binder.c revision 7d42043f093ed83ef80f03b17087a1eaaf8d2e06
1/* binder.c 2 * 3 * Android IPC Subsystem 4 * 5 * Copyright (C) 2007-2008 Google, Inc. 6 * 7 * This software is licensed under the terms of the GNU General Public 8 * License version 2, as published by the Free Software Foundation, and 9 * may be copied, distributed, and modified under those terms. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 */ 17 18#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 19 20#include <asm/cacheflush.h> 21#include <linux/fdtable.h> 22#include <linux/file.h> 23#include <linux/freezer.h> 24#include <linux/fs.h> 25#include <linux/list.h> 26#include <linux/miscdevice.h> 27#include <linux/mm.h> 28#include <linux/module.h> 29#include <linux/mutex.h> 30#include <linux/nsproxy.h> 31#include <linux/poll.h> 32#include <linux/debugfs.h> 33#include <linux/rbtree.h> 34#include <linux/sched.h> 35#include <linux/seq_file.h> 36#include <linux/uaccess.h> 37#include <linux/vmalloc.h> 38#include <linux/slab.h> 39#include <linux/pid_namespace.h> 40 41#include "binder.h" 42#include "binder_trace.h" 43 44static DEFINE_MUTEX(binder_main_lock); 45static DEFINE_MUTEX(binder_deferred_lock); 46static DEFINE_MUTEX(binder_mmap_lock); 47 48static HLIST_HEAD(binder_procs); 49static HLIST_HEAD(binder_deferred_list); 50static HLIST_HEAD(binder_dead_nodes); 51 52static struct dentry *binder_debugfs_dir_entry_root; 53static struct dentry *binder_debugfs_dir_entry_proc; 54static struct binder_node *binder_context_mgr_node; 55static kuid_t binder_context_mgr_uid = INVALID_UID; 56static int binder_last_id; 57static struct workqueue_struct *binder_deferred_workqueue; 58 59#define BINDER_DEBUG_ENTRY(name) \ 60static int binder_##name##_open(struct inode *inode, struct file *file) \ 61{ \ 62 return single_open(file, binder_##name##_show, inode->i_private); \ 63} \ 64\ 65static const struct file_operations binder_##name##_fops = { \ 66 .owner = THIS_MODULE, \ 67 .open = binder_##name##_open, \ 68 .read = seq_read, \ 69 .llseek = seq_lseek, \ 70 .release = single_release, \ 71} 72 73static int binder_proc_show(struct seq_file *m, void *unused); 74BINDER_DEBUG_ENTRY(proc); 75 76/* This is only defined in include/asm-arm/sizes.h */ 77#ifndef SZ_1K 78#define SZ_1K 0x400 79#endif 80 81#ifndef SZ_4M 82#define SZ_4M 0x400000 83#endif 84 85#define FORBIDDEN_MMAP_FLAGS (VM_WRITE) 86 87#define BINDER_SMALL_BUF_SIZE (PAGE_SIZE * 64) 88 89enum { 90 BINDER_DEBUG_USER_ERROR = 1U << 0, 91 BINDER_DEBUG_FAILED_TRANSACTION = 1U << 1, 92 BINDER_DEBUG_DEAD_TRANSACTION = 1U << 2, 93 BINDER_DEBUG_OPEN_CLOSE = 1U << 3, 94 BINDER_DEBUG_DEAD_BINDER = 1U << 4, 95 BINDER_DEBUG_DEATH_NOTIFICATION = 1U << 5, 96 BINDER_DEBUG_READ_WRITE = 1U << 6, 97 BINDER_DEBUG_USER_REFS = 1U << 7, 98 BINDER_DEBUG_THREADS = 1U << 8, 99 BINDER_DEBUG_TRANSACTION = 1U << 9, 100 BINDER_DEBUG_TRANSACTION_COMPLETE = 1U << 10, 101 BINDER_DEBUG_FREE_BUFFER = 1U << 11, 102 BINDER_DEBUG_INTERNAL_REFS = 1U << 12, 103 BINDER_DEBUG_BUFFER_ALLOC = 1U << 13, 104 BINDER_DEBUG_PRIORITY_CAP = 1U << 14, 105 BINDER_DEBUG_BUFFER_ALLOC_ASYNC = 1U << 15, 106}; 107static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR | 108 BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION; 109module_param_named(debug_mask, binder_debug_mask, uint, S_IWUSR | S_IRUGO); 110 111static bool binder_debug_no_lock; 112module_param_named(proc_no_lock, binder_debug_no_lock, bool, S_IWUSR | S_IRUGO); 113 114static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait); 115static int binder_stop_on_user_error; 116 117static int binder_set_stop_on_user_error(const char *val, 118 struct kernel_param *kp) 119{ 120 int ret; 121 122 ret = param_set_int(val, kp); 123 if (binder_stop_on_user_error < 2) 124 wake_up(&binder_user_error_wait); 125 return ret; 126} 127module_param_call(stop_on_user_error, binder_set_stop_on_user_error, 128 param_get_int, &binder_stop_on_user_error, S_IWUSR | S_IRUGO); 129 130#define binder_debug(mask, x...) \ 131 do { \ 132 if (binder_debug_mask & mask) \ 133 pr_info(x); \ 134 } while (0) 135 136#define binder_user_error(x...) \ 137 do { \ 138 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \ 139 pr_info(x); \ 140 if (binder_stop_on_user_error) \ 141 binder_stop_on_user_error = 2; \ 142 } while (0) 143 144enum binder_stat_types { 145 BINDER_STAT_PROC, 146 BINDER_STAT_THREAD, 147 BINDER_STAT_NODE, 148 BINDER_STAT_REF, 149 BINDER_STAT_DEATH, 150 BINDER_STAT_TRANSACTION, 151 BINDER_STAT_TRANSACTION_COMPLETE, 152 BINDER_STAT_COUNT 153}; 154 155struct binder_stats { 156 int br[_IOC_NR(BR_FAILED_REPLY) + 1]; 157 int bc[_IOC_NR(BC_DEAD_BINDER_DONE) + 1]; 158 int obj_created[BINDER_STAT_COUNT]; 159 int obj_deleted[BINDER_STAT_COUNT]; 160}; 161 162static struct binder_stats binder_stats; 163 164static inline void binder_stats_deleted(enum binder_stat_types type) 165{ 166 binder_stats.obj_deleted[type]++; 167} 168 169static inline void binder_stats_created(enum binder_stat_types type) 170{ 171 binder_stats.obj_created[type]++; 172} 173 174struct binder_transaction_log_entry { 175 int debug_id; 176 int call_type; 177 int from_proc; 178 int from_thread; 179 int target_handle; 180 int to_proc; 181 int to_thread; 182 int to_node; 183 int data_size; 184 int offsets_size; 185}; 186struct binder_transaction_log { 187 int next; 188 int full; 189 struct binder_transaction_log_entry entry[32]; 190}; 191static struct binder_transaction_log binder_transaction_log; 192static struct binder_transaction_log binder_transaction_log_failed; 193 194static struct binder_transaction_log_entry *binder_transaction_log_add( 195 struct binder_transaction_log *log) 196{ 197 struct binder_transaction_log_entry *e; 198 199 e = &log->entry[log->next]; 200 memset(e, 0, sizeof(*e)); 201 log->next++; 202 if (log->next == ARRAY_SIZE(log->entry)) { 203 log->next = 0; 204 log->full = 1; 205 } 206 return e; 207} 208 209struct binder_work { 210 struct list_head entry; 211 enum { 212 BINDER_WORK_TRANSACTION = 1, 213 BINDER_WORK_TRANSACTION_COMPLETE, 214 BINDER_WORK_NODE, 215 BINDER_WORK_DEAD_BINDER, 216 BINDER_WORK_DEAD_BINDER_AND_CLEAR, 217 BINDER_WORK_CLEAR_DEATH_NOTIFICATION, 218 } type; 219}; 220 221struct binder_node { 222 int debug_id; 223 struct binder_work work; 224 union { 225 struct rb_node rb_node; 226 struct hlist_node dead_node; 227 }; 228 struct binder_proc *proc; 229 struct hlist_head refs; 230 int internal_strong_refs; 231 int local_weak_refs; 232 int local_strong_refs; 233 binder_uintptr_t ptr; 234 binder_uintptr_t cookie; 235 unsigned has_strong_ref:1; 236 unsigned pending_strong_ref:1; 237 unsigned has_weak_ref:1; 238 unsigned pending_weak_ref:1; 239 unsigned has_async_transaction:1; 240 unsigned accept_fds:1; 241 unsigned min_priority:8; 242 struct list_head async_todo; 243}; 244 245struct binder_ref_death { 246 struct binder_work work; 247 binder_uintptr_t cookie; 248}; 249 250struct binder_ref { 251 /* Lookups needed: */ 252 /* node + proc => ref (transaction) */ 253 /* desc + proc => ref (transaction, inc/dec ref) */ 254 /* node => refs + procs (proc exit) */ 255 int debug_id; 256 struct rb_node rb_node_desc; 257 struct rb_node rb_node_node; 258 struct hlist_node node_entry; 259 struct binder_proc *proc; 260 struct binder_node *node; 261 uint32_t desc; 262 int strong; 263 int weak; 264 struct binder_ref_death *death; 265}; 266 267struct binder_buffer { 268 struct list_head entry; /* free and allocated entries by address */ 269 struct rb_node rb_node; /* free entry by size or allocated entry */ 270 /* by address */ 271 unsigned free:1; 272 unsigned allow_user_free:1; 273 unsigned async_transaction:1; 274 unsigned debug_id:29; 275 276 struct binder_transaction *transaction; 277 278 struct binder_node *target_node; 279 size_t data_size; 280 size_t offsets_size; 281 uint8_t data[0]; 282}; 283 284enum binder_deferred_state { 285 BINDER_DEFERRED_PUT_FILES = 0x01, 286 BINDER_DEFERRED_FLUSH = 0x02, 287 BINDER_DEFERRED_RELEASE = 0x04, 288}; 289 290struct binder_proc { 291 struct hlist_node proc_node; 292 struct rb_root threads; 293 struct rb_root nodes; 294 struct rb_root refs_by_desc; 295 struct rb_root refs_by_node; 296 int pid; 297 struct vm_area_struct *vma; 298 struct mm_struct *vma_vm_mm; 299 struct task_struct *tsk; 300 struct files_struct *files; 301 struct hlist_node deferred_work_node; 302 int deferred_work; 303 void *buffer; 304 ptrdiff_t user_buffer_offset; 305 306 struct list_head buffers; 307 struct rb_root free_buffers; 308 struct rb_root allocated_buffers; 309 size_t free_async_space; 310 311 struct page **pages; 312 size_t buffer_size; 313 uint32_t buffer_free; 314 struct list_head todo; 315 wait_queue_head_t wait; 316 struct binder_stats stats; 317 struct list_head delivered_death; 318 int max_threads; 319 int requested_threads; 320 int requested_threads_started; 321 int ready_threads; 322 long default_priority; 323 struct dentry *debugfs_entry; 324}; 325 326enum { 327 BINDER_LOOPER_STATE_REGISTERED = 0x01, 328 BINDER_LOOPER_STATE_ENTERED = 0x02, 329 BINDER_LOOPER_STATE_EXITED = 0x04, 330 BINDER_LOOPER_STATE_INVALID = 0x08, 331 BINDER_LOOPER_STATE_WAITING = 0x10, 332 BINDER_LOOPER_STATE_NEED_RETURN = 0x20 333}; 334 335struct binder_thread { 336 struct binder_proc *proc; 337 struct rb_node rb_node; 338 int pid; 339 int looper; 340 struct binder_transaction *transaction_stack; 341 struct list_head todo; 342 uint32_t return_error; /* Write failed, return error code in read buf */ 343 uint32_t return_error2; /* Write failed, return error code in read */ 344 /* buffer. Used when sending a reply to a dead process that */ 345 /* we are also waiting on */ 346 wait_queue_head_t wait; 347 struct binder_stats stats; 348}; 349 350struct binder_transaction { 351 int debug_id; 352 struct binder_work work; 353 struct binder_thread *from; 354 struct binder_transaction *from_parent; 355 struct binder_proc *to_proc; 356 struct binder_thread *to_thread; 357 struct binder_transaction *to_parent; 358 unsigned need_reply:1; 359 /* unsigned is_dead:1; */ /* not used at the moment */ 360 361 struct binder_buffer *buffer; 362 unsigned int code; 363 unsigned int flags; 364 long priority; 365 long saved_priority; 366 kuid_t sender_euid; 367}; 368 369static void 370binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer); 371 372static int task_get_unused_fd_flags(struct binder_proc *proc, int flags) 373{ 374 struct files_struct *files = proc->files; 375 unsigned long rlim_cur; 376 unsigned long irqs; 377 378 if (files == NULL) 379 return -ESRCH; 380 381 if (!lock_task_sighand(proc->tsk, &irqs)) 382 return -EMFILE; 383 384 rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE); 385 unlock_task_sighand(proc->tsk, &irqs); 386 387 return __alloc_fd(files, 0, rlim_cur, flags); 388} 389 390/* 391 * copied from fd_install 392 */ 393static void task_fd_install( 394 struct binder_proc *proc, unsigned int fd, struct file *file) 395{ 396 if (proc->files) 397 __fd_install(proc->files, fd, file); 398} 399 400/* 401 * copied from sys_close 402 */ 403static long task_close_fd(struct binder_proc *proc, unsigned int fd) 404{ 405 int retval; 406 407 if (proc->files == NULL) 408 return -ESRCH; 409 410 retval = __close_fd(proc->files, fd); 411 /* can't restart close syscall because file table entry was cleared */ 412 if (unlikely(retval == -ERESTARTSYS || 413 retval == -ERESTARTNOINTR || 414 retval == -ERESTARTNOHAND || 415 retval == -ERESTART_RESTARTBLOCK)) 416 retval = -EINTR; 417 418 return retval; 419} 420 421static inline void binder_lock(const char *tag) 422{ 423 trace_binder_lock(tag); 424 mutex_lock(&binder_main_lock); 425 trace_binder_locked(tag); 426} 427 428static inline void binder_unlock(const char *tag) 429{ 430 trace_binder_unlock(tag); 431 mutex_unlock(&binder_main_lock); 432} 433 434static void binder_set_nice(long nice) 435{ 436 long min_nice; 437 438 if (can_nice(current, nice)) { 439 set_user_nice(current, nice); 440 return; 441 } 442 min_nice = 20 - current->signal->rlim[RLIMIT_NICE].rlim_cur; 443 binder_debug(BINDER_DEBUG_PRIORITY_CAP, 444 "%d: nice value %ld not allowed use %ld instead\n", 445 current->pid, nice, min_nice); 446 set_user_nice(current, min_nice); 447 if (min_nice < 20) 448 return; 449 binder_user_error("%d RLIMIT_NICE not set\n", current->pid); 450} 451 452static size_t binder_buffer_size(struct binder_proc *proc, 453 struct binder_buffer *buffer) 454{ 455 if (list_is_last(&buffer->entry, &proc->buffers)) 456 return proc->buffer + proc->buffer_size - (void *)buffer->data; 457 else 458 return (size_t)list_entry(buffer->entry.next, 459 struct binder_buffer, entry) - (size_t)buffer->data; 460} 461 462static void binder_insert_free_buffer(struct binder_proc *proc, 463 struct binder_buffer *new_buffer) 464{ 465 struct rb_node **p = &proc->free_buffers.rb_node; 466 struct rb_node *parent = NULL; 467 struct binder_buffer *buffer; 468 size_t buffer_size; 469 size_t new_buffer_size; 470 471 BUG_ON(!new_buffer->free); 472 473 new_buffer_size = binder_buffer_size(proc, new_buffer); 474 475 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 476 "%d: add free buffer, size %zd, at %p\n", 477 proc->pid, new_buffer_size, new_buffer); 478 479 while (*p) { 480 parent = *p; 481 buffer = rb_entry(parent, struct binder_buffer, rb_node); 482 BUG_ON(!buffer->free); 483 484 buffer_size = binder_buffer_size(proc, buffer); 485 486 if (new_buffer_size < buffer_size) 487 p = &parent->rb_left; 488 else 489 p = &parent->rb_right; 490 } 491 rb_link_node(&new_buffer->rb_node, parent, p); 492 rb_insert_color(&new_buffer->rb_node, &proc->free_buffers); 493} 494 495static void binder_insert_allocated_buffer(struct binder_proc *proc, 496 struct binder_buffer *new_buffer) 497{ 498 struct rb_node **p = &proc->allocated_buffers.rb_node; 499 struct rb_node *parent = NULL; 500 struct binder_buffer *buffer; 501 502 BUG_ON(new_buffer->free); 503 504 while (*p) { 505 parent = *p; 506 buffer = rb_entry(parent, struct binder_buffer, rb_node); 507 BUG_ON(buffer->free); 508 509 if (new_buffer < buffer) 510 p = &parent->rb_left; 511 else if (new_buffer > buffer) 512 p = &parent->rb_right; 513 else 514 BUG(); 515 } 516 rb_link_node(&new_buffer->rb_node, parent, p); 517 rb_insert_color(&new_buffer->rb_node, &proc->allocated_buffers); 518} 519 520static struct binder_buffer *binder_buffer_lookup(struct binder_proc *proc, 521 uintptr_t user_ptr) 522{ 523 struct rb_node *n = proc->allocated_buffers.rb_node; 524 struct binder_buffer *buffer; 525 struct binder_buffer *kern_ptr; 526 527 kern_ptr = (struct binder_buffer *)(user_ptr - proc->user_buffer_offset 528 - offsetof(struct binder_buffer, data)); 529 530 while (n) { 531 buffer = rb_entry(n, struct binder_buffer, rb_node); 532 BUG_ON(buffer->free); 533 534 if (kern_ptr < buffer) 535 n = n->rb_left; 536 else if (kern_ptr > buffer) 537 n = n->rb_right; 538 else 539 return buffer; 540 } 541 return NULL; 542} 543 544static int binder_update_page_range(struct binder_proc *proc, int allocate, 545 void *start, void *end, 546 struct vm_area_struct *vma) 547{ 548 void *page_addr; 549 unsigned long user_page_addr; 550 struct vm_struct tmp_area; 551 struct page **page; 552 struct mm_struct *mm; 553 554 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 555 "%d: %s pages %p-%p\n", proc->pid, 556 allocate ? "allocate" : "free", start, end); 557 558 if (end <= start) 559 return 0; 560 561 trace_binder_update_page_range(proc, allocate, start, end); 562 563 if (vma) 564 mm = NULL; 565 else 566 mm = get_task_mm(proc->tsk); 567 568 if (mm) { 569 down_write(&mm->mmap_sem); 570 vma = proc->vma; 571 if (vma && mm != proc->vma_vm_mm) { 572 pr_err("%d: vma mm and task mm mismatch\n", 573 proc->pid); 574 vma = NULL; 575 } 576 } 577 578 if (allocate == 0) 579 goto free_range; 580 581 if (vma == NULL) { 582 pr_err("%d: binder_alloc_buf failed to map pages in userspace, no vma\n", 583 proc->pid); 584 goto err_no_vma; 585 } 586 587 for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) { 588 int ret; 589 struct page **page_array_ptr; 590 591 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 592 593 BUG_ON(*page); 594 *page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO); 595 if (*page == NULL) { 596 pr_err("%d: binder_alloc_buf failed for page at %p\n", 597 proc->pid, page_addr); 598 goto err_alloc_page_failed; 599 } 600 tmp_area.addr = page_addr; 601 tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */; 602 page_array_ptr = page; 603 ret = map_vm_area(&tmp_area, PAGE_KERNEL, &page_array_ptr); 604 if (ret) { 605 pr_err("%d: binder_alloc_buf failed to map page at %p in kernel\n", 606 proc->pid, page_addr); 607 goto err_map_kernel_failed; 608 } 609 user_page_addr = 610 (uintptr_t)page_addr + proc->user_buffer_offset; 611 ret = vm_insert_page(vma, user_page_addr, page[0]); 612 if (ret) { 613 pr_err("%d: binder_alloc_buf failed to map page at %lx in userspace\n", 614 proc->pid, user_page_addr); 615 goto err_vm_insert_page_failed; 616 } 617 /* vm_insert_page does not seem to increment the refcount */ 618 } 619 if (mm) { 620 up_write(&mm->mmap_sem); 621 mmput(mm); 622 } 623 return 0; 624 625free_range: 626 for (page_addr = end - PAGE_SIZE; page_addr >= start; 627 page_addr -= PAGE_SIZE) { 628 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 629 if (vma) 630 zap_page_range(vma, (uintptr_t)page_addr + 631 proc->user_buffer_offset, PAGE_SIZE, NULL); 632err_vm_insert_page_failed: 633 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE); 634err_map_kernel_failed: 635 __free_page(*page); 636 *page = NULL; 637err_alloc_page_failed: 638 ; 639 } 640err_no_vma: 641 if (mm) { 642 up_write(&mm->mmap_sem); 643 mmput(mm); 644 } 645 return -ENOMEM; 646} 647 648static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc, 649 size_t data_size, 650 size_t offsets_size, int is_async) 651{ 652 struct rb_node *n = proc->free_buffers.rb_node; 653 struct binder_buffer *buffer; 654 size_t buffer_size; 655 struct rb_node *best_fit = NULL; 656 void *has_page_addr; 657 void *end_page_addr; 658 size_t size; 659 660 if (proc->vma == NULL) { 661 pr_err("%d: binder_alloc_buf, no vma\n", 662 proc->pid); 663 return NULL; 664 } 665 666 size = ALIGN(data_size, sizeof(void *)) + 667 ALIGN(offsets_size, sizeof(void *)); 668 669 if (size < data_size || size < offsets_size) { 670 binder_user_error("%d: got transaction with invalid size %zd-%zd\n", 671 proc->pid, data_size, offsets_size); 672 return NULL; 673 } 674 675 if (is_async && 676 proc->free_async_space < size + sizeof(struct binder_buffer)) { 677 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 678 "%d: binder_alloc_buf size %zd failed, no async space left\n", 679 proc->pid, size); 680 return NULL; 681 } 682 683 while (n) { 684 buffer = rb_entry(n, struct binder_buffer, rb_node); 685 BUG_ON(!buffer->free); 686 buffer_size = binder_buffer_size(proc, buffer); 687 688 if (size < buffer_size) { 689 best_fit = n; 690 n = n->rb_left; 691 } else if (size > buffer_size) 692 n = n->rb_right; 693 else { 694 best_fit = n; 695 break; 696 } 697 } 698 if (best_fit == NULL) { 699 pr_err("%d: binder_alloc_buf size %zd failed, no address space\n", 700 proc->pid, size); 701 return NULL; 702 } 703 if (n == NULL) { 704 buffer = rb_entry(best_fit, struct binder_buffer, rb_node); 705 buffer_size = binder_buffer_size(proc, buffer); 706 } 707 708 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 709 "%d: binder_alloc_buf size %zd got buffer %p size %zd\n", 710 proc->pid, size, buffer, buffer_size); 711 712 has_page_addr = 713 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK); 714 if (n == NULL) { 715 if (size + sizeof(struct binder_buffer) + 4 >= buffer_size) 716 buffer_size = size; /* no room for other buffers */ 717 else 718 buffer_size = size + sizeof(struct binder_buffer); 719 } 720 end_page_addr = 721 (void *)PAGE_ALIGN((uintptr_t)buffer->data + buffer_size); 722 if (end_page_addr > has_page_addr) 723 end_page_addr = has_page_addr; 724 if (binder_update_page_range(proc, 1, 725 (void *)PAGE_ALIGN((uintptr_t)buffer->data), end_page_addr, NULL)) 726 return NULL; 727 728 rb_erase(best_fit, &proc->free_buffers); 729 buffer->free = 0; 730 binder_insert_allocated_buffer(proc, buffer); 731 if (buffer_size != size) { 732 struct binder_buffer *new_buffer = (void *)buffer->data + size; 733 734 list_add(&new_buffer->entry, &buffer->entry); 735 new_buffer->free = 1; 736 binder_insert_free_buffer(proc, new_buffer); 737 } 738 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 739 "%d: binder_alloc_buf size %zd got %p\n", 740 proc->pid, size, buffer); 741 buffer->data_size = data_size; 742 buffer->offsets_size = offsets_size; 743 buffer->async_transaction = is_async; 744 if (is_async) { 745 proc->free_async_space -= size + sizeof(struct binder_buffer); 746 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 747 "%d: binder_alloc_buf size %zd async free %zd\n", 748 proc->pid, size, proc->free_async_space); 749 } 750 751 return buffer; 752} 753 754static void *buffer_start_page(struct binder_buffer *buffer) 755{ 756 return (void *)((uintptr_t)buffer & PAGE_MASK); 757} 758 759static void *buffer_end_page(struct binder_buffer *buffer) 760{ 761 return (void *)(((uintptr_t)(buffer + 1) - 1) & PAGE_MASK); 762} 763 764static void binder_delete_free_buffer(struct binder_proc *proc, 765 struct binder_buffer *buffer) 766{ 767 struct binder_buffer *prev, *next = NULL; 768 int free_page_end = 1; 769 int free_page_start = 1; 770 771 BUG_ON(proc->buffers.next == &buffer->entry); 772 prev = list_entry(buffer->entry.prev, struct binder_buffer, entry); 773 BUG_ON(!prev->free); 774 if (buffer_end_page(prev) == buffer_start_page(buffer)) { 775 free_page_start = 0; 776 if (buffer_end_page(prev) == buffer_end_page(buffer)) 777 free_page_end = 0; 778 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 779 "%d: merge free, buffer %p share page with %p\n", 780 proc->pid, buffer, prev); 781 } 782 783 if (!list_is_last(&buffer->entry, &proc->buffers)) { 784 next = list_entry(buffer->entry.next, 785 struct binder_buffer, entry); 786 if (buffer_start_page(next) == buffer_end_page(buffer)) { 787 free_page_end = 0; 788 if (buffer_start_page(next) == 789 buffer_start_page(buffer)) 790 free_page_start = 0; 791 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 792 "%d: merge free, buffer %p share page with %p\n", 793 proc->pid, buffer, prev); 794 } 795 } 796 list_del(&buffer->entry); 797 if (free_page_start || free_page_end) { 798 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 799 "%d: merge free, buffer %p do not share page%s%s with %p or %p\n", 800 proc->pid, buffer, free_page_start ? "" : " end", 801 free_page_end ? "" : " start", prev, next); 802 binder_update_page_range(proc, 0, free_page_start ? 803 buffer_start_page(buffer) : buffer_end_page(buffer), 804 (free_page_end ? buffer_end_page(buffer) : 805 buffer_start_page(buffer)) + PAGE_SIZE, NULL); 806 } 807} 808 809static void binder_free_buf(struct binder_proc *proc, 810 struct binder_buffer *buffer) 811{ 812 size_t size, buffer_size; 813 814 buffer_size = binder_buffer_size(proc, buffer); 815 816 size = ALIGN(buffer->data_size, sizeof(void *)) + 817 ALIGN(buffer->offsets_size, sizeof(void *)); 818 819 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 820 "%d: binder_free_buf %p size %zd buffer_size %zd\n", 821 proc->pid, buffer, size, buffer_size); 822 823 BUG_ON(buffer->free); 824 BUG_ON(size > buffer_size); 825 BUG_ON(buffer->transaction != NULL); 826 BUG_ON((void *)buffer < proc->buffer); 827 BUG_ON((void *)buffer > proc->buffer + proc->buffer_size); 828 829 if (buffer->async_transaction) { 830 proc->free_async_space += size + sizeof(struct binder_buffer); 831 832 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 833 "%d: binder_free_buf size %zd async free %zd\n", 834 proc->pid, size, proc->free_async_space); 835 } 836 837 binder_update_page_range(proc, 0, 838 (void *)PAGE_ALIGN((uintptr_t)buffer->data), 839 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK), 840 NULL); 841 rb_erase(&buffer->rb_node, &proc->allocated_buffers); 842 buffer->free = 1; 843 if (!list_is_last(&buffer->entry, &proc->buffers)) { 844 struct binder_buffer *next = list_entry(buffer->entry.next, 845 struct binder_buffer, entry); 846 847 if (next->free) { 848 rb_erase(&next->rb_node, &proc->free_buffers); 849 binder_delete_free_buffer(proc, next); 850 } 851 } 852 if (proc->buffers.next != &buffer->entry) { 853 struct binder_buffer *prev = list_entry(buffer->entry.prev, 854 struct binder_buffer, entry); 855 856 if (prev->free) { 857 binder_delete_free_buffer(proc, buffer); 858 rb_erase(&prev->rb_node, &proc->free_buffers); 859 buffer = prev; 860 } 861 } 862 binder_insert_free_buffer(proc, buffer); 863} 864 865static struct binder_node *binder_get_node(struct binder_proc *proc, 866 binder_uintptr_t ptr) 867{ 868 struct rb_node *n = proc->nodes.rb_node; 869 struct binder_node *node; 870 871 while (n) { 872 node = rb_entry(n, struct binder_node, rb_node); 873 874 if (ptr < node->ptr) 875 n = n->rb_left; 876 else if (ptr > node->ptr) 877 n = n->rb_right; 878 else 879 return node; 880 } 881 return NULL; 882} 883 884static struct binder_node *binder_new_node(struct binder_proc *proc, 885 binder_uintptr_t ptr, 886 binder_uintptr_t cookie) 887{ 888 struct rb_node **p = &proc->nodes.rb_node; 889 struct rb_node *parent = NULL; 890 struct binder_node *node; 891 892 while (*p) { 893 parent = *p; 894 node = rb_entry(parent, struct binder_node, rb_node); 895 896 if (ptr < node->ptr) 897 p = &(*p)->rb_left; 898 else if (ptr > node->ptr) 899 p = &(*p)->rb_right; 900 else 901 return NULL; 902 } 903 904 node = kzalloc(sizeof(*node), GFP_KERNEL); 905 if (node == NULL) 906 return NULL; 907 binder_stats_created(BINDER_STAT_NODE); 908 rb_link_node(&node->rb_node, parent, p); 909 rb_insert_color(&node->rb_node, &proc->nodes); 910 node->debug_id = ++binder_last_id; 911 node->proc = proc; 912 node->ptr = ptr; 913 node->cookie = cookie; 914 node->work.type = BINDER_WORK_NODE; 915 INIT_LIST_HEAD(&node->work.entry); 916 INIT_LIST_HEAD(&node->async_todo); 917 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 918 "%d:%d node %d u%016llx c%016llx created\n", 919 proc->pid, current->pid, node->debug_id, 920 (u64)node->ptr, (u64)node->cookie); 921 return node; 922} 923 924static int binder_inc_node(struct binder_node *node, int strong, int internal, 925 struct list_head *target_list) 926{ 927 if (strong) { 928 if (internal) { 929 if (target_list == NULL && 930 node->internal_strong_refs == 0 && 931 !