_t user_buffer_offset; 250 251 struct list_head buffers; 252 struct rb_root free_buffers; 253 struct rb_root allocated_buffers; 254 size_t free_async_space; 255 256 struct page **pages; 257 size_t buffer_size; 258 uint32_t buffer_free; 259 struct list_head todo; 260 wait_queue_head_t wait; 261 struct binder_stats stats; 262 struct list_head delivered_death; 263 int max_threads; 264 int requested_threads; 265 int requested_threads_started; 266 int ready_threads; 267 long default_priority; 268}; 269 270enum { 271 BINDER_LOOPER_STATE_REGISTERED = 0x01, 272 BINDER_LOOPER_STATE_ENTERED = 0x02, 273 BINDER_LOOPER_STATE_EXITED = 0x04, 274 BINDER_LOOPER_STATE_INVALID = 0x08, 275 BINDER_LOOPER_STATE_WAITING = 0x10, 276 BINDER_LOOPER_STATE_NEED_RETURN = 0x20 277}; 278 279struct binder_thread { 280 struct binder_proc *proc; 281 struct rb_node rb_node; 282 int pid; 283 int looper; 284 struct binder_transaction *transaction_stack; 285 struct list_head todo; 286 uint32_t return_error; /* Write failed, return error code in read buf */ 287 uint32_t return_error2; /* Write failed, return error code in read */ 288 /* buffer. Used when sending a reply to a dead process that */ 289 /* we are also waiting on */ 290 wait_queue_head_t wait; 291 struct binder_stats stats; 292}; 293 294struct binder_transaction { 295 int debug_id; 296 struct binder_work work; 297 struct binder_thread *from; 298 struct binder_transaction *from_parent; 299 struct binder_proc *to_proc; 300 struct binder_thread *to_thread; 301 struct binder_transaction *to_parent; 302 unsigned need_reply : 1; 303 /*unsigned is_dead : 1;*/ /* not used at the moment */ 304 305 struct binder_buffer *buffer; 306 unsigned int code; 307 unsigned int flags; 308 long priority; 309 long saved_priority; 310 uid_t sender_euid; 311}; 312 313/* 314 * copied from get_unused_fd_flags 315 */ 316int task_get_unused_fd_flags(struct binder_proc *proc, int flags) 317{ 318 struct files_struct *files = proc->files; 319 int fd, error; 320 struct fdtable *fdt; 321 unsigned long rlim_cur; 322 unsigned long irqs; 323 324 if (files == NULL) 325 return -ESRCH; 326 327 error = -EMFILE; 328 spin_lock(&files->file_lock); 329 330repeat: 331 fdt = files_fdtable(files); 332 fd = find_next_zero_bit(fdt->open_fds->fds_bits, fdt->max_fds, 333 files->next_fd); 334 335 /* 336 * N.B. For clone tasks sharing a files structure, this test 337 * will limit the total number of files that can be opened. 338 */ 339 rlim_cur = 0; 340 if (lock_task_sighand(proc->tsk, &irqs)) { 341 rlim_cur = proc->tsk->signal->rlim[RLIMIT_NOFILE].rlim_cur; 342 unlock_task_sighand(proc->tsk, &irqs); 343 } 344 if (fd >= rlim_cur) 345 goto out; 346 347 /* Do we need to expand the fd array or fd set? */ 348 error = expand_files(files, fd); 349 if (error < 0) 350 goto out; 351 352 if (error) { 353 /* 354 * If we needed to expand the fs array we 355 * might have blocked - try again. 356 */ 357 error = -EMFILE; 358 goto repeat; 359 } 360 361 FD_SET(fd, fdt->open_fds); 362 if (flags & O_CLOEXEC) 363 FD_SET(fd, fdt->close_on_exec); 364 else 365 FD_CLR(fd, fdt->close_on_exec); 366 files->next_fd = fd + 1; 367#if 1 368 /* Sanity check */ 369 if (fdt->fd[fd] != NULL) { 370 printk(KERN_WARNING "get_unused_fd: slot %d not NULL!\n", fd); 371 fdt->fd[fd] = NULL; 372 } 373#endif 374 error = fd; 375 376out: 377 spin_unlock(&files->file_lock); 378 return error; 379} 380 381/* 382 * copied from fd_install 383 */ 384static void task_fd_install( 385 struct binder_proc *proc, unsigned int fd, struct file *file) 386{ 387 struct files_struct *files = proc->files; 388 struct fdtable *fdt; 389 390 if (files == NULL) 391 return; 392 393 spin_lock(&files->file_lock); 394 fdt = files_fdtable(files); 395 BUG_ON(fdt->fd[fd] != NULL); 396 rcu_assign_pointer(fdt->fd[fd], file); 397 spin_unlock(&files->file_lock); 398} 399 400/* 401 * copied from __put_unused_fd in open.c 402 */ 403static void __put_unused_fd(struct files_struct *files, unsigned int fd) 404{ 405 struct fdtable *fdt = files_fdtable(files); 406 __FD_CLR(fd, fdt->open_fds); 407 if (fd < files->next_fd) 408 files->next_fd = fd; 409} 410 411/* 412 * copied from sys_close 413 */ 414static long task_close_fd(struct binder_proc *proc, unsigned int fd) 415{ 416 struct file *filp; 417 struct files_struct *files = proc->files; 418 struct fdtable *fdt; 419 int retval; 420 421 if (files == NULL) 422 return -ESRCH; 423 424 spin_lock(&files->file_lock); 425 fdt = files_fdtable(files); 426 if (fd >= fdt->max_fds) 427 goto out_unlock; 428 filp = fdt->fd[fd]; 429 if (!filp) 430 goto out_unlock; 431 rcu_assign_pointer(fdt->fd[fd], NULL); 432 FD_CLR(fd, fdt->close_on_exec); 433 __put_unused_fd(files, fd); 434 spin_unlock(&files->file_lock); 435 retval = filp_close(filp, files); 436 437 /* can't restart close syscall because file table entry was cleared */ 438 if (unlikely(retval == -ERESTARTSYS || 439 retval == -ERESTARTNOINTR || 440 retval == -ERESTARTNOHAND || 441 retval == -ERESTART_RESTARTBLOCK)) 442 retval = -EINTR; 443 444 return retval; 445 446out_unlock: 447 spin_unlock(&files->file_lock); 448 return -EBADF; 449} 450 451static void binder_set_nice(long nice) 452{ 453 long min_nice; 454 if (can_nice(current, nice)) { 455 set_user_nice(current, nice); 456 return; 457 } 458 min_nice = 20 - current->signal->rlim[RLIMIT_NICE].rlim_cur; 459 if (binder_debug_mask & BINDER_DEBUG_PRIORITY_CAP) 460 printk(KERN_INFO "binder: %d: nice value %ld not allowed use " 461 "%ld instead\n", current->pid, nice, min_nice); 462 set_user_nice(current, min_nice); 463 if (min_nice < 20) 464 return; 465 binder_user_error("binder: %d RLIMIT_NICE not set\n", current->pid); 466} 467 468static size_t binder_buffer_size( 469 struct binder_proc *proc, struct binder_buffer *buffer) 470{ 471 if (list_is_last(&buffer->entry, &proc->buffers)) 472 return proc->buffer + proc->buffer_size - (void *)buffer->data; 473 else 474 return (size_t)list_entry(buffer->entry.next, 475 struct binder_buffer, entry) - (size_t)buffer->data; 476} 477 478static void binder_insert_free_buffer( 479 struct binder_proc *proc, struct binder_buffer *new_buffer) 480{ 481 struct rb_node **p = &proc->free_buffers.rb_node; 482 struct rb_node *parent = NULL; 483 struct binder_buffer *buffer; 484 size_t buffer_size; 485 size_t new_buffer_size; 486 487 BUG_ON(!new_buffer->free); 488 489 new_buffer_size = binder_buffer_size(proc, new_buffer); 490 491 if (binder_debug_mask & BINDER_DEBUG_BUFFER_ALLOC) 492 printk(KERN_INFO "binder: %d: add free buffer, size %zd, " 493 "at %p\n", proc->pid, new_buffer_size, new_buffer); 494 495 while (*p) { 496 parent = *p; 497 buffer = rb_entry(parent, struct binder_buffer, rb_node); 498 BUG_ON(!buffer->free); 499 500 buffer_size = binder_buffer_size(proc, buffer); 501 502 if (new_buffer_size < buffer_size) 503 p = &parent->rb_left; 504 else 505 p = &parent->rb_right; 506 } 507 rb_link_node(&new_buffer->rb_node, parent, p); 508 rb_insert_color(&new_buffer->rb_node, &proc->free_buffers); 509} 510 511static void binder_insert_allocated_buffer( 512 struct binder_proc *proc, struct binder_buffer *new_buffer) 513{ 514 struct rb_node **p = &proc->allocated_buffers.rb_node; 515 struct rb_node *parent = NULL; 516 struct binder_buffer *buffer; 517 518 BUG_ON(new_buffer->free); 519 520 while (*p) { 521 parent = *p; 522 buffer = rb_entry(parent, struct binder_buffer, rb_node); 523 BUG_ON(buffer->free); 524 525 if (new_buffer < buffer) 526 p = &parent->rb_left; 527 else if (new_buffer > buffer) 528 p = &parent->rb_right; 529 else 530 BUG(); 531 } 532 rb_link_node(&new_buffer->rb_node, parent, p); 533 rb_insert_color(&new_buffer->rb_node, &proc->allocated_buffers); 534} 535 536static struct binder_buffer *binder_buffer_lookup( 537 struct binder_proc *proc, void __user *user_ptr) 538{ 539 struct rb_node *n = proc->allocated_buffers.rb_node; 540 struct binder_buffer *buffer; 541 struct binder_buffer *kern_ptr; 542 543 kern_ptr = user_ptr - proc->user_buffer_offset 544 - offsetof(struct binder_buffer, data); 545 546 while (n) { 547 buffer = rb_entry(n, struct binder_buffer, rb_node); 548 BUG_ON(buffer->free); 549 550 if (kern_ptr < buffer) 551 n = n->rb_left; 552 else if (kern_ptr > buffer) 553 n = n->rb_right; 554 else 555 return buffer; 556 } 557 return NULL; 558} 559 560static int binder_update_page_range(struct binder_proc *proc, int allocate, 561 void *start, void *end, struct vm_area_struct *vma) 562{ 563 void *page_addr; 564 unsigned long user_page_addr; 565 struct vm_struct tmp_area; 566 struct page **page; 567 struct mm_struct *mm; 568 569 if (binder_debug_mask & BINDER_DEBUG_BUFFER_ALLOC) 570 printk(KERN_INFO "binder: %d: %s pages %p-%p\n", 571 proc->pid, allocate ? "allocate" : "free", start, end); 572 573 if (end <= start) 574 return 0; 575 576 if (vma) 577 mm = NULL; 578 else 579 mm = get_task_mm(proc->tsk); 580 581 if (mm) { 582 down_write(&mm->mmap_sem); 583 vma = proc->vma; 584 } 585 586 if (allocate == 0) 587 goto free_range; 588 589 if (vma == NULL) { 590 printk(KERN_ERR "binder: %d: binder_alloc_buf failed to " 591 "map pages in userspace, no vma\n", proc->pid); 592 goto err_no_vma; 593 } 594 595 for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) { 596 int ret; 597 struct page **page_array_ptr; 598 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 599 600 BUG_ON(*page); 601 *page = alloc_page(GFP_KERNEL | __GFP_ZERO); 602 if (*page == NULL) { 603 printk(KERN_ERR "binder: %d: binder_alloc_buf failed " 604 "for page at %p\n", proc->pid, page_addr); 605 goto err_alloc_page_failed; 606 } 607 tmp_area.addr = page_addr; 608 tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */; 609 page_array_ptr = page; 610 ret = map_vm_area(&tmp_area, PAGE_KERNEL, &page_array_ptr); 611 if (ret) { 612 printk(KERN_ERR "binder: %d: binder_alloc_buf failed " 613 "to map page at %p in kernel\n", 614 proc->pid, page_addr); 615 goto err_map_kernel_failed; 616 } 617 user_page_addr = (size_t)page_addr + proc->user_buffer_offset; 618 ret = vm_insert_page(vma, user_page_addr, page[0]); 619 if (ret) { 620 printk(KERN_ERR "binder: %d: binder_alloc_buf failed " 621 "to map page at %lx in userspace\n", 622 proc->pid, user_page_addr); 623 goto err_vm_insert_page_failed; 624 } 625 /* vm_insert_page does not seem to increment the refcount */ 626 } 627 if (mm) { 628 up_write(&mm->mmap_sem); 629 mmput(mm); 630 } 631 return 0; 632 633free_range: 634 for (page_addr = end - PAGE_SIZE; page_addr >= start; 635 page_addr -= PAGE_SIZE) { 636 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 637 if (vma) 638 zap_page_range(vma, (size_t)page_addr + 639 proc->user_buffer_offset, PAGE_SIZE, NULL); 640err_vm_insert_page_failed: 641 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE); 642err_map_kernel_failed: 643 __free_page(*page); 644 *page = NULL; 645err_alloc_page_failed: 646 ; 647 } 648err_no_vma: 649 if (mm) { 650 up_write(&mm->mmap_sem); 651 mmput(mm); 652 } 653 return -ENOMEM; 654} 655 656static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc, 657 size_t data_size, size_t offsets_size, int is_async) 658{ 659 struct rb_node *n = proc->free_buffers.rb_node; 660 struct binder_buffer *buffer; 661 size_t buffer_size; 662 struct rb_node *best_fit = NULL; 663 void *has_page_addr; 664 void *end_page_addr; 665 size_t size; 666 667 if (proc->vma == NULL) { 668 printk(KERN_ERR "binder: %d: binder_alloc_buf, no vma\n", 669 proc->pid); 670 return NULL; 671 } 672 673 size = ALIGN(data_size, sizeof(void *)) + 674 ALIGN(offsets_size, sizeof(void *)); 675 676 if (size < data_size || size < offsets_size) { 677 binder_user_error("binder: %d: got transaction with invalid " 678 "size %zd-%zd\n", proc->pid, data_size, offsets_size); 679 return NULL; 680 } 681 682 if (is_async && 683 proc->free_async_space < size + sizeof(struct binder_buffer)) { 684 if (binder_debug_mask & BINDER_DEBUG_BUFFER_ALLOC) 685 printk(KERN_ERR "binder: %d: binder_alloc_buf size %zd f" 686 "ailed, no async space left\n", proc->pid, size); 687 return NULL; 688 } 689 690 while (n) { 691 buffer = rb_entry(n, struct binder_buffer, rb_node); 692 BUG_ON(!buffer->free); 693 buffer_size = binder_buffer_size(proc, buffer); 694 695 if (size < buffer_size) { 696 best_fit = n; 697 n = n->rb_left; 698 } else if (size > buffer_size) 699 n = n->rb_right; 700 else { 701 best_fit = n; 702 break; 703 } 704 } 705 if (best_fit == NULL) { 706 printk(KERN_ERR "binder: %d: binder_alloc_buf size %zd failed, " 707 "no address space\n", proc->pid, size); 708 return NULL; 709 } 710 if (n == NULL) { 711 buffer = rb_entry(best_fit, struct binder_buffer, rb_node); 712 buffer_size = binder_buffer_size(proc, buffer); 713 } 714 if (binder_debug_mask & BINDER_DEBUG_BUFFER_ALLOC) 715 printk(KERN_INFO "binder: %d: binder_alloc_buf size %zd got buff" 716 "er %p size %zd\n", proc->pid, size, buffer, buffer_size); 717 718 has_page_addr = 719 (void *)(((size_t)buffer->data + buffer_size) & PAGE_MASK); 720 if (n == NULL) { 721 if (size + sizeof(struct binder_buffer) + 4 >= buffer_size) 722 buffer_size = size; /* no room for other buffers */ 723 else 724 buffer_size = size + sizeof(struct binder_buffer); 725 } 726 end_page_addr = (void *)PAGE_ALIGN((size_t)buffer->data + buffer_size); 727 if (end_page_addr > has_page_addr) 728 end_page_addr = has_page_addr; 729 if (binder_update_page_range(proc, 1, 730 (void *)PAGE_ALIGN((size_t)buffer->data), end_page_addr, NULL)) 731 return NULL; 732 733 rb_erase(best_fit, &proc->free_buffers); 734 buffer->free = 0; 735 binder_insert_allocated_buffer(proc, buffer); 736 if (buffer_size != size) { 737 struct binder_buffer *new_buffer = (void *)buffer->data + size; 738 list_add(&new_buffer->entry, &buffer->entry); 739 new_buffer->free = 1; 740 binder_insert_free_buffer(proc, new_buffer); 741 } 742 if (binder_debug_mask & BINDER_DEBUG_BUFFER_ALLOC) 743 printk(KERN_INFO "binder: %d: binder_alloc_buf size %zd got " 744 "%p\n", proc->pid, size, buffer); 745 buffer->data_size = data_size; 746 buffer->offsets_size = offsets_size; 747 buffer->async_transaction = is_async; 748 if (is_async) { 749 proc->free_async_space -= size + sizeof(struct binder_buffer); 750 if (binder_debug_mask & BINDER_DEBUG_BUFFER_ALLOC_ASYNC) 751 printk(KERN_INFO "binder: %d: binder_alloc_buf size %zd " 752 "async free %zd\n", proc->pid, size, 753 proc->free_async_space); 754 } 755 756 return buffer; 757} 758 759static void *buffer_start_page(struct binder_buffer *buffer) 760{ 761 return (void *)((size_t)buffer & PAGE_MASK); 762} 763 764static void *buffer_end_page(struct binder_buffer *buffer) 765{ 766 return (void *)(((size_t)(buffer + 1) - 1) & PAGE_MASK); 767} 768 769static void binder_delete_free_buffer( 770 struct binder_proc *proc, struct binder_buffer *buffer) 771{ 772 struct binder_buffer *prev, *next = NULL; 773 int free_page_end = 1; 774 int free_page_start = 1; 775 776 BUG_ON(proc->buffers.next == &buffer->entry); 777 prev = list_entry(buffer->entry.prev, struct binder_buffer, entry); 778 BUG_ON(!prev->free); 779 if (buffer_end_page(prev) == buffer_start_page(buffer)) { 780 free_page_start = 0; 781 if (buffer_end_page(prev) == buffer_end_page(buffer)) 782 free_page_end = 0; 783 if (binder_debug_mask & BINDER_DEBUG_BUFFER_ALLOC) 784 printk(KERN_INFO "binder: %d: merge free, buffer %p " 785 "share page with %p\n", proc->pid, buffer, prev); 786 } 787 788 if (!list_is_last(&buffer->entry, &proc->buffers)) { 789 next = list_entry(buffer->entry.next, 790 struct binder_buffer, entry); 791 if (buffer_start_page(next) == buffer_end_page(buffer)) { 792 free_page_end = 0; 793 if (buffer_start_page(next) == 794 buffer_start_page(buffer)) 795 free_page_start = 0; 796 if (binder_debug_mask & BINDER_DEBUG_BUFFER_ALLOC) 797 printk(KERN_INFO "binder: %d: merge free, " 798 "buffer %p share page with %p\n", 799 proc->pid, buffer, prev); 800 } 801 } 802 list_del(&buffer->entry); 803 if (free_page_start || free_page_end) { 804 if (binder_debug_mask & BINDER_DEBUG_BUFFER_ALLOC) 805 printk(KERN_INFO "binder: %d: merge free, buffer %p do " 806 "not share page%s%s with with %p or %p\n", 807 proc->pid, buffer, free_page_start ? "" : " end", 808 free_page_end ? "" : " start", prev, next); 809 binder_update_page_range(proc, 0, free_page_start ? 810 buffer_start_page(buffer) : buffer_end_page(buffer), 811 (free_page_end ? buffer_end_page(buffer) : 812 buffer_start_page(buffer)) + PAGE_SIZE, NULL); 813 } 814} 815 816static void binder_free_buf( 817 struct binder_proc *proc, struct binder_buffer *buffer) 818{ 819 size_t size, buffer_size; 820 821 buffer_size = binder_buffer_size(proc, buffer); 822 823 size = ALIGN(buffer->data_size, sizeof(void *)) + 824 ALIGN(buffer->offsets_size, sizeof(void *)); 825 if (binder_debug_mask & BINDER_DEBUG_BUFFER_ALLOC) 826 printk(KERN_INFO "binder: %d: binder_free_buf %p size %zd buffer" 827 "_size %zd\n", proc->pid, buffer, size, buffer_size); 828 829 BUG_ON(buffer->free); 830 BUG_ON(size > buffer_size); 831 BUG_ON(buffer->transaction != NULL); 832 BUG_ON((void *)buffer < proc->buffer); 833 BUG_ON((void *)buffer > proc->buffer + proc->buffer_size); 834 835 if (buffer->async_transaction) { 836 proc->free_async_space += size + sizeof(struct binder_buffer); 837 if (binder_debug_mask & BINDER_DEBUG_BUFFER_ALLOC_ASYNC) 838 printk(KERN_INFO "binder: %d: binder_free_buf size %zd " 839 "async free %zd\n", proc->pid, size, 840 proc->free_async_space); 841 } 842 843 binder_update_page_range(proc, 0, 844 (void *)PAGE_ALIGN((size_t)buffer->data), 845 (void *)(((size_t)buffer->data + buffer_size) & PAGE_MASK), 846 NULL); 847 rb_erase(&buffer->rb_node, &proc->allocated_buffers); 848 buffer->free = 1; 849 if (!list_is_last(&buffer->entry, &proc->buffers)) { 850 struct binder_buffer *next = list_entry(buffer->entry.next, 851 struct binder_buffer, entry); 852 if (next->free) { 853 rb_erase(&next->rb_node, &proc->free_buffers); 854 binder_delete_free_buffer(proc, next); 855 } 856 } 857 if (proc->buffers.next != &buffer->entry) { 858 struct binder_buffer *prev = list_entry(buffer->entry.prev, 859 struct binder_buffer, entry); 860 if (prev->free) { 861 binder_delete_free_buffer(proc, buffer); 862 rb_erase(&prev->rb_node, &proc->free_buffers); 863 buffer = prev; 864 } 865 } 866 binder_insert_free_buffer(proc, buffer); 867} 868 869static struct binder_node * 870binder_get_node(struct binder_proc *proc, void __user *ptr) 871{ 872 struct rb_node *n = proc->nodes.rb_node; 873 struct binder_node *node; 874 875 while (n) { 876 node = rb_entry(n, struct binder_node, rb_node); 877 878 if (ptr < node->ptr) 879 n = n->rb_left; 880 else if (ptr > node->ptr) 881 n = n->rb_right; 882 else 883 return node; 884 } 885 return NULL; 886} 887 888static struct binder_node * 889binder_new_node(struct binder_proc *proc, void __user *ptr, void __user *cookie) 890{ 891 struct rb_node **p = &proc->nodes.rb_node; 892 struct rb_node *parent = NULL; 893 struct binder_node *node; 894 895 while (*p) { 896 parent = *p; 897 node = rb_entry(parent, struct binder_node, rb_node); 898 899 if (ptr < node->ptr) 900 p = &(*p)->rb_left; 901 else if (ptr > node->ptr) 902 p = &(*p)->rb_right; 903 else 904 return NULL; 905 } 906 907 node = kzalloc(sizeof(*node), GFP_KERNEL); 908 if (node == NULL) 909 return NULL; 910 binder_stats.obj_created[BINDER_STAT_NODE]++; 911 rb_link_node(&node->rb_node, parent, p); 912 rb_insert_color(&node->rb_node, &proc->nodes); 913 node->debug_id = ++binder_last_id; 914 node->proc = proc; 915 node->ptr = ptr; 916 node->cookie = cookie; 917 node->work.type = BINDER_WORK_NODE; 918 INIT_LIST_HEAD(&node->work.entry); 919 INIT_LIST_HEAD(&node->async_todo); 920 if (binder_debug_mask & BINDER_DEBUG_INTERNAL_REFS) 921 printk(KERN_INFO "binder: %d:%d node %d u%p c%p created\n", 922 proc->pid, current->pid, node->debug_id, 923 node->ptr, node->cookie); 924 return node; 925} 926 927static int 928binder_inc_node(struct binder_node *node, int strong, int internal, 929 struct list_head *target_list) 930{ 931 if (strong) { 932 if (internal) { 933 if (target_list == NULL && 934 node->internal_strong_refs == 0 && 935 !(node == binder_context_mgr_node && 936 node->has_strong_ref)) { 937 printk(KERN_ERR "binder: invalid inc strong " 938 "node for %d\n", node->debug_id); 939 return -EINVAL; 940 } 941 node->internal_strong_refs++; 942 } else 943 node->local_strong_refs++; 944 if (!node->has_strong_ref && target_list) { 945 list_del_init(&node->work.entry); 946 list_add_tail(&node->work.entry, target_list); 947 } 948 } else { 949 if (!internal) 950 node->local_weak_refs++; 951 if (!node->has_weak_ref && list_empty(&node->work.entry)) { 952 if (target_list == NULL) { 953 printk(KERN_ERR "binder: invalid inc weak node " 954 "for %d\n", node->debug_id); 955 return -EINVAL; 956 } 957 list_add_tail(&node->work.entry, target_list); 958 } 959 } 960 return 0; 961} 962 963static int 964binder_dec_node(struct binder_node *node, int strong, int internal) 965{ 966 if (strong) { 967 if (internal) 968 node->internal_strong_refs--; 969 else 970 node->local_strong_refs--; 971 if (node->local_strong_refs || node->internal_strong_refs) 972 return 0; 973 } else { 974 if (!internal) 975 node->local_weak_refs--; 976 if (node->local_weak_refs || !hlist_empty(&node->refs)) 977 return 0; 978 } 979 if (node->proc && (node->has_strong_ref || node->has_weak_ref)) { 980 if (list_empty(&node->work.entry)) { 981 list_add_tail(&node->work.entry, &node->proc->todo); 982 wake_up_interruptible(&node->proc->wait); 983 } 984 } else { 985 if (hlist_empty(&node->refs) && !node->local_strong_refs && 986 !node->local_weak_refs) { 987 list_del_init(&node->work.entry); 988 if (node->proc) { 989 rb_erase(&node->rb_node, &node->proc->nodes); 990 if (binder_debug_mask & BINDER_DEBUG_INTERNAL_REFS) 991 printk(KERN_INFO "binder: refless node %d deleted\n", node->debug_id); 992 } else { 993 hlist_del(&node->dead_node); 994 if (binder_debug_mask & BINDER_DEBUG_INTERNAL_REFS) 995 printk(KERN_INFO "binder: dead node %d deleted\n", node->debug_id); 996 } 997 kfree(node); 998 binder_stats.obj_deleted[BINDER_STAT_NODE]++; 999 } 1000 } 1001 1002 return 0; 1003} 1004 1005 1006static struct binder_ref * 1007binder_get_ref(struct binder_proc *proc, uint32_t desc) 1008{ 1009 struct rb_node *n = proc->refs_by_desc.rb_node; 1010 struct binder_ref *ref; 1011 1012 while (n) { 1013 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1014 1015 if (desc < ref->desc) 1016 n = n->rb_left; 1017 else if (desc > ref->desc) 1018 n = n->rb_right; 1019 else 1020 return ref; 1021 } 1022 return NULL; 1023} 1024 1025static struct binder_ref * 1026binder_get_ref_for_node(struct binder_proc *proc, struct binder_node *node) 1027{ 1028 struct rb_node *n; 1029 struct rb_node **p = &proc->refs_by_node.rb_node; 1030 struct rb_node *parent = NULL; 1031 struct binder_ref *ref, *new_ref; 1032 1033 while (*p) { 1034 parent = *p; 1035 ref = rb_entry(parent, struct binder_ref, rb_node_node); 1036 1037 if (node < ref->node) 1038 p = &(*p)->rb_left; 1039 else if (node > ref->node) 1040 p = &(*p)->rb_right; 1041 else 1042 return ref; 1043 } 1044 new_ref = kzalloc(sizeof(*ref), GFP_KERNEL); 1045 if (new_ref == NULL) 1046 return NULL; 1047 binder_stats.obj_created[BINDER_STAT_REF]++; 1048 new_ref->debug_id = ++binder_last_id; 1049 new_ref->proc = proc; 1050 new_ref->node = node; 1051 rb_link_node(&new_ref->rb_node_node, parent, p); 1052 rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node); 1053 1054 new_ref->desc = (node == binder_context_mgr_node) ? 0 : 1; 1055 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 1056 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1057 if (ref->desc > new_ref->desc) 1058 break; 1059 new_ref->desc = ref->desc + 1; 1060 } 1061 1062 p = &proc->refs_by_desc.rb_node; 1063 while (*p) { 1064 parent = *p; 1065 ref = rb_entry(parent, struct binder_ref, rb_node_desc); 1066 1067 if (new_ref->desc < ref->desc) 1068 p = &(*p)->rb_left; 1069 else if (new_ref->desc > ref->desc) 1070 p = &(*p)->rb_right; 1071 else 1072 BUG(); 1073 } 1074 rb_link_node(&new_ref->rb_node_desc, parent, p); 1075 rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc); 1076 if (node) { 1077 hlist_add_head(&new_ref->node_entry, &node->refs); 1078 if (binder_debug_mask & BINDER_DEBUG_INTERNAL_REFS) 1079 printk(KERN_INFO "binder: %d new ref %d desc %d for " 1080 "node %d\n", proc->pid, new_ref->debug_id, 1081 new_ref->desc, node->debug_id); 1082 } else { 1083 if (binder_debug_mask & BINDER_DEBUG_INTERNAL_REFS) 1084 printk(KERN_INFO "binder: %d new ref %d desc %d for " 1085 "dead node\n", proc->pid, new_ref->debug_id, 1086 new_ref->desc); 1087 } 1088 return new_ref; 1089} 1090 1091static void 1092binder_delete_ref(struct binder_ref *ref) 1093{ 1094 if (binder_debug_mask & BINDER_DEBUG_INTERNAL_REFS) 1095 printk(KERN_INFO "binder: %d delete ref %d desc %d for " 1096 "node %d\n", ref->proc->pid, ref->debug_id, 1097 ref->desc, ref->node->debug_id); 1098 rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc); 1099 rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node); 1100 if (ref->strong) 1101 binder_dec_node(ref->node, 1, 1); 1102 hlist_del(&ref->node_entry); 1103 binder_dec_node(ref->node, 0, 1); 1104 if (ref->death) { 1105 if (binder_debug_mask & BINDER_DEBUG_DEAD_BINDER) 1106 printk(KERN_INFO "binder: %d delete ref %d desc %d " 1107 "has death notification\n", ref->proc->pid, 1108 ref->debug_id, ref->desc); 1109 list_del(&ref->death->work.entry); 1110 kfree(ref->death); 1111 binder_stats.obj_deleted[BINDER_STAT_DEATH]++; 1112 } 1113 kfree(ref); 1114 binder_stats.obj_deleted[BINDER_STAT_REF]++; 1115} 1116 1117static int 1118binder_inc_ref( 1119 struct binder_ref *ref, int strong, struct list_head *target_list) 1120{ 1121 int ret; 1122 if (strong) { 1123 if (ref->strong == 0) { 1124 ret = binder_inc_node(ref->node, 1, 1, target_list); 1125 if (ret) 1126 return ret; 1127 } 1128 ref->strong++; 1129 } else { 1130 if (ref->weak == 0) { 1131 ret = binder_inc_node(ref->node, 0, 1, target_list); 1132 if (ret) 1133 return ret; 1134 } 1135 ref->weak++; 1136 } 1137 return 0; 1138} 1139 1140 1141static int 1142binder_dec_ref(struct binder_ref *ref, int strong) 1143{ 1144 if (strong) { 1145 if (ref->strong == 0) { 1146 binder_user_error("binder: %d invalid dec strong, " 1147 "ref %d desc %d s %d w %d\n", 1148 ref->proc->pid, ref->debug_id, 