binder.c revision e194fd8a5d8e0a7eeed239a8534460724b62fe2d
1/* binder.c 2 * 3 * Android IPC Subsystem 4 * 5 * Copyright (C) 2007-2008 Google, Inc. 6 * 7 * This software is licensed under the terms of the GNU General Public 8 * License version 2, as published by the Free Software Foundation, and 9 * may be copied, distributed, and modified under those terms. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 */ 17 18#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 19 20#include <asm/cacheflush.h> 21#include <linux/fdtable.h> 22#include <linux/file.h> 23#include <linux/freezer.h> 24#include <linux/fs.h> 25#include <linux/list.h> 26#include <linux/miscdevice.h> 27#include <linux/mm.h> 28#include <linux/module.h> 29#include <linux/mutex.h> 30#include <linux/nsproxy.h> 31#include <linux/poll.h> 32#include <linux/debugfs.h> 33#include <linux/rbtree.h> 34#include <linux/sched.h> 35#include <linux/seq_file.h> 36#include <linux/uaccess.h> 37#include <linux/vmalloc.h> 38#include <linux/slab.h> 39#include <linux/pid_namespace.h> 40 41#include "binder.h" 42#include "binder_trace.h" 43 44static DEFINE_MUTEX(binder_main_lock); 45static DEFINE_MUTEX(binder_deferred_lock); 46static DEFINE_MUTEX(binder_mmap_lock); 47 48static HLIST_HEAD(binder_procs); 49static HLIST_HEAD(binder_deferred_list); 50static HLIST_HEAD(binder_dead_nodes); 51 52static struct dentry *binder_debugfs_dir_entry_root; 53static struct dentry *binder_debugfs_dir_entry_proc; 54static struct binder_node *binder_context_mgr_node; 55static kuid_t binder_context_mgr_uid = INVALID_UID; 56static int binder_last_id; 57static struct workqueue_struct *binder_deferred_workqueue; 58 59#define BINDER_DEBUG_ENTRY(name) \ 60static int binder_##name##_open(struct inode *inode, struct file *file) \ 61{ \ 62 return single_open(file, binder_##name##_show, inode->i_private); \ 63} \ 64\ 65static const struct file_operations binder_##name##_fops = { \ 66 .owner = THIS_MODULE, \ 67 .open = binder_##name##_open, \ 68 .read = seq_read, \ 69 .llseek = seq_lseek, \ 70 .release = single_release, \ 71} 72 73static int binder_proc_show(struct seq_file *m, void *unused); 74BINDER_DEBUG_ENTRY(proc); 75 76/* This is only defined in include/asm-arm/sizes.h */ 77#ifndef SZ_1K 78#define SZ_1K 0x400 79#endif 80 81#ifndef SZ_4M 82#define SZ_4M 0x400000 83#endif 84 85#define FORBIDDEN_MMAP_FLAGS (VM_WRITE) 86 87#define BINDER_SMALL_BUF_SIZE (PAGE_SIZE * 64) 88 89enum { 90 BINDER_DEBUG_USER_ERROR = 1U << 0, 91 BINDER_DEBUG_FAILED_TRANSACTION = 1U << 1, 92 BINDER_DEBUG_DEAD_TRANSACTION = 1U << 2, 93 BINDER_DEBUG_OPEN_CLOSE = 1U << 3, 94 BINDER_DEBUG_DEAD_BINDER = 1U << 4, 95 BINDER_DEBUG_DEATH_NOTIFICATION = 1U << 5, 96 BINDER_DEBUG_READ_WRITE = 1U << 6, 97 BINDER_DEBUG_USER_REFS = 1U << 7, 98 BINDER_DEBUG_THREADS = 1U << 8, 99 BINDER_DEBUG_TRANSACTION = 1U << 9, 100 BINDER_DEBUG_TRANSACTION_COMPLETE = 1U << 10, 101 BINDER_DEBUG_FREE_BUFFER = 1U << 11, 102 BINDER_DEBUG_INTERNAL_REFS = 1U << 12, 103 BINDER_DEBUG_BUFFER_ALLOC = 1U << 13, 104 BINDER_DEBUG_PRIORITY_CAP = 1U << 14, 105 BINDER_DEBUG_BUFFER_ALLOC_ASYNC = 1U << 15, 106}; 107static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR | 108 BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION; 109module_param_named(debug_mask, binder_debug_mask, uint, S_IWUSR | S_IRUGO); 110 111static bool binder_debug_no_lock; 112module_param_named(proc_no_lock, binder_debug_no_lock, bool, S_IWUSR | S_IRUGO); 113 114static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait); 115static int binder_stop_on_user_error; 116 117static int binder_set_stop_on_user_error(const char *val, 118 struct kernel_param *kp) 119{ 120 int ret; 121 ret = param_set_int(val, kp); 122 if (binder_stop_on_user_error < 2) 123 wake_up(&binder_user_error_wait); 124 return ret; 125} 126module_param_call(stop_on_user_error, binder_set_stop_on_user_error, 127 param_get_int, &binder_stop_on_user_error, S_IWUSR | S_IRUGO); 128 129#define binder_debug(mask, x...) \ 130 do { \ 131 if (binder_debug_mask & mask) \ 132 pr_info(x); \ 133 } while (0) 134 135#define binder_user_error(x...) \ 136 do { \ 137 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \ 138 pr_info(x); \ 139 if (binder_stop_on_user_error) \ 140 binder_stop_on_user_error = 2; \ 141 } while (0) 142 143enum binder_stat_types { 144 BINDER_STAT_PROC, 145 BINDER_STAT_THREAD, 146 BINDER_STAT_NODE, 147 BINDER_STAT_REF, 148 BINDER_STAT_DEATH, 149 BINDER_STAT_TRANSACTION, 150 BINDER_STAT_TRANSACTION_COMPLETE, 151 BINDER_STAT_COUNT 152}; 153 154struct binder_stats { 155 int br[_IOC_NR(BR_FAILED_REPLY) + 1]; 156 int bc[_IOC_NR(BC_DEAD_BINDER_DONE) + 1]; 157 int obj_created[BINDER_STAT_COUNT]; 158 int obj_deleted[BINDER_STAT_COUNT]; 159}; 160 161static struct binder_stats binder_stats; 162 163static inline void binder_stats_deleted(enum binder_stat_types type) 164{ 165 binder_stats.obj_deleted[type]++; 166} 167 168static inline void binder_stats_created(enum binder_stat_types type) 169{ 170 binder_stats.obj_created[type]++; 171} 172 173struct binder_transaction_log_entry { 174 int debug_id; 175 int call_type; 176 int from_proc; 177 int from_thread; 178 int target_handle; 179 int to_proc; 180 int to_thread; 181 int to_node; 182 int data_size; 183 int offsets_size; 184}; 185struct binder_transaction_log { 186 int next; 187 int full; 188 struct binder_transaction_log_entry entry[32]; 189}; 190static struct binder_transaction_log binder_transaction_log; 191static struct binder_transaction_log binder_transaction_log_failed; 192 193static struct binder_transaction_log_entry *binder_transaction_log_add( 194 struct binder_transaction_log *log) 195{ 196 struct binder_transaction_log_entry *e; 197 e = &log->entry[log->next]; 198 memset(e, 0, sizeof(*e)); 199 log->next++; 200 if (log->next == ARRAY_SIZE(log->entry)) { 201 log->next = 0; 202 log->full = 1; 203 } 204 return e; 205} 206 207struct binder_work { 208 struct list_head entry; 209 enum { 210 BINDER_WORK_TRANSACTION = 1, 211 BINDER_WORK_TRANSACTION_COMPLETE, 212 BINDER_WORK_NODE, 213 BINDER_WORK_DEAD_BINDER, 214 BINDER_WORK_DEAD_BINDER_AND_CLEAR, 215 BINDER_WORK_CLEAR_DEATH_NOTIFICATION, 216 } type; 217}; 218 219struct binder_node { 220 int debug_id; 221 struct binder_work work; 222 union { 223 struct rb_node rb_node; 224 struct hlist_node dead_node; 225 }; 226 struct binder_proc *proc; 227 struct hlist_head refs; 228 int internal_strong_refs; 229 int local_weak_refs; 230 int local_strong_refs; 231 void __user *ptr; 232 void __user *cookie; 233 unsigned has_strong_ref:1; 234 unsigned pending_strong_ref:1; 235 unsigned has_weak_ref:1; 236 unsigned pending_weak_ref:1; 237 unsigned has_async_transaction:1; 238 unsigned accept_fds:1; 239 unsigned min_priority:8; 240 struct list_head async_todo; 241}; 242 243struct binder_ref_death { 244 struct binder_work work; 245 void __user *cookie; 246}; 247 248struct binder_ref { 249 /* Lookups needed: */ 250 /* node + proc => ref (transaction) */ 251 /* desc + proc => ref (transaction, inc/dec ref) */ 252 /* node => refs + procs (proc exit) */ 253 int debug_id; 254 struct rb_node rb_node_desc; 255 struct rb_node rb_node_node; 256 struct hlist_node node_entry; 257 struct binder_proc *proc; 258 struct binder_node *node; 259 uint32_t desc; 260 int strong; 261 int weak; 262 struct binder_ref_death *death; 263}; 264 265struct binder_buffer { 266 struct list_head entry; /* free and allocated entries by address */ 267 struct rb_node rb_node; /* free entry by size or allocated entry */ 268 /* by address */ 269 unsigned free:1; 270 unsigned allow_user_free:1; 271 unsigned async_transaction:1; 272 unsigned debug_id:29; 273 274 struct binder_transaction *transaction; 275 276 struct binder_node *target_node; 277 size_t data_size; 278 size_t offsets_size; 279 uint8_t data[0]; 280}; 281 282enum binder_deferred_state { 283 BINDER_DEFERRED_PUT_FILES = 0x01, 284 BINDER_DEFERRED_FLUSH = 0x02, 285 BINDER_DEFERRED_RELEASE = 0x04, 286}; 287 288struct binder_proc { 289 struct hlist_node proc_node; 290 struct rb_root threads; 291 struct rb_root nodes; 292 struct rb_root refs_by_desc; 293 struct rb_root refs_by_node; 294 int pid; 295 struct vm_area_struct *vma; 296 struct mm_struct *vma_vm_mm; 297 struct task_struct *tsk; 298 struct files_struct *files; 299 struct hlist_node deferred_work_node; 300 int deferred_work; 301 void *buffer; 302 ptrdiff_t user_buffer_offset; 303 304 struct list_head buffers; 305 struct rb_root free_buffers; 306 struct rb_root allocated_buffers; 307 size_t free_async_space; 308 309 struct page **pages; 310 size_t buffer_size; 311 uint32_t buffer_free; 312 struct list_head todo; 313 wait_queue_head_t wait; 314 struct binder_stats stats; 315 struct list_head delivered_death; 316 int max_threads; 317 int requested_threads; 318 int requested_threads_started; 319 int ready_threads; 320 long default_priority; 321 struct dentry *debugfs_entry; 322}; 323 324enum { 325 BINDER_LOOPER_STATE_REGISTERED = 0x01, 326 BINDER_LOOPER_STATE_ENTERED = 0x02, 327 BINDER_LOOPER_STATE_EXITED = 0x04, 328 BINDER_LOOPER_STATE_INVALID = 0x08, 329 BINDER_LOOPER_STATE_WAITING = 0x10, 330 BINDER_LOOPER_STATE_NEED_RETURN = 0x20 331}; 332 333struct binder_thread { 334 struct binder_proc *proc; 335 struct rb_node rb_node; 336 int pid; 337 int looper; 338 struct binder_transaction *transaction_stack; 339 struct list_head todo; 340 uint32_t return_error; /* Write failed, return error code in read buf */ 341 uint32_t return_error2; /* Write failed, return error code in read */ 342 /* buffer. Used when sending a reply to a dead process that */ 343 /* we are also waiting on */ 344 wait_queue_head_t wait; 345 struct binder_stats stats; 346}; 347 348struct binder_transaction { 349 int debug_id; 350 struct binder_work work; 351 struct binder_thread *from; 352 struct binder_transaction *from_parent; 353 struct binder_proc *to_proc; 354 struct binder_thread *to_thread; 355 struct binder_transaction *to_parent; 356 unsigned need_reply:1; 357 /* unsigned is_dead:1; */ /* not used at the moment */ 358 359 struct binder_buffer *buffer; 360 unsigned int code; 361 unsigned int flags; 362 long priority; 363 long saved_priority; 364 kuid_t sender_euid; 365}; 366 367static void 368binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer); 369 370static int task_get_unused_fd_flags(struct binder_proc *proc, int flags) 371{ 372 struct files_struct *files = proc->files; 373 unsigned long rlim_cur; 374 unsigned long irqs; 375 376 if (files == NULL) 377 return -ESRCH; 378 379 if (!lock_task_sighand(proc->tsk, &irqs)) 380 return -EMFILE; 381 382 rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE); 383 unlock_task_sighand(proc->tsk, &irqs); 384 385 return __alloc_fd(files, 0, rlim_cur, flags); 386} 387 388/* 389 * copied from fd_install 390 */ 391static void task_fd_install( 392 struct binder_proc *proc, unsigned int fd, struct file *file) 393{ 394 if (proc->files) 395 __fd_install(proc->files, fd, file); 396} 397 398/* 399 * copied from sys_close 400 */ 401static long task_close_fd(struct binder_proc *proc, unsigned int fd) 402{ 403 int retval; 404 405 if (proc->files == NULL) 406 return -ESRCH; 407 408 retval = __close_fd(proc->files, fd); 409 /* can't restart close syscall because file table entry was cleared */ 410 if (unlikely(retval == -ERESTARTSYS || 411 retval == -ERESTARTNOINTR || 412 retval == -ERESTARTNOHAND || 413 retval == -ERESTART_RESTARTBLOCK)) 414 retval = -EINTR; 415 416 return retval; 417} 418 419static inline void binder_lock(const char *tag) 420{ 421 trace_binder_lock(tag); 422 mutex_lock(&binder_main_lock); 423 trace_binder_locked(tag); 424} 425 426static inline void binder_unlock(const char *tag) 427{ 428 trace_binder_unlock(tag); 429 mutex_unlock(&binder_main_lock); 430} 431 432static void binder_set_nice(long nice) 433{ 434 long min_nice; 435 if (can_nice(current, nice)) { 436 set_user_nice(current, nice); 437 return; 438 } 439 min_nice = 20 - current->signal->rlim[RLIMIT_NICE].rlim_cur; 440 binder_debug(BINDER_DEBUG_PRIORITY_CAP, 441 "%d: nice value %ld not allowed use %ld instead\n", 442 current->pid, nice, min_nice); 443 set_user_nice(current, min_nice); 444 if (min_nice < 20) 445 return; 446 binder_user_error("%d RLIMIT_NICE not set\n", current->pid); 447} 448 449static size_t binder_buffer_size(struct binder_proc *proc, 450 struct binder_buffer *buffer) 451{ 452 if (list_is_last(&buffer->entry, &proc->buffers)) 453 return proc->buffer + proc->buffer_size - (void *)buffer->data; 454 else 455 return (size_t)list_entry(buffer->entry.next, 456 struct binder_buffer, entry) - (size_t)buffer->data; 457} 458 459static void binder_insert_free_buffer(struct binder_proc *proc, 460 struct binder_buffer *new_buffer) 461{ 462 struct rb_node **p = &proc->free_buffers.rb_node; 463 struct rb_node *parent = NULL; 464 struct binder_buffer *buffer; 465 size_t buffer_size; 466 size_t new_buffer_size; 467 468 BUG_ON(!new_buffer->free); 469 470 new_buffer_size = binder_buffer_size(proc, new_buffer); 471 472 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 473 "%d: add free buffer, size %zd, at %p\n", 474 proc->pid, new_buffer_size, new_buffer); 475 476 while (*p) { 477 parent = *p; 478 buffer = rb_entry(parent, struct binder_buffer, rb_node); 479 BUG_ON(!buffer->free); 480 481 buffer_size = binder_buffer_size(proc, buffer); 482 483 if (new_buffer_size < buffer_size) 484 p = &parent->rb_left; 485 else 486 p = &parent->rb_right; 487 } 488 rb_link_node(&new_buffer->rb_node, parent, p); 489 rb_insert_color(&new_buffer->rb_node, &proc->free_buffers); 490} 491 492static void binder_insert_allocated_buffer(struct