(node == binder_context_mgr_node && 932 node->has_strong_ref)) { 933 pr_err("invalid inc strong node for %d\n", 934 node->debug_id); 935 return -EINVAL; 936 } 937 node->internal_strong_refs++; 938 } else 939 node->local_strong_refs++; 940 if (!node->has_strong_ref && target_list) { 941 list_del_init(&node->work.entry); 942 list_add_tail(&node->work.entry, target_list); 943 } 944 } else { 945 if (!internal) 946 node->local_weak_refs++; 947 if (!node->has_weak_ref && list_empty(&node->work.entry)) { 948 if (target_list == NULL) { 949 pr_err("invalid inc weak node for %d\n", 950 node->debug_id); 951 return -EINVAL; 952 } 953 list_add_tail(&node->work.entry, target_list); 954 } 955 } 956 return 0; 957} 958 959static int binder_dec_node(struct binder_node *node, int strong, int internal) 960{ 961 if (strong) { 962 if (internal) 963 node->internal_strong_refs--; 964 else 965 node->local_strong_refs--; 966 if (node->local_strong_refs || node->internal_strong_refs) 967 return 0; 968 } else { 969 if (!internal) 970 node->local_weak_refs--; 971 if (node->local_weak_refs || !hlist_empty(&node->refs)) 972 return 0; 973 } 974 if (node->proc && (node->has_strong_ref || node->has_weak_ref)) { 975 if (list_empty(&node->work.entry)) { 976 list_add_tail(&node->work.entry, &node->proc->todo); 977 wake_up_interruptible(&node->proc->wait); 978 } 979 } else { 980 if (hlist_empty(&node->refs) && !node->local_strong_refs && 981 !node->local_weak_refs) { 982 list_del_init(&node->work.entry); 983 if (node->proc) { 984 rb_erase(&node->rb_node, &node->proc->nodes); 985 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 986 "refless node %d deleted\n", 987 node->debug_id); 988 } else { 989 hlist_del(&node->dead_node); 990 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 991 "dead node %d deleted\n", 992 node->debug_id); 993 } 994 kfree(node); 995 binder_stats_deleted(BINDER_STAT_NODE); 996 } 997 } 998 999 return 0; 1000} 1001 1002 1003static struct binder_ref *binder_get_ref(struct binder_proc *proc, 1004 uint32_t desc) 1005{ 1006 struct rb_node *n = proc->refs_by_desc.rb_node; 1007 struct binder_ref *ref; 1008 1009 while (n) { 1010 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1011 1012 if (desc < ref->desc) 1013 n = n->rb_left; 1014 else if (desc > ref->desc) 1015 n = n->rb_right; 1016 else 1017 return ref; 1018 } 1019 return NULL; 1020} 1021 1022static struct binder_ref *binder_get_ref_for_node(struct binder_proc *proc, 1023 struct binder_node *node) 1024{ 1025 struct rb_node *n; 1026 struct rb_node **p = &proc->refs_by_node.rb_node; 1027 struct rb_node *parent = NULL; 1028 struct binder_ref *ref, *new_ref; 1029 1030 while (*p) { 1031 parent = *p; 1032 ref = rb_entry(parent, struct binder_ref, rb_node_node); 1033 1034 if (node < ref->node) 1035 p = &(*p)->rb_left; 1036 else if (node > ref->node) 1037 p = &(*p)->rb_right; 1038 else 1039 return ref; 1040 } 1041 new_ref = kzalloc(sizeof(*ref), GFP_KERNEL); 1042 if (new_ref == NULL) 1043 return NULL; 1044 binder_stats_created(BINDER_STAT_REF); 1045 new_ref->debug_id = ++binder_last_id; 1046 new_ref->proc = proc; 1047 new_ref->node = node; 1048 rb_link_node(&new_ref->rb_node_node, parent, p); 1049 rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node); 1050 1051 new_ref->desc = (node == binder_context_mgr_node) ? 0 : 1; 1052 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 1053 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1054 if (ref->desc > new_ref->desc) 1055 break; 1056 new_ref->desc = ref->desc + 1; 1057 } 1058 1059 p = &proc->refs_by_desc.rb_node; 1060 while (*p) { 1061 parent = *p; 1062 ref = rb_entry(parent, struct binder_ref, rb_node_desc); 1063 1064 if (new_ref->desc < ref->desc) 1065 p = &(*p)->rb_left; 1066 else if (new_ref->desc > ref->desc) 1067 p = &(*p)->rb_right; 1068 else 1069 BUG(); 1070 } 1071 rb_link_node(&new_ref->rb_node_desc, parent, p); 1072 rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc); 1073 if (node) { 1074 hlist_add_head(&new_ref->node_entry, &node->refs); 1075 1076 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1077 "%d new ref %d desc %d for node %d\n", 1078 proc->pid, new_ref->debug_id, new_ref->desc, 1079 node->debug_id); 1080 } else { 1081 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1082 "%d new ref %d desc %d for dead node\n", 1083 proc->pid, new_ref->debug_id, new_ref->desc); 1084 } 1085 return new_ref; 1086} 1087 1088static void binder_delete_ref(struct binder_ref *ref) 1089{ 1090 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1091 "%d delete ref %d desc %d for node %d\n", 1092 ref->proc->pid, ref->debug_id, ref->desc, 1093 ref->node->debug_id); 1094 1095 rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc); 1096 rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node); 1097 if (ref->strong) 1098 binder_dec_node(ref->node, 1, 1); 1099 hlist_del(&ref->node_entry); 1100 binder_dec_node(ref->node, 0, 1); 1101 if (ref->death) { 1102 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1103 "%d delete ref %d desc %d has death notification\n", 1104 ref->proc->pid, ref->debug_id, ref->desc); 1105 list_del(&ref->death->work.entry); 1106 kfree(ref->death); 1107 binder_stats_deleted(BINDER_STAT_DEATH); 1108 } 1109 kfree(ref); 1110 binder_stats_deleted(BINDER_STAT_REF); 1111} 1112 1113static int binder_inc_ref(struct binder_ref *ref, int strong, 1114 struct list_head *target_list) 1115{ 1116 int ret; 1117 1118 if (strong) { 1119 if (ref->strong == 0) { 1120 ret = binder_inc_node(ref->node, 1, 1, target_list); 1121 if (ret) 1122 return ret; 1123 } 1124 ref->strong++; 1125 } else { 1126 if (ref->weak == 0) { 1127 ret = binder_inc_node(ref->node, 0, 1, target_list); 1128 if (ret) 1129 return ret; 1130 } 1131 ref->weak++; 1132 } 1133 return 0; 1134} 1135 1136 1137static int binder_dec_ref(struct binder_ref *ref, int strong) 1138{ 1139 if (strong) { 1140 if (ref->strong == 0) { 1141 binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n", 1142 ref->proc->pid, ref->debug_id, 1143 ref->desc, ref->strong, ref->weak); 1144 return -EINVAL; 1145 } 1146 ref->strong--; 1147 if (ref->strong == 0) { 1148 int ret; 1149 1150 ret = binder_dec_node(ref->node, strong, 1); 1151 if (ret) 1152 return ret; 1153 } 1154 } else { 1155 if (ref->weak == 0) { 1156 binder_user_error("%d invalid dec weak, ref %d desc %d s %d w %d\n", 1157 ref->proc->pid, ref->debug_id, 1158 ref->desc, ref->strong, ref->weak); 1159 return -EINVAL; 1160 } 1161 ref->weak--; 1162 } 1163 if (ref->strong == 0 && ref->weak == 0) 1164 binder_delete_ref(ref); 1165 return 0; 1166} 1167 1168static void binder_pop_transaction(struct binder_thread *target_thread, 1169 struct binder_transaction *t) 1170{ 1171 if (target_thread) { 1172 BUG_ON(target_thread->transaction_stack != t); 1173 BUG_ON(target_thread->transaction_stack->from != target_thread); 1174 target_thread->transaction_stack = 1175 target_thread->transaction_stack->from_parent; 1176 t->from = NULL; 1177 } 1178 t->need_reply = 0; 1179 if (t->buffer) 1180 t->buffer->transaction = NULL; 1181 kfree(t); 1182 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1183} 1184 1185static void binder_send_failed_reply(struct binder_transaction *t, 1186 uint32_t error_code) 1187{ 1188 struct binder_thread *target_thread; 1189 1190 BUG_ON(t->flags & TF_ONE_WAY); 1191 while (1) { 1192 target_thread = t->from; 1193 if (target_thread) { 1194 if (target_thread->return_error != BR_OK && 1195 target_thread->return_error2 == BR_OK) { 1196 target_thread->return_error2 = 1197 target_thread->return_error; 1198 target_thread->return_error = BR_OK; 1199 } 1200 if (target_thread->return_error == BR_OK) { 1201 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1202 "send failed reply for transaction %d to %d:%d\n", 1203 t->debug_id, target_thread->proc->pid, 1204 target_thread->pid); 1205 1206 binder_pop_transaction(target_thread, t); 1207 target_thread->return_error = error_code; 1208 wake_up_interruptible(&target_thread->wait); 1209 } else { 1210 pr_err("reply failed, target thread, %d:%d, has error code %d already\n", 1211 target_thread->proc->pid, 1212 target_thread->pid, 1213 target_thread->return_error); 1214 } 1215 return; 1216 } else { 1217 struct binder_transaction *next = t->from_parent; 1218 1219 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1220 "send failed reply for transaction %d, target dead\n", 1221 t->debug_id); 1222 1223 binder_pop_transaction(target_thread, t); 1224 if (next == NULL) { 1225 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1226 "reply failed, no target thread at root\n"); 1227 return; 1228 } 1229 t = next; 1230 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1231 "reply failed, no target thread -- retry %d\n", 1232 t->debug_id); 1233 } 1234 } 1235} 1236 1237static void binder_transaction_buffer_release(struct binder_proc *proc, 1238 struct binder_buffer *buffer, 1239 binder_size_t *failed_at) 1240{ 1241 binder_size_t *offp, *off_end; 1242 int debug_id = buffer->debug_id; 1243 1244 binder_debug(BINDER_DEBUG_TRANSACTION, 1245 "%d buffer release %d, size %zd-%zd, failed at %p\n", 1246 proc->pid, buffer->debug_id, 1247 buffer->data_size, buffer->offsets_size, failed_at); 1248 1249 if (buffer->target_node) 1250 binder_dec_node(buffer->target_node, 1, 0); 1251 1252 offp = (binder_size_t *)(buffer->data + 1253 ALIGN(buffer->data_size, sizeof(void *))); 1254 if (failed_at) 1255 off_end = failed_at; 1256 else 1257 off_end = (void *)offp + buffer->offsets_size; 1258 for (; offp < off_end; offp++) { 1259 struct flat_binder_object *fp; 1260 1261 if (*offp > buffer->data_size - sizeof(*fp) || 1262 buffer->data_size < sizeof(*fp) || 1263 !IS_ALIGNED(*offp, sizeof(u32))) { 1264 pr_err("transaction release %d bad offset %lld, size %zd\n", 1265 debug_id, (u64)*offp, buffer->data_size); 1266 continue; 1267 } 1268 fp = (struct flat_binder_object *)(buffer->data + *offp); 1269 switch (fp->type) { 1270 case BINDER_TYPE_BINDER: 1271 case BINDER_TYPE_WEAK_BINDER: { 1272 struct binder_node *node = binder_get_node(proc, fp->binder); 1273 1274 if (node == NULL) { 1275 pr_err("transaction release %d bad node %016llx\n", 1276 debug_id, (u64)fp->binder); 1277 break; 1278 } 1279 binder_debug(BINDER_DEBUG_TRANSACTION, 1280 " node %d u%016llx\n", 1281 node->debug_id, (u64)node->ptr); 1282 binder_dec_node(node, fp->type == BINDER_TYPE_BINDER, 0); 1283 } break; 1284 case BINDER_TYPE_HANDLE: 1285 case BINDER_TYPE_WEAK_HANDLE: { 1286 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1287 1288 if (ref == NULL) { 1289 pr_err("transaction release %d bad handle %d\n", 1290 debug_id, fp->handle); 1291 break; 1292 } 1293 binder_debug(BINDER_DEBUG_TRANSACTION, 1294 " ref %d desc %d (node %d)\n", 1295 ref->debug_id, ref->desc, ref->node->debug_id); 1296 binder_dec_ref(ref, fp->type == BINDER_TYPE_HANDLE); 1297 } break; 1298 1299 case BINDER_TYPE_FD: 1300 binder_debug(BINDER_DEBUG_TRANSACTION, 1301 " fd %d\n", fp->handle); 1302 if (failed_at) 1303 task_close_fd(proc, fp->handle); 1304 break; 1305 1306 default: 1307 pr_err("transaction release %d bad object type %x\n", 1308 debug_id, fp->type); 1309 break; 1310 } 1311 } 1312} 1313 1314static void binder_transaction(struct binder_proc *proc, 1315 struct binder_thread *thread, 1316 struct binder_transaction_data *tr, int reply) 1317{ 1318 struct binder_transaction *t; 1319 struct binder_work *tcomplete; 1320 binder_size_t *offp, *off_end; 1321 struct binder_proc *target_proc; 1322 struct binder_thread *target_thread = NULL; 1323 struct binder_node *target_node = NULL; 1324 struct list_head *target_list; 1325 wait_queue_head_t *target_wait; 1326 struct binder_transaction *in_reply_to = NULL; 1327 struct binder_transaction_log_entry *e; 1328 uint32_t return_error; 1329 const struct cred *cred = __task_cred(proc->tsk); 1330 1331 e = binder_transaction_log_add(&binder_transaction_log); 1332 e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY); 1333 e->from_proc = proc->pid; 1334 e->from_thread = thread->pid; 1335 e->target_handle = tr->target.handle; 1336 e->data_size = tr->data_size; 1337 e->offsets_size = tr->offsets_size; 1338 1339 if (reply) { 1340 in_reply_to = thread->transaction_stack; 1341 if (in_reply_to == NULL) { 1342 binder_user_error("%d:%d got reply transaction with no transaction stack\n", 1343 proc->pid, thread->pid); 1344 return_error = BR_FAILED_REPLY; 1345 goto err_empty_call_stack; 1346 } 1347 binder_set_nice(in_reply_to->saved_priority); 1348 if (in_reply_to->to_thread != thread) { 1349 binder_user_error("%d:%d got reply transaction with bad transaction stack, transaction %d has target %d:%d\n", 1350 proc->pid, thread->pid, in_reply_to->debug_id, 1351 in_reply_to->to_proc ? 1352 in_reply_to->to_proc->pid : 0, 1353 in_reply_to->to_thread ? 1354 in_reply_to->to_thread->pid : 0); 1355 return_error = BR_FAILED_REPLY; 1356 in_reply_to = NULL; 1357 goto err_bad_call_stack; 1358 } 1359 thread->transaction_stack = in_reply_to->to_parent; 1360 target_thread = in_reply_to->from; 1361 if (target_thread == NULL) { 1362 return_error = BR_DEAD_REPLY; 1363 goto err_dead_binder; 1364 } 1365 if (target_thread->transaction_stack != in_reply_to) { 1366 binder_user_error("%d:%d got reply transaction with bad target transaction stack %d, expected %d\n", 1367 proc->pid, thread->pid, 1368 target_thread->transaction_stack ? 1369 target_thread->transaction_stack->debug_id : 0, 1370 in_reply_to->debug_id); 1371 return_error = BR_FAILED_REPLY; 1372 in_reply_to = NULL; 1373 target_thread = NULL; 1374 goto err_dead_binder; 1375 } 1376 target_proc = target_thread->proc; 1377 } else { 1378 if (tr->target.handle) { 1379 struct binder_ref *ref; 1380 1381 ref = binder_get_ref(proc, tr->target.handle); 1382 if (ref == NULL) { 1383 binder_user_error("%d:%d got transaction to invalid handle\n", 1384 proc->pid, thread->pid); 1385 return_error = BR_FAILED_REPLY; 1386 goto err_invalid_target_handle; 1387 } 1388 target_node = ref->node; 1389 } else { 1390 target_node = binder_context_mgr_node; 1391 if (target_node == NULL) { 1392 return_error = BR_DEAD_REPLY; 1393 goto err_no_context_mgr_node; 1394 } 1395 } 1396 e->to_node = target_node->debug_id; 1397 target_proc = target_node->proc; 1398 if (target_proc == NULL) { 1399 return_error = BR_DEAD_REPLY; 1400 goto err_dead_binder; 1401 } 1402 if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) { 1403 struct binder_transaction *tmp; 1404 1405 tmp = thread->transaction_stack; 1406 if (tmp->to_thread != thread) { 1407 binder_user_error("%d:%d got new transaction with bad transaction stack, transaction %d has target %d:%d\n", 1408 proc->pid, thread->pid, tmp->debug_id, 1409 tmp->to_proc ? tmp->to_proc->pid : 0, 1410 tmp->to_thread ? 