1 /* binder.c 2 * 3 * Android IPC Subsystem 4 * 5 * Copyright (C) 2007-2008 Google, Inc. 6 * 7 * This software is licensed under the terms of the GNU General Public 8 * License version 2, as published by the Free Software Foundation, and 9 * may be copied, distributed, and modified under those terms. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 */ 17 18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 19 20 #include <asm/cacheflush.h> 21 #include <linux/fdtable.h> 22 #include <linux/file.h> 23 #include <linux/freezer.h> 24 #include <linux/fs.h> 25 #include <linux/list.h> 26 #include <linux/miscdevice.h> 27 #include <linux/mm.h> 28 #include <linux/module.h> 29 #include <linux/mutex.h> 30 #include <linux/nsproxy.h> 31 #include <linux/poll.h> 32 #include <linux/debugfs.h> 33 #include <linux/rbtree.h> 34 #include <linux/sched/signal.h> 35 #include <linux/sched/mm.h> 36 #include <linux/seq_file.h> 37 #include <linux/uaccess.h> 38 #include <linux/vmalloc.h> 39 #include <linux/slab.h> 40 #include <linux/pid_namespace.h> 41 #include <linux/security.h> 42 43 #ifdef CONFIG_ANDROID_BINDER_IPC_32BIT 44 #define BINDER_IPC_32BIT 1 45 #endif 46 47 #include <uapi/linux/android/binder.h> 48 #include "binder_trace.h" 49 50 static DEFINE_MUTEX(binder_main_lock); 51 static DEFINE_MUTEX(binder_deferred_lock); 52 static DEFINE_MUTEX(binder_mmap_lock); 53 54 static HLIST_HEAD(binder_devices); 55 static HLIST_HEAD(binder_procs); 56 static HLIST_HEAD(binder_deferred_list); 57 static HLIST_HEAD(binder_dead_nodes); 58 59 static struct dentry *binder_debugfs_dir_entry_root; 60 static struct dentry *binder_debugfs_dir_entry_proc; 61 static int binder_last_id; 62 63 #define BINDER_DEBUG_ENTRY(name) \ 64 static int binder_##name##_open(struct inode *inode, struct file *file) \ 65 { \ 66 return single_open(file, binder_##name##_show, inode->i_private); \ 67 } \ 68 \ 69 static const struct file_operations binder_##name##_fops = { \ 70 .owner = THIS_MODULE, \ 71 .open = binder_##name##_open, \ 72 .read = seq_read, \ 73 .llseek = seq_lseek, \ 74 .release = single_release, \ 75 } 76 77 static int binder_proc_show(struct seq_file *m, void *unused); 78 BINDER_DEBUG_ENTRY(proc); 79 80 /* This is only defined in include/asm-arm/sizes.h */ 81 #ifndef SZ_1K 82 #define SZ_1K 0x400 83 #endif 84 85 #ifndef SZ_4M 86 #define SZ_4M 0x400000 87 #endif 88 89 #define FORBIDDEN_MMAP_FLAGS (VM_WRITE) 90 91 #define BINDER_SMALL_BUF_SIZE (PAGE_SIZE * 64) 92 93 enum { 94 BINDER_DEBUG_USER_ERROR = 1U << 0, 95 BINDER_DEBUG_FAILED_TRANSACTION = 1U << 1, 96 BINDER_DEBUG_DEAD_TRANSACTION = 1U << 2, 97 BINDER_DEBUG_OPEN_CLOSE = 1U << 3, 98 BINDER_DEBUG_DEAD_BINDER = 1U << 4, 99 BINDER_DEBUG_DEATH_NOTIFICATION = 1U << 5, 100 BINDER_DEBUG_READ_WRITE = 1U << 6, 101 BINDER_DEBUG_USER_REFS = 1U << 7, 102 BINDER_DEBUG_THREADS = 1U << 8, 103 BINDER_DEBUG_TRANSACTION = 1U << 9, 104 BINDER_DEBUG_TRANSACTION_COMPLETE = 1U << 10, 105 BINDER_DEBUG_FREE_BUFFER = 1U << 11, 106 BINDER_DEBUG_INTERNAL_REFS = 1U << 12, 107 BINDER_DEBUG_BUFFER_ALLOC = 1U << 13, 108 BINDER_DEBUG_PRIORITY_CAP = 1U << 14, 109 BINDER_DEBUG_BUFFER_ALLOC_ASYNC = 1U << 15, 110 }; 111 static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR | 112 BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION; 113 module_param_named(debug_mask, binder_debug_mask, uint, S_IWUSR | S_IRUGO); 114 115 static bool binder_debug_no_lock; 116 module_param_named(proc_no_lock, binder_debug_no_lock, bool, S_IWUSR | S_IRUGO); 117 118 static char *binder_devices_param = CONFIG_ANDROID_BINDER_DEVICES; 119 module_param_named(devices, binder_devices_param, charp, 0444); 120 121 static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait); 122 static int binder_stop_on_user_error; 123 124 static int binder_set_stop_on_user_error(const char *val, 125 struct kernel_param *kp) 126 { 127 int ret; 128 129 ret = param_set_int(val, kp); 130 if (binder_stop_on_user_error < 2) 131 wake_up(&binder_user_error_wait); 132 return ret; 133 } 134 module_param_call(stop_on_user_error, binder_set_stop_on_user_error, 135 param_get_int, &binder_stop_on_user_error, S_IWUSR | S_IRUGO); 136 137 #define binder_debug(mask, x...) \ 138 do { \ 139 if (binder_debug_mask & mask) \ 140 pr_info(x); \ 141 } while (0) 142 143 #define binder_user_error(x...) \ 144 do { \ 145 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \ 146 pr_info(x); \ 147 if (binder_stop_on_user_error) \ 148 binder_stop_on_user_error = 2; \ 149 } while (0) 150 151 #define to_flat_binder_object(hdr) \ 152 container_of(hdr, struct flat_binder_object, hdr) 153 154 #define to_binder_fd_object(hdr) container_of(hdr, struct binder_fd_object, hdr) 155 156 #define to_binder_buffer_object(hdr) \ 157 container_of(hdr, struct binder_buffer_object, hdr) 158 159 #define to_binder_fd_array_object(hdr) \ 160 container_of(hdr, struct binder_fd_array_object, hdr) 161 162 enum binder_stat_types { 163 BINDER_STAT_PROC, 164 BINDER_STAT_THREAD, 165 BINDER_STAT_NODE, 166 BINDER_STAT_REF, 167 BINDER_STAT_DEATH, 168 BINDER_STAT_TRANSACTION, 169 BINDER_STAT_TRANSACTION_COMPLETE, 170 BINDER_STAT_COUNT 171 }; 172 173 struct binder_stats { 174 int br[_IOC_NR(BR_FAILED_REPLY) + 1]; 175 int bc[_IOC_NR(BC_REPLY_SG) + 1]; 176 int obj_created[BINDER_STAT_COUNT]; 177 int obj_deleted[BINDER_STAT_COUNT]; 178 }; 179 180 static struct binder_stats binder_stats; 181 182 static inline void binder_stats_deleted(enum binder_stat_types type) 183 { 184 binder_stats.obj_deleted[type]++; 185 } 186 187 static inline void binder_stats_created(enum binder_stat_types type) 188 { 189 binder_stats.obj_created[type]++; 190 } 191 192 struct binder_transaction_log_entry { 193 int debug_id; 194 int call_type; 195 int from_proc; 196 int from_thread; 197 int target_handle; 198 int to_proc; 199 int to_thread; 200 int to_node; 201 int data_size; 202 int offsets_size; 203 const char *context_name; 204 }; 205 struct binder_transaction_log { 206 int next; 207 int full; 208 struct binder_transaction_log_entry entry[32]; 209 }; 210 static struct binder_transaction_log binder_transaction_log; 211 static struct binder_transaction_log binder_transaction_log_failed; 212 213 static struct binder_transaction_log_entry *binder_transaction_log_add( 214 struct binder_transaction_log *log) 215 { 216 struct binder_transaction_log_entry *e; 217 218 e = &log->entry[log->next]; 219 memset(e, 0, sizeof(*e)); 220 log->next++; 221 if (log->next == ARRAY_SIZE(log->entry)) { 222 log->next = 0; 223 log->full = 1; 224 } 225 return e; 226 } 227 228 struct binder_context { 229 struct binder_node *binder_context_mgr_node; 230 kuid_t binder_context_mgr_uid; 231 const char *name; 232 }; 233 234 struct binder_device { 235 struct hlist_node hlist; 236 struct miscdevice miscdev; 237 struct binder_context context; 238 }; 239 240 struct binder_work { 241 struct list_head entry; 242 enum { 243 BINDER_WORK_TRANSACTION = 1, 244 BINDER_WORK_TRANSACTION_COMPLETE, 245 BINDER_WORK_NODE, 246 BINDER_WORK_DEAD_BINDER, 247 BINDER_WORK_DEAD_BINDER_AND_CLEAR, 248 BINDER_WORK_CLEAR_DEATH_NOTIFICATION, 249 } type; 250 }; 251 252 struct binder_node { 253 int debug_id; 254 struct binder_work work; 255 union { 256 struct rb_node rb_node; 257 struct hlist_node dead_node; 258 }; 259 struct binder_proc *proc; 260 struct hlist_head refs; 261 int internal_strong_refs; 262 int local_weak_refs; 263 int local_strong_refs; 264 binder_uintptr_t ptr; 265 binder_uintptr_t cookie; 266 unsigned has_strong_ref:1; 267 unsigned pending_strong_ref:1; 268 unsigned has_weak_ref:1; 269 unsigned pending_weak_ref:1; 270 unsigned has_async_transaction:1; 271 unsigned accept_fds:1; 272 unsigned min_priority:8; 273 struct list_head async_todo; 274 }; 275 276 struct binder_ref_death { 277 struct binder_work work; 278 binder_uintptr_t cookie; 279 }; 280 281 struct binder_ref { 282 /* Lookups needed: */ 283 /* node + proc => ref (transaction) */ 284 /* desc + proc => ref (transaction, inc/dec ref) */ 285 /* node => refs + procs (proc exit) */ 286 int debug_id; 287 struct rb_node rb_node_desc; 288 struct rb_node rb_node_node; 289 struct hlist_node node_entry; 290 struct binder_proc *proc; 291 struct binder_node *node; 292 uint32_t desc; 293 int strong; 294 int weak; 295 struct binder_ref_death *death; 296 }; 297 298 struct binder_buffer { 299 struct list_head entry; /* free and allocated entries by address */ 300 struct rb_node rb_node; /* free entry by size or allocated entry */ 301 /* by address */ 302 unsigned free:1; 303 unsigned allow_user_free:1; 304 unsigned async_transaction:1; 305 unsigned debug_id:29; 306 307 struct binder_transaction *transaction; 308 309 struct binder_node *target_node; 310 size_t data_size; 311 size_t offsets_size; 312 size_t extra_buffers_size; 313 uint8_t data[0]; 314 }; 315 316 enum binder_deferred_state { 317 BINDER_DEFERRED_PUT_FILES = 0x01, 318 BINDER_DEFERRED_FLUSH = 0x02, 319 BINDER_DEFERRED_RELEASE = 0x04, 320 }; 321 322 struct binder_proc { 323 struct hlist_node proc_node; 324 struct rb_root threads; 325 struct rb_root nodes; 326 struct rb_root refs_by_desc; 327 struct rb_root refs_by_node; 328 int pid; 329 struct vm_area_struct *vma; 330 struct mm_struct *vma_vm_mm; 331 struct task_struct *tsk; 332 struct files_struct *files; 333 struct hlist_node deferred_work_node; 334 int deferred_work; 335 void *buffer; 336 ptrdiff_t user_buffer_offset; 337 338 struct list_head buffers; 339 struct rb_root free_buffers; 340 struct rb_root allocated_buffers; 341 size_t free_async_space; 342 343 struct page **pages; 344 size_t buffer_size; 345 uint32_t buffer_free; 346 struct list_head todo; 347 wait_queue_head_t wait; 348 struct binder_stats stats; 349 struct list_head delivered_death; 350 int max_threads; 351 int requested_threads; 352 int requested_threads_started; 353 int ready_threads; 354 long default_priority; 355 struct dentry *debugfs_entry; 356 struct binder_context *context; 357 }; 358 359 enum { 360 BINDER_LOOPER_STATE_REGISTERED = 0x01, 361 BINDER_LOOPER_STATE_ENTERED = 0x02, 362 BINDER_LOOPER_STATE_EXITED = 0x04, 363 BINDER_LOOPER_STATE_INVALID = 0x08, 364 BINDER_LOOPER_STATE_WAITING = 0x10, 365 BINDER_LOOPER_STATE_NEED_RETURN = 0x20 366 }; 367 368 struct binder_thread { 369 struct binder_proc *proc; 370 struct rb_node rb_node; 371 int pid; 372 int looper; 373 struct binder_transaction *transaction_stack; 374 struct list_head todo; 375 uint32_t return_error; /* Write failed, return error code in read buf */ 376 uint32_t return_error2; /* Write failed, return error code in read */ 377 /* buffer. Used when sending a reply to a dead process that */ 378 /* we are also waiting on */ 379 wait_queue_head_t wait; 380 struct binder_stats stats; 381 }; 382 383 struct binder_transaction { 384 int debug_id; 385 struct binder_work work; 386 struct binder_thread *from; 387 struct binder_transaction *from_parent; 388 struct binder_proc *to_proc; 389 struct binder_thread *to_thread; 390 struct binder_transaction *to_parent; 391 unsigned need_reply:1; 392 /* unsigned is_dead:1; */ /* not used at the moment */ 393 394 struct binder_buffer *buffer; 395 unsigned int code; 396 unsigned int flags; 397 long priority; 398 long saved_priority; 399 kuid_t sender_euid; 400 }; 401 402 static void 403 binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer); 404 405 static int task_get_unused_fd_flags(struct binder_proc *proc, int flags) 406 { 407 struct files_struct *files = proc->files; 408 unsigned long rlim_cur; 409 unsigned long irqs; 410 411 if (files == NULL) 412 return -ESRCH; 413 414 if (!lock_task_sighand(proc->tsk, &irqs)) 415 return -EMFILE; 416 417 rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE); 418 unlock_task_sighand(proc->tsk, &irqs); 419 420 return __alloc_fd(files, 0, rlim_cur, flags); 421 } 422 423 /* 424 * copied from fd_install 425 */ 426 static void task_fd_install( 427 struct binder_proc *proc, unsigned int fd, struct file *file) 428 { 429 if (proc->files) 430 __fd_install(proc->files, fd, file); 431 } 432 433 /* 434 * copied from sys_close 435 */ 436 static long task_close_fd(struct binder_proc *proc, unsigned int fd) 437 { 438 int retval; 439 440 if (proc->files == NULL) 441 return -ESRCH; 442 443 retval = __close_fd(proc->files, fd); 444 /* can't restart close syscall because file table entry was cleared */ 445 if (unlikely(retval == -ERESTARTSYS || 446 retval == -ERESTARTNOINTR || 447 retval == -ERESTARTNOHAND || 448 retval == -ERESTART_RESTARTBLOCK)) 449 retval = -EINTR; 450 451 return retval; 452 } 453 454 static inline void binder_lock(const char *tag) 455 { 456 trace_binder_lock(tag); 457 mutex_lock(&binder_main_lock); 458 trace_binder_locked(tag); 459 } 460 461 static inline void binder_unlock(const char *tag) 462 { 463 trace_binder_unlock(tag); 464 mutex_unlock(&binder_main_lock); 465 } 466 467 static void binder_set_nice(long nice) 468 { 469 long min_nice; 470 471 if (can_nice(current, nice)) { 472 set_user_nice(current, nice); 473 return; 474 } 475 min_nice = rlimit_to_nice(current->signal->rlim[RLIMIT_NICE].rlim_cur); 476 binder_debug(BINDER_DEBUG_PRIORITY_CAP, 477 "%d: nice value %ld not allowed use %ld instead\n", 478 current->pid, nice, min_nice); 479 set_user_nice(current, min_nice); 480 if (min_nice <= MAX_NICE) 481 return; 482 binder_user_error("%d RLIMIT_NICE not set\n", current->pid); 483 } 484 485 static size_t binder_buffer_size(struct binder_proc *proc, 486 struct binder_buffer *buffer) 487 { 488 if (list_is_last(&buffer->entry, &proc->buffers)) 489 return proc->buffer + proc->buffer_size - (void *)buffer->data; 490 return (size_t)list_entry(buffer->entry.next, 491 struct binder_buffer, entry) - (size_t)buffer->data; 492 } 493 494 static void binder_insert_free_buffer(struct binder_proc *proc, 495 struct binder_buffer *new_buffer) 496 { 497 struct rb_node **p = &proc->free_buffers.rb_node; 498 struct rb_node *parent = NULL; 499 struct binder_buffer *buffer; 500 size_t buffer_size; 501 size_t new_buffer_size; 502 503 BUG_ON(!new_buffer->free); 504 505 new_buffer_size = binder_buffer_size(proc, new_buffer); 506 507 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 508 "%d: add free buffer, size %zd, at %p\n", 509 proc->pid, new_buffer_size, new_buffer); 510 511 while (*p) { 512 parent = *p; 513 buffer = rb_entry(parent, struct binder_buffer, rb_node); 514 BUG_ON(!buffer->free); 515 516 buffer_size = binder_buffer_size(proc, buffer); 517 518 if (new_buffer_size < buffer_size) 519 p = &parent->rb_left; 520 else 521 p = &parent->rb_right; 522 } 523 rb_link_node(&new_buffer->rb_node, parent, p); 524 rb_insert_color(&new_buffer->rb_node, &proc->free_buffers); 525 } 526 527 static void binder_insert_allocated_buffer(struct binder_proc *proc, 528 struct binder_buffer *new_buffer) 529 { 530 struct rb_node **p = &proc->allocated_buffers.rb_node; 531 struct rb_node *parent = NULL; 532 struct binder_buffer *buffer; 533 534 BUG_ON(new_buffer->free); 535 536 while (*p) { 537 parent = *p; 538 buffer = rb_entry(parent, struct binder_buffer, rb_node); 539 BUG_ON(buffer->free); 540 541 if (new_buffer < buffer) 542 p = &parent->rb_left; 543 else if (new_buffer > buffer) 544 p = &parent->rb_right; 545 else 546 BUG(); 547 } 548 rb_link_node(&new_buffer->rb_node, parent, p); 549 rb_insert_color(&new_buffer->rb_node, &proc->allocated_buffers); 550 } 551 552 static struct binder_buffer *binder_buffer_lookup(struct binder_proc *proc, 553 uintptr_t user_ptr) 554 { 555 struct rb_node *n = proc->allocated_buffers.rb_node; 556 struct binder_buffer *buffer; 557 struct binder_buffer *kern_ptr; 558 559 kern_ptr = (struct binder_buffer *)(user_ptr - proc->user_buffer_offset 560 - offsetof(struct binder_buffer, data)); 561 562 while (n) { 563 buffer = rb_entry(n, struct binder_buffer, rb_node); 564 BUG_ON(buffer->free); 565 566 if (kern_ptr < buffer) 567 n = n->rb_left; 568 else if (kern_ptr > buffer) 569 n = n->rb_right; 570 else 571 return buffer; 572 } 573 return NULL; 574 } 575 576 static int binder_update_page_range(struct binder_proc *proc, int allocate, 577 void *start, void *end, 578 struct vm_area_struct *vma) 579 { 580 void *page_addr; 581 unsigned long user_page_addr; 582 struct page **page; 583 struct mm_struct *mm; 584 585 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 586 "%d: %s pages %p-%p\n", proc->pid, 587 allocate ? "allocate" : "free", start, end); 588 589 if (end <= start) 590 return 0; 591 592 trace_binder_update_page_range(proc, allocate, start, end); 593 