binder.c revision d4ec15e16ff0d72f9a3f1909b1ed20515f1f40d0
1/* binder.c 2 * 3 * Android IPC Subsystem 4 * 5 * Copyright (C) 2007-2008 Google, Inc. 6 * 7 * This software is licensed under the terms of the GNU General Public 8 * License version 2, as published by the Free Software Foundation, and 9 * may be copied, distributed, and modified under those terms. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 */ 17 18#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 19 20#include <asm/cacheflush.h> 21#include <linux/fdtable.h> 22#include <linux/file.h> 23#include <linux/freezer.h> 24#include <linux/fs.h> 25#include <linux/list.h> 26#include <linux/miscdevice.h> 27#include <linux/mm.h> 28#include <linux/module.h> 29#include <linux/mutex.h> 30#include <linux/nsproxy.h> 31#include <linux/poll.h> 32#include <linux/debugfs.h> 33#include <linux/rbtree.h> 34#include <linux/sched.h> 35#include <linux/seq_file.h> 36#include <linux/uaccess.h> 37#include <linux/vmalloc.h> 38#include <linux/slab.h> 39#include <linux/pid_namespace.h> 40 41#include "binder.h" 42#include "binder_trace.h" 43 44static DEFINE_MUTEX(binder_main_lock); 45static DEFINE_MUTEX(binder_deferred_lock); 46static DEFINE_MUTEX(binder_mmap_lock); 47 48static HLIST_HEAD(binder_procs); 49static HLIST_HEAD(binder_deferred_list); 50static HLIST_HEAD(binder_dead_nodes); 51 52static struct dentry *binder_debugfs_dir_entry_root; 53static struct dentry *binder_debugfs_dir_entry_proc; 54static struct binder_node *binder_context_mgr_node; 55static kuid_t binder_context_mgr_uid = INVALID_UID; 56static int binder_last_id; 57static struct workqueue_struct *binder_deferred_workqueue; 58 59#define BINDER_DEBUG_ENTRY(name) \ 60static int binder_##name##_open(struct inode *inode, struct file *file) \ 61{ \ 62 return single_open(file, binder_##name##_show, inode->i_private); \ 63} \ 64\ 65static const struct file_operations binder_##name##_fops = { \ 66 .owner = THIS_MODULE, \ 67 .open = binder_##name##_open, \ 68 .read = seq_read, \ 69 .llseek = seq_lseek, \ 70 .release = single_release, \ 71} 72 73static int binder_proc_show(struct seq_file *m, void *unused); 74BINDER_DEBUG_ENTRY(proc); 75 76/* This is only defined in include/asm-arm/sizes.h */ 77#ifndef SZ_1K 78#define SZ_1K 0x400 79#endif 80 81#ifndef SZ_4M 82#define SZ_4M 0x400000 83#endif 84 85#define FORBIDDEN_MMAP_FLAGS (VM_WRITE) 86 87#define BINDER_SMALL_BUF_SIZE (PAGE_SIZE * 64) 88 89enum { 90 BINDER_DEBUG_USER_ERROR = 1U << 0, 91 BINDER_DEBUG_FAILED_TRANSACTION = 1U << 1, 92 BINDER_DEBUG_DEAD_TRANSACTION = 1U << 2, 93 BINDER_DEBUG_OPEN_CLOSE = 1U << 3, 94 BINDER_DEBUG_DEAD_BINDER = 1U << 4, 95 BINDER_DEBUG_DEATH_NOTIFICATION = 1U << 5, 96 BINDER_DEBUG_READ_WRITE = 1U << 6, 97 BINDER_DEBUG_USER_REFS = 1U << 7, 98 BINDER_DEBUG_THREADS = 1U << 8, 99 BINDER_DEBUG_TRANSACTION = 1U << 9, 100 BINDER_DEBUG_TRANSACTION_COMPLETE = 1U << 10, 101 BINDER_DEBUG_FREE_BUFFER = 1U << 11, 102 BINDER_DEBUG_INTERNAL_REFS = 1U << 12, 103 BINDER_DEBUG_BUFFER_ALLOC = 1U << 13, 104 BINDER_DEBUG_PRIORITY_CAP = 1U << 14, 105 BINDER_DEBUG_BUFFER_ALLOC_ASYNC = 1U << 15, 106}; 107static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR | 108 BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION; 109module_param_named(debug_mask, binder_debug_mask, uint, S_IWUSR | S_IRUGO); 110 111static bool binder_debug_no_lock; 112module_param_named(proc_no_lock, binder_debug_no_lock, bool, S_IWUSR | S_IRUGO); 113 114static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait); 115static int binder_stop_on_user_error; 116 117static int binder_set_stop_on_user_error(const char *val, 118 struct kernel_param *kp) 119{ 120 int ret; 121 122 ret = param_set_int(val, kp); 123 if (binder_stop_on_user_error < 2) 124 wake_up(&binder_user_error_wait); 125 return ret; 126} 127module_param_call(stop_on_user_error, binder_set_stop_on_user_error, 128 param_get_int, &binder_stop_on_user_error, S_IWUSR | S_IRUGO); 129 130#define binder_debug(mask, x...) \ 131 do { \ 132 if (binder_debug_mask & mask) \ 133 pr_info(x); \ 134 } while (0) 135 136#define binder_user_error(x...) \ 137 do { \ 138 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \ 139 pr_info(x); \ 140 if (binder_stop_on_user_error) \ 141 binder_stop_on_user_error = 2; \ 142 } while (0) 143 144enum binder_stat_types { 145 BINDER_STAT_PROC, 146 BINDER_STAT_THREAD, 147 BINDER_STAT_NODE, 148 BINDER_STAT_REF, 149 BINDER_STAT_DEATH, 150 BINDER_STAT_TRANSACTION, 151 BINDER_STAT_TRANSACTION_COMPLETE, 152 BINDER_STAT_COUNT 153}; 154 155struct binder_stats { 156 int br[_IOC_NR(BR_FAILED_REPLY) + 1]; 157 int bc[_IOC_NR(BC_DEAD_BINDER_DONE) + 1]; 158 int obj_created[BINDER_STAT_COUNT]; 159 int obj_deleted[BINDER_STAT_COUNT]; 160}; 161 162static struct binder_stats binder_stats; 163 164static inline void binder_stats_deleted(enum binder_stat_types type) 165{ 166 binder_stats.obj_deleted[type]++; 167} 168 169static inline void binder_stats_created(enum binder_stat_types type) 170{ 171 binder_stats.obj_created[type]++; 172} 173 174struct binder_transaction_log_entry { 175 int debug_id; 176 int call_type; 177 int from_proc; 178 int from_thread; 179 int target_handle; 180 int to_proc; 181 int to_thread; 182 int to_node; 183 int data_size; 184 int offsets_size; 185}; 186struct binder_transaction_log { 187 int next; 188 int full; 189 struct binder_transaction_log_entry entry[32]; 190}; 191static struct binder_transaction_log binder_transaction_log; 192static struct binder_transaction_log binder_transaction_log_failed; 193 194static struct binder_transaction_log_entry *binder_transaction_log_add( 195 struct binder_transaction_log *log) 196{ 197 struct binder_transaction_log_entry *e; 198 199 e = &log->entry[log->next]; 200 memset(e, 0, sizeof(*e)); 201 log->next++; 202 if (log->next == ARRAY_SIZE(log->entry)) { 203 log->next = 0; 204 log->full = 1; 205 } 206 return e; 207} 208 209struct binder_work { 210 struct list_head entry; 211 enum { 212 BINDER_WORK_TRANSACTION = 1, 213 BINDER_WORK_TRANSACTION_COMPLETE, 214 BINDER_WORK_NODE, 215 BINDER_WORK_DEAD_BINDER, 216 BINDER_WORK_DEAD_BINDER_AND_CLEAR, 217 BINDER_WORK_CLEAR_DEATH_NOTIFICATION, 218 } type; 219}; 220 221struct binder_node { 222 int debug_id; 223 struct binder_work work; 224 union { 225 struct rb_node rb_node; 226 struct hlist_node dead_node; 227 }; 228 struct binder_proc *proc; 229 struct hlist_head refs; 230 int internal_strong_refs; 231 int local_weak_refs; 232 int local_strong_refs; 233 binder_uintptr_t ptr; 234 binder_uintptr_t cookie; 235 unsigned has_strong_ref:1; 236 unsigned pending_strong_ref:1; 237 unsigned has_weak_ref:1; 238 unsigned pending_weak_ref:1; 239 unsigned has_async_transaction:1; 240 unsigned accept_fds:1; 241 unsigned min_priority:8; 242 struct list_head async_todo; 243}; 244 245struct binder_ref_death { 246 struct binder_work work; 247 binder_uintptr_t cookie; 248}; 249 250struct binder_ref { 251 /* Lookups needed: */ 252 /* node + proc => ref (transaction) */ 253 /* desc + proc => ref (transaction, inc/dec ref) */ 254 /* node => refs + procs (proc exit) */ 255 int debug_id; 256 struct rb_node rb_node_desc; 257 struct rb_node rb_node_node; 258 struct hlist_node node_entry; 259 struct binder_proc *proc; 260 struct binder_node *node; 261 uint32_t desc; 262 int strong; 263 int weak; 264 struct binder_ref_death *death; 265}; 266 267struct binder_buffer { 268 struct list_head entry; /* free and allocated entries by address */ 269 struct rb_node rb_node; /* free entry by size or allocated entry */ 270 /* by address */ 271 unsigned free:1; 272 unsigned allow_user_free:1; 273 unsigned async_transaction:1; 274 unsigned debug_id:29; 275 276 struct binder_transaction *transaction; 277 278 struct binder_node *target_node; 279 size_t data_size; 280 size_t offsets_size; 281 uint8_t data[0]; 282}; 283 284enum binder_deferred_state { 285 BINDER_DEFERRED_PUT_FILES = 0x01, 286 BINDER_DEFERRED_FLUSH = 0x02, 287 BINDER_DEFERRED_RELEASE = 0x04, 288}; 289 290struct binder_proc { 291 struct hlist_node proc_node; 292 struct rb_root threads; 293 struct rb_root nodes; 294 struct rb_root refs_by_desc; 295 struct rb_root refs_by_node; 296 int pid; 297 struct vm_area_struct *vma; 298 struct mm_struct *vma_vm_mm; 299 struct task_struct *tsk; 300 struct files_struct *files; 301 struct hlist_node deferred_work_node; 302 int deferred_work; 303 void *buffer; 304 ptrdiff_t user_buffer_offset; 305 306 struct list_head buffers; 307 struct rb_root free_buffers; 308 struct rb_root allocated_buffers; 309 size_t free_async_space; 310 311 struct page **pages; 312 size_t buffer_size; 313 uint32_t buffer_free; 314 struct list_head todo; 315 wait_queue_head_t wait; 316 struct binder_stats stats; 317 struct list_head delivered_death; 318 int max_threads; 319 int requested_threads; 320 int requested_threads_started; 321 int ready_threads; 322 long default_priority; 323 struct dentry *debugfs_entry; 324}; 325 326enum { 327 BINDER_LOOPER_STATE_REGISTERED = 0x01, 328 BINDER_LOOPER_STATE_ENTERED = 0x02, 329 BINDER_LOOPER_STATE_EXITED = 0x04, 330 BINDER_LOOPER_STATE_INVALID = 0x08, 331 BINDER_LOOPER_STATE_WAITING = 0x10, 332 BINDER_LOOPER_STATE_NEED_RETURN = 0x20 333}; 334 335struct binder_thread { 336 struct binder_proc *proc; 337 struct rb_node rb_node; 338 int pid; 339 int looper; 340 struct binder_transaction *transaction_stack; 341 struct list_head todo; 342 uint32_t return_error; /* Write failed, return error code in read buf */ 343 uint32_t return_error2; /* Write failed, return error code in read */ 344 /* buffer. Used when sending a reply to a dead process that */ 345 /* we are also waiting on */ 346 wait_queue_head_t wait; 347 struct binder_stats stats; 348}; 349 350struct binder_transaction { 351 int debug_id; 352 struct binder_work work; 353 struct binder_thread *from; 354 struct binder_transaction *from_parent; 355 struct binder_proc *to_proc; 356 struct binder_thread *to_thread; 357 struct binder_transaction *to_parent; 358 unsigned need_reply:1; 359 /* unsigned is_dead:1; */ /* not used at the moment */ 360 361 struct binder_buffer *buffer; 362 unsigned int code; 363 unsigned int flags; 364 long priority; 365 long saved_priority; 366 kuid_t sender_euid; 367}; 368 369static void 370binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer); 371 372static int task_get_unused_fd_flags(struct binder_proc *proc, int flags) 373{ 374 struct files_struct *files = proc->files; 375 unsigned long rlim_cur; 376 unsigned long irqs; 377 378 if (files == NULL) 379 return -ESRCH; 380 381 if (!lock_task_sighand(proc->tsk, &irqs)) 382 return -EMFILE; 383 384 rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE); 385 unlock_task_sighand(proc->tsk, &irqs); 386 387 return __alloc_fd(files, 0, rlim_cur, flags); 388} 389 390/* 391 * copied from fd_install 392 */ 393static void task_fd_install( 394 struct binder_proc *proc, unsigned int fd, struct file *file) 395{ 396 if (proc->files) 397 __fd_install(proc->files, fd, file); 398} 399 400/* 401 * copied from sys_close 402 */ 403static long task_close_fd(struct binder_proc *proc, unsigned int fd) 404{ 405 int retval; 406 407 if (proc->files == NULL) 408 return -ESRCH; 409 410 retval = __close_fd(proc->files, fd); 411 /* can't restart close syscall because file table entry was cleared */ 412 if (unlikely(retval == -ERESTARTSYS || 413 retval == -ERESTARTNOINTR || 414 retval == -ERESTARTNOHAND || 415 retval == -ERESTART_RESTARTBLOCK)) 416 retval = -EINTR; 417 418 return retval; 419} 420 421static inline void binder_lock(const char *tag) 422{ 423 trace_binder_lock(tag); 424 mutex_lock(&binder_main_lock); 425 trace_binder_locked(tag); 426} 427 428static inline void binder_unlock(const char *tag) 429{ 430 trace_binder_unlock(tag); 431 mutex_unlock(&binder_main_lock); 432} 433 434static void binder_set_nice(long nice) 435{ 436 long min_nice; 437 438 if (can_nice(current, nice)) { 439 set_user_nice(current, nice); 440 return; 441 } 442 min_nice = rlimit_to_nice(current->signal->rlim[RLIMIT_NICE].rlim_cur); 443 binder_debug(BINDER_DEBUG_PRIORITY_CAP, 444 "%d: nice value %ld not allowed use %ld instead\n", 445 current->pid, nice, min_nice); 446 set_user_nice(current, min_nice); 447 if (min_nice <= MAX_NICE) 448 return; 449 binder_user_error("%d RLIMIT_NICE not set\n", current->pid); 450} 451 452static size_t binder_buffer_size(struct binder_proc *proc, 453 struct binder_buffer *buffer) 454{ 455 if (list_is_last(&buffer->entry, &proc->buffers)) 456 return proc->buffer + proc->buffer_size - (void *)buffer->data; 457 return (size_t)list_entry(buffer->entry.next, 458 struct binder_buffer, entry) - (size_t)buffer->data; 459} 460 461static void binder_insert_free_buffer(struct binder_proc *proc, 462 struct binder_buffer *new_buffer) 463{ 464 struct rb_node **p = &proc->free_buffers.rb_node; 465 struct rb_node *parent = NULL; 466 struct binder_buffer *buffer; 467 size_t buffer_size; 468 size_t new_buffer_size; 469 470 BUG_ON(!new_buffer->free); 471 472 new_buffer_size = binder_buffer_size(proc, new_buffer); 473 474 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 475 "%d: add free buffer, size %zd, at %p\n", 476 proc->pid, new_buffer_size, new_buffer); 477 478 while (*p) { 479 parent = *p; 480 buffer = rb_entry(parent, struct binder_buffer, rb_node); 481 BUG_ON(!buffer->free); 482 483 buffer_size = binder_buffer_size(proc, buffer); 484 485 if (new_buffer_size < buffer_size) 486 p = &parent->rb_left; 487 else 488 p = &parent->rb_right; 489 } 490 rb_link_node(&new_buffer->rb_node, parent, p); 491 rb_insert_color(&new_buffer->rb_node, &proc->free_buffers); 492} 493 494static void binder_insert_allocated_buffer(struct binder_proc *proc, 495 struct binder_buffer *new_buffer) 496{ 497 struct rb_node **p = &proc->allocated_buffers.rb_node; 498 struct rb_node *parent = NULL; 499 struct binder_buffer *buffer; 500 501 BUG_ON(new_buffer->free); 502 503 while (*p) { 504 parent = *p; 505 buffer = rb_entry(parent, struct binder_buffer, rb_node); 506 BUG_ON(buffer->free); 507 508 if (new_buffer < buffer) 509 p = &parent->rb_left; 510 else if (new_buffer > buffer) 511 p = &parent->rb_right; 512 else 513 BUG(); 514 } 515 rb_link_node(&new_buffer->rb_node, parent, p); 516 rb_insert_color(&new_buffer->rb_node, &proc->allocated_buffers); 517} 518 519static struct binder_buffer *binder_buffer_lookup(struct binder_proc *proc, 520 uintptr_t user_ptr) 521{ 522 struct rb_node *n = proc->allocated_buffers.rb_node; 523 struct binder_buffer *buffer; 524 struct binder_buffer *kern_ptr; 525 526 kern_ptr = (struct binder_buffer *)(user_ptr - proc->user_buffer_offset 527 - offsetof(struct binder_buffer, data)); 528 529 while (n) { 530 buffer = rb_entry(n, struct binder_buffer, rb_node); 531 BUG_ON(buffer->free); 532 533 if (kern_ptr < buffer) 534 n = n->rb_left; 535 else if (kern_ptr > buffer) 536 n = n->rb_right; 537 else 538 return buffer; 539 } 540 return NULL; 541} 542 543static int binder_update_page_range(struct binder_proc *proc, int allocate, 544 void *start, void *end, 545 struct vm_area_struct *vma) 546{ 547 void *page_addr; 548 unsigned long user_page_addr; 549 struct vm_struct tmp_area; 550 struct page **page; 551 struct mm_struct *mm; 552 553 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 554 "%d: %s pages %p-%p\n", proc->pid, 555 allocate ? "allocate" : "free", start, end); 556 557 if (end <= start) 558 return 0; 559 560 trace_binder_update_page_range(proc, allocate, start, end); 561 562 if (vma) 563 mm = NULL; 564 else 565 mm = get_task_mm(proc->tsk); 566 567 if (mm) { 568 down_write(&mm->mmap_sem); 569 vma = proc->vma; 570 if (vma && mm != proc->vma_vm_mm) { 571 pr_err("%d: vma mm and task mm mismatch\n", 572 proc->pid); 573 vma = NULL; 574 } 575 } 576 577 if (allocate == 0) 578 goto free_range; 579 580 if (vma == NULL) { 581 pr_err("%d: binder_alloc_buf failed to map pages in userspace, no vma\n", 582 proc->pid); 583 goto err_no_vma; 584 } 585 586 for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) { 587 int ret; 588 struct page **page_array_ptr; 589 590 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 591 592 BUG_ON(*page); 593 *page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO); 594 if (*page == NULL) { 595 pr_err("%d: binder_alloc_buf failed for page at %p\n", 596 proc->pid, page_addr); 597 goto err_alloc_page_failed; 598 } 599 tmp_area.addr = page_addr; 600 tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */; 601 page_array_ptr = page; 602 ret = map_vm_area(&tmp_area, PAGE_KERNEL, &page_array_ptr); 603 if (ret) { 604 pr_err("%d: binder_alloc_buf failed to map page at %p in kernel\n", 605 proc->pid, page_addr); 606 goto err_map_kernel_failed; 607 } 608 user_page_addr = 609 (uintptr_t)page_addr + proc->user_buffer_offset; 610 ret = vm_insert_page(vma, user_page_addr, page[0]); 611 if (ret) { 612 pr_err("%d: binder_alloc_buf failed to map page at %lx in userspace\n", 613 proc->pid, user_page_addr); 614 goto err_vm_insert_page_failed; 615 } 616 /* vm_insert_page does not seem to increment the refcount */ 617 } 618 if (mm) { 619 up_write(&mm->mmap_sem); 620 mmput(mm); 621 } 622 return 0; 623 624free_range: 625 for (page_addr = end - PAGE_SIZE; page_addr >= start; 626 page_addr -= PAGE_SIZE) { 627 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 628 if (vma) 629 zap_page_range(vma, (uintptr_t)page_addr + 630 proc->user_buffer_offset, PAGE_SIZE, NULL); 631err_vm_insert_page_failed: 632 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE); 633err_map_kernel_failed: 634 __free_page(*page); 635 *page = NULL; 636err_alloc_page_failed: 637 ; 638 } 639err_no_vma: 640 if (mm) { 641 up_write(&mm->mmap_sem); 642 mmput(mm); 643 } 644 return -ENOMEM; 645} 646 647static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc, 648 size_t data_size, 649 size_t offsets_size, int is_async) 650{ 651 struct rb_node *n = proc->free_buffers.rb_node; 652 struct binder_buffer *buffer; 653 size_t buffer_size; 654 struct rb_node *best_fit = NULL; 655 void *has_page_addr; 656 void *end_page_addr; 657 size_t size; 658 659 if (proc->vma == NULL) { 660 pr_err("%d: binder_alloc_buf, no vma\n", 661 proc->pid); 662 return NULL; 663 } 664 665 size = ALIGN(data_size, sizeof(void *)) + 666 ALIGN(offsets_size, sizeof(void *)); 667 668 if (size < data_size || size < offsets_size) { 669 binder_user_error("%d: got transaction with invalid size %zd-%zd\n", 670 proc->pid, data_size, offsets_size); 671 return NULL; 672 } 673 674 if (is_async && 675 proc->free_async_space < size + sizeof(struct binder_buffer)) { 676 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 677 "%d: binder_alloc_buf size %zd failed, no async space left\n", 678 proc->pid, size); 679 return NULL; 680 } 681 682 while (n) { 683 buffer = rb_entry(n, struct binder_buffer, rb_node); 684 BUG_ON(!buffer->free); 685 buffer_size = binder_buffer_size(proc, buffer); 686 687 if (size < buffer_size) { 688 best_fit = n; 689 n = n->rb_left; 690 } else if (size > buffer_size) 691 n = n->rb_right; 692 else { 693 best_fit = n; 694 break; 695 } 696 } 697 if (best_fit == NULL) { 698 pr_err("%d: binder_alloc_buf size %zd failed, no address space\n", 699 proc->pid, size); 700 return NULL; 701 } 702 if (n == NULL) { 703 buffer = rb_entry(best_fit, struct binder_buffer, rb_node); 704 buffer_size = binder_buffer_size(proc, buffer); 705 } 706 707 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 708 "%d: binder_alloc_buf size %zd got buffer %p size %zd\n", 709 proc->pid, size, buffer, buffer_size); 710 711 has_page_addr = 712 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK); 713 if (n == NULL) { 714 if (size + sizeof(struct binder_buffer) + 4 >= buffer_size) 715 buffer_size = size; /* no room for other buffers */ 716 else 717 buffer_size = size + sizeof(struct binder_buffer); 718 } 719 end_page_addr = 720 (void *)PAGE_ALIGN((uintptr_t)buffer->data + buffer_size); 721 if (end_page_addr > has_page_addr) 722 end_page_addr = has_page_addr; 723 if (binder_update_page_range(proc, 1, 724 (void *)PAGE_ALIGN((uintptr_t)buffer->data), end_page_addr, NULL)) 725 return NULL; 726 727 rb_erase(best_fit, &proc->free_buffers); 728 buffer->free = 0; 729 binder_insert_allocated_buffer(proc, buffer); 730 if (buffer_size != size) { 731 struct binder_buffer *new_buffer = (void *)buffer->data + size; 732 733 list_add(&new_buffer->entry, &buffer->entry); 734 new_buffer->free = 1; 735 binder_insert_free_buffer(proc, new_buffer); 736 } 737 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 738 "%d: binder_alloc_buf size %zd got %p\n", 739 proc->pid, size, buffer); 740 buffer->data_size = data_size; 741 buffer->offsets_size = offsets_size; 742 buffer->async_transaction = is_async; 743 if (is_async) { 744 proc->free_async_space -= size + sizeof(struct binder_buffer); 745 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 746 "%d: binder_alloc_buf size %zd async free %zd\n", 747 proc->pid, size, proc->free_async_space); 748 } 749 750 return buffer; 751} 752 753static void *buffer_start_page(struct binder_buffer *buffer) 754{ 755 return (void *)((uintptr_t)buffer & PAGE_MASK); 756} 757 758static void *buffer_end_page(struct binder_buffer *buffer) 759{ 760 return (void *)(((uintptr_t)(buffer + 1) - 1) & PAGE_MASK); 761} 762 763static void binder_delete_free_buffer(struct binder_proc *proc, 764 struct binder_buffer *buffer) 765{ 766 struct binder_buffer *prev, *next = NULL; 767 int free_page_end = 1; 768 int free_page_start = 1; 769 770 BUG_ON(proc->buffers.next == &buffer->entry); 771 prev = list_entry(buffer->entry.prev, struct binder_buffer, entry); 772 BUG_ON(!prev->free); 773 if (buffer_end_page(prev) == buffer_start_page(buffer)) { 774 free_page_start = 0; 775 if (buffer_end_page(prev) == buffer_end_page(buffer)) 776 free_page_end = 0; 777 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 778 "%d: merge free, buffer %p share page with %p\n", 779 proc->pid, buffer, prev); 780 } 781 782 if (!list_is_last(&buffer->entry, &proc->buffers)) { 783 next = list_entry(buffer->entry.next, 784 struct binder_buffer, entry); 785 if (buffer_start_page(next) == buffer_end_page(buffer)) { 786 free_page_end = 0; 787 if (buffer_start_page(next) == 788 buffer_start_page(buffer)) 789 free_page_start = 0; 790 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 791 "%d: merge free, buffer %p share page with %p\n", 792 proc->pid, buffer, prev); 793 } 794 } 795 list_del(&buffer->entry); 796 if (free_page_start || free_page_end) { 797 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 798 "%d: merge free, buffer %p do not share page%s%s with %p or %p\n", 799 proc->pid, buffer, free_page_start ? "" : " end", 800 free_page_end ? "" : " start", prev, next); 801 binder_update_page_range(proc, 0, free_page_start ? 802 buffer_start_page(buffer) : buffer_end_page(buffer), 803 (free_page_end ? buffer_end_page(buffer) : 804 buffer_start_page(buffer)) + PAGE_SIZE, NULL); 805 } 806} 807 808static void binder_free_buf(struct binder_proc *proc, 809 struct binder_buffer *buffer) 810{ 811 size_t size, buffer_size; 812 813 buffer_size = binder_buffer_size(proc, buffer); 814 815 size = ALIGN(buffer->data_size, sizeof(void *)) + 816 ALIGN(buffer->offsets_size, sizeof(void *)); 817 818 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 819 "%d: binder_free_buf %p size %zd buffer_size %zd\n", 820 proc->pid, buffer, size, buffer_size); 821 822 BUG_ON(buffer->free); 823 BUG_ON(size > buffer_size); 824 BUG_ON(buffer->transaction != NULL); 825 BUG_ON((void *)buffer < proc->buffer); 826 BUG_ON((void *)buffer > proc->buffer + proc->buffer_size); 827 828 if (buffer->async_transaction) { 829 proc->free_async_space += size + sizeof(struct binder_buffer); 830 831 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 832 "%d: binder_free_buf size %zd async free %zd\n", 833 proc->pid, size, proc->free_async_space); 834 } 835 836 binder_update_page_range(proc, 0, 837 (void *)PAGE_ALIGN((uintptr_t)buffer->data), 838 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK), 839 NULL); 840 rb_erase(&buffer->rb_node, &proc->allocated_buffers); 841 buffer->free = 1; 842 if (!list_is_last(&buffer->entry, &proc->buffers)) { 843 struct binder_buffer *next = list_entry(buffer->entry.next, 844 struct binder_buffer, entry); 845 846 if (next->free) { 847 rb_erase(&next->rb_node, &proc->free_buffers); 848 binder_delete_free_buffer(proc, next); 849 } 850 } 851 if (proc->buffers.next != &buffer->entry) { 852 struct binder_buffer *prev = list_entry(buffer->entry.prev, 853 struct binder_buffer, entry); 854 855 if (prev->free) { 856 binder_delete_free_buffer(proc, buffer); 857 rb_erase(&prev->rb_node, &proc->free_buffers); 858 buffer = prev; 859 } 860 } 861 binder_insert_free_buffer(proc, buffer); 862} 863 864static struct binder_node *binder_get_node(struct binder_proc *proc, 865 binder_uintptr_t ptr) 866{ 867 struct rb_node *n = proc->nodes.rb_node; 868 struct binder_node *node; 869 870 while (n) { 871 node = rb_entry(n, struct binder_node, rb_node); 872 873 if (ptr < node->ptr) 874 n = n->rb_left; 875 else if (ptr > node->ptr) 876 n = n->rb_right; 877 else 878 return node; 879 } 880 return NULL; 881} 882 883static struct binder_node *binder_new_node(struct binder_proc *proc, 884 binder_uintptr_t ptr, 885 binder_uintptr_t cookie) 886{ 887 struct rb_node **p = &proc->nodes.rb_node; 888 struct rb_node *parent = NULL; 889 struct binder_node *node; 890 891 while (*p) { 892 parent = *p; 893 node = rb_entry(parent, struct binder_node, rb_node); 894 895 if (ptr < node->ptr) 896 p = &(*p)->rb_left; 897 else if (ptr > node->ptr) 898 p = &(*p)->rb_right; 899 else 900 return NULL; 901 } 902 903 node = kzalloc(sizeof(*node), GFP_KERNEL); 904 if (node == NULL) 905 return NULL; 906 binder_stats_created(BINDER_STAT_NODE); 907 rb_link_node(&node->rb_node, parent, p); 908 rb_insert_color(&node->rb_node, &proc->nodes); 909 node->debug_id = ++binder_last_id; 910 node->proc = proc; 911 node->ptr = ptr; 912 node->cookie = cookie; 913 node->work.type = BINDER_WORK_NODE; 914 INIT_LIST_HEAD(&node->work.entry); 915 INIT_LIST_HEAD(&node->async_todo); 916 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 917 "%d:%d node %d u%016llx c%016llx created\n", 918 proc->pid, current->pid, node->debug_id, 919 (u64)node->ptr, (u64)node->cookie); 920 return node; 921} 922 923static int binder_inc_node(struct binder_node *node, int strong, int internal, 924 struct list_head *target_list) 925{ 926 if (strong) { 927 if (internal) { 928 if (target_list == NULL && 929 node->internal_strong_refs == 0 && 930 !