binder.c revision 4a2ebb93bf0ae67b4b49f1974a525523eb923da0
1/* binder.c 2 * 3 * Android IPC Subsystem 4 * 5 * Copyright (C) 2007-2008 Google, Inc. 6 * 7 * This software is licensed under the terms of the GNU General Public 8 * License version 2, as published by the Free Software Foundation, and 9 * may be copied, distributed, and modified under those terms. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 */ 17 18#include <asm/cacheflush.h> 19#include <linux/fdtable.h> 20#include <linux/file.h> 21#include <linux/fs.h> 22#include <linux/list.h> 23#include <linux/miscdevice.h> 24#include <linux/mm.h> 25#include <linux/module.h> 26#include <linux/mutex.h> 27#include <linux/nsproxy.h> 28#include <linux/poll.h> 29#include <linux/debugfs.h> 30#include <linux/rbtree.h> 31#include <linux/sched.h> 32#include <linux/seq_file.h> 33#include <linux/uaccess.h> 34#include <linux/vmalloc.h> 35#include <linux/slab.h> 36 37#include "binder.h" 38 39static DEFINE_MUTEX(binder_lock); 40static DEFINE_MUTEX(binder_deferred_lock); 41static DEFINE_MUTEX(binder_mmap_lock); 42 43static HLIST_HEAD(binder_procs); 44static HLIST_HEAD(binder_deferred_list); 45static HLIST_HEAD(binder_dead_nodes); 46 47static struct dentry *binder_debugfs_dir_entry_root; 48static struct dentry *binder_debugfs_dir_entry_proc; 49static struct binder_node *binder_context_mgr_node; 50static kuid_t binder_context_mgr_uid = INVALID_UID; 51static int binder_last_id; 52static struct workqueue_struct *binder_deferred_workqueue; 53 54#define BINDER_DEBUG_ENTRY(name) \ 55static int binder_##name##_open(struct inode *inode, struct file *file) \ 56{ \ 57 return single_open(file, binder_##name##_show, inode->i_private); \ 58} \ 59\ 60static const struct file_operations binder_##name##_fops = { \ 61 .owner = THIS_MODULE, \ 62 .open = binder_##name##_open, \ 63 .read = seq_read, \ 64 .llseek = seq_lseek, \ 65 .release = single_release, \ 66} 67 68static int binder_proc_show(struct seq_file *m, void *unused); 69BINDER_DEBUG_ENTRY(proc); 70 71/* This is only defined in include/asm-arm/sizes.h */ 72#ifndef SZ_1K 73#define SZ_1K 0x400 74#endif 75 76#ifndef SZ_4M 77#define SZ_4M 0x400000 78#endif 79 80#define FORBIDDEN_MMAP_FLAGS (VM_WRITE) 81 82#define BINDER_SMALL_BUF_SIZE (PAGE_SIZE * 64) 83 84enum { 85 BINDER_DEBUG_USER_ERROR = 1U << 0, 86 BINDER_DEBUG_FAILED_TRANSACTION = 1U << 1, 87 BINDER_DEBUG_DEAD_TRANSACTION = 1U << 2, 88 BINDER_DEBUG_OPEN_CLOSE = 1U << 3, 89 BINDER_DEBUG_DEAD_BINDER = 1U << 4, 90 BINDER_DEBUG_DEATH_NOTIFICATION = 1U << 5, 91 BINDER_DEBUG_READ_WRITE = 1U << 6, 92 BINDER_DEBUG_USER_REFS = 1U << 7, 93 BINDER_DEBUG_THREADS = 1U << 8, 94 BINDER_DEBUG_TRANSACTION = 1U << 9, 95 BINDER_DEBUG_TRANSACTION_COMPLETE = 1U << 10, 96 BINDER_DEBUG_FREE_BUFFER = 1U << 11, 97 BINDER_DEBUG_INTERNAL_REFS = 1U << 12, 98 BINDER_DEBUG_BUFFER_ALLOC = 1U << 13, 99 BINDER_DEBUG_PRIORITY_CAP = 1U << 14, 100 BINDER_DEBUG_BUFFER_ALLOC_ASYNC = 1U << 15, 101}; 102static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR | 103 BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION; 104module_param_named(debug_mask, binder_debug_mask, uint, S_IWUSR | S_IRUGO); 105 106static bool binder_debug_no_lock; 107module_param_named(proc_no_lock, binder_debug_no_lock, bool, S_IWUSR | S_IRUGO); 108 109static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait); 110static int binder_stop_on_user_error; 111 112static int binder_set_stop_on_user_error(const char *val, 113 struct kernel_param *kp) 114{ 115 int ret; 116 ret = param_set_int(val, kp); 117 if (binder_stop_on_user_error < 2) 118 wake_up(&binder_user_error_wait); 119 return ret; 120} 121module_param_call(stop_on_user_error, binder_set_stop_on_user_error, 122 param_get_int, &binder_stop_on_user_error, S_IWUSR | S_IRUGO); 123 124#define binder_debug(mask, x...) \ 125 do { \ 126 if (binder_debug_mask & mask) \ 127 pr_info(x); \ 128 } while (0) 129 130#define binder_user_error(x...) \ 131 do { \ 132 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \ 133 pr_info(x); \ 134 if (binder_stop_on_user_error) \ 135 binder_stop_on_user_error = 2; \ 136 } while (0) 137 138enum binder_stat_types { 139 BINDER_STAT_PROC, 140 BINDER_STAT_THREAD, 141 BINDER_STAT_NODE, 142 BINDER_STAT_REF, 143 BINDER_STAT_DEATH, 144 BINDER_STAT_TRANSACTION, 145 BINDER_STAT_TRANSACTION_COMPLETE, 146 BINDER_STAT_COUNT 147}; 148 149struct binder_stats { 150 int br[_IOC_NR(BR_FAILED_REPLY) + 1]; 151 int bc[_IOC_NR(BC_DEAD_BINDER_DONE) + 1]; 152 int obj_created[BINDER_STAT_COUNT]; 153 int obj_deleted[BINDER_STAT_COUNT]; 154}; 155 156static struct binder_stats binder_stats; 157 158static inline void binder_stats_deleted(enum binder_stat_types type) 159{ 160 binder_stats.obj_deleted[type]++; 161} 162 163static inline void binder_stats_created(enum binder_stat_types type) 164{ 165 binder_stats.obj_created[type]++; 166} 167 168struct binder_transaction_log_entry { 169 int debug_id; 170 int call_type; 171 int from_proc; 172 int from_thread; 173 int target_handle; 174 int to_proc; 175 int to_thread; 176 int to_node; 177 int data_size; 178 int offsets_size; 179}; 180struct binder_transaction_log { 181 int next; 182 int full; 183 struct binder_transaction_log_entry entry[32]; 184}; 185static struct binder_transaction_log binder_transaction_log; 186static struct binder_transaction_log binder_transaction_log_failed; 187 188static struct binder_transaction_log_entry *binder_transaction_log_add( 189 struct binder_transaction_log *log) 190{ 191 struct binder_transaction_log_entry *e; 192 e = &log->entry[log->next]; 193 memset(e, 0, sizeof(*e)); 194 log->next++; 195 if (log->next == ARRAY_SIZE(log->entry)) { 196 log->next = 0; 197 log->full = 1; 198 } 199 return e; 200} 201 202struct binder_work { 203 struct list_head entry; 204 enum { 205 BINDER_WORK_TRANSACTION = 1, 206 BINDER_WORK_TRANSACTION_COMPLETE, 207 BINDER_WORK_NODE, 208 BINDER_WORK_DEAD_BINDER, 209 BINDER_WORK_DEAD_BINDER_AND_CLEAR, 210 BINDER_WORK_CLEAR_DEATH_NOTIFICATION, 211 } type; 212}; 213 214struct binder_node { 215 int debug_id; 216 struct binder_work work; 217 union { 218 struct rb_node rb_node; 219 struct hlist_node dead_node; 220 }; 221 struct binder_proc *proc; 222 struct hlist_head refs; 223 int internal_strong_refs; 224 int local_weak_refs; 225 int local_strong_refs; 226 void __user *ptr; 227 void __user *cookie; 228 unsigned has_strong_ref:1; 229 unsigned pending_strong_ref:1; 230 unsigned has_weak_ref:1; 231 unsigned pending_weak_ref:1; 232 unsigned has_async_transaction:1; 233 unsigned accept_fds:1; 234 unsigned min_priority:8; 235 struct list_head async_todo; 236}; 237 238struct binder_ref_death { 239 struct binder_work work; 240 void __user *cookie; 241}; 242 243struct binder_ref { 244 /* Lookups needed: */ 245 /* node + proc => ref (transaction) */ 246 /* desc + proc => ref (transaction, inc/dec ref) */ 247 /* node => refs + procs (proc exit) */ 248 int debug_id; 249 struct rb_node rb_node_desc; 250 struct rb_node rb_node_node; 251 struct hlist_node node_entry; 252 struct binder_proc *proc; 253 struct binder_node *node; 254 uint32_t desc; 255 int strong; 256 int weak; 257 struct binder_ref_death *death; 258}; 259 260struct binder_buffer { 261 struct list_head entry; /* free and allocated entries by address */ 262 struct rb_node rb_node; /* free entry by size or allocated entry */ 263 /* by address */ 264 unsigned free:1; 265 unsigned allow_user_free:1; 266 unsigned async_transaction:1; 267 unsigned debug_id:29; 268 269 struct binder_transaction *transaction; 270 271 struct binder_node *target_node; 272 size_t data_size; 273 size_t offsets_size; 274 uint8_t data[0]; 275}; 276 277enum binder_deferred_state { 278 BINDER_DEFERRED_PUT_FILES = 0x01, 279 BINDER_DEFERRED_FLUSH = 0x02, 280 BINDER_DEFERRED_RELEASE = 0x04, 281}; 282 283struct binder_proc { 284 struct hlist_node proc_node; 285 struct rb_root threads; 286 struct rb_root nodes; 287 struct rb_root refs_by_desc; 288 struct rb_root refs_by_node; 289 int pid; 290 struct vm_area_struct *vma; 291 struct mm_struct *vma_vm_mm; 292 struct task_struct *tsk; 293 struct files_struct *files; 294 struct hlist_node deferred_work_node; 295 int deferred_work; 296 void *buffer; 297 ptrdiff_t user_buffer_offset; 298 299 struct list_head buffers; 300 struct rb_root free_buffers; 301 struct rb_root allocated_buffers; 302 size_t free_async_space; 303 304 struct page **pages; 305 size_t buffer_size; 306 uint32_t buffer_free; 307 struct list_head todo; 308 wait_queue_head_t wait; 309 struct binder_stats stats; 310 struct list_head delivered_death; 311 int max_threads; 312 int requested_threads; 313 int requested_threads_started; 314 int ready_threads; 315 long default_priority; 316 struct dentry *debugfs_entry; 317}; 318 319enum { 320 BINDER_LOOPER_STATE_REGISTERED = 0x01, 321 BINDER_LOOPER_STATE_ENTERED = 0x02, 322 BINDER_LOOPER_STATE_EXITED = 0x04, 323 BINDER_LOOPER_STATE_INVALID = 0x08, 324 BINDER_LOOPER_STATE_WAITING = 0x10, 325 BINDER_LOOPER_STATE_NEED_RETURN = 0x20 326}; 327 328struct binder_thread { 329 struct binder_proc *proc; 330 struct rb_node rb_node; 331 int pid; 332 int looper; 333 struct binder_transaction *transaction_stack; 334 struct list_head todo; 335 uint32_t return_error; /* Write failed, return error code in read buf */ 336 uint32_t return_error2; /* Write failed, return error code in read */ 337 /* buffer. Used when sending a reply to a dead process that */ 338 /* we are also waiting on */ 339 wait_queue_head_t wait; 340 struct binder_stats stats; 341}; 342 343struct binder_transaction { 344 int debug_id; 345 struct binder_work work; 346 struct binder_thread *from; 347 struct binder_transaction *from_parent; 348 struct binder_proc *to_proc; 349 struct binder_thread *to_thread; 350 struct binder_transaction *to_parent; 351 unsigned need_reply:1; 352 /* unsigned is_dead:1; */ /* not used at the moment */ 353 354 struct binder_buffer *buffer; 355 unsigned int code; 356 unsigned int flags; 357 long priority; 358 long saved_priority; 359 kuid_t sender_euid; 360}; 361 362static void 363binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer); 364 365/* 366 * copied from get_unused_fd_flags 367 */ 368int task_get_unused_fd_flags(struct binder_proc *proc, int flags) 369{ 370 struct files_struct *files = proc->files; 371 int fd, error; 372 struct fdtable *fdt; 373 unsigned long rlim_cur; 374 unsigned long irqs; 375 376 if (files == NULL) 377 return -ESRCH; 378 379 error = -EMFILE; 380 spin_lock(&files->file_lock); 381 382repeat: 383 fdt = files_fdtable(files); 384 fd = find_next_zero_bit(fdt->open_fds, fdt->max_fds, files->next_fd); 385 386 /* 387 * N.B. For clone tasks sharing a files structure, this test 388 * will limit the total number of files that can be opened. 389 */ 390 rlim_cur = 0; 391 if (lock_task_sighand(proc->tsk, &irqs)) { 392 rlim_cur = proc->tsk->signal->rlim[RLIMIT_NOFILE].rlim_cur; 393 unlock_task_sighand(proc->tsk, &irqs); 394 } 395 if (fd >= rlim_cur) 396 goto out; 397 398 /* Do we need to expand the fd array or fd set? */ 399 error = expand_files(files, fd); 400 if (error < 0) 401 goto out; 402 403 if (error) { 404 /* 405 * If we needed to expand the fs array we 406 * might have blocked - try again. 407 */ 408 error = -EMFILE; 409 goto repeat; 410 } 411 412 __set_open_fd(fd, fdt); 413 if (flags & O_CLOEXEC) 414 __set_close_on_exec(fd, fdt); 415 else 416 __clear_close_on_exec(fd, fdt); 417 files->next_fd = fd + 1; 418#if 1 419 /* Sanity check */ 420 if (fdt->fd[fd] != NULL) { 421 pr_warn("get_unused_fd: slot %d not NULL!\n", fd); 422 fdt->fd[fd] = NULL; 423 } 424#endif 425 error = fd; 426 427out: 428 spin_unlock(&files->file_lock); 429 return error; 430} 431 432/* 433 * copied from fd_install 434 */ 435static void task_fd_install( 436 struct binder_proc *proc, unsigned int fd, struct file *file) 437{ 438 struct files_struct *files = proc->files; 439 struct fdtable *fdt; 440 441 if (files == NULL) 442 return; 443 444 spin_lock(&files->file_lock); 445 fdt = files_fdtable(files); 446 BUG_ON(fdt->fd[fd] != NULL); 447 rcu_assign_pointer(fdt->fd[fd], file); 448 spin_unlock(&files->file_lock); 449} 450 451/* 452 * copied from __put_unused_fd in open.c 453 */ 454static void __put_unused_fd(struct files_struct *files, unsigned int fd) 455{ 456 struct fdtable *fdt = files_fdtable(files); 457 __clear_open_fd(fd, fdt); 458 if (fd < files->next_fd) 459 files->next_fd = fd; 460} 461 462/* 463 * copied from sys_close 464 */ 465static long task_close_fd(struct binder_proc *proc, unsigned int fd) 466{ 467 struct file *filp; 468 struct files_struct *files = proc->files; 469 struct fdtable *fdt; 470 int retval; 471 472 if (files == NULL) 473 return -ESRCH; 474 475 spin_lock(&files->file_lock); 476 fdt = files_fdtable(files); 477 if (fd >= fdt->max_fds) 478 goto out_unlock; 479 filp = fdt->fd[fd]; 480 if (!filp) 481 goto out_unlock; 482 rcu_assign_pointer(fdt->fd[fd], NULL); 483 __clear_close_on_exec(fd, fdt); 484 __put_unused_fd(files, fd); 485 spin_unlock(&files->file_lock); 486 retval = filp_close(filp, files); 487 488 /* can't restart close syscall because file table entry was cleared */ 489 if (unlikely(retval == -ERESTARTSYS || 490 retval == -ERESTARTNOINTR || 491 retval == -ERESTARTNOHAND || 492 retval == -ERESTART_RESTARTBLOCK)) 493 retval = -EINTR; 494 495 return retval; 496 497out_unlock: 498 spin_unlock(&files->file_lock); 499 return -EBADF; 500} 501 502static void binder_set_nice(long nice) 503{ 504 long min_nice; 505 if (can_nice(current, nice)) { 506 set_user_nice(current, nice); 507 return; 508 } 509 min_nice = 20 - current->signal->rlim[RLIMIT_NICE].rlim_cur; 510 binder_debug(BINDER_DEBUG_PRIORITY_CAP, 511 "binder: %d: nice value %ld not allowed use " 512 "%ld