binder_proc *proc, 493 struct binder_buffer *new_buffer) 494{ 495 struct rb_node **p = &proc->allocated_buffers.rb_node; 496 struct rb_node *parent = NULL; 497 struct binder_buffer *buffer; 498 499 BUG_ON(new_buffer->free); 500 501 while (*p) { 502 parent = *p; 503 buffer = rb_entry(parent, struct binder_buffer, rb_node); 504 BUG_ON(buffer->free); 505 506 if (new_buffer < buffer) 507 p = &parent->rb_left; 508 else if (new_buffer > buffer) 509 p = &parent->rb_right; 510 else 511 BUG(); 512 } 513 rb_link_node(&new_buffer->rb_node, parent, p); 514 rb_insert_color(&new_buffer->rb_node, &proc->allocated_buffers); 515} 516 517static struct binder_buffer *binder_buffer_lookup(struct binder_proc *proc, 518 void __user *user_ptr) 519{ 520 struct rb_node *n = proc->allocated_buffers.rb_node; 521 struct binder_buffer *buffer; 522 struct binder_buffer *kern_ptr; 523 524 kern_ptr = user_ptr - proc->user_buffer_offset 525 - offsetof(struct binder_buffer, data); 526 527 while (n) { 528 buffer = rb_entry(n, struct binder_buffer, rb_node); 529 BUG_ON(buffer->free); 530 531 if (kern_ptr < buffer) 532 n = n->rb_left; 533 else if (kern_ptr > buffer) 534 n = n->rb_right; 535 else 536 return buffer; 537 } 538 return NULL; 539} 540 541static int binder_update_page_range(struct binder_proc *proc, int allocate, 542 void *start, void *end, 543 struct vm_area_struct *vma) 544{ 545 void *page_addr; 546 unsigned long user_page_addr; 547 struct vm_struct tmp_area; 548 struct page **page; 549 struct mm_struct *mm; 550 551 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 552 "%d: %s pages %p-%p\n", proc->pid, 553 allocate ? "allocate" : "free", start, end); 554 555 if (end <= start) 556 return 0; 557 558 trace_binder_update_page_range(proc, allocate, start, end); 559 560 if (vma) 561 mm = NULL; 562 else 563 mm = get_task_mm(proc->tsk); 564 565 if (mm) { 566 down_write(&mm->mmap_sem); 567 vma = proc->vma; 568 if (vma && mm != proc->vma_vm_mm) { 569 pr_err("%d: vma mm and task mm mismatch\n", 570 proc->pid); 571 vma = NULL; 572 } 573 } 574 575 if (allocate == 0) 576 goto free_range; 577 578 if (vma == NULL) { 579 pr_err("%d: binder_alloc_buf failed to map pages in userspace, no vma\n", 580 proc->pid); 581 goto err_no_vma; 582 } 583 584 for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) { 585 int ret; 586 struct page **page_array_ptr; 587 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 588 589 BUG_ON(*page); 590 *page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO); 591 if (*page == NULL) { 592 pr_err("%d: binder_alloc_buf failed for page at %p\n", 593 proc->pid, page_addr); 594 goto err_alloc_page_failed; 595 } 596 tmp_area.addr = page_addr; 597 tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */; 598 page_array_ptr = page; 599 ret = map_vm_area(&tmp_area, PAGE_KERNEL, &page_array_ptr); 600 if (ret) { 601 pr_err("%d: binder_alloc_buf failed to map page at %p in kernel\n", 602 proc->pid, page_addr); 603 goto err_map_kernel_failed; 604 } 605 user_page_addr = 606 (uintptr_t)page_addr + proc->user_buffer_offset; 607 ret = vm_insert_page(vma, user_page_addr, page[0]); 608 if (ret) { 609 pr_err("%d: binder_alloc_buf failed to map page at %lx in userspace\n", 610 proc->pid, user_page_addr); 611 goto err_vm_insert_page_failed; 612 } 613 /* vm_insert_page does not seem to increment the refcount */ 614 } 615 if (mm) { 616 up_write(&mm->mmap_sem); 617 mmput(mm); 618 } 619 return 0; 620 621free_range: 622 for (page_addr = end - PAGE_SIZE; page_addr >= start; 623 page_addr -= PAGE_SIZE) { 624 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 625 if (vma) 626 zap_page_range(vma, (uintptr_t)page_addr + 627 proc->user_buffer_offset, PAGE_SIZE, NULL); 628err_vm_insert_page_failed: 629 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE); 630err_map_kernel_failed: 631 __free_page(*page); 632 *page = NULL; 633err_alloc_page_failed: 634 ; 635 } 636err_no_vma: 637 if (mm) { 638 up_write(&mm->mmap_sem); 639 mmput(mm); 640 } 641 return -ENOMEM; 642} 643 644static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc, 645 size_t data_size, 646 size_t offsets_size, int is_async) 647{ 648 struct rb_node *n = proc->free_buffers.rb_node; 649 struct binder_buffer *buffer; 650 size_t buffer_size; 651 struct rb_node *best_fit = NULL; 652 void *has_page_addr; 653 void *end_page_addr; 654 size_t size; 655 656 if (proc->vma == NULL) { 657 pr_err("%d: binder_alloc_buf, no vma\n", 658 proc->pid); 659 return NULL; 660 } 661 662 size = ALIGN(data_size, sizeof(void *)) + 663 ALIGN(offsets_size, sizeof(void *)); 664 665 if (size < data_size || size < offsets_size) { 666 binder_user_error("%d: got transaction with invalid size %zd-%zd\n", 667 proc->pid, data_size, offsets_size); 668 return NULL; 669 } 670 671 if (is_async && 672 proc->free_async_space < size + sizeof(struct binder_buffer)) { 673 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 674 "%d: binder_alloc_buf size %zd failed, no async space left\n", 675 proc->pid, size); 676 return NULL; 677 } 678 679 while (n) { 680 buffer = rb_entry(n, struct binder_buffer, rb_node); 681 BUG_ON(!buffer->free); 682 buffer_size = binder_buffer_size(proc, buffer); 683 684 if (size < buffer_size) { 685 best_fit = n; 686 n = n->rb_left; 687 } else if (size > buffer_size) 688 n = n->rb_right; 689 else { 690 best_fit = n; 691 break; 692 } 693 } 694 if (best_fit == NULL) { 695 pr_err("%d: binder_alloc_buf size %zd failed, no address space\n", 696 proc->pid, size); 697 return NULL; 698 } 699 if (n == NULL) { 700 buffer = rb_entry(best_fit, struct binder_buffer, rb_node); 701 buffer_size = binder_buffer_size(proc, buffer); 702 } 703 704 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 705 "%d: binder_alloc_buf size %zd got buffer %p size %zd\n", 706 proc->pid, size, buffer, buffer_size); 707 708 has_page_addr = 709 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK); 710 if (n == NULL) { 711 if (size + sizeof(struct binder_buffer) + 4 >= buffer_size) 712 buffer_size = size; /* no room for other buffers */ 713 else 714 buffer_size = size + sizeof(struct binder_buffer); 715 } 716 end_page_addr = 717 (void *)PAGE_ALIGN((uintptr_t)buffer->data + buffer_size); 718 if (end_page_addr > has_page_addr) 719 end_page_addr = has_page_addr; 720 if (binder_update_page_range(proc, 1, 721 (void *)PAGE_ALIGN((uintptr_t)buffer->data), end_page_addr, NULL)) 722 return NULL; 723 724 rb_erase(best_fit, &proc->free_buffers); 725 buffer->free = 0; 726 binder_insert_allocated_buffer(proc, buffer); 727 if (buffer_size != size) { 728 struct binder_buffer *new_buffer = (void *)buffer->data + size; 729 list_add(&new_buffer->entry, &buffer->entry); 730 new_buffer->free = 1; 731 binder_insert_free_buffer(proc, new_buffer); 732 } 733 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 734 "%d: binder_alloc_buf size %zd got %p\n", 735 proc->pid, size, buffer); 736 buffer->data_size = data_size; 737 buffer->offsets_size = offsets_size; 738 buffer->async_transaction = is_async; 739 if (is_async) { 740 proc->free_async_space -= size + sizeof(struct binder_buffer); 741 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 742 "%d: binder_alloc_buf size %zd async free %zd\n", 743 proc->pid, size, proc->free_async_space); 744 } 745 746 return buffer; 747} 748 749static void *buffer_start_page(struct binder_buffer *buffer) 750{ 751 return (void *)((uintptr_t)buffer & PAGE_MASK); 752} 753 754static void *buffer_end_page(struct binder_buffer *buffer) 755{ 756 return (void *)(((uintptr_t)(buffer + 1) - 1) & PAGE_MASK); 757} 758 759static void binder_delete_free_buffer(struct binder_proc *proc, 760 struct binder_buffer *buffer) 761{ 762 struct binder_buffer *prev, *next = NULL; 763 int free_page_end = 1; 764 int free_page_start = 1; 765 766 BUG_ON(proc->buffers.next == &buffer->entry); 767 prev = list_entry(buffer->entry.prev, struct binder_buffer, entry); 768 BUG_ON(!prev->free); 769 if (buffer_end_page(prev) == buffer_start_page(buffer)) { 770 free_page_start = 0; 771 if (buffer_end_page(prev) == buffer_end_page(buffer)) 772 free_page_end = 0; 773 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 774 "%d: merge free, buffer %p share page with %p\n", 775 proc->pid, buffer, prev); 776 } 777 778 if (!list_is_last(&buffer->entry, &proc->buffers)) { 779 next = list_entry(buffer->entry.next, 780 struct binder_buffer, entry); 781 if (buffer_start_page(next) == buffer_end_page(buffer)) { 782 free_page_end = 0; 783 if (buffer_start_page(next) == 784 buffer_start_page(buffer)) 785 free_page_start = 0; 786 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 787 "%d: merge free, buffer %p share page with %p\n", 788 proc->pid, buffer, prev); 789 } 790 } 791 list_del(&buffer->entry); 792 if (free_page_start || free_page_end) { 793 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 794 "%d: merge free, buffer %p do not share page%s%s with %p or %p\n", 795 proc->pid, buffer, free_page_start ? "" : " end", 796 free_page_end ? "" : " start", prev, next); 797 binder_update_page_range(proc, 0, free_page_start ? 798 buffer_start_page(buffer) : buffer_end_page(buffer), 799 (free_page_end ? buffer_end_page(buffer) : 800 buffer_start_page(buffer)) + PAGE_SIZE, NULL); 801 } 802} 803 804static void binder_free_buf(struct binder_proc *proc, 805 struct binder_buffer *buffer) 806{ 807 size_t size, buffer_size; 808 809 buffer_size = binder_buffer_size(proc, buffer); 810 811 size = ALIGN(buffer->data_size, sizeof(void *)) + 812 ALIGN(buffer->offsets_size, sizeof(void *)); 813 814 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 815 "%d: binder_free_buf %p size %zd buffer_size %zd\n", 816 proc->pid, buffer, size, buffer_size); 817 818 BUG_ON(buffer->free); 819 BUG_ON(size > buffer_size); 820 BUG_ON(buffer->transaction != NULL); 821 BUG_ON((void *)buffer < proc->buffer); 822 BUG_ON((void *)buffer > proc->buffer + proc->buffer_size); 823 824 if (buffer->async_transaction) { 825 proc->free_async_space += size + sizeof(struct binder_buffer); 826 827 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 828 "%d: binder_free_buf size %zd async free %zd\n", 829 proc->pid, size, proc->free_async_space); 830 } 831 832 binder_update_page_range(proc, 0, 833 (void *)PAGE_ALIGN((uintptr_t)buffer->data), 834 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK), 835 NULL); 836 rb_erase(&buffer->rb_node, &proc->allocated_buffers); 837 buffer->free = 1; 838 if (!list_is_last(&buffer->entry, &proc->buffers)) { 839 struct binder_buffer *next = list_entry(buffer->entry.next, 840 struct binder_buffer, entry); 841 if (next->free) { 842 rb_erase(&next->rb_node, &proc->free_buffers); 843 binder_delete_free_buffer(proc, next); 844 } 845 } 846 if (proc->buffers.next != &buffer->entry) { 847 struct binder_buffer *prev = list_entry(buffer->entry.prev, 848 struct binder_buffer, entry); 849 if (prev->free) { 850 binder_delete_free_buffer(proc, buffer); 851 rb_erase(&prev->rb_node, &proc->free_buffers); 852 buffer = prev; 853 } 854 } 855 binder_insert_free_buffer(proc, buffer); 856} 857 858static struct binder_node *binder_get_node(struct binder_proc *proc, 859 void __user *ptr) 860{ 861 struct rb_node *n = proc->nodes.rb_node; 862 struct binder_node *node; 863 864 while (n) { 865 node = rb_entry(n, struct binder_node, rb_node); 866 867 if (ptr < node->ptr) 868 n = n->rb_left; 869 else if (ptr > node->ptr) 870 n = n->rb_right; 871 else 872 return node; 873 } 874 return NULL; 875} 876 877static struct binder_node *binder_new_node(struct binder_proc *proc, 878 void __user *ptr, 879 void __user *cookie) 880{ 881 struct rb_node **p = &proc->nodes.rb_node; 882 struct rb_node *parent = NULL; 883 struct binder_node *node; 884 885 while (*p) { 886 parent = *p; 887 node = rb_entry(parent, struct binder_node, rb_node); 888 889 if (ptr < node->ptr) 890 p = &(*p)->rb_left; 891 else if (ptr > node->ptr) 892 p = &(*p)->rb_right; 893 else 894 return NULL; 895 } 896 897 node = kzalloc(sizeof(*node), GFP_KERNEL); 898 if (node == NULL) 899 return NULL; 900 binder_stats_created(BINDER_STAT_NODE); 901 rb_link_node(&node->rb_node, parent, p); 902 rb_insert_color(&node->rb_node, &proc->nodes); 903 node->debug_id = ++binder_last_id; 904 node->proc = proc; 905 node->ptr = ptr; 906 node->cookie = cookie; 907 node->work.type = BINDER_WORK_NODE; 908 INIT_LIST_HEAD(&node->work.entry); 909 INIT_LIST_HEAD(&node->async_todo); 910 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 911 "%d:%d node %d u%p c%p created\n", 912 proc->pid, current->pid, node->debug_id, 913 node->ptr, node->cookie); 914 return node; 915} 916 917static int binder_inc_node(struct binder_node *node, int strong, int internal, 918 struct list_head *target_list) 919{ 920 if (strong) { 921 if (internal) { 922 if (target_list == NULL && 923 node->internal_strong_refs == 0 && 924 !