binder.c revision a79f41ed9786b75ebe75e52295ad54049b8551b6
1/* binder.c 2 * 3 * Android IPC Subsystem 4 * 5 * Copyright (C) 2007-2008 Google, Inc. 6 * 7 * This software is licensed under the terms of the GNU General Public 8 * License version 2, as published by the Free Software Foundation, and 9 * may be copied, distributed, and modified under those terms. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 */ 17 18#include <asm/cacheflush.h> 19#include <linux/fdtable.h> 20#include <linux/file.h> 21#include <linux/fs.h> 22#include <linux/list.h> 23#include <linux/miscdevice.h> 24#include <linux/mm.h> 25#include <linux/module.h> 26#include <linux/mutex.h> 27#include <linux/nsproxy.h> 28#include <linux/poll.h> 29#include <linux/debugfs.h> 30#include <linux/rbtree.h> 31#include <linux/sched.h> 32#include <linux/seq_file.h> 33#include <linux/uaccess.h> 34#include <linux/vmalloc.h> 35#include <linux/slab.h> 36 37#include "binder.h" 38 39static DEFINE_MUTEX(binder_lock); 40static DEFINE_MUTEX(binder_deferred_lock); 41static DEFINE_MUTEX(binder_mmap_lock); 42 43static HLIST_HEAD(binder_procs); 44static HLIST_HEAD(binder_deferred_list); 45static HLIST_HEAD(binder_dead_nodes); 46 47static struct dentry *binder_debugfs_dir_entry_root; 48static struct dentry *binder_debugfs_dir_entry_proc; 49static struct binder_node *binder_context_mgr_node; 50static uid_t binder_context_mgr_uid = -1; 51static int binder_last_id; 52static struct workqueue_struct *binder_deferred_workqueue; 53 54#define BINDER_DEBUG_ENTRY(name) \ 55static int binder_##name##_open(struct inode *inode, struct file *file) \ 56{ \ 57 return single_open(file, binder_##name##_show, inode->i_private); \ 58} \ 59\ 60static const struct file_operations binder_##name##_fops = { \ 61 .owner = THIS_MODULE, \ 62 .open = binder_##name##_open, \ 63 .read = seq_read, \ 64 .llseek = seq_lseek, \ 65 .release = single_release, \ 66} 67 68static int binder_proc_show(struct seq_file *m, void *unused); 69BINDER_DEBUG_ENTRY(proc); 70 71/* This is only defined in include/asm-arm/sizes.h */ 72#ifndef SZ_1K 73#define SZ_1K 0x400 74#endif 75 76#ifndef SZ_4M 77#define SZ_4M 0x400000 78#endif 79 80#define FORBIDDEN_MMAP_FLAGS (VM_WRITE) 81 82#define BINDER_SMALL_BUF_SIZE (PAGE_SIZE * 64) 83 84enum { 85 BINDER_DEBUG_USER_ERROR = 1U << 0, 86 BINDER_DEBUG_FAILED_TRANSACTION = 1U << 1, 87 BINDER_DEBUG_DEAD_TRANSACTION = 1U << 2, 88 BINDER_DEBUG_OPEN_CLOSE = 1U << 3, 89 BINDER_DEBUG_DEAD_BINDER = 1U << 4, 90 BINDER_DEBUG_DEATH_NOTIFICATION = 1U << 5, 91 BINDER_DEBUG_READ_WRITE = 1U << 6, 92 BINDER_DEBUG_USER_REFS = 1U << 7, 93 BINDER_DEBUG_THREADS = 1U << 8, 94 BINDER_DEBUG_TRANSACTION = 1U << 9, 95 BINDER_DEBUG_TRANSACTION_COMPLETE = 1U << 10, 96 BINDER_DEBUG_FREE_BUFFER = 1U << 11, 97 BINDER_DEBUG_INTERNAL_REFS = 1U << 12, 98 BINDER_DEBUG_BUFFER_ALLOC = 1U << 13, 99 BINDER_DEBUG_PRIORITY_CAP = 1U << 14, 100 BINDER_DEBUG_BUFFER_ALLOC_ASYNC = 1U << 15, 101}; 102static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR | 103 BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION; 104module_param_named(debug_mask, binder_debug_mask, uint, S_IWUSR | S_IRUGO); 105 106static bool binder_debug_no_lock; 107module_param_named(proc_no_lock, binder_debug_no_lock, bool, S_IWUSR | S_IRUGO); 108 109static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait); 110static int binder_stop_on_user_error; 111 112static int binder_set_stop_on_user_error(const char *val, 113 struct kernel_param *kp) 114{ 115 int ret; 116 ret = param_set_int(val, kp); 117 if (binder_stop_on_user_error < 2) 118 wake_up(&binder_user_error_wait); 119 return ret; 120} 121module_param_call(stop_on_user_error, binder_set_stop_on_user_error, 122 param_get_int, &binder_stop_on_user_error, S_IWUSR | S_IRUGO); 123 124#define binder_debug(mask, x...) \ 125 do { \ 126 if (binder_debug_mask & mask) \ 127 pr_info(x); \ 128 } while (0) 129 130#define binder_user_error(x...) \ 131 do { \ 132 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \ 133 pr_info(x); \ 134 if (binder_stop_on_user_error) \ 135 binder_stop_on_user_error = 2; \ 136 } while (0) 137 138enum binder_stat_types { 139 BINDER_STAT_PROC, 140 BINDER_STAT_THREAD, 141 BINDER_STAT_NODE, 142 BINDER_STAT_REF, 143 BINDER_STAT_DEATH, 144 BINDER_STAT_TRANSACTION, 145 BINDER_STAT_TRANSACTION_COMPLETE, 146 BINDER_STAT_COUNT 147}; 148 149struct binder_stats { 150 int br[_IOC_NR(BR_FAILED_REPLY) + 1]; 151 int bc[_IOC_NR(BC_DEAD_BINDER_DONE) + 1]; 152 int obj_created[BINDER_STAT_COUNT]; 153 int obj_deleted[BINDER_STAT_COUNT]; 154}; 155 156static struct binder_stats binder_stats; 157 158static inline void binder_stats_deleted(enum binder_stat_types type) 159{ 160 binder_stats.obj_deleted[type]++; 161} 162 163static inline void binder_stats_created(enum binder_stat_types type) 164{ 165 binder_stats.obj_created[type]++; 166} 167 168struct binder_transaction_log_entry { 169 int debug_id; 170 int call_type; 171 int from_proc; 172 int from_thread; 173 int target_handle; 174 int to_proc; 175 int to_thread; 176 int to_node; 177 int data_size; 178 int offsets_size; 179}; 180struct binder_transaction_log { 181 int next; 182 int full; 183 struct binder_transaction_log_entry entry[32]; 184}; 185static struct binder_transaction_log binder_transaction_log; 186static struct binder_transaction_log binder_transaction_log_failed; 187 188static struct binder_transaction_log_entry *binder_transaction_log_add( 189 struct binder_transaction_log *log) 190{ 191 struct binder_transaction_log_entry *e; 192 e = &log->entry[log->next]; 193 memset(e, 0, sizeof(*e)); 194 log->next++; 195 if (log->next == ARRAY_SIZE(log->entry)) { 196 log->next = 0; 197 log->full = 1; 198 } 199 return e; 200} 201 202struct binder_work { 203 struct list_head entry; 204 enum { 205 BINDER_WORK_TRANSACTION = 1, 206 BINDER_WORK_TRANSACTION_COMPLETE, 207 BINDER_WORK_NODE, 208 BINDER_WORK_DEAD_BINDER, 209 BINDER_WORK_DEAD_BINDER_AND_CLEAR, 210 BINDER_WORK_CLEAR_DEATH_NOTIFICATION, 211 } type; 212}; 213 214struct binder_node { 215 int debug_id; 216 struct binder_work work; 217 union { 218 struct rb_node rb_node; 219 struct hlist_node dead_node; 220 }; 221 struct binder_proc *proc; 222 struct hlist_head refs; 223 int internal_strong_refs; 224 int local_weak_refs; 225 int local_strong_refs; 226 void __user *ptr; 227 void __user *cookie; 228 unsigned has_strong_ref:1; 229 unsigned pending_strong_ref:1; 230 unsigned has_weak_ref:1; 231 unsigned pending_weak_ref:1; 232 unsigned has_async_transaction:1; 233 unsigned accept_fds:1; 234 unsigned min_priority:8; 235 struct list_head async_todo; 236}; 237 238struct binder_ref_death { 239 struct binder_work work; 240 void __user *cookie; 241}; 242 243struct binder_ref { 244 /* Lookups needed: */ 245 /* node + proc => ref (transaction) */ 246 /* desc + proc => ref (transaction, inc/dec ref) */ 247 /* node => refs + procs (proc exit) */ 248 int debug_id; 249 struct rb_node rb_node_desc; 250 struct rb_node rb_node_node; 251 struct hlist_node node_entry; 252 struct binder_proc *proc; 253 struct binder_node *node; 254 uint32_t desc; 255 int strong; 256 int weak; 257 struct binder_ref_death *death; 258}; 259 260struct binder_buffer { 261 struct list_head entry; /* free and allocated entries by address */ 262 struct rb_node rb_node; /* free entry by size or allocated entry */ 263 /* by address */ 264 unsigned free:1; 265 unsigned allow_user_free:1; 266 unsigned async_transaction:1; 267 unsigned debug_id:29; 268 269 struct binder_transaction *transaction; 270 271 struct binder_node *target_node; 272 size_t data_size; 273 size_t offsets_size; 274 uint8_t data[0]; 275}; 276 277enum binder_deferred_state { 278 BINDER_DEFERRED_PUT_FILES = 0x01, 279 BINDER_DEFERRED_FLUSH = 0x02, 280 BINDER_DEFERRED_RELEASE = 0x04, 281}; 282 283struct binder_proc { 284 struct hlist_node proc_node; 285 struct rb_root threads; 286 struct rb_root nodes; 287 struct rb_root refs_by_desc; 288 struct rb_root refs_by_node; 289 int pid; 290 struct vm_area_struct *vma; 291 struct mm_struct *vma_vm_mm; 292 struct task_struct *tsk; 293 struct files_struct *files; 294 struct hlist_node deferred_work_node; 295 int deferred_work; 296 void *buffer; 297 ptrdiff_t user_buffer_offset; 298 299 struct list_head buffers; 300 struct rb_root free_buffers; 301 struct rb_root allocated_buffers; 302 size_t free_async_space; 303 304 struct page **pages; 305 size_t buffer_size; 306 uint32_t buffer_free; 307 struct list_head todo; 308 wait_queue_head_t wait; 309 struct binder_stats stats; 310 struct list_head delivered_death; 311 int max_threads; 312 int requested_threads; 313 int requested_threads_started; 314 int ready_threads; 315 long default_priority; 316 struct dentry *debugfs_entry; 317}; 318 319enum { 320 BINDER_LOOPER_STATE_REGISTERED = 0x01, 321 BINDER_LOOPER_STATE_ENTERED = 0x02, 322 BINDER_LOOPER_STATE_EXITED = 0x04, 323 BINDER_LOOPER_STATE_INVALID = 0x08, 324 BINDER_LOOPER_STATE_WAITING = 0x10, 325 BINDER_LOOPER_STATE_NEED_RETURN = 0x20 326}; 327 328struct binder_thread { 329 struct binder_proc *proc; 330 struct rb_node rb_node; 331 int pid; 332 int looper; 333 struct binder_transaction *transaction_stack; 334 struct list_head todo; 335 uint32_t return_error; /* Write failed, return error code in read buf */ 336 uint32_t return_error2; /* Write failed, return error code in read */ 337 /* buffer. Used when sending a reply to a dead process that */ 338 /* we are also waiting on */ 339 wait_queue_head_t wait; 340 struct binder_stats stats; 341}; 342 343struct binder_transaction { 344 int debug_id; 345 struct binder_work work; 346 struct binder_thread *from; 347 struct binder_transaction *from_parent; 348 struct binder_proc *to_proc; 349 struct binder_thread *to_thread; 350 struct binder_transaction *to_parent; 351 unsigned need_reply:1; 352 /* unsigned is_dead:1; */ /* not used at the moment */ 353 354 struct binder_buffer *buffer; 355 unsigned int code; 356 unsigned int flags; 357 long priority; 358 long saved_priority; 359 uid_t sender_euid; 360}; 361 362static void 363binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer); 364 365/* 366 * copied from get_unused_fd_flags 367 */ 368int task_get_unused_fd_flags(struct binder_proc *proc, int flags) 369{ 370 struct files_struct *files = proc->files; 371 int fd, error; 372 struct fdtable *fdt; 373 unsigned long rlim_cur; 374 unsigned long irqs; 375 376 if (files == NULL) 377 return -ESRCH; 378 379 error = -EMFILE; 380 spin_lock(&files->file_lock); 381 382repeat: 383 fdt = files_fdtable(files); 384 fd = find_next_zero_bit(fdt->open_fds, fdt->max_fds, files->next_fd); 385 386 /* 387 * N.B. For clone tasks sharing a files structure, this test 388 * will limit the total number of files that can be opened. 389 */ 390 rlim_cur = 0; 391 if (lock_task_sighand(proc->tsk, &irqs)) { 392 rlim_cur = proc->tsk->signal->rlim[RLIMIT_NOFILE].rlim_cur; 393 unlock_task_sighand(proc->tsk, &irqs); 394 } 395 if (fd >= rlim_cur) 396 goto out; 397 398 /* Do we need to expand the fd array or fd set? */ 399 error = expand_files(files, fd); 400 if (error < 0) 401 goto out; 402 403 if (error) { 404 /* 405 * If we needed to expand the fs array we 406 * might have blocked - try again. 407 */ 408 error = -EMFILE; 409 goto repeat; 410 } 411 412 __set_open_fd(fd, fdt); 413 if (flags & O_CLOEXEC) 414 __set_close_on_exec(fd, fdt); 415 else 416 __clear_close_on_exec(fd, fdt); 417 files->next_fd = fd + 1; 418#if 1 419 /* Sanity check */ 420 if (fdt->fd[fd] != NULL) { 421 pr_warn("get_unused_fd: slot %d not NULL!\n", fd); 422 fdt->fd[fd] = NULL; 423 } 424#endif 425 error = fd; 426 427out: 428 spin_unlock(&files->file_lock); 429 return error; 430} 431 432/* 433 * copied from fd_install 434 */ 435static void task_fd_install( 436 struct binder_proc *proc, unsigned int fd, struct file *file) 437{ 438 struct files_struct *files = proc->files; 439 struct fdtable *fdt; 440 441 if (files == NULL) 442 return; 443 444 spin_lock(&files->file_lock); 445 fdt = files_fdtable(files); 446 BUG_ON(fdt->fd[fd] != NULL); 447 rcu_assign_pointer(fdt->fd[fd], file); 448 spin_unlock(&files->file_lock); 449} 450 451/* 452 * copied from __put_unused_fd in open.c 453 */ 454static void __put_unused_fd(struct files_struct *files, unsigned int fd) 455{ 456 struct fdtable *fdt = files_fdtable(files); 457 __clear_open_fd(fd, fdt); 458 if (fd < files->next_fd) 459 files->next_fd = fd; 460} 461 462/* 463 * copied from sys_close 464 */ 465static long task_close_fd(struct binder_proc *proc, unsigned int fd) 466{ 467 struct file *filp; 468 struct files_struct *files = proc->files; 469 struct fdtable *fdt; 470 int retval; 471 472 if (files == NULL) 473 return -ESRCH; 474 475 spin_lock(&files->file_lock); 476 fdt = files_fdtable(files); 477 if (fd >= fdt->max_fds) 478 goto out_unlock; 479 filp = fdt->fd[fd]; 480 if (!filp) 481 goto out_unlock; 482 rcu_assign_pointer(fdt->fd[fd], NULL); 483 __clear_close_on_exec(fd, fdt); 484 __put_unused_fd(files, fd); 485 spin_unlock(&files->file_lock); 486 retval = filp_close(filp, files); 487 488 /* can't restart close syscall because file table entry was cleared */ 489 if (unlikely(retval == -ERESTARTSYS || 490 retval == -ERESTARTNOINTR || 491 retval == -ERESTARTNOHAND || 492 retval == -ERESTART_RESTARTBLOCK)) 493 retval = -EINTR; 494 495 return retval; 496 497out_unlock: 498 spin_unlock(&files->file_lock); 499 return -EBADF; 500} 501 502static void binder_set_nice(long nice) 503{ 504 long min_nice; 505 if (can_nice(current, nice)) { 506 set_user_nice(current, nice); 507 return; 508 } 509 min_nice = 20 - current->signal->rlim[RLIMIT_NICE].rlim_cur; 510 binder_debug(BINDER_DEBUG_PRIORITY_CAP, 511 "binder: %d: nice value %ld not allowed use " 512 "%ld