projects / GitHub / LineageOS / android_kernel_motorola_exynos9610.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
binder: change binder_stats to atomics
[GitHub/LineageOS/android_kernel_motorola_exynos9610.git] / drivers / android / binder.c
CommitLineData
355b0502
GKH		 1/* binder.c
2 *
3 * Android IPC Subsystem
4 *
5 * Copyright (C) 2007-2008 Google, Inc.
6 *
7 * This software is licensed under the terms of the GNU General Public
8 * License version 2, as published by the Free Software Foundation, and
9 * may be copied, distributed, and modified under those terms.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 */
17
56b468fc
AS		 18#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
19
355b0502
GKH		 20#include <asm/cacheflush.h>
21#include <linux/fdtable.h>
22#include <linux/file.h>
e2610b26 23#include <linux/freezer.h>
355b0502
GKH		 24#include <linux/fs.h>
25#include <linux/list.h>
26#include <linux/miscdevice.h>
355b0502
GKH		 27#include <linux/module.h>
28#include <linux/mutex.h>
29#include <linux/nsproxy.h>
30#include <linux/poll.h>
16b66554 31#include <linux/debugfs.h>
355b0502 32#include <linux/rbtree.h>
3f07c014 33#include <linux/sched/signal.h>
6e84f315 34#include <linux/sched/mm.h>
5249f488 35#include <linux/seq_file.h>
355b0502 36#include <linux/uaccess.h>
17cf22c3 37#include <linux/pid_namespace.h>
79af7307 38#include <linux/security.h>
355b0502 39
9246a4a9
GKH		 40#ifdef CONFIG_ANDROID_BINDER_IPC_32BIT
41#define BINDER_IPC_32BIT 1
42#endif
43
44#include <uapi/linux/android/binder.h>
0c972a05 45#include "binder_alloc.h"
975a1ac9 46#include "binder_trace.h"
355b0502 47
975a1ac9 48static DEFINE_MUTEX(binder_main_lock);
c44b1231
TK		 49
50static HLIST_HEAD(binder_deferred_list);
355b0502
GKH		 51static DEFINE_MUTEX(binder_deferred_lock);
52
ac4812c5 53static HLIST_HEAD(binder_devices);
355b0502 54static HLIST_HEAD(binder_procs);
c44b1231
TK		 55static DEFINE_MUTEX(binder_procs_lock);
56
355b0502 57static HLIST_HEAD(binder_dead_nodes);
c44b1231 58static DEFINE_SPINLOCK(binder_dead_nodes_lock);
355b0502 59
16b66554
AH		 60static struct dentry *binder_debugfs_dir_entry_root;
61static struct dentry *binder_debugfs_dir_entry_proc;
355b0502
GKH		 62static int binder_last_id;
63
5249f488
AH		 64#define BINDER_DEBUG_ENTRY(name) \
65static int binder_##name##_open(struct inode *inode, struct file *file) \
66{ \
16b66554 67 return single_open(file, binder_##name##_show, inode->i_private); \
5249f488
AH		 68} \
69\
70static const struct file_operations binder_##name##_fops = { \
71 .owner = THIS_MODULE, \
72 .open = binder_##name##_open, \
73 .read = seq_read, \
74 .llseek = seq_lseek, \
75 .release = single_release, \
76}
77
78static int binder_proc_show(struct seq_file *m, void *unused);
79BINDER_DEBUG_ENTRY(proc);
355b0502
GKH		 80
81/* This is only defined in include/asm-arm/sizes.h */
82#ifndef SZ_1K
83#define SZ_1K 0x400
84#endif
85
86#ifndef SZ_4M
87#define SZ_4M 0x400000
88#endif
89
90#define FORBIDDEN_MMAP_FLAGS (VM_WRITE)
91
92#define BINDER_SMALL_BUF_SIZE (PAGE_SIZE * 64)
93
94enum {
95 BINDER_DEBUG_USER_ERROR = 1U << 0,
96 BINDER_DEBUG_FAILED_TRANSACTION = 1U << 1,
97 BINDER_DEBUG_DEAD_TRANSACTION = 1U << 2,
98 BINDER_DEBUG_OPEN_CLOSE = 1U << 3,
99 BINDER_DEBUG_DEAD_BINDER = 1U << 4,
100 BINDER_DEBUG_DEATH_NOTIFICATION = 1U << 5,
101 BINDER_DEBUG_READ_WRITE = 1U << 6,
102 BINDER_DEBUG_USER_REFS = 1U << 7,
103 BINDER_DEBUG_THREADS = 1U << 8,
104 BINDER_DEBUG_TRANSACTION = 1U << 9,
105 BINDER_DEBUG_TRANSACTION_COMPLETE = 1U << 10,
106 BINDER_DEBUG_FREE_BUFFER = 1U << 11,
107 BINDER_DEBUG_INTERNAL_REFS = 1U << 12,
19c98724 108 BINDER_DEBUG_PRIORITY_CAP = 1U << 13,
355b0502
GKH		 109};
110static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR |
111 BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION;
112module_param_named(debug_mask, binder_debug_mask, uint, S_IWUSR | S_IRUGO);
113
ac4812c5
MC		 114static char *binder_devices_param = CONFIG_ANDROID_BINDER_DEVICES;
115module_param_named(devices, binder_devices_param, charp, 0444);
116
355b0502
GKH		 117static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait);
118static int binder_stop_on_user_error;
119
120static int binder_set_stop_on_user_error(const char *val,
121 struct kernel_param *kp)
122{
123 int ret;
10f62861 124
355b0502
GKH		 125 ret = param_set_int(val, kp);
126 if (binder_stop_on_user_error < 2)
127 wake_up(&binder_user_error_wait);
128 return ret;
129}
130module_param_call(stop_on_user_error, binder_set_stop_on_user_error,
131 param_get_int, &binder_stop_on_user_error, S_IWUSR | S_IRUGO);
132
133#define binder_debug(mask, x...) \
134 do { \
135 if (binder_debug_mask & mask) \
258767fe 136 pr_info(x); \
355b0502
GKH		 137 } while (0)
138
139#define binder_user_error(x...) \
140 do { \
141 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \
258767fe 142 pr_info(x); \
355b0502
GKH		 143 if (binder_stop_on_user_error) \
144 binder_stop_on_user_error = 2; \
145 } while (0)
146
feba3900
MC		 147#define to_flat_binder_object(hdr) \
148 container_of(hdr, struct flat_binder_object, hdr)
149
150#define to_binder_fd_object(hdr) container_of(hdr, struct binder_fd_object, hdr)
151
7980240b
MC		 152#define to_binder_buffer_object(hdr) \
153 container_of(hdr, struct binder_buffer_object, hdr)
154
def95c73
MC		 155#define to_binder_fd_array_object(hdr) \
156 container_of(hdr, struct binder_fd_array_object, hdr)
157
355b0502
GKH		 158enum binder_stat_types {
159 BINDER_STAT_PROC,
160 BINDER_STAT_THREAD,
161 BINDER_STAT_NODE,
162 BINDER_STAT_REF,
163 BINDER_STAT_DEATH,
164 BINDER_STAT_TRANSACTION,
165 BINDER_STAT_TRANSACTION_COMPLETE,
166 BINDER_STAT_COUNT
167};
168
169struct binder_stats {
0953c797
BJS		 170 atomic_t br[_IOC_NR(BR_FAILED_REPLY) + 1];
171 atomic_t bc[_IOC_NR(BC_REPLY_SG) + 1];
172 atomic_t obj_created[BINDER_STAT_COUNT];
173 atomic_t obj_deleted[BINDER_STAT_COUNT];
355b0502
GKH		 174};
175
176static struct binder_stats binder_stats;
177
178static inline void binder_stats_deleted(enum binder_stat_types type)
179{
0953c797 180 atomic_inc(&binder_stats.obj_deleted[type]);
355b0502
GKH		 181}
182
183static inline void binder_stats_created(enum binder_stat_types type)
184{
0953c797 185 atomic_inc(&binder_stats.obj_created[type]);
355b0502
GKH		 186}
187
188struct binder_transaction_log_entry {
189 int debug_id;
190 int call_type;
191 int from_proc;
192 int from_thread;
193 int target_handle;
194 int to_proc;
195 int to_thread;
196 int to_node;
197 int data_size;
198 int offsets_size;
14db3181 199 const char *context_name;
355b0502
GKH		 200};
201struct binder_transaction_log {
202 int next;
203 int full;
204 struct binder_transaction_log_entry entry[32];
205};
206static struct binder_transaction_log binder_transaction_log;
207static struct binder_transaction_log binder_transaction_log_failed;
208
209static struct binder_transaction_log_entry *binder_transaction_log_add(
210 struct binder_transaction_log *log)
211{
212 struct binder_transaction_log_entry *e;
10f62861 213
355b0502
GKH		 214 e = &log->entry[log->next];