(node == binder_context_mgr_node && 925 node->has_strong_ref)) { 926 pr_err("invalid inc strong node for %d\n", 927 node->debug_id); 928 return -EINVAL; 929 } 930 node->internal_strong_refs++; 931 } else 932 node->local_strong_refs++; 933 if (!node->has_strong_ref && target_list) { 934 list_del_init(&node->work.entry); 935 list_add_tail(&node->work.entry, target_list); 936 } 937 } else { 938 if (!internal) 939 node->local_weak_refs++; 940 if (!node->has_weak_ref && list_empty(&node->work.entry)) { 941 if (target_list == NULL) { 942 pr_err("invalid inc weak node for %d\n", 943 node->debug_id); 944 return -EINVAL; 945 } 946 list_add_tail(&node->work.entry, target_list); 947 } 948 } 949 return 0; 950} 951 952static int binder_dec_node(struct binder_node *node, int strong, int internal) 953{ 954 if (strong) { 955 if (internal) 956 node->internal_strong_refs--; 957 else 958 node->local_strong_refs--; 959 if (node->local_strong_refs || node->internal_strong_refs) 960 return 0; 961 } else { 962 if (!internal) 963 node->local_weak_refs--; 964 if (node->local_weak_refs || !hlist_empty(&node->refs)) 965 return 0; 966 } 967 if (node->proc && (node->has_strong_ref || node->has_weak_ref)) { 968 if (list_empty(&node->work.entry)) { 969 list_add_tail(&node->work.entry, &node->proc->todo); 970 wake_up_interruptible(&node->proc->wait); 971 } 972 } else { 973 if (hlist_empty(&node->refs) && !node->local_strong_refs && 974 !node->local_weak_refs) { 975 list_del_init(&node->work.entry); 976 if (node->proc) { 977 rb_erase(&node->rb_node, &node->proc->nodes); 978 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 979 "refless node %d deleted\n", 980 node->debug_id); 981 } else { 982 hlist_del(&node->dead_node); 983 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 984 "dead node %d deleted\n", 985 node->debug_id); 986 } 987 kfree(node); 988 binder_stats_deleted(BINDER_STAT_NODE); 989 } 990 } 991 992 return 0; 993} 994 995 996static struct binder_ref *binder_get_ref(struct binder_proc *proc, 997 uint32_t desc) 998{ 999 struct rb_node *n = proc->refs_by_desc.rb_node; 1000 struct binder_ref *ref; 1001 1002 while (n) { 1003 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1004 1005 if (desc < ref->desc) 1006 n = n->rb_left; 1007 else if (desc > ref->desc) 1008 n = n->rb_right; 1009 else 1010 return ref; 1011 } 1012 return NULL; 1013} 1014 1015static struct binder_ref *binder_get_ref_for_node(struct binder_proc *proc, 1016 struct binder_node *node) 1017{ 1018 struct rb_node *n; 1019 struct rb_node **p = &proc->refs_by_node.rb_node; 1020 struct rb_node *parent = NULL; 1021 struct binder_ref *ref, *new_ref; 1022 1023 while (*p) { 1024 parent = *p; 1025 ref = rb_entry(parent, struct binder_ref, rb_node_node); 1026 1027 if (node < ref->node) 1028 p = &(*p)->rb_left; 1029 else if (node > ref->node) 1030 p = &(*p)->rb_right; 1031 else 1032 return ref; 1033 } 1034 new_ref = kzalloc(sizeof(*ref), GFP_KERNEL); 1035 if (new_ref == NULL) 1036 return NULL; 1037 binder_stats_created(BINDER_STAT_REF); 1038 new_ref->debug_id = ++binder_last_id; 1039 new_ref->proc = proc; 1040 new_ref->node = node; 1041 rb_link_node(&new_ref->rb_node_node, parent, p); 1042 rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node); 1043 1044 new_ref->desc = (node == binder_context_mgr_node) ? 0 : 1; 1045 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 1046 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1047 if (ref->desc > new_ref->desc) 1048 break; 1049 new_ref->desc = ref->desc + 1; 1050 } 1051 1052 p = &proc->refs_by_desc.rb_node; 1053 while (*p) { 1054 parent = *p; 1055 ref = rb_entry(parent, struct binder_ref, rb_node_desc); 1056 1057 if (new_ref->desc < ref->desc) 1058 p = &(*p)->rb_left; 1059 else if (new_ref->desc > ref->desc) 1060 p = &(*p)->rb_right; 1061 else 1062 BUG(); 1063 } 1064 rb_link_node(&new_ref->rb_node_desc, parent, p); 1065 rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc); 1066 if (node) { 1067 hlist_add_head(&new_ref->node_entry, &node->refs); 1068 1069 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1070 "%d new ref %d desc %d for node %d\n", 1071 proc->pid, new_ref->debug_id, new_ref->desc, 1072 node->debug_id); 1073 } else { 1074 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1075 "%d new ref %d desc %d for dead node\n", 1076 proc->pid, new_ref->debug_id, new_ref->desc); 1077 } 1078 return new_ref; 1079} 1080 1081static void binder_delete_ref(struct binder_ref *ref) 1082{ 1083 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1084 "%d delete ref %d desc %d for node %d\n", 1085 ref->proc->pid, ref->debug_id, ref->desc, 1086 ref->node->debug_id); 1087 1088 rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc); 1089 rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node); 1090 if (ref->strong) 1091 binder_dec_node(ref->node, 1, 1); 1092 hlist_del(&ref->node_entry); 1093 binder_dec_node(ref->node, 0, 1); 1094 if (ref->death) { 1095 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1096 "%d delete ref %d desc %d has death notification\n", 1097 ref->proc->pid, ref->debug_id, ref->desc); 1098 list_del(&ref->death->work.entry); 1099 kfree(ref->death); 1100 binder_stats_deleted(BINDER_STAT_DEATH); 1101 } 1102 kfree(ref); 1103 binder_stats_deleted(BINDER_STAT_REF); 1104} 1105 1106static int binder_inc_ref(struct binder_ref *ref, int strong, 1107 struct list_head *target_list) 1108{ 1109 int ret; 1110 if (strong) { 1111 if (ref->strong == 0) { 1112 ret = binder_inc_node(ref->node, 1, 1, target_list); 1113 if (ret) 1114 return ret; 1115 } 1116 ref->strong++; 1117 } else { 1118 if (ref->weak == 0) { 1119 ret = binder_inc_node(ref->node, 0, 1, target_list); 1120 if (ret) 1121 return ret; 1122 } 1123 ref->weak++; 1124 } 1125 return 0; 1126} 1127 1128 1129static int binder_dec_ref(struct binder_ref *ref, int strong) 1130{ 1131 if (strong) { 1132 if (ref->strong == 0) { 1133 binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n", 1134 ref->proc->pid, ref->debug_id, 1135 ref->desc, ref->strong, ref->weak); 1136 return -EINVAL; 1137 } 1138 ref->strong--; 1139 if (ref->strong == 0) { 1140 int ret; 1141 ret = binder_dec_node(ref->node, strong, 1); 1142 if (ret) 1143 return ret; 1144 } 1145 } else { 1146 if (ref->weak == 0) { 1147 binder_user_error("%d invalid dec weak, ref %d desc %d s %d w %d\n", 1148 ref->proc->pid, ref->debug_id, 1149 ref->desc, ref->strong, ref->weak); 1150 return -EINVAL; 1151 } 1152 ref->weak--; 1153 } 1154 if (ref->strong == 0 && ref->weak == 0) 1155 binder_delete_ref(ref); 1156 return 0; 1157} 1158 1159static void binder_pop_transaction(struct binder_thread *target_thread, 1160 struct binder_transaction *t) 1161{ 1162 if (target_thread) { 1163 BUG_ON(target_thread->transaction_stack != t); 1164 BUG_ON(target_thread->transaction_stack->from != target_thread); 1165 target_thread->transaction_stack = 1166 target_thread->transaction_stack->from_parent; 1167 t->from = NULL; 1168 } 1169 t->need_reply = 0; 1170 if (t->buffer) 1171 t->buffer->transaction = NULL; 1172 kfree(t); 1173 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1174} 1175 1176static void binder_send_failed_reply(struct binder_transaction *t, 1177 uint32_t error_code) 1178{ 1179 struct binder_thread *target_thread; 1180 BUG_ON(t->flags & TF_ONE_WAY); 1181 while (1) { 1182 target_thread = t->from; 1183 if (target_thread) { 1184 if (target_thread->return_error != BR_OK && 1185 target_thread->return_error2 == BR_OK) { 1186 target_thread->return_error2 = 1187 target_thread->return_error; 1188 target_thread->return_error = BR_OK; 1189 } 1190 if (target_thread->return_error == BR_OK) { 1191 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1192 "send failed reply for transaction %d to %d:%d\n", 1193 t->debug_id, target_thread->proc->pid, 1194 target_thread->pid); 1195 1196 binder_pop_transaction(target_thread, t); 1197 target_thread->return_error = error_code; 1198 wake_up_interruptible(&target_thread->wait); 1199 } else { 1200 pr_err("reply failed, target thread, %d:%d, has error code %d already\n", 1201 target_thread->proc->pid, 1202 target_thread->pid, 1203 target_thread->return_error); 1204 } 1205 return; 1206 } else { 1207 struct binder_transaction *next = t->from_parent; 1208 1209 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1210 "send failed reply for transaction %d, target dead\n", 1211 t->debug_id); 1212 1213 binder_pop_transaction(target_thread, t); 1214 if (next == NULL) { 1215 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1216 "reply failed, no target thread at root\n"); 1217 return; 1218 } 1219 t = next; 1220 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1221 "reply failed, no target thread -- retry %d\n", 1222 t->debug_id); 1223 } 1224 } 1225} 1226 1227static void binder_transaction_buffer_release(struct binder_proc *proc, 1228 struct binder_buffer *buffer, 1229 size_t *failed_at) 1230{ 1231 size_t *offp, *off_end; 1232 int debug_id = buffer->debug_id; 1233 1234 binder_debug(BINDER_DEBUG_TRANSACTION, 1235 "%d buffer release %d, size %zd-%zd, failed at %p\n", 1236 proc->pid, buffer->debug_id, 1237 buffer->data_size, buffer->offsets_size, failed_at); 1238 1239 if (buffer->target_node) 1240 binder_dec_node(buffer->target_node, 1, 0); 1241 1242 offp = (size_t *)(buffer->data + ALIGN(buffer->data_size, sizeof(void *))); 1243 if (failed_at) 1244 off_end = failed_at; 1245 else 1246 off_end = (void *)offp + buffer->offsets_size; 1247 for (; offp < off_end; offp++) { 1248 struct flat_binder_object *fp; 1249 if (*offp > buffer->data_size - sizeof(*fp) || 1250 buffer->data_size < sizeof(*fp) || 1251 !IS_ALIGNED(*offp, sizeof(u32))) { 1252 pr_err("transaction release %d bad offset %zd, size %zd\n", 1253 debug_id, *offp, buffer->data_size); 1254 continue; 1255 } 1256 fp = (struct flat_binder_object *)(buffer->data + *offp); 1257 switch (fp->type) { 1258 case BINDER_TYPE_BINDER: 1259 case BINDER_TYPE_WEAK_BINDER: { 1260 struct binder_node *node = binder_get_node(proc, fp->binder); 1261 if (node == NULL) { 1262 pr_err("transaction release %d bad node %p\n", 1263 debug_id, fp->binder); 1264 break; 1265 } 1266 binder_debug(BINDER_DEBUG_TRANSACTION, 1267 " node %d u%p\n", 1268 node->debug_id, node->ptr); 1269 binder_dec_node(node, fp->type == BINDER_TYPE_BINDER, 0); 1270 } break; 1271 case BINDER_TYPE_HANDLE: 1272 case BINDER_TYPE_WEAK_HANDLE: { 1273 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1274 if (ref == NULL) { 1275 pr_err("transaction release %d bad handle %d\n", 1276 debug_id, fp->handle); 1277 break; 1278 } 1279 binder_debug(BINDER_DEBUG_TRANSACTION, 1280 " ref %d desc %d (node %d)\n", 1281 ref->debug_id, ref->desc, ref->node->debug_id); 1282 binder_dec_ref(ref, fp->type == BINDER_TYPE_HANDLE); 1283 } break; 1284 1285 case BINDER_TYPE_FD: 1286 binder_debug(BINDER_DEBUG_TRANSACTION, 1287 " fd %d\n", fp->handle); 1288 if (failed_at) 1289 task_close_fd(proc, fp->handle); 1290 break; 1291 1292 default: 1293 pr_err("transaction release %d bad object type %x\n", 1294 debug_id, fp->type); 1295 break; 1296 } 1297 } 1298} 1299 1300static void binder_transaction(struct binder_proc *proc, 1301 struct binder_thread *thread, 1302 struct binder_transaction_data *tr, int reply) 1303{ 1304 struct binder_transaction *t; 1305 struct binder_work *tcomplete; 1306 size_t *offp, *off_end; 1307 struct binder_proc *target_proc; 1308 struct binder_thread *target_thread = NULL; 1309 struct binder_node *target_node = NULL; 1310 struct list_head *target_list; 1311 wait_queue_head_t *target_wait; 1312 struct binder_transaction *in_reply_to = NULL; 1313 struct binder_transaction_log_entry *e; 1314 uint32_t return_error; 1315 1316 e = binder_transaction_log_add(&binder_transaction_log); 1317 e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY); 1318 e->from_proc = proc->pid; 1319 e->from_thread = thread->pid; 1320 e->target_handle = tr->target.handle; 1321 e->data_size = tr->data_size; 1322 e->offsets_size = tr->offsets_size; 1323 1324 if (reply) { 1325 in_reply_to = thread->transaction_stack; 1326 if (in_reply_to == NULL) { 1327 binder_user_error("%d:%d got reply transaction with no transaction stack\n", 1328 proc->pid, thread->pid); 1329 return_error = BR_FAILED_REPLY; 1330 goto err_empty_call_stack; 1331 } 1332 binder_set_nice(in_reply_to->saved_priority); 1333 if (in_reply_to->to_thread != thread) { 1334 binder_user_error("%d:%d got reply transaction with bad transaction stack, transaction %d has target %d:%d\n", 1335 proc->pid, thread->pid, in_reply_to->debug_id, 1336 in_reply_to->to_proc ? 1337 in_reply_to->to_proc->pid : 0, 1338 in_reply_to->to_thread ? 1339 in_reply_to->to_thread->pid : 0); 1340 return_error = BR_FAILED_REPLY; 1341 in_reply_to = NULL; 1342 goto err_bad_call_stack; 1343 } 1344 thread->transaction_stack = in_reply_to->to_parent; 1345 target_thread = in_reply_to->from; 1346 if (target_thread == NULL) { 1347 return_error = BR_DEAD_REPLY; 1348 goto err_dead_binder; 1349 } 1350 if (target_thread->transaction_stack != in_reply_to) { 1351 binder_user_error("%d:%d got reply transaction with bad target transaction stack %d, expected %d\n", 1352 proc->pid, thread->pid, 1353 target_thread->transaction_stack ? 1354 target_thread->transaction_stack->debug_id : 0, 1355 in_reply_to->debug_id); 1356 return_error = BR_FAILED_REPLY; 1357 in_reply_to = NULL; 1358 target_thread = NULL; 1359 goto err_dead_binder; 1360 } 1361 target_proc = target_thread->proc; 1362 } else { 1363 if (tr->target.handle) { 1364 struct binder_ref *ref; 1365 ref = binder_get_ref(proc, tr->target.handle); 1366 if (ref == NULL) { 1367 binder_user_error("%d:%d got transaction to invalid handle\n", 1368 proc->pid, thread->pid); 1369 return_error = BR_FAILED_REPLY; 1370 goto err_invalid_target_handle; 1371 } 1372 target_node = ref->node; 1373 } else { 1374 target_node = binder_context_mgr_node; 1375 if (target_node == NULL) { 1376 return_error = BR_DEAD_REPLY; 1377 goto err_no_context_mgr_node; 1378 } 1379 } 1380 e->to_node = target_node->debug_id; 1381 target_proc = target_node->proc; 1382 if (target_proc == NULL) { 1383 return_error = BR_DEAD_REPLY; 1384 goto err_dead_binder; 1385 } 1386 if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) { 1387 struct binder_transaction *tmp; 1388 tmp = thread->transaction_stack; 1389 if (tmp->to_thread != thread) { 1390 binder_user_error("%d:%d got new transaction with bad transaction stack, transaction %d has target %d:%d\n", 1391 proc->pid, thread->pid, tmp->debug_id, 1392 tmp->to_proc ? tmp->to_proc->pid : 0, 1393 tmp->to_thread ? 