(node == binder_context_mgr_node && 931 node->has_strong_ref)) { 932 pr_err("invalid inc strong node for %d\n", 933 node->debug_id); 934 return -EINVAL; 935 } 936 node->internal_strong_refs++; 937 } else 938 node->local_strong_refs++; 939 if (!node->has_strong_ref && target_list) { 940 list_del_init(&node->work.entry); 941 list_add_tail(&node->work.entry, target_list); 942 } 943 } else { 944 if (!internal) 945 node->local_weak_refs++; 946 if (!node->has_weak_ref && list_empty(&node->work.entry)) { 947 if (target_list == NULL) { 948 pr_err("invalid inc weak node for %d\n", 949 node->debug_id); 950 return -EINVAL; 951 } 952 list_add_tail(&node->work.entry, target_list); 953 } 954 } 955 return 0; 956} 957 958static int binder_dec_node(struct binder_node *node, int strong, int internal) 959{ 960 if (strong) { 961 if (internal) 962 node->internal_strong_refs--; 963 else 964 node->local_strong_refs--; 965 if (node->local_strong_refs || node->internal_strong_refs) 966 return 0; 967 } else { 968 if (!internal) 969 node->local_weak_refs--; 970 if (node->local_weak_refs || !hlist_empty(&node->refs)) 971 return 0; 972 } 973 if (node->proc && (node->has_strong_ref || node->has_weak_ref)) { 974 if (list_empty(&node->work.entry)) { 975 list_add_tail(&node->work.entry, &node->proc->todo); 976 wake_up_interruptible(&node->proc->wait); 977 } 978 } else { 979 if (hlist_empty(&node->refs) && !node->local_strong_refs && 980 !node->local_weak_refs) { 981 list_del_init(&node->work.entry); 982 if (node->proc) { 983 rb_erase(&node->rb_node, &node->proc->nodes); 984 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 985 "refless node %d deleted\n", 986 node->debug_id); 987 } else { 988 hlist_del(&node->dead_node); 989 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 990 "dead node %d deleted\n", 991 node->debug_id); 992 } 993 kfree(node); 994 binder_stats_deleted(BINDER_STAT_NODE); 995 } 996 } 997 998 return 0; 999} 1000 1001 1002static struct binder_ref *binder_get_ref(struct binder_proc *proc, 1003 uint32_t desc) 1004{ 1005 struct rb_node *n = proc->refs_by_desc.rb_node; 1006 struct binder_ref *ref; 1007 1008 while (n) { 1009 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1010 1011 if (desc < ref->desc) 1012 n = n->rb_left; 1013 else if (desc > ref->desc) 1014 n = n->rb_right; 1015 else 1016 return ref; 1017 } 1018 return NULL; 1019} 1020 1021static struct binder_ref *binder_get_ref_for_node(struct binder_proc *proc, 1022 struct binder_node *node) 1023{ 1024 struct rb_node *n; 1025 struct rb_node **p = &proc->refs_by_node.rb_node; 1026 struct rb_node *parent = NULL; 1027 struct binder_ref *ref, *new_ref; 1028 1029 while (*p) { 1030 parent = *p; 1031 ref = rb_entry(parent, struct binder_ref, rb_node_node); 1032 1033 if (node < ref->node) 1034 p = &(*p)->rb_left; 1035 else if (node > ref->node) 1036 p = &(*p)->rb_right; 1037 else 1038 return ref; 1039 } 1040 new_ref = kzalloc(sizeof(*ref), GFP_KERNEL); 1041 if (new_ref == NULL) 1042 return NULL; 1043 binder_stats_created(BINDER_STAT_REF); 1044 new_ref->debug_id = ++binder_last_id; 1045 new_ref->proc = proc; 1046 new_ref->node = node; 1047 rb_link_node(&new_ref->rb_node_node, parent, p); 1048 rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node); 1049 1050 new_ref->desc = (node == binder_context_mgr_node) ? 0 : 1; 1051 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 1052 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1053 if (ref->desc > new_ref->desc) 1054 break; 1055 new_ref->desc = ref->desc + 1; 1056 } 1057 1058 p = &proc->refs_by_desc.rb_node; 1059 while (*p) { 1060 parent = *p; 1061 ref = rb_entry(parent, struct binder_ref, rb_node_desc); 1062 1063 if (new_ref->desc < ref->desc) 1064 p = &(*p)->rb_left; 1065 else if (new_ref->desc > ref->desc) 1066 p = &(*p)->rb_right; 1067 else 1068 BUG(); 1069 } 1070 rb_link_node(&new_ref->rb_node_desc, parent, p); 1071 rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc); 1072 if (node) { 1073 hlist_add_head(&new_ref->node_entry, &node->refs); 1074 1075 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1076 "%d new ref %d desc %d for node %d\n", 1077 proc->pid, new_ref->debug_id, new_ref->desc, 1078 node->debug_id); 1079 } else { 1080 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1081 "%d new ref %d desc %d for dead node\n", 1082 proc->pid, new_ref->debug_id, new_ref->desc); 1083 } 1084 return new_ref; 1085} 1086 1087static void binder_delete_ref(struct binder_ref *ref) 1088{ 1089 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1090 "%d delete ref %d desc %d for node %d\n", 1091 ref->proc->pid, ref->debug_id, ref->desc, 1092 ref->node->debug_id); 1093 1094 rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc); 1095 rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node); 1096 if (ref->strong) 1097 binder_dec_node(ref->node, 1, 1); 1098 hlist_del(&ref->node_entry); 1099 binder_dec_node(ref->node, 0, 1); 1100 if (ref->death) { 1101 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1102 "%d delete ref %d desc %d has death notification\n", 1103 ref->proc->pid, ref->debug_id, ref->desc); 1104 list_del(&ref->death->work.entry); 1105 kfree(ref->death); 1106 binder_stats_deleted(BINDER_STAT_DEATH); 1107 } 1108 kfree(ref); 1109 binder_stats_deleted(BINDER_STAT_REF); 1110} 1111 1112static int binder_inc_ref(struct binder_ref *ref, int strong, 1113 struct list_head *target_list) 1114{ 1115 int ret; 1116 1117 if (strong) { 1118 if (ref->strong == 0) { 1119 ret = binder_inc_node(ref->node, 1, 1, target_list); 1120 if (ret) 1121 return ret; 1122 } 1123 ref->strong++; 1124 } else { 1125 if (ref->weak == 0) { 1126 ret = binder_inc_node(ref->node, 0, 1, target_list); 1127 if (ret) 1128 return ret; 1129 } 1130 ref->weak++; 1131 } 1132 return 0; 1133} 1134 1135 1136static int binder_dec_ref(struct binder_ref *ref, int strong) 1137{ 1138 if (strong) { 1139 if (ref->strong == 0) { 1140 binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n", 1141 ref->proc->pid, ref->debug_id, 1142 ref->desc, ref->strong, ref->weak); 1143 return -EINVAL; 1144 } 1145 ref->strong--; 1146 if (ref->strong == 0) { 1147 int ret; 1148 1149 ret = binder_dec_node(ref->node, strong, 1); 1150 if (ret) 1151 return ret; 1152 } 1153 } else { 1154 if (ref->weak == 0) { 1155 binder_user_error("%d invalid dec weak, ref %d desc %d s %d w %d\n", 1156 ref->proc->pid, ref->debug_id, 1157 ref->desc, ref->strong, ref->weak); 1158 return -EINVAL; 1159 } 1160 ref->weak--; 1161 } 1162 if (ref->strong == 0 && ref->weak == 0) 1163 binder_delete_ref(ref); 1164 return 0; 1165} 1166 1167static void binder_pop_transaction(struct binder_thread *target_thread, 1168 struct binder_transaction *t) 1169{ 1170 if (target_thread) { 1171 BUG_ON(target_thread->transaction_stack != t); 1172 BUG_ON(target_thread->transaction_stack->from != target_thread); 1173 target_thread->transaction_stack = 1174 target_thread->transaction_stack->from_parent; 1175 t->from = NULL; 1176 } 1177 t->need_reply = 0; 1178 if (t->buffer) 1179 t->buffer->transaction = NULL; 1180 kfree(t); 1181 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1182} 1183 1184static void binder_send_failed_reply(struct binder_transaction *t, 1185 uint32_t error_code) 1186{ 1187 struct binder_thread *target_thread; 1188 struct binder_transaction *next; 1189 1190 BUG_ON(t->flags & TF_ONE_WAY); 1191 while (1) { 1192 target_thread = t->from; 1193 if (target_thread) { 1194 if (target_thread->return_error != BR_OK && 1195 target_thread->return_error2 == BR_OK) { 1196 target_thread->return_error2 = 1197 target_thread->return_error; 1198 target_thread->return_error = BR_OK; 1199 } 1200 if (target_thread->return_error == BR_OK) { 1201 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1202 "send failed reply for transaction %d to %d:%d\n", 1203 t->debug_id, target_thread->proc->pid, 1204 target_thread->pid); 1205 1206 binder_pop_transaction(target_thread, t); 1207 target_thread->return_error = error_code; 1208 wake_up_interruptible(&target_thread->wait); 1209 } else { 1210 pr_err("reply failed, target thread, %d:%d, has error code %d already\n", 1211 target_thread->proc->pid, 1212 target_thread->pid, 1213 target_thread->return_error); 1214 } 1215 return; 1216 } 1217 next = t->from_parent; 1218 1219 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1220 "send failed reply for transaction %d, target dead\n", 1221 t->debug_id); 1222 1223 binder_pop_transaction(target_thread, t); 1224 if (next == NULL) { 1225 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1226 "reply failed, no target thread at root\n"); 1227 return; 1228 } 1229 t = next; 1230 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1231 "reply failed, no target thread -- retry %d\n", 1232 t->debug_id); 1233 } 1234} 1235 1236static void binder_transaction_buffer_release(struct binder_proc *proc, 1237 struct binder_buffer *buffer, 1238 binder_size_t *failed_at) 1239{ 1240 binder_size_t *offp, *off_end; 1241 int debug_id = buffer->debug_id; 1242 1243 binder_debug(BINDER_DEBUG_TRANSACTION, 1244 "%d buffer release %d, size %zd-%zd, failed at %p\n", 1245 proc->pid, buffer->debug_id, 1246 buffer->data_size, buffer->offsets_size, failed_at); 1247 1248 if (buffer->target_node) 1249 binder_dec_node(buffer->target_node, 1, 0); 1250 1251 offp = (binder_size_t *)(buffer->data + 1252 ALIGN(buffer->data_size, sizeof(void *))); 1253 if (failed_at) 1254 off_end = failed_at; 1255 else 1256 off_end = (void *)offp + buffer->offsets_size; 1257 for (; offp < off_end; offp++) { 1258 struct flat_binder_object *fp; 1259 1260 if (*offp > buffer->data_size - sizeof(*fp) || 1261 buffer->data_size < sizeof(*fp) || 1262 !IS_ALIGNED(*offp, sizeof(u32))) { 1263 pr_err("transaction release %d bad offset %lld, size %zd\n", 1264 debug_id, (u64)*offp, buffer->data_size); 1265 continue; 1266 } 1267 fp = (struct flat_binder_object *)(buffer->data + *offp); 1268 switch (fp->type) { 1269 case BINDER_TYPE_BINDER: 1270 case BINDER_TYPE_WEAK_BINDER: { 1271 struct binder_node *node = binder_get_node(proc, fp->binder); 1272 1273 if (node == NULL) { 1274 pr_err("transaction release %d bad node %016llx\n", 1275 debug_id, (u64)fp->binder); 1276 break; 1277 } 1278 binder_debug(BINDER_DEBUG_TRANSACTION, 1279 " node %d u%016llx\n", 1280 node->debug_id, (u64)node->ptr); 1281 binder_dec_node(node, fp->type == BINDER_TYPE_BINDER, 0); 1282 } break; 1283 case BINDER_TYPE_HANDLE: 1284 case BINDER_TYPE_WEAK_HANDLE: { 1285 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1286 1287 if (ref == NULL) { 1288 pr_err("transaction release %d bad handle %d\n", 1289 debug_id, fp->handle); 1290 break; 1291 } 1292 binder_debug(BINDER_DEBUG_TRANSACTION, 1293 " ref %d desc %d (node %d)\n", 1294 ref->debug_id, ref->desc, ref->node->debug_id); 1295 binder_dec_ref(ref, fp->type == BINDER_TYPE_HANDLE); 1296 } break; 1297 1298 case BINDER_TYPE_FD: 1299 binder_debug(BINDER_DEBUG_TRANSACTION, 1300 " fd %d\n", fp->handle); 1301 if (failed_at) 1302 task_close_fd(proc, fp->handle); 1303 break; 1304 1305 default: 1306 pr_err("transaction release %d bad object type %x\n", 1307 debug_id, fp->type); 1308 break; 1309 } 1310 } 1311} 1312 1313static void binder_transaction(struct binder_proc *proc, 1314 struct binder_thread *thread, 1315 struct binder_transaction_data *tr, int reply) 1316{ 1317 struct binder_transaction *t; 1318 struct binder_work *tcomplete; 1319 binder_size_t *offp, *off_end; 1320 struct binder_proc *target_proc; 1321 struct binder_thread *target_thread = NULL; 1322 struct binder_node *target_node = NULL; 1323 struct list_head *target_list; 1324 wait_queue_head_t *target_wait; 1325 struct binder_transaction *in_reply_to = NULL; 1326 struct binder_transaction_log_entry *e; 1327 uint32_t return_error; 1328 1329 e = binder_transaction_log_add(&binder_transaction_log); 1330 e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY); 1331 e->from_proc = proc->pid; 1332 e->from_thread = thread->pid; 1333 e->target_handle = tr->target.handle; 1334 e->data_size = tr->data_size; 1335 e->offsets_size = tr->offsets_size; 1336 1337 if (reply) { 1338 in_reply_to = thread->transaction_stack; 1339 if (in_reply_to == NULL) { 1340 binder_user_error("%d:%d got reply transaction with no transaction stack\n", 1341 proc->pid, thread->pid); 1342 return_error = BR_FAILED_REPLY; 1343 goto err_empty_call_stack; 1344 } 1345 binder_set_nice(in_reply_to->saved_priority); 1346 if (in_reply_to->to_thread != thread) { 1347 binder_user_error("%d:%d got reply transaction with bad transaction stack, transaction %d has target %d:%d\n", 1348 proc->pid, thread->pid, in_reply_to->debug_id, 1349 in_reply_to->to_proc ? 1350 in_reply_to->to_proc->pid : 0, 1351 in_reply_to->to_thread ? 1352 in_reply_to->to_thread->pid : 0); 1353 return_error = BR_FAILED_REPLY; 1354 in_reply_to = NULL; 1355 goto err_bad_call_stack; 1356 } 1357 thread->transaction_stack = in_reply_to->to_parent; 1358 target_thread = in_reply_to->from; 1359 if (target_thread == NULL) { 1360 return_error = BR_DEAD_REPLY; 1361 goto err_dead_binder; 1362 } 1363 if (target_thread->transaction_stack != in_reply_to) { 1364 binder_user_error("%d:%d got reply transaction with bad target transaction stack %d, expected %d\n", 1365 proc->pid, thread->pid, 1366 target_thread->transaction_stack ? 1367 target_thread->transaction_stack->debug_id : 0, 1368 in_reply_to->debug_id); 1369 return_error = BR_FAILED_REPLY; 1370 in_reply_to = NULL; 1371 target_thread = NULL; 1372 goto err_dead_binder; 1373 } 1374 target_proc = target_thread->proc; 1375 } else { 1376 if (tr->target.handle) { 1377 struct binder_ref *ref; 1378 1379 ref = binder_get_ref(proc, tr->target.handle); 1380 if (ref == NULL) { 1381 binder_user_error("%d:%d got transaction to invalid handle\n", 1382 proc->pid, thread->pid); 1383 return_error = BR_FAILED_REPLY; 1384 goto err_invalid_target_handle; 1385 } 1386 target_node = ref->node; 1387 } else { 1388 target_node = binder_context_mgr_node; 1389 if (target_node == NULL) { 1390 return_error = BR_DEAD_REPLY; 1391 goto err_no_context_mgr_node; 1392 } 1393 } 1394 e->to_node = target_node->debug_id; 1395 target_proc = target_node->proc; 1396 if (target_proc == NULL) { 1397 return_error = BR_DEAD_REPLY; 1398 goto err_dead_binder; 1399 } 1400 if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) { 1401 struct binder_transaction *tmp; 1402 1403 tmp = thread->transaction_stack; 1404 if (tmp->to_thread != thread) { 1405 binder_user_error("%d:%d got new transaction with bad transaction stack, transaction %d has target %d:%d\n", 1406 proc->pid, thread->pid, tmp->debug_id, 1407 tmp->to_proc ? tmp->to_proc->pid : 0, 1408 tmp->to_thread ? 