215 memset(e, 0, sizeof(*e));
216 log->next++;
217 if (log->next == ARRAY_SIZE(log->entry)) {
218 log->next = 0;
219 log->full = 1;
220 }
221 return e;
222}
223
342e5c90
MC		 224struct binder_context {
225 struct binder_node *binder_context_mgr_node;
c44b1231
TK		 226 struct mutex context_mgr_node_lock;
227
342e5c90 228 kuid_t binder_context_mgr_uid;
14db3181 229 const char *name;
342e5c90
MC		 230};
231
ac4812c5
MC		 232struct binder_device {
233 struct hlist_node hlist;
234 struct miscdevice miscdev;
235 struct binder_context context;
342e5c90
MC		 236};
237
355b0502
GKH		 238struct binder_work {
239 struct list_head entry;
240 enum {
241 BINDER_WORK_TRANSACTION = 1,
242 BINDER_WORK_TRANSACTION_COMPLETE,
243 BINDER_WORK_NODE,
244 BINDER_WORK_DEAD_BINDER,
245 BINDER_WORK_DEAD_BINDER_AND_CLEAR,
246 BINDER_WORK_CLEAR_DEATH_NOTIFICATION,
247 } type;
248};
249
250struct binder_node {
251 int debug_id;
252 struct binder_work work;
253 union {
254 struct rb_node rb_node;
255 struct hlist_node dead_node;
256 };
257 struct binder_proc *proc;
258 struct hlist_head refs;
259 int internal_strong_refs;
260 int local_weak_refs;
261 int local_strong_refs;
da49889d
AH		 262 binder_uintptr_t ptr;
263 binder_uintptr_t cookie;
355b0502
GKH		 264 unsigned has_strong_ref:1;
265 unsigned pending_strong_ref:1;
266 unsigned has_weak_ref:1;
267 unsigned pending_weak_ref:1;
268 unsigned has_async_transaction:1;
269 unsigned accept_fds:1;
270 unsigned min_priority:8;
271 struct list_head async_todo;
272};
273
274struct binder_ref_death {
275 struct binder_work work;
da49889d 276 binder_uintptr_t cookie;
355b0502
GKH		 277};
278
279struct binder_ref {
280 /* Lookups needed: */
281 /* node + proc => ref (transaction) */
282 /* desc + proc => ref (transaction, inc/dec ref) */
283 /* node => refs + procs (proc exit) */
284 int debug_id;
285 struct rb_node rb_node_desc;
286 struct rb_node rb_node_node;
287 struct hlist_node node_entry;
288 struct binder_proc *proc;
289 struct binder_node *node;
290 uint32_t desc;
291 int strong;
292 int weak;
293 struct binder_ref_death *death;
294};
295
355b0502
GKH		 296enum binder_deferred_state {
297 BINDER_DEFERRED_PUT_FILES = 0x01,
298 BINDER_DEFERRED_FLUSH = 0x02,
299 BINDER_DEFERRED_RELEASE = 0x04,
300};
301
302struct binder_proc {
303 struct hlist_node proc_node;
304 struct rb_root threads;
305 struct rb_root nodes;
306 struct rb_root refs_by_desc;
307 struct rb_root refs_by_node;
308 int pid;
355b0502
GKH		 309 struct task_struct *tsk;
310 struct files_struct *files;
311 struct hlist_node deferred_work_node;
312 int deferred_work;
355b0502 313
355b0502
GKH		 314 struct list_head todo;
315 wait_queue_head_t wait;
316 struct binder_stats stats;
317 struct list_head delivered_death;
318 int max_threads;
319 int requested_threads;
320 int requested_threads_started;
321 int ready_threads;
322 long default_priority;
16b66554 323 struct dentry *debugfs_entry;
fdfb4a99 324 struct binder_alloc alloc;
342e5c90 325 struct binder_context *context;
355b0502
GKH		 326};
327
328enum {
329 BINDER_LOOPER_STATE_REGISTERED = 0x01,
330 BINDER_LOOPER_STATE_ENTERED = 0x02,
331 BINDER_LOOPER_STATE_EXITED = 0x04,
332 BINDER_LOOPER_STATE_INVALID = 0x08,
333 BINDER_LOOPER_STATE_WAITING = 0x10,
334 BINDER_LOOPER_STATE_NEED_RETURN = 0x20
335};
336
337struct binder_thread {
338 struct binder_proc *proc;
339 struct rb_node rb_node;
340 int pid;
341 int looper;
342 struct binder_transaction *transaction_stack;
343 struct list_head todo;
344 uint32_t return_error; /* Write failed, return error code in read buf */
345 uint32_t return_error2; /* Write failed, return error code in read */
346 /* buffer. Used when sending a reply to a dead process that */
347 /* we are also waiting on */
348 wait_queue_head_t wait;
349 struct binder_stats stats;
350};
351
352struct binder_transaction {
353 int debug_id;
354 struct binder_work work;
355 struct binder_thread *from;
356 struct binder_transaction *from_parent;
357 struct binder_proc *to_proc;
358 struct binder_thread *to_thread;
359 struct binder_transaction *to_parent;
360 unsigned need_reply:1;
361 /* unsigned is_dead:1; */ /* not used at the moment */
362
363 struct binder_buffer *buffer;
364 unsigned int code;
365 unsigned int flags;
366 long priority;
367 long saved_priority;
4a2ebb93 368 kuid_t sender_euid;
355b0502
GKH		 369};
370
371static void
372binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer);
373
efde99cd 374static int task_get_unused_fd_flags(struct binder_proc *proc, int flags)
355b0502
GKH		 375{
376 struct files_struct *files = proc->files;
355b0502
GKH		 377 unsigned long rlim_cur;
378 unsigned long irqs;
379
380 if (files == NULL)
381 return -ESRCH;
382
dcfadfa4
AV		 383 if (!lock_task_sighand(proc->tsk, &irqs))
384 return -EMFILE;
bf202361 385
dcfadfa4
AV		 386 rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE);
387 unlock_task_sighand(proc->tsk, &irqs);
355b0502 388
dcfadfa4 389 return __alloc_fd(files, 0, rlim_cur, flags);
355b0502
GKH		 390}
391
392/*
393 * copied from fd_install
394 */
395static void task_fd_install(
396 struct binder_proc *proc, unsigned int fd, struct file *file)
397{
f869e8a7
AV		 398 if (proc->files)
399 __fd_install(proc->files, fd, file);
355b0502
GKH		 400}
401
402/*
403 * copied from sys_close
404 */
405static long task_close_fd(struct binder_proc *proc, unsigned int fd)
406{
355b0502
GKH		 407 int retval;
408
483ce1d4 409 if (proc->files == NULL)
355b0502
GKH		 410 return -ESRCH;
411
483ce1d4 412 retval = __close_fd(proc->files, fd);
355b0502
GKH		 413 /* can't restart close syscall because file table entry was cleared */
414 if (unlikely(retval == -ERESTARTSYS ||
415 retval == -ERESTARTNOINTR ||
416 retval == -ERESTARTNOHAND ||
417 retval == -ERESTART_RESTARTBLOCK))
418 retval = -EINTR;
419
420 return retval;
355b0502
GKH		 421}
422
975a1ac9
AH		 423static inline void binder_lock(const char *tag)
424{
425 trace_binder_lock(tag);
426 mutex_lock(&binder_main_lock);
427 trace_binder_locked(tag);
428}
429
430static inline void binder_unlock(const char *tag)
431{
432 trace_binder_unlock(tag);
433 mutex_unlock(&binder_main_lock);
434}
435
355b0502
GKH		 436static void binder_set_nice(long nice)
437{
438 long min_nice;
10f62861 439
355b0502
GKH		 440 if (can_nice(current, nice)) {
441 set_user_nice(current, nice);
442 return;
443 }
7aa2c016 444 min_nice = rlimit_to_nice(current->signal->rlim[RLIMIT_NICE].rlim_cur);
355b0502 445 binder_debug(BINDER_DEBUG_PRIORITY_CAP,
56b468fc
AS		 446 "%d: nice value %ld not allowed use %ld instead\n",
447 current->pid, nice, min_nice);
355b0502 448 set_user_nice(current, min_nice);
8698a745 449 if (min_nice <= MAX_NICE)
355b0502 450 return;
56b468fc 451 binder_user_error("%d RLIMIT_NICE not set\n", current->pid);
355b0502
GKH		 452}
453
355b0502 454static struct binder_node *binder_get_node(struct binder_proc *proc,
da49889d 455 binder_uintptr_t ptr)
355b0502
GKH		 456{
457 struct rb_node *n = proc->nodes.rb_node;
458 struct binder_node *node;
459
460 while (n) {
461 node = rb_entry(n, struct binder_node, rb_node);