1149 ref->desc, ref->strong, ref->weak); 1150 return -EINVAL; 1151 } 1152 ref->strong--; 1153 if (ref->strong == 0) { 1154 int ret; 1155 ret = binder_dec_node(ref->node, strong, 1); 1156 if (ret) 1157 return ret; 1158 } 1159 } else { 1160 if (ref->weak == 0) { 1161 binder_user_error("binder: %d invalid dec weak, " 1162 "ref %d desc %d s %d w %d\n", 1163 ref->proc->pid, ref->debug_id, 1164 ref->desc, ref->strong, ref->weak); 1165 return -EINVAL; 1166 } 1167 ref->weak--; 1168 } 1169 if (ref->strong == 0 && ref->weak == 0) 1170 binder_delete_ref(ref); 1171 return 0; 1172} 1173 1174static void 1175binder_pop_transaction( 1176 struct binder_thread *target_thread, struct binder_transaction *t) 1177{ 1178 if (target_thread) { 1179 BUG_ON(target_thread->transaction_stack != t); 1180 BUG_ON(target_thread->transaction_stack->from != target_thread); 1181 target_thread->transaction_stack = 1182 target_thread->transaction_stack->from_parent; 1183 t->from = NULL; 1184 } 1185 t->need_reply = 0; 1186 if (t->buffer) 1187 t->buffer->transaction = NULL; 1188 kfree(t); 1189 binder_stats.obj_deleted[BINDER_STAT_TRANSACTION]++; 1190} 1191 1192static void 1193binder_send_failed_reply(struct binder_transaction *t, uint32_t error_code) 1194{ 1195 struct binder_thread *target_thread; 1196 BUG_ON(t->flags & TF_ONE_WAY); 1197 while (1) { 1198 target_thread = t->from; 1199 if (target_thread) { 1200 if (target_thread->return_error != BR_OK && 1201 target_thread->return_error2 == BR_OK) { 1202 target_thread->return_error2 = 1203 target_thread->return_error; 1204 target_thread->return_error = BR_OK; 1205 } 1206 if (target_thread->return_error == BR_OK) { 1207 if (binder_debug_mask & BINDER_DEBUG_FAILED_TRANSACTION) 1208 printk(KERN_INFO "binder: send failed reply for transaction %d to %d:%d\n", 1209 t->debug_id, target_thread->proc->pid, target_thread->pid); 1210 1211 binder_pop_transaction(target_thread, t); 1212 target_thread->return_error = error_code; 1213 wake_up_interruptible(&target_thread->wait); 1214 } else { 1215 printk(KERN_ERR "binder: reply failed, target " 1216 "thread, %d:%d, has error code %d " 1217 "already\n", target_thread->proc->pid, 1218 target_thread->pid, 1219 target_thread->return_error); 1220 } 1221 return; 1222 } else { 1223 struct binder_transaction *next = t->from_parent; 1224 1225 if (binder_debug_mask & BINDER_DEBUG_FAILED_TRANSACTION) 1226 printk(KERN_INFO "binder: send failed reply " 1227 "for transaction %d, target dead\n", 1228 t->debug_id); 1229 1230 binder_pop_transaction(target_thread, t); 1231 if (next == NULL) { 1232 if (binder_debug_mask & BINDER_DEBUG_DEAD_BINDER) 1233 printk(KERN_INFO "binder: reply failed," 1234 " no target thread at root\n"); 1235 return; 1236 } 1237 t = next; 1238 if (binder_debug_mask & BINDER_DEBUG_DEAD_BINDER) 1239 printk(KERN_INFO "binder: reply failed, no targ" 1240 "et thread -- retry %d\n", t->debug_id); 1241 } 1242 } 1243} 1244 1245static void 1246binder_transaction_buffer_release(struct binder_proc *proc, 1247 struct binder_buffer *buffer, size_t *failed_at); 1248 1249static void 1250binder_transaction(struct binder_proc *proc, struct binder_thread *thread, 1251 struct binder_transaction_data *tr, int reply) 1252{ 1253 struct binder_transaction *t; 1254 struct binder_work *tcomplete; 1255 size_t *offp, *off_end; 1256 struct binder_proc *target_proc; 1257 struct binder_thread *target_thread = NULL; 1258 struct binder_node *target_node = NULL; 1259 struct list_head *target_list; 1260 wait_queue_head_t *target_wait; 1261 struct binder_transaction *in_reply_to = NULL; 1262 struct binder_transaction_log_entry *e; 1263 uint32_t return_error; 1264 1265 e = binder_transaction_log_add(&binder_transaction_log); 1266 e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY); 1267 e->from_proc = proc->pid; 1268 e->from_thread = thread->pid; 1269 e->target_handle = tr->target.handle; 1270 e->data_size = tr->data_size; 1271 e->offsets_size = tr->offsets_size; 1272 1273 if (reply) { 1274 in_reply_to = thread->transaction_stack; 1275 if (in_reply_to == NULL) { 1276 binder_user_error("binder: %d:%d got reply transaction " 1277 "with no transaction stack\n", 1278 proc->pid, thread->pid); 1279 return_error = BR_FAILED_REPLY; 1280 goto err_empty_call_stack; 1281 } 1282 binder_set_nice(in_reply_to->saved_priority); 1283 if (in_reply_to->to_thread != thread) { 1284 binder_user_error("binder: %d:%d got reply transaction " 1285 "with bad transaction stack," 1286 " transaction %d has target %d:%d\n", 1287 proc->pid, thread->pid, in_reply_to->debug_id, 1288 in_reply_to->to_proc ? 1289 in_reply_to->to_proc->pid : 0, 1290 in_reply_to->to_thread ? 1291 in_reply_to->to_thread->pid : 0); 1292 return_error = BR_FAILED_REPLY; 1293 in_reply_to = NULL; 1294 goto err_bad_call_stack; 1295 } 1296 thread->transaction_stack = in_reply_to->to_parent; 1297 target_thread = in_reply_to->from; 1298 if (target_thread == NULL) { 1299 return_error = BR_DEAD_REPLY; 1300 goto err_dead_binder; 1301 } 1302 if (target_thread->transaction_stack != in_reply_to) { 1303 binder_user_error("binder: %d:%d got reply transaction " 1304 "with bad target transaction stack %d, " 1305 "expected %d\n", 1306 proc->pid, thread->pid, 1307 target_thread->transaction_stack ? 1308 target_thread->transaction_stack->debug_id : 0, 1309 in_reply_to->debug_id); 1310 return_error = BR_FAILED_REPLY; 1311 in_reply_to = NULL; 1312 target_thread = NULL; 1313 goto err_dead_binder; 1314 } 1315 target_proc = target_thread->proc; 1316 } else { 1317 if (tr->target.handle) { 1318 struct binder_ref *ref; 1319 ref = binder_get_ref(proc, tr->target.handle); 1320 if (ref == NULL) { 1321 binder_user_error("binder: %d:%d got " 1322 "transaction to invalid handle\n", 1323 proc->pid, thread->pid); 1324 return_error = BR_FAILED_REPLY; 1325 goto err_invalid_target_handle; 1326 } 1327 target_node = ref->node; 1328 } else { 1329 target_node = binder_context_mgr_node; 1330 if (target_node == NULL) { 1331 return_error = BR_DEAD_REPLY; 1332 goto err_no_context_mgr_node; 1333 } 1334 } 1335 e->to_node = target_node->debug_id; 1336 target_proc = target_node->proc; 1337 if (target_proc == NULL) { 1338 return_error = BR_DEAD_REPLY; 1339 goto err_dead_binder; 1340 } 1341 if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) { 1342 struct binder_transaction *tmp; 1343 tmp = thread->transaction_stack; 1344 while (tmp) { 1345 if (tmp->from && tmp->from->proc == target_proc) 1346 target_thread = tmp->from; 1347 tmp = tmp->from_parent; 1348 } 1349 } 1350 } 1351 if (target_thread) { 1352 e->to_thread = target_thread->pid; 1353 target_list = &target_thread->todo; 1354 target_wait = &target_thread->wait; 1355 } else { 1356 target_list = &target_proc->todo; 1357 target_wait = &target_proc->wait; 1358 } 1359 e->to_proc = target_proc->pid; 1360 1361 /* TODO: reuse incoming transaction for reply */ 1362 t = kzalloc(sizeof(*t), GFP_KERNEL); 1363 if (t == NULL) { 1364 return_error = BR_FAILED_REPLY; 1365 goto err_alloc_t_failed; 1366 } 1367 binder_stats.obj_created[BINDER_STAT_TRANSACTION]++; 1368 1369 tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL); 1370 if (tcomplete == NULL) { 1371 return_error = BR_FAILED_REPLY; 1372 goto err_alloc_tcomplete_failed; 1373 } 1374 binder_stats.obj_created[BINDER_STAT_TRANSACTION_COMPLETE]++; 1375 1376 t->debug_id = ++binder_last_id; 1377 e->debug_id = t->debug_id; 1378 1379 if (binder_debug_mask & BINDER_DEBUG_TRANSACTION) { 1380 if (reply) 1381 printk(KERN_INFO "binder: %d:%d BC_REPLY %d -> %d:%d, " 1382 "data %p-%p size %zd-%zd\n", 1383 proc->pid, thread->pid, t->debug_id, 1384 target_proc->pid, target_thread->pid, 1385 tr->data.ptr.buffer, tr->data.ptr.offsets, 1386 tr->data_size, tr->offsets_size); 1387 else 1388 printk(KERN_INFO "binder: %d:%d BC_TRANSACTION %d -> " 1389 "%d - node %d, data %p-%p size %zd-%zd\n", 1390 proc->pid, thread->pid, t->debug_id, 1391 target_proc->pid, target_node->debug_id, 1392 tr->data.ptr.buffer, tr->data.ptr.offsets, 1393 tr->data_size, tr->offsets_size); 1394 } 1395 1396 if (!reply && !(tr->flags & TF_ONE_WAY)) 1397 t->from = thread; 1398 else 1399 t->from = NULL; 1400 t->sender_euid = proc->tsk->cred->euid; 1401 t->to_proc = target_proc; 1402 t->to_thread = target_thread; 1403 t->code = tr->code; 1404 t->flags = tr->flags; 1405 t->priority = task_nice(current); 1406 t->buffer = binder_alloc_buf(target_proc, tr->data_size, 1407 tr->offsets_size, !reply && (t->flags & TF_ONE_WAY)); 1408 if (t->buffer == NULL) { 1409 return_error = BR_FAILED_REPLY; 1410 goto err_binder_alloc_buf_failed; 1411 } 1412 t->buffer->allow_user_free = 0; 1413 t->buffer->debug_id = t->debug_id; 1414 t->buffer->transaction = t; 1415 t->buffer->target_node = target_node; 1416 if (target_node) 1417 binder_inc_node(target_node, 1, 0, NULL); 1418 1419 offp = (size_t *)(t->buffer->data + ALIGN(tr->data_size, sizeof(void *))); 1420 1421 if (copy_from_user(t->buffer->data, tr->data.ptr.buffer, tr->data_size)) { 1422 binder_user_error("binder: %d:%d got transaction with invalid " 1423 "data ptr\n", proc->pid, thread->pid); 1424 return_error = BR_FAILED_REPLY; 1425 goto err_copy_data_failed; 1426 } 1427 if (copy_from_user(offp, tr->data.ptr.offsets, tr->offsets_size)) { 1428 binder_user_error("binder: %d:%d got transaction with invalid " 1429 "offsets ptr\n", proc->pid, thread->pid); 1430 return_error = BR_FAILED_REPLY; 1431 goto err_copy_data_failed; 1432 } 1433 if (!IS_ALIGNED(tr->offsets_size, sizeof(size_t))) { 1434 binder_user_error("binder: %d:%d got transaction with " 1435 "invalid offsets size, %zd\n", 1436 proc->pid, thread->pid, tr->offsets_size); 1437 return_error = BR_FAILED_REPLY; 1438 goto err_bad_offset; 1439 } 1440 off_end = (void *)offp + tr->offsets_size; 1441 for (; offp < off_end; offp++) { 1442 struct flat_binder_object *fp; 1443 if (*offp > t->buffer->data_size - sizeof(*fp) || 1444 t->buffer->data_size < sizeof(*fp) || 1445 !IS_ALIGNED(*offp, sizeof(void *))) { 1446 binder_user_error("binder: %d:%d got transaction with " 1447 "invalid offset, %zd\n", 1448 proc->pid, thread->pid, *offp); 1449 return_error = BR_FAILED_REPLY; 1450 goto err_bad_offset; 1451 } 1452 fp = (struct flat_binder_object *)(t->buffer->data + *offp); 1453 switch (fp->type) { 1454 case BINDER_TYPE_BINDER: 1455 case BINDER_TYPE_WEAK_BINDER: { 1456 struct binder_ref *ref; 1457 struct binder_node *node = binder_get_node(proc, fp->binder); 1458 if (node == NULL) { 1459 node = binder_new_node(proc, fp->binder, fp->cookie); 1460 if (node == NULL) { 1461 return_error = BR_FAILED_REPLY; 1462 goto err_binder_new_node_failed; 1463 } 1464 node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK; 1465 node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS); 1466 } 1467 if (fp->cookie != node->cookie) { 1468 binder_user_error("binder: %d:%d sending u%p " 1469 "node %d, cookie mismatch %p != %p\n", 1470 proc->pid, thread->pid, 1471 fp->binder, node->debug_id, 1472 fp->cookie, node->cookie); 1473 goto err_binder_get_ref_for_node_failed; 1474 } 1475 ref = binder_get_ref_for_node(target_proc, node); 1476 if (ref == NULL) { 1477 return_error = BR_FAILED_REPLY; 1478 goto err_binder_get_ref_for_node_failed; 1479 } 1480 if (fp->type == BINDER_TYPE_BINDER) 1481 fp->type = BINDER_TYPE_HANDLE; 1482 else 1483 fp->type = BINDER_TYPE_WEAK_HANDLE; 1484 fp->handle = ref->desc; 1485 binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE, &thread->todo); 1486 if (binder_debug_mask & BINDER_DEBUG_TRANSACTION) 1487 printk(KERN_INFO " node %d u%p -> ref %d desc %d\n", 1488 node->debug_id, node->ptr, ref->debug_id, ref->desc); 1489 } break; 1490 case BINDER_TYPE_HANDLE: 1491 case BINDER_TYPE_WEAK_HANDLE: { 1492 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1493 if (ref == NULL) { 1494 binder_user_error("binder: %d:%d got " 1495 "transaction with invalid " 1496 "handle, %ld\n", proc->pid, 1497 thread->pid, fp->handle); 1498 return_error = BR_FAILED_REPLY; 1499 goto err_binder_get_ref_failed; 1500 } 1501 if (ref->node->proc == target_proc) { 1502 if (fp->type == BINDER_TYPE_HANDLE) 1503 fp->type = BINDER_TYPE_BINDER; 1504 else 1505 fp->type = BINDER_TYPE_WEAK_BINDER; 1506 fp->binder = ref->node->ptr; 1507 fp->cookie = ref->node->cookie; 1508 binder_inc_node(ref->node, fp->type == BINDER_TYPE_BINDER, 0, NULL); 1509 if (binder_debug_mask & BINDER_DEBUG_TRANSACTION) 1510 printk(KERN_INFO " ref %d desc %d -> node %d u%p\n", 1511 ref->debug_id, ref->desc, ref->node->debug_id, ref->node->ptr); 1512 } else { 1513 struct binder_ref *new_ref; 1514 new_ref = binder_get_ref_for_node(target_proc, ref->node); 1515 if (new_ref == NULL) { 1516 return_error = BR_FAILED_REPLY; 1517 goto err_binder_get_ref_for_node_failed; 1518 } 1519 fp->handle = new_ref->desc; 1520 binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL); 1521 if (binder_debug_mask & BINDER_DEBUG_TRANSACTION) 1522 printk(KERN_INFO " ref %d desc %d -> ref %d desc %d (node %d)\n", 1523 ref->debug_id, ref->desc, new_ref->debug_id, new_ref->desc, ref->node->debug_id); 1524 } 1525 } break; 1526 1527 case BINDER_TYPE_FD: { 1528 int target_fd; 1529 struct file *file; 1530 1531 if (reply) { 1532 if (!