1 /* binder.c 2 * 3 * Android IPC Subsystem 4 * 5 * Copyright (C) 2007-2008 Google, Inc. 6 * 7 * This software is licensed under the terms of the GNU General Public 8 * License version 2, as published by the Free Software Foundation, and 9 * may be copied, distributed, and modified under those terms. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 */ 17 18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 19 20 #include <asm/cacheflush.h> 21 #include <linux/fdtable.h> 22 #include <linux/file.h> 23 #include <linux/freezer.h> 24 #include <linux/fs.h> 25 #include <linux/list.h> 26 #include <linux/miscdevice.h> 27 #include <linux/mm.h> 28 #include <linux/module.h> 29 #include <linux/mutex.h> 30 #include <linux/nsproxy.h> 31 #include <linux/poll.h> 32 #include <linux/debugfs.h> 33 #include <linux/rbtree.h> 34 #include <linux/sched.h> 35 #include <linux/seq_file.h> 36 #include <linux/uaccess.h> 37 #include <linux/vmalloc.h> 38 #include <linux/slab.h> 39 #include <linux/pid_namespace.h> 40 41 #include "binder.h" 42 #include "binder_trace.h" 43 44 static DEFINE_MUTEX(binder_main_lock); 45 static DEFINE_MUTEX(binder_deferred_lock); 46 static DEFINE_MUTEX(binder_mmap_lock); 47 48 static HLIST_HEAD(binder_procs); 49 static HLIST_HEAD(binder_deferred_list); 50 static HLIST_HEAD(binder_dead_nodes); 51 52 static struct dentry *binder_debugfs_dir_entry_root; 53 static struct dentry *binder_debugfs_dir_entry_proc; 54 static struct binder_node *binder_context_mgr_node; 55 static kuid_t binder_context_mgr_uid = INVALID_UID; 56 static int binder_last_id; 57 static struct workqueue_struct *binder_deferred_workqueue; 58 59 #define BINDER_DEBUG_ENTRY(name) \ 60 static int binder_##name##_open(struct inode *inode, struct file *file) \ 61 { \ 62 return single_open(file, binder_##name##_show, inode->i_private); \ 63 } \ 64 \ 65 static const struct file_operations binder_##name##_fops = { \ 66 .owner = THIS_MODULE, \ 67 .open = binder_##name##_open, \ 68 .read = seq_read, \ 69 .llseek = seq_lseek, \ 70 .release = single_release, \ 71 } 72 73 static int binder_proc_show(struct seq_file *m, void *unused); 74 BINDER_DEBUG_ENTRY(proc); 75 76 /* This is only defined in include/asm-arm/sizes.h */ 77 #ifndef SZ_1K 78 #define SZ_1K 0x400 79 #endif 80 81 #ifndef SZ_4M 82 #define SZ_4M 0x400000 83 #endif 84 85 #define FORBIDDEN_MMAP_FLAGS (VM_WRITE) 86 87 #define BINDER_SMALL_BUF_SIZE (PAGE_SIZE * 64) 88 89 enum { 90 BINDER_DEBUG_USER_ERROR = 1U << 0, 91 BINDER_DEBUG_FAILED_TRANSACTION = 1U << 1, 92 BINDER_DEBUG_DEAD_TRANSACTION = 1U << 2, 93 BINDER_DEBUG_OPEN_CLOSE = 1U << 3, 94 BINDER_DEBUG_DEAD_BINDER = 1U << 4, 95 BINDER_DEBUG_DEATH_NOTIFICATION = 1U << 5, 96 BINDER_DEBUG_READ_WRITE = 1U << 6, 97 BINDER_DEBUG_USER_REFS = 1U << 7, 98 BINDER_DEBUG_THREADS = 1U << 8, 99 BINDER_DEBUG_TRANSACTION = 1U << 9, 100 BINDER_DEBUG_TRANSACTION_COMPLETE = 1U << 10, 101 BINDER_DEBUG_FREE_BUFFER = 1U << 11, 102 BINDER_DEBUG_INTERNAL_REFS = 1U << 12, 103 BINDER_DEBUG_BUFFER_ALLOC = 1U << 13, 104 BINDER_DEBUG_PRIORITY_CAP = 1U << 14, 105 BINDER_DEBUG_BUFFER_ALLOC_ASYNC = 1U << 15, 106 }; 107 static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR | 108 BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION; 109 module_param_named(debug_mask, binder_debug_mask, uint, S_IWUSR | S_IRUGO); 110 111 static bool binder_debug_no_lock; 112 module_param_named(proc_no_lock, binder_debug_no_lock, bool, S_IWUSR | S_IRUGO); 113 114 static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait); 115 static int binder_stop_on_user_error; 116 117 static int binder_set_stop_on_user_error(const char *val, 118 struct kernel_param *kp) 119 { 120 int ret; 121 122 ret = param_set_int(val, kp); 123 if (binder_stop_on_user_error < 2) 124 wake_up(&binder_user_error_wait); 125 return ret; 126 } 127 module_param_call(stop_on_user_error, binder_set_stop_on_user_error, 128 param_get_int, &binder_stop_on_user_error, S_IWUSR | S_IRUGO); 129 130 #define binder_debug(mask, x...) \ 131 do { \ 132 if (binder_debug_mask & mask) \ 133 pr_info(x); \ 134 } while (0) 135 136 #define binder_user_error(x...) \ 137 do { \ 138 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \ 139 pr_info(x); \ 140 if (binder_stop_on_user_error) \ 141 binder_stop_on_user_error = 2; \ 142 } while (0) 143 144 enum binder_stat_types { 145 BINDER_STAT_PROC, 146 BINDER_STAT_THREAD, 147 BINDER_STAT_NODE, 148 BINDER_STAT_REF, 149 BINDER_STAT_DEATH, 150 BINDER_STAT_TRANSACTION, 151 BINDER_STAT_TRANSACTION_COMPLETE, 152 BINDER_STAT_COUNT 153 }; 154 155 struct binder_stats { 156 int br[_IOC_NR(BR_FAILED_REPLY) + 1]; 157 int bc[_IOC_NR(BC_DEAD_BINDER_DONE) + 1]; 158 int obj_created[BINDER_STAT_COUNT]; 159 int obj_deleted[BINDER_STAT_COUNT]; 160 }; 161 162 static struct binder_stats binder_stats; 163 164 static inline void binder_stats_deleted(enum binder_stat_types type) 165 { 166 binder_stats.obj_deleted[type]++; 167 } 168 169 static inline void binder_stats_created(enum binder_stat_types type) 170 { 171 binder_stats.obj_created[type]++; 172 } 173 174 struct binder_transaction_log_entry { 175 int debug_id; 176 int call_type; 177 int from_proc; 178 int from_thread; 179 int target_handle; 180 int to_proc; 181 int to_thread; 182 int to_node; 183 int data_size; 184 int offsets_size; 185 }; 186 struct binder_transaction_log { 187 int next; 188 int full; 189 struct binder_transaction_log_entry entry[32]; 190 }; 191 static struct binder_transaction_log binder_transaction_log; 192 static struct binder_transaction_log binder_transaction_log_failed; 193 194 static struct binder_transaction_log_entry *binder_transaction_log_add( 195 struct binder_transaction_log *log) 196 { 197 struct binder_transaction_log_entry *e; 198 199 e = &log->entry[log->next]; 200 memset(e, 0, sizeof(*e)); 201 log->next++; 202 if (log->next == ARRAY_SIZE(log->entry)) { 203 log->next = 0; 204 log->full = 1; 205 } 206 return e; 207 } 208 209 struct binder_work { 210 struct list_head entry; 211 enum { 212 BINDER_WORK_TRANSACTION = 1, 213 BINDER_WORK_TRANSACTION_COMPLETE, 214 BINDER_WORK_NODE, 215 BINDER_WORK_DEAD_BINDER, 216 BINDER_WORK_DEAD_BINDER_AND_CLEAR, 217 BINDER_WORK_CLEAR_DEATH_NOTIFICATION, 218 } type; 219 }; 220 221 struct binder_node { 222 int debug_id; 223 struct binder_work work; 224 union { 225 struct rb_node rb_node; 226 struct hlist_node dead_node; 227 }; 228 struct binder_proc *proc; 229 struct hlist_head refs; 230 int internal_strong_refs; 231 int local_weak_refs; 232 int local_strong_refs; 233 binder_uintptr_t ptr; 234 binder_uintptr_t cookie; 235 unsigned has_strong_ref:1; 236 unsigned pending_strong_ref:1; 237 unsigned has_weak_ref:1; 238 unsigned pending_weak_ref:1; 239 unsigned has_async_transaction:1; 240 unsigned accept_fds:1; 241 unsigned min_priority:8; 242 struct list_head async_todo; 243 }; 244 245 struct binder_ref_death { 246 struct binder_work work; 247 binder_uintptr_t cookie; 248 }; 249 250 struct binder_ref { 251 /* Lookups needed: */ 252 /* node + proc => ref (transaction) */ 253 /* desc + proc => ref (transaction, inc/dec ref) */ 254 /* node => refs + procs (proc exit) */ 255 int debug_id; 256 struct rb_node rb_node_desc; 257 struct rb_node rb_node_node; 258 struct hlist_node node_entry; 259 struct binder_proc *proc; 260 struct binder_node *node; 261 uint32_t desc; 262 int strong; 263 int weak; 264 struct binder_ref_death *death; 265 }; 266 267 struct binder_buffer { 268 struct list_head entry; /* free and allocated entries by address */ 269 struct rb_node rb_node; /* free entry by size or allocated entry */ 270 /* by address */ 271 unsigned free:1; 272 unsigned allow_user_free:1; 273 unsigned async_transaction:1; 274 unsigned debug_id:29; 275 276 struct binder_transaction *transaction; 277 278 struct binder_node *target_node; 279 size_t data_size; 280 size_t offsets_size; 281 uint8_t data[0]; 282 }; 283 284 enum binder_deferred_state { 285 BINDER_DEFERRED_PUT_FILES = 0x01, 286 BINDER_DEFERRED_FLUSH = 0x02, 287 BINDER_DEFERRED_RELEASE = 0x04, 288 }; 289 290 struct binder_proc { 291 struct hlist_node proc_node; 292 struct rb_root threads; 293 struct rb_root nodes; 294 struct rb_root refs_by_desc; 295 struct rb_root refs_by_node; 296 int pid; 297 struct vm_area_struct *vma; 298 struct mm_struct *vma_vm_mm; 299 struct task_struct *tsk; 300 struct files_struct *files; 301 struct hlist_node deferred_work_node; 302 int deferred_work; 303 void *buffer; 304 ptrdiff_t user_buffer_offset; 305 306 struct list_head buffers; 307 struct rb_root free_buffers; 308 struct rb_root allocated_buffers; 309 size_t free_async_space; 310 311 struct page **pages; 312 size_t buffer_size; 313 uint32_t buffer_free; 314 struct list_head todo; 315 wait_queue_head_t wait; 316 struct binder_stats stats; 317 struct list_head delivered_death; 318 int max_threads; 319 int requested_threads; 320 int requested_threads_started; 321 int ready_threads; 322 long default_priority; 323 struct dentry *debugfs_entry; 324 }; 325 326 enum { 327 BINDER_LOOPER_STATE_REGISTERED = 0x01, 328 BINDER_LOOPER_STATE_ENTERED = 0x02, 329 BINDER_LOOPER_STATE_EXITED = 0x04, 330 BINDER_LOOPER_STATE_INVALID = 0x08, 331 BINDER_LOOPER_STATE_WAITING = 0x10, 332 BINDER_LOOPER_STATE_NEED_RETURN = 0x20 333 }; 334 335 struct binder_thread { 336 struct binder_proc *proc; 337 struct rb_node rb_node; 338 int pid; 339 int looper; 340 struct binder_transaction *transaction_stack; 341 struct list_head todo; 342 uint32_t return_error; /* Write failed, return error code in read buf */ 343 uint32_t return_error2; /* Write failed, return error code in read */ 344 /* buffer. Used when sending a reply to a dead process that */ 345 /* we are also waiting on */ 346 wait_queue_head_t wait; 347 struct binder_stats stats; 348 }; 349 350 struct binder_transaction { 351 int debug_id; 352 struct binder_work work; 353 struct binder_thread *from; 354 struct binder_transaction *from_parent; 355 struct binder_proc *to_proc; 356 struct binder_thread *to_thread; 357 struct binder_transaction *to_parent; 358 unsigned need_reply:1; 359 /* unsigned is_dead:1; */ /* not used at the moment */ 360 361 struct binder_buffer *buffer; 362 unsigned int code; 363 unsigned int flags; 364 long priority; 365 long saved_priority; 366 kuid_t sender_euid; 367 }; 368 369 static void 370 binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer); 371 372 static int task_get_unused_fd_flags(struct binder_proc *proc, int flags) 373 { 374 struct files_struct *files = proc->files; 375 unsigned long rlim_cur; 376 unsigned long irqs; 377 378 if (files == NULL) 379 return -ESRCH; 380 381 if (!lock_task_sighand(proc->tsk, &irqs)) 382 return -EMFILE; 383 384 rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE); 385 unlock_task_sighand(proc->tsk, &irqs); 386 387 return __alloc_fd(files, 0, rlim_cur, flags); 388 } 389 390 /* 391 * copied from fd_install 392 */ 393 static void task_fd_install( 394 struct binder_proc *proc, unsigned int fd, struct file *file) 395 { 396 if (proc->files) 397 __fd_install(proc->files, fd, file); 398 } 399 400 /* 401 * copied from sys_close 402 */ 403 static long task_close_fd(struct binder_proc *proc, unsigned int fd) 404 { 405 int retval; 406 407 if (proc->files == NULL) 408 return -ESRCH; 409 410 retval = __close_fd(proc->files, fd); 411 /* can't restart close syscall because file table entry was cleared */ 412 if (unlikely(retval == -ERESTARTSYS || 413 retval == -ERESTARTNOINTR || 414 retval == -ERESTARTNOHAND || 415 retval == -ERESTART_RESTARTBLOCK)) 416 retval = -EINTR; 417 418 return retval; 419 } 420 421 static inline void binder_lock(const char *tag) 422 { 423 trace_binder_lock(tag); 424 mutex_lock(&binder_main_lock); 425 trace_binder_locked(tag); 426 } 427 428 static inline void binder_unlock(const char *tag) 429 { 430 trace_binder_unlock(tag); 431 mutex_unlock(&binder_main_lock); 432 } 433 434 static void binder_set_nice(long nice) 435 { 436 long min_nice; 437 438 if (can_nice(current, nice)) { 439 set_user_nice(current, nice); 440 return; 441 } 442 min_nice = rlimit_to_nice(current->signal->rlim[RLIMIT_NICE].rlim_cur); 443 binder_debug(BINDER_DEBUG_PRIORITY_CAP, 444 "%d: nice value %ld not allowed use %ld instead\n", 445 current->pid, nice, min_nice); 446 set_user_nice(current, min_nice); 447 if (min_nice <= MAX_NICE) 448 return; 449 binder_user_error("%d RLIMIT_NICE not set\n", current->pid); 450 } 451 452 static size_t binder_buffer_size(struct binder_proc *proc, 453 struct binder_buffer *buffer) 454 { 455 if (list_is_last(&buffer->entry, &proc->buffers)) 456 return proc->buffer + proc->buffer_size - (void *)buffer->data; 457 return (size_t)list_entry(buffer->entry.next, 458 struct binder_buffer, entry) - (size_t)buffer->data; 459 } 460 461 static void binder_insert_free_buffer(struct binder_proc *proc, 462 struct binder_buffer *new_buffer) 463 { 464 struct rb_node **p = &proc->free_buffers.rb_node; 465 struct rb_node *parent = NULL; 466 struct binder_buffer *buffer; 467 size_t buffer_size; 468 size_t new_buffer_size; 469 470 BUG_ON(!new_buffer->free); 471 472 new_buffer_size = binder_buffer_size(proc, new_buffer); 473 474 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 475 "%d: add free buffer, size %zd, at %p\n", 476 proc->pid, new_buffer_size, new_buffer); 477 478 while (*p) { 479 parent = *p; 480 buffer = rb_entry(parent, struct binder_buffer, rb_node); 481 BUG_ON(!buffer->free); 482 483 buffer_size = binder_buffer_size(proc, buffer); 484 485 if (new_buffer_size < buffer_size) 486 p = &parent->rb_left; 487 else 488 p = &parent->rb_right; 489 } 490 rb_link_node(&new_buffer->rb_node, parent, p); 491 rb_insert_color(&new_buffer->rb_node, &proc->free_buffers); 492 } 493 494 static void binder_insert_allocated_buffer(struct binder_proc *proc, 495 struct binder_buffer *new_buffer) 496 { 497 struct rb_node **p = &proc->allocated_buffers.rb_node; 498 struct rb_node *parent = NULL; 499 struct binder_buffer *buffer; 500 501 