594 if (vma) 595 mm = NULL; 596 else 597 mm = get_task_mm(proc->tsk); 598 599 if (mm) { 600 down_write(&mm->mmap_sem); 601 vma = proc->vma; 602 if (vma && mm != proc->vma_vm_mm) { 603 pr_err("%d: vma mm and task mm mismatch\n", 604 proc->pid); 605 vma = NULL; 606 } 607 } 608 609 if (allocate == 0) 610 goto free_range; 611 612 if (vma == NULL) { 613 pr_err("%d: binder_alloc_buf failed to map pages in userspace, no vma\n", 614 proc->pid); 615 goto err_no_vma; 616 } 617 618 for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) { 619 int ret; 620 621 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 622 623 BUG_ON(*page); 624 *page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO); 625 if (*page == NULL) { 626 pr_err("%d: binder_alloc_buf failed for page at %p\n", 627 proc->pid, page_addr); 628 goto err_alloc_page_failed; 629 } 630 ret = map_kernel_range_noflush((unsigned long)page_addr, 631 PAGE_SIZE, PAGE_KERNEL, page); 632 flush_cache_vmap((unsigned long)page_addr, 633 (unsigned long)page_addr + PAGE_SIZE); 634 if (ret != 1) { 635 pr_err("%d: binder_alloc_buf failed to map page at %p in kernel\n", 636 proc->pid, page_addr); 637 goto err_map_kernel_failed; 638 } 639 user_page_addr = 640 (uintptr_t)page_addr + proc->user_buffer_offset; 641 ret = vm_insert_page(vma, user_page_addr, page[0]); 642 if (ret) { 643 pr_err("%d: binder_alloc_buf failed to map page at %lx in userspace\n", 644 proc->pid, user_page_addr); 645 goto err_vm_insert_page_failed; 646 } 647 /* vm_insert_page does not seem to increment the refcount */ 648 } 649 if (mm) { 650 up_write(&mm->mmap_sem); 651 mmput(mm); 652 } 653 return 0; 654 655 free_range: 656 for (page_addr = end - PAGE_SIZE; page_addr >= start; 657 page_addr -= PAGE_SIZE) { 658 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; 659 if (vma) 660 zap_page_range(vma, (uintptr_t)page_addr + 661 proc->user_buffer_offset, PAGE_SIZE); 662 err_vm_insert_page_failed: 663 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE); 664 err_map_kernel_failed: 665 __free_page(*page); 666 *page = NULL; 667 err_alloc_page_failed: 668 ; 669 } 670 err_no_vma: 671 if (mm) { 672 up_write(&mm->mmap_sem); 673 mmput(mm); 674 } 675 return -ENOMEM; 676 } 677 678 static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc, 679 size_t data_size, 680 size_t offsets_size, 681 size_t extra_buffers_size, 682 int is_async) 683 { 684 struct rb_node *n = proc->free_buffers.rb_node; 685 struct binder_buffer *buffer; 686 size_t buffer_size; 687 struct rb_node *best_fit = NULL; 688 void *has_page_addr; 689 void *end_page_addr; 690 size_t size, data_offsets_size; 691 692 if (proc->vma == NULL) { 693 pr_err("%d: binder_alloc_buf, no vma\n", 694 proc->pid); 695 return NULL; 696 } 697 698 data_offsets_size = ALIGN(data_size, sizeof(void *)) + 699 ALIGN(offsets_size, sizeof(void *)); 700 701 if (data_offsets_size < data_size || data_offsets_size < offsets_size) { 702 binder_user_error("%d: got transaction with invalid size %zd-%zd\n", 703 proc->pid, data_size, offsets_size); 704 return NULL; 705 } 706 size = data_offsets_size + ALIGN(extra_buffers_size, sizeof(void *)); 707 if (size < data_offsets_size || size < extra_buffers_size) { 708 binder_user_error("%d: got transaction with invalid extra_buffers_size %zd\n", 709 proc->pid, extra_buffers_size); 710 return NULL; 711 } 712 if (is_async && 713 proc->free_async_space < size + sizeof(struct binder_buffer)) { 714 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 715 "%d: binder_alloc_buf size %zd failed, no async space left\n", 716 proc->pid, size); 717 return NULL; 718 } 719 720 while (n) { 721 buffer = rb_entry(n, struct binder_buffer, rb_node); 722 BUG_ON(!buffer->free); 723 buffer_size = binder_buffer_size(proc, buffer); 724 725 if (size < buffer_size) { 726 best_fit = n; 727 n = n->rb_left; 728 } else if (size > buffer_size) 729 n = n->rb_right; 730 else { 731 best_fit = n; 732 break; 733 } 734 } 735 if (best_fit == NULL) { 736 pr_err("%d: binder_alloc_buf size %zd failed, no address space\n", 737 proc->pid, size); 738 return NULL; 739 } 740 if (n == NULL) { 741 buffer = rb_entry(best_fit, struct binder_buffer, rb_node); 742 buffer_size = binder_buffer_size(proc, buffer); 743 } 744 745 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 746 "%d: binder_alloc_buf size %zd got buffer %p size %zd\n", 747 proc->pid, size, buffer, buffer_size); 748 749 has_page_addr = 750 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK); 751 if (n == NULL) { 752 if (size + sizeof(struct binder_buffer) + 4 >= buffer_size) 753 buffer_size = size; /* no room for other buffers */ 754 else 755 buffer_size = size + sizeof(struct binder_buffer); 756 } 757 end_page_addr = 758 (void *)PAGE_ALIGN((uintptr_t)buffer->data + buffer_size); 759 if (end_page_addr > has_page_addr) 760 end_page_addr = has_page_addr; 761 if (binder_update_page_range(proc, 1, 762 (void *)PAGE_ALIGN((uintptr_t)buffer->data), end_page_addr, NULL)) 763 return NULL; 764 765 rb_erase(best_fit, &proc->free_buffers); 766 buffer->free = 0; 767 binder_insert_allocated_buffer(proc, buffer); 768 if (buffer_size != size) { 769 struct binder_buffer *new_buffer = (void *)buffer->data + size; 770 771 list_add(&new_buffer->entry, &buffer->entry); 772 new_buffer->free = 1; 773 binder_insert_free_buffer(proc, new_buffer); 774 } 775 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 776 "%d: binder_alloc_buf size %zd got %p\n", 777 proc->pid, size, buffer); 778 buffer->data_size = data_size; 779 buffer->offsets_size = offsets_size; 780 buffer->extra_buffers_size = extra_buffers_size; 781 buffer->async_transaction = is_async; 782 if (is_async) { 783 proc->free_async_space -= size + sizeof(struct binder_buffer); 784 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 785 "%d: binder_alloc_buf size %zd async free %zd\n", 786 proc->pid, size, proc->free_async_space); 787 } 788 789 return buffer; 790 } 791 792 static void *buffer_start_page(struct binder_buffer *buffer) 793 { 794 return (void *)((uintptr_t)buffer & PAGE_MASK); 795 } 796 797 static void *buffer_end_page(struct binder_buffer *buffer) 798 { 799 return (void *)(((uintptr_t)(buffer + 1) - 1) & PAGE_MASK); 800 } 801 802 static void binder_delete_free_buffer(struct binder_proc *proc, 803 struct binder_buffer *buffer) 804 { 805 struct binder_buffer *prev, *next = NULL; 806 int free_page_end = 1; 807 int free_page_start = 1; 808 809 BUG_ON(proc->buffers.next == &buffer->entry); 810 prev = list_entry(buffer->entry.prev, struct binder_buffer, entry); 811 BUG_ON(!prev->free); 812 if (buffer_end_page(prev) == buffer_start_page(buffer)) { 813 free_page_start = 0; 814 if (buffer_end_page(prev) == buffer_end_page(buffer)) 815 free_page_end = 0; 816 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 817 "%d: merge free, buffer %p share page with %p\n", 818 proc->pid, buffer, prev); 819 } 820 821 if (!list_is_last(&buffer->entry, &proc->buffers)) { 822 next = list_entry(buffer->entry.next, 823 struct binder_buffer, entry); 824 if (buffer_start_page(next) == buffer_end_page(buffer)) { 825 free_page_end = 0; 826 if (buffer_start_page(next) == 827 buffer_start_page(buffer)) 828 free_page_start = 0; 829 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 830 "%d: merge free, buffer %p share page with %p\n", 831 proc->pid, buffer, prev); 832 } 833 } 834 list_del(&buffer->entry); 835 if (free_page_start || free_page_end) { 836 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 837 "%d: merge free, buffer %p do not share page%s%s with %p or %p\n", 838 proc->pid, buffer, free_page_start ? "" : " end", 839 free_page_end ? "" : " start", prev, next); 840 binder_update_page_range(proc, 0, free_page_start ? 841 buffer_start_page(buffer) : buffer_end_page(buffer), 842 (free_page_end ? buffer_end_page(buffer) : 843 buffer_start_page(buffer)) + PAGE_SIZE, NULL); 844 } 845 } 846 847 static void binder_free_buf(struct binder_proc *proc, 848 struct binder_buffer *buffer) 849 { 850 size_t size, buffer_size; 851 852 buffer_size = binder_buffer_size(proc, buffer); 853 854 size = ALIGN(buffer->data_size, sizeof(void *)) + 855 ALIGN(buffer->offsets_size, sizeof(void *)) + 856 ALIGN(buffer->extra_buffers_size, sizeof(void *)); 857 858 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 859 "%d: binder_free_buf %p size %zd buffer_size %zd\n", 860 proc->pid, buffer, size, buffer_size); 861 862 BUG_ON(buffer->free); 863 BUG_ON(size > buffer_size); 864 BUG_ON(buffer->transaction != NULL); 865 BUG_ON((void *)buffer < proc->buffer); 866 BUG_ON((void *)buffer > proc->buffer + proc->buffer_size); 867 868 if (buffer->async_transaction) { 869 proc->free_async_space += size + sizeof(struct binder_buffer); 870 871 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, 872 "%d: binder_free_buf size %zd async free %zd\n", 873 proc->pid, size, proc->free_async_space); 874 } 875 876 binder_update_page_range(proc, 0, 877 (void *)PAGE_ALIGN((uintptr_t)buffer->data), 878 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK), 879 NULL); 880 rb_erase(&buffer->rb_node, &proc->allocated_buffers); 881 buffer->free = 1; 882 if (!list_is_last(&buffer->entry, &proc->buffers)) { 883 struct binder_buffer *next = list_entry(buffer->entry.next, 884 struct binder_buffer, entry); 885 886 if (next->free) { 887 rb_erase(&next->rb_node, &proc->free_buffers); 888 binder_delete_free_buffer(proc, next); 889 } 890 } 891 if (proc->buffers.next != &buffer->entry) { 892 struct binder_buffer *prev = list_entry(buffer->entry.prev, 893 struct binder_buffer, entry); 894 895 if (prev->free) { 896 binder_delete_free_buffer(proc, buffer); 897 rb_erase(&prev->rb_node, &proc->free_buffers); 898 buffer = prev; 899 } 900 } 901 binder_insert_free_buffer(proc, buffer); 902 } 903 904 static struct binder_node *binder_get_node(struct binder_proc *proc, 905 binder_uintptr_t ptr) 906 { 907 struct rb_node *n = proc->nodes.rb_node; 908 struct binder_node *node; 909 910 while (n) { 911 node = rb_entry(n, struct binder_node, rb_node); 912 913 if (ptr < node->ptr) 914 n = n->rb_left; 915 else if (ptr > node->ptr) 916 n = n->rb_right; 917 else 918 return node; 919 } 920 return NULL; 921 } 922 923 static struct binder_node *binder_new_node(struct binder_proc *proc, 924 binder_uintptr_t ptr, 925 binder_uintptr_t cookie) 926 { 927 struct rb_node **p = &proc->nodes.rb_node; 928 struct rb_node *parent = NULL; 929 struct binder_node *node; 930 931 while (*p) { 932 parent = *p; 933 node = rb_entry(parent, struct binder_node, rb_node); 934 935 if (ptr < node->ptr) 936 p = &(*p)->rb_left; 937 else if (ptr > node->ptr) 938 p = &(*p)->rb_right; 939 else 940 return NULL; 941 } 942 943 node = kzalloc(sizeof(*node), GFP_KERNEL); 944 if (node == NULL) 945 return NULL; 946 binder_stats_created(BINDER_STAT_NODE); 947 rb_link_node(&node->rb_node, parent, p); 948 rb_insert_color(&node->rb_node, &proc->nodes); 949 node->debug_id = ++binder_last_id; 950 node->proc = proc; 951 node->ptr = ptr; 952 node->cookie = cookie; 953 node->work.type = BINDER_WORK_NODE; 954 INIT_LIST_HEAD(&node->work.entry); 955 INIT_LIST_HEAD(&node->async_todo); 956 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 957 "%d:%d node %d u%016llx c%016llx created\n", 958 proc->pid, current->pid, node->debug_id, 959 (u64)node->ptr, (u64)node->cookie); 960 return node; 961 } 962 963 static int binder_inc_node(struct binder_node *node, int strong, int internal, 964 struct list_head *target_list) 965 { 966 if (strong) { 967 if (internal) { 968 if (target_list == NULL && 969 node->internal_strong_refs == 0 && 970 !(node->proc && 971 node == node->proc->context->binder_context_mgr_node && 972 node->has_strong_ref)) { 973 pr_err("invalid inc strong node for %d\n", 974 node->debug_id); 975 return -EINVAL; 976 } 977 node->internal_strong_refs++; 978 } else 979 node->local_strong_refs++; 980 if (!node->has_strong_ref && target_list) { 981 list_del_init(&node->work.entry); 982 list_add_tail(&node->work.entry, target_list); 983 } 984 } else { 985 if (!internal) 986 node->local_weak_refs++; 987 if (!node->has_weak_ref && list_empty(&node->work.entry)) { 988 if (target_list == NULL) { 989 pr_err("invalid inc weak node for %d\n", 990 node->debug_id); 991 return -EINVAL; 992 } 993 list_add_tail(&node->work.entry, target_list); 994 } 995 } 996 return 0; 997 } 998 999 static int binder_dec_node(struct binder_node *node, int strong, int internal) 1000 { 1001 if (strong) { 1002 if (internal) 1003 node->internal_strong_refs--; 1004 else 1005 node->local_strong_refs--; 1006 if (node->local_strong_refs || node->internal_strong_refs) 1007 return 0; 1008 } else { 1009 if (!internal) 1010 node->local_weak_refs--; 1011 if (node->local_weak_refs || !hlist_empty(&node->refs)) 1012 return 0; 1013 } 1014 if (node->proc && (node->has_strong_ref || node->has_weak_ref)) { 1015 if (list_empty(&node->work.entry)) { 1016 list_add_tail(&node->work.entry, &node->proc->todo); 1017 wake_up_interruptible(&node->proc->wait); 1018 } 1019 } else { 1020 if (hlist_empty(&node->refs) && !node->local_strong_refs && 1021 !node->local_weak_refs) { 1022 list_del_init(&node->work.entry); 1023 if (node->proc) { 1024 rb_erase(&node->rb_node, &node->proc->nodes); 1025 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1026 "refless node %d deleted\n", 1027 node->debug_id); 1028 } else { 1029 hlist_del(&node->dead_node); 1030 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1031 "dead node %d deleted\n", 1032 node->debug_id); 1033 } 1034 kfree(node); 1035 binder_stats_deleted(BINDER_STAT_NODE); 1036 } 1037 } 1038 1039 return 0; 1040 } 1041 1042 1043 static struct binder_ref *binder_get_ref(struct binder_proc *proc, 1044 u32 desc, bool need_strong_ref) 1045 { 1046 struct rb_node *n = proc->refs_by_desc.rb_node; 1047 struct binder_ref *ref; 1048 1049 while (n) { 1050 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1051 1052 if (desc < ref->desc) { 1053 n = n->rb_left; 1054 } else if (desc > ref->desc) { 1055 n = n->rb_right; 1056 } else if (need_strong_ref && !ref->strong) { 1057 binder_user_error("tried to use weak ref as strong ref\n"); 1058 return NULL; 1059 } else { 1060 return ref; 1061 } 1062 } 1063 return NULL; 1064 } 1065 1066 static struct binder_ref *binder_get_ref_for_node(struct binder_proc *proc, 1067 struct binder_node *node) 1068 { 1069 struct rb_node *n; 1070 struct rb_node **p = &proc->refs_by_node.rb_node; 1071 struct rb_node *parent = NULL; 1072 struct binder_ref *ref, *new_ref; 1073 struct binder_context *context = proc->context; 1074 1075 while (*p) { 1076 parent = *p; 1077 ref = rb_entry(parent, struct binder_ref, rb_node_node); 1078 1079 if (node < ref->node) 1080 p = &(*p)->rb_left; 1081 else if (node > ref->node) 1082 p = &(*p)->rb_right; 1083 else 1084 return ref; 1085 } 1086 new_ref = kzalloc(sizeof(*ref), GFP_KERNEL); 1087 if (new_ref == NULL) 1088 return NULL; 1089 binder_stats_created(BINDER_STAT_REF); 1090 new_ref->debug_id = ++binder_last_id; 1091 new_ref->proc = proc; 1092 new_ref->node = node; 1093 rb_link_node(&new_ref->rb_node_node, parent, p); 1094 rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node); 1095 1096 new_ref->desc = (node == context->binder_context_mgr_node) ? 