instead\n", current->pid, nice, min_nice); 513 set_user_nice(current, min_nice); 514 if (min_nice < 20) 515 return; 516 binder_user_error("binder: %d RLIMIT_NICE not set\n", current->pid); 517} 518 519static size_t binder_buffer_size(struct binder_proc *proc, 520 struct binder_buffer *buffer) 521{ 522 if (list_is_last(&buffer->entry, &proc->buffers)) 523 return proc->buffer + proc->buffer_size - (void *)buffer->data; 524 else 525 return (size_t)list_entry(buffer->entry.next, 526 struct binder_buffer, entry) - (size_t)buffer->data; 527} 528 529static void binder_insert_free_buffer(struct binder_proc *proc, 530 struct binder_buffer *new_buffer) 531{ 532 struct rb_node **p = &proc->free_buffers.rb_node; 533 struct rb_node *parent = NULL; 534 struct binder_buffer *buffer; 535 size_t buffer_size; 536 size_t new_buffer_size; 537 538 BUG_ON(!new_buffer->free); 539 540 new_buffer_size = binder_buffer_size(proc, new_buffer); 541 542 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 543 "binder: %d: add free buffer, size %zd, " 544 "at %p\n", proc->pid, new_buffer_size, new_buffer); 545 546 while (*p) { 547 parent = *p; 548 buffer = rb_entry(parent, struct binder_buffer, rb_node); 549 BUG_ON(!buffer->free); 550 551 buffer_size = binder_buffer_size(proc, buffer); 552 553 if (new_buffer_size < buffer_size) 554 p = &parent->rb_left; 555 else 556 p = &parent->rb_right; 557 } 558 rb_link_node(&new_buffer->rb_node, parent, p); 559 rb_insert_color(&new_buffer->rb_node, &proc->free_buffers); 560} 561 562static void binder_insert_allocated_buffer(struct binder_proc *proc, 563 struct binder_buffer *new_buffer) 564{ 565 struct rb_node **p = &proc->allocated_buffers.rb_node; 566 struct rb_node *parent = NULL; 567 struct binder_buffer *buffer; 568 569 BUG_ON(new_buffer->free); 570 571 while (*p) { 572 parent = *p; 573 buffer = rb_entry(parent, struct binder_buffer, rb_node); 574 BUG_ON(buffer->free); 575 576 if (new_buffer < buffer) 577 p = &parent->rb_left; 578 else if (new_buffer > buffer) 579 p = &parent->rb_right; 580 else 581 BUG(); 582 } 583 rb_link_node(&new_buffer->rb_node, parent, p); 584 rb_insert_color(&new_buffer->rb_node, &proc->allocated_buffers); 585} 586 587static struct binder_buffer *binder_buffer_lookup(struct binder_proc *proc, 588 void __user *user_ptr) 589{ 590 struct rb_node *n = proc->allocated_buffers.rb_node; 591 struct binder_buffer *buffer; 592 struct binder_buffer *kern_ptr; 593 594 kern_ptr = user_ptr - proc->user_buffer_offset 595 - offsetof(struct binder_buffer, data); 596 597 while (n) { 598 buffer = rb_entry(n, struct binder_buffer, rb_node); 599 BUG_ON(buffer->free); 600 601 if (kern_ptr < buffer) 602 n = n->rb_left; 603 else if (kern_ptr > buffer) 604 n = n->rb_right; 605 else 606 return buffer; 607 } 608 return NULL; 609} 610 611static int binder_update_page_range(struct binder_proc *proc, int allocate, 612 void *start, void *end, 613 struct vm_area_struct *vma) 614{ 615 void *page_addr; 616 unsigned long user_page_addr; 617 struct vm_struct tmp_area; 618 struct page **page; 619 struct mm_struct *mm; 620 621 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 622 "binder: %d: %s pages %p-%p\n", proc->pid, 623 allocate ? "allocate" : "free", start, end); 624 625 if (end <= start) 626 return 0; 627 628 if (vma) 629 mm = NULL; 630 else 631 mm = get_task_mm(proc->tsk); 632 633 if (mm) { 634 down_write(&mm->mmap_sem); 635 vma = proc->vma; 636 if (vma && mm != proc->vma_vm_mm) { 637 pr_err("binder: %d: vma mm and task mm mismatch\n", 638 proc->pid); 639 vma = NULL; 640 } 641 } 642 643 if (allocate == 0) 644 goto free_range; 645 646 if (vma == NULL) { 647 pr_err("binder: %d: binder_alloc_buf failed to " 648 "map pages in userspace, no vma\n", proc->pid); 649 goto err_no_vma; 650 } 651 652 for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) { 653 int ret; 654 struct page **page_array_ptr; 655 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 656 657 BUG_ON(*page); 658 *page = alloc_page(GFP_KERNEL | __GFP_ZERO); 659 if (*page == NULL) { 660 pr_err("binder: %d: binder_alloc_buf failed " 661 "for page at %p\n", proc->pid, page_addr); 662 goto err_alloc_page_failed; 663 } 664 tmp_area.addr = page_addr; 665 tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */; 666 page_array_ptr = page; 667 ret = map_vm_area(&tmp_area, PAGE_KERNEL, &page_array_ptr); 668 if (ret) { 669 pr_err("binder: %d: binder_alloc_buf failed " 670 "to map page at %p in kernel\n", 671 proc->pid, page_addr); 672 goto err_map_kernel_failed; 673 } 674 user_page_addr = 675 (uintptr_t)page_addr + proc->user_buffer_offset; 676 ret = vm_insert_page(vma, user_page_addr, page[0]); 677 if (ret) { 678 pr_err("binder: %d: binder_alloc_buf failed " 679 "to map page at %lx in userspace\n", 680 proc->pid, user_page_addr); 681 goto err_vm_insert_page_failed; 682 } 683 /* vm_insert_page does not seem to increment the refcount */ 684 } 685 if (mm) { 686 up_write(&mm->mmap_sem); 687 mmput(mm); 688 } 689 return 0; 690 691free_range: 692 for (page_addr = end - PAGE_SIZE; page_addr >= start; 693 page_addr -= PAGE_SIZE) { 694 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 695 if (vma) 696 zap_page_range(vma, (uintptr_t)page_addr + 697 proc->user_buffer_offset, PAGE_SIZE, NULL); 698err_vm_insert_page_failed: 699 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE); 700err_map_kernel_failed: 701 __free_page(*page); 702 *page = NULL; 703err_alloc_page_failed: 704 ; 705 } 706err_no_vma: 707 if (mm) { 708 up_write(&mm->mmap_sem); 709 mmput(mm); 710 } 711 return -ENOMEM; 712} 713 714static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc, 715 size_t data_size, 716 size_t offsets_size, int is_async) 717{ 718 struct rb_node *n = proc->free_buffers.rb_node; 719 struct binder_buffer *buffer; 720 size_t buffer_size; 721 struct rb_node *best_fit = NULL; 722 void *has_page_addr; 723 void *end_page_addr; 724 size_t size; 725 726 if (proc->vma == NULL) { 727 pr_err("binder: %d: binder_alloc_buf, no vma\n", 728 proc->pid); 729 return NULL; 730 } 731 732 size = ALIGN(data_size, sizeof(void *)) + 733 ALIGN(offsets_size, sizeof(void *)); 734 735 if (size < data_size || size < offsets_size) { 736 binder_user_error("binder: %d: got transaction with invalid " 737 "size %zd-%zd\n", proc->pid, data_size, offsets_size); 738 return NULL; 739 } 740 741 if (is_async && 742 proc->free_async_space < size + sizeof(struct binder_buffer)) { 743 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 744 "binder: %d: binder_alloc_buf size %zd" 745 "failed, no async space left\n", proc->pid, size); 746 return NULL; 747 } 748 749 while (n) { 750 buffer = rb_entry(n, struct binder_buffer, rb_node); 751 BUG_ON(!buffer->free); 752 buffer_size = binder_buffer_size(proc, buffer); 753 754 if (size < buffer_size) { 755 best_fit = n; 756 n = n->rb_left; 757 } else if (size > buffer_size) 758 n = n->rb_right; 759 else { 760 best_fit = n; 761 break; 762 } 763 } 764 if (best_fit == NULL) { 765 pr_err("binder: %d: binder_alloc_buf size %zd failed, " 766 "no address space\n", proc->pid, size); 767 return NULL; 768 } 769 if (n == NULL) { 770 buffer = rb_entry(best_fit, struct binder_buffer, rb_node); 771 buffer_size = binder_buffer_size(proc, buffer); 772 } 773 774 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 775 "binder: %d: binder_alloc_buf size %zd got buff" 776 "er %p size %zd\n", proc->pid, size, buffer, buffer_size); 777 778 has_page_addr = 779 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK); 780 if (n == NULL) { 781 if (size + sizeof(struct binder_buffer) + 4 >= buffer_size) 782 buffer_size = size; /* no room for other buffers */ 783 else 784 buffer_size = size + sizeof(struct binder_buffer); 785 } 786 end_page_addr = 787 (void *)PAGE_ALIGN((uintptr_t)buffer->data + buffer_size); 788 if (end_page_addr > has_page_addr) 789 end_page_addr = has_page_addr; 790 if (binder_update_page_range(proc, 1, 791 (void *)PAGE_ALIGN((uintptr_t)buffer->data), end_page_addr, NULL)) 792 return NULL; 793 794 rb_erase(best_fit, &proc->free_buffers); 795 buffer->free = 0; 796 binder_insert_allocated_buffer(proc, buffer); 797 if (buffer_size != size) { 798 struct binder_buffer *new_buffer = (void *)buffer->data + size; 799 list_add(&new_buffer->entry, &buffer->entry); 800 new_buffer->free = 1; 801 binder_insert_free_buffer(proc, new_buffer); 802 } 803 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 804 "binder: %d: binder_alloc_buf size %zd got " 805 "%p\n", proc->pid, size, buffer); 806 buffer->data_size = data_size; 807 buffer->offsets_size = offsets_size; 808 buffer->async_transaction = is_async; 809 if (is_async) { 810 proc->free_async_space -= size + sizeof(struct binder_buffer); 811 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 812 "binder: %d: binder_alloc_buf size %zd " 813 "async free %zd\n", proc->pid, size, 814 proc->free_async_space); 815 } 816 817 return buffer; 818} 819 820static void *buffer_start_page(struct binder_buffer *buffer) 821{ 822 return (void *)((uintptr_t)buffer & PAGE_MASK); 823} 824 825static void *buffer_end_page(struct binder_buffer *buffer) 826{ 827 return (void *)(((uintptr_t)(buffer + 1) - 1) & PAGE_MASK); 828} 829 830static void binder_delete_free_buffer(struct binder_proc *proc, 831 struct binder_buffer *buffer) 832{ 833 struct binder_buffer *prev, *next = NULL; 834 int free_page_end = 1; 835 int free_page_start = 1; 836 837 BUG_ON(proc->buffers.next == &buffer->entry); 838 prev = list_entry(buffer->entry.prev, struct binder_buffer, entry); 839 BUG_ON(!prev->free); 840 if (buffer_end_page(prev) == buffer_start_page(buffer)) { 841 free_page_start = 0; 842 if (buffer_end_page(prev) == buffer_end_page(buffer)) 843 free_page_end = 0; 844 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 845 "binder: %d: merge free, buffer %p " 846 "share page with %p\n", proc->pid, buffer, prev); 847 } 848 849 if (!list_is_last(&buffer->entry, &proc->buffers)) { 850 next = list_entry(buffer->entry.next, 851 struct binder_buffer, entry); 852 if (buffer_start_page(next) == buffer_end_page(buffer)) { 853 free_page_end = 0; 854 if (buffer_start_page(next) == 855 buffer_start_page(buffer)) 856 free_page_start = 0; 857 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 858 "binder: %d: merge free, buffer" 859 " %p share page with %p\n", proc->pid, 860 buffer, prev); 861 } 862 } 863 list_del(&buffer->entry); 864 if (free_page_start || free_page_end) { 865 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 866 "binder: %d: merge free, buffer %p do " 867 "not share page%s%s with with %p or %p\n", 868 proc->pid, buffer, free_page_start ? "" : " end", 869 free_page_end ? "" : " start", prev, next); 870 binder_update_page_range(proc, 0, free_page_start ? 871 buffer_start_page(buffer) : buffer_end_page(buffer), 872 (free_page_end ? buffer_end_page(buffer) : 873 buffer_start_page(buffer)) + PAGE_SIZE, NULL); 874 } 875} 876 877static void binder_free_buf(struct binder_proc *proc, 878 struct binder_buffer *buffer) 879{ 880 size_t size, buffer_size; 881 882 buffer_size = binder_buffer_size(proc, buffer); 883 884 size = ALIGN(buffer->data_size, sizeof(void *)) + 885 ALIGN(buffer->offsets_size, sizeof(void *)); 886 887 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 888 "binder: %d: binder_free_buf %p size %zd buffer" 889 "_size %zd\n", proc->pid, buffer, size, buffer_size); 890 891 BUG_ON(buffer->free); 892 BUG_ON(size > buffer_size); 893 BUG_ON(buffer->transaction != NULL); 894 BUG_ON((void *)buffer < proc->buffer); 895 BUG_ON((void *)buffer > proc->buffer + proc->buffer_size); 896 897 if (buffer->async_transaction) { 898 proc->free_async_space += size + sizeof(struct binder_buffer); 899 900 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 901 "binder: %d: binder_free_buf size %zd " 902 "async free %zd\n", proc->pid, size, 903 proc->free_async_space); 904 } 905 906 binder_update_page_range(proc, 0, 907 (void *)PAGE_ALIGN((uintptr_t)buffer->data), 908 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK), 909 NULL); 910 rb_erase(&buffer->rb_node, &proc->allocated_buffers); 911 buffer->free = 1; 912 if (!list_is_last(&buffer->entry, &proc->buffers)) { 913 struct binder_buffer *next = list_entry(buffer->entry.next, 914 struct binder_buffer, entry); 915 if (next->free) { 916 rb_erase(&next->rb_node, &proc->free_buffers); 917 binder_delete_free_buffer(proc, next); 918 } 919 } 920 if (proc->buffers.next != &buffer->entry) { 921 struct binder_buffer *prev = list_entry(buffer->entry.prev, 922 struct binder_buffer, entry); 923 if (prev->free) { 924 binder_delete_free_buffer(proc, buffer); 925 rb_erase(&prev->rb_node, &proc->free_buffers); 926 buffer = prev; 927 } 928 } 929 binder_insert_free_buffer(proc, buffer); 930} 931 932static struct binder_node *binder_get_node(struct binder_proc *proc, 933 void __user *ptr) 934{ 935 struct rb_node *n = proc->nodes.rb_node; 936 struct binder_node *node; 937 938 while (n) { 939 node = rb_entry(n, struct binder_node, rb_node); 940 941 if (ptr < node->ptr) 942 n = n->rb_left; 943 else if (ptr > node->ptr) 944 n = n->rb_right; 945 else 946 return node; 947 } 948 return NULL; 949} 950 951static struct binder_node *binder_new_node(struct binder_proc *proc, 952 void __user *ptr, 953 void __user *cookie) 954{ 955 struct rb_node **p = &proc->nodes.rb_node; 956 struct rb_node *parent = NULL; 957 struct binder_node *node; 958 959 while (*p) { 960 parent = *p; 961 node = rb_entry(parent, struct binder_node, rb_node); 962 963 if (ptr < node->ptr) 964 p = &(*p)->rb_left; 965 else if (ptr > node->ptr) 966 p = &(*p)->rb_right; 967 else 968 return NULL; 969 } 970 971 node = kzalloc(sizeof(*node), GFP_KERNEL); 972 if (node == NULL) 973 return NULL; 974 binder_stats_created(BINDER_STAT_NODE); 975 rb_link_node(&node->rb_node, parent, p); 976 rb_insert_color(&node->rb_node, &proc->nodes); 977 node->debug_id = ++binder_last_id; 978 node->proc = proc; 979 node->ptr = ptr; 980 node->cookie = cookie; 981 node->work.type = BINDER_WORK_NODE; 982 INIT_LIST_HEAD(&node->work.entry); 983 INIT_LIST_HEAD(&node->async_todo); 984 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 985 "binder: %d:%d node %d u%p c%p created\n", 986 proc->pid, current->pid, node->debug_id, 987 node->ptr, node->cookie); 988 return node; 989} 990 991static int binder_inc_node(struct binder_node *node, int strong, int internal, 992 struct list_head *target_list) 993{ 994 if (strong) { 995 if (internal) { 996 if (target_list == NULL && 997 node->internal_strong_refs == 0 && 998 !