1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
53
54#include <asm/cacheflush.h>
55#include <linux/fdtable.h>
56#include <linux/file.h>
57#include <linux/freezer.h>
58#include <linux/fs.h>
59#include <linux/list.h>
60#include <linux/miscdevice.h>
61#include <linux/module.h>
62#include <linux/mutex.h>
63#include <linux/nsproxy.h>
64#include <linux/poll.h>
65#include <linux/debugfs.h>
66#include <linux/rbtree.h>
67#include <linux/sched/signal.h>
68#include <linux/sched/mm.h>
69#include <linux/seq_file.h>
70#include <linux/uaccess.h>
71#include <linux/pid_namespace.h>
72#include <linux/security.h>
73#include <linux/spinlock.h>
74
75#ifdef CONFIG_ANDROID_BINDER_IPC_32BIT
76#define BINDER_IPC_32BIT 1
77#endif
78
79#include <uapi/linux/android/binder.h>
80#include "binder_alloc.h"
81#include "binder_trace.h"
82
83static HLIST_HEAD(binder_deferred_list);
84static DEFINE_MUTEX(binder_deferred_lock);
85
86static HLIST_HEAD(binder_devices);
87static HLIST_HEAD(binder_procs);
88static DEFINE_MUTEX(binder_procs_lock);
89
90static HLIST_HEAD(binder_dead_nodes);
91static DEFINE_SPINLOCK(binder_dead_nodes_lock);
92
93static struct dentry *binder_debugfs_dir_entry_root;
94static struct dentry *binder_debugfs_dir_entry_proc;
95static atomic_t binder_last_id;
96
97#define BINDER_DEBUG_ENTRY(name) \
98static int binder_##name##_open(struct inode *inode, struct file *file) \
99{ \
100 return single_open(file, binder_##name##_show, inode->i_private); \
101} \
102\
103static const struct file_operations binder_##name##_fops = { \
104 .owner = THIS_MODULE, \
105 .open = binder_##name##_open, \
106 .read = seq_read, \
107 .llseek = seq_lseek, \
108 .release = single_release, \
109}
110
111static int binder_proc_show(struct seq_file *m, void *unused);
112BINDER_DEBUG_ENTRY(proc);
113
114
115#ifndef SZ_1K
116#define SZ_1K 0x400
117#endif
118
119#ifndef SZ_4M
120#define SZ_4M 0x400000
121#endif
122
123#define FORBIDDEN_MMAP_FLAGS (VM_WRITE)
124
125enum {
126 BINDER_DEBUG_USER_ERROR = 1U << 0,
127 BINDER_DEBUG_FAILED_TRANSACTION = 1U << 1,
128 BINDER_DEBUG_DEAD_TRANSACTION = 1U << 2,
129 BINDER_DEBUG_OPEN_CLOSE = 1U << 3,
130 BINDER_DEBUG_DEAD_BINDER = 1U << 4,
131 BINDER_DEBUG_DEATH_NOTIFICATION = 1U << 5,
132 BINDER_DEBUG_READ_WRITE = 1U << 6,
133 BINDER_DEBUG_USER_REFS = 1U << 7,
134 BINDER_DEBUG_THREADS = 1U << 8,
135 BINDER_DEBUG_TRANSACTION = 1U << 9,
136 BINDER_DEBUG_TRANSACTION_COMPLETE = 1U << 10,
137 BINDER_DEBUG_FREE_BUFFER = 1U << 11,
138 BINDER_DEBUG_INTERNAL_REFS = 1U << 12,
139 BINDER_DEBUG_PRIORITY_CAP = 1U << 13,
140 BINDER_DEBUG_SPINLOCKS = 1U << 14,
141};
142static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR |
143 BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION;
144module_param_named(debug_mask, binder_debug_mask, uint, 0644);
145
146static char *binder_devices_param = CONFIG_ANDROID_BINDER_DEVICES;
147module_param_named(devices, binder_devices_param, charp, 0444);
148
149static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait);
150static int binder_stop_on_user_error;
151
152static int binder_set_stop_on_user_error(const char *val,
153 const struct kernel_param *kp)
154{
155 int ret;
156
157 ret = param_set_int(val, kp);
158 if (binder_stop_on_user_error < 2)
159 wake_up(&binder_user_error_wait);
160 return ret;
161}
162module_param_call(stop_on_user_error, binder_set_stop_on_user_error,
163 param_get_int, &binder_stop_on_user_error, 0644);
164
165#define binder_debug(mask, x...) \
166 do { \
167 if (binder_debug_mask & mask) \
168 pr_info(x); \
169 } while (0)
170
171#define binder_user_error(x...) \
172 do { \
173 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \
174 pr_info(x); \
175 if (binder_stop_on_user_error) \
176 binder_stop_on_user_error = 2; \
177 } while (0)
178
179#define to_flat_binder_object(hdr) \
180 container_of(hdr, struct flat_binder_object, hdr)
181
182#define to_binder_fd_object(hdr) container_of(hdr, struct binder_fd_object, hdr)
183
184#define to_binder_buffer_object(hdr) \
185 container_of(hdr, struct binder_buffer_object, hdr)
186
187#define to_binder_fd_array_object(hdr) \
188 container_of(hdr, struct binder_fd_array_object, hdr)
189
190enum binder_stat_types {
191 BINDER_STAT_PROC,
192 BINDER_STAT_THREAD,
193 BINDER_STAT_NODE,
194 BINDER_STAT_REF,
195 BINDER_STAT_DEATH,
196 BINDER_STAT_TRANSACTION,
197 BINDER_STAT_TRANSACTION_COMPLETE,
198 BINDER_STAT_COUNT
199};
200
201struct binder_stats {
202 atomic_t br[_IOC_NR(BR_FAILED_REPLY) + 1];
203 atomic_t bc[_IOC_NR(BC_REPLY_SG) + 1];
204 atomic_t obj_created[BINDER_STAT_COUNT];
205 atomic_t obj_deleted[BINDER_STAT_COUNT];
206};
207
208static struct binder_stats binder_stats;
209
210static inline void binder_stats_deleted(enum binder_stat_types type)
211{
212 atomic_inc(&binder_stats.obj_deleted[type]);
213}
214
215static inline void binder_stats_created(enum binder_stat_types type)
216{
217 atomic_inc(&binder_stats.obj_created[type]);
218}
219
220struct binder_transaction_log_entry {
221 int debug_id;
222 int debug_id_done;
223 int call_type;
224 int from_proc;
225 int from_thread;
226 int target_handle;
227 int to_proc;
228 int to_thread;
229 int to_node;
230 int data_size;
231 int offsets_size;
232 int return_error_line;
233 uint32_t return_error;
234 uint32_t return_error_param;
235 const char *context_name;
236};
237struct binder_transaction_log {
238 atomic_t cur;
239 bool full;
240 struct binder_transaction_log_entry entry[32];
241};
242static struct binder_transaction_log binder_transaction_log;
243static struct binder_transaction_log binder_transaction_log_failed;
244
245static struct binder_transaction_log_entry *binder_transaction_log_add(
246 struct binder_transaction_log *log)
247{
248 struct binder_transaction_log_entry *e;
249 unsigned int cur = atomic_inc_return(&log->cur);
250
251 if (cur >= ARRAY_SIZE(log->entry))
252 log->full = true;
253 e = &log->entry[cur % ARRAY_SIZE(log->entry)];
254 WRITE_ONCE(e->debug_id_done, 0);
255
256
257
258
259
260 smp_wmb();
261 memset(e, 0, sizeof(*e));
262 return e;
263}
264
265struct binder_context {
266 struct binder_node *binder_context_mgr_node;
267 struct mutex context_mgr_node_lock;
268
269 kuid_t binder_context_mgr_uid;
270 const char *name;
271};
272
273struct binder_device {
274 struct hlist_node hlist;
275 struct miscdevice miscdev;
276 struct binder_context context;
277};
278
279
280
281
282
283
284
285
286struct binder_work {
287 struct list_head entry;
288
289 enum {
290 BINDER_WORK_TRANSACTION = 1,
291 BINDER_WORK_TRANSACTION_COMPLETE,
292 BINDER_WORK_RETURN_ERROR,
293 BINDER_WORK_NODE,
294 BINDER_WORK_DEAD_BINDER,
295 BINDER_WORK_DEAD_BINDER_AND_CLEAR,
296 BINDER_WORK_CLEAR_DEATH_NOTIFICATION,
297 } type;
298};
299
300struct binder_error {
301 struct binder_work work;
302 uint32_t cmd;
303};
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363struct binder_node {
364 int debug_id;
365 spinlock_t lock;
366 struct binder_work work;
367 union {
368 struct rb_node rb_node;
369 struct hlist_node dead_node;
370 };
371 struct binder_proc *proc;
372 struct hlist_head refs;
373 int internal_strong_refs;
374 int local_weak_refs;
375 int local_strong_refs;
376 int tmp_refs;
377 binder_uintptr_t ptr;
378 binder_uintptr_t cookie;
379 struct {
380
381
382
383
384 u8 has_strong_ref:1;
385 u8 pending_strong_ref:1;
386 u8 has_weak_ref:1;
387 u8 pending_weak_ref:1;
388 };
389 struct {
390
391
392
393 u8 accept_fds:1;
394 u8 min_priority;
395 };
396 bool has_async_transaction;
397 struct list_head async_todo;
398};
399
400struct binder_ref_death {
401
402
403
404
405
406 struct binder_work work;
407 binder_uintptr_t cookie;
408};
409
410
411
412
413
414
415
416
417
418
419
420
421
422struct binder_ref_data {
423 int debug_id;
424 uint32_t desc;
425 int strong;
426 int weak;
427};
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446struct binder_ref {
447
448
449
450
451 struct binder_ref_data data;
452 struct rb_node rb_node_desc;
453 struct rb_node rb_node_node;
454 struct hlist_node node_entry;
455 struct binder_proc *proc;
456 struct binder_node *node;
457 struct binder_ref_death *death;
458};
459
460enum binder_deferred_state {
461 BINDER_DEFERRED_PUT_FILES = 0x01,
462 BINDER_DEFERRED_FLUSH = 0x02,
463 BINDER_DEFERRED_RELEASE = 0x04,
464};
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522struct binder_proc {
523 struct hlist_node proc_node;
524 struct rb_root threads;
525 struct rb_root nodes;
526 struct rb_root refs_by_desc;
527 struct rb_root refs_by_node;
528 struct list_head waiting_threads;
529 int pid;
530 struct task_struct *tsk;
531 struct files_struct *files;
532 struct mutex files_lock;
533 struct hlist_node deferred_work_node;
534 int deferred_work;
535 bool is_dead;
536
537 struct list_head todo;
538 struct binder_stats stats;
539 struct list_head delivered_death;
540 int max_threads;
541 int requested_threads;
542 int requested_threads_started;
543 int tmp_ref;
544 long default_priority;
545 struct dentry *debugfs_entry;
546 struct binder_alloc alloc;
547 struct binder_context *context;
548 spinlock_t inner_lock;
549 spinlock_t outer_lock;
550};
551
552enum {
553 BINDER_LOOPER_STATE_REGISTERED = 0x01,
554 BINDER_LOOPER_STATE_ENTERED = 0x02,
555 BINDER_LOOPER_STATE_EXITED = 0x04,
556 BINDER_LOOPER_STATE_INVALID = 0x08,
557 BINDER_LOOPER_STATE_WAITING = 0x10,
558 BINDER_LOOPER_STATE_POLL = 0x20,
559};
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597struct binder_thread {
598 struct binder_proc *proc;
599 struct rb_node rb_node;
600 struct list_head waiting_thread_node;
601 int pid;
602 int looper;
603 bool looper_need_return;
604 struct binder_transaction *transaction_stack;
605 struct list_head todo;
606 bool process_todo;
607 struct binder_error return_error;
608 struct binder_error reply_error;
609 wait_queue_head_t wait;
610 struct binder_stats stats;
611 atomic_t tmp_ref;
612 bool is_dead;
613};
614
615struct binder_transaction {
616 int debug_id;
617 struct binder_work work;
618 struct binder_thread *from;
619 struct binder_transaction *from_parent;
620 struct binder_proc *to_proc;
621 struct binder_thread *to_thread;
622 struct binder_transaction *to_parent;
623 unsigned need_reply:1;
624
625
626 struct binder_buffer *buffer;
627 unsigned int code;
628 unsigned int flags;
629 long priority;
630 long saved_priority;
631 kuid_t sender_euid;
632
633
634
635
636
637
638 spinlock_t lock;
639};
640
641
642
643
644
645
646
647
648#define binder_proc_lock(proc) _binder_proc_lock(proc, __LINE__)
649static void
650_binder_proc_lock(struct binder_proc *proc, int line)
651{
652 binder_debug(BINDER_DEBUG_SPINLOCKS,
653 "%s: line=%d\n", __func__, line);
654 spin_lock(&proc->outer_lock);
655}
656
657
658
659
660
661
662
663#define binder_proc_unlock(_proc) _binder_proc_unlock(_proc, __LINE__)
664static void
665_binder_proc_unlock(struct binder_proc *proc, int line)
666{
667 binder_debug(BINDER_DEBUG_SPINLOCKS,
668 "%s: line=%d\n", __func__, line);
669 spin_unlock(&proc->outer_lock);
670}
671
672
673
674
675
676
677
678#define binder_inner_proc_lock(proc) _binder_inner_proc_lock(proc, __LINE__)
679static void
680_binder_inner_proc_lock(struct binder_proc *proc, int line)
681{
682 binder_debug(BINDER_DEBUG_SPINLOCKS,
683 "%s: line=%d\n", __func__, line);
684 spin_lock(&proc->inner_lock);
685}
686
687
688
689
690
691
692
693#define binder_inner_proc_unlock(proc) _binder_inner_proc_unlock(proc, __LINE__)
694static void
695_binder_inner_proc_unlock(struct binder_proc *proc, int line)
696{
697 binder_debug(BINDER_DEBUG_SPINLOCKS,
698 "%s: line=%d\n", __func__, line);
699 spin_unlock(&proc->inner_lock);
700}
701
702
703
704
705
706
707
708#define binder_node_lock(node) _binder_node_lock(node, __LINE__)
709static void
710_binder_node_lock(struct binder_node *node, int line)
711{
712 binder_debug(BINDER_DEBUG_SPINLOCKS,
713 "%s: line=%d\n", __func__, line);
714 spin_lock(&node->lock);
715}
716
717
718
719
720
721
722
723#define binder_node_unlock(node) _binder_node_unlock(node, __LINE__)
724static void
725_binder_node_unlock(struct binder_node *node, int line)
726{
727 binder_debug(BINDER_DEBUG_SPINLOCKS,
728 "%s: line=%d\n", __func__, line);
729 spin_unlock(&node->lock);
730}
731
732
733
734
735
736
737
738
739#define binder_node_inner_lock(node) _binder_node_inner_lock(node, __LINE__)
740static void
741_binder_node_inner_lock(struct binder_node *node, int line)
742{
743 binder_debug(BINDER_DEBUG_SPINLOCKS,
744 "%s: line=%d\n", __func__, line);
745 spin_lock(&node->lock);
746 if (node->proc)
747 binder_inner_proc_lock(node->proc);
748}
749
750
751
752
753
754
755
756#define binder_node_inner_unlock(node) _binder_node_inner_unlock(node, __LINE__)
757static void
758_binder_node_inner_unlock(struct binder_node *node, int line)
759{
760 struct binder_proc *proc = node->proc;
761
762 binder_debug(BINDER_DEBUG_SPINLOCKS,
763 "%s: line=%d\n", __func__, line);
764 if (proc)
765 binder_inner_proc_unlock(proc);
766 spin_unlock(&node->lock);
767}
768
769static bool binder_worklist_empty_ilocked(struct list_head *list)
770{
771 return list_empty(list);
772}
773
774
775
776
777
778
779
780
781static bool binder_worklist_empty(struct binder_proc *proc,
782 struct list_head *list)
783{
784 bool ret;
785
786 binder_inner_proc_lock(proc);
787 ret = binder_worklist_empty_ilocked(list);
788 binder_inner_proc_unlock(proc);
789 return ret;
790}
791
792
793
794
795
796
797
798
799
800
801
802static void
803binder_enqueue_work_ilocked(struct binder_work *work,
804 struct list_head *target_list)
805{
806 BUG_ON(target_list == NULL);
807 BUG_ON(work->entry.next && !list_empty(&work->entry));
808 list_add_tail(&work->entry, target_list);
809}
810
811
812
813
814
815
816
817
818
819
820
821
822static void
823binder_enqueue_deferred_thread_work_ilocked(struct binder_thread *thread,
824 struct binder_work *work)
825{
826 binder_enqueue_work_ilocked(work, &thread->todo);
827}
828
829
830
831
832
833
834
835
836
837
838
839static void
840binder_enqueue_thread_work_ilocked(struct binder_thread *thread,
841 struct binder_work *work)
842{
843 binder_enqueue_work_ilocked(work, &thread->todo);
844 thread->process_todo = true;
845}
846
847
848
849
850
851
852
853
854
855static void
856binder_enqueue_thread_work(struct binder_thread *thread,
857 struct binder_work *work)
858{
859 binder_inner_proc_lock(thread->proc);
860 binder_enqueue_thread_work_ilocked(thread, work);
861 binder_inner_proc_unlock(thread->proc);
862}
863
864static void
865binder_dequeue_work_ilocked(struct binder_work *work)
866{
867 list_del_init(&work->entry);
868}
869
870
871
872
873
874
875
876
877
878static void
879binder_dequeue_work(struct binder_proc *proc, struct binder_work *work)
880{
881 binder_inner_proc_lock(proc);
882 binder_dequeue_work_ilocked(work);
883 binder_inner_proc_unlock(proc);
884}
885
886static struct binder_work *binder_dequeue_work_head_ilocked(
887 struct list_head *list)
888{
889 struct binder_work *w;
890
891 w = list_first_entry_or_null(list, struct binder_work, entry);
892 if (w)
893 list_del_init(&w->entry);
894 return w;
895}
896
897
898
899
900
901
902
903
904
905
906static struct binder_work *binder_dequeue_work_head(
907 struct binder_proc *proc,
908 struct list_head *list)
909{
910 struct binder_work *w;
911
912 binder_inner_proc_lock(proc);
913 w = binder_dequeue_work_head_ilocked(list);
914 binder_inner_proc_unlock(proc);
915 return w;
916}
917
918static void
919binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer);
920static void binder_free_thread(struct binder_thread *thread);
921static void binder_free_proc(struct binder_proc *proc);
922static void binder_inc_node_tmpref_ilocked(struct binder_node *node);
923
924static int task_get_unused_fd_flags(struct binder_proc *proc, int flags)
925{
926 unsigned long rlim_cur;
927 unsigned long irqs;
928 int ret;
929
930 mutex_lock(&proc->files_lock);
931 if (proc->files == NULL) {
932 ret = -ESRCH;
933 goto err;
934 }
935 if (!lock_task_sighand(proc->tsk, &irqs)) {
936 ret = -EMFILE;
937 goto err;
938 }
939 rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE);
940 unlock_task_sighand(proc->tsk, &irqs);
941
942 ret = __alloc_fd(proc->files, 0, rlim_cur, flags);
943err:
944 mutex_unlock(&proc->files_lock);
945 return ret;
946}
947
948
949
950
951static void task_fd_install(
952 struct binder_proc *proc, unsigned int fd, struct file *file)
953{
954 mutex_lock(&proc->files_lock);
955 if (proc->files)
956 __fd_install(proc->files, fd, file);
957 mutex_unlock(&proc->files_lock);
958}
959
960
961
962
963static long task_close_fd(struct binder_proc *proc, unsigned int fd)
964{
965 int retval;
966
967 mutex_lock(&proc->files_lock);
968 if (proc->files == NULL) {
969 retval = -ESRCH;
970 goto err;
971 }
972 retval = __close_fd(proc->files, fd);
973
974 if (unlikely(retval == -ERESTARTSYS ||
975 retval == -ERESTARTNOINTR ||
976 retval == -ERESTARTNOHAND ||
977 retval == -ERESTART_RESTARTBLOCK))
978 retval = -EINTR;
979err:
980 mutex_unlock(&proc->files_lock);
981 return retval;
982}
983
984static bool binder_has_work_ilocked(struct binder_thread *thread,
985 bool do_proc_work)
986{
987 return thread->process_todo ||
988 thread->looper_need_return ||
989 (do_proc_work &&
990 !binder_worklist_empty_ilocked(&thread->proc->todo));
991}
992
993static bool binder_has_work(struct binder_thread *thread, bool do_proc_work)
994{
995 bool has_work;
996
997 binder_inner_proc_lock(thread->proc);
998 has_work = binder_has_work_ilocked(thread, do_proc_work);
999 binder_inner_proc_unlock(thread->proc);
1000
1001 return has_work;
1002}
1003
1004static bool binder_available_for_proc_work_ilocked(struct binder_thread *thread)
1005{
1006 return !thread->transaction_stack &&
1007 binder_worklist_empty_ilocked(&thread->todo) &&
1008 (thread->looper & (BINDER_LOOPER_STATE_ENTERED |
1009 BINDER_LOOPER_STATE_REGISTERED));
1010}
1011
1012static void binder_wakeup_poll_threads_ilocked(struct binder_proc *proc,
1013 bool sync)
1014{
1015 struct rb_node *n;
1016 struct binder_thread *thread;
1017
1018 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) {
1019 thread = rb_entry(n, struct binder_thread, rb_node);
1020 if (thread->looper & BINDER_LOOPER_STATE_POLL &&
1021 binder_available_for_proc_work_ilocked(thread)) {
1022 if (sync)
1023 wake_up_interruptible_sync(&thread->wait);
1024 else
1025 wake_up_interruptible(&thread->wait);
1026 }
1027 }
1028}
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042static struct binder_thread *
1043binder_select_thread_ilocked(struct binder_proc *proc)
1044{
1045 struct binder_thread *thread;
1046
1047 assert_spin_locked(&proc->inner_lock);
1048 thread = list_first_entry_or_null(&proc->waiting_threads,
1049 struct binder_thread,
1050 waiting_thread_node);
1051
1052 if (thread)
1053 list_del_init(&thread->waiting_thread_node);
1054
1055 return thread;
1056}
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074static void binder_wakeup_thread_ilocked(struct binder_proc *proc,
1075 struct binder_thread *thread,
1076 bool sync)
1077{
1078 assert_spin_locked(&proc->inner_lock);
1079
1080 if (thread) {
1081 if (sync)
1082 wake_up_interruptible_sync(&thread->wait);
1083 else
1084 wake_up_interruptible(&thread->wait);
1085 return;
1086 }
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101 binder_wakeup_poll_threads_ilocked(proc, sync);
1102}
1103
1104static void binder_wakeup_proc_ilocked(struct binder_proc *proc)
1105{
1106 struct binder_thread *thread = binder_select_thread_ilocked(proc);
1107
1108 binder_wakeup_thread_ilocked(proc, thread, false);
1109}
1110
1111static void binder_set_nice(long nice)
1112{
1113 long min_nice;
1114
1115 if (can_nice(current, nice)) {
1116 set_user_nice(current, nice);
1117 return;
1118 }
1119 min_nice = rlimit_to_nice(rlimit(RLIMIT_NICE));
1120 binder_debug(BINDER_DEBUG_PRIORITY_CAP,
1121 "%d: nice value %ld not allowed use %ld instead\n",
1122 current->pid, nice, min_nice);
1123 set_user_nice(current, min_nice);
1124 if (min_nice <= MAX_NICE)