462
463 if (ptr < node->ptr)
464 n = n->rb_left;
465 else if (ptr > node->ptr)
466 n = n->rb_right;
467 else
468 return node;
469 }
470 return NULL;
471}
472
473static struct binder_node *binder_new_node(struct binder_proc *proc,
da49889d
AH		 474 binder_uintptr_t ptr,
475 binder_uintptr_t cookie)
355b0502
GKH		 476{
477 struct rb_node **p = &proc->nodes.rb_node;
478 struct rb_node *parent = NULL;
479 struct binder_node *node;
480
481 while (*p) {
482 parent = *p;
483 node = rb_entry(parent, struct binder_node, rb_node);
484
485 if (ptr < node->ptr)
486 p = &(*p)->rb_left;
487 else if (ptr > node->ptr)
488 p = &(*p)->rb_right;
489 else
490 return NULL;
491 }
492
493 node = kzalloc(sizeof(*node), GFP_KERNEL);
494 if (node == NULL)
495 return NULL;
496 binder_stats_created(BINDER_STAT_NODE);
497 rb_link_node(&node->rb_node, parent, p);
498 rb_insert_color(&node->rb_node, &proc->nodes);
499 node->debug_id = ++binder_last_id;
500 node->proc = proc;
501 node->ptr = ptr;
502 node->cookie = cookie;
503 node->work.type = BINDER_WORK_NODE;
504 INIT_LIST_HEAD(&node->work.entry);
505 INIT_LIST_HEAD(&node->async_todo);
506 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
da49889d 507 "%d:%d node %d u%016llx c%016llx created\n",
355b0502 508 proc->pid, current->pid, node->debug_id,
da49889d 509 (u64)node->ptr, (u64)node->cookie);
355b0502
GKH		 510 return node;
511}
512
513static int binder_inc_node(struct binder_node *node, int strong, int internal,
514 struct list_head *target_list)
515{
516 if (strong) {
517 if (internal) {
518 if (target_list == NULL &&
519 node->internal_strong_refs == 0 &&
342e5c90
MC		 520 !(node->proc &&
521 node == node->proc->context->binder_context_mgr_node &&
522 node->has_strong_ref)) {
56b468fc
AS		 523 pr_err("invalid inc strong node for %d\n",
524 node->debug_id);
355b0502
GKH		 525 return -EINVAL;
526 }
527 node->internal_strong_refs++;
528 } else
529 node->local_strong_refs++;
530 if (!node->has_strong_ref && target_list) {
531 list_del_init(&node->work.entry);
532 list_add_tail(&node->work.entry, target_list);
533 }
534 } else {
535 if (!internal)
536 node->local_weak_refs++;
537 if (!node->has_weak_ref && list_empty(&node->work.entry)) {
538 if (target_list == NULL) {
56b468fc
AS		 539 pr_err("invalid inc weak node for %d\n",
540 node->debug_id);
355b0502
GKH		 541 return -EINVAL;
542 }
543 list_add_tail(&node->work.entry, target_list);
544 }
545 }
546 return 0;
547}
548
549static int binder_dec_node(struct binder_node *node, int strong, int internal)
550{
551 if (strong) {
552 if (internal)
553 node->internal_strong_refs--;
554 else
555 node->local_strong_refs--;
556 if (node->local_strong_refs || node->internal_strong_refs)
557 return 0;
558 } else {
559 if (!internal)
560 node->local_weak_refs--;
561 if (node->local_weak_refs || !hlist_empty(&node->refs))
562 return 0;
563 }
564 if (node->proc && (node->has_strong_ref || node->has_weak_ref)) {
565 if (list_empty(&node->work.entry)) {
566 list_add_tail(&node->work.entry, &node->proc->todo);
567 wake_up_interruptible(&node->proc->wait);
568 }
569 } else {
570 if (hlist_empty(&node->refs) && !node->local_strong_refs &&
571 !node->local_weak_refs) {
572 list_del_init(&node->work.entry);
573 if (node->proc) {
574 rb_erase(&node->rb_node, &node->proc->nodes);
575 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
56b468fc 576 "refless node %d deleted\n",
355b0502
GKH		 577 node->debug_id);
578 } else {
c44b1231 579 spin_lock(&binder_dead_nodes_lock);
355b0502 580 hlist_del(&node->dead_node);
c44b1231 581 spin_unlock(&binder_dead_nodes_lock);
355b0502 582 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
56b468fc 583 "dead node %d deleted\n",
355b0502
GKH		 584 node->debug_id);
585 }
586 kfree(node);
587 binder_stats_deleted(BINDER_STAT_NODE);
588 }
589 }
590
591 return 0;
592}
593
594
595static struct binder_ref *binder_get_ref(struct binder_proc *proc,
0a3ffab9 596 u32 desc, bool need_strong_ref)
355b0502
GKH		 597{
598 struct rb_node *n = proc->refs_by_desc.rb_node;
599 struct binder_ref *ref;
600
601 while (n) {
602 ref = rb_entry(n, struct binder_ref, rb_node_desc);
603
0a3ffab9 604 if (desc < ref->desc) {
355b0502 605 n = n->rb_left;
0a3ffab9 606 } else if (desc > ref->desc) {
355b0502 607 n = n->rb_right;
0a3ffab9
AH		 608 } else if (need_strong_ref && !ref->strong) {
609 binder_user_error("tried to use weak ref as strong ref\n");
610 return NULL;
611 } else {
355b0502 612 return ref;
0a3ffab9 613 }
355b0502
GKH		 614 }
615 return NULL;
616}
617
618static struct binder_ref *binder_get_ref_for_node(struct binder_proc *proc,
619 struct binder_node *node)
620{
621 struct rb_node *n;
622 struct rb_node **p = &proc->refs_by_node.rb_node;
623 struct rb_node *parent = NULL;
624 struct binder_ref *ref, *new_ref;
342e5c90 625 struct binder_context *context = proc->context;
355b0502
GKH		 626
627 while (*p) {
628 parent = *p;
629 ref = rb_entry(parent, struct binder_ref, rb_node_node);
630
631 if (node < ref->node)
632 p = &(*p)->rb_left;
633 else if (node > ref->node)
634 p = &(*p)->rb_right;
635 else
636 return ref;
637 }
638 new_ref = kzalloc(sizeof(*ref), GFP_KERNEL);
639 if (new_ref == NULL)
640 return NULL;
641 binder_stats_created(BINDER_STAT_REF);
642 new_ref->debug_id = ++binder_last_id;
643 new_ref->proc = proc;
644 new_ref->node = node;
645 rb_link_node(&new_ref->rb_node_node, parent, p);
646 rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node);
647
342e5c90 648 new_ref->desc = (node == context->binder_context_mgr_node) ? 0 : 1;
355b0502
GKH		 649 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) {
650 ref = rb_entry(n, struct binder_ref, rb_node_desc);
651 if (ref->desc > new_ref->desc)
652 break;
653 new_ref->desc = ref->desc + 1;
654 }
655
656 p = &proc->refs_by_desc.rb_node;
657 while (*p) {
658 parent = *p;
659 ref = rb_entry(parent, struct binder_ref, rb_node_desc);
660
661 if (new_ref->desc < ref->desc)
662 p = &(*p)->rb_left;
663 else if (new_ref->desc > ref->desc)
664 p = &(*p)->rb_right;
665 else
666 BUG();
667 }
668 rb_link_node(&new_ref->rb_node_desc, parent, p);
669 rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc);
670 if (node) {
671 hlist_add_head(&new_ref->node_entry, &node->refs);
672
673 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
56b468fc
AS		 674 "%d new ref %d desc %d for node %d\n",
675 proc->pid, new_ref->debug_id, new_ref->desc,
676 node->debug_id);
355b0502
GKH		 677 } else {
678 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
56b468fc
AS		 679 "%d new ref %d desc %d for dead node\n",
680 proc->pid, new_ref->debug_id, new_ref->desc);
355b0502
GKH		 681 }
682 return new_ref;
683}
684
685static void binder_delete_ref(struct binder_ref *ref)
686{
687 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
56b468fc
AS		 688 "%d delete ref %d desc %d for node %d\n",
689 ref->proc->pid, ref->debug_id, ref->desc,
690 ref->node->debug_id);
355b0502
GKH		 691
692 rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc);
693 rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node);