(node == binder_context_mgr_node && 999 node->has_strong_ref)) { 1000 pr_err("binder: invalid inc strong " 1001 "node for %d\n", node->debug_id); 1002 return -EINVAL; 1003 } 1004 node->internal_strong_refs++; 1005 } else 1006 node->local_strong_refs++; 1007 if (!node->has_strong_ref && target_list) { 1008 list_del_init(&node->work.entry); 1009 list_add_tail(&node->work.entry, target_list); 1010 } 1011 } else { 1012 if (!internal) 1013 node->local_weak_refs++; 1014 if (!node->has_weak_ref && list_empty(&node->work.entry)) { 1015 if (target_list == NULL) { 1016 pr_err("binder: invalid inc weak node " 1017 "for %d\n", node->debug_id); 1018 return -EINVAL; 1019 } 1020 list_add_tail(&node->work.entry, target_list); 1021 } 1022 } 1023 return 0; 1024} 1025 1026static int binder_dec_node(struct binder_node *node, int strong, int internal) 1027{ 1028 if (strong) { 1029 if (internal) 1030 node->internal_strong_refs--; 1031 else 1032 node->local_strong_refs--; 1033 if (node->local_strong_refs || node->internal_strong_refs) 1034 return 0; 1035 } else { 1036 if (!internal) 1037 node->local_weak_refs--; 1038 if (node->local_weak_refs || !hlist_empty(&node->refs)) 1039 return 0; 1040 } 1041 if (node->proc && (node->has_strong_ref || node->has_weak_ref)) { 1042 if (list_empty(&node->work.entry)) { 1043 list_add_tail(&node->work.entry, &node->proc->todo); 1044 wake_up_interruptible(&node->proc->wait); 1045 } 1046 } else { 1047 if (hlist_empty(&node->refs) && !node->local_strong_refs && 1048 !node->local_weak_refs) { 1049 list_del_init(&node->work.entry); 1050 if (node->proc) { 1051 rb_erase(&node->rb_node, &node->proc->nodes); 1052 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1053 "binder: refless node %d deleted\n", 1054 node->debug_id); 1055 } else { 1056 hlist_del(&node->dead_node); 1057 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1058 "binder: dead node %d deleted\n", 1059 node->debug_id); 1060 } 1061 kfree(node); 1062 binder_stats_deleted(BINDER_STAT_NODE); 1063 } 1064 } 1065 1066 return 0; 1067} 1068 1069 1070static struct binder_ref *binder_get_ref(struct binder_proc *proc, 1071 uint32_t desc) 1072{ 1073 struct rb_node *n = proc->refs_by_desc.rb_node; 1074 struct binder_ref *ref; 1075 1076 while (n) { 1077 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1078 1079 if (desc < ref->desc) 1080 n = n->rb_left; 1081 else if (desc > ref->desc) 1082 n = n->rb_right; 1083 else 1084 return ref; 1085 } 1086 return NULL; 1087} 1088 1089static struct binder_ref *binder_get_ref_for_node(struct binder_proc *proc, 1090 struct binder_node *node) 1091{ 1092 struct rb_node *n; 1093 struct rb_node **p = &proc->refs_by_node.rb_node; 1094 struct rb_node *parent = NULL; 1095 struct binder_ref *ref, *new_ref; 1096 1097 while (*p) { 1098 parent = *p; 1099 ref = rb_entry(parent, struct binder_ref, rb_node_node); 1100 1101 if (node < ref->node) 1102 p = &(*p)->rb_left; 1103 else if (node > ref->node) 1104 p = &(*p)->rb_right; 1105 else 1106 return ref; 1107 } 1108 new_ref = kzalloc(sizeof(*ref), GFP_KERNEL); 1109 if (new_ref == NULL) 1110 return NULL; 1111 binder_stats_created(BINDER_STAT_REF); 1112 new_ref->debug_id = ++binder_last_id; 1113 new_ref->proc = proc; 1114 new_ref->node = node; 1115 rb_link_node(&new_ref->rb_node_node, parent, p); 1116 rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node); 1117 1118 new_ref->desc = (node == binder_context_mgr_node) ? 0 : 1; 1119 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 1120 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1121 if (ref->desc > new_ref->desc) 1122 break; 1123 new_ref->desc = ref->desc + 1; 1124 } 1125 1126 p = &proc->refs_by_desc.rb_node; 1127 while (*p) { 1128 parent = *p; 1129 ref = rb_entry(parent, struct binder_ref, rb_node_desc); 1130 1131 if (new_ref->desc < ref->desc) 1132 p = &(*p)->rb_left; 1133 else if (new_ref->desc > ref->desc) 1134 p = &(*p)->rb_right; 1135 else 1136 BUG(); 1137 } 1138 rb_link_node(&new_ref->rb_node_desc, parent, p); 1139 rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc); 1140 if (node) { 1141 hlist_add_head(&new_ref->node_entry, &node->refs); 1142 1143 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1144 "binder: %d new ref %d desc %d for " 1145 "node %d\n", proc->pid, new_ref->debug_id, 1146 new_ref->desc, node->debug_id); 1147 } else { 1148 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1149 "binder: %d new ref %d desc %d for " 1150 "dead node\n", proc->pid, new_ref->debug_id, 1151 new_ref->desc); 1152 } 1153 return new_ref; 1154} 1155 1156static void binder_delete_ref(struct binder_ref *ref) 1157{ 1158 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1159 "binder: %d delete ref %d desc %d for " 1160 "node %d\n", ref->proc->pid, ref->debug_id, 1161 ref->desc, ref->node->debug_id); 1162 1163 rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc); 1164 rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node); 1165 if (ref->strong) 1166 binder_dec_node(ref->node, 1, 1); 1167 hlist_del(&ref->node_entry); 1168 binder_dec_node(ref->node, 0, 1); 1169 if (ref->death) { 1170 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1171 "binder: %d delete ref %d desc %d " 1172 "has death notification\n", ref->proc->pid, 1173 ref->debug_id, ref->desc); 1174 list_del(&ref->death->work.entry); 1175 kfree(ref->death); 1176 binder_stats_deleted(BINDER_STAT_DEATH); 1177 } 1178 kfree(ref); 1179 binder_stats_deleted(BINDER_STAT_REF); 1180} 1181 1182static int binder_inc_ref(struct binder_ref *ref, int strong, 1183 struct list_head *target_list) 1184{ 1185 int ret; 1186 if (strong) { 1187 if (ref->strong == 0) { 1188 ret = binder_inc_node(ref->node, 1, 1, target_list); 1189 if (ret) 1190 return ret; 1191 } 1192 ref->strong++; 1193 } else { 1194 if (ref->weak == 0) { 1195 ret = binder_inc_node(ref->node, 0, 1, target_list); 1196 if (ret) 1197 return ret; 1198 } 1199 ref->weak++; 1200 } 1201 return 0; 1202} 1203 1204 1205static int binder_dec_ref(struct binder_ref *ref, int strong) 1206{ 1207 if (strong) { 1208 if (ref->strong == 0) { 1209 binder_user_error("binder: %d invalid dec strong, " 1210 "ref %d desc %d s %d w %d\n", 1211 ref->proc->pid, ref->debug_id, 1212 ref->desc, ref->strong, ref->weak); 1213 return -EINVAL; 1214 } 1215 ref->strong--; 1216 if (ref->strong == 0) { 1217 int ret; 1218 ret = binder_dec_node(ref->node, strong, 1); 1219 if (ret) 1220 return ret; 1221 } 1222 } else { 1223 if (ref->weak == 0) { 1224 binder_user_error("binder: %d invalid dec weak, " 1225 "ref %d desc %d s %d w %d\n", 1226 ref->proc->pid, ref->debug_id, 1227 ref->desc, ref->strong, ref->weak); 1228 return -EINVAL; 1229 } 1230 ref->weak--; 1231 } 1232 if (ref->strong == 0 && ref->weak == 0) 1233 binder_delete_ref(ref); 1234 return 0; 1235} 1236 1237static void binder_pop_transaction(struct binder_thread *target_thread, 1238 struct binder_transaction *t) 1239{ 1240 if (target_thread) { 1241 BUG_ON(target_thread->transaction_stack != t); 1242 BUG_ON(target_thread->transaction_stack->from != target_thread); 1243 target_thread->transaction_stack = 1244 target_thread->transaction_stack->from_parent; 1245 t->from = NULL; 1246 } 1247 t->need_reply = 0; 1248 if (t->buffer) 1249 t->buffer->transaction = NULL; 1250 kfree(t); 1251 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1252} 1253 1254static void binder_send_failed_reply(struct binder_transaction *t, 1255 uint32_t error_code) 1256{ 1257 struct binder_thread *target_thread; 1258 BUG_ON(t->flags & TF_ONE_WAY); 1259 while (1) { 1260 target_thread = t->from; 1261 if (target_thread) { 1262 if (target_thread->return_error != BR_OK && 1263 target_thread->return_error2 == BR_OK) { 1264 target_thread->return_error2 = 1265 target_thread->return_error; 1266 target_thread->return_error = BR_OK; 1267 } 1268 if (target_thread->return_error == BR_OK) { 1269 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1270 "binder: send failed reply for " 1271 "transaction %d to %d:%d\n", 1272 t->debug_id, target_thread->proc->pid, 1273 target_thread->pid); 1274 1275 binder_pop_transaction(target_thread, t); 1276 target_thread->return_error = error_code; 1277 wake_up_interruptible(&target_thread->wait); 1278 } else { 1279 pr_err("binder: reply failed, target " 1280 "thread, %d:%d, has error code %d " 1281 "already\n", target_thread->proc->pid, 1282 target_thread->pid, 1283 target_thread->return_error); 1284 } 1285 return; 1286 } else { 1287 struct binder_transaction *next = t->from_parent; 1288 1289 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1290 "binder: send failed reply " 1291 "for transaction %d, target dead\n", 1292 t->debug_id); 1293 1294 binder_pop_transaction(target_thread, t); 1295 if (next == NULL) { 1296 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1297 "binder: reply failed," 1298 " no target thread at root\n"); 1299 return; 1300 } 1301 t = next; 1302 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1303 "binder: reply failed, no target " 1304 "thread -- retry %d\n", t->debug_id); 1305 } 1306 } 1307} 1308 1309static void binder_transaction_buffer_release(struct binder_proc *proc, 1310 struct binder_buffer *buffer, 1311 size_t *failed_at) 1312{ 1313 size_t *offp, *off_end; 1314 int debug_id = buffer->debug_id; 1315 1316 binder_debug(BINDER_DEBUG_TRANSACTION, 1317 "binder: %d buffer release %d, size %zd-%zd, failed at %p\n", 1318 proc->pid, buffer->debug_id, 1319 buffer->data_size, buffer->offsets_size, failed_at); 1320 1321 if (buffer->target_node) 1322 binder_dec_node(buffer->target_node, 1, 0); 1323 1324 offp = (size_t *)(buffer->data + ALIGN(buffer->data_size, sizeof(void *))); 1325 if (failed_at) 1326 off_end = failed_at; 1327 else 1328 off_end = (void *)offp + buffer->offsets_size; 1329 for (; offp < off_end; offp++) { 1330 struct flat_binder_object *fp; 1331 if (*offp > buffer->data_size - sizeof(*fp) || 1332 buffer->data_size < sizeof(*fp) || 1333 !IS_ALIGNED(*offp, sizeof(void *))) { 1334 pr_err("binder: transaction release %d bad" 1335 "offset %zd, size %zd\n", debug_id, 1336 *offp, buffer->data_size); 1337 continue; 1338 } 1339 fp = (struct flat_binder_object *)(buffer->data + *offp); 1340 switch (fp->type) { 1341 case BINDER_TYPE_BINDER: 1342 case BINDER_TYPE_WEAK_BINDER: { 1343 struct binder_node *node = binder_get_node(proc, fp->binder); 1344 if (node == NULL) { 1345 pr_err("binder: transaction release %d" 1346 " bad node %p\n", debug_id, fp->binder); 1347 break; 1348 } 1349 binder_debug(BINDER_DEBUG_TRANSACTION, 1350 " node %d u%p\n", 1351 node->debug_id, node->ptr); 1352 binder_dec_node(node, fp->type == BINDER_TYPE_BINDER, 0); 1353 } break; 1354 case BINDER_TYPE_HANDLE: 1355 case BINDER_TYPE_WEAK_HANDLE: { 1356 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1357 if (ref == NULL) { 1358 pr_err("binder: transaction release %d" 1359 " bad handle %ld\n", debug_id, 1360 fp->handle); 1361 break; 1362 } 1363 binder_debug(BINDER_DEBUG_TRANSACTION, 1364 " ref %d desc %d (node %d)\n", 1365 ref->debug_id, ref->desc, ref->node->debug_id); 1366 binder_dec_ref(ref, fp->type == BINDER_TYPE_HANDLE); 1367 } break; 1368 1369 case BINDER_TYPE_FD: 1370 binder_debug(BINDER_DEBUG_TRANSACTION, 1371 " fd %ld\n", fp->handle); 1372 if (failed_at) 1373 task_close_fd(proc, fp->handle); 1374 break; 1375 1376 default: 1377 pr_err("binder: transaction release %d bad " 1378 "object type %lx\n", debug_id, fp->type); 1379 break; 1380 } 1381 } 1382} 1383 1384static void binder_transaction(struct binder_proc *proc, 1385 struct binder_thread *thread, 1386 struct binder_transaction_data *tr, int reply) 1387{ 1388 struct binder_transaction *t; 1389 struct binder_work *tcomplete; 1390 size_t *offp, *off_end; 1391 struct binder_proc *target_proc; 1392 struct binder_thread *target_thread = NULL; 1393 struct binder_node *target_node = NULL; 1394 struct list_head *target_list; 1395 wait_queue_head_t *target_wait; 1396 struct binder_transaction *in_reply_to = NULL; 1397 struct binder_transaction_log_entry *e; 1398 uint32_t return_error; 1399 1400 e = binder_transaction_log_add(&binder_transaction_log); 1401 e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY); 1402 e->from_proc = proc->pid; 1403 e->from_thread = thread->pid; 1404 e->target_handle = tr->target.handle; 1405 e->data_size = tr->data_size; 1406 e->offsets_size = tr->offsets_size; 1407 1408 if (reply) { 1409 in_reply_to = thread->transaction_stack; 1410 if (in_reply_to == NULL) { 1411 binder_user_error("binder: %d:%d got reply transaction " 1412 "with no transaction stack\n", 1413 proc->pid, thread->pid); 1414 return_error = BR_FAILED_REPLY; 1415 goto err_empty_call_stack; 1416 } 1417 binder_set_nice(in_reply_to->saved_priority); 1418 if (in_reply_to->to_thread != thread) { 1419 binder_user_error("binder: %d:%d got reply transaction " 1420 "with bad transaction stack," 1421 " transaction %d has target %d:%d\n", 1422 proc->pid, thread->pid, in_reply_to->debug_id, 1423 in_reply_to->to_proc ? 