binder.c revision b67bfe0d42cac56c512dd5da4b1b347a23f4b70a
1/* binder.c 2 * 3 * Android IPC Subsystem 4 * 5 * Copyright (C) 2007-2008 Google, Inc. 6 * 7 * This software is licensed under the terms of the GNU General Public 8 * License version 2, as published by the Free Software Foundation, and 9 * may be copied, distributed, and modified under those terms. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 */ 17 18#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 19 20#include <asm/cacheflush.h> 21#include <linux/fdtable.h> 22#include <linux/file.h> 23#include <linux/fs.h> 24#include <linux/list.h> 25#include <linux/miscdevice.h> 26#include <linux/mm.h> 27#include <linux/module.h> 28#include <linux/mutex.h> 29#include <linux/nsproxy.h> 30#include <linux/poll.h> 31#include <linux/debugfs.h> 32#include <linux/rbtree.h> 33#include <linux/sched.h> 34#include <linux/seq_file.h> 35#include <linux/uaccess.h> 36#include <linux/vmalloc.h> 37#include <linux/slab.h> 38#include <linux/pid_namespace.h> 39 40#include "binder.h" 41#include "binder_trace.h" 42 43static DEFINE_MUTEX(binder_main_lock); 44static DEFINE_MUTEX(binder_deferred_lock); 45static DEFINE_MUTEX(binder_mmap_lock); 46 47static HLIST_HEAD(binder_procs); 48static HLIST_HEAD(binder_deferred_list); 49static HLIST_HEAD(binder_dead_nodes); 50 51static struct dentry *binder_debugfs_dir_entry_root; 52static struct dentry *binder_debugfs_dir_entry_proc; 53static struct binder_node *binder_context_mgr_node; 54static kuid_t binder_context_mgr_uid = INVALID_UID; 55static int binder_last_id; 56static struct workqueue_struct *binder_deferred_workqueue; 57 58#define BINDER_DEBUG_ENTRY(name) \ 59static int binder_##name##_open(struct inode *inode, struct file *file) \ 60{ \ 61 return single_open(file, binder_##name##_show, inode->i_private); \ 62} \ 63\ 64static const struct file_operations binder_##name##_fops = { \ 65 .owner = THIS_MODULE, \ 66 .open = binder_##name##_open, \ 67 .read = seq_read, \ 68 .llseek = seq_lseek, \ 69 .release = single_release, \ 70} 71 72static int binder_proc_show(struct seq_file *m, void *unused); 73BINDER_DEBUG_ENTRY(proc); 74 75/* This is only defined in include/asm-arm/sizes.h */ 76#ifndef SZ_1K 77#define SZ_1K 0x400 78#endif 79 80#ifndef SZ_4M 81#define SZ_4M 0x400000 82#endif 83 84#define FORBIDDEN_MMAP_FLAGS (VM_WRITE) 85 86#define BINDER_SMALL_BUF_SIZE (PAGE_SIZE * 64) 87 88enum { 89 BINDER_DEBUG_USER_ERROR = 1U << 0, 90 BINDER_DEBUG_FAILED_TRANSACTION = 1U << 1, 91 BINDER_DEBUG_DEAD_TRANSACTION = 1U << 2, 92 BINDER_DEBUG_OPEN_CLOSE = 1U << 3, 93 BINDER_DEBUG_DEAD_BINDER = 1U << 4, 94 BINDER_DEBUG_DEATH_NOTIFICATION = 1U << 5, 95 BINDER_DEBUG_READ_WRITE = 1U << 6, 96 BINDER_DEBUG_USER_REFS = 1U << 7, 97 BINDER_DEBUG_THREADS = 1U << 8, 98 BINDER_DEBUG_TRANSACTION = 1U << 9, 99 BINDER_DEBUG_TRANSACTION_COMPLETE = 1U << 10, 100 BINDER_DEBUG_FREE_BUFFER = 1U << 11, 101 BINDER_DEBUG_INTERNAL_REFS = 1U << 12, 102 BINDER_DEBUG_BUFFER_ALLOC = 1U << 13, 103 BINDER_DEBUG_PRIORITY_CAP = 1U << 14, 104 BINDER_DEBUG_BUFFER_ALLOC_ASYNC = 1U << 15, 105}; 106static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR | 107 BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION; 108module_param_named(debug_mask, binder_debug_mask, uint, S_IWUSR | S_IRUGO); 109 110static bool binder_debug_no_lock; 111module_param_named(proc_no_lock, binder_debug_no_lock, bool, S_IWUSR | S_IRUGO); 112 113static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait); 114static int binder_stop_on_user_error; 115 116static int binder_set_stop_on_user_error(const char *val, 117 struct kernel_param *kp) 118{ 119 int ret; 120 ret = param_set_int(val, kp); 121 if (binder_stop_on_user_error < 2) 122 wake_up(&binder_user_error_wait); 123 return ret; 124} 125module_param_call(stop_on_user_error, binder_set_stop_on_user_error, 126 param_get_int, &binder_stop_on_user_error, S_IWUSR | S_IRUGO); 127 128#define binder_debug(mask, x...) \ 129 do { \ 130 if (binder_debug_mask & mask) \ 131 pr_info(x); \ 132 } while (0) 133 134#define binder_user_error(x...) \ 135 do { \ 136 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \ 137 pr_info(x); \ 138 if (binder_stop_on_user_error) \ 139 binder_stop_on_user_error = 2; \ 140 } while (0) 141 142enum binder_stat_types { 143 BINDER_STAT_PROC, 144 BINDER_STAT_THREAD, 145 BINDER_STAT_NODE, 146 BINDER_STAT_REF, 147 BINDER_STAT_DEATH, 148 BINDER_STAT_TRANSACTION, 149 BINDER_STAT_TRANSACTION_COMPLETE, 150 BINDER_STAT_COUNT 151}; 152 153struct binder_stats { 154 int br[_IOC_NR(BR_FAILED_REPLY) + 1]; 155 int bc[_IOC_NR(BC_DEAD_BINDER_DONE) + 1]; 156 int obj_created[BINDER_STAT_COUNT]; 157 int obj_deleted[BINDER_STAT_COUNT]; 158}; 159 160static struct binder_stats binder_stats; 161 162static inline void binder_stats_deleted(enum binder_stat_types type) 163{ 164 binder_stats.obj_deleted[type]++; 165} 166 167static inline void binder_stats_created(enum binder_stat_types type) 168{ 169 binder_stats.obj_created[type]++; 170} 171 172struct binder_transaction_log_entry { 173 int debug_id; 174 int call_type; 175 int from_proc; 176 int from_thread; 177 int target_handle; 178 int to_proc; 179 int to_thread; 180 int to_node; 181 int data_size; 182 int offsets_size; 183}; 184struct binder_transaction_log { 185 int next; 186 int full; 187 struct binder_transaction_log_entry entry[32]; 188}; 189static struct binder_transaction_log binder_transaction_log; 190static struct binder_transaction_log binder_transaction_log_failed; 191 192static struct binder_transaction_log_entry *binder_transaction_log_add( 193 struct binder_transaction_log *log) 194{ 195 struct binder_transaction_log_entry *e; 196 e = &log->entry[log->next]; 197 memset(e, 0, sizeof(*e)); 198 log->next++; 199 if (log->next == ARRAY_SIZE(log->entry)) { 200 log->next = 0; 201 log->full = 1; 202 } 203 return e; 204} 205 206struct binder_work { 207 struct list_head entry; 208 enum { 209 BINDER_WORK_TRANSACTION = 1, 210 BINDER_WORK_TRANSACTION_COMPLETE, 211 BINDER_WORK_NODE, 212 BINDER_WORK_DEAD_BINDER, 213 BINDER_WORK_DEAD_BINDER_AND_CLEAR, 214 BINDER_WORK_CLEAR_DEATH_NOTIFICATION, 215 } type; 216}; 217 218struct binder_node { 219 int debug_id; 220 struct binder_work work; 221 union { 222 struct rb_node rb_node; 223 struct hlist_node dead_node; 224 }; 225 struct binder_proc *proc; 226 struct hlist_head refs; 227 int internal_strong_refs; 228 int local_weak_refs; 229 int local_strong_refs; 230 void __user *ptr; 231 void __user *cookie; 232 unsigned has_strong_ref:1; 233 unsigned pending_strong_ref:1; 234 unsigned has_weak_ref:1; 235 unsigned pending_weak_ref:1; 236 unsigned has_async_transaction:1; 237 unsigned accept_fds:1; 238 unsigned min_priority:8; 239 struct list_head async_todo; 240}; 241 242struct binder_ref_death { 243 struct binder_work work; 244 void __user *cookie; 245}; 246 247struct binder_ref { 248 /* Lookups needed: */ 249 /* node + proc => ref (transaction) */ 250 /* desc + proc => ref (transaction, inc/dec ref) */ 251 /* node => refs + procs (proc exit) */ 252 int debug_id; 253 struct rb_node rb_node_desc; 254 struct rb_node rb_node_node; 255 struct hlist_node node_entry; 256 struct binder_proc *proc; 257 struct binder_node *node; 258 uint32_t desc; 259 int strong; 260 int weak; 261 struct binder_ref_death *death; 262}; 263 264struct binder_buffer { 265 struct list_head entry; /* free and allocated entries by address */ 266 struct rb_node rb_node; /* free entry by size or allocated entry */ 267 /* by address */ 268 unsigned free:1; 269 unsigned allow_user_free:1; 270 unsigned async_transaction:1; 271 unsigned debug_id:29; 272 273 struct binder_transaction *transaction; 274 275 struct binder_node *target_node; 276 size_t data_size; 277 size_t offsets_size; 278 uint8_t data[0]; 279}; 280 281enum binder_deferred_state { 282 BINDER_DEFERRED_PUT_FILES = 0x01, 283 BINDER_DEFERRED_FLUSH = 0x02, 284 BINDER_DEFERRED_RELEASE = 0x04, 285}; 286 287struct binder_proc { 288 struct hlist_node proc_node; 289 struct rb_root threads; 290 struct rb_root nodes; 291 struct rb_root refs_by_desc; 292 struct rb_root refs_by_node; 293 int pid; 294 struct vm_area_struct *vma; 295 struct mm_struct *vma_vm_mm; 296 struct task_struct *tsk; 297 struct files_struct *files; 298 struct hlist_node deferred_work_node; 299 int deferred_work; 300 void *buffer; 301 ptrdiff_t user_buffer_offset; 302 303 struct list_head buffers; 304 struct rb_root free_buffers; 305 struct rb_root allocated_buffers; 306 size_t free_async_space; 307 308 struct page **pages; 309 size_t buffer_size; 310 uint32_t buffer_free; 311 struct list_head todo; 312 wait_queue_head_t wait; 313 struct binder_stats stats; 314 struct list_head delivered_death; 315 int max_threads; 316 int requested_threads; 317 int requested_threads_started; 318 int ready_threads; 319 long default_priority; 320 struct dentry *debugfs_entry; 321}; 322 323enum { 324 BINDER_LOOPER_STATE_REGISTERED = 0x01, 325 BINDER_LOOPER_STATE_ENTERED = 0x02, 326 BINDER_LOOPER_STATE_EXITED = 0x04, 327 BINDER_LOOPER_STATE_INVALID = 0x08, 328 BINDER_LOOPER_STATE_WAITING = 0x10, 329 BINDER_LOOPER_STATE_NEED_RETURN = 0x20 330}; 331 332struct binder_thread { 333 struct binder_proc *proc; 334 struct rb_node rb_node; 335 int pid; 336 int looper; 337 struct binder_transaction *transaction_stack; 338 struct list_head todo; 339 uint32_t return_error; /* Write failed, return error code in read buf */ 340 uint32_t return_error2; /* Write failed, return error code in read */ 341 /* buffer. Used when sending a reply to a dead process that */ 342 /* we are also waiting on */ 343 wait_queue_head_t wait; 344 struct binder_stats stats; 345}; 346 347struct binder_transaction { 348 int debug_id; 349 struct binder_work work; 350 struct binder_thread *from; 351 struct binder_transaction *from_parent; 352 struct binder_proc *to_proc; 353 struct binder_thread *to_thread; 354 struct binder_transaction *to_parent; 355 unsigned need_reply:1; 356 /* unsigned is_dead:1; */ /* not used at the moment */ 357 358 struct binder_buffer *buffer; 359 unsigned int code; 360 unsigned int flags; 361 long priority; 362 long saved_priority; 363 kuid_t sender_euid; 364}; 365 366static void 367binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer); 368 369static int task_get_unused_fd_flags(struct binder_proc *proc, int flags) 370{ 371 struct files_struct *files = proc->files; 372 unsigned long rlim_cur; 373 unsigned long irqs; 374 375 if (files == NULL) 376 return -ESRCH; 377 378 if (!lock_task_sighand(proc->tsk, &irqs)) 379 return -EMFILE; 380 381 rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE); 382 unlock_task_sighand(proc->tsk, &irqs); 383 384 return __alloc_fd(files, 0, rlim_cur, flags); 385} 386 387/* 388 * copied from fd_install 389 */ 390static void task_fd_install( 391 struct binder_proc *proc, unsigned int fd, struct file *file) 392{ 393 if (proc->files) 394 __fd_install(proc->files, fd, file); 395} 396 397/* 398 * copied from sys_close 399 */ 400static long task_close_fd(struct binder_proc *proc, unsigned int fd) 401{ 402 int retval; 403 404 if (proc->files == NULL) 405 return -ESRCH; 406 407 retval = __close_fd(proc->files, fd); 408 /* can't restart close syscall because file table entry was cleared */ 409 if (unlikely(retval == -ERESTARTSYS || 410 retval == -ERESTARTNOINTR || 411 retval == -ERESTARTNOHAND || 412 retval == -ERESTART_RESTARTBLOCK)) 413 retval = -EINTR; 414 415 return retval; 416} 417 418static inline void binder_lock(const char *tag) 419{ 420 trace_binder_lock(tag); 421 mutex_lock(&binder_main_lock); 422 trace_binder_locked(tag); 423} 424 425static inline void binder_unlock(const char *tag) 426{ 427 trace_binder_unlock(tag); 428 mutex_unlock(&binder_main_lock); 429} 430 431static void binder_set_nice(long nice) 432{ 433 long min_nice; 434 if (can_nice(current, nice)) { 435 set_user_nice(current, nice); 436 return; 437 } 438 min_nice = 20 - current->signal->rlim[RLIMIT_NICE].rlim_cur; 439 binder_debug(BINDER_DEBUG_PRIORITY_CAP, 440 "%d: nice value %ld not allowed use %ld instead\n", 441 current->pid, nice, min_nice); 442 set_user_nice(current, min_nice); 443 if (min_nice < 20) 444 return; 445 binder_user_error("%d RLIMIT_NICE not set\n", current->pid); 446} 447 448static size_t binder_buffer_size(struct binder_proc *proc, 449 struct binder_buffer *buffer) 450{ 451 if (list_is_last(&buffer->entry, &proc->buffers)) 452 return proc->buffer + proc->buffer_size - (void *)buffer->data; 453 else 454 return (size_t)list_entry(buffer->entry.next, 455 struct binder_buffer, entry) - (size_t)buffer->data; 456} 457 458static void binder_insert_free_buffer(struct binder_proc *proc, 459 struct binder_buffer *new_buffer) 460{ 461 struct rb_node **p = &proc->free_buffers.rb_node; 462 struct rb_node *parent = NULL; 463 struct binder_buffer *buffer; 464 size_t buffer_size; 465 size_t new_buffer_size; 466 467 BUG_ON(!new_buffer->free); 468 469 new_buffer_size = binder_buffer_size(proc, new_buffer); 470 471 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 472 "%d: add free buffer, size %zd, at %p\n", 473 proc->pid, new_buffer_size, new_buffer); 474 475 while (*p) { 476 parent = *p; 477 buffer = rb_entry(parent, struct binder_buffer, rb_node); 478 BUG_ON(!buffer->free); 479 480 buffer_size = binder_buffer_size(proc, buffer); 481 482 if (new_buffer_size < buffer_size) 483 p = &parent->rb_left; 484 else 485 p = &parent->rb_right; 486 } 487 rb_link_node(&new_buffer->rb_node, parent, p); 488 rb_insert_color(&new_buffer->rb_node, &proc->free_buffers); 489} 490 491static void