1125 return;
1126 binder_user_error("%d RLIMIT_NICE not set\n", current->pid);
1127}
1128
1129static struct binder_node *binder_get_node_ilocked(struct binder_proc *proc,
1130 binder_uintptr_t ptr)
1131{
1132 struct rb_node *n = proc->nodes.rb_node;
1133 struct binder_node *node;
1134
1135 assert_spin_locked(&proc->inner_lock);
1136
1137 while (n) {
1138 node = rb_entry(n, struct binder_node, rb_node);
1139
1140 if (ptr < node->ptr)
1141 n = n->rb_left;
1142 else if (ptr > node->ptr)
1143 n = n->rb_right;
1144 else {
1145
1146
1147
1148
1149
1150 binder_inc_node_tmpref_ilocked(node);
1151 return node;
1152 }
1153 }
1154 return NULL;
1155}
1156
1157static struct binder_node *binder_get_node(struct binder_proc *proc,
1158 binder_uintptr_t ptr)
1159{
1160 struct binder_node *node;
1161
1162 binder_inner_proc_lock(proc);
1163 node = binder_get_node_ilocked(proc, ptr);
1164 binder_inner_proc_unlock(proc);
1165 return node;
1166}
1167
1168static struct binder_node *binder_init_node_ilocked(
1169 struct binder_proc *proc,
1170 struct binder_node *new_node,
1171 struct flat_binder_object *fp)
1172{
1173 struct rb_node **p = &proc->nodes.rb_node;
1174 struct rb_node *parent = NULL;
1175 struct binder_node *node;
1176 binder_uintptr_t ptr = fp ? fp->binder : 0;
1177 binder_uintptr_t cookie = fp ? fp->cookie : 0;
1178 __u32 flags = fp ? fp->flags : 0;
1179
1180 assert_spin_locked(&proc->inner_lock);
1181
1182 while (*p) {
1183
1184 parent = *p;
1185 node = rb_entry(parent, struct binder_node, rb_node);
1186
1187 if (ptr < node->ptr)
1188 p = &(*p)->rb_left;
1189 else if (ptr > node->ptr)
1190 p = &(*p)->rb_right;
1191 else {
1192
1193
1194
1195
1196
1197 binder_inc_node_tmpref_ilocked(node);
1198 return node;
1199 }
1200 }
1201 node = new_node;
1202 binder_stats_created(BINDER_STAT_NODE);
1203 node->tmp_refs++;
1204 rb_link_node(&node->rb_node, parent, p);
1205 rb_insert_color(&node->rb_node, &proc->nodes);
1206 node->debug_id = atomic_inc_return(&binder_last_id);
1207 node->proc = proc;
1208 node->ptr = ptr;
1209 node->cookie = cookie;
1210 node->work.type = BINDER_WORK_NODE;
1211 node->min_priority = flags & FLAT_BINDER_FLAG_PRIORITY_MASK;
1212 node->accept_fds = !!(flags & FLAT_BINDER_FLAG_ACCEPTS_FDS);
1213 spin_lock_init(&node->lock);
1214 INIT_LIST_HEAD(&node->work.entry);
1215 INIT_LIST_HEAD(&node->async_todo);
1216 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1217 "%d:%d node %d u%016llx c%016llx created\n",
1218 proc->pid, current->pid, node->debug_id,
1219 (u64)node->ptr, (u64)node->cookie);
1220
1221 return node;
1222}
1223
1224static struct binder_node *binder_new_node(struct binder_proc *proc,
1225 struct flat_binder_object *fp)
1226{
1227 struct binder_node *node;
1228 struct binder_node *new_node = kzalloc(sizeof(*node), GFP_KERNEL);
1229
1230 if (!new_node)
1231 return NULL;
1232 binder_inner_proc_lock(proc);
1233 node = binder_init_node_ilocked(proc, new_node, fp);
1234 binder_inner_proc_unlock(proc);
1235 if (node != new_node)
1236
1237
1238
1239 kfree(new_node);
1240
1241 return node;
1242}
1243
1244static void binder_free_node(struct binder_node *node)
1245{
1246 kfree(node);
1247 binder_stats_deleted(BINDER_STAT_NODE);
1248}
1249
1250static int binder_inc_node_nilocked(struct binder_node *node, int strong,
1251 int internal,
1252 struct list_head *target_list)
1253{
1254 struct binder_proc *proc = node->proc;
1255
1256 assert_spin_locked(&node->lock);
1257 if (proc)
1258 assert_spin_locked(&proc->inner_lock);
1259 if (strong) {
1260 if (internal) {
1261 if (target_list == NULL &&
1262 node->internal_strong_refs == 0 &&
1263 !(node->proc &&
1264 node == node->proc->context->binder_context_mgr_node &&
1265 node->has_strong_ref)) {
1266 pr_err("invalid inc strong node for %d\n",
1267 node->debug_id);
1268 return -EINVAL;
1269 }
1270 node->internal_strong_refs++;
1271 } else
1272 node->local_strong_refs++;
1273 if (!node->has_strong_ref && target_list) {
1274 binder_dequeue_work_ilocked(&node->work);
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286 binder_enqueue_work_ilocked(&node->work, target_list);
1287 }
1288 } else {
1289 if (!internal)
1290 node->local_weak_refs++;
1291 if (!node->has_weak_ref && list_empty(&node->work.entry)) {
1292 if (target_list == NULL) {
1293 pr_err("invalid inc weak node for %d\n",
1294 node->debug_id);
1295 return -EINVAL;
1296 }
1297
1298
1299
1300 binder_enqueue_work_ilocked(&node->work, target_list);
1301 }
1302 }
1303 return 0;
1304}
1305
1306static int binder_inc_node(struct binder_node *node, int strong, int internal,
1307 struct list_head *target_list)
1308{
1309 int ret;
1310
1311 binder_node_inner_lock(node);
1312 ret = binder_inc_node_nilocked(node, strong, internal, target_list);
1313 binder_node_inner_unlock(node);
1314
1315 return ret;
1316}
1317
1318static bool binder_dec_node_nilocked(struct binder_node *node,
1319 int strong, int internal)
1320{
1321 struct binder_proc *proc = node->proc;
1322
1323 assert_spin_locked(&node->lock);
1324 if (proc)
1325 assert_spin_locked(&proc->inner_lock);
1326 if (strong) {
1327 if (internal)
1328 node->internal_strong_refs--;
1329 else
1330 node->local_strong_refs--;
1331 if (node->local_strong_refs || node->internal_strong_refs)
1332 return false;
1333 } else {
1334 if (!internal)
1335 node->local_weak_refs--;
1336 if (node->local_weak_refs || node->tmp_refs ||
1337 !hlist_empty(&node->refs))
1338 return false;
1339 }
1340
1341 if (proc && (node->has_strong_ref || node->has_weak_ref)) {
1342 if (list_empty(&node->work.entry)) {
1343 binder_enqueue_work_ilocked(&node->work, &proc->todo);
1344 binder_wakeup_proc_ilocked(proc);
1345 }
1346 } else {
1347 if (hlist_empty(&node->refs) && !node->local_strong_refs &&
1348 !node->local_weak_refs && !node->tmp_refs) {
1349 if (proc) {
1350 binder_dequeue_work_ilocked(&node->work);
1351 rb_erase(&node->rb_node, &proc->nodes);
1352 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1353 "refless node %d deleted\n",
1354 node->debug_id);
1355 } else {
1356 BUG_ON(!list_empty(&node->work.entry));
1357 spin_lock(&binder_dead_nodes_lock);
1358
1359
1360
1361
1362 if (node->tmp_refs) {
1363 spin_unlock(&binder_dead_nodes_lock);
1364 return false;
1365 }
1366 hlist_del(&node->dead_node);
1367 spin_unlock(&binder_dead_nodes_lock);
1368 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1369 "dead node %d deleted\n",
1370 node->debug_id);
1371 }
1372 return true;
1373 }
1374 }
1375 return false;
1376}
1377
1378static void binder_dec_node(struct binder_node *node, int strong, int internal)
1379{
1380 bool free_node;
1381
1382 binder_node_inner_lock(node);
1383 free_node = binder_dec_node_nilocked(node, strong, internal);
1384 binder_node_inner_unlock(node);
1385 if (free_node)
1386 binder_free_node(node);
1387}
1388
1389static void binder_inc_node_tmpref_ilocked(struct binder_node *node)
1390{
1391
1392
1393
1394
1395
1396 node->tmp_refs++;
1397}
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411
1412static void binder_inc_node_tmpref(struct binder_node *node)
1413{
1414 binder_node_lock(node);
1415 if (node->proc)
1416 binder_inner_proc_lock(node->proc);
1417 else
1418 spin_lock(&binder_dead_nodes_lock);
1419 binder_inc_node_tmpref_ilocked(node);
1420 if (node->proc)
1421 binder_inner_proc_unlock(node->proc);
1422 else
1423 spin_unlock(&binder_dead_nodes_lock);
1424 binder_node_unlock(node);
1425}
1426
1427
1428
1429
1430
1431
1432
1433static void binder_dec_node_tmpref(struct binder_node *node)
1434{
1435 bool free_node;
1436
1437 binder_node_inner_lock(node);
1438 if (!node->proc)
1439 spin_lock(&binder_dead_nodes_lock);
1440 node->tmp_refs--;
1441 BUG_ON(node->tmp_refs < 0);
1442 if (!node->proc)
1443 spin_unlock(&binder_dead_nodes_lock);
1444
1445
1446
1447
1448
1449
1450 free_node = binder_dec_node_nilocked(node, 0, 1);
1451 binder_node_inner_unlock(node);
1452 if (free_node)
1453 binder_free_node(node);
1454}
1455
1456static void binder_put_node(struct binder_node *node)
1457{
1458 binder_dec_node_tmpref(node);
1459}
1460
1461static struct binder_ref *binder_get_ref_olocked(struct binder_proc *proc,
1462 u32 desc, bool need_strong_ref)
1463{
1464 struct rb_node *n = proc->refs_by_desc.rb_node;
1465 struct binder_ref *ref;
1466
1467 while (n) {
1468 ref = rb_entry(n, struct binder_ref, rb_node_desc);
1469
1470 if (desc < ref->data.desc) {
1471 n = n->rb_left;
1472 } else if (desc > ref->data.desc) {
1473 n = n->rb_right;
1474 } else if (need_strong_ref && !ref->data.strong) {
1475 binder_user_error("tried to use weak ref as strong ref\n");
1476 return NULL;
1477 } else {
1478 return ref;
1479 }
1480 }
1481 return NULL;
1482}
1483
1484
1485
1486
1487
1488
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502static struct binder_ref *binder_get_ref_for_node_olocked(
1503 struct binder_proc *proc,
1504 struct binder_node *node,
1505 struct binder_ref *new_ref)
1506{
1507 struct binder_context *context = proc->context;
1508 struct rb_node **p = &proc->refs_by_node.rb_node;
1509 struct rb_node *parent = NULL;
1510 struct binder_ref *ref;
1511 struct rb_node *n;
1512
1513 while (*p) {
1514 parent = *p;
1515 ref = rb_entry(parent, struct binder_ref, rb_node_node);
1516
1517 if (node < ref->node)
1518 p = &(*p)->rb_left;
1519 else if (node > ref->node)
1520 p = &(*p)->rb_right;
1521 else
1522 return ref;
1523 }
1524 if (!new_ref)
1525 return NULL;
1526
1527 binder_stats_created(BINDER_STAT_REF);
1528 new_ref->data.debug_id = atomic_inc_return(&binder_last_id);
1529 new_ref->proc = proc;
1530 new_ref->node = node;
1531 rb_link_node(&new_ref->rb_node_node, parent, p);
1532 rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node);
1533
1534 new_ref->data.desc = (node == context->binder_context_mgr_node) ? 0 : 1;
1535 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) {
1536 ref = rb_entry(n, struct binder_ref, rb_node_desc);
1537 if (ref->data.desc > new_ref->data.desc)
1538 break;
1539 new_ref->data.desc = ref->data.desc + 1;
1540 }
1541
1542 p = &proc->refs_by_desc.rb_node;
1543 while (*p) {
1544 parent = *p;
1545 ref = rb_entry(parent, struct binder_ref, rb_node_desc);
1546
1547 if (new_ref->data.desc < ref->data.desc)
1548 p = &(*p)->rb_left;
1549 else if (new_ref->data.desc > ref->data.desc)
1550 p = &(*p)->rb_right;
1551 else
1552 BUG();
1553 }
1554 rb_link_node(&new_ref->rb_node_desc, parent, p);
1555 rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc);
1556
1557 binder_node_lock(node);
1558 hlist_add_head(&new_ref->node_entry, &node->refs);
1559
1560 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1561 "%d new ref %d desc %d for node %d\n",
1562 proc->pid, new_ref->data.debug_id, new_ref->data.desc,
1563 node->debug_id);
1564 binder_node_unlock(node);
1565 return new_ref;
1566}
1567
1568static void binder_cleanup_ref_olocked(struct binder_ref *ref)
1569{
1570 bool delete_node = false;
1571
1572 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1573 "%d delete ref %d desc %d for node %d\n",
1574 ref->proc->pid, ref->data.debug_id, ref->data.desc,
1575 ref->node->debug_id);
1576
1577 rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc);
1578 rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node);
1579
1580 binder_node_inner_lock(ref->node);
1581 if (ref->data.strong)
1582 binder_dec_node_nilocked(ref->node, 1, 1);
1583
1584 hlist_del(&ref->node_entry);
1585 delete_node = binder_dec_node_nilocked(ref->node, 0, 1);
1586 binder_node_inner_unlock(ref->node);
1587
1588
1589
1590 if (!delete_node) {
1591
1592
1593
1594
1595
1596 ref->node = NULL;
1597 }
1598
1599 if (ref->death) {
1600 binder_debug(BINDER_DEBUG_DEAD_BINDER,
1601 "%d delete ref %d desc %d has death notification\n",
1602 ref->proc->pid, ref->data.debug_id,
1603 ref->data.desc);
1604 binder_dequeue_work(ref->proc, &ref->death->work);
1605 binder_stats_deleted(BINDER_STAT_DEATH);
1606 }
1607 binder_stats_deleted(BINDER_STAT_REF);
1608}
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620static int binder_inc_ref_olocked(struct binder_ref *ref, int strong,
1621 struct list_head *target_list)
1622{
1623 int ret;
1624
1625 if (strong) {
1626 if (ref->data.strong == 0) {
1627 ret = binder_inc_node(ref->node, 1, 1, target_list);
1628 if (ret)
1629 return ret;
1630 }
1631 ref->data.strong++;
1632 } else {
1633 if (ref->data.weak == 0) {
1634 ret = binder_inc_node(ref->node, 0, 1, target_list);
1635 if (ret)
1636 return ret;
1637 }
1638 ref->data.weak++;
1639 }
1640 return 0;
1641}
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652static bool binder_dec_ref_olocked(struct binder_ref *ref, int strong)
1653{
1654 if (strong) {
1655 if (ref->data.strong == 0) {
1656 binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n",
1657 ref->proc->pid, ref->data.debug_id,
1658 ref->data.desc, ref->data.strong,
1659 ref->data.weak);
1660 return false;
1661 }
1662 ref->data.strong--;
1663 if (ref->data.strong == 0)
1664 binder_dec_node(ref->node, strong, 1);
1665 } else {
1666 if (ref->data.weak == 0) {
1667 binder_user_error("%d invalid dec weak, ref %d desc %d s %d w %d\n",
1668 ref->proc->pid, ref->data.debug_id,
1669 ref->data.desc, ref->data.strong,
1670 ref->data.weak);
1671 return false;
1672 }
1673 ref->data.weak--;
1674 }
1675 if (ref->data.strong == 0 && ref->data.weak == 0) {
1676 binder_cleanup_ref_olocked(ref);
1677 return true;
1678 }
1679 return false;
1680}
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693static struct binder_node *binder_get_node_from_ref(
1694 struct binder_proc *proc,
1695 u32 desc, bool need_strong_ref,
1696 struct binder_ref_data *rdata)
1697{
1698 struct binder_node *node;
1699 struct binder_ref *ref;
1700
1701 binder_proc_lock(proc);
1702 ref = binder_get_ref_olocked(proc, desc, need_strong_ref);
1703 if (!ref)
1704 goto err_no_ref;
1705 node = ref->node;
1706
1707
1708
1709
1710 binder_inc_node_tmpref(node);
1711 if (rdata)
1712 *rdata = ref->data;
1713 binder_proc_unlock(proc);
1714
1715 return node;
1716
1717err_no_ref:
1718 binder_proc_unlock(proc);
1719 return NULL;
1720}
1721
1722
1723
1724
1725
1726
1727
1728
1729static void binder_free_ref(struct binder_ref *ref)
1730{
1731 if (ref->node)
1732 binder_free_node(ref->node);
1733 kfree(ref->death);
1734 kfree(ref);
1735}
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750static int binder_update_ref_for_handle(struct binder_proc *proc,
1751 uint32_t desc, bool increment, bool strong,
1752 struct binder_ref_data *rdata)
1753{
1754 int ret = 0;
1755 struct binder_ref *ref;
1756 bool delete_ref = false;
1757
1758 binder_proc_lock(proc);
1759 ref = binder_get_ref_olocked(proc, desc, strong);
1760 if (!ref) {
1761 ret = -EINVAL;
1762 goto err_no_ref;
1763 }
1764 if (increment)
1765 ret = binder_inc_ref_olocked(ref, strong, NULL);
1766 else
1767 delete_ref = binder_dec_ref_olocked(ref, strong);
1768
1769 if (rdata)
1770 *rdata = ref->data;
1771 binder_proc_unlock(proc);
1772
1773 if (delete_ref)
1774 binder_free_ref(ref);
1775 return ret;
1776
1777err_no_ref:
1778 binder_proc_unlock(proc);
1779 return ret;
1780}
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793static int binder_dec_ref_for_handle(struct binder_proc *proc,
1794 uint32_t desc, bool strong, struct binder_ref_data *rdata)
1795{
1796 return binder_update_ref_for_handle(proc, desc, false, strong, rdata);
1797}
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813static int binder_inc_ref_for_node(struct binder_proc *proc,
1814 struct binder_node *node,
1815 bool strong,
1816 struct list_head *target_list,
1817 struct binder_ref_data *rdata)
1818{
1819 struct binder_ref *ref;
1820 struct binder_ref *new_ref = NULL;
1821 int ret = 0;
1822
1823 binder_proc_lock(proc);
1824 ref = binder_get_ref_for_node_olocked(proc, node, NULL);
1825 if (!ref) {
1826 binder_proc_unlock(proc);
1827 new_ref = kzalloc(sizeof(*ref), GFP_KERNEL);
1828 if (!new_ref)
1829 return -ENOMEM;
1830 binder_proc_lock(proc);
1831 ref = binder_get_ref_for_node_olocked(proc, node, new_ref);
1832 }
1833 ret = binder_inc_ref_olocked(ref, strong, target_list);
1834 *rdata = ref->data;
1835 binder_proc_unlock(proc);
1836 if (new_ref && ref != new_ref)
1837
1838
1839
1840
1841 kfree(new_ref);
1842 return ret;
1843}
1844
1845static void binder_pop_transaction_ilocked(struct binder_thread *target_thread,
1846 struct binder_transaction *t)
1847{
1848 BUG_ON(!target_thread);
1849 assert_spin_locked(&target_thread->proc->inner_lock);
1850 BUG_ON(target_thread->transaction_stack != t);
1851 BUG_ON(target_thread->transaction_stack->from != target_thread);
1852 target_thread->transaction_stack =
1853 target_thread->transaction_stack->from_parent;
1854 t->from = NULL;
1855}
1856
1857
1858
1859
1860
1861
1862
1863
1864
1865
1866
1867
1868
1869static void binder_thread_dec_tmpref(struct binder_thread *thread)
1870{
1871
1872
1873
1874
1875 binder_inner_proc_lock(thread->proc);
1876 atomic_dec(&thread->tmp_ref);
1877 if (thread->is_dead && !atomic_read(&thread->tmp_ref)) {
1878 binder_inner_proc_unlock(thread->proc);
1879 binder_free_thread(thread);
1880 return;
1881 }
1882 binder_inner_proc_unlock(thread->proc);
1883}
1884
1885
1886
1887
1888
1889
1890
1891
1892
1893
1894
1895
1896
1897static void binder_proc_dec_tmpref(struct binder_proc *proc)
1898{
1899 binder_inner_proc_lock(proc);
1900 proc->tmp_ref--;
1901 if (proc->is_dead && RB_EMPTY_ROOT(&proc->threads) &&
1902 !proc->tmp_ref) {
1903 binder_inner_proc_unlock(proc);
1904 binder_free_proc(proc);
1905 return;
1906 }
1907 binder_inner_proc_unlock(proc);
1908}
1909
1910
1911
1912
1913
1914
1915
1916
1917
1918
1919
1920static struct binder_thread *binder_get_txn_from(
1921 struct binder_transaction *t)
1922{
1923 struct binder_thread *from;
1924
1925 spin_lock(&t->lock);
1926 from = t->from;
1927 if (from)
1928 atomic_inc(&from->tmp_ref);
1929 spin_unlock(&t->lock);
1930 return from;
1931}
1932
1933
1934
1935
1936
1937
1938
1939
1940
1941
1942
1943
1944static struct binder_thread *binder_get_txn_from_and_acq_inner(
1945 struct binder_transaction *t)
1946{
1947 struct binder_thread *from;
1948
1949 from = binder_get_txn_from(t);
1950 if (!from)
1951 return NULL;
1952 binder_inner_proc_lock(from->proc);
1953 if (t->from) {
1954 BUG_ON(from != t->from);
1955 return from;
1956 }
1957 binder_inner_proc_unlock(from->proc);
1958 binder_thread_dec_tmpref(from);
1959 return NULL;
1960}
1961
1962static void binder_free_transaction(struct binder_transaction *t)
1963{
1964 if (t->buffer)
1965 t->buffer->transaction = NULL;
1966 kfree(t);
1967 binder_stats_deleted(BINDER_STAT_TRANSACTION);
1968}
1969
1970static void binder_send_failed_reply(struct binder_transaction *t,
1971 uint32_t error_code)
1972{
1973 struct binder_thread *target_thread;
1974 struct binder_transaction *next;
1975
1976 BUG_ON(t->flags & TF_ONE_WAY);
1977 while (1) {
1978 target_thread = binder_get_txn_from_and_acq_inner(t);
1979 if (target_thread) {
1980 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
1981 "send failed reply for transaction %d to %d:%d\n",
1982 t->debug_id,
1983 target_thread->proc->pid,
1984 target_thread->pid);
1985
1986 binder_pop_transaction_ilocked(target_thread, t);
1987 if (target_thread->reply_error.cmd == BR_OK) {
1988 target_thread->reply_error.cmd = error_code;
1989 binder_enqueue_thread_work_ilocked(
1990 target_thread,
1991 &target_thread->reply_error.work);
1992 wake_up_interruptible(&target_thread->wait);
1993 } else {
1994
1995
1996
1997
1998
1999
2000 pr_warn("Unexpected reply error: %u\n",
2001 target_thread->reply_error.cmd);
2002 }
2003 binder_inner_proc_unlock(target_thread->proc);
2004 binder_thread_dec_tmpref(target_thread);
2005 binder_free_transaction(t);
2006 return;
2007 }
2008 next = t->from_parent;
2009
2010 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
2011 "send failed reply for transaction %d, target dead\n",
2012 t->debug_id);
2013
2014 binder_free_transaction(t);
2015 if (next == NULL) {
2016 binder_debug(BINDER_DEBUG_DEAD_BINDER,
