1/* binder.c 2 * 3 * Android IPC Subsystem 4 * 5 * Copyright (C) 2007-2008 Google, Inc. 6 * 7 * This software is licensed under the terms of the GNU General Public 8 * License version 2, as published by the Free Software Foundation, and 9 * may be copied, distributed, and modified under those terms. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 */ 17 18#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 19 20#include <asm/cacheflush.h> 21#include <linux/fdtable.h> 22#include <linux/file.h> 23#include <linux/freezer.h> 24#include <linux/fs.h> 25#include <linux/list.h> 26#include <linux/miscdevice.h> 27#include <linux/mm.h> 28#include <linux/module.h> 29#include <linux/mutex.h> 30#include <linux/nsproxy.h> 31#include <linux/poll.h> 32#include <linux/debugfs.h> 33#include <linux/rbtree.h> 34#include <linux/sched.h> 35#include <linux/seq_file.h> 36#include <linux/uaccess.h> 37#include <linux/vmalloc.h> 38#include <linux/slab.h> 39#include <linux/pid_namespace.h> 40#include <linux/security.h> 41 42#ifdef CONFIG_ANDROID_BINDER_IPC_32BIT 43#define BINDER_IPC_32BIT 1 44#endif 45 46#include <uapi/linux/android/binder.h> 47#include "binder_trace.h" 48 49static DEFINE_MUTEX(binder_main_lock); 50static DEFINE_MUTEX(binder_deferred_lock); 51static DEFINE_MUTEX(binder_mmap_lock); 52 53static HLIST_HEAD(binder_procs); 54static HLIST_HEAD(binder_deferred_list); 55static HLIST_HEAD(binder_dead_nodes); 56 57static struct dentry *binder_debugfs_dir_entry_root; 58static struct dentry *binder_debugfs_dir_entry_proc; 59static struct binder_node *binder_context_mgr_node; 60static kuid_t binder_context_mgr_uid = INVALID_UID; 61static int binder_last_id; 62static struct workqueue_struct *binder_deferred_workqueue; 63 64#define BINDER_DEBUG_ENTRY(name) \ 65static int binder_##name##_open(struct inode *inode, struct file *file) \ 66{ \ 67 return single_open(file, binder_##name##_show, inode->i_private); \ 68} \ 69\ 70static const struct file_operations binder_##name##_fops = { \ 71 .owner = THIS_MODULE, \ 72 .open = binder_##name##_open, \ 73 .read = seq_read, \ 74 .llseek = seq_lseek, \ 75 .release = single_release, \ 76} 77 78static int binder_proc_show(struct seq_file *m, void *unused); 79BINDER_DEBUG_ENTRY(proc); 80 81/* This is only defined in include/asm-arm/sizes.h */ 82#ifndef SZ_1K 83#define SZ_1K 0x400 84#endif 85 86#ifndef SZ_4M 87#define SZ_4M 0x400000 88#endif 89 90#define FORBIDDEN_MMAP_FLAGS (VM_WRITE) 91 92#define BINDER_SMALL_BUF_SIZE (PAGE_SIZE * 64) 93 94enum { 95 BINDER_DEBUG_USER_ERROR = 1U << 0, 96 BINDER_DEBUG_FAILED_TRANSACTION = 1U << 1, 97 BINDER_DEBUG_DEAD_TRANSACTION = 1U << 2, 98 BINDER_DEBUG_OPEN_CLOSE = 1U << 3, 99 BINDER_DEBUG_DEAD_BINDER = 1U << 4, 100 BINDER_DEBUG_DEATH_NOTIFICATION = 1U << 5, 101 BINDER_DEBUG_READ_WRITE = 1U << 6, 102 BINDER_DEBUG_USER_REFS = 1U << 7, 103 BINDER_DEBUG_THREADS = 1U << 8, 104 BINDER_DEBUG_TRANSACTION = 1U << 9, 105 BINDER_DEBUG_TRANSACTION_COMPLETE = 1U << 10, 106 BINDER_DEBUG_FREE_BUFFER = 1U << 11, 107 BINDER_DEBUG_INTERNAL_REFS = 1U << 12, 108 BINDER_DEBUG_BUFFER_ALLOC = 1U << 13, 109 BINDER_DEBUG_PRIORITY_CAP = 1U << 14, 110 BINDER_DEBUG_BUFFER_ALLOC_ASYNC = 1U << 15, 111}; 112static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR | 113 BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION; 114module_param_named(debug_mask, binder_debug_mask, uint, S_IWUSR | S_IRUGO); 115 116static bool binder_debug_no_lock; 117module_param_named(proc_no_lock, binder_debug_no_lock, bool, S_IWUSR | S_IRUGO); 118 119static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait); 120static int binder_stop_on_user_error; 121 122static int binder_set_stop_on_user_error(const char *val, 123 struct kernel_param *kp) 124{ 125 int ret; 126 127 ret = param_set_int(val, kp); 128 if (binder_stop_on_user_error < 2) 129 wake_up(&binder_user_error_wait); 130 return ret; 131} 132module_param_call(stop_on_user_error, binder_set_stop_on_user_error, 133 param_get_int, &binder_stop_on_user_error, S_IWUSR | S_IRUGO); 134 135#define binder_debug(mask, x...) \ 136 do { \ 137 if (binder_debug_mask & mask) \ 138 pr_info(x); \ 139 } while (0) 140 141#define binder_user_error(x...) \ 142 do { \ 143 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \ 144 pr_info(x); \ 145 if (binder_stop_on_user_error) \ 146 binder_stop_on_user_error = 2; \ 147 } while (0) 148 149enum binder_stat_types { 150 BINDER_STAT_PROC, 151 BINDER_STAT_THREAD, 152 BINDER_STAT_NODE, 153 BINDER_STAT_REF, 154 BINDER_STAT_DEATH, 155 BINDER_STAT_TRANSACTION, 156 BINDER_STAT_TRANSACTION_COMPLETE, 157 BINDER_STAT_COUNT 158}; 159 160struct binder_stats { 161 int br[_IOC_NR(BR_FAILED_REPLY) + 1]; 162 int bc[_IOC_NR(BC_DEAD_BINDER_DONE) + 1]; 163 int obj_created[BINDER_STAT_COUNT]; 164 int obj_deleted[BINDER_STAT_COUNT]; 165}; 166 167static struct binder_stats binder_stats; 168 169static inline void binder_stats_deleted(enum binder_stat_types type) 170{ 171 binder_stats.obj_deleted[type]++; 172} 173 174static inline void binder_stats_created(enum binder_stat_types type) 175{ 176 binder_stats.obj_created[type]++; 177} 178 179struct binder_transaction_log_entry { 180 int debug_id; 181 int call_type; 182 int from_proc; 183 int from_thread; 184 int target_handle; 185 int to_proc; 186 int to_thread; 187 int to_node; 188 int data_size; 189 int offsets_size; 190}; 191struct binder_transaction_log { 192 int next; 193 int full; 194 struct binder_transaction_log_entry entry[32]; 195}; 196static struct binder_transaction_log binder_transaction_log; 197static struct binder_transaction_log binder_transaction_log_failed; 198 199static struct binder_transaction_log_entry *binder_transaction_log_add( 200 struct binder_transaction_log *log) 201{ 202 struct binder_transaction_log_entry *e; 203 204 e = &log->entry[log->next]; 205 memset(e, 0, sizeof(*e)); 206 log->next++; 207 if (log->next == ARRAY_SIZE(log->entry)) { 208 log->next = 0; 209 log->full = 1; 210 } 211 return e; 212} 213 214struct binder_work { 215 struct list_head entry; 216 enum { 217 BINDER_WORK_TRANSACTION = 1, 218 BINDER_WORK_TRANSACTION_COMPLETE, 219 BINDER_WORK_NODE, 220 BINDER_WORK_DEAD_BINDER, 221 BINDER_WORK_DEAD_BINDER_AND_CLEAR, 222 BINDER_WORK_CLEAR_DEATH_NOTIFICATION, 223 } type; 224}; 225 226struct binder_node { 227 int debug_id; 228 struct binder_work work; 229 union { 230 struct rb_node rb_node; 231 struct hlist_node dead_node; 232 }; 233 struct binder_proc *proc; 234 struct hlist_head refs; 235 int internal_strong_refs; 236 int local_weak_refs; 237 int local_strong_refs; 238 binder_uintptr_t ptr; 239 binder_uintptr_t cookie; 240 unsigned has_strong_ref:1; 241 unsigned pending_strong_ref:1; 242 unsigned has_weak_ref:1; 243 unsigned pending_weak_ref:1; 244 unsigned has_async_transaction:1; 245 unsigned accept_fds:1; 246 unsigned min_priority:8; 247 struct list_head async_todo; 248}; 249 250struct binder_ref_death { 251 struct binder_work work; 252 binder_uintptr_t cookie; 253}; 254 255struct binder_ref { 256 /* Lookups needed: */ 257 /* node + proc => ref (transaction) */ 258 /* desc + proc => ref (transaction, inc/dec ref) */ 259 /* node => refs + procs (proc exit) */ 260 int debug_id; 261 struct rb_node rb_node_desc; 262 struct rb_node rb_node_node; 263 struct hlist_node node_entry; 264 struct binder_proc *proc; 265 struct binder_node *node; 266 uint32_t desc; 267 int strong; 268 int weak; 269 struct binder_ref_death *death; 270}; 271 272struct binder_buffer { 273 struct list_head entry; /* free and allocated entries by address */ 274 struct rb_node rb_node; /* free entry by size or allocated entry */ 275 /* by address */ 276 unsigned free:1; 277 unsigned allow_user_free:1; 278 unsigned async_transaction:1; 279 unsigned debug_id:29; 280 281 struct binder_transaction *transaction; 282 283 struct binder_node *target_node; 284 size_t data_size; 285 size_t offsets_size; 286 uint8_t data[0]; 287}; 288 289enum binder_deferred_state { 290 BINDER_DEFERRED_PUT_FILES = 0x01, 291 BINDER_DEFERRED_FLUSH = 0x02, 292 BINDER_DEFERRED_RELEASE = 0x04, 293}; 294 295struct binder_proc { 296 struct hlist_node proc_node; 297 struct rb_root threads; 298 struct rb_root nodes; 299 struct rb_root refs_by_desc; 300 struct rb_root refs_by_node; 301 int pid; 302 struct vm_area_struct *vma; 303 struct mm_struct *vma_vm_mm; 304 struct task_struct *tsk; 305 struct files_struct *files; 306 struct hlist_node deferred_work_node; 307 int deferred_work; 308 void *buffer; 309 ptrdiff_t user_buffer_offset; 310 311 struct list_head buffers; 312 struct rb_root free_buffers; 313 struct rb_root allocated_buffers; 314 size_t free_async_space; 315 316 struct page **pages; 317 size_t buffer_size; 318 uint32_t buffer_free; 319 struct list_head todo; 320 wait_queue_head_t wait; 321 struct binder_stats stats; 322 struct list_head delivered_death; 323 int max_threads; 324 int requested_threads; 325 int requested_threads_started; 326 int ready_threads; 327 long default_priority; 328 struct dentry *debugfs_entry; 329}; 330 331enum { 332 BINDER_LOOPER_STATE_REGISTERED = 0x01, 333 BINDER_LOOPER_STATE_ENTERED = 0x02, 334 BINDER_LOOPER_STATE_EXITED = 0x04, 335 BINDER_LOOPER_STATE_INVALID = 0x08, 336 BINDER_LOOPER_STATE_WAITING = 0x10, 337 BINDER_LOOPER_STATE_NEED_RETURN = 0x20 338}; 339 340struct binder_thread { 341 struct binder_proc *proc; 342 struct rb_node rb_node; 343 int pid; 344 int looper; 345 struct binder_transaction *transaction_stack; 346 struct list_head todo; 347 uint32_t return_error; /* Write failed, return error code in read buf */ 348 uint32_t return_error2; /* Write failed, return error code in read */ 349 /* buffer. Used when sending a reply to a dead process that */ 350 /* we are also waiting on */ 351 wait_queue_head_t wait; 352 struct binder_stats stats; 353}; 354 355struct binder_transaction { 356 int debug_id; 357 struct binder_work work; 358 struct binder_thread *from; 359 struct binder_transaction *from_parent; 360 struct binder_proc *to_proc; 361 struct binder_thread *to_thread; 362 struct binder_transaction *to_parent; 363 unsigned need_reply:1; 364 /* unsigned is_dead:1; */ /* not used at the moment */ 365 366 struct binder_buffer *buffer; 367 unsigned int code; 368 unsigned int flags; 369 long priority; 370 long saved_priority; 371 kuid_t sender_euid; 372}; 373 374static void 375binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer); 376 377static int task_get_unused_fd_flags(struct binder_proc *proc, int flags) 378{ 379 struct files_struct *files = proc->files; 380 unsigned long rlim_cur; 381 unsigned long irqs; 382 383 if (files == NULL) 384 return -ESRCH; 385 386 if (!lock_task_sighand(proc->tsk, &irqs)) 387 return -EMFILE; 388 389 rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE); 390 unlock_task_sighand(proc->tsk, &irqs); 391 392 return __alloc_fd(files, 0, rlim_cur, flags); 393} 394 395/* 396 * copied from fd_install 397 */ 398static void task_fd_install( 399 struct binder_proc *proc, unsigned int fd, struct file *file) 400{ 401 if (proc->files) 402 __fd_install(proc->files, fd, file); 403} 404 405/* 406 * copied from sys_close 407 */ 408static long task_close_fd(struct binder_proc *proc, unsigned int fd) 409{ 410 int retval; 411 412 if (proc->files == NULL) 413 return -ESRCH; 414 415 retval = __close_fd(proc->files, fd); 416 /* can't restart close syscall because file table entry was cleared */ 417 if (unlikely(retval == -ERESTARTSYS || 418 retval == -ERESTARTNOINTR || 419 retval == -ERESTARTNOHAND || 420 retval == -ERESTART_RESTARTBLOCK)) 421 retval = -EINTR; 422 423 return retval; 424} 425 426static inline void binder_lock(const char *tag) 427{ 428 trace_binder_lock(tag); 429 mutex_lock(&binder_main_lock); 430 trace_binder_locked(tag); 431} 432 433static inline void binder_unlock(const char *tag) 434{ 435 trace_binder_unlock(tag); 436 mutex_unlock(&binder_main_lock); 437} 438 439static void binder_set_nice(long nice) 440{ 441 long min_nice; 442 443 if (can_nice(current, nice)) { 444 set_user_nice(current, nice); 445 return; 446 } 447 min_nice = rlimit_to_nice(current->signal->rlim[RLIMIT_NICE].rlim_cur); 448 binder_debug(BINDER_DEBUG_PRIORITY_CAP, 449 "%d: nice value %ld not allowed use %ld instead\n", 450 current->pid, nice, min_nice); 451 set_user_nice(current, min_nice); 452 if (min_nice <= MAX_NICE) 453 return; 454 binder_user_error("%d RLIMIT_NICE not set\n", current->pid); 455} 456 457static size_t binder_buffer_size(struct binder_proc *proc, 458 struct binder_buffer *buffer) 459{ 460 if (list_is_last(&buffer->entry, &proc->buffers)) 461 return proc->buffer + proc->buffer_size - (void *)buffer->data; 462 return (size_t)list_entry(buffer->entry.next, 463 struct binder_buffer, entry) - (size_t)buffer->data; 464} 465 466static void binder_insert_free_buffer(struct binder_proc *proc, 467 struct binder_buffer *new_buffer) 468{ 469 struct rb_node **p = &proc->free_buffers.rb_node; 470 struct rb_node *parent = NULL; 471 struct binder_buffer *buffer; 472 size_t buffer_size; 473 size_t new_buffer_size; 474 475 BUG_ON(!new_buffer->free); 476 477 new_buffer_size = binder_buffer_size(proc, new_buffer); 478 479 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 480 "%d: add free buffer, size %zd, at %p\n", 481 proc->pid, new_buffer_size, new_buffer); 482 483 while (*p) { 484 parent = *p; 485 buffer = rb_entry(parent, struct binder_buffer, rb_node); 486 BUG_ON(!buffer->free); 487 488 buffer_size = binder_buffer_size(proc, buffer); 489 490 if (new_buffer_size < buffer_size) 491 p = &parent->rb_left; 492 else 493 p = &parent->rb_right; 494 } 495 rb_link_node(&new_buffer->rb_node, parent, p); 496 rb_insert_color(&new_buffer->rb_node, &proc->free_buffers); 497} 498 499static void binder_insert_allocated_buffer(struct binder_proc *proc, 500 struct binder_buffer *new_buffer) 501{ 502 struct rb_node **p = &proc->allocated_buffers.rb_node; 503 struct rb_node *parent = NULL; 504 struct binder_buffer *buffer; 505 506 BUG_ON(new_buffer->free); 507 508 while (*p) { 509 parent = *p; 510 