instead\n", current->pid, nice, min_nice); 513 set_user_nice(current, min_nice); 514 if (min_nice < 20) 515 return; 516 binder_user_error("binder: %d RLIMIT_NICE not set\n", current->pid); 517} 518 519static size_t binder_buffer_size(struct binder_proc *proc, 520 struct binder_buffer *buffer) 521{ 522 if (list_is_last(&buffer->entry, &proc->buffers)) 523 return proc->buffer + proc->buffer_size - (void *)buffer->data; 524 else 525 return (size_t)list_entry(buffer->entry.next, 526 struct binder_buffer, entry) - (size_t)buffer->data; 527} 528 529static void binder_insert_free_buffer(struct binder_proc *proc, 530 struct binder_buffer *new_buffer) 531{ 532 struct rb_node **p = &proc->free_buffers.rb_node; 533 struct rb_node *parent = NULL; 534 struct binder_buffer *buffer; 535 size_t buffer_size; 536 size_t new_buffer_size; 537 538 BUG_ON(!new_buffer->free); 539 540 new_buffer_size = binder_buffer_size(proc, new_buffer); 541 542 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 543 "binder: %d: add free buffer, size %zd, " 544 "at %p\n", proc->pid, new_buffer_size, new_buffer); 545 546 while (*p) { 547 parent = *p; 548 buffer = rb_entry(parent, struct binder_buffer, rb_node); 549 BUG_ON(!buffer->free); 550 551 buffer_size = binder_buffer_size(proc, buffer); 552 553 if (new_buffer_size < buffer_size) 554 p = &parent->rb_left; 555 else 556 p = &parent->rb_right; 557 } 558 rb_link_node(&new_buffer->rb_node, parent, p); 559 rb_insert_color(&new_buffer->rb_node, &proc->free_buffers); 560} 561 562static void binder_insert_allocated_buffer(struct binder_proc *proc, 563 struct binder_buffer *new_buffer) 564{ 565 struct rb_node **p = &proc->allocated_buffers.rb_node; 566 struct rb_node *parent = NULL; 567 struct binder_buffer *buffer; 568 569 BUG_ON(new_buffer->free); 570 571 while (*p) { 572 parent = *p; 573 buffer = rb_entry(parent, struct binder_buffer, rb_node); 574 BUG_ON(buffer->free); 575 576 if (new_buffer < buffer) 577 p = &parent->rb_left; 578 else if (new_buffer > buffer) 579 p = &parent->rb_right; 580 else 581 BUG(); 582 } 583 rb_link_node(&new_buffer->rb_node, parent, p); 584 rb_insert_color(&new_buffer->rb_node, &proc->allocated_buffers); 585} 586 587static struct binder_buffer *binder_buffer_lookup(struct binder_proc *proc, 588 void __user *user_ptr) 589{ 590 struct rb_node *n = proc->allocated_buffers.rb_node; 591 struct binder_buffer *buffer; 592 struct binder_buffer *kern_ptr; 593 594 kern_ptr = user_ptr - proc->user_buffer_offset 595 - offsetof(struct binder_buffer, data); 596 597 while (n) { 598 buffer = rb_entry(n, struct binder_buffer, rb_node); 599 BUG_ON(buffer->free); 600 601 if (kern_ptr < buffer) 602 n = n->rb_left; 603 else if (kern_ptr > buffer) 604 n = n->rb_right; 605 else 606 return buffer; 607 } 608 return NULL; 609} 610 611static int binder_update_page_range(struct binder_proc *proc, int allocate, 612 void *start, void *end, 613 struct vm_area_struct *vma) 614{ 615 void *page_addr; 616 unsigned long user_page_addr; 617 struct vm_struct tmp_area; 618 struct page **page; 619 struct mm_struct *mm; 620 621 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 622 "binder: %d: %s pages %p-%p\n", proc->pid, 623 allocate ? "allocate" : "free", start, end); 624 625 if (end <= start) 626 return 0; 627 628 if (vma) 629 mm = NULL; 630 else 631 mm = get_task_mm(proc->tsk); 632 633 if (mm) { 634 down_write(&mm->mmap_sem); 635 vma = proc->vma; 636 if (vma && mm != proc->vma_vm_mm) { 637 pr_err("binder: %d: vma mm and task mm mismatch\n", 638 proc->pid); 639 vma = NULL; 640 } 641 } 642 643 if (allocate == 0) 644 goto free_range; 645 646 if (vma == NULL) { 647 pr_err("binder: %d: binder_alloc_buf failed to " 648 "map pages in userspace, no vma\n", proc->pid); 649 goto err_no_vma; 650 } 651 652 for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) { 653 int ret; 654 struct page **page_array_ptr; 655 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 656 657 BUG_ON(*page); 658 *page = alloc_page(GFP_KERNEL | __GFP_ZERO); 659 if (*page == NULL) { 660 pr_err("binder: %d: binder_alloc_buf failed " 661 "for page at %p\n", proc->pid, page_addr); 662 goto err_alloc_page_failed; 663 } 664 tmp_area.addr = page_addr; 665 tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */; 666 page_array_ptr = page; 667 ret = map_vm_area(&tmp_area, PAGE_KERNEL, &page_array_ptr); 668 if (ret) { 669 pr_err("binder: %d: binder_alloc_buf failed " 670 "to map page at %p in kernel\n", 671 proc->pid, page_addr); 672 goto err_map_kernel_failed; 673 } 674 user_page_addr = 675 (uintptr_t)page_addr + proc->user_buffer_offset; 676 ret = vm_insert_page(vma, user_page_addr, page[0]); 677 if (ret) { 678 pr_err("binder: %d: binder_alloc_buf failed " 679 "to map page at %lx in userspace\n", 680 proc->pid, user_page_addr); 681 goto err_vm_insert_page_failed; 682 } 683 /* vm_insert_page does not seem to increment the refcount */ 684 } 685 if (mm) { 686 up_write(&mm->mmap_sem); 687 mmput(mm); 688 } 689 return 0; 690 691free_range: 692 for (page_addr = end - PAGE_SIZE; page_addr >= start; 693 page_addr -= PAGE_SIZE) { 694 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 695 if (vma) 696 zap_page_range(vma, (uintptr_t)page_addr + 697 proc->user_buffer_offset, PAGE_SIZE, NULL); 698err_vm_insert_page_failed: 699 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE); 700err_map_kernel_failed: 701 __free_page(*page); 702 *page = NULL; 703err_alloc_page_failed: 704 ; 705 } 706err_no_vma: 707 if (mm) { 708 up_write(&mm->mmap_sem); 709 mmput(mm); 710 } 711 return -ENOMEM; 712} 713 714static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc, 715 size_t data_size, 716 size_t offsets_size, int is_async) 717{ 718 struct rb_node *n = proc->free_buffers.rb_node; 719 struct binder_buffer *buffer; 720 size_t buffer_size; 721 struct rb_node *best_fit = NULL; 722 void *has_page_addr; 723 void *end_page_addr; 724 size_t size; 725 726 if (proc->vma == NULL) { 727 pr_err("binder: %d: binder_alloc_buf, no vma\n", 728 proc->pid); 729 return NULL; 730 } 731 732 size = ALIGN(data_size, sizeof(void *)) + 733 ALIGN(offsets_size, sizeof(void *)); 734 735 if (size < data_size || size < offsets_size) { 736 binder_user_error("binder: %d: got transaction with invalid " 737 "size %zd-%zd\n", proc->pid, data_size, offsets_size); 738 return NULL; 739 } 740 741 if (is_async && 742 proc->free_async_space < size + sizeof(struct binder_buffer)) { 743 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 744 "binder: %d: binder_alloc_buf size %zd" 745 "failed, no async space left\n", proc->pid, size); 746 return NULL; 747 } 748 749 while (n) { 750 buffer = rb_entry(n, struct binder_buffer, rb_node); 751 BUG_ON(!buffer->free); 752 buffer_size = binder_buffer_size(proc, buffer); 753 754 if (size < buffer_size) { 755 best_fit = n; 756 n = n->rb_left; 757 } else if (size > buffer_size) 758 n = n->rb_right; 759 else { 760 best_fit = n; 761 break; 762 } 763 } 764 if (best_fit == NULL) { 765 pr_err("binder: %d: binder_alloc_buf size %zd failed, " 766 "no address space\n", proc->pid, size); 767 return NULL; 768 } 769 if (n == NULL) { 770 buffer = rb_entry(best_fit, struct binder_buffer, rb_node); 771 buffer_size = binder_buffer_size(proc, buffer); 772 } 773 774 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 775 "binder: %d: binder_alloc_buf size %zd got buff" 776 "er %p size %zd\n", proc->pid, size, buffer, buffer_size); 777 778 has_page_addr = 779 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK); 780 if (n == NULL) { 781 if (size + sizeof(struct binder_buffer) + 4 >= buffer_size) 782 buffer_size = size; /* no room for other buffers */ 783 else 784 buffer_size = size + sizeof(struct binder_buffer); 785 } 786 end_page_addr = 787 (void *)PAGE_ALIGN((uintptr_t)buffer->data + buffer_size); 788 if (end_page_addr > has_page_addr) 789 end_page_addr = has_page_addr; 790 if (binder_update_page_range(proc, 1, 791 (void *)PAGE_ALIGN((uintptr_t)buffer->data), end_page_addr, NULL)) 792 return NULL; 793 794 rb_erase(best_fit, &proc->free_buffers); 795 buffer->free = 0; 796 binder_insert_allocated_buffer(proc, buffer); 797 if (buffer_size != size) { 798 struct binder_buffer *new_buffer = (void *)buffer->data + size; 799 list_add(&new_buffer->entry, &buffer->entry); 800 new_buffer->free = 1; 801 binder_insert_free_buffer(proc, new_buffer); 802 } 803 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 804 "binder: %d: binder_alloc_buf size %zd got " 805 "%p\n", proc->pid, size, buffer); 806 buffer->data_size = data_size; 807 buffer->offsets_size = offsets_size; 808 buffer->async_transaction = is_async; 809 if (is_async) { 810 proc->free_async_space -= size + sizeof(struct binder_buffer); 811 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 812 "binder: %d: binder_alloc_buf size %zd " 813 "async free %zd\n", proc->pid, size, 814 proc->free_async_space); 815 } 816 817 return buffer; 818} 819 820static void *buffer_start_page(struct binder_buffer *buffer) 821{ 822 return (void *)((uintptr_t)buffer & PAGE_MASK); 823} 824 825static void *buffer_end_page(struct binder_buffer *buffer) 826{ 827 return (void *)(((uintptr_t)(buffer + 1) - 1) & PAGE_MASK); 828} 829 830static void binder_delete_free_buffer(struct binder_proc *proc, 831 struct binder_buffer *buffer) 832{ 833 struct binder_buffer *prev, *next = NULL; 834 int free_page_end = 1; 835 int free_page_start = 1; 836 837 BUG_ON(proc->buffers.next == &buffer->entry); 838 prev = list_entry(buffer->entry.prev, struct binder_buffer, entry); 839 BUG_ON(!prev->free); 840 if (buffer_end_page(prev) == buffer_start_page(buffer)) { 841 free_page_start = 0; 842 if (buffer_end_page(prev) == buffer_end_page(buffer)) 843 free_page_end = 0; 844 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 845 "binder: %d: merge free, buffer %p " 846 "share page with %p\n", proc->pid, buffer, prev); 847 } 848 849 if (!list_is_last(&buffer->entry, &proc->buffers)) { 850 next = list_entry(buffer->entry.next, 851 struct binder_buffer, entry); 852 if (buffer_start_page(next) == buffer_end_page(buffer)) { 853 free_page_end = 0; 854 if (buffer_start_page(next) == 855 buffer_start_page(buffer)) 856 free_page_start = 0; 857 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 858 "binder: %d: merge free, buffer" 859 " %p share page with %p\n", proc->pid, 860 buffer, prev); 861 } 862 } 863 list_del(&buffer->entry); 864 if (free_page_start || free_page_end) { 865 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 866 "binder: %d: merge free, buffer %p do " 867 "not share page%s%s with with %p or %p\n", 868 proc->pid, buffer, free_page_start ? "" : " end", 869 free_page_end ? "" : " start", prev, next); 870 binder_update_page_range(proc, 0, free_page_start ? 871 buffer_start_page(buffer) : buffer_end_page(buffer), 872 (free_page_end ? buffer_end_page(buffer) : 873 buffer_start_page(buffer)) + PAGE_SIZE, NULL); 874 } 875} 876 877static void binder_free_buf(struct binder_proc *proc, 878 struct binder_buffer *buffer) 879{ 880 size_t size, buffer_size; 881 882 buffer_size = binder_buffer_size(proc, buffer); 883 884 size = ALIGN(buffer->data_size, sizeof(void *)) + 885 ALIGN(buffer->offsets_size, sizeof(void *)); 886 887 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 888 "binder: %d: binder_free_buf %p size %zd buffer" 889 "_size %zd\n", proc->pid, buffer, size, buffer_size); 890 891 BUG_ON(buffer->free); 892 BUG_ON(size > buffer_size); 893 BUG_ON(buffer->transaction != NULL); 894 BUG_ON((void *)buffer < proc->buffer); 895 BUG_ON((void *)buffer > proc->buffer + proc->buffer_size); 896 897 if (buffer->async_transaction) { 898 proc->free_async_space += size + sizeof(struct binder_buffer); 899 900 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 901 "binder: %d: binder_free_buf size %zd " 902 "async free %zd\n", proc->pid, size, 903 proc->free_async_space); 904 } 905 906 binder_update_page_range(proc, 0, 907 (void *)PAGE_ALIGN((uintptr_t)buffer->data), 908 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK), 909 NULL); 910 rb_erase(&buffer->rb_node, &proc->allocated_buffers); 911 buffer->free = 1; 912 if (!list_is_last(&buffer->entry, &proc->buffers)) { 913 struct binder_buffer *next = list_entry(buffer->entry.next, 914 struct binder_buffer, entry); 915 if (next->free) { 916 rb_erase(&next->rb_node, &proc->free_buffers); 917 binder_delete_free_buffer(proc, next); 918 } 919 } 920 if (proc->buffers.next != &buffer->entry) { 921 struct binder_buffer *prev = list_entry(buffer->entry.prev, 922 struct binder_buffer, entry); 923 if (prev->free) { 924 binder_delete_free_buffer(proc, buffer); 925 rb_erase(&prev->rb_node, &proc->free_buffers); 926 buffer = prev; 927 } 928 } 929 binder_insert_free_buffer(proc, buffer); 930} 931 932static struct binder_node *binder_get_node(struct binder_proc *proc, 933 void __user *ptr) 934{ 935 struct rb_node *n = proc->nodes.rb_node; 936 struct binder_node *node; 937 938 while (n) { 939 node = rb_entry(n, struct binder_node, rb_node); 940 941 if (ptr < node->ptr) 942 n = n->rb_left; 943 else if (ptr > node->ptr) 944 n = n->rb_right; 945 else 946 return node; 947 } 948 return NULL; 949} 950 951static struct binder_node *binder_new_node(struct binder_proc *proc, 952 void __user *ptr, 953 void __user *cookie) 954{ 955 struct rb_node **p = &proc->nodes.rb_node; 956 struct rb_node *parent = NULL; 957 struct binder_node *node; 958 959 while (*p) { 960 parent = *p; 961 node = rb_entry(parent, struct binder_node, rb_node); 962 963 if (ptr < node->ptr) 964 p = &(*p)->rb_left; 965 else if (ptr > node->ptr) 966 p = &(*p)->rb_right; 967 else 968 return NULL; 969 } 970 971 node = kzalloc(sizeof(*node), GFP_KERNEL); 972 if (node == NULL) 973 return NULL; 974 binder_stats_created(BINDER_STAT_NODE); 975 rb_link_node(&node->rb_node, parent, p); 976 rb_insert_color(&node->rb_node, &proc->nodes); 977 node->debug_id = ++binder_last_id; 978 node->proc = proc; 979 node->ptr = ptr; 980 node->cookie = cookie; 981 node->work.type = BINDER_WORK_NODE; 982 INIT_LIST_HEAD(&node->work.entry); 983 INIT_LIST_HEAD(&node->async_todo); 984 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 985 "binder: %d:%d node %d u%p c%p created\n", 986 proc->pid, current->pid, node->debug_id, 987 node->ptr, node->cookie); 988 return node; 989} 990 991static int binder_inc_node(struct binder_node *node, int strong, int internal, 992 struct list_head *target_list) 993{ 994 if (strong) { 995 if (internal) { 996 if (target_list == NULL && 997 node->internal_strong_refs == 0 && 998 !