1409 tmp->to_thread->pid : 0); 1410 return_error = BR_FAILED_REPLY; 1411 goto err_bad_call_stack; 1412 } 1413 while (tmp) { 1414 if (tmp->from && tmp->from->proc == target_proc) 1415 target_thread = tmp->from; 1416 tmp = tmp->from_parent; 1417 } 1418 } 1419 } 1420 if (target_thread) { 1421 e->to_thread = target_thread->pid; 1422 target_list = &target_thread->todo; 1423 target_wait = &target_thread->wait; 1424 } else { 1425 target_list = &target_proc->todo; 1426 target_wait = &target_proc->wait; 1427 } 1428 e->to_proc = target_proc->pid; 1429 1430 /* TODO: reuse incoming transaction for reply */ 1431 t = kzalloc(sizeof(*t), GFP_KERNEL); 1432 if (t == NULL) { 1433 return_error = BR_FAILED_REPLY; 1434 goto err_alloc_t_failed; 1435 } 1436 binder_stats_created(BINDER_STAT_TRANSACTION); 1437 1438 tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL); 1439 if (tcomplete == NULL) { 1440 return_error = BR_FAILED_REPLY; 1441 goto err_alloc_tcomplete_failed; 1442 } 1443 binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE); 1444 1445 t->debug_id = ++binder_last_id; 1446 e->debug_id = t->debug_id; 1447 1448 if (reply) 1449 binder_debug(BINDER_DEBUG_TRANSACTION, 1450 "%d:%d BC_REPLY %d -> %d:%d, data %016llx-%016llx size %lld-%lld\n", 1451 proc->pid, thread->pid, t->debug_id, 1452 target_proc->pid, target_thread->pid, 1453 (u64)tr->data.ptr.buffer, 1454 (u64)tr->data.ptr.offsets, 1455 (u64)tr->data_size, (u64)tr->offsets_size); 1456 else 1457 binder_debug(BINDER_DEBUG_TRANSACTION, 1458 "%d:%d BC_TRANSACTION %d -> %d - node %d, data %016llx-%016llx size %lld-%lld\n", 1459 proc->pid, thread->pid, t->debug_id, 1460 target_proc->pid, target_node->debug_id, 1461 (u64)tr->data.ptr.buffer, 1462 (u64)tr->data.ptr.offsets, 1463 (u64)tr->data_size, (u64)tr->offsets_size); 1464 1465 if (!reply && !(tr->flags & TF_ONE_WAY)) 1466 t->from = thread; 1467 else 1468 t->from = NULL; 1469 t->sender_euid = task_euid(proc->tsk); 1470 t->to_proc = target_proc; 1471 t->to_thread = target_thread; 1472 t->code = tr->code; 1473 t->flags = tr->flags; 1474 t->priority = task_nice(current); 1475 1476 trace_binder_transaction(reply, t, target_node); 1477 1478 t->buffer = binder_alloc_buf(target_proc, tr->data_size, 1479 tr->offsets_size, !reply && (t->flags & TF_ONE_WAY)); 1480 if (t->buffer == NULL) { 1481 return_error = BR_FAILED_REPLY; 1482 goto err_binder_alloc_buf_failed; 1483 } 1484 t->buffer->allow_user_free = 0; 1485 t->buffer->debug_id = t->debug_id; 1486 t->buffer->transaction = t; 1487 t->buffer->target_node = target_node; 1488 trace_binder_transaction_alloc_buf(t->buffer); 1489 if (target_node) 1490 binder_inc_node(target_node, 1, 0, NULL); 1491 1492 offp = (binder_size_t *)(t->buffer->data + 1493 ALIGN(tr->data_size, sizeof(void *))); 1494 1495 if (copy_from_user(t->buffer->data, (const void __user *)(uintptr_t) 1496 tr->data.ptr.buffer, tr->data_size)) { 1497 binder_user_error("%d:%d got transaction with invalid data ptr\n", 1498 proc->pid, thread->pid); 1499 return_error = BR_FAILED_REPLY; 1500 goto err_copy_data_failed; 1501 } 1502 if (copy_from_user(offp, (const void __user *)(uintptr_t) 1503 tr->data.ptr.offsets, tr->offsets_size)) { 1504 binder_user_error("%d:%d got transaction with invalid offsets ptr\n", 1505 proc->pid, thread->pid); 1506 return_error = BR_FAILED_REPLY; 1507 goto err_copy_data_failed; 1508 } 1509 if (!IS_ALIGNED(tr->offsets_size, sizeof(binder_size_t))) { 1510 binder_user_error("%d:%d got transaction with invalid offsets size, %lld\n", 1511 proc->pid, thread->pid, (u64)tr->offsets_size); 1512 return_error = BR_FAILED_REPLY; 1513 goto err_bad_offset; 1514 } 1515 off_end = (void *)offp + tr->offsets_size; 1516 for (; offp < off_end; offp++) { 1517 struct flat_binder_object *fp; 1518 1519 if (*offp > t->buffer->data_size - sizeof(*fp) || 1520 t->buffer->data_size < sizeof(*fp) || 1521 !IS_ALIGNED(*offp, sizeof(u32))) { 1522 binder_user_error("%d:%d got transaction with invalid offset, %lld\n", 1523 proc->pid, thread->pid, (u64)*offp); 1524 return_error = BR_FAILED_REPLY; 1525 goto err_bad_offset; 1526 } 1527 fp = (struct flat_binder_object *)(t->buffer->data + *offp); 1528 switch (fp->type) { 1529 case BINDER_TYPE_BINDER: 1530 case BINDER_TYPE_WEAK_BINDER: { 1531 struct binder_ref *ref; 1532 struct binder_node *node = binder_get_node(proc, fp->binder); 1533 1534 if (node == NULL) { 1535 node = binder_new_node(proc, fp->binder, fp->cookie); 1536 if (node == NULL) { 1537 return_error = BR_FAILED_REPLY; 1538 goto err_binder_new_node_failed; 1539 } 1540 node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK; 1541 node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS); 1542 } 1543 if (fp->cookie != node->cookie) { 1544 binder_user_error("%d:%d sending u%016llx node %d, cookie mismatch %016llx != %016llx\n", 1545 proc->pid, thread->pid, 1546 (u64)fp->binder, node->debug_id, 1547 (u64)fp->cookie, (u64)node->cookie); 1548 return_error = BR_FAILED_REPLY; 1549 goto err_binder_get_ref_for_node_failed; 1550 } 1551 ref = binder_get_ref_for_node(target_proc, node); 1552 if (ref == NULL) { 1553 return_error = BR_FAILED_REPLY; 1554 goto err_binder_get_ref_for_node_failed; 1555 } 1556 if (fp->type == BINDER_TYPE_BINDER) 1557 fp->type = BINDER_TYPE_HANDLE; 1558 else 1559 fp->type = BINDER_TYPE_WEAK_HANDLE; 1560 fp->handle = ref->desc; 1561 binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE, 1562 &thread->todo); 1563 1564 trace_binder_transaction_node_to_ref(t, node, ref); 1565 binder_debug(BINDER_DEBUG_TRANSACTION, 1566 " node %d u%016llx -> ref %d desc %d\n", 1567 node->debug_id, (u64)node->ptr, 1568 ref->debug_id, ref->desc); 1569 } break; 1570 case BINDER_TYPE_HANDLE: 1571 case BINDER_TYPE_WEAK_HANDLE: { 1572 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1573 1574 if (ref == NULL) { 1575 binder_user_error("%d:%d got transaction with invalid handle, %d\n", 1576 proc->pid, 1577 thread->pid, fp->handle); 1578 return_error = BR_FAILED_REPLY; 1579 goto err_binder_get_ref_failed; 1580 } 1581 if (ref->node->proc == target_proc) { 1582 if (fp->type == BINDER_TYPE_HANDLE) 1583 fp->type = BINDER_TYPE_BINDER; 1584 else 1585 fp->type = BINDER_TYPE_WEAK_BINDER; 1586 fp->binder = ref->node->ptr; 1587 fp->cookie = ref->node->cookie; 1588 binder_inc_node(ref->node, fp->type == BINDER_TYPE_BINDER, 0, NULL); 1589 trace_binder_transaction_ref_to_node(t, ref); 1590 binder_debug(BINDER_DEBUG_TRANSACTION, 1591 " ref %d desc %d -> node %d u%016llx\n", 1592 ref->debug_id, ref->desc, ref->node->debug_id, 1593 (u64)ref->node->ptr); 1594 } else { 1595 struct binder_ref *new_ref; 1596 1597 new_ref = binder_get_ref_for_node(target_proc, ref->node); 1598 if (new_ref == NULL) { 1599 return_error = BR_FAILED_REPLY; 1600 goto err_binder_get_ref_for_node_failed; 1601 } 1602 fp->handle = new_ref->desc; 1603 binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL); 1604 trace_binder_transaction_ref_to_ref(t, ref, 1605 new_ref); 1606 binder_debug(BINDER_DEBUG_TRANSACTION, 1607 " ref %d desc %d -> ref %d desc %d (node %d)\n", 1608 ref->debug_id, ref->desc, new_ref->debug_id, 1609 new_ref->desc, ref->node->debug_id); 1610 } 1611 } break; 1612 1613 case BINDER_TYPE_FD: { 1614 int target_fd; 1615 struct file *file; 1616 1617 if (reply) { 1618 if (!(in_reply_to->flags & TF_ACCEPT_FDS)) { 1619 binder_user_error("%d:%d got reply with fd, %d, but target does not allow fds\n", 1620 proc->pid, thread->pid, fp->handle); 1621 return_error = BR_FAILED_REPLY; 1622 goto err_fd_not_allowed; 1623 } 1624 } else if (!target_node->accept_fds) { 1625 binder_user_error("%d:%d got transaction with fd, %d, but target does not allow fds\n", 1626 proc->pid, thread->pid, fp->handle); 1627 return_error = BR_FAILED_REPLY; 1628 goto err_fd_not_allowed; 1629 } 1630 1631 file = fget(fp->handle); 1632 if (file == NULL) { 1633 binder_user_error("%d:%d got transaction with invalid fd, %d\n", 1634 proc->pid, thread->pid, fp->handle); 1635 return_error = BR_FAILED_REPLY; 1636 goto err_fget_failed; 1637 } 1638 target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC); 1639 if (target_fd < 0) { 1640 fput(file); 1641 return_error = BR_FAILED_REPLY; 1642 goto err_get_unused_fd_failed; 1643 } 1644 task_fd_install(target_proc, target_fd, file); 1645 trace_binder_transaction_fd(t, fp->handle, target_fd); 1646 binder_debug(BINDER_DEBUG_TRANSACTION, 1647 " fd %d -> %d\n", fp->handle, target_fd); 1648 /* TODO: fput? */ 1649 fp->handle = target_fd; 1650 } break; 1651 1652 default: 1653 binder_user_error("%d:%d got transaction with invalid object type, %x\n", 1654 proc->pid, thread->pid, fp->type); 1655 return_error = BR_FAILED_REPLY; 1656 goto err_bad_object_type; 1657 } 1658 } 1659 if (reply) { 1660 BUG_ON(t->buffer->async_transaction != 0); 1661 binder_pop_transaction(target_thread, in_reply_to); 1662 } else if (!(t->flags & TF_ONE_WAY)) { 1663 BUG_ON(t->buffer->async_transaction != 0); 1664 t->need_reply = 1; 1665 t->from_parent = thread->transaction_stack; 1666 thread->transaction_stack = t; 1667 } else { 1668 BUG_ON(target_node == NULL); 1669 BUG_ON(t->buffer->async_transaction != 1); 1670 if (target_node->has_async_transaction) { 1671 target_list = &target_node->async_todo; 1672 target_wait = NULL; 1673 } else 1674 target_node->has_async_transaction = 1; 1675 } 1676 t->work.type = BINDER_WORK_TRANSACTION; 1677 list_add_tail(&t->work.entry, target_list); 1678 tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE; 1679 list_add_tail(&tcomplete->entry, &thread->todo); 1680 if (target_wait) 1681 wake_up_interruptible(target_wait); 1682 return; 1683 1684err_get_unused_fd_failed: 1685err_fget_failed: 1686err_fd_not_allowed: 1687err_binder_get_ref_for_node_failed: 1688err_binder_get_ref_failed: 1689err_binder_new_node_failed: 1690err_bad_object_type: 1691err_bad_offset: 1692err_copy_data_failed: 1693 trace_binder_transaction_failed_buffer_release(t->buffer); 1694 binder_transaction_buffer_release(target_proc, t->buffer, offp); 1695 t->buffer->transaction = NULL; 1696 binder_free_buf(target_proc, t->buffer); 1697err_binder_alloc_buf_failed: 1698 kfree(tcomplete); 1699 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 1700err_alloc_tcomplete_failed: 1701 kfree(t); 1702 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1703err_alloc_t_failed: 1704err_bad_call_stack: 1705err_empty_call_stack: 1706err_dead_binder: 1707err_invalid_target_handle: 1708err_no_context_mgr_node: 1709 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1710 "%d:%d transaction failed %d, size %lld-%lld\n", 1711 proc->pid, thread->pid, return_error, 1712 (u64)tr->data_size, (u64)tr->offsets_size); 1713 1714 { 1715 struct binder_transaction_log_entry *fe; 1716 1717 fe = binder_transaction_log_add(&binder_transaction_log_failed); 1718 *fe = *e; 1719 } 1720 1721 BUG_ON(thread->return_error != BR_OK); 1722 if (in_reply_to) { 1723 thread->return_error = BR_TRANSACTION_COMPLETE; 1724 binder_send_failed_reply(in_reply_to, return_error); 1725 } else 1726 thread->return_error = return_error; 1727} 1728 1729static int binder_thread_write(struct binder_proc *proc, 1730 struct binder_thread *thread, 1731 binder_uintptr_t binder_buffer, size_t size, 1732 binder_size_t *consumed) 1733{ 1734 uint32_t cmd; 1735 void __user *buffer = (void __user *)(uintptr_t)binder_buffer; 1736 void __user *ptr = buffer + *consumed; 1737 void __user *end = buffer + size; 1738 1739 while (ptr < end && thread->return_error == BR_OK) { 1740 if (get_user(cmd, (uint32_t __user *)ptr)) 1741 return -EFAULT; 1742 ptr += sizeof(uint32_t); 1743 trace_binder_command(cmd); 1744 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) { 1745 binder_stats.bc[_IOC_NR(cmd)]++; 1746 proc->stats.bc[_IOC_NR(cmd)]++; 1747 thread->stats.bc[_IOC_NR(cmd)]++; 1748 } 1749 switch (cmd) { 1750 case BC_INCREFS: 1751 case BC_ACQUIRE: 1752 case BC_RELEASE: 1753 case BC_DECREFS: { 1754 uint32_t target; 1755 struct binder_ref *ref; 1756 const char *debug_string; 1757 1758 if (get_user(target, (uint32_t __user *)ptr)) 1759 return -EFAULT; 1760 ptr += sizeof(uint32_t); 1761 if (target == 0 && binder_context_mgr_node && 1762 (cmd == BC_INCREFS || cmd == BC_ACQUIRE)) { 1763 ref = binder_get_ref_for_node(proc, 1764 binder_context_mgr_node); 1765 if (ref->desc != target) { 1766 binder_user_error("%d:%d tried to acquire reference to desc 0, got %d instead\n", 1767 proc->pid, thread->pid, 1768 ref->desc); 1769 } 1770 } else 1771 ref = binder_get_ref(proc, target); 1772 if (ref == NULL) { 1773 binder_user_error("%d:%d refcount change on invalid ref %d\n", 1774 proc->pid, thread->pid, target); 1775 break; 1776 } 1777 switch (cmd) { 1778 case BC_INCREFS: 1779 debug_string = "IncRefs"; 1780 binder_inc_ref(ref, 0, NULL); 1781 break; 1782 case BC_ACQUIRE: 1783 debug_string = "Acquire"; 1784 binder_inc_ref(ref, 1, NULL); 1785 break; 1786 case BC_RELEASE: 1787 debug_string = "Release"; 1788 binder_dec_ref(ref, 1); 1789 break; 1790 case BC_DECREFS: 1791 default: 1792 debug_string = "DecRefs"; 1793 binder_dec_ref(ref, 0); 1794 break; 1795 } 1796 binder_debug(BINDER_DEBUG_USER_REFS, 1797 "%d:%d %s ref %d desc %d s %d w %d for node %d\n", 1798 proc->pid, thread->pid, debug_string, ref->debug_id, 1799 ref->desc, ref->strong, ref->weak, ref->node->debug_id); 1800 break; 1801 } 1802 case BC_INCREFS_DONE: 1803 case BC_ACQUIRE_DONE: { 1804 binder_uintptr_t node_ptr; 1805 binder_uintptr_t cookie; 1806 struct binder_node *node; 1807 1808 if (get_user(node_ptr, (binder_uintptr_t __user *)ptr)) 1809 return -EFAULT; 1810 ptr += sizeof(binder_uintptr_t); 1811 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 1812 return -EFAULT; 1813 ptr += sizeof(binder_uintptr_t); 1814 node = binder_get_node(proc, node_ptr); 1815 if (node == NULL) { 1816 binder_user_error("%d:%d %s u%016llx no match\n", 1817 proc->pid, thread->pid, 1818 cmd == BC_INCREFS_DONE ? 1819 "BC_INCREFS_DONE" : 1820 "BC_ACQUIRE_DONE", 1821 (u64)node_ptr); 1822 break; 1823 } 1824 if (cookie != node->cookie) { 1825 binder_user_error("%d:%d %s u%016llx node %d cookie mismatch %016llx != %016llx\n", 1826 proc->pid, thread->pid, 1827 cmd == BC_INCREFS_DONE ? 