buffer = rb_entry(parent, struct binder_buffer, rb_node); 511 BUG_ON(buffer->free); 512 513 if (new_buffer < buffer) 514 p = &parent->rb_left; 515 else if (new_buffer > buffer) 516 p = &parent->rb_right; 517 else 518 BUG(); 519 } 520 rb_link_node(&new_buffer->rb_node, parent, p); 521 rb_insert_color(&new_buffer->rb_node, &proc->allocated_buffers); 522} 523 524static struct binder_buffer *binder_buffer_lookup(struct binder_proc *proc, 525 uintptr_t user_ptr) 526{ 527 struct rb_node *n = proc->allocated_buffers.rb_node; 528 struct binder_buffer *buffer; 529 struct binder_buffer *kern_ptr; 530 531 kern_ptr = (struct binder_buffer *)(user_ptr - proc->user_buffer_offset 532 - offsetof(struct binder_buffer, data)); 533 534 while (n) { 535 buffer = rb_entry(n, struct binder_buffer, rb_node); 536 BUG_ON(buffer->free); 537 538 if (kern_ptr < buffer) 539 n = n->rb_left; 540 else if (kern_ptr > buffer) 541 n = n->rb_right; 542 else 543 return buffer; 544 } 545 return NULL; 546} 547 548static int binder_update_page_range(struct binder_proc *proc, int allocate, 549 void *start, void *end, 550 struct vm_area_struct *vma) 551{ 552 void *page_addr; 553 unsigned long user_page_addr; 554 struct page **page; 555 struct mm_struct *mm; 556 557 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 558 "%d: %s pages %p-%p\n", proc->pid, 559 allocate ? "allocate" : "free", start, end); 560 561 if (end <= start) 562 return 0; 563 564 trace_binder_update_page_range(proc, allocate, start, end); 565 566 if (vma) 567 mm = NULL; 568 else 569 mm = get_task_mm(proc->tsk); 570 571 if (mm) { 572 down_write(&mm->mmap_sem); 573 vma = proc->vma; 574 if (vma && mm != proc->vma_vm_mm) { 575 pr_err("%d: vma mm and task mm mismatch\n", 576 proc->pid); 577 vma = NULL; 578 } 579 } 580 581 if (allocate == 0) 582 goto free_range; 583 584 if (vma == NULL) { 585 pr_err("%d: binder_alloc_buf failed to map pages in userspace, no vma\n", 586 proc->pid); 587 goto err_no_vma; 588 } 589 590 for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) { 591 int ret; 592 593 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 594 595 BUG_ON(*page); 596 *page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO); 597 if (*page == NULL) { 598 pr_err("%d: binder_alloc_buf failed for page at %p\n", 599 proc->pid, page_addr); 600 goto err_alloc_page_failed; 601 } 602 ret = map_kernel_range_noflush((unsigned long)page_addr, 603 PAGE_SIZE, PAGE_KERNEL, page); 604 flush_cache_vmap((unsigned long)page_addr, 605 (unsigned long)page_addr + PAGE_SIZE); 606 if (ret != 1) { 607 pr_err("%d: binder_alloc_buf failed to map page at %p in kernel\n", 608 proc->pid, page_addr); 609 goto err_map_kernel_failed; 610 } 611 user_page_addr = 612 (uintptr_t)page_addr + proc->user_buffer_offset; 613 ret = vm_insert_page(vma, user_page_addr, page[0]); 614 if (ret) { 615 pr_err("%d: binder_alloc_buf failed to map page at %lx in userspace\n", 616 proc->pid, user_page_addr); 617 goto err_vm_insert_page_failed; 618 } 619 /* vm_insert_page does not seem to increment the refcount */ 620 } 621 if (mm) { 622 up_write(&mm->mmap_sem); 623 mmput(mm); 624 } 625 return 0; 626 627free_range: 628 for (page_addr = end - PAGE_SIZE; page_addr >= start; 629 page_addr -= PAGE_SIZE) { 630 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 631 if (vma) 632 zap_page_range(vma, (uintptr_t)page_addr + 633 proc->user_buffer_offset, PAGE_SIZE, NULL); 634err_vm_insert_page_failed: 635 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE); 636err_map_kernel_failed: 637 __free_page(*page); 638 *page = NULL; 639err_alloc_page_failed: 640 ; 641 } 642err_no_vma: 643 if (mm) { 644 up_write(&mm->mmap_sem); 645 mmput(mm); 646 } 647 return -ENOMEM; 648} 649 650static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc, 651 size_t data_size, 652 size_t offsets_size, int is_async) 653{ 654 struct rb_node *n = proc->free_buffers.rb_node; 655 struct binder_buffer *buffer; 656 size_t buffer_size; 657 struct rb_node *best_fit = NULL; 658 void *has_page_addr; 659 void *end_page_addr; 660 size_t size; 661 662 if (proc->vma == NULL) { 663 pr_err("%d: binder_alloc_buf, no vma\n", 664 proc->pid); 665 return NULL; 666 } 667 668 size = ALIGN(data_size, sizeof(void *)) + 669 ALIGN(offsets_size, sizeof(void *)); 670 671 if (size < data_size || size < offsets_size) { 672 binder_user_error("%d: got transaction with invalid size %zd-%zd\n", 673 proc->pid, data_size, offsets_size); 674 return NULL; 675 } 676 677 if (is_async && 678 proc->free_async_space < size + sizeof(struct binder_buffer)) { 679 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 680 "%d: binder_alloc_buf size %zd failed, no async space left\n", 681 proc->pid, size); 682 return NULL; 683 } 684 685 while (n) { 686 buffer = rb_entry(n, struct binder_buffer, rb_node); 687 BUG_ON(!buffer->free); 688 buffer_size = binder_buffer_size(proc, buffer); 689 690 if (size < buffer_size) { 691 best_fit = n; 692 n = n->rb_left; 693 } else if (size > buffer_size) 694 n = n->rb_right; 695 else { 696 best_fit = n; 697 break; 698 } 699 } 700 if (best_fit == NULL) { 701 pr_err("%d: binder_alloc_buf size %zd failed, no address space\n", 702 proc->pid, size); 703 return NULL; 704 } 705 if (n == NULL) { 706 buffer = rb_entry(best_fit, struct binder_buffer, rb_node); 707 buffer_size = binder_buffer_size(proc, buffer); 708 } 709 710 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 711 "%d: binder_alloc_buf size %zd got buffer %p size %zd\n", 712 proc->pid, size, buffer, buffer_size); 713 714 has_page_addr = 715 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK); 716 if (n == NULL) { 717 if (size + sizeof(struct binder_buffer) + 4 >= buffer_size) 718 buffer_size = size; /* no room for other buffers */ 719 else 720 buffer_size = size + sizeof(struct binder_buffer); 721 } 722 end_page_addr = 723 (void *)PAGE_ALIGN((uintptr_t)buffer->data + buffer_size); 724 if (end_page_addr > has_page_addr) 725 end_page_addr = has_page_addr; 726 if (binder_update_page_range(proc, 1, 727 (void *)PAGE_ALIGN((uintptr_t)buffer->data), end_page_addr, NULL)) 728 return NULL; 729 730 rb_erase(best_fit, &proc->free_buffers); 731 buffer->free = 0; 732 binder_insert_allocated_buffer(proc, buffer); 733 if (buffer_size != size) { 734 struct binder_buffer *new_buffer = (void *)buffer->data + size; 735 736 list_add(&new_buffer->entry, &buffer->entry); 737 new_buffer->free = 1; 738 binder_insert_free_buffer(proc, new_buffer); 739 } 740 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 741 "%d: binder_alloc_buf size %zd got %p\n", 742 proc->pid, size, buffer); 743 buffer->data_size = data_size; 744 buffer->offsets_size = offsets_size; 745 buffer->async_transaction = is_async; 746 if (is_async) { 747 proc->free_async_space -= size + sizeof(struct binder_buffer); 748 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 749 "%d: binder_alloc_buf size %zd async free %zd\n", 750 proc->pid, size, proc->free_async_space); 751 } 752 753 return buffer; 754} 755 756static void *buffer_start_page(struct binder_buffer *buffer) 757{ 758 return (void *)((uintptr_t)buffer & PAGE_MASK); 759} 760 761static void *buffer_end_page(struct binder_buffer *buffer) 762{ 763 return (void *)(((uintptr_t)(buffer + 1) - 1) & PAGE_MASK); 764} 765 766static void binder_delete_free_buffer(struct binder_proc *proc, 767 struct binder_buffer *buffer) 768{ 769 struct binder_buffer *prev, *next = NULL; 770 int free_page_end = 1; 771 int free_page_start = 1; 772 773 BUG_ON(proc->buffers.next == &buffer->entry); 774 prev = list_entry(buffer->entry.prev, struct binder_buffer, entry); 775 BUG_ON(!prev->free); 776 if (buffer_end_page(prev) == buffer_start_page(buffer)) { 777 free_page_start = 0; 778 if (buffer_end_page(prev) == buffer_end_page(buffer)) 779 free_page_end = 0; 780 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 781 "%d: merge free, buffer %p share page with %p\n", 782 proc->pid, buffer, prev); 783 } 784 785 if (!list_is_last(&buffer->entry, &proc->buffers)) { 786 next = list_entry(buffer->entry.next, 787 struct binder_buffer, entry); 788 if (buffer_start_page(next) == buffer_end_page(buffer)) { 789 free_page_end = 0; 790 if (buffer_start_page(next) == 791 buffer_start_page(buffer)) 792 free_page_start = 0; 793 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 794 "%d: merge free, buffer %p share page with %p\n", 795 proc->pid, buffer, prev); 796 } 797 } 798 list_del(&buffer->entry); 799 if (free_page_start || free_page_end) { 800 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 801 "%d: merge free, buffer %p do not share page%s%s with %p or %p\n", 802 proc->pid, buffer, free_page_start ? "" : " end", 803 free_page_end ? "" : " start", prev, next); 804 binder_update_page_range(proc, 0, free_page_start ? 805 buffer_start_page(buffer) : buffer_end_page(buffer), 806 (free_page_end ? buffer_end_page(buffer) : 807 buffer_start_page(buffer)) + PAGE_SIZE, NULL); 808 } 809} 810 811static void binder_free_buf(struct binder_proc *proc, 812 struct binder_buffer *buffer) 813{ 814 size_t size, buffer_size; 815 816 buffer_size = binder_buffer_size(proc, buffer); 817 818 size = ALIGN(buffer->data_size, sizeof(void *)) + 819 ALIGN(buffer->offsets_size, sizeof(void *)); 820 821 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 822 "%d: binder_free_buf %p size %zd buffer_size %zd\n", 823 proc->pid, buffer, size, buffer_size); 824 825 BUG_ON(buffer->free); 826 BUG_ON(size > buffer_size); 827 BUG_ON(buffer->transaction != NULL); 828 BUG_ON((void *)buffer < proc->buffer); 829 BUG_ON((void *)buffer > proc->buffer + proc->buffer_size); 830 831 if (buffer->async_transaction) { 832 proc->free_async_space += size + sizeof(struct binder_buffer); 833 834 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 835 "%d: binder_free_buf size %zd async free %zd\n", 836 proc->pid, size, proc->free_async_space); 837 } 838 839 binder_update_page_range(proc, 0, 840 (void *)PAGE_ALIGN((uintptr_t)buffer->data), 841 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK), 842 NULL); 843 rb_erase(&buffer->rb_node, &proc->allocated_buffers); 844 buffer->free = 1; 845 if (!list_is_last(&buffer->entry, &proc->buffers)) { 846 struct binder_buffer *next = list_entry(buffer->entry.next, 847 struct binder_buffer, entry); 848 849 if (next->free) { 850 rb_erase(&next->rb_node, &proc->free_buffers); 851 binder_delete_free_buffer(proc, next); 852 } 853 } 854 if (proc->buffers.next != &buffer->entry) { 855 struct binder_buffer *prev = list_entry(buffer->entry.prev, 856 struct binder_buffer, entry); 857 858 if (prev->free) { 859 binder_delete_free_buffer(proc, buffer); 860 rb_erase(&prev->rb_node, &proc->free_buffers); 861 buffer = prev; 862 } 863 } 864 binder_insert_free_buffer(proc, buffer); 865} 866 867static struct binder_node *binder_get_node(struct binder_proc *proc, 868 binder_uintptr_t ptr) 869{ 870 struct rb_node *n = proc->nodes.rb_node; 871 struct binder_node *node; 872 873 while (n) { 874 node = rb_entry(n, struct binder_node, rb_node); 875 876 if (ptr < node->ptr) 877 n = n->rb_left; 878 else if (ptr > node->ptr) 879 n = n->rb_right; 880 else 881 return node; 882 } 883 return NULL; 884} 885 886static struct binder_node *binder_new_node(struct binder_proc *proc, 887 binder_uintptr_t ptr, 888 binder_uintptr_t cookie) 889{ 890 struct rb_node **p = &proc->nodes.rb_node; 891 struct rb_node *parent = NULL; 892 struct binder_node *node; 893 894 while (*p) { 895 parent = *p; 896 node = rb_entry(parent, struct binder_node, rb_node); 897 898 if (ptr < node->ptr) 899 p = &(*p)->rb_left; 900 else if (ptr > node->ptr) 901 p = &(*p)->rb_right; 902 else 903 return NULL; 904 } 905 906 node = kzalloc(sizeof(*node), GFP_KERNEL); 907 if (node == NULL) 908 return NULL; 909 binder_stats_created(BINDER_STAT_NODE); 910 rb_link_node(&node->rb_node, parent, p); 911 rb_insert_color(&node->rb_node, &proc->nodes); 912 node->debug_id = ++binder_last_id; 913 node->proc = proc; 914 node->ptr = ptr; 915 node->cookie = cookie; 916 node->work.type = BINDER_WORK_NODE; 917 INIT_LIST_HEAD(&node->work.entry); 918 INIT_LIST_HEAD(&node->async_todo); 919 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 920 "%d:%d node %d u%016llx c%016llx created\n", 921 proc->pid, current->pid, node->debug_id, 922 (u64)node->ptr, (u64)node->cookie); 923 return node; 924} 925 926static int binder_inc_node(struct binder_node *node, int strong, int internal, 927 struct list_head *target_list) 928{ 929 if (strong) { 930 if (internal) { 931 if (target_list == NULL && 932 node->internal_strong_refs == 0 && 933 !