(in_reply_to->flags & TF_ACCEPT_FDS)) { 1533 binder_user_error("binder: %d:%d got reply with fd, %ld, but target does not allow fds\n", 1534 proc->pid, thread->pid, fp->handle); 1535 return_error = BR_FAILED_REPLY; 1536 goto err_fd_not_allowed; 1537 } 1538 } else if (!target_node->accept_fds) { 1539 binder_user_error("binder: %d:%d got transaction with fd, %ld, but target does not allow fds\n", 1540 proc->pid, thread->pid, fp->handle); 1541 return_error = BR_FAILED_REPLY; 1542 goto err_fd_not_allowed; 1543 } 1544 1545 file = fget(fp->handle); 1546 if (file == NULL) { 1547 binder_user_error("binder: %d:%d got transaction with invalid fd, %ld\n", 1548 proc->pid, thread->pid, fp->handle); 1549 return_error = BR_FAILED_REPLY; 1550 goto err_fget_failed; 1551 } 1552 target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC); 1553 if (target_fd < 0) { 1554 fput(file); 1555 return_error = BR_FAILED_REPLY; 1556 goto err_get_unused_fd_failed; 1557 } 1558 task_fd_install(target_proc, target_fd, file); 1559 if (binder_debug_mask & BINDER_DEBUG_TRANSACTION) 1560 printk(KERN_INFO " fd %ld -> %d\n", fp->handle, target_fd); 1561 /* TODO: fput? */ 1562 fp->handle = target_fd; 1563 } break; 1564 1565 default: 1566 binder_user_error("binder: %d:%d got transactio" 1567 "n with invalid object type, %lx\n", 1568 proc->pid, thread->pid, fp->type); 1569 return_error = BR_FAILED_REPLY; 1570 goto err_bad_object_type; 1571 } 1572 } 1573 if (reply) { 1574 BUG_ON(t->buffer->async_transaction != 0); 1575 binder_pop_transaction(target_thread, in_reply_to); 1576 } else if (!(t->flags & TF_ONE_WAY)) { 1577 BUG_ON(t->buffer->async_transaction != 0); 1578 t->need_reply = 1; 1579 t->from_parent = thread->transaction_stack; 1580 thread->transaction_stack = t; 1581 } else { 1582 BUG_ON(target_node == NULL); 1583 BUG_ON(t->buffer->async_transaction != 1); 1584 if (target_node->has_async_transaction) { 1585 target_list = &target_node->async_todo; 1586 target_wait = NULL; 1587 } else 1588 target_node->has_async_transaction = 1; 1589 } 1590 t->work.type = BINDER_WORK_TRANSACTION; 1591 list_add_tail(&t->work.entry, target_list); 1592 tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE; 1593 list_add_tail(&tcomplete->entry, &thread->todo); 1594 if (target_wait) 1595 wake_up_interruptible(target_wait); 1596 return; 1597 1598err_get_unused_fd_failed: 1599err_fget_failed: 1600err_fd_not_allowed: 1601err_binder_get_ref_for_node_failed: 1602err_binder_get_ref_failed: 1603err_binder_new_node_failed: 1604err_bad_object_type: 1605err_bad_offset: 1606err_copy_data_failed: 1607 binder_transaction_buffer_release(target_proc, t->buffer, offp); 1608 t->buffer->transaction = NULL; 1609 binder_free_buf(target_proc, t->buffer); 1610err_binder_alloc_buf_failed: 1611 kfree(tcomplete); 1612 binder_stats.obj_deleted[BINDER_STAT_TRANSACTION_COMPLETE]++; 1613err_alloc_tcomplete_failed: 1614 kfree(t); 1615 binder_stats.obj_deleted[BINDER_STAT_TRANSACTION]++; 1616err_alloc_t_failed: 1617err_bad_call_stack: 1618err_empty_call_stack: 1619err_dead_binder: 1620err_invalid_target_handle: 1621err_no_context_mgr_node: 1622 if (binder_debug_mask & BINDER_DEBUG_FAILED_TRANSACTION) 1623 printk(KERN_INFO "binder: %d:%d transaction failed %d, size" 1624 "%zd-%zd\n", 1625 proc->pid, thread->pid, return_error, 1626 tr->data_size, tr->offsets_size); 1627 1628 { 1629 struct binder_transaction_log_entry *fe; 1630 fe = binder_transaction_log_add(&binder_transaction_log_failed); 1631 *fe = *e; 1632 } 1633 1634 BUG_ON(thread->return_error != BR_OK); 1635 if (in_reply_to) { 1636 thread->return_error = BR_TRANSACTION_COMPLETE; 1637 binder_send_failed_reply(in_reply_to, return_error); 1638 } else 1639 thread->return_error = return_error; 1640} 1641 1642static void 1643binder_transaction_buffer_release(struct binder_proc *proc, struct binder_buffer *buffer, size_t *failed_at) 1644{ 1645 size_t *offp, *off_end; 1646 int debug_id = buffer->debug_id; 1647 1648 if (binder_debug_mask & BINDER_DEBUG_TRANSACTION) 1649 printk(KERN_INFO "binder: %d buffer release %d, size %zd-%zd, failed at %p\n", 1650 proc->pid, buffer->debug_id, 1651 buffer->data_size, buffer->offsets_size, failed_at); 1652 1653 if (buffer->target_node) 1654 binder_dec_node(buffer->target_node, 1, 0); 1655 1656 offp = (size_t *)(buffer->data + ALIGN(buffer->data_size, sizeof(void *))); 1657 if (failed_at) 1658 off_end = failed_at; 1659 else 1660 off_end = (void *)offp + buffer->offsets_size; 1661 for (; offp < off_end; offp++) { 1662 struct flat_binder_object *fp; 1663 if (*offp > buffer->data_size - sizeof(*fp) || 1664 buffer->data_size < sizeof(*fp) || 1665 !IS_ALIGNED(*offp, sizeof(void *))) { 1666 printk(KERN_ERR "binder: transaction release %d bad" 1667 "offset %zd, size %zd\n", debug_id, *offp, buffer->data_size); 1668 continue; 1669 } 1670 fp = (struct flat_binder_object *)(buffer->data + *offp); 1671 switch (fp->type) { 1672 case BINDER_TYPE_BINDER: 1673 case BINDER_TYPE_WEAK_BINDER: { 1674 struct binder_node *node = binder_get_node(proc, fp->binder); 1675 if (node == NULL) { 1676 printk(KERN_ERR "binder: transaction release %d bad node %p\n", debug_id, fp->binder); 1677 break; 1678 } 1679 if (binder_debug_mask & BINDER_DEBUG_TRANSACTION) 1680 printk(KERN_INFO " node %d u%p\n", 1681 node->debug_id, node->ptr); 1682 binder_dec_node(node, fp->type == BINDER_TYPE_BINDER, 0); 1683 } break; 1684 case BINDER_TYPE_HANDLE: 1685 case BINDER_TYPE_WEAK_HANDLE: { 1686 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1687 if (ref == NULL) { 1688 printk(KERN_ERR "binder: transaction release %d bad handle %ld\n", debug_id, fp->handle); 1689 break; 1690 } 1691 if (binder_debug_mask & BINDER_DEBUG_TRANSACTION) 1692 printk(KERN_INFO " ref %d desc %d (node %d)\n", 1693 ref->debug_id, ref->desc, ref->node->debug_id); 1694 binder_dec_ref(ref, fp->type == BINDER_TYPE_HANDLE); 1695 } break; 1696 1697 case BINDER_TYPE_FD: 1698 if (binder_debug_mask & BINDER_DEBUG_TRANSACTION) 1699 printk(KERN_INFO " fd %ld\n", fp->handle); 1700 if (failed_at) 1701 task_close_fd(proc, fp->handle); 1702 break; 1703 1704 default: 1705 printk(KERN_ERR "binder: transaction release %d bad object type %lx\n", debug_id, fp->type); 1706 break; 1707 } 1708 } 1709} 1710 1711int 1712binder_thread_write(struct binder_proc *proc, struct binder_thread *thread, 1713 void __user *buffer, int size, signed long *consumed) 1714{ 1715 uint32_t cmd; 1716 void __user *ptr = buffer + *consumed; 1717 void __user *end = buffer + size; 1718 1719 while (ptr < end && thread->return_error == BR_OK) { 1720 if (get_user(cmd, (uint32_t __user *)ptr)) 1721 return -EFAULT; 1722 ptr += sizeof(uint32_t); 1723 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) { 1724 binder_stats.bc[_IOC_NR(cmd)]++; 1725 proc->stats.bc[_IOC_NR(cmd)]++; 1726 thread->stats.bc[_IOC_NR(cmd)]++; 1727 } 1728 switch (cmd) { 1729 case BC_INCREFS: 1730 case BC_ACQUIRE: 1731 case BC_RELEASE: 1732 case BC_DECREFS: { 1733 uint32_t target; 1734 struct binder_ref *ref; 1735 const char *debug_string; 1736 1737 if (get_user(target, (uint32_t __user *)ptr)) 1738 return -EFAULT; 1739 ptr += sizeof(uint32_t); 1740 if (target == 0 && binder_context_mgr_node && 1741 (cmd == BC_INCREFS || cmd == BC_ACQUIRE)) { 1742 ref = binder_get_ref_for_node(proc, 1743 binder_context_mgr_node); 1744 if (ref->desc != target) { 1745 binder_user_error("binder: %d:" 1746 "%d tried to acquire " 1747 "reference to desc 0, " 1748 "got %d instead\n", 1749 proc->pid, thread->pid, 1750 ref->desc); 1751 } 1752 } else 1753 ref = binder_get_ref(proc, target); 1754 if (ref == NULL) { 1755 binder_user_error("binder: %d:%d refcou" 1756 "nt change on invalid ref %d\n", 1757 proc->pid, thread->pid, target); 1758 break; 1759 } 1760 switch (cmd) { 1761 case BC_INCREFS: 1762 debug_string = "IncRefs"; 1763 binder_inc_ref(ref, 0, NULL); 1764 break; 1765 case BC_ACQUIRE: 1766 debug_string = "Acquire"; 1767 binder_inc_ref(ref, 1, NULL); 1768 break; 1769 case BC_RELEASE: 1770 debug_string = "Release"; 1771 binder_dec_ref(ref, 1); 1772 break; 1773 case BC_DECREFS: 1774 default: 1775 debug_string = "DecRefs"; 1776 binder_dec_ref(ref, 0); 1777 break; 1778 } 1779 if (binder_debug_mask & BINDER_DEBUG_USER_REFS) 1780 printk(KERN_INFO "binder: %d:%d %s ref %d desc %d s %d w %d for node %d\n", 1781 proc->pid, thread->pid, debug_string, ref->debug_id, ref->desc, ref->strong, ref->weak, ref->node->debug_id); 1782 break; 1783 } 1784 case BC_INCREFS_DONE: 1785 case BC_ACQUIRE_DONE: { 1786 void __user *node_ptr; 1787 void *cookie; 1788 struct binder_node *node; 1789 1790 if (get_user(node_ptr, (void * __user *)ptr)) 1791 return -EFAULT; 1792 ptr += sizeof(void *); 1793 if (get_user(cookie, (void * __user *)ptr)) 1794 return -EFAULT; 1795 ptr += sizeof(void *); 1796 node = binder_get_node(proc, node_ptr); 1797 if (node == NULL) { 1798 binder_user_error("binder: %d:%d " 1799 "%s u%p no match\n", 1800 proc->pid, thread->pid, 1801 cmd == BC_INCREFS_DONE ? 1802 "BC_INCREFS_DONE" : 1803 "BC_ACQUIRE_DONE", 1804 node_ptr); 1805 break; 1806 } 1807 if (cookie != node->cookie) { 1808 binder_user_error("binder: %d:%d %s u%p node %d" 1809 " cookie mismatch %p != %p\n", 1810 proc->pid, thread->pid, 1811 cmd == BC_INCREFS_DONE ? 1812 "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1813 node_ptr, node->debug_id, 1814 cookie, node->cookie); 1815 break; 1816 } 1817 if (cmd == BC_ACQUIRE_DONE) { 1818 if (node->pending_strong_ref == 0) { 1819 binder_user_error("binder: %d:%d " 1820 "BC_ACQUIRE_DONE node %d has " 1821 "no pending acquire request\n", 1822 proc->pid, thread->pid, 1823 node->debug_id); 1824 break; 1825 } 1826 node->pending_strong_ref = 0; 1827 } else { 1828 if (node->pending_weak_ref == 0) { 1829 binder_user_error("binder: %d:%d " 1830 "BC_INCREFS_DONE node %d has " 1831 "no pending increfs request\n", 1832 proc->pid, thread->pid, 1833 node->debug_id); 1834 break; 1835 } 1836 node->pending_weak_ref = 0; 1837 } 1838 binder_dec_node(node, cmd == BC_ACQUIRE_DONE, 0); 1839 if (binder_debug_mask & BINDER_DEBUG_USER_REFS) 1840 printk(KERN_INFO "binder: %d:%d %s node %d ls %d lw %d\n", 1841 proc->pid, thread->pid, cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", node->debug_id, node->local_strong_refs, node->local_weak_refs); 1842 break; 1843 } 1844 case BC_ATTEMPT_ACQUIRE: 1845 printk(KERN_ERR "binder: BC_ATTEMPT_ACQUIRE not supported\n"); 1846 return -EINVAL; 1847 case BC_ACQUIRE_RESULT: 1848 printk(KERN_ERR "binder: BC_ACQUIRE_RESULT not supported\n"); 1849 return -EINVAL; 1850 1851 case BC_FREE_BUFFER: { 1852 void __user *data_ptr; 1853 struct binder_buffer *buffer; 1854 1855 if (get_user(data_ptr, (void * __user *)ptr)) 1856 return -EFAULT; 1857 ptr += sizeof(void *); 1858 1859 buffer = binder_buffer_lookup(proc, data_ptr); 1860 if (buffer == NULL) { 1861 binder_user_error("binder: %d:%d " 1862 "BC_FREE_BUFFER u%p no match\n", 1863 proc->pid, thread->pid, data_ptr); 1864 break; 1865 } 1866 if (!buffer->allow_user_free) { 1867 binder_user_error("binder: %d:%d " 1868 "BC_FREE_BUFFER u%p matched " 1869 "unreturned buffer\n", 1870 proc->pid, thread->pid, data_ptr); 1871 break; 1872 } 1873 if (binder_debug_mask & BINDER_DEBUG_FREE_BUFFER) 1874 printk(KERN_INFO "binder: %d:%d BC_FREE_BUFFER u%p found buffer %d for %s transaction\n", 1875 proc->pid, thread->pid, data_ptr, buffer->debug_id, 1876 buffer->transaction ? "active" : "finished"); 1877 1878 if (buffer->transaction) { 1879 buffer->transaction->buffer = NULL; 1880 buffer->transaction = NULL; 1881 } 1882 if (buffer->async_transaction && buffer->target_node) { 1883 BUG_ON(!buffer->target_node->has_async_transaction); 1884 if (list_empty(&buffer->target_node->async_todo)) 1885 buffer->target_node->has_async_transaction = 0; 1886 else 1887 list_move_tail(buffer->target_node->async_todo.next, &thread->todo); 1888 } 1889 binder_transaction_buffer_release(proc, buffer, NULL); 1890 binder_free_buf(proc, buffer); 1891 break; 1892 } 1893 1894 case BC_TRANSACTION: 1895 case BC_REPLY: { 1896 struct binder_transaction_data tr; 1897 1898 if (copy_from_user(&tr, ptr, sizeof(tr))) 1899 return -EFAULT; 1900 ptr += sizeof(tr); 1901 binder_transaction(proc, thread, &tr, cmd == BC_REPLY); 1902 break; 1903 } 1904 1905 case BC_REGISTER_LOOPER: 1906 if (binder_debug_mask & BINDER_DEBUG_THREADS) 1907 printk(KERN_INFO "binder: %d:%d BC_REGISTER_LOOPER\n", 1908 proc->pid, thread->pid); 1909 if (thread->looper & BINDER_LOOPER_STATE_ENTERED) { 1910 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1911 binder_user_error("binder: %d:%d ERROR:" 1912 " BC_REGISTER_LOOPER called " 1913 "after BC_ENTER_LOOPER\n", 1914 proc->pid, thread->pid); 1915 } else if (proc->requested_threads == 0) { 1916 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1917 binder_user_error("binder: %d:%d ERROR:" 1918 " BC_REGISTER_LOOPER called " 1919 "without request\n", 1920 proc->pid, thread->pid); 1921 } else { 1922 proc->requested_threads--; 1923 proc->requested_threads_started++; 1924 } 1925 thread->looper |= BINDER_LOOPER_STATE_REGISTERED; 1926 break; 1927 case BC_ENTER_LOOPER: 1928 if (binder_debug_mask & BINDER_DEBUG_THREADS) 1929 printk(KERN_INFO "binder: %d:%d BC_ENTER_LOOPER\n", 1930 proc->pid, thread->pid); 1931 if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) { 1932 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1933 binder_user_error("binder: %d:%d ERROR:" 1934 " BC_ENTER_LOOPER called after " 1935 "BC_REGISTER_LOOPER\n", 1936 proc->pid, thread->pid); 1937 } 1938 thread->looper |= BINDER_LOOPER_STATE_ENTERED; 1939 break; 1940 case BC_EXIT_LOOPER: 1941 if (binder_debug_mask & BINDER_DEBUG_THREADS) 1942 printk(KERN_INFO "binder: %d:%d BC_EXIT_LOOPER\n", 1943 proc->pid, thread->pid); 1944 thread->looper |= BINDER_LOOPER_STATE_EXITED; 1945 break; 1946 1947 case BC_REQUEST_DEATH_NOTIFICATION: 1948 case BC_CLEAR_DEATH_NOTIFICATION: { 1949 uint32_t target; 1950 void __user *cookie; 1951 struct binder_ref *ref; 1952 struct binder_ref_death *death; 1953 1954 if (get_user(target, (uint32_t __user *)ptr)) 1955 return -EFAULT; 1956 ptr += sizeof(uint32_t); 1957 if (get_user(cookie, (void __user * __user *)ptr)) 1958 return -EFAULT; 1959 ptr += sizeof(void *); 1960 ref = binder_get_ref(proc, target); 1961 if (ref == NULL) { 1962 binder_user_error("binder: %d:%d %s " 1963 "invalid ref %d\n", 1964 proc->pid, thread->pid, 1965 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 1966 "BC_REQUEST_DEATH_NOTIFICATION" : 1967 "BC_CLEAR_DEATH_NOTIFICATION", 1968 target); 1969 break; 1970 } 1971 1972 if (binder_debug_mask & BINDER_DEBUG_DEATH_NOTIFICATION) 1973 printk(KERN_INFO "binder: %d:%d %s %p ref %d desc %d s %d w %d for node %d\n", 1974 proc->pid, thread->pid, 1975 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 1976 "BC_REQUEST_DEATH_NOTIFICATION" : 1977 "BC_CLEAR_DEATH_NOTIFICATION", 1978 cookie, ref->debug_id, ref->desc, 1979 ref->strong, ref->weak, ref->node->debug_id); 1980 1981 if (cmd == BC_REQUEST_DEATH_NOTIFICATION) { 1982 if (ref->death) { 1983 binder_user_error("binder: %d:%" 1984 "d BC_REQUEST_DEATH_NOTI" 1985 "FICATION death notific" 1986 "ation already set\n", 1987 proc->pid, thread->pid); 1988 break; 1989 } 1990 death = kzalloc(sizeof(*death), GFP_KERNEL); 1991 if (death == NULL) { 1992 thread->return_error = BR_ERROR; 1993 if (binder_debug_mask & BINDER_DEBUG_FAILED_TRANSACTION) 1994 printk(KERN_INFO "binder: %d:%d " 1995 "BC_REQUEST_DEATH_NOTIFICATION failed\n", 1996 proc->pid, thread->pid); 1997 break; 1998 } 1999 binder_stats.obj_created[BINDER_STAT_DEATH]++; 2000 INIT_LIST_HEAD(&death->work.entry); 2001 death->cookie = cookie; 2002 ref->death = death; 2003 if (ref->node->proc == NULL) { 2004 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 2005 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2006 list_add_tail(&ref->death->work.entry, &thread->todo); 2007 } else { 2008 list_add_tail(&ref->death->work.entry, &proc->todo); 2009 wake_up_interruptible(&proc->wait); 2010 } 2011 } 2012 } else { 2013 if (ref->death == NULL) { 2014 binder_user_error("binder: %d:%" 2015 "d BC_CLEAR_DEATH_NOTIFI" 2016 "CATION death notificat" 2017 "ion not active\n", 2018 proc->pid, thread->pid); 2019 break; 2020 } 2021 death = ref->death; 2022 if (death->cookie != cookie) { 2023 binder_user_error("binder: %d:%" 2024 "d BC_CLEAR_DEATH_NOTIFI" 2025 "CATION death notificat" 2026 "ion cookie mismatch " 2027 "%p != %p\n", 2028 proc->pid, thread->pid, 2029 death->cookie, cookie); 2030 break; 2031 } 2032 ref->death = NULL; 2033 if (list_empty(&death->work.entry)) { 2034 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2035 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2036 list_add_tail(&death->work.entry, &thread->todo); 2037 } else { 2038 list_add_tail(&death->work.entry, &proc->todo); 2039 wake_up_interruptible(&proc->wait); 2040 } 2041 } else { 2042 BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER); 2043 death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR; 2044 } 2045 } 2046 } break; 2047 case BC_DEAD_BINDER_DONE: { 2048 struct binder_work *w; 2049 void __user *cookie; 2050 struct binder_ref_death *death = NULL; 2051 if (get_user(cookie, (void __user * __user *)ptr)) 2052 return -EFAULT; 2053 2054 ptr += sizeof(void *); 2055 list_for_each_entry(w, &proc->delivered_death, entry) { 2056 struct binder_ref_death *tmp_death = container_of(w, struct binder_ref_death, work); 2057 if (tmp_death->cookie == cookie) { 2058 death = tmp_death; 2059 break; 2060 } 2061 } 2062 if (binder_debug_mask & BINDER_DEBUG_DEAD_BINDER) 2063 printk(KERN_INFO "binder: %d:%d BC_DEAD_BINDER_DONE %p found %p\n", 2064 proc->pid, thread->pid, cookie, death); 2065 if (death == NULL) { 2066 binder_user_error("binder: %d:%d BC_DEAD" 2067 "_BINDER_DONE %p not found\n", 2068 proc->pid, thread->pid, cookie); 2069 break; 2070 } 2071 2072 list_del_init(&death->work.entry); 2073 if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) { 2074 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2075 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2076 list_add_tail(&death->work.entry, &thread->todo); 2077 } else { 2078 list_add_tail(&death->work.entry, &proc->todo); 2079 wake_up_interruptible(&proc->wait); 2080 } 2081 } 2082 } break; 2083 2084 default: 2085 printk(KERN_ERR "binder: %d:%d unknown command %d\n", proc->pid, thread->pid, cmd); 2086 return -EINVAL; 2087 } 2088 *consumed = ptr - buffer; 2089 } 2090 return 0; 2091} 2092 2093void 2094binder_stat_br(struct binder_proc *proc, struct binder_thread *thread, uint32_t cmd) 2095{ 2096 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) { 2097 binder_stats.br[_IOC_NR(cmd)]++; 2098 proc->stats.br[_IOC_NR(cmd)]++; 2099 thread->stats.br[_IOC_NR(cmd)]++; 2100 } 2101} 2102 2103static int 2104binder_has_proc_work(struct binder_proc *proc, struct binder_thread *thread) 2105{ 2106 return !list_empty(&proc->todo) || (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2107} 2108 2109static int 2110binder_has_thread_work(struct binder_thread *thread) 2111{ 2112 return !list_empty(&thread->todo) || thread->return_error != BR_OK || 2113 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2114} 2115 2116static int 2117binder_thread_read(struct binder_proc *proc, struct binder_thread *thread, 2118 void __user *buffer, int size, signed long *consumed, int non_block) 2119{ 2120 void __user *ptr = buffer + *consumed; 2121 void __user *end = buffer + size; 2122 2123 int ret = 0; 2124 int wait_for_proc_work; 2125 2126 if (*consumed == 0) { 2127 if (put_user(BR_NOOP, (uint32_t __user *)ptr)) 2128 return -EFAULT; 2129 ptr += sizeof(uint32_t); 2130 } 2131 2132retry: 2133 wait_for_proc_work = thread->transaction_stack == NULL && list_empty(&thread->todo); 2134 2135 if (thread->return_error != BR_OK && ptr < end) { 2136 if (thread->return_error2 != BR_OK) { 2137 if (put_user(thread->return_error2, (uint32_t __user *)ptr)) 2138 return -EFAULT; 2139 ptr += sizeof(uint32_t); 2140 if (ptr == end) 2141 goto done; 2142 thread->return_error2 = BR_OK; 2143 } 2144 if (put_user(thread->return_error, (uint32_t __user *)ptr)) 2145 return -EFAULT; 2146 ptr += sizeof(uint32_t); 2147 thread->return_error = BR_OK; 2148 goto done; 2149 } 2150 2151 2152 thread->looper |= BINDER_LOOPER_STATE_WAITING; 2153 if (wait_for_proc_work) 2154 proc->ready_threads++; 2155 mutex_unlock(&binder_lock); 2156 if (wait_for_proc_work) { 2157 if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2158 BINDER_LOOPER_STATE_ENTERED))) { 2159 binder_user_error("binder: %d:%d ERROR: Thread waiting " 2160 "for process work before calling BC_REGISTER_" 2161 "LOOPER or BC_ENTER_LOOPER (state %x)\n", 2162 proc->pid, thread->pid, thread->looper); 2163 wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2164 } 2165 binder_set_nice(proc->default_priority); 2166 if (non_block) { 2167 if (!binder_has_proc_work(proc, thread)) 2168 ret = -EAGAIN; 2169 } else 2170 ret = wait_event_interruptible_exclusive(proc->wait, binder_has_proc_work(proc, thread)); 2171 } else { 2172 if (non_block) { 2173 if (!binder_has_thread_work(thread)) 2174 ret = -EAGAIN; 2175 } else 2176 ret = wait_event_interruptible(thread->wait, binder_has_thread_work(thread)); 2177 } 2178 mutex_lock(&binder_lock); 2179 if (wait_for_proc_work) 2180 proc->ready_threads--; 2181 thread->looper &= ~BINDER_LOOPER_STATE_WAITING; 2182 2183 if (ret) 2184 return ret; 2185 2186 while (1) { 2187 uint32_t cmd; 2188 struct binder_transaction_data tr; 2189 struct binder_work *w; 2190 struct binder_transaction *t = NULL; 2191 2192 if (!list_empty(&thread->todo)) 2193 w = list_first_entry(&thread->todo, struct binder_work, entry); 2194 else if (!list_empty(&proc->todo) && wait_for_proc_work) 2195 w = list_first_entry(&proc->todo, struct binder_work, entry); 2196 else { 2197 if (ptr - buffer == 4 && !(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN)) /* no data added */ 2198 goto retry; 2199 break; 2200 } 2201 2202 if (end - ptr < sizeof(tr) + 4) 2203 break; 2204 2205 switch (w->type) { 2206 case BINDER_WORK_TRANSACTION: { 2207 t = container_of(w, struct binder_transaction, work); 2208 } break; 2209 case BINDER_WORK_TRANSACTION_COMPLETE: { 2210 cmd = BR_TRANSACTION_COMPLETE; 2211 if (put_user(cmd, (uint32_t __user *)ptr)) 2212 return -EFAULT; 2213 ptr += sizeof(uint32_t); 2214 2215 binder_stat_br(proc, thread, cmd); 2216 if (binder_debug_mask & BINDER_DEBUG_TRANSACTION_COMPLETE) 2217 printk(KERN_INFO "binder: %d:%d BR_TRANSACTION_COMPLETE\n", 2218 proc->pid, thread->pid); 2219 2220 list_del(&w->entry); 2221 kfree(w); 2222 binder_stats.obj_deleted[BINDER_STAT_TRANSACTION_COMPLETE]++; 2223 } break; 2224 case BINDER_WORK_NODE: { 2225 struct binder_node *node = container_of(w, struct binder_node, work); 2226 uint32_t cmd = BR_NOOP; 2227 const char *cmd_name; 2228 int strong = node->internal_strong_refs || node->local_strong_refs; 2229 int weak = !hlist_empty(&node->refs) || node->local_weak_refs || strong; 2230 if (weak && !node->has_weak_ref) { 2231 cmd = BR_INCREFS; 2232 cmd_name = "BR_INCREFS"; 2233 node->has_weak_ref = 1; 2234 node->pending_weak_ref = 1; 2235 node->local_weak_refs++; 2236 } else if (strong && !node->has_strong_ref) { 2237 cmd = BR_ACQUIRE; 2238 cmd_name = "BR_ACQUIRE"; 2239 node->has_strong_ref = 1; 2240 node->pending_strong_ref = 1; 2241 node->local_strong_refs++; 2242 } else if (!strong && node->has_strong_ref) { 2243 cmd = BR_RELEASE; 2244 cmd_name = "BR_RELEASE"; 2245 node->has_strong_ref = 0; 2246 } else if (!weak && node->has_weak_ref) { 2247 cmd = BR_DECREFS; 2248 cmd_name = "BR_DECREFS"; 2249 node->has_weak_ref = 0; 2250 } 2251 if (cmd != BR_NOOP) { 2252 if (put_user(cmd, (uint32_t __user *)ptr)) 2253 return -EFAULT; 2254 ptr += sizeof(uint32_t); 2255 if (put_user(node->ptr, (void * __user *)ptr)) 2256 return -EFAULT; 2257 ptr += sizeof(void *); 2258 if (put_user(node->cookie, (void * __user *)ptr)) 2259 return -EFAULT; 2260 ptr += sizeof(void *); 2261 2262 binder_stat_br(proc, thread, cmd); 2263 if (binder_debug_mask & BINDER_DEBUG_USER_REFS) 2264 printk(KERN_INFO "binder: %d:%d %s %d u%p c%p\n", 2265 proc->pid, thread->pid, cmd_name, node->debug_id, node->ptr, node->cookie); 2266 } else { 2267 list_del_init(&w->entry); 2268 if (!weak && !strong) { 2269 if (binder_debug_mask & BINDER_DEBUG_INTERNAL_REFS) 2270 printk(KERN_INFO "binder: %d:%d node %d u%p c%p deleted\n", 2271 proc->pid, thread->pid, node->debug_id, node->ptr, node->cookie); 2272 rb_erase(&node->rb_node, &proc->nodes); 2273 kfree(node); 2274 binder_stats.obj_deleted[BINDER_STAT_NODE]++; 2275 } else { 2276 if (binder_debug_mask & BINDER_DEBUG_INTERNAL_REFS) 2277 printk(KERN_INFO "binder: %d:%d node %d u%p c%p state unchanged\n", 2278 proc->pid, thread->pid, node->debug_id, node->ptr, node->cookie); 2279 } 2280 } 2281 } break; 2282 case BINDER_WORK_DEAD_BINDER: 2283 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 2284 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 2285 struct binder_ref_death *death = container_of(w, struct binder_ref_death, work); 2286 uint32_t cmd; 2287 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) 2288 cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE; 2289 else 2290 cmd = BR_DEAD_BINDER; 2291 if (put_user(cmd, (uint32_t __user *)ptr)) 2292 return -EFAULT; 2293 ptr += sizeof(uint32_t); 2294 if (put_user(death->cookie, (void * __user *)ptr)) 2295 return -EFAULT; 2296 ptr += sizeof(void *); 2297 if (binder_debug_mask & BINDER_DEBUG_DEATH_NOTIFICATION) 2298 printk(KERN_INFO "binder: %d:%d %s %p\n", 2299 proc->pid, thread->pid, 2300 cmd == BR_DEAD_BINDER ? 2301 "BR_DEAD_BINDER" : 2302 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 2303 death->cookie); 2304 2305 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) { 2306 list_del(&w->entry); 2307 kfree(death); 2308 binder_stats.obj_deleted[BINDER_STAT_DEATH]++; 2309 } else 2310 list_move(&w->entry, &proc->delivered_death); 2311 if (cmd == BR_DEAD_BINDER) 2312 goto done; /* DEAD_BINDER notifications can cause transactions */ 2313 } break; 2314 } 2315 2316 if (!t) 2317 continue; 2318 2319 BUG_ON(t->buffer == NULL); 2320 if (t->buffer->target_node) { 2321 struct binder_node *target_node = t->buffer->target_node; 2322 tr.target.ptr = target_node->ptr; 2323 tr.cookie = target_node->cookie; 2324 t->saved_priority = task_nice(current); 2325 if (t->priority < target_node->min_priority && 2326 !