BUG_ON(new_buffer->free); 502 503 while (*p) { 504 parent = *p; 505 buffer = rb_entry(parent, struct binder_buffer, rb_node); 506 BUG_ON(buffer->free); 507 508 if (new_buffer < buffer) 509 p = &parent->rb_left; 510 else if (new_buffer > buffer) 511 p = &parent->rb_right; 512 else 513 BUG(); 514 } 515 rb_link_node(&new_buffer->rb_node, parent, p); 516 rb_insert_color(&new_buffer->rb_node, &proc->allocated_buffers); 517 } 518 519 static struct binder_buffer *binder_buffer_lookup(struct binder_proc *proc, 520 uintptr_t user_ptr) 521 { 522 struct rb_node *n = proc->allocated_buffers.rb_node; 523 struct binder_buffer *buffer; 524 struct binder_buffer *kern_ptr; 525 526 kern_ptr = (struct binder_buffer *)(user_ptr - proc->user_buffer_offset 527 - offsetof(struct binder_buffer, data)); 528 529 while (n) { 530 buffer = rb_entry(n, struct binder_buffer, rb_node); 531 BUG_ON(buffer->free); 532 533 if (kern_ptr < buffer) 534 n = n->rb_left; 535 else if (kern_ptr > buffer) 536 n = n->rb_right; 537 else 538 return buffer; 539 } 540 return NULL; 541 } 542 543 static int binder_update_page_range(struct binder_proc *proc, int allocate, 544 void *start, void *end, 545 struct vm_area_struct *vma) 546 { 547 void *page_addr; 548 unsigned long user_page_addr; 549 struct vm_struct tmp_area; 550 struct page **page; 551 struct mm_struct *mm; 552 553 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 554 "%d: %s pages %p-%p\n", proc->pid, 555 allocate ? "allocate" : "free", start, end); 556 557 if (end <= start) 558 return 0; 559 560 trace_binder_update_page_range(proc, allocate, start, end); 561 562 if (vma) 563 mm = NULL; 564 else 565 mm = get_task_mm(proc->tsk); 566 567 if (mm) { 568 down_write(&mm->mmap_sem); 569 vma = proc->vma; 570 if (vma && mm != proc->vma_vm_mm) { 571 pr_err("%d: vma mm and task mm mismatch\n", 572 proc->pid); 573 vma = NULL; 574 } 575 } 576 577 if (allocate == 0) 578 goto free_range; 579 580 if (vma == NULL) { 581 pr_err("%d: binder_alloc_buf failed to map pages in userspace, no vma\n", 582 proc->pid); 583 goto err_no_vma; 584 } 585 586 for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) { 587 int ret; 588 589 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 590 591 BUG_ON(*page); 592 *page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO); 593 if (*page == NULL) { 594 pr_err("%d: binder_alloc_buf failed for page at %p\n", 595 proc->pid, page_addr); 596 goto err_alloc_page_failed; 597 } 598 tmp_area.addr = page_addr; 599 tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */; 600 ret = map_vm_area(&tmp_area, PAGE_KERNEL, page); 601 if (ret) { 602 pr_err("%d: binder_alloc_buf failed to map page at %p in kernel\n", 603 proc->pid, page_addr); 604 goto err_map_kernel_failed; 605 } 606 user_page_addr = 607 (uintptr_t)page_addr + proc->user_buffer_offset; 608 ret = vm_insert_page(vma, user_page_addr, page[0]); 609 if (ret) { 610 pr_err("%d: binder_alloc_buf failed to map page at %lx in userspace\n", 611 proc->pid, user_page_addr); 612 goto err_vm_insert_page_failed; 613 } 614 /* vm_insert_page does not seem to increment the refcount */ 615 } 616 if (mm) { 617 up_write(&mm->mmap_sem); 618 mmput(mm); 619 } 620 return 0; 621 622 free_range: 623 for (page_addr = end - PAGE_SIZE; page_addr >= start; 624 page_addr -= PAGE_SIZE) { 625 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 626 if (vma) 627 zap_page_range(vma, (uintptr_t)page_addr + 628 proc->user_buffer_offset, PAGE_SIZE, NULL); 629 err_vm_insert_page_failed: 630 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE); 631 err_map_kernel_failed: 632 __free_page(*page); 633 *page = NULL; 634 err_alloc_page_failed: 635 ; 636 } 637 err_no_vma: 638 if (mm) { 639 up_write(&mm->mmap_sem); 640 mmput(mm); 641 } 642 return -ENOMEM; 643 } 644 645 static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc, 646 size_t data_size, 647 size_t offsets_size, int is_async) 648 { 649 struct rb_node *n = proc->free_buffers.rb_node; 650 struct binder_buffer *buffer; 651 size_t buffer_size; 652 struct rb_node *best_fit = NULL; 653 void *has_page_addr; 654 void *end_page_addr; 655 size_t size; 656 657 if (proc->vma == NULL) { 658 pr_err("%d: binder_alloc_buf, no vma\n", 659 proc->pid); 660 return NULL; 661 } 662 663 size = ALIGN(data_size, sizeof(void *)) + 664 ALIGN(offsets_size, sizeof(void *)); 665 666 if (size < data_size || size < offsets_size) { 667 binder_user_error("%d: got transaction with invalid size %zd-%zd\n", 668 proc->pid, data_size, offsets_size); 669 return NULL; 670 } 671 672 if (is_async && 673 proc->free_async_space < size + sizeof(struct binder_buffer)) { 674 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 675 "%d: binder_alloc_buf size %zd failed, no async space left\n", 676 proc->pid, size); 677 return NULL; 678 } 679 680 while (n) { 681 buffer = rb_entry(n, struct binder_buffer, rb_node); 682 BUG_ON(!buffer->free); 683 buffer_size = binder_buffer_size(proc, buffer); 684 685 if (size < buffer_size) { 686 best_fit = n; 687 n = n->rb_left; 688 } else if (size > buffer_size) 689 n = n->rb_right; 690 else { 691 best_fit = n; 692 break; 693 } 694 } 695 if (best_fit == NULL) { 696 pr_err("%d: binder_alloc_buf size %zd failed, no address space\n", 697 proc->pid, size); 698 return NULL; 699 } 700 if (n == NULL) { 701 buffer = rb_entry(best_fit, struct binder_buffer, rb_node); 702 buffer_size = binder_buffer_size(proc, buffer); 703 } 704 705 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 706 "%d: binder_alloc_buf size %zd got buffer %p size %zd\n", 707 proc->pid, size, buffer, buffer_size); 708 709 has_page_addr = 710 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK); 711 if (n == NULL) { 712 if (size + sizeof(struct binder_buffer) + 4 >= buffer_size) 713 buffer_size = size; /* no room for other buffers */ 714 else 715 buffer_size = size + sizeof(struct binder_buffer); 716 } 717 end_page_addr = 718 (void *)PAGE_ALIGN((uintptr_t)buffer->data + buffer_size); 719 if (end_page_addr > has_page_addr) 720 end_page_addr = has_page_addr; 721 if (binder_update_page_range(proc, 1, 722 (void *)PAGE_ALIGN((uintptr_t)buffer->data), end_page_addr, NULL)) 723 return NULL; 724 725 rb_erase(best_fit, &proc->free_buffers); 726 buffer->free = 0; 727 binder_insert_allocated_buffer(proc, buffer); 728 if (buffer_size != size) { 729 struct binder_buffer *new_buffer = (void *)buffer->data + size; 730 731 list_add(&new_buffer->entry, &buffer->entry); 732 new_buffer->free = 1; 733 binder_insert_free_buffer(proc, new_buffer); 734 } 735 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 736 "%d: binder_alloc_buf size %zd got %p\n", 737 proc->pid, size, buffer); 738 buffer->data_size = data_size; 739 buffer->offsets_size = offsets_size; 740 buffer->async_transaction = is_async; 741 if (is_async) { 742 proc->free_async_space -= size + sizeof(struct binder_buffer); 743 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 744 "%d: binder_alloc_buf size %zd async free %zd\n", 745 proc->pid, size, proc->free_async_space); 746 } 747 748 return buffer; 749 } 750 751 static void *buffer_start_page(struct binder_buffer *buffer) 752 { 753 return (void *)((uintptr_t)buffer & PAGE_MASK); 754 } 755 756 static void *buffer_end_page(struct binder_buffer *buffer) 757 { 758 return (void *)(((uintptr_t)(buffer + 1) - 1) & PAGE_MASK); 759 } 760 761 static void binder_delete_free_buffer(struct binder_proc *proc, 762 struct binder_buffer *buffer) 763 { 764 struct binder_buffer *prev, *next = NULL; 765 int free_page_end = 1; 766 int free_page_start = 1; 767 768 BUG_ON(proc->buffers.next == &buffer->entry); 769 prev = list_entry(buffer->entry.prev, struct binder_buffer, entry); 770 BUG_ON(!prev->free); 771 if (buffer_end_page(prev) == buffer_start_page(buffer)) { 772 free_page_start = 0; 773 if (buffer_end_page(prev) == buffer_end_page(buffer)) 774 free_page_end = 0; 775 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 776 "%d: merge free, buffer %p share page with %p\n", 777 proc->pid, buffer, prev); 778 } 779 780 if (!list_is_last(&buffer->entry, &proc->buffers)) { 781 next = list_entry(buffer->entry.next, 782 struct binder_buffer, entry); 783 if (buffer_start_page(next) == buffer_end_page(buffer)) { 784 free_page_end = 0; 785 if (buffer_start_page(next) == 786 buffer_start_page(buffer)) 787 free_page_start = 0; 788 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 789 "%d: merge free, buffer %p share page with %p\n", 790 proc->pid, buffer, prev); 791 } 792 } 793 list_del(&buffer->entry); 794 if (free_page_start || free_page_end) { 795 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 796 "%d: merge free, buffer %p do not share page%s%s with %p or %p\n", 797 proc->pid, buffer, free_page_start ? "" : " end", 798 free_page_end ? "" : " start", prev, next); 799 binder_update_page_range(proc, 0, free_page_start ? 800 buffer_start_page(buffer) : buffer_end_page(buffer), 801 (free_page_end ? buffer_end_page(buffer) : 802 buffer_start_page(buffer)) + PAGE_SIZE, NULL); 803 } 804 } 805 806 static void binder_free_buf(struct binder_proc *proc, 807 struct binder_buffer *buffer) 808 { 809 size_t size, buffer_size; 810 811 buffer_size = binder_buffer_size(proc, buffer); 812 813 size = ALIGN(buffer->data_size, sizeof(void *)) + 814 ALIGN(buffer->offsets_size, sizeof(void *)); 815 816 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 817 "%d: binder_free_buf %p size %zd buffer_size %zd\n", 818 proc->pid, buffer, size, buffer_size); 819 820 BUG_ON(buffer->free); 821 BUG_ON(size > buffer_size); 822 BUG_ON(buffer->transaction != NULL); 823 BUG_ON((void *)buffer < proc->buffer); 824 BUG_ON((void *)buffer > proc->buffer + proc->buffer_size); 825 826 if (buffer->async_transaction) { 827 proc->free_async_space += size + sizeof(struct binder_buffer); 828 829 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 830 "%d: binder_free_buf size %zd async free %zd\n", 831 proc->pid, size, proc->free_async_space); 832 } 833 834 binder_update_page_range(proc, 0, 835 (void *)PAGE_ALIGN((uintptr_t)buffer->data), 836 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK), 837 NULL); 838 rb_erase(&buffer->rb_node, &proc->allocated_buffers); 839 buffer->free = 1; 840 if (!list_is_last(&buffer->entry, &proc->buffers)) { 841 struct binder_buffer *next = list_entry(buffer->entry.next, 842 struct binder_buffer, entry); 843 844 if (next->free) { 845 rb_erase(&next->rb_node, &proc->free_buffers); 846 binder_delete_free_buffer(proc, next); 847 } 848 } 849 if (proc->buffers.next != &buffer->entry) { 850 struct binder_buffer *prev = list_entry(buffer->entry.prev, 851 struct binder_buffer, entry); 852 853 if (prev->free) { 854 binder_delete_free_buffer(proc, buffer); 855 rb_erase(&prev->rb_node, &proc->free_buffers); 856 buffer = prev; 857 } 858 } 859 binder_insert_free_buffer(proc, buffer); 860 } 861 862 static struct binder_node *binder_get_node(struct binder_proc *proc, 863 binder_uintptr_t ptr) 864 { 865 struct rb_node *n = proc->nodes.rb_node; 866 struct binder_node *node; 867 868 while (n) { 869 node = rb_entry(n, struct binder_node, rb_node); 870 871 if (ptr < node->ptr) 872 n = n->rb_left; 873 else if (ptr > node->ptr) 874 n = n->rb_right; 875 else 876 return node; 877 } 878 return NULL; 879 } 880 881 static struct binder_node *binder_new_node(struct binder_proc *proc, 882 binder_uintptr_t ptr, 883 binder_uintptr_t cookie) 884 { 885 struct rb_node **p = &proc->nodes.rb_node; 886 struct rb_node *parent = NULL; 887 struct binder_node *node; 888 889 while (*p) { 890 parent = *p; 891 node = rb_entry(parent, struct binder_node, rb_node); 892 893 if (ptr < node->ptr) 894 p = &(*p)->rb_left; 895 else if (ptr > node->ptr) 896 p = &(*p)->rb_right; 897 else 898 return NULL; 899 } 900 901 node = kzalloc(sizeof(*node), GFP_KERNEL); 902 if (node == NULL) 903 return NULL; 904 binder_stats_created(BINDER_STAT_NODE); 905 rb_link_node(&node->rb_node, parent, p); 906 rb_insert_color(&node->rb_node, &proc->nodes); 907 node->debug_id = ++binder_last_id; 908 node->proc = proc; 909 node->ptr = ptr; 910 node->cookie = cookie; 911 node->work.type = BINDER_WORK_NODE; 912 INIT_LIST_HEAD(&node->work.entry); 913 INIT_LIST_HEAD(&node->async_todo); 914 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 915 "%d:%d node %d u%016llx c%016llx created\n", 916 proc->pid, current->pid, node->debug_id, 917 (u64)node->ptr, (u64)node->cookie); 918 return node; 919 } 920 921 static int binder_inc_node(struct binder_node *node, int strong, int internal, 922 struct list_head *target_list) 923 { 924 if (strong) { 925 if (internal) { 926 if (target_list == NULL && 927 node->internal_strong_refs == 0 && 928 !