(node == binder_context_mgr_node && 934 node->has_strong_ref)) { 935 pr_err("invalid inc strong node for %d\n", 936 node->debug_id); 937 return -EINVAL; 938 } 939 node->internal_strong_refs++; 940 } else 941 node->local_strong_refs++; 942 if (!node->has_strong_ref && target_list) { 943 list_del_init(&node->work.entry); 944 list_add_tail(&node->work.entry, target_list); 945 } 946 } else { 947 if (!internal) 948 node->local_weak_refs++; 949 if (!node->has_weak_ref && list_empty(&node->work.entry)) { 950 if (target_list == NULL) { 951 pr_err("invalid inc weak node for %d\n", 952 node->debug_id); 953 return -EINVAL; 954 } 955 list_add_tail(&node->work.entry, target_list); 956 } 957 } 958 return 0; 959} 960 961static int binder_dec_node(struct binder_node *node, int strong, int internal) 962{ 963 if (strong) { 964 if (internal) 965 node->internal_strong_refs--; 966 else 967 node->local_strong_refs--; 968 if (node->local_strong_refs || node->internal_strong_refs) 969 return 0; 970 } else { 971 if (!internal) 972 node->local_weak_refs--; 973 if (node->local_weak_refs || !hlist_empty(&node->refs)) 974 return 0; 975 } 976 if (node->proc && (node->has_strong_ref || node->has_weak_ref)) { 977 if (list_empty(&node->work.entry)) { 978 list_add_tail(&node->work.entry, &node->proc->todo); 979 wake_up_interruptible(&node->proc->wait); 980 } 981 } else { 982 if (hlist_empty(&node->refs) && !node->local_strong_refs && 983 !node->local_weak_refs) { 984 list_del_init(&node->work.entry); 985 if (node->proc) { 986 rb_erase(&node->rb_node, &node->proc->nodes); 987 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 988 "refless node %d deleted\n", 989 node->debug_id); 990 } else { 991 hlist_del(&node->dead_node); 992 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 993 "dead node %d deleted\n", 994 node->debug_id); 995 } 996 kfree(node); 997 binder_stats_deleted(BINDER_STAT_NODE); 998 } 999 } 1000 1001 return 0; 1002} 1003 1004 1005static struct binder_ref *binder_get_ref(struct binder_proc *proc, 1006 uint32_t desc) 1007{ 1008 struct rb_node *n = proc->refs_by_desc.rb_node; 1009 struct binder_ref *ref; 1010 1011 while (n) { 1012 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1013 1014 if (desc < ref->desc) 1015 n = n->rb_left; 1016 else if (desc > ref->desc) 1017 n = n->rb_right; 1018 else 1019 return ref; 1020 } 1021 return NULL; 1022} 1023 1024static struct binder_ref *binder_get_ref_for_node(struct binder_proc *proc, 1025 struct binder_node *node) 1026{ 1027 struct rb_node *n; 1028 struct rb_node **p = &proc->refs_by_node.rb_node; 1029 struct rb_node *parent = NULL; 1030 struct binder_ref *ref, *new_ref; 1031 1032 while (*p) { 1033 parent = *p; 1034 ref = rb_entry(parent, struct binder_ref, rb_node_node); 1035 1036 if (node < ref->node) 1037 p = &(*p)->rb_left; 1038 else if (node > ref->node) 1039 p = &(*p)->rb_right; 1040 else 1041 return ref; 1042 } 1043 new_ref = kzalloc(sizeof(*ref), GFP_KERNEL); 1044 if (new_ref == NULL) 1045 return NULL; 1046 binder_stats_created(BINDER_STAT_REF); 1047 new_ref->debug_id = ++binder_last_id; 1048 new_ref->proc = proc; 1049 new_ref->node = node; 1050 rb_link_node(&new_ref->rb_node_node, parent, p); 1051 rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node); 1052 1053 new_ref->desc = (node == binder_context_mgr_node) ? 0 : 1; 1054 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 1055 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1056 if (ref->desc > new_ref->desc) 1057 break; 1058 new_ref->desc = ref->desc + 1; 1059 } 1060 1061 p = &proc->refs_by_desc.rb_node; 1062 while (*p) { 1063 parent = *p; 1064 ref = rb_entry(parent, struct binder_ref, rb_node_desc); 1065 1066 if (new_ref->desc < ref->desc) 1067 p = &(*p)->rb_left; 1068 else if (new_ref->desc > ref->desc) 1069 p = &(*p)->rb_right; 1070 else 1071 BUG(); 1072 } 1073 rb_link_node(&new_ref->rb_node_desc, parent, p); 1074 rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc); 1075 if (node) { 1076 hlist_add_head(&new_ref->node_entry, &node->refs); 1077 1078 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1079 "%d new ref %d desc %d for node %d\n", 1080 proc->pid, new_ref->debug_id, new_ref->desc, 1081 node->debug_id); 1082 } else { 1083 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1084 "%d new ref %d desc %d for dead node\n", 1085 proc->pid, new_ref->debug_id, new_ref->desc); 1086 } 1087 return new_ref; 1088} 1089 1090static void binder_delete_ref(struct binder_ref *ref) 1091{ 1092 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1093 "%d delete ref %d desc %d for node %d\n", 1094 ref->proc->pid, ref->debug_id, ref->desc, 1095 ref->node->debug_id); 1096 1097 rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc); 1098 rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node); 1099 if (ref->strong) 1100 binder_dec_node(ref->node, 1, 1); 1101 hlist_del(&ref->node_entry); 1102 binder_dec_node(ref->node, 0, 1); 1103 if (ref->death) { 1104 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1105 "%d delete ref %d desc %d has death notification\n", 1106 ref->proc->pid, ref->debug_id, ref->desc); 1107 list_del(&ref->death->work.entry); 1108 kfree(ref->death); 1109 binder_stats_deleted(BINDER_STAT_DEATH); 1110 } 1111 kfree(ref); 1112 binder_stats_deleted(BINDER_STAT_REF); 1113} 1114 1115static int binder_inc_ref(struct binder_ref *ref, int strong, 1116 struct list_head *target_list) 1117{ 1118 int ret; 1119 1120 if (strong) { 1121 if (ref->strong == 0) { 1122 ret = binder_inc_node(ref->node, 1, 1, target_list); 1123 if (ret) 1124 return ret; 1125 } 1126 ref->strong++; 1127 } else { 1128 if (ref->weak == 0) { 1129 ret = binder_inc_node(ref->node, 0, 1, target_list); 1130 if (ret) 1131 return ret; 1132 } 1133 ref->weak++; 1134 } 1135 return 0; 1136} 1137 1138 1139static int binder_dec_ref(struct binder_ref *ref, int strong) 1140{ 1141 if (strong) { 1142 if (ref->strong == 0) { 1143 binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n", 1144 ref->proc->pid, ref->debug_id, 1145 ref->desc, ref->strong, ref->weak); 1146 return -EINVAL; 1147 } 1148 ref->strong--; 1149 if (ref->strong == 0) { 1150 int ret; 1151 1152 ret = binder_dec_node(ref->node, strong, 1); 1153 if (ret) 1154 return ret; 1155 } 1156 } else { 1157 if (ref->weak == 0) { 1158 binder_user_error("%d invalid dec weak, ref %d desc %d s %d w %d\n", 1159 ref->proc->pid, ref->debug_id, 1160 ref->desc, ref->strong, ref->weak); 1161 return -EINVAL; 1162 } 1163 ref->weak--; 1164 } 1165 if (ref->strong == 0 && ref->weak == 0) 1166 binder_delete_ref(ref); 1167 return 0; 1168} 1169 1170static void binder_pop_transaction(struct binder_thread *target_thread, 1171 struct binder_transaction *t) 1172{ 1173 if (target_thread) { 1174 BUG_ON(target_thread->transaction_stack != t); 1175 BUG_ON(target_thread->transaction_stack->from != target_thread); 1176 target_thread->transaction_stack = 1177 target_thread->transaction_stack->from_parent; 1178 t->from = NULL; 1179 } 1180 t->need_reply = 0; 1181 if (t->buffer) 1182 t->buffer->transaction = NULL; 1183 kfree(t); 1184 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1185} 1186 1187static void binder_send_failed_reply(struct binder_transaction *t, 1188 uint32_t error_code) 1189{ 1190 struct binder_thread *target_thread; 1191 struct binder_transaction *next; 1192 1193 BUG_ON(t->flags & TF_ONE_WAY); 1194 while (1) { 1195 target_thread = t->from; 1196 if (target_thread) { 1197 if (target_thread->return_error != BR_OK && 1198 target_thread->return_error2 == BR_OK) { 1199 target_thread->return_error2 = 1200 target_thread->return_error; 1201 target_thread->return_error = BR_OK; 1202 } 1203 if (target_thread->return_error == BR_OK) { 1204 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1205 "send failed reply for transaction %d to %d:%d\n", 1206 t->debug_id, 1207 target_thread->proc->pid, 1208 target_thread->pid); 1209 1210 binder_pop_transaction(target_thread, t); 1211 target_thread->return_error = error_code; 1212 wake_up_interruptible(&target_thread->wait); 1213 } else { 1214 pr_err("reply failed, target thread, %d:%d, has error code %d already\n", 1215 target_thread->proc->pid, 1216 target_thread->pid, 1217 target_thread->return_error); 1218 } 1219 return; 1220 } 1221 next = t->from_parent; 1222 1223 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1224 "send failed reply for transaction %d, target dead\n", 1225 t->debug_id); 1226 1227 binder_pop_transaction(target_thread, t); 1228 if (next == NULL) { 1229 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1230 "reply failed, no target thread at root\n"); 1231 return; 1232 } 1233 t = next; 1234 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1235 "reply failed, no target thread -- retry %d\n", 1236 t->debug_id); 1237 } 1238} 1239 1240static void binder_transaction_buffer_release(struct binder_proc *proc, 1241 struct binder_buffer *buffer, 1242 binder_size_t *failed_at) 1243{ 1244 binder_size_t *offp, *off_end; 1245 int debug_id = buffer->debug_id; 1246 1247 binder_debug(BINDER_DEBUG_TRANSACTION, 1248 "%d buffer release %d, size %zd-%zd, failed at %p\n", 1249 proc->pid, buffer->debug_id, 1250 buffer->data_size, buffer->offsets_size, failed_at); 1251 1252 if (buffer->target_node) 1253 binder_dec_node(buffer->target_node, 1, 0); 1254 1255 offp = (binder_size_t *)(buffer->data + 1256 ALIGN(buffer->data_size, sizeof(void *))); 1257 if (failed_at) 1258 off_end = failed_at; 1259 else 1260 off_end = (void *)offp + buffer->offsets_size; 1261 for (; offp < off_end; offp++) { 1262 struct flat_binder_object *fp; 1263 1264 if (*offp > buffer->data_size - sizeof(*fp) || 1265 buffer->data_size < sizeof(*fp) || 1266 !IS_ALIGNED(*offp, sizeof(u32))) { 1267 pr_err("transaction release %d bad offset %lld, size %zd\n", 1268 debug_id, (u64)*offp, buffer->data_size); 1269 continue; 1270 } 1271 fp = (struct flat_binder_object *)(buffer->data + *offp); 1272 switch (fp->type) { 1273 case BINDER_TYPE_BINDER: 1274 case BINDER_TYPE_WEAK_BINDER: { 1275 struct binder_node *node = binder_get_node(proc, fp->binder); 1276 1277 if (node == NULL) { 1278 pr_err("transaction release %d bad node %016llx\n", 1279 debug_id, (u64)fp->binder); 1280 break; 1281 } 1282 binder_debug(BINDER_DEBUG_TRANSACTION, 1283 " node %d u%016llx\n", 1284 node->debug_id, (u64)node->ptr); 1285 binder_dec_node(node, fp->type == BINDER_TYPE_BINDER, 0); 1286 } break; 1287 case BINDER_TYPE_HANDLE: 1288 case BINDER_TYPE_WEAK_HANDLE: { 1289 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1290 1291 if (ref == NULL) { 1292 pr_err("transaction release %d bad handle %d\n", 1293 debug_id, fp->handle); 1294 break; 1295 } 1296 binder_debug(BINDER_DEBUG_TRANSACTION, 1297 " ref %d desc %d (node %d)\n", 1298 ref->debug_id, ref->desc, ref->node->debug_id); 1299 binder_dec_ref(ref, fp->type == BINDER_TYPE_HANDLE); 1300 } break; 1301 1302 case BINDER_TYPE_FD: 1303 binder_debug(BINDER_DEBUG_TRANSACTION, 1304 " fd %d\n", fp->handle); 1305 if (failed_at) 1306 task_close_fd(proc, fp->handle); 1307 break; 1308 1309 default: 1310 pr_err("transaction release %d bad object type %x\n", 1311 debug_id, fp->type); 1312 break; 1313 } 1314 } 1315} 1316 1317static void binder_transaction(struct binder_proc *proc, 1318 struct binder_thread *thread, 1319 struct binder_transaction_data *tr, int reply) 1320{ 1321 struct binder_transaction *t; 1322 struct binder_work *tcomplete; 1323 binder_size_t *offp, *off_end; 1324 struct binder_proc *target_proc; 1325 struct binder_thread *target_thread = NULL; 1326 struct binder_node *target_node = NULL; 1327 struct list_head *target_list; 1328 wait_queue_head_t *target_wait; 1329 struct binder_transaction *in_reply_to = NULL; 1330 struct binder_transaction_log_entry *e; 1331 uint32_t return_error; 1332 1333 e = binder_transaction_log_add(&binder_transaction_log); 1334 e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY); 1335 e->from_proc = proc->pid; 1336 e->from_thread = thread->pid; 1337 e->target_handle = tr->target.handle; 1338 e->data_size = tr->data_size; 1339 e->offsets_size = tr->offsets_size; 1340 1341 if (reply) { 1342 in_reply_to = thread->transaction_stack; 1343 if (in_reply_to == NULL) { 1344 binder_user_error("%d:%d got reply transaction with no transaction stack\n", 1345 proc->pid, thread->pid); 1346 return_error = BR_FAILED_REPLY; 1347 goto err_empty_call_stack; 1348 } 1349 binder_set_nice(in_reply_to->saved_priority); 1350 if (in_reply_to->to_thread != thread) { 1351 binder_user_error("%d:%d got reply transaction with bad transaction stack, transaction %d has target %d:%d\n", 1352 proc->pid, thread->pid, in_reply_to->debug_id, 1353 in_reply_to->to_proc ? 1354 in_reply_to->to_proc->pid : 0, 1355 in_reply_to->to_thread ? 1356 in_reply_to->to_thread->pid : 0); 1357 return_error = BR_FAILED_REPLY; 1358 in_reply_to = NULL; 1359 goto err_bad_call_stack; 1360 } 1361 thread->transaction_stack = in_reply_to->to_parent; 1362 target_thread = in_reply_to->from; 1363 if (target_thread == NULL) { 1364 return_error = BR_DEAD_REPLY; 1365 goto err_dead_binder; 1366 } 1367 if (target_thread->transaction_stack != in_reply_to) { 1368 binder_user_error("%d:%d got reply transaction with bad target transaction stack %d, expected %d\n", 1369 proc->pid, thread->pid, 1370 target_thread->transaction_stack ? 1371 target_thread->transaction_stack->debug_id : 0, 1372 in_reply_to->debug_id); 1373 return_error = BR_FAILED_REPLY; 1374 in_reply_to = NULL; 1375 target_thread = NULL; 1376 goto err_dead_binder; 1377 } 1378 target_proc = target_thread->proc; 1379 } else { 1380 if (tr->target.handle) { 1381 struct binder_ref *ref; 1382 1383 ref = binder_get_ref(proc, tr->target.handle); 1384 if (ref == NULL) { 1385 binder_user_error("%d:%d got transaction to invalid handle\n", 1386 proc->pid, thread->pid); 1387 return_error = BR_FAILED_REPLY; 1388 goto err_invalid_target_handle; 1389 } 1390 target_node = ref->node; 1391 } else { 1392 target_node = binder_context_mgr_node; 1393 if (target_node == NULL) { 1394 return_error = BR_DEAD_REPLY; 1395 goto err_no_context_mgr_node; 1396 } 1397 } 1398 e->to_node = target_node->debug_id; 1399 target_proc = target_node->proc; 1400 if (target_proc == NULL) { 1401 return_error = BR_DEAD_REPLY; 1402 goto err_dead_binder; 1403 } 1404 if (security_binder_transaction(proc->tsk, 1405 target_proc->tsk) < 0) { 1406 return_error = BR_FAILED_REPLY; 1407 goto err_invalid_target_handle; 1408 } 1409 if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) { 1410 struct binder_transaction *tmp; 1411 1412 tmp = thread->transaction_stack; 1413 if (tmp->to_thread != thread) { 1414 binder_user_error("%d:%d got new transaction with bad transaction stack, transaction %d has target %d:%d\n", 1415 proc->pid, thread->pid, tmp->debug_id, 1416 tmp->to_proc ? tmp->to_proc->pid : 0, 1417 tmp->to_thread ? 