2017 "reply failed, no target thread at root\n");
2018 return;
2019 }
2020 t = next;
2021 binder_debug(BINDER_DEBUG_DEAD_BINDER,
2022 "reply failed, no target thread -- retry %d\n",
2023 t->debug_id);
2024 }
2025}
2026
2027
2028
2029
2030
2031
2032
2033static void binder_cleanup_transaction(struct binder_transaction *t,
2034 const char *reason,
2035 uint32_t error_code)
2036{
2037 if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) {
2038 binder_send_failed_reply(t, error_code);
2039 } else {
2040 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
2041 "undelivered transaction %d, %s\n",
2042 t->debug_id, reason);
2043 binder_free_transaction(t);
2044 }
2045}
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055static size_t binder_validate_object(struct binder_buffer *buffer, u64 offset)
2056{
2057
2058 struct binder_object_header *hdr;
2059 size_t object_size = 0;
2060
2061 if (offset > buffer->data_size - sizeof(*hdr) ||
2062 buffer->data_size < sizeof(*hdr) ||
2063 !IS_ALIGNED(offset, sizeof(u32)))
2064 return 0;
2065
2066
2067 hdr = (struct binder_object_header *)(buffer->data + offset);
2068 switch (hdr->type) {
2069 case BINDER_TYPE_BINDER:
2070 case BINDER_TYPE_WEAK_BINDER:
2071 case BINDER_TYPE_HANDLE:
2072 case BINDER_TYPE_WEAK_HANDLE:
2073 object_size = sizeof(struct flat_binder_object);
2074 break;
2075 case BINDER_TYPE_FD:
2076 object_size = sizeof(struct binder_fd_object);
2077 break;
2078 case BINDER_TYPE_PTR:
2079 object_size = sizeof(struct binder_buffer_object);
2080 break;
2081 case BINDER_TYPE_FDA:
2082 object_size = sizeof(struct binder_fd_array_object);
2083 break;
2084 default:
2085 return 0;
2086 }
2087 if (offset <= buffer->data_size - object_size &&
2088 buffer->data_size >= object_size)
2089 return object_size;
2090 else
2091 return 0;
2092}
2093
2094
2095
2096
2097
2098
2099
2100
2101
2102
2103
2104
2105
2106
2107
2108
2109
2110
2111static struct binder_buffer_object *binder_validate_ptr(struct binder_buffer *b,
2112 binder_size_t index,
2113 binder_size_t *start,
2114 binder_size_t num_valid)
2115{
2116 struct binder_buffer_object *buffer_obj;
2117 binder_size_t *offp;
2118
2119 if (index >= num_valid)
2120 return NULL;
2121
2122 offp = start + index;
2123 buffer_obj = (struct binder_buffer_object *)(b->data + *offp);
2124 if (buffer_obj->hdr.type != BINDER_TYPE_PTR)
2125 return NULL;
2126
2127 return buffer_obj;
2128}
2129
2130
2131
2132
2133
2134
2135
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148
2149
2150
2151
2152
2153
2154
2155
2156
2157
2158
2159
2160
2161
2162
2163
2164
2165
2166
2167
2168static bool binder_validate_fixup(struct binder_buffer *b,
2169 binder_size_t *objects_start,
2170 struct binder_buffer_object *buffer,
2171 binder_size_t fixup_offset,
2172 struct binder_buffer_object *last_obj,
2173 binder_size_t last_min_offset)
2174{
2175 if (!last_obj) {
2176
2177 return false;
2178 }
2179
2180 while (last_obj != buffer) {
2181
2182
2183
2184
2185 if ((last_obj->flags & BINDER_BUFFER_FLAG_HAS_PARENT) == 0)
2186 return false;
2187 last_min_offset = last_obj->parent_offset + sizeof(uintptr_t);
2188 last_obj = (struct binder_buffer_object *)
2189 (b->data + *(objects_start + last_obj->parent));
2190 }
2191 return (fixup_offset >= last_min_offset);
2192}
2193
2194static void binder_transaction_buffer_release(struct binder_proc *proc,
2195 struct binder_buffer *buffer,
2196 binder_size_t *failed_at)
2197{
2198 binder_size_t *offp, *off_start, *off_end;
2199 int debug_id = buffer->debug_id;
2200
2201 binder_debug(BINDER_DEBUG_TRANSACTION,
2202 "%d buffer release %d, size %zd-%zd, failed at %pK\n",
2203 proc->pid, buffer->debug_id,
2204 buffer->data_size, buffer->offsets_size, failed_at);
2205
2206 if (buffer->target_node)
2207 binder_dec_node(buffer->target_node, 1, 0);
2208
2209 off_start = (binder_size_t *)(buffer->data +
2210 ALIGN(buffer->data_size, sizeof(void *)));
2211 if (failed_at)
2212 off_end = failed_at;
2213 else
2214 off_end = (void *)off_start + buffer->offsets_size;
2215 for (offp = off_start; offp < off_end; offp++) {
2216 struct binder_object_header *hdr;
2217 size_t object_size = binder_validate_object(buffer, *offp);
2218
2219 if (object_size == 0) {
2220 pr_err("transaction release %d bad object at offset %lld, size %zd\n",
2221 debug_id, (u64)*offp, buffer->data_size);
2222 continue;
2223 }
2224 hdr = (struct binder_object_header *)(buffer->data + *offp);
2225 switch (hdr->type) {
2226 case BINDER_TYPE_BINDER:
2227 case BINDER_TYPE_WEAK_BINDER: {
2228 struct flat_binder_object *fp;
2229 struct binder_node *node;
2230
2231 fp = to_flat_binder_object(hdr);
2232 node = binder_get_node(proc, fp->binder);
2233 if (node == NULL) {
2234 pr_err("transaction release %d bad node %016llx\n",
2235 debug_id, (u64)fp->binder);
2236 break;
2237 }
2238 binder_debug(BINDER_DEBUG_TRANSACTION,
2239 " node %d u%016llx\n",
2240 node->debug_id, (u64)node->ptr);
2241 binder_dec_node(node, hdr->type == BINDER_TYPE_BINDER,
2242 0);
2243 binder_put_node(node);
2244 } break;
2245 case BINDER_TYPE_HANDLE:
2246 case BINDER_TYPE_WEAK_HANDLE: {
2247 struct flat_binder_object *fp;
2248 struct binder_ref_data rdata;
2249 int ret;
2250
2251 fp = to_flat_binder_object(hdr);
2252 ret = binder_dec_ref_for_handle(proc, fp->handle,
2253 hdr->type == BINDER_TYPE_HANDLE, &rdata);
2254
2255 if (ret) {
2256 pr_err("transaction release %d bad handle %d, ret = %d\n",
2257 debug_id, fp->handle, ret);
2258 break;
2259 }
2260 binder_debug(BINDER_DEBUG_TRANSACTION,
2261 " ref %d desc %d\n",
2262 rdata.debug_id, rdata.desc);
2263 } break;
2264
2265 case BINDER_TYPE_FD: {
2266 struct binder_fd_object *fp = to_binder_fd_object(hdr);
2267
2268 binder_debug(BINDER_DEBUG_TRANSACTION,
2269 " fd %d\n", fp->fd);
2270 if (failed_at)
2271 task_close_fd(proc, fp->fd);
2272 } break;
2273 case BINDER_TYPE_PTR:
2274
2275
2276
2277
2278 break;
2279 case BINDER_TYPE_FDA: {
2280 struct binder_fd_array_object *fda;
2281 struct binder_buffer_object *parent;
2282 uintptr_t parent_buffer;
2283 u32 *fd_array;
2284 size_t fd_index;
2285 binder_size_t fd_buf_size;
2286
2287 fda = to_binder_fd_array_object(hdr);
2288 parent = binder_validate_ptr(buffer, fda->parent,
2289 off_start,
2290 offp - off_start);
2291 if (!parent) {
2292 pr_err("transaction release %d bad parent offset\n",
2293 debug_id);
2294 continue;
2295 }
2296
2297
2298
2299
2300 parent_buffer = parent->buffer -
2301 binder_alloc_get_user_buffer_offset(
2302 &proc->alloc);
2303
2304 fd_buf_size = sizeof(u32) * fda->num_fds;
2305 if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {
2306 pr_err("transaction release %d invalid number of fds (%lld)\n",
2307 debug_id, (u64)fda->num_fds);
2308 continue;
2309 }
2310 if (fd_buf_size > parent->length ||
2311 fda->parent_offset > parent->length - fd_buf_size) {
2312
2313 pr_err("transaction release %d not enough space for %lld fds in buffer\n",
2314 debug_id, (u64)fda->num_fds);
2315 continue;
2316 }
2317 fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);
2318 for (fd_index = 0; fd_index < fda->num_fds; fd_index++)
2319 task_close_fd(proc, fd_array[fd_index]);
2320 } break;
2321 default:
2322 pr_err("transaction release %d bad object type %x\n",
2323 debug_id, hdr->type);
2324 break;
2325 }
2326 }
2327}
2328
2329static int binder_translate_binder(struct flat_binder_object *fp,
2330 struct binder_transaction *t,
2331 struct binder_thread *thread)
2332{
2333 struct binder_node *node;
2334 struct binder_proc *proc = thread->proc;
2335 struct binder_proc *target_proc = t->to_proc;
2336 struct binder_ref_data rdata;
2337 int ret = 0;
2338
2339 node = binder_get_node(proc, fp->binder);
2340 if (!node) {
2341 node = binder_new_node(proc, fp);
2342 if (!node)
2343 return -ENOMEM;
2344 }
2345 if (fp->cookie != node->cookie) {
2346 binder_user_error("%d:%d sending u%016llx node %d, cookie mismatch %016llx != %016llx\n",
2347 proc->pid, thread->pid, (u64)fp->binder,
2348 node->debug_id, (u64)fp->cookie,
2349 (u64)node->cookie);
2350 ret = -EINVAL;
2351 goto done;
2352 }
2353 if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
2354 ret = -EPERM;
2355 goto done;
2356 }
2357
2358 ret = binder_inc_ref_for_node(target_proc, node,
2359 fp->hdr.type == BINDER_TYPE_BINDER,
2360 &thread->todo, &rdata);
2361 if (ret)
2362 goto done;
2363
2364 if (fp->hdr.type == BINDER_TYPE_BINDER)
2365 fp->hdr.type = BINDER_TYPE_HANDLE;
2366 else
2367 fp->hdr.type = BINDER_TYPE_WEAK_HANDLE;
2368 fp->binder = 0;
2369 fp->handle = rdata.desc;
2370 fp->cookie = 0;
2371
2372 trace_binder_transaction_node_to_ref(t, node, &rdata);
2373 binder_debug(BINDER_DEBUG_TRANSACTION,
2374 " node %d u%016llx -> ref %d desc %d\n",
2375 node->debug_id, (u64)node->ptr,
2376 rdata.debug_id, rdata.desc);
2377done:
2378 binder_put_node(node);
2379 return ret;
2380}
2381
2382static int binder_translate_handle(struct flat_binder_object *fp,
2383 struct binder_transaction *t,
2384 struct binder_thread *thread)
2385{
2386 struct binder_proc *proc = thread->proc;
2387 struct binder_proc *target_proc = t->to_proc;
2388 struct binder_node *node;
2389 struct binder_ref_data src_rdata;
2390 int ret = 0;
2391
2392 node = binder_get_node_from_ref(proc, fp->handle,
2393 fp->hdr.type == BINDER_TYPE_HANDLE, &src_rdata);
2394 if (!node) {
2395 binder_user_error("%d:%d got transaction with invalid handle, %d\n",
2396 proc->pid, thread->pid, fp->handle);
2397 return -EINVAL;
2398 }
2399 if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
2400 ret = -EPERM;
2401 goto done;
2402 }
2403
2404 binder_node_lock(node);
2405 if (node->proc == target_proc) {
2406 if (fp->hdr.type == BINDER_TYPE_HANDLE)
2407 fp->hdr.type = BINDER_TYPE_BINDER;
2408 else
2409 fp->hdr.type = BINDER_TYPE_WEAK_BINDER;
2410 fp->binder = node->ptr;
2411 fp->cookie = node->cookie;
2412 if (node->proc)
2413 binder_inner_proc_lock(node->proc);
2414 binder_inc_node_nilocked(node,
2415 fp->hdr.type == BINDER_TYPE_BINDER,
2416 0, NULL);
2417 if (node->proc)
2418 binder_inner_proc_unlock(node->proc);
2419 trace_binder_transaction_ref_to_node(t, node, &src_rdata);
2420 binder_debug(BINDER_DEBUG_TRANSACTION,
2421 " ref %d desc %d -> node %d u%016llx\n",
2422 src_rdata.debug_id, src_rdata.desc, node->debug_id,
2423 (u64)node->ptr);
2424 binder_node_unlock(node);
2425 } else {
2426 struct binder_ref_data dest_rdata;
2427
2428 binder_node_unlock(node);
2429 ret = binder_inc_ref_for_node(target_proc, node,
2430 fp->hdr.type == BINDER_TYPE_HANDLE,
2431 NULL, &dest_rdata);
2432 if (ret)
2433 goto done;
2434
2435 fp->binder = 0;
2436 fp->handle = dest_rdata.desc;
2437 fp->cookie = 0;
2438 trace_binder_transaction_ref_to_ref(t, node, &src_rdata,
2439 &dest_rdata);
2440 binder_debug(BINDER_DEBUG_TRANSACTION,
2441 " ref %d desc %d -> ref %d desc %d (node %d)\n",
2442 src_rdata.debug_id, src_rdata.desc,
2443 dest_rdata.debug_id, dest_rdata.desc,
2444 node->debug_id);
2445 }
2446done:
2447 binder_put_node(node);
2448 return ret;
2449}
2450
2451static int binder_translate_fd(int fd,
2452 struct binder_transaction *t,
2453 struct binder_thread *thread,
2454 struct binder_transaction *in_reply_to)
2455{
2456 struct binder_proc *proc = thread->proc;
2457 struct binder_proc *target_proc = t->to_proc;
2458 int target_fd;
2459 struct file *file;
2460 int ret;
2461 bool target_allows_fd;
2462
2463 if (in_reply_to)
2464 target_allows_fd = !!(in_reply_to->flags & TF_ACCEPT_FDS);
2465 else
2466 target_allows_fd = t->buffer->target_node->accept_fds;
2467 if (!target_allows_fd) {
2468 binder_user_error("%d:%d got %s with fd, %d, but target does not allow fds\n",
2469 proc->pid, thread->pid,
2470 in_reply_to ? "reply" : "transaction",
2471 fd);
2472 ret = -EPERM;
2473 goto err_fd_not_accepted;
2474 }
2475
2476 file = fget(fd);
2477 if (!file) {
2478 binder_user_error("%d:%d got transaction with invalid fd, %d\n",
2479 proc->pid, thread->pid, fd);
2480 ret = -EBADF;
2481 goto err_fget;
2482 }
2483 ret = security_binder_transfer_file(proc->tsk, target_proc->tsk, file);
2484 if (ret < 0) {
2485 ret = -EPERM;
2486 goto err_security;
2487 }
2488
2489 target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC);
2490 if (target_fd < 0) {
2491 ret = -ENOMEM;
2492 goto err_get_unused_fd;
2493 }
2494 task_fd_install(target_proc, target_fd, file);
2495 trace_binder_transaction_fd(t, fd, target_fd);
2496 binder_debug(BINDER_DEBUG_TRANSACTION, " fd %d -> %d\n",
2497 fd, target_fd);
2498
2499 return target_fd;
2500
2501err_get_unused_fd:
2502err_security:
2503 fput(file);
2504err_fget:
2505err_fd_not_accepted:
2506 return ret;
2507}
2508
2509static int binder_translate_fd_array(struct binder_fd_array_object *fda,
2510 struct binder_buffer_object *parent,
2511 struct binder_transaction *t,
2512 struct binder_thread *thread,
2513 struct binder_transaction *in_reply_to)
2514{
2515 binder_size_t fdi, fd_buf_size, num_installed_fds;
2516 int target_fd;
2517 uintptr_t parent_buffer;
2518 u32 *fd_array;
2519 struct binder_proc *proc = thread->proc;
2520 struct binder_proc *target_proc = t->to_proc;
2521
2522 fd_buf_size = sizeof(u32) * fda->num_fds;
2523 if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {
2524 binder_user_error("%d:%d got transaction with invalid number of fds (%lld)\n",
2525 proc->pid, thread->pid, (u64)fda->num_fds);
2526 return -EINVAL;
2527 }
2528 if (fd_buf_size > parent->length ||
2529 fda->parent_offset > parent->length - fd_buf_size) {
2530
2531 binder_user_error("%d:%d not enough space to store %lld fds in buffer\n",
2532 proc->pid, thread->pid, (u64)fda->num_fds);
2533 return -EINVAL;
2534 }
2535
2536
2537
2538
2539 parent_buffer = parent->buffer -
2540 binder_alloc_get_user_buffer_offset(&target_proc->alloc);
2541 fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);
2542 if (!IS_ALIGNED((unsigned long)fd_array, sizeof(u32))) {
2543 binder_user_error("%d:%d parent offset not aligned correctly.\n",
2544 proc->pid, thread->pid);
2545 return -EINVAL;
2546 }
2547 for (fdi = 0; fdi < fda->num_fds; fdi++) {
2548 target_fd = binder_translate_fd(fd_array[fdi], t, thread,
2549 in_reply_to);
2550 if (target_fd < 0)
2551 goto err_translate_fd_failed;
2552 fd_array[fdi] = target_fd;
2553 }
2554 return 0;
2555
2556err_translate_fd_failed:
2557
2558
2559
2560
2561 num_installed_fds = fdi;
2562 for (fdi = 0; fdi < num_installed_fds; fdi++)
2563 task_close_fd(target_proc, fd_array[fdi]);
2564 return target_fd;
2565}
2566
2567static int binder_fixup_parent(struct binder_transaction *t,
2568 struct binder_thread *thread,
2569 struct binder_buffer_object *bp,
2570 binder_size_t *off_start,
2571 binder_size_t num_valid,
2572 struct binder_buffer_object *last_fixup_obj,
2573 binder_size_t last_fixup_min_off)
2574{
2575 struct binder_buffer_object *parent;
2576 u8 *parent_buffer;
2577 struct binder_buffer *b = t->buffer;
2578 struct binder_proc *proc = thread->proc;
2579 struct binder_proc *target_proc = t->to_proc;
2580
2581 if (!(bp->flags & BINDER_BUFFER_FLAG_HAS_PARENT))
2582 return 0;
2583
2584 parent = binder_validate_ptr(b, bp->parent, off_start, num_valid);
2585 if (!parent) {
2586 binder_user_error("%d:%d got transaction with invalid parent offset or type\n",
2587 proc->pid, thread->pid);
2588 return -EINVAL;
2589 }
2590
2591 if (!binder_validate_fixup(b, off_start,
2592 parent, bp->parent_offset,
2593 last_fixup_obj,
2594 last_fixup_min_off)) {
2595 binder_user_error("%d:%d got transaction with out-of-order buffer fixup\n",
2596 proc->pid, thread->pid);
2597 return -EINVAL;
2598 }
2599
2600 if (parent->length < sizeof(binder_uintptr_t) ||
2601 bp->parent_offset > parent->length - sizeof(binder_uintptr_t)) {
2602
2603 binder_user_error("%d:%d got transaction with invalid parent offset\n",
2604 proc->pid, thread->pid);
2605 return -EINVAL;
2606 }
2607 parent_buffer = (u8 *)((uintptr_t)parent->buffer -
2608 binder_alloc_get_user_buffer_offset(
2609 &target_proc->alloc));
2610 *(binder_uintptr_t *)(parent_buffer + bp->parent_offset) = bp->buffer;
2611
2612 return 0;
2613}
2614
2615
2616
2617
2618
2619
2620
2621
2622
2623
2624
2625
2626
2627
2628
2629
2630
2631
2632static bool binder_proc_transaction(struct binder_transaction *t,
2633 struct binder_proc *proc,
2634 struct binder_thread *thread)
2635{
2636 struct binder_node *node = t->buffer->target_node;
2637 bool oneway = !!(t->flags & TF_ONE_WAY);
2638 bool pending_async = false;
2639
2640 BUG_ON(!node);
2641 binder_node_lock(node);
2642 if (oneway) {
2643 BUG_ON(thread);
2644 if (node->has_async_transaction) {
2645 pending_async = true;
2646 } else {
2647 node->has_async_transaction = true;
2648 }
2649 }
2650
2651 binder_inner_proc_lock(proc);
2652
2653 if (proc->is_dead || (thread && thread->is_dead)) {
2654 binder_inner_proc_unlock(proc);
2655 binder_node_unlock(node);
2656 return false;
2657 }
2658
2659 if (!thread && !pending_async)
2660 thread = binder_select_thread_ilocked(proc);
2661
2662 if (thread)
2663 binder_enqueue_thread_work_ilocked(thread, &t->work);
2664 else if (!pending_async)
2665 binder_enqueue_work_ilocked(&t->work, &proc->todo);
2666 else
2667 binder_enqueue_work_ilocked(&t->work, &node->async_todo);
2668
2669 if (!pending_async)
2670 binder_wakeup_thread_ilocked(proc, thread, !oneway );
2671
2672 binder_inner_proc_unlock(proc);
2673 binder_node_unlock(node);
2674
2675 return true;
2676}
2677
2678
2679
2680
2681
2682
2683
2684
2685
2686
2687
2688
2689
2690
2691
2692
2693
2694
2695
2696
2697
2698
2699static struct binder_node *binder_get_node_refs_for_txn(
2700 struct binder_node *node,
2701 struct binder_proc **procp,
2702 uint32_t *error)
2703{
2704 struct binder_node *target_node = NULL;
2705
2706 binder_node_inner_lock(node);
2707 if (node->proc) {
2708 target_node = node;
2709 binder_inc_node_nilocked(node, 1, 0, NULL);
2710 binder_inc_node_tmpref_ilocked(node);
2711 node->proc->tmp_ref++;
2712 *procp = node->proc;
2713 } else
2714 *error = BR_DEAD_REPLY;
2715 binder_node_inner_unlock(node);
2716
2717 return target_node;
2718}
2719
2720static void binder_transaction(struct binder_proc *proc,
2721 struct binder_thread *thread,
2722 struct binder_transaction_data *tr, int reply,
2723 binder_size_t extra_buffers_size)
2724{
2725 int ret;
2726 struct binder_transaction *t;
2727 struct binder_work *tcomplete;
2728 binder_size_t *offp, *off_end, *off_start;
2729 binder_size_t off_min;
2730 u8 *sg_bufp, *sg_buf_end;
2731 struct binder_proc *target_proc = NULL;
2732 struct binder_thread *target_thread = NULL;
2733 struct binder_node *target_node = NULL;
2734 struct binder_transaction *in_reply_to = NULL;
2735 struct binder_transaction_log_entry *e;
2736 uint32_t return_error = 0;
2737 uint32_t return_error_param = 0;
2738 uint32_t return_error_line = 0;
2739 struct binder_buffer_object *last_fixup_obj = NULL;
2740 binder_size_t last_fixup_min_off = 0;
2741 struct binder_context *context = proc->context;
2742 int t_debug_id = atomic_inc_return(&binder_last_id);
2743
2744 e = binder_transaction_log_add(&binder_transaction_log);
2745 e->debug_id = t_debug_id;
2746 e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY);
2747 e->from_proc = proc->pid;
2748 e->from_thread = thread->pid;
2749 e->target_handle = tr->target.handle;
2750 e->data_size = tr->data_size;
2751 e->offsets_size = tr->offsets_size;
2752 e->context_name = proc->context->name;
2753
2754 if (reply) {
2755 binder_inner_proc_lock(proc);
2756 in_reply_to = thread->transaction_stack;
2757 if (in_reply_to == NULL) {
2758 binder_inner_proc_unlock(proc);
2759 binder_user_error("%d:%d got reply transaction with no transaction stack\n",
2760 proc->pid, thread->pid);
2761 return_error = BR_FAILED_REPLY;
2762 return_error_param = -EPROTO;
2763 return_error_line = __LINE__;
2764 goto err_empty_call_stack;
2765 }
2766 if (in_reply_to->to_thread != thread) {
2767 spin_lock(&in_reply_to->lock);
2768 binder_user_error("%d:%d got reply transaction with bad transaction stack, transaction %d has target %d:%d\n",
2769 proc->pid, thread->pid, in_reply_to->debug_id,
2770 in_reply_to->to_proc ?