binder_insert_allocated_buffer(struct binder_proc *proc, 492 struct binder_buffer *new_buffer) 493{ 494 struct rb_node **p = &proc->allocated_buffers.rb_node; 495 struct rb_node *parent = NULL; 496 struct binder_buffer *buffer; 497 498 BUG_ON(new_buffer->free); 499 500 while (*p) { 501 parent = *p; 502 buffer = rb_entry(parent, struct binder_buffer, rb_node); 503 BUG_ON(buffer->free); 504 505 if (new_buffer < buffer) 506 p = &parent->rb_left; 507 else if (new_buffer > buffer) 508 p = &parent->rb_right; 509 else 510 BUG(); 511 } 512 rb_link_node(&new_buffer->rb_node, parent, p); 513 rb_insert_color(&new_buffer->rb_node, &proc->allocated_buffers); 514} 515 516static struct binder_buffer *binder_buffer_lookup(struct binder_proc *proc, 517 void __user *user_ptr) 518{ 519 struct rb_node *n = proc->allocated_buffers.rb_node; 520 struct binder_buffer *buffer; 521 struct binder_buffer *kern_ptr; 522 523 kern_ptr = user_ptr - proc->user_buffer_offset 524 - offsetof(struct binder_buffer, data); 525 526 while (n) { 527 buffer = rb_entry(n, struct binder_buffer, rb_node); 528 BUG_ON(buffer->free); 529 530 if (kern_ptr < buffer) 531 n = n->rb_left; 532 else if (kern_ptr > buffer) 533 n = n->rb_right; 534 else 535 return buffer; 536 } 537 return NULL; 538} 539 540static int binder_update_page_range(struct binder_proc *proc, int allocate, 541 void *start, void *end, 542 struct vm_area_struct *vma) 543{ 544 void *page_addr; 545 unsigned long user_page_addr; 546 struct vm_struct tmp_area; 547 struct page **page; 548 struct mm_struct *mm; 549 550 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 551 "%d: %s pages %p-%p\n", proc->pid, 552 allocate ? "allocate" : "free", start, end); 553 554 if (end <= start) 555 return 0; 556 557 trace_binder_update_page_range(proc, allocate, start, end); 558 559 if (vma) 560 mm = NULL; 561 else 562 mm = get_task_mm(proc->tsk); 563 564 if (mm) { 565 down_write(&mm->mmap_sem); 566 vma = proc->vma; 567 if (vma && mm != proc->vma_vm_mm) { 568 pr_err("%d: vma mm and task mm mismatch\n", 569 proc->pid); 570 vma = NULL; 571 } 572 } 573 574 if (allocate == 0) 575 goto free_range; 576 577 if (vma == NULL) { 578 pr_err("%d: binder_alloc_buf failed to map pages in userspace, no vma\n", 579 proc->pid); 580 goto err_no_vma; 581 } 582 583 for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) { 584 int ret; 585 struct page **page_array_ptr; 586 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 587 588 BUG_ON(*page); 589 *page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO); 590 if (*page == NULL) { 591 pr_err("%d: binder_alloc_buf failed for page at %p\n", 592 proc->pid, page_addr); 593 goto err_alloc_page_failed; 594 } 595 tmp_area.addr = page_addr; 596 tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */; 597 page_array_ptr = page; 598 ret = map_vm_area(&tmp_area, PAGE_KERNEL, &page_array_ptr); 599 if (ret) { 600 pr_err("%d: binder_alloc_buf failed to map page at %p in kernel\n", 601 proc->pid, page_addr); 602 goto err_map_kernel_failed; 603 } 604 user_page_addr = 605 (uintptr_t)page_addr + proc->user_buffer_offset; 606 ret = vm_insert_page(vma, user_page_addr, page[0]); 607 if (ret) { 608 pr_err("%d: binder_alloc_buf failed to map page at %lx in userspace\n", 609 proc->pid, user_page_addr); 610 goto err_vm_insert_page_failed; 611 } 612 /* vm_insert_page does not seem to increment the refcount */ 613 } 614 if (mm) { 615 up_write(&mm->mmap_sem); 616 mmput(mm); 617 } 618 return 0; 619 620free_range: 621 for (page_addr = end - PAGE_SIZE; page_addr >= start; 622 page_addr -= PAGE_SIZE) { 623 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 624 if (vma) 625 zap_page_range(vma, (uintptr_t)page_addr + 626 proc->user_buffer_offset, PAGE_SIZE, NULL); 627err_vm_insert_page_failed: 628 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE); 629err_map_kernel_failed: 630 __free_page(*page); 631 *page = NULL; 632err_alloc_page_failed: 633 ; 634 } 635err_no_vma: 636 if (mm) { 637 up_write(&mm->mmap_sem); 638 mmput(mm); 639 } 640 return -ENOMEM; 641} 642 643static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc, 644 size_t data_size, 645 size_t offsets_size, int is_async) 646{ 647 struct rb_node *n = proc->free_buffers.rb_node; 648 struct binder_buffer *buffer; 649 size_t buffer_size; 650 struct rb_node *best_fit = NULL; 651 void *has_page_addr; 652 void *end_page_addr; 653 size_t size; 654 655 if (proc->vma == NULL) { 656 pr_err("%d: binder_alloc_buf, no vma\n", 657 proc->pid); 658 return NULL; 659 } 660 661 size = ALIGN(data_size, sizeof(void *)) + 662 ALIGN(offsets_size, sizeof(void *)); 663 664 if (size < data_size || size < offsets_size) { 665 binder_user_error("%d: got transaction with invalid size %zd-%zd\n", 666 proc->pid, data_size, offsets_size); 667 return NULL; 668 } 669 670 if (is_async && 671 proc->free_async_space < size + sizeof(struct binder_buffer)) { 672 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 673 "%d: binder_alloc_buf size %zd failed, no async space left\n", 674 proc->pid, size); 675 return NULL; 676 } 677 678 while (n) { 679 buffer = rb_entry(n, struct binder_buffer, rb_node); 680 BUG_ON(!buffer->free); 681 buffer_size = binder_buffer_size(proc, buffer); 682 683 if (size < buffer_size) { 684 best_fit = n; 685 n = n->rb_left; 686 } else if (size > buffer_size) 687 n = n->rb_right; 688 else { 689 best_fit = n; 690 break; 691 } 692 } 693 if (best_fit == NULL) { 694 pr_err("%d: binder_alloc_buf size %zd failed, no address space\n", 695 proc->pid, size); 696 return NULL; 697 } 698 if (n == NULL) { 699 buffer = rb_entry(best_fit, struct binder_buffer, rb_node); 700 buffer_size = binder_buffer_size(proc, buffer); 701 } 702 703 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 704 "%d: binder_alloc_buf size %zd got buffer %p size %zd\n", 705 proc->pid, size, buffer, buffer_size); 706 707 has_page_addr = 708 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK); 709 if (n == NULL) { 710 if (size + sizeof(struct binder_buffer) + 4 >= buffer_size) 711 buffer_size = size; /* no room for other buffers */ 712 else 713 buffer_size = size + sizeof(struct binder_buffer); 714 } 715 end_page_addr = 716 (void *)PAGE_ALIGN((uintptr_t)buffer->data + buffer_size); 717 if (end_page_addr > has_page_addr) 718 end_page_addr = has_page_addr; 719 if (binder_update_page_range(proc, 1, 720 (void *)PAGE_ALIGN((uintptr_t)buffer->data), end_page_addr, NULL)) 721 return NULL; 722 723 rb_erase(best_fit, &proc->free_buffers); 724 buffer->free = 0; 725 binder_insert_allocated_buffer(proc, buffer); 726 if (buffer_size != size) { 727 struct binder_buffer *new_buffer = (void *)buffer->data + size; 728 list_add(&new_buffer->entry, &buffer->entry); 729 new_buffer->free = 1; 730 binder_insert_free_buffer(proc, new_buffer); 731 } 732 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 733 "%d: binder_alloc_buf size %zd got %p\n", 734 proc->pid, size, buffer); 735 buffer->data_size = data_size; 736 buffer->offsets_size = offsets_size; 737 buffer->async_transaction = is_async; 738 if (is_async) { 739 proc->free_async_space -= size + sizeof(struct binder_buffer); 740 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 741 "%d: binder_alloc_buf size %zd async free %zd\n", 742 proc->pid, size, proc->free_async_space); 743 } 744 745 return buffer; 746} 747 748static void *buffer_start_page(struct binder_buffer *buffer) 749{ 750 return (void *)((uintptr_t)buffer & PAGE_MASK); 751} 752 753static void *buffer_end_page(struct binder_buffer *buffer) 754{ 755 return (void *)(((uintptr_t)(buffer + 1) - 1) & PAGE_MASK); 756} 757 758static void binder_delete_free_buffer(struct binder_proc *proc, 759 struct binder_buffer *buffer) 760{ 761 struct binder_buffer *prev, *next = NULL; 762 int free_page_end = 1; 763 int free_page_start = 1; 764 765 BUG_ON(proc->buffers.next == &buffer->entry); 766 prev = list_entry(buffer->entry.prev, struct binder_buffer, entry); 767 BUG_ON(!prev->free); 768 if (buffer_end_page(prev) == buffer_start_page(buffer)) { 769 free_page_start = 0; 770 if (buffer_end_page(prev) == buffer_end_page(buffer)) 771 free_page_end = 0; 772 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 773 "%d: merge free, buffer %p share page with %p\n", 774 proc->pid, buffer, prev); 775 } 776 777 if (!list_is_last(&buffer->entry, &proc->buffers)) { 778 next = list_entry(buffer->entry.next, 779 struct binder_buffer, entry); 780 if (buffer_start_page(next) == buffer_end_page(buffer)) { 781 free_page_end = 0; 782 if (buffer_start_page(next) == 783 buffer_start_page(buffer)) 784 free_page_start = 0; 785 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 786 "%d: merge free, buffer %p share page with %p\n", 787 proc->pid, buffer, prev); 788 } 789 } 790 list_del(&buffer->entry); 791 if (free_page_start || free_page_end) { 792 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 793 "%d: merge free, buffer %p do not share page%s%s with with %p or %p\n", 794 proc->pid, buffer, free_page_start ? "" : " end", 795 free_page_end ? "" : " start", prev, next); 796 binder_update_page_range(proc, 0, free_page_start ? 797 buffer_start_page(buffer) : buffer_end_page(buffer), 798 (free_page_end ? buffer_end_page(buffer) : 799 buffer_start_page(buffer)) + PAGE_SIZE, NULL); 800 } 801} 802 803static void binder_free_buf(struct binder_proc *proc, 804 struct binder_buffer *buffer) 805{ 806 size_t size, buffer_size; 807 808 buffer_size = binder_buffer_size(proc, buffer); 809 810 size = ALIGN(buffer->data_size, sizeof(void *)) + 811 ALIGN(buffer->offsets_size, sizeof(void *)); 812 813 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 814 "%d: binder_free_buf %p size %zd buffer_size %zd\n", 815 proc->pid, buffer, size, buffer_size); 816 817 BUG_ON(buffer->free); 818 BUG_ON(size > buffer_size); 819 BUG_ON(buffer->transaction != NULL); 820 BUG_ON((void *)buffer < proc->buffer); 821 BUG_ON((void *)buffer > proc->buffer + proc->buffer_size); 822 823 if (buffer->async_transaction) { 824 proc->free_async_space += size + sizeof(struct binder_buffer); 825 826 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 827 "%d: binder_free_buf size %zd async free %zd\n", 828 proc->pid, size, proc->free_async_space); 829 } 830 831 binder_update_page_range(proc, 0, 832 (void *)PAGE_ALIGN((uintptr_t)buffer->data), 833 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK), 834 NULL); 835 rb_erase(&buffer->rb_node, &proc->allocated_buffers); 836 buffer->free = 1; 837 if (!list_is_last(&buffer->entry, &proc->buffers)) { 838 struct binder_buffer *next = list_entry(buffer->entry.next, 839 struct binder_buffer, entry); 840 if (next->free) { 841 rb_erase(&next->rb_node, &proc->free_buffers); 842 binder_delete_free_buffer(proc, next); 843 } 844 } 845 if (proc->buffers.next != &buffer->entry) { 846 struct binder_buffer *prev = list_entry(buffer->entry.prev, 847 struct binder_buffer, entry); 848 if (prev->free) { 849 binder_delete_free_buffer(proc, buffer); 850 rb_erase(&prev->rb_node, &proc->free_buffers); 851 buffer = prev; 852 } 853 } 854 binder_insert_free_buffer(proc, buffer); 855} 856 857static struct binder_node *binder_get_node(struct binder_proc *proc, 858 void __user *ptr) 859{ 860 struct rb_node *n = proc->nodes.rb_node; 861 struct binder_node *node; 862 863 while (n) { 864 node = rb_entry(n, struct binder_node, rb_node); 865 866 if (ptr < node->ptr) 867 n = n->rb_left; 868 else if (ptr > node->ptr) 869 n = n->rb_right; 870 else 871 return node; 872 } 873 return NULL; 874} 875 876static struct binder_node *binder_new_node(struct binder_proc *proc, 877 void __user *ptr, 878 void __user *cookie) 879{ 880 struct rb_node **p = &proc->nodes.rb_node; 881 struct rb_node *parent = NULL; 882 struct binder_node *node; 883 884 while (*p) { 885 parent = *p; 886 node = rb_entry(parent, struct binder_node, rb_node); 887 888 if (ptr < node->ptr) 889 p = &(*p)->rb_left; 890 else if (ptr > node->ptr) 891 p = &(*p)->rb_right; 892 else 893 return NULL; 894 } 895 896 node = kzalloc(sizeof(*node), GFP_KERNEL); 897 if (node == NULL) 898 return NULL; 899 binder_stats_created(BINDER_STAT_NODE); 900 rb_link_node(&node->rb_node, parent, p); 901 rb_insert_color(&node->rb_node, &proc->nodes); 902 node->debug_id = ++binder_last_id; 903 node->proc = proc; 904 node->ptr = ptr; 905 node->cookie = cookie; 906 node->work.type = BINDER_WORK_NODE; 907 INIT_LIST_HEAD(&node->work.entry); 908 INIT_LIST_HEAD(&node->async_todo); 909 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 910 "%d:%d node %d u%p c%p created\n", 911 proc->pid, current->pid, node->debug_id, 912 node->ptr, node->cookie); 913 return node; 914} 915 916static int binder_inc_node(struct binder_node *node, int strong, int internal, 917 struct list_head *target_list) 918{ 919 if (strong) { 920 if (internal) { 921 if (target_list == NULL && 922 node->internal_strong_refs == 0 && 923 !