1418 tmp->to_thread->pid : 0); 1419 return_error = BR_FAILED_REPLY; 1420 goto err_bad_call_stack; 1421 } 1422 while (tmp) { 1423 if (tmp->from && tmp->from->proc == target_proc) 1424 target_thread = tmp->from; 1425 tmp = tmp->from_parent; 1426 } 1427 } 1428 } 1429 if (target_thread) { 1430 e->to_thread = target_thread->pid; 1431 target_list = &target_thread->todo; 1432 target_wait = &target_thread->wait; 1433 } else { 1434 target_list = &target_proc->todo; 1435 target_wait = &target_proc->wait; 1436 } 1437 e->to_proc = target_proc->pid; 1438 1439 /* TODO: reuse incoming transaction for reply */ 1440 t = kzalloc(sizeof(*t), GFP_KERNEL); 1441 if (t == NULL) { 1442 return_error = BR_FAILED_REPLY; 1443 goto err_alloc_t_failed; 1444 } 1445 binder_stats_created(BINDER_STAT_TRANSACTION); 1446 1447 tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL); 1448 if (tcomplete == NULL) { 1449 return_error = BR_FAILED_REPLY; 1450 goto err_alloc_tcomplete_failed; 1451 } 1452 binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE); 1453 1454 t->debug_id = ++binder_last_id; 1455 e->debug_id = t->debug_id; 1456 1457 if (reply) 1458 binder_debug(BINDER_DEBUG_TRANSACTION, 1459 "%d:%d BC_REPLY %d -> %d:%d, data %016llx-%016llx size %lld-%lld\n", 1460 proc->pid, thread->pid, t->debug_id, 1461 target_proc->pid, target_thread->pid, 1462 (u64)tr->data.ptr.buffer, 1463 (u64)tr->data.ptr.offsets, 1464 (u64)tr->data_size, (u64)tr->offsets_size); 1465 else 1466 binder_debug(BINDER_DEBUG_TRANSACTION, 1467 "%d:%d BC_TRANSACTION %d -> %d - node %d, data %016llx-%016llx size %lld-%lld\n", 1468 proc->pid, thread->pid, t->debug_id, 1469 target_proc->pid, target_node->debug_id, 1470 (u64)tr->data.ptr.buffer, 1471 (u64)tr->data.ptr.offsets, 1472 (u64)tr->data_size, (u64)tr->offsets_size); 1473 1474 if (!reply && !(tr->flags & TF_ONE_WAY)) 1475 t->from = thread; 1476 else 1477 t->from = NULL; 1478 t->sender_euid = task_euid(proc->tsk); 1479 t->to_proc = target_proc; 1480 t->to_thread = target_thread; 1481 t->code = tr->code; 1482 t->flags = tr->flags; 1483 t->priority = task_nice(current); 1484 1485 trace_binder_transaction(reply, t, target_node); 1486 1487 t->buffer = binder_alloc_buf(target_proc, tr->data_size, 1488 tr->offsets_size, !reply && (t->flags & TF_ONE_WAY)); 1489 if (t->buffer == NULL) { 1490 return_error = BR_FAILED_REPLY; 1491 goto err_binder_alloc_buf_failed; 1492 } 1493 t->buffer->allow_user_free = 0; 1494 t->buffer->debug_id = t->debug_id; 1495 t->buffer->transaction = t; 1496 t->buffer->target_node = target_node; 1497 trace_binder_transaction_alloc_buf(t->buffer); 1498 if (target_node) 1499 binder_inc_node(target_node, 1, 0, NULL); 1500 1501 offp = (binder_size_t *)(t->buffer->data + 1502 ALIGN(tr->data_size, sizeof(void *))); 1503 1504 if (copy_from_user(t->buffer->data, (const void __user *)(uintptr_t) 1505 tr->data.ptr.buffer, tr->data_size)) { 1506 binder_user_error("%d:%d got transaction with invalid data ptr\n", 1507 proc->pid, thread->pid); 1508 return_error = BR_FAILED_REPLY; 1509 goto err_copy_data_failed; 1510 } 1511 if (copy_from_user(offp, (const void __user *)(uintptr_t) 1512 tr->data.ptr.offsets, tr->offsets_size)) { 1513 binder_user_error("%d:%d got transaction with invalid offsets ptr\n", 1514 proc->pid, thread->pid); 1515 return_error = BR_FAILED_REPLY; 1516 goto err_copy_data_failed; 1517 } 1518 if (!IS_ALIGNED(tr->offsets_size, sizeof(binder_size_t))) { 1519 binder_user_error("%d:%d got transaction with invalid offsets size, %lld\n", 1520 proc->pid, thread->pid, (u64)tr->offsets_size); 1521 return_error = BR_FAILED_REPLY; 1522 goto err_bad_offset; 1523 } 1524 off_end = (void *)offp + tr->offsets_size; 1525 for (; offp < off_end; offp++) { 1526 struct flat_binder_object *fp; 1527 1528 if (*offp > t->buffer->data_size - sizeof(*fp) || 1529 t->buffer->data_size < sizeof(*fp) || 1530 !IS_ALIGNED(*offp, sizeof(u32))) { 1531 binder_user_error("%d:%d got transaction with invalid offset, %lld\n", 1532 proc->pid, thread->pid, (u64)*offp); 1533 return_error = BR_FAILED_REPLY; 1534 goto err_bad_offset; 1535 } 1536 fp = (struct flat_binder_object *)(t->buffer->data + *offp); 1537 switch (fp->type) { 1538 case BINDER_TYPE_BINDER: 1539 case BINDER_TYPE_WEAK_BINDER: { 1540 struct binder_ref *ref; 1541 struct binder_node *node = binder_get_node(proc, fp->binder); 1542 1543 if (node == NULL) { 1544 node = binder_new_node(proc, fp->binder, fp->cookie); 1545 if (node == NULL) { 1546 return_error = BR_FAILED_REPLY; 1547 goto err_binder_new_node_failed; 1548 } 1549 node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK; 1550 node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS); 1551 } 1552 if (fp->cookie != node->cookie) { 1553 binder_user_error("%d:%d sending u%016llx node %d, cookie mismatch %016llx != %016llx\n", 1554 proc->pid, thread->pid, 1555 (u64)fp->binder, node->debug_id, 1556 (u64)fp->cookie, (u64)node->cookie); 1557 return_error = BR_FAILED_REPLY; 1558 goto err_binder_get_ref_for_node_failed; 1559 } 1560 if (security_binder_transfer_binder(proc->tsk, 1561 target_proc->tsk)) { 1562 return_error = BR_FAILED_REPLY; 1563 goto err_binder_get_ref_for_node_failed; 1564 } 1565 ref = binder_get_ref_for_node(target_proc, node); 1566 if (ref == NULL) { 1567 return_error = BR_FAILED_REPLY; 1568 goto err_binder_get_ref_for_node_failed; 1569 } 1570 if (fp->type == BINDER_TYPE_BINDER) 1571 fp->type = BINDER_TYPE_HANDLE; 1572 else 1573 fp->type = BINDER_TYPE_WEAK_HANDLE; 1574 fp->handle = ref->desc; 1575 binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE, 1576 &thread->todo); 1577 1578 trace_binder_transaction_node_to_ref(t, node, ref); 1579 binder_debug(BINDER_DEBUG_TRANSACTION, 1580 " node %d u%016llx -> ref %d desc %d\n", 1581 node->debug_id, (u64)node->ptr, 1582 ref->debug_id, ref->desc); 1583 } break; 1584 case BINDER_TYPE_HANDLE: 1585 case BINDER_TYPE_WEAK_HANDLE: { 1586 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1587 1588 if (ref == NULL) { 1589 binder_user_error("%d:%d got transaction with invalid handle, %d\n", 1590 proc->pid, 1591 thread->pid, fp->handle); 1592 return_error = BR_FAILED_REPLY; 1593 goto err_binder_get_ref_failed; 1594 } 1595 if (security_binder_transfer_binder(proc->tsk, 1596 target_proc->tsk)) { 1597 return_error = BR_FAILED_REPLY; 1598 goto err_binder_get_ref_failed; 1599 } 1600 if (ref->node->proc == target_proc) { 1601 if (fp->type == BINDER_TYPE_HANDLE) 1602 fp->type = BINDER_TYPE_BINDER; 1603 else 1604 fp->type = BINDER_TYPE_WEAK_BINDER; 1605 fp->binder = ref->node->ptr; 1606 fp->cookie = ref->node->cookie; 1607 binder_inc_node(ref->node, fp->type == BINDER_TYPE_BINDER, 0, NULL); 1608 trace_binder_transaction_ref_to_node(t, ref); 1609 binder_debug(BINDER_DEBUG_TRANSACTION, 1610 " ref %d desc %d -> node %d u%016llx\n", 1611 ref->debug_id, ref->desc, ref->node->debug_id, 1612 (u64)ref->node->ptr); 1613 } else { 1614 struct binder_ref *new_ref; 1615 1616 new_ref = binder_get_ref_for_node(target_proc, ref->node); 1617 if (new_ref == NULL) { 1618 return_error = BR_FAILED_REPLY; 1619 goto err_binder_get_ref_for_node_failed; 1620 } 1621 fp->handle = new_ref->desc; 1622 binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL); 1623 trace_binder_transaction_ref_to_ref(t, ref, 1624 new_ref); 1625 binder_debug(BINDER_DEBUG_TRANSACTION, 1626 " ref %d desc %d -> ref %d desc %d (node %d)\n", 1627 ref->debug_id, ref->desc, new_ref->debug_id, 1628 new_ref->desc, ref->node->debug_id); 1629 } 1630 } break; 1631 1632 case BINDER_TYPE_FD: { 1633 int target_fd; 1634 struct file *file; 1635 1636 if (reply) { 1637 if (!(in_reply_to->flags & TF_ACCEPT_FDS)) { 1638 binder_user_error("%d:%d got reply with fd, %d, but target does not allow fds\n", 1639 proc->pid, thread->pid, fp->handle); 1640 return_error = BR_FAILED_REPLY; 1641 goto err_fd_not_allowed; 1642 } 1643 } else if (!target_node->accept_fds) { 1644 binder_user_error("%d:%d got transaction with fd, %d, but target does not allow fds\n", 1645 proc->pid, thread->pid, fp->handle); 1646 return_error = BR_FAILED_REPLY; 1647 goto err_fd_not_allowed; 1648 } 1649 1650 file = fget(fp->handle); 1651 if (file == NULL) { 1652 binder_user_error("%d:%d got transaction with invalid fd, %d\n", 1653 proc->pid, thread->pid, fp->handle); 1654 return_error = BR_FAILED_REPLY; 1655 goto err_fget_failed; 1656 } 1657 if (security_binder_transfer_file(proc->tsk, 1658 target_proc->tsk, 1659 file) < 0) { 1660 fput(file); 1661 return_error = BR_FAILED_REPLY; 1662 goto err_get_unused_fd_failed; 1663 } 1664 target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC); 1665 if (target_fd < 0) { 1666 fput(file); 1667 return_error = BR_FAILED_REPLY; 1668 goto err_get_unused_fd_failed; 1669 } 1670 task_fd_install(target_proc, target_fd, file); 1671 trace_binder_transaction_fd(t, fp->handle, target_fd); 1672 binder_debug(BINDER_DEBUG_TRANSACTION, 1673 " fd %d -> %d\n", fp->handle, target_fd); 1674 /* TODO: fput? */ 1675 fp->handle = target_fd; 1676 } break; 1677 1678 default: 1679 binder_user_error("%d:%d got transaction with invalid object type, %x\n", 1680 proc->pid, thread->pid, fp->type); 1681 return_error = BR_FAILED_REPLY; 1682 goto err_bad_object_type; 1683 } 1684 } 1685 if (reply) { 1686 BUG_ON(t->buffer->async_transaction != 0); 1687 binder_pop_transaction(target_thread, in_reply_to); 1688 } else if (!(t->flags & TF_ONE_WAY)) { 1689 BUG_ON(t->buffer->async_transaction != 0); 1690 t->need_reply = 1; 1691 t->from_parent = thread->transaction_stack; 1692 thread->transaction_stack = t; 1693 } else { 1694 BUG_ON(target_node == NULL); 1695 BUG_ON(t->buffer->async_transaction != 1); 1696 if (target_node->has_async_transaction) { 1697 target_list = &target_node->async_todo; 1698 target_wait = NULL; 1699 } else 1700 target_node->has_async_transaction = 1; 1701 } 1702 t->work.type = BINDER_WORK_TRANSACTION; 1703 list_add_tail(&t->work.entry, target_list); 1704 tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE; 1705 list_add_tail(&tcomplete->entry, &thread->todo); 1706 if (target_wait) 1707 wake_up_interruptible(target_wait); 1708 return; 1709 1710err_get_unused_fd_failed: 1711err_fget_failed: 1712err_fd_not_allowed: 1713err_binder_get_ref_for_node_failed: 1714err_binder_get_ref_failed: 1715err_binder_new_node_failed: 1716err_bad_object_type: 1717err_bad_offset: 1718err_copy_data_failed: 1719 trace_binder_transaction_failed_buffer_release(t->buffer); 1720 binder_transaction_buffer_release(target_proc, t->buffer, offp); 1721 t->buffer->transaction = NULL; 1722 binder_free_buf(target_proc, t->buffer); 1723err_binder_alloc_buf_failed: 1724 kfree(tcomplete); 1725 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 1726err_alloc_tcomplete_failed: 1727 kfree(t); 1728 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1729err_alloc_t_failed: 1730err_bad_call_stack: 1731err_empty_call_stack: 1732err_dead_binder: 1733err_invalid_target_handle: 1734err_no_context_mgr_node: 1735 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1736 "%d:%d transaction failed %d, size %lld-%lld\n", 1737 proc->pid, thread->pid, return_error, 1738 (u64)tr->data_size, (u64)tr->offsets_size); 1739 1740 { 1741 struct binder_transaction_log_entry *fe; 1742 1743 fe = binder_transaction_log_add(&binder_transaction_log_failed); 1744 *fe = *e; 1745 } 1746 1747 BUG_ON(thread->return_error != BR_OK); 1748 if (in_reply_to) { 1749 thread->return_error = BR_TRANSACTION_COMPLETE; 1750 binder_send_failed_reply(in_reply_to, return_error); 1751 } else 1752 thread->return_error = return_error; 1753} 1754 1755static int binder_thread_write(struct binder_proc *proc, 1756 struct binder_thread *thread, 1757 binder_uintptr_t binder_buffer, size_t size, 1758 binder_size_t *consumed) 1759{ 1760 uint32_t cmd; 1761 void __user *buffer = (void __user *)(uintptr_t)binder_buffer; 1762 void __user *ptr = buffer + *consumed; 1763 void __user *end = buffer + size; 1764 1765 while (ptr < end && thread->return_error == BR_OK) { 1766 if (get_user(cmd, (uint32_t __user *)ptr)) 1767 return -EFAULT; 1768 ptr += sizeof(uint32_t); 1769 trace_binder_command(cmd); 1770 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) { 1771 binder_stats.bc[_IOC_NR(cmd)]++; 1772 proc->stats.bc[_IOC_NR(cmd)]++; 1773 thread->stats.bc[_IOC_NR(cmd)]++; 1774 } 1775 switch (cmd) { 1776 case BC_INCREFS: 1777 case BC_ACQUIRE: 1778 case BC_RELEASE: 1779 case BC_DECREFS: { 1780 uint32_t target; 1781 struct binder_ref *ref; 1782 const char *debug_string; 1783 1784 if (get_user(target, (uint32_t __user *)ptr)) 1785 return -EFAULT; 1786 ptr += sizeof(uint32_t); 1787 if (target == 0 && binder_context_mgr_node && 1788 (cmd == BC_INCREFS || cmd == BC_ACQUIRE)) { 1789 ref = binder_get_ref_for_node(proc, 1790 binder_context_mgr_node); 1791 if (ref->desc != target) { 1792 binder_user_error("%d:%d tried to acquire reference to desc 0, got %d instead\n", 1793 proc->pid, thread->pid, 1794 ref->desc); 1795 } 1796 } else 1797 ref = binder_get_ref(proc, target); 1798 if (ref == NULL) { 1799 binder_user_error("%d:%d refcount change on invalid ref %d\n", 1800 proc->pid, thread->pid, target); 1801 break; 1802 } 1803 switch (cmd) { 1804 case BC_INCREFS: 1805 debug_string = "IncRefs"; 1806 binder_inc_ref(ref, 0, NULL); 1807 break; 1808 case BC_ACQUIRE: 1809 debug_string = "Acquire"; 1810 binder_inc_ref(ref, 1, NULL); 1811 break; 1812 case BC_RELEASE: 1813 debug_string = "Release"; 1814 binder_dec_ref(ref, 1); 1815 break; 1816 case BC_DECREFS: 1817 default: 1818 debug_string = "DecRefs"; 1819 binder_dec_ref(ref, 0); 1820 break; 1821 } 1822 binder_debug(BINDER_DEBUG_USER_REFS, 1823 "%d:%d %s ref %d desc %d s %d w %d for node %d\n", 1824 proc->pid, thread->pid, debug_string, ref->debug_id, 1825 ref->desc, ref->strong, ref->weak, ref->node->debug_id); 1826 break; 1827 } 1828 case BC_INCREFS_DONE: 1829 case BC_ACQUIRE_DONE: { 1830 binder_uintptr_t node_ptr; 1831 binder_uintptr_t cookie; 1832 struct binder_node *node; 1833 1834 if (get_user(node_ptr, (binder_uintptr_t __user *)ptr)) 1835 return -EFAULT; 1836 ptr += sizeof(binder_uintptr_t); 1837 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 1838 return -EFAULT; 1839 ptr += sizeof(binder_uintptr_t); 1840 node = binder_get_node(proc, node_ptr); 1841 if (node == NULL) { 1842 binder_user_error("%d:%d %s u%016llx no match\n", 1843 proc->pid, thread->pid, 1844 cmd == BC_INCREFS_DONE ? 1845 "BC_INCREFS_DONE" : 1846 "BC_ACQUIRE_DONE", 1847 (u64)node_ptr); 1848 break; 1849 } 1850 if (cookie != node->cookie) { 1851 binder_user_error("%d:%d %s u%016llx node %d cookie mismatch %016llx != %016llx\n", 1852 proc->pid, thread->pid, 1853 cmd == BC_INCREFS_DONE ? 