2771 in_reply_to->to_proc->pid : 0,
2772 in_reply_to->to_thread ?
2773 in_reply_to->to_thread->pid : 0);
2774 spin_unlock(&in_reply_to->lock);
2775 binder_inner_proc_unlock(proc);
2776 return_error = BR_FAILED_REPLY;
2777 return_error_param = -EPROTO;
2778 return_error_line = __LINE__;
2779 in_reply_to = NULL;
2780 goto err_bad_call_stack;
2781 }
2782 thread->transaction_stack = in_reply_to->to_parent;
2783 binder_inner_proc_unlock(proc);
2784 binder_set_nice(in_reply_to->saved_priority);
2785 target_thread = binder_get_txn_from_and_acq_inner(in_reply_to);
2786 if (target_thread == NULL) {
2787 return_error = BR_DEAD_REPLY;
2788 return_error_line = __LINE__;
2789 goto err_dead_binder;
2790 }
2791 if (target_thread->transaction_stack != in_reply_to) {
2792 binder_user_error("%d:%d got reply transaction with bad target transaction stack %d, expected %d\n",
2793 proc->pid, thread->pid,
2794 target_thread->transaction_stack ?
2795 target_thread->transaction_stack->debug_id : 0,
2796 in_reply_to->debug_id);
2797 binder_inner_proc_unlock(target_thread->proc);
2798 return_error = BR_FAILED_REPLY;
2799 return_error_param = -EPROTO;
2800 return_error_line = __LINE__;
2801 in_reply_to = NULL;
2802 target_thread = NULL;
2803 goto err_dead_binder;
2804 }
2805 target_proc = target_thread->proc;
2806 target_proc->tmp_ref++;
2807 binder_inner_proc_unlock(target_thread->proc);
2808 } else {
2809 if (tr->target.handle) {
2810 struct binder_ref *ref;
2811
2812
2813
2814
2815
2816
2817
2818
2819 binder_proc_lock(proc);
2820 ref = binder_get_ref_olocked(proc, tr->target.handle,
2821 true);
2822 if (ref) {
2823 target_node = binder_get_node_refs_for_txn(
2824 ref->node, &target_proc,
2825 &return_error);
2826 } else {
2827 binder_user_error("%d:%d got transaction to invalid handle\n",
2828 proc->pid, thread->pid);
2829 return_error = BR_FAILED_REPLY;
2830 }
2831 binder_proc_unlock(proc);
2832 } else {
2833 mutex_lock(&context->context_mgr_node_lock);
2834 target_node = context->binder_context_mgr_node;
2835 if (target_node)
2836 target_node = binder_get_node_refs_for_txn(
2837 target_node, &target_proc,
2838 &return_error);
2839 else
2840 return_error = BR_DEAD_REPLY;
2841 mutex_unlock(&context->context_mgr_node_lock);
2842 }
2843 if (!target_node) {
2844
2845
2846
2847 return_error_param = -EINVAL;
2848 return_error_line = __LINE__;
2849 goto err_dead_binder;
2850 }
2851 e->to_node = target_node->debug_id;
2852 if (security_binder_transaction(proc->tsk,
2853 target_proc->tsk) < 0) {
2854 return_error = BR_FAILED_REPLY;
2855 return_error_param = -EPERM;
2856 return_error_line = __LINE__;
2857 goto err_invalid_target_handle;
2858 }
2859 binder_inner_proc_lock(proc);
2860 if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) {
2861 struct binder_transaction *tmp;
2862
2863 tmp = thread->transaction_stack;
2864 if (tmp->to_thread != thread) {
2865 spin_lock(&tmp->lock);
2866 binder_user_error("%d:%d got new transaction with bad transaction stack, transaction %d has target %d:%d\n",
2867 proc->pid, thread->pid, tmp->debug_id,
2868 tmp->to_proc ? tmp->to_proc->pid : 0,
2869 tmp->to_thread ?
2870 tmp->to_thread->pid : 0);
2871 spin_unlock(&tmp->lock);
2872 binder_inner_proc_unlock(proc);
2873 return_error = BR_FAILED_REPLY;
2874 return_error_param = -EPROTO;
2875 return_error_line = __LINE__;
2876 goto err_bad_call_stack;
2877 }
2878 while (tmp) {
2879 struct binder_thread *from;
2880
2881 spin_lock(&tmp->lock);
2882 from = tmp->from;
2883 if (from && from->proc == target_proc) {
2884 atomic_inc(&from->tmp_ref);
2885 target_thread = from;
2886 spin_unlock(&tmp->lock);
2887 break;
2888 }
2889 spin_unlock(&tmp->lock);
2890 tmp = tmp->from_parent;
2891 }
2892 }
2893 binder_inner_proc_unlock(proc);
2894 }
2895 if (target_thread)
2896 e->to_thread = target_thread->pid;
2897 e->to_proc = target_proc->pid;
2898
2899
2900 t = kzalloc(sizeof(*t), GFP_KERNEL);
2901 if (t == NULL) {
2902 return_error = BR_FAILED_REPLY;
2903 return_error_param = -ENOMEM;
2904 return_error_line = __LINE__;
2905 goto err_alloc_t_failed;
2906 }
2907 binder_stats_created(BINDER_STAT_TRANSACTION);
2908 spin_lock_init(&t->lock);
2909
2910 tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL);
2911 if (tcomplete == NULL) {
2912 return_error = BR_FAILED_REPLY;
2913 return_error_param = -ENOMEM;
2914 return_error_line = __LINE__;
2915 goto err_alloc_tcomplete_failed;
2916 }
2917 binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE);
2918
2919 t->debug_id = t_debug_id;
2920
2921 if (reply)
2922 binder_debug(BINDER_DEBUG_TRANSACTION,
2923 "%d:%d BC_REPLY %d -> %d:%d, data %016llx-%016llx size %lld-%lld-%lld\n",
2924 proc->pid, thread->pid, t->debug_id,
2925 target_proc->pid, target_thread->pid,
2926 (u64)tr->data.ptr.buffer,
2927 (u64)tr->data.ptr.offsets,
2928 (u64)tr->data_size, (u64)tr->offsets_size,
2929 (u64)extra_buffers_size);
2930 else
2931 binder_debug(BINDER_DEBUG_TRANSACTION,
2932 "%d:%d BC_TRANSACTION %d -> %d - node %d, data %016llx-%016llx size %lld-%lld-%lld\n",
2933 proc->pid, thread->pid, t->debug_id,
2934 target_proc->pid, target_node->debug_id,
2935 (u64)tr->data.ptr.buffer,
2936 (u64)tr->data.ptr.offsets,
2937 (u64)tr->data_size, (u64)tr->offsets_size,
2938 (u64)extra_buffers_size);
2939
2940 if (!reply && !(tr->flags & TF_ONE_WAY))
2941 t->from = thread;
2942 else
2943 t->from = NULL;
2944 t->sender_euid = task_euid(proc->tsk);
2945 t->to_proc = target_proc;
2946 t->to_thread = target_thread;
2947 t->code = tr->code;
2948 t->flags = tr->flags;
2949 t->priority = task_nice(current);
2950
2951 trace_binder_transaction(reply, t, target_node);
2952
2953 t->buffer = binder_alloc_new_buf(&target_proc->alloc, tr->data_size,
2954 tr->offsets_size, extra_buffers_size,
2955 !reply && (t->flags & TF_ONE_WAY));
2956 if (IS_ERR(t->buffer)) {
2957
2958
2959
2960 return_error_param = PTR_ERR(t->buffer);
2961 return_error = return_error_param == -ESRCH ?
2962 BR_DEAD_REPLY : BR_FAILED_REPLY;
2963 return_error_line = __LINE__;
2964 t->buffer = NULL;
2965 goto err_binder_alloc_buf_failed;
2966 }
2967 t->buffer->allow_user_free = 0;
2968 t->buffer->debug_id = t->debug_id;
2969 t->buffer->transaction = t;
2970 t->buffer->target_node = target_node;
2971 trace_binder_transaction_alloc_buf(t->buffer);
2972 off_start = (binder_size_t *)(t->buffer->data +
2973 ALIGN(tr->data_size, sizeof(void *)));
2974 offp = off_start;
2975
2976 if (copy_from_user(t->buffer->data, (const void __user *)(uintptr_t)
2977 tr->data.ptr.buffer, tr->data_size)) {
2978 binder_user_error("%d:%d got transaction with invalid data ptr\n",
2979 proc->pid, thread->pid);
2980 return_error = BR_FAILED_REPLY;
2981 return_error_param = -EFAULT;
2982 return_error_line = __LINE__;
2983 goto err_copy_data_failed;
2984 }
2985 if (copy_from_user(offp, (const void __user *)(uintptr_t)
2986 tr->data.ptr.offsets, tr->offsets_size)) {
2987 binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
2988 proc->pid, thread->pid);
2989 return_error = BR_FAILED_REPLY;
2990 return_error_param = -EFAULT;
2991 return_error_line = __LINE__;
2992 goto err_copy_data_failed;
2993 }
2994 if (!IS_ALIGNED(tr->offsets_size, sizeof(binder_size_t))) {
2995 binder_user_error("%d:%d got transaction with invalid offsets size, %lld\n",
2996 proc->pid, thread->pid, (u64)tr->offsets_size);
2997 return_error = BR_FAILED_REPLY;
2998 return_error_param = -EINVAL;
2999 return_error_line = __LINE__;
3000 goto err_bad_offset;
3001 }
3002 if (!IS_ALIGNED(extra_buffers_size, sizeof(u64))) {
3003 binder_user_error("%d:%d got transaction with unaligned buffers size, %lld\n",
3004 proc->pid, thread->pid,
3005 (u64)extra_buffers_size);
3006 return_error = BR_FAILED_REPLY;
3007 return_error_param = -EINVAL;
3008 return_error_line = __LINE__;
3009 goto err_bad_offset;
3010 }
3011 off_end = (void *)off_start + tr->offsets_size;
3012 sg_bufp = (u8 *)(PTR_ALIGN(off_end, sizeof(void *)));
3013 sg_buf_end = sg_bufp + extra_buffers_size;
3014 off_min = 0;
3015 for (; offp < off_end; offp++) {
3016 struct binder_object_header *hdr;
3017 size_t object_size = binder_validate_object(t->buffer, *offp);
3018
3019 if (object_size == 0 || *offp < off_min) {
3020 binder_user_error("%d:%d got transaction with invalid offset (%lld, min %lld max %lld) or object.\n",
3021 proc->pid, thread->pid, (u64)*offp,
3022 (u64)off_min,
3023 (u64)t->buffer->data_size);
3024 return_error = BR_FAILED_REPLY;
3025 return_error_param = -EINVAL;
3026 return_error_line = __LINE__;
3027 goto err_bad_offset;
3028 }
3029
3030 hdr = (struct binder_object_header *)(t->buffer->data + *offp);
3031 off_min = *offp + object_size;
3032 switch (hdr->type) {
3033 case BINDER_TYPE_BINDER:
3034 case BINDER_TYPE_WEAK_BINDER: {
3035 struct flat_binder_object *fp;
3036
3037 fp = to_flat_binder_object(hdr);
3038 ret = binder_translate_binder(fp, t, thread);
3039 if (ret < 0) {
3040 return_error = BR_FAILED_REPLY;
3041 return_error_param = ret;
3042 return_error_line = __LINE__;
3043 goto err_translate_failed;
3044 }
3045 } break;
3046 case BINDER_TYPE_HANDLE:
3047 case BINDER_TYPE_WEAK_HANDLE: {
3048 struct flat_binder_object *fp;
3049
3050 fp = to_flat_binder_object(hdr);
3051 ret = binder_translate_handle(fp, t, thread);
3052 if (ret < 0) {
3053 return_error = BR_FAILED_REPLY;
3054 return_error_param = ret;
3055 return_error_line = __LINE__;
3056 goto err_translate_failed;
3057 }
3058 } break;
3059
3060 case BINDER_TYPE_FD: {
3061 struct binder_fd_object *fp = to_binder_fd_object(hdr);
3062 int target_fd = binder_translate_fd(fp->fd, t, thread,
3063 in_reply_to);
3064
3065 if (target_fd < 0) {
3066 return_error = BR_FAILED_REPLY;
3067 return_error_param = target_fd;
3068 return_error_line = __LINE__;
3069 goto err_translate_failed;
3070 }
3071 fp->pad_binder = 0;
3072 fp->fd = target_fd;
3073 } break;
3074 case BINDER_TYPE_FDA: {
3075 struct binder_fd_array_object *fda =
3076 to_binder_fd_array_object(hdr);
3077 struct binder_buffer_object *parent =
3078 binder_validate_ptr(t->buffer, fda->parent,
3079 off_start,
3080 offp - off_start);
3081 if (!parent) {
3082 binder_user_error("%d:%d got transaction with invalid parent offset or type\n",
3083 proc->pid, thread->pid);
3084 return_error = BR_FAILED_REPLY;
3085 return_error_param = -EINVAL;
3086 return_error_line = __LINE__;
3087 goto err_bad_parent;
3088 }
3089 if (!binder_validate_fixup(t->buffer, off_start,
3090 parent, fda->parent_offset,
3091 last_fixup_obj,
3092 last_fixup_min_off)) {
3093 binder_user_error("%d:%d got transaction with out-of-order buffer fixup\n",
3094 proc->pid, thread->pid);
3095 return_error = BR_FAILED_REPLY;
3096 return_error_param = -EINVAL;
3097 return_error_line = __LINE__;
3098 goto err_bad_parent;
3099 }
3100 ret = binder_translate_fd_array(fda, parent, t, thread,
3101 in_reply_to);
3102 if (ret < 0) {
3103 return_error = BR_FAILED_REPLY;
3104 return_error_param = ret;
3105 return_error_line = __LINE__;
3106 goto err_translate_failed;
3107 }
3108 last_fixup_obj = parent;
3109 last_fixup_min_off =
3110 fda->parent_offset + sizeof(u32) * fda->num_fds;
3111 } break;
3112 case BINDER_TYPE_PTR: {
3113 struct binder_buffer_object *bp =
3114 to_binder_buffer_object(hdr);
3115 size_t buf_left = sg_buf_end - sg_bufp;
3116
3117 if (bp->length > buf_left) {
3118 binder_user_error("%d:%d got transaction with too large buffer\n",
3119 proc->pid, thread->pid);
3120 return_error = BR_FAILED_REPLY;
3121 return_error_param = -EINVAL;
3122 return_error_line = __LINE__;
3123 goto err_bad_offset;
3124 }
3125 if (copy_from_user(sg_bufp,
3126 (const void __user *)(uintptr_t)
3127 bp->buffer, bp->length)) {
3128 binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
3129 proc->pid, thread->pid);
3130 return_error_param = -EFAULT;
3131 return_error = BR_FAILED_REPLY;
3132 return_error_line = __LINE__;
3133 goto err_copy_data_failed;
3134 }
3135
3136 bp->buffer = (uintptr_t)sg_bufp +
3137 binder_alloc_get_user_buffer_offset(
3138 &target_proc->alloc);
3139 sg_bufp += ALIGN(bp->length, sizeof(u64));
3140
3141 ret = binder_fixup_parent(t, thread, bp, off_start,
3142 offp - off_start,
3143 last_fixup_obj,
3144 last_fixup_min_off);
3145 if (ret < 0) {
3146 return_error = BR_FAILED_REPLY;
3147 return_error_param = ret;
3148 return_error_line = __LINE__;
3149 goto err_translate_failed;
3150 }
3151 last_fixup_obj = bp;
3152 last_fixup_min_off = 0;
3153 } break;
3154 default:
3155 binder_user_error("%d:%d got transaction with invalid object type, %x\n",
3156 proc->pid, thread->pid, hdr->type);
3157 return_error = BR_FAILED_REPLY;
3158 return_error_param = -EINVAL;
3159 return_error_line = __LINE__;
3160 goto err_bad_object_type;
3161 }
3162 }
3163 tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
3164 t->work.type = BINDER_WORK_TRANSACTION;
3165
3166 if (reply) {
3167 binder_enqueue_thread_work(thread, tcomplete);
3168 binder_inner_proc_lock(target_proc);
3169 if (target_thread->is_dead) {
3170 binder_inner_proc_unlock(target_proc);
3171 goto err_dead_proc_or_thread;
3172 }
3173 BUG_ON(t->buffer->async_transaction != 0);
3174 binder_pop_transaction_ilocked(target_thread, in_reply_to);
3175 binder_enqueue_thread_work_ilocked(target_thread, &t->work);
3176 binder_inner_proc_unlock(target_proc);
3177 wake_up_interruptible_sync(&target_thread->wait);
3178 binder_free_transaction(in_reply_to);
3179 } else if (!(t->flags & TF_ONE_WAY)) {
3180 BUG_ON(t->buffer->async_transaction != 0);
3181 binder_inner_proc_lock(proc);
3182
3183
3184
3185
3186
3187
3188