1828 "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1829 (u64)node_ptr, node->debug_id, 1830 (u64)cookie, (u64)node->cookie); 1831 break; 1832 } 1833 if (cmd == BC_ACQUIRE_DONE) { 1834 if (node->pending_strong_ref == 0) { 1835 binder_user_error("%d:%d BC_ACQUIRE_DONE node %d has no pending acquire request\n", 1836 proc->pid, thread->pid, 1837 node->debug_id); 1838 break; 1839 } 1840 node->pending_strong_ref = 0; 1841 } else { 1842 if (node->pending_weak_ref == 0) { 1843 binder_user_error("%d:%d BC_INCREFS_DONE node %d has no pending increfs request\n", 1844 proc->pid, thread->pid, 1845 node->debug_id); 1846 break; 1847 } 1848 node->pending_weak_ref = 0; 1849 } 1850 binder_dec_node(node, cmd == BC_ACQUIRE_DONE, 0); 1851 binder_debug(BINDER_DEBUG_USER_REFS, 1852 "%d:%d %s node %d ls %d lw %d\n", 1853 proc->pid, thread->pid, 1854 cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1855 node->debug_id, node->local_strong_refs, node->local_weak_refs); 1856 break; 1857 } 1858 case BC_ATTEMPT_ACQUIRE: 1859 pr_err("BC_ATTEMPT_ACQUIRE not supported\n"); 1860 return -EINVAL; 1861 case BC_ACQUIRE_RESULT: 1862 pr_err("BC_ACQUIRE_RESULT not supported\n"); 1863 return -EINVAL; 1864 1865 case BC_FREE_BUFFER: { 1866 binder_uintptr_t data_ptr; 1867 struct binder_buffer *buffer; 1868 1869 if (get_user(data_ptr, (binder_uintptr_t __user *)ptr)) 1870 return -EFAULT; 1871 ptr += sizeof(binder_uintptr_t); 1872 1873 buffer = binder_buffer_lookup(proc, data_ptr); 1874 if (buffer == NULL) { 1875 binder_user_error("%d:%d BC_FREE_BUFFER u%016llx no match\n", 1876 proc->pid, thread->pid, (u64)data_ptr); 1877 break; 1878 } 1879 if (!buffer->allow_user_free) { 1880 binder_user_error("%d:%d BC_FREE_BUFFER u%016llx matched unreturned buffer\n", 1881 proc->pid, thread->pid, (u64)data_ptr); 1882 break; 1883 } 1884 binder_debug(BINDER_DEBUG_FREE_BUFFER, 1885 "%d:%d BC_FREE_BUFFER u%016llx found buffer %d for %s transaction\n", 1886 proc->pid, thread->pid, (u64)data_ptr, 1887 buffer->debug_id, 1888 buffer->transaction ? "active" : "finished"); 1889 1890 if (buffer->transaction) { 1891 buffer->transaction->buffer = NULL; 1892 buffer->transaction = NULL; 1893 } 1894 if (buffer->async_transaction && buffer->target_node) { 1895 BUG_ON(!buffer->target_node->has_async_transaction); 1896 if (list_empty(&buffer->target_node->async_todo)) 1897 buffer->target_node->has_async_transaction = 0; 1898 else 1899 list_move_tail(buffer->target_node->async_todo.next, &thread->todo); 1900 } 1901 trace_binder_transaction_buffer_release(buffer); 1902 binder_transaction_buffer_release(proc, buffer, NULL); 1903 binder_free_buf(proc, buffer); 1904 break; 1905 } 1906 1907 case BC_TRANSACTION: 1908 case BC_REPLY: { 1909 struct binder_transaction_data tr; 1910 1911 if (copy_from_user(&tr, ptr, sizeof(tr))) 1912 return -EFAULT; 1913 ptr += sizeof(tr); 1914 binder_transaction(proc, thread, &tr, cmd == BC_REPLY); 1915 break; 1916 } 1917 1918 case BC_REGISTER_LOOPER: 1919 binder_debug(BINDER_DEBUG_THREADS, 1920 "%d:%d BC_REGISTER_LOOPER\n", 1921 proc->pid, thread->pid); 1922 if (thread->looper & BINDER_LOOPER_STATE_ENTERED) { 1923 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1924 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER\n", 1925 proc->pid, thread->pid); 1926 } else if (proc->requested_threads == 0) { 1927 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1928 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called without request\n", 1929 proc->pid, thread->pid); 1930 } else { 1931 proc->requested_threads--; 1932 proc->requested_threads_started++; 1933 } 1934 thread->looper |= BINDER_LOOPER_STATE_REGISTERED; 1935 break; 1936 case BC_ENTER_LOOPER: 1937 binder_debug(BINDER_DEBUG_THREADS, 1938 "%d:%d BC_ENTER_LOOPER\n", 1939 proc->pid, thread->pid); 1940 if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) { 1941 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1942 binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n", 1943 proc->pid, thread->pid); 1944 } 1945 thread->looper |= BINDER_LOOPER_STATE_ENTERED; 1946 break; 1947 case BC_EXIT_LOOPER: 1948 binder_debug(BINDER_DEBUG_THREADS, 1949 "%d:%d BC_EXIT_LOOPER\n", 1950 proc->pid, thread->pid); 1951 thread->looper |= BINDER_LOOPER_STATE_EXITED; 1952 break; 1953 1954 case BC_REQUEST_DEATH_NOTIFICATION: 1955 case BC_CLEAR_DEATH_NOTIFICATION: { 1956 uint32_t target; 1957 binder_uintptr_t cookie; 1958 struct binder_ref *ref; 1959 struct binder_ref_death *death; 1960 1961 if (get_user(target, (uint32_t __user *)ptr)) 1962 return -EFAULT; 1963 ptr += sizeof(uint32_t); 1964 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 1965 return -EFAULT; 1966 ptr += sizeof(binder_uintptr_t); 1967 ref = binder_get_ref(proc, target); 1968 if (ref == NULL) { 1969 binder_user_error("%d:%d %s invalid ref %d\n", 1970 proc->pid, thread->pid, 1971 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 1972 "BC_REQUEST_DEATH_NOTIFICATION" : 1973 "BC_CLEAR_DEATH_NOTIFICATION", 1974 target); 1975 break; 1976 } 1977 1978 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 1979 "%d:%d %s %016llx ref %d desc %d s %d w %d for node %d\n", 1980 proc->pid, thread->pid, 1981 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 1982 "BC_REQUEST_DEATH_NOTIFICATION" : 1983 "BC_CLEAR_DEATH_NOTIFICATION", 1984 (u64)cookie, ref->debug_id, ref->desc, 1985 ref->strong, ref->weak, ref->node->debug_id); 1986 1987 if (cmd == BC_REQUEST_DEATH_NOTIFICATION) { 1988 if (ref->death) { 1989 binder_user_error("%d:%d BC_REQUEST_DEATH_NOTIFICATION death notification already set\n", 1990 proc->pid, thread->pid); 1991 break; 1992 } 1993 death = kzalloc(sizeof(*death), GFP_KERNEL); 1994 if (death == NULL) { 1995 thread->return_error = BR_ERROR; 1996 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1997 "%d:%d BC_REQUEST_DEATH_NOTIFICATION failed\n", 1998 proc->pid, thread->pid); 1999 break; 2000 } 2001 binder_stats_created(BINDER_STAT_DEATH); 2002 INIT_LIST_HEAD(&death->work.entry); 2003 death->cookie = cookie; 2004 ref->death = death; 2005 if (ref->node->proc == NULL) { 2006 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 2007 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2008 list_add_tail(&ref->death->work.entry, &thread->todo); 2009 } else { 2010 list_add_tail(&ref->death->work.entry, &proc->todo); 2011 wake_up_interruptible(&proc->wait); 2012 } 2013 } 2014 } else { 2015 if (ref->death == NULL) { 2016 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification not active\n", 2017 proc->pid, thread->pid); 2018 break; 2019 } 2020 death = ref->death; 2021 if (death->cookie != cookie) { 2022 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch %016llx != %016llx\n", 2023 proc->pid, thread->pid, 2024 (u64)death->cookie, 2025 (u64)cookie); 2026 break; 2027 } 2028 ref->death = NULL; 2029 if (list_empty(&death->work.entry)) { 2030 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2031 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2032 list_add_tail(&death->work.entry, &thread->todo); 2033 } else { 2034 list_add_tail(&death->work.entry, &proc->todo); 2035 wake_up_interruptible(&proc->wait); 2036 } 2037 } else { 2038 BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER); 2039 death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR; 2040 } 2041 } 2042 } break; 2043 case BC_DEAD_BINDER_DONE: { 2044 struct binder_work *w; 2045 binder_uintptr_t cookie; 2046 struct binder_ref_death *death = NULL; 2047 2048 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 2049 return -EFAULT; 2050 2051 ptr += sizeof(void *); 2052 list_for_each_entry(w, &proc->delivered_death, entry) { 2053 struct binder_ref_death *tmp_death = container_of(w, struct binder_ref_death, work); 2054 2055 if (tmp_death->cookie == cookie) { 2056 death = tmp_death; 2057 break; 2058 } 2059 } 2060 binder_debug(BINDER_DEBUG_DEAD_BINDER, 2061 "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n", 2062 proc->pid, thread->pid, (u64)cookie, 2063 death); 2064 if (death == NULL) { 2065 binder_user_error("%d:%d BC_DEAD_BINDER_DONE %016llx not found\n", 2066 proc->pid, thread->pid, (u64)cookie); 2067 break; 2068 } 2069 2070 list_del_init(&death->work.entry); 2071 if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) { 2072 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2073 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2074 list_add_tail(&death->work.entry, &thread->todo); 2075 } else { 2076 list_add_tail(&death->work.entry, &proc->todo); 2077 wake_up_interruptible(&proc->wait); 2078 } 2079 } 2080 } break; 2081 2082 default: 2083 pr_err("%d:%d unknown command %d\n", 2084 proc->pid, thread->pid, cmd); 2085 return -EINVAL; 2086 } 2087 *consumed = ptr - buffer; 2088 } 2089 return 0; 2090} 2091 2092static void binder_stat_br(struct binder_proc *proc, 2093 struct binder_thread *thread, uint32_t cmd) 2094{ 2095 trace_binder_return(cmd); 2096 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) { 2097 binder_stats.br[_IOC_NR(cmd)]++; 2098 proc->stats.br[_IOC_NR(cmd)]++; 2099 thread->stats.br[_IOC_NR(cmd)]++; 2100 } 2101} 2102 2103static int binder_has_proc_work(struct binder_proc *proc, 2104 struct binder_thread *thread) 2105{ 2106 return !list_empty(&proc->todo) || 2107 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2108} 2109 2110static int binder_has_thread_work(struct binder_thread *thread) 2111{ 2112 return !list_empty(&thread->todo) || thread->return_error != BR_OK || 2113 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2114} 2115 2116static int binder_thread_read(struct binder_proc *proc, 2117 struct binder_thread *thread, 2118 binder_uintptr_t binder_buffer, size_t size, 2119 binder_size_t *consumed, int non_block) 2120{ 2121 void __user *buffer = (void __user *)(uintptr_t)binder_buffer; 2122 void __user *ptr = buffer + *consumed; 2123 void __user *end = buffer + size; 2124 2125 int ret = 0; 2126 int wait_for_proc_work; 2127 2128 if (*consumed == 0) { 2129 if (put_user(BR_NOOP, (uint32_t __user *)ptr)) 2130 return -EFAULT; 2131 ptr += sizeof(uint32_t); 2132 } 2133 2134retry: 2135 wait_for_proc_work = thread->transaction_stack == NULL && 2136 list_empty(&thread->todo); 2137 2138 if (thread->return_error != BR_OK && ptr < end) { 2139 if (thread->return_error2 != BR_OK) { 2140 if (put_user(thread->return_error2, (uint32_t __user *)ptr)) 2141 return -EFAULT; 2142 ptr += sizeof(uint32_t); 2143 binder_stat_br(proc, thread, thread->return_error2); 2144 if (ptr == end) 2145 goto done; 2146 thread->return_error2 = BR_OK; 2147 } 2148 if (put_user(thread->return_error, (uint32_t __user *)ptr)) 2149 return -EFAULT; 2150 ptr += sizeof(uint32_t); 2151 binder_stat_br(proc, thread, thread->return_error); 2152 thread->return_error = BR_OK; 2153 goto done; 2154 } 2155 2156 2157 thread->looper |= BINDER_LOOPER_STATE_WAITING; 2158 if (wait_for_proc_work) 2159 proc->ready_threads++; 2160 2161 binder_unlock(__func__); 2162 2163 trace_binder_wait_for_work(wait_for_proc_work, 2164 !!thread->transaction_stack, 2165 !list_empty(&thread->todo)); 2166 if (wait_for_proc_work) { 2167 if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2168 BINDER_LOOPER_STATE_ENTERED))) { 2169 binder_user_error("%d:%d ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state %x)\n", 2170 proc->pid, thread->pid, thread->looper); 2171 wait_event_interruptible(binder_user_error_wait, 2172 binder_stop_on_user_error < 2); 2173 } 2174 binder_set_nice(proc->default_priority); 2175 if (non_block) { 2176 if (!binder_has_proc_work(proc, thread)) 2177 ret = -EAGAIN; 2178 } else 2179 ret = wait_event_freezable_exclusive(proc->wait, binder_has_proc_work(proc, thread)); 2180 } else { 2181 if (non_block) { 2182 if (!binder_has_thread_work(thread)) 2183 ret = -EAGAIN; 2184 } else 2185 ret = wait_event_freezable(thread->wait, binder_has_thread_work(thread)); 2186 } 2187 2188 binder_lock(__func__); 2189 2190 if (wait_for_proc_work) 2191 proc->ready_threads--; 2192 thread->looper &= ~BINDER_LOOPER_STATE_WAITING; 2193 2194 if (ret) 2195 return ret; 2196 2197 while (1) { 2198 uint32_t cmd; 2199 struct binder_transaction_data tr; 2200 struct binder_work *w; 2201 struct binder_transaction *t = NULL; 2202 2203 if (!list_empty(&thread->todo)) 2204 w = list_first_entry(&thread->todo, struct binder_work, entry); 2205 else if (!list_empty(&proc->todo) && wait_for_proc_work) 2206 w = list_first_entry(&proc->todo, struct binder_work, entry); 2207 else { 2208 if (ptr - buffer == 4 && !