1854 "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1855 (u64)node_ptr, node->debug_id, 1856 (u64)cookie, (u64)node->cookie); 1857 break; 1858 } 1859 if (cmd == BC_ACQUIRE_DONE) { 1860 if (node->pending_strong_ref == 0) { 1861 binder_user_error("%d:%d BC_ACQUIRE_DONE node %d has no pending acquire request\n", 1862 proc->pid, thread->pid, 1863 node->debug_id); 1864 break; 1865 } 1866 node->pending_strong_ref = 0; 1867 } else { 1868 if (node->pending_weak_ref == 0) { 1869 binder_user_error("%d:%d BC_INCREFS_DONE node %d has no pending increfs request\n", 1870 proc->pid, thread->pid, 1871 node->debug_id); 1872 break; 1873 } 1874 node->pending_weak_ref = 0; 1875 } 1876 binder_dec_node(node, cmd == BC_ACQUIRE_DONE, 0); 1877 binder_debug(BINDER_DEBUG_USER_REFS, 1878 "%d:%d %s node %d ls %d lw %d\n", 1879 proc->pid, thread->pid, 1880 cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1881 node->debug_id, node->local_strong_refs, node->local_weak_refs); 1882 break; 1883 } 1884 case BC_ATTEMPT_ACQUIRE: 1885 pr_err("BC_ATTEMPT_ACQUIRE not supported\n"); 1886 return -EINVAL; 1887 case BC_ACQUIRE_RESULT: 1888 pr_err("BC_ACQUIRE_RESULT not supported\n"); 1889 return -EINVAL; 1890 1891 case BC_FREE_BUFFER: { 1892 binder_uintptr_t data_ptr; 1893 struct binder_buffer *buffer; 1894 1895 if (get_user(data_ptr, (binder_uintptr_t __user *)ptr)) 1896 return -EFAULT; 1897 ptr += sizeof(binder_uintptr_t); 1898 1899 buffer = binder_buffer_lookup(proc, data_ptr); 1900 if (buffer == NULL) { 1901 binder_user_error("%d:%d BC_FREE_BUFFER u%016llx no match\n", 1902 proc->pid, thread->pid, (u64)data_ptr); 1903 break; 1904 } 1905 if (!buffer->allow_user_free) { 1906 binder_user_error("%d:%d BC_FREE_BUFFER u%016llx matched unreturned buffer\n", 1907 proc->pid, thread->pid, (u64)data_ptr); 1908 break; 1909 } 1910 binder_debug(BINDER_DEBUG_FREE_BUFFER, 1911 "%d:%d BC_FREE_BUFFER u%016llx found buffer %d for %s transaction\n", 1912 proc->pid, thread->pid, (u64)data_ptr, 1913 buffer->debug_id, 1914 buffer->transaction ? "active" : "finished"); 1915 1916 if (buffer->transaction) { 1917 buffer->transaction->buffer = NULL; 1918 buffer->transaction = NULL; 1919 } 1920 if (buffer->async_transaction && buffer->target_node) { 1921 BUG_ON(!buffer->target_node->has_async_transaction); 1922 if (list_empty(&buffer->target_node->async_todo)) 1923 buffer->target_node->has_async_transaction = 0; 1924 else 1925 list_move_tail(buffer->target_node->async_todo.next, &thread->todo); 1926 } 1927 trace_binder_transaction_buffer_release(buffer); 1928 binder_transaction_buffer_release(proc, buffer, NULL); 1929 binder_free_buf(proc, buffer); 1930 break; 1931 } 1932 1933 case BC_TRANSACTION: 1934 case BC_REPLY: { 1935 struct binder_transaction_data tr; 1936 1937 if (copy_from_user(&tr, ptr, sizeof(tr))) 1938 return -EFAULT; 1939 ptr += sizeof(tr); 1940 binder_transaction(proc, thread, &tr, cmd == BC_REPLY); 1941 break; 1942 } 1943 1944 case BC_REGISTER_LOOPER: 1945 binder_debug(BINDER_DEBUG_THREADS, 1946 "%d:%d BC_REGISTER_LOOPER\n", 1947 proc->pid, thread->pid); 1948 if (thread->looper & BINDER_LOOPER_STATE_ENTERED) { 1949 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1950 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER\n", 1951 proc->pid, thread->pid); 1952 } else if (proc->requested_threads == 0) { 1953 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1954 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called without request\n", 1955 proc->pid, thread->pid); 1956 } else { 1957 proc->requested_threads--; 1958 proc->requested_threads_started++; 1959 } 1960 thread->looper |= BINDER_LOOPER_STATE_REGISTERED; 1961 break; 1962 case BC_ENTER_LOOPER: 1963 binder_debug(BINDER_DEBUG_THREADS, 1964 "%d:%d BC_ENTER_LOOPER\n", 1965 proc->pid, thread->pid); 1966 if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) { 1967 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1968 binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n", 1969 proc->pid, thread->pid); 1970 } 1971 thread->looper |= BINDER_LOOPER_STATE_ENTERED; 1972 break; 1973 case BC_EXIT_LOOPER: 1974 binder_debug(BINDER_DEBUG_THREADS, 1975 "%d:%d BC_EXIT_LOOPER\n", 1976 proc->pid, thread->pid); 1977 thread->looper |= BINDER_LOOPER_STATE_EXITED; 1978 break; 1979 1980 case BC_REQUEST_DEATH_NOTIFICATION: 1981 case BC_CLEAR_DEATH_NOTIFICATION: { 1982 uint32_t target; 1983 binder_uintptr_t cookie; 1984 struct binder_ref *ref; 1985 struct binder_ref_death *death; 1986 1987 if (get_user(target, (uint32_t __user *)ptr)) 1988 return -EFAULT; 1989 ptr += sizeof(uint32_t); 1990 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 1991 return -EFAULT; 1992 ptr += sizeof(binder_uintptr_t); 1993 ref = binder_get_ref(proc, target); 1994 if (ref == NULL) { 1995 binder_user_error("%d:%d %s invalid ref %d\n", 1996 proc->pid, thread->pid, 1997 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 1998 "BC_REQUEST_DEATH_NOTIFICATION" : 1999 "BC_CLEAR_DEATH_NOTIFICATION", 2000 target); 2001 break; 2002 } 2003 2004 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 2005 "%d:%d %s %016llx ref %d desc %d s %d w %d for node %d\n", 2006 proc->pid, thread->pid, 2007 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 2008 "BC_REQUEST_DEATH_NOTIFICATION" : 2009 "BC_CLEAR_DEATH_NOTIFICATION", 2010 (u64)cookie, ref->debug_id, ref->desc, 2011 ref->strong, ref->weak, ref->node->debug_id); 2012 2013 if (cmd == BC_REQUEST_DEATH_NOTIFICATION) { 2014 if (ref->death) { 2015 binder_user_error("%d:%d BC_REQUEST_DEATH_NOTIFICATION death notification already set\n", 2016 proc->pid, thread->pid); 2017 break; 2018 } 2019 death = kzalloc(sizeof(*death), GFP_KERNEL); 2020 if (death == NULL) { 2021 thread->return_error = BR_ERROR; 2022 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 2023 "%d:%d BC_REQUEST_DEATH_NOTIFICATION failed\n", 2024 proc->pid, thread->pid); 2025 break; 2026 } 2027 binder_stats_created(BINDER_STAT_DEATH); 2028 INIT_LIST_HEAD(&death->work.entry); 2029 death->cookie = cookie; 2030 ref->death = death; 2031 if (ref->node->proc == NULL) { 2032 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 2033 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2034 list_add_tail(&ref->death->work.entry, &thread->todo); 2035 } else { 2036 list_add_tail(&ref->death->work.entry, &proc->todo); 2037 wake_up_interruptible(&proc->wait); 2038 } 2039 } 2040 } else { 2041 if (ref->death == NULL) { 2042 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification not active\n", 2043 proc->pid, thread->pid); 2044 break; 2045 } 2046 death = ref->death; 2047 if (death->cookie != cookie) { 2048 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch %016llx != %016llx\n", 2049 proc->pid, thread->pid, 2050 (u64)death->cookie, 2051 (u64)cookie); 2052 break; 2053 } 2054 ref->death = NULL; 2055 if (list_empty(&death->work.entry)) { 2056 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2057 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2058 list_add_tail(&death->work.entry, &thread->todo); 2059 } else { 2060 list_add_tail(&death->work.entry, &proc->todo); 2061 wake_up_interruptible(&proc->wait); 2062 } 2063 } else { 2064 BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER); 2065 death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR; 2066 } 2067 } 2068 } break; 2069 case BC_DEAD_BINDER_DONE: { 2070 struct binder_work *w; 2071 binder_uintptr_t cookie; 2072 struct binder_ref_death *death = NULL; 2073 2074 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 2075 return -EFAULT; 2076 2077 ptr += sizeof(cookie); 2078 list_for_each_entry(w, &proc->delivered_death, entry) { 2079 struct binder_ref_death *tmp_death = container_of(w, struct binder_ref_death, work); 2080 2081 if (tmp_death->cookie == cookie) { 2082 death = tmp_death; 2083 break; 2084 } 2085 } 2086 binder_debug(BINDER_DEBUG_DEAD_BINDER, 2087 "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n", 2088 proc->pid, thread->pid, (u64)cookie, 2089 death); 2090 if (death == NULL) { 2091 binder_user_error("%d:%d BC_DEAD_BINDER_DONE %016llx not found\n", 2092 proc->pid, thread->pid, (u64)cookie); 2093 break; 2094 } 2095 2096 list_del_init(&death->work.entry); 2097 if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) { 2098 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2099 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2100 list_add_tail(&death->work.entry, &thread->todo); 2101 } else { 2102 list_add_tail(&death->work.entry, &proc->todo); 2103 wake_up_interruptible(&proc->wait); 2104 } 2105 } 2106 } break; 2107 2108 default: 2109 pr_err("%d:%d unknown command %d\n", 2110 proc->pid, thread->pid, cmd); 2111 return -EINVAL; 2112 } 2113 *consumed = ptr - buffer; 2114 } 2115 return 0; 2116} 2117 2118static void binder_stat_br(struct binder_proc *proc, 2119 struct binder_thread *thread, uint32_t cmd) 2120{ 2121 trace_binder_return(cmd); 2122 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) { 2123 binder_stats.br[_IOC_NR(cmd)]++; 2124 proc->stats.br[_IOC_NR(cmd)]++; 2125 thread->stats.br[_IOC_NR(cmd)]++; 2126 } 2127} 2128 2129static int binder_has_proc_work(struct binder_proc *proc, 2130 struct binder_thread *thread) 2131{ 2132 return !list_empty(&proc->todo) || 2133 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2134} 2135 2136static int binder_has_thread_work(struct binder_thread *thread) 2137{ 2138 return !list_empty(&thread->todo) || thread->return_error != BR_OK || 2139 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2140} 2141 2142static int binder_thread_read(struct binder_proc *proc, 2143 struct binder_thread *thread, 2144 binder_uintptr_t binder_buffer, size_t size, 2145 binder_size_t *consumed, int non_block) 2146{ 2147 void __user *buffer = (void __user *)(uintptr_t)binder_buffer; 2148 void __user *ptr = buffer + *consumed; 2149 void __user *end = buffer + size; 2150 2151 int ret = 0; 2152 int wait_for_proc_work; 2153 2154 if (*consumed == 0) { 2155 if (put_user(BR_NOOP, (uint32_t __user *)ptr)) 2156 return -EFAULT; 2157 ptr += sizeof(uint32_t); 2158 } 2159 2160retry: 2161 wait_for_proc_work = thread->transaction_stack == NULL && 2162 list_empty(&thread->todo); 2163 2164 if (thread->return_error != BR_OK && ptr < end) { 2165 if (thread->return_error2 != BR_OK) { 2166 if (put_user(thread->return_error2, (uint32_t __user *)ptr)) 2167 return -EFAULT; 2168 ptr += sizeof(uint32_t); 2169 binder_stat_br(proc, thread, thread->return_error2); 2170 if (ptr == end) 2171 goto done; 2172 thread->return_error2 = BR_OK; 2173 } 2174 if (put_user(thread->return_error, (uint32_t __user *)ptr)) 2175 return -EFAULT; 2176 ptr += sizeof(uint32_t); 2177 binder_stat_br(proc, thread, thread->return_error); 2178 thread->return_error = BR_OK; 2179 goto done; 2180 } 2181 2182 2183 thread->looper |= BINDER_LOOPER_STATE_WAITING; 2184 if (wait_for_proc_work) 2185 proc->ready_threads++; 2186 2187 binder_unlock(__func__); 2188 2189 trace_binder_wait_for_work(wait_for_proc_work, 2190 !!thread->transaction_stack, 2191 !list_empty(&thread->todo)); 2192 if (wait_for_proc_work) { 2193 if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2194 BINDER_LOOPER_STATE_ENTERED))) { 2195 binder_user_error("%d:%d ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state %x)\n", 2196 proc->pid, thread->pid, thread->looper); 2197 wait_event_interruptible(binder_user_error_wait, 2198 binder_stop_on_user_error < 2); 2199 } 2200 binder_set_nice(proc->default_priority); 2201 if (non_block) { 2202 if (!binder_has_proc_work(proc, thread)) 2203 ret = -EAGAIN; 2204 } else 2205 ret = wait_event_freezable_exclusive(proc->wait, binder_has_proc_work(proc, thread)); 2206 } else { 2207 if (non_block) { 2208 if (!binder_has_thread_work(thread)) 2209 ret = -EAGAIN; 2210 } else 2211 ret = wait_event_freezable(thread->wait, binder_has_thread_work(thread)); 2212 } 2213 2214 binder_lock(__func__); 2215 2216 if (wait_for_proc_work) 2217 proc->ready_threads--; 2218 thread->looper &= ~BINDER_LOOPER_STATE_WAITING; 2219 2220 if (ret) 2221 return ret; 2222 2223 while (1) { 2224 uint32_t cmd; 2225 struct binder_transaction_data tr; 2226 struct binder_work *w; 2227 struct binder_transaction *t = NULL; 2228 2229 if (!list_empty(&thread->todo)) { 2230 w = list_first_entry(&thread->todo, struct binder_work, 2231 entry); 2232 } else if (!list_empty(&proc->todo) && wait_for_proc_work) { 2233 w = list_first_entry(&proc->todo, struct binder_work, 2234 entry); 2235 } else { 2236 /* no data added */ 2237 if (ptr - buffer == 4 && 2238 !