(node == binder_context_mgr_node && 924 node->has_strong_ref)) { 925 pr_err("invalid inc strong node for %d\n", 926 node->debug_id); 927 return -EINVAL; 928 } 929 node->internal_strong_refs++; 930 } else 931 node->local_strong_refs++; 932 if (!node->has_strong_ref && target_list) { 933 list_del_init(&node->work.entry); 934 list_add_tail(&node->work.entry, target_list); 935 } 936 } else { 937 if (!internal) 938 node->local_weak_refs++; 939 if (!node->has_weak_ref && list_empty(&node->work.entry)) { 940 if (target_list == NULL) { 941 pr_err("invalid inc weak node for %d\n", 942 node->debug_id); 943 return -EINVAL; 944 } 945 list_add_tail(&node->work.entry, target_list); 946 } 947 } 948 return 0; 949} 950 951static int binder_dec_node(struct binder_node *node, int strong, int internal) 952{ 953 if (strong) { 954 if (internal) 955 node->internal_strong_refs--; 956 else 957 node->local_strong_refs--; 958 if (node->local_strong_refs || node->internal_strong_refs) 959 return 0; 960 } else { 961 if (!internal) 962 node->local_weak_refs--; 963 if (node->local_weak_refs || !hlist_empty(&node->refs)) 964 return 0; 965 } 966 if (node->proc && (node->has_strong_ref || node->has_weak_ref)) { 967 if (list_empty(&node->work.entry)) { 968 list_add_tail(&node->work.entry, &node->proc->todo); 969 wake_up_interruptible(&node->proc->wait); 970 } 971 } else { 972 if (hlist_empty(&node->refs) && !node->local_strong_refs && 973 !node->local_weak_refs) { 974 list_del_init(&node->work.entry); 975 if (node->proc) { 976 rb_erase(&node->rb_node, &node->proc->nodes); 977 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 978 "refless node %d deleted\n", 979 node->debug_id); 980 } else { 981 hlist_del(&node->dead_node); 982 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 983 "dead node %d deleted\n", 984 node->debug_id); 985 } 986 kfree(node); 987 binder_stats_deleted(BINDER_STAT_NODE); 988 } 989 } 990 991 return 0; 992} 993 994 995static struct binder_ref *binder_get_ref(struct binder_proc *proc, 996 uint32_t desc) 997{ 998 struct rb_node *n = proc->refs_by_desc.rb_node; 999 struct binder_ref *ref; 1000 1001 while (n) { 1002 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1003 1004 if (desc < ref->desc) 1005 n = n->rb_left; 1006 else if (desc > ref->desc) 1007 n = n->rb_right; 1008 else 1009 return ref; 1010 } 1011 return NULL; 1012} 1013 1014static struct binder_ref *binder_get_ref_for_node(struct binder_proc *proc, 1015 struct binder_node *node) 1016{ 1017 struct rb_node *n; 1018 struct rb_node **p = &proc->refs_by_node.rb_node; 1019 struct rb_node *parent = NULL; 1020 struct binder_ref *ref, *new_ref; 1021 1022 while (*p) { 1023 parent = *p; 1024 ref = rb_entry(parent, struct binder_ref, rb_node_node); 1025 1026 if (node < ref->node) 1027 p = &(*p)->rb_left; 1028 else if (node > ref->node) 1029 p = &(*p)->rb_right; 1030 else 1031 return ref; 1032 } 1033 new_ref = kzalloc(sizeof(*ref), GFP_KERNEL); 1034 if (new_ref == NULL) 1035 return NULL; 1036 binder_stats_created(BINDER_STAT_REF); 1037 new_ref->debug_id = ++binder_last_id; 1038 new_ref->proc = proc; 1039 new_ref->node = node; 1040 rb_link_node(&new_ref->rb_node_node, parent, p); 1041 rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node); 1042 1043 new_ref->desc = (node == binder_context_mgr_node) ? 0 : 1; 1044 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 1045 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1046 if (ref->desc > new_ref->desc) 1047 break; 1048 new_ref->desc = ref->desc + 1; 1049 } 1050 1051 p = &proc->refs_by_desc.rb_node; 1052 while (*p) { 1053 parent = *p; 1054 ref = rb_entry(parent, struct binder_ref, rb_node_desc); 1055 1056 if (new_ref->desc < ref->desc) 1057 p = &(*p)->rb_left; 1058 else if (new_ref->desc > ref->desc) 1059 p = &(*p)->rb_right; 1060 else 1061 BUG(); 1062 } 1063 rb_link_node(&new_ref->rb_node_desc, parent, p); 1064 rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc); 1065 if (node) { 1066 hlist_add_head(&new_ref->node_entry, &node->refs); 1067 1068 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1069 "%d new ref %d desc %d for node %d\n", 1070 proc->pid, new_ref->debug_id, new_ref->desc, 1071 node->debug_id); 1072 } else { 1073 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1074 "%d new ref %d desc %d for dead node\n", 1075 proc->pid, new_ref->debug_id, new_ref->desc); 1076 } 1077 return new_ref; 1078} 1079 1080static void binder_delete_ref(struct binder_ref *ref) 1081{ 1082 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1083 "%d delete ref %d desc %d for node %d\n", 1084 ref->proc->pid, ref->debug_id, ref->desc, 1085 ref->node->debug_id); 1086 1087 rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc); 1088 rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node); 1089 if (ref->strong) 1090 binder_dec_node(ref->node, 1, 1); 1091 hlist_del(&ref->node_entry); 1092 binder_dec_node(ref->node, 0, 1); 1093 if (ref->death) { 1094 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1095 "%d delete ref %d desc %d has death notification\n", 1096 ref->proc->pid, ref->debug_id, ref->desc); 1097 list_del(&ref->death->work.entry); 1098 kfree(ref->death); 1099 binder_stats_deleted(BINDER_STAT_DEATH); 1100 } 1101 kfree(ref); 1102 binder_stats_deleted(BINDER_STAT_REF); 1103} 1104 1105static int binder_inc_ref(struct binder_ref *ref, int strong, 1106 struct list_head *target_list) 1107{ 1108 int ret; 1109 if (strong) { 1110 if (ref->strong == 0) { 1111 ret = binder_inc_node(ref->node, 1, 1, target_list); 1112 if (ret) 1113 return ret; 1114 } 1115 ref->strong++; 1116 } else { 1117 if (ref->weak == 0) { 1118 ret = binder_inc_node(ref->node, 0, 1, target_list); 1119 if (ret) 1120 return ret; 1121 } 1122 ref->weak++; 1123 } 1124 return 0; 1125} 1126 1127 1128static int binder_dec_ref(struct binder_ref *ref, int strong) 1129{ 1130 if (strong) { 1131 if (ref->strong == 0) { 1132 binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n", 1133 ref->proc->pid, ref->debug_id, 1134 ref->desc, ref->strong, ref->weak); 1135 return -EINVAL; 1136 } 1137 ref->strong--; 1138 if (ref->strong == 0) { 1139 int ret; 1140 ret = binder_dec_node(ref->node, strong, 1); 1141 if (ret) 1142 return ret; 1143 } 1144 } else { 1145 if (ref->weak == 0) { 1146 binder_user_error("%d invalid dec weak, ref %d desc %d s %d w %d\n", 1147 ref->proc->pid, ref->debug_id, 1148 ref->desc, ref->strong, ref->weak); 1149 return -EINVAL; 1150 } 1151 ref->weak--; 1152 } 1153 if (ref->strong == 0 && ref->weak == 0) 1154 binder_delete_ref(ref); 1155 return 0; 1156} 1157 1158static void binder_pop_transaction(struct binder_thread *target_thread, 1159 struct binder_transaction *t) 1160{ 1161 if (target_thread) { 1162 BUG_ON(target_thread->transaction_stack != t); 1163 BUG_ON(target_thread->transaction_stack->from != target_thread); 1164 target_thread->transaction_stack = 1165 target_thread->transaction_stack->from_parent; 1166 t->from = NULL; 1167 } 1168 t->need_reply = 0; 1169 if (t->buffer) 1170 t->buffer->transaction = NULL; 1171 kfree(t); 1172 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1173} 1174 1175static void binder_send_failed_reply(struct binder_transaction *t, 1176 uint32_t error_code) 1177{ 1178 struct binder_thread *target_thread; 1179 BUG_ON(t->flags & TF_ONE_WAY); 1180 while (1) { 1181 target_thread = t->from; 1182 if (target_thread) { 1183 if (target_thread->return_error != BR_OK && 1184 target_thread->return_error2 == BR_OK) { 1185 target_thread->return_error2 = 1186 target_thread->return_error; 1187 target_thread->return_error = BR_OK; 1188 } 1189 if (target_thread->return_error == BR_OK) { 1190 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1191 "send failed reply for transaction %d to %d:%d\n", 1192 t->debug_id, target_thread->proc->pid, 1193 target_thread->pid); 1194 1195 binder_pop_transaction(target_thread, t); 1196 target_thread->return_error = error_code; 1197 wake_up_interruptible(&target_thread->wait); 1198 } else { 1199 pr_err("reply failed, target thread, %d:%d, has error code %d already\n", 1200 target_thread->proc->pid, 1201 target_thread->pid, 1202 target_thread->return_error); 1203 } 1204 return; 1205 } else { 1206 struct binder_transaction *next = t->from_parent; 1207 1208 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1209 "send failed reply for transaction %d, target dead\n", 1210 t->debug_id); 1211 1212 binder_pop_transaction(target_thread, t); 1213 if (next == NULL) { 1214 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1215 "reply failed, no target thread at root\n"); 1216 return; 1217 } 1218 t = next; 1219 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1220 "reply failed, no target thread -- retry %d\n", 1221 t->debug_id); 1222 } 1223 } 1224} 1225 1226static void binder_transaction_buffer_release(struct binder_proc *proc, 1227 struct binder_buffer *buffer, 1228 size_t *failed_at) 1229{ 1230 size_t *offp, *off_end; 1231 int debug_id = buffer->debug_id; 1232 1233 binder_debug(BINDER_DEBUG_TRANSACTION, 1234 "%d buffer release %d, size %zd-%zd, failed at %p\n", 1235 proc->pid, buffer->debug_id, 1236 buffer->data_size, buffer->offsets_size, failed_at); 1237 1238 if (buffer->target_node) 1239 binder_dec_node(buffer->target_node, 1, 0); 1240 1241 offp = (size_t *)(buffer->data + ALIGN(buffer->data_size, sizeof(void *))); 1242 if (failed_at) 1243 off_end = failed_at; 1244 else 1245 off_end = (void *)offp + buffer->offsets_size; 1246 for (; offp < off_end; offp++) { 1247 struct flat_binder_object *fp; 1248 if (*offp > buffer->data_size - sizeof(*fp) || 1249 buffer->data_size < sizeof(*fp) || 1250 !IS_ALIGNED(*offp, sizeof(void *))) { 1251 pr_err("transaction release %d bad offset %zd, size %zd\n", 1252 debug_id, *offp, buffer->data_size); 1253 continue; 1254 } 1255 fp = (struct flat_binder_object *)(buffer->data + *offp); 1256 switch (fp->type) { 1257 case BINDER_TYPE_BINDER: 1258 case BINDER_TYPE_WEAK_BINDER: { 1259 struct binder_node *node = binder_get_node(proc, fp->binder); 1260 if (node == NULL) { 1261 pr_err("transaction release %d bad node %p\n", 1262 debug_id, fp->binder); 1263 break; 1264 } 1265 binder_debug(BINDER_DEBUG_TRANSACTION, 1266 " node %d u%p\n", 1267 node->debug_id, node->ptr); 1268 binder_dec_node(node, fp->type == BINDER_TYPE_BINDER, 0); 1269 } break; 1270 case BINDER_TYPE_HANDLE: 1271 case BINDER_TYPE_WEAK_HANDLE: { 1272 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1273 if (ref == NULL) { 1274 pr_err("transaction release %d bad handle %ld\n", 1275 debug_id, fp->handle); 1276 break; 1277 } 1278 binder_debug(BINDER_DEBUG_TRANSACTION, 1279 " ref %d desc %d (node %d)\n", 1280 ref->debug_id, ref->desc, ref->node->debug_id); 1281 binder_dec_ref(ref, fp->type == BINDER_TYPE_HANDLE); 1282 } break; 1283 1284 case BINDER_TYPE_FD: 1285 binder_debug(BINDER_DEBUG_TRANSACTION, 1286 " fd %ld\n", fp->handle); 1287 if (failed_at) 1288 task_close_fd(proc, fp->handle); 1289 break; 1290 1291 default: 1292 pr_err("transaction release %d bad object type %lx\n", 1293 debug_id, fp->type); 1294 break; 1295 } 1296 } 1297} 1298 1299static void binder_transaction(struct binder_proc *proc, 1300 struct binder_thread *thread, 1301 struct binder_transaction_data *tr, int reply) 1302{ 1303 struct binder_transaction *t; 1304 struct binder_work *tcomplete; 1305 size_t *offp, *off_end; 1306 struct binder_proc *target_proc; 1307 struct binder_thread *target_thread = NULL; 1308 struct binder_node *target_node = NULL; 1309 struct list_head *target_list; 1310 wait_queue_head_t *target_wait; 1311 struct binder_transaction *in_reply_to = NULL; 1312 struct binder_transaction_log_entry *e; 1313 uint32_t return_error; 1314 1315 e = binder_transaction_log_add(&binder_transaction_log); 1316 e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY); 1317 e->from_proc = proc->pid; 1318 e->from_thread = thread->pid; 1319 e->target_handle = tr->target.handle; 1320 e->data_size = tr->data_size; 1321 e->offsets_size = tr->offsets_size; 1322 1323 if (reply) { 1324 in_reply_to = thread->transaction_stack; 1325 if (in_reply_to == NULL) { 1326 binder_user_error("%d:%d got reply transaction with no transaction stack\n", 1327 proc->pid, thread->pid); 1328 return_error = BR_FAILED_REPLY; 1329 goto err_empty_call_stack; 1330 } 1331 binder_set_nice(in_reply_to->saved_priority); 1332 if (in_reply_to->to_thread != thread) { 1333 binder_user_error("%d:%d got reply transaction with bad transaction stack, transaction %d has target %d:%d\n", 1334 proc->pid, thread->pid, in_reply_to->debug_id, 1335 in_reply_to->to_proc ? 1336 in_reply_to->to_proc->pid : 0, 1337 in_reply_to->to_thread ? 1338 in_reply_to->to_thread->pid : 0); 1339 return_error = BR_FAILED_REPLY; 1340 in_reply_to = NULL; 1341 goto err_bad_call_stack; 1342 } 1343 thread->transaction_stack = in_reply_to->to_parent; 1344 target_thread = in_reply_to->from; 1345 if (target_thread == NULL) { 1346 return_error = BR_DEAD_REPLY; 1347 goto err_dead_binder; 1348 } 1349 if (target_thread->transaction_stack != in_reply_to) { 1350 binder_user_error("%d:%d got reply transaction with bad target transaction stack %d, expected %d\n", 1351 proc->pid, thread->pid, 1352 target_thread->transaction_stack ? 1353 target_thread->transaction_stack->debug_id : 0, 1354 in_reply_to->debug_id); 1355 return_error = BR_FAILED_REPLY; 1356 in_reply_to = NULL; 1357 target_thread = NULL; 1358 goto err_dead_binder; 1359 } 1360 target_proc = target_thread->proc; 1361 } else { 1362 if (tr->target.handle) { 1363 struct binder_ref *ref; 1364 ref = binder_get_ref(proc, tr->target.handle); 1365 if (ref == NULL) { 1366 binder_user_error("%d:%d got transaction to invalid handle\n", 1367 proc->pid, thread->pid); 1368 return_error = BR_FAILED_REPLY; 1369 goto err_invalid_target_handle; 1370 } 1371 target_node = ref->node; 1372 } else { 1373 target_node = binder_context_mgr_node; 1374 if (target_node == NULL) { 1375 return_error = BR_DEAD_REPLY; 1376 goto err_no_context_mgr_node; 1377 } 1378 } 1379 e->to_node = target_node->debug_id; 1380 target_proc = target_node->proc; 1381 if (target_proc == NULL) { 1382 return_error = BR_DEAD_REPLY; 1383 goto err_dead_binder; 1384 } 1385 if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) { 1386 struct binder_transaction *tmp; 1387 tmp = thread->transaction_stack; 1388 if (tmp->to_thread != thread) { 1389 binder_user_error("%d:%d got new transaction with bad transaction stack, transaction %d has target %d:%d\n", 1390 proc->pid, thread->pid, tmp->debug_id, 1391 tmp->to_proc ? tmp->to_proc->pid : 0, 1392 tmp->to_thread ? 