(t->flags & TF_ONE_WAY)) 2327 binder_set_nice(t->priority); 2328 else if (!(t->flags & TF_ONE_WAY) || 2329 t->saved_priority > target_node->min_priority) 2330 binder_set_nice(target_node->min_priority); 2331 cmd = BR_TRANSACTION; 2332 } else { 2333 tr.target.ptr = NULL; 2334 tr.cookie = NULL; 2335 cmd = BR_REPLY; 2336 } 2337 tr.code = t->code; 2338 tr.flags = t->flags; 2339 tr.sender_euid = t->sender_euid; 2340 2341 if (t->from) { 2342 struct task_struct *sender = t->from->proc->tsk; 2343 tr.sender_pid = task_tgid_nr_ns(sender, current->nsproxy->pid_ns); 2344 } else { 2345 tr.sender_pid = 0; 2346 } 2347 2348 tr.data_size = t->buffer->data_size; 2349 tr.offsets_size = t->buffer->offsets_size; 2350 tr.data.ptr.buffer = (void *)((void *)t->buffer->data + proc->user_buffer_offset); 2351 tr.data.ptr.offsets = tr.data.ptr.buffer + ALIGN(t->buffer->data_size, sizeof(void *)); 2352 2353 if (put_user(cmd, (uint32_t __user *)ptr)) 2354 return -EFAULT; 2355 ptr += sizeof(uint32_t); 2356 if (copy_to_user(ptr, &tr, sizeof(tr))) 2357 return -EFAULT; 2358 ptr += sizeof(tr); 2359 2360 binder_stat_br(proc, thread, cmd); 2361 if (binder_debug_mask & BINDER_DEBUG_TRANSACTION) 2362 printk(KERN_INFO "binder: %d:%d %s %d %d:%d, cmd %d" 2363 "size %zd-%zd ptr %p-%p\n", 2364 proc->pid, thread->pid, 2365 (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" : "BR_REPLY", 2366 t->debug_id, t->from ? t->from->proc->pid : 0, 2367 t->from ? t->from->pid : 0, cmd, 2368 t->buffer->data_size, t->buffer->offsets_size, 2369 tr.data.ptr.buffer, tr.data.ptr.offsets); 2370 2371 list_del(&t->work.entry); 2372 t->buffer->allow_user_free = 1; 2373 if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) { 2374 t->to_parent = thread->transaction_stack; 2375 t->to_thread = thread; 2376 thread->transaction_stack = t; 2377 } else { 2378 t->buffer->transaction = NULL; 2379 kfree(t); 2380 binder_stats.obj_deleted[BINDER_STAT_TRANSACTION]++; 2381 } 2382 break; 2383 } 2384 2385done: 2386 2387 *consumed = ptr - buffer; 2388 if (proc->requested_threads + proc->ready_threads == 0 && 2389 proc->requested_threads_started < proc->max_threads && 2390 (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2391 BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */ 2392 /*spawn a new thread if we leave this out */) { 2393 proc->requested_threads++; 2394 if (binder_debug_mask & BINDER_DEBUG_THREADS) 2395 printk(KERN_INFO "binder: %d:%d BR_SPAWN_LOOPER\n", 2396 proc->pid, thread->pid); 2397 if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer)) 2398 return -EFAULT; 2399 } 2400 return 0; 2401} 2402 2403static void binder_release_work(struct list_head *list) 2404{ 2405 struct binder_work *w; 2406 while (!list_empty(list)) { 2407 w = list_first_entry(list, struct binder_work, entry); 2408 list_del_init(&w->entry); 2409 switch (w->type) { 2410 case BINDER_WORK_TRANSACTION: { 2411 struct binder_transaction *t = container_of(w, struct binder_transaction, work); 2412 if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) 2413 binder_send_failed_reply(t, BR_DEAD_REPLY); 2414 } break; 2415 case BINDER_WORK_TRANSACTION_COMPLETE: { 2416 kfree(w); 2417 binder_stats.obj_deleted[BINDER_STAT_TRANSACTION_COMPLETE]++; 2418 } break; 2419 default: 2420 break; 2421 } 2422 } 2423 2424} 2425 2426static struct binder_thread *binder_get_thread(struct binder_proc *proc) 2427{ 2428 struct binder_thread *thread = NULL; 2429 struct rb_node *parent = NULL; 2430 struct rb_node **p = &proc->threads.rb_node; 2431 2432 while (*p) { 2433 parent = *p; 2434 thread = rb_entry(parent, struct binder_thread, rb_node); 2435 2436 if (current->pid < thread->pid) 2437 p = &(*p)->rb_left; 2438 else if (current->pid > thread->pid) 2439 p = &(*p)->rb_right; 2440 else 2441 break; 2442 } 2443 if (*p == NULL) { 2444 thread = kzalloc(sizeof(*thread), GFP_KERNEL); 2445 if (thread == NULL) 2446 return NULL; 2447 binder_stats.obj_created[BINDER_STAT_THREAD]++; 2448 thread->proc = proc; 2449 thread->pid = current->pid; 2450 init_waitqueue_head(&thread->wait); 2451 INIT_LIST_HEAD(&thread->todo); 2452 rb_link_node(&thread->rb_node, parent, p); 2453 rb_insert_color(&thread->rb_node, &proc->threads); 2454 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2455 thread->return_error = BR_OK; 2456 thread->return_error2 = BR_OK; 2457 } 2458 return thread; 2459} 2460 2461static int binder_free_thread(struct binder_proc *proc, struct binder_thread *thread) 2462{ 2463 struct binder_transaction *t; 2464 struct binder_transaction *send_reply = NULL; 2465 int active_transactions = 0; 2466 2467 rb_erase(&thread->rb_node, &proc->threads); 2468 t = thread->transaction_stack; 2469 if (t && t->to_thread == thread) 2470 send_reply = t; 2471 while (t) { 2472 active_transactions++; 2473 if (binder_debug_mask & BINDER_DEBUG_DEAD_TRANSACTION) 2474 printk(KERN_INFO "binder: release %d:%d transaction %d %s, still active\n", 2475 proc->pid, thread->pid, t->debug_id, (t->to_thread == thread) ? "in" : "out"); 2476 if (t->to_thread == thread) { 2477 t->to_proc = NULL; 2478 t->to_thread = NULL; 2479 if (t->buffer) { 2480 t->buffer->transaction = NULL; 2481 t->buffer = NULL; 2482 } 2483 t = t->to_parent; 2484 } else if (t->from == thread) { 2485 t->from = NULL; 2486 t = t->from_parent; 2487 } else 2488 BUG(); 2489 } 2490 if (send_reply) 2491 binder_send_failed_reply(send_reply, BR_DEAD_REPLY); 2492 binder_release_work(&thread->todo); 2493 kfree(thread); 2494 binder_stats.obj_deleted[BINDER_STAT_THREAD]++; 2495 return active_transactions; 2496} 2497 2498static unsigned int binder_poll(struct file *filp, struct poll_table_struct *wait) 2499{ 2500 struct binder_proc *proc = filp->private_data; 2501 struct binder_thread *thread = NULL; 2502 int wait_for_proc_work; 2503 2504 mutex_lock(&binder_lock); 2505 thread = binder_get_thread(proc); 2506 2507 wait_for_proc_work = thread->transaction_stack == NULL && 2508 list_empty(&thread->todo) && thread->return_error == BR_OK; 2509 mutex_unlock(&binder_lock); 2510 2511 if (wait_for_proc_work) { 2512 if (binder_has_proc_work(proc, thread)) 2513 return POLLIN; 2514 poll_wait(filp, &proc->wait, wait); 2515 if (binder_has_proc_work(proc, thread)) 2516 return POLLIN; 2517 } else { 2518 if (binder_has_thread_work(thread)) 2519 return POLLIN; 2520 poll_wait(filp, &thread->wait, wait); 2521 if (binder_has_thread_work(thread)) 2522 return POLLIN; 2523 } 2524 return 0; 2525} 2526 2527static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 2528{ 2529 int ret; 2530 struct binder_proc *proc = filp->private_data; 2531 struct binder_thread *thread; 2532 unsigned int size = _IOC_SIZE(cmd); 2533 void __user *ubuf = (void __user *)arg; 2534 2535 /*printk(KERN_INFO "binder_ioctl: %d:%d %x %lx\n", proc->pid, current->pid, cmd, arg);*/ 2536 2537 ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2538 if (ret) 2539 return ret; 2540 2541 mutex_lock(&binder_lock); 2542 thread = binder_get_thread(proc); 2543 if (thread == NULL) { 2544 ret = -ENOMEM; 2545 goto err; 2546 } 2547 2548 switch (cmd) { 2549 case BINDER_WRITE_READ: { 2550 struct binder_write_read bwr; 2551 if (size != sizeof(struct binder_write_read)) { 2552 ret = -EINVAL; 2553 goto err; 2554 } 2555 if (copy_from_user(&bwr, ubuf, sizeof(bwr))) { 2556 ret = -EFAULT; 2557 goto err; 2558 } 2559 if (binder_debug_mask & BINDER_DEBUG_READ_WRITE) 2560 printk(KERN_INFO "binder: %d:%d write %ld at %08lx, read %ld at %08lx\n", 2561 proc->pid, thread->pid, bwr.write_size, bwr.write_buffer, bwr.read_size, bwr.read_buffer); 2562 if (bwr.write_size > 0) { 2563 ret = binder_thread_write(proc, thread, (void __user *)bwr.write_buffer, bwr.write_size, &bwr.write_consumed); 2564 if (ret < 0) { 2565 bwr.read_consumed = 0; 2566 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2567 ret = -EFAULT; 2568 goto err; 2569 } 2570 } 2571 if (bwr.read_size > 0) { 2572 ret = binder_thread_read(proc, thread, (void __user *)bwr.read_buffer, bwr.read_size, &bwr.read_consumed, filp->f_flags & O_NONBLOCK); 2573 if (!list_empty(&proc->todo)) 2574 wake_up_interruptible(&proc->wait); 2575 if (ret < 0) { 2576 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2577 ret = -EFAULT; 2578 goto err; 2579 } 2580 } 2581 if (binder_debug_mask & BINDER_DEBUG_READ_WRITE) 2582 printk(KERN_INFO "binder: %d:%d wrote %ld of %ld, read return %ld of %ld\n", 2583 proc->pid, thread->pid, bwr.write_consumed, bwr.write_size, bwr.read_consumed, bwr.read_size); 2584 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) { 2585 ret = -EFAULT; 2586 goto err; 2587 } 2588 break; 2589 } 2590 case BINDER_SET_MAX_THREADS: 2591 if (copy_from_user(&proc->max_threads, ubuf, sizeof(proc->max_threads))) { 2592 ret = -EINVAL; 2593 goto err; 2594 } 2595 break; 2596 case BINDER_SET_CONTEXT_MGR: 2597 if (binder_context_mgr_node != NULL) { 2598 printk(KERN_ERR "binder: BINDER_SET_CONTEXT_MGR already set\n"); 2599 ret = -EBUSY; 2600 goto err; 2601 } 2602 if (binder_context_mgr_uid != -1) { 2603 if (binder_context_mgr_uid != current->cred->euid) { 2604 printk(KERN_ERR "binder: BINDER_SET_" 2605 "CONTEXT_MGR bad uid %d != %d\n", 2606 current->cred->euid, 2607 binder_context_mgr_uid); 2608 ret = -EPERM; 2609 goto err; 2610 } 2611 } else 2612 binder_context_mgr_uid = current->cred->euid; 2613 binder_context_mgr_node = binder_new_node(proc, NULL, NULL); 2614 if (binder_context_mgr_node == NULL) { 2615 ret = -ENOMEM; 2616 goto err; 2617 } 2618 binder_context_mgr_node->local_weak_refs++; 2619 binder_context_mgr_node->local_strong_refs++; 2620 binder_context_mgr_node->has_strong_ref = 1; 2621 binder_context_mgr_node->has_weak_ref = 1; 2622 break; 2623 case BINDER_THREAD_EXIT: 2624 if (binder_debug_mask & BINDER_DEBUG_THREADS) 2625 printk(KERN_INFO "binder: %d:%d exit\n", 2626 proc->pid, thread->pid); 2627 binder_free_thread(proc, thread); 2628 thread = NULL; 2629 break; 2630 case BINDER_VERSION: 2631 if (size != sizeof(struct binder_version)) { 2632 ret = -EINVAL; 2633 goto err; 2634 } 2635 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION, &((struct binder_version *)ubuf)->protocol_version)) { 2636 ret = -EINVAL; 2637 goto err; 2638 } 2639 break; 2640 default: 2641 ret = -EINVAL; 2642 goto err; 2643 } 2644 ret = 0; 2645err: 2646 if (thread) 2647 thread->looper &= ~BINDER_LOOPER_STATE_NEED_RETURN; 2648 mutex_unlock(&binder_lock); 2649 wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2650 if (ret && ret != -ERESTARTSYS) 2651 printk(KERN_INFO "binder: %d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret); 2652 return ret; 2653} 2654 2655static void binder_vma_open(struct vm_area_struct *vma) 2656{ 2657 struct binder_proc *proc = vma->vm_private_data; 2658 if (binder_debug_mask & BINDER_DEBUG_OPEN_CLOSE) 2659 printk(KERN_INFO 2660 "binder: %d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2661 proc->pid, vma->vm_start, vma->vm_end, 2662 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2663 (unsigned long)pgprot_val(vma->vm_page_prot)); 2664 dump_stack(); 2665} 2666 2667static void binder_release_files(struct work_struct *work) 2668{ 2669 struct binder_proc *proc; 2670 struct files_struct *files; 2671 do { 2672 mutex_lock(&binder_lock); 2673 mutex_lock(&binder_release_files_lock); 2674 if (!hlist_empty(&binder_release_files_list)) { 2675 proc = hlist_entry(binder_release_files_list.first, 2676 struct binder_proc, release_files_node); 2677 hlist_del_init(&proc->release_files_node); 2678 files = proc->files; 2679 if (files) 2680 proc->files = NULL; 2681 } else { 2682 proc = NULL; 2683 files = NULL; 2684 } 2685 mutex_unlock(&binder_release_files_lock); 2686 mutex_unlock(&binder_lock); 2687 if (files) 2688 put_files_struct(files); 2689 } while (proc); 2690} 2691 2692static DECLARE_WORK(binder_release_files_work, binder_release_files); 2693 2694static void binder_vma_close(struct vm_area_struct *vma) 2695{ 2696 struct binder_proc *proc = vma->vm_private_data; 2697 if (binder_debug_mask & BINDER_DEBUG_OPEN_CLOSE) 2698 printk(KERN_INFO 2699 "binder: %d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2700 proc->pid, vma->vm_start, vma->vm_end, 2701 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2702 (unsigned long)pgprot_val(vma->vm_page_prot)); 2703 proc->vma = NULL; 2704 mutex_lock(&binder_release_files_lock); 2705 if (proc->files) { 2706 hlist_add_head(&proc->release_files_node, 2707 &binder_release_files_list); 2708 schedule_work(&binder_release_files_work); 2709 } 2710 mutex_unlock(&binder_release_files_lock); 2711} 2712 2713static struct vm_operations_struct binder_vm_ops = { 2714 .open = binder_vma_open, 2715 .close = binder_vma_close, 2716}; 2717 2718static int binder_mmap(struct file *filp, struct vm_area_struct *vma) 2719{ 2720 int ret; 2721 struct vm_struct *area; 2722 struct binder_proc *proc = filp->private_data; 2723 const char *failure_string; 2724 struct binder_buffer *buffer; 2725 2726 if ((vma->vm_end - vma->vm_start) > SZ_4M) 2727 vma->vm_end = vma->vm_start + SZ_4M; 2728 2729 if (binder_debug_mask & BINDER_DEBUG_OPEN_CLOSE) 2730 printk(KERN_INFO 2731 "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n", 