(node == binder_context_mgr_node && 999 node->has_strong_ref)) { 1000 pr_err("binder: invalid inc strong " 1001 "node for %d\n", node->debug_id); 1002 return -EINVAL; 1003 } 1004 node->internal_strong_refs++; 1005 } else 1006 node->local_strong_refs++; 1007 if (!node->has_strong_ref && target_list) { 1008 list_del_init(&node->work.entry); 1009 list_add_tail(&node->work.entry, target_list); 1010 } 1011 } else { 1012 if (!internal) 1013 node->local_weak_refs++; 1014 if (!node->has_weak_ref && list_empty(&node->work.entry)) { 1015 if (target_list == NULL) { 1016 pr_err("binder: invalid inc weak node " 1017 "for %d\n", node->debug_id); 1018 return -EINVAL; 1019 } 1020 list_add_tail(&node->work.entry, target_list); 1021 } 1022 } 1023 return 0; 1024} 1025 1026static int binder_dec_node(struct binder_node *node, int strong, int internal) 1027{ 1028 if (strong) { 1029 if (internal) 1030 node->internal_strong_refs--; 1031 else 1032 node->local_strong_refs--; 1033 if (node->local_strong_refs || node->internal_strong_refs) 1034 return 0; 1035 } else { 1036 if (!internal) 1037 node->local_weak_refs--; 1038 if (node->local_weak_refs || !hlist_empty(&node->refs)) 1039 return 0; 1040 } 1041 if (node->proc && (node->has_strong_ref || node->has_weak_ref)) { 1042 if (list_empty(&node->work.entry)) { 1043 list_add_tail(&node->work.entry, &node->proc->todo); 1044 wake_up_interruptible(&node->proc->wait); 1045 } 1046 } else { 1047 if (hlist_empty(&node->refs) && !node->local_strong_refs && 1048 !node->local_weak_refs) { 1049 list_del_init(&node->work.entry); 1050 if (node->proc) { 1051 rb_erase(&node->rb_node, &node->proc->nodes); 1052 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1053 "binder: refless node %d deleted\n", 1054 node->debug_id); 1055 } else { 1056 hlist_del(&node->dead_node); 1057 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1058 "binder: dead node %d deleted\n", 1059 node->debug_id); 1060 } 1061 kfree(node); 1062 binder_stats_deleted(BINDER_STAT_NODE); 1063 } 1064 } 1065 1066 return 0; 1067} 1068 1069 1070static struct binder_ref *binder_get_ref(struct binder_proc *proc, 1071 uint32_t desc) 1072{ 1073 struct rb_node *n = proc->refs_by_desc.rb_node; 1074 struct binder_ref *ref; 1075 1076 while (n) { 1077 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1078 1079 if (desc < ref->desc) 1080 n = n->rb_left; 1081 else if (desc > ref->desc) 1082 n = n->rb_right; 1083 else 1084 return ref; 1085 } 1086 return NULL; 1087} 1088 1089static struct binder_ref *binder_get_ref_for_node(struct binder_proc *proc, 1090 struct binder_node *node) 1091{ 1092 struct rb_node *n; 1093 struct rb_node **p = &proc->refs_by_node.rb_node; 1094 struct rb_node *parent = NULL; 1095 struct binder_ref *ref, *new_ref; 1096 1097 while (*p) { 1098 parent = *p; 1099 ref = rb_entry(parent, struct binder_ref, rb_node_node); 1100 1101 if (node < ref->node) 1102 p = &(*p)->rb_left; 1103 else if (node > ref->node) 1104 p = &(*p)->rb_right; 1105 else 1106 return ref; 1107 } 1108 new_ref = kzalloc(sizeof(*ref), GFP_KERNEL); 1109 if (new_ref == NULL) 1110 return NULL; 1111 binder_stats_created(BINDER_STAT_REF); 1112 new_ref->debug_id = ++binder_last_id; 1113 new_ref->proc = proc; 1114 new_ref->node = node; 1115 rb_link_node(&new_ref->rb_node_node, parent, p); 1116 rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node); 1117 1118 new_ref->desc = (node == binder_context_mgr_node) ? 0 : 1; 1119 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 1120 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1121 if (ref->desc > new_ref->desc) 1122 break; 1123 new_ref->desc = ref->desc + 1; 1124 } 1125 1126 p = &proc->refs_by_desc.rb_node; 1127 while (*p) { 1128 parent = *p; 1129 ref = rb_entry(parent, struct binder_ref, rb_node_desc); 1130 1131 if (new_ref->desc < ref->desc) 1132 p = &(*p)->rb_left; 1133 else if (new_ref->desc > ref->desc) 1134 p = &(*p)->rb_right; 1135 else 1136 BUG(); 1137 } 1138 rb_link_node(&new_ref->rb_node_desc, parent, p); 1139 rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc); 1140 if (node) { 1141 hlist_add_head(&new_ref->node_entry, &node->refs); 1142 1143 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1144 "binder: %d new ref %d desc %d for " 1145 "node %d\n", proc->pid, new_ref->debug_id, 1146 new_ref->desc, node->debug_id); 1147 } else { 1148 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1149 "binder: %d new ref %d desc %d for " 1150 "dead node\n", proc->pid, new_ref->debug_id, 1151 new_ref->desc); 1152 } 1153 return new_ref; 1154} 1155 1156static void binder_delete_ref(struct binder_ref *ref) 1157{ 1158 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1159 "binder: %d delete ref %d desc %d for " 1160 "node %d\n", ref->proc->pid, ref->debug_id, 1161 ref->desc, ref->node->debug_id); 1162 1163 rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc); 1164 rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node); 1165 if (ref->strong) 1166 binder_dec_node(ref->node, 1, 1); 1167 hlist_del(&ref->node_entry); 1168 binder_dec_node(ref->node, 0, 1); 1169 if (ref->death) { 1170 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1171 "binder: %d delete ref %d desc %d " 1172 "has death notification\n", ref->proc->pid, 1173 ref->debug_id, ref->desc); 1174 list_del(&ref->death->work.entry); 1175 kfree(ref->death); 1176 binder_stats_deleted(BINDER_STAT_DEATH); 1177 } 1178 kfree(ref); 1179 binder_stats_deleted(BINDER_STAT_REF); 1180} 1181 1182static int binder_inc_ref(struct binder_ref *ref, int strong, 1183 struct list_head *target_list) 1184{ 1185 int ret; 1186 if (strong) { 1187 if (ref->strong == 0) { 1188 ret = binder_inc_node(ref->node, 1, 1, target_list); 1189 if (ret) 1190 return ret; 1191 } 1192 ref->strong++; 1193 } else { 1194 if (ref->weak == 0) { 1195 ret = binder_inc_node(ref->node, 0, 1, target_list); 1196 if (ret) 1197 return ret; 1198 } 1199 ref->weak++; 1200 } 1201 return 0; 1202} 1203 1204 1205static int binder_dec_ref(struct binder_ref *ref, int strong) 1206{ 1207 if (strong) { 1208 if (ref->strong == 0) { 1209 binder_user_error("binder: %d invalid dec strong, " 1210 "ref %d desc %d s %d w %d\n", 1211 ref->proc->pid, ref->debug_id, 1212 ref->desc, ref->strong, ref->weak); 1213 return -EINVAL; 1214 } 1215 ref->strong--; 1216 if (ref->strong == 0) { 1217 int ret; 1218 ret = binder_dec_node(ref->node, strong, 1); 1219 if (ret) 1220 return ret; 1221 } 1222 } else { 1223 if (ref->weak == 0) { 1224 binder_user_error("binder: %d invalid dec weak, " 1225 "ref %d desc %d s %d w %d\n", 1226 ref->proc->pid, ref->debug_id, 1227 ref->desc, ref->strong, ref->weak); 1228 return -EINVAL; 1229 } 1230 ref->weak--; 1231 } 1232 if (ref->strong == 0 && ref->weak == 0) 1233 binder_delete_ref(ref); 1234 return 0; 1235} 1236 1237static void binder_pop_transaction(struct binder_thread *target_thread, 1238 struct binder_transaction *t) 1239{ 1240 if (target_thread) { 1241 BUG_ON(target_thread->transaction_stack != t); 1242 BUG_ON(target_thread->transaction_stack->from != target_thread); 1243 target_thread->transaction_stack = 1244 target_thread->transaction_stack->from_parent; 1245 t->from = NULL; 1246 } 1247 t->need_reply = 0; 1248 if (t->buffer) 1249 t->buffer->transaction = NULL; 1250 kfree(t); 1251 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1252} 1253 1254static void binder_send_failed_reply(struct binder_transaction *t, 1255 uint32_t error_code) 1256{ 1257 struct binder_thread *target_thread; 1258 BUG_ON(t->flags & TF_ONE_WAY); 1259 while (1) { 1260 target_thread = t->from; 1261 if (target_thread) { 1262 if (target_thread->return_error != BR_OK && 1263 target_thread->return_error2 == BR_OK) { 1264 target_thread->return_error2 = 1265 target_thread->return_error; 1266 target_thread->return_error = BR_OK; 1267 } 1268 if (target_thread->return_error == BR_OK) { 1269 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1270 "binder: send failed reply for " 1271 "transaction %d to %d:%d\n", 1272 t->debug_id, target_thread->proc->pid, 1273 target_thread->pid); 1274 1275 binder_pop_transaction(target_thread, t); 1276 target_thread->return_error = error_code; 1277 wake_up_interruptible(&target_thread->wait); 1278 } else { 1279 pr_err("binder: reply failed, target " 1280 "thread, %d:%d, has error code %d " 1281 "already\n", target_thread->proc->pid, 1282 target_thread->pid, 1283 target_thread->return_error); 1284 } 1285 return; 1286 } else { 1287 struct binder_transaction *next = t->from_parent; 1288 1289 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1290 "binder: send failed reply " 1291 "for transaction %d, target dead\n", 1292 t->debug_id); 1293 1294 binder_pop_transaction(target_thread, t); 1295 if (next == NULL) { 1296 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1297 "binder: reply failed," 1298 " no target thread at root\n"); 1299 return; 1300 } 1301 t = next; 1302 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1303 "binder: reply failed, no target " 1304 "thread -- retry %d\n", t->debug_id); 1305 } 1306 } 1307} 1308 1309static void binder_transaction_buffer_release(struct binder_proc *proc, 1310 struct binder_buffer *buffer, 1311 size_t *failed_at) 1312{ 1313 size_t *offp, *off_end; 1314 int debug_id = buffer->debug_id; 1315 1316 binder_debug(BINDER_DEBUG_TRANSACTION, 1317 "binder: %d buffer release %d, size %zd-%zd, failed at %p\n", 1318 proc->pid, buffer->debug_id, 1319 buffer->data_size, buffer->offsets_size, failed_at); 1320 1321 if (buffer->target_node) 1322 binder_dec_node(buffer->target_node, 1, 0); 1323 1324 offp = (size_t *)(buffer->data + ALIGN(buffer->data_size, sizeof(void *))); 1325 if (failed_at) 1326 off_end = failed_at; 1327 else 1328 off_end = (void *)offp + buffer->offsets_size; 1329 for (; offp < off_end; offp++) { 1330 struct flat_binder_object *fp; 1331 if (*offp > buffer->data_size - sizeof(*fp) || 1332 buffer->data_size < sizeof(*fp) || 1333 !IS_ALIGNED(*offp, sizeof(void *))) { 1334 pr_err("binder: transaction release %d bad" 1335 "offset %zd, size %zd\n", debug_id, 1336 *offp, buffer->data_size); 1337 continue; 1338 } 1339 fp = (struct flat_binder_object *)(buffer->data + *offp); 1340 switch (fp->type) { 1341 case BINDER_TYPE_BINDER: 1342 case BINDER_TYPE_WEAK_BINDER: { 1343 struct binder_node *node = binder_get_node(proc, fp->binder); 1344 if (node == NULL) { 1345 pr_err("binder: transaction release %d" 1346 " bad node %p\n", debug_id, fp->binder); 1347 break; 1348 } 1349 binder_debug(BINDER_DEBUG_TRANSACTION, 1350 " node %d u%p\n", 1351 node->debug_id, node->ptr); 1352 binder_dec_node(node, fp->type == BINDER_TYPE_BINDER, 0); 1353 } break; 1354 case BINDER_TYPE_HANDLE: 1355 case BINDER_TYPE_WEAK_HANDLE: { 1356 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1357 if (ref == NULL) { 1358 pr_err("binder: transaction release %d" 1359 " bad handle %ld\n", debug_id, 1360 fp->handle); 1361 break; 1362 } 1363 binder_debug(BINDER_DEBUG_TRANSACTION, 1364 " ref %d desc %d (node %d)\n", 1365 ref->debug_id, ref->desc, ref->node->debug_id); 1366 binder_dec_ref(ref, fp->type == BINDER_TYPE_HANDLE); 1367 } break; 1368 1369 case BINDER_TYPE_FD: 1370 binder_debug(BINDER_DEBUG_TRANSACTION, 1371 " fd %ld\n", fp->handle); 1372 if (failed_at) 1373 task_close_fd(proc, fp->handle); 1374 break; 1375 1376 default: 1377 pr_err("binder: transaction release %d bad " 1378 "object type %lx\n", debug_id, fp->type); 1379 break; 1380 } 1381 } 1382} 1383 1384static void binder_transaction(struct binder_proc *proc, 1385 struct binder_thread *thread, 1386 struct binder_transaction_data *tr, int reply) 1387{ 1388 struct binder_transaction *t; 1389 struct binder_work *tcomplete; 1390 size_t *offp, *off_end; 1391 struct binder_proc *target_proc; 1392 struct binder_thread *target_thread = NULL; 1393 struct binder_node *target_node = NULL; 1394 struct list_head *target_list; 1395 wait_queue_head_t *target_wait; 1396 struct binder_transaction *in_reply_to = NULL; 1397 struct binder_transaction_log_entry *e; 1398 uint32_t return_error; 1399 1400 e = binder_transaction_log_add(&binder_transaction_log); 1401 e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY); 1402 e->from_proc = proc->pid; 1403 e->from_thread = thread->pid; 1404 e->target_handle = tr->target.handle; 1405 e->data_size = tr->data_size; 1406 e->offsets_size = tr->offsets_size; 1407 1408 if (reply) { 1409 in_reply_to = thread->transaction_stack; 1410 if (in_reply_to == NULL) { 1411 binder_user_error("binder: %d:%d got reply transaction " 1412 "with no transaction stack\n", 1413 proc->pid, thread->pid); 1414 return_error = BR_FAILED_REPLY; 1415 goto err_empty_call_stack; 1416 } 1417 binder_set_nice(in_reply_to->saved_priority); 1418 if (in_reply_to->to_thread != thread) { 1419 binder_user_error("binder: %d:%d got reply transaction " 1420 "with bad transaction stack," 1421 " transaction %d has target %d:%d\n", 1422 proc->pid, thread->pid, in_reply_to->debug_id, 1423 in_reply_to->to_proc ? 