1394 tmp->to_thread->pid : 0); 1395 return_error = BR_FAILED_REPLY; 1396 goto err_bad_call_stack; 1397 } 1398 while (tmp) { 1399 if (tmp->from && tmp->from->proc == target_proc) 1400 target_thread = tmp->from; 1401 tmp = tmp->from_parent; 1402 } 1403 } 1404 } 1405 if (target_thread) { 1406 e->to_thread = target_thread->pid; 1407 target_list = &target_thread->todo; 1408 target_wait = &target_thread->wait; 1409 } else { 1410 target_list = &target_proc->todo; 1411 target_wait = &target_proc->wait; 1412 } 1413 e->to_proc = target_proc->pid; 1414 1415 /* TODO: reuse incoming transaction for reply */ 1416 t = kzalloc(sizeof(*t), GFP_KERNEL); 1417 if (t == NULL) { 1418 return_error = BR_FAILED_REPLY; 1419 goto err_alloc_t_failed; 1420 } 1421 binder_stats_created(BINDER_STAT_TRANSACTION); 1422 1423 tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL); 1424 if (tcomplete == NULL) { 1425 return_error = BR_FAILED_REPLY; 1426 goto err_alloc_tcomplete_failed; 1427 } 1428 binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE); 1429 1430 t->debug_id = ++binder_last_id; 1431 e->debug_id = t->debug_id; 1432 1433 if (reply) 1434 binder_debug(BINDER_DEBUG_TRANSACTION, 1435 "%d:%d BC_REPLY %d -> %d:%d, data %p-%p size %zd-%zd\n", 1436 proc->pid, thread->pid, t->debug_id, 1437 target_proc->pid, target_thread->pid, 1438 tr->data.ptr.buffer, tr->data.ptr.offsets, 1439 tr->data_size, tr->offsets_size); 1440 else 1441 binder_debug(BINDER_DEBUG_TRANSACTION, 1442 "%d:%d BC_TRANSACTION %d -> %d - node %d, data %p-%p size %zd-%zd\n", 1443 proc->pid, thread->pid, t->debug_id, 1444 target_proc->pid, target_node->debug_id, 1445 tr->data.ptr.buffer, tr->data.ptr.offsets, 1446 tr->data_size, tr->offsets_size); 1447 1448 if (!reply && !(tr->flags & TF_ONE_WAY)) 1449 t->from = thread; 1450 else 1451 t->from = NULL; 1452 t->sender_euid = proc->tsk->cred->euid; 1453 t->to_proc = target_proc; 1454 t->to_thread = target_thread; 1455 t->code = tr->code; 1456 t->flags = tr->flags; 1457 t->priority = task_nice(current); 1458 1459 trace_binder_transaction(reply, t, target_node); 1460 1461 t->buffer = binder_alloc_buf(target_proc, tr->data_size, 1462 tr->offsets_size, !reply && (t->flags & TF_ONE_WAY)); 1463 if (t->buffer == NULL) { 1464 return_error = BR_FAILED_REPLY; 1465 goto err_binder_alloc_buf_failed; 1466 } 1467 t->buffer->allow_user_free = 0; 1468 t->buffer->debug_id = t->debug_id; 1469 t->buffer->transaction = t; 1470 t->buffer->target_node = target_node; 1471 trace_binder_transaction_alloc_buf(t->buffer); 1472 if (target_node) 1473 binder_inc_node(target_node, 1, 0, NULL); 1474 1475 offp = (size_t *)(t->buffer->data + ALIGN(tr->data_size, sizeof(void *))); 1476 1477 if (copy_from_user(t->buffer->data, tr->data.ptr.buffer, tr->data_size)) { 1478 binder_user_error("%d:%d got transaction with invalid data ptr\n", 1479 proc->pid, thread->pid); 1480 return_error = BR_FAILED_REPLY; 1481 goto err_copy_data_failed; 1482 } 1483 if (copy_from_user(offp, tr->data.ptr.offsets, tr->offsets_size)) { 1484 binder_user_error("%d:%d got transaction with invalid offsets ptr\n", 1485 proc->pid, thread->pid); 1486 return_error = BR_FAILED_REPLY; 1487 goto err_copy_data_failed; 1488 } 1489 if (!IS_ALIGNED(tr->offsets_size, sizeof(size_t))) { 1490 binder_user_error("%d:%d got transaction with invalid offsets size, %zd\n", 1491 proc->pid, thread->pid, tr->offsets_size); 1492 return_error = BR_FAILED_REPLY; 1493 goto err_bad_offset; 1494 } 1495 off_end = (void *)offp + tr->offsets_size; 1496 for (; offp < off_end; offp++) { 1497 struct flat_binder_object *fp; 1498 if (*offp > t->buffer->data_size - sizeof(*fp) || 1499 t->buffer->data_size < sizeof(*fp) || 1500 !IS_ALIGNED(*offp, sizeof(u32))) { 1501 binder_user_error("%d:%d got transaction with invalid offset, %zd\n", 1502 proc->pid, thread->pid, *offp); 1503 return_error = BR_FAILED_REPLY; 1504 goto err_bad_offset; 1505 } 1506 fp = (struct flat_binder_object *)(t->buffer->data + *offp); 1507 switch (fp->type) { 1508 case BINDER_TYPE_BINDER: 1509 case BINDER_TYPE_WEAK_BINDER: { 1510 struct binder_ref *ref; 1511 struct binder_node *node = binder_get_node(proc, fp->binder); 1512 if (node == NULL) { 1513 node = binder_new_node(proc, fp->binder, fp->cookie); 1514 if (node == NULL) { 1515 return_error = BR_FAILED_REPLY; 1516 goto err_binder_new_node_failed; 1517 } 1518 node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK; 1519 node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS); 1520 } 1521 if (fp->cookie != node->cookie) { 1522 binder_user_error("%d:%d sending u%p node %d, cookie mismatch %p != %p\n", 1523 proc->pid, thread->pid, 1524 fp->binder, node->debug_id, 1525 fp->cookie, node->cookie); 1526 goto err_binder_get_ref_for_node_failed; 1527 } 1528 ref = binder_get_ref_for_node(target_proc, node); 1529 if (ref == NULL) { 1530 return_error = BR_FAILED_REPLY; 1531 goto err_binder_get_ref_for_node_failed; 1532 } 1533 if (fp->type == BINDER_TYPE_BINDER) 1534 fp->type = BINDER_TYPE_HANDLE; 1535 else 1536 fp->type = BINDER_TYPE_WEAK_HANDLE; 1537 fp->handle = ref->desc; 1538 binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE, 1539 &thread->todo); 1540 1541 trace_binder_transaction_node_to_ref(t, node, ref); 1542 binder_debug(BINDER_DEBUG_TRANSACTION, 1543 " node %d u%p -> ref %d desc %d\n", 1544 node->debug_id, node->ptr, ref->debug_id, 1545 ref->desc); 1546 } break; 1547 case BINDER_TYPE_HANDLE: 1548 case BINDER_TYPE_WEAK_HANDLE: { 1549 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1550 if (ref == NULL) { 1551 binder_user_error("%d:%d got transaction with invalid handle, %d\n", 1552 proc->pid, 1553 thread->pid, fp->handle); 1554 return_error = BR_FAILED_REPLY; 1555 goto err_binder_get_ref_failed; 1556 } 1557 if (ref->node->proc == target_proc) { 1558 if (fp->type == BINDER_TYPE_HANDLE) 1559 fp->type = BINDER_TYPE_BINDER; 1560 else 1561 fp->type = BINDER_TYPE_WEAK_BINDER; 1562 fp->binder = ref->node->ptr; 1563 fp->cookie = ref->node->cookie; 1564 binder_inc_node(ref->node, fp->type == BINDER_TYPE_BINDER, 0, NULL); 1565 trace_binder_transaction_ref_to_node(t, ref); 1566 binder_debug(BINDER_DEBUG_TRANSACTION, 1567 " ref %d desc %d -> node %d u%p\n", 1568 ref->debug_id, ref->desc, ref->node->debug_id, 1569 ref->node->ptr); 1570 } else { 1571 struct binder_ref *new_ref; 1572 new_ref = binder_get_ref_for_node(target_proc, ref->node); 1573 if (new_ref == NULL) { 1574 return_error = BR_FAILED_REPLY; 1575 goto err_binder_get_ref_for_node_failed; 1576 } 1577 fp->handle = new_ref->desc; 1578 binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL); 1579 trace_binder_transaction_ref_to_ref(t, ref, 1580 new_ref); 1581 binder_debug(BINDER_DEBUG_TRANSACTION, 1582 " ref %d desc %d -> ref %d desc %d (node %d)\n", 1583 ref->debug_id, ref->desc, new_ref->debug_id, 1584 new_ref->desc, ref->node->debug_id); 1585 } 1586 } break; 1587 1588 case BINDER_TYPE_FD: { 1589 int target_fd; 1590 struct file *file; 1591 1592 if (reply) { 1593 if (!(in_reply_to->flags & TF_ACCEPT_FDS)) { 1594 binder_user_error("%d:%d got reply with fd, %d, but target does not allow fds\n", 1595 proc->pid, thread->pid, fp->handle); 1596 return_error = BR_FAILED_REPLY; 1597 goto err_fd_not_allowed; 1598 } 1599 } else if (!target_node->accept_fds) { 1600 binder_user_error("%d:%d got transaction with fd, %d, but target does not allow fds\n", 1601 proc->pid, thread->pid, fp->handle); 1602 return_error = BR_FAILED_REPLY; 1603 goto err_fd_not_allowed; 1604 } 1605 1606 file = fget(fp->handle); 1607 if (file == NULL) { 1608 binder_user_error("%d:%d got transaction with invalid fd, %d\n", 1609 proc->pid, thread->pid, fp->handle); 1610 return_error = BR_FAILED_REPLY; 1611 goto err_fget_failed; 1612 } 1613 target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC); 1614 if (target_fd < 0) { 1615 fput(file); 1616 return_error = BR_FAILED_REPLY; 1617 goto err_get_unused_fd_failed; 1618 } 1619 task_fd_install(target_proc, target_fd, file); 1620 trace_binder_transaction_fd(t, fp->handle, target_fd); 1621 binder_debug(BINDER_DEBUG_TRANSACTION, 1622 " fd %d -> %d\n", fp->handle, target_fd); 1623 /* TODO: fput? */ 1624 fp->handle = target_fd; 1625 } break; 1626 1627 default: 1628 binder_user_error("%d:%d got transaction with invalid object type, %x\n", 1629 proc->pid, thread->pid, fp->type); 1630 return_error = BR_FAILED_REPLY; 1631 goto err_bad_object_type; 1632 } 1633 } 1634 if (reply) { 1635 BUG_ON(t->buffer->async_transaction != 0); 1636 binder_pop_transaction(target_thread, in_reply_to); 1637 } else if (!(t->flags & TF_ONE_WAY)) { 1638 BUG_ON(t->buffer->async_transaction != 0); 1639 t->need_reply = 1; 1640 t->from_parent = thread->transaction_stack; 1641 thread->transaction_stack = t; 1642 } else { 1643 BUG_ON(target_node == NULL); 1644 BUG_ON(t->buffer->async_transaction != 1); 1645 if (target_node->has_async_transaction) { 1646 target_list = &target_node->async_todo; 1647 target_wait = NULL; 1648 } else 1649 target_node->has_async_transaction = 1; 1650 } 1651 t->work.type = BINDER_WORK_TRANSACTION; 1652 list_add_tail(&t->work.entry, target_list); 1653 tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE; 1654 list_add_tail(&tcomplete->entry, &thread->todo); 1655 if (target_wait) 1656 wake_up_interruptible(target_wait); 1657 return; 1658 1659err_get_unused_fd_failed: 1660err_fget_failed: 1661err_fd_not_allowed: 1662err_binder_get_ref_for_node_failed: 1663err_binder_get_ref_failed: 1664err_binder_new_node_failed: 1665err_bad_object_type: 1666err_bad_offset: 1667err_copy_data_failed: 1668 trace_binder_transaction_failed_buffer_release(t->buffer); 1669 binder_transaction_buffer_release(target_proc, t->buffer, offp); 1670 t->buffer->transaction = NULL; 1671 binder_free_buf(target_proc, t->buffer); 1672err_binder_alloc_buf_failed: 1673 kfree(tcomplete); 1674 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 1675err_alloc_tcomplete_failed: 1676 kfree(t); 1677 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1678err_alloc_t_failed: 1679err_bad_call_stack: 1680err_empty_call_stack: 1681err_dead_binder: 1682err_invalid_target_handle: 1683err_no_context_mgr_node: 1684 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1685 "%d:%d transaction failed %d, size %zd-%zd\n", 1686 proc->pid, thread->pid, return_error, 1687 tr->data_size, tr->offsets_size); 1688 1689 { 1690 struct binder_transaction_log_entry *fe; 1691 fe = binder_transaction_log_add(&binder_transaction_log_failed); 1692 *fe = *e; 1693 } 1694 1695 BUG_ON(thread->return_error != BR_OK); 1696 if (in_reply_to) { 1697 thread->return_error = BR_TRANSACTION_COMPLETE; 1698 binder_send_failed_reply(in_reply_to, return_error); 1699 } else 1700 thread->return_error = return_error; 1701} 1702 1703static int binder_thread_write(struct binder_proc *proc, 1704 struct binder_thread *thread, 1705 void __user *buffer, size_t size, size_t *consumed) 1706{ 1707 uint32_t cmd; 1708 void __user *ptr = buffer + *consumed; 1709 void __user *end = buffer + size; 1710 1711 while (ptr < end && thread->return_error == BR_OK) { 1712 if (get_user(cmd, (uint32_t __user *)ptr)) 1713 return -EFAULT; 1714 ptr += sizeof(uint32_t); 1715 trace_binder_command(cmd); 1716 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) { 1717 binder_stats.bc[_IOC_NR(cmd)]++; 1718 proc->stats.bc[_IOC_NR(cmd)]++; 1719 thread->stats.bc[_IOC_NR(cmd)]++; 1720 } 1721 switch (cmd) { 1722 case BC_INCREFS: 1723 case BC_ACQUIRE: 1724 case BC_RELEASE: 1725 case BC_DECREFS: { 1726 uint32_t target; 1727 struct binder_ref *ref; 1728 const char *debug_string; 1729 1730 if (get_user(target, (uint32_t __user *)ptr)) 1731 return -EFAULT; 1732 ptr += sizeof(uint32_t); 1733 if (target == 0 && binder_context_mgr_node && 1734 (cmd == BC_INCREFS || cmd == BC_ACQUIRE)) { 1735 ref = binder_get_ref_for_node(proc, 1736 binder_context_mgr_node); 1737 if (ref->desc != target) { 1738 binder_user_error("%d:%d tried to acquire reference to desc 0, got %d instead\n", 1739 proc->pid, thread->pid, 1740 ref->desc); 1741 } 1742 } else 1743 ref = binder_get_ref(proc, target); 1744 if (ref == NULL) { 1745 binder_user_error("%d:%d refcount change on invalid ref %d\n", 1746 proc->pid, thread->pid, target); 1747 break; 1748 } 1749 switch (cmd) { 1750 case BC_INCREFS: 1751 debug_string = "IncRefs"; 1752 binder_inc_ref(ref, 0, NULL); 1753 break; 1754 case BC_ACQUIRE: 1755 debug_string = "Acquire"; 1756 binder_inc_ref(ref, 1, NULL); 1757 break; 1758 case BC_RELEASE: 1759 debug_string = "Release"; 1760 binder_dec_ref(ref, 1); 1761 break; 1762 case BC_DECREFS: 1763 default: 1764 debug_string = "DecRefs"; 1765 binder_dec_ref(ref, 0); 1766 break; 1767 } 1768 binder_debug(BINDER_DEBUG_USER_REFS, 1769 "%d:%d %s ref %d desc %d s %d w %d for node %d\n", 1770 proc->pid, thread->pid, debug_string, ref->debug_id, 1771 ref->desc, ref->strong, ref->weak, ref->node->debug_id); 1772 break; 1773 } 1774 case BC_INCREFS_DONE: 1775 case BC_ACQUIRE_DONE: { 1776 void __user *node_ptr; 1777 void __user *cookie; 1778 struct binder_node *node; 1779 1780 if (get_user(node_ptr, (void * __user *)ptr)) 1781 return -EFAULT; 1782 ptr += sizeof(void *); 1783 if (get_user(cookie, (void * __user *)ptr)) 1784 return -EFAULT; 1785 ptr += sizeof(void *); 1786 node = binder_get_node(proc, node_ptr); 1787 if (node == NULL) { 1788 binder_user_error("%d:%d %s u%p no match\n", 1789 proc->pid, thread->pid, 1790 cmd == BC_INCREFS_DONE ? 