1393 tmp->to_thread->pid : 0); 1394 return_error = BR_FAILED_REPLY; 1395 goto err_bad_call_stack; 1396 } 1397 while (tmp) { 1398 if (tmp->from && tmp->from->proc == target_proc) 1399 target_thread = tmp->from; 1400 tmp = tmp->from_parent; 1401 } 1402 } 1403 } 1404 if (target_thread) { 1405 e->to_thread = target_thread->pid; 1406 target_list = &target_thread->todo; 1407 target_wait = &target_thread->wait; 1408 } else { 1409 target_list = &target_proc->todo; 1410 target_wait = &target_proc->wait; 1411 } 1412 e->to_proc = target_proc->pid; 1413 1414 /* TODO: reuse incoming transaction for reply */ 1415 t = kzalloc(sizeof(*t), GFP_KERNEL); 1416 if (t == NULL) { 1417 return_error = BR_FAILED_REPLY; 1418 goto err_alloc_t_failed; 1419 } 1420 binder_stats_created(BINDER_STAT_TRANSACTION); 1421 1422 tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL); 1423 if (tcomplete == NULL) { 1424 return_error = BR_FAILED_REPLY; 1425 goto err_alloc_tcomplete_failed; 1426 } 1427 binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE); 1428 1429 t->debug_id = ++binder_last_id; 1430 e->debug_id = t->debug_id; 1431 1432 if (reply) 1433 binder_debug(BINDER_DEBUG_TRANSACTION, 1434 "%d:%d BC_REPLY %d -> %d:%d, data %p-%p size %zd-%zd\n", 1435 proc->pid, thread->pid, t->debug_id, 1436 target_proc->pid, target_thread->pid, 1437 tr->data.ptr.buffer, tr->data.ptr.offsets, 1438 tr->data_size, tr->offsets_size); 1439 else 1440 binder_debug(BINDER_DEBUG_TRANSACTION, 1441 "%d:%d BC_TRANSACTION %d -> %d - node %d, data %p-%p size %zd-%zd\n", 1442 proc->pid, thread->pid, t->debug_id, 1443 target_proc->pid, target_node->debug_id, 1444 tr->data.ptr.buffer, tr->data.ptr.offsets, 1445 tr->data_size, tr->offsets_size); 1446 1447 if (!reply && !(tr->flags & TF_ONE_WAY)) 1448 t->from = thread; 1449 else 1450 t->from = NULL; 1451 t->sender_euid = proc->tsk->cred->euid; 1452 t->to_proc = target_proc; 1453 t->to_thread = target_thread; 1454 t->code = tr->code; 1455 t->flags = tr->flags; 1456 t->priority = task_nice(current); 1457 1458 trace_binder_transaction(reply, t, target_node); 1459 1460 t->buffer = binder_alloc_buf(target_proc, tr->data_size, 1461 tr->offsets_size, !reply && (t->flags & TF_ONE_WAY)); 1462 if (t->buffer == NULL) { 1463 return_error = BR_FAILED_REPLY; 1464 goto err_binder_alloc_buf_failed; 1465 } 1466 t->buffer->allow_user_free = 0; 1467 t->buffer->debug_id = t->debug_id; 1468 t->buffer->transaction = t; 1469 t->buffer->target_node = target_node; 1470 trace_binder_transaction_alloc_buf(t->buffer); 1471 if (target_node) 1472 binder_inc_node(target_node, 1, 0, NULL); 1473 1474 offp = (size_t *)(t->buffer->data + ALIGN(tr->data_size, sizeof(void *))); 1475 1476 if (copy_from_user(t->buffer->data, tr->data.ptr.buffer, tr->data_size)) { 1477 binder_user_error("%d:%d got transaction with invalid data ptr\n", 1478 proc->pid, thread->pid); 1479 return_error = BR_FAILED_REPLY; 1480 goto err_copy_data_failed; 1481 } 1482 if (copy_from_user(offp, tr->data.ptr.offsets, tr->offsets_size)) { 1483 binder_user_error("%d:%d got transaction with invalid offsets ptr\n", 1484 proc->pid, thread->pid); 1485 return_error = BR_FAILED_REPLY; 1486 goto err_copy_data_failed; 1487 } 1488 if (!IS_ALIGNED(tr->offsets_size, sizeof(size_t))) { 1489 binder_user_error("%d:%d got transaction with invalid offsets size, %zd\n", 1490 proc->pid, thread->pid, tr->offsets_size); 1491 return_error = BR_FAILED_REPLY; 1492 goto err_bad_offset; 1493 } 1494 off_end = (void *)offp + tr->offsets_size; 1495 for (; offp < off_end; offp++) { 1496 struct flat_binder_object *fp; 1497 if (*offp > t->buffer->data_size - sizeof(*fp) || 1498 t->buffer->data_size < sizeof(*fp) || 1499 !IS_ALIGNED(*offp, sizeof(void *))) { 1500 binder_user_error("%d:%d got transaction with invalid offset, %zd\n", 1501 proc->pid, thread->pid, *offp); 1502 return_error = BR_FAILED_REPLY; 1503 goto err_bad_offset; 1504 } 1505 fp = (struct flat_binder_object *)(t->buffer->data + *offp); 1506 switch (fp->type) { 1507 case BINDER_TYPE_BINDER: 1508 case BINDER_TYPE_WEAK_BINDER: { 1509 struct binder_ref *ref; 1510 struct binder_node *node = binder_get_node(proc, fp->binder); 1511 if (node == NULL) { 1512 node = binder_new_node(proc, fp->binder, fp->cookie); 1513 if (node == NULL) { 1514 return_error = BR_FAILED_REPLY; 1515 goto err_binder_new_node_failed; 1516 } 1517 node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK; 1518 node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS); 1519 } 1520 if (fp->cookie != node->cookie) { 1521 binder_user_error("%d:%d sending u%p node %d, cookie mismatch %p != %p\n", 1522 proc->pid, thread->pid, 1523 fp->binder, node->debug_id, 1524 fp->cookie, node->cookie); 1525 goto err_binder_get_ref_for_node_failed; 1526 } 1527 ref = binder_get_ref_for_node(target_proc, node); 1528 if (ref == NULL) { 1529 return_error = BR_FAILED_REPLY; 1530 goto err_binder_get_ref_for_node_failed; 1531 } 1532 if (fp->type == BINDER_TYPE_BINDER) 1533 fp->type = BINDER_TYPE_HANDLE; 1534 else 1535 fp->type = BINDER_TYPE_WEAK_HANDLE; 1536 fp->handle = ref->desc; 1537 binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE, 1538 &thread->todo); 1539 1540 trace_binder_transaction_node_to_ref(t, node, ref); 1541 binder_debug(BINDER_DEBUG_TRANSACTION, 1542 " node %d u%p -> ref %d desc %d\n", 1543 node->debug_id, node->ptr, ref->debug_id, 1544 ref->desc); 1545 } break; 1546 case BINDER_TYPE_HANDLE: 1547 case BINDER_TYPE_WEAK_HANDLE: { 1548 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1549 if (ref == NULL) { 1550 binder_user_error("%d:%d got transaction with invalid handle, %ld\n", 1551 proc->pid, 1552 thread->pid, fp->handle); 1553 return_error = BR_FAILED_REPLY; 1554 goto err_binder_get_ref_failed; 1555 } 1556 if (ref->node->proc == target_proc) { 1557 if (fp->type == BINDER_TYPE_HANDLE) 1558 fp->type = BINDER_TYPE_BINDER; 1559 else 1560 fp->type = BINDER_TYPE_WEAK_BINDER; 1561 fp->binder = ref->node->ptr; 1562 fp->cookie = ref->node->cookie; 1563 binder_inc_node(ref->node, fp->type == BINDER_TYPE_BINDER, 0, NULL); 1564 trace_binder_transaction_ref_to_node(t, ref); 1565 binder_debug(BINDER_DEBUG_TRANSACTION, 1566 " ref %d desc %d -> node %d u%p\n", 1567 ref->debug_id, ref->desc, ref->node->debug_id, 1568 ref->node->ptr); 1569 } else { 1570 struct binder_ref *new_ref; 1571 new_ref = binder_get_ref_for_node(target_proc, ref->node); 1572 if (new_ref == NULL) { 1573 return_error = BR_FAILED_REPLY; 1574 goto err_binder_get_ref_for_node_failed; 1575 } 1576 fp->handle = new_ref->desc; 1577 binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL); 1578 trace_binder_transaction_ref_to_ref(t, ref, 1579 new_ref); 1580 binder_debug(BINDER_DEBUG_TRANSACTION, 1581 " ref %d desc %d -> ref %d desc %d (node %d)\n", 1582 ref->debug_id, ref->desc, new_ref->debug_id, 1583 new_ref->desc, ref->node->debug_id); 1584 } 1585 } break; 1586 1587 case BINDER_TYPE_FD: { 1588 int target_fd; 1589 struct file *file; 1590 1591 if (reply) { 1592 if (!(in_reply_to->flags & TF_ACCEPT_FDS)) { 1593 binder_user_error("%d:%d got reply with fd, %ld, but target does not allow fds\n", 1594 proc->pid, thread->pid, fp->handle); 1595 return_error = BR_FAILED_REPLY; 1596 goto err_fd_not_allowed; 1597 } 1598 } else if (!target_node->accept_fds) { 1599 binder_user_error("%d:%d got transaction with fd, %ld, but target does not allow fds\n", 1600 proc->pid, thread->pid, fp->handle); 1601 return_error = BR_FAILED_REPLY; 1602 goto err_fd_not_allowed; 1603 } 1604 1605 file = fget(fp->handle); 1606 if (file == NULL) { 1607 binder_user_error("%d:%d got transaction with invalid fd, %ld\n", 1608 proc->pid, thread->pid, fp->handle); 1609 return_error = BR_FAILED_REPLY; 1610 goto err_fget_failed; 1611 } 1612 target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC); 1613 if (target_fd < 0) { 1614 fput(file); 1615 return_error = BR_FAILED_REPLY; 1616 goto err_get_unused_fd_failed; 1617 } 1618 task_fd_install(target_proc, target_fd, file); 1619 trace_binder_transaction_fd(t, fp->handle, target_fd); 1620 binder_debug(BINDER_DEBUG_TRANSACTION, 1621 " fd %ld -> %d\n", fp->handle, target_fd); 1622 /* TODO: fput? */ 1623 fp->handle = target_fd; 1624 } break; 1625 1626 default: 1627 binder_user_error("%d:%d got transaction with invalid object type, %lx\n", 1628 proc->pid, thread->pid, fp->type); 1629 return_error = BR_FAILED_REPLY; 1630 goto err_bad_object_type; 1631 } 1632 } 1633 if (reply) { 1634 BUG_ON(t->buffer->async_transaction != 0); 1635 binder_pop_transaction(target_thread, in_reply_to); 1636 } else if (!(t->flags & TF_ONE_WAY)) { 1637 BUG_ON(t->buffer->async_transaction != 0); 1638 t->need_reply = 1; 1639 t->from_parent = thread->transaction_stack; 1640 thread->transaction_stack = t; 1641 } else { 1642 BUG_ON(target_node == NULL); 1643 BUG_ON(t->buffer->async_transaction != 1); 1644 if (target_node->has_async_transaction) { 1645 target_list = &target_node->async_todo; 1646 target_wait = NULL; 1647 } else 1648 target_node->has_async_transaction = 1; 1649 } 1650 t->work.type = BINDER_WORK_TRANSACTION; 1651 list_add_tail(&t->work.entry, target_list); 1652 tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE; 1653 list_add_tail(&tcomplete->entry, &thread->todo); 1654 if (target_wait) 1655 wake_up_interruptible(target_wait); 1656 return; 1657 1658err_get_unused_fd_failed: 1659err_fget_failed: 1660err_fd_not_allowed: 1661err_binder_get_ref_for_node_failed: 1662err_binder_get_ref_failed: 1663err_binder_new_node_failed: 1664err_bad_object_type: 1665err_bad_offset: 1666err_copy_data_failed: 1667 trace_binder_transaction_failed_buffer_release(t->buffer); 1668 binder_transaction_buffer_release(target_proc, t->buffer, offp); 1669 t->buffer->transaction = NULL; 1670 binder_free_buf(target_proc, t->buffer); 1671err_binder_alloc_buf_failed: 1672 kfree(tcomplete); 1673 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 1674err_alloc_tcomplete_failed: 1675 kfree(t); 1676 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1677err_alloc_t_failed: 1678err_bad_call_stack: 1679err_empty_call_stack: 1680err_dead_binder: 1681err_invalid_target_handle: 1682err_no_context_mgr_node: 1683 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1684 "%d:%d transaction failed %d, size %zd-%zd\n", 1685 proc->pid, thread->pid, return_error, 1686 tr->data_size, tr->offsets_size); 1687 1688 { 1689 struct binder_transaction_log_entry *fe; 1690 fe = binder_transaction_log_add(&binder_transaction_log_failed); 1691 *fe = *e; 1692 } 1693 1694 BUG_ON(thread->return_error != BR_OK); 1695 if (in_reply_to) { 1696 thread->return_error = BR_TRANSACTION_COMPLETE; 1697 binder_send_failed_reply(in_reply_to, return_error); 1698 } else 1699 thread->return_error = return_error; 1700} 1701 1702int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread, 1703 void __user *buffer, int size, signed long *consumed) 1704{ 1705 uint32_t cmd; 1706 void __user *ptr = buffer + *consumed; 1707 void __user *end = buffer + size; 1708 1709 while (ptr < end && thread->return_error == BR_OK) { 1710 if (get_user(cmd, (uint32_t __user *)ptr)) 1711 return -EFAULT; 1712 ptr += sizeof(uint32_t); 1713 trace_binder_command(cmd); 1714 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) { 1715 binder_stats.bc[_IOC_NR(cmd)]++; 1716 proc->stats.bc[_IOC_NR(cmd)]++; 1717 thread->stats.bc[_IOC_NR(cmd)]++; 1718 } 1719 switch (cmd) { 1720 case BC_INCREFS: 1721 case BC_ACQUIRE: 1722 case BC_RELEASE: 1723 case BC_DECREFS: { 1724 uint32_t target; 1725 struct binder_ref *ref; 1726 const char *debug_string; 1727 1728 if (get_user(target, (uint32_t __user *)ptr)) 1729 return -EFAULT; 1730 ptr += sizeof(uint32_t); 1731 if (target == 0 && binder_context_mgr_node && 1732 (cmd == BC_INCREFS || cmd == BC_ACQUIRE)) { 1733 ref = binder_get_ref_for_node(proc, 1734 binder_context_mgr_node); 1735 if (ref->desc != target) { 1736 binder_user_error("%d:%d tried to acquire reference to desc 0, got %d instead\n", 1737 proc->pid, thread->pid, 1738 ref->desc); 1739 } 1740 } else 1741 ref = binder_get_ref(proc, target); 1742 if (ref == NULL) { 1743 binder_user_error("%d:%d refcount change on invalid ref %d\n", 1744 proc->pid, thread->pid, target); 1745 break; 1746 } 1747 switch (cmd) { 1748 case BC_INCREFS: 1749 debug_string = "IncRefs"; 1750 binder_inc_ref(ref, 0, NULL); 1751 break; 1752 case BC_ACQUIRE: 1753 debug_string = "Acquire"; 1754 binder_inc_ref(ref, 1, NULL); 1755 break; 1756 case BC_RELEASE: 1757 debug_string = "Release"; 1758 binder_dec_ref(ref, 1); 1759 break; 1760 case BC_DECREFS: 1761 default: 1762 debug_string = "DecRefs"; 1763 binder_dec_ref(ref, 0); 1764 break; 1765 } 1766 binder_debug(BINDER_DEBUG_USER_REFS, 1767 "%d:%d %s ref %d desc %d s %d w %d for node %d\n", 1768 proc->pid, thread->pid, debug_string, ref->debug_id, 1769 ref->desc, ref->strong, ref->weak, ref->node->debug_id); 1770 break; 1771 } 1772 case BC_INCREFS_DONE: 1773 case BC_ACQUIRE_DONE: { 1774 void __user *node_ptr; 1775 void *cookie; 1776 struct binder_node *node; 1777 1778 if (get_user(node_ptr, (void * __user *)ptr)) 1779 return -EFAULT; 1780 ptr += sizeof(void *); 1781 if (get_user(cookie, (void * __user *)ptr)) 1782 return -EFAULT; 1783 ptr += sizeof(void *); 1784 node = binder_get_node(proc, node_ptr); 1785 if (node == NULL) { 1786 binder_user_error("%d:%d %s u%p no match\n", 1787 proc->pid, thread->pid, 1788 cmd == BC_INCREFS_DONE ? 