694 if (ref->strong)
695 binder_dec_node(ref->node, 1, 1);
696 hlist_del(&ref->node_entry);
697 binder_dec_node(ref->node, 0, 1);
698 if (ref->death) {
699 binder_debug(BINDER_DEBUG_DEAD_BINDER,
56b468fc
AS		 700 "%d delete ref %d desc %d has death notification\n",
701 ref->proc->pid, ref->debug_id, ref->desc);
355b0502
GKH		 702 list_del(&ref->death->work.entry);
703 kfree(ref->death);
704 binder_stats_deleted(BINDER_STAT_DEATH);
705 }
706 kfree(ref);
707 binder_stats_deleted(BINDER_STAT_REF);
708}
709
710static int binder_inc_ref(struct binder_ref *ref, int strong,
711 struct list_head *target_list)
712{
713 int ret;
10f62861 714
355b0502
GKH		 715 if (strong) {
716 if (ref->strong == 0) {
717 ret = binder_inc_node(ref->node, 1, 1, target_list);
718 if (ret)
719 return ret;
720 }
721 ref->strong++;
722 } else {
723 if (ref->weak == 0) {
724 ret = binder_inc_node(ref->node, 0, 1, target_list);
725 if (ret)
726 return ret;
727 }
728 ref->weak++;
729 }
730 return 0;
731}
732
733
734static int binder_dec_ref(struct binder_ref *ref, int strong)
735{
736 if (strong) {
737 if (ref->strong == 0) {
56b468fc 738 binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n",
355b0502
GKH		 739 ref->proc->pid, ref->debug_id,
740 ref->desc, ref->strong, ref->weak);
741 return -EINVAL;
742 }
743 ref->strong--;
744 if (ref->strong == 0) {
745 int ret;
10f62861 746
355b0502
GKH		 747 ret = binder_dec_node(ref->node, strong, 1);
748 if (ret)
749 return ret;
750 }
751 } else {
752 if (ref->weak == 0) {
56b468fc 753 binder_user_error("%d invalid dec weak, ref %d desc %d s %d w %d\n",
355b0502
GKH		 754 ref->proc->pid, ref->debug_id,
755 ref->desc, ref->strong, ref->weak);
756 return -EINVAL;
757 }
758 ref->weak--;
759 }
760 if (ref->strong == 0 && ref->weak == 0)
761 binder_delete_ref(ref);
762 return 0;
763}
764
765static void binder_pop_transaction(struct binder_thread *target_thread,
766 struct binder_transaction *t)
767{
768 if (target_thread) {
769 BUG_ON(target_thread->transaction_stack != t);
770 BUG_ON(target_thread->transaction_stack->from != target_thread);
771 target_thread->transaction_stack =
772 target_thread->transaction_stack->from_parent;
773 t->from = NULL;
774 }
775 t->need_reply = 0;
776 if (t->buffer)
777 t->buffer->transaction = NULL;
778 kfree(t);
779 binder_stats_deleted(BINDER_STAT_TRANSACTION);
780}
781
782static void binder_send_failed_reply(struct binder_transaction *t,
783 uint32_t error_code)
784{
785 struct binder_thread *target_thread;
d4ec15e1 786 struct binder_transaction *next;
10f62861 787
355b0502
GKH		 788 BUG_ON(t->flags & TF_ONE_WAY);
789 while (1) {
790 target_thread = t->from;
791 if (target_thread) {
792 if (target_thread->return_error != BR_OK &&
793 target_thread->return_error2 == BR_OK) {
794 target_thread->return_error2 =
795 target_thread->return_error;
796 target_thread->return_error = BR_OK;
797 }
798 if (target_thread->return_error == BR_OK) {
799 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
56b468fc 800 "send failed reply for transaction %d to %d:%d\n",
0232a42c
WP		 801 t->debug_id,
802 target_thread->proc->pid,
355b0502
GKH		 803 target_thread->pid);
804
805 binder_pop_transaction(target_thread, t);
806 target_thread->return_error = error_code;
807 wake_up_interruptible(&target_thread->wait);
808 } else {
56b468fc
AS		 809 pr_err("reply failed, target thread, %d:%d, has error code %d already\n",
810 target_thread->proc->pid,
355b0502
GKH		 811 target_thread->pid,
812 target_thread->return_error);
813 }
814 return;
d4ec15e1
LT		 815 }
816 next = t->from_parent;
817
818 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
819 "send failed reply for transaction %d, target dead\n",
820 t->debug_id);
821
822 binder_pop_transaction(target_thread, t);
823 if (next == NULL) {
355b0502 824 binder_debug(BINDER_DEBUG_DEAD_BINDER,
d4ec15e1
LT		 825 "reply failed, no target thread at root\n");
826 return;
355b0502 827 }
d4ec15e1
LT		 828 t = next;
829 binder_debug(BINDER_DEBUG_DEAD_BINDER,
830 "reply failed, no target thread -- retry %d\n",
831 t->debug_id);
355b0502
GKH		 832 }
833}
834
feba3900
MC		 835/**
836 * binder_validate_object() - checks for a valid metadata object in a buffer.
837 * @buffer: binder_buffer that we're parsing.
838 * @offset: offset in the buffer at which to validate an object.
839 *
840 * Return: If there's a valid metadata object at @offset in @buffer, the
841 * size of that object. Otherwise, it returns zero.
842 */
843static size_t binder_validate_object(struct binder_buffer *buffer, u64 offset)
844{
845 /* Check if we can read a header first */
846 struct binder_object_header *hdr;
847 size_t object_size = 0;
848
849 if (offset > buffer->data_size - sizeof(*hdr) ||
850 buffer->data_size < sizeof(*hdr) ||
851 !IS_ALIGNED(offset, sizeof(u32)))
852 return 0;
853
854 /* Ok, now see if we can read a complete object. */
855 hdr = (struct binder_object_header *)(buffer->data + offset);
856 switch (hdr->type) {
857 case BINDER_TYPE_BINDER:
858 case BINDER_TYPE_WEAK_BINDER:
859 case BINDER_TYPE_HANDLE:
860 case BINDER_TYPE_WEAK_HANDLE:
861 object_size = sizeof(struct flat_binder_object);
862 break;
863 case BINDER_TYPE_FD:
864 object_size = sizeof(struct binder_fd_object);
865 break;
7980240b
MC		 866 case BINDER_TYPE_PTR:
867 object_size = sizeof(struct binder_buffer_object);
868 break;
def95c73
MC		 869 case BINDER_TYPE_FDA:
870 object_size = sizeof(struct binder_fd_array_object);
871 break;
feba3900
MC		 872 default:
873 return 0;
874 }
875 if (offset <= buffer->data_size - object_size &&
876 buffer->data_size >= object_size)
877 return object_size;
878 else
879 return 0;
880}
881
7980240b
MC		 882/**
883 * binder_validate_ptr() - validates binder_buffer_object in a binder_buffer.
884 * @b: binder_buffer containing the object
885 * @index: index in offset array at which the binder_buffer_object is
886 * located
887 * @start: points to the start of the offset array
888 * @num_valid: the number of valid offsets in the offset array
889 *
890 * Return: If @index is within the valid range of the offset array
891 * described by @start and @num_valid, and if there's a valid
892 * binder_buffer_object at the offset found in index @index
893 * of the offset array, that object is returned. Otherwise,
894 * %NULL is returned.
895 * Note that the offset found in index @index itself is not
896 * verified; this function assumes that @num_valid elements
897 * from @start were previously verified to have valid offsets.
898 */
899static struct binder_buffer_object *binder_validate_ptr(struct binder_buffer *b,
900 binder_size_t index,
901 binder_size_t *start,
902 binder_size_t num_valid)
903{
904 struct binder_buffer_object *buffer_obj;
905 binder_size_t *offp;
906
907 if (index >= num_valid)
908 return NULL;
909
910 offp = start + index;
911 buffer_obj = (struct binder_buffer_object *)(b->data + *offp);
912 if (buffer_obj->hdr.type != BINDER_TYPE_PTR)
913 return NULL;
914
915 return buffer_obj;
916}
917
918/**
919 * binder_validate_fixup() - validates pointer/fd fixups happen in order.