1411 tmp->to_thread->pid : 0); 1412 return_error = BR_FAILED_REPLY; 1413 goto err_bad_call_stack; 1414 } 1415 while (tmp) { 1416 if (tmp->from && tmp->from->proc == target_proc) 1417 target_thread = tmp->from; 1418 tmp = tmp->from_parent; 1419 } 1420 } 1421 } 1422 if (target_thread) { 1423 e->to_thread = target_thread->pid; 1424 target_list = &target_thread->todo; 1425 target_wait = &target_thread->wait; 1426 } else { 1427 target_list = &target_proc->todo; 1428 target_wait = &target_proc->wait; 1429 } 1430 e->to_proc = target_proc->pid; 1431 1432 /* TODO: reuse incoming transaction for reply */ 1433 t = kzalloc(sizeof(*t), GFP_KERNEL); 1434 if (t == NULL) { 1435 return_error = BR_FAILED_REPLY; 1436 goto err_alloc_t_failed; 1437 } 1438 binder_stats_created(BINDER_STAT_TRANSACTION); 1439 1440 tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL); 1441 if (tcomplete == NULL) { 1442 return_error = BR_FAILED_REPLY; 1443 goto err_alloc_tcomplete_failed; 1444 } 1445 binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE); 1446 1447 t->debug_id = ++binder_last_id; 1448 e->debug_id = t->debug_id; 1449 1450 if (reply) 1451 binder_debug(BINDER_DEBUG_TRANSACTION, 1452 "%d:%d BC_REPLY %d -> %d:%d, data %016llx-%016llx size %lld-%lld\n", 1453 proc->pid, thread->pid, t->debug_id, 1454 target_proc->pid, target_thread->pid, 1455 (u64)tr->data.ptr.buffer, 1456 (u64)tr->data.ptr.offsets, 1457 (u64)tr->data_size, (u64)tr->offsets_size); 1458 else 1459 binder_debug(BINDER_DEBUG_TRANSACTION, 1460 "%d:%d BC_TRANSACTION %d -> %d - node %d, data %016llx-%016llx size %lld-%lld\n", 1461 proc->pid, thread->pid, t->debug_id, 1462 target_proc->pid, target_node->debug_id, 1463 (u64)tr->data.ptr.buffer, 1464 (u64)tr->data.ptr.offsets, 1465 (u64)tr->data_size, (u64)tr->offsets_size); 1466 1467 if (!reply && !(tr->flags & TF_ONE_WAY)) 1468 t->from = thread; 1469 else 1470 t->from = NULL; 1471 t->sender_euid = cred->euid; 1472 t->to_proc = target_proc; 1473 t->to_thread = target_thread; 1474 t->code = tr->code; 1475 t->flags = tr->flags; 1476 t->priority = task_nice(current); 1477 1478 trace_binder_transaction(reply, t, target_node); 1479 1480 t->buffer = binder_alloc_buf(target_proc, tr->data_size, 1481 tr->offsets_size, !reply && (t->flags & TF_ONE_WAY)); 1482 if (t->buffer == NULL) { 1483 return_error = BR_FAILED_REPLY; 1484 goto err_binder_alloc_buf_failed; 1485 } 1486 t->buffer->allow_user_free = 0; 1487 t->buffer->debug_id = t->debug_id; 1488 t->buffer->transaction = t; 1489 t->buffer->target_node = target_node; 1490 trace_binder_transaction_alloc_buf(t->buffer); 1491 if (target_node) 1492 binder_inc_node(target_node, 1, 0, NULL); 1493 1494 offp = (binder_size_t *)(t->buffer->data + 1495 ALIGN(tr->data_size, sizeof(void *))); 1496 1497 if (copy_from_user(t->buffer->data, (const void __user *)(uintptr_t) 1498 tr->data.ptr.buffer, tr->data_size)) { 1499 binder_user_error("%d:%d got transaction with invalid data ptr\n", 1500 proc->pid, thread->pid); 1501 return_error = BR_FAILED_REPLY; 1502 goto err_copy_data_failed; 1503 } 1504 if (copy_from_user(offp, (const void __user *)(uintptr_t) 1505 tr->data.ptr.offsets, tr->offsets_size)) { 1506 binder_user_error("%d:%d got transaction with invalid offsets ptr\n", 1507 proc->pid, thread->pid); 1508 return_error = BR_FAILED_REPLY; 1509 goto err_copy_data_failed; 1510 } 1511 if (!IS_ALIGNED(tr->offsets_size, sizeof(binder_size_t))) { 1512 binder_user_error("%d:%d got transaction with invalid offsets size, %lld\n", 1513 proc->pid, thread->pid, (u64)tr->offsets_size); 1514 return_error = BR_FAILED_REPLY; 1515 goto err_bad_offset; 1516 } 1517 off_end = (void *)offp + tr->offsets_size; 1518 for (; offp < off_end; offp++) { 1519 struct flat_binder_object *fp; 1520 1521 if (*offp > t->buffer->data_size - sizeof(*fp) || 1522 t->buffer->data_size < sizeof(*fp) || 1523 !IS_ALIGNED(*offp, sizeof(u32))) { 1524 binder_user_error("%d:%d got transaction with invalid offset, %lld\n", 1525 proc->pid, thread->pid, (u64)*offp); 1526 return_error = BR_FAILED_REPLY; 1527 goto err_bad_offset; 1528 } 1529 fp = (struct flat_binder_object *)(t->buffer->data + *offp); 1530 switch (fp->type) { 1531 case BINDER_TYPE_BINDER: 1532 case BINDER_TYPE_WEAK_BINDER: { 1533 struct binder_ref *ref; 1534 struct binder_node *node = binder_get_node(proc, fp->binder); 1535 1536 if (node == NULL) { 1537 node = binder_new_node(proc, fp->binder, fp->cookie); 1538 if (node == NULL) { 1539 return_error = BR_FAILED_REPLY; 1540 goto err_binder_new_node_failed; 1541 } 1542 node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK; 1543 node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS); 1544 } 1545 if (fp->cookie != node->cookie) { 1546 binder_user_error("%d:%d sending u%016llx node %d, cookie mismatch %016llx != %016llx\n", 1547 proc->pid, thread->pid, 1548 (u64)fp->binder, node->debug_id, 1549 (u64)fp->cookie, (u64)node->cookie); 1550 return_error = BR_FAILED_REPLY; 1551 goto err_binder_get_ref_for_node_failed; 1552 } 1553 ref = binder_get_ref_for_node(target_proc, node); 1554 if (ref == NULL) { 1555 return_error = BR_FAILED_REPLY; 1556 goto err_binder_get_ref_for_node_failed; 1557 } 1558 if (fp->type == BINDER_TYPE_BINDER) 1559 fp->type = BINDER_TYPE_HANDLE; 1560 else 1561 fp->type = BINDER_TYPE_WEAK_HANDLE; 1562 fp->handle = ref->desc; 1563 binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE, 1564 &thread->todo); 1565 1566 trace_binder_transaction_node_to_ref(t, node, ref); 1567 binder_debug(BINDER_DEBUG_TRANSACTION, 1568 " node %d u%016llx -> ref %d desc %d\n", 1569 node->debug_id, (u64)node->ptr, 1570 ref->debug_id, ref->desc); 1571 } break; 1572 case BINDER_TYPE_HANDLE: 1573 case BINDER_TYPE_WEAK_HANDLE: { 1574 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1575 1576 if (ref == NULL) { 1577 binder_user_error("%d:%d got transaction with invalid handle, %d\n", 1578 proc->pid, 1579 thread->pid, fp->handle); 1580 return_error = BR_FAILED_REPLY; 1581 goto err_binder_get_ref_failed; 1582 } 1583 if (ref->node->proc == target_proc) { 1584 if (fp->type == BINDER_TYPE_HANDLE) 1585 fp->type = BINDER_TYPE_BINDER; 1586 else 1587 fp->type = BINDER_TYPE_WEAK_BINDER; 1588 fp->binder = ref->node->ptr; 1589 fp->cookie = ref->node->cookie; 1590 binder_inc_node(ref->node, fp->type == BINDER_TYPE_BINDER, 0, NULL); 1591 trace_binder_transaction_ref_to_node(t, ref); 1592 binder_debug(BINDER_DEBUG_TRANSACTION, 1593 " ref %d desc %d -> node %d u%016llx\n", 1594 ref->debug_id, ref->desc, ref->node->debug_id, 1595 (u64)ref->node->ptr); 1596 } else { 1597 struct binder_ref *new_ref; 1598 1599 new_ref = binder_get_ref_for_node(target_proc, ref->node); 1600 if (new_ref == NULL) { 1601 return_error = BR_FAILED_REPLY; 1602 goto err_binder_get_ref_for_node_failed; 1603 } 1604 fp->handle = new_ref->desc; 1605 binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL); 1606 trace_binder_transaction_ref_to_ref(t, ref, 1607 new_ref); 1608 binder_debug(BINDER_DEBUG_TRANSACTION, 1609 " ref %d desc %d -> ref %d desc %d (node %d)\n", 1610 ref->debug_id, ref->desc, new_ref->debug_id, 1611 new_ref->desc, ref->node->debug_id); 1612 } 1613 } break; 1614 1615 case BINDER_TYPE_FD: { 1616 int target_fd; 1617 struct file *file; 1618 1619 if (reply) { 1620 if (!(in_reply_to->flags & TF_ACCEPT_FDS)) { 1621 binder_user_error("%d:%d got reply with fd, %d, but target does not allow fds\n", 1622 proc->pid, thread->pid, fp->handle); 1623 return_error = BR_FAILED_REPLY; 1624 goto err_fd_not_allowed; 1625 } 1626 } else if (!target_node->accept_fds) { 1627 binder_user_error("%d:%d got transaction with fd, %d, but target does not allow fds\n", 1628 proc->pid, thread->pid, fp->handle); 1629 return_error = BR_FAILED_REPLY; 1630 goto err_fd_not_allowed; 1631 } 1632 1633 file = fget(fp->handle); 1634 if (file == NULL) { 1635 binder_user_error("%d:%d got transaction with invalid fd, %d\n", 1636 proc->pid, thread->pid, fp->handle); 1637 return_error = BR_FAILED_REPLY; 1638 goto err_fget_failed; 1639 } 1640 target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC); 1641 if (target_fd < 0) { 1642 fput(file); 1643 return_error = BR_FAILED_REPLY; 1644 goto err_get_unused_fd_failed; 1645 } 1646 task_fd_install(target_proc, target_fd, file); 1647 trace_binder_transaction_fd(t, fp->handle, target_fd); 1648 binder_debug(BINDER_DEBUG_TRANSACTION, 1649 " fd %d -> %d\n", fp->handle, target_fd); 1650 /* TODO: fput? */ 1651 fp->handle = target_fd; 1652 } break; 1653 1654 default: 1655 binder_user_error("%d:%d got transaction with invalid object type, %x\n", 1656 proc->pid, thread->pid, fp->type); 1657 return_error = BR_FAILED_REPLY; 1658 goto err_bad_object_type; 1659 } 1660 } 1661 if (reply) { 1662 BUG_ON(t->buffer->async_transaction != 0); 1663 binder_pop_transaction(target_thread, in_reply_to); 1664 } else if (!(t->flags & TF_ONE_WAY)) { 1665 BUG_ON(t->buffer->async_transaction != 0); 1666 t->need_reply = 1; 1667 t->from_parent = thread->transaction_stack; 1668 thread->transaction_stack = t; 1669 } else { 1670 BUG_ON(target_node == NULL); 1671 BUG_ON(t->buffer->async_transaction != 1); 1672 if (target_node->has_async_transaction) { 1673 target_list = &target_node->async_todo; 1674 target_wait = NULL; 1675 } else 1676 target_node->has_async_transaction = 1; 1677 } 1678 t->work.type = BINDER_WORK_TRANSACTION; 1679 list_add_tail(&t->work.entry, target_list); 1680 tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE; 1681 list_add_tail(&tcomplete->entry, &thread->todo); 1682 if (target_wait) 1683 wake_up_interruptible(target_wait); 1684 return; 1685 1686err_get_unused_fd_failed: 1687err_fget_failed: 1688err_fd_not_allowed: 1689err_binder_get_ref_for_node_failed: 1690err_binder_get_ref_failed: 1691err_binder_new_node_failed: 1692err_bad_object_type: 1693err_bad_offset: 1694err_copy_data_failed: 1695 trace_binder_transaction_failed_buffer_release(t->buffer); 1696 binder_transaction_buffer_release(target_proc, t->buffer, offp); 1697 t->buffer->transaction = NULL; 1698 binder_free_buf(target_proc, t->buffer); 1699err_binder_alloc_buf_failed: 1700 kfree(tcomplete); 1701 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 1702err_alloc_tcomplete_failed: 1703 kfree(t); 1704 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1705err_alloc_t_failed: 1706err_bad_call_stack: 1707err_empty_call_stack: 1708err_dead_binder: 1709err_invalid_target_handle: 1710err_no_context_mgr_node: 1711 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1712 "%d:%d transaction failed %d, size %lld-%lld\n", 1713 proc->pid, thread->pid, return_error, 1714 (u64)tr->data_size, (u64)tr->offsets_size); 1715 1716 { 1717 struct binder_transaction_log_entry *fe; 1718 1719 fe = binder_transaction_log_add(&binder_transaction_log_failed); 1720 *fe = *e; 1721 } 1722 1723 BUG_ON(thread->return_error != BR_OK); 1724 if (in_reply_to) { 1725 thread->return_error = BR_TRANSACTION_COMPLETE; 1726 binder_send_failed_reply(in_reply_to, return_error); 1727 } else 1728 thread->return_error = return_error; 1729} 1730 1731static int binder_thread_write(struct binder_proc *proc, 1732 struct binder_thread *thread, 1733 binder_uintptr_t binder_buffer, size_t size, 1734 binder_size_t *consumed) 1735{ 1736 uint32_t cmd; 1737 void __user *buffer = (void __user *)(uintptr_t)binder_buffer; 1738 void __user *ptr = buffer + *consumed; 1739 void __user *end = buffer + size; 1740 1741 while (ptr < end && thread->return_error == BR_OK) { 1742 if (get_user(cmd, (uint32_t __user *)ptr)) 1743 return -EFAULT; 1744 ptr += sizeof(uint32_t); 1745 trace_binder_command(cmd); 1746 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) { 1747 binder_stats.bc[_IOC_NR(cmd)]++; 1748 proc->stats.bc[_IOC_NR(cmd)]++; 1749 thread->stats.bc[_IOC_NR(cmd)]++; 1750 } 1751 switch (cmd) { 1752 case BC_INCREFS: 1753 case BC_ACQUIRE: 1754 case BC_RELEASE: 1755 case BC_DECREFS: { 1756 uint32_t target; 1757 struct binder_ref *ref; 1758 const char *debug_string; 1759 1760 if (get_user(target, (uint32_t __user *)ptr)) 1761 return -EFAULT; 1762 ptr += sizeof(uint32_t); 1763 if (target == 0 && binder_context_mgr_node && 1764 (cmd == BC_INCREFS || cmd == BC_ACQUIRE)) { 1765 ref = binder_get_ref_for_node(proc, 1766 binder_context_mgr_node); 1767 if (ref->desc != target) { 1768 binder_user_error("%d:%d tried to acquire reference to desc 0, got %d instead\n", 1769 proc->pid, thread->pid, 1770 ref->desc); 1771 } 1772 } else 1773 ref = binder_get_ref(proc, target); 1774 if (ref == NULL) { 1775 binder_user_error("%d:%d refcount change on invalid ref %d\n", 1776 proc->pid, thread->pid, target); 1777 break; 1778 } 1779 switch (cmd) { 1780 case BC_INCREFS: 1781 debug_string = "IncRefs"; 1782 binder_inc_ref(ref, 0, NULL); 1783 break; 1784 case BC_ACQUIRE: 1785 debug_string = "Acquire"; 1786 binder_inc_ref(ref, 1, NULL); 1787 break; 1788 case BC_RELEASE: 1789 debug_string = "Release"; 1790 binder_dec_ref(ref, 1); 1791 break; 1792 case BC_DECREFS: 1793 default: 1794 debug_string = "DecRefs"; 1795 binder_dec_ref(ref, 0); 1796 break; 1797 } 1798 binder_debug(BINDER_DEBUG_USER_REFS, 1799 "%d:%d %s ref %d desc %d s %d w %d for node %d\n", 1800 proc->pid, thread->pid, debug_string, ref->debug_id, 1801 ref->desc, ref->strong, ref->weak, ref->node->debug_id); 1802 break; 1803 } 1804 case BC_INCREFS_DONE: 1805 case BC_ACQUIRE_DONE: { 1806 binder_uintptr_t node_ptr; 1807 binder_uintptr_t cookie; 1808 struct binder_node *node; 1809 1810 if (get_user(node_ptr, (binder_uintptr_t __user *)ptr)) 1811 return -EFAULT; 1812 ptr += sizeof(binder_uintptr_t); 1813 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 1814 return -EFAULT; 1815 ptr += sizeof(binder_uintptr_t); 1816 node = binder_get_node(proc, node_ptr); 1817 if (node == NULL) { 1818 binder_user_error("%d:%d %s u%016llx no match\n", 1819 proc->pid, thread->pid, 1820 cmd == BC_INCREFS_DONE ? 