(node == binder_context_mgr_node && 929 node->has_strong_ref)) { 930 pr_err("invalid inc strong node for %d\n", 931 node->debug_id); 932 return -EINVAL; 933 } 934 node->internal_strong_refs++; 935 } else 936 node->local_strong_refs++; 937 if (!node->has_strong_ref && target_list) { 938 list_del_init(&node->work.entry); 939 list_add_tail(&node->work.entry, target_list); 940 } 941 } else { 942 if (!internal) 943 node->local_weak_refs++; 944 if (!node->has_weak_ref && list_empty(&node->work.entry)) { 945 if (target_list == NULL) { 946 pr_err("invalid inc weak node for %d\n", 947 node->debug_id); 948 return -EINVAL; 949 } 950 list_add_tail(&node->work.entry, target_list); 951 } 952 } 953 return 0; 954 } 955 956 static int binder_dec_node(struct binder_node *node, int strong, int internal) 957 { 958 if (strong) { 959 if (internal) 960 node->internal_strong_refs--; 961 else 962 node->local_strong_refs--; 963 if (node->local_strong_refs || node->internal_strong_refs) 964 return 0; 965 } else { 966 if (!internal) 967 node->local_weak_refs--; 968 if (node->local_weak_refs || !hlist_empty(&node->refs)) 969 return 0; 970 } 971 if (node->proc && (node->has_strong_ref || node->has_weak_ref)) { 972 if (list_empty(&node->work.entry)) { 973 list_add_tail(&node->work.entry, &node->proc->todo); 974 wake_up_interruptible(&node->proc->wait); 975 } 976 } else { 977 if (hlist_empty(&node->refs) && !node->local_strong_refs && 978 !node->local_weak_refs) { 979 list_del_init(&node->work.entry); 980 if (node->proc) { 981 rb_erase(&node->rb_node, &node->proc->nodes); 982 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 983 "refless node %d deleted\n", 984 node->debug_id); 985 } else { 986 hlist_del(&node->dead_node); 987 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 988 "dead node %d deleted\n", 989 node->debug_id); 990 } 991 kfree(node); 992 binder_stats_deleted(BINDER_STAT_NODE); 993 } 994 } 995 996 return 0; 997 } 998 999 1000 static struct binder_ref *binder_get_ref(struct binder_proc *proc, 1001 uint32_t desc) 1002 { 1003 struct rb_node *n = proc->refs_by_desc.rb_node; 1004 struct binder_ref *ref; 1005 1006 while (n) { 1007 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1008 1009 if (desc < ref->desc) 1010 n = n->rb_left; 1011 else if (desc > ref->desc) 1012 n = n->rb_right; 1013 else 1014 return ref; 1015 } 1016 return NULL; 1017 } 1018 1019 static struct binder_ref *binder_get_ref_for_node(struct binder_proc *proc, 1020 struct binder_node *node) 1021 { 1022 struct rb_node *n; 1023 struct rb_node **p = &proc->refs_by_node.rb_node; 1024 struct rb_node *parent = NULL; 1025 struct binder_ref *ref, *new_ref; 1026 1027 while (*p) { 1028 parent = *p; 1029 ref = rb_entry(parent, struct binder_ref, rb_node_node); 1030 1031 if (node < ref->node) 1032 p = &(*p)->rb_left; 1033 else if (node > ref->node) 1034 p = &(*p)->rb_right; 1035 else 1036 return ref; 1037 } 1038 new_ref = kzalloc(sizeof(*ref), GFP_KERNEL); 1039 if (new_ref == NULL) 1040 return NULL; 1041 binder_stats_created(BINDER_STAT_REF); 1042 new_ref->debug_id = ++binder_last_id; 1043 new_ref->proc = proc; 1044 new_ref->node = node; 1045 rb_link_node(&new_ref->rb_node_node, parent, p); 1046 rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node); 1047 1048 new_ref->desc = (node == binder_context_mgr_node) ? 0 : 1; 1049 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 1050 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1051 if (ref->desc > new_ref->desc) 1052 break; 1053 new_ref->desc = ref->desc + 1; 1054 } 1055 1056 p = &proc->refs_by_desc.rb_node; 1057 while (*p) { 1058 parent = *p; 1059 ref = rb_entry(parent, struct binder_ref, rb_node_desc); 1060 1061 if (new_ref->desc < ref->desc) 1062 p = &(*p)->rb_left; 1063 else if (new_ref->desc > ref->desc) 1064 p = &(*p)->rb_right; 1065 else 1066 BUG(); 1067 } 1068 rb_link_node(&new_ref->rb_node_desc, parent, p); 1069 rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc); 1070 if (node) { 1071 hlist_add_head(&new_ref->node_entry, &node->refs); 1072 1073 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1074 "%d new ref %d desc %d for node %d\n", 1075 proc->pid, new_ref->debug_id, new_ref->desc, 1076 node->debug_id); 1077 } else { 1078 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1079 "%d new ref %d desc %d for dead node\n", 1080 proc->pid, new_ref->debug_id, new_ref->desc); 1081 } 1082 return new_ref; 1083 } 1084 1085 static void binder_delete_ref(struct binder_ref *ref) 1086 { 1087 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1088 "%d delete ref %d desc %d for node %d\n", 1089 ref->proc->pid, ref->debug_id, ref->desc, 1090 ref->node->debug_id); 1091 1092 rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc); 1093 rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node); 1094 if (ref->strong) 1095 binder_dec_node(ref->node, 1, 1); 1096 hlist_del(&ref->node_entry); 1097 binder_dec_node(ref->node, 0, 1); 1098 if (ref->death) { 1099 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1100 "%d delete ref %d desc %d has death notification\n", 1101 ref->proc->pid, ref->debug_id, ref->desc); 1102 list_del(&ref->death->work.entry); 1103 kfree(ref->death); 1104 binder_stats_deleted(BINDER_STAT_DEATH); 1105 } 1106 kfree(ref); 1107 binder_stats_deleted(BINDER_STAT_REF); 1108 } 1109 1110 static int binder_inc_ref(struct binder_ref *ref, int strong, 1111 struct list_head *target_list) 1112 { 1113 int ret; 1114 1115 if (strong) { 1116 if (ref->strong == 0) { 1117 ret = binder_inc_node(ref->node, 1, 1, target_list); 1118 if (ret) 1119 return ret; 1120 } 1121 ref->strong++; 1122 } else { 1123 if (ref->weak == 0) { 1124 ret = binder_inc_node(ref->node, 0, 1, target_list); 1125 if (ret) 1126 return ret; 1127 } 1128 ref->weak++; 1129 } 1130 return 0; 1131 } 1132 1133 1134 static int binder_dec_ref(struct binder_ref *ref, int strong) 1135 { 1136 if (strong) { 1137 if (ref->strong == 0) { 1138 binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n", 1139 ref->proc->pid, ref->debug_id, 1140 ref->desc, ref->strong, ref->weak); 1141 return -EINVAL; 1142 } 1143 ref->strong--; 1144 if (ref->strong == 0) { 1145 int ret; 1146 1147 ret = binder_dec_node(ref->node, strong, 1); 1148 if (ret) 1149 return ret; 1150 } 1151 } else { 1152 if (ref->weak == 0) { 1153 binder_user_error("%d invalid dec weak, ref %d desc %d s %d w %d\n", 1154 ref->proc->pid, ref->debug_id, 1155 ref->desc, ref->strong, ref->weak); 1156 return -EINVAL; 1157 } 1158 ref->weak--; 1159 } 1160 if (ref->strong == 0 && ref->weak == 0) 1161 binder_delete_ref(ref); 1162 return 0; 1163 } 1164 1165 static void binder_pop_transaction(struct binder_thread *target_thread, 1166 struct binder_transaction *t) 1167 { 1168 if (target_thread) { 1169 BUG_ON(target_thread->transaction_stack != t); 1170 BUG_ON(target_thread->transaction_stack->from != target_thread); 1171 target_thread->transaction_stack = 1172 target_thread->transaction_stack->from_parent; 1173 t->from = NULL; 1174 } 1175 t->need_reply = 0; 1176 if (t->buffer) 1177 t->buffer->transaction = NULL; 1178 kfree(t); 1179 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1180 } 1181 1182 static void binder_send_failed_reply(struct binder_transaction *t, 1183 uint32_t error_code) 1184 { 1185 struct binder_thread *target_thread; 1186 struct binder_transaction *next; 1187 1188 BUG_ON(t->flags & TF_ONE_WAY); 1189 while (1) { 1190 target_thread = t->from; 1191 if (target_thread) { 1192 if (target_thread->return_error != BR_OK && 1193 target_thread->return_error2 == BR_OK) { 1194 target_thread->return_error2 = 1195 target_thread->return_error; 1196 target_thread->return_error = BR_OK; 1197 } 1198 if (target_thread->return_error == BR_OK) { 1199 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1200 "send failed reply for transaction %d to %d:%d\n", 1201 t->debug_id, 1202 target_thread->proc->pid, 1203 target_thread->pid); 1204 1205 binder_pop_transaction(target_thread, t); 1206 target_thread->return_error = error_code; 1207 wake_up_interruptible(&target_thread->wait); 1208 } else { 1209 pr_err("reply failed, target thread, %d:%d, has error code %d already\n", 1210 target_thread->proc->pid, 1211 target_thread->pid, 1212 target_thread->return_error); 1213 } 1214 return; 1215 } 1216 next = t->from_parent; 1217 1218 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1219 "send failed reply for transaction %d, target dead\n", 1220 t->debug_id); 1221 1222 binder_pop_transaction(target_thread, t); 1223 if (next == NULL) { 1224 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1225 "reply failed, no target thread at root\n"); 1226 return; 1227 } 1228 t = next; 1229 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1230 "reply failed, no target thread -- retry %d\n", 1231 t->debug_id); 1232 } 1233 } 1234 1235 static void binder_transaction_buffer_release(struct binder_proc *proc, 1236 struct binder_buffer *buffer, 1237 binder_size_t *failed_at) 1238 { 1239 binder_size_t *offp, *off_end; 1240 int debug_id = buffer->debug_id; 1241 1242 binder_debug(BINDER_DEBUG_TRANSACTION, 1243 "%d buffer release %d, size %zd-%zd, failed at %p\n", 1244 proc->pid, buffer->debug_id, 1245 buffer->data_size, buffer->offsets_size, failed_at); 1246 1247 if (buffer->target_node) 1248 binder_dec_node(buffer->target_node, 1, 0); 1249 1250 offp = (binder_size_t *)(buffer->data + 1251 ALIGN(buffer->data_size, sizeof(void *))); 1252 if (failed_at) 1253 off_end = failed_at; 1254 else 1255 off_end = (void *)offp + buffer->offsets_size; 1256 for (; offp < off_end; offp++) { 1257 struct flat_binder_object *fp; 1258 1259 if (*offp > buffer->data_size - sizeof(*fp) || 1260 buffer->data_size < sizeof(*fp) || 1261 !IS_ALIGNED(*offp, sizeof(u32))) { 1262 pr_err("transaction release %d bad offset %lld, size %zd\n", 1263 debug_id, (u64)*offp, buffer->data_size); 1264 continue; 1265 } 1266 fp = (struct flat_binder_object *)(buffer->data + *offp); 1267 switch (fp->type) { 1268 case BINDER_TYPE_BINDER: 1269 case BINDER_TYPE_WEAK_BINDER: { 1270 struct binder_node *node = binder_get_node(proc, fp->binder); 1271 1272 if (node == NULL) { 1273 pr_err("transaction release %d bad node %016llx\n", 1274 debug_id, (u64)fp->binder); 1275 break; 1276 } 1277 binder_debug(BINDER_DEBUG_TRANSACTION, 1278 " node %d u%016llx\n", 1279 node->debug_id, (u64)node->ptr); 1280 binder_dec_node(node, fp->type == BINDER_TYPE_BINDER, 0); 1281 } break; 1282 case BINDER_TYPE_HANDLE: 1283 case BINDER_TYPE_WEAK_HANDLE: { 1284 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1285 1286 if (ref == NULL) { 1287 pr_err("transaction release %d bad handle %d\n", 1288 debug_id, fp->handle); 1289 break; 1290 } 1291 binder_debug(BINDER_DEBUG_TRANSACTION, 1292 " ref %d desc %d (node %d)\n", 1293 ref->debug_id, ref->desc, ref->node->debug_id); 1294 binder_dec_ref(ref, fp->type == BINDER_TYPE_HANDLE); 1295 } break; 1296 1297 case BINDER_TYPE_FD: 1298 binder_debug(BINDER_DEBUG_TRANSACTION, 1299 " fd %d\n", fp->handle); 1300 if (failed_at) 1301 task_close_fd(proc, fp->handle); 1302 break; 1303 1304 default: 1305 pr_err("transaction release %d bad object type %x\n", 1306 debug_id, fp->type); 1307 break; 1308 } 1309 } 1310 } 1311 1312 static void binder_transaction(struct binder_proc *proc, 1313 struct binder_thread *thread, 1314 struct binder_transaction_data *tr, int reply) 1315 { 1316 struct binder_transaction *t; 1317 struct binder_work *tcomplete; 1318 binder_size_t *offp, *off_end; 1319 struct binder_proc *target_proc; 1320 struct binder_thread *target_thread = NULL; 1321 struct binder_node *target_node = NULL; 1322 struct list_head *target_list; 1323 wait_queue_head_t *target_wait; 1324 struct binder_transaction *in_reply_to = NULL; 1325 struct binder_transaction_log_entry *e; 1326 uint32_t return_error; 1327 1328 e = binder_transaction_log_add(&binder_transaction_log); 1329 e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY); 1330 e->from_proc = proc->pid; 1331 e->from_thread = thread->pid; 1332 e->target_handle = tr->target.handle; 1333 e->data_size = tr->data_size; 1334 e->offsets_size = tr->offsets_size; 1335 1336 if (reply) { 1337 in_reply_to = thread->transaction_stack; 1338 if (in_reply_to == NULL) { 1339 binder_user_error("%d:%d got reply transaction with no transaction stack\n", 1340 proc->pid, thread->pid); 1341 return_error = BR_FAILED_REPLY; 1342 goto err_empty_call_stack; 1343 } 1344 binder_set_nice(in_reply_to->saved_priority); 1345 if (in_reply_to->to_thread != thread) { 1346 binder_user_error("%d:%d got reply transaction with bad transaction stack, transaction %d has target %d:%d\n", 1347 proc->pid, thread->pid, in_reply_to->debug_id, 1348 in_reply_to->to_proc ? 1349 in_reply_to->to_proc->pid : 0, 1350 in_reply_to->to_thread ? 1351 in_reply_to->to_thread->pid : 0); 1352 return_error = BR_FAILED_REPLY; 1353 in_reply_to = NULL; 1354 goto err_bad_call_stack; 1355 } 1356 thread->transaction_stack = in_reply_to->to_parent; 1357 target_thread = in_reply_to->from; 1358 if (target_thread == NULL) { 1359 return_error = BR_DEAD_REPLY; 1360 goto err_dead_binder; 1361 } 1362 if (target_thread->transaction_stack != in_reply_to) { 1363 binder_user_error("%d:%d got reply transaction with bad target transaction stack %d, expected %d\n", 1364 proc->pid, thread->pid, 1365 target_thread->transaction_stack ? 1366 target_thread->transaction_stack->debug_id : 0, 1367 in_reply_to->debug_id); 1368 return_error = BR_FAILED_REPLY; 1369 in_reply_to = NULL; 1370 target_thread = NULL; 1371 goto err_dead_binder; 1372 } 1373 target_proc = target_thread->proc; 1374 } else { 1375 if (tr->target.handle) { 1376 struct binder_ref *ref; 1377 1378 ref = binder_get_ref(proc, tr->target.handle); 1379 if (ref == NULL) { 1380 binder_user_error("%d:%d got transaction to invalid handle\n", 1381 proc->pid, thread->pid); 1382 return_error = BR_FAILED_REPLY; 1383 goto err_invalid_target_handle; 1384 } 1385 target_node = ref->node; 1386 } else { 1387 target_node = binder_context_mgr_node; 1388 if (target_node == NULL) { 1389 return_error = BR_DEAD_REPLY; 1390 goto err_no_context_mgr_node; 1391 } 1392 } 1393 e->to_node = target_node->debug_id; 1394 target_proc = target_node->proc; 1395 if (target_proc == NULL) { 1396 return_error = BR_DEAD_REPLY; 1397 goto err_dead_binder; 1398 } 1399 if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) { 1400 struct binder_transaction *tmp; 1401 1402 tmp = thread->transaction_stack; 1403 if (tmp->to_thread != thread) { 1404 binder_user_error("%d:%d got new transaction with bad transaction stack, transaction %d has target %d:%d\n", 1405 proc->pid, thread->pid, tmp->debug_id, 1406 tmp->to_proc ? tmp->to_proc->pid : 0, 1407 tmp->to_thread ? 