3189 binder_enqueue_deferred_thread_work_ilocked(thread, tcomplete);
3190 t->need_reply = 1;
3191 t->from_parent = thread->transaction_stack;
3192 thread->transaction_stack = t;
3193 binder_inner_proc_unlock(proc);
3194 if (!binder_proc_transaction(t, target_proc, target_thread)) {
3195 binder_inner_proc_lock(proc);
3196 binder_pop_transaction_ilocked(thread, t);
3197 binder_inner_proc_unlock(proc);
3198 goto err_dead_proc_or_thread;
3199 }
3200 } else {
3201 BUG_ON(target_node == NULL);
3202 BUG_ON(t->buffer->async_transaction != 1);
3203 binder_enqueue_thread_work(thread, tcomplete);
3204 if (!binder_proc_transaction(t, target_proc, NULL))
3205 goto err_dead_proc_or_thread;
3206 }
3207 if (target_thread)
3208 binder_thread_dec_tmpref(target_thread);
3209 binder_proc_dec_tmpref(target_proc);
3210 if (target_node)
3211 binder_dec_node_tmpref(target_node);
3212
3213
3214
3215
3216 smp_wmb();
3217 WRITE_ONCE(e->debug_id_done, t_debug_id);
3218 return;
3219
3220err_dead_proc_or_thread:
3221 return_error = BR_DEAD_REPLY;
3222 return_error_line = __LINE__;
3223 binder_dequeue_work(proc, tcomplete);
3224err_translate_failed:
3225err_bad_object_type:
3226err_bad_offset:
3227err_bad_parent:
3228err_copy_data_failed:
3229 trace_binder_transaction_failed_buffer_release(t->buffer);
3230 binder_transaction_buffer_release(target_proc, t->buffer, offp);
3231 if (target_node)
3232 binder_dec_node_tmpref(target_node);
3233 target_node = NULL;
3234 t->buffer->transaction = NULL;
3235 binder_alloc_free_buf(&target_proc->alloc, t->buffer);
3236err_binder_alloc_buf_failed:
3237 kfree(tcomplete);
3238 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
3239err_alloc_tcomplete_failed:
3240 kfree(t);
3241 binder_stats_deleted(BINDER_STAT_TRANSACTION);
3242err_alloc_t_failed:
3243err_bad_call_stack:
3244err_empty_call_stack:
3245err_dead_binder:
3246err_invalid_target_handle:
3247 if (target_thread)
3248 binder_thread_dec_tmpref(target_thread);
3249 if (target_proc)
3250 binder_proc_dec_tmpref(target_proc);
3251 if (target_node) {
3252 binder_dec_node(target_node, 1, 0);
3253 binder_dec_node_tmpref(target_node);
3254 }
3255
3256 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
3257 "%d:%d transaction failed %d/%d, size %lld-%lld line %d\n",
3258 proc->pid, thread->pid, return_error, return_error_param,
3259 (u64)tr->data_size, (u64)tr->offsets_size,
3260 return_error_line);
3261
3262 {
3263 struct binder_transaction_log_entry *fe;
3264
3265 e->return_error = return_error;
3266 e->return_error_param = return_error_param;
3267 e->return_error_line = return_error_line;
3268 fe = binder_transaction_log_add(&binder_transaction_log_failed);
3269 *fe = *e;
3270
3271
3272
3273
3274 smp_wmb();
3275 WRITE_ONCE(e->debug_id_done, t_debug_id);
3276 WRITE_ONCE(fe->debug_id_done, t_debug_id);
3277 }
3278
3279 BUG_ON(thread->return_error.cmd != BR_OK);
3280 if (in_reply_to) {
3281 thread->return_error.cmd = BR_TRANSACTION_COMPLETE;
3282 binder_enqueue_thread_work(thread, &thread->return_error.work);
3283 binder_send_failed_reply(in_reply_to, return_error);
3284 } else {
3285 thread->return_error.cmd = return_error;
3286 binder_enqueue_thread_work(thread, &thread->return_error.work);
3287 }
3288}
3289
3290static int binder_thread_write(struct binder_proc *proc,
3291 struct binder_thread *thread,
3292 binder_uintptr_t binder_buffer, size_t size,
3293 binder_size_t *consumed)
3294{
3295 uint32_t cmd;
3296 struct binder_context *context = proc->context;
3297 void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
3298 void __user *ptr = buffer + *consumed;
3299 void __user *end = buffer + size;
3300
3301 while (ptr < end && thread->return_error.cmd == BR_OK) {
3302 int ret;
3303
3304 if (get_user(cmd, (uint32_t __user *)ptr))
3305 return -EFAULT;
3306 ptr += sizeof(uint32_t);
3307 trace_binder_command(cmd);
3308 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) {
3309 atomic_inc(&binder_stats.bc[_IOC_NR(cmd)]);
3310 atomic_inc(&proc->stats.bc[_IOC_NR(cmd)]);
3311 atomic_inc(&thread->stats.bc[_IOC_NR(cmd)]);
3312 }
3313 switch (cmd) {
3314 case BC_INCREFS:
3315 case BC_ACQUIRE:
3316 case BC_RELEASE:
3317 case BC_DECREFS: {
3318 uint32_t target;
3319 const char *debug_string;
3320 bool strong = cmd == BC_ACQUIRE || cmd == BC_RELEASE;
3321 bool increment = cmd == BC_INCREFS || cmd == BC_ACQUIRE;
3322 struct binder_ref_data rdata;
3323
3324 if (get_user(target, (uint32_t __user *)ptr))
3325 return -EFAULT;
3326
3327 ptr += sizeof(uint32_t);
3328 ret = -1;
3329 if (increment && !target) {
3330 struct binder_node *ctx_mgr_node;
3331 mutex_lock(&context->context_mgr_node_lock);
3332 ctx_mgr_node = context->binder_context_mgr_node;
3333 if (ctx_mgr_node)
3334 ret = binder_inc_ref_for_node(
3335 proc, ctx_mgr_node,
3336 strong, NULL, &rdata);
3337 mutex_unlock(&context->context_mgr_node_lock);
3338 }
3339 if (ret)
3340 ret = binder_update_ref_for_handle(
3341 proc, target, increment, strong,
3342 &rdata);
3343 if (!ret && rdata.desc != target) {
3344 binder_user_error("%d:%d tried to acquire reference to desc %d, got %d instead\n",
3345 proc->pid, thread->pid,
3346 target, rdata.desc);
3347 }
3348 switch (cmd) {
3349 case BC_INCREFS:
3350 debug_string = "IncRefs";
3351 break;
3352 case BC_ACQUIRE:
3353 debug_string = "Acquire";
3354 break;
3355 case BC_RELEASE:
3356 debug_string = "Release";
3357 break;
3358 case BC_DECREFS:
3359 default:
3360 debug_string = "DecRefs";
3361 break;
3362 }
3363 if (ret) {
3364 binder_user_error("%d:%d %s %d refcount change on invalid ref %d ret %d\n",
3365 proc->pid, thread->pid, debug_string,
3366 strong, target, ret);
3367 break;
3368 }
3369 binder_debug(BINDER_DEBUG_USER_REFS,
3370 "%d:%d %s ref %d desc %d s %d w %d\n",
3371 proc->pid, thread->pid, debug_string,
3372 rdata.debug_id, rdata.desc, rdata.strong,
3373 rdata.weak);
3374 break;
3375 }
3376 case BC_INCREFS_DONE:
3377 case BC_ACQUIRE_DONE: {
3378 binder_uintptr_t node_ptr;
3379 binder_uintptr_t cookie;
3380 struct binder_node *node;
3381 bool free_node;
3382
3383 if (get_user(node_ptr, (binder_uintptr_t __user *)ptr))
3384 return -EFAULT;
3385 ptr += sizeof(binder_uintptr_t);
3386 if (get_user(cookie, (binder_uintptr_t __user *)ptr))
3387 return -EFAULT;
3388 ptr += sizeof(binder_uintptr_t);
3389 node = binder_get_node(proc, node_ptr);
3390 if (node == NULL) {
3391 binder_user_error("%d:%d %s u%016llx no match\n",
3392 proc->pid, thread->pid,
3393 cmd == BC_INCREFS_DONE ?
3394 "BC_INCREFS_DONE" :
3395 "BC_ACQUIRE_DONE",
3396 (u64)node_ptr);
3397 break;
3398 }
3399 if (cookie != node->cookie) {
3400 binder_user_error("%d:%d %s u%016llx node %d cookie mismatch %016llx != %016llx\n",
3401 proc->pid, thread->pid,
3402 cmd == BC_INCREFS_DONE ?
3403 "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
3404 (u64)node_ptr, node->debug_id,
3405 (u64)cookie, (u64)node->cookie);
3406 binder_put_node(node);
3407 break;
3408 }
3409 binder_node_inner_lock(node);
3410 if (cmd == BC_ACQUIRE_DONE) {
3411 if (node->pending_strong_ref == 0) {
3412 binder_user_error("%d:%d BC_ACQUIRE_DONE node %d has no pending acquire request\n",
3413 proc->pid, thread->pid,
3414 node->debug_id);
3415 binder_node_inner_unlock(node);
3416 binder_put_node(node);
3417 break;
3418 }
3419 node->pending_strong_ref = 0;
3420 } else {
3421 if (node->pending_weak_ref == 0) {
3422 binder_user_error("%d:%d BC_INCREFS_DONE node %d has no pending increfs request\n",
3423 proc->pid, thread->pid,
3424 node->debug_id);
3425 binder_node_inner_unlock(node);
3426 binder_put_node(node);
3427 break;
3428 }
3429 node->pending_weak_ref = 0;
3430 }
3431 free_node = binder_dec_node_nilocked(node,
3432 cmd == BC_ACQUIRE_DONE, 0);
3433 WARN_ON(free_node);
3434 binder_debug(BINDER_DEBUG_USER_REFS,
3435 "%d:%d %s node %d ls %d lw %d tr %d\n",
3436 proc->pid, thread->pid,
3437 cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
3438 node->debug_id, node->local_strong_refs,
3439 node->local_weak_refs, node->tmp_refs);
3440 binder_node_inner_unlock(node);
3441 binder_put_node(node);
3442 break;
3443 }
3444 case BC_ATTEMPT_ACQUIRE:
3445 pr_err("BC_ATTEMPT_ACQUIRE not supported\n");
3446 return -EINVAL;
3447 case BC_ACQUIRE_RESULT:
3448 pr_err("BC_ACQUIRE_RESULT not supported\n");
3449 return -EINVAL;
3450
3451 case BC_FREE_BUFFER: {
3452 binder_uintptr_t data_ptr;
3453 struct binder_buffer *buffer;
3454
3455 if (get_user(data_ptr, (binder_uintptr_t __user *)ptr))
3456 return -EFAULT;
3457 ptr += sizeof(binder_uintptr_t);
3458
3459 buffer = binder_alloc_prepare_to_free(&proc->alloc,
3460 data_ptr);
3461 if (buffer == NULL) {
3462 binder_user_error("%d:%d BC_FREE_BUFFER u%016llx no match\n",
3463 proc->pid, thread->pid, (u64)data_ptr);
3464 break;
3465 }
3466 if (!buffer->allow_user_free) {
3467 binder_user_error("%d:%d BC_FREE_BUFFER u%016llx matched unreturned buffer\n",
3468 proc->pid, thread->pid, (u64)data_ptr);
3469 break;
3470 }
3471 binder_debug(BINDER_DEBUG_FREE_BUFFER,
3472 "%d:%d BC_FREE_BUFFER u%016llx found buffer %d for %s transaction\n",
3473 proc->pid, thread->pid, (u64)data_ptr,
3474 buffer->debug_id,
3475 buffer->transaction ? "active" : "finished");
3476
3477 if (buffer->transaction) {
3478 buffer->transaction->buffer = NULL;
3479 buffer->transaction = NULL;
3480 }
3481 if (buffer->async_transaction && buffer->target_node) {
3482 struct binder_node *buf_node;
3483 struct binder_work *w;
3484
3485 buf_node = buffer->target_node;
3486 binder_node_inner_lock(buf_node);
3487 BUG_ON(!buf_node->has_async_transaction);
3488 BUG_ON(buf_node->proc != proc);
3489 w = binder_dequeue_work_head_ilocked(
3490 &buf_node->async_todo);
3491 if (!w) {
3492 buf_node->has_async_transaction = false;
3493 } else {
3494 binder_enqueue_work_ilocked(
3495 w, &proc->todo);
3496 binder_wakeup_proc_ilocked(proc);
3497 }
3498 binder_node_inner_unlock(buf_node);
3499 }
3500 trace_binder_transaction_buffer_release(buffer);
3501 binder_transaction_buffer_release(proc, buffer, NULL);
3502 binder_alloc_free_buf(&proc->alloc, buffer);
3503 break;
3504 }
3505
3506 case BC_TRANSACTION_SG:
3507 case BC_REPLY_SG: {
3508 struct binder_transaction_data_sg tr;
3509
3510 if (copy_from_user(&tr, ptr, sizeof(tr)))
3511 return -EFAULT;
3512 ptr += sizeof(tr);
3513 binder_transaction(proc, thread, &tr.transaction_data,
3514 cmd == BC_REPLY_SG, tr.buffers_size);
3515 break;
3516 }
3517 case BC_TRANSACTION:
3518 case BC_REPLY: {
3519 struct binder_transaction_data tr;
3520
3521 if (copy_from_user(&tr, ptr, sizeof(tr)))
3522 return -EFAULT;
3523 ptr += sizeof(tr);
3524 binder_transaction(proc, thread, &tr,
3525 cmd == BC_REPLY, 0);
3526 break;
3527 }
3528
3529 case BC_REGISTER_LOOPER:
3530 binder_debug(BINDER_DEBUG_THREADS,
3531 "%d:%d BC_REGISTER_LOOPER\n",
3532 proc->pid, thread->pid);
3533 binder_inner_proc_lock(proc);
3534 if (thread->looper & BINDER_LOOPER_STATE_ENTERED) {
3535 thread->looper |= BINDER_LOOPER_STATE_INVALID;
3536 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER\n",
3537 proc->pid, thread->pid);
3538 } else if (proc->requested_threads == 0) {
3539 thread->looper |= BINDER_LOOPER_STATE_INVALID;
3540 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called without request\n",
3541 proc->pid, thread->pid);
3542 } else {
3543 proc->requested_threads--;
3544 proc->requested_threads_started++;
3545 }
3546 thread->looper |= BINDER_LOOPER_STATE_REGISTERED;
3547 binder_inner_proc_unlock(proc);
3548 break;
3549 case BC_ENTER_LOOPER:
3550 binder_debug(BINDER_DEBUG_THREADS,
3551 "%d:%d BC_ENTER_LOOPER\n",
3552 proc->pid, thread->pid);
3553 if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) {
3554 thread->looper |= BINDER_LOOPER_STATE_INVALID;
3555 binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n",
3556 proc->pid, thread->pid);
3557 }
3558 thread->looper |= BINDER_LOOPER_STATE_ENTERED;
3559 break;
3560 case BC_EXIT_LOOPER:
3561 binder_debug(BINDER_DEBUG_THREADS,
3562 "%d:%d BC_EXIT_LOOPER\n",
3563 proc->pid, thread->pid);
3564 thread->looper |= BINDER_LOOPER_STATE_EXITED;
3565 break;
3566
3567 case BC_REQUEST_DEATH_NOTIFICATION:
3568 case BC_CLEAR_DEATH_NOTIFICATION: {
3569 uint32_t target;
3570 binder_uintptr_t cookie;
3571 struct binder_ref *ref;
3572 struct binder_ref_death *death = NULL;
3573
3574 if (get_user(target, (uint32_t __user *)ptr))
3575 return -EFAULT;
3576 ptr += sizeof(uint32_t);
3577 if (get_user(cookie, (binder_uintptr_t __user *)ptr))
3578 return -EFAULT;
3579 ptr += sizeof(binder_uintptr_t);
3580 if (cmd == BC_REQUEST_DEATH_NOTIFICATION) {
3581
3582
3583
3584
3585 death = kzalloc(sizeof(*death), GFP_KERNEL);
3586 if (death == NULL) {
3587 WARN_ON(thread->return_error.cmd !=
3588 BR_OK);
3589 thread->return_error.cmd = BR_ERROR;
3590 binder_enqueue_thread_work(
3591 thread,
3592 &thread->return_error.work);
3593 binder_debug(
3594 BINDER_DEBUG_FAILED_TRANSACTION,
3595 "%d:%d BC_REQUEST_DEATH_NOTIFICATION failed\n",
3596 proc->pid, thread->pid);
3597 break;
3598 }
3599 }
3600 binder_proc_lock(proc);
3601 ref = binder_get_ref_olocked(proc, target, false);
3602 if (ref == NULL) {
3603 binder_user_error("%d:%d %s invalid ref %d\n",
3604 proc->pid, thread->pid,
3605 cmd == BC_REQUEST_DEATH_NOTIFICATION ?
3606 "BC_REQUEST_DEATH_NOTIFICATION" :
3607 "BC_CLEAR_DEATH_NOTIFICATION",
3608 target);
3609 binder_proc_unlock(proc);
3610 kfree(death);
3611 break;
3612 }
3613
3614 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
3615 "%d:%d %s %016llx ref %d desc %d s %d w %d for node %d\n",
3616 proc->pid, thread->pid,
3617 cmd == BC_REQUEST_DEATH_NOTIFICATION ?