920 * @b: transaction buffer
921 * @objects_start start of objects buffer
922 * @buffer: binder_buffer_object in which to fix up
923 * @offset: start offset in @buffer to fix up
924 * @last_obj: last binder_buffer_object that we fixed up in
925 * @last_min_offset: minimum fixup offset in @last_obj
926 *
927 * Return: %true if a fixup in buffer @buffer at offset @offset is
928 * allowed.
929 *
930 * For safety reasons, we only allow fixups inside a buffer to happen
931 * at increasing offsets; additionally, we only allow fixup on the last
932 * buffer object that was verified, or one of its parents.
933 *
934 * Example of what is allowed:
935 *
936 * A
937 * B (parent = A, offset = 0)
938 * C (parent = A, offset = 16)
939 * D (parent = C, offset = 0)
940 * E (parent = A, offset = 32) // min_offset is 16 (C.parent_offset)
941 *
942 * Examples of what is not allowed:
943 *
944 * Decreasing offsets within the same parent:
945 * A
946 * C (parent = A, offset = 16)
947 * B (parent = A, offset = 0) // decreasing offset within A
948 *
949 * Referring to a parent that wasn't the last object or any of its parents:
950 * A
951 * B (parent = A, offset = 0)
952 * C (parent = A, offset = 0)
953 * C (parent = A, offset = 16)
954 * D (parent = B, offset = 0) // B is not A or any of A's parents
955 */
956static bool binder_validate_fixup(struct binder_buffer *b,
957 binder_size_t *objects_start,
958 struct binder_buffer_object *buffer,
959 binder_size_t fixup_offset,
960 struct binder_buffer_object *last_obj,
961 binder_size_t last_min_offset)
962{
963 if (!last_obj) {
964 /* Nothing to fix up in */
965 return false;
966 }
967
968 while (last_obj != buffer) {
969 /*
970 * Safe to retrieve the parent of last_obj, since it
971 * was already previously verified by the driver.
972 */
973 if ((last_obj->flags & BINDER_BUFFER_FLAG_HAS_PARENT) == 0)
974 return false;
975 last_min_offset = last_obj->parent_offset + sizeof(uintptr_t);
976 last_obj = (struct binder_buffer_object *)
977 (b->data + *(objects_start + last_obj->parent));
978 }
979 return (fixup_offset >= last_min_offset);
980}
981
355b0502
GKH		 982static void binder_transaction_buffer_release(struct binder_proc *proc,
983 struct binder_buffer *buffer,
da49889d 984 binder_size_t *failed_at)
355b0502 985{
7980240b 986 binder_size_t *offp, *off_start, *off_end;
355b0502
GKH		 987 int debug_id = buffer->debug_id;
988
989 binder_debug(BINDER_DEBUG_TRANSACTION,
56b468fc 990 "%d buffer release %d, size %zd-%zd, failed at %p\n",
355b0502
GKH		 991 proc->pid, buffer->debug_id,
992 buffer->data_size, buffer->offsets_size, failed_at);
993
994 if (buffer->target_node)
995 binder_dec_node(buffer->target_node, 1, 0);
996
7980240b
MC		 997 off_start = (binder_size_t *)(buffer->data +
998 ALIGN(buffer->data_size, sizeof(void *)));
355b0502
GKH		 999 if (failed_at)
1000 off_end = failed_at;
1001 else
7980240b
MC		 1002 off_end = (void *)off_start + buffer->offsets_size;
1003 for (offp = off_start; offp < off_end; offp++) {
feba3900
MC		 1004 struct binder_object_header *hdr;
1005 size_t object_size = binder_validate_object(buffer, *offp);
10f62861 1006
feba3900
MC		 1007 if (object_size == 0) {
1008 pr_err("transaction release %d bad object at offset %lld, size %zd\n",
da49889d 1009 debug_id, (u64)*offp, buffer->data_size);
355b0502
GKH		 1010 continue;
1011 }
feba3900
MC		 1012 hdr = (struct binder_object_header *)(buffer->data + *offp);
1013 switch (hdr->type) {
355b0502
GKH		 1014 case BINDER_TYPE_BINDER:
1015 case BINDER_TYPE_WEAK_BINDER: {
feba3900
MC		 1016 struct flat_binder_object *fp;
1017 struct binder_node *node;
10f62861 1018
feba3900
MC		 1019 fp = to_flat_binder_object(hdr);
1020 node = binder_get_node(proc, fp->binder);
355b0502 1021 if (node == NULL) {
da49889d
AH		 1022 pr_err("transaction release %d bad node %016llx\n",
1023 debug_id, (u64)fp->binder);
355b0502
GKH		 1024 break;
1025 }
1026 binder_debug(BINDER_DEBUG_TRANSACTION,
da49889d
AH		 1027 " node %d u%016llx\n",
1028 node->debug_id, (u64)node->ptr);
feba3900
MC		 1029 binder_dec_node(node, hdr->type == BINDER_TYPE_BINDER,
1030 0);
355b0502
GKH		 1031 } break;
1032 case BINDER_TYPE_HANDLE:
1033 case BINDER_TYPE_WEAK_HANDLE: {
feba3900 1034 struct flat_binder_object *fp;
0a3ffab9
AH		 1035 struct binder_ref *ref;
1036
feba3900 1037 fp = to_flat_binder_object(hdr);
0a3ffab9 1038 ref = binder_get_ref(proc, fp->handle,
feba3900 1039 hdr->type == BINDER_TYPE_HANDLE);
355b0502 1040 if (ref == NULL) {
64dcfe6b 1041 pr_err("transaction release %d bad handle %d\n",
56b468fc 1042 debug_id, fp->handle);
355b0502
GKH		 1043 break;
1044 }
1045 binder_debug(BINDER_DEBUG_TRANSACTION,
1046 " ref %d desc %d (node %d)\n",
1047 ref->debug_id, ref->desc, ref->node->debug_id);
feba3900 1048 binder_dec_ref(ref, hdr->type == BINDER_TYPE_HANDLE);
355b0502
GKH		 1049 } break;
1050
feba3900
MC		 1051 case BINDER_TYPE_FD: {
1052 struct binder_fd_object *fp = to_binder_fd_object(hdr);
1053
355b0502 1054 binder_debug(BINDER_DEBUG_TRANSACTION,
feba3900 1055 " fd %d\n", fp->fd);
355b0502 1056 if (failed_at)
feba3900
MC		 1057 task_close_fd(proc, fp->fd);
1058 } break;
7980240b
MC		 1059 case BINDER_TYPE_PTR:
1060 /*
1061 * Nothing to do here, this will get cleaned up when the
1062 * transaction buffer gets freed
1063 */
1064 break;
def95c73
MC		 1065 case BINDER_TYPE_FDA: {
1066 struct binder_fd_array_object *fda;
1067 struct binder_buffer_object *parent;
1068 uintptr_t parent_buffer;
1069 u32 *fd_array;
1070 size_t fd_index;
1071 binder_size_t fd_buf_size;
1072
1073 fda = to_binder_fd_array_object(hdr);
1074 parent = binder_validate_ptr(buffer, fda->parent,
1075 off_start,
1076 offp - off_start);
1077 if (!parent) {
1078 pr_err("transaction release %d bad parent offset",
1079 debug_id);
1080 continue;
1081 }
1082 /*
1083 * Since the parent was already fixed up, convert it
1084 * back to kernel address space to access it
1085 */
1086 parent_buffer = parent->buffer -
19c98724
TK		 1087 binder_alloc_get_user_buffer_offset(
1088 &proc->alloc);
def95c73
MC		 1089
1090 fd_buf_size = sizeof(u32) * fda->num_fds;
1091 if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {
1092 pr_err("transaction release %d invalid number of fds (%lld)\n",
1093 debug_id, (u64)fda->num_fds);
1094 continue;
1095 }
1096 if (fd_buf_size > parent->length ||
1097 fda->parent_offset > parent->length - fd_buf_size) {
1098 /* No space for all file descriptors here. */
1099 pr_err("transaction release %d not enough space for %lld fds in buffer\n",
1100 debug_id, (u64)fda->num_fds);
1101 continue;
1102 }
1103 fd_array = (u32 *)(parent_buffer + fda->parent_offset);
1104 for (fd_index = 0; fd_index < fda->num_fds; fd_index++)
1105 task_close_fd(proc, fd_array[fd_index]);
1106 } break;
355b0502 1107 default:
64dcfe6b 1108 pr_err("transaction release %d bad object type %x\n",
feba3900 1109 debug_id, hdr->type);
355b0502
GKH		 1110 break;
1111 }
1112 }
1113}
1114
a056af42