1408 tmp->to_thread->pid : 0); 1409 return_error = BR_FAILED_REPLY; 1410 goto err_bad_call_stack; 1411 } 1412 while (tmp) { 1413 if (tmp->from && tmp->from->proc == target_proc) 1414 target_thread = tmp->from; 1415 tmp = tmp->from_parent; 1416 } 1417 } 1418 } 1419 if (target_thread) { 1420 e->to_thread = target_thread->pid; 1421 target_list = &target_thread->todo; 1422 target_wait = &target_thread->wait; 1423 } else { 1424 target_list = &target_proc->todo; 1425 target_wait = &target_proc->wait; 1426 } 1427 e->to_proc = target_proc->pid; 1428 1429 /* TODO: reuse incoming transaction for reply */ 1430 t = kzalloc(sizeof(*t), GFP_KERNEL); 1431 if (t == NULL) { 1432 return_error = BR_FAILED_REPLY; 1433 goto err_alloc_t_failed; 1434 } 1435 binder_stats_created(BINDER_STAT_TRANSACTION); 1436 1437 tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL); 1438 if (tcomplete == NULL) { 1439 return_error = BR_FAILED_REPLY; 1440 goto err_alloc_tcomplete_failed; 1441 } 1442 binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE); 1443 1444 t->debug_id = ++binder_last_id; 1445 e->debug_id = t->debug_id; 1446 1447 if (reply) 1448 binder_debug(BINDER_DEBUG_TRANSACTION, 1449 "%d:%d BC_REPLY %d -> %d:%d, data %016llx-%016llx size %lld-%lld\n", 1450 proc->pid, thread->pid, t->debug_id, 1451 target_proc->pid, target_thread->pid, 1452 (u64)tr->data.ptr.buffer, 1453 (u64)tr->data.ptr.offsets, 1454 (u64)tr->data_size, (u64)tr->offsets_size); 1455 else 1456 binder_debug(BINDER_DEBUG_TRANSACTION, 1457 "%d:%d BC_TRANSACTION %d -> %d - node %d, data %016llx-%016llx size %lld-%lld\n", 1458 proc->pid, thread->pid, t->debug_id, 1459 target_proc->pid, target_node->debug_id, 1460 (u64)tr->data.ptr.buffer, 1461 (u64)tr->data.ptr.offsets, 1462 (u64)tr->data_size, (u64)tr->offsets_size); 1463 1464 if (!reply && !(tr->flags & TF_ONE_WAY)) 1465 t->from = thread; 1466 else 1467 t->from = NULL; 1468 t->sender_euid = task_euid(proc->tsk); 1469 t->to_proc = target_proc; 1470 t->to_thread = target_thread; 1471 t->code = tr->code; 1472 t->flags = tr->flags; 1473 t->priority = task_nice(current); 1474 1475 trace_binder_transaction(reply, t, target_node); 1476 1477 t->buffer = binder_alloc_buf(target_proc, tr->data_size, 1478 tr->offsets_size, !reply && (t->flags & TF_ONE_WAY)); 1479 if (t->buffer == NULL) { 1480 return_error = BR_FAILED_REPLY; 1481 goto err_binder_alloc_buf_failed; 1482 } 1483 t->buffer->allow_user_free = 0; 1484 t->buffer->debug_id = t->debug_id; 1485 t->buffer->transaction = t; 1486 t->buffer->target_node = target_node; 1487 trace_binder_transaction_alloc_buf(t->buffer); 1488 if (target_node) 1489 binder_inc_node(target_node, 1, 0, NULL); 1490 1491 offp = (binder_size_t *)(t->buffer->data + 1492 ALIGN(tr->data_size, sizeof(void *))); 1493 1494 if (copy_from_user(t->buffer->data, (const void __user *)(uintptr_t) 1495 tr->data.ptr.buffer, tr->data_size)) { 1496 binder_user_error("%d:%d got transaction with invalid data ptr\n", 1497 proc->pid, thread->pid); 1498 return_error = BR_FAILED_REPLY; 1499 goto err_copy_data_failed; 1500 } 1501 if (copy_from_user(offp, (const void __user *)(uintptr_t) 1502 tr->data.ptr.offsets, tr->offsets_size)) { 1503 binder_user_error("%d:%d got transaction with invalid offsets ptr\n", 1504 proc->pid, thread->pid); 1505 return_error = BR_FAILED_REPLY; 1506 goto err_copy_data_failed; 1507 } 1508 if (!IS_ALIGNED(tr->offsets_size, sizeof(binder_size_t))) { 1509 binder_user_error("%d:%d got transaction with invalid offsets size, %lld\n", 1510 proc->pid, thread->pid, (u64)tr->offsets_size); 1511 return_error = BR_FAILED_REPLY; 1512 goto err_bad_offset; 1513 } 1514 off_end = (void *)offp + tr->offsets_size; 1515 for (; offp < off_end; offp++) { 1516 struct flat_binder_object *fp; 1517 1518 if (*offp > t->buffer->data_size - sizeof(*fp) || 1519 t->buffer->data_size < sizeof(*fp) || 1520 !IS_ALIGNED(*offp, sizeof(u32))) { 1521 binder_user_error("%d:%d got transaction with invalid offset, %lld\n", 1522 proc->pid, thread->pid, (u64)*offp); 1523 return_error = BR_FAILED_REPLY; 1524 goto err_bad_offset; 1525 } 1526 fp = (struct flat_binder_object *)(t->buffer->data + *offp); 1527 switch (fp->type) { 1528 case BINDER_TYPE_BINDER: 1529 case BINDER_TYPE_WEAK_BINDER: { 1530 struct binder_ref *ref; 1531 struct binder_node *node = binder_get_node(proc, fp->binder); 1532 1533 if (node == NULL) { 1534 node = binder_new_node(proc, fp->binder, fp->cookie); 1535 if (node == NULL) { 1536 return_error = BR_FAILED_REPLY; 1537 goto err_binder_new_node_failed; 1538 } 1539 node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK; 1540 node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS); 1541 } 1542 if (fp->cookie != node->cookie) { 1543 binder_user_error("%d:%d sending u%016llx node %d, cookie mismatch %016llx != %016llx\n", 1544 proc->pid, thread->pid, 1545 (u64)fp->binder, node->debug_id, 1546 (u64)fp->cookie, (u64)node->cookie); 1547 return_error = BR_FAILED_REPLY; 1548 goto err_binder_get_ref_for_node_failed; 1549 } 1550 ref = binder_get_ref_for_node(target_proc, node); 1551 if (ref == NULL) { 1552 return_error = BR_FAILED_REPLY; 1553 goto err_binder_get_ref_for_node_failed; 1554 } 1555 if (fp->type == BINDER_TYPE_BINDER) 1556 fp->type = BINDER_TYPE_HANDLE; 1557 else 1558 fp->type = BINDER_TYPE_WEAK_HANDLE; 1559 fp->handle = ref->desc; 1560 binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE, 1561 &thread->todo); 1562 1563 trace_binder_transaction_node_to_ref(t, node, ref); 1564 binder_debug(BINDER_DEBUG_TRANSACTION, 1565 " node %d u%016llx -> ref %d desc %d\n", 1566 node->debug_id, (u64)node->ptr, 1567 ref->debug_id, ref->desc); 1568 } break; 1569 case BINDER_TYPE_HANDLE: 1570 case BINDER_TYPE_WEAK_HANDLE: { 1571 struct binder_ref *ref = binder_get_ref(proc, fp->handle); 1572 1573 if (ref == NULL) { 1574 binder_user_error("%d:%d got transaction with invalid handle, %d\n", 1575 proc->pid, 1576 thread->pid, fp->handle); 1577 return_error = BR_FAILED_REPLY; 1578 goto err_binder_get_ref_failed; 1579 } 1580 if (ref->node->proc == target_proc) { 1581 if (fp->type == BINDER_TYPE_HANDLE) 1582 fp->type = BINDER_TYPE_BINDER; 1583 else 1584 fp->type = BINDER_TYPE_WEAK_BINDER; 1585 fp->binder = ref->node->ptr; 1586 fp->cookie = ref->node->cookie; 1587 binder_inc_node(ref->node, fp->type == BINDER_TYPE_BINDER, 0, NULL); 1588 trace_binder_transaction_ref_to_node(t, ref); 1589 binder_debug(BINDER_DEBUG_TRANSACTION, 1590 " ref %d desc %d -> node %d u%016llx\n", 1591 ref->debug_id, ref->desc, ref->node->debug_id, 1592 (u64)ref->node->ptr); 1593 } else { 1594 struct binder_ref *new_ref; 1595 1596 new_ref = binder_get_ref_for_node(target_proc, ref->node); 1597 if (new_ref == NULL) { 1598 return_error = BR_FAILED_REPLY; 1599 goto err_binder_get_ref_for_node_failed; 1600 } 1601 fp->handle = new_ref->desc; 1602 binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL); 1603 trace_binder_transaction_ref_to_ref(t, ref, 1604 new_ref); 1605 binder_debug(BINDER_DEBUG_TRANSACTION, 1606 " ref %d desc %d -> ref %d desc %d (node %d)\n", 1607 ref->debug_id, ref->desc, new_ref->debug_id, 1608 new_ref->desc, ref->node->debug_id); 1609 } 1610 } break; 1611 1612 case BINDER_TYPE_FD: { 1613 int target_fd; 1614 struct file *file; 1615 1616 if (reply) { 1617 if (!(in_reply_to->flags & TF_ACCEPT_FDS)) { 1618 binder_user_error("%d:%d got reply with fd, %d, but target does not allow fds\n", 1619 proc->pid, thread->pid, fp->handle); 1620 return_error = BR_FAILED_REPLY; 1621 goto err_fd_not_allowed; 1622 } 1623 } else if (!target_node->accept_fds) { 1624 binder_user_error("%d:%d got transaction with fd, %d, but target does not allow fds\n", 1625 proc->pid, thread->pid, fp->handle); 1626 return_error = BR_FAILED_REPLY; 1627 goto err_fd_not_allowed; 1628 } 1629 1630 file = fget(fp->handle); 1631 if (file == NULL) { 1632 binder_user_error("%d:%d got transaction with invalid fd, %d\n", 1633 proc->pid, thread->pid, fp->handle); 1634 return_error = BR_FAILED_REPLY; 1635 goto err_fget_failed; 1636 } 1637 target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC); 1638 if (target_fd < 0) { 1639 fput(file); 1640 return_error = BR_FAILED_REPLY; 1641 goto err_get_unused_fd_failed; 1642 } 1643 task_fd_install(target_proc, target_fd, file); 1644 trace_binder_transaction_fd(t, fp->handle, target_fd); 1645 binder_debug(BINDER_DEBUG_TRANSACTION, 1646 " fd %d -> %d\n", fp->handle, target_fd); 1647 /* TODO: fput? */ 1648 fp->handle = target_fd; 1649 } break; 1650 1651 default: 1652 binder_user_error("%d:%d got transaction with invalid object type, %x\n", 1653 proc->pid, thread->pid, fp->type); 1654 return_error = BR_FAILED_REPLY; 1655 goto err_bad_object_type; 1656 } 1657 } 1658 if (reply) { 1659 BUG_ON(t->buffer->async_transaction != 0); 1660 binder_pop_transaction(target_thread, in_reply_to); 1661 } else if (!(t->flags & TF_ONE_WAY)) { 1662 BUG_ON(t->buffer->async_transaction != 0); 1663 t->need_reply = 1; 1664 t->from_parent = thread->transaction_stack; 1665 thread->transaction_stack = t; 1666 } else { 1667 BUG_ON(target_node == NULL); 1668 BUG_ON(t->buffer->async_transaction != 1); 1669 if (target_node->has_async_transaction) { 1670 target_list = &target_node->async_todo; 1671 target_wait = NULL; 1672 } else 1673 target_node->has_async_transaction = 1; 1674 } 1675 t->work.type = BINDER_WORK_TRANSACTION; 1676 list_add_tail(&t->work.entry, target_list); 1677 tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE; 1678 list_add_tail(&tcomplete->entry, &thread->todo); 1679 if (target_wait) 1680 wake_up_interruptible(target_wait); 1681 return; 1682 1683 err_get_unused_fd_failed: 1684 err_fget_failed: 1685 err_fd_not_allowed: 1686 err_binder_get_ref_for_node_failed: 1687 err_binder_get_ref_failed: 1688 err_binder_new_node_failed: 1689 err_bad_object_type: 1690 err_bad_offset: 1691 err_copy_data_failed: 1692 trace_binder_transaction_failed_buffer_release(t->buffer); 1693 binder_transaction_buffer_release(target_proc, t->buffer, offp); 1694 t->buffer->transaction = NULL; 1695 binder_free_buf(target_proc, t->buffer); 1696 err_binder_alloc_buf_failed: 1697 kfree(tcomplete); 1698 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 1699 err_alloc_tcomplete_failed: 1700 kfree(t); 1701 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1702 err_alloc_t_failed: 1703 err_bad_call_stack: 1704 err_empty_call_stack: 1705 err_dead_binder: 1706 err_invalid_target_handle: 1707 err_no_context_mgr_node: 1708 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1709 "%d:%d transaction failed %d, size %lld-%lld\n", 1710 proc->pid, thread->pid, return_error, 1711 (u64)tr->data_size, (u64)tr->offsets_size); 1712 1713 { 1714 struct binder_transaction_log_entry *fe; 1715 1716 fe = binder_transaction_log_add(&binder_transaction_log_failed); 1717 *fe = *e; 1718 } 1719 1720 BUG_ON(thread->return_error != BR_OK); 1721 if (in_reply_to) { 1722 thread->return_error = BR_TRANSACTION_COMPLETE; 1723 binder_send_failed_reply(in_reply_to, return_error); 1724 } else 1725 thread->return_error = return_error; 1726 } 1727 1728 static int binder_thread_write(struct binder_proc *proc, 1729 struct binder_thread *thread, 1730 binder_uintptr_t binder_buffer, size_t size, 1731 binder_size_t *consumed) 1732 { 1733 uint32_t cmd; 1734 void __user *buffer = (void __user *)(uintptr_t)binder_buffer; 1735 void __user *ptr = buffer + *consumed; 1736 void __user *end = buffer + size; 1737 1738 while (ptr < end && thread->return_error == BR_OK) { 1739 if (get_user(cmd, (uint32_t __user *)ptr)) 1740 return -EFAULT; 1741 ptr += sizeof(uint32_t); 1742 trace_binder_command(cmd); 1743 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) { 1744 binder_stats.bc[_IOC_NR(cmd)]++; 1745 proc->stats.bc[_IOC_NR(cmd)]++; 1746 thread->stats.bc[_IOC_NR(cmd)]++; 1747 } 1748 switch (cmd) { 1749 case BC_INCREFS: 1750 case BC_ACQUIRE: 1751 case BC_RELEASE: 1752 case BC_DECREFS: { 1753 uint32_t target; 1754 struct binder_ref *ref; 1755 const char *debug_string; 1756 1757 if (get_user(target, (uint32_t __user *)ptr)) 1758 return -EFAULT; 1759 ptr += sizeof(uint32_t); 1760 if (target == 0 && binder_context_mgr_node && 1761 (cmd == BC_INCREFS || cmd == BC_ACQUIRE)) { 1762 ref = binder_get_ref_for_node(proc, 1763 binder_context_mgr_node); 1764 if (ref->desc != target) { 1765 binder_user_error("%d:%d tried to acquire reference to desc 0, got %d instead\n", 1766 proc->pid, thread->pid, 1767 ref->desc); 1768 } 1769 } else 1770 ref = binder_get_ref(proc, target); 1771 if (ref == NULL) { 1772 binder_user_error("%d:%d refcount change on invalid ref %d\n", 1773 proc->pid, thread->pid, target); 1774 break; 1775 } 1776 switch (cmd) { 1777 case BC_INCREFS: 1778 debug_string = "IncRefs"; 1779 binder_inc_ref(ref, 0, NULL); 1780 break; 1781 case BC_ACQUIRE: 1782 debug_string = "Acquire"; 1783 binder_inc_ref(ref, 1, NULL); 1784 break; 1785 case BC_RELEASE: 1786 debug_string = "Release"; 1787 binder_dec_ref(ref, 1); 1788 break; 1789 case BC_DECREFS: 1790 default: 1791 debug_string = "DecRefs"; 1792 binder_dec_ref(ref, 0); 1793 break; 1794 } 1795 binder_debug(BINDER_DEBUG_USER_REFS, 1796 "%d:%d %s ref %d desc %d s %d w %d for node %d\n", 1797 proc->pid, thread->pid, debug_string, ref->debug_id, 1798 ref->desc, ref->strong, ref->weak, ref->node->debug_id); 1799 break; 1800 } 1801 case BC_INCREFS_DONE: 1802 case BC_ACQUIRE_DONE: { 1803 binder_uintptr_t node_ptr; 1804 binder_uintptr_t cookie; 1805 struct binder_node *node; 1806 1807 if (get_user(node_ptr, (binder_uintptr_t __user *)ptr)) 1808 return -EFAULT; 1809 ptr += sizeof(binder_uintptr_t); 1810 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 1811 return -EFAULT; 1812 ptr += sizeof(binder_uintptr_t); 1813 node = binder_get_node(proc, node_ptr); 1814 if (node == NULL) { 1815 binder_user_error("%d:%d %s u%016llx no match\n", 1816 proc->pid, thread->pid, 1817 cmd == BC_INCREFS_DONE ? 1818 "BC_INCREFS_DONE" : 1819 "BC_ACQUIRE_DONE", 1820 (u64)node_ptr); 1821 break; 1822 } 1823 if (cookie != node->cookie) { 1824 binder_user_error("%d:%d %s u%016llx node %d cookie mismatch %016llx != %016llx\n", 1825 proc->pid, thread->pid, 1826 cmd == BC_INCREFS_DONE ? 