3618 "BC_REQUEST_DEATH_NOTIFICATION" :
3619 "BC_CLEAR_DEATH_NOTIFICATION",
3620 (u64)cookie, ref->data.debug_id,
3621 ref->data.desc, ref->data.strong,
3622 ref->data.weak, ref->node->debug_id);
3623
3624 binder_node_lock(ref->node);
3625 if (cmd == BC_REQUEST_DEATH_NOTIFICATION) {
3626 if (ref->death) {
3627 binder_user_error("%d:%d BC_REQUEST_DEATH_NOTIFICATION death notification already set\n",
3628 proc->pid, thread->pid);
3629 binder_node_unlock(ref->node);
3630 binder_proc_unlock(proc);
3631 kfree(death);
3632 break;
3633 }
3634 binder_stats_created(BINDER_STAT_DEATH);
3635 INIT_LIST_HEAD(&death->work.entry);
3636 death->cookie = cookie;
3637 ref->death = death;
3638 if (ref->node->proc == NULL) {
3639 ref->death->work.type = BINDER_WORK_DEAD_BINDER;
3640
3641 binder_inner_proc_lock(proc);
3642 binder_enqueue_work_ilocked(
3643 &ref->death->work, &proc->todo);
3644 binder_wakeup_proc_ilocked(proc);
3645 binder_inner_proc_unlock(proc);
3646 }
3647 } else {
3648 if (ref->death == NULL) {
3649 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification not active\n",
3650 proc->pid, thread->pid);
3651 binder_node_unlock(ref->node);
3652 binder_proc_unlock(proc);
3653 break;
3654 }
3655 death = ref->death;
3656 if (death->cookie != cookie) {
3657 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch %016llx != %016llx\n",
3658 proc->pid, thread->pid,
3659 (u64)death->cookie,
3660 (u64)cookie);
3661 binder_node_unlock(ref->node);
3662 binder_proc_unlock(proc);
3663 break;
3664 }
3665 ref->death = NULL;
3666 binder_inner_proc_lock(proc);
3667 if (list_empty(&death->work.entry)) {
3668 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;
3669 if (thread->looper &
3670 (BINDER_LOOPER_STATE_REGISTERED |
3671 BINDER_LOOPER_STATE_ENTERED))
3672 binder_enqueue_thread_work_ilocked(
3673 thread,
3674 &death->work);
3675 else {
3676 binder_enqueue_work_ilocked(
3677 &death->work,
3678 &proc->todo);
3679 binder_wakeup_proc_ilocked(
3680 proc);
3681 }
3682 } else {
3683 BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER);
3684 death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR;
3685 }
3686 binder_inner_proc_unlock(proc);
3687 }
3688 binder_node_unlock(ref->node);
3689 binder_proc_unlock(proc);
3690 } break;
3691 case BC_DEAD_BINDER_DONE: {
3692 struct binder_work *w;
3693 binder_uintptr_t cookie;
3694 struct binder_ref_death *death = NULL;
3695
3696 if (get_user(cookie, (binder_uintptr_t __user *)ptr))
3697 return -EFAULT;
3698
3699 ptr += sizeof(cookie);
3700 binder_inner_proc_lock(proc);
3701 list_for_each_entry(w, &proc->delivered_death,
3702 entry) {
3703 struct binder_ref_death *tmp_death =
3704 container_of(w,
3705 struct binder_ref_death,
3706 work);
3707
3708 if (tmp_death->cookie == cookie) {
3709 death = tmp_death;
3710 break;
3711 }
3712 }
3713 binder_debug(BINDER_DEBUG_DEAD_BINDER,
3714 "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
3715 proc->pid, thread->pid, (u64)cookie,
3716 death);
3717 if (death == NULL) {
3718 binder_user_error("%d:%d BC_DEAD_BINDER_DONE %016llx not found\n",
3719 proc->pid, thread->pid, (u64)cookie);
3720 binder_inner_proc_unlock(proc);
3721 break;
3722 }
3723 binder_dequeue_work_ilocked(&death->work);
3724 if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) {
3725 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;
3726 if (thread->looper &
3727 (BINDER_LOOPER_STATE_REGISTERED |
3728 BINDER_LOOPER_STATE_ENTERED))
3729 binder_enqueue_thread_work_ilocked(
3730 thread, &death->work);
3731 else {
3732 binder_enqueue_work_ilocked(
3733 &death->work,
3734 &proc->todo);
3735 binder_wakeup_proc_ilocked(proc);
3736 }
3737 }
3738 binder_inner_proc_unlock(proc);
3739 } break;
3740
3741 default:
3742 pr_err("%d:%d unknown command %d\n",
3743 proc->pid, thread->pid, cmd);
3744 return -EINVAL;
3745 }
3746 *consumed = ptr - buffer;
3747 }
3748 return 0;
3749}
3750
3751static void binder_stat_br(struct binder_proc *proc,
3752 struct binder_thread *thread, uint32_t cmd)
3753{
3754 trace_binder_return(cmd);
3755 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) {
3756 atomic_inc(&binder_stats.br[_IOC_NR(cmd)]);
3757 atomic_inc(&proc->stats.br[_IOC_NR(cmd)]);
3758 atomic_inc(&thread->stats.br[_IOC_NR(cmd)]);
3759 }
3760}
3761
3762static int binder_put_node_cmd(struct binder_proc *proc,
3763 struct binder_thread *thread,
3764 void __user **ptrp,
3765 binder_uintptr_t node_ptr,
3766 binder_uintptr_t node_cookie,
3767 int node_debug_id,
3768 uint32_t cmd, const char *cmd_name)
3769{
3770 void __user *ptr = *ptrp;
3771
3772 if (put_user(cmd, (uint32_t __user *)ptr))
3773 return -EFAULT;
3774 ptr += sizeof(uint32_t);
3775
3776 if (put_user(node_ptr, (binder_uintptr_t __user *)ptr))
3777 return -EFAULT;
3778 ptr += sizeof(binder_uintptr_t);
3779
3780 if (put_user(node_cookie, (binder_uintptr_t __user *)ptr))
3781 return -EFAULT;
3782 ptr += sizeof(binder_uintptr_t);
3783
3784 binder_stat_br(proc, thread, cmd);
3785 binder_debug(BINDER_DEBUG_USER_REFS, "%d:%d %s %d u%016llx c%016llx\n",
3786 proc->pid, thread->pid, cmd_name, node_debug_id,
3787 (u64)node_ptr, (u64)node_cookie);
3788
3789 *ptrp = ptr;
3790 return 0;
3791}
3792
3793static int binder_wait_for_work(struct binder_thread *thread,
3794 bool do_proc_work)
3795{
3796 DEFINE_WAIT(wait);
3797 struct binder_proc *proc = thread->proc;
3798 int ret = 0;
3799
3800 freezer_do_not_count();
3801 binder_inner_proc_lock(proc);
3802 for (;;) {
3803 prepare_to_wait(&thread->wait, &wait, TASK_INTERRUPTIBLE);
3804 if (binder_has_work_ilocked(thread, do_proc_work))
3805 break;
3806 if (do_proc_work)
3807 list_add(&thread->waiting_thread_node,
3808 &proc->waiting_threads);
3809 binder_inner_proc_unlock(proc);
3810 schedule();
3811 binder_inner_proc_lock(proc);
3812 list_del_init(&thread->waiting_thread_node);
3813 if (signal_pending(current)) {
3814 ret = -ERESTARTSYS;
3815 break;
3816 }
3817 }
3818 finish_wait(&thread->wait, &wait);
3819 binder_inner_proc_unlock(proc);
3820 freezer_count();
3821
3822 return ret;
3823}
3824
3825static int binder_thread_read(struct binder_proc *proc,
3826 struct binder_thread *thread,
3827 binder_uintptr_t binder_buffer, size_t size,
3828 binder_size_t *consumed, int non_block)
3829{
3830 void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
3831 void __user *ptr = buffer + *consumed;
3832 void __user *end = buffer + size;
3833
3834 int ret = 0;
3835 int wait_for_proc_work;
3836
3837 if (*consumed == 0) {
3838 if (put_user(BR_NOOP, (uint32_t __user *)ptr))
3839 return -EFAULT;
3840 ptr += sizeof(uint32_t);
3841 }
3842
3843retry:
3844 binder_inner_proc_lock(proc);
3845 wait_for_proc_work = binder_available_for_proc_work_ilocked(thread);
3846 binder_inner_proc_unlock(proc);
3847
3848 thread->looper |= BINDER_LOOPER_STATE_WAITING;
3849
3850 trace_binder_wait_for_work(wait_for_proc_work,
3851 !!thread->transaction_stack,
3852 !binder_worklist_empty(proc, &thread->todo));
3853 if (wait_for_proc_work) {
3854 if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
3855 BINDER_LOOPER_STATE_ENTERED))) {
3856 binder_user_error("%d:%d ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state %x)\n",
3857 proc->pid, thread->pid, thread->looper);
3858 wait_event_interruptible(binder_user_error_wait,
3859 binder_stop_on_user_error < 2);
3860 }
3861 binder_set_nice(proc->default_priority);
3862 }
3863
3864 if (non_block) {
3865 if (!binder_has_work(thread, wait_for_proc_work))
3866 ret = -EAGAIN;
3867 } else {
3868 ret = binder_wait_for_work(thread, wait_for_proc_work);
3869 }
3870
3871 thread->looper &= ~BINDER_LOOPER_STATE_WAITING;
3872
3873 if (ret)
3874 return ret;
3875
3876 while (1) {
3877 uint32_t cmd;
3878 struct binder_transaction_data tr;
3879 struct binder_work *w = NULL;
3880 struct list_head *list = NULL;
3881 struct binder_transaction *t = NULL;
3882 struct binder_thread *t_from;
3883
3884 binder_inner_proc_lock(proc);
3885 if (!binder_worklist_empty_ilocked(&thread->todo))
3886 list = &thread->todo;
3887 else if (!binder_worklist_empty_ilocked(&proc->todo) &&
3888 wait_for_proc_work)
3889 list = &proc->todo;
3890 else {
3891 binder_inner_proc_unlock(proc);
3892
3893
3894 if (ptr - buffer == 4 && !thread->looper_need_return)
3895 goto retry;
3896 break;
3897 }
3898
3899 if (end - ptr < sizeof(tr) + 4) {
3900 binder_inner_proc_unlock(proc);
3901 break;
3902 }
3903 w = binder_dequeue_work_head_ilocked(list);
3904 if (binder_worklist_empty_ilocked(&thread->todo))
3905 thread->process_todo = false;
3906
3907 switch (w->type) {
3908 case BINDER_WORK_TRANSACTION: {
3909 binder_inner_proc_unlock(proc);
3910 t = container_of(w, struct binder_transaction, work);
3911 } break;
3912 case BINDER_WORK_RETURN_ERROR: {
3913 struct binder_error *e = container_of(
3914 w, struct binder_error, work);
3915
3916 WARN_ON(e->cmd == BR_OK);
3917 binder_inner_proc_unlock(proc);
3918 if (put_user(e->cmd, (uint32_t __user *)ptr))
3919 return -EFAULT;
3920 e->cmd = BR_OK;
3921 ptr += sizeof(uint32_t);
3922
3923 binder_stat_br(proc, thread, e->cmd);
3924 } break;
3925 case BINDER_WORK_TRANSACTION_COMPLETE: {
3926 binder_inner_proc_unlock(proc);
3927 cmd = BR_TRANSACTION_COMPLETE;
3928 if (put_user(cmd, (uint32_t __user *)ptr))
3929 return -EFAULT;
3930 ptr += sizeof(uint32_t);
3931
3932 binder_stat_br(proc, thread, cmd);
3933 binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE,
3934 "%d:%d BR_TRANSACTION_COMPLETE\n",
3935 proc->pid, thread->pid);
3936 kfree(w);
3937 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
3938 } break;
3939 case BINDER_WORK_NODE: {
3940 struct binder_node *node = container_of(w, struct binder_node, work);
3941 int strong, weak;
3942 binder_uintptr_t node_ptr = node->ptr;
3943 binder_uintptr_t node_cookie = node->cookie;
3944 int node_debug_id = node->debug_id;
3945 int has_weak_ref;
3946 int has_strong_ref;
3947 void __user *orig_ptr = ptr;
3948
3949 BUG_ON(proc != node->proc);
3950 strong = node->internal_strong_refs ||
3951 node->local_strong_refs;
3952 weak = !hlist_empty(&node->refs) ||
3953 node->local_weak_refs ||
3954 node->tmp_refs || strong;
3955 has_strong_ref = node->has_strong_ref;
3956 has_weak_ref = node->has_weak_ref;
3957
3958 if (weak && !has_weak_ref) {
3959 node->has_weak_ref = 1;
3960 node->pending_weak_ref = 1;
3961 node->local_weak_refs++;
3962 }
3963 if (strong && !has_strong_ref) {
3964 node->has_strong_ref = 1;
3965 node->pending_strong_ref = 1;
3966 node->local_strong_refs++;
3967 }
3968 if (!strong && has_strong_ref)
3969 node->has_strong_ref = 0;
3970 if (!weak && has_weak_ref)
3971 node->has_weak_ref = 0;
3972 if (!weak && !strong) {
3973 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
3974 "%d:%d node %d u%016llx c%016llx deleted\n",
3975 proc->pid, thread->pid,
3976 node_debug_id,
3977 (u64)node_ptr,
3978 (u64)node_cookie);
3979 rb_erase(&node->rb_node, &proc->nodes);
3980 binder_inner_proc_unlock(proc);
3981 binder_node_lock(node);
3982
3983
3984
3985
3986
3987
3988
3989
3990
3991 binder_node_unlock(node);
3992 binder_free_node(node);
3993 } else
3994 binder_inner_proc_unlock(proc);
3995
3996 if (weak && !has_weak_ref)
3997 ret = binder_put_node_cmd(
3998 proc, thread, &ptr, node_ptr,
3999 node_cookie, node_debug_id,
4000 BR_INCREFS, "BR_INCREFS");
4001 if (!ret && strong && !has_strong_ref)
4002 ret = binder_put_node_cmd(
4003 proc, thread, &ptr, node_ptr,
4004 node_cookie, node_debug_id,
4005 BR_ACQUIRE, "BR_ACQUIRE");
4006 if (!ret && !strong && has_strong_ref)
4007 ret = binder_put_node_cmd(
4008 proc, thread, &ptr, node_ptr,
4009 node_cookie, node_debug_id,
4010 BR_RELEASE, "BR_RELEASE");
4011 if (!ret && !weak && has_weak_ref)
4012 ret = binder_put_node_cmd(
4013 proc, thread, &ptr, node_ptr,
4014 node_cookie, node_debug_id,
4015 BR_DECREFS, "BR_DECREFS");
4016 if (orig_ptr == ptr)
4017 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
4018 "%d:%d node %d u%016llx c%016llx state unchanged\n",
4019 proc->pid, thread->pid,
4020 node_debug_id,
4021 (u64)node_ptr,
4022 (u64)node_cookie);
4023 if (ret)
4024 return ret;
4025 } break;
4026 case BINDER_WORK_DEAD_BINDER:
4027 case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
4028 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
4029 struct binder_ref_death *death;
4030 uint32_t cmd;
4031 binder_uintptr_t cookie;
4032
4033 death = container_of(w, struct binder_ref_death, work);
4034 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION)
4035 cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE;
4036 else
4037 cmd = BR_DEAD_BINDER;
4038 cookie = death->cookie;
4039
4040 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
4041 "%d:%d %s %016llx\n",
4042 proc->pid, thread->pid,
4043 cmd == BR_DEAD_BINDER ?
4044 "BR_DEAD_BINDER" :
4045 "BR_CLEAR_DEATH_NOTIFICATION_DONE",
4046 (u64)cookie);
4047 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) {
4048 binder_inner_proc_unlock(proc);
4049 kfree(death);
4050 binder_stats_deleted(BINDER_STAT_DEATH);
4051 } else {
4052 binder_enqueue_work_ilocked(
4053 w, &proc->delivered_death);
4054 binder_inner_proc_unlock(proc);
4055 }
4056 if (put_user(cmd, (uint32_t __user *)ptr))
4057 return -EFAULT;
4058 ptr += sizeof(uint32_t);
4059 if (put_user(cookie,
4060 (binder_uintptr_t __user *)ptr))
4061 return -EFAULT;
4062 ptr += sizeof(binder_uintptr_t);
4063 binder_stat_br(proc, thread, cmd);
4064 if (cmd == BR_DEAD_BINDER)
4065 goto done;
4066 } break;
4067 }
4068
4069 if (!t)
4070 continue;
4071
4072 BUG_ON(t->buffer == NULL);
4073 if (t->buffer->target_node) {
4074 struct binder_node *target_node = t->buffer->target_node;
4075
4076 tr.target.ptr = target_node->ptr;
4077 tr.cookie = target_node->cookie;
4078 t->saved_priority = task_nice(current);
4079 if (t->priority < target_node->min_priority &&
4080 !(t->flags & TF_ONE_WAY))
4081 binder_set_nice(t->priority);
4082 else if (!(t->flags & TF_ONE_WAY) ||
4083 t->saved_priority > target_node->min_priority)
4084 binder_set_nice(target_node->min_priority);
4085 cmd = BR_TRANSACTION;
4086 } else {
4087 tr.target.ptr = 0;
4088 tr.cookie = 0;
4089 cmd = BR_REPLY;
4090 }
4091 tr.code = t->code;
4092 tr.flags = t->flags;
4093 tr.sender_euid = from_kuid(current_user_ns(), t->sender_euid);
4094
4095 t_from = binder_get_txn_from(t);
4096 if (t_from) {
4097 struct task_struct *sender = t_from->proc->tsk;
4098
4099 tr.sender_pid = task_tgid_nr_ns(sender,
4100 task_active_pid_ns(current));
4101 } else {
4102 tr.sender_pid = 0;
4103 }
4104
4105 tr.data_size = t->buffer->data_size;
4106 tr.offsets_size = t->buffer->offsets_size;
4107 tr.data.ptr.buffer = (binder_uintptr_t)
4108 ((uintptr_t)t->buffer->data +
4109 binder_alloc_get_user_buffer_offset(&proc->alloc));
4110 tr.data.ptr.offsets = tr.data.ptr.buffer +
4111 ALIGN(t->buffer->data_size,
4112 sizeof(void *));
4113
4114 if (put_user(cmd, (uint32_t __user *)ptr)) {
4115 if (t_from)
4116 binder_thread_dec_tmpref(t_from);
4117
4118 binder_cleanup_transaction(t, "put_user failed",
4119 BR_FAILED_REPLY);
4120
4121 return -EFAULT;
4122 }
4123 ptr += sizeof(uint32_t);
4124 if (copy_to_user(ptr, &tr, sizeof(tr))) {
4125 if (t_from)
4126 binder_thread_dec_tmpref(t_from);
4127
4128 binder_cleanup_transaction(t, "copy_to_user failed",
4129 BR_FAILED_REPLY);
4130
4131 return -EFAULT;
4132 }
4133 ptr += sizeof(tr);
4134
4135 trace_binder_transaction_received(t);
4136 binder_stat_br(proc, thread, cmd);
4137 binder_debug(BINDER_DEBUG_TRANSACTION,
4138 "%d:%d %s %d %d:%d, cmd %d size %zd-%zd ptr %016llx-%016llx\n",
4139 proc->pid, thread->pid,
4140 (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" :
4141 "BR_REPLY",
4142 t->debug_id, t_from ? t_from->proc->pid : 0,
4143 t_from ? t_from->pid : 0, cmd,
4144 t->buffer->data_size, t->buffer->offsets_size,
4145 (u64)tr.data.ptr.buffer, (u64)tr.data.ptr.offsets);
4146
4147 if (t_from)
4148 binder_thread_dec_tmpref(t_from);
4149 t->buffer->allow_user_free = 1;
4150 if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) {
4151 binder_inner_proc_lock(thread->proc);
4152 t->to_parent = thread->transaction_stack;
4153 t->to_thread = thread;
4154 thread->transaction_stack = t;
4155 binder_inner_proc_unlock(thread->proc);
4156 } else {
4157 binder_free_transaction(t);
4158 }
4159 break;
4160 }
4161
4162done:
4163
4164 *consumed = ptr - buffer;
4165 binder_inner_proc_lock(proc);
4166 if (proc->requested_threads == 0 &&
4167 list_empty(&thread->proc->waiting_threads) &&
4168 proc->requested_threads_started < proc->max_threads &&
4169 (thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
4170 BINDER_LOOPER_STATE_ENTERED))
4171 ) {
4172 proc->requested_threads++;
4173 binder_inner_proc_unlock(proc);
4174 binder_debug(BINDER_DEBUG_THREADS,
4175 "%d:%d BR_SPAWN_LOOPER\n",
4176 proc->pid, thread->pid);
4177 if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer))
4178 return -EFAULT;
4179 binder_stat_br(proc, thread, BR_SPAWN_LOOPER);
4180 } else
4181 binder_inner_proc_unlock(proc);
4182 return 0;
4183}
4184
4185static void binder_release_work(struct binder_proc *proc,
4186 struct list_head *list)
4187{
4188 struct binder_work *w;
4189
4190 while (1) {
4191 w = binder_dequeue_work_head(proc, list);
4192 if (!w)
4193 return;
4194
4195 switch (w->type) {
4196 case BINDER_WORK_TRANSACTION: {
4197 struct binder_transaction *t;
4198
4199 t = container_of(w, struct binder_transaction, work);
4200
4201 binder_cleanup_transaction(t, "process died.",
4202 BR_DEAD_REPLY);
4203 } break;
4204 case BINDER_WORK_RETURN_ERROR: {
4205 struct binder_error *e = container_of(
4206 w, struct binder_error, work);
4207
4208 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
4209 "undelivered TRANSACTION_ERROR: %u\n",
4210 e->cmd);
4211 } break;
4212 case BINDER_WORK_TRANSACTION_COMPLETE: {
4213 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
4214 "undelivered TRANSACTION_COMPLETE\n");
4215 kfree(w);
4216 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
4217 } break;
4218 case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
4219 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
4220 struct binder_ref_death *death;
4221
4222 death = container_of(w, struct binder_ref_death, work);
4223 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
4224 "undelivered death notification, %016llx\n",
4225 (u64)death->cookie);
4226 kfree(death);
4227 binder_stats_deleted(BINDER_STAT_DEATH);
4228 } break;
4229 default:
4230 pr_err("unexpected work type, %d, not freed\n",
4231 w->type);
4232 break;
4233 }
4234 }
4235
4236}
4237
4238static struct binder_thread *binder_get_thread_ilocked(
4239 struct binder_proc *proc, struct binder_thread *new_thread)
4240{
4241 struct binder_thread *thread = NULL;
4242 struct rb_node *parent = NULL;
4243 struct rb_node **p = &proc->threads.rb_node;
4244
4245 while (*p) {
4246 parent = *p;
4247 thread = rb_entry(parent, struct binder_thread, rb_node);
4248
4249 if (current->pid < thread->pid)
4250 p = &(*p)->rb_left;
4251 else if (current->pid > thread->pid)
4252 p = &(*p)->rb_right;
4253 else
4254 return thread;
4255 }
4256 if (!new_thread)
4257 return NULL;
4258 thread = new_thread;
4259 binder_stats_created(BINDER_STAT_THREAD);
4260 thread->proc = proc;
4261 thread->pid = current->pid;
4262 atomic_set(&thread->tmp_ref, 0);
4263 init_waitqueue_head(&thread->wait);
4264 INIT_LIST_HEAD(&thread->todo);
4265 rb_link_node(&thread->rb_node, parent, p);
4266 rb_insert_color(&thread->rb_node, &proc->threads);
4267 thread->looper_need_return = true;
4268 thread->return_error.work.type = BINDER_WORK_RETURN_ERROR;
4269 thread->return_error.cmd = BR_OK;
4270 thread->reply_error.work.type = BINDER_WORK_RETURN_ERROR;
4271 thread->reply_error.cmd = BR_OK;
4272 INIT_LIST_HEAD(&new_thread->waiting_thread_node);
4273 return thread;
4274}
4275
4276static struct binder_thread *binder_get_thread(struct binder_proc *proc)