2732 proc->pid, vma->vm_start, vma->vm_end, 2733 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2734 (unsigned long)pgprot_val(vma->vm_page_prot)); 2735 2736 if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) { 2737 ret = -EPERM; 2738 failure_string = "bad vm_flags"; 2739 goto err_bad_arg; 2740 } 2741 vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE; 2742 2743 if (proc->buffer) { 2744 ret = -EBUSY; 2745 failure_string = "already mapped"; 2746 goto err_already_mapped; 2747 } 2748 2749 area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP); 2750 if (area == NULL) { 2751 ret = -ENOMEM; 2752 failure_string = "get_vm_area"; 2753 goto err_get_vm_area_failed; 2754 } 2755 proc->buffer = area->addr; 2756 proc->user_buffer_offset = vma->vm_start - (size_t)proc->buffer; 2757 2758#ifdef CONFIG_CPU_CACHE_VIPT 2759 if (cache_is_vipt_aliasing()) { 2760 while (CACHE_COLOUR((vma->vm_start ^ (uint32_t)proc->buffer))) { 2761 printk(KERN_INFO "binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer); 2762 vma->vm_start += PAGE_SIZE; 2763 } 2764 } 2765#endif 2766 proc->pages = kzalloc(sizeof(proc->pages[0]) * ((vma->vm_end - vma->vm_start) / PAGE_SIZE), GFP_KERNEL); 2767 if (proc->pages == NULL) { 2768 ret = -ENOMEM; 2769 failure_string = "alloc page array"; 2770 goto err_alloc_pages_failed; 2771 } 2772 proc->buffer_size = vma->vm_end - vma->vm_start; 2773 2774 vma->vm_ops = &binder_vm_ops; 2775 vma->vm_private_data = proc; 2776 2777 if (binder_update_page_range(proc, 1, proc->buffer, proc->buffer + PAGE_SIZE, vma)) { 2778 ret = -ENOMEM; 2779 failure_string = "alloc small buf"; 2780 goto err_alloc_small_buf_failed; 2781 } 2782 buffer = proc->buffer; 2783 INIT_LIST_HEAD(&proc->buffers); 2784 list_add(&buffer->entry, &proc->buffers); 2785 buffer->free = 1; 2786 binder_insert_free_buffer(proc, buffer); 2787 proc->free_async_space = proc->buffer_size / 2; 2788 barrier(); 2789 proc->files = get_files_struct(current); 2790 proc->vma = vma; 2791 2792 /*printk(KERN_INFO "binder_mmap: %d %lx-%lx maps %p\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/ 2793 return 0; 2794 2795err_alloc_small_buf_failed: 2796 kfree(proc->pages); 2797 proc->pages = NULL; 2798err_alloc_pages_failed: 2799 vfree(proc->buffer); 2800 proc->buffer = NULL; 2801err_get_vm_area_failed: 2802err_already_mapped: 2803err_bad_arg: 2804 printk(KERN_ERR "binder_mmap: %d %lx-%lx %s failed %d\n", proc->pid, vma->vm_start, vma->vm_end, failure_string, ret); 2805 return ret; 2806} 2807 2808static int binder_open(struct inode *nodp, struct file *filp) 2809{ 2810 struct binder_proc *proc; 2811 2812 if (binder_debug_mask & BINDER_DEBUG_OPEN_CLOSE) 2813 printk(KERN_INFO "binder_open: %d:%d\n", current->group_leader->pid, current->pid); 2814 2815 proc = kzalloc(sizeof(*proc), GFP_KERNEL); 2816 if (proc == NULL) 2817 return -ENOMEM; 2818 get_task_struct(current); 2819 proc->tsk = current; 2820 INIT_LIST_HEAD(&proc->todo); 2821 init_waitqueue_head(&proc->wait); 2822 proc->default_priority = task_nice(current); 2823 mutex_lock(&binder_lock); 2824 binder_stats.obj_created[BINDER_STAT_PROC]++; 2825 hlist_add_head(&proc->proc_node, &binder_procs); 2826 proc->pid = current->group_leader->pid; 2827 INIT_LIST_HEAD(&proc->delivered_death); 2828 filp->private_data = proc; 2829 mutex_unlock(&binder_lock); 2830 2831 if (binder_proc_dir_entry_proc) { 2832 char strbuf[11]; 2833 snprintf(strbuf, sizeof(strbuf), "%u", proc->pid); 2834 remove_proc_entry(strbuf, binder_proc_dir_entry_proc); 2835 create_proc_read_entry(strbuf, S_IRUGO, binder_proc_dir_entry_proc, binder_read_proc_proc, proc); 2836 } 2837 2838 return 0; 2839} 2840 2841static int binder_flush(struct file *filp, fl_owner_t id) 2842{ 2843 struct rb_node *n; 2844 struct binder_proc *proc = filp->private_data; 2845 int wake_count = 0; 2846 2847 mutex_lock(&binder_lock); 2848 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) { 2849 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node); 2850 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2851 if (thread->looper & BINDER_LOOPER_STATE_WAITING) { 2852 wake_up_interruptible(&thread->wait); 2853 wake_count++; 2854 } 2855 } 2856 wake_up_interruptible_all(&proc->wait); 2857 mutex_unlock(&binder_lock); 2858 2859 if (binder_debug_mask & BINDER_DEBUG_OPEN_CLOSE) 2860 printk(KERN_INFO "binder_flush: %d woke %d threads\n", proc->pid, wake_count); 2861 2862 return 0; 2863} 2864 2865static int binder_release(struct inode *nodp, struct file *filp) 2866{ 2867 struct hlist_node *pos; 2868 struct binder_transaction *t; 2869 struct rb_node *n; 2870 struct files_struct *files; 2871 struct binder_proc *proc = filp->private_data; 2872 int threads, nodes, incoming_refs, outgoing_refs, buffers, active_transactions, page_count; 2873 2874 if (binder_proc_dir_entry_proc) { 2875 char strbuf[11]; 2876 snprintf(strbuf, sizeof(strbuf), "%u", proc->pid); 2877 remove_proc_entry(strbuf, binder_proc_dir_entry_proc); 2878 } 2879 mutex_lock(&binder_lock); 2880 mutex_lock(&binder_release_files_lock); 2881 if (!hlist_unhashed(&proc->release_files_node)) 2882 hlist_del(&proc->release_files_node); 2883 files = proc->files; 2884 if (files) 2885 proc->files = NULL; 2886 mutex_unlock(&binder_release_files_lock); 2887 2888 hlist_del(&proc->proc_node); 2889 if (binder_context_mgr_node && binder_context_mgr_node->proc == proc) { 2890 if (binder_debug_mask & BINDER_DEBUG_DEAD_BINDER) 2891 printk(KERN_INFO "binder_release: %d context_mgr_node gone\n", proc->pid); 2892 binder_context_mgr_node = NULL; 2893 } 2894 2895 threads = 0; 2896 active_transactions = 0; 2897 while ((n = rb_first(&proc->threads))) { 2898 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node); 2899 threads++; 2900 active_transactions += binder_free_thread(proc, thread); 2901 } 2902 nodes = 0; 2903 incoming_refs = 0; 2904 while ((n = rb_first(&proc->nodes))) { 2905 struct binder_node *node = rb_entry(n, struct binder_node, rb_node); 2906 2907 nodes++; 2908 rb_erase(&node->rb_node, &proc->nodes); 2909 list_del_init(&node->work.entry); 2910 if (hlist_empty(&node->refs)) { 2911 kfree(node); 2912 binder_stats.obj_deleted[BINDER_STAT_NODE]++; 2913 } else { 2914 struct binder_ref *ref; 2915 int death = 0; 2916 2917 node->proc = NULL; 2918 node->local_strong_refs = 0; 2919 node->local_weak_refs = 0; 2920 hlist_add_head(&node->dead_node, &binder_dead_nodes); 2921 2922 hlist_for_each_entry(ref, pos, &node->refs, node_entry) { 2923 incoming_refs++; 2924 if (ref->death) { 2925 death++; 2926 if (list_empty(&ref->death->work.entry)) { 2927 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 2928 list_add_tail(&ref->death->work.entry, &ref->proc->todo); 2929 wake_up_interruptible(&ref->proc->wait); 2930 } else 2931 BUG(); 2932 } 2933 } 2934 if (binder_debug_mask & BINDER_DEBUG_DEAD_BINDER) 2935 printk(KERN_INFO "binder: node %d now dead, refs %d, death %d\n", node->debug_id, incoming_refs, death); 2936 } 2937 } 2938 outgoing_refs = 0; 2939 while ((n = rb_first(&proc->refs_by_desc))) { 2940 struct binder_ref *ref = rb_entry(n, struct binder_ref, rb_node_desc); 2941 outgoing_refs++; 2942 binder_delete_ref(ref); 2943 } 2944 binder_release_work(&proc->todo); 2945 buffers = 0; 2946 2947 while ((n = rb_first(&proc->allocated_buffers))) { 2948 struct binder_buffer *buffer = rb_entry(n, struct binder_buffer, rb_node); 2949 t = buffer->transaction; 2950 if (t) { 2951 t->buffer = NULL; 2952 buffer->transaction = NULL; 2953 printk(KERN_ERR "binder: release proc %d, transaction %d, not freed\n", proc->pid, t->debug_id); 2954 /*BUG();*/ 2955 } 2956 binder_free_buf(proc, buffer); 2957 buffers++; 2958 } 2959 2960 binder_stats.obj_deleted[BINDER_STAT_PROC]++; 2961 mutex_unlock(&binder_lock); 2962 2963 page_count = 0; 2964 if (proc->pages) { 2965 int i; 2966 for (i = 0; i < proc->buffer_size / PAGE_SIZE; i++) { 2967 if (proc->pages[i]) { 2968 if (binder_debug_mask & BINDER_DEBUG_BUFFER_ALLOC) 2969 printk(KERN_INFO "binder_release: %d: page %d at %p not freed\n", proc->pid, i, proc->buffer + i * PAGE_SIZE); 2970 __free_page(proc->pages[i]); 2971 page_count++; 2972 } 2973 } 2974 kfree(proc->pages); 2975 vfree(proc->buffer); 2976 } 2977 2978 put_task_struct(proc->tsk); 2979 2980 if (binder_debug_mask & BINDER_DEBUG_OPEN_CLOSE) 2981 printk(KERN_INFO "binder_release: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d, buffers %d, pages %d\n", 2982 proc->pid, threads, nodes, incoming_refs, outgoing_refs, active_transactions, buffers, page_count); 2983 2984 kfree(proc); 2985 if (files) 2986 put_files_struct(files); 2987 return 0; 2988} 2989 2990static char *print_binder_transaction(char *buf, char *end, const char *prefix, struct binder_transaction *t) 2991{ 2992 buf += snprintf(buf, end - buf, "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d", 2993 prefix, t->debug_id, t, t->from ? t->from->proc->pid : 0, 2994 t->from ? t->from->pid : 0, 2995 t->to_proc ? t->to_proc->pid : 0, 2996 t->to_thread ? t->to_thread->pid : 0, 2997 t->code, t->flags, t->priority, t->need_reply); 2998 if (buf >= end) 2999 return buf; 3000 if (t->buffer == NULL) { 3001 buf += snprintf(buf, end - buf, " buffer free\n"); 3002 return buf; 3003 } 3004 if (t->buffer->target_node) { 3005 buf += snprintf(buf, end - buf, " node %d", 3006 t->buffer->target_node->debug_id); 3007 if (buf >= end) 3008 return buf; 3009 } 3010 buf += snprintf(buf, end - buf, " size %zd:%zd data %p\n", 3011 t->buffer->data_size, t->buffer->offsets_size, 3012 t->buffer->data); 3013 return buf; 3014} 3015 3016static char *print_binder_buffer(char *buf, char *end, const char *prefix, struct binder_buffer *buffer) 3017{ 3018 buf += snprintf(buf, end - buf, "%s %d: %p size %zd:%zd %s\n", 3019 prefix, buffer->debug_id, buffer->data, 3020 buffer->data_size, buffer->offsets_size, 3021 buffer->transaction ? "active" : "delivered"); 3022 return buf; 3023} 3024 3025static char *print_binder_work(char *buf, char *end, const char *prefix, 3026 const char *transaction_prefix, struct binder_work *w) 3027{ 3028 struct binder_node *node; 3029 struct binder_transaction *t; 3030 3031 switch (w->type) { 3032 case BINDER_WORK_TRANSACTION: 3033 t = container_of(w, struct binder_transaction, work); 3034 buf = print_binder_transaction(buf, end, transaction_prefix, t); 3035 break; 3036 case BINDER_WORK_TRANSACTION_COMPLETE: 3037 buf += snprintf(buf, end - buf, 3038 "%stransaction complete\n", prefix); 3039 break; 3040 case BINDER_WORK_NODE: 3041 node = container_of(w, struct binder_node, work); 3042 buf += snprintf(buf, end - buf, "%snode work %d: u%p c%p\n", 3043 prefix, node->debug_id, node->ptr, node->cookie); 3044 break; 3045 case BINDER_WORK_DEAD_BINDER: 3046 buf += snprintf(buf, end - buf, "%shas dead binder\n", prefix); 3047 break; 3048 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 3049 buf += snprintf(buf, end - buf, 3050 "%shas cleared dead binder\n", prefix); 3051 break; 3052 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: 3053 buf += snprintf(buf, end - buf, 3054 "%shas cleared death notification\n", prefix); 3055 break; 3056 default: 3057 buf += snprintf(buf, end - buf, "%sunknown work: type %d\n", 3058 prefix, w->type); 3059 break; 3060 } 3061 return buf; 3062} 3063 3064static char *print_binder_thread(char *buf, char *end, struct binder_thread *thread, int print_always) 3065{ 3066 struct binder_transaction *t; 3067 struct binder_work *w; 3068 char *start_buf = buf; 3069 char *header_buf; 3070 3071 buf += snprintf(buf, end - buf, " thread %d: l %02x\n", thread->pid, thread->looper); 3072 header_buf = buf; 3073 t = thread->transaction_stack; 3074 while (t) { 3075 if (buf >= end) 3076 break; 3077 if (t->from == thread) { 3078 buf = print_binder_transaction(buf, end, " outgoing transaction", t); 3079 t = t->from_parent; 3080 } else if (t->to_thread == thread) { 3081 buf = print_binder_transaction(buf, end, " incoming transaction", t); 3082 t = t->to_parent; 3083 } else { 3084 buf = print_binder_transaction(buf, end, " bad transaction", t); 3085 t = NULL; 3086 } 3087 } 3088 list_for_each_entry(w, &thread->todo, entry) { 3089 if (buf >= end) 3090 break; 3091 buf = print_binder_work(buf, end, " ", 3092 " pending transaction", w); 3093 } 3094 if (!print_always && buf == header_buf) 3095 buf = start_buf; 3096 return buf; 3097} 3098 3099static char *print_binder_node(char *buf, char *end, struct binder_node *node) 3100{ 3101 struct binder_ref *ref; 3102 struct hlist_node *pos; 3103 struct binder_work *w; 3104 int count; 3105 count = 0; 3106 hlist_for_each_entry(ref, pos, &node->refs, node_entry) 3107 count++; 3108 3109 buf += snprintf(buf, end - buf, " node %d: u%p c%p hs %d hw %d ls %d lw %d is %d iw %d", 3110 node->debug_id, node->ptr, node->cookie, 3111 node->has_strong_ref, node->has_weak_ref, 3112 node->local_strong_refs, node->local_weak_refs, 3113 node->internal_strong_refs, count); 3114 if (buf >= end) 3115 return buf; 3116 if (count) { 3117 buf += snprintf(buf, end - buf, " proc"); 3118 if (buf >= end) 3119 return buf; 3120 hlist_for_each_entry(ref, pos, &node->refs, node_entry) { 3121 buf += snprintf(buf, end - buf, " %d", ref->proc->pid); 3122 