1791 "BC_INCREFS_DONE" : 1792 "BC_ACQUIRE_DONE", 1793 node_ptr); 1794 break; 1795 } 1796 if (cookie != node->cookie) { 1797 binder_user_error("%d:%d %s u%p node %d cookie mismatch %p != %p\n", 1798 proc->pid, thread->pid, 1799 cmd == BC_INCREFS_DONE ? 1800 "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1801 node_ptr, node->debug_id, 1802 cookie, node->cookie); 1803 break; 1804 } 1805 if (cmd == BC_ACQUIRE_DONE) { 1806 if (node->pending_strong_ref == 0) { 1807 binder_user_error("%d:%d BC_ACQUIRE_DONE node %d has no pending acquire request\n", 1808 proc->pid, thread->pid, 1809 node->debug_id); 1810 break; 1811 } 1812 node->pending_strong_ref = 0; 1813 } else { 1814 if (node->pending_weak_ref == 0) { 1815 binder_user_error("%d:%d BC_INCREFS_DONE node %d has no pending increfs request\n", 1816 proc->pid, thread->pid, 1817 node->debug_id); 1818 break; 1819 } 1820 node->pending_weak_ref = 0; 1821 } 1822 binder_dec_node(node, cmd == BC_ACQUIRE_DONE, 0); 1823 binder_debug(BINDER_DEBUG_USER_REFS, 1824 "%d:%d %s node %d ls %d lw %d\n", 1825 proc->pid, thread->pid, 1826 cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1827 node->debug_id, node->local_strong_refs, node->local_weak_refs); 1828 break; 1829 } 1830 case BC_ATTEMPT_ACQUIRE: 1831 pr_err("BC_ATTEMPT_ACQUIRE not supported\n"); 1832 return -EINVAL; 1833 case BC_ACQUIRE_RESULT: 1834 pr_err("BC_ACQUIRE_RESULT not supported\n"); 1835 return -EINVAL; 1836 1837 case BC_FREE_BUFFER: { 1838 void __user *data_ptr; 1839 struct binder_buffer *buffer; 1840 1841 if (get_user(data_ptr, (void * __user *)ptr)) 1842 return -EFAULT; 1843 ptr += sizeof(void *); 1844 1845 buffer = binder_buffer_lookup(proc, data_ptr); 1846 if (buffer == NULL) { 1847 binder_user_error("%d:%d BC_FREE_BUFFER u%p no match\n", 1848 proc->pid, thread->pid, data_ptr); 1849 break; 1850 } 1851 if (!buffer->allow_user_free) { 1852 binder_user_error("%d:%d BC_FREE_BUFFER u%p matched unreturned buffer\n", 1853 proc->pid, thread->pid, data_ptr); 1854 break; 1855 } 1856 binder_debug(BINDER_DEBUG_FREE_BUFFER, 1857 "%d:%d BC_FREE_BUFFER u%p found buffer %d for %s transaction\n", 1858 proc->pid, thread->pid, data_ptr, buffer->debug_id, 1859 buffer->transaction ? "active" : "finished"); 1860 1861 if (buffer->transaction) { 1862 buffer->transaction->buffer = NULL; 1863 buffer->transaction = NULL; 1864 } 1865 if (buffer->async_transaction && buffer->target_node) { 1866 BUG_ON(!buffer->target_node->has_async_transaction); 1867 if (list_empty(&buffer->target_node->async_todo)) 1868 buffer->target_node->has_async_transaction = 0; 1869 else 1870 list_move_tail(buffer->target_node->async_todo.next, &thread->todo); 1871 } 1872 trace_binder_transaction_buffer_release(buffer); 1873 binder_transaction_buffer_release(proc, buffer, NULL); 1874 binder_free_buf(proc, buffer); 1875 break; 1876 } 1877 1878 case BC_TRANSACTION: 1879 case BC_REPLY: { 1880 struct binder_transaction_data tr; 1881 1882 if (copy_from_user(&tr, ptr, sizeof(tr))) 1883 return -EFAULT; 1884 ptr += sizeof(tr); 1885 binder_transaction(proc, thread, &tr, cmd == BC_REPLY); 1886 break; 1887 } 1888 1889 case BC_REGISTER_LOOPER: 1890 binder_debug(BINDER_DEBUG_THREADS, 1891 "%d:%d BC_REGISTER_LOOPER\n", 1892 proc->pid, thread->pid); 1893 if (thread->looper & BINDER_LOOPER_STATE_ENTERED) { 1894 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1895 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER\n", 1896 proc->pid, thread->pid); 1897 } else if (proc->requested_threads == 0) { 1898 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1899 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called without request\n", 1900 proc->pid, thread->pid); 1901 } else { 1902 proc->requested_threads--; 1903 proc->requested_threads_started++; 1904 } 1905 thread->looper |= BINDER_LOOPER_STATE_REGISTERED; 1906 break; 1907 case BC_ENTER_LOOPER: 1908 binder_debug(BINDER_DEBUG_THREADS, 1909 "%d:%d BC_ENTER_LOOPER\n", 1910 proc->pid, thread->pid); 1911 if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) { 1912 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1913 binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n", 1914 proc->pid, thread->pid); 1915 } 1916 thread->looper |= BINDER_LOOPER_STATE_ENTERED; 1917 break; 1918 case BC_EXIT_LOOPER: 1919 binder_debug(BINDER_DEBUG_THREADS, 1920 "%d:%d BC_EXIT_LOOPER\n", 1921 proc->pid, thread->pid); 1922 thread->looper |= BINDER_LOOPER_STATE_EXITED; 1923 break; 1924 1925 case BC_REQUEST_DEATH_NOTIFICATION: 1926 case BC_CLEAR_DEATH_NOTIFICATION: { 1927 uint32_t target; 1928 void __user *cookie; 1929 struct binder_ref *ref; 1930 struct binder_ref_death *death; 1931 1932 if (get_user(target, (uint32_t __user *)ptr)) 1933 return -EFAULT; 1934 ptr += sizeof(uint32_t); 1935 if (get_user(cookie, (void __user * __user *)ptr)) 1936 return -EFAULT; 1937 ptr += sizeof(void *); 1938 ref = binder_get_ref(proc, target); 1939 if (ref == NULL) { 1940 binder_user_error("%d:%d %s invalid ref %d\n", 1941 proc->pid, thread->pid, 1942 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 1943 "BC_REQUEST_DEATH_NOTIFICATION" : 1944 "BC_CLEAR_DEATH_NOTIFICATION", 1945 target); 1946 break; 1947 } 1948 1949 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 1950 "%d:%d %s %p ref %d desc %d s %d w %d for node %d\n", 1951 proc->pid, thread->pid, 1952 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 1953 "BC_REQUEST_DEATH_NOTIFICATION" : 1954 "BC_CLEAR_DEATH_NOTIFICATION", 1955 cookie, ref->debug_id, ref->desc, 1956 ref->strong, ref->weak, ref->node->debug_id); 1957 1958 if (cmd == BC_REQUEST_DEATH_NOTIFICATION) { 1959 if (ref->death) { 1960 binder_user_error("%d:%d BC_REQUEST_DEATH_NOTIFICATION death notification already set\n", 1961 proc->pid, thread->pid); 1962 break; 1963 } 1964 death = kzalloc(sizeof(*death), GFP_KERNEL); 1965 if (death == NULL) { 1966 thread->return_error = BR_ERROR; 1967 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1968 "%d:%d BC_REQUEST_DEATH_NOTIFICATION failed\n", 1969 proc->pid, thread->pid); 1970 break; 1971 } 1972 binder_stats_created(BINDER_STAT_DEATH); 1973 INIT_LIST_HEAD(&death->work.entry); 1974 death->cookie = cookie; 1975 ref->death = death; 1976 if (ref->node->proc == NULL) { 1977 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 1978 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 1979 list_add_tail(&ref->death->work.entry, &thread->todo); 1980 } else { 1981 list_add_tail(&ref->death->work.entry, &proc->todo); 1982 wake_up_interruptible(&proc->wait); 1983 } 1984 } 1985 } else { 1986 if (ref->death == NULL) { 1987 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification not active\n", 1988 proc->pid, thread->pid); 1989 break; 1990 } 1991 death = ref->death; 1992 if (death->cookie != cookie) { 1993 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch %p != %p\n", 1994 proc->pid, thread->pid, 1995 death->cookie, cookie); 1996 break; 1997 } 1998 ref->death = NULL; 1999 if (list_empty(&death->work.entry)) { 2000 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2001 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2002 list_add_tail(&death->work.entry, &thread->todo); 2003 } else { 2004 list_add_tail(&death->work.entry, &proc->todo); 2005 wake_up_interruptible(&proc->wait); 2006 } 2007 } else { 2008 BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER); 2009 death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR; 2010 } 2011 } 2012 } break; 2013 case BC_DEAD_BINDER_DONE: { 2014 struct binder_work *w; 2015 void __user *cookie; 2016 struct binder_ref_death *death = NULL; 2017 if (get_user(cookie, (void __user * __user *)ptr)) 2018 return -EFAULT; 2019 2020 ptr += sizeof(void *); 2021 list_for_each_entry(w, &proc->delivered_death, entry) { 2022 struct binder_ref_death *tmp_death = container_of(w, struct binder_ref_death, work); 2023 if (tmp_death->cookie == cookie) { 2024 death = tmp_death; 2025 break; 2026 } 2027 } 2028 binder_debug(BINDER_DEBUG_DEAD_BINDER, 2029 "%d:%d BC_DEAD_BINDER_DONE %p found %p\n", 2030 proc->pid, thread->pid, cookie, death); 2031 if (death == NULL) { 2032 binder_user_error("%d:%d BC_DEAD_BINDER_DONE %p not found\n", 2033 proc->pid, thread->pid, cookie); 2034 break; 2035 } 2036 2037 list_del_init(&death->work.entry); 2038 if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) { 2039 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2040 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2041 list_add_tail(&death->work.entry, &thread->todo); 2042 } else { 2043 list_add_tail(&death->work.entry, &proc->todo); 2044 wake_up_interruptible(&proc->wait); 2045 } 2046 } 2047 } break; 2048 2049 default: 2050 pr_err("%d:%d unknown command %d\n", 2051 proc->pid, thread->pid, cmd); 2052 return -EINVAL; 2053 } 2054 *consumed = ptr - buffer; 2055 } 2056 return 0; 2057} 2058 2059static void binder_stat_br(struct binder_proc *proc, 2060 struct binder_thread *thread, uint32_t cmd) 2061{ 2062 trace_binder_return(cmd); 2063 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) { 2064 binder_stats.br[_IOC_NR(cmd)]++; 2065 proc->stats.br[_IOC_NR(cmd)]++; 2066 thread->stats.br[_IOC_NR(cmd)]++; 2067 } 2068} 2069 2070static int binder_has_proc_work(struct binder_proc *proc, 2071 struct binder_thread *thread) 2072{ 2073 return !list_empty(&proc->todo) || 2074 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2075} 2076 2077static int binder_has_thread_work(struct binder_thread *thread) 2078{ 2079 return !list_empty(&thread->todo) || thread->return_error != BR_OK || 2080 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2081} 2082 2083static int binder_thread_read(struct binder_proc *proc, 2084 struct binder_thread *thread, 2085 void __user *buffer, size_t size, 2086 size_t *consumed, int non_block) 2087{ 2088 void __user *ptr = buffer + *consumed; 2089 void __user *end = buffer + size; 2090 2091 int ret = 0; 2092 int wait_for_proc_work; 2093 2094 if (*consumed == 0) { 2095 if (put_user(BR_NOOP, (uint32_t __user *)ptr)) 2096 return -EFAULT; 2097 ptr += sizeof(uint32_t); 2098 } 2099 2100retry: 2101 wait_for_proc_work = thread->transaction_stack == NULL && 2102 list_empty(&thread->todo); 2103 2104 if (thread->return_error != BR_OK && ptr < end) { 2105 if (thread->return_error2 != BR_OK) { 2106 if (put_user(thread->return_error2, (uint32_t __user *)ptr)) 2107 return -EFAULT; 2108 ptr += sizeof(uint32_t); 2109 binder_stat_br(proc, thread, thread->return_error2); 2110 if (ptr == end) 2111 goto done; 2112 thread->return_error2 = BR_OK; 2113 } 2114 if (put_user(thread->return_error, (uint32_t __user *)ptr)) 2115 return -EFAULT; 2116 ptr += sizeof(uint32_t); 2117 binder_stat_br(proc, thread, thread->return_error); 2118 thread->return_error = BR_OK; 2119 goto done; 2120 } 2121 2122 2123 thread->looper |= BINDER_LOOPER_STATE_WAITING; 2124 if (wait_for_proc_work) 2125 proc->ready_threads++; 2126 2127 binder_unlock(__func__); 2128 2129 trace_binder_wait_for_work(wait_for_proc_work, 2130 !!thread->transaction_stack, 2131 !list_empty(&thread->todo)); 2132 if (wait_for_proc_work) { 2133 if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2134 BINDER_LOOPER_STATE_ENTERED))) { 2135 binder_user_error("%d:%d ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state %x)\n", 2136 proc->pid, thread->pid, thread->looper); 2137 wait_event_interruptible(binder_user_error_wait, 2138 binder_stop_on_user_error < 2); 2139 } 2140 binder_set_nice(proc->default_priority); 2141 if (non_block) { 2142 if (!binder_has_proc_work(proc, thread)) 2143 ret = -EAGAIN; 2144 } else 2145 ret = wait_event_freezable_exclusive(proc->wait, binder_has_proc_work(proc, thread)); 2146 } else { 2147 if (non_block) { 2148 if (!binder_has_thread_work(thread)) 2149 ret = -EAGAIN; 2150 } else 2151 ret = wait_event_freezable(thread->wait, binder_has_thread_work(thread)); 2152 } 2153 2154 binder_lock(__func__); 2155 2156 if (wait_for_proc_work) 2157 proc->ready_threads--; 2158 thread->looper &= ~BINDER_LOOPER_STATE_WAITING; 2159 2160 if (ret) 2161 return ret; 2162 2163 while (1) { 2164 uint32_t cmd; 2165 struct binder_transaction_data tr; 2166 struct binder_work *w; 2167 struct binder_transaction *t = NULL; 2168 2169 if (!list_empty(&thread->todo)) 2170 w = list_first_entry(&thread->todo, struct binder_work, entry); 2171 else if (!list_empty(&proc->todo) && wait_for_proc_work) 2172 w = list_first_entry(&proc->todo, struct binder_work, entry); 2173 else { 2174 if (ptr - buffer == 4 && !