MC		 1115static int binder_translate_binder(struct flat_binder_object *fp,
1116 struct binder_transaction *t,
1117 struct binder_thread *thread)
1118{
1119 struct binder_node *node;
1120 struct binder_ref *ref;
1121 struct binder_proc *proc = thread->proc;
1122 struct binder_proc *target_proc = t->to_proc;
1123
1124 node = binder_get_node(proc, fp->binder);
1125 if (!node) {
1126 node = binder_new_node(proc, fp->binder, fp->cookie);
1127 if (!node)
1128 return -ENOMEM;
1129
1130 node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK;
1131 node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS);
1132 }
1133 if (fp->cookie != node->cookie) {
1134 binder_user_error("%d:%d sending u%016llx node %d, cookie mismatch %016llx != %016llx\n",
1135 proc->pid, thread->pid, (u64)fp->binder,
1136 node->debug_id, (u64)fp->cookie,
1137 (u64)node->cookie);
1138 return -EINVAL;
1139 }
1140 if (security_binder_transfer_binder(proc->tsk, target_proc->tsk))
1141 return -EPERM;
1142
1143 ref = binder_get_ref_for_node(target_proc, node);
1144 if (!ref)
1145 return -EINVAL;
1146
1147 if (fp->hdr.type == BINDER_TYPE_BINDER)
1148 fp->hdr.type = BINDER_TYPE_HANDLE;
1149 else
1150 fp->hdr.type = BINDER_TYPE_WEAK_HANDLE;
1151 fp->binder = 0;
1152 fp->handle = ref->desc;
1153 fp->cookie = 0;
1154 binder_inc_ref(ref, fp->hdr.type == BINDER_TYPE_HANDLE, &thread->todo);
1155
1156 trace_binder_transaction_node_to_ref(t, node, ref);
1157 binder_debug(BINDER_DEBUG_TRANSACTION,
1158 " node %d u%016llx -> ref %d desc %d\n",
1159 node->debug_id, (u64)node->ptr,
1160 ref->debug_id, ref->desc);
1161
1162 return 0;
1163}
1164
1165static int binder_translate_handle(struct flat_binder_object *fp,
1166 struct binder_transaction *t,
1167 struct binder_thread *thread)
1168{
1169 struct binder_ref *ref;
1170 struct binder_proc *proc = thread->proc;
1171 struct binder_proc *target_proc = t->to_proc;
1172
1173 ref = binder_get_ref(proc, fp->handle,
1174 fp->hdr.type == BINDER_TYPE_HANDLE);
1175 if (!ref) {
1176 binder_user_error("%d:%d got transaction with invalid handle, %d\n",
1177 proc->pid, thread->pid, fp->handle);
1178 return -EINVAL;
1179 }
1180 if (security_binder_transfer_binder(proc->tsk, target_proc->tsk))
1181 return -EPERM;
1182
1183 if (ref->node->proc == target_proc) {
1184 if (fp->hdr.type == BINDER_TYPE_HANDLE)
1185 fp->hdr.type = BINDER_TYPE_BINDER;
1186 else
1187 fp->hdr.type = BINDER_TYPE_WEAK_BINDER;
1188 fp->binder = ref->node->ptr;
1189 fp->cookie = ref->node->cookie;
1190 binder_inc_node(ref->node, fp->hdr.type == BINDER_TYPE_BINDER,
1191 0, NULL);
1192 trace_binder_transaction_ref_to_node(t, ref);
1193 binder_debug(BINDER_DEBUG_TRANSACTION,
1194 " ref %d desc %d -> node %d u%016llx\n",
1195 ref->debug_id, ref->desc, ref->node->debug_id,
1196 (u64)ref->node->ptr);
1197 } else {
1198 struct binder_ref *new_ref;
1199
1200 new_ref = binder_get_ref_for_node(target_proc, ref->node);
1201 if (!new_ref)
1202 return -EINVAL;
1203
1204 fp->binder = 0;
1205 fp->handle = new_ref->desc;
1206 fp->cookie = 0;
1207 binder_inc_ref(new_ref, fp->hdr.type == BINDER_TYPE_HANDLE,
1208 NULL);
1209 trace_binder_transaction_ref_to_ref(t, ref, new_ref);
1210 binder_debug(BINDER_DEBUG_TRANSACTION,
1211 " ref %d desc %d -> ref %d desc %d (node %d)\n",
1212 ref->debug_id, ref->desc, new_ref->debug_id,
1213 new_ref->desc, ref->node->debug_id);
1214 }
1215 return 0;
1216}
1217
1218static int binder_translate_fd(int fd,
1219 struct binder_transaction *t,
1220 struct binder_thread *thread,
1221 struct binder_transaction *in_reply_to)
1222{
1223 struct binder_proc *proc = thread->proc;
1224 struct binder_proc *target_proc = t->to_proc;
1225 int target_fd;
1226 struct file *file;
1227 int ret;
1228 bool target_allows_fd;
1229
1230 if (in_reply_to)
1231 target_allows_fd = !!(in_reply_to->flags & TF_ACCEPT_FDS);
1232 else
1233 target_allows_fd = t->buffer->target_node->accept_fds;
1234 if (!target_allows_fd) {
1235 binder_user_error("%d:%d got %s with fd, %d, but target does not allow fds\n",
1236 proc->pid, thread->pid,
1237 in_reply_to ? "reply" : "transaction",
1238 fd);
1239 ret = -EPERM;
1240 goto err_fd_not_accepted;
1241 }
1242
1243 file = fget(fd);
1244 if (!file) {
1245 binder_user_error("%d:%d got transaction with invalid fd, %d\n",
1246 proc->pid, thread->pid, fd);
1247 ret = -EBADF;
1248 goto err_fget;
1249 }
1250 ret = security_binder_transfer_file(proc->tsk, target_proc->tsk, file);
1251 if (ret < 0) {
1252 ret = -EPERM;
1253 goto err_security;
1254 }
1255
1256 target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC);
1257 if (target_fd < 0) {
1258 ret = -ENOMEM;
1259 goto err_get_unused_fd;
1260 }
1261 task_fd_install(target_proc, target_fd, file);
1262 trace_binder_transaction_fd(t, fd, target_fd);
1263 binder_debug(BINDER_DEBUG_TRANSACTION, " fd %d -> %d\n",
1264 fd, target_fd);
1265
1266 return target_fd;
1267
1268err_get_unused_fd:
1269err_security:
1270 fput(file);
1271err_fget:
1272err_fd_not_accepted:
1273 return ret;
1274}
1275
def95c73
MC		 1276static int binder_translate_fd_array(struct binder_fd_array_object *fda,
1277 struct binder_buffer_object *parent,
1278 struct binder_transaction *t,
1279 struct binder_thread *thread,
1280 struct binder_transaction *in_reply_to)
1281{
1282 binder_size_t fdi, fd_buf_size, num_installed_fds;
1283 int target_fd;
1284 uintptr_t parent_buffer;
1285 u32 *fd_array;
1286 struct binder_proc *proc = thread->proc;
1287 struct binder_proc *target_proc = t->to_proc;
1288
1289 fd_buf_size = sizeof(u32) * fda->num_fds;
1290 if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {
1291 binder_user_error("%d:%d got transaction with invalid number of fds (%lld)\n",
1292 proc->pid, thread->pid, (u64)fda->num_fds);
1293 return -EINVAL;
1294 }
1295 if (fd_buf_size > parent->length ||
1296 fda->parent_offset > parent->length - fd_buf_size) {
1297 /* No space for all file descriptors here. */
1298 binder_user_error("%d:%d not enough space to store %lld fds in buffer\n",
1299 proc->pid, thread->pid, (u64)fda->num_fds);
1300 return -EINVAL;
1301 }
1302 /*
1303 * Since the parent was already fixed up, convert it
1304 * back to the kernel address space to access it
1305 */
19c98724
TK		 1306 parent_buffer = parent->buffer -
1307 binder_alloc_get_user_buffer_offset(&target_proc->alloc);
def95c73
MC		 1308 fd_array = (u32 *)(parent_buffer + fda->parent_offset);
1309 if (!IS_ALIGNED((unsigned long)fd_array, sizeof(u32))) {
1310 binder_user_error("%d:%d parent offset not aligned correctly.\n",
1311 proc->pid, thread->pid);
1312 return -EINVAL;
1313 }
1314 for (fdi = 0; fdi < fda->num_fds; fdi++) {
1315 target_fd = binder_translate_fd(fd_array[fdi], t, thread,
1316 in_reply_to);
1317 if (target_fd < 0)
1318 goto err_translate_fd_failed;
1319 fd_array[fdi] = target_fd;
1320 }
1321 return 0;
1322
1323err_translate_fd_failed:
1324 /*
1325 * Failed to allocate fd or security error, free fds
1326 * installed so far.