1424 in_reply_to->to_proc->pid : 0, 1425 in_reply_to->to_thread ? 1426 in_reply_to->to_thread->pid : 0); 1427 return_error = BR_FAILED_REPLY; 1428 in_reply_to = NULL; 1429 goto err_bad_call_stack; 1430 } 1431 thread->transaction_stack = in_reply_to->to_parent; 1432 target_thread = in_reply_to->from; 1433 if (target_thread == NULL) { 1434 return_error = BR_DEAD_REPLY; 1435 goto err_dead_binder; 1436 } 1437 if (target_thread->transaction_stack != in_reply_to) { 1438 binder_user_error("binder: %d:%d got reply transaction " 1439 "with bad target transaction stack %d, " 1440 "expected %d\n", 1441 proc->pid, thread->pid, 1442 target_thread->transaction_stack ? 1443 target_thread->transaction_stack->debug_id : 0, 1444 in_reply_to->debug_id); 1445 return_error = BR_FAILED_REPLY; 1446 in_reply_to = NULL; 1447 target_thread = NULL; 1448 goto err_dead_binder; 1449 } 1450 target_proc = target_thread->proc; 1451 } else { 1452 if (tr->target.handle) { 1453 struct binder_ref *ref; 1454 ref = binder_get_ref(proc, tr->target.handle); 1455 if (ref == NULL) { 1456 binder_user_error("binder: %d:%d got " 1457 "transaction to invalid handle\n", 1458 proc->pid, thread->pid); 1459 return_error = BR_FAILED_REPLY; 1460 goto err_invalid_target_handle; 1461 } 1462 target_node = ref->node; 1463 } else { 1464 target_node = binder_context_mgr_node; 1465 if (target_node == NULL) { 1466 return_error = BR_DEAD_REPLY; 1467 goto err_no_context_mgr_node; 1468 } 1469 } 1470 e->to_node = target_node->debug_id; 1471 target_proc = target_node->proc; 1472 if (target_proc == NULL) { 1473 return_error = BR_DEAD_REPLY; 1474 goto err_dead_binder; 1475 } 1476 if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) { 1477 struct binder_transaction *tmp; 1478 tmp = thread->transaction_stack; 1479 if (tmp->to_thread != thread) { 1480 binder_user_error("binder: %d:%d got new " 1481 "transaction with bad transaction stack" 1482 ", transaction %d has target %d:%d\n", 1483 proc->pid, thread->pid, tmp->debug_id, 1484 tmp->to_proc ? tmp->to_proc->pid : 0, 1485 tmp->to_thread ? 1486 tmp->to_thread->pid : 0); 1487 return_error = BR_FAILED_REPLY; 1488 goto err_bad_call_stack; 1489 } 1490 while (tmp) { 1491 if (tmp->from && tmp->from->proc == target_proc) 1492 target_thread = tmp->from; 1493 tmp = tmp->from_parent; 1494 } 1495 } 1496 } 1497 if (target_thread) { 1498 e->to_thread = target_thread->pid; 1499 target_list = &target_thread->todo; 1500 target_wait = &target_thread->wait; 1501 } else { 1502 target_list = &target_proc->todo; 1503 target_wait = &target_proc->wait; 1504 } 1505 e->to_proc = target_proc->pid; 1506 1507 /* TODO: reuse incoming transaction for reply */ 1508 t = kzalloc(sizeof(*t), GFP_KERNEL); 1509 if (t == NULL) { 1510 return_error = BR_FAILED_REPLY; 1511 goto err_alloc_t_failed; 1512 } 1513 binder_stats_created(BINDER_STAT_TRANSACTION); 1514 1515 tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL); 1516 if (tcomplete == NULL) { 1517 return_error = BR_FAILED_REPLY; 1518 goto err_alloc_tcomplete_failed; 1519 } 1520 binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE); 1521 1522 t->debug_id = ++binder_last_id; 1523 e->debug_id = t->debug_id; 1524 1525 if (reply) 1526 binder_debug(BINDER_DEBUG_TRANSACTION, 1527 "binder: %d:%d BC_REPLY %d -> %d:%d, " 1528 "data %p-%p size %zd-%zd\n", 1529 proc->pid, thread->pid, t->debug_id, 1530 target_proc->pid, target_thread->pid, 1531 tr->data.ptr.buffer, tr->data.ptr.offsets, 1532 tr->data_size, tr->offsets_size); 1533 else 1534 binder_debug(BINDER_DEBUG_TRANSACTION, 1535 "binder: %d:%d BC_TRANSACTION %d -> " 1536 "%d - node %d, data %p-%p size %zd-%zd\n", 1537 proc->pid, thread->pid, t->debug_id, 1538 target_proc->pid, target_node->debug_id, 1539 tr->data.ptr.buffer, tr->data.ptr.offsets, 1540 tr->data_size, tr->offsets_size); 1541 1542 if (!reply && !(tr->flags & TF_ONE_WAY)) 1543 t->from = thread; 1544 else 1545 t->from = NULL; 1546 t->sender_euid = proc->tsk->cred->euid; 1547 t->to_proc = target_proc; 1548 t->to_thread = target_thread; 1549 t->code = tr->code; 1550 t->flags = tr->flags; 1551 t->priority = task_nice(current); 1552 t->buffer = binder_alloc_buf(target_proc, tr->data_size, 1553 tr->offsets_size, !reply && (t->flags & TF_ONE_WAY)); 1554 if (t->buffer == NULL) { 1555 return_error = BR_FAILED_REPLY; 1556 goto err_binder_alloc_buf_failed; 1557 } 1558 t->buffer->allow_user_free = 0; 1559 t->buffer->debug_id = t->debug_id; 1560 t->buffer->transaction = t; 1561 t->buffer->target_node = target_node; 1562 if (target_node) 1563 binder_inc_node(target_node, 1, 0, NULL); 1564 1565 offp = (size_t *)(t->buffer->data + ALIGN(tr->data_size, sizeof(void *))); 1566 1567 if (copy_from_user(t->buffer->data, tr->data.ptr.buffer, tr->data_size)) { 1568 binder_user_error("binder: %d:%d got transaction with invalid " 1569 "data ptr\n", proc->pid, thread->pid); 1570 return_error = BR_FAILED_REPLY; 1571 goto err_copy_data_failed; 1572 } 1573 if (copy_from_user(offp, tr->data.ptr.offsets, tr->offsets_size)) { 1574 binder_user_error("binder: %d:%d got transaction with invalid " 1575 "offsets ptr\n", proc->pid, thread->pid); 1576 return_error = BR_FAILED_REPLY; 1577 goto err_copy_data_failed; 1578 } 1579 if (!IS_ALIGNED(tr->offsets_size, sizeof(size_t))) { 1580 binder_user_error("binder: %d:%d got transaction with " 1581 "invalid offsets size, %zd\n", 1582 proc->pid, thread->pid, tr->offsets_size); 1583 return_error = BR_FAILED_REPLY; 1584 goto err_bad_offset; 1585 } 1586 off_end = (void *)offp + tr->offsets_size; 1587 for (; offp < off_end; offp++) { 1588 struct flat_binder_object *fp; 1589 if (*offp > t->buffer->data_size - sizeof(*fp) || 1590 t->buffer->data_size < sizeof(*fp) || 1591 !IS_ALIGNED(*offp, sizeof(void *))) { 1592 binder_user_error("binder: %d:%d got transaction with " 1593 "invalid offset, %zd\n", 1594 proc->pid, thread->pid, *offp); 1595 return_error = BR_FAILED_REPLY; 1596 goto err_bad_offset; 1597 } 1598 fp = (struct flat_binder_object *)(t->buffer->data + *offp); 1599 switch (fp->type) { 1600 case BINDER_TYPE_BINDER: 1601 case BINDER_TYPE_WEAK_BINDER: { 1602 struct binder_ref *ref; 1603 struct binder_node *node = binder_get_node(proc, fp->binder); 1604 if (node == NULL) { 1605 node = binder_new_node(proc, fp->binder, fp->cookie); 1606 if (node == NULL) { 1607 return_error = BR_FAILED_REPLY; 1608 goto err_binder_new_node_failed; 1609 } 1610 node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK; 1611 node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS); 1612 } 1613 if (fp->cookie != node->cookie) { 1614 binder_user_error("binder: %d:%d sending u%p " 1615 "node %d, cookie mismatch %p != %p\n", 1616 proc->pid, thread->pid, 1617 fp->binder, node->debug_id, 1618 fp->cookie, node->cookie); 1619 goto err_binder_get_ref_for_node_failed; 1620 } 1621 ref = binder_get_ref_for_node(target_proc, node); 1622 if (ref == NULL) { 1623 return_error = BR_FAILED_REPLY; 1624 goto err_binder_get_ref_for_node_failed; 1625 } 1626 if (fp->type == BINDER_TYPE_BINDER) 1627 fp->type = BINDER_TYPE_HANDLE; 1628 else 1629 fp->type = BINDER_TYPE_WEAK_HANDLE; 1630 fp->handle = ref->desc; 1631 binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE, 1632 &thread->todo); 1633 1634 binder_debug(BINDER_DEBUG_TRANSACTION, 1635 " node %d u%p -> ref %d desc %d\n", 1636 node->debug_id, node->ptr, ref->debug_id, 1637 ref->desc); 1638 } break; 1639 case BINDER_TYPE_HANDLE: 1640 case BINDER_TYPE_WEAK_HANDLE: { 1641 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1642 if (ref == NULL) { 1643 binder_user_error("binder: %d:%d got " 1644 "transaction with invalid " 1645 "handle, %ld\n", proc->pid, 1646 thread->pid, fp->handle); 1647 return_error = BR_FAILED_REPLY; 1648 goto err_binder_get_ref_failed; 1649 } 1650 if (ref->node->proc == target_proc) { 1651 if (fp->type == BINDER_TYPE_HANDLE) 1652 fp->type = BINDER_TYPE_BINDER; 1653 else 1654 fp->type = BINDER_TYPE_WEAK_BINDER; 1655 fp->binder = ref->node->ptr; 1656 fp->cookie = ref->node->cookie; 1657 binder_inc_node(ref->node, fp->type == BINDER_TYPE_BINDER, 0, NULL); 1658 binder_debug(BINDER_DEBUG_TRANSACTION, 1659 " ref %d desc %d -> node %d u%p\n", 1660 ref->debug_id, ref->desc, ref->node->debug_id, 1661 ref->node->ptr); 1662 } else { 1663 struct binder_ref *new_ref; 1664 new_ref = binder_get_ref_for_node(target_proc, ref->node); 1665 if (new_ref == NULL) { 1666 return_error = BR_FAILED_REPLY; 1667 goto err_binder_get_ref_for_node_failed; 1668 } 1669 fp->handle = new_ref->desc; 1670 binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL); 1671 binder_debug(BINDER_DEBUG_TRANSACTION, 1672 " ref %d desc %d -> ref %d desc %d (node %d)\n", 1673 ref->debug_id, ref->desc, new_ref->debug_id, 1674 new_ref->desc, ref->node->debug_id); 1675 } 1676 } break; 1677 1678 case BINDER_TYPE_FD: { 1679 int target_fd; 1680 struct file *file; 1681 1682 if (reply) { 1683 if (!(in_reply_to->flags & TF_ACCEPT_FDS)) { 1684 binder_user_error("binder: %d:%d got reply with fd, %ld, but target does not allow fds\n", 1685 proc->pid, thread->pid, fp->handle); 1686 return_error = BR_FAILED_REPLY; 1687 goto err_fd_not_allowed; 1688 } 1689 } else if (!target_node->accept_fds) { 1690 binder_user_error("binder: %d:%d got transaction with fd, %ld, but target does not allow fds\n", 1691 proc->pid, thread->pid, fp->handle); 1692 return_error = BR_FAILED_REPLY; 1693 goto err_fd_not_allowed; 1694 } 1695 1696 file = fget(fp->handle); 1697 if (file == NULL) { 1698 binder_user_error("binder: %d:%d got transaction with invalid fd, %ld\n", 1699 proc->pid, thread->pid, fp->handle); 1700 return_error = BR_FAILED_REPLY; 1701 goto err_fget_failed; 1702 } 1703 target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC); 1704 if (target_fd < 0) { 1705 fput(file); 1706 return_error = BR_FAILED_REPLY; 1707 goto err_get_unused_fd_failed; 1708 } 1709 task_fd_install(target_proc, target_fd, file); 1710 binder_debug(BINDER_DEBUG_TRANSACTION, 1711 " fd %ld -> %d\n", fp->handle, target_fd); 1712 /* TODO: fput? */ 1713 fp->handle = target_fd; 1714 } break; 1715 1716 default: 1717 binder_user_error("binder: %d:%d got transactio" 1718 "n with invalid object type, %lx\n", 1719 proc->pid, thread->pid, fp->type); 1720 return_error = BR_FAILED_REPLY; 1721 goto err_bad_object_type; 1722 } 1723 } 1724 if (reply) { 1725 BUG_ON(t->buffer->async_transaction != 0); 1726 binder_pop_transaction(target_thread, in_reply_to); 1727 } else if (!(t->flags & TF_ONE_WAY)) { 1728 BUG_ON(t->buffer->async_transaction != 0); 1729 t->need_reply = 1; 1730 t->from_parent = thread->transaction_stack; 1731 thread->transaction_stack = t; 1732 } else { 1733 BUG_ON(target_node == NULL); 1734 BUG_ON(t->buffer->async_transaction != 1); 1735 if (target_node->has_async_transaction) { 1736 target_list = &target_node->async_todo; 1737 target_wait = NULL; 1738 } else 1739 target_node->has_async_transaction = 1; 1740 } 1741 t->work.type = BINDER_WORK_TRANSACTION; 1742 list_add_tail(&t->work.entry, target_list); 1743 tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE; 1744 list_add_tail(&tcomplete->entry, &thread->todo); 1745 if (target_wait) 1746 wake_up_interruptible(target_wait); 1747 return; 1748 1749err_get_unused_fd_failed: 1750err_fget_failed: 1751err_fd_not_allowed: 1752err_binder_get_ref_for_node_failed: 1753err_binder_get_ref_failed: 1754err_binder_new_node_failed: 1755err_bad_object_type: 1756err_bad_offset: 1757err_copy_data_failed: 1758 binder_transaction_buffer_release(target_proc, t->buffer, offp); 1759 t->buffer->transaction = NULL; 1760 binder_free_buf(target_proc, t->buffer); 1761err_binder_alloc_buf_failed: 1762 kfree(tcomplete); 1763 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 1764err_alloc_tcomplete_failed: 1765 kfree(t); 1766 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1767err_alloc_t_failed: 1768err_bad_call_stack: 1769err_empty_call_stack: 1770err_dead_binder: 1771err_invalid_target_handle: 1772err_no_context_mgr_node: 1773 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1774 "binder: %d:%d transaction failed %d, size %zd-%zd\n", 1775 proc->pid, thread->pid, return_error, 1776 tr->data_size, tr->offsets_size); 1777 1778 { 1779 struct binder_transaction_log_entry *fe; 1780 fe = binder_transaction_log_add(&binder_transaction_log_failed); 1781 *fe = *e; 1782 } 1783 1784 BUG_ON(thread->return_error != BR_OK); 1785 if (in_reply_to) { 1786 thread->return_error = BR_TRANSACTION_COMPLETE; 1787 binder_send_failed_reply(in_reply_to, return_error); 1788 } else 1789 thread->return_error = return_error; 1790} 1791 1792int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread, 1793 void __user *buffer, int size, signed long *consumed) 1794{ 1795 uint32_t cmd; 1796 void __user *ptr = buffer + *consumed; 1797 void __user *end = buffer + size; 1798 1799 while (ptr < end && thread->return_error == BR_OK) { 1800 if (get_user(cmd, (uint32_t __user *)ptr)) 1801 return -EFAULT; 1802 ptr += sizeof(uint32_t); 1803 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) { 1804 binder_stats.bc[_IOC_NR(cmd)]++; 1805 proc->stats.bc[_IOC_NR(cmd)]++; 1806 thread->stats.bc[_IOC_NR(cmd)]++; 1807 } 1808 switch (cmd) { 1809 case BC_INCREFS: 1810 case BC_ACQUIRE: 1811 case BC_RELEASE: 1812 case BC_DECREFS: { 1813 uint32_t target; 1814 struct binder_ref *ref; 1815 const char *debug_string; 1816 1817 if (get_user(target, (uint32_t __user *)ptr)) 1818 return -EFAULT; 1819 ptr += sizeof(uint32_t); 1820 if (target == 0 && binder_context_mgr_node && 1821 (cmd == BC_INCREFS || cmd == BC_ACQUIRE)) { 1822 ref = binder_get_ref_for_node(proc, 1823 binder_context_mgr_node); 1824 if (ref->desc != target) { 1825 binder_user_error("binder: %d:" 1826 "%d tried to acquire " 1827 "reference to desc 0, " 1828 "got %d instead\n", 1829 proc->pid, thread->pid, 1830 ref->desc); 1831 } 1832 } else 1833 ref = binder_get_ref(proc, target); 1834 if (ref == NULL) { 1835 binder_user_error("binder: %d:%d refcou" 1836 "nt change on invalid ref %d\n", 1837 proc->pid, thread->pid, target); 1838 break; 1839 } 1840 switch (cmd) { 1841 case BC_INCREFS: 1842 debug_string = "IncRefs"; 1843 binder_inc_ref(ref, 0, NULL); 1844 break; 1845 case BC_ACQUIRE: 1846 debug_string = "Acquire"; 1847 binder_inc_ref(ref, 1, NULL); 1848 break; 1849 case BC_RELEASE: 1850 debug_string = "Release"; 1851 binder_dec_ref(ref, 1); 1852 break; 1853 case BC_DECREFS: 1854 default: 1855 debug_string = "DecRefs"; 1856 binder_dec_ref(ref, 0); 1857 break; 1858 } 1859 binder_debug(BINDER_DEBUG_USER_REFS, 1860 "binder: %d:%d %s ref %d desc %d s %d w %d for node %d\n", 1861 proc->pid, thread->pid, debug_string, ref->debug_id, 1862 ref->desc, ref->strong, ref->weak, ref->node->debug_id); 1863 break; 1864 } 1865 case BC_INCREFS_DONE: 1866 case BC_ACQUIRE_DONE: { 1867 void __user *node_ptr; 1868 void *cookie; 1869 struct binder_node *node; 1870 1871 if (get_user(node_ptr, (void * __user *)ptr)) 1872 return -EFAULT; 1873 ptr += sizeof(void *); 1874 if (get_user(cookie, (void * __user *)ptr)) 1875 return -EFAULT; 1876 ptr += sizeof(void *); 1877 node = binder_get_node(proc, node_ptr); 1878 if (node == NULL) { 1879 binder_user_error("binder: %d:%d " 1880 "%s u%p no match\n", 1881 proc->pid, thread->pid, 1882 cmd == BC_INCREFS_DONE ? 