1424 in_reply_to->to_proc->pid : 0, 1425 in_reply_to->to_thread ? 1426 in_reply_to->to_thread->pid : 0); 1427 return_error = BR_FAILED_REPLY; 1428 in_reply_to = NULL; 1429 goto err_bad_call_stack; 1430 } 1431 thread->transaction_stack = in_reply_to->to_parent; 1432 target_thread = in_reply_to->from; 1433 if (target_thread == NULL) { 1434 return_error = BR_DEAD_REPLY; 1435 goto err_dead_binder; 1436 } 1437 if (target_thread->transaction_stack != in_reply_to) { 1438 binder_user_error("binder: %d:%d got reply transaction " 1439 "with bad target transaction stack %d, " 1440 "expected %d\n", 1441 proc->pid, thread->pid, 1442 target_thread->transaction_stack ? 1443 target_thread->transaction_stack->debug_id : 0, 1444 in_reply_to->debug_id); 1445 return_error = BR_FAILED_REPLY; 1446 in_reply_to = NULL; 1447 target_thread = NULL; 1448 goto err_dead_binder; 1449 } 1450 target_proc = target_thread->proc; 1451 } else { 1452 if (tr->target.handle) { 1453 struct binder_ref *ref; 1454 ref = binder_get_ref(proc, tr->target.handle); 1455 if (ref == NULL) { 1456 binder_user_error("binder: %d:%d got " 1457 "transaction to invalid handle\n", 1458 proc->pid, thread->pid); 1459 return_error = BR_FAILED_REPLY; 1460 goto err_invalid_target_handle; 1461 } 1462 target_node = ref->node; 1463 } else { 1464 target_node = binder_context_mgr_node; 1465 if (target_node == NULL) { 1466 return_error = BR_DEAD_REPLY; 1467 goto err_no_context_mgr_node; 1468 } 1469 } 1470 e->to_node = target_node->debug_id; 1471 target_proc = target_node->proc; 1472 if (target_proc == NULL) { 1473 return_error = BR_DEAD_REPLY; 1474 goto err_dead_binder; 1475 } 1476 if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) { 1477 struct binder_transaction *tmp; 1478 tmp = thread->transaction_stack; 1479 if (tmp->to_thread != thread) { 1480 binder_user_error("binder: %d:%d got new " 1481 "transaction with bad transaction stack" 1482 ", transaction %d has target %d:%d\n", 1483 proc->pid, thread->pid, tmp->debug_id, 1484 tmp->to_proc ? tmp->to_proc->pid : 0, 1485 tmp->to_thread ? 1486 tmp->to_thread->pid : 0); 1487 return_error = BR_FAILED_REPLY; 1488 goto err_bad_call_stack; 1489 } 1490 while (tmp) { 1491 if (tmp->from && tmp->from->proc == target_proc) 1492 target_thread = tmp->from; 1493 tmp = tmp->from_parent; 1494 } 1495 } 1496 } 1497 if (target_thread) { 1498 e->to_thread = target_thread->pid; 1499 target_list = &target_thread->todo; 1500 target_wait = &target_thread->wait; 1501 } else { 1502 target_list = &target_proc->todo; 1503 target_wait = &target_proc->wait; 1504 } 1505 e->to_proc = target_proc->pid; 1506 1507 /* TODO: reuse incoming transaction for reply */ 1508 t = kzalloc(sizeof(*t), GFP_KERNEL); 1509 if (t == NULL) { 1510 return_error = BR_FAILED_REPLY; 1511 goto err_alloc_t_failed; 1512 } 1513 binder_stats_created(BINDER_STAT_TRANSACTION); 1514 1515 tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL); 1516 if (tcomplete == NULL) { 1517 return_error = BR_FAILED_REPLY; 1518 goto err_alloc_tcomplete_failed; 1519 } 1520 binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE); 1521 1522 t->debug_id = ++binder_last_id; 1523 e->debug_id = t->debug_id; 1524 1525 if (reply) 1526 binder_debug(BINDER_DEBUG_TRANSACTION, 1527 "binder: %d:%d BC_REPLY %d -> %d:%d, " 1528 "data %p-%p size %zd-%zd\n", 1529 proc->pid, thread->pid, t->debug_id, 1530 target_proc->pid, target_thread->pid, 1531 tr->data.ptr.buffer, tr->data.ptr.offsets, 1532 tr->data_size, tr->offsets_size); 1533 else 1534 binder_debug(BINDER_DEBUG_TRANSACTION, 1535 "binder: %d:%d BC_TRANSACTION %d -> " 1536 "%d - node %d, data %p-%p size %zd-%zd\n", 1537 proc->pid, thread->pid, t->debug_id, 1538 target_proc->pid, target_node->debug_id, 1539 tr->data.ptr.buffer, tr->data.ptr.offsets, 1540 tr->data_size, tr->offsets_size); 1541 1542 if (!reply && !(tr->flags & TF_ONE_WAY)) 1543 t->from = thread; 1544 else 1545 t->from = NULL; 1546 t->sender_euid = proc->tsk->cred->euid; 1547 t->to_proc = target_proc; 1548 t->to_thread = target_thread; 1549 t->code = tr->code; 1550 t->flags = tr->flags; 1551 t->priority = task_nice(current); 1552 t->buffer = binder_alloc_buf(target_proc, tr->data_size, 1553 tr->offsets_size, !reply && (t->flags & TF_ONE_WAY)); 1554 if (t->buffer == NULL) { 1555 return_error = BR_FAILED_REPLY; 1556 goto err_binder_alloc_buf_failed; 1557 } 1558 t->buffer->allow_user_free = 0; 1559 t->buffer->debug_id = t->debug_id; 1560 t->buffer->transaction = t; 1561 t->buffer->target_node = target_node; 1562 if (target_node) 1563 binder_inc_node(target_node, 1, 0, NULL); 1564 1565 offp = (size_t *)(t->buffer->data + ALIGN(tr->data_size, sizeof(void *))); 1566 1567 if (copy_from_user(t->buffer->data, tr->data.ptr.buffer, tr->data_size)) { 1568 binder_user_error("binder: %d:%d got transaction with invalid " 1569 "data ptr\n", proc->pid, thread->pid); 1570 return_error = BR_FAILED_REPLY; 1571 goto err_copy_data_failed; 1572 } 1573 if (copy_from_user(offp, tr->data.ptr.offsets, tr->offsets_size)) { 1574 binder_user_error("binder: %d:%d got transaction with invalid " 1575 "offsets ptr\n", proc->pid, thread->pid); 1576 return_error = BR_FAILED_REPLY; 1577 goto err_copy_data_failed; 1578 } 1579 if (!IS_ALIGNED(tr->offsets_size, sizeof(size_t))) { 1580 binder_user_error("binder: %d:%d got transaction with " 1581 "invalid offsets size, %zd\n", 1582 proc->pid, thread->pid, tr->offsets_size); 1583 return_error = BR_FAILED_REPLY; 1584 goto err_bad_offset; 1585 } 1586 off_end = (void *)offp + tr->offsets_size; 1587 for (; offp < off_end; offp++) { 1588 struct flat_binder_object *fp; 1589 if (*offp > t->buffer->data_size - sizeof(*fp) || 1590 t->buffer->data_size < sizeof(*fp) || 1591 !IS_ALIGNED(*offp, sizeof(void *))) { 1592 binder_user_error("binder: %d:%d got transaction with " 1593 "invalid offset, %zd\n", 1594 proc->pid, thread->pid, *offp); 1595 return_error = BR_FAILED_REPLY; 1596 goto err_bad_offset; 1597 } 1598 fp = (struct flat_binder_object *)(t->buffer->data + *offp); 1599 switch (fp->type) { 1600 case BINDER_TYPE_BINDER: 1601 case BINDER_TYPE_WEAK_BINDER: { 1602 struct binder_ref *ref; 1603 struct binder_node *node = binder_get_node(proc, fp->binder); 1604 if (node == NULL) { 1605 node = binder_new_node(proc, fp->binder, fp->cookie); 1606 if (node == NULL) { 1607 return_error = BR_FAILED_REPLY; 1608 goto err_binder_new_node_failed; 1609 } 1610 node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK; 1611 node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS); 1612 } 1613 if (fp->cookie != node->cookie) { 1614 binder_user_error("binder: %d:%d sending u%p " 1615 "node %d, cookie mismatch %p != %p\n", 1616 proc->pid, thread->pid, 1617 fp->binder, node->debug_id, 1618 fp->cookie, node->cookie); 1619 goto err_binder_get_ref_for_node_failed; 1620 } 1621 ref = binder_get_ref_for_node(target_proc, node); 1622 if (ref == NULL) { 1623 return_error = BR_FAILED_REPLY; 1624 goto err_binder_get_ref_for_node_failed; 1625 } 1626 if (fp->type == BINDER_TYPE_BINDER) 1627 fp->type = BINDER_TYPE_HANDLE; 1628 else 1629 fp->type = BINDER_TYPE_WEAK_HANDLE; 1630 fp->handle = ref->desc; 1631 binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE, 1632 &thread->todo); 1633 1634 binder_debug(BINDER_DEBUG_TRANSACTION, 1635 " node %d u%p -> ref %d desc %d\n", 1636 node->debug_id, node->ptr, ref->debug_id, 1637 ref->desc); 1638 } break; 1639 case BINDER_TYPE_HANDLE: 1640 case BINDER_TYPE_WEAK_HANDLE: { 1641 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1642 if (ref == NULL) { 1643 binder_user_error("binder: %d:%d got " 1644 "transaction with invalid " 1645 "handle, %ld\n", proc->pid, 1646 thread->pid, fp->handle); 1647 return_error = BR_FAILED_REPLY; 1648 goto err_binder_get_ref_failed; 1649 } 1650 if (ref->node->proc == target_proc) { 1651 if (fp->type == BINDER_TYPE_HANDLE) 1652 fp->type = BINDER_TYPE_BINDER; 1653 else 1654 fp->type = BINDER_TYPE_WEAK_BINDER; 1655 fp->binder = ref->node->ptr; 1656 fp->cookie = ref->node->cookie; 1657 binder_inc_node(ref->node, fp->type == BINDER_TYPE_BINDER, 0, NULL); 1658 binder_debug(BINDER_DEBUG_TRANSACTION, 1659 " ref %d desc %d -> node %d u%p\n", 1660 ref->debug_id, ref->desc, ref->node->debug_id, 1661 ref->node->ptr); 1662 } else { 1663 struct binder_ref *new_ref; 1664 new_ref = binder_get_ref_for_node(target_proc, ref->node); 1665 if (new_ref == NULL) { 1666 return_error = BR_FAILED_REPLY; 1667 goto err_binder_get_ref_for_node_failed; 1668 } 1669 fp->handle = new_ref->desc; 1670 binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL); 1671 binder_debug(BINDER_DEBUG_TRANSACTION, 1672 " ref %d desc %d -> ref %d desc %d (node %d)\n", 1673 ref->debug_id, ref->desc, new_ref->debug_id, 1674 new_ref->desc, ref->node->debug_id); 1675 } 1676 } break; 1677 1678 case BINDER_TYPE_FD: { 1679 int target_fd; 1680 struct file *file; 1681 1682 if (reply) { 1683 if (!(in_reply_to->flags & TF_ACCEPT_FDS)) { 1684 binder_user_error("binder: %d:%d got reply with fd, %ld, but target does not allow fds\n", 1685 proc->pid, thread->pid, fp->handle); 1686 return_error = BR_FAILED_REPLY; 1687 goto err_fd_not_allowed; 1688 } 1689 } else if (!target_node->accept_fds) { 1690 binder_user_error("binder: %d:%d got transaction with fd, %ld, but target does not allow fds\n", 1691 proc->pid, thread->pid, fp->handle); 1692 return_error = BR_FAILED_REPLY; 1693 goto err_fd_not_allowed; 1694 } 1695 1696 file = fget(fp->handle); 1697 if (file == NULL) { 1698 binder_user_error("binder: %d:%d got transaction with invalid fd, %ld\n", 1699 proc->pid, thread->pid, fp->handle); 1700 return_error = BR_FAILED_REPLY; 1701 goto err_fget_failed; 1702 } 1703 target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC); 1704 if (target_fd < 0) { 1705 fput(file); 1706 return_error = BR_FAILED_REPLY; 1707 goto err_get_unused_fd_failed; 1708 } 1709 task_fd_install(target_proc, target_fd, file); 1710 binder_debug(BINDER_DEBUG_TRANSACTION, 1711 " fd %ld -> %d\n", fp->handle, target_fd); 1712 /* TODO: fput? */ 1713 fp->handle = target_fd; 1714 } break; 1715 1716 default: 1717 binder_user_error("binder: %d:%d got transactio" 1718 "n with invalid object type, %lx\n", 1719 proc->pid, thread->pid, fp->type); 1720 return_error = BR_FAILED_REPLY; 1721 goto err_bad_object_type; 1722 } 1723 } 1724 if (reply) { 1725 BUG_ON(t->buffer->async_transaction != 0); 1726 binder_pop_transaction(target_thread, in_reply_to); 1727 } else if (!(t->flags & TF_ONE_WAY)) { 1728 BUG_ON(t->buffer->async_transaction != 0); 1729 t->need_reply = 1; 1730 t->from_parent = thread->transaction_stack; 1731 thread->transaction_stack = t; 1732 } else { 1733 BUG_ON(target_node == NULL); 1734 BUG_ON(t->buffer->async_transaction != 1); 1735 if (target_node->has_async_transaction) { 1736 target_list = &target_node->async_todo; 1737 target_wait = NULL; 1738 } else 1739 target_node->has_async_transaction = 1; 1740 } 1741 t->work.type = BINDER_WORK_TRANSACTION; 1742 list_add_tail(&t->work.entry, target_list); 1743 tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE; 1744 list_add_tail(&tcomplete->entry, &thread->todo); 1745 if (target_wait) 1746 wake_up_interruptible(target_wait); 1747 return; 1748 1749err_get_unused_fd_failed: 1750err_fget_failed: 1751err_fd_not_allowed: 1752err_binder_get_ref_for_node_failed: 1753err_binder_get_ref_failed: 1754err_binder_new_node_failed: 1755err_bad_object_type: 1756err_bad_offset: 1757err_copy_data_failed: 1758 binder_transaction_buffer_release(target_proc, t->buffer, offp); 1759 t->buffer->transaction = NULL; 1760 binder_free_buf(target_proc, t->buffer); 1761err_binder_alloc_buf_failed: 1762 kfree(tcomplete); 1763 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 1764err_alloc_tcomplete_failed: 1765 kfree(t); 1766 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1767err_alloc_t_failed: 1768err_bad_call_stack: 1769err_empty_call_stack: 1770err_dead_binder: 1771err_invalid_target_handle: 1772err_no_context_mgr_node: 1773 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1774 "binder: %d:%d transaction failed %d, size %zd-%zd\n", 1775 proc->pid, thread->pid, return_error, 1776 tr->data_size, tr->offsets_size); 1777 1778 { 1779 struct binder_transaction_log_entry *fe; 1780 fe = binder_transaction_log_add(&binder_transaction_log_failed); 1781 *fe = *e; 1782 } 1783 1784 BUG_ON(thread->return_error != BR_OK); 1785 if (in_reply_to) { 1786 thread->return_error = BR_TRANSACTION_COMPLETE; 1787 binder_send_failed_reply(in_reply_to, return_error); 1788 } else 1789 thread->return_error = return_error; 1790} 1791 1792int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread, 1793 void __user *buffer, int size, signed long *consumed) 1794{ 1795 uint32_t cmd; 1796 void __user *ptr = buffer + *consumed; 1797 void __user *end = buffer + size; 1798 1799 while (ptr < end && thread->return_error == BR_OK) { 1800 if (get_user(cmd, (uint32_t __user *)ptr)) 1801 return -EFAULT; 1802 ptr += sizeof(uint32_t); 1803 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) { 1804 binder_stats.bc[_IOC_NR(cmd)]++; 1805 proc->stats.bc[_IOC_NR(cmd)]++; 1806 thread->stats.bc[_IOC_NR(cmd)]++; 1807 } 1808 switch (cmd) { 1809 case BC_INCREFS: 1810 case BC_ACQUIRE: 1811 case BC_RELEASE: 1812 case BC_DECREFS: { 1813 uint32_t target; 1814 struct binder_ref *ref; 1815 const char *debug_string; 1816 1817 if (get_user(target, (uint32_t __user *)ptr)) 1818 return -EFAULT; 1819 ptr += sizeof(uint32_t); 1820 if (target == 0 && binder_context_mgr_node && 1821 (cmd == BC_INCREFS || cmd == BC_ACQUIRE)) { 1822 ref = binder_get_ref_for_node(proc, 1823 binder_context_mgr_node); 1824 if (ref->desc != target) { 1825 binder_user_error("binder: %d:" 1826 "%d tried to acquire " 1827 "reference to desc 0, " 1828 "got %d instead\n", 1829 proc->pid, thread->pid, 1830 ref->desc); 1831 } 1832 } else 1833 ref = binder_get_ref(proc, target); 1834 if (ref == NULL) { 1835 binder_user_error("binder: %d:%d refcou" 1836 "nt change on invalid ref %d\n", 1837 proc->pid, thread->pid, target); 1838 break; 1839 } 1840 switch (cmd) { 1841 case BC_INCREFS: 1842 debug_string = "IncRefs"; 1843 binder_inc_ref(ref, 0, NULL); 1844 break; 1845 case BC_ACQUIRE: 1846 debug_string = "Acquire"; 1847 binder_inc_ref(ref, 1, NULL); 1848 break; 1849 case BC_RELEASE: 1850 debug_string = "Release"; 1851 binder_dec_ref(ref, 1); 1852 break; 1853 case BC_DECREFS: 1854 default: 1855 debug_string = "DecRefs"; 1856 binder_dec_ref(ref, 0); 1857 break; 1858 } 1859 binder_debug(BINDER_DEBUG_USER_REFS, 1860 "binder: %d:%d %s ref %d desc %d s %d w %d for node %d\n", 1861 proc->pid, thread->pid, debug_string, ref->debug_id, 1862 ref->desc, ref->strong, ref->weak, ref->node->debug_id); 1863 break; 1864 } 1865 case BC_INCREFS_DONE: 1866 case BC_ACQUIRE_DONE: { 1867 void __user *node_ptr; 1868 void *cookie; 1869 struct binder_node *node; 1870 1871 if (get_user(node_ptr, (void * __user *)ptr)) 1872 return -EFAULT; 1873 ptr += sizeof(void *); 1874 if (get_user(cookie, (void * __user *)ptr)) 1875 return -EFAULT; 1876 ptr += sizeof(void *); 1877 node = binder_get_node(proc, node_ptr); 1878 if (node == NULL) { 1879 binder_user_error("binder: %d:%d " 1880 "%s u%p no match\n", 1881 proc->pid, thread->pid, 1882 cmd == BC_INCREFS_DONE ? 