0 : 1; 1097 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 1098 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1099 if (ref->desc > new_ref->desc) 1100 break; 1101 new_ref->desc = ref->desc + 1; 1102 } 1103 1104 p = &proc->refs_by_desc.rb_node; 1105 while (*p) { 1106 parent = *p; 1107 ref = rb_entry(parent, struct binder_ref, rb_node_desc); 1108 1109 if (new_ref->desc < ref->desc) 1110 p = &(*p)->rb_left; 1111 else if (new_ref->desc > ref->desc) 1112 p = &(*p)->rb_right; 1113 else 1114 BUG(); 1115 } 1116 rb_link_node(&new_ref->rb_node_desc, parent, p); 1117 rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc); 1118 if (node) { 1119 hlist_add_head(&new_ref->node_entry, &node->refs); 1120 1121 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1122 "%d new ref %d desc %d for node %d\n", 1123 proc->pid, new_ref->debug_id, new_ref->desc, 1124 node->debug_id); 1125 } else { 1126 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1127 "%d new ref %d desc %d for dead node\n", 1128 proc->pid, new_ref->debug_id, new_ref->desc); 1129 } 1130 return new_ref; 1131 } 1132 1133 static void binder_delete_ref(struct binder_ref *ref) 1134 { 1135 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1136 "%d delete ref %d desc %d for node %d\n", 1137 ref->proc->pid, ref->debug_id, ref->desc, 1138 ref->node->debug_id); 1139 1140 rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc); 1141 rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node); 1142 if (ref->strong) 1143 binder_dec_node(ref->node, 1, 1); 1144 hlist_del(&ref->node_entry); 1145 binder_dec_node(ref->node, 0, 1); 1146 if (ref->death) { 1147 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1148 "%d delete ref %d desc %d has death notification\n", 1149 ref->proc->pid, ref->debug_id, ref->desc); 1150 list_del(&ref->death->work.entry); 1151 kfree(ref->death); 1152 binder_stats_deleted(BINDER_STAT_DEATH); 1153 } 1154 kfree(ref); 1155 binder_stats_deleted(BINDER_STAT_REF); 1156 } 1157 1158 static int binder_inc_ref(struct binder_ref *ref, int strong, 1159 struct list_head *target_list) 1160 { 1161 int ret; 1162 1163 if (strong) { 1164 if (ref->strong == 0) { 1165 ret = binder_inc_node(ref->node, 1, 1, target_list); 1166 if (ret) 1167 return ret; 1168 } 1169 ref->strong++; 1170 } else { 1171 if (ref->weak == 0) { 1172 ret = binder_inc_node(ref->node, 0, 1, target_list); 1173 if (ret) 1174 return ret; 1175 } 1176 ref->weak++; 1177 } 1178 return 0; 1179 } 1180 1181 1182 static int binder_dec_ref(struct binder_ref *ref, int strong) 1183 { 1184 if (strong) { 1185 if (ref->strong == 0) { 1186 binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n", 1187 ref->proc->pid, ref->debug_id, 1188 ref->desc, ref->strong, ref->weak); 1189 return -EINVAL; 1190 } 1191 ref->strong--; 1192 if (ref->strong == 0) { 1193 int ret; 1194 1195 ret = binder_dec_node(ref->node, strong, 1); 1196 if (ret) 1197 return ret; 1198 } 1199 } else { 1200 if (ref->weak == 0) { 1201 binder_user_error("%d invalid dec weak, ref %d desc %d s %d w %d\n", 1202 ref->proc->pid, ref->debug_id, 1203 ref->desc, ref->strong, ref->weak); 1204 return -EINVAL; 1205 } 1206 ref->weak--; 1207 } 1208 if (ref->strong == 0 && ref->weak == 0) 1209 binder_delete_ref(ref); 1210 return 0; 1211 } 1212 1213 static void binder_pop_transaction(struct binder_thread *target_thread, 1214 struct binder_transaction *t) 1215 { 1216 if (target_thread) { 1217 BUG_ON(target_thread->transaction_stack != t); 1218 BUG_ON(target_thread->transaction_stack->from != target_thread); 1219 target_thread->transaction_stack = 1220 target_thread->transaction_stack->from_parent; 1221 t->from = NULL; 1222 } 1223 t->need_reply = 0; 1224 if (t->buffer) 1225 t->buffer->transaction = NULL; 1226 kfree(t); 1227 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1228 } 1229 1230 static void binder_send_failed_reply(struct binder_transaction *t, 1231 uint32_t error_code) 1232 { 1233 struct binder_thread *target_thread; 1234 struct binder_transaction *next; 1235 1236 BUG_ON(t->flags & TF_ONE_WAY); 1237 while (1) { 1238 target_thread = t->from; 1239 if (target_thread) { 1240 if (target_thread->return_error != BR_OK && 1241 target_thread->return_error2 == BR_OK) { 1242 target_thread->return_error2 = 1243 target_thread->return_error; 1244 target_thread->return_error = BR_OK; 1245 } 1246 if (target_thread->return_error == BR_OK) { 1247 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1248 "send failed reply for transaction %d to %d:%d\n", 1249 t->debug_id, 1250 target_thread->proc->pid, 1251 target_thread->pid); 1252 1253 binder_pop_transaction(target_thread, t); 1254 target_thread->return_error = error_code; 1255 wake_up_interruptible(&target_thread->wait); 1256 } else { 1257 pr_err("reply failed, target thread, %d:%d, has error code %d already\n", 1258 target_thread->proc->pid, 1259 target_thread->pid, 1260 target_thread->return_error); 1261 } 1262 return; 1263 } 1264 next = t->from_parent; 1265 1266 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1267 "send failed reply for transaction %d, target dead\n", 1268 t->debug_id); 1269 1270 binder_pop_transaction(target_thread, t); 1271 if (next == NULL) { 1272 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1273 "reply failed, no target thread at root\n"); 1274 return; 1275 } 1276 t = next; 1277 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1278 "reply failed, no target thread -- retry %d\n", 1279 t->debug_id); 1280 } 1281 } 1282 1283 /** 1284 * binder_validate_object() - checks for a valid metadata object in a buffer. 1285 * @buffer: binder_buffer that we're parsing. 1286 * @offset: offset in the buffer at which to validate an object. 1287 * 1288 * Return: If there's a valid metadata object at @offset in @buffer, the 1289 * size of that object. Otherwise, it returns zero. 1290 */ 1291 static size_t binder_validate_object(struct binder_buffer *buffer, u64 offset) 1292 { 1293 /* Check if we can read a header first */ 1294 struct binder_object_header *hdr; 1295 size_t object_size = 0; 1296 1297 if (offset > buffer->data_size - sizeof(*hdr) || 1298 buffer->data_size < sizeof(*hdr) || 1299 !IS_ALIGNED(offset, sizeof(u32))) 1300 return 0; 1301 1302 /* Ok, now see if we can read a complete object. */ 1303 hdr = (struct binder_object_header *)(buffer->data + offset); 1304 switch (hdr->type) { 1305 case BINDER_TYPE_BINDER: 1306 case BINDER_TYPE_WEAK_BINDER: 1307 case BINDER_TYPE_HANDLE: 1308 case BINDER_TYPE_WEAK_HANDLE: 1309 object_size = sizeof(struct flat_binder_object); 1310 break; 1311 case BINDER_TYPE_FD: 1312 object_size = sizeof(struct binder_fd_object); 1313 break; 1314 case BINDER_TYPE_PTR: 1315 object_size = sizeof(struct binder_buffer_object); 1316 break; 1317 case BINDER_TYPE_FDA: 1318 object_size = sizeof(struct binder_fd_array_object); 1319 break; 1320 default: 1321 return 0; 1322 } 1323 if (offset <= buffer->data_size - object_size && 1324 buffer->data_size >= object_size) 1325 return object_size; 1326 else 1327 return 0; 1328 } 1329 1330 /** 1331 * binder_validate_ptr() - validates binder_buffer_object in a binder_buffer. 1332 * @b: binder_buffer containing the object 1333 * @index: index in offset array at which the binder_buffer_object is 1334 * located 1335 * @start: points to the start of the offset array 1336 * @num_valid: the number of valid offsets in the offset array 1337 * 1338 * Return: If @index is within the valid range of the offset array 1339 * described by @start and @num_valid, and if there's a valid 1340 * binder_buffer_object at the offset found in index @index 1341 * of the offset array, that object is returned. Otherwise, 1342 * %NULL is returned. 1343 * Note that the offset found in index @index itself is not 1344 * verified; this function assumes that @num_valid elements 1345 * from @start were previously verified to have valid offsets. 1346 */ 1347 static struct binder_buffer_object *binder_validate_ptr(struct binder_buffer *b, 1348 binder_size_t index, 1349 binder_size_t *start, 1350 binder_size_t num_valid) 1351 { 1352 struct binder_buffer_object *buffer_obj; 1353 binder_size_t *offp; 1354 1355 if (index >= num_valid) 1356 return NULL; 1357 1358 offp = start + index; 1359 buffer_obj = (struct binder_buffer_object *)(b->data + *offp); 1360 if (buffer_obj->hdr.type != BINDER_TYPE_PTR) 1361 return NULL; 1362 1363 return buffer_obj; 1364 } 1365 1366 /** 1367 * binder_validate_fixup() - validates pointer/fd fixups happen in order. 1368 * @b: transaction buffer 1369 * @objects_start start of objects buffer 1370 * @buffer: binder_buffer_object in which to fix up 1371 * @offset: start offset in @buffer to fix up 1372 * @last_obj: last binder_buffer_object that we fixed up in 1373 * @last_min_offset: minimum fixup offset in @last_obj 1374 * 1375 * Return: %true if a fixup in buffer @buffer at offset @offset is 1376 * allowed. 1377 * 1378 * For safety reasons, we only allow fixups inside a buffer to happen 1379 * at increasing offsets; additionally, we only allow fixup on the last 1380 * buffer object that was verified, or one of its parents. 1381 * 1382 * Example of what is allowed: 1383 * 1384 * A 1385 * B (parent = A, offset = 0) 1386 * C (parent = A, offset = 16) 1387 * D (parent = C, offset = 0) 1388 * E (parent = A, offset = 32) // min_offset is 16 (C.parent_offset) 1389 * 1390 * Examples of what is not allowed: 1391 * 1392 * Decreasing offsets within the same parent: 1393 * A 1394 * C (parent = A, offset = 16) 1395 * B (parent = A, offset = 0) // decreasing offset within A 1396 * 1397 * Referring to a parent that wasn't the last object or any of its parents: 1398 * A 1399 * B (parent = A, offset = 0) 1400 * C (parent = A, offset = 0) 1401 * C (parent = A, offset = 16) 1402 * D (parent = B, offset = 0) // B is not A or any of A's parents 1403 */ 1404 static bool binder_validate_fixup(struct binder_buffer *b, 1405 binder_size_t *objects_start, 1406 struct binder_buffer_object *buffer, 1407 binder_size_t fixup_offset, 1408 struct binder_buffer_object *last_obj, 1409 binder_size_t last_min_offset) 1410 { 1411 if (!last_obj) { 1412 /* Nothing to fix up in */ 1413 return false; 1414 } 1415 1416 while (last_obj != buffer) { 1417 /* 1418 * Safe to retrieve the parent of last_obj, since it 1419 * was already previously verified by the driver. 1420 */ 1421 if ((last_obj->flags & BINDER_BUFFER_FLAG_HAS_PARENT) == 0) 1422 return false; 1423 last_min_offset = last_obj->parent_offset + sizeof(uintptr_t); 1424 last_obj = (struct binder_buffer_object *) 1425 (b->data + *(objects_start + last_obj->parent)); 1426 } 1427 return (fixup_offset >= last_min_offset); 1428 } 1429 1430 static void binder_transaction_buffer_release(struct binder_proc *proc, 1431 struct binder_buffer *buffer, 1432 binder_size_t *failed_at) 1433 { 1434 binder_size_t *offp, *off_start, *off_end; 1435 int debug_id = buffer->debug_id; 1436 1437 binder_debug(BINDER_DEBUG_TRANSACTION, 1438 "%d buffer release %d, size %zd-%zd, failed at %p\n", 1439 proc->pid, buffer->debug_id, 1440 buffer->data_size, buffer->offsets_size, failed_at); 1441 1442 if (buffer->target_node) 1443 binder_dec_node(buffer->target_node, 1, 0); 1444 1445 off_start = (binder_size_t *)(buffer->data + 1446 ALIGN(buffer->data_size, sizeof(void *))); 1447 if (failed_at) 1448 off_end = failed_at; 1449 else 1450 off_end = (void *)off_start + buffer->offsets_size; 1451 for (offp = off_start; offp < off_end; offp++) { 1452 struct binder_object_header *hdr; 1453 size_t object_size = binder_validate_object(buffer, *offp); 1454 1455 if (object_size == 0) { 1456 pr_err("transaction release %d bad object at offset %lld, size %zd\n", 1457 debug_id, (u64)*offp, buffer->data_size); 1458 continue; 1459 } 1460 hdr = (struct binder_object_header *)(buffer->data + *offp); 1461 switch (hdr->type) { 1462 case BINDER_TYPE_BINDER: 1463 case BINDER_TYPE_WEAK_BINDER: { 1464 struct flat_binder_object *fp; 1465 struct binder_node *node; 1466 1467 fp = to_flat_binder_object(hdr); 1468 node = binder_get_node(proc, fp->binder); 1469 if (node == NULL) { 1470 pr_err("transaction release %d bad node %016llx\n", 1471 debug_id, (u64)fp->binder); 1472 break; 1473 } 1474 binder_debug(BINDER_DEBUG_TRANSACTION, 1475 " node %d u%016llx\n", 1476 node->debug_id, (u64)node->ptr); 1477 binder_dec_node(node, hdr->type == BINDER_TYPE_BINDER, 1478 0); 1479 } break; 1480 case BINDER_TYPE_HANDLE: 1481 case BINDER_TYPE_WEAK_HANDLE: { 1482 struct flat_binder_object *fp; 1483 struct binder_ref *ref; 1484 1485 fp = to_flat_binder_object(hdr); 1486 ref = binder_get_ref(proc, fp->handle, 1487 hdr->type == BINDER_TYPE_HANDLE); 1488 if (ref == NULL) { 1489 pr_err("transaction release %d bad handle %d\n", 1490 debug_id, fp->handle); 1491 break; 1492 } 1493 binder_debug(BINDER_DEBUG_TRANSACTION, 1494 " ref %d desc %d (node %d)\n", 1495 ref->debug_id, ref->desc, ref->node->debug_id); 1496 binder_dec_ref(ref, hdr->type == BINDER_TYPE_HANDLE); 1497 } break; 1498 1499 case BINDER_TYPE_FD: { 1500 struct binder_fd_object *fp = to_binder_fd_object(hdr); 1501 1502 binder_debug(BINDER_DEBUG_TRANSACTION, 1503 " fd %d\n", fp->fd); 1504 if (failed_at) 1505 task_close_fd(proc, fp->fd); 1506 } break; 1507 case BINDER_TYPE_PTR: 1508 /* 1509 * Nothing to do here, this will get cleaned up when the 1510 * transaction buffer gets freed 1511 */ 1512 break; 1513 case BINDER_TYPE_FDA: { 1514 struct binder_fd_array_object *fda; 1515 struct binder_buffer_object *parent; 1516 uintptr_t parent_buffer; 1517 u32 *fd_array; 1518 size_t fd_index; 1519 binder_size_t fd_buf_size; 1520 1521 fda = to_binder_fd_array_object(hdr); 1522 parent = binder_validate_ptr(buffer, fda->parent, 1523 off_start, 1524 offp - off_start); 1525 if (!parent) { 1526 pr_err("transaction release %d bad parent offset", 1527 debug_id); 1528 continue; 1529 } 1530 /* 1531 * Since the parent was already fixed up, convert it 1532 * back to kernel address space to access it 1533 */ 1534 parent_buffer = parent->buffer - 1535 proc->user_buffer_offset; 1536 1537 fd_buf_size = sizeof(u32) * fda->num_fds; 1538 if (fda->num_fds >= SIZE_MAX / sizeof(u32)) { 1539 pr_err("transaction release %d invalid number of fds (%lld)\n", 1540 debug_id, (u64)fda->num_fds); 1541 continue; 1542 } 1543 if (fd_buf_size > parent->length || 1544 fda->parent_offset > parent->length - fd_buf_size) { 1545 /* No space for all file descriptors here. */ 1546 pr_err("transaction release %d not enough space for %lld fds in buffer\n", 1547 debug_id, (u64)fda->num_fds); 1548 continue; 1549 } 1550 fd_array = (u32 *)(parent_buffer + fda->parent_offset); 1551 for (fd_index = 0; fd_index < fda->num_fds; fd_index++) 1552 task_close_fd(proc, fd_array[fd_index]); 1553 } break; 1554 default: 1555 pr_err("transaction release %d bad object type %x\n", 1556 debug_id, hdr->type); 1557 break; 1558 } 1559 } 1560 } 1561 1562 static int binder_translate_binder(struct flat_binder_object *fp, 1563 struct binder_transaction *t, 1564 struct binder_thread *thread) 1565 { 1566 struct binder_node *node; 1567 struct binder_ref *ref; 1568 struct binder_proc *proc = thread->proc; 1569 struct binder_proc *target_proc = t->to_proc; 1570 1571 node = binder_get_node(proc, fp->binder); 1572 if (!node) { 1573 node = binder_new_node(proc, fp->binder, fp->cookie); 1574 if (!node) 1575 return -ENOMEM; 1576 1577 node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK; 1578 node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS); 1579 } 1580 if (fp->cookie != node->cookie) { 1581 binder_user_error("%d:%d sending u%016llx node %d, cookie mismatch %016llx != %016llx\n", 1582 proc->pid, thread->pid, (u64)fp->binder, 1583 node->debug_id, (u64)fp->cookie, 1584 (u64)node->cookie); 1585 return -EINVAL; 1586 } 1587 if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) 1588 return -EPERM; 1589 1590 ref = binder_get_ref_for_node(target_proc, node); 1591 if (!ref) 1592 return -EINVAL; 1593 1594 if (fp->hdr.type == BINDER_TYPE_BINDER) 1595 fp->hdr.type = BINDER_TYPE_HANDLE; 1596 else 1597 fp->hdr.type = BINDER_TYPE_WEAK_HANDLE; 1598 fp->binder = 0; 1599 fp->handle = ref->desc; 1600 fp->cookie = 0; 1601 binder_inc_ref(ref, fp->hdr.type == BINDER_TYPE_HANDLE, &thread->todo); 1602 1603 trace_binder_transaction_node_to_ref(t, node, ref); 1604 binder_debug(BINDER_DEBUG_TRANSACTION, 1605 " node %d u%016llx -> ref %d desc %d\n", 1606 node->debug_id, (u64)node->ptr, 1607 ref->debug_id, ref->desc); 1608 1609 return 0; 1610 } 1611 1612 static int binder_translate_handle(struct flat_binder_object *fp, 1613 struct binder_transaction *t, 1614 struct binder_thread *thread) 1615 { 1616 struct binder_ref *ref; 1617 struct binder_proc *proc = thread->proc; 1618 struct binder_proc *target_proc = t->to_proc; 1619 1620 ref = binder_get_ref(proc, fp->handle, 1621 fp->hdr.type == BINDER_TYPE_HANDLE); 1622 if (!ref) { 1623 binder_user_error("%d:%d got transaction with invalid handle, %d\n", 1624 proc->pid, thread->pid, fp->handle); 1625 return -EINVAL; 1626 } 1627 if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) 1628 return -EPERM; 1629 1630 if (ref->node->proc == target_proc) { 1631 if (fp->hdr.type == BINDER_TYPE_HANDLE) 1632 fp->hdr.type = BINDER_TYPE_BINDER; 1633 else 1634 fp->hdr.type = BINDER_TYPE_WEAK_BINDER; 1635 fp->binder = ref->node->ptr; 1636 fp->cookie = ref->node->cookie; 1637 binder_inc_node(ref->node, fp->hdr.type == BINDER_TYPE_BINDER, 1638 0, NULL); 1639 trace_binder_transaction_ref_to_node(t, ref); 1640 binder_debug(BINDER_DEBUG_TRANSACTION, 1641 " ref %d desc %d -> node %d u%016llx\n", 1642 ref->debug_id, ref->desc, ref->node->debug_id, 1643 (u64)ref->node->ptr); 1644 } else { 1645 struct binder_ref *new_ref; 1646 1647 new_ref = binder_get_ref_for_node(target_proc, ref->node); 1648 if (!new_ref) 1649 return -EINVAL; 1650 1651 fp->binder = 0; 1652 fp->handle = new_ref->desc; 1653 fp->cookie = 0; 1654 binder_inc_ref(new_ref, fp->hdr.type == BINDER_TYPE_HANDLE, 1655 NULL); 1656 trace_binder_transaction_ref_to_ref(t, ref, new_ref); 1657 binder_debug(BINDER_DEBUG_TRANSACTION, 1658 " ref %d desc %d -> ref %d desc %d (node %d)\n", 1659 ref->debug_id, ref->desc, new_ref->debug_id, 1660 new_ref->desc, ref->node->debug_id); 1661 } 1662 return 0; 1663 } 1664 1665 static int binder_translate_fd(int fd, 1666 struct binder_transaction *t, 1667 struct binder_thread *thread, 1668 struct binder_transaction *in_reply_to) 1669 { 1670 struct binder_proc *proc = thread->proc; 1671 struct binder_proc *target_proc = t->to_proc; 1672 int target_fd; 1673 struct file *file; 1674 int ret; 1675 bool target_allows_fd; 1676 1677 if (in_reply_to) 1678 target_allows_fd = !!