1883 "BC_INCREFS_DONE" : 1884 "BC_ACQUIRE_DONE", 1885 node_ptr); 1886 break; 1887 } 1888 if (cookie != node->cookie) { 1889 binder_user_error("binder: %d:%d %s u%p node %d" 1890 " cookie mismatch %p != %p\n", 1891 proc->pid, thread->pid, 1892 cmd == BC_INCREFS_DONE ? 1893 "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1894 node_ptr, node->debug_id, 1895 cookie, node->cookie); 1896 break; 1897 } 1898 if (cmd == BC_ACQUIRE_DONE) { 1899 if (node->pending_strong_ref == 0) { 1900 binder_user_error("binder: %d:%d " 1901 "BC_ACQUIRE_DONE node %d has " 1902 "no pending acquire request\n", 1903 proc->pid, thread->pid, 1904 node->debug_id); 1905 break; 1906 } 1907 node->pending_strong_ref = 0; 1908 } else { 1909 if (node->pending_weak_ref == 0) { 1910 binder_user_error("binder: %d:%d " 1911 "BC_INCREFS_DONE node %d has " 1912 "no pending increfs request\n", 1913 proc->pid, thread->pid, 1914 node->debug_id); 1915 break; 1916 } 1917 node->pending_weak_ref = 0; 1918 } 1919 binder_dec_node(node, cmd == BC_ACQUIRE_DONE, 0); 1920 binder_debug(BINDER_DEBUG_USER_REFS, 1921 "binder: %d:%d %s node %d ls %d lw %d\n", 1922 proc->pid, thread->pid, 1923 cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1924 node->debug_id, node->local_strong_refs, node->local_weak_refs); 1925 break; 1926 } 1927 case BC_ATTEMPT_ACQUIRE: 1928 pr_err("binder: BC_ATTEMPT_ACQUIRE not supported\n"); 1929 return -EINVAL; 1930 case BC_ACQUIRE_RESULT: 1931 pr_err("binder: BC_ACQUIRE_RESULT not supported\n"); 1932 return -EINVAL; 1933 1934 case BC_FREE_BUFFER: { 1935 void __user *data_ptr; 1936 struct binder_buffer *buffer; 1937 1938 if (get_user(data_ptr, (void * __user *)ptr)) 1939 return -EFAULT; 1940 ptr += sizeof(void *); 1941 1942 buffer = binder_buffer_lookup(proc, data_ptr); 1943 if (buffer == NULL) { 1944 binder_user_error("binder: %d:%d " 1945 "BC_FREE_BUFFER u%p no match\n", 1946 proc->pid, thread->pid, data_ptr); 1947 break; 1948 } 1949 if (!buffer->allow_user_free) { 1950 binder_user_error("binder: %d:%d " 1951 "BC_FREE_BUFFER u%p matched " 1952 "unreturned buffer\n", 1953 proc->pid, thread->pid, data_ptr); 1954 break; 1955 } 1956 binder_debug(BINDER_DEBUG_FREE_BUFFER, 1957 "binder: %d:%d BC_FREE_BUFFER u%p found buffer %d for %s transaction\n", 1958 proc->pid, thread->pid, data_ptr, buffer->debug_id, 1959 buffer->transaction ? "active" : "finished"); 1960 1961 if (buffer->transaction) { 1962 buffer->transaction->buffer = NULL; 1963 buffer->transaction = NULL; 1964 } 1965 if (buffer->async_transaction && buffer->target_node) { 1966 BUG_ON(!buffer->target_node->has_async_transaction); 1967 if (list_empty(&buffer->target_node->async_todo)) 1968 buffer->target_node->has_async_transaction = 0; 1969 else 1970 list_move_tail(buffer->target_node->async_todo.next, &thread->todo); 1971 } 1972 binder_transaction_buffer_release(proc, buffer, NULL); 1973 binder_free_buf(proc, buffer); 1974 break; 1975 } 1976 1977 case BC_TRANSACTION: 1978 case BC_REPLY: { 1979 struct binder_transaction_data tr; 1980 1981 if (copy_from_user(&tr, ptr, sizeof(tr))) 1982 return -EFAULT; 1983 ptr += sizeof(tr); 1984 binder_transaction(proc, thread, &tr, cmd == BC_REPLY); 1985 break; 1986 } 1987 1988 case BC_REGISTER_LOOPER: 1989 binder_debug(BINDER_DEBUG_THREADS, 1990 "binder: %d:%d BC_REGISTER_LOOPER\n", 1991 proc->pid, thread->pid); 1992 if (thread->looper & BINDER_LOOPER_STATE_ENTERED) { 1993 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1994 binder_user_error("binder: %d:%d ERROR:" 1995 " BC_REGISTER_LOOPER called " 1996 "after BC_ENTER_LOOPER\n", 1997 proc->pid, thread->pid); 1998 } else if (proc->requested_threads == 0) { 1999 thread->looper |= BINDER_LOOPER_STATE_INVALID; 2000 binder_user_error("binder: %d:%d ERROR:" 2001 " BC_REGISTER_LOOPER called " 2002 "without request\n", 2003 proc->pid, thread->pid); 2004 } else { 2005 proc->requested_threads--; 2006 proc->requested_threads_started++; 2007 } 2008 thread->looper |= BINDER_LOOPER_STATE_REGISTERED; 2009 break; 2010 case BC_ENTER_LOOPER: 2011 binder_debug(BINDER_DEBUG_THREADS, 2012 "binder: %d:%d BC_ENTER_LOOPER\n", 2013 proc->pid, thread->pid); 2014 if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) { 2015 thread->looper |= BINDER_LOOPER_STATE_INVALID; 2016 binder_user_error("binder: %d:%d ERROR:" 2017 " BC_ENTER_LOOPER called after " 2018 "BC_REGISTER_LOOPER\n", 2019 proc->pid, thread->pid); 2020 } 2021 thread->looper |= BINDER_LOOPER_STATE_ENTERED; 2022 break; 2023 case BC_EXIT_LOOPER: 2024 binder_debug(BINDER_DEBUG_THREADS, 2025 "binder: %d:%d BC_EXIT_LOOPER\n", 2026 proc->pid, thread->pid); 2027 thread->looper |= BINDER_LOOPER_STATE_EXITED; 2028 break; 2029 2030 case BC_REQUEST_DEATH_NOTIFICATION: 2031 case BC_CLEAR_DEATH_NOTIFICATION: { 2032 uint32_t target; 2033 void __user *cookie; 2034 struct binder_ref *ref; 2035 struct binder_ref_death *death; 2036 2037 if (get_user(target, (uint32_t __user *)ptr)) 2038 return -EFAULT; 2039 ptr += sizeof(uint32_t); 2040 if (get_user(cookie, (void __user * __user *)ptr)) 2041 return -EFAULT; 2042 ptr += sizeof(void *); 2043 ref = binder_get_ref(proc, target); 2044 if (ref == NULL) { 2045 binder_user_error("binder: %d:%d %s " 2046 "invalid ref %d\n", 2047 proc->pid, thread->pid, 2048 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 2049 "BC_REQUEST_DEATH_NOTIFICATION" : 2050 "BC_CLEAR_DEATH_NOTIFICATION", 2051 target); 2052 break; 2053 } 2054 2055 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 2056 "binder: %d:%d %s %p ref %d desc %d s %d w %d for node %d\n", 2057 proc->pid, thread->pid, 2058 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 2059 "BC_REQUEST_DEATH_NOTIFICATION" : 2060 "BC_CLEAR_DEATH_NOTIFICATION", 2061 cookie, ref->debug_id, ref->desc, 2062 ref->strong, ref->weak, ref->node->debug_id); 2063 2064 if (cmd == BC_REQUEST_DEATH_NOTIFICATION) { 2065 if (ref->death) { 2066 binder_user_error("binder: %d:%" 2067 "d BC_REQUEST_DEATH_NOTI" 2068 "FICATION death notific" 2069 "ation already set\n", 2070 proc->pid, thread->pid); 2071 break; 2072 } 2073 death = kzalloc(sizeof(*death), GFP_KERNEL); 2074 if (death == NULL) { 2075 thread->return_error = BR_ERROR; 2076 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 2077 "binder: %d:%d " 2078 "BC_REQUEST_DEATH_NOTIFICATION failed\n", 2079 proc->pid, thread->pid); 2080 break; 2081 } 2082 binder_stats_created(BINDER_STAT_DEATH); 2083 INIT_LIST_HEAD(&death->work.entry); 2084 death->cookie = cookie; 2085 ref->death = death; 2086 if (ref->node->proc == NULL) { 2087 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 2088 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2089 list_add_tail(&ref->death->work.entry, &thread->todo); 2090 } else { 2091 list_add_tail(&ref->death->work.entry, &proc->todo); 2092 wake_up_interruptible(&proc->wait); 2093 } 2094 } 2095 } else { 2096 if (ref->death == NULL) { 2097 binder_user_error("binder: %d:%" 2098 "d BC_CLEAR_DEATH_NOTIFI" 2099 "CATION death notificat" 2100 "ion not active\n", 2101 proc->pid, thread->pid); 2102 break; 2103 } 2104 death = ref->death; 2105 if (death->cookie != cookie) { 2106 binder_user_error("binder: %d:%" 2107 "d BC_CLEAR_DEATH_NOTIFI" 2108 "CATION death notificat" 2109 "ion cookie mismatch " 2110 "%p != %p\n", 2111 proc->pid, thread->pid, 2112 death->cookie, cookie); 2113 break; 2114 } 2115 ref->death = NULL; 2116 if (list_empty(&death->work.entry)) { 2117 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2118 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2119 list_add_tail(&death->work.entry, &thread->todo); 2120 } else { 2121 list_add_tail(&death->work.entry, &proc->todo); 2122 wake_up_interruptible(&proc->wait); 2123 } 2124 } else { 2125 BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER); 2126 death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR; 2127 } 2128 } 2129 } break; 2130 case BC_DEAD_BINDER_DONE: { 2131 struct binder_work *w; 2132 void __user *cookie; 2133 struct binder_ref_death *death = NULL; 2134 if (get_user(cookie, (void __user * __user *)ptr)) 2135 return -EFAULT; 2136 2137 ptr += sizeof(void *); 2138 list_for_each_entry(w, &proc->delivered_death, entry) { 2139 struct binder_ref_death *tmp_death = container_of(w, struct binder_ref_death, work); 2140 if (tmp_death->cookie == cookie) { 2141 death = tmp_death; 2142 break; 2143 } 2144 } 2145 binder_debug(BINDER_DEBUG_DEAD_BINDER, 2146 "binder: %d:%d BC_DEAD_BINDER_DONE %p found %p\n", 2147 proc->pid, thread->pid, cookie, death); 2148 if (death == NULL) { 2149 binder_user_error("binder: %d:%d BC_DEAD" 2150 "_BINDER_DONE %p not found\n", 2151 proc->pid, thread->pid, cookie); 2152 break; 2153 } 2154 2155 list_del_init(&death->work.entry); 2156 if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) { 2157 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2158 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2159 list_add_tail(&death->work.entry, &thread->todo); 2160 } else { 2161 list_add_tail(&death->work.entry, &proc->todo); 2162 wake_up_interruptible(&proc->wait); 2163 } 2164 } 2165 } break; 2166 2167 default: 2168 pr_err("binder: %d:%d unknown command %d\n", 2169 proc->pid, thread->pid, cmd); 2170 return -EINVAL; 2171 } 2172 *consumed = ptr - buffer; 2173 } 2174 return 0; 2175} 2176 2177void binder_stat_br(struct binder_proc *proc, struct binder_thread *thread, 2178 uint32_t cmd) 2179{ 2180 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) { 2181 binder_stats.br[_IOC_NR(cmd)]++; 2182 proc->stats.br[_IOC_NR(cmd)]++; 2183 thread->stats.br[_IOC_NR(cmd)]++; 2184 } 2185} 2186 2187static int binder_has_proc_work(struct binder_proc *proc, 2188 struct binder_thread *thread) 2189{ 2190 return !list_empty(&proc->todo) || 2191 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2192} 2193 2194static int binder_has_thread_work(struct binder_thread *thread) 2195{ 2196 return !list_empty(&thread->todo) || thread->return_error != BR_OK || 2197 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2198} 2199 2200static int binder_thread_read(struct binder_proc *proc, 2201 struct binder_thread *thread, 2202 void __user *buffer, int size, 2203 signed long *consumed, int non_block) 2204{ 2205 void __user *ptr = buffer + *consumed; 2206 void __user *end = buffer + size; 2207 2208 int ret = 0; 2209 int wait_for_proc_work; 2210 2211 if (*consumed == 0) { 2212 if (put_user(BR_NOOP, (uint32_t __user *)ptr)) 2213 return -EFAULT; 2214 ptr += sizeof(uint32_t); 2215 } 2216 2217retry: 2218 wait_for_proc_work = thread->transaction_stack == NULL && 2219 list_empty(&thread->todo); 2220 2221 if (thread->return_error != BR_OK && ptr < end) { 2222 if (thread->return_error2 != BR_OK) { 2223 if (put_user(thread->return_error2, (uint32_t __user *)ptr)) 2224 return -EFAULT; 2225 ptr += sizeof(uint32_t); 2226 if (ptr == end) 2227 goto done; 2228 thread->return_error2 = BR_OK; 2229 } 2230 if (put_user(thread->return_error, (uint32_t __user *)ptr)) 2231 return -EFAULT; 2232 ptr += sizeof(uint32_t); 2233 thread->return_error = BR_OK; 2234 goto done; 2235 } 2236 2237 2238 thread->looper |= BINDER_LOOPER_STATE_WAITING; 2239 if (wait_for_proc_work) 2240 proc->ready_threads++; 2241 mutex_unlock(&binder_lock); 2242 if (wait_for_proc_work) { 2243 if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2244 BINDER_LOOPER_STATE_ENTERED))) { 2245 binder_user_error("binder: %d:%d ERROR: Thread waiting " 2246 "for process work before calling BC_REGISTER_" 2247 "LOOPER or BC_ENTER_LOOPER (state %x)\n", 2248 proc->pid, thread->pid, thread->looper); 2249 wait_event_interruptible(binder_user_error_wait, 2250 binder_stop_on_user_error < 2); 2251 } 2252 binder_set_nice(proc->default_priority); 2253 if (non_block) { 2254 if (!binder_has_proc_work(proc, thread)) 2255 ret = -EAGAIN; 2256 } else 2257 ret = wait_event_interruptible_exclusive(proc->wait, binder_has_proc_work(proc, thread)); 2258 } else { 2259 if (non_block) { 2260 if (!binder_has_thread_work(thread)) 2261 ret = -EAGAIN; 2262 } else 2263 ret = wait_event_interruptible(thread->wait, binder_has_thread_work(thread)); 2264 } 2265 mutex_lock(&binder_lock); 2266 if (wait_for_proc_work) 2267 proc->ready_threads--; 2268 thread->looper &= ~BINDER_LOOPER_STATE_WAITING; 2269 2270 if (ret) 2271 return ret; 2272 2273 while (1) { 2274 uint32_t cmd; 2275 struct binder_transaction_data tr; 2276 struct binder_work *w; 2277 struct binder_transaction *t = NULL; 2278 2279 if (!list_empty(&thread->todo)) 2280 w = list_first_entry(&thread->todo, struct binder_work, entry); 2281 else if (!list_empty(&proc->todo) && wait_for_proc_work) 2282 w = list_first_entry(&proc->todo, struct binder_work, entry); 2283 else { 2284 if (ptr - buffer == 4 && !