1883 "BC_INCREFS_DONE" : 1884 "BC_ACQUIRE_DONE", 1885 node_ptr); 1886 break; 1887 } 1888 if (cookie != node->cookie) { 1889 binder_user_error("binder: %d:%d %s u%p node %d" 1890 " cookie mismatch %p != %p\n", 1891 proc->pid, thread->pid, 1892 cmd == BC_INCREFS_DONE ? 1893 "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1894 node_ptr, node->debug_id, 1895 cookie, node->cookie); 1896 break; 1897 } 1898 if (cmd == BC_ACQUIRE_DONE) { 1899 if (node->pending_strong_ref == 0) { 1900 binder_user_error("binder: %d:%d " 1901 "BC_ACQUIRE_DONE node %d has " 1902 "no pending acquire request\n", 1903 proc->pid, thread->pid, 1904 node->debug_id); 1905 break; 1906 } 1907 node->pending_strong_ref = 0; 1908 } else { 1909 if (node->pending_weak_ref == 0) { 1910 binder_user_error("binder: %d:%d " 1911 "BC_INCREFS_DONE node %d has " 1912 "no pending increfs request\n", 1913 proc->pid, thread->pid, 1914 node->debug_id); 1915 break; 1916 } 1917 node->pending_weak_ref = 0; 1918 } 1919 binder_dec_node(node, cmd == BC_ACQUIRE_DONE, 0); 1920 binder_debug(BINDER_DEBUG_USER_REFS, 1921 "binder: %d:%d %s node %d ls %d lw %d\n", 1922 proc->pid, thread->pid, 1923 cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1924 node->debug_id, node->local_strong_refs, node->local_weak_refs); 1925 break; 1926 } 1927 case BC_ATTEMPT_ACQUIRE: 1928 pr_err("binder: BC_ATTEMPT_ACQUIRE not supported\n"); 1929 return -EINVAL; 1930 case BC_ACQUIRE_RESULT: 1931 pr_err("binder: BC_ACQUIRE_RESULT not supported\n"); 1932 return -EINVAL; 1933 1934 case BC_FREE_BUFFER: { 1935 void __user *data_ptr; 1936 struct binder_buffer *buffer; 1937 1938 if (get_user(data_ptr, (void * __user *)ptr)) 1939 return -EFAULT; 1940 ptr += sizeof(void *); 1941 1942 buffer = binder_buffer_lookup(proc, data_ptr); 1943 if (buffer == NULL) { 1944 binder_user_error("binder: %d:%d " 1945 "BC_FREE_BUFFER u%p no match\n", 1946 proc->pid, thread->pid, data_ptr); 1947 break; 1948 } 1949 if (!buffer->allow_user_free) { 1950 binder_user_error("binder: %d:%d " 1951 "BC_FREE_BUFFER u%p matched " 1952 "unreturned buffer\n", 1953 proc->pid, thread->pid, data_ptr); 1954 break; 1955 } 1956 binder_debug(BINDER_DEBUG_FREE_BUFFER, 1957 "binder: %d:%d BC_FREE_BUFFER u%p found buffer %d for %s transaction\n", 1958 proc->pid, thread->pid, data_ptr, buffer->debug_id, 1959 buffer->transaction ? "active" : "finished"); 1960 1961 if (buffer->transaction) { 1962 buffer->transaction->buffer = NULL; 1963 buffer->transaction = NULL; 1964 } 1965 if (buffer->async_transaction && buffer->target_node) { 1966 BUG_ON(!buffer->target_node->has_async_transaction); 1967 if (list_empty(&buffer->target_node->async_todo)) 1968 buffer->target_node->has_async_transaction = 0; 1969 else 1970 list_move_tail(buffer->target_node->async_todo.next, &thread->todo); 1971 } 1972 binder_transaction_buffer_release(proc, buffer, NULL); 1973 binder_free_buf(proc, buffer); 1974 break; 1975 } 1976 1977 case BC_TRANSACTION: 1978 case BC_REPLY: { 1979 struct binder_transaction_data tr; 1980 1981 if (copy_from_user(&tr, ptr, sizeof(tr))) 1982 return -EFAULT; 1983 ptr += sizeof(tr); 1984 binder_transaction(proc, thread, &tr, cmd == BC_REPLY); 1985 break; 1986 } 1987 1988 case BC_REGISTER_LOOPER: 1989 binder_debug(BINDER_DEBUG_THREADS, 1990 "binder: %d:%d BC_REGISTER_LOOPER\n", 1991 proc->pid, thread->pid); 1992 if (thread->looper & BINDER_LOOPER_STATE_ENTERED) { 1993 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1994 binder_user_error("binder: %d:%d ERROR:" 1995 " BC_REGISTER_LOOPER called " 1996 "after BC_ENTER_LOOPER\n", 1997 proc->pid, thread->pid); 1998 } else if (proc->requested_threads == 0) { 1999 thread->looper |= BINDER_LOOPER_STATE_INVALID; 2000 binder_user_error("binder: %d:%d ERROR:" 2001 " BC_REGISTER_LOOPER called " 2002 "without request\n", 2003 proc->pid, thread->pid); 2004 } else { 2005 proc->requested_threads--; 2006 proc->requested_threads_started++; 2007 } 2008 thread->looper |= BINDER_LOOPER_STATE_REGISTERED; 2009 break; 2010 case BC_ENTER_LOOPER: 2011 binder_debug(BINDER_DEBUG_THREADS, 2012 "binder: %d:%d BC_ENTER_LOOPER\n", 2013 proc->pid, thread->pid); 2014 if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) { 2015 thread->looper |= BINDER_LOOPER_STATE_INVALID; 2016 binder_user_error("binder: %d:%d ERROR:" 2017 " BC_ENTER_LOOPER called after " 2018 "BC_REGISTER_LOOPER\n", 2019 proc->pid, thread->pid); 2020 } 2021 thread->looper |= BINDER_LOOPER_STATE_ENTERED; 2022 break; 2023 case BC_EXIT_LOOPER: 2024 binder_debug(BINDER_DEBUG_THREADS, 2025 "binder: %d:%d BC_EXIT_LOOPER\n", 2026 proc->pid, thread->pid); 2027 thread->looper |= BINDER_LOOPER_STATE_EXITED; 2028 break; 2029 2030 case BC_REQUEST_DEATH_NOTIFICATION: 2031 case BC_CLEAR_DEATH_NOTIFICATION: { 2032 uint32_t target; 2033 void __user *cookie; 2034 struct binder_ref *ref; 2035 struct binder_ref_death *death; 2036 2037 if (get_user(target, (uint32_t __user *)ptr)) 2038 return -EFAULT; 2039 ptr += sizeof(uint32_t); 2040 if (get_user(cookie, (void __user * __user *)ptr)) 2041 return -EFAULT; 2042 ptr += sizeof(void *); 2043 ref = binder_get_ref(proc, target); 2044 if (ref == NULL) { 2045 binder_user_error("binder: %d:%d %s " 2046 "invalid ref %d\n", 2047 proc->pid, thread->pid, 2048 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 2049 "BC_REQUEST_DEATH_NOTIFICATION" : 2050 "BC_CLEAR_DEATH_NOTIFICATION", 2051 target); 2052 break; 2053 } 2054 2055 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 2056 "binder: %d:%d %s %p ref %d desc %d s %d w %d for node %d\n", 2057 proc->pid, thread->pid, 2058 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 2059 "BC_REQUEST_DEATH_NOTIFICATION" : 2060 "BC_CLEAR_DEATH_NOTIFICATION", 2061 cookie, ref->debug_id, ref->desc, 2062 ref->strong, ref->weak, ref->node->debug_id); 2063 2064 if (cmd == BC_REQUEST_DEATH_NOTIFICATION) { 2065 if (ref->death) { 2066 binder_user_error("binder: %d:%" 2067 "d BC_REQUEST_DEATH_NOTI" 2068 "FICATION death notific" 2069 "ation already set\n", 2070 proc->pid, thread->pid); 2071 break; 2072 } 2073 death = kzalloc(sizeof(*death), GFP_KERNEL); 2074 if (death == NULL) { 2075 thread->return_error = BR_ERROR; 2076 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 2077 "binder: %d:%d " 2078 "BC_REQUEST_DEATH_NOTIFICATION failed\n", 2079 proc->pid, thread->pid); 2080 break; 2081 } 2082 binder_stats_created(BINDER_STAT_DEATH); 2083 INIT_LIST_HEAD(&death->work.entry); 2084 death->cookie = cookie; 2085 ref->death = death; 2086 if (ref->node->proc == NULL) { 2087 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 2088 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2089 list_add_tail(&ref->death->work.entry, &thread->todo); 2090 } else { 2091 list_add_tail(&ref->death->work.entry, &proc->todo); 2092 wake_up_interruptible(&proc->wait); 2093 } 2094 } 2095 } else { 2096 if (ref->death == NULL) { 2097 binder_user_error("binder: %d:%" 2098 "d BC_CLEAR_DEATH_NOTIFI" 2099 "CATION death notificat" 2100 "ion not active\n", 2101 proc->pid, thread->pid); 2102 break; 2103 } 2104 death = ref->death; 2105 if (death->cookie != cookie) { 2106 binder_user_error("binder: %d:%" 2107 "d BC_CLEAR_DEATH_NOTIFI" 2108 "CATION death notificat" 2109 "ion cookie mismatch " 2110 "%p != %p\n", 2111 proc->pid, thread->pid, 2112 death->cookie, cookie); 2113 break; 2114 } 2115 ref->death = NULL; 2116 if (list_empty(&death->work.entry)) { 2117 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2118 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2119 list_add_tail(&death->work.entry, &thread->todo); 2120 } else { 2121 list_add_tail(&death->work.entry, &proc->todo); 2122 wake_up_interruptible(&proc->wait); 2123 } 2124 } else { 2125 BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER); 2126 death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR; 2127 } 2128 } 2129 } break; 2130 case BC_DEAD_BINDER_DONE: { 2131 struct binder_work *w; 2132 void __user *cookie; 2133 struct binder_ref_death *death = NULL; 2134 if (get_user(cookie, (void __user * __user *)ptr)) 2135 return -EFAULT; 2136 2137 ptr += sizeof(void *); 2138 list_for_each_entry(w, &proc->delivered_death, entry) { 2139 struct binder_ref_death *tmp_death = container_of(w, struct binder_ref_death, work); 2140 if (tmp_death->cookie == cookie) { 2141 death = tmp_death; 2142 break; 2143 } 2144 } 2145 binder_debug(BINDER_DEBUG_DEAD_BINDER, 2146 "binder: %d:%d BC_DEAD_BINDER_DONE %p found %p\n", 2147 proc->pid, thread->pid, cookie, death); 2148 if (death == NULL) { 2149 binder_user_error("binder: %d:%d BC_DEAD" 2150 "_BINDER_DONE %p not found\n", 2151 proc->pid, thread->pid, cookie); 2152 break; 2153 } 2154 2155 list_del_init(&death->work.entry); 2156 if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) { 2157 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2158 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2159 list_add_tail(&death->work.entry, &thread->todo); 2160 } else { 2161 list_add_tail(&death->work.entry, &proc->todo); 2162 wake_up_interruptible(&proc->wait); 2163 } 2164 } 2165 } break; 2166 2167 default: 2168 pr_err("binder: %d:%d unknown command %d\n", 2169 proc->pid, thread->pid, cmd); 2170 return -EINVAL; 2171 } 2172 *consumed = ptr - buffer; 2173 } 2174 return 0; 2175} 2176 2177void binder_stat_br(struct binder_proc *proc, struct binder_thread *thread, 2178 uint32_t cmd) 2179{ 2180 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) { 2181 binder_stats.br[_IOC_NR(cmd)]++; 2182 proc->stats.br[_IOC_NR(cmd)]++; 2183 thread->stats.br[_IOC_NR(cmd)]++; 2184 } 2185} 2186 2187static int binder_has_proc_work(struct binder_proc *proc, 2188 struct binder_thread *thread) 2189{ 2190 return !list_empty(&proc->todo) || 2191 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2192} 2193 2194static int binder_has_thread_work(struct binder_thread *thread) 2195{ 2196 return !list_empty(&thread->todo) || thread->return_error != BR_OK || 2197 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2198} 2199 2200static int binder_thread_read(struct binder_proc *proc, 2201 struct binder_thread *thread, 2202 void __user *buffer, int size, 2203 signed long *consumed, int non_block) 2204{ 2205 void __user *ptr = buffer + *consumed; 2206 void __user *end = buffer + size; 2207 2208 int ret = 0; 2209 int wait_for_proc_work; 2210 2211 if (*consumed == 0) { 2212 if (put_user(BR_NOOP, (uint32_t __user *)ptr)) 2213 return -EFAULT; 2214 ptr += sizeof(uint32_t); 2215 } 2216 2217retry: 2218 wait_for_proc_work = thread->transaction_stack == NULL && 2219 list_empty(&thread->todo); 2220 2221 if (thread->return_error != BR_OK && ptr < end) { 2222 if (thread->return_error2 != BR_OK) { 2223 if (put_user(thread->return_error2, (uint32_t __user *)ptr)) 2224 return -EFAULT; 2225 ptr += sizeof(uint32_t); 2226 if (ptr == end) 2227 goto done; 2228 thread->return_error2 = BR_OK; 2229 } 2230 if (put_user(thread->return_error, (uint32_t __user *)ptr)) 2231 return -EFAULT; 2232 ptr += sizeof(uint32_t); 2233 thread->return_error = BR_OK; 2234 goto done; 2235 } 2236 2237 2238 thread->looper |= BINDER_LOOPER_STATE_WAITING; 2239 if (wait_for_proc_work) 2240 proc->ready_threads++; 2241 mutex_unlock(&binder_lock); 2242 if (wait_for_proc_work) { 2243 if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2244 BINDER_LOOPER_STATE_ENTERED))) { 2245 binder_user_error("binder: %d:%d ERROR: Thread waiting " 2246 "for process work before calling BC_REGISTER_" 2247 "LOOPER or BC_ENTER_LOOPER (state %x)\n", 2248 proc->pid, thread->pid, thread->looper); 2249 wait_event_interruptible(binder_user_error_wait, 2250 binder_stop_on_user_error < 2); 2251 } 2252 binder_set_nice(proc->default_priority); 2253 if (non_block) { 2254 if (!binder_has_proc_work(proc, thread)) 2255 ret = -EAGAIN; 2256 } else 2257 ret = wait_event_interruptible_exclusive(proc->wait, binder_has_proc_work(proc, thread)); 2258 } else { 2259 if (non_block) { 2260 if (!binder_has_thread_work(thread)) 2261 ret = -EAGAIN; 2262 } else 2263 ret = wait_event_interruptible(thread->wait, binder_has_thread_work(thread)); 2264 } 2265 mutex_lock(&binder_lock); 2266 if (wait_for_proc_work) 2267 proc->ready_threads--; 2268 thread->looper &= ~BINDER_LOOPER_STATE_WAITING; 2269 2270 if (ret) 2271 return ret; 2272 2273 while (1) { 2274 uint32_t cmd; 2275 struct binder_transaction_data tr; 2276 struct binder_work *w; 2277 struct binder_transaction *t = NULL; 2278 2279 if (!list_empty(&thread->todo)) 2280 w = list_first_entry(&thread->todo, struct binder_work, entry); 2281 else if (!list_empty(&proc->todo) && wait_for_proc_work) 2282 w = list_first_entry(&proc->todo, struct binder_work, entry); 2283 else { 2284 if (ptr - buffer == 4 && !