(in_reply_to->flags & TF_ACCEPT_FDS); 1679 else 1680 target_allows_fd = t->buffer->target_node->accept_fds; 1681 if (!target_allows_fd) { 1682 binder_user_error("%d:%d got %s with fd, %d, but target does not allow fds\n", 1683 proc->pid, thread->pid, 1684 in_reply_to ? "reply" : "transaction", 1685 fd); 1686 ret = -EPERM; 1687 goto err_fd_not_accepted; 1688 } 1689 1690 file = fget(fd); 1691 if (!file) { 1692 binder_user_error("%d:%d got transaction with invalid fd, %d\n", 1693 proc->pid, thread->pid, fd); 1694 ret = -EBADF; 1695 goto err_fget; 1696 } 1697 ret = security_binder_transfer_file(proc->tsk, target_proc->tsk, file); 1698 if (ret < 0) { 1699 ret = -EPERM; 1700 goto err_security; 1701 } 1702 1703 target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC); 1704 if (target_fd < 0) { 1705 ret = -ENOMEM; 1706 goto err_get_unused_fd; 1707 } 1708 task_fd_install(target_proc, target_fd, file); 1709 trace_binder_transaction_fd(t, fd, target_fd); 1710 binder_debug(BINDER_DEBUG_TRANSACTION, " fd %d -> %d\n", 1711 fd, target_fd); 1712 1713 return target_fd; 1714 1715 err_get_unused_fd: 1716 err_security: 1717 fput(file); 1718 err_fget: 1719 err_fd_not_accepted: 1720 return ret; 1721 } 1722 1723 static int binder_translate_fd_array(struct binder_fd_array_object *fda, 1724 struct binder_buffer_object *parent, 1725 struct binder_transaction *t, 1726 struct binder_thread *thread, 1727 struct binder_transaction *in_reply_to) 1728 { 1729 binder_size_t fdi, fd_buf_size, num_installed_fds; 1730 int target_fd; 1731 uintptr_t parent_buffer; 1732 u32 *fd_array; 1733 struct binder_proc *proc = thread->proc; 1734 struct binder_proc *target_proc = t->to_proc; 1735 1736 fd_buf_size = sizeof(u32) * fda->num_fds; 1737 if (fda->num_fds >= SIZE_MAX / sizeof(u32)) { 1738 binder_user_error("%d:%d got transaction with invalid number of fds (%lld)\n", 1739 proc->pid, thread->pid, (u64)fda->num_fds); 1740 return -EINVAL; 1741 } 1742 if (fd_buf_size > parent->length || 1743 fda->parent_offset > parent->length - fd_buf_size) { 1744 /* No space for all file descriptors here. */ 1745 binder_user_error("%d:%d not enough space to store %lld fds in buffer\n", 1746 proc->pid, thread->pid, (u64)fda->num_fds); 1747 return -EINVAL; 1748 } 1749 /* 1750 * Since the parent was already fixed up, convert it 1751 * back to the kernel address space to access it 1752 */ 1753 parent_buffer = parent->buffer - target_proc->user_buffer_offset; 1754 fd_array = (u32 *)(parent_buffer + fda->parent_offset); 1755 if (!IS_ALIGNED((unsigned long)fd_array, sizeof(u32))) { 1756 binder_user_error("%d:%d parent offset not aligned correctly.\n", 1757 proc->pid, thread->pid); 1758 return -EINVAL; 1759 } 1760 for (fdi = 0; fdi < fda->num_fds; fdi++) { 1761 target_fd = binder_translate_fd(fd_array[fdi], t, thread, 1762 in_reply_to); 1763 if (target_fd < 0) 1764 goto err_translate_fd_failed; 1765 fd_array[fdi] = target_fd; 1766 } 1767 return 0; 1768 1769 err_translate_fd_failed: 1770 /* 1771 * Failed to allocate fd or security error, free fds 1772 * installed so far. 1773 */ 1774 num_installed_fds = fdi; 1775 for (fdi = 0; fdi < num_installed_fds; fdi++) 1776 task_close_fd(target_proc, fd_array[fdi]); 1777 return target_fd; 1778 } 1779 1780 static int binder_fixup_parent(struct binder_transaction *t, 1781 struct binder_thread *thread, 1782 struct binder_buffer_object *bp, 1783 binder_size_t *off_start, 1784 binder_size_t num_valid, 1785 struct binder_buffer_object *last_fixup_obj, 1786 binder_size_t last_fixup_min_off) 1787 { 1788 struct binder_buffer_object *parent; 1789 u8 *parent_buffer; 1790 struct binder_buffer *b = t->buffer; 1791 struct binder_proc *proc = thread->proc; 1792 struct binder_proc *target_proc = t->to_proc; 1793 1794 if (!(bp->flags & BINDER_BUFFER_FLAG_HAS_PARENT)) 1795 return 0; 1796 1797 parent = binder_validate_ptr(b, bp->parent, off_start, num_valid); 1798 if (!parent) { 1799 binder_user_error("%d:%d got transaction with invalid parent offset or type\n", 1800 proc->pid, thread->pid); 1801 return -EINVAL; 1802 } 1803 1804 if (!binder_validate_fixup(b, off_start, 1805 parent, bp->parent_offset, 1806 last_fixup_obj, 1807 last_fixup_min_off)) { 1808 binder_user_error("%d:%d got transaction with out-of-order buffer fixup\n", 1809 proc->pid, thread->pid); 1810 return -EINVAL; 1811 } 1812 1813 if (parent->length < sizeof(binder_uintptr_t) || 1814 bp->parent_offset > parent->length - sizeof(binder_uintptr_t)) { 1815 /* No space for a pointer here! */ 1816 binder_user_error("%d:%d got transaction with invalid parent offset\n", 1817 proc->pid, thread->pid); 1818 return -EINVAL; 1819 } 1820 parent_buffer = (u8 *)(parent->buffer - 1821 target_proc->user_buffer_offset); 1822 *(binder_uintptr_t *)(parent_buffer + bp->parent_offset) = bp->buffer; 1823 1824 return 0; 1825 } 1826 1827 static void binder_transaction(struct binder_proc *proc, 1828 struct binder_thread *thread, 1829 struct binder_transaction_data *tr, int reply, 1830 binder_size_t extra_buffers_size) 1831 { 1832 int ret; 1833 struct binder_transaction *t; 1834 struct binder_work *tcomplete; 1835 binder_size_t *offp, *off_end, *off_start; 1836 binder_size_t off_min; 1837 u8 *sg_bufp, *sg_buf_end; 1838 struct binder_proc *target_proc; 1839 struct binder_thread *target_thread = NULL; 1840 struct binder_node *target_node = NULL; 1841 struct list_head *target_list; 1842 wait_queue_head_t *target_wait; 1843 struct binder_transaction *in_reply_to = NULL; 1844 struct binder_transaction_log_entry *e; 1845 uint32_t return_error; 1846 struct binder_buffer_object *last_fixup_obj = NULL; 1847 binder_size_t last_fixup_min_off = 0; 1848 struct binder_context *context = proc->context; 1849 1850 e = binder_transaction_log_add(&binder_transaction_log); 1851 e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY); 1852 e->from_proc = proc->pid; 1853 e->from_thread = thread->pid; 1854 e->target_handle = tr->target.handle; 1855 e->data_size = tr->data_size; 1856 e->offsets_size = tr->offsets_size; 1857 e->context_name = proc->context->name; 1858 1859 if (reply) { 1860 in_reply_to = thread->transaction_stack; 1861 if (in_reply_to == NULL) { 1862 binder_user_error("%d:%d got reply transaction with no transaction stack\n", 1863 proc->pid, thread->pid); 1864 return_error = BR_FAILED_REPLY; 1865 goto err_empty_call_stack; 1866 } 1867 binder_set_nice(in_reply_to->saved_priority); 1868 if (in_reply_to->to_thread != thread) { 1869 binder_user_error("%d:%d got reply transaction with bad transaction stack, transaction %d has target %d:%d\n", 1870 proc->pid, thread->pid, in_reply_to->debug_id, 1871 in_reply_to->to_proc ? 1872 in_reply_to->to_proc->pid : 0, 1873 in_reply_to->to_thread ? 1874 in_reply_to->to_thread->pid : 0); 1875 return_error = BR_FAILED_REPLY; 1876 in_reply_to = NULL; 1877 goto err_bad_call_stack; 1878 } 1879 thread->transaction_stack = in_reply_to->to_parent; 1880 target_thread = in_reply_to->from; 1881 if (target_thread == NULL) { 1882 return_error = BR_DEAD_REPLY; 1883 goto err_dead_binder; 1884 } 1885 if (target_thread->transaction_stack != in_reply_to) { 1886 binder_user_error("%d:%d got reply transaction with bad target transaction stack %d, expected %d\n", 1887 proc->pid, thread->pid, 1888 target_thread->transaction_stack ? 1889 target_thread->transaction_stack->debug_id : 0, 1890 in_reply_to->debug_id); 1891 return_error = BR_FAILED_REPLY; 1892 in_reply_to = NULL; 1893 target_thread = NULL; 1894 goto err_dead_binder; 1895 } 1896 target_proc = target_thread->proc; 1897 } else { 1898 if (tr->target.handle) { 1899 struct binder_ref *ref; 1900 1901 ref = binder_get_ref(proc, tr->target.handle, true); 1902 if (ref == NULL) { 1903 binder_user_error("%d:%d got transaction to invalid handle\n", 1904 proc->pid, thread->pid); 1905 return_error = BR_FAILED_REPLY; 1906 goto err_invalid_target_handle; 1907 } 1908 target_node = ref->node; 1909 } else { 1910 target_node = context->binder_context_mgr_node; 1911 if (target_node == NULL) { 1912 return_error = BR_DEAD_REPLY; 1913 goto err_no_context_mgr_node; 1914 } 1915 } 1916 e->to_node = target_node->debug_id; 1917 target_proc = target_node->proc; 1918 if (target_proc == NULL) { 1919 return_error = BR_DEAD_REPLY; 1920 goto err_dead_binder; 1921 } 1922 if (security_binder_transaction(proc->tsk, 1923 target_proc->tsk) < 0) { 1924 return_error = BR_FAILED_REPLY; 1925 goto err_invalid_target_handle; 1926 } 1927 if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) { 1928 struct binder_transaction *tmp; 1929 1930 tmp = thread->transaction_stack; 1931 if (tmp->to_thread != thread) { 1932 binder_user_error("%d:%d got new transaction with bad transaction stack, transaction %d has target %d:%d\n", 1933 proc->pid, thread->pid, tmp->debug_id, 1934 tmp->to_proc ? tmp->to_proc->pid : 0, 1935 tmp->to_thread ? 1936 tmp->to_thread->pid : 0); 1937 return_error = BR_FAILED_REPLY; 1938 goto err_bad_call_stack; 1939 } 1940 while (tmp) { 1941 if (tmp->from && tmp->from->proc == target_proc) 1942 target_thread = tmp->from; 1943 tmp = tmp->from_parent; 1944 } 1945 } 1946 } 1947 if (target_thread) { 1948 e->to_thread = target_thread->pid; 1949 target_list = &target_thread->todo; 1950 target_wait = &target_thread->wait; 1951 } else { 1952 target_list = &target_proc->todo; 1953 target_wait = &target_proc->wait; 1954 } 1955 e->to_proc = target_proc->pid; 1956 1957 /* TODO: reuse incoming transaction for reply */ 1958 t = kzalloc(sizeof(*t), GFP_KERNEL); 1959 if (t == NULL) { 1960 return_error = BR_FAILED_REPLY; 1961 goto err_alloc_t_failed; 1962 } 1963 binder_stats_created(BINDER_STAT_TRANSACTION); 1964 1965 tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL); 1966 if (tcomplete == NULL) { 1967 return_error = BR_FAILED_REPLY; 1968 goto err_alloc_tcomplete_failed; 1969 } 1970 binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE); 1971 1972 t->debug_id = ++binder_last_id; 1973 e->debug_id = t->debug_id; 1974 1975 if (reply) 1976 binder_debug(BINDER_DEBUG_TRANSACTION, 1977 "%d:%d BC_REPLY %d -> %d:%d, data %016llx-%016llx size %lld-%lld-%lld\n", 1978 proc->pid, thread->pid, t->debug_id, 1979 target_proc->pid, target_thread->pid, 1980 (u64)tr->data.ptr.buffer, 1981 (u64)tr->data.ptr.offsets, 1982 (u64)tr->data_size, (u64)tr->offsets_size, 1983 (u64)extra_buffers_size); 1984 else 1985 binder_debug(BINDER_DEBUG_TRANSACTION, 1986 "%d:%d BC_TRANSACTION %d -> %d - node %d, data %016llx-%016llx size %lld-%lld-%lld\n", 1987 proc->pid, thread->pid, t->debug_id, 1988 target_proc->pid, target_node->debug_id, 1989 (u64)tr->data.ptr.buffer, 1990 (u64)tr->data.ptr.offsets, 1991 (u64)tr->data_size, (u64)tr->offsets_size, 1992 (u64)extra_buffers_size); 1993 1994 if (!reply && !(tr->flags & TF_ONE_WAY)) 1995 t->from = thread; 1996 else 1997 t->from = NULL; 1998 t->sender_euid = task_euid(proc->tsk); 1999 t->to_proc = target_proc; 2000 t->to_thread = target_thread; 2001 t->code = tr->code; 2002 t->flags = tr->flags; 2003 t->priority = task_nice(current); 2004 2005 trace_binder_transaction(reply, t, target_node); 2006 2007 t->buffer = binder_alloc_buf(target_proc, tr->data_size, 2008 tr->offsets_size, extra_buffers_size, 2009 !reply && (t->flags & TF_ONE_WAY)); 2010 if (t->buffer == NULL) { 2011 return_error = BR_FAILED_REPLY; 2012 goto err_binder_alloc_buf_failed; 2013 } 2014 t->buffer->allow_user_free = 0; 2015 t->buffer->debug_id = t->debug_id; 2016 t->buffer->transaction = t; 2017 t->buffer->target_node = target_node; 2018 trace_binder_transaction_alloc_buf(t->buffer); 2019 if (target_node) 2020 binder_inc_node(target_node, 1, 0, NULL); 2021 2022 off_start = (binder_size_t *)(t->buffer->data + 2023 ALIGN(tr->data_size, sizeof(void *))); 2024 offp = off_start; 2025 2026 if (copy_from_user(t->buffer->data, (const void __user *)(uintptr_t) 2027 tr->data.ptr.buffer, tr->data_size)) { 2028 binder_user_error("%d:%d got transaction with invalid data ptr\n", 2029 proc->pid, thread->pid); 2030 return_error = BR_FAILED_REPLY; 2031 goto err_copy_data_failed; 2032 } 2033 if (copy_from_user(offp, (const void __user *)(uintptr_t) 2034 tr->data.ptr.offsets, tr->offsets_size)) { 2035 binder_user_error("%d:%d got transaction with invalid offsets ptr\n", 2036 proc->pid, thread->pid); 2037 return_error = BR_FAILED_REPLY; 2038 goto err_copy_data_failed; 2039 } 2040 if (!IS_ALIGNED(tr->offsets_size, sizeof(binder_size_t))) { 2041 binder_user_error("%d:%d got transaction with invalid offsets size, %lld\n", 2042 proc->pid, thread->pid, (u64)tr->offsets_size); 2043 return_error = BR_FAILED_REPLY; 2044 goto err_bad_offset; 2045 } 2046 if (!IS_ALIGNED(extra_buffers_size, sizeof(u64))) { 2047 binder_user_error("%d:%d got transaction with unaligned buffers size, %lld\n", 2048 proc->pid, thread->pid, 2049 (u64)extra_buffers_size); 2050 return_error = BR_FAILED_REPLY; 2051 goto err_bad_offset; 2052 } 2053 off_end = (void *)off_start + tr->offsets_size; 2054 sg_bufp = (u8 *)(PTR_ALIGN(off_end, sizeof(void *))); 2055 sg_buf_end = sg_bufp + extra_buffers_size; 2056 off_min = 0; 2057 for (; offp < off_end; offp++) { 2058 struct binder_object_header *hdr; 2059 size_t object_size = binder_validate_object(t->buffer, *offp); 2060 2061 if (object_size == 0 || *offp < off_min) { 2062 binder_user_error("%d:%d got transaction with invalid offset (%lld, min %lld max %lld) or object.\n", 2063 proc->pid, thread->pid, (u64)*offp, 2064 (u64)off_min, 2065 (u64)t->buffer->data_size); 2066 return_error = BR_FAILED_REPLY; 2067 goto err_bad_offset; 2068 } 2069 2070 hdr = (struct binder_object_header *)(t->buffer->data + *offp); 2071 off_min = *offp + object_size; 2072 switch (hdr->type) { 2073 case BINDER_TYPE_BINDER: 2074 case BINDER_TYPE_WEAK_BINDER: { 2075 struct flat_binder_object *fp; 2076 2077 fp = to_flat_binder_object(hdr); 2078 ret = binder_translate_binder(fp, t, thread); 2079 if (ret < 0) { 2080 return_error = BR_FAILED_REPLY; 2081 goto err_translate_failed; 2082 } 2083 } break; 2084 case BINDER_TYPE_HANDLE: 2085 case BINDER_TYPE_WEAK_HANDLE: { 2086 struct flat_binder_object *fp; 2087 2088 fp = to_flat_binder_object(hdr); 2089 ret = binder_translate_handle(fp, t, thread); 2090 if (ret < 0) { 2091 return_error = BR_FAILED_REPLY; 2092 goto err_translate_failed; 2093 } 2094 } break; 2095 2096 case BINDER_TYPE_FD: { 2097 struct binder_fd_object *fp = to_binder_fd_object(hdr); 2098 int target_fd = binder_translate_fd(fp->fd, t, thread, 2099 in_reply_to); 2100 2101 if (target_fd < 0) { 2102 return_error = BR_FAILED_REPLY; 2103 goto err_translate_failed; 2104 } 2105 fp->pad_binder = 0; 2106 fp->fd = target_fd; 2107 } break; 2108 case BINDER_TYPE_FDA: { 2109 struct binder_fd_array_object *fda = 2110 to_binder_fd_array_object(hdr); 2111 struct binder_buffer_object *parent = 2112 binder_validate_ptr(t->buffer, fda->parent, 2113 off_start, 2114 offp - off_start); 2115 if (!parent) { 2116 binder_user_error("%d:%d got transaction with invalid parent offset or type\n", 2117 proc->pid, thread->pid); 2118 return_error = BR_FAILED_REPLY; 2119 goto err_bad_parent; 2120 } 2121 if (!binder_validate_fixup(t->buffer, off_start, 2122 parent, fda->parent_offset, 2123 last_fixup_obj, 2124 last_fixup_min_off)) { 2125 binder_user_error("%d:%d got transaction with out-of-order buffer fixup\n", 2126 proc->pid, thread->pid); 2127 return_error = BR_FAILED_REPLY; 2128 goto err_bad_parent; 2129 } 2130 ret = binder_translate_fd_array(fda, parent, t, thread, 2131 in_reply_to); 2132 if (ret < 0) { 2133 return_error = BR_FAILED_REPLY; 2134 goto err_translate_failed; 2135 } 2136 last_fixup_obj = parent; 2137 last_fixup_min_off = 2138 fda->parent_offset + sizeof(u32) * fda->num_fds; 2139 } break; 2140 case BINDER_TYPE_PTR: { 2141 struct binder_buffer_object *bp = 2142 to_binder_buffer_object(hdr); 2143 size_t buf_left = sg_buf_end - sg_bufp; 2144 2145 if (bp->length > buf_left) { 2146 binder_user_error("%d:%d got transaction with too large buffer\n", 2147 proc->pid, thread->pid); 2148 return_error = BR_FAILED_REPLY; 2149 goto err_bad_offset; 2150 } 2151 if (copy_from_user(sg_bufp, 2152 (const void __user *)(uintptr_t) 2153 bp->buffer, bp->length)) { 2154 binder_user_error("%d:%d got transaction with invalid offsets ptr\n", 2155 proc->pid, thread->pid); 2156 return_error = BR_FAILED_REPLY; 2157 goto err_copy_data_failed; 2158 } 2159 /* Fixup buffer pointer to target proc address space */ 2160 bp->buffer = (uintptr_t)sg_bufp + 2161 target_proc->user_buffer_offset; 2162 sg_bufp += ALIGN(bp->length, sizeof(u64)); 2163 2164 ret = binder_fixup_parent(t, thread, bp, off_start, 2165 offp - off_start, 2166 last_fixup_obj, 2167 last_fixup_min_off); 2168 if (ret < 0) { 2169 return_error = BR_FAILED_REPLY; 2170 goto err_translate_failed; 2171 } 2172 last_fixup_obj = bp; 2173 last_fixup_min_off = 0; 2174 } break; 2175 default: 2176 binder_user_error("%d:%d got transaction with invalid object type, %x\n", 2177 proc->pid, thread->pid, hdr->type); 2178 return_error = BR_FAILED_REPLY; 2179 goto err_bad_object_type; 2180 } 2181 } 2182 if (reply) { 2183 BUG_ON(t->buffer->async_transaction != 0); 2184 binder_pop_transaction(target_thread, in_reply_to); 2185 } else if (!