1827 "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1828 (u64)node_ptr, node->debug_id, 1829 (u64)cookie, (u64)node->cookie); 1830 break; 1831 } 1832 if (cmd == BC_ACQUIRE_DONE) { 1833 if (node->pending_strong_ref == 0) { 1834 binder_user_error("%d:%d BC_ACQUIRE_DONE node %d has no pending acquire request\n", 1835 proc->pid, thread->pid, 1836 node->debug_id); 1837 break; 1838 } 1839 node->pending_strong_ref = 0; 1840 } else { 1841 if (node->pending_weak_ref == 0) { 1842 binder_user_error("%d:%d BC_INCREFS_DONE node %d has no pending increfs request\n", 1843 proc->pid, thread->pid, 1844 node->debug_id); 1845 break; 1846 } 1847 node->pending_weak_ref = 0; 1848 } 1849 binder_dec_node(node, cmd == BC_ACQUIRE_DONE, 0); 1850 binder_debug(BINDER_DEBUG_USER_REFS, 1851 "%d:%d %s node %d ls %d lw %d\n", 1852 proc->pid, thread->pid, 1853 cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 1854 node->debug_id, node->local_strong_refs, node->local_weak_refs); 1855 break; 1856 } 1857 case BC_ATTEMPT_ACQUIRE: 1858 pr_err("BC_ATTEMPT_ACQUIRE not supported\n"); 1859 return -EINVAL; 1860 case BC_ACQUIRE_RESULT: 1861 pr_err("BC_ACQUIRE_RESULT not supported\n"); 1862 return -EINVAL; 1863 1864 case BC_FREE_BUFFER: { 1865 binder_uintptr_t data_ptr; 1866 struct binder_buffer *buffer; 1867 1868 if (get_user(data_ptr, (binder_uintptr_t __user *)ptr)) 1869 return -EFAULT; 1870 ptr += sizeof(binder_uintptr_t); 1871 1872 buffer = binder_buffer_lookup(proc, data_ptr); 1873 if (buffer == NULL) { 1874 binder_user_error("%d:%d BC_FREE_BUFFER u%016llx no match\n", 1875 proc->pid, thread->pid, (u64)data_ptr); 1876 break; 1877 } 1878 if (!buffer->allow_user_free) { 1879 binder_user_error("%d:%d BC_FREE_BUFFER u%016llx matched unreturned buffer\n", 1880 proc->pid, thread->pid, (u64)data_ptr); 1881 break; 1882 } 1883 binder_debug(BINDER_DEBUG_FREE_BUFFER, 1884 "%d:%d BC_FREE_BUFFER u%016llx found buffer %d for %s transaction\n", 1885 proc->pid, thread->pid, (u64)data_ptr, 1886 buffer->debug_id, 1887 buffer->transaction ? "active" : "finished"); 1888 1889 if (buffer->transaction) { 1890 buffer->transaction->buffer = NULL; 1891 buffer->transaction = NULL; 1892 } 1893 if (buffer->async_transaction && buffer->target_node) { 1894 BUG_ON(!buffer->target_node->has_async_transaction); 1895 if (list_empty(&buffer->target_node->async_todo)) 1896 buffer->target_node->has_async_transaction = 0; 1897 else 1898 list_move_tail(buffer->target_node->async_todo.next, &thread->todo); 1899 } 1900 trace_binder_transaction_buffer_release(buffer); 1901 binder_transaction_buffer_release(proc, buffer, NULL); 1902 binder_free_buf(proc, buffer); 1903 break; 1904 } 1905 1906 case BC_TRANSACTION: 1907 case BC_REPLY: { 1908 struct binder_transaction_data tr; 1909 1910 if (copy_from_user(&tr, ptr, sizeof(tr))) 1911 return -EFAULT; 1912 ptr += sizeof(tr); 1913 binder_transaction(proc, thread, &tr, cmd == BC_REPLY); 1914 break; 1915 } 1916 1917 case BC_REGISTER_LOOPER: 1918 binder_debug(BINDER_DEBUG_THREADS, 1919 "%d:%d BC_REGISTER_LOOPER\n", 1920 proc->pid, thread->pid); 1921 if (thread->looper & BINDER_LOOPER_STATE_ENTERED) { 1922 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1923 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER\n", 1924 proc->pid, thread->pid); 1925 } else if (proc->requested_threads == 0) { 1926 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1927 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called without request\n", 1928 proc->pid, thread->pid); 1929 } else { 1930 proc->requested_threads--; 1931 proc->requested_threads_started++; 1932 } 1933 thread->looper |= BINDER_LOOPER_STATE_REGISTERED; 1934 break; 1935 case BC_ENTER_LOOPER: 1936 binder_debug(BINDER_DEBUG_THREADS, 1937 "%d:%d BC_ENTER_LOOPER\n", 1938 proc->pid, thread->pid); 1939 if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) { 1940 thread->looper |= BINDER_LOOPER_STATE_INVALID; 1941 binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n", 1942 proc->pid, thread->pid); 1943 } 1944 thread->looper |= BINDER_LOOPER_STATE_ENTERED; 1945 break; 1946 case BC_EXIT_LOOPER: 1947 binder_debug(BINDER_DEBUG_THREADS, 1948 "%d:%d BC_EXIT_LOOPER\n", 1949 proc->pid, thread->pid); 1950 thread->looper |= BINDER_LOOPER_STATE_EXITED; 1951 break; 1952 1953 case BC_REQUEST_DEATH_NOTIFICATION: 1954 case BC_CLEAR_DEATH_NOTIFICATION: { 1955 uint32_t target; 1956 binder_uintptr_t cookie; 1957 struct binder_ref *ref; 1958 struct binder_ref_death *death; 1959 1960 if (get_user(target, (uint32_t __user *)ptr)) 1961 return -EFAULT; 1962 ptr += sizeof(uint32_t); 1963 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 1964 return -EFAULT; 1965 ptr += sizeof(binder_uintptr_t); 1966 ref = binder_get_ref(proc, target); 1967 if (ref == NULL) { 1968 binder_user_error("%d:%d %s invalid ref %d\n", 1969 proc->pid, thread->pid, 1970 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 1971 "BC_REQUEST_DEATH_NOTIFICATION" : 1972 "BC_CLEAR_DEATH_NOTIFICATION", 1973 target); 1974 break; 1975 } 1976 1977 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 1978 "%d:%d %s %016llx ref %d desc %d s %d w %d for node %d\n", 1979 proc->pid, thread->pid, 1980 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 1981 "BC_REQUEST_DEATH_NOTIFICATION" : 1982 "BC_CLEAR_DEATH_NOTIFICATION", 1983 (u64)cookie, ref->debug_id, ref->desc, 1984 ref->strong, ref->weak, ref->node->debug_id); 1985 1986 if (cmd == BC_REQUEST_DEATH_NOTIFICATION) { 1987 if (ref->death) { 1988 binder_user_error("%d:%d BC_REQUEST_DEATH_NOTIFICATION death notification already set\n", 1989 proc->pid, thread->pid); 1990 break; 1991 } 1992 death = kzalloc(sizeof(*death), GFP_KERNEL); 1993 if (death == NULL) { 1994 thread->return_error = BR_ERROR; 1995 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1996 "%d:%d BC_REQUEST_DEATH_NOTIFICATION failed\n", 1997 proc->pid, thread->pid); 1998 break; 1999 } 2000 binder_stats_created(BINDER_STAT_DEATH); 2001 INIT_LIST_HEAD(&death->work.entry); 2002 death->cookie = cookie; 2003 ref->death = death; 2004 if (ref->node->proc == NULL) { 2005 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 2006 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2007 list_add_tail(&ref->death->work.entry, &thread->todo); 2008 } else { 2009 list_add_tail(&ref->death->work.entry, &proc->todo); 2010 wake_up_interruptible(&proc->wait); 2011 } 2012 } 2013 } else { 2014 if (ref->death == NULL) { 2015 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification not active\n", 2016 proc->pid, thread->pid); 2017 break; 2018 } 2019 death = ref->death; 2020 if (death->cookie != cookie) { 2021 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch %016llx != %016llx\n", 2022 proc->pid, thread->pid, 2023 (u64)death->cookie, 2024 (u64)cookie); 2025 break; 2026 } 2027 ref->death = NULL; 2028 if (list_empty(&death->work.entry)) { 2029 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2030 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2031 list_add_tail(&death->work.entry, &thread->todo); 2032 } else { 2033 list_add_tail(&death->work.entry, &proc->todo); 2034 wake_up_interruptible(&proc->wait); 2035 } 2036 } else { 2037 BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER); 2038 death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR; 2039 } 2040 } 2041 } break; 2042 case BC_DEAD_BINDER_DONE: { 2043 struct binder_work *w; 2044 binder_uintptr_t cookie; 2045 struct binder_ref_death *death = NULL; 2046 2047 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 2048 return -EFAULT; 2049 2050 ptr += sizeof(void *); 2051 list_for_each_entry(w, &proc->delivered_death, entry) { 2052 struct binder_ref_death *tmp_death = container_of(w, struct binder_ref_death, work); 2053 2054 if (tmp_death->cookie == cookie) { 2055 death = tmp_death; 2056 break; 2057 } 2058 } 2059 binder_debug(BINDER_DEBUG_DEAD_BINDER, 2060 "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n", 2061 proc->pid, thread->pid, (u64)cookie, 2062 death); 2063 if (death == NULL) { 2064 binder_user_error("%d:%d BC_DEAD_BINDER_DONE %016llx not found\n", 2065 proc->pid, thread->pid, (u64)cookie); 2066 break; 2067 } 2068 2069 list_del_init(&death->work.entry); 2070 if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) { 2071 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2072 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2073 list_add_tail(&death->work.entry, &thread->todo); 2074 } else { 2075 list_add_tail(&death->work.entry, &proc->todo); 2076 wake_up_interruptible(&proc->wait); 2077 } 2078 } 2079 } break; 2080 2081 default: 2082 pr_err("%d:%d unknown command %d\n", 2083 proc->pid, thread->pid, cmd); 2084 return -EINVAL; 2085 } 2086 *consumed = ptr - buffer; 2087 } 2088 return 0; 2089 } 2090 2091 static void binder_stat_br(struct binder_proc *proc, 2092 struct binder_thread *thread, uint32_t cmd) 2093 { 2094 trace_binder_return(cmd); 2095 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) { 2096 binder_stats.br[_IOC_NR(cmd)]++; 2097 proc->stats.br[_IOC_NR(cmd)]++; 2098 thread->stats.br[_IOC_NR(cmd)]++; 2099 } 2100 } 2101 2102 static int binder_has_proc_work(struct binder_proc *proc, 2103 struct binder_thread *thread) 2104 { 2105 return !list_empty(&proc->todo) || 2106 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2107 } 2108 2109 static int binder_has_thread_work(struct binder_thread *thread) 2110 { 2111 return !list_empty(&thread->todo) || thread->return_error != BR_OK || 2112 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2113 } 2114 2115 static int binder_thread_read(struct binder_proc *proc, 2116 struct binder_thread *thread, 2117 binder_uintptr_t binder_buffer, size_t size, 2118 binder_size_t *consumed, int non_block) 2119 { 2120 void __user *buffer = (void __user *)(uintptr_t)binder_buffer; 2121 void __user *ptr = buffer + *consumed; 2122 void __user *end = buffer + size; 2123 2124 int ret = 0; 2125 int wait_for_proc_work; 2126 2127 if (*consumed == 0) { 2128 if (put_user(BR_NOOP, (uint32_t __user *)ptr)) 2129 return -EFAULT; 2130 ptr += sizeof(uint32_t); 2131 } 2132 2133 retry: 2134 wait_for_proc_work = thread->transaction_stack == NULL && 2135 list_empty(&thread->todo); 2136 2137 if (thread->return_error != BR_OK && ptr < end) { 2138 if (thread->return_error2 != BR_OK) { 2139 if (put_user(thread->return_error2, (uint32_t __user *)ptr)) 2140 return -EFAULT; 2141 ptr += sizeof(uint32_t); 2142 binder_stat_br(proc, thread, thread->return_error2); 2143 if (ptr == end) 2144 goto done; 2145 thread->return_error2 = BR_OK; 2146 } 2147 if (put_user(thread->return_error, (uint32_t __user *)ptr)) 2148 return -EFAULT; 2149 ptr += sizeof(uint32_t); 2150 binder_stat_br(proc, thread, thread->return_error); 2151 thread->return_error = BR_OK; 2152 goto done; 2153 } 2154 2155 2156 thread->looper |= BINDER_LOOPER_STATE_WAITING; 2157 if (wait_for_proc_work) 2158 proc->ready_threads++; 2159 2160 binder_unlock(__func__); 2161 2162 trace_binder_wait_for_work(wait_for_proc_work, 2163 !!thread->transaction_stack, 2164 !list_empty(&thread->todo)); 2165 if (wait_for_proc_work) { 2166 if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2167 BINDER_LOOPER_STATE_ENTERED))) { 2168 binder_user_error("%d:%d ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state %x)\n", 2169 proc->pid, thread->pid, thread->looper); 2170 wait_event_interruptible(binder_user_error_wait, 2171 binder_stop_on_user_error < 2); 2172 } 2173 binder_set_nice(proc->default_priority); 2174 if (non_block) { 2175 if (!binder_has_proc_work(proc, thread)) 2176 ret = -EAGAIN; 2177 } else 2178 ret = wait_event_freezable_exclusive(proc->wait, binder_has_proc_work(proc, thread)); 2179 } else { 2180 if (non_block) { 2181 if (!binder_has_thread_work(thread)) 2182 ret = -EAGAIN; 2183 } else 2184 ret = wait_event_freezable(thread->wait, binder_has_thread_work(thread)); 2185 } 2186 2187 binder_lock(__func__); 2188 2189 if (wait_for_proc_work) 2190 proc->ready_threads--; 2191 thread->looper &= ~BINDER_LOOPER_STATE_WAITING; 2192 2193 if (ret) 2194 return ret; 2195 2196 while (1) { 2197 uint32_t cmd; 2198 struct binder_transaction_data tr; 2199 struct binder_work *w; 2200 struct binder_transaction *t = NULL; 2201 2202 if (!list_empty(&thread->todo)) { 2203 w = list_first_entry(&thread->todo, struct binder_work, 2204 entry); 2205 } else if (!list_empty(&proc->todo) && wait_for_proc_work) { 2206 w = list_first_entry(&proc->todo, struct binder_work, 2207 entry); 2208 } else { 2209 /* no data added */ 2210 if (ptr - buffer == 4 && 2211 !