(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN)) /* no data added */ 2285 goto retry; 2286 break; 2287 } 2288 2289 if (end - ptr < sizeof(tr) + 4) 2290 break; 2291 2292 switch (w->type) { 2293 case BINDER_WORK_TRANSACTION: { 2294 t = container_of(w, struct binder_transaction, work); 2295 } break; 2296 case BINDER_WORK_TRANSACTION_COMPLETE: { 2297 cmd = BR_TRANSACTION_COMPLETE; 2298 if (put_user(cmd, (uint32_t __user *)ptr)) 2299 return -EFAULT; 2300 ptr += sizeof(uint32_t); 2301 2302 binder_stat_br(proc, thread, cmd); 2303 binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE, 2304 "binder: %d:%d BR_TRANSACTION_COMPLETE\n", 2305 proc->pid, thread->pid); 2306 2307 list_del(&w->entry); 2308 kfree(w); 2309 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2310 } break; 2311 case BINDER_WORK_NODE: { 2312 struct binder_node *node = container_of(w, struct binder_node, work); 2313 uint32_t cmd = BR_NOOP; 2314 const char *cmd_name; 2315 int strong = node->internal_strong_refs || node->local_strong_refs; 2316 int weak = !hlist_empty(&node->refs) || node->local_weak_refs || strong; 2317 if (weak && !node->has_weak_ref) { 2318 cmd = BR_INCREFS; 2319 cmd_name = "BR_INCREFS"; 2320 node->has_weak_ref = 1; 2321 node->pending_weak_ref = 1; 2322 node->local_weak_refs++; 2323 } else if (strong && !node->has_strong_ref) { 2324 cmd = BR_ACQUIRE; 2325 cmd_name = "BR_ACQUIRE"; 2326 node->has_strong_ref = 1; 2327 node->pending_strong_ref = 1; 2328 node->local_strong_refs++; 2329 } else if (!strong && node->has_strong_ref) { 2330 cmd = BR_RELEASE; 2331 cmd_name = "BR_RELEASE"; 2332 node->has_strong_ref = 0; 2333 } else if (!weak && node->has_weak_ref) { 2334 cmd = BR_DECREFS; 2335 cmd_name = "BR_DECREFS"; 2336 node->has_weak_ref = 0; 2337 } 2338 if (cmd != BR_NOOP) { 2339 if (put_user(cmd, (uint32_t __user *)ptr)) 2340 return -EFAULT; 2341 ptr += sizeof(uint32_t); 2342 if (put_user(node->ptr, (void * __user *)ptr)) 2343 return -EFAULT; 2344 ptr += sizeof(void *); 2345 if (put_user(node->cookie, (void * __user *)ptr)) 2346 return -EFAULT; 2347 ptr += sizeof(void *); 2348 2349 binder_stat_br(proc, thread, cmd); 2350 binder_debug(BINDER_DEBUG_USER_REFS, 2351 "binder: %d:%d %s %d u%p c%p\n", 2352 proc->pid, thread->pid, cmd_name, node->debug_id, node->ptr, node->cookie); 2353 } else { 2354 list_del_init(&w->entry); 2355 if (!weak && !strong) { 2356 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2357 "binder: %d:%d node %d u%p c%p deleted\n", 2358 proc->pid, thread->pid, node->debug_id, 2359 node->ptr, node->cookie); 2360 rb_erase(&node->rb_node, &proc->nodes); 2361 kfree(node); 2362 binder_stats_deleted(BINDER_STAT_NODE); 2363 } else { 2364 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2365 "binder: %d:%d node %d u%p c%p state unchanged\n", 2366 proc->pid, thread->pid, node->debug_id, node->ptr, 2367 node->cookie); 2368 } 2369 } 2370 } break; 2371 case BINDER_WORK_DEAD_BINDER: 2372 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 2373 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 2374 struct binder_ref_death *death; 2375 uint32_t cmd; 2376 2377 death = container_of(w, struct binder_ref_death, work); 2378 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) 2379 cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE; 2380 else 2381 cmd = BR_DEAD_BINDER; 2382 if (put_user(cmd, (uint32_t __user *)ptr)) 2383 return -EFAULT; 2384 ptr += sizeof(uint32_t); 2385 if (put_user(death->cookie, (void * __user *)ptr)) 2386 return -EFAULT; 2387 ptr += sizeof(void *); 2388 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 2389 "binder: %d:%d %s %p\n", 2390 proc->pid, thread->pid, 2391 cmd == BR_DEAD_BINDER ? 2392 "BR_DEAD_BINDER" : 2393 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 2394 death->cookie); 2395 2396 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) { 2397 list_del(&w->entry); 2398 kfree(death); 2399 binder_stats_deleted(BINDER_STAT_DEATH); 2400 } else 2401 list_move(&w->entry, &proc->delivered_death); 2402 if (cmd == BR_DEAD_BINDER) 2403 goto done; /* DEAD_BINDER notifications can cause transactions */ 2404 } break; 2405 } 2406 2407 if (!t) 2408 continue; 2409 2410 BUG_ON(t->buffer == NULL); 2411 if (t->buffer->target_node) { 2412 struct binder_node *target_node = t->buffer->target_node; 2413 tr.target.ptr = target_node->ptr; 2414 tr.cookie = target_node->cookie; 2415 t->saved_priority = task_nice(current); 2416 if (t->priority < target_node->min_priority && 2417 !(t->flags & TF_ONE_WAY)) 2418 binder_set_nice(t->priority); 2419 else if (!(t->flags & TF_ONE_WAY) || 2420 t->saved_priority > target_node->min_priority) 2421 binder_set_nice(target_node->min_priority); 2422 cmd = BR_TRANSACTION; 2423 } else { 2424 tr.target.ptr = NULL; 2425 tr.cookie = NULL; 2426 cmd = BR_REPLY; 2427 } 2428 tr.code = t->code; 2429 tr.flags = t->flags; 2430 tr.sender_euid = from_kuid(current_user_ns(), t->sender_euid); 2431 2432 if (t->from) { 2433 struct task_struct *sender = t->from->proc->tsk; 2434 tr.sender_pid = task_tgid_nr_ns(sender, 2435 current->nsproxy->pid_ns); 2436 } else { 2437 tr.sender_pid = 0; 2438 } 2439 2440 tr.data_size = t->buffer->data_size; 2441 tr.offsets_size = t->buffer->offsets_size; 2442 tr.data.ptr.buffer = (void *)t->buffer->data + 2443 proc->user_buffer_offset; 2444 tr.data.ptr.offsets = tr.data.ptr.buffer + 2445 ALIGN(t->buffer->data_size, 2446 sizeof(void *)); 2447 2448 if (put_user(cmd, (uint32_t __user *)ptr)) 2449 return -EFAULT; 2450 ptr += sizeof(uint32_t); 2451 if (copy_to_user(ptr, &tr, sizeof(tr))) 2452 return -EFAULT; 2453 ptr += sizeof(tr); 2454 2455 binder_stat_br(proc, thread, cmd); 2456 binder_debug(BINDER_DEBUG_TRANSACTION, 2457 "binder: %d:%d %s %d %d:%d, cmd %d" 2458 "size %zd-%zd ptr %p-%p\n", 2459 proc->pid, thread->pid, 2460 (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" : 2461 "BR_REPLY", 2462 t->debug_id, t->from ? t->from->proc->pid : 0, 2463 t->from ? t->from->pid : 0, cmd, 2464 t->buffer->data_size, t->buffer->offsets_size, 2465 tr.data.ptr.buffer, tr.data.ptr.offsets); 2466 2467 list_del(&t->work.entry); 2468 t->buffer->allow_user_free = 1; 2469 if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) { 2470 t->to_parent = thread->transaction_stack; 2471 t->to_thread = thread; 2472 thread->transaction_stack = t; 2473 } else { 2474 t->buffer->transaction = NULL; 2475 kfree(t); 2476 binder_stats_deleted(BINDER_STAT_TRANSACTION); 2477 } 2478 break; 2479 } 2480 2481done: 2482 2483 *consumed = ptr - buffer; 2484 if (proc->requested_threads + proc->ready_threads == 0 && 2485 proc->requested_threads_started < proc->max_threads && 2486 (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2487 BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */ 2488 /*spawn a new thread if we leave this out */) { 2489 proc->requested_threads++; 2490 binder_debug(BINDER_DEBUG_THREADS, 2491 "binder: %d:%d BR_SPAWN_LOOPER\n", 2492 proc->pid, thread->pid); 2493 if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer)) 2494 return -EFAULT; 2495 } 2496 return 0; 2497} 2498 2499static void binder_release_work(struct list_head *list) 2500{ 2501 struct binder_work *w; 2502 while (!list_empty(list)) { 2503 w = list_first_entry(list, struct binder_work, entry); 2504 list_del_init(&w->entry); 2505 switch (w->type) { 2506 case BINDER_WORK_TRANSACTION: { 2507 struct binder_transaction *t; 2508 2509 t = container_of(w, struct binder_transaction, work); 2510 if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) 2511 binder_send_failed_reply(t, BR_DEAD_REPLY); 2512 } break; 2513 case BINDER_WORK_TRANSACTION_COMPLETE: { 2514 kfree(w); 2515 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2516 } break; 2517 default: 2518 break; 2519 } 2520 } 2521 2522} 2523 2524static struct binder_thread *binder_get_thread(struct binder_proc *proc) 2525{ 2526 struct binder_thread *thread = NULL; 2527 struct rb_node *parent = NULL; 2528 struct rb_node **p = &proc->threads.rb_node; 2529 2530 while (*p) { 2531 parent = *p; 2532 thread = rb_entry(parent, struct binder_thread, rb_node); 2533 2534 if (current->pid < thread->pid) 2535 p = &(*p)->rb_left; 2536 else if (current->pid > thread->pid) 2537 p = &(*p)->rb_right; 2538 else 2539 break; 2540 } 2541 if (*p == NULL) { 2542 thread = kzalloc(sizeof(*thread), GFP_KERNEL); 2543 if (thread == NULL) 2544 return NULL; 2545 binder_stats_created(BINDER_STAT_THREAD); 2546 thread->proc = proc; 2547 thread->pid = current->pid; 2548 init_waitqueue_head(&thread->wait); 2549 INIT_LIST_HEAD(&thread->todo); 2550 rb_link_node(&thread->rb_node, parent, p); 2551 rb_insert_color(&thread->rb_node, &proc->threads); 2552 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2553 thread->return_error = BR_OK; 2554 thread->return_error2 = BR_OK; 2555 } 2556 return thread; 2557} 2558 2559static int binder_free_thread(struct binder_proc *proc, 2560 struct binder_thread *thread) 2561{ 2562 struct binder_transaction *t; 2563 struct binder_transaction *send_reply = NULL; 2564 int active_transactions = 0; 2565 2566 rb_erase(&thread->rb_node, &proc->threads); 2567 t = thread->transaction_stack; 2568 if (t && t->to_thread == thread) 2569 send_reply = t; 2570 while (t) { 2571 active_transactions++; 2572 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2573 "binder: release %d:%d transaction %d " 2574 "%s, still active\n", proc->pid, thread->pid, 2575 t->debug_id, 2576 (t->to_thread == thread) ? "in" : "out"); 2577 2578 if (t->to_thread == thread) { 2579 t->to_proc = NULL; 2580 t->to_thread = NULL; 2581 if (t->buffer) { 2582 t->buffer->transaction = NULL; 2583 t->buffer = NULL; 2584 } 2585 t = t->to_parent; 2586 } else if (t->from == thread) { 2587 t->from = NULL; 2588 t = t->from_parent; 2589 } else 2590 BUG(); 2591 } 2592 if (send_reply) 2593 binder_send_failed_reply(send_reply, BR_DEAD_REPLY); 2594 binder_release_work(&thread->todo); 2595 kfree(thread); 2596 binder_stats_deleted(BINDER_STAT_THREAD); 2597 return active_transactions; 2598} 2599 2600static unsigned int binder_poll(struct file *filp, 2601 struct poll_table_struct *wait) 2602{ 2603 struct binder_proc *proc = filp->private_data; 2604 struct binder_thread *thread = NULL; 2605 int wait_for_proc_work; 2606 2607 mutex_lock(&binder_lock); 2608 thread = binder_get_thread(proc); 2609 2610 wait_for_proc_work = thread->transaction_stack == NULL && 2611 list_empty(&thread->todo) && thread->return_error == BR_OK; 2612 mutex_unlock(&binder_lock); 2613 2614 if (wait_for_proc_work) { 2615 if (binder_has_proc_work(proc, thread)) 2616 return POLLIN; 2617 poll_wait(filp, &proc->wait, wait); 2618 if (binder_has_proc_work(proc, thread)) 2619 return POLLIN; 2620 } else { 2621 if (binder_has_thread_work(thread)) 2622 return POLLIN; 2623 poll_wait(filp, &thread->wait, wait); 2624 if (binder_has_thread_work(thread)) 2625 return POLLIN; 2626 } 2627 return 0; 2628} 2629 2630static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 2631{ 2632 int ret; 2633 struct binder_proc *proc = filp->private_data; 2634 struct binder_thread *thread; 2635 unsigned int size = _IOC_SIZE(cmd); 2636 void __user *ubuf = (void __user *)arg; 2637 2638 /*pr_info("binder_ioctl: %d:%d %x %lx\n", proc->pid, current->pid, cmd, arg);*/ 2639 2640 ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2641 if (ret) 2642 return ret; 2643 2644 mutex_lock(&binder_lock); 2645 thread = binder_get_thread(proc); 2646 if (thread == NULL) { 2647 ret = -ENOMEM; 2648 goto err; 2649 } 2650 2651 switch (cmd) { 2652 case BINDER_WRITE_READ: { 2653 struct binder_write_read bwr; 2654 if (size != sizeof(struct binder_write_read)) { 2655 ret = -EINVAL; 2656 goto err; 2657 } 2658 if (copy_from_user(&bwr, ubuf, sizeof(bwr))) { 2659 ret = -EFAULT; 2660 goto err; 2661 } 2662 binder_debug(BINDER_DEBUG_READ_WRITE, 2663 "binder: %d:%d write %ld at %08lx, read %ld at %08lx\n", 2664 proc->pid, thread->pid, bwr.write_size, bwr.write_buffer, 2665 bwr.read_size, bwr.read_buffer); 2666 2667 if (bwr.write_size > 0) { 2668 ret = binder_thread_write(proc, thread, (void __user *)bwr.write_buffer, bwr.write_size, &bwr.write_consumed); 2669 if (ret < 0) { 2670 bwr.read_consumed = 0; 2671 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2672 ret = -EFAULT; 2673 goto err; 2674 } 2675 } 2676 if (bwr.read_size > 0) { 2677 ret = binder_thread_read(proc, thread, (void __user *)bwr.read_buffer, bwr.read_size, &bwr.read_consumed, filp->f_flags & O_NONBLOCK); 2678 if (!list_empty(&proc->todo)) 2679 wake_up_interruptible(&proc->wait); 2680 if (ret < 0) { 2681 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2682 ret = -EFAULT; 2683 goto err; 2684 } 2685 } 2686 binder_debug(BINDER_DEBUG_READ_WRITE, 2687 "binder: %d:%d wrote %ld of %ld, read return %ld of %ld\n", 2688 proc->pid, thread->pid, bwr.write_consumed, bwr.write_size, 2689 bwr.read_consumed, bwr.read_size); 2690 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) { 2691 ret = -EFAULT; 2692 goto err; 2693 } 2694 break; 2695 } 2696 case BINDER_SET_MAX_THREADS: 2697 if (copy_from_user(&proc->max_threads, ubuf, sizeof(proc->max_threads))) { 2698 ret = -EINVAL; 2699 goto err; 2700 } 2701 break; 2702 case BINDER_SET_CONTEXT_MGR: 2703 if (binder_context_mgr_node != NULL) { 2704 pr_err("binder: BINDER_SET_CONTEXT_MGR already set\n"); 2705 ret = -EBUSY; 2706 goto err; 2707 } 2708 