(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN)) 2239 goto retry; 2240 break; 2241 } 2242 2243 if (end - ptr < sizeof(tr) + 4) 2244 break; 2245 2246 switch (w->type) { 2247 case BINDER_WORK_TRANSACTION: { 2248 t = container_of(w, struct binder_transaction, work); 2249 } break; 2250 case BINDER_WORK_TRANSACTION_COMPLETE: { 2251 cmd = BR_TRANSACTION_COMPLETE; 2252 if (put_user(cmd, (uint32_t __user *)ptr)) 2253 return -EFAULT; 2254 ptr += sizeof(uint32_t); 2255 2256 binder_stat_br(proc, thread, cmd); 2257 binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE, 2258 "%d:%d BR_TRANSACTION_COMPLETE\n", 2259 proc->pid, thread->pid); 2260 2261 list_del(&w->entry); 2262 kfree(w); 2263 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2264 } break; 2265 case BINDER_WORK_NODE: { 2266 struct binder_node *node = container_of(w, struct binder_node, work); 2267 uint32_t cmd = BR_NOOP; 2268 const char *cmd_name; 2269 int strong = node->internal_strong_refs || node->local_strong_refs; 2270 int weak = !hlist_empty(&node->refs) || node->local_weak_refs || strong; 2271 2272 if (weak && !node->has_weak_ref) { 2273 cmd = BR_INCREFS; 2274 cmd_name = "BR_INCREFS"; 2275 node->has_weak_ref = 1; 2276 node->pending_weak_ref = 1; 2277 node->local_weak_refs++; 2278 } else if (strong && !node->has_strong_ref) { 2279 cmd = BR_ACQUIRE; 2280 cmd_name = "BR_ACQUIRE"; 2281 node->has_strong_ref = 1; 2282 node->pending_strong_ref = 1; 2283 node->local_strong_refs++; 2284 } else if (!strong && node->has_strong_ref) { 2285 cmd = BR_RELEASE; 2286 cmd_name = "BR_RELEASE"; 2287 node->has_strong_ref = 0; 2288 } else if (!weak && node->has_weak_ref) { 2289 cmd = BR_DECREFS; 2290 cmd_name = "BR_DECREFS"; 2291 node->has_weak_ref = 0; 2292 } 2293 if (cmd != BR_NOOP) { 2294 if (put_user(cmd, (uint32_t __user *)ptr)) 2295 return -EFAULT; 2296 ptr += sizeof(uint32_t); 2297 if (put_user(node->ptr, 2298 (binder_uintptr_t __user *)ptr)) 2299 return -EFAULT; 2300 ptr += sizeof(binder_uintptr_t); 2301 if (put_user(node->cookie, 2302 (binder_uintptr_t __user *)ptr)) 2303 return -EFAULT; 2304 ptr += sizeof(binder_uintptr_t); 2305 2306 binder_stat_br(proc, thread, cmd); 2307 binder_debug(BINDER_DEBUG_USER_REFS, 2308 "%d:%d %s %d u%016llx c%016llx\n", 2309 proc->pid, thread->pid, cmd_name, 2310 node->debug_id, 2311 (u64)node->ptr, (u64)node->cookie); 2312 } else { 2313 list_del_init(&w->entry); 2314 if (!weak && !strong) { 2315 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2316 "%d:%d node %d u%016llx c%016llx deleted\n", 2317 proc->pid, thread->pid, 2318 node->debug_id, 2319 (u64)node->ptr, 2320 (u64)node->cookie); 2321 rb_erase(&node->rb_node, &proc->nodes); 2322 kfree(node); 2323 binder_stats_deleted(BINDER_STAT_NODE); 2324 } else { 2325 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2326 "%d:%d node %d u%016llx c%016llx state unchanged\n", 2327 proc->pid, thread->pid, 2328 node->debug_id, 2329 (u64)node->ptr, 2330 (u64)node->cookie); 2331 } 2332 } 2333 } break; 2334 case BINDER_WORK_DEAD_BINDER: 2335 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 2336 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 2337 struct binder_ref_death *death; 2338 uint32_t cmd; 2339 2340 death = container_of(w, struct binder_ref_death, work); 2341 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) 2342 cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE; 2343 else 2344 cmd = BR_DEAD_BINDER; 2345 if (put_user(cmd, (uint32_t __user *)ptr)) 2346 return -EFAULT; 2347 ptr += sizeof(uint32_t); 2348 if (put_user(death->cookie, 2349 (binder_uintptr_t __user *)ptr)) 2350 return -EFAULT; 2351 ptr += sizeof(binder_uintptr_t); 2352 binder_stat_br(proc, thread, cmd); 2353 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 2354 "%d:%d %s %016llx\n", 2355 proc->pid, thread->pid, 2356 cmd == BR_DEAD_BINDER ? 2357 "BR_DEAD_BINDER" : 2358 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 2359 (u64)death->cookie); 2360 2361 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) { 2362 list_del(&w->entry); 2363 kfree(death); 2364 binder_stats_deleted(BINDER_STAT_DEATH); 2365 } else 2366 list_move(&w->entry, &proc->delivered_death); 2367 if (cmd == BR_DEAD_BINDER) 2368 goto done; /* DEAD_BINDER notifications can cause transactions */ 2369 } break; 2370 } 2371 2372 if (!t) 2373 continue; 2374 2375 BUG_ON(t->buffer == NULL); 2376 if (t->buffer->target_node) { 2377 struct binder_node *target_node = t->buffer->target_node; 2378 2379 tr.target.ptr = target_node->ptr; 2380 tr.cookie = target_node->cookie; 2381 t->saved_priority = task_nice(current); 2382 if (t->priority < target_node->min_priority && 2383 !(t->flags & TF_ONE_WAY)) 2384 binder_set_nice(t->priority); 2385 else if (!(t->flags & TF_ONE_WAY) || 2386 t->saved_priority > target_node->min_priority) 2387 binder_set_nice(target_node->min_priority); 2388 cmd = BR_TRANSACTION; 2389 } else { 2390 tr.target.ptr = 0; 2391 tr.cookie = 0; 2392 cmd = BR_REPLY; 2393 } 2394 tr.code = t->code; 2395 tr.flags = t->flags; 2396 tr.sender_euid = from_kuid(current_user_ns(), t->sender_euid); 2397 2398 if (t->from) { 2399 struct task_struct *sender = t->from->proc->tsk; 2400 2401 tr.sender_pid = task_tgid_nr_ns(sender, 2402 task_active_pid_ns(current)); 2403 } else { 2404 tr.sender_pid = 0; 2405 } 2406 2407 tr.data_size = t->buffer->data_size; 2408 tr.offsets_size = t->buffer->offsets_size; 2409 tr.data.ptr.buffer = (binder_uintptr_t)( 2410 (uintptr_t)t->buffer->data + 2411 proc->user_buffer_offset); 2412 tr.data.ptr.offsets = tr.data.ptr.buffer + 2413 ALIGN(t->buffer->data_size, 2414 sizeof(void *)); 2415 2416 if (put_user(cmd, (uint32_t __user *)ptr)) 2417 return -EFAULT; 2418 ptr += sizeof(uint32_t); 2419 if (copy_to_user(ptr, &tr, sizeof(tr))) 2420 return -EFAULT; 2421 ptr += sizeof(tr); 2422 2423 trace_binder_transaction_received(t); 2424 binder_stat_br(proc, thread, cmd); 2425 binder_debug(BINDER_DEBUG_TRANSACTION, 2426 "%d:%d %s %d %d:%d, cmd %d size %zd-%zd ptr %016llx-%016llx\n", 2427 proc->pid, thread->pid, 2428 (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" : 2429 "BR_REPLY", 2430 t->debug_id, t->from ? t->from->proc->pid : 0, 2431 t->from ? t->from->pid : 0, cmd, 2432 t->buffer->data_size, t->buffer->offsets_size, 2433 (u64)tr.data.ptr.buffer, (u64)tr.data.ptr.offsets); 2434 2435 list_del(&t->work.entry); 2436 t->buffer->allow_user_free = 1; 2437 if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) { 2438 t->to_parent = thread->transaction_stack; 2439 t->to_thread = thread; 2440 thread->transaction_stack = t; 2441 } else { 2442 t->buffer->transaction = NULL; 2443 kfree(t); 2444 binder_stats_deleted(BINDER_STAT_TRANSACTION); 2445 } 2446 break; 2447 } 2448 2449done: 2450 2451 *consumed = ptr - buffer; 2452 if (proc->requested_threads + proc->ready_threads == 0 && 2453 proc->requested_threads_started < proc->max_threads && 2454 (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2455 BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */ 2456 /*spawn a new thread if we leave this out */) { 2457 proc->requested_threads++; 2458 binder_debug(BINDER_DEBUG_THREADS, 2459 "%d:%d BR_SPAWN_LOOPER\n", 2460 proc->pid, thread->pid); 2461 if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer)) 2462 return -EFAULT; 2463 binder_stat_br(proc, thread, BR_SPAWN_LOOPER); 2464 } 2465 return 0; 2466} 2467 2468static void binder_release_work(struct list_head *list) 2469{ 2470 struct binder_work *w; 2471 2472 while (!list_empty(list)) { 2473 w = list_first_entry(list, struct binder_work, entry); 2474 list_del_init(&w->entry); 2475 switch (w->type) { 2476 case BINDER_WORK_TRANSACTION: { 2477 struct binder_transaction *t; 2478 2479 t = container_of(w, struct binder_transaction, work); 2480 if (t->buffer->target_node && 2481 !(t->flags & TF_ONE_WAY)) { 2482 binder_send_failed_reply(t, BR_DEAD_REPLY); 2483 } else { 2484 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2485 "undelivered transaction %d\n", 2486 t->debug_id); 2487 t->buffer->transaction = NULL; 2488 kfree(t); 2489 binder_stats_deleted(BINDER_STAT_TRANSACTION); 2490 } 2491 } break; 2492 case BINDER_WORK_TRANSACTION_COMPLETE: { 2493 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2494 "undelivered TRANSACTION_COMPLETE\n"); 2495 kfree(w); 2496 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2497 } break; 2498 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 2499 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 2500 struct binder_ref_death *death; 2501 2502 death = container_of(w, struct binder_ref_death, work); 2503 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2504 "undelivered death notification, %016llx\n", 2505 (u64)death->cookie); 2506 kfree(death); 2507 binder_stats_deleted(BINDER_STAT_DEATH); 2508 } break; 2509 default: 2510 pr_err("unexpected work type, %d, not freed\n", 2511 w->type); 2512 break; 2513 } 2514 } 2515 2516} 2517 2518static struct binder_thread *binder_get_thread(struct binder_proc *proc) 2519{ 2520 struct binder_thread *thread = NULL; 2521 struct rb_node *parent = NULL; 2522 struct rb_node **p = &proc->threads.rb_node; 2523 2524 while (*p) { 2525 parent = *p; 2526 thread = rb_entry(parent, struct binder_thread, rb_node); 2527 2528 if (current->pid < thread->pid) 2529 p = &(*p)->rb_left; 2530 else if (current->pid > thread->pid) 2531 p = &(*p)->rb_right; 2532 else 2533 break; 2534 } 2535 if (*p == NULL) { 2536 thread = kzalloc(sizeof(*thread), GFP_KERNEL); 2537 if (thread == NULL) 2538 return NULL; 2539 binder_stats_created(BINDER_STAT_THREAD); 2540 thread->proc = proc; 2541 thread->pid = current->pid; 2542 init_waitqueue_head(&thread->wait); 2543 INIT_LIST_HEAD(&thread->todo); 2544 rb_link_node(&thread->rb_node, parent, p); 2545 rb_insert_color(&thread->rb_node, &proc->threads); 2546 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2547 thread->return_error = BR_OK; 2548 thread->return_error2 = BR_OK; 2549 } 2550 return thread; 2551} 2552 2553static int binder_free_thread(struct binder_proc *proc, 2554 struct binder_thread *thread) 2555{ 2556 struct binder_transaction *t; 2557 struct binder_transaction *send_reply = NULL; 2558 int active_transactions = 0; 2559 2560 rb_erase(&thread->rb_node, &proc->threads); 2561 t = thread->transaction_stack; 2562 if (t && t->to_thread == thread) 2563 send_reply = t; 2564 while (t) { 2565 active_transactions++; 2566 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2567 "release %d:%d transaction %d %s, still active\n", 2568 proc->pid, thread->pid, 2569 t->debug_id, 2570 (t->to_thread == thread) ? "in" : "out"); 2571 2572 if (t->to_thread == thread) { 2573 t->to_proc = NULL; 2574 t->to_thread = NULL; 2575 if (t->buffer) { 2576 t->buffer->transaction = NULL; 2577 t->buffer = NULL; 2578 } 2579 t = t->to_parent; 2580 } else if (t->from == thread) { 2581 t->from = NULL; 2582 t = t->from_parent; 2583 } else 2584 BUG(); 2585 } 2586 if (send_reply) 2587 binder_send_failed_reply(send_reply, BR_DEAD_REPLY); 2588 binder_release_work(&thread->todo); 2589 kfree(thread); 2590 binder_stats_deleted(BINDER_STAT_THREAD); 2591 return active_transactions; 2592} 2593 2594static unsigned int binder_poll(struct file *filp, 2595 struct poll_table_struct *wait) 2596{ 2597 struct binder_proc *proc = filp->private_data; 2598 struct binder_thread *thread = NULL; 2599 int wait_for_proc_work; 2600 2601 binder_lock(__func__); 2602 2603 thread = binder_get_thread(proc); 2604 2605 wait_for_proc_work = thread->transaction_stack == NULL && 2606 list_empty(&thread->todo) && thread->return_error == BR_OK; 2607 2608 binder_unlock(__func__); 2609 2610 if (wait_for_proc_work) { 2611 if (binder_has_proc_work(proc, thread)) 2612 return POLLIN; 2613 poll_wait(filp, &proc->wait, wait); 2614 if (binder_has_proc_work(proc, thread)) 2615 return POLLIN; 2616 } else { 2617 if (binder_has_thread_work(thread)) 2618 return POLLIN; 2619 poll_wait(filp, &thread->wait, wait); 2620 if (binder_has_thread_work(thread)) 2621 return POLLIN; 2622 } 2623 return 0; 2624} 2625 2626static int binder_ioctl_write_read(struct file *filp, 2627 unsigned int cmd, unsigned long arg, 2628 struct binder_thread *thread) 2629{ 2630 int ret = 0; 2631 struct binder_proc *proc = filp->private_data; 2632 unsigned int size = _IOC_SIZE(cmd); 2633 void __user *ubuf = (void __user *)arg; 2634 struct binder_write_read bwr; 2635 2636 if (size != sizeof(struct binder_write_read)) { 2637 ret = -EINVAL; 2638 goto out; 2639 } 2640 if (copy_from_user(&bwr, ubuf, sizeof(bwr))) { 2641 ret = -EFAULT; 2642 goto out; 2643 } 2644 binder_debug(BINDER_DEBUG_READ_WRITE, 2645 "%d:%d write %lld at %016llx, read %lld at %016llx\n", 2646 proc->pid, thread->pid, 2647 (u64)bwr.write_size, (u64)bwr.write_buffer, 2648 (u64)bwr.read_size, (u64)bwr.read_buffer); 2649 2650 if (bwr.write_size > 0) { 2651 ret = binder_thread_write(proc, thread, 2652 bwr.write_buffer, 2653 bwr.write_size, 2654 &bwr.write_consumed); 2655 trace_binder_write_done(ret); 2656 if (ret < 0) { 2657 bwr.read_consumed = 0; 2658 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2659 ret = -EFAULT; 2660 goto out; 2661 } 2662 } 2663 if (bwr.read_size > 0) { 2664 ret = binder_thread_read(proc, thread, bwr.read_buffer, 2665 bwr.read_size, 2666 &bwr.read_consumed, 2667 filp->f_flags & O_NONBLOCK); 2668 trace_binder_read_done(ret); 2669 if (!list_empty(&proc->todo)) 2670 wake_up_interruptible(&proc->wait); 2671 if (ret < 0) { 2672 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2673 ret = -EFAULT; 2674 goto out; 2675 } 2676 } 2677 binder_debug(BINDER_DEBUG_READ_WRITE, 2678 "%d:%d wrote %lld of %lld, read return %lld of %lld\n", 2679 proc->pid, thread->pid, 2680 (u64)bwr.write_consumed, (u64)bwr.write_size, 2681 (u64)bwr.read_consumed, (u64)bwr.read_size); 2682 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) { 2683 ret = -EFAULT; 2684 goto out; 2685 } 2686out: 2687 return ret; 2688} 2689 2690static int binder_ioctl_set_ctx_mgr(struct file *filp) 2691{ 2692 int ret = 0; 2693 struct binder_proc *proc = filp->private_data; 2694 kuid_t curr_euid = current_euid(); 2695 2696 if (binder_context_mgr_node != NULL) { 2697 pr_err("BINDER_SET_CONTEXT_MGR already set\n"); 2698 ret = -EBUSY; 2699 goto out; 2700 } 2701 ret = security_binder_set_context_mgr(proc->tsk); 2702 if (ret < 0) 2703 goto out; 2704 if (uid_valid(binder_context_mgr_uid)) { 2705 if (!uid_eq(binder_context_mgr_uid, curr_euid)) { 2706 pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n", 2707 from_kuid(&init_user_ns, curr_euid), 2708 from_kuid(&init_user_ns, 2709 binder_context_mgr_uid)); 2710 ret = -EPERM; 2711 goto out; 2712 } 2713 } else { 2714 binder_context_mgr_uid = curr_euid; 2715 } 2716 binder_context_mgr_node = binder_new_node(proc, 0, 0); 2717 if (binder_context_mgr_node == NULL) { 2718 ret = -ENOMEM; 2719 goto out; 2720 } 2721 binder_context_mgr_node->local_weak_refs++; 2722 binder_context_mgr_node->local_strong_refs++; 2723 binder_context_mgr_node->has_strong_ref = 1; 2724 binder_context_mgr_node->has_weak_ref = 1; 2725out: 2726 return ret; 2727} 2728 2729static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 2730{ 2731 int ret; 2732 struct binder_proc *proc = filp->private_data; 2733 struct binder_thread *thread; 2734 unsigned int size = _IOC_SIZE(cmd); 2735 void __user *ubuf = (void __user *)arg; 2736 2737 /*pr_info("binder_ioctl: %d:%d %x %lx\n", 2738 proc->pid, current->pid, cmd, arg);*/ 2739 2740 trace_binder_ioctl(cmd, arg); 2741 2742 ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2743 if (ret) 2744 goto err_unlocked; 2745 2746 binder_lock(__func__); 2747 thread = binder_get_thread(proc); 2748 if (thread == NULL) { 2749 ret = -ENOMEM; 2750 goto err; 2751 } 2752 2753 switch (cmd) { 2754 case BINDER_WRITE_READ: 2755 ret = binder_ioctl_write_read(filp, cmd, arg, thread); 2756 if (ret) 2757 goto err; 2758 break; 2759 case BINDER_SET_MAX_THREADS: 2760 if (copy_from_user(&proc->max_threads, ubuf, sizeof(proc->max_threads))) { 2761 ret = -EINVAL; 2762 goto err; 2763 } 2764 break; 2765 case BINDER_SET_CONTEXT_MGR: 2766 ret = binder_ioctl_set_ctx_mgr(filp); 2767 if (ret) 2768 goto err; 2769 break; 2770 case BINDER_THREAD_EXIT: 2771 binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n", 2772 proc->pid, thread->pid); 2773 binder_free_thread(proc, thread); 2774 thread = NULL; 2775 break; 2776 case BINDER_VERSION: { 2777 struct binder_version __user *ver = ubuf; 2778 2779 if (size != sizeof(struct binder_version)) { 2780 ret = -EINVAL; 2781 goto err; 2782 } 2783 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION, 2784 &ver->protocol_version)) { 2785 ret = -EINVAL; 2786 goto err; 2787 } 2788 break; 2789 } 2790 default: 2791 ret = -EINVAL; 2792 goto err; 2793 } 2794 ret = 0; 2795err: 2796 if (thread) 2797 thread->looper &= ~BINDER_LOOPER_STATE_NEED_RETURN; 2798 binder_unlock(__func__); 2799 wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2800 if (ret && ret != -ERESTARTSYS) 2801 pr_info("%d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret); 2802err_unlocked: 2803 trace_binder_ioctl_done(ret); 2804 return ret; 2805} 2806 2807static void binder_vma_open(struct vm_area_struct *vma) 2808{ 2809 struct binder_proc *proc = vma->vm_private_data; 2810 2811 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2812 "%d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2813 proc->pid, vma->vm_start, vma->vm_end, 2814 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2815 (unsigned long)pgprot_val(vma->vm_page_prot)); 2816} 2817 2818static void binder_vma_close(struct vm_area_struct *vma) 2819{ 2820 struct binder_proc *proc = vma->vm_private_data; 2821 2822 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2823 "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2824 proc->pid, vma->vm_start, vma->vm_end, 2825 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2826 (unsigned long)pgprot_val(vma->vm_page_prot)); 2827 proc->vma = NULL; 2828 proc->vma_vm_mm = NULL; 2829 binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES); 2830} 2831 2832static int binder_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf) 2833{ 2834 return VM_FAULT_SIGBUS; 2835} 2836 2837static struct vm_operations_struct binder_vm_ops = { 2838 .open = binder_vma_open, 2839 .close = binder_vma_close, 2840 .fault = binder_vm_fault, 2841}; 2842 2843static int binder_mmap(struct file *filp, struct vm_area_struct *vma) 2844{ 2845 int ret; 2846 struct vm_struct *area; 2847 struct binder_proc *proc = filp->private_data; 2848 const char *failure_string; 2849 struct binder_buffer *buffer; 2850 2851 if (proc->tsk != current) 2852 return -EINVAL; 2853 2854 if ((vma->vm_end - vma->vm_start) > SZ_4M) 2855 vma->vm_end = vma->vm_start + SZ_4M; 2856 2857 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2858 "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n", 2859 proc->pid, vma->vm_start, vma->vm_end, 2860 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2861 (unsigned long)pgprot_val(vma->vm_page_prot)); 2862 2863 if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) { 2864 ret = -EPERM; 2865 failure_string = "bad vm_flags"; 2866 goto err_bad_arg; 2867 } 2868 vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE; 2869 2870 mutex_lock(&binder_mmap_lock); 2871 if (proc->buffer) { 2872 ret = -EBUSY; 2873 failure_string = "already mapped"; 2874 goto err_already_mapped; 2875 } 2876 2877 area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP); 2878 if (area == NULL) { 2879 ret = -ENOMEM; 2880 failure_string = "get_vm_area"; 2881 goto err_get_vm_area_failed; 2882 } 2883 proc->buffer = area->addr; 2884 proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer; 2885 mutex_unlock(&binder_mmap_lock); 2886 2887#ifdef CONFIG_CPU_CACHE_VIPT 2888 if (cache_is_vipt_aliasing()) { 2889 while (CACHE_COLOUR((vma->vm_start ^ (uint32_t)proc->buffer))) { 2890 pr_info("binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer); 2891 vma->vm_start += PAGE_SIZE; 2892 } 2893 } 2894#endif 2895 proc->pages = kzalloc(sizeof(proc->pages[0]) * ((vma->vm_end - vma->vm_start) / PAGE_SIZE), GFP_KERNEL); 2896 if (proc->pages == NULL) { 2897 ret = -ENOMEM; 2898 failure_string = "alloc page array"; 2899 goto err_alloc_pages_failed; 2900 } 2901 proc->buffer_size = vma->vm_end - vma->vm_start; 2902 2903 vma->vm_ops = &binder_vm_ops; 2904 vma->vm_private_data = proc; 2905 2906 if (binder_update_page_range(proc, 1, proc->buffer, proc->buffer + PAGE_SIZE, vma)) { 2907 ret = -ENOMEM; 2908 failure_string = "alloc small buf"; 2909 goto err_alloc_small_buf_failed; 2910 } 2911 buffer = proc->buffer; 2912 INIT_LIST_HEAD(&proc->buffers); 2913 list_add(&buffer->entry, &proc->buffers); 2914 buffer->free = 1; 2915 binder_insert_free_buffer(proc, buffer); 2916 proc->free_async_space = proc->buffer_size / 2; 2917 barrier(); 2918 proc->files = get_files_struct(current); 2919 proc->vma = vma; 2920 proc->vma_vm_mm = vma->vm_mm; 2921 2922 /*pr_info("binder_mmap: %d %lx-%lx maps %p\n", 2923 proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/ 2924 return 0; 2925 2926err_alloc_small_buf_failed: 2927 kfree(proc->pages); 2928 proc->pages = NULL; 2929err_alloc_pages_failed: 2930 mutex_lock(&binder_mmap_lock); 2931 vfree(proc->buffer); 2932 proc->buffer = NULL; 2933err_get_vm_area_failed: 2934err_already_mapped: 2935 mutex_unlock(&binder_mmap_lock); 2936err_bad_arg: 2937 pr_err("binder_mmap: %d %lx-%lx %s failed %d\n", 2938 proc->pid, vma->vm_start, vma->vm_end, failure_string, ret); 2939 return ret; 2940} 2941 2942static int binder_open(struct inode *nodp, struct file *filp) 2943{ 2944 struct binder_proc *proc; 2945 2946 binder_debug(BINDER_DEBUG_OPEN_CLOSE, "binder_open: %d:%d\n", 2947 current->group_leader->pid, current->pid); 2948 2949 proc = kzalloc(sizeof(*proc), GFP_KERNEL); 2950 if (proc == NULL) 2951 return -ENOMEM; 2952 get_task_struct(current); 2953 proc->tsk = current; 2954 INIT_LIST_HEAD(&proc->todo); 2955 init_waitqueue_head(&proc->wait); 2956 proc->default_priority = task_nice(current); 2957 2958 binder_lock(__func__); 2959 2960 binder_stats_created(BINDER_STAT_PROC); 2961 hlist_add_head(&proc->proc_node, &binder_procs); 2962 proc->pid = current->group_leader->pid; 2963 INIT_LIST_HEAD(&proc->delivered_death); 2964 filp->private_data = proc; 2965 2966 binder_unlock(__func__); 2967 2968 if (binder_debugfs_dir_entry_proc) { 2969 char strbuf[11]; 2970 2971 snprintf(strbuf, sizeof(strbuf), "%u", proc->pid); 2972 proc->debugfs_entry = debugfs_create_file(strbuf, S_IRUGO, 2973 binder_debugfs_dir_entry_proc, proc, &binder_proc_fops); 2974 } 2975 2976 return 0; 2977} 2978 2979static int binder_flush(struct file *filp, fl_owner_t id) 2980{ 2981 struct binder_proc *proc = filp->private_data; 2982 2983 binder_defer_work(proc, BINDER_DEFERRED_FLUSH); 2984 2985 return 0; 2986} 2987 2988static void binder_deferred_flush(struct binder_proc *proc) 2989{ 2990 struct rb_node *n; 2991 int wake_count = 0; 2992 2993 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) { 2994 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node); 2995 2996 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2997 if (thread->looper & BINDER_LOOPER_STATE_WAITING) { 2998 wake_up_interruptible(&thread->wait); 2999 wake_count++; 3000 } 3001 } 3002 wake_up_interruptible_all(&proc->wait); 3003 3004 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 3005 "binder_flush: %d woke %d threads\n", proc->pid, 3006 wake_count); 3007} 3008 3009static int binder_release(struct inode *nodp, struct file *filp) 3010{ 3011 struct binder_proc *proc = filp->private_data; 3012 3013 debugfs_remove(proc->debugfs_entry); 3014 binder_defer_work(proc, BINDER_DEFERRED_RELEASE); 3015 3016 return 0; 3017} 3018 3019static int binder_node_release(struct binder_node *node, int refs) 3020{ 3021 struct binder_ref *ref; 3022 int death = 0; 3023 3024 list_del_init(&node->work.entry); 3025 binder_release_work(&node->async_todo); 3026 3027 if (hlist_empty(&node->refs)) { 3028 kfree(node); 3029 binder_stats_deleted(BINDER_STAT_NODE); 3030 3031 return refs; 3032 } 3033 3034 node->proc = NULL; 3035 node->local_strong_refs = 0; 3036 node->local_weak_refs = 0; 3037 hlist_add_head(&node->dead_node, &binder_dead_nodes); 3038 3039 hlist_for_each_entry(ref, &node->refs, node_entry) { 3040 refs++; 3041 3042 if (!ref->death) 3043 continue; 3044 3045 death++; 3046 3047 if (list_empty(&ref->death->work.entry)) { 3048 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 3049 list_add_tail(&ref->death->work.entry, 3050 &ref->proc->todo); 3051 wake_up_interruptible(&ref->proc->wait); 3052 } else 3053 BUG(); 3054 } 3055 3056 binder_debug(BINDER_DEBUG_DEAD_BINDER, 3057 "node %d now dead, refs %d, death %d\n", 3058 node->debug_id, refs, death); 3059 3060 return refs; 3061} 3062 3063static void binder_deferred_release(struct binder_proc *proc) 3064{ 3065 struct binder_transaction *t; 3066 struct rb_node *n; 3067 int threads, nodes, incoming_refs, outgoing_refs, buffers, 3068 active_transactions, page_count; 3069 3070 BUG_ON(proc->vma); 3071 BUG_ON(proc->files); 3072 3073 hlist_del(&proc->proc_node); 3074 3075 if (binder_context_mgr_node && binder_context_mgr_node->proc == proc) { 3076 binder_debug(BINDER_DEBUG_DEAD_BINDER, 3077 "%s: %d context_mgr_node gone\n", 3078 __func__, proc->pid); 3079 binder_context_mgr_node = NULL; 3080 } 3081 3082 threads = 0; 3083 active_transactions = 0; 3084 while ((n = rb_first(&proc->threads))) { 3085 struct binder_thread *thread; 3086 3087 thread = rb_entry(n, struct binder_thread, rb_node); 3088 threads++; 3089 active_transactions += binder_free_thread(proc, thread); 3090 } 3091 3092 nodes = 0; 3093 incoming_refs = 0; 3094 while ((n = rb_first(&proc->nodes))) { 3095 struct binder_node *node; 3096 3097 node = rb_entry(n, struct binder_node, rb_node); 3098 nodes++; 3099 rb_erase(&node->rb_node, &proc->nodes); 3100 incoming_refs = binder_node_release(node, incoming_refs); 3101 } 3102 3103 outgoing_refs = 0; 3104 while ((n = rb_first(&proc->refs_by_desc))) { 3105 struct binder_ref *ref; 3106 3107 ref = rb_entry(n, struct binder_ref, rb_node_desc); 3108 outgoing_refs++; 3109 binder_delete_ref(ref); 3110 } 3111 3112 binder_release_work(&proc->todo); 3113 binder_release_work(&proc->delivered_death); 3114 3115 buffers = 0; 3116 while ((n = rb_first(&proc->allocated_buffers))) { 3117 struct binder_buffer *buffer; 3118 3119 buffer = rb_entry(n, struct binder_buffer, rb_node); 3120 3121 t = buffer->transaction; 3122 if (t) { 3123 t->buffer = NULL; 3124 buffer->transaction = NULL; 3125 pr_err("release proc %d, transaction %d, not freed\n", 3126 proc->pid, t->debug_id); 3127 /*BUG();*/ 3128 } 3129 3130 binder_free_buf(proc, buffer); 3131 buffers++; 3132 } 3133 3134 binder_stats_deleted(BINDER_STAT_PROC); 3135 3136 page_count = 0; 3137 if (proc->pages) { 3138 int i; 3139 3140 for (i = 0; i < proc->buffer_size / PAGE_SIZE; i++) { 3141 void *page_addr; 3142 3143 if (!proc->pages[i]) 3144 continue; 3145 3146 page_addr = proc->buffer + i * PAGE_SIZE; 3147 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 3148 "%s: %d: page %d at %p not freed\n", 3149 __func__, proc->pid, i, page_addr); 3150 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE); 3151 __free_page(proc->pages[i]); 3152 page_count++; 3153 } 3154 kfree(proc->pages); 3155 vfree(proc->buffer); 3156 } 3157 3158 put_task_struct(proc->tsk); 3159 3160 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 3161 "%s: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d, buffers %d, pages %d\n", 3162 __func__, proc->pid, threads, nodes, incoming_refs, 3163 outgoing_refs, active_transactions, buffers, page_count); 3164 3165 kfree(proc); 3166} 3167 3168static void binder_deferred_func(struct work_struct *work) 3169{ 3170 struct binder_proc *proc; 3171 struct files_struct *files; 3172 3173 int defer; 3174 3175 do { 3176 binder_lock(__func__); 3177 mutex_lock(&binder_deferred_lock); 3178 if (!hlist_empty(&binder_deferred_list)) { 3179 proc = hlist_entry(binder_deferred_list.first, 3180 struct binder_proc, deferred_work_node); 3181 hlist_del_init(&proc->deferred_work_node); 3182 defer = proc->deferred_work; 3183 proc->deferred_work = 0; 3184 } else { 3185 proc = NULL; 3186 defer = 0; 3187 } 3188 mutex_unlock(&binder_deferred_lock); 3189 3190 files = NULL; 3191 if (defer & BINDER_DEFERRED_PUT_FILES) { 3192 files = proc->files; 3193 if (files) 3194 proc->files = NULL; 3195 } 3196 3197 if (defer & BINDER_DEFERRED_FLUSH) 3198 binder_deferred_flush(proc); 3199 3200 if (defer & BINDER_DEFERRED_RELEASE) 3201 binder_deferred_release(proc); /* frees proc */ 3202 3203 binder_unlock(__func__); 3204 if (files) 3205 put_files_struct(files); 3206 } while (proc); 3207} 3208static DECLARE_WORK(binder_deferred_work, binder_deferred_func); 3209 3210static void 3211binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer) 3212{ 3213 mutex_lock(&binder_deferred_lock); 3214 proc->deferred_work |= defer; 3215 if (hlist_unhashed(&proc->deferred_work_node)) { 3216 hlist_add_head(&proc->deferred_work_node, 3217 &binder_deferred_list); 3218 queue_work(binder_deferred_workqueue, &binder_deferred_work); 3219 } 3220 mutex_unlock(&binder_deferred_lock); 3221} 3222 3223static void print_binder_transaction(struct seq_file *m, const char *prefix, 3224 struct binder_transaction *t) 3225{ 3226 seq_printf(m, 3227 "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d", 3228 prefix, t->debug_id, t, 3229 t->from ? t->from->proc->pid : 0, 3230 t->from ? t->from->pid : 0, 3231 t->to_proc ? t->to_proc->pid : 0, 3232 t->to_thread ? t->to_thread->pid : 0, 3233 t->code, t->flags, t->priority, t->need_reply); 3234 if (t->buffer == NULL) { 3235 seq_puts(m, " buffer free\n"); 3236 return; 3237 } 3238 if (t->buffer->target_node) 3239 seq_printf(m, " node %d", 3240 t->buffer->target_node->debug_id); 3241 seq_printf(m, " size %zd:%zd data %p\n", 3242 t->buffer->data_size, t->buffer->offsets_size, 3243 t->buffer->data); 3244} 3245 3246static void print_binder_buffer(struct seq_file *m, const char *prefix, 3247 struct binder_buffer *buffer) 3248{ 3249 seq_printf(m, "%s %d: %p size %zd:%zd %s\n", 3250 prefix, buffer->debug_id, buffer->data, 3251 buffer->data_size, buffer->offsets_size, 3252 buffer->transaction ? "active" : "delivered"); 3253} 3254 3255static void print_binder_work(struct seq_file *m, const char *prefix, 3256 const char *transaction_prefix, 3257 struct binder_work *w) 3258{ 3259 struct binder_node *node; 3260 struct binder_transaction *t; 3261 3262 switch (w->type) { 3263 case BINDER_WORK_TRANSACTION: 3264 t = container_of(w, struct binder_transaction, work); 3265 print_binder_transaction(m, transaction_prefix, t); 3266 break; 3267 case BINDER_WORK_TRANSACTION_COMPLETE: 3268 seq_printf(m, "%stransaction complete\n", prefix); 3269 break; 3270 case BINDER_WORK_NODE: 3271 node = container_of(w, struct binder_node, work); 3272 seq_printf(m, "%snode work %d: u%016llx c%016llx\n", 3273 prefix, node->debug_id, 3274 (u64)node->ptr, (u64)node->cookie); 3275 break; 3276 case BINDER_WORK_DEAD_BINDER: 3277 seq_printf(m, "%shas dead binder\n", prefix); 3278 break; 3279 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 3280 seq_printf(m, "%shas cleared dead binder\n", prefix); 3281 break; 3282 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: 3283 seq_printf(m, "%shas cleared death notification\n", prefix); 3284 break; 3285 default: 3286 seq_printf(m, "%sunknown work: type %d\n", prefix, w->type); 3287 break; 3288 } 3289} 3290 3291static void print_binder_thread(struct seq_file *m, 3292 struct binder_thread *thread, 3293 int print_always) 3294{ 3295 struct binder_transaction *t; 3296 struct binder_work *w; 3297 size_t start_pos = m->count; 3298 size_t header_pos; 3299 3300 seq_printf(m, " thread %d: l %02x\n", thread->pid, thread->looper); 3301 header_pos = m->count; 3302 t = thread->transaction_stack; 3303 while (t) { 3304 if (t->from == thread) { 3305 print_binder_transaction(m, 3306 " outgoing transaction", t); 3307 t = t->from_parent; 3308 } else if (t->to_thread == thread) { 3309 print_binder_transaction(m, 3310 " incoming transaction", t); 3311 t = t->to_parent; 3312 } else { 3313 print_binder_transaction(m, " bad transaction", t); 3314 t = NULL; 3315 } 3316 } 3317 list_for_each_entry(w, &thread->todo, entry) { 3318 print_binder_work(m, " ", " pending transaction", w); 3319 } 3320 if (!print_always && m->count == header_pos) 3321 m->count = start_pos; 3322} 3323 3324static void print_binder_node(struct seq_file *m, struct binder_node *node) 3325{ 3326 struct binder_ref *ref; 3327 struct binder_work *w; 3328 int count; 3329 3330 count = 0; 3331 hlist_for_each_entry(ref, &node->refs, node_entry) 3332 count++; 3333 3334 seq_printf(m, " node %d: u%016llx c%016llx hs %d hw %d ls %d lw %d is %d iw %d", 3335 node->debug_id, (u64)node->ptr, (u64)node->cookie, 3336 node->has_strong_ref, node->has_weak_ref, 3337 node->local_strong_refs, node->local_weak_refs, 3338 node->internal_strong_refs, count); 3339 if (count) { 3340 seq_puts(m, " proc"); 3341 hlist_for_each_entry(ref, &node->refs, node_entry) 3342 seq_printf(m, " %d", ref->proc->pid); 3343 } 3344 seq_puts(m, "\n"); 3345 list_for_each_entry(w, &node->async_todo, entry) 3346 print_binder_work(m, " ", 3347 " pending async transaction", w); 3348} 3349 3350static void print_binder_ref(struct seq_file *m, struct binder_ref *ref) 3351{ 3352 seq_printf(m, " ref %d: desc %d %snode %d s %d w %d d %p\n", 3353 ref->debug_id, ref->desc, ref->node->proc ? "" : "dead ", 3354 ref->node->debug_id, ref->strong, ref->weak, ref->death); 3355} 3356 3357static void print_binder_proc(struct seq_file *m, 3358 struct binder_proc *proc, int print_all) 3359{ 3360 struct binder_work *w; 3361 struct rb_node *n; 3362 size_t start_pos = m->count; 3363 size_t header_pos; 3364 3365 seq_printf(m, "proc %d\n", proc->pid); 3366 header_pos = m->count; 3367 3368 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3369 print_binder_thread(m, rb_entry(n, struct binder_thread, 3370 rb_node), print_all); 3371 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) { 3372 struct binder_node *node = rb_entry(n, struct binder_node, 3373 rb_node); 3374 if (print_all || node->has_async_transaction) 3375 print_binder_node(m, node); 3376 } 3377 if (print_all) { 3378 for (n = rb_first(&proc->refs_by_desc); 3379 n != NULL; 3380 n = rb_next(n)) 3381 print_binder_ref(m, rb_entry(n, struct binder_ref, 3382 rb_node_desc)); 3383 } 3384 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3385 print_binder_buffer(m, " buffer", 3386 rb_entry(n, struct binder_buffer, rb_node)); 3387 list_for_each_entry(w, &proc->todo, entry) 3388 print_binder_work(m, " ", " pending transaction", w); 3389 list_for_each_entry(w, &proc->delivered_death, entry) { 3390 seq_puts(m, " has delivered dead binder\n"); 3391 break; 3392 } 3393 if (!print_all && m->count == header_pos) 3394 m->count = start_pos; 3395} 3396 3397static const char * const binder_return_strings[] = { 3398 "BR_ERROR", 3399 "BR_OK", 3400 "BR_TRANSACTION", 3401 "BR_REPLY", 3402 "BR_ACQUIRE_RESULT", 3403 "BR_DEAD_REPLY", 3404 "BR_TRANSACTION_COMPLETE", 3405 "BR_INCREFS", 3406 "BR_ACQUIRE", 3407 "BR_RELEASE", 3408 "BR_DECREFS", 3409 "BR_ATTEMPT_ACQUIRE", 3410 "BR_NOOP", 3411 "BR_SPAWN_LOOPER", 3412 "BR_FINISHED", 3413 "BR_DEAD_BINDER", 3414 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 3415 "BR_FAILED_REPLY" 3416}; 3417 3418static const char * const binder_command_strings[] = { 3419 "BC_TRANSACTION", 3420 "BC_REPLY", 3421 "BC_ACQUIRE_RESULT", 3422 "BC_FREE_BUFFER", 3423 "BC_INCREFS", 3424 "BC_ACQUIRE", 3425 "BC_RELEASE", 3426 "BC_DECREFS", 3427 "BC_INCREFS_DONE", 3428 "BC_ACQUIRE_DONE", 3429 "BC_ATTEMPT_ACQUIRE", 3430 "BC_REGISTER_LOOPER", 3431 "BC_ENTER_LOOPER", 3432 "BC_EXIT_LOOPER", 3433 "BC_REQUEST_DEATH_NOTIFICATION", 3434 "BC_CLEAR_DEATH_NOTIFICATION", 3435 "BC_DEAD_BINDER_DONE" 3436}; 3437 3438static const char * const binder_objstat_strings[] = { 3439 "proc", 3440 "thread", 3441 "node", 3442 "ref", 3443 "death", 3444 "transaction", 3445 "transaction_complete" 3446}; 3447 3448static void print_binder_stats(struct seq_file *m, const char *prefix, 3449 struct binder_stats *stats) 3450{ 3451 int i; 3452 3453 BUILD_BUG_ON(ARRAY_SIZE(stats->bc) != 3454 ARRAY_SIZE(binder_command_strings)); 3455 for (i = 0; i < ARRAY_SIZE(stats->bc); i++) { 3456 if (stats->bc[i]) 3457 seq_printf(m, "%s%s: %d\n", prefix, 3458 binder_command_strings[i], stats->bc[i]); 3459 } 3460 3461 BUILD_BUG_ON(ARRAY_SIZE(stats->br) != 3462 ARRAY_SIZE(binder_return_strings)); 3463 for (i = 0; i < ARRAY_SIZE(stats->br); i++) { 3464 if (stats->br[i]) 3465 seq_printf(m, "%s%s: %d\n", prefix, 3466 binder_return_strings[i], stats->br[i]); 3467 } 3468 3469 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 3470 ARRAY_SIZE(binder_objstat_strings)); 3471 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 3472 ARRAY_SIZE(stats->obj_deleted)); 3473 for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) { 3474 if (stats->obj_created[i] || stats->obj_deleted[i]) 3475 seq_printf(m, "%s%s: active %d total %d\n", prefix, 3476 binder_objstat_strings[i], 3477 stats->obj_created[i] - stats->obj_deleted[i], 3478 stats->obj_created[i]); 3479 } 3480} 3481 3482static void print_binder_proc_stats(struct seq_file *m, 3483 struct binder_proc *proc) 3484{ 3485 struct binder_work *w; 3486 struct rb_node *n; 3487 int count, strong, weak; 3488 3489 seq_printf(m, "proc %d\n", proc->pid); 3490 count = 0; 3491 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3492 count++; 3493 seq_printf(m, " threads: %d\n", count); 3494 seq_printf(m, " requested threads: %d+%d/%d\n" 3495 " ready threads %d\n" 3496 " free async space %zd\n", proc->requested_threads, 3497 proc->requested_threads_started, proc->max_threads, 3498 proc->ready_threads, proc->free_async_space); 3499 count = 0; 3500 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) 3501 count++; 3502 seq_printf(m, " nodes: %d\n", count); 3503 count = 0; 3504 strong = 0; 3505 weak = 0; 3506 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 3507 struct binder_ref *ref = rb_entry(n, struct binder_ref, 3508 rb_node_desc); 3509 count++; 3510 strong += ref->strong; 3511 weak += ref->weak; 3512 } 3513 seq_printf(m, " refs: %d s %d w %d\n", count, strong, weak); 3514 3515 count = 0; 3516 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3517 count++; 3518 seq_printf(m, " buffers: %d\n", count); 3519 3520 count = 0; 3521 list_for_each_entry(w, &proc->todo, entry) { 3522 switch (w->type) { 3523 case BINDER_WORK_TRANSACTION: 3524 count++; 3525 break; 3526 default: 3527 break; 3528 } 3529 } 3530 seq_printf(m, " pending transactions: %d\n", count); 3531 3532 print_binder_stats(m, " ", &proc->stats); 3533} 3534 3535 3536static int binder_state_show(struct seq_file *m, void *unused) 3537{ 3538 struct binder_proc *proc; 3539 struct binder_node *node; 3540 int do_lock = !binder_debug_no_lock; 3541 3542 if (do_lock) 3543 binder_lock(__func__); 3544 3545 seq_puts(m, "binder state:\n"); 3546 3547 if (!hlist_empty(&binder_dead_nodes)) 3548 seq_puts(m, "dead nodes:\n"); 3549 hlist_for_each_entry(node, &binder_dead_nodes, dead_node) 3550 print_binder_node(m, node); 3551 3552 hlist_for_each_entry(proc, &binder_procs, proc_node) 3553 print_binder_proc(m, proc, 1); 3554 if (do_lock) 3555 binder_unlock(__func__); 3556 return 0; 3557} 3558 3559static int binder_stats_show(struct seq_file *m, void *unused) 3560{ 3561 struct binder_proc *proc; 3562 int do_lock = !binder_debug_no_lock; 3563 3564 if (do_lock) 3565 binder_lock(__func__); 3566 3567 seq_puts(m, "binder stats:\n"); 3568 3569 print_binder_stats(m, "", &binder_stats); 3570 3571 hlist_for_each_entry(proc, &binder_procs, proc_node) 3572 print_binder_proc_stats(m, proc); 3573 if (do_lock) 3574 binder_unlock(__func__); 3575 return 0; 3576} 3577 3578static int binder_transactions_show(struct seq_file *m, void *unused) 3579{ 3580 struct binder_proc *proc; 3581 int do_lock = !binder_debug_no_lock; 3582 3583 if (do_lock) 3584 binder_lock(__func__); 3585 3586 seq_puts(m, "binder transactions:\n"); 3587 hlist_for_each_entry(proc, &binder_procs, proc_node) 3588 print_binder_proc(m, proc, 0); 3589 if (do_lock) 3590 binder_unlock(__func__); 3591 return 0; 3592} 3593 3594static int binder_proc_show(struct seq_file *m, void *unused) 3595{ 3596 struct binder_proc *proc = m->private; 3597 int do_lock = !binder_debug_no_lock; 3598 3599 if (do_lock) 3600 binder_lock(__func__); 3601 seq_puts(m, "binder proc state:\n"); 3602 print_binder_proc(m, proc, 1); 3603 if (do_lock) 3604 binder_unlock(__func__); 3605 return 0; 3606} 3607 3608static void print_binder_transaction_log_entry(struct seq_file *m, 3609 struct binder_transaction_log_entry *e) 3610{ 3611 seq_printf(m, 3612 "%d: %s from %d:%d to %d:%d node %d handle %d size %d:%d\n", 3613 e->debug_id, (e->call_type == 2) ? "reply" : 3614 ((e->call_type == 1) ? "async" : "call "), e->from_proc, 3615 e->from_thread, e->to_proc, e->to_thread, e->to_node, 3616 e->target_handle, e->data_size, e->offsets_size); 3617} 3618 3619static int binder_transaction_log_show(struct seq_file *m, void *unused) 3620{ 3621 struct binder_transaction_log *log = m->private; 3622 int i; 3623 3624 if (log->full) { 3625 for (i = log->next; i < ARRAY_SIZE(log->entry); i++) 3626 print_binder_transaction_log_entry(m, &log->entry[i]); 3627 } 3628 for (i = 0; i < log->next; i++) 3629 print_binder_transaction_log_entry(m, &log->entry[i]); 3630 return 0; 3631} 3632 3633static const struct file_operations binder_fops = { 3634 .owner = THIS_MODULE, 3635 .poll = binder_poll, 3636 .unlocked_ioctl = binder_ioctl, 3637 .compat_ioctl = binder_ioctl, 3638 .mmap = binder_mmap, 3639 .open = binder_open, 3640 .flush = binder_flush, 3641 .release = binder_release, 3642}; 3643 3644static struct miscdevice binder_miscdev = { 3645 .minor = MISC_DYNAMIC_MINOR, 3646 .name = "binder", 3647 .fops = &binder_fops 3648}; 3649 3650BINDER_DEBUG_ENTRY(state); 3651BINDER_DEBUG_ENTRY(stats); 3652BINDER_DEBUG_ENTRY(transactions); 3653BINDER_DEBUG_ENTRY(transaction_log); 3654 3655static int __init binder_init(void) 3656{ 3657 int ret; 3658 3659 binder_deferred_workqueue = create_singlethread_workqueue("binder"); 3660 if (!binder_deferred_workqueue) 3661 return -ENOMEM; 3662 3663 binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL); 3664 if (binder_debugfs_dir_entry_root) 3665 binder_debugfs_dir_entry_proc = debugfs_create_dir("proc", 3666 binder_debugfs_dir_entry_root); 3667 ret = misc_register(&binder_miscdev); 3668 if (binder_debugfs_dir_entry_root) { 3669 debugfs_create_file("state", 3670 S_IRUGO, 3671 binder_debugfs_dir_entry_root, 3672 NULL, 3673 &binder_state_fops); 3674 debugfs_create_file("stats", 3675 S_IRUGO, 3676 binder_debugfs_dir_entry_root, 3677 NULL, 3678 &binder_stats_fops); 3679 debugfs_create_file("transactions", 3680 S_IRUGO, 3681 binder_debugfs_dir_entry_root, 3682 NULL, 3683 &binder_transactions_fops); 3684 debugfs_create_file("transaction_log", 3685 S_IRUGO, 3686 binder_debugfs_dir_entry_root, 3687 &binder_transaction_log, 3688 &binder_transaction_log_fops); 3689 debugfs_create_file("failed_transaction_log", 3690 S_IRUGO, 3691 binder_debugfs_dir_entry_root, 3692 &binder_transaction_log_failed, 3693 &binder_transaction_log_fops); 3694 } 3695 return ret; 3696} 3697 3698device_initcall(binder_init); 3699 3700#define CREATE_TRACE_POINTS 3701#include "binder_trace.h" 3702 3703MODULE_LICENSE("GPL v2"); 3704