(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN)) 2212 goto retry; 2213 break; 2214 } 2215 2216 if (end - ptr < sizeof(tr) + 4) 2217 break; 2218 2219 switch (w->type) { 2220 case BINDER_WORK_TRANSACTION: { 2221 t = container_of(w, struct binder_transaction, work); 2222 } break; 2223 case BINDER_WORK_TRANSACTION_COMPLETE: { 2224 cmd = BR_TRANSACTION_COMPLETE; 2225 if (put_user(cmd, (uint32_t __user *)ptr)) 2226 return -EFAULT; 2227 ptr += sizeof(uint32_t); 2228 2229 binder_stat_br(proc, thread, cmd); 2230 binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE, 2231 "%d:%d BR_TRANSACTION_COMPLETE\n", 2232 proc->pid, thread->pid); 2233 2234 list_del(&w->entry); 2235 kfree(w); 2236 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2237 } break; 2238 case BINDER_WORK_NODE: { 2239 struct binder_node *node = container_of(w, struct binder_node, work); 2240 uint32_t cmd = BR_NOOP; 2241 const char *cmd_name; 2242 int strong = node->internal_strong_refs || node->local_strong_refs; 2243 int weak = !hlist_empty(&node->refs) || node->local_weak_refs || strong; 2244 2245 if (weak && !node->has_weak_ref) { 2246 cmd = BR_INCREFS; 2247 cmd_name = "BR_INCREFS"; 2248 node->has_weak_ref = 1; 2249 node->pending_weak_ref = 1; 2250 node->local_weak_refs++; 2251 } else if (strong && !node->has_strong_ref) { 2252 cmd = BR_ACQUIRE; 2253 cmd_name = "BR_ACQUIRE"; 2254 node->has_strong_ref = 1; 2255 node->pending_strong_ref = 1; 2256 node->local_strong_refs++; 2257 } else if (!strong && node->has_strong_ref) { 2258 cmd = BR_RELEASE; 2259 cmd_name = "BR_RELEASE"; 2260 node->has_strong_ref = 0; 2261 } else if (!weak && node->has_weak_ref) { 2262 cmd = BR_DECREFS; 2263 cmd_name = "BR_DECREFS"; 2264 node->has_weak_ref = 0; 2265 } 2266 if (cmd != BR_NOOP) { 2267 if (put_user(cmd, (uint32_t __user *)ptr)) 2268 return -EFAULT; 2269 ptr += sizeof(uint32_t); 2270 if (put_user(node->ptr, 2271 (binder_uintptr_t __user *)ptr)) 2272 return -EFAULT; 2273 ptr += sizeof(binder_uintptr_t); 2274 if (put_user(node->cookie, 2275 (binder_uintptr_t __user *)ptr)) 2276 return -EFAULT; 2277 ptr += sizeof(binder_uintptr_t); 2278 2279 binder_stat_br(proc, thread, cmd); 2280 binder_debug(BINDER_DEBUG_USER_REFS, 2281 "%d:%d %s %d u%016llx c%016llx\n", 2282 proc->pid, thread->pid, cmd_name, 2283 node->debug_id, 2284 (u64)node->ptr, (u64)node->cookie); 2285 } else { 2286 list_del_init(&w->entry); 2287 if (!weak && !strong) { 2288 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2289 "%d:%d node %d u%016llx c%016llx deleted\n", 2290 proc->pid, thread->pid, 2291 node->debug_id, 2292 (u64)node->ptr, 2293 (u64)node->cookie); 2294 rb_erase(&node->rb_node, &proc->nodes); 2295 kfree(node); 2296 binder_stats_deleted(BINDER_STAT_NODE); 2297 } else { 2298 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2299 "%d:%d node %d u%016llx c%016llx state unchanged\n", 2300 proc->pid, thread->pid, 2301 node->debug_id, 2302 (u64)node->ptr, 2303 (u64)node->cookie); 2304 } 2305 } 2306 } break; 2307 case BINDER_WORK_DEAD_BINDER: 2308 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 2309 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 2310 struct binder_ref_death *death; 2311 uint32_t cmd; 2312 2313 death = container_of(w, struct binder_ref_death, work); 2314 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) 2315 cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE; 2316 else 2317 cmd = BR_DEAD_BINDER; 2318 if (put_user(cmd, (uint32_t __user *)ptr)) 2319 return -EFAULT; 2320 ptr += sizeof(uint32_t); 2321 if (put_user(death->cookie, 2322 (binder_uintptr_t __user *)ptr)) 2323 return -EFAULT; 2324 ptr += sizeof(binder_uintptr_t); 2325 binder_stat_br(proc, thread, cmd); 2326 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 2327 "%d:%d %s %016llx\n", 2328 proc->pid, thread->pid, 2329 cmd == BR_DEAD_BINDER ? 2330 "BR_DEAD_BINDER" : 2331 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 2332 (u64)death->cookie); 2333 2334 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) { 2335 list_del(&w->entry); 2336 kfree(death); 2337 binder_stats_deleted(BINDER_STAT_DEATH); 2338 } else 2339 list_move(&w->entry, &proc->delivered_death); 2340 if (cmd == BR_DEAD_BINDER) 2341 goto done; /* DEAD_BINDER notifications can cause transactions */ 2342 } break; 2343 } 2344 2345 if (!t) 2346 continue; 2347 2348 BUG_ON(t->buffer == NULL); 2349 if (t->buffer->target_node) { 2350 struct binder_node *target_node = t->buffer->target_node; 2351 2352 tr.target.ptr = target_node->ptr; 2353 tr.cookie = target_node->cookie; 2354 t->saved_priority = task_nice(current); 2355 if (t->priority < target_node->min_priority && 2356 !(t->flags & TF_ONE_WAY)) 2357 binder_set_nice(t->priority); 2358 else if (!(t->flags & TF_ONE_WAY) || 2359 t->saved_priority > target_node->min_priority) 2360 binder_set_nice(target_node->min_priority); 2361 cmd = BR_TRANSACTION; 2362 } else { 2363 tr.target.ptr = 0; 2364 tr.cookie = 0; 2365 cmd = BR_REPLY; 2366 } 2367 tr.code = t->code; 2368 tr.flags = t->flags; 2369 tr.sender_euid = from_kuid(current_user_ns(), t->sender_euid); 2370 2371 if (t->from) { 2372 struct task_struct *sender = t->from->proc->tsk; 2373 2374 tr.sender_pid = task_tgid_nr_ns(sender, 2375 task_active_pid_ns(current)); 2376 } else { 2377 tr.sender_pid = 0; 2378 } 2379 2380 tr.data_size = t->buffer->data_size; 2381 tr.offsets_size = t->buffer->offsets_size; 2382 tr.data.ptr.buffer = (binder_uintptr_t)( 2383 (uintptr_t)t->buffer->data + 2384 proc->user_buffer_offset); 2385 tr.data.ptr.offsets = tr.data.ptr.buffer + 2386 ALIGN(t->buffer->data_size, 2387 sizeof(void *)); 2388 2389 if (put_user(cmd, (uint32_t __user *)ptr)) 2390 return -EFAULT; 2391 ptr += sizeof(uint32_t); 2392 if (copy_to_user(ptr, &tr, sizeof(tr))) 2393 return -EFAULT; 2394 ptr += sizeof(tr); 2395 2396 trace_binder_transaction_received(t); 2397 binder_stat_br(proc, thread, cmd); 2398 binder_debug(BINDER_DEBUG_TRANSACTION, 2399 "%d:%d %s %d %d:%d, cmd %d size %zd-%zd ptr %016llx-%016llx\n", 2400 proc->pid, thread->pid, 2401 (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" : 2402 "BR_REPLY", 2403 t->debug_id, t->from ? t->from->proc->pid : 0, 2404 t->from ? t->from->pid : 0, cmd, 2405 t->buffer->data_size, t->buffer->offsets_size, 2406 (u64)tr.data.ptr.buffer, (u64)tr.data.ptr.offsets); 2407 2408 list_del(&t->work.entry); 2409 t->buffer->allow_user_free = 1; 2410 if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) { 2411 t->to_parent = thread->transaction_stack; 2412 t->to_thread = thread; 2413 thread->transaction_stack = t; 2414 } else { 2415 t->buffer->transaction = NULL; 2416 kfree(t); 2417 binder_stats_deleted(BINDER_STAT_TRANSACTION); 2418 } 2419 break; 2420 } 2421 2422 done: 2423 2424 *consumed = ptr - buffer; 2425 if (proc->requested_threads + proc->ready_threads == 0 && 2426 proc->requested_threads_started < proc->max_threads && 2427 (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2428 BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */ 2429 /*spawn a new thread if we leave this out */) { 2430 proc->requested_threads++; 2431 binder_debug(BINDER_DEBUG_THREADS, 2432 "%d:%d BR_SPAWN_LOOPER\n", 2433 proc->pid, thread->pid); 2434 if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer)) 2435 return -EFAULT; 2436 binder_stat_br(proc, thread, BR_SPAWN_LOOPER); 2437 } 2438 return 0; 2439 } 2440 2441 static void binder_release_work(struct list_head *list) 2442 { 2443 struct binder_work *w; 2444 2445 while (!list_empty(list)) { 2446 w = list_first_entry(list, struct binder_work, entry); 2447 list_del_init(&w->entry); 2448 switch (w->type) { 2449 case BINDER_WORK_TRANSACTION: { 2450 struct binder_transaction *t; 2451 2452 t = container_of(w, struct binder_transaction, work); 2453 if (t->buffer->target_node && 2454 !(t->flags & TF_ONE_WAY)) { 2455 binder_send_failed_reply(t, BR_DEAD_REPLY); 2456 } else { 2457 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2458 "undelivered transaction %d\n", 2459 t->debug_id); 2460 t->buffer->transaction = NULL; 2461 kfree(t); 2462 binder_stats_deleted(BINDER_STAT_TRANSACTION); 2463 } 2464 } break; 2465 case BINDER_WORK_TRANSACTION_COMPLETE: { 2466 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2467 "undelivered TRANSACTION_COMPLETE\n"); 2468 kfree(w); 2469 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2470 } break; 2471 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 2472 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 2473 struct binder_ref_death *death; 2474 2475 death = container_of(w, struct binder_ref_death, work); 2476 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2477 "undelivered death notification, %016llx\n", 2478 (u64)death->cookie); 2479 kfree(death); 2480 binder_stats_deleted(BINDER_STAT_DEATH); 2481 } break; 2482 default: 2483 pr_err("unexpected work type, %d, not freed\n", 2484 w->type); 2485 break; 2486 } 2487 } 2488 2489 } 2490 2491 static struct binder_thread *binder_get_thread(struct binder_proc *proc) 2492 { 2493 struct binder_thread *thread = NULL; 2494 struct rb_node *parent = NULL; 2495 struct rb_node **p = &proc->threads.rb_node; 2496 2497 while (*p) { 2498 parent = *p; 2499 thread = rb_entry(parent, struct binder_thread, rb_node); 2500 2501 if (current->pid < thread->pid) 2502 p = &(*p)->rb_left; 2503 else if (current->pid > thread->pid) 2504 p = &(*p)->rb_right; 2505 else 2506 break; 2507 } 2508 if (*p == NULL) { 2509 thread = kzalloc(sizeof(*thread), GFP_KERNEL); 2510 if (thread == NULL) 2511 return NULL; 2512 binder_stats_created(BINDER_STAT_THREAD); 2513 thread->proc = proc; 2514 thread->pid = current->pid; 2515 init_waitqueue_head(&thread->wait); 2516 INIT_LIST_HEAD(&thread->todo); 2517 rb_link_node(&thread->rb_node, parent, p); 2518 rb_insert_color(&thread->rb_node, &proc->threads); 2519 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2520 thread->return_error = BR_OK; 2521 thread->return_error2 = BR_OK; 2522 } 2523 return thread; 2524 } 2525 2526 static int binder_free_thread(struct binder_proc *proc, 2527 struct binder_thread *thread) 2528 { 2529 struct binder_transaction *t; 2530 struct binder_transaction *send_reply = NULL; 2531 int active_transactions = 0; 2532 2533 rb_erase(&thread->rb_node, &proc->threads); 2534 t = thread->transaction_stack; 2535 if (t && t->to_thread == thread) 2536 send_reply = t; 2537 while (t) { 2538 active_transactions++; 2539 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2540 "release %d:%d transaction %d %s, still active\n", 2541 proc->pid, thread->pid, 2542 t->debug_id, 2543 (t->to_thread == thread) ? "in" : "out"); 2544 2545 if (t->to_thread == thread) { 2546 t->to_proc = NULL; 2547 t->to_thread = NULL; 2548 if (t->buffer) { 2549 t->buffer->transaction = NULL; 2550 t->buffer = NULL; 2551 } 2552 t = t->to_parent; 2553 } else if (t->from == thread) { 2554 t->from = NULL; 2555 t = t->from_parent; 2556 } else 2557 BUG(); 2558 } 2559 if (send_reply) 2560 binder_send_failed_reply(send_reply, BR_DEAD_REPLY); 2561 binder_release_work(&thread->todo); 2562 kfree(thread); 2563 binder_stats_deleted(BINDER_STAT_THREAD); 2564 return active_transactions; 2565 } 2566 2567 static unsigned int binder_poll(struct file *filp, 2568 struct poll_table_struct *wait) 2569 { 2570 struct binder_proc *proc = filp->private_data; 2571 struct binder_thread *thread = NULL; 2572 int wait_for_proc_work; 2573 2574 binder_lock(__func__); 2575 2576 thread = binder_get_thread(proc); 2577 2578 wait_for_proc_work = thread->transaction_stack == NULL && 2579 list_empty(&thread->todo) && thread->return_error == BR_OK; 2580 2581 binder_unlock(__func__); 2582 2583 if (wait_for_proc_work) { 2584 if (binder_has_proc_work(proc, thread)) 2585 return POLLIN; 2586 poll_wait(filp, &proc->wait, wait); 2587 if (binder_has_proc_work(proc, thread)) 2588 return POLLIN; 2589 } else { 2590 if (binder_has_thread_work(thread)) 2591 return POLLIN; 2592 poll_wait(filp, &thread->wait, wait); 2593 if (binder_has_thread_work(thread)) 2594 return POLLIN; 2595 } 2596 return 0; 2597 } 2598 2599 static int binder_ioctl_write_read(struct file *filp, 2600 unsigned int cmd, unsigned long arg, 2601 struct binder_thread *thread) 2602 { 2603 int ret = 0; 2604 struct binder_proc *proc = filp->private_data; 2605 unsigned int size = _IOC_SIZE(cmd); 2606 void __user *ubuf = (void __user *)arg; 2607 struct binder_write_read bwr; 2608 2609 if (size != sizeof(struct binder_write_read)) { 2610 ret = -EINVAL; 2611 goto out; 2612 } 2613 if (copy_from_user(&bwr, ubuf, sizeof(bwr))) { 2614 ret = -EFAULT; 2615 goto out; 2616 } 2617 binder_debug(BINDER_DEBUG_READ_WRITE, 2618 "%d:%d write %lld at %016llx, read %lld at %016llx\n", 2619 proc->pid, thread->pid, 2620 (u64)bwr.write_size, (u64)bwr.write_buffer, 2621 (u64)bwr.read_size, (u64)bwr.read_buffer); 2622 2623 if (bwr.write_size > 0) { 2624 ret = binder_thread_write(proc, thread, 2625 bwr.write_buffer, 2626 bwr.write_size, 2627 &bwr.write_consumed); 2628 trace_binder_write_done(ret); 2629 if (ret < 0) { 2630 bwr.read_consumed = 0; 2631 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2632 ret = -EFAULT; 2633 goto out; 2634 } 2635 } 2636 if (bwr.read_size > 0) { 2637 ret = binder_thread_read(proc, thread, bwr.read_buffer, 2638 bwr.read_size, 2639 &bwr.read_consumed, 2640 filp->f_flags & O_NONBLOCK); 2641 trace_binder_read_done(ret); 2642 if (!list_empty(&proc->todo)) 2643 wake_up_interruptible(&proc->wait); 2644 if (ret < 0) { 2645 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 2646 ret = -EFAULT; 2647 goto out; 2648 } 2649 } 2650 binder_debug(BINDER_DEBUG_READ_WRITE, 2651 "%d:%d wrote %lld of %lld, read return %lld of %lld\n", 2652 proc->pid, thread->pid, 2653 (u64)bwr.write_consumed, (u64)bwr.write_size, 2654 (u64)bwr.read_consumed, (u64)bwr.read_size); 2655 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) { 2656 ret = -EFAULT; 2657 goto out; 2658 } 2659 out: 2660 return ret; 2661 } 2662 2663 static int binder_ioctl_set_ctx_mgr(struct file *filp) 2664 { 2665 int ret = 0; 2666 struct binder_proc *proc = filp->private_data; 2667 kuid_t curr_euid = current_euid(); 2668 2669 if (binder_context_mgr_node != NULL) { 2670 pr_err("BINDER_SET_CONTEXT_MGR already set\n"); 2671 ret = -EBUSY; 2672 goto out; 2673 } 2674 if (uid_valid(binder_context_mgr_uid)) { 2675 if (!uid_eq(binder_context_mgr_uid, curr_euid)) { 2676 pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n", 2677 from_kuid(&init_user_ns, curr_euid), 2678 from_kuid(&init_user_ns, 2679 binder_context_mgr_uid)); 2680 ret = -EPERM; 2681 goto out; 2682 } 2683 } else { 2684 binder_context_mgr_uid = curr_euid; 2685 } 2686 binder_context_mgr_node = binder_new_node(proc, 0, 0); 2687 if (binder_context_mgr_node == NULL) { 2688 ret = -ENOMEM; 2689 goto out; 2690 } 2691 binder_context_mgr_node->local_weak_refs++; 2692 binder_context_mgr_node->local_strong_refs++; 2693 binder_context_mgr_node->has_strong_ref = 1; 2694 binder_context_mgr_node->has_weak_ref = 1; 2695 out: 2696 return ret; 2697 } 2698 2699 static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 2700 { 2701 int ret; 2702 struct binder_proc *proc = filp->private_data; 2703 struct binder_thread *thread; 2704 unsigned int size = _IOC_SIZE(cmd); 2705 void __user *ubuf = (void __user *)arg; 2706 2707 /*pr_info("binder_ioctl: %d:%d %x %lx\n", 2708 proc->pid, current->pid, cmd, arg);*/ 2709 2710 trace_binder_ioctl(cmd, arg); 2711 2712 ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2713 if (ret) 2714 goto err_unlocked; 2715 2716 binder_lock(__func__); 2717 thread = binder_get_thread(proc); 2718 if (thread == NULL) { 2719 ret = -ENOMEM; 2720 goto err; 2721 } 2722 2723 switch (cmd) { 2724 case BINDER_WRITE_READ: 