1821 "BC_INCREFS_DONE" : 1822 "BC_ACQUIRE_DONE", 1823 (u64)node_ptr); 1824 break; 1825 } 1826 if (cookie != node->cookie) { 1827 binder_user_error("%d:%d %s u%016llx node %d cookie mismatch %016llx != %016llx\n", 1828 proc->pid, thread->pid, 1829 cmd == BC_INCREFS_DONE ? 1830 "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1831 (u64)node_ptr, node->debug_id, 1832 (u64)cookie, (u64)node->cookie); 1833 break; 1834 } 1835 if (cmd == BC_ACQUIRE_DONE) { 1836 if (node->pending_strong_ref == 0) { 1837 binder_user_error("%d:%d BC_ACQUIRE_DONE node %d has no pending acquire request\n", 1838 proc->pid, thread->pid, 1839 node->debug_id); 1840 break; 1841 } 1842 node->pending_strong_ref = 0; 1843 } else { 1844 if (node->pending_weak_ref == 0) { 1845 binder_user_error("%d:%d BC_INCREFS_DONE node %d has no pending increfs request\n", 1846 proc->pid, thread->pid, 1847 node->debug_id); 1848 break; 1849 } 1850 node->pending_weak_ref = 0; 1851 } 1852 binder_dec_node(node, cmd == BC_ACQUIRE_DONE, 0); 1853 binder_debug(BINDER_DEBUG_USER_REFS, 1854 "%d:%d %s node %d ls %d lw %d\n", 1855 proc->pid, thread->pid, 1856 cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1857 node->debug_id, node->local_strong_refs, node->local_weak_refs); 1858 break; 1859 } 1860 case BC_ATTEMPT_ACQUIRE: 1861 pr_err("BC_ATTEMPT_ACQUIRE not supported\n"); 1862 return -EINVAL; 1863 case BC_ACQUIRE_RESULT: 1864 pr_err("BC_ACQUIRE_RESULT not supported\n"); 1865 return -EINVAL; 1866 1867 case BC_FREE_BUFFER: { 1868 binder_uintptr_t data_ptr; 1869 struct binder_buffer *buffer; 1870 1871 if (get_user(data_ptr, (binder_uintptr_t __user *)ptr)) 1872 return -EFAULT; 1873 ptr += sizeof(binder_uintptr_t); 1874 1875 buffer = binder_buffer_lookup(proc, data_ptr); 1876 if (buffer == NULL) { 1877 binder_user_error("%d:%d BC_FREE_BUFFER u%016llx no match\n", 1878 proc->pid, thread->pid, (u64)data_ptr); 1879 break; 1880 } 1881 if (!buffer->allow_user_free) { 1882 binder_user_error("%d:%d BC_FREE_BUFFER u%016llx matched unreturned buffer\n", 1883 proc->pid, thread->pid, (u64)data_ptr); 1884 break; 1885 } 1886 binder_debug(BINDER_DEBUG_FREE_BUFFER, 1887 "%d:%d BC_FREE_BUFFER u%016llx found buffer %d for %s transaction\n", 1888 proc->pid, thread->pid, (u64)data_ptr, 1889 buffer->debug_id, 1890 buffer->transaction ? "active" : "finished"); 1891 1892 if (buffer->transaction) { 1893 buffer->transaction->buffer = NULL; 1894 buffer->transaction = NULL; 1895 } 1896 if (buffer->async_transaction && buffer->target_node) { 1897 BUG_ON(!buffer->target_node->has_async_transaction); 1898 if (list_empty(&buffer->target_node->async_todo)) 1899 buffer->target_node->has_async_transaction = 0; 1900 else 1901 list_move_tail(buffer->target_node->async_todo.next, &thread->todo); 1902 } 1903 trace_binder_transaction_buffer_release(buffer); 1904 binder_transaction_buffer_release(proc, buffer, NULL); 1905 binder_free_buf(proc, buffer); 1906 break; 1907 } 1908 1909 case BC_TRANSACTION: 1910 case BC_REPLY: { 1911 struct binder_transaction_data tr; 1912 1913 if (copy_from_user(&tr, ptr, sizeof(tr))) 1914 return -EFAULT; 1915 ptr += sizeof(tr); 1916 binder_transaction(proc, thread, &tr, cmd == BC_REPLY); 1917 break; 1918 } 1919 1920 case BC_REGISTER_LOOPER: 1921 binder_debug(BINDER_DEBUG_THREADS, 1922 "%d:%d BC_REGISTER_LOOPER\n", 1923 proc->pid, thread->pid); 1924 if (thread->looper & BINDER_LOOPER_STATE_ENTERED) { 1925 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1926 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER\n", 1927 proc->pid, thread->pid); 1928 } else if (proc->requested_threads == 0) { 1929 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1930 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called without request\n", 1931 proc->pid, thread->pid); 1932 } else { 1933 proc->requested_threads--; 1934 proc->requested_threads_started++; 1935 } 1936 thread->looper |= BINDER_LOOPER_STATE_REGISTERED; 1937 break; 1938 case BC_ENTER_LOOPER: 1939 binder_debug(BINDER_DEBUG_THREADS, 1940 "%d:%d BC_ENTER_LOOPER\n", 1941 proc->pid, thread->pid); 1942 if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) { 1943 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1944 binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n", 1945 proc->pid, thread->pid); 1946 } 1947 thread->looper |= BINDER_LOOPER_STATE_ENTERED; 1948 break; 1949 case BC_EXIT_LOOPER: 1950 binder_debug(BINDER_DEBUG_THREADS, 1951 "%d:%d BC_EXIT_LOOPER\n", 1952 proc->pid, thread->pid); 1953 thread->looper |= BINDER_LOOPER_STATE_EXITED; 1954 break; 1955 1956 case BC_REQUEST_DEATH_NOTIFICATION: 1957 case BC_CLEAR_DEATH_NOTIFICATION: { 1958 uint32_t target; 1959 binder_uintptr_t cookie; 1960 struct binder_ref *ref; 1961 struct binder_ref_death *death; 1962 1963 if (get_user(target, (uint32_t __user *)ptr)) 1964 return -EFAULT; 1965 ptr += sizeof(uint32_t); 1966 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 1967 return -EFAULT; 1968 ptr += sizeof(binder_uintptr_t); 1969 ref = binder_get_ref(proc, target); 1970 if (ref == NULL) { 1971 binder_user_error("%d:%d %s invalid ref %d\n", 1972 proc->pid, thread->pid, 1973 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 1974 "BC_REQUEST_DEATH_NOTIFICATION" : 1975 "BC_CLEAR_DEATH_NOTIFICATION", 1976 target); 1977 break; 1978 } 1979 1980 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 1981 "%d:%d %s %016llx ref %d desc %d s %d w %d for node %d\n", 1982 proc->pid, thread->pid, 1983 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 1984 "BC_REQUEST_DEATH_NOTIFICATION" : 1985 "BC_CLEAR_DEATH_NOTIFICATION", 1986 (u64)cookie, ref->debug_id, ref->desc, 1987 ref->strong, ref->weak, ref->node->debug_id); 1988 1989 if (cmd == BC_REQUEST_DEATH_NOTIFICATION) { 1990 if (ref->death) { 1991 binder_user_error("%d:%d BC_REQUEST_DEATH_NOTIFICATION death notification already set\n", 1992 proc->pid, thread->pid); 1993 break; 1994 } 1995 death = kzalloc(sizeof(*death), GFP_KERNEL); 1996 if (death == NULL) { 1997 thread->return_error = BR_ERROR; 1998 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1999 "%d:%d BC_REQUEST_DEATH_NOTIFICATION failed\n", 2000 proc->pid, thread->pid); 2001 break; 2002 } 2003 binder_stats_created(BINDER_STAT_DEATH); 2004 INIT_LIST_HEAD(&death->work.entry); 2005 death->cookie = cookie; 2006 ref->death = death; 2007 if (ref->node->proc == NULL) { 2008 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 2009 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2010 list_add_tail(&ref->death->work.entry, &thread->todo); 2011 } else { 2012 list_add_tail(&ref->death->work.entry, &proc->todo); 2013 wake_up_interruptible(&proc->wait); 2014 } 2015 } 2016 } else { 2017 if (ref->death == NULL) { 2018 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification not active\n", 2019 proc->pid, thread->pid); 2020 break; 2021 } 2022 death = ref->death; 2023 if (death->cookie != cookie) { 2024 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch %016llx != %016llx\n", 2025 proc->pid, thread->pid, 2026 (u64)death->cookie, 2027 (u64)cookie); 2028 break; 2029 } 2030 ref->death = NULL; 2031 if (list_empty(&death->work.entry)) { 2032 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2033 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2034 list_add_tail(&death->work.entry, &thread->todo); 2035 } else { 2036 list_add_tail(&death->work.entry, &proc->todo); 2037 wake_up_interruptible(&proc->wait); 2038 } 2039 } else { 2040 BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER); 2041 death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR; 2042 } 2043 } 2044 } break; 2045 case BC_DEAD_BINDER_DONE: { 2046 struct binder_work *w; 2047 binder_uintptr_t cookie; 2048 struct binder_ref_death *death = NULL; 2049 2050 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 2051 return -EFAULT; 2052 2053 ptr += sizeof(void *); 2054 list_for_each_entry(w, &proc->delivered_death, entry) { 2055 struct binder_ref_death *tmp_death = container_of(w, struct binder_ref_death, work); 2056 2057 if (tmp_death->cookie == cookie) { 2058 death = tmp_death; 2059 break; 2060 } 2061 } 2062 binder_debug(BINDER_DEBUG_DEAD_BINDER, 2063 "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n", 2064 proc->pid, thread->pid, (u64)cookie, 2065 death); 2066 if (death == NULL) { 2067 binder_user_error("%d:%d BC_DEAD_BINDER_DONE %016llx not found\n", 2068 proc->pid, thread->pid, (u64)cookie); 2069 break; 2070 } 2071 2072 list_del_init(&death->work.entry); 2073 if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) { 2074 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2075 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2076 list_add_tail(&death->work.entry, &thread->todo); 2077 } else { 2078 list_add_tail(&death->work.entry, &proc->todo); 2079 wake_up_interruptible(&proc->wait); 2080 } 2081 } 2082 } break; 2083 2084 default: 2085 pr_err("%d:%d unknown command %d\n", 2086 proc->pid, thread->pid, cmd); 2087 return -EINVAL; 2088 } 2089 *consumed = ptr - buffer; 2090 } 2091 return 0; 2092} 2093 2094static void binder_stat_br(struct binder_proc *proc, 2095 struct binder_thread *thread, uint32_t cmd) 2096{ 2097 trace_binder_return(cmd); 2098 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) { 2099 binder_stats.br[_IOC_NR(cmd)]++; 2100 proc->stats.br[_IOC_NR(cmd)]++; 2101 thread->stats.br[_IOC_NR(cmd)]++; 2102 } 2103} 2104 2105static int binder_has_proc_work(struct binder_proc *proc, 2106 struct binder_thread *thread) 2107{ 2108 return !list_empty(&proc->todo) || 2109 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2110} 2111 2112static int binder_has_thread_work(struct binder_thread *thread) 2113{ 2114 return !list_empty(&thread->todo) || thread->return_error != BR_OK || 2115 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2116} 2117 2118static int binder_thread_read(struct binder_proc *proc, 2119 struct binder_thread *thread, 2120 binder_uintptr_t binder_buffer, size_t size, 2121 binder_size_t *consumed, int non_block) 2122{ 2123 void __user *buffer = (void __user *)(uintptr_t)binder_buffer; 2124 void __user *ptr = buffer + *consumed; 2125 void __user *end = buffer + size; 2126 2127 int ret = 0; 2128 int wait_for_proc_work; 2129 2130 if (*consumed == 0) { 2131 if (put_user(BR_NOOP, (uint32_t __user *)ptr)) 2132 return -EFAULT; 2133 ptr += sizeof(uint32_t); 2134 } 2135 2136retry: 2137 wait_for_proc_work = thread->transaction_stack == NULL && 2138 list_empty(&thread->todo); 2139 2140 if (thread->return_error != BR_OK && ptr < end) { 2141 if (thread->return_error2 != BR_OK) { 2142 if (put_user(thread->return_error2, (uint32_t __user *)ptr)) 2143 return -EFAULT; 2144 ptr += sizeof(uint32_t); 2145 binder_stat_br(proc, thread, thread->return_error2); 2146 if (ptr == end) 2147 goto done; 2148 thread->return_error2 = BR_OK; 2149 } 2150 if (put_user(thread->return_error, (uint32_t __user *)ptr)) 2151 return -EFAULT; 2152 ptr += sizeof(uint32_t); 2153 binder_stat_br(proc, thread, thread->return_error); 2154 thread->return_error = BR_OK; 2155 goto done; 2156 } 2157 2158 2159 thread->looper |= BINDER_LOOPER_STATE_WAITING; 2160 if (wait_for_proc_work) 2161 proc->ready_threads++; 2162 2163 binder_unlock(__func__); 2164 2165 trace_binder_wait_for_work(wait_for_proc_work, 2166 !!thread->transaction_stack, 2167 !list_empty(&thread->todo)); 2168 if (wait_for_proc_work) { 2169 if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2170 BINDER_LOOPER_STATE_ENTERED))) { 2171 binder_user_error("%d:%d ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state %x)\n", 2172 proc->pid, thread->pid, thread->looper); 2173 wait_event_interruptible(binder_user_error_wait, 2174 binder_stop_on_user_error < 2); 2175 } 2176 binder_set_nice(proc->default_priority); 2177 if (non_block) { 2178 if (!binder_has_proc_work(proc, thread)) 2179 ret = -EAGAIN; 2180 } else 2181 ret = wait_event_freezable_exclusive(proc->wait, binder_has_proc_work(proc, thread)); 2182 } else { 2183 if (non_block) { 2184 if (!binder_has_thread_work(thread)) 2185 ret = -EAGAIN; 2186 } else 2187 ret = wait_event_freezable(thread->wait, binder_has_thread_work(thread)); 2188 } 2189 2190 binder_lock(__func__); 2191 2192 if (wait_for_proc_work) 2193 proc->ready_threads--; 2194 thread->looper &= ~BINDER_LOOPER_STATE_WAITING; 2195 2196 if (ret) 2197 return ret; 2198 2199 while (1) { 2200 uint32_t cmd; 2201 struct binder_transaction_data tr; 2202 struct binder_work *w; 2203 struct binder_transaction *t = NULL; 2204 2205 if (!list_empty(&thread->todo)) 2206 w = list_first_entry(&thread->todo, struct binder_work, entry); 2207 else if (!list_empty(&proc->todo) && wait_for_proc_work) 2208 w = list_first_entry(&proc->todo, struct binder_work, entry); 2209 else { 2210 if (ptr - buffer == 4 && !