(t->flags & TF_ONE_WAY)) { 2186 BUG_ON(t->buffer->async_transaction != 0); 2187 t->need_reply = 1; 2188 t->from_parent = thread->transaction_stack; 2189 thread->transaction_stack = t; 2190 } else { 2191 BUG_ON(target_node == NULL); 2192 BUG_ON(t->buffer->async_transaction != 1); 2193 if (target_node->has_async_transaction) { 2194 target_list = &target_node->async_todo; 2195 target_wait = NULL; 2196 } else 2197 target_node->has_async_transaction = 1; 2198 } 2199 t->work.type = BINDER_WORK_TRANSACTION; 2200 list_add_tail(&t->work.entry, target_list); 2201 tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE; 2202 list_add_tail(&tcomplete->entry, &thread->todo); 2203 if (target_wait) { 2204 if (reply || !(t->flags & TF_ONE_WAY)) 2205 wake_up_interruptible_sync(target_wait); 2206 else 2207 wake_up_interruptible(target_wait); 2208 } 2209 return; 2210 2211 err_translate_failed: 2212 err_bad_object_type: 2213 err_bad_offset: 2214 err_bad_parent: 2215 err_copy_data_failed: 2216 trace_binder_transaction_failed_buffer_release(t->buffer); 2217 binder_transaction_buffer_release(target_proc, t->buffer, offp); 2218 t->buffer->transaction = NULL; 2219 binder_free_buf(target_proc, t->buffer); 2220 err_binder_alloc_buf_failed: 2221 kfree(tcomplete); 2222 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2223 err_alloc_tcomplete_failed: 2224 kfree(t); 2225 binder_stats_deleted(BINDER_STAT_TRANSACTION); 2226 err_alloc_t_failed: 2227 err_bad_call_stack: 2228 err_empty_call_stack: 2229 err_dead_binder: 2230 err_invalid_target_handle: 2231 err_no_context_mgr_node: 2232 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 2233 "%d:%d transaction failed %d, size %lld-%lld\n", 2234 proc->pid, thread->pid, return_error, 2235 (u64)tr->data_size, (u64)tr->offsets_size); 2236 2237 { 2238 struct binder_transaction_log_entry *fe; 2239 2240 fe = binder_transaction_log_add(&binder_transaction_log_failed); 2241 *fe = *e; 2242 } 2243 2244 BUG_ON(thread->return_error != BR_OK); 2245 if (in_reply_to) { 2246 thread->return_error = BR_TRANSACTION_COMPLETE; 2247 binder_send_failed_reply(in_reply_to, return_error); 2248 } else 2249 thread->return_error = return_error; 2250 } 2251 2252 static int binder_thread_write(struct binder_proc *proc, 2253 struct binder_thread *thread, 2254 binder_uintptr_t binder_buffer, size_t size, 2255 binder_size_t *consumed) 2256 { 2257 uint32_t cmd; 2258 struct binder_context *context = proc->context; 2259 void __user *buffer = (void __user *)(uintptr_t)binder_buffer; 2260 void __user *ptr = buffer + *consumed; 2261 void __user *end = buffer + size; 2262 2263 while (ptr < end && thread->return_error == BR_OK) { 2264 if (get_user(cmd, (uint32_t __user *)ptr)) 2265 return -EFAULT; 2266 ptr += sizeof(uint32_t); 2267 trace_binder_command(cmd); 2268 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) { 2269 binder_stats.bc[_IOC_NR(cmd)]++; 2270 proc->stats.bc[_IOC_NR(cmd)]++; 2271 thread->stats.bc[_IOC_NR(cmd)]++; 2272 } 2273 switch (cmd) { 2274 case BC_INCREFS: 2275 case BC_ACQUIRE: 2276 case BC_RELEASE: 2277 case BC_DECREFS: { 2278 uint32_t target; 2279 struct binder_ref *ref; 2280 const char *debug_string; 2281 2282 if (get_user(target, (uint32_t __user *)ptr)) 2283 return -EFAULT; 2284 ptr += sizeof(uint32_t); 2285 if (target == 0 && context->binder_context_mgr_node && 2286 (cmd == BC_INCREFS || cmd == BC_ACQUIRE)) { 2287 ref = binder_get_ref_for_node(proc, 2288 context->binder_context_mgr_node); 2289 if (ref->desc != target) { 2290 binder_user_error("%d:%d tried to acquire reference to desc 0, got %d instead\n", 2291 proc->pid, thread->pid, 2292 ref->desc); 2293 } 2294 } else 2295 ref = binder_get_ref(proc, target, 2296 cmd == BC_ACQUIRE || 2297 cmd == BC_RELEASE); 2298 if (ref == NULL) { 2299 binder_user_error("%d:%d refcount change on invalid ref %d\n", 2300 proc->pid, thread->pid, target); 2301 break; 2302 } 2303 switch (cmd) { 2304 case BC_INCREFS: 2305 debug_string = "IncRefs"; 2306 binder_inc_ref(ref, 0, NULL); 2307 break; 2308 case BC_ACQUIRE: 2309 debug_string = "Acquire"; 2310 binder_inc_ref(ref, 1, NULL); 2311 break; 2312 case BC_RELEASE: 2313 debug_string = "Release"; 2314 binder_dec_ref(ref, 1); 2315 break; 2316 case BC_DECREFS: 2317 default: 2318 debug_string = "DecRefs"; 2319 binder_dec_ref(ref, 0); 2320 break; 2321 } 2322 binder_debug(BINDER_DEBUG_USER_REFS, 2323 "%d:%d %s ref %d desc %d s %d w %d for node %d\n", 2324 proc->pid, thread->pid, debug_string, ref->debug_id, 2325 ref->desc, ref->strong, ref->weak, ref->node->debug_id); 2326 break; 2327 } 2328 case BC_INCREFS_DONE: 2329 case BC_ACQUIRE_DONE: { 2330 binder_uintptr_t node_ptr; 2331 binder_uintptr_t cookie; 2332 struct binder_node *node; 2333 2334 if (get_user(node_ptr, (binder_uintptr_t __user *)ptr)) 2335 return -EFAULT; 2336 ptr += sizeof(binder_uintptr_t); 2337 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 2338 return -EFAULT; 2339 ptr += sizeof(binder_uintptr_t); 2340 node = binder_get_node(proc, node_ptr); 2341 if (node == NULL) { 2342 binder_user_error("%d:%d %s u%016llx no match\n", 2343 proc->pid, thread->pid, 2344 cmd == BC_INCREFS_DONE ? 2345 "BC_INCREFS_DONE" : 2346 "BC_ACQUIRE_DONE", 2347 (u64)node_ptr); 2348 break; 2349 } 2350 if (cookie != node->cookie) { 2351 binder_user_error("%d:%d %s u%016llx node %d cookie mismatch %016llx != %016llx\n", 2352 proc->pid, thread->pid, 2353 cmd == BC_INCREFS_DONE ? 2354 "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 2355 (u64)node_ptr, node->debug_id, 2356 (u64)cookie, (u64)node->cookie); 2357 break; 2358 } 2359 if (cmd == BC_ACQUIRE_DONE) { 2360 if (node->pending_strong_ref == 0) { 2361 binder_user_error("%d:%d BC_ACQUIRE_DONE node %d has no pending acquire request\n", 2362 proc->pid, thread->pid, 2363 node->debug_id); 2364 break; 2365 } 2366 node->pending_strong_ref = 0; 2367 } else { 2368 if (node->pending_weak_ref == 0) { 2369 binder_user_error("%d:%d BC_INCREFS_DONE node %d has no pending increfs request\n", 2370 proc->pid, thread->pid, 2371 node->debug_id); 2372 break; 2373 } 2374 node->pending_weak_ref = 0; 2375 } 2376 binder_dec_node(node, cmd == BC_ACQUIRE_DONE, 0); 2377 binder_debug(BINDER_DEBUG_USER_REFS, 2378 "%d:%d %s node %d ls %d lw %d\n", 2379 proc->pid, thread->pid, 2380 cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 2381 node->debug_id, node->local_strong_refs, node->local_weak_refs); 2382 break; 2383 } 2384 case BC_ATTEMPT_ACQUIRE: 2385 pr_err("BC_ATTEMPT_ACQUIRE not supported\n"); 2386 return -EINVAL; 2387 case BC_ACQUIRE_RESULT: 2388 pr_err("BC_ACQUIRE_RESULT not supported\n"); 2389 return -EINVAL; 2390 2391 case BC_FREE_BUFFER: { 2392 binder_uintptr_t data_ptr; 2393 struct binder_buffer *buffer; 2394 2395 if (get_user(data_ptr, (binder_uintptr_t __user *)ptr)) 2396 return -EFAULT; 2397 ptr += sizeof(binder_uintptr_t); 2398 2399 buffer = binder_buffer_lookup(proc, data_ptr); 2400 if (buffer == NULL) { 2401 binder_user_error("%d:%d BC_FREE_BUFFER u%016llx no match\n", 2402 proc->pid, thread->pid, (u64)data_ptr); 2403 break; 2404 } 2405 if (!buffer->allow_user_free) { 2406 binder_user_error("%d:%d BC_FREE_BUFFER u%016llx matched unreturned buffer\n", 2407 proc->pid, thread->pid, (u64)data_ptr); 2408 break; 2409 } 2410 binder_debug(BINDER_DEBUG_FREE_BUFFER, 2411 "%d:%d BC_FREE_BUFFER u%016llx found buffer %d for %s transaction\n", 2412 proc->pid, thread->pid, (u64)data_ptr, 2413 buffer->debug_id, 2414 buffer->transaction ? "active" : "finished"); 2415 2416 if (buffer->transaction) { 2417 buffer->transaction->buffer = NULL; 2418 buffer->transaction = NULL; 2419 } 2420 if (buffer->async_transaction && buffer->target_node) { 2421 BUG_ON(!buffer->target_node->has_async_transaction); 2422 if (list_empty(&buffer->target_node->async_todo)) 2423 buffer->target_node->has_async_transaction = 0; 2424 else 2425 list_move_tail(buffer->target_node->async_todo.next, &thread->todo); 2426 } 2427 trace_binder_transaction_buffer_release(buffer); 2428 binder_transaction_buffer_release(proc, buffer, NULL); 2429 binder_free_buf(proc, buffer); 2430 break; 2431 } 2432 2433 case BC_TRANSACTION_SG: 2434 case BC_REPLY_SG: { 2435 struct binder_transaction_data_sg tr; 2436 2437 if (copy_from_user(&tr, ptr, sizeof(tr))) 2438 return -EFAULT; 2439 ptr += sizeof(tr); 2440 binder_transaction(proc, thread, &tr.transaction_data, 2441 cmd == BC_REPLY_SG, tr.buffers_size); 2442 break; 2443 } 2444 case BC_TRANSACTION: 2445 case BC_REPLY: { 2446 struct binder_transaction_data tr; 2447 2448 if (copy_from_user(&tr, ptr, sizeof(tr))) 2449 return -EFAULT; 2450 ptr += sizeof(tr); 2451 binder_transaction(proc, thread, &tr, 2452 cmd == BC_REPLY, 0); 2453 break; 2454 } 2455 2456 case BC_REGISTER_LOOPER: 2457 binder_debug(BINDER_DEBUG_THREADS, 2458 "%d:%d BC_REGISTER_LOOPER\n", 2459 proc->pid, thread->pid); 2460 if (thread->looper & BINDER_LOOPER_STATE_ENTERED) { 2461 thread->looper |= BINDER_LOOPER_STATE_INVALID; 2462 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER\n", 2463 proc->pid, thread->pid); 2464 } else if (proc->requested_threads == 0) { 2465 thread->looper |= BINDER_LOOPER_STATE_INVALID; 2466 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called without request\n", 2467 proc->pid, thread->pid); 2468 } else { 2469 proc->requested_threads--; 2470 proc->requested_threads_started++; 2471 } 2472 thread->looper |= BINDER_LOOPER_STATE_REGISTERED; 2473 break; 2474 case BC_ENTER_LOOPER: 2475 binder_debug(BINDER_DEBUG_THREADS, 2476 "%d:%d BC_ENTER_LOOPER\n", 2477 proc->pid, thread->pid); 2478 if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) { 2479 thread->looper |= BINDER_LOOPER_STATE_INVALID; 2480 binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n", 2481 proc->pid, thread->pid); 2482 } 2483 thread->looper |= BINDER_LOOPER_STATE_ENTERED; 2484 break; 2485 case BC_EXIT_LOOPER: 2486 binder_debug(BINDER_DEBUG_THREADS, 2487 "%d:%d BC_EXIT_LOOPER\n", 2488 proc->pid, thread->pid); 2489 thread->looper |= BINDER_LOOPER_STATE_EXITED; 2490 break; 2491 2492 case BC_REQUEST_DEATH_NOTIFICATION: 2493 case BC_CLEAR_DEATH_NOTIFICATION: { 2494 uint32_t target; 2495 binder_uintptr_t cookie; 2496 struct binder_ref *ref; 2497 struct binder_ref_death *death; 2498 2499 if (get_user(target, (uint32_t __user *)ptr)) 2500 return -EFAULT; 2501 ptr += sizeof(uint32_t); 2502 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 2503 return -EFAULT; 2504 ptr += sizeof(binder_uintptr_t); 2505 ref = binder_get_ref(proc, target, false); 2506 if (ref == NULL) { 2507 binder_user_error("%d:%d %s invalid ref %d\n", 2508 proc->pid, thread->pid, 2509 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 2510 "BC_REQUEST_DEATH_NOTIFICATION" : 2511 "BC_CLEAR_DEATH_NOTIFICATION", 2512 target); 2513 break; 2514 } 2515 2516 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 2517 "%d:%d %s %016llx ref %d desc %d s %d w %d for node %d\n", 2518 proc->pid, thread->pid, 2519 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 2520 "BC_REQUEST_DEATH_NOTIFICATION" : 2521 "BC_CLEAR_DEATH_NOTIFICATION", 2522 (u64)cookie, ref->debug_id, ref->desc, 2523 ref->strong, ref->weak, ref->node->debug_id); 2524 2525 if (cmd == BC_REQUEST_DEATH_NOTIFICATION) { 2526 if (ref->death) { 2527 binder_user_error("%d:%d BC_REQUEST_DEATH_NOTIFICATION death notification already set\n", 2528 proc->pid, thread->pid); 2529 break; 2530 } 2531 death = kzalloc(sizeof(*death), GFP_KERNEL); 2532 if (death == NULL) { 2533 thread->return_error = BR_ERROR; 2534 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 2535 "%d:%d BC_REQUEST_DEATH_NOTIFICATION failed\n", 2536 proc->pid, thread->pid); 2537 break; 2538 } 2539 binder_stats_created(BINDER_STAT_DEATH); 2540 INIT_LIST_HEAD(&death->work.entry); 2541 death->cookie = cookie; 2542 ref->death = death; 2543 if (ref->node->proc == NULL) { 2544 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 2545 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2546 list_add_tail(&ref->death->work.entry, &thread->todo); 2547 } else { 2548 list_add_tail(&ref->death->work.entry, &proc->todo); 2549 wake_up_interruptible(&proc->wait); 2550 } 2551 } 2552 } else { 2553 if (ref->death == NULL) { 2554 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification not active\n", 2555 proc->pid, thread->pid); 2556 break; 2557 } 2558 death = ref->death; 2559 if (death->cookie != cookie) { 2560 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch %016llx != %016llx\n", 2561 proc->pid, thread->pid, 2562 (u64)death->cookie, 2563 (u64)cookie); 2564 break; 2565 } 2566 ref->death = NULL; 2567 if (list_empty(&death->work.entry)) { 2568 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2569 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2570 list_add_tail(&death->work.entry, &thread->todo); 2571 } else { 2572 list_add_tail(&death->work.entry, &proc->todo); 2573 wake_up_interruptible(&proc->wait); 2574 } 2575 } else { 2576 BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER); 2577 death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR; 2578 } 2579 } 2580 } break; 2581 case BC_DEAD_BINDER_DONE: { 2582 struct binder_work *w; 2583 binder_uintptr_t cookie; 2584 struct binder_ref_death *death = NULL; 2585 2586 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 2587 return -EFAULT; 2588 2589 ptr += sizeof(cookie); 2590 list_for_each_entry(w, &proc->delivered_death, entry) { 2591 struct binder_ref_death *tmp_death = container_of(w, struct binder_ref_death, work); 2592 2593 if (tmp_death->cookie == cookie) { 2594 death = tmp_death; 2595 break; 2596 } 2597 } 2598 binder_debug(BINDER_DEBUG_DEAD_BINDER, 2599 "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n", 2600 proc->pid, thread->pid, (u64)cookie, 2601 death); 2602 if (death == NULL) { 2603 binder_user_error("%d:%d BC_DEAD_BINDER_DONE %016llx not found\n", 2604 proc->pid, thread->pid, (u64)cookie); 2605 break; 2606 } 2607 2608 list_del_init(&death->work.entry); 2609 if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) { 2610 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 2611 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) { 2612 list_add_tail(&death->work.entry, &thread->todo); 2613 } else { 2614 list_add_tail(&death->work.entry, &proc->todo); 2615 wake_up_interruptible(&proc->wait); 2616 } 2617 } 2618 } break; 2619 2620 default: 2621 pr_err("%d:%d unknown command %d\n", 2622 proc->pid, thread->pid, cmd); 2623 return -EINVAL; 2624 } 2625 *consumed = ptr - buffer; 2626 } 2627 return 0; 2628 } 2629 2630 static void binder_stat_br(struct binder_proc *proc, 2631 struct binder_thread *thread, uint32_t cmd) 2632 { 2633 trace_binder_return(cmd); 2634 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) { 2635 binder_stats.br[_IOC_NR(cmd)]++; 2636 proc->stats.br[_IOC_NR(cmd)]++; 2637 thread->stats.br[_IOC_NR(cmd)]++; 2638 } 2639 } 2640 2641 static int binder_has_proc_work(struct binder_proc *proc, 2642 struct