2725 ret = binder_ioctl_write_read(filp, cmd, arg, thread); 2726 if (ret) 2727 goto err; 2728 break; 2729 case BINDER_SET_MAX_THREADS: 2730 if (copy_from_user(&proc->max_threads, ubuf, sizeof(proc->max_threads))) { 2731 ret = -EINVAL; 2732 goto err; 2733 } 2734 break; 2735 case BINDER_SET_CONTEXT_MGR: 2736 ret = binder_ioctl_set_ctx_mgr(filp); 2737 if (ret) 2738 goto err; 2739 break; 2740 case BINDER_THREAD_EXIT: 2741 binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n", 2742 proc->pid, thread->pid); 2743 binder_free_thread(proc, thread); 2744 thread = NULL; 2745 break; 2746 case BINDER_VERSION: { 2747 struct binder_version __user *ver = ubuf; 2748 2749 if (size != sizeof(struct binder_version)) { 2750 ret = -EINVAL; 2751 goto err; 2752 } 2753 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION, 2754 &ver->protocol_version)) { 2755 ret = -EINVAL; 2756 goto err; 2757 } 2758 break; 2759 } 2760 default: 2761 ret = -EINVAL; 2762 goto err; 2763 } 2764 ret = 0; 2765 err: 2766 if (thread) 2767 thread->looper &= ~BINDER_LOOPER_STATE_NEED_RETURN; 2768 binder_unlock(__func__); 2769 wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 2770 if (ret && ret != -ERESTARTSYS) 2771 pr_info("%d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret); 2772 err_unlocked: 2773 trace_binder_ioctl_done(ret); 2774 return ret; 2775 } 2776 2777 static void binder_vma_open(struct vm_area_struct *vma) 2778 { 2779 struct binder_proc *proc = vma->vm_private_data; 2780 2781 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2782 "%d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2783 proc->pid, vma->vm_start, vma->vm_end, 2784 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2785 (unsigned long)pgprot_val(vma->vm_page_prot)); 2786 } 2787 2788 static void binder_vma_close(struct vm_area_struct *vma) 2789 { 2790 struct binder_proc *proc = vma->vm_private_data; 2791 2792 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2793 "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 2794 proc->pid, vma->vm_start, vma->vm_end, 2795 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2796 (unsigned long)pgprot_val(vma->vm_page_prot)); 2797 proc->vma = NULL; 2798 proc->vma_vm_mm = NULL; 2799 binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES); 2800 } 2801 2802 static int binder_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf) 2803 { 2804 return VM_FAULT_SIGBUS; 2805 } 2806 2807 static struct vm_operations_struct binder_vm_ops = { 2808 .open = binder_vma_open, 2809 .close = binder_vma_close, 2810 .fault = binder_vm_fault, 2811 }; 2812 2813 static int binder_mmap(struct file *filp, struct vm_area_struct *vma) 2814 { 2815 int ret; 2816 struct vm_struct *area; 2817 struct binder_proc *proc = filp->private_data; 2818 const char *failure_string; 2819 struct binder_buffer *buffer; 2820 2821 if (proc->tsk != current) 2822 return -EINVAL; 2823 2824 if ((vma->vm_end - vma->vm_start) > SZ_4M) 2825 vma->vm_end = vma->vm_start + SZ_4M; 2826 2827 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2828 "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n", 2829 proc->pid, vma->vm_start, vma->vm_end, 2830 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 2831 (unsigned long)pgprot_val(vma->vm_page_prot)); 2832 2833 if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) { 2834 ret = -EPERM; 2835 failure_string = "bad vm_flags"; 2836 goto err_bad_arg; 2837 } 2838 vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE; 2839 2840 mutex_lock(&binder_mmap_lock); 2841 if (proc->buffer) { 2842 ret = -EBUSY; 2843 failure_string = "already mapped"; 2844 goto err_already_mapped; 2845 } 2846 2847 area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP); 2848 if (area == NULL) { 2849 ret = -ENOMEM; 2850 failure_string = "get_vm_area"; 2851 goto err_get_vm_area_failed; 2852 } 2853 proc->buffer = area->addr; 2854 proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer; 2855 mutex_unlock(&binder_mmap_lock); 2856 2857 #ifdef CONFIG_CPU_CACHE_VIPT 2858 if (cache_is_vipt_aliasing()) { 2859 while (CACHE_COLOUR((vma->vm_start ^ (uint32_t)proc->buffer))) { 2860 pr_info("binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer); 2861 vma->vm_start += PAGE_SIZE; 2862 } 2863 } 2864 #endif 2865 proc->pages = kzalloc(sizeof(proc->pages[0]) * ((vma->vm_end - vma->vm_start) / PAGE_SIZE), GFP_KERNEL); 2866 if (proc->pages == NULL) { 2867 ret = -ENOMEM; 2868 failure_string = "alloc page array"; 2869 goto err_alloc_pages_failed; 2870 } 2871 proc->buffer_size = vma->vm_end - vma->vm_start; 2872 2873 vma->vm_ops = &binder_vm_ops; 2874 vma->vm_private_data = proc; 2875 2876 if (binder_update_page_range(proc, 1, proc->buffer, proc->buffer + PAGE_SIZE, vma)) { 2877 ret = -ENOMEM; 2878 failure_string = "alloc small buf"; 2879 goto err_alloc_small_buf_failed; 2880 } 2881 buffer = proc->buffer; 2882 INIT_LIST_HEAD(&proc->buffers); 2883 list_add(&buffer->entry, &proc->buffers); 2884 buffer->free = 1; 2885 binder_insert_free_buffer(proc, buffer); 2886 proc->free_async_space = proc->buffer_size / 2; 2887 barrier(); 2888 proc->files = get_files_struct(current); 2889 proc->vma = vma; 2890 proc->vma_vm_mm = vma->vm_mm; 2891 2892 /*pr_info("binder_mmap: %d %lx-%lx maps %p\n", 2893 proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/ 2894 return 0; 2895 2896 err_alloc_small_buf_failed: 2897 kfree(proc->pages); 2898 proc->pages = NULL; 2899 err_alloc_pages_failed: 2900 mutex_lock(&binder_mmap_lock); 2901 vfree(proc->buffer); 2902 proc->buffer = NULL; 2903 err_get_vm_area_failed: 2904 err_already_mapped: 2905 mutex_unlock(&binder_mmap_lock); 2906 err_bad_arg: 2907 pr_err("binder_mmap: %d %lx-%lx %s failed %d\n", 2908 proc->pid, vma->vm_start, vma->vm_end, failure_string, ret); 2909 return ret; 2910 } 2911 2912 static int binder_open(struct inode *nodp, struct file *filp) 2913 { 2914 struct binder_proc *proc; 2915 2916 binder_debug(BINDER_DEBUG_OPEN_CLOSE, "binder_open: %d:%d\n", 2917 current->group_leader->pid, current->pid); 2918 2919 proc = kzalloc(sizeof(*proc), GFP_KERNEL); 2920 if (proc == NULL) 2921 return -ENOMEM; 2922 get_task_struct(current); 2923 proc->tsk = current; 2924 INIT_LIST_HEAD(&proc->todo); 2925 init_waitqueue_head(&proc->wait); 2926 proc->default_priority = task_nice(current); 2927 2928 binder_lock(__func__); 2929 2930 binder_stats_created(BINDER_STAT_PROC); 2931 hlist_add_head(&proc->proc_node, &binder_procs); 2932 proc->pid = current->group_leader->pid; 2933 INIT_LIST_HEAD(&proc->delivered_death); 2934 filp->private_data = proc; 2935 2936 binder_unlock(__func__); 2937 2938 if (binder_debugfs_dir_entry_proc) { 2939 char strbuf[11]; 2940 2941 snprintf(strbuf, sizeof(strbuf), "%u", proc->pid); 2942 proc->debugfs_entry = debugfs_create_file(strbuf, S_IRUGO, 2943 binder_debugfs_dir_entry_proc, proc, &binder_proc_fops); 2944 } 2945 2946 return 0; 2947 } 2948 2949 static int binder_flush(struct file *filp, fl_owner_t id) 2950 { 2951 struct binder_proc *proc = filp->private_data; 2952 2953 binder_defer_work(proc, BINDER_DEFERRED_FLUSH); 2954 2955 return 0; 2956 } 2957 2958 static void binder_deferred_flush(struct binder_proc *proc) 2959 { 2960 struct rb_node *n; 2961 int wake_count = 0; 2962 2963 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) { 2964 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node); 2965 2966 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 2967 if (thread->looper & BINDER_LOOPER_STATE_WAITING) { 2968 wake_up_interruptible(&thread->wait); 2969 wake_count++; 2970 } 2971 } 2972 wake_up_interruptible_all(&proc->wait); 2973 2974 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 2975 "binder_flush: %d woke %d threads\n", proc->pid, 2976 wake_count); 2977 } 2978 2979 static int binder_release(struct inode *nodp, struct file *filp) 2980 { 2981 struct binder_proc *proc = filp->private_data; 2982 2983 debugfs_remove(proc->debugfs_entry); 2984 binder_defer_work(proc, BINDER_DEFERRED_RELEASE); 2985 2986 return 0; 2987 } 2988 2989 static int binder_node_release(struct binder_node *node, int refs) 2990 { 2991 struct binder_ref *ref; 2992 int death = 0; 2993 2994 list_del_init(&node->work.entry); 2995 binder_release_work(&node->async_todo); 2996 2997 if (hlist_empty(&node->refs)) { 2998 kfree(node); 2999 binder_stats_deleted(BINDER_STAT_NODE); 3000 3001 return refs; 3002 } 3003 3004 node->proc = NULL; 3005 node->local_strong_refs = 0; 3006 node->local_weak_refs = 0; 3007 hlist_add_head(&node->dead_node, &binder_dead_nodes); 3008 3009 hlist_for_each_entry(ref, &node->refs, node_entry) { 3010 refs++; 3011 3012 if (!ref->death) 3013 continue; 3014 3015 death++; 3016 3017 if (list_empty(&ref->death->work.entry)) { 3018 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 3019 list_add_tail(&ref->death->work.entry, 3020 &ref->proc->todo); 3021 wake_up_interruptible(&ref->proc->wait); 3022 } else 3023 BUG(); 3024 } 3025 3026 binder_debug(BINDER_DEBUG_DEAD_BINDER, 3027 "node %d now dead, refs %d, death %d\n", 3028 node->debug_id, refs, death); 3029 3030 return refs; 3031 } 3032 3033 static void binder_deferred_release(struct binder_proc *proc) 3034 { 3035 struct binder_transaction *t; 3036 struct rb_node *n; 3037 int threads, nodes, incoming_refs, outgoing_refs, buffers, 3038 active_transactions, page_count; 3039 3040 BUG_ON(proc->vma); 3041 BUG_ON(proc->files); 3042 3043 hlist_del(&proc->proc_node); 3044 3045 if (binder_context_mgr_node && binder_context_mgr_node->proc == proc) { 3046 binder_debug(BINDER_DEBUG_DEAD_BINDER, 3047 "%s: %d context_mgr_node gone\n", 3048 __func__, proc->pid); 3049 binder_context_mgr_node = NULL; 3050 } 3051 3052 threads = 0; 3053 active_transactions = 0; 3054 while ((n = rb_first(&proc->threads))) { 3055 struct binder_thread *thread; 3056 3057 thread = rb_entry(n, struct binder_thread, rb_node); 3058 threads++; 3059 active_transactions += binder_free_thread(proc, thread); 3060 } 3061 3062 nodes = 0; 3063 incoming_refs = 0; 3064 while ((n = rb_first(&proc->nodes))) { 3065 struct binder_node *node; 3066 3067 node = rb_entry(n, struct binder_node, rb_node); 3068 nodes++; 3069 rb_erase(&node->rb_node, &proc->nodes); 3070 incoming_refs = binder_node_release(node, incoming_refs); 3071 } 3072 3073 outgoing_refs = 0; 3074 while ((n = rb_first(&proc->refs_by_desc))) { 3075 struct binder_ref *ref; 3076 3077 ref = rb_entry(n, struct binder_ref, rb_node_desc); 3078 outgoing_refs++; 3079 binder_delete_ref(ref); 3080 } 3081 3082 binder_release_work(&proc->todo); 3083 binder_release_work(&proc->delivered_death); 3084 3085 buffers = 0; 3086 while ((n = rb_first(&proc->allocated_buffers))) { 3087 struct binder_buffer *buffer; 3088 3089 buffer = rb_entry(n, struct binder_buffer, rb_node); 3090 3091 t = buffer->transaction; 3092 if (t) { 3093 t->buffer = NULL; 3094 buffer->transaction = NULL; 3095 pr_err("release proc %d, transaction %d, not freed\n", 3096 proc->pid, t->debug_id); 3097 /*BUG();*/ 3098 } 3099 3100 binder_free_buf(proc, buffer); 3101 buffers++; 3102 } 3103 3104 binder_stats_deleted(BINDER_STAT_PROC); 3105 3106 page_count = 0; 3107 if (proc->pages) { 3108 int i; 3109 3110 for (i = 0; i < proc->buffer_size / PAGE_SIZE; i++) { 3111 void *page_addr; 3112 3113 if (!proc->pages[i]) 3114 continue; 3115 3116 page_addr = proc->buffer + i * PAGE_SIZE; 3117 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 3118 "%s: %d: page %d at %p not freed\n", 3119 __func__, proc->pid, i, page_addr); 3120 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE); 3121 __free_page(proc->pages[i]); 3122 page_count++; 3123 } 3124 kfree(proc->pages); 3125 vfree(proc->buffer); 3126 } 3127 3128 put_task_struct(proc->tsk); 3129 3130 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 3131 "%s: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d, buffers %d, pages %d\n", 3132 __func__, proc->pid, threads, nodes, incoming_refs, 3133 outgoing_refs, active_transactions, buffers, page_count); 3134 3135 kfree(proc); 3136 } 3137 3138 static void binder_deferred_func(struct work_struct *work) 3139 { 3140 struct binder_proc *proc; 3141 struct files_struct *files; 3142 3143 int defer; 3144 3145 do { 3146 binder_lock(__func__); 3147 mutex_lock(&binder_deferred_lock); 3148 if (!hlist_empty(&binder_deferred_list)) { 3149 proc = hlist_entry(binder_deferred_list.first, 3150 struct binder_proc, deferred_work_node); 3151 hlist_del_init(&proc->deferred_work_node); 3152 defer = proc->deferred_work; 3153 proc->deferred_work = 0; 3154 } else { 3155 proc = NULL; 3156 defer = 0; 3157 } 3158 mutex_unlock(&binder_deferred_lock); 3159 3160 files = NULL; 3161 if (defer & BINDER_DEFERRED_PUT_FILES) { 3162 files = proc->files; 3163 if (files) 3164 proc->files = NULL; 3165 } 3166 3167 if (defer & BINDER_DEFERRED_FLUSH) 3168 binder_deferred_flush(proc); 3169 3170 if (defer & BINDER_DEFERRED_RELEASE) 3171 binder_deferred_release(proc); /* frees proc */ 3172 3173 binder_unlock(__func__); 3174 if (files) 3175 put_files_struct(files); 3176 } while (proc); 3177 } 3178 static DECLARE_WORK(binder_deferred_work, binder_deferred_func); 3179 3180 static void 3181 binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer) 3182 { 3183 mutex_lock(&binder_deferred_lock); 3184 proc->deferred_work |= defer; 3185 if (hlist_unhashed(&proc->deferred_work_node)) { 3186 hlist_add_head(&proc->deferred_work_node, 3187 &binder_deferred_list); 3188 queue_work(binder_deferred_workqueue, &binder_deferred_work); 3189 } 3190 mutex_unlock(&binder_deferred_lock); 3191 } 3192 3193 static void print_binder_transaction(struct seq_file *m, const char *prefix, 3194 struct binder_transaction *t) 3195 { 3196 seq_printf(m, 3197 "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d", 3198 prefix, t->debug_id, t, 3199 t->from ? t->from->proc->pid : 0, 3200 t->from ? t->from->pid : 0, 3201 t->to_proc ? t->to_proc->pid : 0, 3202 t->to_thread ? t->to_thread->pid : 0, 3203 t->code, t->flags, t->priority, t->need_reply); 