(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN)) /* no data added */ 2211 goto retry; 2212 break; 2213 } 2214 2215 if (end - ptr < sizeof(tr) + 4) 2216 break; 2217 2218 switch (w->type) { 2219 case BINDER_WORK_TRANSACTION: { 2220 t = container_of(w, struct binder_transaction, work); 2221 } break; 2222 case BINDER_WORK_TRANSACTION_COMPLETE: { 2223 cmd = BR_TRANSACTION_COMPLETE; 2224 if (put_user(cmd, (uint32_t __user *)ptr)) 2225 return -EFAULT; 2226 ptr += sizeof(uint32_t); 2227 2228 binder_stat_br(proc, thread, cmd); 2229 binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE, 2230 "%d:%d BR_TRANSACTION_COMPLETE\n", 2231 proc->pid, thread->pid); 2232 2233 list_del(&w->entry); 2234 kfree(w); 2235 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2236 } break; 2237 case BINDER_WORK_NODE: { 2238 struct binder_node *node = container_of(w, struct binder_node, work); 2239 uint32_t cmd = BR_NOOP; 2240 const char *cmd_name; 2241 int strong = node->internal_strong_refs || node->local_strong_refs; 2242 int weak = !hlist_empty(&node->refs) || node->local_weak_refs || strong; 2243 2244 if (weak && !node->has_weak_ref) { 2245 cmd = BR_INCREFS; 2246 cmd_name = "BR_INCREFS"; 2247 node->has_weak_ref = 1; 2248 node->pending_weak_ref = 1; 2249 node->local_weak_refs++; 2250 } else if (strong && !node->has_strong_ref) { 2251 cmd = BR_ACQUIRE; 2252 cmd_name = "BR_ACQUIRE"; 2253 node->has_strong_ref = 1; 2254 node->pending_strong_ref = 1; 2255 node->local_strong_refs++; 2256 } else if (!strong && node->has_strong_ref) { 2257 cmd = BR_RELEASE; 2258 cmd_name = "BR_RELEASE"; 2259 node->has_strong_ref = 0; 2260 } else if (!weak && node->has_weak_ref) { 2261 cmd = BR_DECREFS; 2262 cmd_name = "BR_DECREFS"; 2263 node->has_weak_ref = 0; 2264 } 2265 if (cmd != BR_NOOP) { 2266 if (put_user(cmd, (uint32_t __user *)ptr)) 2267 return -EFAULT; 2268 ptr += sizeof(uint32_t); 2269 if (put_user(node->ptr, 2270 (binder_uintptr_t __user *)ptr)) 2271 return -EFAULT; 2272 ptr += sizeof(binder_uintptr_t); 2273 if (put_user(node->cookie, 2274 (binder_uintptr_t __user *)ptr)) 2275 return -EFAULT; 2276 ptr += sizeof(binder_uintptr_t); 2277 2278 binder_stat_br(proc, thread, cmd); 2279 binder_debug(BINDER_DEBUG_USER_REFS, 2280 "%d:%d %s %d u%016llx c%016llx\n", 2281 proc->pid, thread->pid, cmd_name, 2282 node->debug_id, 2283 (u64)node->ptr, (u64)node->cookie); 2284 } else { 2285 list_del_init(&w->entry); 2286 if (!weak && !strong) { 2287 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2288 "%d:%d node %d u%016llx c%016llx deleted\n", 2289 proc->pid, thread->pid, 2290 node->debug_id, 2291 (u64)node->ptr, 2292 (u64)node->cookie); 2293 rb_erase(&node->rb_node, &proc->nodes); 2294 kfree(node); 2295 binder_stats_deleted(BINDER_STAT_NODE); 2296 } else { 2297 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2298 "%d:%d node %d u%016llx c%016llx state unchanged\n", 2299 proc->pid, thread->pid, 2300 node->debug_id, 2301 (u64)node->ptr, 2302 (u64)node->cookie); 2303 } 2304 } 2305 } break; 2306 case BINDER_WORK_DEAD_BINDER: 2307 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 2308 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 2309 struct binder_ref_death *death; 2310 uint32_t cmd; 2311 2312 death = container_of(w, struct binder_ref_death, work); 2313 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) 2314 cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE; 2315 else 2316 cmd = BR_DEAD_BINDER; 2317 if (put_user(cmd, (uint32_t __user *)ptr)) 2318 return -EFAULT; 2319 ptr += sizeof(uint32_t); 2320 if (put_user(death->cookie, 2321 (binder_uintptr_t __user *)ptr)) 2322 return -EFAULT; 2323 ptr += sizeof(binder_uintptr_t); 2324 binder_stat_br(proc, thread, cmd); 2325 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 2326 "%d:%d %s %016llx\n", 2327 proc->pid, thread->pid, 2328 cmd == BR_DEAD_BINDER ? 2329 "BR_DEAD_BINDER" : 2330 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 2331 (u64)death->cookie); 2332 2333 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) { 2334 list_del(&w->entry); 2335 kfree(death); 2336 binder_stats_deleted(BINDER_STAT_DEATH); 2337 } else 2338 list_move(&w->entry, &proc->delivered_death); 2339 if (cmd == BR_DEAD_BINDER) 2340 goto done; /* DEAD_BINDER notifications can cause transactions */ 2341 } break; 2342 } 2343 2344 if (!t) 2345 continue; 2346 2347 BUG_ON(t->buffer == NULL); 2348 if (t->buffer->target_node) { 2349 struct binder_node *target_node = t->buffer->target_node; 2350 2351 tr.target.ptr = target_node->ptr; 2352 tr.cookie = target_node->cookie; 2353 t->saved_priority = task_nice(current); 2354 if (t->priority < target_node->min_priority && 2355 !(t->flags & TF_ONE_WAY)) 2356 binder_set_nice(t->priority); 2357 else if (!(t->flags & TF_ONE_WAY) || 2358 t->saved_priority > target_node->min_priority) 2359 binder_set_nice(target_node->min_priority); 2360 cmd = BR_TRANSACTION; 2361 } else { 2362 tr.target.ptr = 0; 2363 tr.cookie = 0; 2364 cmd = BR_REPLY; 2365 } 2366 tr.code = t->code; 2367 tr.flags = t->flags; 2368 tr.sender_euid = from_kuid(current_user_ns(), t->sender_euid); 2369 2370 if (t->from) { 2371 struct task_struct *sender = t->from->proc->tsk; 2372 2373 tr.sender_pid = task_tgid_nr_ns(sender, 2374 task_active_pid_ns(current)); 2375 } else { 2376 tr.sender_pid = 0; 2377 } 2378 2379 tr.data_size = t->buffer->data_size; 2380 tr.offsets_size = t->buffer->offsets_size; 2381 tr.data.ptr.buffer = (binder_uintptr_t)( 2382 (uintptr_t)t->buffer->data + 2383 proc->user_buffer_offset); 2384 tr.data.ptr.offsets = tr.data.ptr.buffer + 2385 ALIGN(t->buffer->data_size, 2386 sizeof(void *)); 2387 2388 if (put_user(cmd, (uint32_t __user *)ptr)) 2389 return -EFAULT; 2390 ptr += sizeof(uint32_t); 2391 if (copy_to_user(ptr, &tr, sizeof(tr))) 2392 return -EFAULT; 2393 ptr += sizeof(tr); 2394 2395 trace_binder_transaction_received(t); 2396 binder_stat_br(proc, thread, cmd); 2397 binder_debug(BINDER_DEBUG_TRANSACTION, 2398 "%d:%d %s %d %d:%d, cmd %d size %zd-%zd ptr %016llx-%016llx\n", 2399 proc->pid, thread->pid, 2400 (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" : 2401 "BR_REPLY", 2402 t->debug_id, t->from ? t->from->proc->pid : 0, 2403 t->from ? t->from->pid : 0, cmd, 2404 t->buffer->data_size, t->buffer->offsets_size, 2405 (u64)tr.data.ptr.buffer, (u64)tr.data.ptr.offsets); 2406 2407 list_del(&t->work.entry); 2408 t->buffer->allow_user_free = 1; 2409 if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) { 2410 t->to_parent = thread->transaction_stack; 2411 t->to_thread = thread; 2412 thread->transaction_stack = t; 2413 } else { 2414 t->buffer->transaction = NULL; 2415 kfree(t); 2416 binder_stats_deleted(BINDER_STAT_TRANSACTION); 2417 } 2418 break; 2419 } 2420 2421done: 2422 2423 *consumed = ptr - buffer; 2424 if (proc->requested_threads + proc->ready_threads == 0 && 2425 proc->requested_threads_started < proc->max_threads && 2426 (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2427 BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */ 2428 /*spawn a new thread if we leave this out */) { 2429 proc->requested_threads++; 2430 binder_debug(BINDER_DEBUG_THREADS, 2431 "%d:%d BR_SPAWN_LOOPER\n", 2432 proc->pid, thread->pid); 2433 if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer)) 2434 return -EFAULT; 2435 binder_stat_br(proc, thread, BR_SPAWN_LOOPER); 2436 } 2437 return 0; 2438} 2439 2440static void binder_release_work(struct list_head *list) 2441{ 2442 struct binder_work *w; 2443 2444 while (!list_empty(list)) { 2445 w = list_first_entry(list, struct binder_work, entry); 2446 list_del_init(&w->entry); 2447 switch (w->type) { 2448 case BINDER_WORK_TRANSACTION: { 2449 struct binder_transaction *t; 2450 2451 t = container_of(w, struct binder_transaction, work); 2452 if (t->buffer->target_node && 2453 !(t->flags & TF_ONE_WAY)) { 2454 binder_send_failed_reply(t, BR_DEAD_REPLY); 2455 } else { 2456 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2457 "undelivered transaction %d\n", 2458 t->debug_id); 2459 t->buffer->transaction = NULL; 2460 kfree(t); 2461 binder_stats_deleted(BINDER_STAT_TRANSACTION); 2462 } 2463 } break; 2464 case BINDER_WORK_TRANSACTION_COMPLETE: { 2465 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2466 "undelivered TRANSACTION_COMPLETE\n"); 2467 kfree(w); 2468 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2469 } break; 2470 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 2471 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 2472 struct binder_ref_death *death; 2473 2474 death = container_of(w, struct binder_ref_death, work); 2475 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2476 "undelivered death notification, %016llx\n", 2477 (u64)death->cookie); 2478 kfree(death); 2479 binder_stats_deleted(BINDER_STAT_DEATH); 2480 } break; 2481 default: 2482 pr_err("unexpected work type, %d, not freed\n", 2483 w->type); 2484 break; 2485 } 2486 } 2487 2488} 2489 2490static struct binder_thread *binder_get_thread(struct binder_proc *proc) 2491{ 2492 struct binder_thread *thread = NULL; 2493 struct rb_node *parent = NULL; 2494 struct rb_node **p = &proc->threads.rb_node; 2495 2496 while (*p) { 2497 parent = *p; 2498 thread = rb_entry(parent, struct binder_thread, rb_node); 2499 2500 if (current->pid < thread->pid) 2501 p = &(*p)->rb_left; 2502 else if (current->pid > thread->pid) 2503 p = &(*p)->rb_right; 2504 else 2505 break; 2506 } 2507 if (*p == NULL) { 2508 thread = kzalloc(sizeof(*thread), GFP_KERNEL); 2509 if (thread == NULL) 2510 return NULL; 2511 binder_stats_created(BINDER_STAT_THREAD); 2512 thread->proc = proc; 2513 thread->pid = current->pid; 2514 init_waitqueue_head(&thread->wait); 2515 INIT_LIST_HEAD(&thread->todo); 2516 rb_link_node(&thread->rb_node, parent, p); 2517 rb_insert_color(&thread->rb_node, &proc->threads); 2518 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2519 thread->return_error = BR_OK; 2520 thread->return_error2 = BR_OK; 2521 } 2522 return thread; 2523} 2524 2525static int binder_free_thread(struct binder_proc *proc, 2526 struct binder_thread *thread) 2527{ 2528 struct binder_transaction *t; 2529 struct binder_transaction *send_reply = NULL; 2530 int active_transactions = 0; 2531 2532 rb_erase(&thread->rb_node, &proc->threads); 2533 t = thread->transaction_stack; 2534 if (t && t->to_thread == thread) 2535 send_reply = t; 2536 while (t) { 2537 active_transactions++; 2538 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2539 "release %d:%d transaction %d %s, still active\n", 2540 proc->pid, thread->pid, 2541 t->debug_id, 2542 (t->to_thread == thread) ? "in" : "out"); 2543 2544 if (t->to_thread == thread) { 2545 t->to_proc = NULL; 2546 t->to_thread = NULL; 2547 if (t->buffer) { 2548 t->buffer->transaction = NULL; 2549 t->buffer = NULL; 2550 } 2551 t = t->to_parent; 2552 } else if (t->from == thread) { 2553 t->from = NULL; 2554 t = t->from_parent; 2555 } else 2556 BUG(); 2557 } 2558 if (send_reply) 2559 binder_send_failed_reply(send_reply, BR_DEAD_REPLY); 2560 binder_release_work(&thread->todo); 2561 kfree(thread); 2562 binder_stats_deleted(BINDER_STAT_THREAD); 2563 return active_transactions; 2564} 2565 2566static unsigned int binder_poll(struct file *filp, 2567 struct poll_table_struct *wait) 2568{ 2569 struct binder_proc *proc = filp->private_data; 2570 struct binder_thread *thread = NULL; 2571 int wait_for_proc_work; 2572 2573 binder_lock(__func__); 2574 2575 thread = binder_get_thread(proc); 2576 2577 wait_for_proc_work = thread->transaction_stack == NULL && 2578 list_empty(&thread->todo) && thread->return_error == BR_OK; 2579 2580 binder_unlock(__func__); 2581 2582 if (wait_for_proc_work) { 2583 if (binder_has_proc_work(proc, thread)) 2584 return POLLIN; 2585 poll_wait(filp, &proc->wait, wait); 2586 if (binder_has_proc_work(proc, thread)) 2587 return POLLIN; 2588 } else { 2589 if (binder_has_thread_work(thread)) 2590 return POLLIN; 2591 poll_wait(filp, &thread->wait, wait); 2592 if (binder_has_thread_work(thread)) 2593 return POLLIN; 2594 } 2595 return 0; 2596} 2597 2598static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 2599{ 2600 int ret; 2601 struct binder_proc *proc = filp->private_data; 2602 struct binder_thread *thread; 2603 unsigned int size = _IOC_SIZE(cmd); 2604 void __user *ubuf = (void __user *)arg; 2605 const struct cred *cred = current_cred(); 2606 2607 /*pr_info("binder_ioctl: %d:%d %x %lx\n", proc->pid, current->pid, cmd, arg);*/ 2608 2609 trace_binder_ioctl(cmd, arg); 2610 2611 ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2612 if (ret) 2613 goto err_unlocked; 2614 2615 binder_lock(__func__); 2616 thread = binder_get_thread(proc); 2617 if (thread == NULL) { 2618 ret = -ENOMEM; 2619 goto err; 2620 } 2621 2622 switch (cmd) { 2623 case BINDER_WRITE_READ: { 2624 struct binder_write_read bwr; 2625 2626 if (size != sizeof(struct binder_write_read)) { 2627 ret = -EINVAL; 2628 goto err; 2629 } 2630 if (copy_from_user(&bwr, ubuf, sizeof(bwr))) { 2631 ret = -EFAULT; 2632 goto err; 2633 } 2634 binder_debug(BINDER_DEBUG_READ_WRITE, 2635 "%d:%d write %lld at %016llx, read %lld at %016llx\n", 2636 proc->pid, thread->pid, 2637 (u64)bwr.write_size, (u64)bwr.write_buffer, 2638 (u64)bwr.read_size, (u64)bwr.read_buffer); 2639 2640 if (bwr.write_size > 0) { 2641 ret = binder_thread_write(proc, thread, 2642 bwr.write_buffer, 2643 bwr.write_size, 2644 &bwr.write_consumed); 2645 trace_binder_write_done(ret); 2646 if (ret < 0) { 2647 bwr.read_consumed = 0; 2648 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2649 ret = -EFAULT; 2650 goto err; 2651 } 2652 } 2653 if (bwr.read_size > 0) { 2654 ret = binder_thread_read(proc, thread, bwr.read_buffer, 2655 bwr.read_size, 2656 &bwr.read_consumed, 2657 filp->f_flags & O_NONBLOCK); 2658 trace_binder_read_done(ret); 2659 if (!list_empty(&proc->todo)) 2660 wake_up_interruptible(&proc->wait); 2661 if (ret < 0) { 2662 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2663 ret = -EFAULT; 2664 goto err; 2665 } 2666 } 2667 binder_debug(BINDER_DEBUG_READ_WRITE, 2668 "%d:%d wrote %lld of %lld, read return %lld of %lld\n", 2669 proc->pid, thread->pid, 2670 (u64)bwr.write_consumed, (u64)bwr.write_size, 2671 (u64)bwr.read_consumed, (u64)bwr.read_size); 2672 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) { 2673 ret = -EFAULT; 2674 goto err; 2675 } 2676 break; 2677 } 2678 case BINDER_SET_MAX_THREADS: 2679 if (copy_from_user(&proc->max_threads, ubuf, sizeof(proc->max_threads))) { 2680 ret = -EINVAL; 2681 goto err; 2682 } 2683 break; 2684 case BINDER_SET_CONTEXT_MGR: 2685 if (binder_context_mgr_node != NULL) { 2686 pr_err("BINDER_SET_CONTEXT_MGR already set\n"); 2687 ret = -EBUSY; 2688 goto err; 2689 } 2690 if (uid_valid(binder_context_mgr_uid)) { 2691 if (!uid_eq(binder_context_mgr_uid, cred->euid)) { 2692 pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n", 2693 from_kuid(&init_user_ns, cred->euid), 2694 from_kuid(&init_user_ns, binder_context_mgr_uid)); 2695 ret = -EPERM; 2696 goto err; 2697 } 2698 } else 2699 binder_context_mgr_uid = cred->euid; 2700 binder_context_mgr_node = binder_new_node(proc, 0, 0); 2701 if (binder_context_mgr_node == NULL) { 2702 ret = -ENOMEM; 2703 goto err; 2704 } 2705 binder_context_mgr_node->local_weak_refs++; 2706 binder_context_mgr_node->local_strong_refs++; 2707 binder_context_mgr_node->has_strong_ref = 1; 2708 binder_context_mgr_node->has_weak_ref = 1; 2709 break; 2710 case BINDER_THREAD_EXIT: 2711 binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n", 2712 proc->pid, thread->pid); 2713 binder_free_thread(proc, thread); 2714 thread = NULL; 2715 break; 2716 case BINDER_VERSION: { 2717 struct binder_version __user *ver = ubuf; 2718 2719 if (size != sizeof(struct binder_version)) { 2720 ret = -EINVAL; 2721 goto err; 2722 } 2723 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION, 2724 &ver->protocol_version)) { 2725 ret = -EINVAL; 2726 goto err; 2727 } 2728 break; 2729 } 2730 default: 2731 ret = -EINVAL; 2732 goto err; 2733 } 2734 ret = 0; 2735err: 2736 if (thread) 2737 thread->looper &= ~BINDER_LOOPER_STATE_NEED_RETURN; 2738 binder_unlock(__func__); 2739 wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2740 if (ret && ret != -ERESTARTSYS) 2741 pr_info("%d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret); 2742err_unlocked: 2743 trace_binder_ioctl_done(ret); 2744 return ret; 2745} 2746 2747static void binder_vma_open(struct vm_area_struct *vma) 2748{ 2749 struct binder_proc *proc = vma->vm_private_data; 2750 2751 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2752 "%d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2753 proc->pid, vma->vm_start, vma->vm_end, 2754 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2755 (unsigned long)pgprot_val(vma->vm_page_prot)); 2756} 2757 2758static void binder_vma_close(struct vm_area_struct *vma) 2759{ 2760 struct binder_proc *proc = vma->vm_private_data; 2761 2762 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2763 "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2764 proc->pid, vma->vm_start, vma->vm_end, 2765 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2766 (unsigned long)pgprot_val(vma->vm_page_prot)); 2767 proc->vma = NULL; 2768 proc->vma_vm_mm = NULL; 2769 binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES); 2770} 2771 2772static struct vm_operations_struct binder_vm_ops = { 2773 .open = binder_vma_open, 2774 .close = binder_vma_close, 2775}; 2776 2777static int binder_mmap(struct file *filp, struct vm_area_struct *vma) 2778{ 2779 int ret; 2780 struct vm_struct *area; 2781 struct binder_proc *proc = filp->private_data; 2782 const char *failure_string; 2783 struct binder_buffer *buffer; 2784 2785 if (proc->tsk != current) 2786 return -EINVAL; 2787 2788 if ((vma->vm_end - vma->vm_start) > SZ_4M) 2789 vma->vm_end = vma->vm_start + SZ_4M; 2790 2791 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2792 "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n", 2793 proc->pid, vma->vm_start, vma->vm_end, 2794 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2795 (unsigned long)pgprot_val(vma->vm_page_prot)); 2796 2797 if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) { 2798 ret = -EPERM; 2799 failure_string = "bad vm_flags"; 2800 goto err_bad_arg; 2801 } 2802 vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE; 2803 2804 mutex_lock(&binder_mmap_lock); 2805 if (proc->buffer) { 2806 ret = -EBUSY; 2807 failure_string = "already mapped"; 2808 goto err_already_mapped; 2809 } 2810 2811 area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP); 2812 if (area == NULL) { 2813 ret = -ENOMEM; 2814 failure_string = "get_vm_area"; 2815 goto err_get_vm_area_failed; 2816 } 2817 proc->buffer = area->addr; 2818 proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer; 2819 mutex_unlock(&binder_mmap_lock); 2820 2821#ifdef CONFIG_CPU_CACHE_VIPT 2822 if (cache_is_vipt_aliasing()) { 2823 while (CACHE_COLOUR((vma->vm_start ^ (uint32_t)proc->buffer))) { 2824 pr_info("binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer); 2825 vma->vm_start += PAGE_SIZE; 2826 } 2827 } 2828#endif 2829 proc->pages = kzalloc(sizeof(proc->pages[0]) * ((vma->vm_end - vma->vm_start) / PAGE_SIZE), GFP_KERNEL); 2830 if (proc->pages == NULL) { 2831 ret = -ENOMEM; 2832 failure_string = "alloc page array"; 2833 goto err_alloc_pages_failed; 2834 } 2835 proc->buffer_size = vma->vm_end - vma->vm_start; 2836 2837 vma->vm_ops = &binder_vm_ops; 2838 vma->vm_private_data = proc; 2839 2840 if (binder_update_page_range(proc, 1, proc->buffer, proc->buffer + PAGE_SIZE, vma)) { 2841 ret = -ENOMEM; 2842 failure_string = "alloc small buf"; 2843 goto err_alloc_small_buf_failed; 2844 } 2845 buffer = proc->buffer; 2846 INIT_LIST_HEAD(&proc->buffers); 2847 list_add(&buffer->entry, &proc->buffers); 2848 buffer->free = 1; 2849 binder_insert_free_buffer(proc, buffer); 2850 proc->free_async_space = proc->buffer_size / 2; 2851 barrier(); 2852 proc->files = get_files_struct(current); 2853 proc->vma = vma; 2854 proc->vma_vm_mm = vma->vm_mm; 2855 2856 /*pr_info("binder_mmap: %d %lx-%lx maps %p\n", 2857 proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/ 2858 return 0; 2859 2860err_alloc_small_buf_failed: 2861 kfree(proc->pages); 2862 proc->pages = NULL; 2863err_alloc_pages_failed: 2864 mutex_lock(&binder_mmap_lock); 2865 vfree(proc->buffer); 2866 proc->buffer = NULL; 2867err_get_vm_area_failed: 2868err_already_mapped: 2869 mutex_unlock(&binder_mmap_lock); 2870err_bad_arg: 2871 pr_err("binder_mmap: %d %lx-%lx %s failed %d\n", 2872 proc->pid, vma->vm_start, vma->vm_end, failure_string, ret); 2873 return ret; 2874} 2875 2876static int binder_open(struct inode *nodp, struct file *filp) 2877{ 2878 struct binder_proc *proc; 2879 2880 binder_debug(BINDER_DEBUG_OPEN_CLOSE, "binder_open: %d:%d\n", 2881 current->group_leader->pid, current->pid); 2882 2883 proc = kzalloc(sizeof(*proc), GFP_KERNEL); 2884 if (proc == NULL) 2885 return -ENOMEM; 2886 get_task_struct(current); 2887 proc->tsk = current; 2888 INIT_LIST_HEAD(&proc->todo); 2889 init_waitqueue_head(&proc->wait); 2890 proc->default_priority = task_nice(current); 2891 2892 binder_lock(__func__); 2893 2894 binder_stats_created(BINDER_STAT_PROC); 2895 hlist_add_head(&proc->proc_node, &binder_procs); 2896 proc->pid = current->group_leader->pid; 2897 INIT_LIST_HEAD(&proc->delivered_death); 2898 filp->private_data = proc; 2899 2900 binder_unlock(__func__); 2901 2902 if (binder_debugfs_dir_entry_proc) { 2903 char strbuf[11]; 2904 2905 snprintf(strbuf, sizeof(strbuf), "%u", proc->pid); 2906 proc->debugfs_entry = debugfs_create_file(strbuf, S_IRUGO, 2907 binder_debugfs_dir_entry_proc, proc, &binder_proc_fops); 2908 } 2909 2910 return 0; 2911} 2912 2913static int binder_flush(struct file *filp, fl_owner_t id) 2914{ 2915 struct binder_proc *proc = filp->private_data; 2916 2917 binder_defer_work(proc, BINDER_DEFERRED_FLUSH); 2918 2919 return 0; 2920} 2921 2922static void binder_deferred_flush(struct binder_proc *proc) 2923{ 2924 struct rb_node *n; 2925 int wake_count = 0; 2926 2927 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) { 2928 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node); 2929 2930 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2931 if (thread->looper & BINDER_LOOPER_STATE_WAITING) { 2932 wake_up_interruptible(&thread->wait); 2933 wake_count++; 2934 } 2935 } 2936 wake_up_interruptible_all(&proc->wait); 2937 2938 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2939 "binder_flush: %d woke %d threads\n", proc->pid, 2940 wake_count); 2941} 2942 2943static int binder_release(struct inode *nodp, struct file *filp) 2944{ 2945 struct binder_proc *proc = filp->private_data; 2946 2947 debugfs_remove(proc->debugfs_entry); 2948 binder_defer_work(proc, BINDER_DEFERRED_RELEASE); 2949 2950 return 0; 2951} 2952 2953static int binder_node_release(struct binder_node *node, int refs) 2954{ 2955 struct binder_ref *ref; 2956 int death = 0; 2957 2958 list_del_init(&node->work.entry); 2959 binder_release_work(&node->async_todo); 2960 2961 if (hlist_empty(&node->refs)) { 2962 kfree(node); 2963 binder_stats_deleted(BINDER_STAT_NODE); 2964 2965 return refs; 2966 } 2967 2968 node->proc = NULL; 2969 node->local_strong_refs = 0; 2970 node->local_weak_refs = 0; 2971 hlist_add_head(&node->dead_node, &binder_dead_nodes); 2972 2973 hlist_for_each_entry(ref, &node->refs, node_entry) { 2974 refs++; 2975 2976 if (!ref->death) 2977 continue; 2978 2979 death++; 2980 2981 if (list_empty(&ref->death->work.entry)) { 2982 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 2983 list_add_tail(&ref->death->work.entry, 2984 &ref->proc->todo); 2985 wake_up_interruptible(&ref->proc->wait); 2986 } else 2987 BUG(); 2988 } 2989 2990 binder_debug(BINDER_DEBUG_DEAD_BINDER, 2991 "node %d now dead, refs %d, death %d\n", 2992 node->debug_id, refs, death); 2993 2994 return refs; 2995} 2996 2997static void binder_deferred_release(struct binder_proc *proc) 2998{ 2999 struct binder_transaction *t; 3000 struct rb_node *n; 3001 int threads, nodes, incoming_refs, outgoing_refs, buffers, 3002 active_transactions, page_count; 3003 3004 BUG_ON(proc->vma); 3005 BUG_ON(proc->files); 3006 3007 hlist_del(&proc->proc_node); 3008 3009 if (binder_context_mgr_node && binder_context_mgr_node->proc == proc) { 3010 binder_debug(BINDER_DEBUG_DEAD_BINDER, 3011 "%s: %d context_mgr_node gone\n", 3012 __func__, proc->pid); 3013 binder_context_mgr_node = NULL; 3014 } 3015 3016 threads = 0; 3017 active_transactions = 0; 3018 while ((n = rb_first(&proc->threads))) { 3019 struct binder_thread *thread; 3020 3021 thread = rb_entry(n, struct binder_thread, rb_node); 3022 threads++; 3023 active_transactions += binder_free_thread(proc, thread); 3024 } 3025 3026 nodes = 0; 3027 incoming_refs = 0; 3028 while ((n = rb_first(&proc->nodes))) { 3029 struct binder_node *node; 3030 3031 node = rb_entry(n, struct binder_node, rb_node); 3032 nodes++; 3033 rb_erase(&node->rb_node, &proc->nodes); 3034 incoming_refs = binder_node_release(node, incoming_refs); 3035 } 3036 3037 outgoing_refs = 0; 3038 while ((n = rb_first(&proc->refs_by_desc))) { 3039 struct binder_ref *ref; 3040 3041 ref = rb_entry(n, struct binder_ref, rb_node_desc); 3042 outgoing_refs++; 3043 binder_delete_ref(ref); 3044 } 3045 3046 binder_release_work(&proc->todo); 3047 binder_release_work(&proc->delivered_death); 3048 3049 buffers = 0; 3050 while ((n = rb_first(&proc->allocated_buffers))) { 3051 struct binder_buffer *buffer; 3052 3053 buffer = rb_entry(n, struct binder_buffer, rb_node); 3054 3055 t = buffer->transaction; 3056 if (t) { 3057 t->buffer = NULL; 3058 buffer->transaction = NULL; 3059 pr_err("release proc %d, transaction %d, not freed\n", 3060 proc->pid, t->debug_id); 3061 /*BUG();*/ 3062 } 3063 3064 binder_free_buf(proc, buffer); 3065 buffers++; 3066 } 3067 3068 binder_stats_deleted(BINDER_STAT_PROC); 3069 3070 page_count = 0; 3071 if (proc->pages) { 3072 int i; 3073 3074 for (i = 0; i < proc->buffer_size / PAGE_SIZE; i++) { 3075 void *page_addr; 3076 3077 if (!proc->pages[i]) 3078 continue; 3079 3080 page_addr = proc->buffer + i * PAGE_SIZE; 3081 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 3082 "%s: %d: page %d at %p not freed\n", 3083 __func__, proc->pid, i, page_addr); 3084 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE); 3085 __free_page(proc->pages[i]); 3086 page_count++; 3087 } 3088 kfree(proc->pages); 3089 vfree(proc->buffer); 3090 } 3091 3092 put_task_struct(proc->tsk); 3093 3094 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 3095 "%s: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d, buffers %d, pages %d\n", 3096 __func__, proc->pid, threads, nodes, incoming_refs, 3097 outgoing_refs, active_transactions, buffers, page_count); 3098 3099 kfree(proc); 3100} 3101 3102static void binder_deferred_func(struct work_struct *work) 3103{ 3104 struct binder_proc *proc; 3105 struct files_struct *files; 3106 3107 int defer; 3108 3109 do { 3110 binder_lock(__func__); 3111 mutex_lock(&binder_deferred_lock); 3112 if (!hlist_empty(&binder_deferred_list)) { 3113 proc = hlist_entry(binder_deferred_list.first, 3114 struct binder_proc, deferred_work_node); 3115 hlist_del_init(&proc->deferred_work_node); 3116 defer = proc->deferred_work; 3117 proc->deferred_work = 0; 3118 } else { 3119 proc = NULL; 3120 defer = 0; 3121 } 3122 mutex_unlock(&binder_deferred_lock); 3123 3124 files = NULL; 3125 if (defer & BINDER_DEFERRED_PUT_FILES) { 3126 files = proc->files; 3127 if (files) 3128 proc->files = NULL; 3129 } 3130 3131 if (defer & BINDER_DEFERRED_FLUSH) 3132 binder_deferred_flush(proc); 3133 3134 if (defer & BINDER_DEFERRED_RELEASE) 3135 binder_deferred_release(proc); /* frees proc */ 3136 3137 binder_unlock(__func__); 3138 if (files) 3139 put_files_struct(files); 3140 } while (proc); 3141} 3142static DECLARE_WORK(binder_deferred_work, binder_deferred_func); 3143 3144static void 3145binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer) 3146{ 3147 mutex_lock(&binder_deferred_lock); 3148 proc->deferred_work |= defer; 3149 if (hlist_unhashed(&proc->deferred_work_node)) { 3150 hlist_add_head(&proc->deferred_work_node, 3151 &binder_deferred_list); 3152 queue_work(binder_deferred_workqueue, &binder_deferred_work); 3153 } 3154 mutex_unlock(&binder_deferred_lock); 3155} 3156 3157static void print_binder_transaction(struct seq_file *m, const char *prefix, 3158 struct binder_transaction *t) 3159{ 3160 seq_printf(m, 3161 "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d", 3162 prefix, t->debug_id, t, 3163 t->from ? t->from->proc->pid : 0, 3164 t->from ? t->from->pid : 0, 3165 t->to_proc ? t->to_proc->pid : 0, 3166 t->to_thread ? t->to_thread->pid : 0, 3167 t->code, t->flags, t->priority, t->need_reply); 3168 if (t->buffer == NULL) { 3169 seq_puts(m, " buffer