(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN)) /* no data added */ 2209 goto retry; 2210 break; 2211 } 2212 2213 if (end - ptr < sizeof(tr) + 4) 2214 break; 2215 2216 switch (w->type) { 2217 case BINDER_WORK_TRANSACTION: { 2218 t = container_of(w, struct binder_transaction, work); 2219 } break; 2220 case BINDER_WORK_TRANSACTION_COMPLETE: { 2221 cmd = BR_TRANSACTION_COMPLETE; 2222 if (put_user(cmd, (uint32_t __user *)ptr)) 2223 return -EFAULT; 2224 ptr += sizeof(uint32_t); 2225 2226 binder_stat_br(proc, thread, cmd); 2227 binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE, 2228 "%d:%d BR_TRANSACTION_COMPLETE\n", 2229 proc->pid, thread->pid); 2230 2231 list_del(&w->entry); 2232 kfree(w); 2233 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2234 } break; 2235 case BINDER_WORK_NODE: { 2236 struct binder_node *node = container_of(w, struct binder_node, work); 2237 uint32_t cmd = BR_NOOP; 2238 const char *cmd_name; 2239 int strong = node->internal_strong_refs || node->local_strong_refs; 2240 int weak = !hlist_empty(&node->refs) || node->local_weak_refs || strong; 2241 2242 if (weak && !node->has_weak_ref) { 2243 cmd = BR_INCREFS; 2244 cmd_name = "BR_INCREFS"; 2245 node->has_weak_ref = 1; 2246 node->pending_weak_ref = 1; 2247 node->local_weak_refs++; 2248 } else if (strong && !node->has_strong_ref) { 2249 cmd = BR_ACQUIRE; 2250 cmd_name = "BR_ACQUIRE"; 2251 node->has_strong_ref = 1; 2252 node->pending_strong_ref = 1; 2253 node->local_strong_refs++; 2254 } else if (!strong && node->has_strong_ref) { 2255 cmd = BR_RELEASE; 2256 cmd_name = "BR_RELEASE"; 2257 node->has_strong_ref = 0; 2258 } else if (!weak && node->has_weak_ref) { 2259 cmd = BR_DECREFS; 2260 cmd_name = "BR_DECREFS"; 2261 node->has_weak_ref = 0; 2262 } 2263 if (cmd != BR_NOOP) { 2264 if (put_user(cmd, (uint32_t __user *)ptr)) 2265 return -EFAULT; 2266 ptr += sizeof(uint32_t); 2267 if (put_user(node->ptr, 2268 (binder_uintptr_t __user *)ptr)) 2269 return -EFAULT; 2270 ptr += sizeof(binder_uintptr_t); 2271 if (put_user(node->cookie, 2272 (binder_uintptr_t __user *)ptr)) 2273 return -EFAULT; 2274 ptr += sizeof(binder_uintptr_t); 2275 2276 binder_stat_br(proc, thread, cmd); 2277 binder_debug(BINDER_DEBUG_USER_REFS, 2278 "%d:%d %s %d u%016llx c%016llx\n", 2279 proc->pid, thread->pid, cmd_name, 2280 node->debug_id, 2281 (u64)node->ptr, (u64)node->cookie); 2282 } else { 2283 list_del_init(&w->entry); 2284 if (!weak && !strong) { 2285 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2286 "%d:%d node %d u%016llx c%016llx deleted\n", 2287 proc->pid, thread->pid, 2288 node->debug_id, 2289 (u64)node->ptr, 2290 (u64)node->cookie); 2291 rb_erase(&node->rb_node, &proc->nodes); 2292 kfree(node); 2293 binder_stats_deleted(BINDER_STAT_NODE); 2294 } else { 2295 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2296 "%d:%d node %d u%016llx c%016llx state unchanged\n", 2297 proc->pid, thread->pid, 2298 node->debug_id, 2299 (u64)node->ptr, 2300 (u64)node->cookie); 2301 } 2302 } 2303 } break; 2304 case BINDER_WORK_DEAD_BINDER: 2305 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 2306 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 2307 struct binder_ref_death *death; 2308 uint32_t cmd; 2309 2310 death = container_of(w, struct binder_ref_death, work); 2311 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) 2312 cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE; 2313 else 2314 cmd = BR_DEAD_BINDER; 2315 if (put_user(cmd, (uint32_t __user *)ptr)) 2316 return -EFAULT; 2317 ptr += sizeof(uint32_t); 2318 if (put_user(death->cookie, 2319 (binder_uintptr_t __user *)ptr)) 2320 return -EFAULT; 2321 ptr += sizeof(binder_uintptr_t); 2322 binder_stat_br(proc, thread, cmd); 2323 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 2324 "%d:%d %s %016llx\n", 2325 proc->pid, thread->pid, 2326 cmd == BR_DEAD_BINDER ? 2327 "BR_DEAD_BINDER" : 2328 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 2329 (u64)death->cookie); 2330 2331 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) { 2332 list_del(&w->entry); 2333 kfree(death); 2334 binder_stats_deleted(BINDER_STAT_DEATH); 2335 } else 2336 list_move(&w->entry, &proc->delivered_death); 2337 if (cmd == BR_DEAD_BINDER) 2338 goto done; /* DEAD_BINDER notifications can cause transactions */ 2339 } break; 2340 } 2341 2342 if (!t) 2343 continue; 2344 2345 BUG_ON(t->buffer == NULL); 2346 if (t->buffer->target_node) { 2347 struct binder_node *target_node = t->buffer->target_node; 2348 2349 tr.target.ptr = target_node->ptr; 2350 tr.cookie = target_node->cookie; 2351 t->saved_priority = task_nice(current); 2352 if (t->priority < target_node->min_priority && 2353 !(t->flags & TF_ONE_WAY)) 2354 binder_set_nice(t->priority); 2355 else if (!(t->flags & TF_ONE_WAY) || 2356 t->saved_priority > target_node->min_priority) 2357 binder_set_nice(target_node->min_priority); 2358 cmd = BR_TRANSACTION; 2359 } else { 2360 tr.target.ptr = 0; 2361 tr.cookie = 0; 2362 cmd = BR_REPLY; 2363 } 2364 tr.code = t->code; 2365 tr.flags = t->flags; 2366 tr.sender_euid = from_kuid(current_user_ns(), t->sender_euid); 2367 2368 if (t->from) { 2369 struct task_struct *sender = t->from->proc->tsk; 2370 2371 tr.sender_pid = task_tgid_nr_ns(sender, 2372 task_active_pid_ns(current)); 2373 } else { 2374 tr.sender_pid = 0; 2375 } 2376 2377 tr.data_size = t->buffer->data_size; 2378 tr.offsets_size = t->buffer->offsets_size; 2379 tr.data.ptr.buffer = (binder_uintptr_t)( 2380 (uintptr_t)t->buffer->data + 2381 proc->user_buffer_offset); 2382 tr.data.ptr.offsets = tr.data.ptr.buffer + 2383 ALIGN(t->buffer->data_size, 2384 sizeof(void *)); 2385 2386 if (put_user(cmd, (uint32_t __user *)ptr)) 2387 return -EFAULT; 2388 ptr += sizeof(uint32_t); 2389 if (copy_to_user(ptr, &tr, sizeof(tr))) 2390 return -EFAULT; 2391 ptr += sizeof(tr); 2392 2393 trace_binder_transaction_received(t); 2394 binder_stat_br(proc, thread, cmd); 2395 binder_debug(BINDER_DEBUG_TRANSACTION, 2396 "%d:%d %s %d %d:%d, cmd %d size %zd-%zd ptr %016llx-%016llx\n", 2397 proc->pid, thread->pid, 2398 (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" : 2399 "BR_REPLY", 2400 t->debug_id, t->from ? t->from->proc->pid : 0, 2401 t->from ? t->from->pid : 0, cmd, 2402 t->buffer->data_size, t->buffer->offsets_size, 2403 (u64)tr.data.ptr.buffer, (u64)tr.data.ptr.offsets); 2404 2405 list_del(&t->work.entry); 2406 t->buffer->allow_user_free = 1; 2407 if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) { 2408 t->to_parent = thread->transaction_stack; 2409 t->to_thread = thread; 2410 thread->transaction_stack = t; 2411 } else { 2412 t->buffer->transaction = NULL; 2413 kfree(t); 2414 binder_stats_deleted(BINDER_STAT_TRANSACTION); 2415 } 2416 break; 2417 } 2418 2419done: 2420 2421 *consumed = ptr - buffer; 2422 if (proc->requested_threads + proc->ready_threads == 0 && 2423 proc->requested_threads_started < proc->max_threads && 2424 (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2425 BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */ 2426 /*spawn a new thread if we leave this out */) { 2427 proc->requested_threads++; 2428 binder_debug(BINDER_DEBUG_THREADS, 2429 "%d:%d BR_SPAWN_LOOPER\n", 2430 proc->pid, thread->pid); 2431 if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer)) 2432 return -EFAULT; 2433 binder_stat_br(proc, thread, BR_SPAWN_LOOPER); 2434 } 2435 return 0; 2436} 2437 2438static void binder_release_work(struct list_head *list) 2439{ 2440 struct binder_work *w; 2441 2442 while (!list_empty(list)) { 2443 w = list_first_entry(list, struct binder_work, entry); 2444 list_del_init(&w->entry); 2445 switch (w->type) { 2446 case BINDER_WORK_TRANSACTION: { 2447 struct binder_transaction *t; 2448 2449 t = container_of(w, struct binder_transaction, work); 2450 if (t->buffer->target_node && 2451 !(t->flags & TF_ONE_WAY)) { 2452 binder_send_failed_reply(t, BR_DEAD_REPLY); 2453 } else { 2454 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2455 "undelivered transaction %d\n", 2456 t->debug_id); 2457 t->buffer->transaction = NULL; 2458 kfree(t); 2459 binder_stats_deleted(BINDER_STAT_TRANSACTION); 2460 } 2461 } break; 2462 case BINDER_WORK_TRANSACTION_COMPLETE: { 2463 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2464 "undelivered TRANSACTION_COMPLETE\n"); 2465 kfree(w); 2466 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2467 } break; 2468 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 2469 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 2470 struct binder_ref_death *death; 2471 2472 death = container_of(w, struct binder_ref_death, work); 2473 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2474 "undelivered death notification, %016llx\n", 2475 (u64)death->cookie); 2476 kfree(death); 2477 binder_stats_deleted(BINDER_STAT_DEATH); 2478 } break; 2479 default: 2480 pr_err("unexpected work type, %d, not freed\n", 2481 w->type); 2482 break; 2483 } 2484 } 2485 2486} 2487 2488static struct binder_thread *binder_get_thread(struct binder_proc *proc) 2489{ 2490 struct binder_thread *thread = NULL; 2491 struct rb_node *parent = NULL; 2492 struct rb_node **p = &proc->threads.rb_node; 2493 2494 while (*p) { 2495 parent = *p; 2496 thread = rb_entry(parent, struct binder_thread, rb_node); 2497 2498 if (current->pid < thread->pid) 2499 p = &(*p)->rb_left; 2500 else if (current->pid > thread->pid) 2501 p = &(*p)->rb_right; 2502 else 2503 break; 2504 } 2505 if (*p == NULL) { 2506 thread = kzalloc(sizeof(*thread), GFP_KERNEL); 2507 if (thread == NULL) 2508 return NULL; 2509 binder_stats_created(BINDER_STAT_THREAD); 2510 thread->proc = proc; 2511 thread->pid = current->pid; 2512 init_waitqueue_head(&thread->wait); 2513 INIT_LIST_HEAD(&thread->todo); 2514 rb_link_node(&thread->rb_node, parent, p); 2515 rb_insert_color(&thread->rb_node, &proc->threads); 2516 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2517 thread->return_error = BR_OK; 2518 thread->return_error2 = BR_OK; 2519 } 2520 return thread; 2521} 2522 2523static int binder_free_thread(struct binder_proc *proc, 2524 struct binder_thread *thread) 2525{ 2526 struct binder_transaction *t; 2527 struct binder_transaction *send_reply = NULL; 2528 int active_transactions = 0; 2529 2530 rb_erase(&thread->rb_node, &proc->threads); 2531 t = thread->transaction_stack; 2532 if (t && t->to_thread == thread) 2533 send_reply = t; 2534 while (t) { 2535 active_transactions++; 2536 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2537 "release %d:%d transaction %d %s, still active\n", 2538 proc->pid, thread->pid, 2539 t->debug_id, 2540 (t->to_thread == thread) ? "in" : "out"); 2541 2542 if (t->to_thread == thread) { 2543 t->to_proc = NULL; 2544 t->to_thread = NULL; 2545 if (t->buffer) { 2546 t->buffer->transaction = NULL; 2547 t->buffer = NULL; 2548 } 2549 t = t->to_parent; 2550 } else if (t->from == thread) { 2551 t->from = NULL; 2552 t = t->from_parent; 2553 } else 2554 BUG(); 2555 } 2556 if (send_reply) 2557 binder_send_failed_reply(send_reply, BR_DEAD_REPLY); 2558 binder_release_work(&thread->todo); 2559 kfree(thread); 2560 binder_stats_deleted(BINDER_STAT_THREAD); 2561 return active_transactions; 2562} 2563 2564static unsigned int binder_poll(struct file *filp, 2565 struct poll_table_struct *wait) 2566{ 2567 struct binder_proc *proc = filp->private_data; 2568 struct binder_thread *thread = NULL; 2569 int wait_for_proc_work; 2570 2571 binder_lock(__func__); 2572 2573 thread = binder_get_thread(proc); 2574 2575 wait_for_proc_work = thread->transaction_stack == NULL && 2576 list_empty(&thread->todo) && thread->return_error == BR_OK; 2577 2578 binder_unlock(__func__); 2579 2580 if (wait_for_proc_work) { 2581 if (binder_has_proc_work(proc, thread)) 2582 return POLLIN; 2583 poll_wait(filp, &proc->wait, wait); 2584 if (binder_has_proc_work(proc, thread)) 2585 return POLLIN; 2586 } else { 2587 if (binder_has_thread_work(thread)) 2588 return POLLIN; 2589 poll_wait(filp, &thread->wait, wait); 2590 if (binder_has_thread_work(thread)) 2591 return POLLIN; 2592 } 2593 return 0; 2594} 2595 2596static int binder_ioctl_write_read(struct file *filp, 2597 unsigned int cmd, unsigned long arg, 2598 struct binder_thread *thread) 2599{ 2600 int ret = 0; 2601 struct binder_proc *proc = filp->private_data; 2602 unsigned int size = _IOC_SIZE(cmd); 2603 void __user *ubuf = (void __user *)arg; 2604 struct binder_write_read bwr; 2605 2606 if (size != sizeof(struct binder_write_read)) { 2607 ret = -EINVAL; 2608 goto out; 2609 } 2610 if (copy_from_user(&bwr, ubuf, sizeof(bwr))) { 2611 ret = -EFAULT; 2612 goto out; 2613 } 2614 binder_debug(BINDER_DEBUG_READ_WRITE, 2615 "%d:%d write %lld at %016llx, read %lld at %016llx\n", 2616 proc->pid, thread->pid, 2617 (u64)bwr.write_size, (u64)bwr.write_buffer, 2618 (u64)bwr.read_size, (u64)bwr.read_buffer); 2619 2620 if (bwr.write_size > 0) { 2621 ret = binder_thread_write(proc, thread, 2622 bwr.write_buffer, 2623 bwr.write_size, 2624 &bwr.write_consumed); 2625 trace_binder_write_done(ret); 2626 if (ret < 0) { 2627 bwr.read_consumed = 0; 2628 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2629 ret = -EFAULT; 2630 goto out; 2631 } 2632 } 2633 if (bwr.read_size > 0) { 2634 ret = binder_thread_read(proc, thread, bwr.read_buffer, 2635 bwr.read_size, 2636 &bwr.read_consumed, 2637 filp->f_flags & O_NONBLOCK); 2638 trace_binder_read_done(ret); 2639 if (!list_empty(&proc->todo)) 2640 wake_up_interruptible(&proc->wait); 2641 if (ret < 0) { 2642 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2643 ret = -EFAULT; 2644 goto out; 2645 } 2646 } 2647 binder_debug(BINDER_DEBUG_READ_WRITE, 2648 "%d:%d wrote %lld of %lld, read return %lld of %lld\n", 2649 proc->pid, thread->pid, 2650 (u64)bwr.write_consumed, (u64)bwr.write_size, 2651 (u64)bwr.read_consumed, (u64)bwr.read_size); 2652 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) { 2653 ret = -EFAULT; 2654 goto out; 2655 } 2656out: 2657 return ret; 2658} 2659 2660static int binder_ioctl_set_ctx_mgr(struct file *filp) 2661{ 2662 int ret = 0; 2663 struct binder_proc *proc = filp->private_data; 2664 kuid_t curr_euid = current_euid(); 2665 2666 if (binder_context_mgr_node != NULL) { 2667 pr_err("BINDER_SET_CONTEXT_MGR already set\n"); 2668 ret = -EBUSY; 2669 goto out; 2670 } 2671 if (uid_valid(binder_context_mgr_uid)) { 2672 if (!uid_eq(binder_context_mgr_uid, curr_euid)) { 2673 pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n", 2674 from_kuid(&init_user_ns, curr_euid), 2675 from_kuid(&init_user_ns, 2676 binder_context_mgr_uid)); 2677 ret = -EPERM; 2678 goto out; 2679 } 2680 } else { 2681 binder_context_mgr_uid = curr_euid; 2682 } 2683 binder_context_mgr_node = binder_new_node(proc, 0, 0); 2684 if (binder_context_mgr_node == NULL) { 2685 ret = -ENOMEM; 2686 goto out; 2687 } 2688 binder_context_mgr_node->local_weak_refs++; 2689 binder_context_mgr_node->local_strong_refs++; 2690 binder_context_mgr_node->has_strong_ref = 1; 2691 binder_context_mgr_node->has_weak_ref = 1; 2692out: 2693 return ret; 2694} 2695 2696static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 2697{ 2698 int ret; 2699 struct binder_proc *proc = filp->private_data; 2700 struct binder_thread *thread; 2701 unsigned int size = _IOC_SIZE(cmd); 2702 void __user *ubuf = (void __user *)arg; 2703 2704 /*pr_info("binder_ioctl: %d:%d %x %lx\n", 2705 proc->pid, current->pid, cmd, arg);*/ 2706 2707 trace_binder_ioctl(cmd, arg); 2708 2709 ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2710 if (ret) 2711 goto err_unlocked; 2712 2713 binder_lock(__func__); 2714 thread = binder_get_thread(proc); 2715 if (thread == NULL) { 2716 ret = -ENOMEM; 2717 goto err; 