4277{
4278 struct binder_thread *thread;
4279 struct binder_thread *new_thread;
4280
4281 binder_inner_proc_lock(proc);
4282 thread = binder_get_thread_ilocked(proc, NULL);
4283 binder_inner_proc_unlock(proc);
4284 if (!thread) {
4285 new_thread = kzalloc(sizeof(*thread), GFP_KERNEL);
4286 if (new_thread == NULL)
4287 return NULL;
4288 binder_inner_proc_lock(proc);
4289 thread = binder_get_thread_ilocked(proc, new_thread);
4290 binder_inner_proc_unlock(proc);
4291 if (thread != new_thread)
4292 kfree(new_thread);
4293 }
4294 return thread;
4295}
4296
4297static void binder_free_proc(struct binder_proc *proc)
4298{
4299 BUG_ON(!list_empty(&proc->todo));
4300 BUG_ON(!list_empty(&proc->delivered_death));
4301 binder_alloc_deferred_release(&proc->alloc);
4302 put_task_struct(proc->tsk);
4303 binder_stats_deleted(BINDER_STAT_PROC);
4304 kfree(proc);
4305}
4306
4307static void binder_free_thread(struct binder_thread *thread)
4308{
4309 BUG_ON(!list_empty(&thread->todo));
4310 binder_stats_deleted(BINDER_STAT_THREAD);
4311 binder_proc_dec_tmpref(thread->proc);
4312 kfree(thread);
4313}
4314
4315static int binder_thread_release(struct binder_proc *proc,
4316 struct binder_thread *thread)
4317{
4318 struct binder_transaction *t;
4319 struct binder_transaction *send_reply = NULL;
4320 int active_transactions = 0;
4321 struct binder_transaction *last_t = NULL;
4322
4323 binder_inner_proc_lock(thread->proc);
4324
4325
4326
4327
4328
4329
4330 proc->tmp_ref++;
4331
4332
4333
4334
4335 atomic_inc(&thread->tmp_ref);
4336 rb_erase(&thread->rb_node, &proc->threads);
4337 t = thread->transaction_stack;
4338 if (t) {
4339 spin_lock(&t->lock);
4340 if (t->to_thread == thread)
4341 send_reply = t;
4342 }
4343 thread->is_dead = true;
4344
4345 while (t) {
4346 last_t = t;
4347 active_transactions++;
4348 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
4349 "release %d:%d transaction %d %s, still active\n",
4350 proc->pid, thread->pid,
4351 t->debug_id,
4352 (t->to_thread == thread) ? "in" : "out");
4353
4354 if (t->to_thread == thread) {
4355 t->to_proc = NULL;
4356 t->to_thread = NULL;
4357 if (t->buffer) {
4358 t->buffer->transaction = NULL;
4359 t->buffer = NULL;
4360 }
4361 t = t->to_parent;
4362 } else if (t->from == thread) {
4363 t->from = NULL;
4364 t = t->from_parent;
4365 } else
4366 BUG();
4367 spin_unlock(&last_t->lock);
4368 if (t)
4369 spin_lock(&t->lock);
4370 }
4371
4372
4373
4374
4375
4376
4377
4378 if ((thread->looper & BINDER_LOOPER_STATE_POLL) &&
4379 waitqueue_active(&thread->wait)) {
4380 wake_up_poll(&thread->wait, EPOLLHUP | POLLFREE);
4381 }
4382
4383 binder_inner_proc_unlock(thread->proc);
4384
4385
4386
4387
4388
4389
4390
4391 if (thread->looper & BINDER_LOOPER_STATE_POLL)
4392 synchronize_rcu();
4393
4394 if (send_reply)
4395 binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
4396 binder_release_work(proc, &thread->todo);
4397 binder_thread_dec_tmpref(thread);
4398 return active_transactions;
4399}
4400
4401static __poll_t binder_poll(struct file *filp,
4402 struct poll_table_struct *wait)
4403{
4404 struct binder_proc *proc = filp->private_data;
4405 struct binder_thread *thread = NULL;
4406 bool wait_for_proc_work;
4407
4408 thread = binder_get_thread(proc);
4409 if (!thread)
4410 return POLLERR;
4411
4412 binder_inner_proc_lock(thread->proc);
4413 thread->looper |= BINDER_LOOPER_STATE_POLL;
4414 wait_for_proc_work = binder_available_for_proc_work_ilocked(thread);
4415
4416 binder_inner_proc_unlock(thread->proc);
4417
4418 poll_wait(filp, &thread->wait, wait);
4419
4420 if (binder_has_work(thread, wait_for_proc_work))
4421 return EPOLLIN;
4422
4423 return 0;
4424}
4425
4426static int binder_ioctl_write_read(struct file *filp,
4427 unsigned int cmd, unsigned long arg,
4428 struct binder_thread *thread)
4429{
4430 int ret = 0;
4431 struct binder_proc *proc = filp->private_data;
4432 unsigned int size = _IOC_SIZE(cmd);
4433 void __user *ubuf = (void __user *)arg;
4434 struct binder_write_read bwr;
4435
4436 if (size != sizeof(struct binder_write_read)) {
4437 ret = -EINVAL;
4438 goto out;
4439 }
4440 if (copy_from_user(&bwr, ubuf, sizeof(bwr))) {
4441 ret = -EFAULT;
4442 goto out;
4443 }
4444 binder_debug(BINDER_DEBUG_READ_WRITE,
4445 "%d:%d write %lld at %016llx, read %lld at %016llx\n",
4446 proc->pid, thread->pid,
4447 (u64)bwr.write_size, (u64)bwr.write_buffer,
4448 (u64)bwr.read_size, (u64)bwr.read_buffer);
4449
4450 if (bwr.write_size > 0) {
4451 ret = binder_thread_write(proc, thread,
4452 bwr.write_buffer,
4453 bwr.write_size,
4454 &bwr.write_consumed);
4455 trace_binder_write_done(ret);
4456 if (ret < 0) {
4457 bwr.read_consumed = 0;
4458 if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
4459 ret = -EFAULT;
4460 goto out;
4461 }
4462 }
4463 if (bwr.read_size > 0) {
4464 ret = binder_thread_read(proc, thread, bwr.read_buffer,
4465 bwr.read_size,
4466 &bwr.read_consumed,
4467 filp->f_flags & O_NONBLOCK);
4468 trace_binder_read_done(ret);
4469 binder_inner_proc_lock(proc);
4470 if (!binder_worklist_empty_ilocked(&proc->todo))
4471 binder_wakeup_proc_ilocked(proc);
4472 binder_inner_proc_unlock(proc);
4473 if (ret < 0) {
4474 if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
4475 ret = -EFAULT;
4476 goto out;
4477 }
4478 }
4479 binder_debug(BINDER_DEBUG_READ_WRITE,
4480 "%d:%d wrote %lld of %lld, read return %lld of %lld\n",
4481 proc->pid, thread->pid,
4482 (u64)bwr.write_consumed, (u64)bwr.write_size,
4483 (u64)bwr.read_consumed, (u64)bwr.read_size);
4484 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) {
4485 ret = -EFAULT;
4486 goto out;
4487 }
4488out:
4489 return ret;
4490}
4491
4492static int binder_ioctl_set_ctx_mgr(struct file *filp)
4493{
4494 int ret = 0;
4495 struct binder_proc *proc = filp->private_data;
4496 struct binder_context *context = proc->context;
4497 struct binder_node *new_node;
4498 kuid_t curr_euid = current_euid();
4499
4500 mutex_lock(&context->context_mgr_node_lock);
4501 if (context->binder_context_mgr_node) {
4502 pr_err("BINDER_SET_CONTEXT_MGR already set\n");
4503 ret = -EBUSY;
4504 goto out;
4505 }
4506 ret = security_binder_set_context_mgr(proc->tsk);
4507 if (ret < 0)
4508 goto out;
4509 if (uid_valid(context->binder_context_mgr_uid)) {
4510 if (!uid_eq(context->binder_context_mgr_uid, curr_euid)) {
4511 pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n",
4512 from_kuid(&init_user_ns, curr_euid),
4513 from_kuid(&init_user_ns,
4514 context->binder_context_mgr_uid));
4515 ret = -EPERM;
4516 goto out;
4517 }
4518 } else {
4519 context->binder_context_mgr_uid = curr_euid;
4520 }
4521 new_node = binder_new_node(proc, NULL);
4522 if (!new_node) {
4523 ret = -ENOMEM;
4524 goto out;
4525 }
4526 binder_node_lock(new_node);
4527 new_node->local_weak_refs++;
4528 new_node->local_strong_refs++;
4529 new_node->has_strong_ref = 1;
4530 new_node->has_weak_ref = 1;
4531 context->binder_context_mgr_node = new_node;
4532 binder_node_unlock(new_node);
4533 binder_put_node(new_node);
4534out:
4535 mutex_unlock(&context->context_mgr_node_lock);
4536 return ret;
4537}
4538
4539static int binder_ioctl_get_node_debug_info(struct binder_proc *proc,
4540 struct binder_node_debug_info *info)
4541{
4542 struct rb_node *n;
4543 binder_uintptr_t ptr = info->ptr;
4544
4545 memset(info, 0, sizeof(*info));
4546
4547 binder_inner_proc_lock(proc);
4548 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) {
4549 struct binder_node *node = rb_entry(n, struct binder_node,
4550 rb_node);
4551 if (node->ptr > ptr) {
4552 info->ptr = node->ptr;
4553 info->cookie = node->cookie;
4554 info->has_strong_ref = node->has_strong_ref;
4555 info->has_weak_ref = node->has_weak_ref;
4556 break;
4557 }
4558 }
4559 binder_inner_proc_unlock(proc);
4560
4561 return 0;
4562}
4563
4564static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
4565{
4566 int ret;
4567 struct binder_proc *proc = filp->private_data;
4568 struct binder_thread *thread;
4569 unsigned int size = _IOC_SIZE(cmd);
4570 void __user *ubuf = (void __user *)arg;
4571
4572
4573
4574
4575 binder_selftest_alloc(&proc->alloc);
4576
4577 trace_binder_ioctl(cmd, arg);
4578
4579 ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
4580 if (ret)
4581 goto err_unlocked;
4582
4583 thread = binder_get_thread(proc);
4584 if (thread == NULL) {
4585 ret = -ENOMEM;
4586 goto err;
4587 }
4588
4589 switch (cmd) {
4590 case BINDER_WRITE_READ:
4591 ret = binder_ioctl_write_read(filp, cmd, arg, thread);
4592 if (ret)
4593 goto err;
4594 break;
4595 case BINDER_SET_MAX_THREADS: {
4596 int max_threads;
4597
4598 if (copy_from_user(&max_threads, ubuf,
4599 sizeof(max_threads))) {
4600 ret = -EINVAL;
4601 goto err;
4602 }
4603 binder_inner_proc_lock(proc);
4604 proc->max_threads = max_threads;
4605 binder_inner_proc_unlock(proc);
4606 break;
4607 }
4608 case BINDER_SET_CONTEXT_MGR:
4609 ret = binder_ioctl_set_ctx_mgr(filp);
4610 if (ret)
4611 goto err;
4612 break;
4613 case BINDER_THREAD_EXIT:
4614 binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n",
4615 proc->pid, thread->pid);
4616 binder_thread_release(proc, thread);
4617 thread = NULL;
4618 break;
4619 case BINDER_VERSION: {
4620 struct binder_version __user *ver = ubuf;
4621
4622 if (size != sizeof(struct binder_version)) {
4623 ret = -EINVAL;
4624 goto err;
4625 }
4626 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION,
4627 &ver->protocol_version)) {
4628 ret = -EINVAL;
4629 goto err;
4630 }
4631 break;
4632 }
4633 case BINDER_GET_NODE_DEBUG_INFO: {
4634 struct binder_node_debug_info info;
4635
4636 if (copy_from_user(&info, ubuf, sizeof(info))) {
4637 ret = -EFAULT;
4638 goto err;
4639 }
4640
4641 ret = binder_ioctl_get_node_debug_info(proc, &info);
4642 if (ret < 0)
4643 goto err;
4644
4645 if (copy_to_user(ubuf, &info, sizeof(info))) {
4646 ret = -EFAULT;
4647 goto err;
4648 }
4649 break;
4650 }
4651 default:
4652 ret = -EINVAL;
4653 goto err;
4654 }
4655 ret = 0;
4656err:
4657 if (thread)
4658 thread->looper_need_return = false;
4659 wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
4660 if (ret && ret != -ERESTARTSYS)
4661 pr_info("%d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret);
4662err_unlocked:
4663 trace_binder_ioctl_done(ret);
4664 return ret;
4665}
4666
4667static void binder_vma_open(struct vm_area_struct *vma)
4668{
4669 struct binder_proc *proc = vma->vm_private_data;
4670
4671 binder_debug(BINDER_DEBUG_OPEN_CLOSE,
4672 "%d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
4673 proc->pid, vma->vm_start, vma->vm_end,
4674 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
4675 (unsigned long)pgprot_val(vma->vm_page_prot));
4676}
4677
4678static void binder_vma_close(struct vm_area_struct *vma)
4679{
4680 struct binder_proc *proc = vma->vm_private_data;
4681
4682 binder_debug(BINDER_DEBUG_OPEN_CLOSE,
4683 "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
4684 proc->pid, vma->vm_start, vma->vm_end,
4685 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
4686 (unsigned long)pgprot_val(vma->vm_page_prot));
4687 binder_alloc_vma_close(&proc->alloc);
4688 binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
4689}
4690
4691static int binder_vm_fault(struct vm_fault *vmf)
4692{
4693 return VM_FAULT_SIGBUS;
4694}
4695
4696static const struct vm_operations_struct binder_vm_ops = {
4697 .open = binder_vma_open,
4698 .close = binder_vma_close,
4699 .fault = binder_vm_fault,
4700};
4701
4702static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
4703{
4704 int ret;
4705 struct binder_proc *proc = filp->private_data;
4706 const char *failure_string;
4707
4708 if (proc->tsk != current->group_leader)
4709 return -EINVAL;
4710
4711 if ((vma->vm_end - vma->vm_start) > SZ_4M)
4712 vma->vm_end = vma->vm_start + SZ_4M;
4713
4714 binder_debug(BINDER_DEBUG_OPEN_CLOSE,
4715 "%s: %d %lx-%lx (%ld K) vma %lx pagep %lx\n",
4716 __func__, proc->pid, vma->vm_start, vma->vm_end,
4717 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
4718 (unsigned long)pgprot_val(vma->vm_page_prot));
4719
4720 if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) {
4721 ret = -EPERM;
4722 failure_string = "bad vm_flags";
4723 goto err_bad_arg;
4724 }
4725 vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE;
4726 vma->vm_ops = &binder_vm_ops;
4727 vma->vm_private_data = proc;
4728
4729 ret = binder_alloc_mmap_handler(&proc->alloc, vma);
4730 if (ret)
4731 return ret;
4732 mutex_lock(&proc->files_lock);
4733 proc->files = get_files_struct(current);
4734 mutex_unlock(&proc->files_lock);
4735 return 0;
4736
4737err_bad_arg:
4738 pr_err("%s: %d %lx-%lx %s failed %d\n", __func__,
4739 proc->pid, vma->vm_start, vma->vm_end, failure_string, ret);
4740 return ret;
4741}
4742
4743static int binder_open(struct inode *nodp, struct file *filp)
4744{
4745 struct binder_proc *proc;
4746 struct binder_device *binder_dev;
4747
4748 binder_debug(BINDER_DEBUG_OPEN_CLOSE, "%s: %d:%d\n", __func__,
4749 current->group_leader->pid, current->pid);
4750
4751 proc = kzalloc(sizeof(*proc), GFP_KERNEL);
4752 if (proc == NULL)
4753 return -ENOMEM;
4754 spin_lock_init(&proc->inner_lock);
4755 spin_lock_init(&proc->outer_lock);
4756 get_task_struct(current->group_leader);
4757 proc->tsk = current->group_leader;
4758 mutex_init(&proc->files_lock);
4759 INIT_LIST_HEAD(&proc->todo);
4760 proc->default_priority = task_nice(current);
4761 binder_dev = container_of(filp->private_data, struct binder_device,
4762 miscdev);
4763 proc->context = &binder_dev->context;
4764 binder_alloc_init(&proc->alloc);
4765
4766 binder_stats_created(BINDER_STAT_PROC);
4767 proc->pid = current->group_leader->pid;
4768 INIT_LIST_HEAD(&proc->delivered_death);
4769 INIT_LIST_HEAD(&proc->waiting_threads);
4770 filp->private_data = proc;
4771
4772 mutex_lock(&binder_procs_lock);
4773 hlist_add_head(&proc->proc_node, &binder_procs);
4774 mutex_unlock(&binder_procs_lock);
4775
4776 if (binder_debugfs_dir_entry_proc) {
4777 char strbuf[11];
4778
4779 snprintf(strbuf, sizeof(strbuf), "%u", proc->pid);
4780
4781
4782
4783
4784
4785
4786
4787 proc->debugfs_entry = debugfs_create_file(strbuf, 0444,
4788 binder_debugfs_dir_entry_proc,
4789 (void *)(unsigned long)proc->pid,
4790 &binder_proc_fops);
4791 }
4792
4793 return 0;
4794}
4795
4796static int binder_flush(struct file *filp, fl_owner_t id)
4797{
4798 struct binder_proc *proc = filp->private_data;
4799
4800 binder_defer_work(proc, BINDER_DEFERRED_FLUSH);
4801
4802 return 0;
4803}
4804
4805static void binder_deferred_flush(struct binder_proc *proc)
4806{
4807 struct rb_node *n;
4808 int wake_count = 0;
4809
4810 binder_inner_proc_lock(proc);
4811 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) {
4812 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node);
4813
4814 thread->looper_need_return = true;
4815 if (thread->looper & BINDER_LOOPER_STATE_WAITING) {
4816 wake_up_interruptible(&thread->wait);
4817 wake_count++;
4818 }
4819 }
4820 binder_inner_proc_unlock(proc);
4821
4822 binder_debug(BINDER_DEBUG_OPEN_CLOSE,
4823 "binder_flush: %d woke %d threads\n", proc->pid,
4824 wake_count);
4825}
4826
4827static int binder_release(struct inode *nodp, struct file *filp)
4828{
4829 struct binder_proc *proc = filp->private_data;
4830
4831 debugfs_remove(proc->debugfs_entry);
4832 binder_defer_work(proc, BINDER_DEFERRED_RELEASE);
4833
4834 return 0;
4835}
4836
4837static int binder_node_release(struct binder_node *node, int refs)
4838{
4839 struct binder_ref *ref;
4840 int death = 0;
4841 struct binder_proc *proc = node->proc;
4842
4843 binder_release_work(proc, &node->async_todo);
4844
4845 binder_node_lock(node);
4846 binder_inner_proc_lock(proc);
4847 binder_dequeue_work_ilocked(&node->work);
4848
4849
4850
4851 BUG_ON(!node->tmp_refs);
4852 if (hlist_empty(&node->refs) && node->tmp_refs == 1) {
4853 binder_inner_proc_unlock(proc);
4854 binder_node_unlock(node);
4855 binder_free_node(node);
4856
4857 return refs;
4858 }
4859
4860 node->proc = NULL;
4861 node->local_strong_refs = 0;
4862 node->local_weak_refs = 0;
4863 binder_inner_proc_unlock(proc);
4864
4865 spin_lock(&binder_dead_nodes_lock);
4866 hlist_add_head(&node->dead_node, &binder_dead_nodes);
4867 spin_unlock(&binder_dead_nodes_lock);
4868
4869 hlist_for_each_entry(ref, &node->refs, node_entry) {
4870 refs++;
4871
4872
4873
4874
4875
4876
4877 binder_inner_proc_lock(ref->proc);
4878 if (!ref->death) {
4879 binder_inner_proc_unlock(ref->proc);
4880 continue;
4881 }
4882
4883 death++;
4884
4885 BUG_ON(!list_empty(&ref->death->work.entry));
4886 ref->death->work.type = BINDER_WORK_DEAD_BINDER;
4887 binder_enqueue_work_ilocked(&ref->death->work,
4888 &ref->proc->todo);
4889 binder_wakeup_proc_ilocked(ref->proc);
4890 binder_inner_proc_unlock(ref->proc);
4891 }
4892
4893 binder_debug(BINDER_DEBUG_DEAD_BINDER,
4894 "node %d now dead, refs %d, death %d\n",
4895 node->debug_id, refs, death);
4896 binder_node_unlock(node);
4897 binder_put_node(node);
4898
4899 return refs;
4900}
4901
4902static void binder_deferred_release(struct binder_proc *proc)
4903{
4904 struct binder_context *context = proc->context;
4905 struct rb_node *n;
4906 int threads, nodes, incoming_refs, outgoing_refs, active_transactions;
4907
4908 BUG_ON(proc->files);
4909
4910 mutex_lock(&binder_procs_lock);
4911 hlist_del(&proc->proc_node);
4912 mutex_unlock(&binder_procs_lock);
4913
4914 mutex_lock(&context->context_mgr_node_lock);
4915 if (context->binder_context_mgr_node &&
4916 context->binder_context_mgr_node->proc == proc) {
4917 binder_debug(BINDER_DEBUG_DEAD_BINDER,
4918 "%s: %d context_mgr_node gone\n",
4919 __func__, proc->pid);
4920 context->binder_context_mgr_node = NULL;
4921 }
4922 mutex_unlock(&context->context_mgr_node_lock);
4923 binder_inner_proc_lock(proc);
4924
4925
4926
4927
4928 proc->tmp_ref++;
4929
4930 proc->is_dead = true;
4931 threads = 0;
4932 active_transactions = 0;
4933 while ((n = rb_first(&proc->threads))) {
4934 struct binder_thread *thread;
4935
4936 thread = rb_entry(n, struct binder_thread, rb_node);
4937 binder_inner_proc_unlock(proc);
4938 threads++;
4939 active_transactions += binder_thread_release(proc, thread);
4940 binder_inner_proc_lock(proc);
4941 }
4942
4943 nodes = 0;
4944 incoming_refs = 0;
4945 while ((n = rb_first(&proc->nodes))) {
4946 struct binder_node *node;
4947
4948 node = rb_entry(n, struct binder_node, rb_node);
4949 nodes++;
4950
4951
4952
4953
4954
4955 binder_inc_node_tmpref_ilocked(node);
4956 rb_erase(&node->rb_node, &proc->nodes);
4957 binder_inner_proc_unlock(proc);
4958 incoming_refs = binder_node_release(node, incoming_refs);
4959 binder_inner_proc_lock(proc);
4960 }
4961 binder_inner_proc_unlock(proc);
4962
4963 outgoing_refs = 0;
4964 binder_proc_lock(proc);
4965 while ((n = rb_first(&proc->refs_by_desc))) {
4966 struct binder_ref *ref;
4967
4968 ref = rb_entry(n, struct binder_ref, rb_node_desc);
4969 outgoing_refs++;
4970 binder_cleanup_ref_olocked(ref);
4971 binder_proc_unlock(proc);
4972 binder_free_ref(ref);
4973 binder_proc_lock(proc);
4974 }
4975 binder_proc_unlock(proc);
4976
4977 binder_release_work(proc, &proc->todo);
4978 binder_release_work(proc, &proc->delivered_death);
4979
4980 binder_debug(BINDER_DEBUG_OPEN_CLOSE,
4981 "%s: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d\n",
4982 __func__, proc->pid, threads, nodes, incoming_refs,
4983 outgoing_refs, active_transactions);
4984
4985 binder_proc_dec_tmpref(proc);
4986}
4987
4988static void binder_deferred_func(struct work_struct *work)
4989{
4990 struct binder_proc *proc;
4991 struct files_struct *files;
4992
4993 int defer;
4994
4995 do {
4996 mutex_lock(&binder_deferred_lock);
4997 if (!hlist_empty(&binder_deferred_list)) {
4998 proc = hlist_entry(binder_deferred_list.first,
4999 struct binder_proc, deferred_work_node);
5000 hlist_del_init(&proc->deferred_work_node);