free\n"); 3170 return; 3171 } 3172 if (t->buffer->target_node) 3173 seq_printf(m, " node %d", 3174 t->buffer->target_node->debug_id); 3175 seq_printf(m, " size %zd:%zd data %p\n", 3176 t->buffer->data_size, t->buffer->offsets_size, 3177 t->buffer->data); 3178} 3179 3180static void print_binder_buffer(struct seq_file *m, const char *prefix, 3181 struct binder_buffer *buffer) 3182{ 3183 seq_printf(m, "%s %d: %p size %zd:%zd %s\n", 3184 prefix, buffer->debug_id, buffer->data, 3185 buffer->data_size, buffer->offsets_size, 3186 buffer->transaction ? "active" : "delivered"); 3187} 3188 3189static void print_binder_work(struct seq_file *m, const char *prefix, 3190 const char *transaction_prefix, 3191 struct binder_work *w) 3192{ 3193 struct binder_node *node; 3194 struct binder_transaction *t; 3195 3196 switch (w->type) { 3197 case BINDER_WORK_TRANSACTION: 3198 t = container_of(w, struct binder_transaction, work); 3199 print_binder_transaction(m, transaction_prefix, t); 3200 break; 3201 case BINDER_WORK_TRANSACTION_COMPLETE: 3202 seq_printf(m, "%stransaction complete\n", prefix); 3203 break; 3204 case BINDER_WORK_NODE: 3205 node = container_of(w, struct binder_node, work); 3206 seq_printf(m, "%snode work %d: u%016llx c%016llx\n", 3207 prefix, node->debug_id, 3208 (u64)node->ptr, (u64)node->cookie); 3209 break; 3210 case BINDER_WORK_DEAD_BINDER: 3211 seq_printf(m, "%shas dead binder\n", prefix); 3212 break; 3213 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 3214 seq_printf(m, "%shas cleared dead binder\n", prefix); 3215 break; 3216 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: 3217 seq_printf(m, "%shas cleared death notification\n", prefix); 3218 break; 3219 default: 3220 seq_printf(m, "%sunknown work: type %d\n", prefix, w->type); 3221 break; 3222 } 3223} 3224 3225static void print_binder_thread(struct seq_file *m, 3226 struct binder_thread *thread, 3227 int print_always) 3228{ 3229 struct binder_transaction *t; 3230 struct binder_work *w; 3231 size_t start_pos = m->count; 3232 size_t header_pos; 3233 3234 seq_printf(m, " thread %d: l %02x\n", thread->pid, thread->looper); 3235 header_pos = m->count; 3236 t = thread->transaction_stack; 3237 while (t) { 3238 if (t->from == thread) { 3239 print_binder_transaction(m, 3240 " outgoing transaction", t); 3241 t = t->from_parent; 3242 } else if (t->to_thread == thread) { 3243 print_binder_transaction(m, 3244 " incoming transaction", t); 3245 t = t->to_parent; 3246 } else { 3247 print_binder_transaction(m, " bad transaction", t); 3248 t = NULL; 3249 } 3250 } 3251 list_for_each_entry(w, &thread->todo, entry) { 3252 print_binder_work(m, " ", " pending transaction", w); 3253 } 3254 if (!print_always && m->count == header_pos) 3255 m->count = start_pos; 3256} 3257 3258static void print_binder_node(struct seq_file *m, struct binder_node *node) 3259{ 3260 struct binder_ref *ref; 3261 struct binder_work *w; 3262 int count; 3263 3264 count = 0; 3265 hlist_for_each_entry(ref, &node->refs, node_entry) 3266 count++; 3267 3268 seq_printf(m, " node %d: u%016llx c%016llx hs %d hw %d ls %d lw %d is %d iw %d", 3269 node->debug_id, (u64)node->ptr, (u64)node->cookie, 3270 node->has_strong_ref, node->has_weak_ref, 3271 node->local_strong_refs, node->local_weak_refs, 3272 node->internal_strong_refs, count); 3273 if (count) { 3274 seq_puts(m, " proc"); 3275 hlist_for_each_entry(ref, &node->refs, node_entry) 3276 seq_printf(m, " %d", ref->proc->pid); 3277 } 3278 seq_puts(m, "\n"); 3279 list_for_each_entry(w, &node->async_todo, entry) 3280 print_binder_work(m, " ", 3281 " pending async transaction", w); 3282} 3283 3284static void print_binder_ref(struct seq_file *m, struct binder_ref *ref) 3285{ 3286 seq_printf(m, " ref %d: desc %d %snode %d s %d w %d d %p\n", 3287 ref->debug_id, ref->desc, ref->node->proc ? "" : "dead ", 3288 ref->node->debug_id, ref->strong, ref->weak, ref->death); 3289} 3290 3291static void print_binder_proc(struct seq_file *m, 3292 struct binder_proc *proc, int print_all) 3293{ 3294 struct binder_work *w; 3295 struct rb_node *n; 3296 size_t start_pos = m->count; 3297 size_t header_pos; 3298 3299 seq_printf(m, "proc %d\n", proc->pid); 3300 header_pos = m->count; 3301 3302 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3303 print_binder_thread(m, rb_entry(n, struct binder_thread, 3304 rb_node), print_all); 3305 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) { 3306 struct binder_node *node = rb_entry(n, struct binder_node, 3307 rb_node); 3308 if (print_all || node->has_async_transaction) 3309 print_binder_node(m, node); 3310 } 3311 if (print_all) { 3312 for (n = rb_first(&proc->refs_by_desc); 3313 n != NULL; 3314 n = rb_next(n)) 3315 print_binder_ref(m, rb_entry(n, struct binder_ref, 3316 rb_node_desc)); 3317 } 3318 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3319 print_binder_buffer(m, " buffer", 3320 rb_entry(n, struct binder_buffer, rb_node)); 3321 list_for_each_entry(w, &proc->todo, entry) 3322 print_binder_work(m, " ", " pending transaction", w); 3323 list_for_each_entry(w, &proc->delivered_death, entry) { 3324 seq_puts(m, " has delivered dead binder\n"); 3325 break; 3326 } 3327 if (!print_all && m->count == header_pos) 3328 m->count = start_pos; 3329} 3330 3331static const char * const binder_return_strings[] = { 3332 "BR_ERROR", 3333 "BR_OK", 3334 "BR_TRANSACTION", 3335 "BR_REPLY", 3336 "BR_ACQUIRE_RESULT", 3337 "BR_DEAD_REPLY", 3338 "BR_TRANSACTION_COMPLETE", 3339 "BR_INCREFS", 3340 "BR_ACQUIRE", 3341 "BR_RELEASE", 3342 "BR_DECREFS", 3343 "BR_ATTEMPT_ACQUIRE", 3344 "BR_NOOP", 3345 "BR_SPAWN_LOOPER", 3346 "BR_FINISHED", 3347 "BR_DEAD_BINDER", 3348 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 3349 "BR_FAILED_REPLY" 3350}; 3351 3352static const char * const binder_command_strings[] = { 3353 "BC_TRANSACTION", 3354 "BC_REPLY", 3355 "BC_ACQUIRE_RESULT", 3356 "BC_FREE_BUFFER", 3357 "BC_INCREFS", 3358 "BC_ACQUIRE", 3359 "BC_RELEASE", 3360 "BC_DECREFS", 3361 "BC_INCREFS_DONE", 3362 "BC_ACQUIRE_DONE", 3363 "BC_ATTEMPT_ACQUIRE", 3364 "BC_REGISTER_LOOPER", 3365 "BC_ENTER_LOOPER", 3366 "BC_EXIT_LOOPER", 3367 "BC_REQUEST_DEATH_NOTIFICATION", 3368 "BC_CLEAR_DEATH_NOTIFICATION", 3369 "BC_DEAD_BINDER_DONE" 3370}; 3371 3372static const char * const binder_objstat_strings[] = { 3373 "proc", 3374 "thread", 3375 "node", 3376 "ref", 3377 "death", 3378 "transaction", 3379 "transaction_complete" 3380}; 3381 3382static void print_binder_stats(struct seq_file *m, const char *prefix, 3383 struct binder_stats *stats) 3384{ 3385 int i; 3386 3387 BUILD_BUG_ON(ARRAY_SIZE(stats->bc) != 3388 ARRAY_SIZE(binder_command_strings)); 3389 for (i = 0; i < ARRAY_SIZE(stats->bc); i++) { 3390 if (stats->bc[i]) 3391 seq_printf(m, "%s%s: %d\n", prefix, 3392 binder_command_strings[i], stats->bc[i]); 3393 } 3394 3395 BUILD_BUG_ON(ARRAY_SIZE(stats->br) != 3396 ARRAY_SIZE(binder_return_strings)); 3397 for (i = 0; i < ARRAY_SIZE(stats->br); i++) { 3398 if (stats->br[i]) 3399 seq_printf(m, "%s%s: %d\n", prefix, 3400 binder_return_strings[i], stats->br[i]); 3401 } 3402 3403 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 3404 ARRAY_SIZE(binder_objstat_strings)); 3405 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 3406 ARRAY_SIZE(stats->obj_deleted)); 3407 for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) { 3408 if (stats->obj_created[i] || stats->obj_deleted[i]) 3409 seq_printf(m, "%s%s: active %d total %d\n", prefix, 3410 binder_objstat_strings[i], 3411 stats->obj_created[i] - stats->obj_deleted[i], 3412 stats->obj_created[i]); 3413 } 3414} 3415 3416static void print_binder_proc_stats(struct seq_file *m, 3417 struct binder_proc *proc) 3418{ 3419 struct binder_work *w; 3420 struct rb_node *n; 3421 int count, strong, weak; 3422 3423 seq_printf(m, "proc %d\n", proc->pid); 3424 count = 0; 3425 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3426 count++; 3427 seq_printf(m, " threads: %d\n", count); 3428 seq_printf(m, " requested threads: %d+%d/%d\n" 3429 " ready threads %d\n" 3430 " free async space %zd\n", proc->requested_threads, 3431 proc->requested_threads_started, proc->max_threads, 3432 proc->ready_threads, proc->free_async_space); 3433 count = 0; 3434 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) 3435 count++; 3436 seq_printf(m, " nodes: %d\n", count); 3437 count = 0; 3438 strong = 0; 3439 weak = 0; 3440 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 3441 struct binder_ref *ref = rb_entry(n, struct binder_ref, 3442 rb_node_desc); 3443 count++; 3444 strong += ref->strong; 3445 weak += ref->weak; 3446 } 3447 seq_printf(m, " refs: %d s %d w %d\n", count, strong, weak); 3448 3449 count = 0; 3450 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3451 count++; 3452 seq_printf(m, " buffers: %d\n", count); 3453 3454 count = 0; 3455 list_for_each_entry(w, &proc->todo, entry) { 3456 switch (w->type) { 3457 case BINDER_WORK_TRANSACTION: 3458 count++; 3459 break; 3460 default: 3461 break; 3462 } 3463 } 3464 seq_printf(m, " pending transactions: %d\n", count); 3465 3466 print_binder_stats(m, " ", &proc->stats); 3467} 3468 3469 3470static int binder_state_show(struct seq_file *m, void *unused) 3471{ 3472 struct binder_proc *proc; 3473 struct binder_node *node; 3474 int do_lock = !binder_debug_no_lock; 3475 3476 if (do_lock) 3477 binder_lock(__func__); 3478 3479 seq_puts(m, "binder state:\n"); 3480 3481 if (!hlist_empty(&binder_dead_nodes)) 3482 seq_puts(m, "dead nodes:\n"); 3483 hlist_for_each_entry(node, &binder_dead_nodes, dead_node) 3484 print_binder_node(m, node); 3485 3486 hlist_for_each_entry(proc, &binder_procs, proc_node) 3487 print_binder_proc(m, proc, 1); 3488 if (do_lock) 3489 binder_unlock(__func__); 3490 return 0; 3491} 3492 3493static int binder_stats_show(struct seq_file *m, void *unused) 3494{ 3495 struct binder_proc *proc; 3496 int do_lock = !binder_debug_no_lock; 3497 3498 if (do_lock) 3499 binder_lock(__func__); 3500 3501 seq_puts(m, "binder stats:\n"); 3502 3503 print_binder_stats(m, "", &binder_stats); 3504 3505 hlist_for_each_entry(proc, &binder_procs, proc_node) 3506 print_binder_proc_stats(m, proc); 3507 if (do_lock) 3508 binder_unlock(__func__); 3509 return 0; 3510} 3511 3512static int binder_transactions_show(struct seq_file *m, void *unused) 3513{ 3514 struct binder_proc *proc; 3515 int do_lock = !binder_debug_no_lock; 3516 3517 if (do_lock) 3518 binder_lock(__func__); 3519 3520 seq_puts(m, "binder transactions:\n"); 3521 hlist_for_each_entry(proc, &binder_procs, proc_node) 3522 print_binder_proc(m, proc, 0); 3523 if (do_lock) 3524 binder_unlock(__func__); 3525 return 0; 3526} 3527 3528static int binder_proc_show(struct seq_file *m, void *unused) 3529{ 3530 struct binder_proc *proc = m->private; 3531 int do_lock = !binder_debug_no_lock; 3532 3533 if (do_lock) 3534 binder_lock(__func__); 3535 seq_puts(m, "binder proc state:\n"); 3536 print_binder_proc(m, proc, 1); 3537 if (do_lock) 3538 binder_unlock(__func__); 3539 return 0; 3540} 3541 3542static void print_binder_transaction_log_entry(struct seq_file *m, 3543 struct binder_transaction_log_entry *e) 3544{ 3545 seq_printf(m, 3546 "%d: %s from %d:%d to %d:%d node %d handle %d size %d:%d\n", 3547 e->debug_id, (e->call_type == 2) ? "reply" : 3548 ((e->call_type == 1) ? "async" : "call "), e->from_proc, 3549 e->from_thread, e->to_proc, e->to_thread, e->to_node, 3550 e->target_handle, e->data_size, e->offsets_size); 3551} 3552 3553static int binder_transaction_log_show(struct seq_file *m, void *unused) 3554{ 3555 struct binder_transaction_log *log = m->private; 3556 int i; 3557 3558 if (log->full) { 3559 for (i = log->next; i < ARRAY_SIZE(log->entry); i++) 3560 print_binder_transaction_log_entry(m, &log->entry[i]); 3561 } 3562 for (i = 0; i < log->next; i++) 3563 print_binder_transaction_log_entry(m, &log->entry[i]); 3564 return 0; 3565} 3566 3567static const struct file_operations binder_fops = { 3568 .owner = THIS_MODULE, 3569 .poll = binder_poll, 3570 .unlocked_ioctl = binder_ioctl, 3571 .compat_ioctl = binder_ioctl, 3572 .mmap = binder_mmap, 3573 .open = binder_open, 3574 .flush = binder_flush, 3575 .release = binder_release, 3576}; 3577 3578static struct miscdevice binder_miscdev = { 3579 .minor = MISC_DYNAMIC_MINOR, 3580 .name = "binder", 3581 .fops = &binder_fops 3582}; 3583 3584BINDER_DEBUG_ENTRY(state); 3585BINDER_DEBUG_ENTRY(stats); 3586BINDER_DEBUG_ENTRY(transactions); 3587BINDER_DEBUG_ENTRY(transaction_log); 3588 3589static int __init binder_init(void) 3590{ 3591 int ret; 3592 3593 binder_deferred_workqueue = create_singlethread_workqueue("binder"); 3594 if (!binder_deferred_workqueue) 3595 return -ENOMEM; 3596 3597 binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL); 3598 if (binder_debugfs_dir_entry_root) 3599 binder_debugfs_dir_entry_proc = debugfs_create_dir("proc", 3600 binder_debugfs_dir_entry_root); 3601 ret = misc_register(&binder_miscdev); 3602 if (binder_debugfs_dir_entry_root) { 3603 debugfs_create_file("state", 3604 S_IRUGO, 3605 binder_debugfs_dir_entry_root, 3606 NULL, 3607 &binder_state_fops); 3608 debugfs_create_file("stats", 3609 S_IRUGO, 3610 binder_debugfs_dir_entry_root, 3611 NULL, 3612 &binder_stats_fops); 3613 debugfs_create_file("transactions", 3614 S_IRUGO, 3615 binder_debugfs_dir_entry_root, 3616 NULL, 3617 &binder_transactions_fops); 3618 debugfs_create_file("transaction_log", 3619 S_IRUGO, 3620 binder_debugfs_dir_entry_root, 3621 &binder_transaction_log, 3622 &binder_transaction_log_fops); 3623 debugfs_create_file("failed_transaction_log", 3624 S_IRUGO, 3625 binder_debugfs_dir_entry_root, 3626 &binder_transaction_log_failed, 3627 &binder_transaction_log_fops); 3628 } 3629 return ret; 3630} 3631 3632device_initcall(binder_init); 3633 3634#define CREATE_TRACE_POINTS 3635#include "binder_trace.h" 3636 3637MODULE_LICENSE("GPL v2"); 3638