2718 } 2719 2720 switch (cmd) { 2721 case BINDER_WRITE_READ: 2722 ret = binder_ioctl_write_read(filp, cmd, arg, thread); 2723 if (ret) 2724 goto err; 2725 break; 2726 case BINDER_SET_MAX_THREADS: 2727 if (copy_from_user(&proc->max_threads, ubuf, sizeof(proc->max_threads))) { 2728 ret = -EINVAL; 2729 goto err; 2730 } 2731 break; 2732 case BINDER_SET_CONTEXT_MGR: 2733 ret = binder_ioctl_set_ctx_mgr(filp); 2734 if (ret) 2735 goto err; 2736 break; 2737 case BINDER_THREAD_EXIT: 2738 binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n", 2739 proc->pid, thread->pid); 2740 binder_free_thread(proc, thread); 2741 thread = NULL; 2742 break; 2743 case BINDER_VERSION: { 2744 struct binder_version __user *ver = ubuf; 2745 2746 if (size != sizeof(struct binder_version)) { 2747 ret = -EINVAL; 2748 goto err; 2749 } 2750 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION, 2751 &ver->protocol_version)) { 2752 ret = -EINVAL; 2753 goto err; 2754 } 2755 break; 2756 } 2757 default: 2758 ret = -EINVAL; 2759 goto err; 2760 } 2761 ret = 0; 2762err: 2763 if (thread) 2764 thread->looper &= ~BINDER_LOOPER_STATE_NEED_RETURN; 2765 binder_unlock(__func__); 2766 wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2767 if (ret && ret != -ERESTARTSYS) 2768 pr_info("%d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret); 2769err_unlocked: 2770 trace_binder_ioctl_done(ret); 2771 return ret; 2772} 2773 2774static void binder_vma_open(struct vm_area_struct *vma) 2775{ 2776 struct binder_proc *proc = vma->vm_private_data; 2777 2778 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2779 "%d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2780 proc->pid, vma->vm_start, vma->vm_end, 2781 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2782 (unsigned long)pgprot_val(vma->vm_page_prot)); 2783} 2784 2785static void binder_vma_close(struct vm_area_struct *vma) 2786{ 2787 struct binder_proc *proc = vma->vm_private_data; 2788 2789 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2790 "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2791 proc->pid, vma->vm_start, vma->vm_end, 2792 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2793 (unsigned long)pgprot_val(vma->vm_page_prot)); 2794 proc->vma = NULL; 2795 proc->vma_vm_mm = NULL; 2796 binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES); 2797} 2798 2799static int binder_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf) 2800{ 2801 return VM_FAULT_SIGBUS; 2802} 2803 2804static struct vm_operations_struct binder_vm_ops = { 2805 .open = binder_vma_open, 2806 .close = binder_vma_close, 2807 .fault = binder_vm_fault, 2808}; 2809 2810static int binder_mmap(struct file *filp, struct vm_area_struct *vma) 2811{ 2812 int ret; 2813 struct vm_struct *area; 2814 struct binder_proc *proc = filp->private_data; 2815 const char *failure_string; 2816 struct binder_buffer *buffer; 2817 2818 if (proc->tsk != current) 2819 return -EINVAL; 2820 2821 if ((vma->vm_end - vma->vm_start) > SZ_4M) 2822 vma->vm_end = vma->vm_start + SZ_4M; 2823 2824 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2825 "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n", 2826 proc->pid, vma->vm_start, vma->vm_end, 2827 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2828 (unsigned long)pgprot_val(vma->vm_page_prot)); 2829 2830 if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) { 2831 ret = -EPERM; 2832 failure_string = "bad vm_flags"; 2833 goto err_bad_arg; 2834 } 2835 vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE; 2836 2837 mutex_lock(&binder_mmap_lock); 2838 if (proc->buffer) { 2839 ret = -EBUSY; 2840 failure_string = "already mapped"; 2841 goto err_already_mapped; 2842 } 2843 2844 area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP); 2845 if (area == NULL) { 2846 ret = -ENOMEM; 2847 failure_string = "get_vm_area"; 2848 goto err_get_vm_area_failed; 2849 } 2850 proc->buffer = area->addr; 2851 proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer; 2852 mutex_unlock(&binder_mmap_lock); 2853 2854#ifdef CONFIG_CPU_CACHE_VIPT 2855 if (cache_is_vipt_aliasing()) { 2856 while (CACHE_COLOUR((vma->vm_start ^ (uint32_t)proc->buffer))) { 2857 pr_info("binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer); 2858 vma->vm_start += PAGE_SIZE; 2859 } 2860 } 2861#endif 2862 proc->pages = kzalloc(sizeof(proc->pages[0]) * ((vma->vm_end - vma->vm_start) / PAGE_SIZE), GFP_KERNEL); 2863 if (proc->pages == NULL) { 2864 ret = -ENOMEM; 2865 failure_string = "alloc page array"; 2866 goto err_alloc_pages_failed; 2867 } 2868 proc->buffer_size = vma->vm_end - vma->vm_start; 2869 2870 vma->vm_ops = &binder_vm_ops; 2871 vma->vm_private_data = proc; 2872 2873 if (binder_update_page_range(proc, 1, proc->buffer, proc->buffer + PAGE_SIZE, vma)) { 2874 ret = -ENOMEM; 2875 failure_string = "alloc small buf"; 2876 goto err_alloc_small_buf_failed; 2877 } 2878 buffer = proc->buffer; 2879 INIT_LIST_HEAD(&proc->buffers); 2880 list_add(&buffer->entry, &proc->buffers); 2881 buffer->free = 1; 2882 binder_insert_free_buffer(proc, buffer); 2883 proc->free_async_space = proc->buffer_size / 2; 2884 barrier(); 2885 proc->files = get_files_struct(current); 2886 proc->vma = vma; 2887 proc->vma_vm_mm = vma->vm_mm; 2888 2889 /*pr_info("binder_mmap: %d %lx-%lx maps %p\n", 2890 proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/ 2891 return 0; 2892 2893err_alloc_small_buf_failed: 2894 kfree(proc->pages); 2895 proc->pages = NULL; 2896err_alloc_pages_failed: 2897 mutex_lock(&binder_mmap_lock); 2898 vfree(proc->buffer); 2899 proc->buffer = NULL; 2900err_get_vm_area_failed: 2901err_already_mapped: 2902 mutex_unlock(&binder_mmap_lock); 2903err_bad_arg: 2904 pr_err("binder_mmap: %d %lx-%lx %s failed %d\n", 2905 proc->pid, vma->vm_start, vma->vm_end, failure_string, ret); 2906 return ret; 2907} 2908 2909static int binder_open(struct inode *nodp, struct file *filp) 2910{ 2911 struct binder_proc *proc; 2912 2913 binder_debug(BINDER_DEBUG_OPEN_CLOSE, "binder_open: %d:%d\n", 2914 current->group_leader->pid, current->pid); 2915 2916 proc = kzalloc(sizeof(*proc), GFP_KERNEL); 2917 if (proc == NULL) 2918 return -ENOMEM; 2919 get_task_struct(current); 2920 proc->tsk = current; 2921 INIT_LIST_HEAD(&proc->todo); 2922 init_waitqueue_head(&proc->wait); 2923 proc->default_priority = task_nice(current); 2924 2925 binder_lock(__func__); 2926 2927 binder_stats_created(BINDER_STAT_PROC); 2928 hlist_add_head(&proc->proc_node, &binder_procs); 2929 proc->pid = current->group_leader->pid; 2930 INIT_LIST_HEAD(&proc->delivered_death); 2931 filp->private_data = proc; 2932 2933 binder_unlock(__func__); 2934 2935 if (binder_debugfs_dir_entry_proc) { 2936 char strbuf[11]; 2937 2938 snprintf(strbuf, sizeof(strbuf), "%u", proc->pid); 2939 proc->debugfs_entry = debugfs_create_file(strbuf, S_IRUGO, 2940 binder_debugfs_dir_entry_proc, proc, &binder_proc_fops); 2941 } 2942 2943 return 0; 2944} 2945 2946static int binder_flush(struct file *filp, fl_owner_t id) 2947{ 2948 struct binder_proc *proc = filp->private_data; 2949 2950 binder_defer_work(proc, BINDER_DEFERRED_FLUSH); 2951 2952 return 0; 2953} 2954 2955static void binder_deferred_flush(struct binder_proc *proc) 2956{ 2957 struct rb_node *n; 2958 int wake_count = 0; 2959 2960 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) { 2961 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node); 2962 2963 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2964 if (thread->looper & BINDER_LOOPER_STATE_WAITING) { 2965 wake_up_interruptible(&thread->wait); 2966 wake_count++; 2967 } 2968 } 2969 wake_up_interruptible_all(&proc->wait); 2970 2971 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2972 "binder_flush: %d woke %d threads\n", proc->pid, 2973 wake_count); 2974} 2975 2976static int binder_release(struct inode *nodp, struct file *filp) 2977{ 2978 struct binder_proc *proc = filp->private_data; 2979 2980 debugfs_remove(proc->debugfs_entry); 2981 binder_defer_work(proc, BINDER_DEFERRED_RELEASE); 2982 2983 return 0; 2984} 2985 2986static int binder_node_release(struct binder_node *node, int refs) 2987{ 2988 struct binder_ref *ref; 2989 int death = 0; 2990 2991 list_del_init(&node->work.entry); 2992 binder_release_work(&node->async_todo); 2993 2994 if (hlist_empty(&node->refs)) { 2995 kfree(node); 2996 binder_stats_deleted(BINDER_STAT_NODE); 2997 2998 return refs; 2999 } 3000 3001 node->proc = NULL; 3002 node->local_strong_refs = 0; 3003 node->local_weak_refs = 0; 3004 hlist_add_head(&node->dead_node, &binder_dead_nodes); 3005 3006 hlist_for_each_entry(ref, &node->refs, node_entry) { 3007 refs++; 3008 3009 if (!ref->death) 3010 continue; 3011 3012 death++; 3013 3014 if (list_empty(&ref->death->work.entry)) { 3015 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 3016 list_add_tail(&ref->death->work.entry, 3017 &ref->proc->todo); 3018 wake_up_interruptible(&ref->proc->wait); 3019 } else 3020 BUG(); 3021 } 3022 3023 binder_debug(BINDER_DEBUG_DEAD_BINDER, 3024 "node %d now dead, refs %d, death %d\n", 3025 node->debug_id, refs, death); 3026 3027 return refs; 3028} 3029 3030static void binder_deferred_release(struct binder_proc *proc) 3031{ 3032 struct binder_transaction *t; 3033 struct rb_node *n; 3034 int threads, nodes, incoming_refs, outgoing_refs, buffers, 3035 active_transactions, page_count; 3036 3037 BUG_ON(proc->vma); 3038 BUG_ON(proc->files); 3039 3040 hlist_del(&proc->proc_node); 3041 3042 if (binder_context_mgr_node && binder_context_mgr_node->proc == proc) { 3043 binder_debug(BINDER_DEBUG_DEAD_BINDER, 3044 "%s: %d context_mgr_node gone\n", 3045 __func__, proc->pid); 3046 binder_context_mgr_node = NULL; 3047 } 3048 3049 threads = 0; 3050 active_transactions = 0; 3051 while ((n = rb_first(&proc->threads))) { 3052 struct binder_thread *thread; 3053 3054 thread = rb_entry(n, struct binder_thread, rb_node); 3055 threads++; 3056 active_transactions += binder_free_thread(proc, thread); 3057 } 3058 3059 nodes = 0; 3060 incoming_refs = 0; 3061 while ((n = rb_first(&proc->nodes))) { 3062 struct binder_node *node; 3063 3064 node = rb_entry(n, struct binder_node, rb_node); 3065 nodes++; 3066 rb_erase(&node->rb_node, &proc->nodes); 3067 incoming_refs = binder_node_release(node, incoming_refs); 3068 } 3069 3070 outgoing_refs = 0; 3071 while ((n = rb_first(&proc->refs_by_desc))) { 3072 struct binder_ref *ref; 3073 3074 ref = rb_entry(n, struct binder_ref, rb_node_desc); 3075 outgoing_refs++; 3076 binder_delete_ref(ref); 3077 } 3078 3079 binder_release_work(&proc->todo); 3080 binder_release_work(&proc->delivered_death); 3081 3082 buffers = 0; 3083 while ((n = rb_first(&proc->allocated_buffers))) { 3084 struct binder_buffer *buffer; 3085 3086 buffer = rb_entry(n, struct binder_buffer, rb_node); 3087 3088 t = buffer->transaction; 3089 if (t) { 3090 t->buffer = NULL; 3091 buffer->transaction = NULL; 3092 pr_err("release proc %d, transaction %d, not freed\n", 3093 proc->pid, t->debug_id); 3094 /*BUG();*/ 3095 } 3096 3097 binder_free_buf(proc, buffer); 3098 buffers++; 3099 } 3100 3101 binder_stats_deleted(BINDER_STAT_PROC); 3102 3103 page_count = 0; 3104 if (proc->pages) { 3105 int i; 3106 3107 for (i = 0; i < proc->buffer_size / PAGE_SIZE; i++) { 3108 void *page_addr; 3109 3110 if (!proc->pages[i]) 3111 continue; 3112 3113 page_addr = proc->buffer + i * PAGE_SIZE; 3114 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 3115 "%s: %d: page %d at %p not freed\n", 3116 __func__, proc->pid, i, page_addr); 3117 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE); 3118 __free_page(proc->pages[i]); 3119 page_count++; 3120 } 3121 kfree(proc->pages); 3122 vfree(proc->buffer); 3123 } 3124 3125 put_task_struct(proc->tsk); 3126 3127 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 3128 "%s: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d, buffers %d, pages %d\n", 3129 __func__, proc->pid, threads, nodes, incoming_refs, 3130 outgoing_refs, active_transactions, buffers, page_count); 3131 3132 kfree(proc); 3133} 3134 3135static void binder_deferred_func(struct work_struct *work) 3136{ 3137 struct binder_proc *proc; 3138 struct files_struct *files; 3139 3140 int defer; 3141 3142 do { 3143 binder_lock(__func__); 3144 mutex_lock(&binder_deferred_lock); 3145 if (!hlist_empty(&binder_deferred_list)) { 3146 proc = hlist_entry(binder_deferred_list.first, 3147 struct binder_proc, deferred_work_node); 3148 hlist_del_init(&proc->deferred_work_node); 3149 defer = proc->deferred_work; 3150 proc->deferred_work = 0; 3151 } else { 3152 proc = NULL; 3153 defer = 0; 3154 } 3155 mutex_unlock(&binder_deferred_lock); 3156 3157 files = NULL; 3158 if (defer & BINDER_DEFERRED_PUT_FILES) { 3159 files = proc->files; 3160 if (files) 3161 proc->files = NULL; 3162 } 3163 3164 if (defer & BINDER_DEFERRED_FLUSH) 3165 binder_deferred_flush(proc); 3166 3167 if (defer & BINDER_DEFERRED_RELEASE) 3168 binder_deferred_release(proc); /* frees proc */ 3169 3170 binder_unlock(__func__); 3171 if (files) 3172 put_files_struct(files); 3173 } while (proc); 3174} 3175static DECLARE_WORK(binder_deferred_work, binder_deferred_func); 3176 3177static void 3178binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer) 3179{ 3180 mutex_lock(&binder_deferred_lock); 3181 proc->deferred_work |= defer; 3182 if (hlist_unhashed(&proc->deferred_work_node)) { 3183 hlist_add_head(&proc->deferred_work_node, 3184 &binder_deferred_list); 3185 queue_work(binder_deferred_workqueue, &binder_deferred_work); 3186 } 3187 mutex_unlock(&binder_deferred_lock); 3188} 3189 3190static void print_binder_transaction(struct seq_file *m, const char *prefix, 3191 struct binder_transaction *t) 3192{ 3193 seq_printf(m, 3194 "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d", 3195 prefix, t->debug_id, t, 3196 t->from ? t->from->proc->pid : 0, 3197 t->from ? t->from->pid : 0, 3198 t->to_proc ? t->to_proc->pid : 0, 3199 t->to_thread ? t->to_thread->pid : 0, 3200 