1789 "BC_INCREFS_DONE" : 1790 "BC_ACQUIRE_DONE", 1791 node_ptr); 1792 break; 1793 } 1794 if (cookie != node->cookie) { 1795 binder_user_error("%d:%d %s u%p node %d cookie mismatch %p != %p\n", 1796 proc->pid, thread->pid, 1797 cmd == BC_INCREFS_DONE ? 1798 "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1799 node_ptr, node->debug_id, 1800 cookie, node->cookie); 1801 break; 1802 } 1803 if (cmd == BC_ACQUIRE_DONE) { 1804 if (node->pending_strong_ref == 0) { 1805 binder_user_error("%d:%d BC_ACQUIRE_DONE node %d has no pending acquire request\n", 1806 proc->pid, thread->pid, 1807 node->debug_id); 1808 break; 1809 } 1810 node->pending_strong_ref = 0; 1811 } else { 1812 if (node->pending_weak_ref == 0) { 1813 binder_user_error("%d:%d BC_INCREFS_DONE node %d has no pending increfs request\n", 1814 proc->pid, thread->pid, 1815 node->debug_id); 1816 break; 1817 } 1818 node->pending_weak_ref = 0; 1819 } 1820 binder_dec_node(node, cmd == BC_ACQUIRE_DONE, 0); 1821 binder_debug(BINDER_DEBUG_USER_REFS, 1822 "%d:%d %s node %d ls %d lw %d\n", 1823 proc->pid, thread->pid, 1824 cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1825 node->debug_id, node->local_strong_refs, node->local_weak_refs); 1826 break; 1827 } 1828 case BC_ATTEMPT_ACQUIRE: 1829 pr_err("BC_ATTEMPT_ACQUIRE not supported\n"); 1830 return -EINVAL; 1831 case BC_ACQUIRE_RESULT: 1832 pr_err("BC_ACQUIRE_RESULT not supported\n"); 1833 return -EINVAL; 1834 1835 case BC_FREE_BUFFER: { 1836 void __user *data_ptr; 1837 struct binder_buffer *buffer; 1838 1839 if (get_user(data_ptr, (void * __user *)ptr)) 1840 return -EFAULT; 1841 ptr += sizeof(void *); 1842 1843 buffer = binder_buffer_lookup(proc, data_ptr); 1844 if (buffer == NULL) { 1845 binder_user_error("%d:%d BC_FREE_BUFFER u%p no match\n", 1846 proc->pid, thread->pid, data_ptr); 1847 break; 1848 } 1849 if (!buffer->allow_user_free) { 1850 binder_user_error("%d:%d BC_FREE_BUFFER u%p matched unreturned buffer\n", 1851 proc->pid, thread->pid, data_ptr); 1852 break; 1853 } 1854 binder_debug(BINDER_DEBUG_FREE_BUFFER, 1855 "%d:%d BC_FREE_BUFFER u%p found buffer %d for %s transaction\n", 1856 proc->pid, thread->pid, data_ptr, buffer->debug_id, 1857 buffer->transaction ? "active" : "finished"); 1858 1859 if (buffer->transaction) { 1860 buffer->transaction->buffer = NULL; 1861 buffer->transaction = NULL; 1862 } 1863 if (buffer->async_transaction && buffer->target_node) { 1864 BUG_ON(!buffer->target_node->has_async_transaction); 1865 if (list_empty(&buffer->target_node->async_todo)) 1866 buffer->target_node->has_async_transaction = 0; 1867 else 1868 list_move_tail(buffer->target_node->async_todo.next, &thread->todo); 1869 } 1870 trace_binder_transaction_buffer_release(buffer); 1871 binder_transaction_buffer_release(proc, buffer, NULL); 1872 binder_free_buf(proc, buffer); 1873 break; 1874 } 1875 1876 case BC_TRANSACTION: 1877 case BC_REPLY: { 1878 struct binder_transaction_data tr; 1879 1880 if (copy_from_user(&tr, ptr, sizeof(tr))) 1881 return -EFAULT; 1882 ptr += sizeof(tr); 1883 binder_transaction(proc, thread, &tr, cmd == BC_REPLY); 1884 break; 1885 } 1886 1887 case BC_REGISTER_LOOPER: 1888 binder_debug(BINDER_DEBUG_THREADS, 1889 "%d:%d BC_REGISTER_LOOPER\n", 1890 proc->pid, thread->pid); 1891 if (thread->looper & BINDER_LOOPER_STATE_ENTERED) { 1892 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1893 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER\n", 1894 proc->pid, thread->pid); 1895 } else if (proc->requested_threads == 0) { 1896 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1897 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called without request\n", 1898 proc->pid, thread->pid); 1899 } else { 1900 proc->requested_threads--; 1901 proc->requested_threads_started++; 1902 } 1903 thread->looper |= BINDER_LOOPER_STATE_REGISTERED; 1904 break; 1905 case BC_ENTER_LOOPER: 1906 binder_debug(BINDER_DEBUG_THREADS, 1907 "%d:%d BC_ENTER_LOOPER\n", 1908 proc->pid, thread->pid); 1909 if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) { 1910 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1911 binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n", 1912 proc->pid, thread->pid); 1913 } 1914 thread->looper |= BINDER_LOOPER_STATE_ENTERED; 1915 break; 1916 case BC_EXIT_LOOPER: 1917 binder_debug(BINDER_DEBUG_THREADS, 1918 "%d:%d BC_EXIT_LOOPER\n", 1919 proc->pid, thread->pid); 1920 thread->looper |= BINDER_LOOPER_STATE_EXITED; 1921 break; 1922 1923 case BC_REQUEST_DEATH_NOTIFICATION: 1924 case BC_CLEAR_DEATH_NOTIFICATION: { 1925 uint32_t target; 1926 void __user *cookie; 1927 struct binder_ref *ref; 1928 struct binder_ref_death *death; 1929 1930 if (get_user(target, (uint32_t __user *)ptr)) 1931 return -EFAULT; 1932 ptr += sizeof(uint32_t); 1933 if (get_user(cookie, (void __user * __user *)ptr)) 1934 return -EFAULT; 1935 ptr += sizeof(void *); 1936 ref = binder_get_ref(proc, target); 1937 if (ref == NULL) { 1938 binder_user_error("%d:%d %s invalid ref %d\n", 1939 proc->pid, thread->pid, 1940 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 1941 "BC_REQUEST_DEATH_NOTIFICATION" : 1942 "BC_CLEAR_DEATH_NOTIFICATION", 1943 target); 1944 break; 1945 } 1946 1947 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 1948 "%d:%d %s %p ref %d desc %d s %d w %d for node %d\n", 1949 proc->pid, thread->pid, 1950 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 1951 "BC_REQUEST_DEATH_NOTIFICATION" : 1952 "BC_CLEAR_DEATH_NOTIFICATION", 1953 cookie, ref->debug_id, ref->desc, 1954 ref->strong, ref->weak, ref->node->debug_id); 1955 1956 if (cmd == BC_REQUEST_DEATH_NOTIFICATION) { 1957 if (ref->death) { 1958 binder_user_error("%d:%d BC_REQUEST_DEATH_NOTIFICATION death notification already set\n", 1959 proc->pid, thread->pid); 1960 break; 1961 } 1962 death = kzalloc(sizeof(*death), GFP_KERNEL); 1963 if (death == NULL) { 1964 thread->return_error = BR_ERROR; 1965 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1966 "%d:%d BC_REQUEST_DEATH_NOTIFICATION failed\n", 1967 proc->pid, thread->pid); 1968 break; 1969 } 1970 binder_stats_created(BINDER_STAT_DEATH); 1971 INIT_LIST_HEAD(&death->work.entry); 1972 death->cookie = cookie; 1973 ref->death = death; 1974 if (ref->node->proc == NULL) { 1975 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 1976 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 1977 list_add_tail(&ref->death->work.entry, &thread->todo); 1978 } else { 1979 list_add_tail(&ref->death->work.entry, &proc->todo); 1980 wake_up_interruptible(&proc->wait); 1981 } 1982 } 1983 } else { 1984 if (ref->death == NULL) { 1985 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification not active\n", 1986 proc->pid, thread->pid); 1987 break; 1988 } 1989 death = ref->death; 1990 if (death->cookie != cookie) { 1991 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch %p != %p\n", 1992 proc->pid, thread->pid, 1993 death->cookie, cookie); 1994 break; 1995 } 1996 ref->death = NULL; 1997 if (list_empty(&death->work.entry)) { 1998 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 1999 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2000 list_add_tail(&death->work.entry, &thread->todo); 2001 } else { 2002 list_add_tail(&death->work.entry, &proc->todo); 2003 wake_up_interruptible(&proc->wait); 2004 } 2005 } else { 2006 BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER); 2007 death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR; 2008 } 2009 } 2010 } break; 2011 case BC_DEAD_BINDER_DONE: { 2012 struct binder_work *w; 2013 void __user *cookie; 2014 struct binder_ref_death *death = NULL; 2015 if (get_user(cookie, (void __user * __user *)ptr)) 2016 return -EFAULT; 2017 2018 ptr += sizeof(void *); 2019 list_for_each_entry(w, &proc->delivered_death, entry) { 2020 struct binder_ref_death *tmp_death = container_of(w, struct binder_ref_death, work); 2021 if (tmp_death->cookie == cookie) { 2022 death = tmp_death; 2023 break; 2024 } 2025 } 2026 binder_debug(BINDER_DEBUG_DEAD_BINDER, 2027 "%d:%d BC_DEAD_BINDER_DONE %p found %p\n", 2028 proc->pid, thread->pid, cookie, death); 2029 if (death == NULL) { 2030 binder_user_error("%d:%d BC_DEAD_BINDER_DONE %p not found\n", 2031 proc->pid, thread->pid, cookie); 2032 break; 2033 } 2034 2035 list_del_init(&death->work.entry); 2036 if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) { 2037 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2038 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2039 list_add_tail(&death->work.entry, &thread->todo); 2040 } else { 2041 list_add_tail(&death->work.entry, &proc->todo); 2042 wake_up_interruptible(&proc->wait); 2043 } 2044 } 2045 } break; 2046 2047 default: 2048 pr_err("%d:%d unknown command %d\n", 2049 proc->pid, thread->pid, cmd); 2050 return -EINVAL; 2051 } 2052 *consumed = ptr - buffer; 2053 } 2054 return 0; 2055} 2056 2057void binder_stat_br(struct binder_proc *proc, struct binder_thread *thread, 2058 uint32_t cmd) 2059{ 2060 trace_binder_return(cmd); 2061 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) { 2062 binder_stats.br[_IOC_NR(cmd)]++; 2063 proc->stats.br[_IOC_NR(cmd)]++; 2064 thread->stats.br[_IOC_NR(cmd)]++; 2065 } 2066} 2067 2068static int binder_has_proc_work(struct binder_proc *proc, 2069 struct binder_thread *thread) 2070{ 2071 return !list_empty(&proc->todo) || 2072 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2073} 2074 2075static int binder_has_thread_work(struct binder_thread *thread) 2076{ 2077 return !list_empty(&thread->todo) || thread->return_error != BR_OK || 2078 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2079} 2080 2081static int binder_thread_read(struct binder_proc *proc, 2082 struct binder_thread *thread, 2083 void __user *buffer, int size, 2084 signed long *consumed, int non_block) 2085{ 2086 void __user *ptr = buffer + *consumed; 2087 void __user *end = buffer + size; 2088 2089 int ret = 0; 2090 int wait_for_proc_work; 2091 2092 if (*consumed == 0) { 2093 if (put_user(BR_NOOP, (uint32_t __user *)ptr)) 2094 return -EFAULT; 2095 ptr += sizeof(uint32_t); 2096 } 2097 2098retry: 2099 wait_for_proc_work = thread->transaction_stack == NULL && 2100 list_empty(&thread->todo); 2101 2102 if (thread->return_error != BR_OK && ptr < end) { 2103 if (thread->return_error2 != BR_OK) { 2104 if (put_user(thread->return_error2, (uint32_t __user *)ptr)) 2105 return -EFAULT; 2106 ptr += sizeof(uint32_t); 2107 binder_stat_br(proc, thread, thread->return_error2); 2108 if (ptr == end) 2109 goto done; 2110 thread->return_error2 = BR_OK; 2111 } 2112 if (put_user(thread->return_error, (uint32_t __user *)ptr)) 2113 return -EFAULT; 2114 ptr += sizeof(uint32_t); 2115 binder_stat_br(proc, thread, thread->return_error); 2116 thread->return_error = BR_OK; 2117 goto done; 2118 } 2119 2120 2121 thread->looper |= BINDER_LOOPER_STATE_WAITING; 2122 if (wait_for_proc_work) 2123 proc->ready_threads++; 2124 2125 binder_unlock(__func__); 2126 2127 trace_binder_wait_for_work(wait_for_proc_work, 2128 !!thread->transaction_stack, 2129 !list_empty(&thread->todo)); 2130 if (wait_for_proc_work) { 2131 if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2132 BINDER_LOOPER_STATE_ENTERED))) { 2133 binder_user_error("%d:%d ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state %x)\n", 2134 proc->pid, thread->pid, thread->looper); 2135 wait_event_interruptible(binder_user_error_wait, 2136 binder_stop_on_user_error < 2); 2137 } 2138 binder_set_nice(proc->default_priority); 2139 if (non_block) { 2140 if (!binder_has_proc_work(proc, thread)) 2141 ret = -EAGAIN; 2142 } else 2143 ret = wait_event_interruptible_exclusive(proc->wait, binder_has_proc_work(proc, thread)); 2144 } else { 2145 if (non_block) { 2146 if (!binder_has_thread_work(thread)) 2147 ret = -EAGAIN; 2148 } else 2149 ret = wait_event_interruptible(thread->wait, binder_has_thread_work(thread)); 2150 } 2151 2152 binder_lock(__func__); 2153 2154 if (wait_for_proc_work) 2155 proc->ready_threads--; 2156 thread->looper &= ~BINDER_LOOPER_STATE_WAITING; 2157 2158 if (ret) 2159 return ret; 2160 2161 while (1) { 2162 uint32_t cmd; 2163 struct binder_transaction_data tr; 2164 struct binder_work *w; 2165 struct binder_transaction *t = NULL; 2166 2167 if (!list_empty(&thread->todo)) 2168 w = list_first_entry(&thread->todo, struct binder_work, entry); 2169 else if (!list_empty(&proc->todo) && wait_for_proc_work) 2170 w = list_first_entry(&proc->todo, struct binder_work, entry); 2171 else { 2172 if (ptr - buffer == 4 && !