(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN)) /* no data added */ 2285 goto retry; 2286 break; 2287 } 2288 2289 if (end - ptr < sizeof(tr) + 4) 2290 break; 2291 2292 switch (w->type) { 2293 case BINDER_WORK_TRANSACTION: { 2294 t = container_of(w, struct binder_transaction, work); 2295 } break; 2296 case BINDER_WORK_TRANSACTION_COMPLETE: { 2297 cmd = BR_TRANSACTION_COMPLETE; 2298 if (put_user(cmd, (uint32_t __user *)ptr)) 2299 return -EFAULT; 2300 ptr += sizeof(uint32_t); 2301 2302 binder_stat_br(proc, thread, cmd); 2303 binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE, 2304 "binder: %d:%d BR_TRANSACTION_COMPLETE\n", 2305 proc->pid, thread->pid); 2306 2307 list_del(&w->entry); 2308 kfree(w); 2309 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2310 } break; 2311 case BINDER_WORK_NODE: { 2312 struct binder_node *node = container_of(w, struct binder_node, work); 2313 uint32_t cmd = BR_NOOP; 2314 const char *cmd_name; 2315 int strong = node->internal_strong_refs || node->local_strong_refs; 2316 int weak = !hlist_empty(&node->refs) || node->local_weak_refs || strong; 2317 if (weak && !node->has_weak_ref) { 2318 cmd = BR_INCREFS; 2319 cmd_name = "BR_INCREFS"; 2320 node->has_weak_ref = 1; 2321 node->pending_weak_ref = 1; 2322 node->local_weak_refs++; 2323 } else if (strong && !node->has_strong_ref) { 2324 cmd = BR_ACQUIRE; 2325 cmd_name = "BR_ACQUIRE"; 2326 node->has_strong_ref = 1; 2327 node->pending_strong_ref = 1; 2328 node->local_strong_refs++; 2329 } else if (!strong && node->has_strong_ref) { 2330 cmd = BR_RELEASE; 2331 cmd_name = "BR_RELEASE"; 2332 node->has_strong_ref = 0; 2333 } else if (!weak && node->has_weak_ref) { 2334 cmd = BR_DECREFS; 2335 cmd_name = "BR_DECREFS"; 2336 node->has_weak_ref = 0; 2337 } 2338 if (cmd != BR_NOOP) { 2339 if (put_user(cmd, (uint32_t __user *)ptr)) 2340 return -EFAULT; 2341 ptr += sizeof(uint32_t); 2342 if (put_user(node->ptr, (void * __user *)ptr)) 2343 return -EFAULT; 2344 ptr += sizeof(void *); 2345 if (put_user(node->cookie, (void * __user *)ptr)) 2346 return -EFAULT; 2347 ptr += sizeof(void *); 2348 2349 binder_stat_br(proc, thread, cmd); 2350 binder_debug(BINDER_DEBUG_USER_REFS, 2351 "binder: %d:%d %s %d u%p c%p\n", 2352 proc->pid, thread->pid, cmd_name, node->debug_id, node->ptr, node->cookie); 2353 } else { 2354 list_del_init(&w->entry); 2355 if (!weak && !strong) { 2356 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2357 "binder: %d:%d node %d u%p c%p deleted\n", 2358 proc->pid, thread->pid, node->debug_id, 2359 node->ptr, node->cookie); 2360 rb_erase(&node->rb_node, &proc->nodes); 2361 kfree(node); 2362 binder_stats_deleted(BINDER_STAT_NODE); 2363 } else { 2364 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2365 "binder: %d:%d node %d u%p c%p state unchanged\n", 2366 proc->pid, thread->pid, node->debug_id, node->ptr, 2367 node->cookie); 2368 } 2369 } 2370 } break; 2371 case BINDER_WORK_DEAD_BINDER: 2372 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 2373 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 2374 struct binder_ref_death *death; 2375 uint32_t cmd; 2376 2377 death = container_of(w, struct binder_ref_death, work); 2378 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) 2379 cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE; 2380 else 2381 cmd = BR_DEAD_BINDER; 2382 if (put_user(cmd, (uint32_t __user *)ptr)) 2383 return -EFAULT; 2384 ptr += sizeof(uint32_t); 2385 if (put_user(death->cookie, (void * __user *)ptr)) 2386 return -EFAULT; 2387 ptr += sizeof(void *); 2388 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 2389 "binder: %d:%d %s %p\n", 2390 proc->pid, thread->pid, 2391 cmd == BR_DEAD_BINDER ? 2392 "BR_DEAD_BINDER" : 2393 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 2394 death->cookie); 2395 2396 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) { 2397 list_del(&w->entry); 2398 kfree(death); 2399 binder_stats_deleted(BINDER_STAT_DEATH); 2400 } else 2401 list_move(&w->entry, &proc->delivered_death); 2402 if (cmd == BR_DEAD_BINDER) 2403 goto done; /* DEAD_BINDER notifications can cause transactions */ 2404 } break; 2405 } 2406 2407 if (!t) 2408 continue; 2409 2410 BUG_ON(t->buffer == NULL); 2411 if (t->buffer->target_node) { 2412 struct binder_node *target_node = t->buffer->target_node; 2413 tr.target.ptr = target_node->ptr; 2414 tr.cookie = target_node->cookie; 2415 t->saved_priority = task_nice(current); 2416 if (t->priority < target_node->min_priority && 2417 !(t->flags & TF_ONE_WAY)) 2418 binder_set_nice(t->priority); 2419 else if (!(t->flags & TF_ONE_WAY) || 2420 t->saved_priority > target_node->min_priority) 2421 binder_set_nice(target_node->min_priority); 2422 cmd = BR_TRANSACTION; 2423 } else { 2424 tr.target.ptr = NULL; 2425 tr.cookie = NULL; 2426 cmd = BR_REPLY; 2427 } 2428 tr.code = t->code; 2429 tr.flags = t->flags; 2430 tr.sender_euid = t->sender_euid; 2431 2432 if (t->from) { 2433 struct task_struct *sender = t->from->proc->tsk; 2434 tr.sender_pid = task_tgid_nr_ns(sender, 2435 current->nsproxy->pid_ns); 2436 } else { 2437 tr.sender_pid = 0; 2438 } 2439 2440 tr.data_size = t->buffer->data_size; 2441 tr.offsets_size = t->buffer->offsets_size; 2442 tr.data.ptr.buffer = (void *)t->buffer->data + 2443 proc->user_buffer_offset; 2444 tr.data.ptr.offsets = tr.data.ptr.buffer + 2445 ALIGN(t->buffer->data_size, 2446 sizeof(void *)); 2447 2448 if (put_user(cmd, (uint32_t __user *)ptr)) 2449 return -EFAULT; 2450 ptr += sizeof(uint32_t); 2451 if (copy_to_user(ptr, &tr, sizeof(tr))) 2452 return -EFAULT; 2453 ptr += sizeof(tr); 2454 2455 binder_stat_br(proc, thread, cmd); 2456 binder_debug(BINDER_DEBUG_TRANSACTION, 2457 "binder: %d:%d %s %d %d:%d, cmd %d" 2458 "size %zd-%zd ptr %p-%p\n", 2459 proc->pid, thread->pid, 2460 (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" : 2461 "BR_REPLY", 2462 t->debug_id, t->from ? t->from->proc->pid : 0, 2463 t->from ? t->from->pid : 0, cmd, 2464 t->buffer->data_size, t->buffer->offsets_size, 2465 tr.data.ptr.buffer, tr.data.ptr.offsets); 2466 2467 list_del(&t->work.entry); 2468 t->buffer->allow_user_free = 1; 2469 if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) { 2470 t->to_parent = thread->transaction_stack; 2471 t->to_thread = thread; 2472 thread->transaction_stack = t; 2473 } else { 2474 t->buffer->transaction = NULL; 2475 kfree(t); 2476 binder_stats_deleted(BINDER_STAT_TRANSACTION); 2477 } 2478 break; 2479 } 2480 2481done: 2482 2483 *consumed = ptr - buffer; 2484 if (proc->requested_threads + proc->ready_threads == 0 && 2485 proc->requested_threads_started < proc->max_threads && 2486 (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2487 BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */ 2488 /*spawn a new thread if we leave this out */) { 2489 proc->requested_threads++; 2490 binder_debug(BINDER_DEBUG_THREADS, 2491 "binder: %d:%d BR_SPAWN_LOOPER\n", 2492 proc->pid, thread->pid); 2493 if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer)) 2494 return -EFAULT; 2495 } 2496 return 0; 2497} 2498 2499static void binder_release_work(struct list_head *list) 2500{ 2501 struct binder_work *w; 2502 while (!list_empty(list)) { 2503 w = list_first_entry(list, struct binder_work, entry); 2504 list_del_init(&w->entry); 2505 switch (w->type) { 2506 case BINDER_WORK_TRANSACTION: { 2507 struct binder_transaction *t; 2508 2509 t = container_of(w, struct binder_transaction, work); 2510 if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) 2511 binder_send_failed_reply(t, BR_DEAD_REPLY); 2512 } break; 2513 case BINDER_WORK_TRANSACTION_COMPLETE: { 2514 kfree(w); 2515 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2516 } break; 2517 default: 2518 break; 2519 } 2520 } 2521 2522} 2523 2524static struct binder_thread *binder_get_thread(struct binder_proc *proc) 2525{ 2526 struct binder_thread *thread = NULL; 2527 struct rb_node *parent = NULL; 2528 struct rb_node **p = &proc->threads.rb_node; 2529 2530 while (*p) { 2531 parent = *p; 2532 thread = rb_entry(parent, struct binder_thread, rb_node); 2533 2534 if (current->pid < thread->pid) 2535 p = &(*p)->rb_left; 2536 else if (current->pid > thread->pid) 2537 p = &(*p)->rb_right; 2538 else 2539 break; 2540 } 2541 if (*p == NULL) { 2542 thread = kzalloc(sizeof(*thread), GFP_KERNEL); 2543 if (thread == NULL) 2544 return NULL; 2545 binder_stats_created(BINDER_STAT_THREAD); 2546 thread->proc = proc; 2547 thread->pid = current->pid; 2548 init_waitqueue_head(&thread->wait); 2549 INIT_LIST_HEAD(&thread->todo); 2550 rb_link_node(&thread->rb_node, parent, p); 2551 rb_insert_color(&thread->rb_node, &proc->threads); 2552 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2553 thread->return_error = BR_OK; 2554 thread->return_error2 = BR_OK; 2555 } 2556 return thread; 2557} 2558 2559static int binder_free_thread(struct binder_proc *proc, 2560 struct binder_thread *thread) 2561{ 2562 struct binder_transaction *t; 2563 struct binder_transaction *send_reply = NULL; 2564 int active_transactions = 0; 2565 2566 rb_erase(&thread->rb_node, &proc->threads); 2567 t = thread->transaction_stack; 2568 if (t && t->to_thread == thread) 2569 send_reply = t; 2570 while (t) { 2571 active_transactions++; 2572 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2573 "binder: release %d:%d transaction %d " 2574 "%s, still active\n", proc->pid, thread->pid, 2575 t->debug_id, 2576 (t->to_thread == thread) ? "in" : "out"); 2577 2578 if (t->to_thread == thread) { 2579 t->to_proc = NULL; 2580 t->to_thread = NULL; 2581 if (t->buffer) { 2582 t->buffer->transaction = NULL; 2583 t->buffer = NULL; 2584 } 2585 t = t->to_parent; 2586 } else if (t->from == thread) { 2587 t->from = NULL; 2588 t = t->from_parent; 2589 } else 2590 BUG(); 2591 } 2592 if (send_reply) 2593 binder_send_failed_reply(send_reply, BR_DEAD_REPLY); 2594 binder_release_work(&thread->todo); 2595 kfree(thread); 2596 binder_stats_deleted(BINDER_STAT_THREAD); 2597 return active_transactions; 2598} 2599 2600static unsigned int binder_poll(struct file *filp, 2601 struct poll_table_struct *wait) 2602{ 2603 struct binder_proc *proc = filp->private_data; 2604 struct binder_thread *thread = NULL; 2605 int wait_for_proc_work; 2606 2607 mutex_lock(&binder_lock); 2608 thread = binder_get_thread(proc); 2609 2610 wait_for_proc_work = thread->transaction_stack == NULL && 2611 list_empty(&thread->todo) && thread->return_error == BR_OK; 2612 mutex_unlock(&binder_lock); 2613 2614 if (wait_for_proc_work) { 2615 if (binder_has_proc_work(proc, thread)) 2616 return POLLIN; 2617 poll_wait(filp, &proc->wait, wait); 2618 if (binder_has_proc_work(proc, thread)) 2619 return POLLIN; 2620 } else { 2621 if (binder_has_thread_work(thread)) 2622 return POLLIN; 2623 poll_wait(filp, &thread->wait, wait); 2624 if (binder_has_thread_work(thread)) 2625 return POLLIN; 2626 } 2627 return 0; 2628} 2629 2630static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 2631{ 2632 int ret; 2633 struct binder_proc *proc = filp->private_data; 2634 struct binder_thread *thread; 2635 unsigned int size = _IOC_SIZE(cmd); 2636 void __user *ubuf = (void __user *)arg; 2637 2638 /*pr_info("binder_ioctl: %d:%d %x %lx\n", proc->pid, current->pid, cmd, arg);*/ 2639 2640 ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2641 if (ret) 2642 return ret; 2643 2644 mutex_lock(&binder_lock); 2645 thread = binder_get_thread(proc); 2646 if (thread == NULL) { 2647 ret = -ENOMEM; 2648 goto err; 2649 } 2650 2651 switch (cmd) { 2652 case BINDER_WRITE_READ: { 2653 struct binder_write_read bwr; 2654 if (size != sizeof(struct binder_write_read)) { 2655 ret = -EINVAL; 2656 goto err; 2657 } 2658 if (copy_from_user(&bwr, ubuf, sizeof(bwr))) { 2659 ret = -EFAULT; 2660 goto err; 2661 } 2662 binder_debug(BINDER_DEBUG_READ_WRITE, 2663 "binder: %d:%d write %ld at %08lx, read %ld at %08lx\n", 2664 proc->pid, thread->pid, bwr.write_size, bwr.write_buffer, 2665 bwr.read_size, bwr.read_buffer); 2666 2667 if (bwr.write_size > 0) { 2668 ret = binder_thread_write(proc, thread, (void __user *)bwr.write_buffer, bwr.write_size, &bwr.write_consumed); 2669 if (ret < 0) { 2670 bwr.read_consumed = 0; 2671 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2672 ret = -EFAULT; 2673 goto err; 2674 } 2675 } 2676 if (bwr.read_size > 0) { 2677 ret = binder_thread_read(proc, thread, (void __user *)bwr.read_buffer, bwr.read_size, &bwr.read_consumed, filp->f_flags & O_NONBLOCK); 2678 if (!list_empty(&proc->todo)) 2679 wake_up_interruptible(&proc->wait); 2680 if (ret < 0) { 2681 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2682 ret = -EFAULT; 2683 goto err; 2684 } 2685 } 2686 binder_debug(BINDER_DEBUG_READ_WRITE, 2687 "binder: %d:%d wrote %ld of %ld, read return %ld of %ld\n", 2688 proc->pid, thread->pid, bwr.write_consumed, bwr.write_size, 2689 bwr.read_consumed, bwr.read_size); 2690 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) { 2691 ret = -EFAULT; 2692 goto err; 2693 } 2694 break; 2695 } 2696 case BINDER_SET_MAX_THREADS: 2697 if (copy_from_user(&proc->max_threads, ubuf, sizeof(proc->max_threads))) { 2698 ret = -EINVAL; 2699 goto err; 2700 } 2701 break; 2702 case BINDER_SET_CONTEXT_MGR: 2703 if (binder_context_mgr_node != NULL) { 2704 pr_err("binder: BINDER_SET_CONTEXT_MGR already set\n"); 2705 ret = -EBUSY; 2706 goto err; 2707 } 2708 if (binder_context_mgr_uid != -1) { 2709 if (binder_context_mgr_uid != current->cred->euid) { 2710 pr_err("binder: BINDER_SET_" 2711 "CONTEXT_MGR bad uid %d != %d\n", 2712 current->cred->euid, 2713 binder_context_mgr_uid); 2714 ret = -EPERM; 2715 goto err; 2716 } 2717 } else 2718 binder_context_mgr_uid = current->cred->euid; 2719 binder_context_mgr_node = binder_new_node(proc, NULL, NULL); 2720 if (binder_context_mgr_node == NULL) { 2721 ret = -ENOMEM; 2722 goto err; 2723 } 2724 binder_context_mgr_node->local_weak_refs++; 2725 binder_context_mgr_node->local_strong_refs++; 2726 binder_context_mgr_node->has_strong_ref = 1; 2727 binder_context_mgr_node->has_weak_ref = 1; 2728 break; 2729 case BINDER_THREAD_EXIT: 2730 binder_debug(BINDER_DEBUG_THREADS, "binder: %d:%d exit\n", 2731 proc->pid, thread->pid); 2732 binder_free_thread(proc, thread); 2733 thread = NULL; 2734 break; 2735 case BINDER_VERSION: 2736 if (size != sizeof(struct binder_version)) { 2737 ret = -EINVAL; 2738 goto err; 2739 } 2740 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION, &((struct binder_version *)ubuf)->protocol_version)) { 2741 ret = -EINVAL; 2742 goto err; 2743 } 2744 break; 2745 default: 2746 ret = -EINVAL; 2747 goto err; 2748 } 2749 ret = 0; 2750err: 2751 if (thread) 2752 thread->looper &= ~BINDER_LOOPER_STATE_NEED_RETURN; 2753 mutex_unlock(&binder_lock); 2754 wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2755 if (ret && ret != -ERESTARTSYS) 2756 pr_info("binder: %d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret); 2757 return ret; 2758} 2759 2760static void binder_vma_open(struct vm_area_struct *vma) 2761{ 2762 struct binder_proc *proc = vma->vm_private_data; 2763 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2764 "binder: %d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2765 proc->pid, vma->vm_start, vma->vm_end, 2766 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2767 (unsigned long)pgprot_val(vma->vm_page_prot)); 2768} 2769 2770static void binder_vma_close(struct vm_area_struct *vma) 2771{ 2772 struct binder_proc *proc = vma->vm_private_data; 2773 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2774 "binder: %d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2775 proc->pid, vma->vm_start, vma->vm_end, 2776 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2777 (unsigned long)pgprot_val(vma->vm_page_prot)); 2778 proc->vma = NULL; 2779 proc->vma_vm_mm = NULL; 2780 binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES); 2781} 2782 2783static struct vm_operations_struct binder_vm_ops = { 2784 .open = binder_vma_open, 2785 .close = binder_vma_close, 2786}; 2787 2788static int binder_mmap(struct file *filp, struct vm_area_struct *vma) 2789{ 2790 int ret; 2791 struct vm_struct *area; 2792 struct binder_proc *proc = filp->private_data; 2793 const char *failure_string; 2794 struct binder_buffer *buffer; 2795 2796 if (proc->tsk != current) 2797 return -EINVAL; 2798 2799 if ((vma->vm_end - vma->vm_start) > SZ_4M) 2800 vma->vm_end = vma->vm_start + SZ_4M; 2801 2802 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2803 "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n", 2804 proc->pid, vma->vm_start, vma->vm_end, 2805 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2806 (unsigned long)pgprot_val(vma->vm_page_prot)); 2807 2808 if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) { 2809 ret = -EPERM; 2810 failure_string = "bad vm_flags"; 2811 goto err_bad_arg; 2812 } 2813 vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE; 2814 2815 mutex_lock(&binder_mmap_lock); 2816 if (proc->buffer) { 2817 ret = -EBUSY; 2818 failure_string = "already mapped"; 2819 goto err_already_mapped; 2820 } 2821 2822 area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP); 2823 if (area == NULL) { 2824 ret = -ENOMEM; 2825 failure_string = "get_vm_area"; 2826 goto err_get_vm_area_failed; 2827 } 2828 proc->buffer = area->addr; 2829 proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer; 2830 mutex_unlock(&binder_mmap_lock); 2831 2832#ifdef CONFIG_CPU_CACHE_VIPT 2833 if (cache_is_vipt_aliasing()) { 2834 while (CACHE_COLOUR((vma->vm_start ^ (uint32_t)proc->buffer))) { 2835 pr_info("binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer); 2836 vma->vm_start += PAGE_SIZE; 2837 } 2838 } 2839#endif 2840 proc->pages = kzalloc(sizeof(proc->pages[0]) * ((vma->vm_end - vma->vm_start) / PAGE_SIZE), GFP_KERNEL); 2841 if (proc->pages == NULL) { 2842 ret = -ENOMEM; 2843 failure_string = "alloc page array"; 2844 goto err_alloc_pages_failed; 2845 } 2846 proc->buffer_size = vma->vm_end - vma->vm_start; 2847 2848 vma->vm_ops = &binder_vm_ops; 2849 vma->vm_private_data = proc; 2850 2851 if (binder_update_page_range(proc, 1, proc->buffer, proc->buffer + PAGE_SIZE, vma)) { 2852 ret = -ENOMEM; 2853 failure_string = "alloc small buf"; 2854 goto err_alloc_small_buf_failed; 2855 } 2856 buffer = proc->buffer; 2857 INIT_LIST_HEAD(&proc->buffers); 2858 list_add(&buffer->entry, &proc->buffers); 2859 buffer->free = 1; 2860 binder_insert_free_buffer(proc, buffer); 2861 proc->free_async_space = proc->buffer_size / 2; 2862 barrier(); 2863 proc->files = get_files_struct(current); 2864 proc->vma = vma; 2865 proc->vma_vm_mm = vma->vm_mm; 2866 2867 /*pr_info("binder_mmap: %d %lx-%lx maps %p\n", 2868 proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/ 2869 return 0; 2870 2871err_alloc_small_buf_failed: 2872 kfree(proc->pages); 2873 proc->pages = NULL; 2874err_alloc_pages_failed: 2875 mutex_lock(&binder_mmap_lock); 2876 vfree(proc->buffer); 2877 proc->buffer = NULL; 2878err_get_vm_area_failed: 2879err_already_mapped: 2880 mutex_unlock(&binder_mmap_lock); 2881err_bad_arg: 2882 pr_err("binder_mmap: %d %lx-%lx %s failed %d\n", 2883 proc->pid, vma->vm_start, vma->vm_end, failure_string, ret); 2884 return ret; 2885} 2886 2887static int binder_open(struct inode *nodp, struct file *filp) 2888{ 2889 struct binder_proc *proc; 2890 2891 binder_debug(BINDER_DEBUG_OPEN_CLOSE, "binder_open: %d:%d\n", 2892 current->group_leader->pid, current->pid); 2893 2894 proc = kzalloc(sizeof(*proc), GFP_KERNEL); 2895 if (proc == NULL) 2896 return -ENOMEM; 2897 get_task_struct(current); 2898 proc->tsk = current; 2899 INIT_LIST_HEAD(&proc->todo); 2900 init_waitqueue_head(&proc->wait); 2901 proc->default_priority = task_nice(current); 2902 mutex_lock(&binder_lock); 2903 binder_stats_created(BINDER_STAT_PROC); 2904 hlist_add_head(&proc->proc_node, &binder_procs); 2905 proc->pid = current->group_leader->pid; 2906 INIT_LIST_HEAD(&proc->delivered_death); 2907 filp->private_data = proc; 2908 mutex_unlock(&binder_lock); 2909 2910 if (binder_debugfs_dir_entry_proc) { 2911 char strbuf[11]; 2912 snprintf(strbuf, sizeof(strbuf), "%u", proc->pid); 2913 proc->debugfs_entry = debugfs_create_file(strbuf, S_IRUGO, 2914 binder_debugfs_dir_entry_proc, proc, &binder_proc_fops); 2915 } 2916 2917 return 0; 2918} 2919 2920static int binder_flush(struct file *filp, fl_owner_t id) 2921{ 2922 struct binder_proc *proc = filp->private_data; 2923 2924 binder_defer_work(proc, BINDER_DEFERRED_FLUSH); 2925 2926 return 0; 2927} 2928 2929static void binder_deferred_flush(struct binder_proc *proc) 2930{ 2931 struct rb_node *n; 2932 int wake_count = 0; 2933 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) { 2934 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node); 2935 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2936 if (thread->looper & BINDER_LOOPER_STATE_WAITING) { 2937 wake_up_interruptible(&thread->wait); 2938 wake_count++; 2939 } 2940 } 2941 wake_up_interruptible_all(&proc->wait); 2942 2943 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2944 "binder_flush: %d woke %d threads\n", proc->pid, 2945 wake_count); 2946} 2947 2948static int binder_release(struct inode *nodp, struct file *filp) 2949{ 2950 struct binder_proc *proc = filp->private_data; 2951 debugfs_remove(proc->debugfs_entry); 2952 binder_defer_work(proc, BINDER_DEFERRED_RELEASE); 2953 2954 return 0; 2955} 2956 2957static void binder_deferred_release(struct binder_proc *proc) 2958{ 2959 struct hlist_node *pos; 2960 struct binder_transaction *t; 2961 struct rb_node *n; 2962 int threads, nodes, incoming_refs, outgoing_refs, buffers, active_transactions, page_count; 2963 2964 BUG_ON(proc->vma); 2965 BUG_ON(proc->files); 2966 2967 hlist_del(&proc->proc_node); 2968 if (binder_context_mgr_node && binder_context_mgr_node->proc == proc) { 2969 binder_debug(BINDER_DEBUG_DEAD_BINDER, 2970 "binder_release: %d context_mgr_node gone\n", 2971 proc->pid); 2972 binder_context_mgr_node = NULL; 2973 } 2974 2975 threads = 0; 2976 active_transactions = 0; 2977 while ((n = rb_first(&proc->threads))) { 2978 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node); 2979 threads++; 2980 active_transactions += binder_free_thread(proc, thread); 2981 } 2982 nodes = 0; 2983 incoming_refs = 0; 2984 while ((n = rb_first(&proc->nodes))) { 2985 struct binder_node *node = rb_entry(n, struct binder_node, rb_node); 2986 2987 nodes++; 2988 rb_erase(&node->rb_node, &proc->nodes); 2989 list_del_init(&node->work.entry); 2990 if (hlist_empty(&node->refs)) { 2991 kfree(node); 2992 binder_stats_deleted(BINDER_STAT_NODE); 2993 } else { 2994 struct binder_ref *ref; 2995 int death = 0; 2996 2997 node->proc = NULL; 2998 node->local_strong_refs = 0; 2999 node->local_weak_refs = 0; 3000 hlist_add_head(&node->dead_node, &binder_dead_nodes); 3001 3002 hlist_for_each_entry(ref, pos, &node->refs, node_entry) { 3003 incoming_refs++; 3004 if (ref->death) { 3005 death++; 3006 if (list_empty(&ref->death->work.entry)) { 3007 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 3008 list_add_tail(&ref->death->work.entry, &ref->proc->todo); 3009 wake_up_interruptible(&ref->proc->wait); 3010 } else 3011 BUG(); 3012 } 3013 } 3014 binder_debug(BINDER_DEBUG_DEAD_BINDER, 3015 "binder: node %d now dead, " 3016 "refs %d, death %d\n", node->debug_id, 3017 incoming_refs, death); 3018 } 3019 } 3020 outgoing_refs = 0; 3021 while ((n = rb_first(&proc->refs_by_desc))) { 3022 struct binder_ref *ref = rb_entry(n, struct binder_ref, 3023 rb_node_desc); 3024 outgoing_refs++; 3025 binder_delete_ref(ref); 3026 } 3027 binder_release_work(&proc->todo); 3028 buffers = 0; 3029 3030 while ((n = rb_first(&proc->allocated_buffers))) { 3031 struct binder_buffer *buffer = rb_entry(n, struct binder_buffer, 3032 rb_node); 3033 t = buffer->transaction; 3034 if (t) { 3035 t->buffer = NULL; 3036 buffer->transaction = NULL; 3037 pr_err("binder: release proc %d, " 3038 "transaction %d, not freed\n", 3039 proc->pid, t->debug_id); 3040 /*BUG();*/ 3041 } 3042 binder_free_buf(proc, buffer); 3043 buffers++; 3044 } 3045 3046 binder_stats_deleted(BINDER_STAT_PROC); 3047 3048 page_count = 0; 3049 if (proc->pages) { 3050 int i; 3051 for (i = 0; i < proc->buffer_size / PAGE_SIZE; i++) { 3052 if (proc->pages[i]) { 3053 void *page_addr = proc->buffer + i * PAGE_SIZE; 3054 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 3055 "binder_release: %d: " 3056 "page %d at %p not freed\n", 3057 proc->pid, i, 3058 page_addr); 3059 unmap_kernel_range((unsigned long)page_addr, 3060 PAGE_SIZE); 3061 __free_page(proc->pages[i]); 3062 page_count++; 3063 } 3064 } 3065 kfree(proc->pages); 3066 vfree(proc->buffer); 3067 } 3068 3069 put_task_struct(proc->tsk); 3070 3071 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 3072 "binder_release: %d threads %d, nodes %d (ref %d), " 3073 "refs %d, active transactions %d, buffers %d, " 3074 "pages %d\n", 3075 proc->pid, threads, nodes, incoming_refs, outgoing_refs, 3076 active_transactions, buffers, page_count); 3077 3078 kfree(proc); 3079} 3080 3081static void binder_deferred_func(struct work_struct *work) 3082{ 3083 struct binder_proc *proc; 3084 struct files_struct *files; 3085 3086 int defer; 3087 do { 3088 mutex_lock(&binder_lock); 3089 mutex_lock(&binder_deferred_lock); 3090 if (!hlist_empty(&binder_deferred_list)) { 3091 proc = hlist_entry(binder_deferred_list.first, 3092 struct binder_proc, deferred_work_node); 3093 hlist_del_init(&proc->deferred_work_node); 3094 defer = proc->deferred_work; 3095 proc->deferred_work = 0; 3096 } else { 3097 proc = NULL; 3098 defer = 0; 3099 } 3100 mutex_unlock(&binder_deferred_lock); 3101 3102 files = NULL; 3103 if (defer & BINDER_DEFERRED_PUT_FILES) { 3104 files = proc->files; 3105 if (files) 3106 proc->files = NULL; 3107 } 3108 3109 if (defer & BINDER_DEFERRED_FLUSH) 3110 binder_deferred_flush(proc); 3111 3112 if (defer & BINDER_DEFERRED_RELEASE) 3113 binder_deferred_release(proc); /* frees proc */ 3114 3115 mutex_unlock(&binder_lock); 3116 if (files) 3117 put_files_struct(files); 3118 } while (proc); 3119} 3120static DECLARE_WORK(binder_deferred_work, binder_deferred_func); 3121 3122static void 3123binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer) 3124{ 3125 mutex_lock(&binder_deferred_lock); 3126 proc->deferred_work |= defer; 3127 if (hlist_unhashed(&proc->deferred_work_node)) { 3128 hlist_add_head(&proc->deferred_work_node, 3129 &binder_deferred_list); 3130 queue_work(binder_deferred_workqueue, &binder_deferred_work); 3131 } 3132 mutex_unlock(&binder_deferred_lock); 3133} 3134 3135static void print_binder_transaction(struct seq_file *m, const char *prefix, 3136 struct binder_transaction *t) 3137{ 3138 seq_printf(m, 3139 "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d", 3140 prefix, t->debug_id, t, 3141 t->from ? t->from->proc->pid : 0, 3142 t->from ? t->from->pid : 0, 3143 t->to_proc ? t->to_proc->pid : 0, 3144 t->to_thread ? t->to_thread->pid : 0, 3145 t->code, t->flags, t->priority, t->need_reply); 3146 if (t->buffer == NULL) { 3147 seq_puts(m, " buffer free\n"); 3148 return; 3149 } 3150 if (t->buffer->target_node) 3151 