3204 if (t->buffer == NULL) { 3205 seq_puts(m, " buffer free\n"); 3206 return; 3207 } 3208 if (t->buffer->target_node) 3209 seq_printf(m, " node %d", 3210 t->buffer->target_node->debug_id); 3211 seq_printf(m, " size %zd:%zd data %p\n", 3212 t->buffer->data_size, t->buffer->offsets_size, 3213 t->buffer->data); 3214 } 3215 3216 static void print_binder_buffer(struct seq_file *m, const char *prefix, 3217 struct binder_buffer *buffer) 3218 { 3219 seq_printf(m, "%s %d: %p size %zd:%zd %s\n", 3220 prefix, buffer->debug_id, buffer->data, 3221 buffer->data_size, buffer->offsets_size, 3222 buffer->transaction ? "active" : "delivered"); 3223 } 3224 3225 static void print_binder_work(struct seq_file *m, const char *prefix, 3226 const char *transaction_prefix, 3227 struct binder_work *w) 3228 { 3229 struct binder_node *node; 3230 struct binder_transaction *t; 3231 3232 switch (w->type) { 3233 case BINDER_WORK_TRANSACTION: 3234 t = container_of(w, struct binder_transaction, work); 3235 print_binder_transaction(m, transaction_prefix, t); 3236 break; 3237 case BINDER_WORK_TRANSACTION_COMPLETE: 3238 seq_printf(m, "%stransaction complete\n", prefix); 3239 break; 3240 case BINDER_WORK_NODE: 3241 node = container_of(w, struct binder_node, work); 3242 seq_printf(m, "%snode work %d: u%016llx c%016llx\n", 3243 prefix, node->debug_id, 3244 (u64)node->ptr, (u64)node->cookie); 3245 break; 3246 case BINDER_WORK_DEAD_BINDER: 3247 seq_printf(m, "%shas dead binder\n", prefix); 3248 break; 3249 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 3250 seq_printf(m, "%shas cleared dead binder\n", prefix); 3251 break; 3252 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: 3253 seq_printf(m, "%shas cleared death notification\n", prefix); 3254 break; 3255 default: 3256 seq_printf(m, "%sunknown work: type %d\n", prefix, w->type); 3257 break; 3258 } 3259 } 3260 3261 static void print_binder_thread(struct seq_file *m, 3262 struct binder_thread *thread, 3263 int print_always) 3264 { 3265 struct binder_transaction *t; 3266 struct binder_work *w; 3267 size_t start_pos = m->count; 3268 size_t header_pos; 3269 3270 seq_printf(m, " thread %d: l %02x\n", thread->pid, thread->looper); 3271 header_pos = m->count; 3272 t = thread->transaction_stack; 3273 while (t) { 3274 if (t->from == thread) { 3275 print_binder_transaction(m, 3276 " outgoing transaction", t); 3277 t = t->from_parent; 3278 } else if (t->to_thread == thread) { 3279 print_binder_transaction(m, 3280 " incoming transaction", t); 3281 t = t->to_parent; 3282 } else { 3283 print_binder_transaction(m, " bad transaction", t); 3284 t = NULL; 3285 } 3286 } 3287 list_for_each_entry(w, &thread->todo, entry) { 3288 print_binder_work(m, " ", " pending transaction", w); 3289 } 3290 if (!print_always && m->count == header_pos) 3291 m->count = start_pos; 3292 } 3293 3294 static void print_binder_node(struct seq_file *m, struct binder_node *node) 3295 { 3296 struct binder_ref *ref; 3297 struct binder_work *w; 3298 int count; 3299 3300 count = 0; 3301 hlist_for_each_entry(ref, &node->refs, node_entry) 3302 count++; 3303 3304 seq_printf(m, " node %d: u%016llx c%016llx hs %d hw %d ls %d lw %d is %d iw %d", 3305 node->debug_id, (u64)node->ptr, (u64)node->cookie, 3306 node->has_strong_ref, node->has_weak_ref, 3307 node->local_strong_refs, node->local_weak_refs, 3308 node->internal_strong_refs, count); 3309 if (count) { 3310 seq_puts(m, " proc"); 3311 hlist_for_each_entry(ref, &node->refs, node_entry) 3312 seq_printf(m, " %d", ref->proc->pid); 3313 } 3314 seq_puts(m, "\n"); 3315 list_for_each_entry(w, &node->async_todo, entry) 3316 print_binder_work(m, " ", 3317 " pending async transaction", w); 3318 } 3319 3320 static void print_binder_ref(struct seq_file *m, struct binder_ref *ref) 3321 { 3322 seq_printf(m, " ref %d: desc %d %snode %d s %d w %d d %p\n", 3323 ref->debug_id, ref->desc, ref->node->proc ? "" : "dead ", 3324 ref->node->debug_id, ref->strong, ref->weak, ref->death); 3325 } 3326 3327 static void print_binder_proc(struct seq_file *m, 3328 struct binder_proc *proc, int print_all) 3329 { 3330 struct binder_work *w; 3331 struct rb_node *n; 3332 size_t start_pos = m->count; 3333 size_t header_pos; 3334 3335 seq_printf(m, "proc %d\n", proc->pid); 3336 header_pos = m->count; 3337 3338 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3339 print_binder_thread(m, rb_entry(n, struct binder_thread, 3340 rb_node), print_all); 3341 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) { 3342 struct binder_node *node = rb_entry(n, struct binder_node, 3343 rb_node); 3344 if (print_all || node->has_async_transaction) 3345 print_binder_node(m, node); 3346 } 3347 if (print_all) { 3348 for (n = rb_first(&proc->refs_by_desc); 3349 n != NULL; 3350 n = rb_next(n)) 3351 print_binder_ref(m, rb_entry(n, struct binder_ref, 3352 rb_node_desc)); 3353 } 3354 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3355 print_binder_buffer(m, " buffer", 3356 rb_entry(n, struct binder_buffer, rb_node)); 3357 list_for_each_entry(w, &proc->todo, entry) 3358 print_binder_work(m, " ", " pending transaction", w); 3359 list_for_each_entry(w, &proc->delivered_death, entry) { 3360 seq_puts(m, " has delivered dead binder\n"); 3361 break; 3362 } 3363 if (!print_all && m->count == header_pos) 3364 m->count = start_pos; 3365 } 3366 3367 static const char * const binder_return_strings[] = { 3368 "BR_ERROR", 3369 "BR_OK", 3370 "BR_TRANSACTION", 3371 "BR_REPLY", 3372 "BR_ACQUIRE_RESULT", 3373 "BR_DEAD_REPLY", 3374 "BR_TRANSACTION_COMPLETE", 3375 "BR_INCREFS", 3376 "BR_ACQUIRE", 3377 "BR_RELEASE", 3378 "BR_DECREFS", 3379 "BR_ATTEMPT_ACQUIRE", 3380 "BR_NOOP", 3381 "BR_SPAWN_LOOPER", 3382 "BR_FINISHED", 3383 "BR_DEAD_BINDER", 3384 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 3385 "BR_FAILED_REPLY" 3386 }; 3387 3388 static const char * const binder_command_strings[] = { 3389 "BC_TRANSACTION", 3390 "BC_REPLY", 3391 "BC_ACQUIRE_RESULT", 3392 "BC_FREE_BUFFER", 3393 "BC_INCREFS", 3394 "BC_ACQUIRE", 3395 "BC_RELEASE", 3396 "BC_DECREFS", 3397 "BC_INCREFS_DONE", 3398 "BC_ACQUIRE_DONE", 3399 "BC_ATTEMPT_ACQUIRE", 3400 "BC_REGISTER_LOOPER", 3401 "BC_ENTER_LOOPER", 3402 "BC_EXIT_LOOPER", 3403 "BC_REQUEST_DEATH_NOTIFICATION", 3404 "BC_CLEAR_DEATH_NOTIFICATION", 3405 "BC_DEAD_BINDER_DONE" 3406 }; 3407 3408 static const char * const binder_objstat_strings[] = { 3409 "proc", 3410 "thread", 3411 "node", 3412 "ref", 3413 "death", 3414 "transaction", 3415 "transaction_complete" 3416 }; 3417 3418 static void print_binder_stats(struct seq_file *m, const char *prefix, 3419 struct binder_stats *stats) 3420 { 3421 int i; 3422 3423 BUILD_BUG_ON(ARRAY_SIZE(stats->bc) != 3424 ARRAY_SIZE(binder_command_strings)); 3425 for (i = 0; i < ARRAY_SIZE(stats->bc); i++) { 3426 if (stats->bc[i]) 3427 seq_printf(m, "%s%s: %d\n", prefix, 3428 binder_command_strings[i], stats->bc[i]); 3429 } 3430 3431 BUILD_BUG_ON(ARRAY_SIZE(stats->br) != 3432 ARRAY_SIZE(binder_return_strings)); 3433 for (i = 0; i < ARRAY_SIZE(stats->br); i++) { 3434 if (stats->br[i]) 3435 seq_printf(m, "%s%s: %d\n", prefix, 3436 binder_return_strings[i], stats->br[i]); 3437 } 3438 3439 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 3440 ARRAY_SIZE(binder_objstat_strings)); 3441 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 3442 ARRAY_SIZE(stats->obj_deleted)); 3443 for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) { 3444 if (stats->obj_created[i] || stats->obj_deleted[i]) 3445 seq_printf(m, "%s%s: active %d total %d\n", prefix, 3446 binder_objstat_strings[i], 3447 stats->obj_created[i] - stats->obj_deleted[i], 3448 stats->obj_created[i]); 3449 } 3450 } 3451 3452 static void print_binder_proc_stats(struct seq_file *m, 3453 struct binder_proc *proc) 3454 { 3455 struct binder_work *w; 3456 struct rb_node *n; 3457 int count, strong, weak; 3458 3459 seq_printf(m, "proc %d\n", proc->pid); 3460 count = 0; 3461 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3462 count++; 3463 seq_printf(m, " threads: %d\n", count); 3464 seq_printf(m, " requested threads: %d+%d/%d\n" 3465 " ready threads %d\n" 3466 " free async space %zd\n", proc->requested_threads, 3467 proc->requested_threads_started, proc->max_threads, 3468 proc->ready_threads, proc->free_async_space); 3469 count = 0; 3470 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) 3471 count++; 3472 seq_printf(m, " nodes: %d\n", count); 3473 count = 0; 3474 strong = 0; 3475 weak = 0; 3476 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 3477 struct binder_ref *ref = rb_entry(n, struct binder_ref, 3478 rb_node_desc); 3479 count++; 3480 strong += ref->strong; 3481 weak += ref->weak; 3482 } 3483 seq_printf(m, " refs: %d s %d w %d\n", count, strong, weak); 3484 3485 count = 0; 3486 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3487 count++; 3488 seq_printf(m, " buffers: %d\n", count); 3489 3490 count = 0; 3491 list_for_each_entry(w, &proc->todo, entry) { 3492 switch (w->type) { 3493 case BINDER_WORK_TRANSACTION: 3494 count++; 3495 break; 3496 default: 3497 break; 3498 } 3499 } 3500 seq_printf(m, " pending transactions: %d\n", count); 3501 3502 print_binder_stats(m, " ", &proc->stats); 3503 } 3504 3505 3506 static int binder_state_show(struct seq_file *m, void *unused) 3507 { 3508 struct binder_proc *proc; 3509 struct binder_node *node; 3510 int do_lock = !binder_debug_no_lock; 3511 3512 if (do_lock) 3513 binder_lock(__func__); 3514 3515 seq_puts(m, "binder state:\n"); 3516 3517 if (!hlist_empty(&binder_dead_nodes)) 3518 seq_puts(m, "dead nodes:\n"); 3519 hlist_for_each_entry(node, &binder_dead_nodes, dead_node) 3520 print_binder_node(m, node); 3521 3522 hlist_for_each_entry(proc, &binder_procs, proc_node) 3523 print_binder_proc(m, proc, 1); 3524 if (do_lock) 3525 binder_unlock(__func__); 3526 return 0; 3527 } 3528 3529 static int binder_stats_show(struct seq_file *m, void *unused) 3530 { 3531 struct binder_proc *proc; 3532 int do_lock = !binder_debug_no_lock; 3533 3534 if (do_lock) 3535 binder_lock(__func__); 3536 3537 seq_puts(m, "binder stats:\n"); 3538 3539 print_binder_stats(m, "", &binder_stats); 3540 3541 hlist_for_each_entry(proc, &binder_procs, proc_node) 3542 print_binder_proc_stats(m, proc); 3543 if (do_lock) 3544 binder_unlock(__func__); 3545 return 0; 3546 } 3547 3548 static int binder_transactions_show(struct seq_file *m, void *unused) 3549 { 3550 struct binder_proc *proc; 3551 int do_lock = !binder_debug_no_lock; 3552 3553 if (do_lock) 3554 binder_lock(__func__); 3555 3556 seq_puts(m, "binder transactions:\n"); 3557 hlist_for_each_entry(proc, &binder_procs, proc_node) 3558 print_binder_proc(m, proc, 0); 3559 if (do_lock) 3560 binder_unlock(__func__); 3561 return 0; 3562 } 3563 3564 static int binder_proc_show(struct seq_file *m, void *unused) 3565 { 3566 struct binder_proc *proc = m->private; 3567 int do_lock = !binder_debug_no_lock; 3568 3569 if (do_lock) 3570 binder_lock(__func__); 3571 seq_puts(m, "binder proc state:\n"); 3572 print_binder_proc(m, proc, 1); 3573 if (do_lock) 3574 binder_unlock(__func__); 3575 return 0; 3576 } 3577 3578 static void print_binder_transaction_log_entry(struct seq_file *m, 3579 struct binder_transaction_log_entry *e) 3580 { 3581 seq_printf(m, 3582 "%d: %s from %d:%d to %d:%d node %d handle %d size %d:%d\n", 3583 e->debug_id, (e->call_type == 2) ? "reply" : 3584 ((e->call_type == 1) ? "async" : "call "), e->from_proc, 3585 e->from_thread, e->to_proc, e->to_thread, e->to_node, 3586 e->target_handle, e->data_size, e->offsets_size); 3587 } 3588 3589 static int binder_transaction_log_show(struct seq_file *m, void *unused) 3590 { 3591 struct binder_transaction_log *log = m->private; 3592 int i; 3593 3594 if (log->full) { 3595 for (i = log->next; i < ARRAY_SIZE(log->entry); i++) 3596 print_binder_transaction_log_entry(m, &log->entry[i]); 3597 } 3598 for (i = 0; i < log->next; i++) 3599 print_binder_transaction_log_entry(m, &log->entry[i]); 3600 return 0; 3601 } 3602 3603 static const struct file_operations binder_fops = { 3604 .owner = THIS_MODULE, 3605 .poll = binder_poll, 3606 .unlocked_ioctl = binder_ioctl, 3607 .compat_ioctl = binder_ioctl, 3608 .mmap = binder_mmap, 3609 .open = binder_open, 3610 .flush = binder_flush, 3611 .release = binder_release, 3612 }; 3613 3614 static struct miscdevice binder_miscdev = { 3615 .minor = MISC_DYNAMIC_MINOR, 3616 .name = "binder", 3617 .fops = &binder_fops 3618 }; 3619 3620 BINDER_DEBUG_ENTRY(state); 3621 BINDER_DEBUG_ENTRY(stats); 3622 BINDER_DEBUG_ENTRY(transactions); 3623 BINDER_DEBUG_ENTRY(transaction_log); 3624 3625 static int __init binder_init(void) 3626 { 3627 int ret; 3628 3629 binder_deferred_workqueue = create_singlethread_workqueue("binder"); 3630 if (!binder_deferred_workqueue) 3631 return -ENOMEM; 3632 3633 binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL); 3634 if (binder_debugfs_dir_entry_root) 3635 binder_debugfs_dir_entry_proc = debugfs_create_dir("proc", 3636 binder_debugfs_dir_entry_root); 3637 ret = misc_register(&binder_miscdev); 3638 if (binder_debugfs_dir_entry_root) { 3639 debugfs_create_file("state", 3640 S_IRUGO, 3641 binder_debugfs_dir_entry_root, 3642 NULL, 3643 &binder_state_fops); 3644 debugfs_create_file("stats", 3645 S_IRUGO, 3646 binder_debugfs_dir_entry_root, 3647 NULL, 3648 &binder_stats_fops); 3649 debugfs_create_file("transactions", 3650 S_IRUGO, 3651 binder_debugfs_dir_entry_root, 3652 NULL, 3653 &binder_transactions_fops); 3654 debugfs_create_file("transaction_log", 3655 S_IRUGO, 3656 binder_debugfs_dir_entry_root, 3657 &binder_transaction_log, 3658 &binder_transaction_log_fops); 3659 debugfs_create_file("failed_transaction_log", 3660 S_IRUGO, 3661 binder_debugfs_dir_entry_root, 3662 &binder_transaction_log_failed, 3663 &binder_transaction_log_fops); 3664 } 3665 return ret; 3666 } 3667 3668 device_initcall(binder_init); 3669 3670 #define CREATE_TRACE_POINTS 3671 #include "binder_trace.h" 3672 3673 MODULE_LICENSE("GPL v2"); 3674