1327 */
1328 num_installed_fds = fdi;
1329 for (fdi = 0; fdi < num_installed_fds; fdi++)
1330 task_close_fd(target_proc, fd_array[fdi]);
1331 return target_fd;
1332}
1333
7980240b
MC		 1334static int binder_fixup_parent(struct binder_transaction *t,
1335 struct binder_thread *thread,
1336 struct binder_buffer_object *bp,
1337 binder_size_t *off_start,
1338 binder_size_t num_valid,
1339 struct binder_buffer_object *last_fixup_obj,
1340 binder_size_t last_fixup_min_off)
1341{
1342 struct binder_buffer_object *parent;
1343 u8 *parent_buffer;
1344 struct binder_buffer *b = t->buffer;
1345 struct binder_proc *proc = thread->proc;
1346 struct binder_proc *target_proc = t->to_proc;
1347
1348 if (!(bp->flags & BINDER_BUFFER_FLAG_HAS_PARENT))
1349 return 0;
1350
1351 parent = binder_validate_ptr(b, bp->parent, off_start, num_valid);
1352 if (!parent) {
1353 binder_user_error("%d:%d got transaction with invalid parent offset or type\n",
1354 proc->pid, thread->pid);
1355 return -EINVAL;
1356 }
1357
1358 if (!binder_validate_fixup(b, off_start,
1359 parent, bp->parent_offset,
1360 last_fixup_obj,
1361 last_fixup_min_off)) {
1362 binder_user_error("%d:%d got transaction with out-of-order buffer fixup\n",
1363 proc->pid, thread->pid);
1364 return -EINVAL;
1365 }
1366
1367 if (parent->length < sizeof(binder_uintptr_t) ||
1368 bp->parent_offset > parent->length - sizeof(binder_uintptr_t)) {
1369 /* No space for a pointer here! */
1370 binder_user_error("%d:%d got transaction with invalid parent offset\n",
1371 proc->pid, thread->pid);
1372 return -EINVAL;
1373 }
1374 parent_buffer = (u8 *)(parent->buffer -
19c98724
TK		 1375 binder_alloc_get_user_buffer_offset(
1376 &target_proc->alloc));
7980240b
MC		 1377 *(binder_uintptr_t *)(parent_buffer + bp->parent_offset) = bp->buffer;
1378
1379 return 0;
1380}
1381
355b0502
GKH		 1382static void binder_transaction(struct binder_proc *proc,
1383 struct binder_thread *thread,
4bfac80a
MC		 1384 struct binder_transaction_data *tr, int reply,
1385 binder_size_t extra_buffers_size)
355b0502 1386{
a056af42 1387 int ret;
355b0502
GKH		 1388 struct binder_transaction *t;
1389 struct binder_work *tcomplete;
7980240b 1390 binder_size_t *offp, *off_end, *off_start;
212265e5 1391 binder_size_t off_min;
7980240b 1392 u8 *sg_bufp, *sg_buf_end;
355b0502
GKH		 1393 struct binder_proc *target_proc;
1394 struct binder_thread *target_thread = NULL;
1395 struct binder_node *target_node = NULL;
1396 struct list_head *target_list;
1397 wait_queue_head_t *target_wait;
1398 struct binder_transaction *in_reply_to = NULL;
1399 struct binder_transaction_log_entry *e;
1400 uint32_t return_error;
7980240b
MC		 1401 struct binder_buffer_object *last_fixup_obj = NULL;
1402 binder_size_t last_fixup_min_off = 0;
342e5c90 1403 struct binder_context *context = proc->context;
355b0502
GKH		 1404
1405 e = binder_transaction_log_add(&binder_transaction_log);
1406 e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY);
1407 e->from_proc = proc->pid;
1408 e->from_thread = thread->pid;
1409 e->target_handle = tr->target.handle;
1410 e->data_size = tr->data_size;
1411 e->offsets_size = tr->offsets_size;
14db3181 1412 e->context_name = proc->context->name;
355b0502
GKH		 1413
1414 if (reply) {
1415 in_reply_to = thread->transaction_stack;
1416 if (in_reply_to == NULL) {
56b468fc 1417 binder_user_error("%d:%d got reply transaction with no transaction stack\n",
355b0502
GKH		 1418 proc->pid, thread->pid);
1419 return_error = BR_FAILED_REPLY;
1420 goto err_empty_call_stack;
1421 }
1422 binder_set_nice(in_reply_to->saved_priority);
1423 if (in_reply_to->to_thread != thread) {
56b468fc 1424 binder_user_error("%d:%d got reply transaction with bad transaction stack, transaction %d has target %d:%d\n",
355b0502
GKH		 1425 proc->pid, thread->pid, in_reply_to->debug_id,
1426 in_reply_to->to_proc ?
1427 in_reply_to->to_proc->pid : 0,
1428 in_reply_to->to_thread ?
1429 in_reply_to->to_thread->pid : 0);
1430 return_error = BR_FAILED_REPLY;
1431 in_reply_to = NULL;
1432 goto err_bad_call_stack;
1433 }
1434 thread->transaction_stack = in_reply_to->to_parent;
1435 target_thread = in_reply_to->from;
1436 if (target_thread == NULL) {
1437 return_error = BR_DEAD_REPLY;
1438 goto err_dead_binder;
1439 }
1440 if (target_thread->transaction_stack != in_reply_to) {
56b468fc 1441 binder_user_error("%d:%d got reply transaction with bad target transaction stack %d, expected %d\n",
355b0502
GKH		 1442 proc->pid, thread->pid,
1443 target_thread->transaction_stack ?
1444 target_thread->transaction_stack->debug_id : 0,
1445 in_reply_to->debug_id);
1446 return_error = BR_FAILED_REPLY;
1447 in_reply_to = NULL;
1448 target_thread = NULL;
1449 goto err_dead_binder;
1450 }
1451 target_proc = target_thread->proc;
1452 } else {
1453 if (tr->target.handle) {
1454 struct binder_ref *ref;
10f62861 1455
0a3ffab9 1456 ref = binder_get_ref(proc, tr->target.handle, true);
355b0502 1457 if (ref == NULL) {
56b468fc 1458 binder_user_error("%d:%d got transaction to invalid handle\n",
355b0502
GKH		 1459 proc->pid, thread->pid);
1460 return_error = BR_FAILED_REPLY;
1461 goto err_invalid_target_handle;
1462 }
1463 target_node = ref->node;
1464 } else {
c44b1231 1465 mutex_lock(&context->context_mgr_node_lock);
342e5c90 1466 target_node = context->binder_context_mgr_node;
355b0502
GKH		 1467 if (target_node == NULL) {
1468 return_error = BR_DEAD_REPLY;
c44b1231 1469 mutex_unlock(&context->context_mgr_node_lock);
355b0502
GKH		 1470 goto err_no_context_mgr_node;
1471 }
c44b1231 1472 mutex_unlock(&context->context_mgr_node_lock);
355b0502
GKH		 1473 }
1474 e->to_node = target_node->debug_id;
1475 target_proc = target_node->proc;
1476 if (target_proc == NULL) {
1477 return_error = BR_DEAD_REPLY;
1478 goto err_dead_binder;
1479 }
79af7307
SS		 1480 if (security_binder_transaction(proc->tsk,
1481 target_proc->tsk) < 0) {
1482 return_error = BR_FAILED_REPLY;
1483 goto err_invalid_target_handle;
1484 }
355b0502
GKH		 1485 if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) {
1486 struct binder_transaction *tmp;
10f62861 1487
355b0502
GKH		 1488 tmp = thread->transaction_stack;
1489 if (tmp->to_thread != thread) {
56b468fc 1490 binder_user_error("%d:%d got new transaction with bad transaction stack, transaction %d has target %d:%d\n",
355b0502
GKH		 1491 proc->pid, thread->pid, tmp->debug_id,
1492 tmp->to_proc ? tmp->to_proc->pid : 0,
1493 tmp->to_thread ?