(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN)) /* no data added */ 2173 goto retry; 2174 break; 2175 } 2176 2177 if (end - ptr < sizeof(tr) + 4) 2178 break; 2179 2180 switch (w->type) { 2181 case BINDER_WORK_TRANSACTION: { 2182 t = container_of(w, struct binder_transaction, work); 2183 } break; 2184 case BINDER_WORK_TRANSACTION_COMPLETE: { 2185 cmd = BR_TRANSACTION_COMPLETE; 2186 if (put_user(cmd, (uint32_t __user *)ptr)) 2187 return -EFAULT; 2188 ptr += sizeof(uint32_t); 2189 2190 binder_stat_br(proc, thread, cmd); 2191 binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE, 2192 "%d:%d BR_TRANSACTION_COMPLETE\n", 2193 proc->pid, thread->pid); 2194 2195 list_del(&w->entry); 2196 kfree(w); 2197 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2198 } break; 2199 case BINDER_WORK_NODE: { 2200 struct binder_node *node = container_of(w, struct binder_node, work); 2201 uint32_t cmd = BR_NOOP; 2202 const char *cmd_name; 2203 int strong = node->internal_strong_refs || node->local_strong_refs; 2204 int weak = !hlist_empty(&node->refs) || node->local_weak_refs || strong; 2205 if (weak && !node->has_weak_ref) { 2206 cmd = BR_INCREFS; 2207 cmd_name = "BR_INCREFS"; 2208 node->has_weak_ref = 1; 2209 node->pending_weak_ref = 1; 2210 node->local_weak_refs++; 2211 } else if (strong && !node->has_strong_ref) { 2212 cmd = BR_ACQUIRE; 2213 cmd_name = "BR_ACQUIRE"; 2214 node->has_strong_ref = 1; 2215 node->pending_strong_ref = 1; 2216 node->local_strong_refs++; 2217 } else if (!strong && node->has_strong_ref) { 2218 cmd = BR_RELEASE; 2219 cmd_name = "BR_RELEASE"; 2220 node->has_strong_ref = 0; 2221 } else if (!weak && node->has_weak_ref) { 2222 cmd = BR_DECREFS; 2223 cmd_name = "BR_DECREFS"; 2224 node->has_weak_ref = 0; 2225 } 2226 if (cmd != BR_NOOP) { 2227 if (put_user(cmd, (uint32_t __user *)ptr)) 2228 return -EFAULT; 2229 ptr += sizeof(uint32_t); 2230 if (put_user(node->ptr, (void * __user *)ptr)) 2231 return -EFAULT; 2232 ptr += sizeof(void *); 2233 if (put_user(node->cookie, (void * __user *)ptr)) 2234 return -EFAULT; 2235 ptr += sizeof(void *); 2236 2237 binder_stat_br(proc, thread, cmd); 2238 binder_debug(BINDER_DEBUG_USER_REFS, 2239 "%d:%d %s %d u%p c%p\n", 2240 proc->pid, thread->pid, cmd_name, node->debug_id, node->ptr, node->cookie); 2241 } else { 2242 list_del_init(&w->entry); 2243 if (!weak && !strong) { 2244 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2245 "%d:%d node %d u%p c%p deleted\n", 2246 proc->pid, thread->pid, node->debug_id, 2247 node->ptr, node->cookie); 2248 rb_erase(&node->rb_node, &proc->nodes); 2249 kfree(node); 2250 binder_stats_deleted(BINDER_STAT_NODE); 2251 } else { 2252 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2253 "%d:%d node %d u%p c%p state unchanged\n", 2254 proc->pid, thread->pid, node->debug_id, node->ptr, 2255 node->cookie); 2256 } 2257 } 2258 } break; 2259 case BINDER_WORK_DEAD_BINDER: 2260 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 2261 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 2262 struct binder_ref_death *death; 2263 uint32_t cmd; 2264 2265 death = container_of(w, struct binder_ref_death, work); 2266 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) 2267 cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE; 2268 else 2269 cmd = BR_DEAD_BINDER; 2270 if (put_user(cmd, (uint32_t __user *)ptr)) 2271 return -EFAULT; 2272 ptr += sizeof(uint32_t); 2273 if (put_user(death->cookie, (void * __user *)ptr)) 2274 return -EFAULT; 2275 ptr += sizeof(void *); 2276 binder_stat_br(proc, thread, cmd); 2277 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 2278 "%d:%d %s %p\n", 2279 proc->pid, thread->pid, 2280 cmd == BR_DEAD_BINDER ? 2281 "BR_DEAD_BINDER" : 2282 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 2283 death->cookie); 2284 2285 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) { 2286 list_del(&w->entry); 2287 kfree(death); 2288 binder_stats_deleted(BINDER_STAT_DEATH); 2289 } else 2290 list_move(&w->entry, &proc->delivered_death); 2291 if (cmd == BR_DEAD_BINDER) 2292 goto done; /* DEAD_BINDER notifications can cause transactions */ 2293 } break; 2294 } 2295 2296 if (!t) 2297 continue; 2298 2299 BUG_ON(t->buffer == NULL); 2300 if (t->buffer->target_node) { 2301 struct binder_node *target_node = t->buffer->target_node; 2302 tr.target.ptr = target_node->ptr; 2303 tr.cookie = target_node->cookie; 2304 t->saved_priority = task_nice(current); 2305 if (t->priority < target_node->min_priority && 2306 !(t->flags & TF_ONE_WAY)) 2307 binder_set_nice(t->priority); 2308 else if (!(t->flags & TF_ONE_WAY) || 2309 t->saved_priority > target_node->min_priority) 2310 binder_set_nice(target_node->min_priority); 2311 cmd = BR_TRANSACTION; 2312 } else { 2313 tr.target.ptr = NULL; 2314 tr.cookie = NULL; 2315 cmd = BR_REPLY; 2316 } 2317 tr.code = t->code; 2318 tr.flags = t->flags; 2319 tr.sender_euid = from_kuid(current_user_ns(), t->sender_euid); 2320 2321 if (t->from) { 2322 struct task_struct *sender = t->from->proc->tsk; 2323 tr.sender_pid = task_tgid_nr_ns(sender, 2324 task_active_pid_ns(current)); 2325 } else { 2326 tr.sender_pid = 0; 2327 } 2328 2329 tr.data_size = t->buffer->data_size; 2330 tr.offsets_size = t->buffer->offsets_size; 2331 tr.data.ptr.buffer = (void *)t->buffer->data + 2332 proc->user_buffer_offset; 2333 tr.data.ptr.offsets = tr.data.ptr.buffer + 2334 ALIGN(t->buffer->data_size, 2335 sizeof(void *)); 2336 2337 if (put_user(cmd, (uint32_t __user *)ptr)) 2338 return -EFAULT; 2339 ptr += sizeof(uint32_t); 2340 if (copy_to_user(ptr, &tr, sizeof(tr))) 2341 return -EFAULT; 2342 ptr += sizeof(tr); 2343 2344 trace_binder_transaction_received(t); 2345 binder_stat_br(proc, thread, cmd); 2346 binder_debug(BINDER_DEBUG_TRANSACTION, 2347 "%d:%d %s %d %d:%d, cmd %d size %zd-%zd ptr %p-%p\n", 2348 proc->pid, thread->pid, 2349 (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" : 2350 "BR_REPLY", 2351 t->debug_id, t->from ? t->from->proc->pid : 0, 2352 t->from ? t->from->pid : 0, cmd, 2353 t->buffer->data_size, t->buffer->offsets_size, 2354 tr.data.ptr.buffer, tr.data.ptr.offsets); 2355 2356 list_del(&t->work.entry); 2357 t->buffer->allow_user_free = 1; 2358 if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) { 2359 t->to_parent = thread->transaction_stack; 2360 t->to_thread = thread; 2361 thread->transaction_stack = t; 2362 } else { 2363 t->buffer->transaction = NULL; 2364 kfree(t); 2365 binder_stats_deleted(BINDER_STAT_TRANSACTION); 2366 } 2367 break; 2368 } 2369 2370done: 2371 2372 *consumed = ptr - buffer; 2373 if (proc->requested_threads + proc->ready_threads == 0 && 2374 proc->requested_threads_started < proc->max_threads && 2375 (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2376 BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */ 2377 /*spawn a new thread if we leave this out */) { 2378 proc->requested_threads++; 2379 binder_debug(BINDER_DEBUG_THREADS, 2380 "%d:%d BR_SPAWN_LOOPER\n", 2381 proc->pid, thread->pid); 2382 if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer)) 2383 return -EFAULT; 2384 binder_stat_br(proc, thread, BR_SPAWN_LOOPER); 2385 } 2386 return 0; 2387} 2388 2389static void binder_release_work(struct list_head *list) 2390{ 2391 struct binder_work *w; 2392 while (!list_empty(list)) { 2393 w = list_first_entry(list, struct binder_work, entry); 2394 list_del_init(&w->entry); 2395 switch (w->type) { 2396 case BINDER_WORK_TRANSACTION: { 2397 struct binder_transaction *t; 2398 2399 t = container_of(w, struct binder_transaction, work); 2400 if (t->buffer->target_node && 2401 !(t->flags & TF_ONE_WAY)) { 2402 binder_send_failed_reply(t, BR_DEAD_REPLY); 2403 } else { 2404 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2405 "undelivered transaction %d\n", 2406 t->debug_id); 2407 t->buffer->transaction = NULL; 2408 kfree(t); 2409 binder_stats_deleted(BINDER_STAT_TRANSACTION); 2410 } 2411 } break; 2412 case BINDER_WORK_TRANSACTION_COMPLETE: { 2413 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2414 "undelivered TRANSACTION_COMPLETE\n"); 2415 kfree(w); 2416 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2417 } break; 2418 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 2419 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 2420 struct binder_ref_death *death; 2421 2422 death = container_of(w, struct binder_ref_death, work); 2423 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2424 "undelivered death notification, %p\n", 2425 death->cookie); 2426 kfree(death); 2427 binder_stats_deleted(BINDER_STAT_DEATH); 2428 } break; 2429 default: 2430 pr_err("unexpected work type, %d, not freed\n", 2431 w->type); 2432 break; 2433 } 2434 } 2435 2436} 2437 2438static struct binder_thread *binder_get_thread(struct binder_proc *proc) 2439{ 2440 struct binder_thread *thread = NULL; 2441 struct rb_node *parent = NULL; 2442 struct rb_node **p = &proc->threads.rb_node; 2443 2444 while (*p) { 2445 parent = *p; 2446 thread = rb_entry(parent, struct binder_thread, rb_node); 2447 2448 if (current->pid < thread->pid) 2449 p = &(*p)->rb_left; 2450 else if (current->pid > thread->pid) 2451 p = &(*p)->rb_right; 2452 else 2453 break; 2454 } 2455 if (*p == NULL) { 2456 thread = kzalloc(sizeof(*thread), GFP_KERNEL); 2457 if (thread == NULL) 2458 return NULL; 2459 binder_stats_created(BINDER_STAT_THREAD); 2460 thread->proc = proc; 2461 thread->pid = current->pid; 2462 init_waitqueue_head(&thread->wait); 2463 INIT_LIST_HEAD(&thread->todo); 2464 rb_link_node(&thread->rb_node, parent, p); 2465 rb_insert_color(&thread->rb_node, &proc->threads); 2466 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2467 thread->return_error = BR_OK; 2468 thread->return_error2 = BR_OK; 2469 } 2470 return thread; 2471} 2472 2473static int binder_free_thread(struct binder_proc *proc, 2474 struct binder_thread *thread) 2475{ 2476 struct binder_transaction *t; 2477 struct binder_transaction *send_reply = NULL; 2478 int active_transactions = 0; 2479 2480 rb_erase(&thread->rb_node, &proc->threads); 2481 t = thread->transaction_stack; 2482 if (t && t->to_thread == thread) 2483 send_reply = t; 2484 while (t) { 2485 active_transactions++; 2486 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2487 "release %d:%d transaction %d %s, still active\n", 2488 proc->pid, thread->pid, 2489 t->debug_id, 2490 (t->to_thread == thread) ? "in" : "out"); 2491 2492 if (t->to_thread == thread) { 2493 t->to_proc = NULL; 2494 t->to_thread = NULL; 2495 if (t->buffer) { 2496 t->buffer->transaction = NULL; 2497 t->buffer = NULL; 2498 } 2499 t = t->to_parent; 2500 } else if (t->from == thread) { 2501 t->from = NULL; 2502 t = t->from_parent; 2503 } else 2504 BUG(); 2505 } 2506 if (send_reply) 2507 binder_send_failed_reply(send_reply, BR_DEAD_REPLY); 2508 binder_release_work(&thread->todo); 2509 kfree(thread); 2510 binder_stats_deleted(BINDER_STAT_THREAD); 2511 return active_transactions; 2512} 2513 2514static unsigned int binder_poll(struct file *filp, 2515 struct poll_table_struct *wait) 2516{ 2517 struct binder_proc *proc = filp->private_data; 2518 struct binder_thread *thread = NULL; 2519 int wait_for_proc_work; 2520 2521 binder_lock(__func__); 2522 2523 thread = binder_get_thread(proc); 2524 2525 wait_for_proc_work = thread->transaction_stack == NULL && 2526 list_empty(&thread->todo) && thread->return_error == BR_OK; 2527 2528 binder_unlock(__func__); 2529 2530 if (wait_for_proc_work) { 2531 if (binder_has_proc_work(proc, thread)) 2532 return POLLIN; 2533 poll_wait(filp, &proc->wait, wait); 2534 if (binder_has_proc_work(proc, thread)) 2535 return POLLIN; 2536 } else { 2537 if (binder_has_thread_work(thread)) 2538 return POLLIN; 2539 poll_wait(filp, &thread->wait, wait); 2540 if (binder_has_thread_work(thread)) 2541 return POLLIN; 2542 } 2543 return 0; 2544} 2545 2546static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 2547{ 2548 int ret; 2549 struct binder_proc *proc = filp->private_data; 2550 struct binder_thread *thread; 2551 unsigned int size = _IOC_SIZE(cmd); 2552 void __user *ubuf = (void __user *)arg; 2553 2554 /*pr_info("binder_ioctl: %d:%d %x %lx\n", proc->pid, current->pid, cmd, arg);*/ 2555 2556 trace_binder_ioctl(cmd, arg); 2557 2558 ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2559 if (ret) 2560 goto err_unlocked; 2561 2562 binder_lock(__func__); 2563 thread = binder_get_thread(proc); 2564 if (thread == NULL) { 2565 ret = -ENOMEM; 2566 goto err; 2567 } 2568 2569 switch (cmd) { 2570 case BINDER_WRITE_READ: { 2571 struct binder_write_read bwr; 2572 if (size != sizeof(struct binder_write_read)) { 2573 ret = -EINVAL; 2574 goto err; 2575 } 2576 if (copy_from_user(&bwr, ubuf, sizeof(bwr))) { 2577 ret = -EFAULT; 2578 goto err; 2579 } 2580 binder_debug(BINDER_DEBUG_READ_WRITE, 2581 "%d:%d write %ld at %08lx, read %ld at %08lx\n", 2582 proc->pid, thread->pid, bwr.write_size, 2583 bwr.write_buffer, bwr.read_size, bwr.read_buffer); 2584 2585 if (bwr.write_size > 0) { 2586 ret = binder_thread_write(proc, thread, (void __user *)bwr.write_buffer, bwr.write_size, &bwr.write_consumed); 2587 trace_binder_write_done(ret); 2588 if (ret < 0) { 2589 bwr.read_consumed = 0; 2590 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2591 ret = -EFAULT; 2592 goto err; 2593 } 2594 } 2595 if (bwr.read_size > 0) { 2596 ret = binder_thread_read(proc, thread, (void __user *)bwr.read_buffer, bwr.read_size, &bwr.read_consumed, filp->f_flags & O_NONBLOCK); 2597 trace_binder_read_done(ret); 2598 if (!list_empty(&proc->todo)) 2599 wake_up_interruptible(&proc->wait); 2600 if (ret < 0) { 2601 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2602 ret = -EFAULT; 2603 goto err; 2604 } 2605 } 2606 binder_debug(BINDER_DEBUG_READ_WRITE, 2607 "%d:%d wrote %ld of %ld, read return %ld of %ld\n", 2608 proc->pid, thread->pid, bwr.write_consumed, bwr.write_size, 2609 bwr.read_consumed, bwr.read_size); 2610 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) { 2611 ret = -EFAULT; 2612 goto err; 2613 } 2614 break; 2615 } 2616 case BINDER_SET_MAX_THREADS: 2617 if (copy_from_user(&proc->max_threads, ubuf, sizeof(proc->max_threads))) { 2618 ret = -EINVAL; 2619 goto err; 2620 } 2621 break; 2622 case BINDER_SET_CONTEXT_MGR: 2623 if (binder_context_mgr_node != NULL) { 2624 pr_err("BINDER_SET_CONTEXT_MGR already set\n"); 2625 ret = -EBUSY; 2626 goto err; 2627 } 2628 if (uid_valid(binder_context_mgr_uid)) { 2629 if (!uid_eq(binder_context_mgr_uid, current->cred->euid)) { 2630 pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n", 2631 from_kuid(&init_user_ns, current->cred->euid), 2632 from_kuid(&init_user_ns, binder_context_mgr_uid)); 2633 ret = -EPERM; 2634 goto err; 