(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN)) /* no data added */ 2175 goto retry; 2176 break; 2177 } 2178 2179 if (end - ptr < sizeof(tr) + 4) 2180 break; 2181 2182 switch (w->type) { 2183 case BINDER_WORK_TRANSACTION: { 2184 t = container_of(w, struct binder_transaction, work); 2185 } break; 2186 case BINDER_WORK_TRANSACTION_COMPLETE: { 2187 cmd = BR_TRANSACTION_COMPLETE; 2188 if (put_user(cmd, (uint32_t __user *)ptr)) 2189 return -EFAULT; 2190 ptr += sizeof(uint32_t); 2191 2192 binder_stat_br(proc, thread, cmd); 2193 binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE, 2194 "%d:%d BR_TRANSACTION_COMPLETE\n", 2195 proc->pid, thread->pid); 2196 2197 list_del(&w->entry); 2198 kfree(w); 2199 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2200 } break; 2201 case BINDER_WORK_NODE: { 2202 struct binder_node *node = container_of(w, struct binder_node, work); 2203 uint32_t cmd = BR_NOOP; 2204 const char *cmd_name; 2205 int strong = node->internal_strong_refs || node->local_strong_refs; 2206 int weak = !hlist_empty(&node->refs) || node->local_weak_refs || strong; 2207 if (weak && !node->has_weak_ref) { 2208 cmd = BR_INCREFS; 2209 cmd_name = "BR_INCREFS"; 2210 node->has_weak_ref = 1; 2211 node->pending_weak_ref = 1; 2212 node->local_weak_refs++; 2213 } else if (strong && !node->has_strong_ref) { 2214 cmd = BR_ACQUIRE; 2215 cmd_name = "BR_ACQUIRE"; 2216 node->has_strong_ref = 1; 2217 node->pending_strong_ref = 1; 2218 node->local_strong_refs++; 2219 } else if (!strong && node->has_strong_ref) { 2220 cmd = BR_RELEASE; 2221 cmd_name = "BR_RELEASE"; 2222 node->has_strong_ref = 0; 2223 } else if (!weak && node->has_weak_ref) { 2224 cmd = BR_DECREFS; 2225 cmd_name = "BR_DECREFS"; 2226 node->has_weak_ref = 0; 2227 } 2228 if (cmd != BR_NOOP) { 2229 if (put_user(cmd, (uint32_t __user *)ptr)) 2230 return -EFAULT; 2231 ptr += sizeof(uint32_t); 2232 if (put_user(node->ptr, (void * __user *)ptr)) 2233 return -EFAULT; 2234 ptr += sizeof(void *); 2235 if (put_user(node->cookie, (void * __user *)ptr)) 2236 return -EFAULT; 2237 ptr += sizeof(void *); 2238 2239 binder_stat_br(proc, thread, cmd); 2240 binder_debug(BINDER_DEBUG_USER_REFS, 2241 "%d:%d %s %d u%p c%p\n", 2242 proc->pid, thread->pid, cmd_name, node->debug_id, node->ptr, node->cookie); 2243 } else { 2244 list_del_init(&w->entry); 2245 if (!weak && !strong) { 2246 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2247 "%d:%d node %d u%p c%p deleted\n", 2248 proc->pid, thread->pid, node->debug_id, 2249 node->ptr, node->cookie); 2250 rb_erase(&node->rb_node, &proc->nodes); 2251 kfree(node); 2252 binder_stats_deleted(BINDER_STAT_NODE); 2253 } else { 2254 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2255 "%d:%d node %d u%p c%p state unchanged\n", 2256 proc->pid, thread->pid, node->debug_id, node->ptr, 2257 node->cookie); 2258 } 2259 } 2260 } break; 2261 case BINDER_WORK_DEAD_BINDER: 2262 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 2263 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 2264 struct binder_ref_death *death; 2265 uint32_t cmd; 2266 2267 death = container_of(w, struct binder_ref_death, work); 2268 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) 2269 cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE; 2270 else 2271 cmd = BR_DEAD_BINDER; 2272 if (put_user(cmd, (uint32_t __user *)ptr)) 2273 return -EFAULT; 2274 ptr += sizeof(uint32_t); 2275 if (put_user(death->cookie, (void * __user *)ptr)) 2276 return -EFAULT; 2277 ptr += sizeof(void *); 2278 binder_stat_br(proc, thread, cmd); 2279 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 2280 "%d:%d %s %p\n", 2281 proc->pid, thread->pid, 2282 cmd == BR_DEAD_BINDER ? 2283 "BR_DEAD_BINDER" : 2284 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 2285 death->cookie); 2286 2287 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) { 2288 list_del(&w->entry); 2289 kfree(death); 2290 binder_stats_deleted(BINDER_STAT_DEATH); 2291 } else 2292 list_move(&w->entry, &proc->delivered_death); 2293 if (cmd == BR_DEAD_BINDER) 2294 goto done; /* DEAD_BINDER notifications can cause transactions */ 2295 } break; 2296 } 2297 2298 if (!t) 2299 continue; 2300 2301 BUG_ON(t->buffer == NULL); 2302 if (t->buffer->target_node) { 2303 struct binder_node *target_node = t->buffer->target_node; 2304 tr.target.ptr = target_node->ptr; 2305 tr.cookie = target_node->cookie; 2306 t->saved_priority = task_nice(current); 2307 if (t->priority < target_node->min_priority && 2308 !(t->flags & TF_ONE_WAY)) 2309 binder_set_nice(t->priority); 2310 else if (!(t->flags & TF_ONE_WAY) || 2311 t->saved_priority > target_node->min_priority) 2312 binder_set_nice(target_node->min_priority); 2313 cmd = BR_TRANSACTION; 2314 } else { 2315 tr.target.ptr = NULL; 2316 tr.cookie = NULL; 2317 cmd = BR_REPLY; 2318 } 2319 tr.code = t->code; 2320 tr.flags = t->flags; 2321 tr.sender_euid = from_kuid(current_user_ns(), t->sender_euid); 2322 2323 if (t->from) { 2324 struct task_struct *sender = t->from->proc->tsk; 2325 tr.sender_pid = task_tgid_nr_ns(sender, 2326 task_active_pid_ns(current)); 2327 } else { 2328 tr.sender_pid = 0; 2329 } 2330 2331 tr.data_size = t->buffer->data_size; 2332 tr.offsets_size = t->buffer->offsets_size; 2333 tr.data.ptr.buffer = (void *)t->buffer->data + 2334 proc->user_buffer_offset; 2335 tr.data.ptr.offsets = tr.data.ptr.buffer + 2336 ALIGN(t->buffer->data_size, 2337 sizeof(void *)); 2338 2339 if (put_user(cmd, (uint32_t __user *)ptr)) 2340 return -EFAULT; 2341 ptr += sizeof(uint32_t); 2342 if (copy_to_user(ptr, &tr, sizeof(tr))) 2343 return -EFAULT; 2344 ptr += sizeof(tr); 2345 2346 trace_binder_transaction_received(t); 2347 binder_stat_br(proc, thread, cmd); 2348 binder_debug(BINDER_DEBUG_TRANSACTION, 2349 "%d:%d %s %d %d:%d, cmd %d size %zd-%zd ptr %p-%p\n", 2350 proc->pid, thread->pid, 2351 (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" : 2352 "BR_REPLY", 2353 t->debug_id, t->from ? t->from->proc->pid : 0, 2354 t->from ? t->from->pid : 0, cmd, 2355 t->buffer->data_size, t->buffer->offsets_size, 2356 tr.data.ptr.buffer, tr.data.ptr.offsets); 2357 2358 list_del(&t->work.entry); 2359 t->buffer->allow_user_free = 1; 2360 if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) { 2361 t->to_parent = thread->transaction_stack; 2362 t->to_thread = thread; 2363 thread->transaction_stack = t; 2364 } else { 2365 t->buffer->transaction = NULL; 2366 kfree(t); 2367 binder_stats_deleted(BINDER_STAT_TRANSACTION); 2368 } 2369 break; 2370 } 2371 2372done: 2373 2374 *consumed = ptr - buffer; 2375 if (proc->requested_threads + proc->ready_threads == 0 && 2376 proc->requested_threads_started < proc->max_threads && 2377 (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2378 BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */ 2379 /*spawn a new thread if we leave this out */) { 2380 proc->requested_threads++; 2381 binder_debug(BINDER_DEBUG_THREADS, 2382 "%d:%d BR_SPAWN_LOOPER\n", 2383 proc->pid, thread->pid); 2384 if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer)) 2385 return -EFAULT; 2386 binder_stat_br(proc, thread, BR_SPAWN_LOOPER); 2387 } 2388 return 0; 2389} 2390 2391static void binder_release_work(struct list_head *list) 2392{ 2393 struct binder_work *w; 2394 while (!list_empty(list)) { 2395 w = list_first_entry(list, struct binder_work, entry); 2396 list_del_init(&w->entry); 2397 switch (w->type) { 2398 case BINDER_WORK_TRANSACTION: { 2399 struct binder_transaction *t; 2400 2401 t = container_of(w, struct binder_transaction, work); 2402 if (t->buffer->target_node && 2403 !(t->flags & TF_ONE_WAY)) { 2404 binder_send_failed_reply(t, BR_DEAD_REPLY); 2405 } else { 2406 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2407 "undelivered transaction %d\n", 2408 t->debug_id); 2409 t->buffer->transaction = NULL; 2410 kfree(t); 2411 binder_stats_deleted(BINDER_STAT_TRANSACTION); 2412 } 2413 } break; 2414 case BINDER_WORK_TRANSACTION_COMPLETE: { 2415 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2416 "undelivered TRANSACTION_COMPLETE\n"); 2417 kfree(w); 2418 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2419 } break; 2420 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 2421 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 2422 struct binder_ref_death *death; 2423 2424 death = container_of(w, struct binder_ref_death, work); 2425 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2426 "undelivered death notification, %p\n", 2427 death->cookie); 2428 kfree(death); 2429 binder_stats_deleted(BINDER_STAT_DEATH); 2430 } break; 2431 default: 2432 pr_err("unexpected work type, %d, not freed\n", 2433 w->type); 2434 break; 2435 } 2436 } 2437 2438} 2439 2440static struct binder_thread *binder_get_thread(struct binder_proc *proc) 2441{ 2442 struct binder_thread *thread = NULL; 2443 struct rb_node *parent = NULL; 2444 struct rb_node **p = &proc->threads.rb_node; 2445 2446 while (*p) { 2447 parent = *p; 2448 thread = rb_entry(parent, struct binder_thread, rb_node); 2449 2450 if (current->pid < thread->pid) 2451 p = &(*p)->rb_left; 2452 else if (current->pid > thread->pid) 2453 p = &(*p)->rb_right; 2454 else 2455 break; 2456 } 2457 if (*p == NULL) { 2458 thread = kzalloc(sizeof(*thread), GFP_KERNEL); 2459 if (thread == NULL) 2460 return NULL; 2461 binder_stats_created(BINDER_STAT_THREAD); 2462 thread->proc = proc; 2463 thread->pid = current->pid; 2464 init_waitqueue_head(&thread->wait); 2465 INIT_LIST_HEAD(&thread->todo); 2466 rb_link_node(&thread->rb_node, parent, p); 2467 rb_insert_color(&thread->rb_node, &proc->threads); 2468 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2469 thread->return_error = BR_OK; 2470 thread->return_error2 = BR_OK; 2471 } 2472 return thread; 2473} 2474 2475static int binder_free_thread(struct binder_proc *proc, 2476 struct binder_thread *thread) 2477{ 2478 struct binder_transaction *t; 2479 struct binder_transaction *send_reply = NULL; 2480 int active_transactions = 0; 2481 2482 rb_erase(&thread->rb_node, &proc->threads); 2483 t = thread->transaction_stack; 2484 if (t && t->to_thread == thread) 2485 send_reply = t; 2486 while (t) { 2487 active_transactions++; 2488 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2489 "release %d:%d transaction %d %s, still active\n", 2490 proc->pid, thread->pid, 2491 t->debug_id, 2492 (t->to_thread == thread) ? "in" : "out"); 2493 2494 if (t->to_thread == thread) { 2495 t->to_proc = NULL; 2496 t->to_thread = NULL; 2497 if (t->buffer) { 2498 t->buffer->transaction = NULL; 2499 t->buffer = NULL; 2500 } 2501 t = t->to_parent; 2502 } else if (t->from == thread) { 2503 t->from = NULL; 2504 t = t->from_parent; 2505 } else 2506 BUG(); 2507 } 2508 if (send_reply) 2509 binder_send_failed_reply(send_reply, BR_DEAD_REPLY); 2510 binder_release_work(&thread->todo); 2511 kfree(thread); 2512 binder_stats_deleted(BINDER_STAT_THREAD); 2513 return active_transactions; 2514} 2515 2516static unsigned int binder_poll(struct file *filp, 2517 struct poll_table_struct *wait) 2518{ 2519 struct binder_proc *proc = filp->private_data; 2520 struct binder_thread *thread = NULL; 2521 int wait_for_proc_work; 2522 2523 binder_lock(__func__); 2524 2525 thread = binder_get_thread(proc); 2526 2527 wait_for_proc_work = thread->transaction_stack == NULL && 2528 list_empty(&thread->todo) && thread->return_error == BR_OK; 2529 2530 binder_unlock(__func__); 2531 2532 if (wait_for_proc_work) { 2533 if (binder_has_proc_work(proc, thread)) 2534 return POLLIN; 2535 poll_wait(filp, &proc->wait, wait); 2536 if (binder_has_proc_work(proc, thread)) 2537 return POLLIN; 2538 } else { 2539 if (binder_has_thread_work(thread)) 2540 return POLLIN; 2541 poll_wait(filp, &thread->wait, wait); 2542 if (binder_has_thread_work(thread)) 2543 return POLLIN; 2544 } 2545 return 0; 2546} 2547 2548static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 2549{ 2550 int ret; 2551 struct binder_proc *proc = filp->private_data; 2552 struct binder_thread *thread; 2553 unsigned int size = _IOC_SIZE(cmd); 2554 void __user *ubuf = (void __user *)arg; 2555 2556 /*pr_info("binder_ioctl: %d:%d %x %lx\n", proc->pid, current->pid, cmd, arg);*/ 2557 2558 trace_binder_ioctl(cmd, arg); 2559 2560 ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2561 if (ret) 2562 goto err_unlocked; 2563 2564 binder_lock(__func__); 2565 thread = binder_get_thread(proc); 2566 if (thread == NULL) { 2567 ret = -ENOMEM; 2568 goto err; 2569 } 2570 2571 switch (cmd) { 2572 case BINDER_WRITE_READ: { 2573 struct binder_write_read bwr; 2574 if (size != sizeof(struct binder_write_read)) { 2575 ret = -EINVAL; 2576 goto err; 2577 } 2578 if (copy_from_user(&bwr, ubuf, sizeof(bwr))) { 2579 ret = -EFAULT; 2580 goto err; 2581 } 2582 binder_debug(BINDER_DEBUG_READ_WRITE, 2583 "%d:%d write %zd at %016lx, read %zd at %016lx\n", 2584 proc->pid, thread->pid, bwr.write_size, 2585 bwr.write_buffer, bwr.read_size, bwr.read_buffer); 2586 2587 if (bwr.write_size > 0) { 2588 ret = binder_thread_write(proc, thread, (void __user *)bwr.write_buffer, bwr.write_size, &bwr.write_consumed); 2589 trace_binder_write_done(ret); 2590 if (ret < 0) { 2591 bwr.read_consumed = 0; 2592 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2593 ret = -EFAULT; 2594 goto err; 2595 } 2596 } 2597 if (bwr.read_size > 0) { 2598 ret = binder_thread_read(proc, thread, (void __user *)bwr.read_buffer, bwr.read_size, &bwr.read_consumed, filp->f_flags & O_NONBLOCK); 2599 trace_binder_read_done(ret); 2600 if (!list_empty(&proc->todo)) 2601 wake_up_interruptible(&proc->wait); 2602 if (ret < 0) { 2603 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2604 ret = -EFAULT; 2605 goto err; 2606 } 2607 } 2608 binder_debug(BINDER_DEBUG_READ_WRITE, 2609 "%d:%d wrote %zd of %zd, read return %zd of %zd\n", 2610 proc->pid, thread->pid, bwr.write_consumed, bwr.write_size, 2611 bwr.read_consumed, bwr.read_size); 2612 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) { 2613 ret = -EFAULT; 2614 goto err; 2615 } 2616 break; 2617 } 2618 case BINDER_SET_MAX_THREADS: 2619 if (copy_from_user(&proc->max_threads, ubuf, sizeof(proc->max_threads))) { 2620 ret = -EINVAL; 2621 goto err; 2622 } 2623 break; 2624 case BINDER_SET_CONTEXT_MGR: 2625 if (binder_context_mgr_node != NULL) { 2626 pr_err("BINDER_SET_CONTEXT_MGR already set\n"); 2627 ret = -EBUSY; 2628 goto err; 2629 } 2630 if (uid_valid(binder_context_mgr_uid)) { 2631 if (!uid_eq(binder_context_mgr_uid, current->cred->euid)) { 2632 pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n", 2633 from_kuid(&init_user_ns, current->cred->euid), 2634 from_kuid(&init_user_ns, binder_context_mgr_uid)); 2635 ret = -EPERM; 2636 goto err; 2637 } 2638 } else 2639 binder_context_mgr_uid = current->cred->euid; 2640 binder_context_mgr_node = binder_new_node(proc, NULL, NULL); 2641 if (binder_context_mgr_node == NULL) { 2642 ret = -ENOMEM; 2643 goto err; 2644 } 2645 