if (uid_valid(binder_context_mgr_uid)) { 2709 if (!uid_eq(binder_context_mgr_uid, current->cred->euid)) { 2710 pr_err("binder: BINDER_SET_" 2711 "CONTEXT_MGR bad uid %d != %d\n", 2712 from_kuid(&init_user_ns, current->cred->euid), 2713 from_kuid(&init_user_ns, binder_context_mgr_uid)); 2714 ret = -EPERM; 2715 goto err; 2716 } 2717 } else 2718 binder_context_mgr_uid = current->cred->euid; 2719 binder_context_mgr_node = binder_new_node(proc, NULL, NULL); 2720 if (binder_context_mgr_node == NULL) { 2721 ret = -ENOMEM; 2722 goto err; 2723 } 2724 binder_context_mgr_node->local_weak_refs++; 2725 binder_context_mgr_node->local_strong_refs++; 2726 binder_context_mgr_node->has_strong_ref = 1; 2727 binder_context_mgr_node->has_weak_ref = 1; 2728 break; 2729 case BINDER_THREAD_EXIT: 2730 binder_debug(BINDER_DEBUG_THREADS, "binder: %d:%d exit\n", 2731 proc->pid, thread->pid); 2732 binder_free_thread(proc, thread); 2733 thread = NULL; 2734 break; 2735 case BINDER_VERSION: 2736 if (size != sizeof(struct binder_version)) { 2737 ret = -EINVAL; 2738 goto err; 2739 } 2740 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION, &((struct binder_version *)ubuf)->protocol_version)) { 2741 ret = -EINVAL; 2742 goto err; 2743 } 2744 break; 2745 default: 2746 ret = -EINVAL; 2747 goto err; 2748 } 2749 ret = 0; 2750err: 2751 if (thread) 2752 thread->looper &= ~BINDER_LOOPER_STATE_NEED_RETURN; 2753 mutex_unlock(&binder_lock); 2754 wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2755 if (ret && ret != -ERESTARTSYS) 2756 pr_info("binder: %d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret); 2757 return ret; 2758} 2759 2760static void binder_vma_open(struct vm_area_struct *vma) 2761{ 2762 struct binder_proc *proc = vma->vm_private_data; 2763 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2764 "binder: %d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2765 proc->pid, vma->vm_start, vma->vm_end, 2766 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2767 (unsigned long)pgprot_val(vma->vm_page_prot)); 2768} 2769 2770static void binder_vma_close(struct vm_area_struct *vma) 2771{ 2772 struct binder_proc *proc = vma->vm_private_data; 2773 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2774 "binder: %d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2775 proc->pid, vma->vm_start, vma->vm_end, 2776 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2777 (unsigned long)pgprot_val(vma->vm_page_prot)); 2778 proc->vma = NULL; 2779 proc->vma_vm_mm = NULL; 2780 binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES); 2781} 2782 2783static struct vm_operations_struct binder_vm_ops = { 2784 .open = binder_vma_open, 2785 .close = binder_vma_close, 2786}; 2787 2788static int binder_mmap(struct file *filp, struct vm_area_struct *vma) 2789{ 2790 int ret; 2791 struct vm_struct *area; 2792 struct binder_proc *proc = filp->private_data; 2793 const char *failure_string; 2794 struct binder_buffer *buffer; 2795 2796 if ((vma->vm_end - vma->vm_start) > SZ_4M) 2797 vma->vm_end = vma->vm_start + SZ_4M; 2798 2799 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2800 "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n", 2801 proc->pid, vma->vm_start, vma->vm_end, 2802 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2803 (unsigned long)pgprot_val(vma->vm_page_prot)); 2804 2805 if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) { 2806 ret = -EPERM; 2807 failure_string = "bad vm_flags"; 2808 goto err_bad_arg; 2809 } 2810 vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE; 2811 2812 mutex_lock(&binder_mmap_lock); 2813 if (proc->buffer) { 2814 ret = -EBUSY; 2815 failure_string = "already mapped"; 2816 goto err_already_mapped; 2817 } 2818 2819 area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP); 2820 if (area == NULL) { 2821 ret = -ENOMEM; 2822 failure_string = "get_vm_area"; 2823 goto err_get_vm_area_failed; 2824 } 2825 proc->buffer = area->addr; 2826 proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer; 2827 mutex_unlock(&binder_mmap_lock); 2828 2829#ifdef CONFIG_CPU_CACHE_VIPT 2830 if (cache_is_vipt_aliasing()) { 2831 while (CACHE_COLOUR((vma->vm_start ^ (uint32_t)proc->buffer))) { 2832 pr_info("binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer); 2833 vma->vm_start += PAGE_SIZE; 2834 } 2835 } 2836#endif 2837 proc->pages = kzalloc(sizeof(proc->pages[0]) * ((vma->vm_end - vma->vm_start) / PAGE_SIZE), GFP_KERNEL); 2838 if (proc->pages == NULL) { 2839 ret = -ENOMEM; 2840 failure_string = "alloc page array"; 2841 goto err_alloc_pages_failed; 2842 } 2843 proc->buffer_size = vma->vm_end - vma->vm_start; 2844 2845 vma->vm_ops = &binder_vm_ops; 2846 vma->vm_private_data = proc; 2847 2848 if (binder_update_page_range(proc, 1, proc->buffer, proc->buffer + PAGE_SIZE, vma)) { 2849 ret = -ENOMEM; 2850 failure_string = "alloc small buf"; 2851 goto err_alloc_small_buf_failed; 2852 } 2853 buffer = proc->buffer; 2854 INIT_LIST_HEAD(&proc->buffers); 2855 list_add(&buffer->entry, &proc->buffers); 2856 buffer->free = 1; 2857 binder_insert_free_buffer(proc, buffer); 2858 proc->free_async_space = proc->buffer_size / 2; 2859 barrier(); 2860 proc->files = get_files_struct(proc->tsk); 2861 proc->vma = vma; 2862 proc->vma_vm_mm = vma->vm_mm; 2863 2864 /*pr_info("binder_mmap: %d %lx-%lx maps %p\n", 2865 proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/ 2866 return 0; 2867 2868err_alloc_small_buf_failed: 2869 kfree(proc->pages); 2870 proc->pages = NULL; 2871err_alloc_pages_failed: 2872 mutex_lock(&binder_mmap_lock); 2873 vfree(proc->buffer); 2874 proc->buffer = NULL; 2875err_get_vm_area_failed: 2876err_already_mapped: 2877 mutex_unlock(&binder_mmap_lock); 2878err_bad_arg: 2879 pr_err("binder_mmap: %d %lx-%lx %s failed %d\n", 2880 proc->pid, vma->vm_start, vma->vm_end, failure_string, ret); 2881 return ret; 2882} 2883 2884static int binder_open(struct inode *nodp, struct file *filp) 2885{ 2886 struct binder_proc *proc; 2887 2888 binder_debug(BINDER_DEBUG_OPEN_CLOSE, "binder_open: %d:%d\n", 2889 current->group_leader->pid, current->pid); 2890 2891 proc = kzalloc(sizeof(*proc), GFP_KERNEL); 2892 if (proc == NULL) 2893 return -ENOMEM; 2894 get_task_struct(current); 2895 proc->tsk = current; 2896 INIT_LIST_HEAD(&proc->todo); 2897 init_waitqueue_head(&proc->wait); 2898 proc->default_priority = task_nice(current); 2899 mutex_lock(&binder_lock); 2900 binder_stats_created(BINDER_STAT_PROC); 2901 hlist_add_head(&proc->proc_node, &binder_procs); 2902 proc->pid = current->group_leader->pid; 2903 INIT_LIST_HEAD(&proc->delivered_death); 2904 filp->private_data = proc; 2905 mutex_unlock(&binder_lock); 2906 2907 if (binder_debugfs_dir_entry_proc) { 2908 char strbuf[11]; 2909 snprintf(strbuf, sizeof(strbuf), "%u", proc->pid); 2910 proc->debugfs_entry = debugfs_create_file(strbuf, S_IRUGO, 2911 binder_debugfs_dir_entry_proc, proc, &binder_proc_fops); 2912 } 2913 2914 return 0; 2915} 2916 2917static int binder_flush(struct file *filp, fl_owner_t id) 2918{ 2919 struct binder_proc *proc = filp->private_data; 2920 2921 binder_defer_work(proc, BINDER_DEFERRED_FLUSH); 2922 2923 return 0; 2924} 2925 2926static void binder_deferred_flush(struct binder_proc *proc) 2927{ 2928 struct rb_node *n; 2929 int wake_count = 0; 2930 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) { 2931 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node); 2932 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2933 if (thread->looper & BINDER_LOOPER_STATE_WAITING) { 2934 wake_up_interruptible(&thread->wait); 2935 wake_count++; 2936 } 2937 } 2938 wake_up_interruptible_all(&proc->wait); 2939 2940 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2941 "binder_flush: %d woke %d threads\n", proc->pid, 2942 wake_count); 2943} 2944 2945static int binder_release(struct inode *nodp, struct file *filp) 2946{ 2947 struct binder_proc *proc = filp->private_data; 2948 debugfs_remove(proc->debugfs_entry); 2949 binder_defer_work(proc, BINDER_DEFERRED_RELEASE); 2950 2951 return 0; 2952} 2953 2954static void binder_deferred_release(struct binder_proc *proc) 2955{ 2956 struct hlist_node *pos; 2957 struct binder_transaction *t; 2958 struct rb_node *n; 2959 int threads, nodes, incoming_refs, outgoing_refs, buffers, active_transactions, page_count; 2960 2961 BUG_ON(proc->vma); 2962 BUG_ON(proc->files); 2963 2964 hlist_del(&proc->proc_node); 2965 if (binder_context_mgr_node && binder_context_mgr_node->proc == proc) { 2966 binder_debug(BINDER_DEBUG_DEAD_BINDER, 2967 "binder_release: %d context_mgr_node gone\n", 2968 proc->pid); 2969 binder_context_mgr_node = NULL; 2970 } 2971 2972 threads = 0; 2973 active_transactions = 0; 2974 while ((n = rb_first(&proc->threads))) { 2975 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node); 2976 threads++; 2977 active_transactions += binder_free_thread(proc, thread); 2978 } 2979 nodes = 0; 2980 incoming_refs = 0; 2981 while ((n = rb_first(&proc->nodes))) { 2982 struct binder_node *node = rb_entry(n, struct binder_node, rb_node); 2983 2984 nodes++; 2985 rb_erase(&node->rb_node, &proc->nodes); 2986 list_del_init(&node->work.entry); 2987 if (hlist_empty(&node->refs)) { 2988 kfree(node); 2989 binder_stats_deleted(BINDER_STAT_NODE); 2990 } else { 2991 struct binder_ref *ref; 2992 int death = 0; 2993 2994 node->proc = NULL; 2995 node->local_strong_refs = 0; 2996 node->local_weak_refs = 0; 2997 hlist_add_head(&node->dead_node, &binder_dead_nodes); 2998 2999 hlist_for_each_entry(ref, pos, &node->refs, node_entry) { 3000 incoming_refs++; 3001 if (ref->death) { 3002 death++; 3003 if (list_empty(&ref->death->work.entry)) { 3004 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 3005 list_add_tail(&ref->death->work.entry, &ref->proc->todo); 3006 wake_up_interruptible(&ref->proc->wait); 3007 } else 3008 BUG(); 3009 } 3010 } 3011 binder_debug(BINDER_DEBUG_DEAD_BINDER, 3012 "binder: node %d now dead, " 3013 "refs %d, death %d\n", node->debug_id, 3014 incoming_refs, death); 3015 } 3016 } 3017 outgoing_refs = 0; 3018 while ((n = rb_first(&proc->refs_by_desc))) { 3019 struct binder_ref *ref = rb_entry(n, struct binder_ref, 3020 rb_node_desc); 3021 outgoing_refs++; 3022 binder_delete_ref(ref); 3023 } 3024 binder_release_work(&proc->todo); 3025 buffers = 0; 3026 3027 while ((n = rb_first(&proc->allocated_buffers))) { 3028 struct binder_buffer *buffer = rb_entry(n, struct binder_buffer, 3029 rb_node); 3030 t = buffer->transaction; 3031 if (t) { 3032 t->buffer = NULL; 3033 buffer->transaction = NULL; 3034 pr_err("binder: release proc %d, " 3035 "transaction %d, not freed\n", 3036 proc->pid, t->debug_id); 3037 /*BUG();*/ 3038 } 3039 binder_free_buf(proc, buffer); 3040 buffers++; 3041 } 3042 3043 binder_stats_deleted(BINDER_STAT_PROC); 3044 3045 page_count = 0; 3046 if (proc->pages) { 3047 int i; 3048 for (i = 0; i < proc->buffer_size / PAGE_SIZE; i++) { 3049 if (proc->pages[i]) { 3050 void *page_addr = proc->buffer + i * PAGE_SIZE; 3051 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 3052 "binder_release: %d: " 3053 "page %d at %p not freed\n", 3054 proc->pid, i, 3055 page_addr); 3056 unmap_kernel_range((unsigned long)page_addr, 3057 PAGE_SIZE); 3058 __free_page(proc->pages[i]); 3059 page_count++; 3060 } 3061 } 3062 kfree(proc->pages); 3063 vfree(proc->buffer); 3064 } 3065 3066 put_task_struct(proc->tsk); 3067 3068 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 3069 "binder_release: %d threads %d, nodes %d (ref %d), " 3070 "refs %d, active transactions %d, buffers %d, " 3071 "pages %d\n", 3072 proc->pid, threads, nodes, incoming_refs, outgoing_refs, 3073 active_transactions, buffers, page_count); 3074 3075 kfree(proc); 3076} 3077 3078static void binder_deferred_func(struct work_struct *work) 3079{ 3080 struct binder_proc *proc; 3081 struct files_struct *files; 3082 3083 int defer; 3084 do { 3085 mutex_lock(&binder_lock); 3086 mutex_lock(&binder_deferred_lock); 3087 if (!hlist_empty(&binder_deferred_list)) { 3088 proc = hlist_entry(binder_deferred_list.first, 3089 struct binder_proc, deferred_work_node); 3090 hlist_del_init(&proc->deferred_work_node); 3091 defer = proc->deferred_work; 3092 proc->deferred_work = 0; 3093 } else { 3094 proc = NULL; 3095 defer = 0; 3096 } 3097 mutex_unlock(&binder_deferred_lock); 3098 3099 files = NULL; 3100 if (defer & BINDER_DEFERRED_PUT_FILES) { 3101 files = proc->files; 3102 if (files) 3103 proc->files = NULL; 3104 } 3105 3106 if (defer & BINDER_DEFERRED_FLUSH) 3107 binder_deferred_flush(proc); 3108 3109 if (defer & BINDER_DEFERRED_RELEASE) 3110 binder_deferred_release(proc); /* frees proc */ 3111 3112 mutex_unlock(&binder_lock); 3113 if (files) 3114 put_files_struct(files); 3115 } while (proc); 3116} 3117static DECLARE_WORK(binder_deferred_work, binder_deferred_func); 3118 3119static void 3120binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer) 3121{ 3122 mutex_lock(&binder_deferred_lock); 3123 proc->deferred_work |= defer; 3124 if (hlist_unhashed(&proc->deferred_work_node)) { 3125 hlist_add_head(&proc->deferred_work_node, 3126 &binder_deferred_list); 3127 queue_work(binder_deferred_workqueue, &binder_deferred_work); 3128 } 3129 mutex_unlock(&binder_deferred_lock); 3130} 3131 3132static void print_binder_transaction(struct seq_file *m, const char *prefix, 3133 struct binder_transaction *t) 3134{ 3135 seq_printf(m, 3136 "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d", 3137 prefix, t->debug_id, t, 3138 t->from ? t->from->proc->pid : 0, 3139 t->from ? t->from->pid : 0, 3140 t->to_proc ? t->to_proc->pid : 0, 3141 t->to_thread ? t->to_thread->pid : 0, 3142 t->code, t->flags, t->priority, t->need_reply); 3143 if (t->buffer == NULL) { 3144 seq_puts(m, " buffer free\n"); 3145 return; 3146 } 3147 if (t->buffer->target_node) 3148 