t->code, t->flags, t->priority, t->need_reply); 3201 if (t->buffer == NULL) { 3202 seq_puts(m, " buffer free\n"); 3203 return; 3204 } 3205 if (t->buffer->target_node) 3206 seq_printf(m, " node %d", 3207 t->buffer->target_node->debug_id); 3208 seq_printf(m, " size %zd:%zd data %p\n", 3209 t->buffer->data_size, t->buffer->offsets_size, 3210 t->buffer->data); 3211} 3212 3213static void print_binder_buffer(struct seq_file *m, const char *prefix, 3214 struct binder_buffer *buffer) 3215{ 3216 seq_printf(m, "%s %d: %p size %zd:%zd %s\n", 3217 prefix, buffer->debug_id, buffer->data, 3218 buffer->data_size, buffer->offsets_size, 3219 buffer->transaction ? "active" : "delivered"); 3220} 3221 3222static void print_binder_work(struct seq_file *m, const char *prefix, 3223 const char *transaction_prefix, 3224 struct binder_work *w) 3225{ 3226 struct binder_node *node; 3227 struct binder_transaction *t; 3228 3229 switch (w->type) { 3230 case BINDER_WORK_TRANSACTION: 3231 t = container_of(w, struct binder_transaction, work); 3232 print_binder_transaction(m, transaction_prefix, t); 3233 break; 3234 case BINDER_WORK_TRANSACTION_COMPLETE: 3235 seq_printf(m, "%stransaction complete\n", prefix); 3236 break; 3237 case BINDER_WORK_NODE: 3238 node = container_of(w, struct binder_node, work); 3239 seq_printf(m, "%snode work %d: u%016llx c%016llx\n", 3240 prefix, node->debug_id, 3241 (u64)node->ptr, (u64)node->cookie); 3242 break; 3243 case BINDER_WORK_DEAD_BINDER: 3244 seq_printf(m, "%shas dead binder\n", prefix); 3245 break; 3246 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 3247 seq_printf(m, "%shas cleared dead binder\n", prefix); 3248 break; 3249 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: 3250 seq_printf(m, "%shas cleared death notification\n", prefix); 3251 break; 3252 default: 3253 seq_printf(m, "%sunknown work: type %d\n", prefix, w->type); 3254 break; 3255 } 3256} 3257 3258static void print_binder_thread(struct seq_file *m, 3259 struct binder_thread *thread, 3260 int print_always) 3261{ 3262 struct binder_transaction *t; 3263 struct binder_work *w; 3264 size_t start_pos = m->count; 3265 size_t header_pos; 3266 3267 seq_printf(m, " thread %d: l %02x\n", thread->pid, thread->looper); 3268 header_pos = m->count; 3269 t = thread->transaction_stack; 3270 while (t) { 3271 if (t->from == thread) { 3272 print_binder_transaction(m, 3273 " outgoing transaction", t); 3274 t = t->from_parent; 3275 } else if (t->to_thread == thread) { 3276 print_binder_transaction(m, 3277 " incoming transaction", t); 3278 t = t->to_parent; 3279 } else { 3280 print_binder_transaction(m, " bad transaction", t); 3281 t = NULL; 3282 } 3283 } 3284 list_for_each_entry(w, &thread->todo, entry) { 3285 print_binder_work(m, " ", " pending transaction", w); 3286 } 3287 if (!print_always && m->count == header_pos) 3288 m->count = start_pos; 3289} 3290 3291static void print_binder_node(struct seq_file *m, struct binder_node *node) 3292{ 3293 struct binder_ref *ref; 3294 struct binder_work *w; 3295 int count; 3296 3297 count = 0; 3298 hlist_for_each_entry(ref, &node->refs, node_entry) 3299 count++; 3300 3301 seq_printf(m, " node %d: u%016llx c%016llx hs %d hw %d ls %d lw %d is %d iw %d", 3302 node->debug_id, (u64)node->ptr, (u64)node->cookie, 3303 node->has_strong_ref, node->has_weak_ref, 3304 node->local_strong_refs, node->local_weak_refs, 3305 node->internal_strong_refs, count); 3306 if (count) { 3307 seq_puts(m, " proc"); 3308 hlist_for_each_entry(ref, &node->refs, node_entry) 3309 seq_printf(m, " %d", ref->proc->pid); 3310 } 3311 seq_puts(m, "\n"); 3312 list_for_each_entry(w, &node->async_todo, entry) 3313 print_binder_work(m, " ", 3314 " pending async transaction", w); 3315} 3316 3317static void print_binder_ref(struct seq_file *m, struct binder_ref *ref) 3318{ 3319 seq_printf(m, " ref %d: desc %d %snode %d s %d w %d d %p\n", 3320 ref->debug_id, ref->desc, ref->node->proc ? "" : "dead ", 3321 ref->node->debug_id, ref->strong, ref->weak, ref->death); 3322} 3323 3324static void print_binder_proc(struct seq_file *m, 3325 struct binder_proc *proc, int print_all) 3326{ 3327 struct binder_work *w; 3328 struct rb_node *n; 3329 size_t start_pos = m->count; 3330 size_t header_pos; 3331 3332 seq_printf(m, "proc %d\n", proc->pid); 3333 header_pos = m->count; 3334 3335 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3336 print_binder_thread(m, rb_entry(n, struct binder_thread, 3337 rb_node), print_all); 3338 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) { 3339 struct binder_node *node = rb_entry(n, struct binder_node, 3340 rb_node); 3341 if (print_all || node->has_async_transaction) 3342 print_binder_node(m, node); 3343 } 3344 if (print_all) { 3345 for (n = rb_first(&proc->refs_by_desc); 3346 n != NULL; 3347 n = rb_next(n)) 3348 print_binder_ref(m, rb_entry(n, struct binder_ref, 3349 rb_node_desc)); 3350 } 3351 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3352 print_binder_buffer(m, " buffer", 3353 rb_entry(n, struct binder_buffer, rb_node)); 3354 list_for_each_entry(w, &proc->todo, entry) 3355 print_binder_work(m, " ", " pending transaction", w); 3356 list_for_each_entry(w, &proc->delivered_death, entry) { 3357 seq_puts(m, " has delivered dead binder\n"); 3358 break; 3359 } 3360 if (!print_all && m->count == header_pos) 3361 m->count = start_pos; 3362} 3363 3364static const char * const binder_return_strings[] = { 3365 "BR_ERROR", 3366 "BR_OK", 3367 "BR_TRANSACTION", 3368 "BR_REPLY", 3369 "BR_ACQUIRE_RESULT", 3370 "BR_DEAD_REPLY", 3371 "BR_TRANSACTION_COMPLETE", 3372 "BR_INCREFS", 3373 "BR_ACQUIRE", 3374 "BR_RELEASE", 3375 "BR_DECREFS", 3376 "BR_ATTEMPT_ACQUIRE", 3377 "BR_NOOP", 3378 "BR_SPAWN_LOOPER", 3379 "BR_FINISHED", 3380 "BR_DEAD_BINDER", 3381 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 3382 "BR_FAILED_REPLY" 3383}; 3384 3385static const char * const binder_command_strings[] = { 3386 "BC_TRANSACTION", 3387 "BC_REPLY", 3388 "BC_ACQUIRE_RESULT", 3389 "BC_FREE_BUFFER", 3390 "BC_INCREFS", 3391 "BC_ACQUIRE", 3392 "BC_RELEASE", 3393 "BC_DECREFS", 3394 "BC_INCREFS_DONE", 3395 "BC_ACQUIRE_DONE", 3396 "BC_ATTEMPT_ACQUIRE", 3397 "BC_REGISTER_LOOPER", 3398 "BC_ENTER_LOOPER", 3399 "BC_EXIT_LOOPER", 3400 "BC_REQUEST_DEATH_NOTIFICATION", 3401 "BC_CLEAR_DEATH_NOTIFICATION", 3402 "BC_DEAD_BINDER_DONE" 3403}; 3404 3405static const char * const binder_objstat_strings[] = { 3406 "proc", 3407 "thread", 3408 "node", 3409 "ref", 3410 "death", 3411 "transaction", 3412 "transaction_complete" 3413}; 3414 3415static void print_binder_stats(struct seq_file *m, const char *prefix, 3416 struct binder_stats *stats) 3417{ 3418 int i; 3419 3420 BUILD_BUG_ON(ARRAY_SIZE(stats->bc) != 3421 ARRAY_SIZE(binder_command_strings)); 3422 for (i = 0; i < ARRAY_SIZE(stats->bc); i++) { 3423 if (stats->bc[i]) 3424 seq_printf(m, "%s%s: %d\n", prefix, 3425 binder_command_strings[i], stats->bc[i]); 3426 } 3427 3428 BUILD_BUG_ON(ARRAY_SIZE(stats->br) != 3429 ARRAY_SIZE(binder_return_strings)); 3430 for (i = 0; i < ARRAY_SIZE(stats->br); i++) { 3431 if (stats->br[i]) 3432 seq_printf(m, "%s%s: %d\n", prefix, 3433 binder_return_strings[i], stats->br[i]); 3434 } 3435 3436 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 3437 ARRAY_SIZE(binder_objstat_strings)); 3438 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 3439 ARRAY_SIZE(stats->obj_deleted)); 3440 for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) { 3441 if (stats->obj_created[i] || stats->obj_deleted[i]) 3442 seq_printf(m, "%s%s: active %d total %d\n", prefix, 3443 binder_objstat_strings[i], 3444 stats->obj_created[i] - stats->obj_deleted[i], 3445 stats->obj_created[i]); 3446 } 3447} 3448 3449static void print_binder_proc_stats(struct seq_file *m, 3450 struct binder_proc *proc) 3451{ 3452 struct binder_work *w; 3453 struct rb_node *n; 3454 int count, strong, weak; 3455 3456 seq_printf(m, "proc %d\n", proc->pid); 3457 count = 0; 3458 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3459 count++; 3460 seq_printf(m, " threads: %d\n", count); 3461 seq_printf(m, " requested threads: %d+%d/%d\n" 3462 " ready threads %d\n" 3463 " free async space %zd\n", proc->requested_threads, 3464 proc->requested_threads_started, proc->max_threads, 3465 proc->ready_threads, proc->free_async_space); 3466 count = 0; 3467 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) 3468 count++; 3469 seq_printf(m, " nodes: %d\n", count); 3470 count = 0; 3471 strong = 0; 3472 weak = 0; 3473 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 3474 struct binder_ref *ref = rb_entry(n, struct binder_ref, 3475 rb_node_desc); 3476 count++; 3477 strong += ref->strong; 3478 weak += ref->weak; 3479 } 3480 seq_printf(m, " refs: %d s %d w %d\n", count, strong, weak); 3481 3482 count = 0; 3483 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3484 count++; 3485 seq_printf(m, " buffers: %d\n", count); 3486 3487 count = 0; 3488 list_for_each_entry(w, &proc->todo, entry) { 3489 switch (w->type) { 3490 case BINDER_WORK_TRANSACTION: 3491 count++; 3492 break; 3493 default: 3494 break; 3495 } 3496 } 3497 seq_printf(m, " pending transactions: %d\n", count); 3498 3499 print_binder_stats(m, " ", &proc->stats); 3500} 3501 3502 3503static int binder_state_show(struct seq_file *m, void *unused) 3504{ 3505 struct binder_proc *proc; 3506 struct binder_node *node; 3507 int do_lock = !binder_debug_no_lock; 3508 3509 if (do_lock) 3510 binder_lock(__func__); 3511 3512 seq_puts(m, "binder state:\n"); 3513 3514 if (!hlist_empty(&binder_dead_nodes)) 3515 seq_puts(m, "dead nodes:\n"); 3516 hlist_for_each_entry(node, &binder_dead_nodes, dead_node) 3517 print_binder_node(m, node); 3518 3519 hlist_for_each_entry(proc, &binder_procs, proc_node) 3520 print_binder_proc(m, proc, 1); 3521 if (do_lock) 3522 binder_unlock(__func__); 3523 return 0; 3524} 3525 3526static int binder_stats_show(struct seq_file *m, void *unused) 3527{ 3528 struct binder_proc *proc; 3529 int do_lock = !binder_debug_no_lock; 3530 3531 if (do_lock) 3532 binder_lock(__func__); 3533 3534 seq_puts(m, "binder stats:\n"); 3535 3536 print_binder_stats(m, "", &binder_stats); 3537 3538 hlist_for_each_entry(proc, &binder_procs, proc_node) 3539 print_binder_proc_stats(m, proc); 3540 if (do_lock) 3541 binder_unlock(__func__); 3542 return 0; 3543} 3544 3545static int binder_transactions_show(struct seq_file *m, void *unused) 3546{ 3547 struct binder_proc *proc; 3548 int do_lock = !binder_debug_no_lock; 3549 3550 if (do_lock) 3551 binder_lock(__func__); 3552 3553 seq_puts(m, "binder transactions:\n"); 3554 hlist_for_each_entry(proc, &binder_procs, proc_node) 3555 print_binder_proc(m, proc, 0); 3556 if (do_lock) 3557 binder_unlock(__func__); 3558 return 0; 3559} 3560 3561static int binder_proc_show(struct seq_file *m, void *unused) 3562{ 3563 struct binder_proc *proc = m->private; 3564 int do_lock = !binder_debug_no_lock; 3565 3566 if (do_lock) 3567 binder_lock(__func__); 3568 seq_puts(m, "binder proc state:\n"); 3569 print_binder_proc(m, proc, 1); 3570 if (do_lock) 3571 binder_unlock(__func__); 3572 return 0; 3573} 3574 3575static void print_binder_transaction_log_entry(struct seq_file *m, 3576 struct binder_transaction_log_entry *e) 3577{ 3578 seq_printf(m, 3579 "%d: %s from %d:%d to %d:%d node %d handle %d size %d:%d\n", 3580 e->debug_id, (e->call_type == 2) ? "reply" : 3581 ((e->call_type == 1) ? "async" : "call "), e->from_proc, 3582 e->from_thread, e->to_proc, e->to_thread, e->to_node, 3583 e->target_handle, e->data_size, e->offsets_size); 3584} 3585 3586static int binder_transaction_log_show(struct seq_file *m, void *unused) 3587{ 3588 struct binder_transaction_log *log = m->private; 3589 int i; 3590 3591 if (log->full) { 3592 for (i = log->next; i < ARRAY_SIZE(log->entry); i++) 3593 print_binder_transaction_log_entry(m, &log->entry[i]); 3594 } 3595 for (i = 0; i < log->next; i++) 3596 print_binder_transaction_log_entry(m, &log->entry[i]); 3597 return 0; 3598} 3599 3600static const struct file_operations binder_fops = { 3601 .owner = THIS_MODULE, 3602 .poll = binder_poll, 3603 .unlocked_ioctl = binder_ioctl, 3604 .compat_ioctl = binder_ioctl, 3605 .mmap = binder_mmap, 3606 .open = binder_open, 3607 .flush = binder_flush, 3608 .release = binder_release, 3609}; 3610 3611static struct miscdevice binder_miscdev = { 3612 .minor = MISC_DYNAMIC_MINOR, 3613 .name = "binder", 3614 .fops = &binder_fops 3615}; 3616 3617BINDER_DEBUG_ENTRY(state); 3618BINDER_DEBUG_ENTRY(stats); 3619BINDER_DEBUG_ENTRY(transactions); 3620BINDER_DEBUG_ENTRY(transaction_log); 3621 3622static int __init binder_init(void) 3623{ 3624 int ret; 3625 3626 binder_deferred_workqueue = create_singlethread_workqueue("binder"); 3627 if (!binder_deferred_workqueue) 3628 return -ENOMEM; 3629 3630 binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL); 3631 if (binder_debugfs_dir_entry_root) 3632 binder_debugfs_dir_entry_proc = debugfs_create_dir("proc", 3633 binder_debugfs_dir_entry_root); 3634 ret = misc_register(&binder_miscdev); 3635 if (binder_debugfs_dir_entry_root) { 3636 debugfs_create_file("state", 3637 S_IRUGO, 3638 binder_debugfs_dir_entry_root, 3639 NULL, 3640 &binder_state_fops); 3641 debugfs_create_file("stats", 3642 S_IRUGO, 3643 binder_debugfs_dir_entry_root, 3644 NULL, 3645 &binder_stats_fops); 3646 debugfs_create_file("transactions", 3647 S_IRUGO, 3648 binder_debugfs_dir_entry_root, 3649 NULL, 3650 &binder_transactions_fops); 3651 debugfs_create_file("transaction_log", 3652 S_IRUGO, 3653 binder_debugfs_dir_entry_root, 3654 &binder_transaction_log, 3655 &binder_transaction_log_fops); 3656 debugfs_create_file("failed_transaction_log", 3657 S_IRUGO, 3658 binder_debugfs_dir_entry_root, 3659 &binder_transaction_log_failed, 3660 &binder_transaction_log_fops); 3661 } 3662 return ret; 3663} 3664 3665device_initcall(binder_init); 3666 3667#define CREATE_TRACE_POINTS 3668#include "binder_trace.h" 3669 3670MODULE_LICENSE("GPL v2"); 3671