2635 } 2636 } else 2637 binder_context_mgr_uid = current->cred->euid; 2638 binder_context_mgr_node = binder_new_node(proc, NULL, NULL); 2639 if (binder_context_mgr_node == NULL) { 2640 ret = -ENOMEM; 2641 goto err; 2642 } 2643 binder_context_mgr_node->local_weak_refs++; 2644 binder_context_mgr_node->local_strong_refs++; 2645 binder_context_mgr_node->has_strong_ref = 1; 2646 binder_context_mgr_node->has_weak_ref = 1; 2647 break; 2648 case BINDER_THREAD_EXIT: 2649 binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n", 2650 proc->pid, thread->pid); 2651 binder_free_thread(proc, thread); 2652 thread = NULL; 2653 break; 2654 case BINDER_VERSION: 2655 if (size != sizeof(struct binder_version)) { 2656 ret = -EINVAL; 2657 goto err; 2658 } 2659 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION, &((struct binder_version *)ubuf)->protocol_version)) { 2660 ret = -EINVAL; 2661 goto err; 2662 } 2663 break; 2664 default: 2665 ret = -EINVAL; 2666 goto err; 2667 } 2668 ret = 0; 2669err: 2670 if (thread) 2671 thread->looper &= ~BINDER_LOOPER_STATE_NEED_RETURN; 2672 binder_unlock(__func__); 2673 wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2674 if (ret && ret != -ERESTARTSYS) 2675 pr_info("%d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret); 2676err_unlocked: 2677 trace_binder_ioctl_done(ret); 2678 return ret; 2679} 2680 2681static void binder_vma_open(struct vm_area_struct *vma) 2682{ 2683 struct binder_proc *proc = vma->vm_private_data; 2684 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2685 "%d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2686 proc->pid, vma->vm_start, vma->vm_end, 2687 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2688 (unsigned long)pgprot_val(vma->vm_page_prot)); 2689} 2690 2691static void binder_vma_close(struct vm_area_struct *vma) 2692{ 2693 struct binder_proc *proc = vma->vm_private_data; 2694 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2695 "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2696 proc->pid, vma->vm_start, vma->vm_end, 2697 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2698 (unsigned long)pgprot_val(vma->vm_page_prot)); 2699 proc->vma = NULL; 2700 proc->vma_vm_mm = NULL; 2701 binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES); 2702} 2703 2704static struct vm_operations_struct binder_vm_ops = { 2705 .open = binder_vma_open, 2706 .close = binder_vma_close, 2707}; 2708 2709static int binder_mmap(struct file *filp, struct vm_area_struct *vma) 2710{ 2711 int ret; 2712 struct vm_struct *area; 2713 struct binder_proc *proc = filp->private_data; 2714 const char *failure_string; 2715 struct binder_buffer *buffer; 2716 2717 if (proc->tsk != current) 2718 return -EINVAL; 2719 2720 if ((vma->vm_end - vma->vm_start) > SZ_4M) 2721 vma->vm_end = vma->vm_start + SZ_4M; 2722 2723 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2724 "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n", 2725 proc->pid, vma->vm_start, vma->vm_end, 2726 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2727 (unsigned long)pgprot_val(vma->vm_page_prot)); 2728 2729 if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) { 2730 ret = -EPERM; 2731 failure_string = "bad vm_flags"; 2732 goto err_bad_arg; 2733 } 2734 vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE; 2735 2736 mutex_lock(&binder_mmap_lock); 2737 if (proc->buffer) { 2738 ret = -EBUSY; 2739 failure_string = "already mapped"; 2740 goto err_already_mapped; 2741 } 2742 2743 area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP); 2744 if (area == NULL) { 2745 ret = -ENOMEM; 2746 failure_string = "get_vm_area"; 2747 goto err_get_vm_area_failed; 2748 } 2749 proc->buffer = area->addr; 2750 proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer; 2751 mutex_unlock(&binder_mmap_lock); 2752 2753#ifdef CONFIG_CPU_CACHE_VIPT 2754 if (cache_is_vipt_aliasing()) { 2755 while (CACHE_COLOUR((vma->vm_start ^ (uint32_t)proc->buffer))) { 2756 pr_info("binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer); 2757 vma->vm_start += PAGE_SIZE; 2758 } 2759 } 2760#endif 2761 proc->pages = kzalloc(sizeof(proc->pages[0]) * ((vma->vm_end - vma->vm_start) / PAGE_SIZE), GFP_KERNEL); 2762 if (proc->pages == NULL) { 2763 ret = -ENOMEM; 2764 failure_string = "alloc page array"; 2765 goto err_alloc_pages_failed; 2766 } 2767 proc->buffer_size = vma->vm_end - vma->vm_start; 2768 2769 vma->vm_ops = &binder_vm_ops; 2770 vma->vm_private_data = proc; 2771 2772 if (binder_update_page_range(proc, 1, proc->buffer, proc->buffer + PAGE_SIZE, vma)) { 2773 ret = -ENOMEM; 2774 failure_string = "alloc small buf"; 2775 goto err_alloc_small_buf_failed; 2776 } 2777 buffer = proc->buffer; 2778 INIT_LIST_HEAD(&proc->buffers); 2779 list_add(&buffer->entry, &proc->buffers); 2780 buffer->free = 1; 2781 binder_insert_free_buffer(proc, buffer); 2782 proc->free_async_space = proc->buffer_size / 2; 2783 barrier(); 2784 proc->files = get_files_struct(current); 2785 proc->vma = vma; 2786 proc->vma_vm_mm = vma->vm_mm; 2787 2788 /*pr_info("binder_mmap: %d %lx-%lx maps %p\n", 2789 proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/ 2790 return 0; 2791 2792err_alloc_small_buf_failed: 2793 kfree(proc->pages); 2794 proc->pages = NULL; 2795err_alloc_pages_failed: 2796 mutex_lock(&binder_mmap_lock); 2797 vfree(proc->buffer); 2798 proc->buffer = NULL; 2799err_get_vm_area_failed: 2800err_already_mapped: 2801 mutex_unlock(&binder_mmap_lock); 2802err_bad_arg: 2803 pr_err("binder_mmap: %d %lx-%lx %s failed %d\n", 2804 proc->pid, vma->vm_start, vma->vm_end, failure_string, ret); 2805 return ret; 2806} 2807 2808static int binder_open(struct inode *nodp, struct file *filp) 2809{ 2810 struct binder_proc *proc; 2811 2812 binder_debug(BINDER_DEBUG_OPEN_CLOSE, "binder_open: %d:%d\n", 2813 current->group_leader->pid, current->pid); 2814 2815 proc = kzalloc(sizeof(*proc), GFP_KERNEL); 2816 if (proc == NULL) 2817 return -ENOMEM; 2818 get_task_struct(current); 2819 proc->tsk = current; 2820 INIT_LIST_HEAD(&proc->todo); 2821 init_waitqueue_head(&proc->wait); 2822 proc->default_priority = task_nice(current); 2823 2824 binder_lock(__func__); 2825 2826 binder_stats_created(BINDER_STAT_PROC); 2827 hlist_add_head(&proc->proc_node, &binder_procs); 2828 proc->pid = current->group_leader->pid; 2829 INIT_LIST_HEAD(&proc->delivered_death); 2830 filp->private_data = proc; 2831 2832 binder_unlock(__func__); 2833 2834 if (binder_debugfs_dir_entry_proc) { 2835 char strbuf[11]; 2836 snprintf(strbuf, sizeof(strbuf), "%u", proc->pid); 2837 proc->debugfs_entry = debugfs_create_file(strbuf, S_IRUGO, 2838 binder_debugfs_dir_entry_proc, proc, &binder_proc_fops); 2839 } 2840 2841 return 0; 2842} 2843 2844static int binder_flush(struct file *filp, fl_owner_t id) 2845{ 2846 struct binder_proc *proc = filp->private_data; 2847 2848 binder_defer_work(proc, BINDER_DEFERRED_FLUSH); 2849 2850 return 0; 2851} 2852 2853static void binder_deferred_flush(struct binder_proc *proc) 2854{ 2855 struct rb_node *n; 2856 int wake_count = 0; 2857 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) { 2858 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node); 2859 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2860 if (thread->looper & BINDER_LOOPER_STATE_WAITING) { 2861 wake_up_interruptible(&thread->wait); 2862 wake_count++; 2863 } 2864 } 2865 wake_up_interruptible_all(&proc->wait); 2866 2867 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2868 "binder_flush: %d woke %d threads\n", proc->pid, 2869 wake_count); 2870} 2871 2872static int binder_release(struct inode *nodp, struct file *filp) 2873{ 2874 struct binder_proc *proc = filp->private_data; 2875 debugfs_remove(proc->debugfs_entry); 2876 binder_defer_work(proc, BINDER_DEFERRED_RELEASE); 2877 2878 return 0; 2879} 2880 2881static void binder_deferred_release(struct binder_proc *proc) 2882{ 2883 struct binder_transaction *t; 2884 struct rb_node *n; 2885 int threads, nodes, incoming_refs, outgoing_refs, buffers, active_transactions, page_count; 2886 2887 BUG_ON(proc->vma); 2888 BUG_ON(proc->files); 2889 2890 hlist_del(&proc->proc_node); 2891 if (binder_context_mgr_node && binder_context_mgr_node->proc == proc) { 2892 binder_debug(BINDER_DEBUG_DEAD_BINDER, 2893 "binder_release: %d context_mgr_node gone\n", 2894 proc->pid); 2895 binder_context_mgr_node = NULL; 2896 } 2897 2898 threads = 0; 2899 active_transactions = 0; 2900 while ((n = rb_first(&proc->threads))) { 2901 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node); 2902 threads++; 2903 active_transactions += binder_free_thread(proc, thread); 2904 } 2905 nodes = 0; 2906 incoming_refs = 0; 2907 while ((n = rb_first(&proc->nodes))) { 2908 struct binder_node *node = rb_entry(n, struct binder_node, rb_node); 2909 2910 nodes++; 2911 rb_erase(&node->rb_node, &proc->nodes); 2912 list_del_init(&node->work.entry); 2913 binder_release_work(&node->async_todo); 2914 if (hlist_empty(&node->refs)) { 2915 kfree(node); 2916 binder_stats_deleted(BINDER_STAT_NODE); 2917 } else { 2918 struct binder_ref *ref; 2919 int death = 0; 2920 2921 node->proc = NULL; 2922 node->local_strong_refs = 0; 2923 node->local_weak_refs = 0; 2924 hlist_add_head(&node->dead_node, &binder_dead_nodes); 2925 2926 hlist_for_each_entry(ref, &node->refs, node_entry) { 2927 incoming_refs++; 2928 if (ref->death) { 2929 death++; 2930 if (list_empty(&ref->death->work.entry)) { 2931 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 2932 list_add_tail(&ref->death->work.entry, &ref->proc->todo); 2933 wake_up_interruptible(&ref->proc->wait); 2934 } else 2935 BUG(); 2936 } 2937 } 2938 binder_debug(BINDER_DEBUG_DEAD_BINDER, 2939 "node %d now dead, refs %d, death %d\n", 2940 node->debug_id, incoming_refs, death); 2941 } 2942 } 2943 outgoing_refs = 0; 2944 while ((n = rb_first(&proc->refs_by_desc))) { 2945 struct binder_ref *ref = rb_entry(n, struct binder_ref, 2946 rb_node_desc); 2947 outgoing_refs++; 2948 binder_delete_ref(ref); 2949 } 2950 binder_release_work(&proc->todo); 2951 binder_release_work(&proc->delivered_death); 2952 buffers = 0; 2953 2954 while ((n = rb_first(&proc->allocated_buffers))) { 2955 struct binder_buffer *buffer = rb_entry(n, struct binder_buffer, 2956 rb_node); 2957 t = buffer->transaction; 2958 if (t) { 2959 t->buffer = NULL; 2960 buffer->transaction = NULL; 2961 pr_err("release proc %d, transaction %d, not freed\n", 2962 proc->pid, t->debug_id); 2963 /*BUG();*/ 2964 } 2965 binder_free_buf(proc, buffer); 2966 buffers++; 2967 } 2968 2969 binder_stats_deleted(BINDER_STAT_PROC); 2970 2971 page_count = 0; 2972 if (proc->pages) { 2973 int i; 2974 for (i = 0; i < proc->buffer_size / PAGE_SIZE; i++) { 2975 if (proc->pages[i]) { 2976 void *page_addr = proc->buffer + i * PAGE_SIZE; 2977 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 2978 "binder_release: %d: page %d at %p not freed\n", 2979 proc->pid, i, 2980 page_addr); 2981 unmap_kernel_range((unsigned long)page_addr, 2982 PAGE_SIZE); 2983 __free_page(proc->pages[i]); 2984 page_count++; 2985 } 2986 } 2987 kfree(proc->pages); 2988 vfree(proc->buffer); 2989 } 2990 2991 put_task_struct(proc->tsk); 2992 2993 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2994 "binder_release: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d, buffers %d, pages %d\n", 2995 proc->pid, threads, nodes, incoming_refs, outgoing_refs, 2996 active_transactions, buffers, page_count); 2997 2998 kfree(proc); 2999} 3000 3001static void binder_deferred_func(struct work_struct *work) 3002{ 3003 struct binder_proc *proc; 3004 struct files_struct *files; 3005 3006 int defer; 3007 do { 3008 binder_lock(__func__); 3009 mutex_lock(&binder_deferred_lock); 3010 if (!hlist_empty(&binder_deferred_list)) { 3011 proc = hlist_entry(binder_deferred_list.first, 3012 struct binder_proc, deferred_work_node); 3013 hlist_del_init(&proc->deferred_work_node); 3014 defer = proc->deferred_work; 3015 proc->deferred_work = 0; 3016 } else { 3017 proc = NULL; 3018 defer = 0; 3019 } 3020 mutex_unlock(&binder_deferred_lock); 3021 3022 files = NULL; 3023 if (defer & BINDER_DEFERRED_PUT_FILES) { 3024 files = proc->files; 3025 if (files) 3026 proc->files = NULL; 3027 } 3028 3029 if (defer & BINDER_DEFERRED_FLUSH) 3030 binder_deferred_flush(proc); 3031 3032 if (defer & BINDER_DEFERRED_RELEASE) 3033 binder_deferred_release(proc); /* frees proc */ 3034 3035 binder_unlock(__func__); 3036 if (files) 3037 put_files_struct(files); 3038 } while (proc); 3039} 3040static DECLARE_WORK(binder_deferred_work, binder_deferred_func); 3041 3042static void 3043binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer) 3044{ 3045 mutex_lock(&binder_deferred_lock); 3046 proc->deferred_work |= defer; 3047 if (hlist_unhashed(&proc->deferred_work_node)) { 3048 hlist_add_head(&proc->deferred_work_node, 3049 &binder_deferred_list); 3050 queue_work(binder_deferred_workqueue, &binder_deferred_work); 3051 } 3052 mutex_unlock(&binder_deferred_lock); 3053} 3054 3055static void print_binder_transaction(struct seq_file *m, const char *prefix, 3056 struct binder_transaction *t) 3057{ 3058 seq_printf(m, 3059 "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d", 3060 prefix, t->debug_id, t, 3061 t->from ? t->from->proc->pid : 0, 3062 t->from ? t->from->pid : 0, 3063 t->to_proc ? t->to_proc->pid : 0, 3064 t->to_thread ? t->to_thread->pid : 0, 3065 t->code, t->flags, t->priority, t->need_reply); 3066 if (t->buffer == NULL) { 3067 seq_puts(m, " buffer free\n"); 3068 return; 3069 } 3070 if (t->buffer->target_node) 3071 seq_printf(m, " node %d", 3072 t->buffer->target_node->debug_id); 3073 seq_printf(m, " size %zd:%zd data %p\n", 3074 t->buffer->data_size, t->buffer->offsets_size, 3075 t->buffer->data); 3076} 3077 3078static void print_binder_buffer(struct seq_file *m, const char *prefix, 3079 struct binder_buffer *buffer) 3080{ 3081 seq_printf(m, "%s %d: %p size %zd:%zd %s\n", 3082 prefix, buffer->debug_id, buffer->data, 3083 buffer->data_size, buffer->offsets_size, 3084 buffer->transaction ? "active" : "delivered"); 3085} 3086 3087static void print_binder_work(struct seq_file *m, const char *prefix, 3088 const char *transaction_prefix, 3089 struct binder_work *w) 3090{ 3091 struct binder_node *node; 3092 struct binder_transaction *t; 3093 3094 switch (w->type) { 3095 case BINDER_WORK_TRANSACTION: 3096 t = container_of(w, struct binder_transaction, work); 3097 print_binder_transaction(m, transaction_prefix, t); 3098 break; 3099 case BINDER_WORK_TRANSACTION_COMPLETE: 3100 seq_printf(m, "%stransaction complete\n", prefix); 3101 break; 3102 case BINDER_WORK_NODE: 3103 node = container_of(w, struct binder_node, work); 3104 seq_printf(m, "%snode work %d: u%p c%p\n", 3105 prefix, node->debug_id, node->ptr, node->cookie); 3106 break; 3107 case BINDER_WORK_DEAD_BINDER: 3108 seq_printf(m, "%shas dead binder\n", prefix); 3109 break; 3110 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 3111 seq_printf(m, "%shas cleared dead binder\n", prefix); 3112 break; 3113 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: 3114 seq_printf(m, "%shas cleared death notification\n", prefix); 3115 break; 3116 default: 3117 seq_printf(m, "%sunknown work: type %d\n", prefix, w->type); 3118 break; 3119 } 3120} 3121 3122static void print_binder_thread(struct seq_file *m, 3123 struct binder_thread *thread, 3124 int print_always) 3125{ 3126 struct binder_transaction *t; 3127 struct binder_work *w; 3128 size_t start_pos = m->count; 3129 size_t header_pos; 3130 3131 seq_printf(m, " thread %d: l %02x\n", thread->pid, thread->looper); 3132 header_pos = m->count; 3133 t = thread->transaction_stack; 3134 while (t) { 3135 if (t->from == thread) { 3136 print_binder_transaction(m, 3137 " outgoing transaction", t); 3138 t = t->from_parent; 3139 } else if (t->to_thread == thread) { 3140 print_binder_transaction(m, 3141 " incoming transaction", t); 3142 t = t->to_parent; 3143 } else { 3144 print_binder_transaction(m, " bad transaction", t); 3145 t = NULL; 3146 } 3147 } 3148 list_for_each_entry(w, &thread->todo, entry) { 3149 print_binder_work(m, " ", " pending transaction", w); 3150 } 3151 if (!print_always && m->count == header_pos) 3152 m->count = start_pos; 3153} 3154 3155static void print_binder_node(struct seq_file *m, struct binder_node *node) 3156{ 3157 struct binder_ref *ref; 3158 struct binder_work *w; 3159 int count; 3160 3161 count = 0; 3162 hlist_for_each_entry(ref, &node->refs, node_entry) 3163 count++; 3164 3165 seq_printf(m, " node %d: u%p c%p hs %d hw %d ls %d lw %d is %d iw %d", 3166 node->debug_id, node->ptr, node->cookie, 3167 node->has_strong_ref, node->has_weak_ref, 3168 node->local_strong_refs, node->local_weak_refs, 3169 node->internal_strong_refs, count); 3170 if (count) { 3171 seq_puts(m, " proc"); 3172 hlist_for_each_entry(ref, &node->refs, node_entry) 3173 seq_printf(m, " %d", ref->proc->pid); 3174 } 3175 seq_puts(m, "\n"); 3176 list_for_each_entry(w, &node->async_todo, entry) 3177 print_binder_work(m, " ", 3178 " pending async transaction", w); 3179} 3180 3181static void print_binder_ref(struct seq_file *m, struct binder_ref *ref) 3182{ 3183 seq_printf(m, " ref %d: desc %d %snode %d s %d w %d d %p\n", 3184 ref->debug_id, ref->desc, ref->node->proc ? "" : "dead ", 3185 ref->node->debug_id, ref->strong, ref->weak, ref->death); 3186} 3187 3188static void print_binder_proc(struct seq_file *m, 3189 struct binder_proc *proc, int print_all) 3190{ 3191 struct binder_work *w; 3192 struct rb_node *n; 3193 size_t start_pos = m->count; 3194 size_t header_pos; 3195 3196 seq_printf(m, "proc %d\n", proc->pid); 3197 header_pos = m->count; 3198 3199 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3200 print_binder_thread(m, rb_entry(n, struct binder_thread, 3201 rb_node), print_all); 3202 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) { 3203 struct binder_node *node = rb_entry(n, struct binder_node, 3204 rb_node); 3205 if (print_all || node->has_async_transaction) 3206 print_binder_node(m, node); 3207 } 3208 if (print_all) { 3209 for (n = rb_first(&proc->refs_by_desc); 3210 n != NULL; 3211 n = rb_next(n)) 3212 print_binder_ref(m, rb_entry(n, struct binder_ref, 3213 rb_node_desc)); 3214 } 3215 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3216 print_binder_buffer(m, " buffer", 3217 rb_entry(n, struct binder_buffer, rb_node)); 3218 list_for_each_entry(w, &proc->todo, entry) 3219 print_binder_work(m, " ", " pending transaction", w); 3220 list_for_each_entry(w, &proc->delivered_death, entry) { 3221 seq_puts(m, " has delivered dead binder\n"); 3222 break; 3223 } 3224 if (!print_all && m->count == header_pos) 3225 m->count = start_pos; 3226} 3227 3228static const char * const binder_return_strings[] = { 3229 "BR_ERROR", 3230 "BR_OK", 3231 "BR_TRANSACTION", 3232 "BR_REPLY", 3233 "BR_ACQUIRE_RESULT", 3234 "BR_DEAD_REPLY", 3235 "BR_TRANSACTION_COMPLETE", 3236 "BR_INCREFS", 3237 "BR_ACQUIRE", 3238 "BR_RELEASE", 3239 "BR_DECREFS", 3240 "BR_ATTEMPT_ACQUIRE", 3241 "BR_NOOP", 3242 "BR_SPAWN_LOOPER", 3243 "BR_FINISHED", 3244 "BR_DEAD_BINDER", 3245 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 3246 "BR_FAILED_REPLY" 3247}; 3248 3249static const char * const binder_command_strings[] = { 3250 "BC_TRANSACTION", 3251 "BC_REPLY", 3252 "BC_ACQUIRE_RESULT", 3253 "BC_FREE_BUFFER", 3254 "BC_INCREFS", 3255 "BC_ACQUIRE", 3256 "BC_RELEASE", 3257 "BC_DECREFS", 3258 "BC_INCREFS_DONE", 3259 "BC_ACQUIRE_DONE", 3260 "BC_ATTEMPT_ACQUIRE", 3261 "BC_REGISTER_LOOPER", 3262 "BC_ENTER_LOOPER", 3263 "BC_EXIT_LOOPER", 3264 "BC_REQUEST_DEATH_NOTIFICATION", 3265 "BC_CLEAR_DEATH_NOTIFICATION", 3266 "BC_DEAD_BINDER_DONE" 3267}; 3268 3269static const char * const binder_objstat_strings[] = { 3270 "proc", 3271 "thread", 3272 "node", 3273 "ref", 3274 "death", 3275 "transaction", 3276 "transaction_complete" 3277}; 3278 3279static void print_binder_stats(struct seq_file *m, const char *prefix, 3280 struct binder_stats *stats) 3281{ 3282 int i; 3283 3284 BUILD_BUG_ON(ARRAY_SIZE(stats->bc) != 3285 ARRAY_SIZE(binder_command_strings)); 3286 for (i = 0; i < ARRAY_SIZE(stats->bc); i++) { 3287 if (stats->bc[i]) 3288 seq_printf(m, "%s%s: %d\n", prefix, 3289 binder_command_strings[i], stats->bc[i]); 3290 } 3291 3292 BUILD_BUG_ON(ARRAY_SIZE(stats->br) != 3293 ARRAY_SIZE(binder_return_strings)); 3294 for (i = 0; i < ARRAY_SIZE(stats->br); i++) { 3295 if (stats->br[i]) 3296 seq_printf(m, "%s%s: %d\n", prefix, 3297 binder_return_strings[i], stats->br[i]); 3298 } 3299 3300 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 3301 ARRAY_SIZE(binder_objstat_strings)); 3302 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 3303 ARRAY_SIZE(stats->obj_deleted)); 3304 for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) { 3305 if (stats->obj_created[i] || stats->obj_deleted[i]) 3306 seq_printf(m, "%s%s: active %d total %d\n", prefix, 3307 binder_objstat_strings[i], 3308 stats->obj_created[i] - stats->obj_deleted[i], 3309 stats->obj_created[i]); 3310 } 3311} 3312 3313static void print_binder_proc_stats(struct seq_file *m, 3314 struct binder_proc *proc) 3315{ 3316 struct binder_work *w; 3317 struct rb_node *n; 3318 int count, strong, weak; 3319 3320 seq_printf(m, "proc %d\n", proc->pid); 3321 count = 0; 3322 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3323 count++; 3324 seq_printf(m, " threads: %d\n", count); 3325 seq_printf(m, " requested threads: %d+%d/%d\n" 3326 " ready threads %d\n" 3327 " free async space %zd\n", proc->requested_threads, 3328 proc->requested_threads_started, proc->max_threads, 3329 proc->ready_threads, proc->free_async_space); 3330 count = 0; 3331 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) 3332 count++; 3333 seq_printf(m, " nodes: %d\n", count); 3334 count = 0; 3335 strong = 0; 3336 weak = 0; 3337 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 3338 struct binder_ref *ref = rb_entry(n, struct binder_ref, 3339 rb_node_desc); 3340 count++; 3341 strong += ref->strong; 3342 weak += ref->weak; 3343 } 3344 seq_printf(m, " refs: %d s %d w %d\n", count, strong, weak); 3345 3346 count = 0; 3347 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3348 count++; 3349 seq_printf(m, " buffers: %d\n", count); 3350 3351 count = 0; 3352 list_for_each_entry(w, &proc->todo, entry) { 3353 switch (w->type) { 3354 case BINDER_WORK_TRANSACTION: 3355 count++; 3356 break; 3357 default: 3358 break; 3359 } 3360 } 3361 seq_printf(m, " pending transactions: %d\n", count); 3362 3363 print_binder_stats(m, " ", &proc->stats); 3364} 3365 3366 3367static int binder_state_show(struct seq_file *m, void *unused) 3368{ 3369 struct binder_proc *proc; 3370 struct binder_node *node; 3371 int do_lock = !binder_debug_no_lock; 3372 3373 if (do_lock) 3374 binder_lock(__func__); 3375 3376 seq_puts(m, "binder state:\n"); 3377 3378 if (!hlist_empty(&binder_dead_nodes)) 3379 seq_puts(m, "dead nodes:\n"); 3380 hlist_for_each_entry(node, &binder_dead_nodes, dead_node) 3381 print_binder_node(m, node); 3382 3383 hlist_for_each_entry(proc, &binder_procs, proc_node) 3384 print_binder_proc(m, proc, 1); 3385 if (do_lock) 3386 binder_unlock(__func__); 3387 return 0; 3388} 3389 3390static int binder_stats_show(struct seq_file *m, void *unused) 3391{ 3392 struct binder_proc *proc; 3393 int do_lock = !binder_debug_no_lock; 3394 3395 if (do_lock) 3396 binder_lock(__func__); 3397 3398 seq_puts(m, "binder stats:\n"); 3399 3400 print_binder_stats(m, "", &binder_stats); 3401 3402 hlist_for_each_entry(proc, &binder_procs, proc_node) 3403 print_binder_proc_stats(m, proc); 3404 if (do_lock) 3405 binder_unlock(__func__); 3406 return 0; 3407} 3408 3409static int binder_transactions_show(struct seq_file *m, void *unused) 3410{ 3411 struct binder_proc *proc; 3412 int do_lock = !binder_debug_no_lock; 3413 3414 if (do_lock) 3415 binder_lock(__func__); 3416 3417 seq_puts(m, "binder transactions:\n"); 3418 hlist_for_each_entry(proc, &binder_procs, proc_node) 3419 print_binder_proc(m, proc, 0); 3420 if (do_lock) 3421 binder_unlock(__func__); 3422 return 0; 3423} 3424 3425static int binder_proc_show(struct seq_file *m, void *unused) 3426{ 3427 struct binder_proc *proc = m->private; 3428 int do_lock = !binder_debug_no_lock; 3429 3430 if (do_lock) 3431 binder_lock(__func__); 3432 seq_puts(m, "binder proc state:\n"); 3433 print_binder_proc(m, proc, 1); 3434 if (do_lock) 3435 binder_unlock(__func__); 3436 return 0; 3437} 3438 3439static void print_binder_transaction_log_entry(struct seq_file *m, 3440 struct binder_transaction_log_entry *e) 3441{ 3442 seq_printf(m, 3443 "%d: %s from %d:%d to %d:%d node %d handle %d size %d:%d\n", 3444 e->debug_id, (e->call_type == 2) ? "reply" : 3445 ((e->call_type == 1) ? "async" : "call "), e->from_proc, 3446 e->from_thread, e->to_proc, e->to_thread, e->to_node, 3447 e->target_handle, e->data_size, e->offsets_size); 3448} 3449 3450static int binder_transaction_log_show(struct seq_file *m, void *unused) 3451{ 3452 struct binder_transaction_log *log = m->private; 3453 int i; 3454 3455 if (log->full) { 3456 for (i = log->next; i < ARRAY_SIZE(log->entry); i++) 3457 print_binder_transaction_log_entry(m, &log->entry[i]); 3458 } 3459 for (i = 0; i < log->next; i++) 3460 print_binder_transaction_log_entry(m, &log->entry[i]); 3461 return 0; 3462} 3463 3464static const struct file_operations binder_fops = { 3465 .owner = THIS_MODULE, 3466 .poll = binder_poll, 3467 .unlocked_ioctl = binder_ioctl, 3468 .mmap = binder_mmap, 3469 .open = binder_open, 3470 .flush = binder_flush, 3471 .release = binder_release, 3472}; 3473 3474static struct miscdevice binder_miscdev = { 3475 .minor = MISC_DYNAMIC_MINOR, 3476 .name = "binder", 3477 .fops = &binder_fops 3478}; 3479 3480BINDER_DEBUG_ENTRY(state); 3481BINDER_DEBUG_ENTRY(stats); 3482BINDER_DEBUG_ENTRY(transactions); 3483BINDER_DEBUG_ENTRY(transaction_log); 3484 3485static int __init binder_init(void) 3486{ 3487 int ret; 3488 3489 binder_deferred_workqueue = create_singlethread_workqueue("binder"); 3490 if (!binder_deferred_workqueue) 3491 return -ENOMEM; 3492 3493 binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL); 3494 if (binder_debugfs_dir_entry_root) 3495 binder_debugfs_dir_entry_proc = debugfs_create_dir("proc", 3496 binder_debugfs_dir_entry_root); 3497 ret = misc_register(&binder_miscdev); 3498 if (binder_debugfs_dir_entry_root) { 3499 debugfs_create_file("state", 3500 S_IRUGO, 3501 binder_debugfs_dir_entry_root, 3502 NULL, 3503 &binder_state_fops); 3504 debugfs_create_file("stats", 3505 S_IRUGO, 3506 binder_debugfs_dir_entry_root, 3507 NULL, 3508 &binder_stats_fops); 3509 debugfs_create_file("transactions", 3510 S_IRUGO, 3511 binder_debugfs_dir_entry_root, 3512 NULL, 3513 &binder_transactions_fops); 3514 debugfs_create_file("transaction_log", 3515 S_IRUGO, 3516 binder_debugfs_dir_entry_root, 3517 &binder_transaction_log, 3518 &binder_transaction_log_fops); 3519 debugfs_create_file("failed_transaction_log", 3520 S_IRUGO, 3521 binder_debugfs_dir_entry_root, 3522 &binder_transaction_log_failed, 3523 &binder_transaction_log_fops); 3524 } 3525 return ret; 3526} 3527 3528device_initcall(binder_init); 3529 3530#define CREATE_TRACE_POINTS 3531#include "binder_trace.h" 3532 3533MODULE_LICENSE("GPL v2"); 3534