binder_thread *thread) 2643 { 2644 return !list_empty(&proc->todo) || 2645 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2646 } 2647 2648 static int binder_has_thread_work(struct binder_thread *thread) 2649 { 2650 return !list_empty(&thread->todo) || thread->return_error != BR_OK || 2651 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN); 2652 } 2653 2654 static int binder_thread_read(struct binder_proc *proc, 2655 struct binder_thread *thread, 2656 binder_uintptr_t binder_buffer, size_t size, 2657 binder_size_t *consumed, int non_block) 2658 { 2659 void __user *buffer = (void __user *)(uintptr_t)binder_buffer; 2660 void __user *ptr = buffer + *consumed; 2661 void __user *end = buffer + size; 2662 2663 int ret = 0; 2664 int wait_for_proc_work; 2665 2666 if (*consumed == 0) { 2667 if (put_user(BR_NOOP, (uint32_t __user *)ptr)) 2668 return -EFAULT; 2669 ptr += sizeof(uint32_t); 2670 } 2671 2672 retry: 2673 wait_for_proc_work = thread->transaction_stack == NULL && 2674 list_empty(&thread->todo); 2675 2676 if (thread->return_error != BR_OK && ptr < end) { 2677 if (thread->return_error2 != BR_OK) { 2678 if (put_user(thread->return_error2, (uint32_t __user *)ptr)) 2679 return -EFAULT; 2680 ptr += sizeof(uint32_t); 2681 binder_stat_br(proc, thread, thread->return_error2); 2682 if (ptr == end) 2683 goto done; 2684 thread->return_error2 = BR_OK; 2685 } 2686 if (put_user(thread->return_error, (uint32_t __user *)ptr)) 2687 return -EFAULT; 2688 ptr += sizeof(uint32_t); 2689 binder_stat_br(proc, thread, thread->return_error); 2690 thread->return_error = BR_OK; 2691 goto done; 2692 } 2693 2694 2695 thread->looper |= BINDER_LOOPER_STATE_WAITING; 2696 if (wait_for_proc_work) 2697 proc->ready_threads++; 2698 2699 binder_unlock(__func__); 2700 2701 trace_binder_wait_for_work(wait_for_proc_work, 2702 !!thread->transaction_stack, 2703 !list_empty(&thread->todo)); 2704 if (wait_for_proc_work) { 2705 if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2706 BINDER_LOOPER_STATE_ENTERED))) { 2707 binder_user_error("%d:%d ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state %x)\n", 2708 proc->pid, thread->pid, thread->looper); 2709 wait_event_interruptible(binder_user_error_wait, 2710 binder_stop_on_user_error < 2); 2711 } 2712 binder_set_nice(proc->default_priority); 2713 if (non_block) { 2714 if (!binder_has_proc_work(proc, thread)) 2715 ret = -EAGAIN; 2716 } else 2717 ret = wait_event_freezable_exclusive(proc->wait, binder_has_proc_work(proc, thread)); 2718 } else { 2719 if (non_block) { 2720 if (!binder_has_thread_work(thread)) 2721 ret = -EAGAIN; 2722 } else 2723 ret = wait_event_freezable(thread->wait, binder_has_thread_work(thread)); 2724 } 2725 2726 binder_lock(__func__); 2727 2728 if (wait_for_proc_work) 2729 proc->ready_threads--; 2730 thread->looper &= ~BINDER_LOOPER_STATE_WAITING; 2731 2732 if (ret) 2733 return ret; 2734 2735 while (1) { 2736 uint32_t cmd; 2737 struct binder_transaction_data tr; 2738 struct binder_work *w; 2739 struct binder_transaction *t = NULL; 2740 2741 if (!list_empty(&thread->todo)) { 2742 w = list_first_entry(&thread->todo, struct binder_work, 2743 entry); 2744 } else if (!list_empty(&proc->todo) && wait_for_proc_work) { 2745 w = list_first_entry(&proc->todo, struct binder_work, 2746 entry); 2747 } else { 2748 /* no data added */ 2749 if (ptr - buffer == 4 && 2750 !(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN)) 2751 goto retry; 2752 break; 2753 } 2754 2755 if (end - ptr < sizeof(tr) + 4) 2756 break; 2757 2758 switch (w->type) { 2759 case BINDER_WORK_TRANSACTION: { 2760 t = container_of(w, struct binder_transaction, work); 2761 } break; 2762 case BINDER_WORK_TRANSACTION_COMPLETE: { 2763 cmd = BR_TRANSACTION_COMPLETE; 2764 if (put_user(cmd, (uint32_t __user *)ptr)) 2765 return -EFAULT; 2766 ptr += sizeof(uint32_t); 2767 2768 binder_stat_br(proc, thread, cmd); 2769 binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE, 2770 "%d:%d BR_TRANSACTION_COMPLETE\n", 2771 proc->pid, thread->pid); 2772 2773 list_del(&w->entry); 2774 kfree(w); 2775 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 2776 } break; 2777 case BINDER_WORK_NODE: { 2778 struct binder_node *node = container_of(w, struct binder_node, work); 2779 uint32_t cmd = BR_NOOP; 2780 const char *cmd_name; 2781 int strong = node->internal_strong_refs || node->local_strong_refs; 2782 int weak = !hlist_empty(&node->refs) || node->local_weak_refs || strong; 2783 2784 if (weak && !node->has_weak_ref) { 2785 cmd = BR_INCREFS; 2786 cmd_name = "BR_INCREFS"; 2787 node->has_weak_ref = 1; 2788 node->pending_weak_ref = 1; 2789 node->local_weak_refs++; 2790 } else if (strong && !node->has_strong_ref) { 2791 cmd = BR_ACQUIRE; 2792 cmd_name = "BR_ACQUIRE"; 2793 node->has_strong_ref = 1; 2794 node->pending_strong_ref = 1; 2795 node->local_strong_refs++; 2796 } else if (!strong && node->has_strong_ref) { 2797 cmd = BR_RELEASE; 2798 cmd_name = "BR_RELEASE"; 2799 node->has_strong_ref = 0; 2800 } else if (!weak && node->has_weak_ref) { 2801 cmd = BR_DECREFS; 2802 cmd_name = "BR_DECREFS"; 2803 node->has_weak_ref = 0; 2804 } 2805 if (cmd != BR_NOOP) { 2806 if (put_user(cmd, (uint32_t __user *)ptr)) 2807 return -EFAULT; 2808 ptr += sizeof(uint32_t); 2809 if (put_user(node->ptr, 2810 (binder_uintptr_t __user *)ptr)) 2811 return -EFAULT; 2812 ptr += sizeof(binder_uintptr_t); 2813 if (put_user(node->cookie, 2814 (binder_uintptr_t __user *)ptr)) 2815 return -EFAULT; 2816 ptr += sizeof(binder_uintptr_t); 2817 2818 binder_stat_br(proc, thread, cmd); 2819 binder_debug(BINDER_DEBUG_USER_REFS, 2820 "%d:%d %s %d u%016llx c%016llx\n", 2821 proc->pid, thread->pid, cmd_name, 2822 node->debug_id, 2823 (u64)node->ptr, (u64)node->cookie); 2824 } else { 2825 list_del_init(&w->entry); 2826 if (!weak && !strong) { 2827 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2828 "%d:%d node %d u%016llx c%016llx deleted\n", 2829 proc->pid, thread->pid, 2830 node->debug_id, 2831 (u64)node->ptr, 2832 (u64)node->cookie); 2833 rb_erase(&node->rb_node, &proc->nodes); 2834 kfree(node); 2835 binder_stats_deleted(BINDER_STAT_NODE); 2836 } else { 2837 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 2838 "%d:%d node %d u%016llx c%016llx state unchanged\n", 2839 proc->pid, thread->pid, 2840 node->debug_id, 2841 (u64)node->ptr, 2842 (u64)node->cookie); 2843 } 2844 } 2845 } break; 2846 case BINDER_WORK_DEAD_BINDER: 2847 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 2848 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 2849 struct binder_ref_death *death; 2850 uint32_t cmd; 2851 2852 death = container_of(w, struct binder_ref_death, work); 2853 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) 2854 cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE; 2855 else 2856 cmd = BR_DEAD_BINDER; 2857 if (put_user(cmd, (uint32_t __user *)ptr)) 2858 return -EFAULT; 2859 ptr += sizeof(uint32_t); 2860 if (put_user(death->cookie, 2861 (binder_uintptr_t __user *)ptr)) 2862 return -EFAULT; 2863 ptr += sizeof(binder_uintptr_t); 2864 binder_stat_br(proc, thread, cmd); 2865 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 2866 "%d:%d %s %016llx\n", 2867 proc->pid, thread->pid, 2868 cmd == BR_DEAD_BINDER ? 2869 "BR_DEAD_BINDER" : 2870 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 2871 (u64)death->cookie); 2872 2873 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) { 2874 list_del(&w->entry); 2875 kfree(death); 2876 binder_stats_deleted(BINDER_STAT_DEATH); 2877 } else 2878 list_move(&w->entry, &proc->delivered_death); 2879 if (cmd == BR_DEAD_BINDER) 2880 goto done; /* DEAD_BINDER notifications can cause transactions */ 2881 } break; 2882 } 2883 2884 if (!t) 2885 continue; 2886 2887 BUG_ON(t->buffer == NULL); 2888 if (t->buffer->target_node) { 2889 struct binder_node *target_node = t->buffer->target_node; 2890 2891 tr.target.ptr = target_node->ptr; 2892 tr.cookie = target_node->cookie; 2893 t->saved_priority = task_nice(current); 2894 if (t->priority < target_node->min_priority && 2895 !(t->flags & TF_ONE_WAY)) 2896 binder_set_nice(t->priority); 2897 else if (!(t->flags & TF_ONE_WAY) || 2898 t->saved_priority > target_node->min_priority) 2899 binder_set_nice(target_node->min_priority); 2900 cmd = BR_TRANSACTION; 2901 } else { 2902 tr.target.ptr = 0; 2903 tr.cookie = 0; 2904 cmd = BR_REPLY; 2905 } 2906 tr.code = t->code; 2907 tr.flags = t->flags; 2908 tr.sender_euid = from_kuid(current_user_ns(), t->sender_euid); 2909 2910 if (t->from) { 2911 struct task_struct *sender = t->from->proc->tsk; 2912 2913 tr.sender_pid = task_tgid_nr_ns(sender, 2914 task_active_pid_ns(current)); 2915 } else { 2916 tr.sender_pid = 0; 2917 } 2918 2919 tr.data_size = t->buffer->data_size; 2920 tr.offsets_size = t->buffer->offsets_size; 2921 tr.data.ptr.buffer = (binder_uintptr_t)( 2922 (uintptr_t)t->buffer->data + 2923 proc->user_buffer_offset); 2924 tr.data.ptr.offsets = tr.data.ptr.buffer + 2925 ALIGN(t->buffer->data_size, 2926 sizeof(void *)); 2927 2928 if (put_user(cmd, (uint32_t __user *)ptr)) 2929 return -EFAULT; 2930 ptr += sizeof(uint32_t); 2931 if (copy_to_user(ptr, &tr, sizeof(tr))) 2932 return -EFAULT; 2933 ptr += sizeof(tr); 2934 2935 trace_binder_transaction_received(t); 2936 binder_stat_br(proc, thread, cmd); 2937 binder_debug(BINDER_DEBUG_TRANSACTION, 2938 "%d:%d %s %d %d:%d, cmd %d size %zd-%zd ptr %016llx-%016llx\n", 2939 proc->pid, thread->pid, 2940 (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" : 2941 "BR_REPLY", 2942 t->debug_id, t->from ? t->from->proc->pid : 0, 2943 t->from ? t->from->pid : 0, cmd, 2944 t->buffer->data_size, t->buffer->offsets_size, 2945 (u64)tr.data.ptr.buffer, (u64)tr.data.ptr.offsets); 2946 2947 list_del(&t->work.entry); 2948 t->buffer->allow_user_free = 1; 2949 if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) { 2950 t->to_parent = thread->transaction_stack; 2951 t->to_thread = thread; 2952 thread->transaction_stack = t; 2953 } else { 2954 t->buffer->transaction = NULL; 2955 kfree(t); 2956 binder_stats_deleted(BINDER_STAT_TRANSACTION); 2957 } 2958 break; 2959 } 2960 2961 done: 2962 2963 *consumed = ptr - buffer; 2964 if (proc->requested_threads + proc->ready_threads == 0 && 2965 proc->requested_threads_started < proc->max_threads && 2966 (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 2967 BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */ 2968 /*spawn a new thread if we leave this out */) { 2969 proc->requested_threads++; 2970 binder_debug(BINDER_DEBUG_THREADS, 2971 "%d:%d BR_SPAWN_LOOPER\n", 2972 proc->pid, thread->pid); 2973 if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer)) 2974 return -EFAULT; 2975 binder_stat_br(proc, thread, BR_SPAWN_LOOPER); 2976 } 2977 return 0; 2978 } 2979 2980 static void binder_release_work(struct list_head *list) 2981 { 2982 struct binder_work *w; 2983 2984 while (!list_empty(list)) { 2985 w = list_first_entry(list, struct binder_work, entry); 2986 list_del_init(&w->entry); 2987 switch (w->type) { 2988 case BINDER_WORK_TRANSACTION: { 2989 struct binder_transaction *t; 2990 2991 t = container_of(w, struct binder_transaction, work); 2992 if (t->buffer->target_node && 2993 !(t->flags & TF_ONE_WAY)) { 2994 binder_send_failed_reply(t, BR_DEAD_REPLY); 2995 } else { 2996 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 2997 "undelivered transaction %d\n", 2998 t->debug_id); 2999 t->buffer->transaction = NULL; 3000 kfree(t); 3001 binder_stats_deleted(BINDER_STAT_TRANSACTION); 3002 } 3003 } break; 3004 case BINDER_WORK_TRANSACTION_COMPLETE: { 3005 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 3006 "undelivered TRANSACTION_COMPLETE\n"); 3007 kfree(w); 3008 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 3009 } break; 3010 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 3011 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 3012 struct binder_ref_death *death; 3013 3014 death = container_of(w, struct binder_ref_death, work); 3015 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 3016 "undelivered death notification, %016llx\n", 3017 (u64)death->cookie); 3018 kfree(death); 3019 binder_stats_deleted(BINDER_STAT_DEATH); 3020 } break; 3021 default: 3022 pr_err("unexpected work type, %d, not freed\n", 3023 w->type); 3024 break; 3025 } 3026 } 3027 3028 } 3029 3030 static struct binder_thread *binder_get_thread(struct binder_proc *proc) 3031 { 3032 struct binder_thread *thread = NULL; 3033 struct rb_node *parent = NULL; 3034 struct rb_node **p = &proc->threads.rb_node; 3035 3036 while (*p) { 3037 parent = *p; 3038 thread = rb_entry(parent, struct binder_thread, rb_node); 3039 3040 if (current->pid < thread->pid) 3041 p = &(*p)->rb_left; 3042 else if (current->pid > thread->pid) 3043 p = &(*p)->rb_right; 3044 else 3045 break; 3046 } 3047 if (*p == NULL) { 3048 thread = kzalloc(sizeof(*thread), GFP_KERNEL); 3049 if (thread == NULL) 3050 return NULL; 3051 binder_stats_created(BINDER_STAT_THREAD); 3052 thread->proc = proc; 3053 thread->pid = current->pid; 3054 init_waitqueue_head(&thread->wait); 3055 INIT_LIST_HEAD(&thread->todo); 3056 rb_link_node(&thread->rb_node, parent, p); 3057 rb_insert_color(&thread->rb_node, &proc->threads); 3058 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 3059 thread->return_error = BR_OK; 3060 thread->return_error2 = BR_OK; 3061 } 3062 return thread; 3063 } 3064 3065 static int binder_free_thread(struct binder_proc *proc, 3066 struct binder_thread *thread) 3067 { 3068 struct binder_transaction *t; 3069 struct binder_transaction *send_reply = NULL; 3070 int active_transactions = 0; 3071 3072 rb_erase(&thread->rb_node, &proc->threads); 3073 t = thread->transaction_stack; 3074 if (t && t->to_thread == thread) 3075 send_reply = t; 3076 while (t) { 3077 active_transactions++; 3078 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 3079 "release %d:%d transaction %d %s, still active\n", 3080 proc->pid, thread->pid, 3081 t->debug_id, 3082 (t->to_thread == thread) ? "in" : "out"); 3083 3084 if (t->to_thread == thread) { 3085 t->to_proc = NULL; 3086 t->to_thread = NULL; 3087 if (t->buffer) { 3088 t->buffer->transaction = NULL; 3089 t->buffer = NULL; 3090 } 3091 t = t->to_parent; 3092 } else if (t->from == thread) { 3093 t->from = NULL; 3094 t = t->from_parent; 3095 } else 3096 BUG(); 3097 } 3098 if (send_reply) 3099 binder_send_failed_reply(send_reply, BR_DEAD_REPLY); 3100 binder_release_work(&thread->todo); 3101 kfree(thread); 3102 binder_stats_deleted(BINDER_STAT_THREAD); 3103 return active_transactions; 3104 } 3105 3106 static unsigned int binder_poll(struct file *filp, 3107 struct poll_table_struct *wait) 3108 { 3109 struct binder_proc *proc = filp->private_data; 3110 struct binder_thread *thread = NULL; 3111 int wait_for_proc_work; 3112 3113 binder_lock(__func__); 3114 3115 thread = binder_get_thread(proc); 3116 3117 wait_for_proc_work = thread->transaction_stack == NULL && 3118 list_empty(&thread->todo) && thread->return_error == BR_OK; 3119 3120 binder_unlock(__func__); 3121 3122 if (wait_for_proc_work) { 3123 if (binder_has_proc_work(proc, thread)) 3124 return POLLIN; 3125 poll_wait(filp, &proc->wait, wait); 3126 if (binder_has_proc_work(proc, thread)) 3127 return POLLIN; 3128 } else { 3129 if (binder_has_thread_work(thread)) 3130 return POLLIN; 3131 poll_wait(filp, &thread->wait, wait); 3132 if (binder_has_thread_work(thread)) 3133 return POLLIN; 3134 } 3135 return 0; 3136 } 3137 3138 static int binder_ioctl_write_read(struct file *filp, 3139 unsigned int cmd, unsigned long arg, 3140 struct binder_thread *thread) 3141 { 3142 int ret = 0; 3143 struct binder_proc *proc = filp->private_data; 3144 unsigned int size = _IOC_SIZE(cmd); 3145 void __user *ubuf = (void __user *)arg; 3146 struct binder_write_read bwr; 3147 3148 if (size != sizeof(struct binder_write_read)) { 3149 ret = -EINVAL; 3150 goto out; 3151 } 3152 if (copy_from_user(&bwr, ubuf, sizeof(bwr))) { 3153 ret = -EFAULT; 3154 goto out; 3155 } 3156 binder_debug(BINDER_DEBUG_READ_WRITE, 3157 "%d:%d write %lld at %016llx, read %lld at %016llx\n", 3158 proc->pid, thread->pid, 3159 (u64)bwr.write_size, (u64)bwr.write_buffer, 3160 (u64)bwr.read_size, (u64)bwr.read_buffer); 3161 3162 if (bwr.write_size > 0) { 3163 ret = binder_thread_write(proc, thread, 3164 bwr.write_buffer, 3165 bwr.write_size, 3166 &bwr.write_consumed); 3167 trace_binder_write_done(ret); 3168 if (ret < 0) { 3169 bwr.read_consumed = 0; 3170 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 3171 ret = -EFAULT; 3172 goto out; 3173 } 3174 } 3175 if (bwr.read_size > 0) { 3176 ret = binder_thread_read(proc, thread, bwr.read_buffer, 3177 bwr.read_size, 3178 &bwr.read_consumed, 3179 filp->f_flags & O_NONBLOCK); 3180 trace_binder_read_done(ret); 3181 if (!list_empty(&proc->todo)) 3182 wake_up_interruptible(&proc->wait); 3183 if (ret < 0) { 3184 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 3185 ret = -EFAULT; 3186 goto out; 3187 } 3188 } 3189 binder_debug(BINDER_DEBUG_READ_WRITE, 3190 "%d:%d wrote %lld of %lld, read return %lld of %lld\n", 3191 proc->pid, thread->pid, 3192 (u64)bwr.write_consumed, (u64)bwr.write_size, 3193 (u64)bwr.read_consumed, (u64)bwr.read_size); 3194 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) { 3195 ret = -EFAULT; 3196 goto out; 3197 } 3198 out: 3199 return ret; 3200 } 3201 3202 static int binder_ioctl_set_ctx_mgr(struct file *filp) 3203 { 3204 int ret = 0; 3205 struct binder_proc *proc = filp->private_data; 3206 struct binder_context *context = proc->context; 3207 3208 kuid_t curr_euid = current_euid(); 3209 3210 if (context->binder_context_mgr_node) { 3211 pr_err("BINDER_SET_CONTEXT_MGR already set\n"); 3212 ret = -EBUSY; 3213 goto out; 3214 } 3215 ret = security_binder_set_context_mgr(proc->tsk); 3216 if (ret < 0) 3217 goto out; 3218 if (uid_valid(context->binder_context_mgr_uid)) { 3219 if (!uid_eq(context->binder_context_mgr_uid, curr_euid)) { 3220 pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n", 3221 from_kuid(&init_user_ns, curr_euid), 3222 from_kuid(&init_user_ns, 3223 context->binder_context_mgr_uid)); 3224 ret = -EPERM; 3225 goto out; 3226 } 3227 } else { 3228 context->binder_context_mgr_uid = curr_euid; 3229 } 3230 context->binder_context_mgr_node = binder_new_node(proc, 0, 0); 3231 if (!context->binder_context_mgr_node) { 3232 ret = -ENOMEM; 3233 goto out; 3234 } 3235 context->binder_context_mgr_node->local_weak_refs++; 3236 context->binder_context_mgr_node->local_strong_refs++; 3237 context->binder_context_mgr_node->has_strong_ref = 1; 3238 context->binder_context_mgr_node->has_weak_ref = 1; 3239 out: 3240 return ret; 3241 } 3242 3243 static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 3244 { 3245 int ret; 3246 struct binder_proc *proc = filp->private_data; 3247 struct binder_thread *thread; 3248 unsigned int size = _IOC_SIZE(cmd); 3249 void __user *ubuf = (void __user *)arg; 3250 3251 /*pr_info("binder_ioctl: %d:%d %x %lx\n", 3252 proc->pid, current->pid, cmd, arg);*/ 3253 3254 trace_binder_ioctl(cmd, arg); 3255 3256 ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 3257 if (ret) 3258 goto err_unlocked; 3259 3260 binder_lock(__func__); 3261 thread = binder_get_thread(proc); 3262 if (thread == NULL) { 3263 ret = -ENOMEM; 3264 goto err; 3265 } 3266 3267 switch (cmd) { 3268 case BINDER_WRITE_READ: 3269 ret = binder_ioctl_write_read(filp, cmd, arg, thread); 3270 if (ret) 3271 goto err; 3272 break; 3273 case BINDER_SET_MAX_THREADS: 3274 if (copy_from_user(&proc->max_threads, ubuf, sizeof(proc->max_threads))) { 3275 ret = -EINVAL; 3276 goto err; 3277 } 3278 break; 3279 case BINDER_SET_CONTEXT_MGR: 3280 ret = binder_ioctl_set_ctx_mgr(filp); 3281 if (ret) 3282 goto err; 3283 break; 3284 case BINDER_THREAD_EXIT: 3285 binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n", 3286 proc->pid, thread->pid); 3287 binder_free_thread(proc, thread); 3288 thread = NULL; 3289 break; 3290 case BINDER_VERSION: { 3291 struct binder_version __user *ver = ubuf; 3292 3293 if (size != sizeof(struct binder_version)) { 3294 ret = -EINVAL; 3295 goto err; 3296 } 3297 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION, 3298 &ver->protocol_version)) { 3299 ret = -EINVAL; 3300 goto err; 3301 } 3302 break; 3303 } 3304 default: 3305 ret = -EINVAL; 3306 goto err; 3307 } 3308 ret = 0; 3309 err: 3310 if (thread) 3311 thread->looper &= ~BINDER_LOOPER_STATE_NEED_RETURN; 3312 binder_unlock(__func__); 3313 wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 3314 if (ret && ret != -ERESTARTSYS) 3315 pr_info("%d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret); 3316 err_unlocked: 3317 trace_binder_ioctl_done(ret); 3318 return ret; 3319 } 3320 3321 static void binder_vma_open(struct vm_area_struct *vma) 3322 { 3323 struct binder_proc *proc = vma->vm_private_data; 3324 3325 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 3326 "%d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 3327 proc->pid, vma->vm_start, vma->vm_end, 3328 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 3329 (unsigned long)pgprot_val(vma->vm_page_prot)); 3330 } 3331 3332 static void binder_vma_close(struct vm_area_struct *vma) 3333 { 3334 struct binder_proc *proc = vma->vm_private_data; 3335 3336 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 3337 "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 3338 proc->pid, vma->vm_start, vma->vm_end, 3339 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 3340 (unsigned long)pgprot_val(vma->vm_page_prot)); 3341 proc->vma = NULL; 3342 proc->vma_vm_mm = NULL; 3343 binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES); 3344 } 3345 3346 static int binder_vm_fault(struct vm_fault *vmf) 3347 { 3348 return VM_FAULT_SIGBUS; 3349 } 3350 3351 static const struct vm_operations_struct binder_vm_ops = { 3352 .open = binder_vma_open, 3353 .close = binder_vma_close, 3354 .fault = binder_vm_fault, 3355 }; 3356 3357 static int binder_mmap(struct file *filp, struct vm_area_struct *vma) 3358 { 3359 int ret; 3360 struct vm_struct *area; 3361 struct binder_proc *proc = filp->private_data; 3362 const char *failure_string; 3363 struct binder_buffer *buffer; 3364 3365 if (proc->tsk != current) 3366 return -EINVAL; 3367 3368 if ((vma->vm_end - vma->vm_start) > SZ_4M) 3369 vma->vm_end = vma->vm_start + SZ_4M; 3370 3371 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 3372 "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n", 3373 proc->pid, vma->vm_start, vma->vm_end, 3374 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 3375 (unsigned long)pgprot_val(vma->vm_page_prot)); 3376 3377 if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) { 3378 ret = -EPERM; 3379 failure_string = "bad vm_flags"; 3380 goto err_bad_arg; 3381 } 3382 vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE; 3383 3384 mutex_lock(&binder_mmap_lock); 3385 if (proc->buffer) { 3386 ret = -EBUSY; 3387 failure_string = "already mapped"; 3388 goto err_already_mapped; 3389 } 3390 3391 area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP); 3392 if (area == NULL) { 3393 ret = -ENOMEM; 3394 failure_string = "get_vm_area"; 3395 goto err_get_vm_area_failed; 3396 } 3397 proc->buffer = area->addr; 3398 proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer; 3399 mutex_unlock(&binder_mmap_lock); 3400 3401 #ifdef CONFIG_CPU_CACHE_VIPT 3402 if (cache_is_vipt_aliasing()) { 3403 while (CACHE_COLOUR((vma->vm_start ^ (uint32_t)proc->buffer))) { 3404 pr_info("binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer); 3405 vma->vm_start += PAGE_SIZE; 3406 } 3407 } 3408 #endif 3409 proc->pages = kzalloc(sizeof(proc->pages[0]) * ((vma->vm_end - vma->vm_start) / PAGE_SIZE), GFP_KERNEL); 3410 if (proc->pages == NULL) { 3411 ret = -ENOMEM; 3412 failure_string = "alloc page array"; 3413 goto err_alloc_pages_failed; 3414 } 3415 proc->buffer_size = vma->vm_end - vma->vm_start; 3416 3417 vma->vm_ops = &binder_vm_ops; 3418 vma->vm_private_data = proc; 3419 3420 if (binder_update_page_range(proc, 1, proc->buffer, proc->buffer + PAGE_SIZE, vma)) { 3421 ret = -ENOMEM; 3422 failure_string = "alloc small buf"; 3423 goto err_alloc_small_buf_failed; 3424 } 3425 buffer = proc->buffer; 3426 INIT_LIST_HEAD(&proc->buffers); 3427 list_add(&buffer->entry, &proc->buffers); 3428 buffer->free = 1; 3429 binder_insert_free_buffer(proc, buffer); 3430 proc->free_async_space = proc->buffer_size / 2; 3431 barrier(); 3432 proc->files = get_files_struct(current); 3433 proc->vma = vma; 3434 proc->vma_vm_mm = vma->vm_mm; 3435 3436 /*pr_info("binder_mmap: %d %lx-%lx maps %p\n", 3437 proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/ 3438 return 0; 3439 3440 err_alloc_small_buf_failed: 3441 kfree(proc->pages); 3442 proc->pages = NULL; 3443 err_alloc_pages_failed: 3444 mutex_lock(&binder_mmap_lock); 3445 vfree(proc->buffer); 3446 proc->buffer = NULL; 3447 err_get_vm_area_failed: 3448 err_already_mapped: 3449 mutex_unlock(&binder_mmap_lock); 3450 err_bad_arg: 3451 pr_err("binder_mmap: %d %lx-%lx %s failed %d\n", 3452 proc->pid, vma->vm_start, vma->vm_end, failure_string, ret); 3453 return ret; 3454 } 3455 3456 static int binder_open(struct inode *nodp, struct file *filp) 3457 { 3458 struct binder_proc *proc; 3459 struct binder_device *binder_dev; 3460 3461 binder_debug(BINDER_DEBUG_OPEN_CLOSE, "binder_open: %d:%d\n", 3462 current->group_leader->pid, current->pid); 3463 3464 proc = kzalloc(sizeof(*proc), GFP_KERNEL); 3465 if (proc == NULL) 3466 return -ENOMEM; 3467 get_task_struct(current->group_leader); 3468 proc->tsk = current->group_leader; 3469 INIT_LIST_HEAD(&proc->todo); 3470 init_waitqueue_head(&proc->wait); 3471 proc->default_priority = task_nice(current); 3472 binder_dev = container_of(filp->private_data, struct binder_device, 3473 miscdev); 3474 proc->context = &binder_dev->context; 3475 3476 binder_lock(__func__); 3477 3478 binder_stats_created(BINDER_STAT_PROC); 3479 hlist_add_head(&proc->proc_node, &binder_procs); 3480 proc->pid = current->group_leader->pid; 3481 INIT_LIST_HEAD(&proc->delivered_death); 3482 filp->private_data = proc; 3483 3484 binder_unlock(__func__); 3485 3486 if (binder_debugfs_dir_entry_proc) { 3487 char strbuf[11]; 3488 3489 snprintf(strbuf, sizeof(strbuf), "%u", proc->pid); 3490 /* 3491 * proc debug entries are shared between contexts, so 3492 * this will fail if the process tries to open the driver 3493 * again with a different context. The priting code will 3494 * anyway print all contexts that a given PID has, so this 3495 * is not a problem. 3496 */ 3497 proc->debugfs_entry = debugfs_create_file(strbuf, S_IRUGO, 3498 binder_debugfs_dir_entry_proc, 3499 (void *)(unsigned long)proc->pid, 3500 &binder_proc_fops); 3501 } 3502 3503 return 0; 3504 } 3505 3506 static int binder_flush(struct file *filp, fl_owner_t id) 3507 { 3508 struct binder_proc *proc = filp->private_data; 3509 3510 binder_defer_work(proc, BINDER_DEFERRED_FLUSH); 3511 3512 return 0; 3513 } 3514 3515 static void binder_deferred_flush(struct binder_proc *proc) 3516 { 3517 struct rb_node *n; 3518 int wake_count = 0; 3519 3520 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) { 3521 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node); 3522 3523 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN; 3524 if (thread->looper & BINDER_LOOPER_STATE_WAITING) { 3525 wake_up_interruptible(&thread->wait); 3526 wake_count++; 3527 } 3528 } 3529 wake_up_interruptible_all(&proc->wait); 3530 3531 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 3532 "binder_flush: %d woke %d threads\n", proc->pid, 3533 wake_count); 3534 } 3535 3536 static int binder_release(struct inode *nodp, struct file *filp) 3537 { 3538 struct binder_proc *proc = filp->private_data; 3539 3540 debugfs_remove(proc->debugfs_entry); 3541 binder_defer_work(proc, BINDER_DEFERRED_RELEASE); 3542 3543 return 0; 3544 } 3545 3546 static int binder_node_release(struct binder_node *node, int refs) 3547 { 3548 struct binder_ref *ref; 3549 int death = 0; 3550 3551 list_del_init(&node->work.entry); 3552 binder_release_work(&node->async_todo); 3553 3554 if (hlist_empty(&node->refs)) { 3555 kfree(node); 3556 binder_stats_deleted(BINDER_STAT_NODE); 3557 3558 return refs; 3559 } 3560 3561 node->proc = NULL; 3562 node->local_strong_refs = 0; 3563 node->local_weak_refs = 0; 3564 hlist_add_head(&node->dead_node, &binder_dead_nodes); 3565 3566 hlist_for_each_entry(ref, &node->refs, node_entry) { 3567 refs++; 3568 3569 if (!ref->death) 3570 continue; 3571 3572 death++; 3573 3574 if (list_empty(&ref->death->work.entry)) { 3575 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 3576 list_add_tail(&ref->death->work.entry, 3577 &ref->proc->todo); 3578 wake_up_interruptible(&ref->proc->wait); 3579 } else 3580 BUG(); 3581 } 3582 3583 binder_debug(BINDER_DEBUG_DEAD_BINDER, 3584 "node %d now dead, refs %d, death %d\n", 3585 node->debug_id, refs, death); 3586 3587 return refs; 3588 } 3589 3590 static void binder_deferred_release(struct binder_proc *proc) 3591 { 3592 struct binder_transaction *t; 3593 struct binder_context *context = proc->context; 3594 struct rb_node *n; 3595 int threads, nodes, incoming_refs, outgoing_refs, buffers, 3596 active_transactions, page_count; 3597 3598 BUG_ON(proc->vma); 3599 BUG_ON(proc->files); 3600 3601 hlist_del(&proc->proc_node); 3602 3603 if (context->binder_context_mgr_node && 3604 context->binder_context_mgr_node->proc == proc) { 3605 binder_debug(BINDER_DEBUG_DEAD_BINDER, 3606 "%s: %d context_mgr_node gone\n", 3607 __func__, proc->pid); 3608 context->binder_context_mgr_node = NULL; 3609 } 3610 3611 threads = 0; 3612 active_transactions = 0; 3613 while ((n = rb_first(&proc->threads))) { 3614 struct binder_thread *thread; 3615 3616 thread = rb_entry(n, struct binder_thread, rb_node); 3617 threads++; 3618 active_transactions += binder_free_thread(proc, thread); 3619 } 3620 3621 nodes = 0; 3622 incoming_refs = 0; 3623 while ((n = rb_first(&proc->nodes))) { 3624 struct binder_node *node; 3625 3626 node = rb_entry(n, struct binder_node, rb_node); 3627 nodes++; 3628 rb_erase(&node->rb_node, &proc->nodes); 3629 incoming_refs = binder_node_release(node, incoming_refs); 3630 } 3631 3632 outgoing_refs = 0; 3633 while ((n = rb_first(&proc->refs_by_desc))) { 3634 struct binder_ref *ref; 3635 3636 ref = rb_entry(n, struct binder_ref, rb_node_desc); 3637 outgoing_refs++; 3638 binder_delete_ref(ref); 3639 } 3640 3641 binder_release_work(&proc->todo); 3642 binder_release_work(&proc->delivered_death); 3643 3644 buffers = 0; 3645 while ((n = rb_first(&proc->allocated_buffers))) { 3646 struct binder_buffer *buffer; 3647 3648 buffer = rb_entry(n, struct binder_buffer, rb_node); 3649 3650 t = buffer->transaction; 3651 if (t) { 3652 t->buffer = NULL; 3653 buffer->transaction = NULL; 3654 pr_err("release proc %d, transaction %d, not freed\n", 3655 proc->pid, t->debug_id); 3656 /*BUG();*/ 3657 } 3658 3659 binder_free_buf(proc, buffer); 3660 buffers++; 3661 } 3662 3663 binder_stats_deleted(BINDER_STAT_PROC); 3664 3665 page_count = 0; 3666 if (proc->pages) { 3667 int i; 3668 3669 for (i = 0; i < proc->buffer_size / PAGE_SIZE; i++) { 3670 void *page_addr; 3671 3672 if (!proc->pages[i]) 3673 continue; 3674 3675 page_addr = proc->buffer + i * PAGE_SIZE; 3676 binder_debug(BINDER_DEBUG_BUFFER_ALLOC, 3677 "%s: %d: page %d at %p not freed\n", 3678 __func__, proc->pid, i, page_addr); 3679 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE); 3680 __free_page(proc->pages[i]); 3681 page_count++; 3682 } 3683 kfree(proc->pages); 3684 vfree(proc->buffer); 3685 } 3686 3687 put_task_struct(proc->tsk); 3688 3689 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 3690 "%s: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d, buffers %d, pages %d\n", 3691 __func__, proc->pid, threads, nodes, incoming_refs, 3692 outgoing_refs, active_transactions, buffers, page_count); 3693 3694 kfree(proc); 3695 } 3696 3697 static void binder_deferred_func(struct work_struct *work) 3698 { 3699 struct binder_proc *proc; 3700 struct files_struct *files; 3701 3702 int defer; 3703 3704 do { 3705 binder_lock(__func__); 3706 mutex_lock(&binder_deferred_lock); 3707 if (!hlist_empty(&binder_deferred_list)) { 3708 proc = hlist_entry(binder_deferred_list.first, 3709 struct binder_proc, deferred_work_node); 3710 hlist_del_init(&proc->deferred_work_node); 3711 defer = proc->deferred_work; 3712 proc->deferred_work = 0; 3713 } else { 3714 proc = NULL; 3715 defer = 0; 3716 } 3717 mutex_unlock(&binder_deferred_lock); 3718 3719 files = NULL; 3720 if (defer & BINDER_DEFERRED_PUT_FILES) { 3721 files = proc->files; 3722 if (files) 3723 proc->files = NULL; 3724 } 3725 3726 if (defer & BINDER_DEFERRED_FLUSH) 3727 binder_deferred_flush(proc); 3728 3729 if (defer & BINDER_DEFERRED_RELEASE) 3730 binder_deferred_release(proc); /* frees proc */ 3731 3732 binder_unlock(__func__); 3733 if (files) 3734 put_files_struct(files); 3735 } while (proc); 3736 } 3737 static DECLARE_WORK(binder_deferred_work, binder_deferred_func); 