binder_context_mgr_node->local_weak_refs++; 2646 binder_context_mgr_node->local_strong_refs++; 2647 binder_context_mgr_node->has_strong_ref = 1; 2648 binder_context_mgr_node->has_weak_ref = 1; 2649 break; 2650 case BINDER_THREAD_EXIT: 2651 binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n", 2652 proc->pid, thread->pid); 2653 binder_free_thread(proc, thread); 2654 thread = NULL; 2655 break; 2656 case BINDER_VERSION: 2657 if (size != sizeof(struct binder_version)) { 2658 ret = -EINVAL; 2659 goto err; 2660 } 2661 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION, &((struct binder_version *)ubuf)->protocol_version)) { 2662 ret = -EINVAL; 2663 goto err; 2664 } 2665 break; 2666 default: 2667 ret = -EINVAL; 2668 goto err; 2669 } 2670 ret = 0; 2671err: 2672 if (thread) 2673 thread->looper &= ~BINDER_LOOPER_STATE_NEED_RETURN; 2674 binder_unlock(__func__); 2675 wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2676 if (ret && ret != -ERESTARTSYS) 2677 pr_info("%d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret); 2678err_unlocked: 2679 trace_binder_ioctl_done(ret); 2680 return ret; 2681} 2682 2683static void binder_vma_open(struct vm_area_struct *vma) 2684{ 2685 struct binder_proc *proc = vma->vm_private_data; 2686 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2687 "%d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2688 proc->pid, vma->vm_start, vma->vm_end, 2689 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2690 (unsigned long)pgprot_val(vma->vm_page_prot)); 2691} 2692 2693static void binder_vma_close(struct vm_area_struct *vma) 2694{ 2695 struct binder_proc *proc = vma->vm_private_data; 2696 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2697 "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2698 proc->pid, vma->vm_start, vma->vm_end, 2699 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2700 (unsigned long)pgprot_val(vma->vm_page_prot)); 2701 proc->vma = NULL; 2702 proc->vma_vm_mm = NULL; 2703 binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES); 2704} 2705 2706static struct vm_operations_struct binder_vm_ops = { 2707 .open = binder_vma_open, 2708 .close = binder_vma_close, 2709}; 2710 2711static int binder_mmap(struct file *filp, struct vm_area_struct *vma) 2712{ 2713 int ret; 2714 struct vm_struct *area; 2715 struct binder_proc *proc = filp->private_data; 2716 const char *failure_string; 2717 struct binder_buffer *buffer; 2718 2719 if (proc->tsk != current) 2720 return -EINVAL; 2721 2722 if ((vma->vm_end - vma->vm_start) > SZ_4M) 2723 vma->vm_end = vma->vm_start + SZ_4M; 2724 2725 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2726 "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n", 2727 proc->pid, vma->vm_start, vma->vm_end, 2728 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2729 (unsigned long)pgprot_val(vma->vm_page_prot)); 2730 2731 if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) { 2732 ret = -EPERM; 2733 failure_string = "bad vm_flags"; 2734 goto err_bad_arg; 2735 } 2736 vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE; 2737 2738 mutex_lock(&binder_mmap_lock); 2739 if (proc->buffer) { 2740 ret = -EBUSY; 2741 failure_string = "already mapped"; 2742 goto err_already_mapped; 2743 } 2744 2745 area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP); 2746 if (area == NULL) { 2747 ret = -ENOMEM; 2748 failure_string = "get_vm_area"; 2749 goto err_get_vm_area_failed; 2750 } 2751 proc->buffer = area->addr; 2752 proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer; 2753 mutex_unlock(&binder_mmap_lock); 2754 2755#ifdef CONFIG_CPU_CACHE_VIPT 2756 if (cache_is_vipt_aliasing()) { 2757 while (CACHE_COLOUR((vma->vm_start ^ (uint32_t)proc->buffer))) { 2758 pr_info("binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer); 2759 vma->vm_start += PAGE_SIZE; 2760 } 2761 } 2762#endif 2763 proc->pages = kzalloc(sizeof(proc->pages[0]) * ((vma->vm_end - vma->vm_start) / PAGE_SIZE), GFP_KERNEL); 2764 if (proc->pages == NULL) { 2765 ret = -ENOMEM; 2766 failure_string = "alloc page array"; 2767 goto err_alloc_pages_failed; 2768 } 2769 proc->buffer_size = vma->vm_end - vma->vm_start; 2770 2771 vma->vm_ops = &binder_vm_ops; 2772 vma->vm_private_data = proc; 2773 2774 if (binder_update_page_range(proc, 1, proc->buffer, proc->buffer + PAGE_SIZE, vma)) { 2775 ret = -ENOMEM; 2776 failure_string = "alloc small buf"; 2777 goto err_alloc_small_buf_failed; 2778 } 2779 buffer = proc->buffer; 2780 INIT_LIST_HEAD(&proc->buffers); 2781 list_add(&buffer->entry, &proc->buffers); 2782 buffer->free = 1; 2783 binder_insert_free_buffer(proc, buffer); 2784 proc->free_async_space = proc->buffer_size / 2; 2785 barrier(); 2786 proc->files = get_files_struct(current); 2787 proc->vma = vma; 2788 proc->vma_vm_mm = vma->vm_mm; 2789 2790 /*pr_info("binder_mmap: %d %lx-%lx maps %p\n", 2791 proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/ 2792 return 0; 2793 2794err_alloc_small_buf_failed: 2795 kfree(proc->pages); 2796 proc->pages = NULL; 2797err_alloc_pages_failed: 2798 mutex_lock(&binder_mmap_lock); 2799 vfree(proc->buffer); 2800 proc->buffer = NULL; 2801err_get_vm_area_failed: 2802err_already_mapped: 2803 mutex_unlock(&binder_mmap_lock); 2804err_bad_arg: 2805 pr_err("binder_mmap: %d %lx-%lx %s failed %d\n", 2806 proc->pid, vma->vm_start, vma->vm_end, failure_string, ret); 2807 return ret; 2808} 2809 2810static int binder_open(struct inode *nodp, struct file *filp) 2811{ 2812 struct binder_proc *proc; 2813 2814 binder_debug(BINDER_DEBUG_OPEN_CLOSE, "binder_open: %d:%d\n", 2815 current->group_leader->pid, current->pid); 2816 2817 proc = kzalloc(sizeof(*proc), GFP_KERNEL); 2818 if (proc == NULL) 2819 return -ENOMEM; 2820 get_task_struct(current); 2821 proc->tsk = current; 2822 INIT_LIST_HEAD(&proc->todo); 2823 init_waitqueue_head(&proc->wait); 2824 proc->default_priority = task_nice(current); 2825 2826 binder_lock(__func__); 2827 2828 binder_stats_created(BINDER_STAT_PROC); 2829 hlist_add_head(&proc->proc_node, &binder_procs); 2830 proc->pid = current->group_leader->pid; 2831 INIT_LIST_HEAD(&proc->delivered_death); 2832 filp->private_data = proc; 2833 2834 binder_unlock(__func__); 2835 2836 if (binder_debugfs_dir_entry_proc) { 2837 char strbuf[11]; 2838 snprintf(strbuf, sizeof(strbuf), "%u", proc->pid); 2839 proc->debugfs_entry = debugfs_create_file(strbuf, S_IRUGO, 2840 binder_debugfs_dir_entry_proc, proc, &binder_proc_fops); 2841 } 2842 2843 return 0; 2844} 2845 2846static int binder_flush(struct file *filp, fl_owner_t id) 2847{ 2848 struct binder_proc *proc = filp->private_data; 2849 2850 binder_defer_work(proc, BINDER_DEFERRED_FLUSH); 2851 2852 return 0; 2853} 2854 2855static void binder_deferred_flush(struct binder_proc *proc) 2856{ 2857 struct rb_node *n; 2858 int wake_count = 0; 2859 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) { 2860 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node); 2861 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2862 if (thread->looper & BINDER_LOOPER_STATE_WAITING) { 2863 wake_up_interruptible(&thread->wait); 2864 wake_count++; 2865 } 2866 } 2867 wake_up_interruptible_all(&proc->wait); 2868 2869 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2870 "binder_flush: %d woke %d threads\n", proc->pid, 2871 wake_count); 2872} 2873 2874static int binder_release(struct inode *nodp, struct file *filp) 2875{ 2876 struct binder_proc *proc = filp->private_data; 2877 debugfs_remove(proc->debugfs_entry); 2878 binder_defer_work(proc, BINDER_DEFERRED_RELEASE); 2879 2880 return 0; 2881} 2882 2883static int binder_node_release(struct binder_node *node, int refs) 2884{ 2885 struct binder_ref *ref; 2886 int death = 0; 2887 2888 list_del_init(&node->work.entry); 2889 binder_release_work(&node->async_todo); 2890 2891 if (hlist_empty(&node->refs)) { 2892 kfree(node); 2893 binder_stats_deleted(BINDER_STAT_NODE); 2894 2895 return refs; 2896 } 2897 2898 node->proc = NULL; 2899 node->local_strong_refs = 0; 2900 node->local_weak_refs = 0; 2901 hlist_add_head(&node->dead_node, &binder_dead_nodes); 2902 2903 hlist_for_each_entry(ref, &node->refs, node_entry) { 2904 refs++; 2905 2906 if (!ref->death) 2907 continue; 2908 2909 death++; 2910 2911 if (list_empty(&ref->death->work.entry)) { 2912 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 2913 list_add_tail(&ref->death->work.entry, 2914 &ref->proc->todo); 2915 wake_up_interruptible(&ref->proc->wait); 2916 } else 2917 BUG(); 2918 } 2919 2920 binder_debug(BINDER_DEBUG_DEAD_BINDER, 2921 "node %d now dead, refs %d, death %d\n", 2922 node->debug_id, refs, death); 2923 2924 return refs; 2925} 2926 2927static void binder_deferred_release(struct binder_proc *proc) 2928{ 2929 struct binder_transaction *t; 2930 struct rb_node *n; 2931 int threads, nodes, incoming_refs, outgoing_refs, buffers, 2932 active_transactions, page_count; 2933 2934 BUG_ON(proc->vma); 2935 BUG_ON(proc->files); 2936 2937 hlist_del(&proc->proc_node); 2938 2939 if (binder_context_mgr_node && binder_context_mgr_node->proc == proc) { 2940 binder_debug(BINDER_DEBUG_DEAD_BINDER, 2941 "%s: %d context_mgr_node gone\n", 2942 __func__, proc->pid); 2943 binder_context_mgr_node = NULL; 2944 } 2945 2946 threads = 0; 2947 active_transactions = 0; 2948 while ((n = rb_first(&proc->threads))) { 2949 struct binder_thread *thread; 2950 2951 thread = rb_entry(n, struct binder_thread, rb_node); 2952 threads++; 2953 active_transactions += binder_free_thread(proc, thread); 2954 } 2955 2956 nodes = 0; 2957 incoming_refs = 0; 2958 while ((n = rb_first(&proc->nodes))) { 2959 struct binder_node *node; 2960 2961 node = rb_entry(n, struct binder_node, rb_node); 2962 nodes++; 2963 rb_erase(&node->rb_node, &proc->nodes); 2964 incoming_refs = binder_node_release(node, incoming_refs); 2965 } 2966 2967 outgoing_refs = 0; 2968 while ((n = rb_first(&proc->refs_by_desc))) { 2969 struct binder_ref *ref; 2970 2971 ref = rb_entry(n, struct binder_ref, rb_node_desc); 2972 outgoing_refs++; 2973 binder_delete_ref(ref); 2974 } 2975 2976 binder_release_work(&proc->todo); 2977 binder_release_work(&proc->delivered_death); 2978 2979 buffers = 0; 2980 while ((n = rb_first(&proc->allocated_buffers))) { 2981 struct binder_buffer *buffer; 2982 2983 buffer = rb_entry(n, struct binder_buffer, rb_node); 2984 2985 t = buffer->transaction; 2986 if (t) { 2987 t->buffer = NULL; 2988 buffer->transaction = NULL; 2989 pr_err("release proc %d, transaction %d, not freed\n", 2990 proc->pid, t->debug_id); 2991 /*BUG();*/ 2992 } 2993 2994 binder_free_buf(proc, buffer); 2995 buffers++; 2996 } 2997 2998 binder_stats_deleted(BINDER_STAT_PROC); 2999 3000 page_count = 0; 3001 if (proc->pages) { 3002 int i; 3003 3004 for (i = 0; i < proc->buffer_size / PAGE_SIZE; i++) { 3005 void *page_addr; 3006 3007 if (!proc->pages[i]) 3008 continue; 3009 3010 page_addr = proc->buffer + i * PAGE_SIZE; 3011 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 3012 "%s: %d: page %d at %p not freed\n", 3013 __func__, proc->pid, i, page_addr); 3014 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE); 3015 __free_page(proc->pages[i]); 3016 page_count++; 3017 } 3018 kfree(proc->pages); 3019 vfree(proc->buffer); 3020 } 3021 3022 put_task_struct(proc->tsk); 3023 3024 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 3025 "%s: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d, buffers %d, pages %d\n", 3026 __func__, proc->pid, threads, nodes, incoming_refs, 3027 outgoing_refs, active_transactions, buffers, page_count); 3028 3029 kfree(proc); 3030} 3031 3032static void binder_deferred_func(struct work_struct *work) 3033{ 3034 struct binder_proc *proc; 3035 struct files_struct *files; 3036 3037 int defer; 3038 do { 3039 binder_lock(__func__); 3040 mutex_lock(&binder_deferred_lock); 3041 if (!hlist_empty(&binder_deferred_list)) { 3042 proc = hlist_entry(binder_deferred_list.first, 3043 struct binder_proc, deferred_work_node); 3044 hlist_del_init(&proc->deferred_work_node); 3045 defer = proc->deferred_work; 3046 proc->deferred_work = 0; 3047 } else { 3048 proc = NULL; 3049 defer = 0; 3050 } 3051 mutex_unlock(&binder_deferred_lock); 3052 3053 files = NULL; 3054 if (defer & BINDER_DEFERRED_PUT_FILES) { 3055 files = proc->files; 3056 if (files) 3057 proc->files = NULL; 3058 } 3059 3060 if (defer & BINDER_DEFERRED_FLUSH) 3061 binder_deferred_flush(proc); 3062 3063 if (defer & BINDER_DEFERRED_RELEASE) 3064 binder_deferred_release(proc); /* frees proc */ 3065 3066 binder_unlock(__func__); 3067 if (files) 3068 put_files_struct(files); 3069 } while (proc); 3070} 3071static DECLARE_WORK(binder_deferred_work, binder_deferred_func); 3072 3073static void 3074binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer) 3075{ 3076 mutex_lock(&binder_deferred_lock); 3077 proc->deferred_work |= defer; 3078 if (hlist_unhashed(&proc->deferred_work_node)) { 3079 hlist_add_head(&proc->deferred_work_node, 3080 &binder_deferred_list); 3081 queue_work(binder_deferred_workqueue, &binder_deferred_work); 3082 } 3083 mutex_unlock(&binder_deferred_lock); 3084} 3085 3086static void print_binder_transaction(struct seq_file *m, const char *prefix, 3087 struct binder_transaction *t) 3088{ 3089 seq_printf(m, 3090 "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d", 3091 prefix, t->debug_id, t, 3092 t->from ? t->from->proc->pid : 0, 3093 t->from ? t->from->pid : 0, 3094 t->to_proc ? t->to_proc->pid : 0, 3095 t->to_thread ? t->to_thread->pid : 0, 3096 t->code, t->flags, t->priority, t->need_reply); 3097 if (t->buffer == NULL) { 3098 seq_puts(m, " buffer free\n"); 3099 return; 3100 } 3101 if (t->buffer->target_node) 3102 seq_printf(m, " node %d", 3103 