if (buf >= end) 3123 return buf; 3124 } 3125 } 3126 buf += snprintf(buf, end - buf, "\n"); 3127 list_for_each_entry(w, &node->async_todo, entry) { 3128 if (buf >= end) 3129 break; 3130 buf = print_binder_work(buf, end, " ", 3131 " pending async transaction", w); 3132 } 3133 return buf; 3134} 3135 3136static char *print_binder_ref(char *buf, char *end, struct binder_ref *ref) 3137{ 3138 buf += snprintf(buf, end - buf, " ref %d: desc %d %snode %d s %d w %d d %p\n", 3139 ref->debug_id, ref->desc, ref->node->proc ? "" : "dead ", 3140 ref->node->debug_id, ref->strong, ref->weak, ref->death); 3141 return buf; 3142} 3143 3144static char *print_binder_proc(char *buf, char *end, struct binder_proc *proc, int print_all) 3145{ 3146 struct binder_work *w; 3147 struct rb_node *n; 3148 char *start_buf = buf; 3149 char *header_buf; 3150 3151 buf += snprintf(buf, end - buf, "proc %d\n", proc->pid); 3152 header_buf = buf; 3153 3154 for (n = rb_first(&proc->threads); n != NULL && buf < end; n = rb_next(n)) 3155 buf = print_binder_thread(buf, end, rb_entry(n, struct binder_thread, rb_node), print_all); 3156 for (n = rb_first(&proc->nodes); n != NULL && buf < end; n = rb_next(n)) { 3157 struct binder_node *node = rb_entry(n, struct binder_node, rb_node); 3158 if (print_all || node->has_async_transaction) 3159 buf = print_binder_node(buf, end, node); 3160 } 3161 if (print_all) { 3162 for (n = rb_first(&proc->refs_by_desc); n != NULL && buf < end; n = rb_next(n)) 3163 buf = print_binder_ref(buf, end, rb_entry(n, struct binder_ref, rb_node_desc)); 3164 } 3165 for (n = rb_first(&proc->allocated_buffers); n != NULL && buf < end; n = rb_next(n)) 3166 buf = print_binder_buffer(buf, end, " buffer", rb_entry(n, struct binder_buffer, rb_node)); 3167 list_for_each_entry(w, &proc->todo, entry) { 3168 if (buf >= end) 3169 break; 3170 buf = print_binder_work(buf, end, " ", 3171 " pending transaction", w); 3172 } 3173 list_for_each_entry(w, &proc->delivered_death, entry) { 3174 if (buf >= end) 3175 break; 3176 buf += snprintf(buf, end - buf, " has delivered dead binder\n"); 3177 break; 3178 } 3179 if (!print_all && buf == header_buf) 3180 buf = start_buf; 3181 return buf; 3182} 3183 3184static const char *binder_return_strings[] = { 3185 "BR_ERROR", 3186 "BR_OK", 3187 "BR_TRANSACTION", 3188 "BR_REPLY", 3189 "BR_ACQUIRE_RESULT", 3190 "BR_DEAD_REPLY", 3191 "BR_TRANSACTION_COMPLETE", 3192 "BR_INCREFS", 3193 "BR_ACQUIRE", 3194 "BR_RELEASE", 3195 "BR_DECREFS", 3196 "BR_ATTEMPT_ACQUIRE", 3197 "BR_NOOP", 3198 "BR_SPAWN_LOOPER", 3199 "BR_FINISHED", 3200 "BR_DEAD_BINDER", 3201 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 3202 "BR_FAILED_REPLY" 3203}; 3204 3205static const char *binder_command_strings[] = { 3206 "BC_TRANSACTION", 3207 "BC_REPLY", 3208 "BC_ACQUIRE_RESULT", 3209 "BC_FREE_BUFFER", 3210 "BC_INCREFS", 3211 "BC_ACQUIRE", 3212 "BC_RELEASE", 3213 "BC_DECREFS", 3214 "BC_INCREFS_DONE", 3215 "BC_ACQUIRE_DONE", 3216 "BC_ATTEMPT_ACQUIRE", 3217 "BC_REGISTER_LOOPER", 3218 "BC_ENTER_LOOPER", 3219 "BC_EXIT_LOOPER", 3220 "BC_REQUEST_DEATH_NOTIFICATION", 3221 "BC_CLEAR_DEATH_NOTIFICATION", 3222 "BC_DEAD_BINDER_DONE" 3223}; 3224 3225static const char *binder_objstat_strings[] = { 3226 "proc", 3227 "thread", 3228 "node", 3229 "ref", 3230 "death", 3231 "transaction", 3232 "transaction_complete" 3233}; 3234 3235static char *print_binder_stats(char *buf, char *end, const char *prefix, struct binder_stats *stats) 3236{ 3237 int i; 3238 3239 BUILD_BUG_ON(ARRAY_SIZE(stats->bc) != ARRAY_SIZE(binder_command_strings)); 3240 for (i = 0; i < ARRAY_SIZE(stats->bc); i++) { 3241 if (stats->bc[i]) 3242 buf += snprintf(buf, end - buf, "%s%s: %d\n", prefix, 3243 binder_command_strings[i], stats->bc[i]); 3244 if (buf >= end) 3245 return buf; 3246 } 3247 3248 BUILD_BUG_ON(ARRAY_SIZE(stats->br) != ARRAY_SIZE(binder_return_strings)); 3249 for (i = 0; i < ARRAY_SIZE(stats->br); i++) { 3250 if (stats->br[i]) 3251 buf += snprintf(buf, end - buf, "%s%s: %d\n", prefix, 3252 binder_return_strings[i], stats->br[i]); 3253 if (buf >= end) 3254 return buf; 3255 } 3256 3257 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != ARRAY_SIZE(binder_objstat_strings)); 3258 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != ARRAY_SIZE(stats->obj_deleted)); 3259 for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) { 3260 if (stats->obj_created[i] || stats->obj_deleted[i]) 3261 buf += snprintf(buf, end - buf, "%s%s: active %d total %d\n", prefix, 3262 binder_objstat_strings[i], 3263 stats->obj_created[i] - stats->obj_deleted[i], 3264 stats->obj_created[i]); 3265 if (buf >= end) 3266 return buf; 3267 } 3268 return buf; 3269} 3270 3271static char *print_binder_proc_stats(char *buf, char *end, struct binder_proc *proc) 3272{ 3273 struct binder_work *w; 3274 struct rb_node *n; 3275 int count, strong, weak; 3276 3277 buf += snprintf(buf, end - buf, "proc %d\n", proc->pid); 3278 if (buf >= end) 3279 return buf; 3280 count = 0; 3281 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3282 count++; 3283 buf += snprintf(buf, end - buf, " threads: %d\n", count); 3284 if (buf >= end) 3285 return buf; 3286 buf += snprintf(buf, end - buf, " requested threads: %d+%d/%d\n" 3287 " ready threads %d\n" 3288 " free async space %zd\n", proc->requested_threads, 3289 proc->requested_threads_started, proc->max_threads, 3290 proc->ready_threads, proc->free_async_space); 3291 if (buf >= end) 3292 return buf; 3293 count = 0; 3294 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) 3295 count++; 3296 buf += snprintf(buf, end - buf, " nodes: %d\n", count); 3297 if (buf >= end) 3298 return buf; 3299 count = 0; 3300 strong = 0; 3301 weak = 0; 3302 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 3303 struct binder_ref *ref = rb_entry(n, struct binder_ref, rb_node_desc); 3304 count++; 3305 strong += ref->strong; 3306 weak += ref->weak; 3307 } 3308 buf += snprintf(buf, end - buf, " refs: %d s %d w %d\n", count, strong, weak); 3309 if (buf >= end) 3310 return buf; 3311 3312 count = 0; 3313 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3314 count++; 3315 buf += snprintf(buf, end - buf, " buffers: %d\n", count); 3316 if (buf >= end) 3317 return buf; 3318 3319 count = 0; 3320 list_for_each_entry(w, &proc->todo, entry) { 3321 switch (w->type) { 3322 case BINDER_WORK_TRANSACTION: 3323 count++; 3324 break; 3325 default: 3326 break; 3327 } 3328 } 3329 buf += snprintf(buf, end - buf, " pending transactions: %d\n", count); 3330 if (buf >= end) 3331 return buf; 3332 3333 buf = print_binder_stats(buf, end, " ", &proc->stats); 3334 3335 return buf; 3336} 3337 3338 3339static int binder_read_proc_state( 3340 char *page, char **start, off_t off, int count, int *eof, void *data) 3341{ 3342 struct binder_proc *proc; 3343 struct hlist_node *pos; 3344 struct binder_node *node; 3345 int len = 0; 3346 char *buf = page; 3347 char *end = page + PAGE_SIZE; 3348 int do_lock = !binder_debug_no_lock; 3349 3350 if (off) 3351 return 0; 3352 3353 if (do_lock) 3354 mutex_lock(&binder_lock); 3355 3356 buf += snprintf(buf, end - buf, "binder state:\n"); 3357 3358 if (!hlist_empty(&binder_dead_nodes)) 3359 buf += snprintf(buf, end - buf, "dead nodes:\n"); 3360 hlist_for_each_entry(node, pos, &binder_dead_nodes, dead_node) { 3361 if (buf >= end) 3362 break; 3363 buf = print_binder_node(buf, end, node); 3364 } 3365 3366 hlist_for_each_entry(proc, pos, &binder_procs, proc_node) { 3367 if (buf >= end) 3368 break; 3369 buf = print_binder_proc(buf, end, proc, 1); 3370 } 3371 if (do_lock) 3372 mutex_unlock(&binder_lock); 3373 if (buf > page + PAGE_SIZE) 3374 buf = page + PAGE_SIZE; 3375 3376 *start = page + off; 3377 3378 len = buf - page; 3379 if (len > off) 3380 len -= off; 3381 else 3382 len = 0; 3383 3384 return len < count ? len : count; 3385} 3386 3387static int binder_read_proc_stats( 3388 char *page, char **start, off_t off, int count, int *eof, void *data) 3389{ 3390 struct binder_proc *proc; 3391 struct hlist_node *pos; 3392 int len = 0; 3393 char *p = page; 3394 int do_lock = !binder_debug_no_lock; 3395 3396 if (off) 3397 return 0; 3398 3399 if (do_lock) 3400 mutex_lock(&binder_lock); 3401 3402 p += snprintf(p, PAGE_SIZE, "binder stats:\n"); 3403 3404 p = print_binder_stats(p, page + PAGE_SIZE, "", &binder_stats); 3405 3406 hlist_for_each_entry(proc, pos, &binder_procs, proc_node) { 3407 if (p >= page + PAGE_SIZE) 3408 break; 3409 p = print_binder_proc_stats(p, page + PAGE_SIZE, proc); 3410 } 3411 if (do_lock) 3412 mutex_unlock(&binder_lock); 3413 if (p > page + PAGE_SIZE) 3414 p = page + PAGE_SIZE; 3415 3416 *start = page + off; 3417 3418 len = p - page; 3419 if (len > off) 3420 len -= off; 3421 else 3422 len = 0; 3423 3424 return len < count ? len : count; 3425} 3426 3427static int binder_read_proc_transactions( 3428 char *page, char **start, off_t off, int count, int *eof, void *data) 3429{ 3430 struct binder_proc *proc; 3431 struct hlist_node *pos; 3432 int len = 0; 3433 char *buf = page; 3434 char *end = page + PAGE_SIZE; 3435 int do_lock = !binder_debug_no_lock; 3436 3437 if (off) 3438 return 0; 3439 3440 if (do_lock) 3441 mutex_lock(&binder_lock); 3442 3443 buf += snprintf(buf, end - buf, "binder transactions:\n"); 3444 hlist_for_each_entry(proc, pos, &binder_procs, proc_node) { 3445 if (buf >= end) 3446 break; 3447 buf = print_binder_proc(buf, end, proc, 0); 3448 } 3449 if (do_lock) 3450 mutex_unlock(&binder_lock); 3451 if (buf > page + PAGE_SIZE) 3452 buf = page + PAGE_SIZE; 3453 3454 *start = page + off; 3455 3456 len = buf - page; 3457 if (len > off) 3458 len -= off; 3459 else 3460 len = 0; 3461 3462 return len < count ? len : count; 3463} 3464 3465static int binder_read_proc_proc( 3466 char *page, char **start, off_t off, int count, int *eof, void *data) 3467{ 3468 struct binder_proc *proc = data; 3469 int len = 0; 3470 char *p = page; 3471 int do_lock = !binder_debug_no_lock; 3472 3473 if (off) 3474 return 0; 3475 3476 if (do_lock) 3477 mutex_lock(&binder_lock); 3478 p += snprintf(p, PAGE_SIZE, "binder proc state:\n"); 3479 p = print_binder_proc(p, page + PAGE_SIZE, proc, 1); 3480 if (do_lock) 3481 mutex_unlock(&binder_lock); 3482 3483 if (p > page + PAGE_SIZE) 3484 p = page + PAGE_SIZE; 3485 *start = page + off; 3486 3487 len = p - page; 3488 if (len > off) 3489 len -= off; 3490 else 3491 len = 0; 3492 3493 return len < count ? len : count; 3494} 3495 3496static char *print_binder_transaction_log_entry(char *buf, char *end, struct binder_transaction_log_entry *e) 3497{ 3498 buf += snprintf(buf, end - buf, "%d: %s from %d:%d to %d:%d node %d handle %d size %d:%d\n", 3499 e->debug_id, (e->call_type == 2) ? "reply" : 3500 ((e->call_type == 1) ? "async" : "call "), e->from_proc, 3501 e->from_thread, e->to_proc, e->to_thread, e->to_node, 3502 e->target_handle, e->data_size, e->offsets_size); 3503 return buf; 3504} 3505 3506static int binder_read_proc_transaction_log( 3507 char *page, char **start, off_t off, int count, int *eof, void *data) 3508{ 3509 struct binder_transaction_log *log = data; 3510 int len = 0; 3511 int i; 3512 char *buf = page; 3513 char *end = page + PAGE_SIZE; 3514 3515 if (off) 3516 return 0; 3517 3518 if (log->full) { 3519 for (i = log->next; i < ARRAY_SIZE(log->entry); i++) { 3520 if (buf >= end) 3521 break; 3522 buf = print_binder_transaction_log_entry(buf, end, &log->entry[i]); 3523 } 3524 } 3525 for (i = 0; i < log->next; i++) { 3526 if (buf >= end) 3527 break; 3528 buf = print_binder_transaction_log_entry(buf, end, &log->entry[i]); 3529 } 3530 3531 *start = page + off; 3532 3533 len = buf - page; 3534 if (len > off) 3535 len -= off; 3536 else 3537 len = 0; 3538 3539 return len < count ? len : count; 3540} 3541 3542static struct file_operations binder_fops = { 3543 .owner = THIS_MODULE, 3544 .poll = binder_poll, 3545 .unlocked_ioctl = binder_ioctl, 3546 .mmap = binder_mmap, 3547 .open = binder_open, 3548 .flush = binder_flush, 3549 .release = binder_release, 3550}; 3551 3552static struct miscdevice binder_miscdev = { 3553 .minor = MISC_DYNAMIC_MINOR, 3554 .name = "binder", 3555 .fops = &binder_fops 3556}; 3557 3558static int __init binder_init(void) 3559{ 3560 int ret; 3561 3562 binder_proc_dir_entry_root = proc_mkdir("binder", NULL); 3563 if (binder_proc_dir_entry_root) 3564 binder_proc_dir_entry_proc = proc_mkdir("proc", binder_proc_dir_entry_root); 3565 ret = misc_register(&binder_miscdev); 3566 if (binder_proc_dir_entry_root) { 3567 create_proc_read_entry("state", S_IRUGO, binder_proc_dir_entry_root, binder_read_proc_state, NULL); 3568 create_proc_read_entry("stats", S_IRUGO, binder_proc_dir_entry_root, binder_read_proc_stats, NULL); 3569 create_proc_read_entry("transactions", S_IRUGO, binder_proc_dir_entry_root, binder_read_proc_transactions, NULL); 3570 create_proc_read_entry("transaction_log", S_IRUGO, binder_proc_dir_entry_root, binder_read_proc_transaction_log, &binder_transaction_log); 3571 create_proc_read_entry("failed_transaction_log", S_IRUGO, binder_proc_dir_entry_root, binder_read_proc_transaction_log, &binder_transaction_log_failed); 3572 } 3573 return ret; 3574} 3575 3576device_initcall(binder_init); 3577 3578MODULE_LICENSE("GPL v2"); 3579