3738 3739 static void 3740 binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer) 3741 { 3742 mutex_lock(&binder_deferred_lock); 3743 proc->deferred_work |= defer; 3744 if (hlist_unhashed(&proc->deferred_work_node)) { 3745 hlist_add_head(&proc->deferred_work_node, 3746 &binder_deferred_list); 3747 schedule_work(&binder_deferred_work); 3748 } 3749 mutex_unlock(&binder_deferred_lock); 3750 } 3751 3752 static void print_binder_transaction(struct seq_file *m, const char *prefix, 3753 struct binder_transaction *t) 3754 { 3755 seq_printf(m, 3756 "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d", 3757 prefix, t->debug_id, t, 3758 t->from ? t->from->proc->pid : 0, 3759 t->from ? t->from->pid : 0, 3760 t->to_proc ? t->to_proc->pid : 0, 3761 t->to_thread ? t->to_thread->pid : 0, 3762 t->code, t->flags, t->priority, t->need_reply); 3763 if (t->buffer == NULL) { 3764 seq_puts(m, " buffer free\n"); 3765 return; 3766 } 3767 if (t->buffer->target_node) 3768 seq_printf(m, " node %d", 3769 t->buffer->target_node->debug_id); 3770 seq_printf(m, " size %zd:%zd data %p\n", 3771 t->buffer->data_size, t->buffer->offsets_size, 3772 t->buffer->data); 3773 } 3774 3775 static void print_binder_buffer(struct seq_file *m, const char *prefix, 3776 struct binder_buffer *buffer) 3777 { 3778 seq_printf(m, "%s %d: %p size %zd:%zd %s\n", 3779 prefix, buffer->debug_id, buffer->data, 3780 buffer->data_size, buffer->offsets_size, 3781 buffer->transaction ? "active" : "delivered"); 3782 } 3783 3784 static void print_binder_work(struct seq_file *m, const char *prefix, 3785 const char *transaction_prefix, 3786 struct binder_work *w) 3787 { 3788 struct binder_node *node; 3789 struct binder_transaction *t; 3790 3791 switch (w->type) { 3792 case BINDER_WORK_TRANSACTION: 3793 t = container_of(w, struct binder_transaction, work); 3794 print_binder_transaction(m, transaction_prefix, t); 3795 break; 3796 case BINDER_WORK_TRANSACTION_COMPLETE: 3797 seq_printf(m, "%stransaction complete\n", prefix); 3798 break; 3799 case BINDER_WORK_NODE: 3800 node = container_of(w, struct binder_node, work); 3801 seq_printf(m, "%snode work %d: u%016llx c%016llx\n", 3802 prefix, node->debug_id, 3803 (u64)node->ptr, (u64)node->cookie); 3804 break; 3805 case BINDER_WORK_DEAD_BINDER: 3806 seq_printf(m, "%shas dead binder\n", prefix); 3807 break; 3808 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 3809 seq_printf(m, "%shas cleared dead binder\n", prefix); 3810 break; 3811 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: 3812 seq_printf(m, "%shas cleared death notification\n", prefix); 3813 break; 3814 default: 3815 seq_printf(m, "%sunknown work: type %d\n", prefix, w->type); 3816 break; 3817 } 3818 } 3819 3820 static void print_binder_thread(struct seq_file *m, 3821 struct binder_thread *thread, 3822 int print_always) 3823 { 3824 struct binder_transaction *t; 3825 struct binder_work *w; 3826 size_t start_pos = m->count; 3827 size_t header_pos; 3828 3829 seq_printf(m, " thread %d: l %02x\n", thread->pid, thread->looper); 3830 header_pos = m->count; 3831 t = thread->transaction_stack; 3832 while (t) { 3833 if (t->from == thread) { 3834 print_binder_transaction(m, 3835 " outgoing transaction", t); 3836 t = t->from_parent; 3837 } else if (t->to_thread == thread) { 3838 print_binder_transaction(m, 3839 " incoming transaction", t); 3840 t = t->to_parent; 3841 } else { 3842 print_binder_transaction(m, " bad transaction", t); 3843 t = NULL; 3844 } 3845 } 3846 list_for_each_entry(w, &thread->todo, entry) { 3847 print_binder_work(m, " ", " pending transaction", w); 3848 } 3849 if (!print_always && m->count == header_pos) 3850 m->count = start_pos; 3851 } 3852 3853 static void print_binder_node(struct seq_file *m, struct binder_node *node) 3854 { 3855 struct binder_ref *ref; 3856 struct binder_work *w; 3857 int count; 3858 3859 count = 0; 3860 hlist_for_each_entry(ref, &node->refs, node_entry) 3861 count++; 3862 3863 seq_printf(m, " node %d: u%016llx c%016llx hs %d hw %d ls %d lw %d is %d iw %d", 3864 node->debug_id, (u64)node->ptr, (u64)node->cookie, 3865 node->has_strong_ref, node->has_weak_ref, 3866 node->local_strong_refs, node->local_weak_refs, 3867 node->internal_strong_refs, count); 3868 if (count) { 3869 seq_puts(m, " proc"); 3870 hlist_for_each_entry(ref, &node->refs, node_entry) 3871 seq_printf(m, " %d", ref->proc->pid); 3872 } 3873 seq_puts(m, "\n"); 3874 list_for_each_entry(w, &node->async_todo, entry) 3875 print_binder_work(m, " ", 3876 " pending async transaction", w); 3877 } 3878 3879 static void print_binder_ref(struct seq_file *m, struct binder_ref *ref) 3880 { 3881 seq_printf(m, " ref %d: desc %d %snode %d s %d w %d d %p\n", 3882 ref->debug_id, ref->desc, ref->node->proc ? "" : "dead ", 3883 ref->node->debug_id, ref->strong, ref->weak, ref->death); 3884 } 3885 3886 static void print_binder_proc(struct seq_file *m, 3887 struct binder_proc *proc, int print_all) 3888 { 3889 struct binder_work *w; 3890 struct rb_node *n; 3891 size_t start_pos = m->count; 3892 size_t header_pos; 3893 3894 seq_printf(m, "proc %d\n", proc->pid); 3895 seq_printf(m, "context %s\n", proc->context->name); 3896 header_pos = m->count; 3897 3898 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 3899 print_binder_thread(m, rb_entry(n, struct binder_thread, 3900 rb_node), print_all); 3901 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) { 3902 struct binder_node *node = rb_entry(n, struct binder_node, 3903 rb_node); 3904 if (print_all || node->has_async_transaction) 3905 print_binder_node(m, node); 3906 } 3907 if (print_all) { 3908 for (n = rb_first(&proc->refs_by_desc); 3909 n != NULL; 3910 n = rb_next(n)) 3911 print_binder_ref(m, rb_entry(n, struct binder_ref, 3912 rb_node_desc)); 3913 } 3914 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 3915 print_binder_buffer(m, " buffer", 3916 rb_entry(n, struct binder_buffer, rb_node)); 3917 list_for_each_entry(w, &proc->todo, entry) 3918 print_binder_work(m, " ", " pending transaction", w); 3919 list_for_each_entry(w, &proc->delivered_death, entry) { 3920 seq_puts(m, " has delivered dead binder\n"); 3921 break; 3922 } 3923 if (!print_all && m->count == header_pos) 3924 m->count = start_pos; 3925 } 3926 3927 static const char * const binder_return_strings[] = { 3928 "BR_ERROR", 3929 "BR_OK", 3930 "BR_TRANSACTION", 3931 "BR_REPLY", 3932 "BR_ACQUIRE_RESULT", 3933 "BR_DEAD_REPLY", 3934 "BR_TRANSACTION_COMPLETE", 3935 "BR_INCREFS", 3936 "BR_ACQUIRE", 3937 "BR_RELEASE", 3938 "BR_DECREFS", 3939 "BR_ATTEMPT_ACQUIRE", 3940 "BR_NOOP", 3941 "BR_SPAWN_LOOPER", 3942 "BR_FINISHED", 3943 "BR_DEAD_BINDER", 3944 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 3945 "BR_FAILED_REPLY" 3946 }; 3947 3948 static const char * const binder_command_strings[] = { 3949 "BC_TRANSACTION", 3950 "BC_REPLY", 3951 "BC_ACQUIRE_RESULT", 3952 "BC_FREE_BUFFER", 3953 "BC_INCREFS", 3954 "BC_ACQUIRE", 3955 "BC_RELEASE", 3956 "BC_DECREFS", 3957 "BC_INCREFS_DONE", 3958 "BC_ACQUIRE_DONE", 3959 "BC_ATTEMPT_ACQUIRE", 3960 "BC_REGISTER_LOOPER", 3961 "BC_ENTER_LOOPER", 3962 "BC_EXIT_LOOPER", 3963 "BC_REQUEST_DEATH_NOTIFICATION", 3964 "BC_CLEAR_DEATH_NOTIFICATION", 3965 "BC_DEAD_BINDER_DONE", 3966 "BC_TRANSACTION_SG", 3967 "BC_REPLY_SG", 3968 }; 3969 3970 static const char * const binder_objstat_strings[] = { 3971 "proc", 3972 "thread", 3973 "node", 3974 "ref", 3975 "death", 3976 "transaction", 3977 "transaction_complete" 3978 }; 3979 3980 static void print_binder_stats(struct seq_file *m, const char *prefix, 3981 struct binder_stats *stats) 3982 { 3983 int i; 3984 3985 BUILD_BUG_ON(ARRAY_SIZE(stats->bc) != 3986 ARRAY_SIZE(binder_command_strings)); 3987 for (i = 0; i < ARRAY_SIZE(stats->bc); i++) { 3988 if (stats->bc[i]) 3989 seq_printf(m, "%s%s: %d\n", prefix, 3990 binder_command_strings[i], stats->bc[i]); 3991 } 3992 3993 BUILD_BUG_ON(ARRAY_SIZE(stats->br) != 3994 ARRAY_SIZE(binder_return_strings)); 3995 for (i = 0; i < ARRAY_SIZE(stats->br); i++) { 3996 if (stats->br[i]) 3997 seq_printf(m, "%s%s: %d\n", prefix, 3998 binder_return_strings[i], stats->br[i]); 3999 } 4000 4001 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 4002 ARRAY_SIZE(binder_objstat_strings)); 4003 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 4004 ARRAY_SIZE(stats->obj_deleted)); 4005 for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) { 4006 if (stats->obj_created[i] || stats->obj_deleted[i]) 4007 seq_printf(m, "%s%s: active %d total %d\n", prefix, 4008 binder_objstat_strings[i], 4009 stats->obj_created[i] - stats->obj_deleted[i], 4010 stats->obj_created[i]); 4011 } 4012 } 4013 4014 static void print_binder_proc_stats(struct seq_file *m, 4015 struct binder_proc *proc) 4016 { 4017 struct binder_work *w; 4018 struct rb_node *n; 4019 int count, strong, weak; 4020 4021 seq_printf(m, "proc %d\n", proc->pid); 4022 seq_printf(m, "context %s\n", proc->context->name); 4023 count = 0; 4024 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 4025 count++; 4026 seq_printf(m, " threads: %d\n", count); 4027 seq_printf(m, " requested threads: %d+%d/%d\n" 4028 " ready threads %d\n" 4029 " free async space %zd\n", proc->requested_threads, 4030 proc->requested_threads_started, proc->max_threads, 4031 proc->ready_threads, proc->free_async_space); 4032 count = 0; 4033 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) 4034 count++; 4035 seq_printf(m, " nodes: %d\n", count); 4036 count = 0; 4037 strong = 0; 4038 weak = 0; 4039 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 4040 struct binder_ref *ref = rb_entry(n, struct binder_ref, 4041 rb_node_desc); 4042 count++; 4043 strong += ref->strong; 4044 weak += ref->weak; 4045 } 4046 seq_printf(m, " refs: %d s %d w %d\n", count, strong, weak); 4047 4048 count = 0; 4049 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n)) 4050 count++; 4051 seq_printf(m, " buffers: %d\n", count); 4052 4053 count = 0; 4054 list_for_each_entry(w, &proc->todo, entry) { 4055 switch (w->type) { 4056 case BINDER_WORK_TRANSACTION: 4057 count++; 4058 break; 4059 default: 4060 break; 4061 } 4062 } 4063 seq_printf(m, " pending transactions: %d\n", count); 4064 4065 print_binder_stats(m, " ", &proc->stats); 4066 } 4067 4068 4069 static int binder_state_show(struct seq_file *m, void *unused) 4070 { 4071 struct binder_proc *proc; 4072 struct binder_node *node; 4073 int do_lock = !binder_debug_no_lock; 4074 4075 if (do_lock) 4076 binder_lock(__func__); 4077 4078 seq_puts(m, "binder state:\n"); 4079 4080 if (!hlist_empty(&binder_dead_nodes)) 4081 seq_puts(m, "dead nodes:\n"); 4082 hlist_for_each_entry(node, &binder_dead_nodes, dead_node) 4083 print_binder_node(m, node); 4084 4085 hlist_for_each_entry(proc, &binder_procs, proc_node) 4086 print_binder_proc(m, proc, 1); 4087 if (do_lock) 4088 binder_unlock(__func__); 4089 return 0; 4090 } 4091 4092 static int binder_stats_show(struct seq_file *m, void *unused) 4093 { 4094 struct binder_proc *proc; 4095 int do_lock = !binder_debug_no_lock; 4096 4097 if (do_lock) 4098 binder_lock(__func__); 4099 4100 seq_puts(m, "binder stats:\n"); 4101 4102 print_binder_stats(m, "", &binder_stats); 4103 4104 hlist_for_each_entry(proc, &binder_procs, proc_node) 4105 print_binder_proc_stats(m, proc); 4106 if (do_lock) 4107 binder_unlock(__func__); 4108 return 0; 4109 } 4110 4111 static int binder_transactions_show(struct seq_file *m, void *unused) 4112 { 4113 struct binder_proc *proc; 4114 int do_lock = !binder_debug_no_lock; 4115 4116 if (do_lock) 4117 binder_lock(__func__); 4118 4119 seq_puts(m, "binder transactions:\n"); 4120 hlist_for_each_entry(proc, &binder_procs, proc_node) 4121 print_binder_proc(m, proc, 0); 4122 if (do_lock) 4123 binder_unlock(__func__); 4124 return 0; 4125 } 4126 4127 static int binder_proc_show(struct seq_file *m, void *unused) 4128 { 4129 struct binder_proc *itr; 4130 int pid = (unsigned long)m->private; 4131 int do_lock = !binder_debug_no_lock; 4132 4133 if (do_lock) 4134 binder_lock(__func__); 4135 4136 hlist_for_each_entry(itr, &binder_procs, proc_node) { 4137 if (itr->pid == pid) { 4138 seq_puts(m, "binder proc state:\n"); 4139 print_binder_proc(m, itr, 1); 4140 } 4141 } 4142 if (do_lock) 4143 binder_unlock(__func__); 4144 return 0; 4145 } 4146 4147 static void print_binder_transaction_log_entry(struct seq_file *m, 4148 struct binder_transaction_log_entry *e) 4149 { 4150 seq_printf(m, 4151 "%d: %s from %d:%d to %d:%d context %s node %d handle %d size %d:%d\n", 4152 e->debug_id, (e->call_type == 2) ? "reply" : 4153 ((e->call_type == 1) ? "async" : "call "), e->from_proc, 4154 e->from_thread, e->to_proc, e->to_thread, e->context_name, 4155 e->to_node, e->target_handle, e->data_size, e->offsets_size); 4156 } 4157 4158 static int binder_transaction_log_show(struct seq_file *m, void *unused) 4159 { 4160 struct binder_transaction_log *log = m->private; 4161 int i; 4162 4163 if (log->full) { 4164 for (i = log->next; i < ARRAY_SIZE(log->entry); i++) 4165 print_binder_transaction_log_entry(m, &log->entry[i]); 4166 } 4167 for (i = 0; i < log->next; i++) 4168 print_binder_transaction_log_entry(m, &log->entry[i]); 4169 return 0; 4170 } 4171 4172 static const struct file_operations binder_fops = { 4173 .owner = THIS_MODULE, 4174 .poll = binder_poll, 4175 .unlocked_ioctl = binder_ioctl, 4176 .compat_ioctl = binder_ioctl, 4177 .mmap = binder_mmap, 4178 .open = binder_open, 4179 .flush = binder_flush, 4180 .release = binder_release, 4181 }; 4182 4183 BINDER_DEBUG_ENTRY(state); 4184 BINDER_DEBUG_ENTRY(stats); 4185 BINDER_DEBUG_ENTRY(transactions); 4186 BINDER_DEBUG_ENTRY(transaction_log); 4187 4188 static int __init init_binder_device(const char *name) 4189 { 4190 int ret; 4191 struct binder_device *binder_device; 4192 4193 binder_device = kzalloc(sizeof(*binder_device), GFP_KERNEL); 4194 if (!binder_device) 4195 return -ENOMEM; 4196 4197 binder_device->miscdev.fops = &binder_fops; 4198 binder_device->miscdev.minor = MISC_DYNAMIC_MINOR; 4199 binder_device->miscdev.name = name; 4200 4201 binder_device->context.binder_context_mgr_uid = INVALID_UID; 4202 binder_device->context.name = name; 4203 4204 ret = misc_register(&binder_device->miscdev); 4205 if (ret < 0) { 4206 kfree(binder_device); 4207 return ret; 4208 } 4209 4210 hlist_add_head(&binder_device->hlist, &binder_devices); 4211 4212 return ret; 4213 } 4214 4215 static int __init binder_init(void) 4216 { 4217 int ret; 4218 char *device_name, *device_names; 4219 struct binder_device *device; 4220 struct hlist_node *tmp; 4221 4222 binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL); 4223 if (binder_debugfs_dir_entry_root) 4224 binder_debugfs_dir_entry_proc = debugfs_create_dir("proc", 4225 binder_debugfs_dir_entry_root); 4226 4227 if (binder_debugfs_dir_entry_root) { 4228 debugfs_create_file("state", 4229 S_IRUGO, 4230 binder_debugfs_dir_entry_root, 4231 NULL, 4232 &binder_state_fops); 4233 debugfs_create_file("stats", 4234 S_IRUGO, 4235 binder_debugfs_dir_entry_root, 4236 NULL, 4237 &binder_stats_fops); 4238 debugfs_create_file("transactions", 4239 S_IRUGO, 4240 binder_debugfs_dir_entry_root, 4241 NULL, 4242 &binder_transactions_fops); 4243 debugfs_create_file("transaction_log", 4244 S_IRUGO, 4245 binder_debugfs_dir_entry_root, 4246 &binder_transaction_log, 4247 &binder_transaction_log_fops); 4248 debugfs_create_file("failed_transaction_log", 4249 S_IRUGO, 4250 binder_debugfs_dir_entry_root, 4251 &binder_transaction_log_failed, 4252 &binder_transaction_log_fops); 4253 } 4254 4255 /* 4256 * Copy the module_parameter string, because we don't want to 4257 * tokenize it in-place. 4258 */ 4259 device_names = kzalloc(strlen(binder_devices_param) + 1, GFP_KERNEL); 4260 if (!device_names) { 4261 ret = -ENOMEM; 4262 goto err_alloc_device_names_failed; 4263 } 4264 strcpy(device_names, binder_devices_param); 4265 4266 while ((device_name = strsep(&device_names, ","))) { 4267 ret = init_binder_device(device_name); 4268 if (ret) 4269 goto err_init_binder_device_failed; 4270 } 4271 4272 return ret; 4273 4274 err_init_binder_device_failed: 4275 hlist_for_each_entry_safe(device, tmp, &binder_devices, hlist) { 4276 misc_deregister(&device->miscdev); 4277 hlist_del(&device->hlist); 4278 kfree(device); 4279 } 4280 err_alloc_device_names_failed: 4281 debugfs_remove_recursive(binder_debugfs_dir_entry_root); 4282 4283 return ret; 4284 } 4285 4286 device_initcall(binder_init); 4287 4288 #define CREATE_TRACE_POINTS 4289 #include "binder_trace.h" 4290 4291 MODULE_LICENSE("GPL v2"); 4292