5001 defer = proc->deferred_work;
5002 proc->deferred_work = 0;
5003 } else {
5004 proc = NULL;
5005 defer = 0;
5006 }
5007 mutex_unlock(&binder_deferred_lock);
5008
5009 files = NULL;
5010 if (defer & BINDER_DEFERRED_PUT_FILES) {
5011 mutex_lock(&proc->files_lock);
5012 files = proc->files;
5013 if (files)
5014 proc->files = NULL;
5015 mutex_unlock(&proc->files_lock);
5016 }
5017
5018 if (defer & BINDER_DEFERRED_FLUSH)
5019 binder_deferred_flush(proc);
5020
5021 if (defer & BINDER_DEFERRED_RELEASE)
5022 binder_deferred_release(proc);
5023
5024 if (files)
5025 put_files_struct(files);
5026 } while (proc);
5027}
5028static DECLARE_WORK(binder_deferred_work, binder_deferred_func);
5029
5030static void
5031binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer)
5032{
5033 mutex_lock(&binder_deferred_lock);
5034 proc->deferred_work |= defer;
5035 if (hlist_unhashed(&proc->deferred_work_node)) {
5036 hlist_add_head(&proc->deferred_work_node,
5037 &binder_deferred_list);
5038 schedule_work(&binder_deferred_work);
5039 }
5040 mutex_unlock(&binder_deferred_lock);
5041}
5042
5043static void print_binder_transaction_ilocked(struct seq_file *m,
5044 struct binder_proc *proc,
5045 const char *prefix,
5046 struct binder_transaction *t)
5047{
5048 struct binder_proc *to_proc;
5049 struct binder_buffer *buffer = t->buffer;
5050
5051 spin_lock(&t->lock);
5052 to_proc = t->to_proc;
5053 seq_printf(m,
5054 "%s %d: %pK from %d:%d to %d:%d code %x flags %x pri %ld r%d",
5055 prefix, t->debug_id, t,
5056 t->from ? t->from->proc->pid : 0,
5057 t->from ? t->from->pid : 0,
5058 to_proc ? to_proc->pid : 0,
5059 t->to_thread ? t->to_thread->pid : 0,
5060 t->code, t->flags, t->priority, t->need_reply);
5061 spin_unlock(&t->lock);
5062
5063 if (proc != to_proc) {
5064
5065
5066
5067
5068 seq_puts(m, "\n");
5069 return;
5070 }
5071
5072 if (buffer == NULL) {
5073 seq_puts(m, " buffer free\n");
5074 return;
5075 }
5076 if (buffer->target_node)
5077 seq_printf(m, " node %d", buffer->target_node->debug_id);
5078 seq_printf(m, " size %zd:%zd data %pK\n",
5079 buffer->data_size, buffer->offsets_size,
5080 buffer->data);
5081}
5082
5083static void print_binder_work_ilocked(struct seq_file *m,
5084 struct binder_proc *proc,
5085 const char *prefix,
5086 const char *transaction_prefix,
5087 struct binder_work *w)
5088{
5089 struct binder_node *node;
5090 struct binder_transaction *t;
5091
5092 switch (w->type) {
5093 case BINDER_WORK_TRANSACTION:
5094 t = container_of(w, struct binder_transaction, work);
5095 print_binder_transaction_ilocked(
5096 m, proc, transaction_prefix, t);
5097 break;
5098 case BINDER_WORK_RETURN_ERROR: {
5099 struct binder_error *e = container_of(
5100 w, struct binder_error, work);
5101
5102 seq_printf(m, "%stransaction error: %u\n",
5103 prefix, e->cmd);
5104 } break;
5105 case BINDER_WORK_TRANSACTION_COMPLETE:
5106 seq_printf(m, "%stransaction complete\n", prefix);
5107 break;
5108 case BINDER_WORK_NODE:
5109 node = container_of(w, struct binder_node, work);
5110 seq_printf(m, "%snode work %d: u%016llx c%016llx\n",
5111 prefix, node->debug_id,
5112 (u64)node->ptr, (u64)node->cookie);
5113 break;
5114 case BINDER_WORK_DEAD_BINDER:
5115 seq_printf(m, "%shas dead binder\n", prefix);
5116 break;
5117 case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
5118 seq_printf(m, "%shas cleared dead binder\n", prefix);
5119 break;
5120 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION:
5121 seq_printf(m, "%shas cleared death notification\n", prefix);
5122 break;
5123 default:
5124 seq_printf(m, "%sunknown work: type %d\n", prefix, w->type);
5125 break;
5126 }
5127}
5128
5129static void print_binder_thread_ilocked(struct seq_file *m,
5130 struct binder_thread *thread,
5131 int print_always)
5132{
5133 struct binder_transaction *t;
5134 struct binder_work *w;
5135 size_t start_pos = m->count;
5136 size_t header_pos;
5137
5138 seq_printf(m, " thread %d: l %02x need_return %d tr %d\n",
5139 thread->pid, thread->looper,
5140 thread->looper_need_return,
5141 atomic_read(&thread->tmp_ref));
5142 header_pos = m->count;
5143 t = thread->transaction_stack;
5144 while (t) {
5145 if (t->from == thread) {
5146 print_binder_transaction_ilocked(m, thread->proc,
5147 " outgoing transaction", t);
5148 t = t->from_parent;
5149 } else if (t->to_thread == thread) {
5150 print_binder_transaction_ilocked(m, thread->proc,
5151 " incoming transaction", t);
5152 t = t->to_parent;
5153 } else {
5154 print_binder_transaction_ilocked(m, thread->proc,
5155 " bad transaction", t);
5156 t = NULL;
5157 }
5158 }
5159 list_for_each_entry(w, &thread->todo, entry) {
5160 print_binder_work_ilocked(m, thread->proc, " ",
5161 " pending transaction", w);
5162 }
5163 if (!print_always && m->count == header_pos)
5164 m->count = start_pos;
5165}
5166
5167static void print_binder_node_nilocked(struct seq_file *m,
5168 struct binder_node *node)
5169{
5170 struct binder_ref *ref;
5171 struct binder_work *w;
5172 int count;
5173
5174 count = 0;
5175 hlist_for_each_entry(ref, &node->refs, node_entry)
5176 count++;
5177
5178 seq_printf(m, " node %d: u%016llx c%016llx hs %d hw %d ls %d lw %d is %d iw %d tr %d",
5179 node->debug_id, (u64)node->ptr, (u64)node->cookie,
5180 node->has_strong_ref, node->has_weak_ref,
5181 node->local_strong_refs, node->local_weak_refs,
5182 node->internal_strong_refs, count, node->tmp_refs);
5183 if (count) {
5184 seq_puts(m, " proc");
5185 hlist_for_each_entry(ref, &node->refs, node_entry)
5186 seq_printf(m, " %d", ref->proc->pid);
5187 }
5188 seq_puts(m, "\n");
5189 if (node->proc) {
5190 list_for_each_entry(w, &node->async_todo, entry)
5191 print_binder_work_ilocked(m, node->proc, " ",
5192 " pending async transaction", w);
5193 }
5194}
5195
5196static void print_binder_ref_olocked(struct seq_file *m,
5197 struct binder_ref *ref)
5198{
5199 binder_node_lock(ref->node);
5200 seq_printf(m, " ref %d: desc %d %snode %d s %d w %d d %pK\n",
5201 ref->data.debug_id, ref->data.desc,
5202 ref->node->proc ? "" : "dead ",
5203 ref->node->debug_id, ref->data.strong,
5204 ref->data.weak, ref->death);
5205 binder_node_unlock(ref->node);
5206}
5207
5208static void print_binder_proc(struct seq_file *m,
5209 struct binder_proc *proc, int print_all)
5210{
5211 struct binder_work *w;
5212 struct rb_node *n;
5213 size_t start_pos = m->count;
5214 size_t header_pos;
5215 struct binder_node *last_node = NULL;
5216
5217 seq_printf(m, "proc %d\n", proc->pid);
5218 seq_printf(m, "context %s\n", proc->context->name);
5219 header_pos = m->count;
5220
5221 binder_inner_proc_lock(proc);
5222 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n))
5223 print_binder_thread_ilocked(m, rb_entry(n, struct binder_thread,
5224 rb_node), print_all);
5225
5226 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) {
5227 struct binder_node *node = rb_entry(n, struct binder_node,
5228 rb_node);
5229
5230
5231
5232
5233
5234 binder_inc_node_tmpref_ilocked(node);
5235
5236 binder_inner_proc_unlock(proc);
5237 if (last_node)
5238 binder_put_node(last_node);
5239 binder_node_inner_lock(node);
5240 print_binder_node_nilocked(m, node);
5241 binder_node_inner_unlock(node);
5242 last_node = node;
5243 binder_inner_proc_lock(proc);
5244 }
5245 binder_inner_proc_unlock(proc);
5246 if (last_node)
5247 binder_put_node(last_node);
5248
5249 if (print_all) {
5250 binder_proc_lock(proc);
5251 for (n = rb_first(&proc->refs_by_desc);
5252 n != NULL;
5253 n = rb_next(n))
5254 print_binder_ref_olocked(m, rb_entry(n,
5255 struct binder_ref,
5256 rb_node_desc));
5257 binder_proc_unlock(proc);
5258 }
5259 binder_alloc_print_allocated(m, &proc->alloc);
5260 binder_inner_proc_lock(proc);
5261 list_for_each_entry(w, &proc->todo, entry)
5262 print_binder_work_ilocked(m, proc, " ",
5263 " pending transaction", w);
5264 list_for_each_entry(w, &proc->delivered_death, entry) {
5265 seq_puts(m, " has delivered dead binder\n");
5266 break;
5267 }
5268 binder_inner_proc_unlock(proc);
5269 if (!print_all && m->count == header_pos)
5270 m->count = start_pos;
5271}
5272
5273static const char * const binder_return_strings[] = {
5274 "BR_ERROR",
5275 "BR_OK",
5276 "BR_TRANSACTION",
5277 "BR_REPLY",
5278 "BR_ACQUIRE_RESULT",
5279 "BR_DEAD_REPLY",
5280 "BR_TRANSACTION_COMPLETE",
5281 "BR_INCREFS",
5282 "BR_ACQUIRE",
5283 "BR_RELEASE",
5284 "BR_DECREFS",
5285 "BR_ATTEMPT_ACQUIRE",
5286 "BR_NOOP",
5287 "BR_SPAWN_LOOPER",
5288 "BR_FINISHED",
5289 "BR_DEAD_BINDER",
5290 "BR_CLEAR_DEATH_NOTIFICATION_DONE",
5291 "BR_FAILED_REPLY"
5292};
5293
5294static const char * const binder_command_strings[] = {
5295 "BC_TRANSACTION",
5296 "BC_REPLY",
5297 "BC_ACQUIRE_RESULT",
5298 "BC_FREE_BUFFER",
5299 "BC_INCREFS",
5300 "BC_ACQUIRE",
5301 "BC_RELEASE",
5302 "BC_DECREFS",
5303 "BC_INCREFS_DONE",
5304 "BC_ACQUIRE_DONE",
5305 "BC_ATTEMPT_ACQUIRE",
5306 "BC_REGISTER_LOOPER",
5307 "BC_ENTER_LOOPER",
5308 "BC_EXIT_LOOPER",
5309 "BC_REQUEST_DEATH_NOTIFICATION",
5310 "BC_CLEAR_DEATH_NOTIFICATION",
5311 "BC_DEAD_BINDER_DONE",
5312 "BC_TRANSACTION_SG",
5313 "BC_REPLY_SG",
5314};
5315
5316static const char * const binder_objstat_strings[] = {
5317 "proc",
5318 "thread",
5319 "node",
5320 "ref",
5321 "death",
5322 "transaction",
5323 "transaction_complete"
5324};
5325
5326static void print_binder_stats(struct seq_file *m, const char *prefix,
5327 struct binder_stats *stats)
5328{
5329 int i;
5330
5331 BUILD_BUG_ON(ARRAY_SIZE(stats->bc) !=
5332 ARRAY_SIZE(binder_command_strings));
5333 for (i = 0; i < ARRAY_SIZE(stats->bc); i++) {
5334 int temp = atomic_read(&stats->bc[i]);
5335
5336 if (temp)
5337 seq_printf(m, "%s%s: %d\n", prefix,
5338 binder_command_strings[i], temp);
5339 }
5340
5341 BUILD_BUG_ON(ARRAY_SIZE(stats->br) !=
5342 ARRAY_SIZE(binder_return_strings));
5343 for (i = 0; i < ARRAY_SIZE(stats->br); i++) {
5344 int temp = atomic_read(&stats->br[i]);
5345
5346 if (temp)
5347 seq_printf(m, "%s%s: %d\n", prefix,
5348 binder_return_strings[i], temp);
5349 }
5350
5351 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) !=
5352 ARRAY_SIZE(binder_objstat_strings));
5353 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) !=
5354 ARRAY_SIZE(stats->obj_deleted));
5355 for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) {
5356 int created = atomic_read(&stats->obj_created[i]);
5357 int deleted = atomic_read(&stats->obj_deleted[i]);
5358
5359 if (created || deleted)
5360 seq_printf(m, "%s%s: active %d total %d\n",
5361 prefix,
5362 binder_objstat_strings[i],
5363 created - deleted,
5364 created);
5365 }
5366}
5367
5368static void print_binder_proc_stats(struct seq_file *m,
5369 struct binder_proc *proc)
5370{
5371 struct binder_work *w;
5372 struct binder_thread *thread;
5373 struct rb_node *n;
5374 int count, strong, weak, ready_threads;
5375 size_t free_async_space =
5376 binder_alloc_get_free_async_space(&proc->alloc);
5377
5378 seq_printf(m, "proc %d\n", proc->pid);
5379 seq_printf(m, "context %s\n", proc->context->name);
5380 count = 0;
5381 ready_threads = 0;
5382 binder_inner_proc_lock(proc);
5383 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n))
5384 count++;
5385
5386 list_for_each_entry(thread, &proc->waiting_threads, waiting_thread_node)
5387 ready_threads++;
5388
5389 seq_printf(m, " threads: %d\n", count);
5390 seq_printf(m, " requested threads: %d+%d/%d\n"
5391 " ready threads %d\n"
5392 " free async space %zd\n", proc->requested_threads,
5393 proc->requested_threads_started, proc->max_threads,
5394 ready_threads,
5395 free_async_space);
5396 count = 0;
5397 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n))
5398 count++;
5399 binder_inner_proc_unlock(proc);
5400 seq_printf(m, " nodes: %d\n", count);
5401 count = 0;
5402 strong = 0;
5403 weak = 0;
5404 binder_proc_lock(proc);
5405 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) {
5406 struct binder_ref *ref = rb_entry(n, struct binder_ref,
5407 rb_node_desc);
5408 count++;
5409 strong += ref->data.strong;
5410 weak += ref->data.weak;
5411 }
5412 binder_proc_unlock(proc);
5413 seq_printf(m, " refs: %d s %d w %d\n", count, strong, weak);
5414
5415 count = binder_alloc_get_allocated_count(&proc->alloc);
5416 seq_printf(m, " buffers: %d\n", count);
5417
5418 binder_alloc_print_pages(m, &proc->alloc);
5419
5420 count = 0;
5421 binder_inner_proc_lock(proc);
5422 list_for_each_entry(w, &proc->todo, entry) {
5423 if (w->type == BINDER_WORK_TRANSACTION)
5424 count++;
5425 }
5426 binder_inner_proc_unlock(proc);
5427 seq_printf(m, " pending transactions: %d\n", count);
5428
5429 print_binder_stats(m, " ", &proc->stats);
5430}
5431
5432
5433static int binder_state_show(struct seq_file *m, void *unused)
5434{
5435 struct binder_proc *proc;
5436 struct binder_node *node;
5437 struct binder_node *last_node = NULL;
5438
5439 seq_puts(m, "binder state:\n");
5440
5441 spin_lock(&binder_dead_nodes_lock);
5442 if (!hlist_empty(&binder_dead_nodes))
5443 seq_puts(m, "dead nodes:\n");
5444 hlist_for_each_entry(node, &binder_dead_nodes, dead_node) {
5445
5446
5447
5448
5449
5450 node->tmp_refs++;
5451 spin_unlock(&binder_dead_nodes_lock);
5452 if (last_node)
5453 binder_put_node(last_node);
5454 binder_node_lock(node);
5455 print_binder_node_nilocked(m, node);
5456 binder_node_unlock(node);
5457 last_node = node;
5458 spin_lock(&binder_dead_nodes_lock);
5459 }
5460 spin_unlock(&binder_dead_nodes_lock);
5461 if (last_node)
5462 binder_put_node(last_node);
5463
5464 mutex_lock(&binder_procs_lock);
5465 hlist_for_each_entry(proc, &binder_procs, proc_node)
5466 print_binder_proc(m, proc, 1);
5467 mutex_unlock(&binder_procs_lock);
5468
5469 return 0;
5470}
5471
5472static int binder_stats_show(struct seq_file *m, void *unused)
5473{
5474 struct binder_proc *proc;
5475
5476 seq_puts(m, "binder stats:\n");
5477
5478 print_binder_stats(m, "", &binder_stats);
5479
5480 mutex_lock(&binder_procs_lock);
5481 hlist_for_each_entry(proc, &binder_procs, proc_node)
5482 print_binder_proc_stats(m, proc);
5483 mutex_unlock(&binder_procs_lock);
5484
5485 return 0;
5486}
5487
5488static int binder_transactions_show(struct seq_file *m, void *unused)
5489{
5490 struct binder_proc *proc;
5491
5492 seq_puts(m, "binder transactions:\n");
5493 mutex_lock(&binder_procs_lock);
5494 hlist_for_each_entry(proc, &binder_procs, proc_node)
5495 print_binder_proc(m, proc, 0);
5496 mutex_unlock(&binder_procs_lock);
5497
5498 return 0;
5499}
5500
5501static int binder_proc_show(struct seq_file *m, void *unused)
5502{
5503 struct binder_proc *itr;
5504 int pid = (unsigned long)m->private;
5505
5506 mutex_lock(&binder_procs_lock);
5507 hlist_for_each_entry(itr, &binder_procs, proc_node) {
5508 if (itr->pid == pid) {
5509 seq_puts(m, "binder proc state:\n");
5510 print_binder_proc(m, itr, 1);
5511 }
5512 }
5513 mutex_unlock(&binder_procs_lock);
5514
5515 return 0;
5516}
5517
5518static void print_binder_transaction_log_entry(struct seq_file *m,
5519 struct binder_transaction_log_entry *e)
5520{
5521 int debug_id = READ_ONCE(e->debug_id_done);
5522
5523
5524
5525
5526 smp_rmb();
5527 seq_printf(m,
5528 "%d: %s from %d:%d to %d:%d context %s node %d handle %d size %d:%d ret %d/%d l=%d",
5529 e->debug_id, (e->call_type == 2) ? "reply" :
5530 ((e->call_type == 1) ? "async" : "call "), e->from_proc,
5531 e->from_thread, e->to_proc, e->to_thread, e->context_name,
5532 e->to_node, e->target_handle, e->data_size, e->offsets_size,
5533 e->return_error, e->return_error_param,
5534 e->return_error_line);
5535
5536
5537
5538
5539 smp_rmb();
5540 seq_printf(m, debug_id && debug_id == READ_ONCE(e->debug_id_done) ?
5541 "\n" : " (incomplete)\n");
5542}
5543
5544static int binder_transaction_log_show(struct seq_file *m, void *unused)
5545{
5546 struct binder_transaction_log *log = m->private;
5547 unsigned int log_cur = atomic_read(&log->cur);
5548 unsigned int count;
5549 unsigned int cur;
5550 int i;
5551
5552 count = log_cur + 1;
5553 cur = count < ARRAY_SIZE(log->entry) && !log->full ?
5554 0 : count % ARRAY_SIZE(log->entry);
5555 if (count > ARRAY_SIZE(log->entry) || log->full)
5556 count = ARRAY_SIZE(log->entry);
5557 for (i = 0; i < count; i++) {
5558 unsigned int index = cur++ % ARRAY_SIZE(log->entry);
5559
5560 print_binder_transaction_log_entry(m, &log->entry[index]);
5561 }
5562 return 0;
5563}
5564
5565static const struct file_operations binder_fops = {
5566 .owner = THIS_MODULE,
5567 .poll = binder_poll,
5568 .unlocked_ioctl = binder_ioctl,
5569 .compat_ioctl = binder_ioctl,
5570 .mmap = binder_mmap,
5571 .open = binder_open,
5572 .flush = binder_flush,
5573 .release = binder_release,
5574};
5575
5576BINDER_DEBUG_ENTRY(state);
5577BINDER_DEBUG_ENTRY(stats);
5578BINDER_DEBUG_ENTRY(transactions);
5579BINDER_DEBUG_ENTRY(transaction_log);
5580
5581static int __init init_binder_device(const char *name)
5582{
5583 int ret;
5584 struct binder_device *binder_device;
5585
5586 binder_device = kzalloc(sizeof(*binder_device), GFP_KERNEL);
5587 if (!binder_device)
5588 return -ENOMEM;
5589
5590 binder_device->miscdev.fops = &binder_fops;
5591 binder_device->miscdev.minor = MISC_DYNAMIC_MINOR;
5592 binder_device->miscdev.name = name;
5593
5594 binder_device->context.binder_context_mgr_uid = INVALID_UID;
5595 binder_device->context.name = name;
5596 mutex_init(&binder_device->context.context_mgr_node_lock);
5597
5598 ret = misc_register(&binder_device->miscdev);
5599 if (ret < 0) {
5600 kfree(binder_device);
5601 return ret;
5602 }
5603
5604 hlist_add_head(&binder_device->hlist, &binder_devices);
5605
5606 return ret;
5607}
5608
5609static int __init binder_init(void)
5610{
5611 int ret;
5612 char *device_name, *device_names, *device_tmp;
5613 struct binder_device *device;
5614 struct hlist_node *tmp;
5615
5616 ret = binder_alloc_shrinker_init();
5617 if (ret)
5618 return ret;
5619
5620 atomic_set(&binder_transaction_log.cur, ~0U);
5621 atomic_set(&binder_transaction_log_failed.cur, ~0U);
5622
5623 binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL);
5624 if (binder_debugfs_dir_entry_root)
5625 binder_debugfs_dir_entry_proc = debugfs_create_dir("proc",
5626 binder_debugfs_dir_entry_root);
5627
5628 if (binder_debugfs_dir_entry_root) {
5629 debugfs_create_file("state",
5630 0444,
5631 binder_debugfs_dir_entry_root,
5632 NULL,
5633 &binder_state_fops);
5634 debugfs_create_file("stats",
5635 0444,
5636 binder_debugfs_dir_entry_root,
5637 NULL,
5638 &binder_stats_fops);
5639 debugfs_create_file("transactions",
5640 0444,
5641 binder_debugfs_dir_entry_root,
5642 NULL,
5643 &binder_transactions_fops);
5644 debugfs_create_file("transaction_log",
5645 0444,
5646 binder_debugfs_dir_entry_root,
5647 &binder_transaction_log,
5648 &binder_transaction_log_fops);
5649 debugfs_create_file("failed_transaction_log",
5650 0444,
5651 binder_debugfs_dir_entry_root,
5652 &binder_transaction_log_failed,
5653 &binder_transaction_log_fops);
5654 }
5655
5656
5657
5658
5659
5660 device_names = kzalloc(strlen(binder_devices_param) + 1, GFP_KERNEL);
5661 if (!device_names) {
5662 ret = -ENOMEM;
5663 goto err_alloc_device_names_failed;
5664 }
5665 strcpy(device_names, binder_devices_param);
5666
5667 device_tmp = device_names;
5668 while ((device_name = strsep(&device_tmp, ","))) {
5669 ret = init_binder_device(device_name);
5670 if (ret)
5671 goto err_init_binder_device_failed;
5672 }
5673
5674 return ret;
5675
5676err_init_binder_device_failed:
5677 hlist_for_each_entry_safe(device, tmp, &binder_devices, hlist) {
5678 misc_deregister(&device->miscdev);
5679 hlist_del(&device->hlist);
5680 kfree(device);
5681 }
5682
5683 kfree(device_names);
5684
5685err_alloc_device_names_failed:
5686 debugfs_remove_recursive(binder_debugfs_dir_entry_root);
5687
5688 return ret;
5689}
5690
5691device_initcall(binder_init);
5692
5693#define CREATE_TRACE_POINTS
5694#include "binder_trace.h"
5695
5696MODULE_LICENSE("GPL v2");
5697