seq_printf(m, " node %d", 3149 t->buffer->target_node->debug_id); 3150 seq_printf(m, " size %zd:%zd data %p\n", 3151 t->buffer->data_size, t->buffer->offsets_size, 3152 t->buffer->data); 3153} 3154 3155static void print_binder_buffer(struct seq_file *m, const char *prefix, 3156 struct binder_buffer *buffer) 3157{ 3158 seq_printf(m, "%s %d: %p size %zd:%zd %s\n", 3159 prefix, buffer->debug_id, buffer->data, 3160 buffer->data_size, buffer->offsets_size, 3161 buffer->transaction ? "active" : "delivered"); 3162} 3163 3164static void print_binder_work(struct seq_file *m, const char *prefix, 3165 const char *transaction_prefix, 3166 struct binder_work *w) 3167{ 3168 struct binder_node *node; 3169 struct binder_transaction *t; 3170 3171 switch (w->type) { 3172 case BINDER_WORK_TRANSACTION: 3173 t = container_of(w, struct binder_transaction, work); 3174 print_binder_transaction(m, transaction_prefix, t); 3175 break; 3176 case BINDER_WORK_TRANSACTION_COMPLETE: 3177 seq_printf(m, "%stransaction complete\n", prefix); 3178 break; 3179 case BINDER_WORK_NODE: 3180 node = container_of(w, struct binder_node, work); 3181 seq_printf(m, "%snode work %d: u%p c%p\n", 3182 prefix, node->debug_id, node->ptr, node->cookie); 3183 break; 3184 case BINDER_WORK_DEAD_BINDER: 3185 seq_printf(m, "%shas dead binder\n", prefix); 3186 break; 3187 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 3188 seq_printf(m, "%shas cleared dead binder\n", prefix); 3189 break; 3190 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: 3191 seq_printf(m, "%shas cleared death notification\n", prefix); 3192 break; 3193 default: 3194 seq_printf(m, "%sunknown work: type %d\n", prefix, w->type); 3195 break; 3196 } 3197} 3198 3199static void print_binder_thread(struct seq_file *m, 3200 struct binder_thread *thread, 3201 int print_always) 3202{ 3203 struct binder_transaction *t; 3204 struct binder_work *w; 3205 size_t start_pos = m->count; 3206 size_t header_pos; 3207 3208 seq_printf(m, " thread %d: l %02x\n", thread->pid, thread->looper); 3209 header_pos = m->count; 3210 t = thread->transaction_stack; 3211 while (t) { 3212 if (t->from == thread) { 3213 print_binder_transaction(m, 3214 " outgoing transaction", t); 3215 t = t->from_parent; 3216 } else if (t->to_thread == thread) { 3217 print_binder_transaction(m, 3218 " incoming transaction", t); 3219 t = t->to_parent; 3220 } else { 3221 print_binder_transaction(m, " bad transaction", t); 3222 t = NULL; 3223 } 3224 } 3225 list_for_each_entry(w, &thread->todo, entry) { 3226 print_binder_work(m, " ", " pending transaction", w); 3227 } 3228 if (!print_always && m->count == header_pos) 3229 m->count = start_pos; 3230} 3231 3232static void print_binder_node(struct seq_file *m, struct binder_node *node) 3233{ 3234 struct binder_ref *ref; 3235 struct hlist_node *pos; 3236 struct binder_work *w; 3237 int count; 3238 3239 count = 0; 3240 hlist_for_each_entry(ref, pos, &node->refs, node_entry) 3241 count++; 3242 3243 seq_printf(m, " node %d: u%p c%p hs %d hw %d ls %d lw %d is %d iw %d", 3244 node->debug_id, node->ptr, node->cookie, 3245 node->has_strong_ref, node->has_weak_ref, 3246 node->local_strong_refs, node->local_weak_refs, 3247 node->internal_strong_refs, count); 3248 if (count) { 3249 seq_puts(m, " proc"); 3250 hlist_for_each_entry(ref, pos, &node->refs, node_entry) 3251 seq_printf(m, " %d", ref->proc->pid); 3252 } 3253 seq_puts(m, "\n"); 3254 list_for_each_entry(w, &node->async_todo, entry) 3255 print_binder_work(m, " ", 3256 " pending async transaction", w); 3257} 3258 3259static void print_binder_ref(struct seq_file *m, struct binder_ref *ref) 3260{ 3261 seq_printf(m, " ref %d: desc %d %snode %d s %d w %d d %p\n", 3262 ref->debug_id, ref->desc, ref->node->proc ? "" : "dead ", 3263 ref->node->debug_id, ref->strong, ref->weak, ref->death); 3264} 3265 3266static void print_binder_proc(struct seq_file *m, 3267 struct binder_proc *proc, int print_all) 3268{ 3269 struct binder_work *w; 3270 struct rb_node *n; 3271 size_t start_pos = m->count; 3272 size_t header_pos; 3273 3274 seq_printf(m, "proc %d\n", proc->pid); 3275 header_pos = m->count; 3276 3277 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3278 print_binder_thread(m, rb_entry(n, struct binder_thread, 3279 rb_node), print_all); 3280 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) { 3281 struct binder_node *node = rb_entry(n, struct binder_node, 3282 rb_node); 3283 if (print_all || node->has_async_transaction) 3284 print_binder_node(m, node); 3285 } 3286 if (print_all) { 3287 for (n = rb_first(&proc->refs_by_desc); 3288 n != NULL; 3289 n = rb_next(n)) 3290 print_binder_ref(m, rb_entry(n, struct binder_ref, 3291 rb_node_desc)); 3292 } 3293 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3294 print_binder_buffer(m, " buffer", 3295 rb_entry(n, struct binder_buffer, rb_node)); 3296 list_for_each_entry(w, &proc->todo, entry) 3297 print_binder_work(m, " ", " pending transaction", w); 3298 list_for_each_entry(w, &proc->delivered_death, entry) { 3299 seq_puts(m, " has delivered dead binder\n"); 3300 break; 3301 } 3302 if (!print_all && m->count == header_pos) 3303 m->count = start_pos; 3304} 3305 3306static const char *binder_return_strings[] = { 3307 "BR_ERROR", 3308 "BR_OK", 3309 "BR_TRANSACTION", 3310 "BR_REPLY", 3311 "BR_ACQUIRE_RESULT", 3312 "BR_DEAD_REPLY", 3313 "BR_TRANSACTION_COMPLETE", 3314 "BR_INCREFS", 3315 "BR_ACQUIRE", 3316 "BR_RELEASE", 3317 "BR_DECREFS", 3318 "BR_ATTEMPT_ACQUIRE", 3319 "BR_NOOP", 3320 "BR_SPAWN_LOOPER", 3321 "BR_FINISHED", 3322 "BR_DEAD_BINDER", 3323 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 3324 "BR_FAILED_REPLY" 3325}; 3326 3327static const char *binder_command_strings[] = { 3328 "BC_TRANSACTION", 3329 "BC_REPLY", 3330 "BC_ACQUIRE_RESULT", 3331 "BC_FREE_BUFFER", 3332 "BC_INCREFS", 3333 "BC_ACQUIRE", 3334 "BC_RELEASE", 3335 "BC_DECREFS", 3336 "BC_INCREFS_DONE", 3337 "BC_ACQUIRE_DONE", 3338 "BC_ATTEMPT_ACQUIRE", 3339 "BC_REGISTER_LOOPER", 3340 "BC_ENTER_LOOPER", 3341 "BC_EXIT_LOOPER", 3342 "BC_REQUEST_DEATH_NOTIFICATION", 3343 "BC_CLEAR_DEATH_NOTIFICATION", 3344 "BC_DEAD_BINDER_DONE" 3345}; 3346 3347static const char *binder_objstat_strings[] = { 3348 "proc", 3349 "thread", 3350 "node", 3351 "ref", 3352 "death", 3353 "transaction", 3354 "transaction_complete" 3355}; 3356 3357static void print_binder_stats(struct seq_file *m, const char *prefix, 3358 struct binder_stats *stats) 3359{ 3360 int i; 3361 3362 BUILD_BUG_ON(ARRAY_SIZE(stats->bc) != 3363 ARRAY_SIZE(binder_command_strings)); 3364 for (i = 0; i < ARRAY_SIZE(stats->bc); i++) { 3365 if (stats->bc[i]) 3366 seq_printf(m, "%s%s: %d\n", prefix, 3367 binder_command_strings[i], stats->bc[i]); 3368 } 3369 3370 BUILD_BUG_ON(ARRAY_SIZE(stats->br) != 3371 ARRAY_SIZE(binder_return_strings)); 3372 for (i = 0; i < ARRAY_SIZE(stats->br); i++) { 3373 if (stats->br[i]) 3374 seq_printf(m, "%s%s: %d\n", prefix, 3375 binder_return_strings[i], stats->br[i]); 3376 } 3377 3378 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 3379 ARRAY_SIZE(binder_objstat_strings)); 3380 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 3381 ARRAY_SIZE(stats->obj_deleted)); 3382 for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) { 3383 if (stats->obj_created[i] || stats->obj_deleted[i]) 3384 seq_printf(m, "%s%s: active %d total %d\n", prefix, 3385 binder_objstat_strings[i], 3386 stats->obj_created[i] - stats->obj_deleted[i], 3387 stats->obj_created[i]); 3388 } 3389} 3390 3391static void print_binder_proc_stats(struct seq_file *m, 3392 struct binder_proc *proc) 3393{ 3394 struct binder_work *w; 3395 struct rb_node *n; 3396 int count, strong, weak; 3397 3398 seq_printf(m, "proc %d\n", proc->pid); 3399 count = 0; 3400 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3401 count++; 3402 seq_printf(m, " threads: %d\n", count); 3403 seq_printf(m, " requested threads: %d+%d/%d\n" 3404 " ready threads %d\n" 3405 " free async space %zd\n", proc->requested_threads, 3406 proc->requested_threads_started, proc->max_threads, 3407 proc->ready_threads, proc->free_async_space); 3408 count = 0; 3409 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) 3410 count++; 3411 seq_printf(m, " nodes: %d\n", count); 3412 count = 0; 3413 strong = 0; 3414 weak = 0; 3415 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 3416 struct binder_ref *ref = rb_entry(n, struct binder_ref, 3417 rb_node_desc); 3418 count++; 3419 strong += ref->strong; 3420 weak += ref->weak; 3421 } 3422 seq_printf(m, " refs: %d s %d w %d\n", count, strong, weak); 3423 3424 count = 0; 3425 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3426 count++; 3427 seq_printf(m, " buffers: %d\n", count); 3428 3429 count = 0; 3430 list_for_each_entry(w, &proc->todo, entry) { 3431 switch (w->type) { 3432 case BINDER_WORK_TRANSACTION: 3433 count++; 3434 break; 3435 default: 3436 break; 3437 } 3438 } 3439 seq_printf(m, " pending transactions: %d\n", count); 3440 3441 print_binder_stats(m, " ", &proc->stats); 3442} 3443 3444 3445static int binder_state_show(struct seq_file *m, void *unused) 3446{ 3447 struct binder_proc *proc; 3448 struct hlist_node *pos; 3449 struct binder_node *node; 3450 int do_lock = !binder_debug_no_lock; 3451 3452 if (do_lock) 3453 mutex_lock(&binder_lock); 3454 3455 seq_puts(m, "binder state:\n"); 3456 3457 if (!hlist_empty(&binder_dead_nodes)) 3458 seq_puts(m, "dead nodes:\n"); 3459 hlist_for_each_entry(node, pos, &binder_dead_nodes, dead_node) 3460 print_binder_node(m, node); 3461 3462 hlist_for_each_entry(proc, pos, &binder_procs, proc_node) 3463 print_binder_proc(m, proc, 1); 3464 if (do_lock) 3465 mutex_unlock(&binder_lock); 3466 return 0; 3467} 3468 3469static int binder_stats_show(struct seq_file *m, void *unused) 3470{ 3471 struct binder_proc *proc; 3472 struct hlist_node *pos; 3473 int do_lock = !binder_debug_no_lock; 3474 3475 if (do_lock) 3476 mutex_lock(&binder_lock); 3477 3478 seq_puts(m, "binder stats:\n"); 3479 3480 print_binder_stats(m, "", &binder_stats); 3481 3482 hlist_for_each_entry(proc, pos, &binder_procs, proc_node) 3483 print_binder_proc_stats(m, proc); 3484 if (do_lock) 3485 mutex_unlock(&binder_lock); 3486 return 0; 3487} 3488 3489static int binder_transactions_show(struct seq_file *m, void *unused) 3490{ 3491 struct binder_proc *proc; 3492 struct hlist_node *pos; 3493 int do_lock = !binder_debug_no_lock; 3494 3495 if (do_lock) 3496 mutex_lock(&binder_lock); 3497 3498 seq_puts(m, "binder transactions:\n"); 3499 hlist_for_each_entry(proc, pos, &binder_procs, proc_node) 3500 print_binder_proc(m, proc, 0); 3501 if (do_lock) 3502 mutex_unlock(&binder_lock); 3503 return 0; 3504} 3505 3506static int binder_proc_show(struct seq_file *m, void *unused) 3507{ 3508 struct binder_proc *proc = m->private; 3509 int do_lock = !binder_debug_no_lock; 3510 3511 if (do_lock) 3512 mutex_lock(&binder_lock); 3513 seq_puts(m, "binder proc state:\n"); 3514 print_binder_proc(m, proc, 1); 3515 if (do_lock) 3516 mutex_unlock(&binder_lock); 3517 return 0; 3518} 3519 3520static void print_binder_transaction_log_entry(struct seq_file *m, 3521 struct binder_transaction_log_entry *e) 3522{ 3523 seq_printf(m, 3524 "%d: %s from %d:%d to %d:%d node %d handle %d size %d:%d\n", 3525 e->debug_id, (e->call_type == 2) ? "reply" : 3526 ((e->call_type == 1) ? "async" : "call "), e->from_proc, 3527 e->from_thread, e->to_proc, e->to_thread, e->to_node, 3528 e->target_handle, e->data_size, e->offsets_size); 3529} 3530 3531static int binder_transaction_log_show(struct seq_file *m, void *unused) 3532{ 3533 struct binder_transaction_log *log = m->private; 3534 int i; 3535 3536 if (log->full) { 3537 for (i = log->next; i < ARRAY_SIZE(log->entry); i++) 3538 print_binder_transaction_log_entry(m, &log->entry[i]); 3539 } 3540 for (i = 0; i < log->next; i++) 3541 print_binder_transaction_log_entry(m, &log->entry[i]); 3542 return 0; 3543} 3544 3545static const struct file_operations binder_fops = { 3546 .owner = THIS_MODULE, 3547 .poll = binder_poll, 3548 .unlocked_ioctl = binder_ioctl, 3549 .mmap = binder_mmap, 3550 .open = binder_open, 3551 .flush = binder_flush, 3552 .release = binder_release, 3553}; 3554 3555static struct miscdevice binder_miscdev = { 3556 .minor = MISC_DYNAMIC_MINOR, 3557 .name = "binder", 3558 .fops = &binder_fops 3559}; 3560 3561BINDER_DEBUG_ENTRY(state); 3562BINDER_DEBUG_ENTRY(stats); 3563BINDER_DEBUG_ENTRY(transactions); 3564BINDER_DEBUG_ENTRY(transaction_log); 3565 3566static int __init binder_init(void) 3567{ 3568 int ret; 3569 3570 binder_deferred_workqueue = create_singlethread_workqueue("binder"); 3571 if (!binder_deferred_workqueue) 3572 return -ENOMEM; 3573 3574 binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL); 3575 if (binder_debugfs_dir_entry_root) 3576 binder_debugfs_dir_entry_proc = debugfs_create_dir("proc", 3577 binder_debugfs_dir_entry_root); 3578 ret = misc_register(&binder_miscdev); 3579 if (binder_debugfs_dir_entry_root) { 3580 debugfs_create_file("state", 3581 S_IRUGO, 3582 binder_debugfs_dir_entry_root, 3583 NULL, 3584 &binder_state_fops); 3585 debugfs_create_file("stats", 3586 S_IRUGO, 3587 binder_debugfs_dir_entry_root, 3588 NULL, 3589 &binder_stats_fops); 3590 debugfs_create_file("transactions", 3591 S_IRUGO, 3592 binder_debugfs_dir_entry_root, 3593 NULL, 3594 &binder_transactions_fops); 3595 debugfs_create_file("transaction_log", 3596 S_IRUGO, 3597 binder_debugfs_dir_entry_root, 3598 &binder_transaction_log, 3599 &binder_transaction_log_fops); 3600 debugfs_create_file("failed_transaction_log", 3601 S_IRUGO, 3602 binder_debugfs_dir_entry_root, 3603 &binder_transaction_log_failed, 3604 &binder_transaction_log_fops); 3605 } 3606 return ret; 3607} 3608 3609device_initcall(binder_init); 3610 3611MODULE_LICENSE("GPL v2"); 3612