t->buffer->target_node->debug_id); 3104 seq_printf(m, " size %zd:%zd data %p\n", 3105 t->buffer->data_size, t->buffer->offsets_size, 3106 t->buffer->data); 3107} 3108 3109static void print_binder_buffer(struct seq_file *m, const char *prefix, 3110 struct binder_buffer *buffer) 3111{ 3112 seq_printf(m, "%s %d: %p size %zd:%zd %s\n", 3113 prefix, buffer->debug_id, buffer->data, 3114 buffer->data_size, buffer->offsets_size, 3115 buffer->transaction ? "active" : "delivered"); 3116} 3117 3118static void print_binder_work(struct seq_file *m, const char *prefix, 3119 const char *transaction_prefix, 3120 struct binder_work *w) 3121{ 3122 struct binder_node *node; 3123 struct binder_transaction *t; 3124 3125 switch (w->type) { 3126 case BINDER_WORK_TRANSACTION: 3127 t = container_of(w, struct binder_transaction, work); 3128 print_binder_transaction(m, transaction_prefix, t); 3129 break; 3130 case BINDER_WORK_TRANSACTION_COMPLETE: 3131 seq_printf(m, "%stransaction complete\n", prefix); 3132 break; 3133 case BINDER_WORK_NODE: 3134 node = container_of(w, struct binder_node, work); 3135 seq_printf(m, "%snode work %d: u%p c%p\n", 3136 prefix, node->debug_id, node->ptr, node->cookie); 3137 break; 3138 case BINDER_WORK_DEAD_BINDER: 3139 seq_printf(m, "%shas dead binder\n", prefix); 3140 break; 3141 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 3142 seq_printf(m, "%shas cleared dead binder\n", prefix); 3143 break; 3144 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: 3145 seq_printf(m, "%shas cleared death notification\n", prefix); 3146 break; 3147 default: 3148 seq_printf(m, "%sunknown work: type %d\n", prefix, w->type); 3149 break; 3150 } 3151} 3152 3153static void print_binder_thread(struct seq_file *m, 3154 struct binder_thread *thread, 3155 int print_always) 3156{ 3157 struct binder_transaction *t; 3158 struct binder_work *w; 3159 size_t start_pos = m->count; 3160 size_t header_pos; 3161 3162 seq_printf(m, " thread %d: l %02x\n", thread->pid, thread->looper); 3163 header_pos = m->count; 3164 t = thread->transaction_stack; 3165 while (t) { 3166 if (t->from == thread) { 3167 print_binder_transaction(m, 3168 " outgoing transaction", t); 3169 t = t->from_parent; 3170 } else if (t->to_thread == thread) { 3171 print_binder_transaction(m, 3172 " incoming transaction", t); 3173 t = t->to_parent; 3174 } else { 3175 print_binder_transaction(m, " bad transaction", t); 3176 t = NULL; 3177 } 3178 } 3179 list_for_each_entry(w, &thread->todo, entry) { 3180 print_binder_work(m, " ", " pending transaction", w); 3181 } 3182 if (!print_always && m->count == header_pos) 3183 m->count = start_pos; 3184} 3185 3186static void print_binder_node(struct seq_file *m, struct binder_node *node) 3187{ 3188 struct binder_ref *ref; 3189 struct binder_work *w; 3190 int count; 3191 3192 count = 0; 3193 hlist_for_each_entry(ref, &node->refs, node_entry) 3194 count++; 3195 3196 seq_printf(m, " node %d: u%p c%p hs %d hw %d ls %d lw %d is %d iw %d", 3197 node->debug_id, node->ptr, node->cookie, 3198 node->has_strong_ref, node->has_weak_ref, 3199 node->local_strong_refs, node->local_weak_refs, 3200 node->internal_strong_refs, count); 3201 if (count) { 3202 seq_puts(m, " proc"); 3203 hlist_for_each_entry(ref, &node->refs, node_entry) 3204 seq_printf(m, " %d", ref->proc->pid); 3205 } 3206 seq_puts(m, "\n"); 3207 list_for_each_entry(w, &node->async_todo, entry) 3208 print_binder_work(m, " ", 3209 " pending async transaction", w); 3210} 3211 3212static void print_binder_ref(struct seq_file *m, struct binder_ref *ref) 3213{ 3214 seq_printf(m, " ref %d: desc %d %snode %d s %d w %d d %p\n", 3215 ref->debug_id, ref->desc, ref->node->proc ? "" : "dead ", 3216 ref->node->debug_id, ref->strong, ref->weak, ref->death); 3217} 3218 3219static void print_binder_proc(struct seq_file *m, 3220 struct binder_proc *proc, int print_all) 3221{ 3222 struct binder_work *w; 3223 struct rb_node *n; 3224 size_t start_pos = m->count; 3225 size_t header_pos; 3226 3227 seq_printf(m, "proc %d\n", proc->pid); 3228 header_pos = m->count; 3229 3230 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3231 print_binder_thread(m, rb_entry(n, struct binder_thread, 3232 rb_node), print_all); 3233 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) { 3234 struct binder_node *node = rb_entry(n, struct binder_node, 3235 rb_node); 3236 if (print_all || node->has_async_transaction) 3237 print_binder_node(m, node); 3238 } 3239 if (print_all) { 3240 for (n = rb_first(&proc->refs_by_desc); 3241 n != NULL; 3242 n = rb_next(n)) 3243 print_binder_ref(m, rb_entry(n, struct binder_ref, 3244 rb_node_desc)); 3245 } 3246 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3247 print_binder_buffer(m, " buffer", 3248 rb_entry(n, struct binder_buffer, rb_node)); 3249 list_for_each_entry(w, &proc->todo, entry) 3250 print_binder_work(m, " ", " pending transaction", w); 3251 list_for_each_entry(w, &proc->delivered_death, entry) { 3252 seq_puts(m, " has delivered dead binder\n"); 3253 break; 3254 } 3255 if (!print_all && m->count == header_pos) 3256 m->count = start_pos; 3257} 3258 3259static const char * const binder_return_strings[] = { 3260 "BR_ERROR", 3261 "BR_OK", 3262 "BR_TRANSACTION", 3263 "BR_REPLY", 3264 "BR_ACQUIRE_RESULT", 3265 "BR_DEAD_REPLY", 3266 "BR_TRANSACTION_COMPLETE", 3267 "BR_INCREFS", 3268 "BR_ACQUIRE", 3269 "BR_RELEASE", 3270 "BR_DECREFS", 3271 "BR_ATTEMPT_ACQUIRE", 3272 "BR_NOOP", 3273 "BR_SPAWN_LOOPER", 3274 "BR_FINISHED", 3275 "BR_DEAD_BINDER", 3276 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 3277 "BR_FAILED_REPLY" 3278}; 3279 3280static const char * const binder_command_strings[] = { 3281 "BC_TRANSACTION", 3282 "BC_REPLY", 3283 "BC_ACQUIRE_RESULT", 3284 "BC_FREE_BUFFER", 3285 "BC_INCREFS", 3286 "BC_ACQUIRE", 3287 "BC_RELEASE", 3288 "BC_DECREFS", 3289 "BC_INCREFS_DONE", 3290 "BC_ACQUIRE_DONE", 3291 "BC_ATTEMPT_ACQUIRE", 3292 "BC_REGISTER_LOOPER", 3293 "BC_ENTER_LOOPER", 3294 "BC_EXIT_LOOPER", 3295 "BC_REQUEST_DEATH_NOTIFICATION", 3296 "BC_CLEAR_DEATH_NOTIFICATION", 3297 "BC_DEAD_BINDER_DONE" 3298}; 3299 3300static const char * const binder_objstat_strings[] = { 3301 "proc", 3302 "thread", 3303 "node", 3304 "ref", 3305 "death", 3306 "transaction", 3307 "transaction_complete" 3308}; 3309 3310static void print_binder_stats(struct seq_file *m, const char *prefix, 3311 struct binder_stats *stats) 3312{ 3313 int i; 3314 3315 BUILD_BUG_ON(ARRAY_SIZE(stats->bc) != 3316 ARRAY_SIZE(binder_command_strings)); 3317 for (i = 0; i < ARRAY_SIZE(stats->bc); i++) { 3318 if (stats->bc[i]) 3319 seq_printf(m, "%s%s: %d\n", prefix, 3320 binder_command_strings[i], stats->bc[i]); 3321 } 3322 3323 BUILD_BUG_ON(ARRAY_SIZE(stats->br) != 3324 ARRAY_SIZE(binder_return_strings)); 3325 for (i = 0; i < ARRAY_SIZE(stats->br); i++) { 3326 if (stats->br[i]) 3327 seq_printf(m, "%s%s: %d\n", prefix, 3328 binder_return_strings[i], stats->br[i]); 3329 } 3330 3331 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 3332 ARRAY_SIZE(binder_objstat_strings)); 3333 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 3334 ARRAY_SIZE(stats->obj_deleted)); 3335 for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) { 3336 if (stats->obj_created[i] || stats->obj_deleted[i]) 3337 seq_printf(m, "%s%s: active %d total %d\n", prefix, 3338 binder_objstat_strings[i], 3339 stats->obj_created[i] - stats->obj_deleted[i], 3340 stats->obj_created[i]); 3341 } 3342} 3343 3344static void print_binder_proc_stats(struct seq_file *m, 3345 struct binder_proc *proc) 3346{ 3347 struct binder_work *w; 3348 struct rb_node *n; 3349 int count, strong, weak; 3350 3351 seq_printf(m, "proc %d\n", proc->pid); 3352 count = 0; 3353 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3354 count++; 3355 seq_printf(m, " threads: %d\n", count); 3356 seq_printf(m, " requested threads: %d+%d/%d\n" 3357 " ready threads %d\n" 3358 " free async space %zd\n", proc->requested_threads, 3359 proc->requested_threads_started, proc->max_threads, 3360 proc->ready_threads, proc->free_async_space); 3361 count = 0; 3362 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) 3363 count++; 3364 seq_printf(m, " nodes: %d\n", count); 3365 count = 0; 3366 strong = 0; 3367 weak = 0; 3368 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 3369 struct binder_ref *ref = rb_entry(n, struct binder_ref, 3370 rb_node_desc); 3371 count++; 3372 strong += ref->strong; 3373 weak += ref->weak; 3374 } 3375 seq_printf(m, " refs: %d s %d w %d\n", count, strong, weak); 3376 3377 count = 0; 3378 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3379 count++; 3380 seq_printf(m, " buffers: %d\n", count); 3381 3382 count = 0; 3383 list_for_each_entry(w, &proc->todo, entry) { 3384 switch (w->type) { 3385 case BINDER_WORK_TRANSACTION: 3386 count++; 3387 break; 3388 default: 3389 break; 3390 } 3391 } 3392 seq_printf(m, " pending transactions: %d\n", count); 3393 3394 print_binder_stats(m, " ", &proc->stats); 3395} 3396 3397 3398static int binder_state_show(struct seq_file *m, void *unused) 3399{ 3400 struct binder_proc *proc; 3401 struct binder_node *node; 3402 int do_lock = !binder_debug_no_lock; 3403 3404 if (do_lock) 3405 binder_lock(__func__); 3406 3407 seq_puts(m, "binder state:\n"); 3408 3409 if (!hlist_empty(&binder_dead_nodes)) 3410 seq_puts(m, "dead nodes:\n"); 3411 hlist_for_each_entry(node, &binder_dead_nodes, dead_node) 3412 print_binder_node(m, node); 3413 3414 hlist_for_each_entry(proc, &binder_procs, proc_node) 3415 print_binder_proc(m, proc, 1); 3416 if (do_lock) 3417 binder_unlock(__func__); 3418 return 0; 3419} 3420 3421static int binder_stats_show(struct seq_file *m, void *unused) 3422{ 3423 struct binder_proc *proc; 3424 int do_lock = !binder_debug_no_lock; 3425 3426 if (do_lock) 3427 binder_lock(__func__); 3428 3429 seq_puts(m, "binder stats:\n"); 3430 3431 print_binder_stats(m, "", &binder_stats); 3432 3433 hlist_for_each_entry(proc, &binder_procs, proc_node) 3434 print_binder_proc_stats(m, proc); 3435 if (do_lock) 3436 binder_unlock(__func__); 3437 return 0; 3438} 3439 3440static int binder_transactions_show(struct seq_file *m, void *unused) 3441{ 3442 struct binder_proc *proc; 3443 int do_lock = !binder_debug_no_lock; 3444 3445 if (do_lock) 3446 binder_lock(__func__); 3447 3448 seq_puts(m, "binder transactions:\n"); 3449 hlist_for_each_entry(proc, &binder_procs, proc_node) 3450 print_binder_proc(m, proc, 0); 3451 if (do_lock) 3452 binder_unlock(__func__); 3453 return 0; 3454} 3455 3456static int binder_proc_show(struct seq_file *m, void *unused) 3457{ 3458 struct binder_proc *proc = m->private; 3459 int do_lock = !binder_debug_no_lock; 3460 3461 if (do_lock) 3462 binder_lock(__func__); 3463 seq_puts(m, "binder proc state:\n"); 3464 print_binder_proc(m, proc, 1); 3465 if (do_lock) 3466 binder_unlock(__func__); 3467 return 0; 3468} 3469 3470static void print_binder_transaction_log_entry(struct seq_file *m, 3471 struct binder_transaction_log_entry *e) 3472{ 3473 seq_printf(m, 3474 "%d: %s from %d:%d to %d:%d node %d handle %d size %d:%d\n", 3475 e->debug_id, (e->call_type == 2) ? "reply" : 3476 ((e->call_type == 1) ? "async" : "call "), e->from_proc, 3477 e->from_thread, e->to_proc, e->to_thread, e->to_node, 3478 e->target_handle, e->data_size, e->offsets_size); 3479} 3480 3481static int binder_transaction_log_show(struct seq_file *m, void *unused) 3482{ 3483 struct binder_transaction_log *log = m->private; 3484 int i; 3485 3486 if (log->full) { 3487 for (i = log->next; i < ARRAY_SIZE(log->entry); i++) 3488 print_binder_transaction_log_entry(m, &log->entry[i]); 3489 } 3490 for (i = 0; i < log->next; i++) 3491 print_binder_transaction_log_entry(m, &log->entry[i]); 3492 return 0; 3493} 3494 3495static const struct file_operations binder_fops = { 3496 .owner = THIS_MODULE, 3497 .poll = binder_poll, 3498 .unlocked_ioctl = binder_ioctl, 3499 .mmap = binder_mmap, 3500 .open = binder_open, 3501 .flush = binder_flush, 3502 .release = binder_release, 3503}; 3504 3505static struct miscdevice binder_miscdev = { 3506 .minor = MISC_DYNAMIC_MINOR, 3507 .name = "binder", 3508 .fops = &binder_fops 3509}; 3510 3511BINDER_DEBUG_ENTRY(state); 3512BINDER_DEBUG_ENTRY(stats); 3513BINDER_DEBUG_ENTRY(transactions); 3514BINDER_DEBUG_ENTRY(transaction_log); 3515 3516static int __init binder_init(void) 3517{ 3518 int ret; 3519 3520 binder_deferred_workqueue = create_singlethread_workqueue("binder"); 3521 if (!binder_deferred_workqueue) 3522 return -ENOMEM; 3523 3524 binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL); 3525 if (binder_debugfs_dir_entry_root) 3526 binder_debugfs_dir_entry_proc = debugfs_create_dir("proc", 3527 binder_debugfs_dir_entry_root); 3528 ret = misc_register(&binder_miscdev); 3529 if (binder_debugfs_dir_entry_root) { 3530 debugfs_create_file("state", 3531 S_IRUGO, 3532 binder_debugfs_dir_entry_root, 3533 NULL, 3534 &binder_state_fops); 3535 debugfs_create_file("stats", 3536 S_IRUGO, 3537 binder_debugfs_dir_entry_root, 3538 NULL, 3539 &binder_stats_fops); 3540 debugfs_create_file("transactions", 3541 S_IRUGO, 3542 binder_debugfs_dir_entry_root, 3543 NULL, 3544 &binder_transactions_fops); 3545 debugfs_create_file("transaction_log", 3546 S_IRUGO, 3547 binder_debugfs_dir_entry_root, 3548 &binder_transaction_log, 3549 &binder_transaction_log_fops); 3550 debugfs_create_file("failed_transaction_log", 3551 S_IRUGO, 3552 binder_debugfs_dir_entry_root, 3553 &binder_transaction_log_failed, 3554 &binder_transaction_log_fops); 3555 } 3556 return ret; 3557} 3558 3559device_initcall(binder_init); 3560 3561#define CREATE_TRACE_POINTS 3562#include "binder_trace.h" 3563 3564MODULE_LICENSE("GPL v2"); 3565