seq_printf(m, " node %d", 3152 t->buffer->target_node->debug_id); 3153 seq_printf(m, " size %zd:%zd data %p\n", 3154 t->buffer->data_size, t->buffer->offsets_size, 3155 t->buffer->data); 3156} 3157 3158static void print_binder_buffer(struct seq_file *m, const char *prefix, 3159 struct binder_buffer *buffer) 3160{ 3161 seq_printf(m, "%s %d: %p size %zd:%zd %s\n", 3162 prefix, buffer->debug_id, buffer->data, 3163 buffer->data_size, buffer->offsets_size, 3164 buffer->transaction ? "active" : "delivered"); 3165} 3166 3167static void print_binder_work(struct seq_file *m, const char *prefix, 3168 const char *transaction_prefix, 3169 struct binder_work *w) 3170{ 3171 struct binder_node *node; 3172 struct binder_transaction *t; 3173 3174 switch (w->type) { 3175 case BINDER_WORK_TRANSACTION: 3176 t = container_of(w, struct binder_transaction, work); 3177 print_binder_transaction(m, transaction_prefix, t); 3178 break; 3179 case BINDER_WORK_TRANSACTION_COMPLETE: 3180 seq_printf(m, "%stransaction complete\n", prefix); 3181 break; 3182 case BINDER_WORK_NODE: 3183 node = container_of(w, struct binder_node, work); 3184 seq_printf(m, "%snode work %d: u%p c%p\n", 3185 prefix, node->debug_id, node->ptr, node->cookie); 3186 break; 3187 case BINDER_WORK_DEAD_BINDER: 3188 seq_printf(m, "%shas dead binder\n", prefix); 3189 break; 3190 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 3191 seq_printf(m, "%shas cleared dead binder\n", prefix); 3192 break; 3193 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: 3194 seq_printf(m, "%shas cleared death notification\n", prefix); 3195 break; 3196 default: 3197 seq_printf(m, "%sunknown work: type %d\n", prefix, w->type); 3198 break; 3199 } 3200} 3201 3202static void print_binder_thread(struct seq_file *m, 3203 struct binder_thread *thread, 3204 int print_always) 3205{ 3206 struct binder_transaction *t; 3207 struct binder_work *w; 3208 size_t start_pos = m->count; 3209 size_t header_pos; 3210 3211 seq_printf(m, " thread %d: l %02x\n", thread->pid, thread->looper); 3212 header_pos = m->count; 3213 t = thread->transaction_stack; 3214 while (t) { 3215 if (t->from == thread) { 3216 print_binder_transaction(m, 3217 " outgoing transaction", t); 3218 t = t->from_parent; 3219 } else if (t->to_thread == thread) { 3220 print_binder_transaction(m, 3221 " incoming transaction", t); 3222 t = t->to_parent; 3223 } else { 3224 print_binder_transaction(m, " bad transaction", t); 3225 t = NULL; 3226 } 3227 } 3228 list_for_each_entry(w, &thread->todo, entry) { 3229 print_binder_work(m, " ", " pending transaction", w); 3230 } 3231 if (!print_always && m->count == header_pos) 3232 m->count = start_pos; 3233} 3234 3235static void print_binder_node(struct seq_file *m, struct binder_node *node) 3236{ 3237 struct binder_ref *ref; 3238 struct hlist_node *pos; 3239 struct binder_work *w; 3240 int count; 3241 3242 count = 0; 3243 hlist_for_each_entry(ref, pos, &node->refs, node_entry) 3244 count++; 3245 3246 seq_printf(m, " node %d: u%p c%p hs %d hw %d ls %d lw %d is %d iw %d", 3247 node->debug_id, node->ptr, node->cookie, 3248 node->has_strong_ref, node->has_weak_ref, 3249 node->local_strong_refs, node->local_weak_refs, 3250 node->internal_strong_refs, count); 3251 if (count) { 3252 seq_puts(m, " proc"); 3253 hlist_for_each_entry(ref, pos, &node->refs, node_entry) 3254 seq_printf(m, " %d", ref->proc->pid); 3255 } 3256 seq_puts(m, "\n"); 3257 list_for_each_entry(w, &node->async_todo, entry) 3258 print_binder_work(m, " ", 3259 " pending async transaction", w); 3260} 3261 3262static void print_binder_ref(struct seq_file *m, struct binder_ref *ref) 3263{ 3264 seq_printf(m, " ref %d: desc %d %snode %d s %d w %d d %p\n", 3265 ref->debug_id, ref->desc, ref->node->proc ? "" : "dead ", 3266 ref->node->debug_id, ref->strong, ref->weak, ref->death); 3267} 3268 3269static void print_binder_proc(struct seq_file *m, 3270 struct binder_proc *proc, int print_all) 3271{ 3272 struct binder_work *w; 3273 struct rb_node *n; 3274 size_t start_pos = m->count; 3275 size_t header_pos; 3276 3277 seq_printf(m, "proc %d\n", proc->pid); 3278 header_pos = m->count; 3279 3280 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3281 print_binder_thread(m, rb_entry(n, struct binder_thread, 3282 rb_node), print_all); 3283 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) { 3284 struct binder_node *node = rb_entry(n, struct binder_node, 3285 rb_node); 3286 if (print_all || node->has_async_transaction) 3287 print_binder_node(m, node); 3288 } 3289 if (print_all) { 3290 for (n = rb_first(&proc->refs_by_desc); 3291 n != NULL; 3292 n = rb_next(n)) 3293 print_binder_ref(m, rb_entry(n, struct binder_ref, 3294 rb_node_desc)); 3295 } 3296 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3297 print_binder_buffer(m, " buffer", 3298 rb_entry(n, struct binder_buffer, rb_node)); 3299 list_for_each_entry(w, &proc->todo, entry) 3300 print_binder_work(m, " ", " pending transaction", w); 3301 list_for_each_entry(w, &proc->delivered_death, entry) { 3302 seq_puts(m, " has delivered dead binder\n"); 3303 break; 3304 } 3305 if (!print_all && m->count == header_pos) 3306 m->count = start_pos; 3307} 3308 3309static const char *binder_return_strings[] = { 3310 "BR_ERROR", 3311 "BR_OK", 3312 "BR_TRANSACTION", 3313 "BR_REPLY", 3314 "BR_ACQUIRE_RESULT", 3315 "BR_DEAD_REPLY", 3316 "BR_TRANSACTION_COMPLETE", 3317 "BR_INCREFS", 3318 "BR_ACQUIRE", 3319 "BR_RELEASE", 3320 "BR_DECREFS", 3321 "BR_ATTEMPT_ACQUIRE", 3322 "BR_NOOP", 3323 "BR_SPAWN_LOOPER", 3324 "BR_FINISHED", 3325 "BR_DEAD_BINDER", 3326 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 3327 "BR_FAILED_REPLY" 3328}; 3329 3330static const char *binder_command_strings[] = { 3331 "BC_TRANSACTION", 3332 "BC_REPLY", 3333 "BC_ACQUIRE_RESULT", 3334 "BC_FREE_BUFFER", 3335 "BC_INCREFS", 3336 "BC_ACQUIRE", 3337 "BC_RELEASE", 3338 "BC_DECREFS", 3339 "BC_INCREFS_DONE", 3340 "BC_ACQUIRE_DONE", 3341 "BC_ATTEMPT_ACQUIRE", 3342 "BC_REGISTER_LOOPER", 3343 "BC_ENTER_LOOPER", 3344 "BC_EXIT_LOOPER", 3345 "BC_REQUEST_DEATH_NOTIFICATION", 3346 "BC_CLEAR_DEATH_NOTIFICATION", 3347 "BC_DEAD_BINDER_DONE" 3348}; 3349 3350static const char *binder_objstat_strings[] = { 3351 "proc", 3352 "thread", 3353 "node", 3354 "ref", 3355 "death", 3356 "transaction", 3357 "transaction_complete" 3358}; 3359 3360static void print_binder_stats(struct seq_file *m, const char *prefix, 3361 struct binder_stats *stats) 3362{ 3363 int i; 3364 3365 BUILD_BUG_ON(ARRAY_SIZE(stats->bc) != 3366 ARRAY_SIZE(binder_command_strings)); 3367 for (i = 0; i < ARRAY_SIZE(stats->bc); i++) { 3368 if (stats->bc[i]) 3369 seq_printf(m, "%s%s: %d\n", prefix, 3370 binder_command_strings[i], stats->bc[i]); 3371 } 3372 3373 BUILD_BUG_ON(ARRAY_SIZE(stats->br) != 3374 ARRAY_SIZE(binder_return_strings)); 3375 for (i = 0; i < ARRAY_SIZE(stats->br); i++) { 3376 if (stats->br[i]) 3377 seq_printf(m, "%s%s: %d\n", prefix, 3378 binder_return_strings[i], stats->br[i]); 3379 } 3380 3381 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 3382 ARRAY_SIZE(binder_objstat_strings)); 3383 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 3384 ARRAY_SIZE(stats->obj_deleted)); 3385 for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) { 3386 if (stats->obj_created[i] || stats->obj_deleted[i]) 3387 seq_printf(m, "%s%s: active %d total %d\n", prefix, 3388 binder_objstat_strings[i], 3389 stats->obj_created[i] - stats->obj_deleted[i], 3390 stats->obj_created[i]); 3391 } 3392} 3393 3394static void print_binder_proc_stats(struct seq_file *m, 3395 struct binder_proc *proc) 3396{ 3397 struct binder_work *w; 3398 struct rb_node *n; 3399 int count, strong, weak; 3400 3401 seq_printf(m, "proc %d\n", proc->pid); 3402 count = 0; 3403 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3404 count++; 3405 seq_printf(m, " threads: %d\n", count); 3406 seq_printf(m, " requested threads: %d+%d/%d\n" 3407 " ready threads %d\n" 3408 " free async space %zd\n", proc->requested_threads, 3409 proc->requested_threads_started, proc->max_threads, 3410 proc->ready_threads, proc->free_async_space); 3411 count = 0; 3412 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) 3413 count++; 3414 seq_printf(m, " nodes: %d\n", count); 3415 count = 0; 3416 strong = 0; 3417 weak = 0; 3418 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 3419 struct binder_ref *ref = rb_entry(n, struct binder_ref, 3420 rb_node_desc); 3421 count++; 3422 strong += ref->strong; 3423 weak += ref->weak; 3424 } 3425 seq_printf(m, " refs: %d s %d w %d\n", count, strong, weak); 3426 3427 count = 0; 3428 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3429 count++; 3430 seq_printf(m, " buffers: %d\n", count); 3431 3432 count = 0; 3433 list_for_each_entry(w, &proc->todo, entry) { 3434 switch (w->type) { 3435 case BINDER_WORK_TRANSACTION: 3436 count++; 3437 break; 3438 default: 3439 break; 3440 } 3441 } 3442 seq_printf(m, " pending transactions: %d\n", count); 3443 3444 print_binder_stats(m, " ", &proc->stats); 3445} 3446 3447 3448static int binder_state_show(struct seq_file *m, void *unused) 3449{ 3450 struct binder_proc *proc; 3451 struct hlist_node *pos; 3452 struct binder_node *node; 3453 int do_lock = !binder_debug_no_lock; 3454 3455 if (do_lock) 3456 mutex_lock(&binder_lock); 3457 3458 seq_puts(m, "binder state:\n"); 3459 3460 if (!hlist_empty(&binder_dead_nodes)) 3461 seq_puts(m, "dead nodes:\n"); 3462 hlist_for_each_entry(node, pos, &binder_dead_nodes, dead_node) 3463 print_binder_node(m, node); 3464 3465 hlist_for_each_entry(proc, pos, &binder_procs, proc_node) 3466 print_binder_proc(m, proc, 1); 3467 if (do_lock) 3468 mutex_unlock(&binder_lock); 3469 return 0; 3470} 3471 3472static int binder_stats_show(struct seq_file *m, void *unused) 3473{ 3474 struct binder_proc *proc; 3475 struct hlist_node *pos; 3476 int do_lock = !binder_debug_no_lock; 3477 3478 if (do_lock) 3479 mutex_lock(&binder_lock); 3480 3481 seq_puts(m, "binder stats:\n"); 3482 3483 print_binder_stats(m, "", &binder_stats); 3484 3485 hlist_for_each_entry(proc, pos, &binder_procs, proc_node) 3486 print_binder_proc_stats(m, proc); 3487 if (do_lock) 3488 mutex_unlock(&binder_lock); 3489 return 0; 3490} 3491 3492static int binder_transactions_show(struct seq_file *m, void *unused) 3493{ 3494 struct binder_proc *proc; 3495 struct hlist_node *pos; 3496 int do_lock = !binder_debug_no_lock; 3497 3498 if (do_lock) 3499 mutex_lock(&binder_lock); 3500 3501 seq_puts(m, "binder transactions:\n"); 3502 hlist_for_each_entry(proc, pos, &binder_procs, proc_node) 3503 print_binder_proc(m, proc, 0); 3504 if (do_lock) 3505 mutex_unlock(&binder_lock); 3506 return 0; 3507} 3508 3509static int binder_proc_show(struct seq_file *m, void *unused) 3510{ 3511 struct binder_proc *proc = m->private; 3512 int do_lock = !binder_debug_no_lock; 3513 3514 if (do_lock) 3515 mutex_lock(&binder_lock); 3516 seq_puts(m, "binder proc state:\n"); 3517 print_binder_proc(m, proc, 1); 3518 if (do_lock) 3519 mutex_unlock(&binder_lock); 3520 return 0; 3521} 3522 3523static void print_binder_transaction_log_entry(struct seq_file *m, 3524 struct binder_transaction_log_entry *e) 3525{ 3526 seq_printf(m, 3527 "%d: %s from %d:%d to %d:%d node %d handle %d size %d:%d\n", 3528 e->debug_id, (e->call_type == 2) ? "reply" : 3529 ((e->call_type == 1) ? "async" : "call "), e->from_proc, 3530 e->from_thread, e->to_proc, e->to_thread, e->to_node, 3531 e->target_handle, e->data_size, e->offsets_size); 3532} 3533 3534static int binder_transaction_log_show(struct seq_file *m, void *unused) 3535{ 3536 struct binder_transaction_log *log = m->private; 3537 int i; 3538 3539 if (log->full) { 3540 for (i = log->next; i < ARRAY_SIZE(log->entry); i++) 3541 print_binder_transaction_log_entry(m, &log->entry[i]); 3542 } 3543 for (i = 0; i < log->next; i++) 3544 print_binder_transaction_log_entry(m, &log->entry[i]); 3545 return 0; 3546} 3547 3548static const struct file_operations binder_fops = { 3549 .owner = THIS_MODULE, 3550 .poll = binder_poll, 3551 .unlocked_ioctl = binder_ioctl, 3552 .mmap = binder_mmap, 3553 .open = binder_open, 3554 .flush = binder_flush, 3555 .release = binder_release, 3556}; 3557 3558static struct miscdevice binder_miscdev = { 3559 .minor = MISC_DYNAMIC_MINOR, 3560 .name = "binder", 3561 .fops = &binder_fops 3562}; 3563 3564BINDER_DEBUG_ENTRY(state); 3565BINDER_DEBUG_ENTRY(stats); 3566BINDER_DEBUG_ENTRY(transactions); 3567BINDER_DEBUG_ENTRY(transaction_log); 3568 3569static int __init binder_init(void) 3570{ 3571 int ret; 3572 3573 binder_deferred_workqueue = create_singlethread_workqueue("binder"); 3574 if (!binder_deferred_workqueue) 3575 return -ENOMEM; 3576 3577 binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL); 3578 if (binder_debugfs_dir_entry_root) 3579 binder_debugfs_dir_entry_proc = debugfs_create_dir("proc", 3580 binder_debugfs_dir_entry_root); 3581 ret = misc_register(&binder_miscdev); 3582 if (binder_debugfs_dir_entry_root) { 3583 debugfs_create_file("state", 3584 S_IRUGO, 3585 binder_debugfs_dir_entry_root, 3586 NULL, 3587 &binder_state_fops); 3588 debugfs_create_file("stats", 3589 S_IRUGO, 3590 binder_debugfs_dir_entry_root, 3591 NULL, 3592 &binder_stats_fops); 3593 debugfs_create_file("transactions", 3594 S_IRUGO, 3595 binder_debugfs_dir_entry_root, 3596 NULL, 3597 &binder_transactions_fops); 3598 debugfs_create_file("transaction_log", 3599 S_IRUGO, 3600 binder_debugfs_dir_entry_root, 3601 &binder_transaction_log, 3602 &binder_transaction_log_fops); 3603 debugfs_create_file("failed_transaction_log", 3604 S_IRUGO, 3605 binder_debugfs_dir_entry_root, 3606 &binder_transaction_log_failed, 3607 &binder_transaction_log_fops); 3608 } 3609 return ret; 3610} 3611 3612device_initcall(binder_init); 3613 3614MODULE_LICENSE("GPL v2"); 3615