1494 tmp->to_thread->pid : 0);
1495 return_error = BR_FAILED_REPLY;
1496 goto err_bad_call_stack;
1497 }
1498 while (tmp) {
1499 if (tmp->from && tmp->from->proc == target_proc)
1500 target_thread = tmp->from;
1501 tmp = tmp->from_parent;
1502 }
1503 }
1504 }
1505 if (target_thread) {
1506 e->to_thread = target_thread->pid;
1507 target_list = &target_thread->todo;
1508 target_wait = &target_thread->wait;
1509 } else {
1510 target_list = &target_proc->todo;
1511 target_wait = &target_proc->wait;
1512 }
1513 e->to_proc = target_proc->pid;
1514
1515 /* TODO: reuse incoming transaction for reply */
1516 t = kzalloc(sizeof(*t), GFP_KERNEL);
1517 if (t == NULL) {
1518 return_error = BR_FAILED_REPLY;
1519 goto err_alloc_t_failed;
1520 }
1521 binder_stats_created(BINDER_STAT_TRANSACTION);
1522
1523 tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL);
1524 if (tcomplete == NULL) {
1525 return_error = BR_FAILED_REPLY;
1526 goto err_alloc_tcomplete_failed;
1527 }
1528 binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE);
1529
1530 t->debug_id = ++binder_last_id;
1531 e->debug_id = t->debug_id;
1532
1533 if (reply)
1534 binder_debug(BINDER_DEBUG_TRANSACTION,
4bfac80a 1535 "%d:%d BC_REPLY %d -> %d:%d, data %016llx-%016llx size %lld-%lld-%lld\n",
355b0502
GKH		 1536 proc->pid, thread->pid, t->debug_id,
1537 target_proc->pid, target_thread->pid,
da49889d
AH		 1538 (u64)tr->data.ptr.buffer,
1539 (u64)tr->data.ptr.offsets,
4bfac80a
MC		 1540 (u64)tr->data_size, (u64)tr->offsets_size,
1541 (u64)extra_buffers_size);
355b0502
GKH		 1542 else
1543 binder_debug(BINDER_DEBUG_TRANSACTION,
4bfac80a 1544 "%d:%d BC_TRANSACTION %d -> %d - node %d, data %016llx-%016llx size %lld-%lld-%lld\n",
355b0502
GKH		 1545 proc->pid, thread->pid, t->debug_id,
1546 target_proc->pid, target_node->debug_id,
da49889d
AH		 1547 (u64)tr->data.ptr.buffer,
1548 (u64)tr->data.ptr.offsets,
4bfac80a
MC		 1549 (u64)tr->data_size, (u64)tr->offsets_size,
1550 (u64)extra_buffers_size);
355b0502
GKH		 1551
1552 if (!reply && !(tr->flags & TF_ONE_WAY))
1553 t->from = thread;
1554 else
1555 t->from = NULL;
57bab7cb 1556 t->sender_euid = task_euid(proc->tsk);
355b0502
GKH		 1557 t->to_proc = target_proc;
1558 t->to_thread = target_thread;
1559 t->code = tr->code;
1560 t->flags = tr->flags;
1561 t->priority = task_nice(current);
975a1ac9
AH		 1562
1563 trace_binder_transaction(reply, t, target_node);
1564
19c98724 1565 t->buffer = binder_alloc_new_buf(&target_proc->alloc, tr->data_size,
4bfac80a
MC		 1566 tr->offsets_size, extra_buffers_size,
1567 !reply && (t->flags & TF_ONE_WAY));
355b0502
GKH		 1568 if (t->buffer == NULL) {
1569 return_error = BR_FAILED_REPLY;
1570 goto err_binder_alloc_buf_failed;
1571 }
1572 t->buffer->allow_user_free = 0;
1573 t->buffer->debug_id = t->debug_id;
1574 t->buffer->transaction = t;
1575 t->buffer->target_node = target_node;
975a1ac9 1576 trace_binder_transaction_alloc_buf(t->buffer);
355b0502
GKH		 1577 if (target_node)
1578 binder_inc_node(target_node, 1, 0, NULL);
1579
7980240b
MC		 1580 off_start = (binder_size_t *)(t->buffer->data +
1581 ALIGN(tr->data_size, sizeof(void *)));
1582 offp = off_start;
355b0502 1583
da49889d
AH		 1584 if (copy_from_user(t->buffer->data, (const void __user *)(uintptr_t)
1585 tr->data.ptr.buffer, tr->data_size)) {
56b468fc
AS		 1586 binder_user_error("%d:%d got transaction with invalid data ptr\n",
1587 proc->pid, thread->pid);
355b0502
GKH		 1588 return_error = BR_FAILED_REPLY;
1589 goto err_copy_data_failed;
1590 }
da49889d
AH		 1591 if (copy_from_user(offp, (const void __user *)(uintptr_t)
1592 tr->data.ptr.offsets, tr->offsets_size)) {
56b468fc
AS		 1593 binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
1594 proc->pid, thread->pid);
355b0502
GKH		 1595 return_error = BR_FAILED_REPLY;
1596 goto err_copy_data_failed;
1597 }
da49889d
AH		 1598 if (!IS_ALIGNED(tr->offsets_size, sizeof(binder_size_t))) {
1599 binder_user_error("%d:%d got transaction with invalid offsets size, %lld\n",
1600 proc->pid, thread->pid, (u64)tr->offsets_size);
355b0502
GKH		 1601 return_error = BR_FAILED_REPLY;
1602 goto err_bad_offset;
1603 }
7980240b
MC		 1604 if (!IS_ALIGNED(extra_buffers_size, sizeof(u64))) {
1605 binder_user_error("%d:%d got transaction with unaligned buffers size, %lld\n",
1606 proc->pid, thread->pid,
1607 (u64)extra_buffers_size);
1608 return_error = BR_FAILED_REPLY;
1609 goto err_bad_offset;
1610 }
1611 off_end = (void *)off_start + tr->offsets_size;
1612 sg_bufp = (u8 *)(PTR_ALIGN(off_end, sizeof(void *)));
1613 sg_buf_end = sg_bufp + extra_buffers_size;
212265e5 1614 off_min = 0;
355b0502 1615 for (; offp < off_end; offp++) {
feba3900
MC		 1616 struct binder_object_header *hdr;
1617 size_t object_size = binder_validate_object(t->buffer, *offp);
10f62861 1618
feba3900
MC		 1619 if (object_size == 0 || *offp < off_min) {
1620 binder_user_error("%d:%d got transaction with invalid offset (%lld, min %lld max %lld) or object.\n",
212265e5
AH		 1621 proc->pid, thread->pid, (u64)*offp,
1622 (u64)off_min,
feba3900 1623 (u64)t->buffer->data_size);
355b0502
GKH		 1624 return_error = BR_FAILED_REPLY;
1625 goto err_bad_offset;
1626 }
feba3900
MC		 1627
1628 hdr = (struct binder_object_header *)(t->buffer->data + *offp);
1629 off_min = *offp + object_size;
1630 switch (hdr->type) {
355b0502
GKH		 1631 case BINDER_TYPE_BINDER:
1632 case BINDER_TYPE_WEAK_BINDER: {
feba3900 1633 struct flat_binder_object *fp;
10f62861 1634
feba3900 1635 fp = to_flat_binder_object(hdr);
a056af42
MC		 1636 ret = binder_translate_binder(fp, t, thread);
1637 if (ret < 0) {
355b0502 1638 return_error = BR_FAILED_REPLY;
a056af42 1639 goto err_translate_failed;
355b0502 1640 }
355b0502
GKH		 1641 } break;
1642 case BINDER_TYPE_HANDLE:
1643 case BINDER_TYPE_WEAK_HANDLE: {
feba3900 1644 struct flat_binder_object *fp;
0a3ffab9 1645
feba3900 1646 fp = to_flat_binder_object(hdr);
a056af42
MC		 1647 ret = binder_translate_handle(fp, t, thread);
1648 if (ret < 0) {
79af7307 1649 return_error = BR_FAILED_REPLY;
a056af42 1650 goto err_translate_failed;
355b0502
GKH		 1651 }
1652 } break;
1653
1654 case BINDER_TYPE_FD: {
feba3900 1655 struct binder_fd_object *fp = to_binder_fd_object(hdr);
a056af42
MC		 1656 int target_fd = binder_translate_fd(fp->fd, t, thread,
1657 in_reply_to);
355b0502 1658
355b0502 1659 if (target_fd < 0) {
355b0502 1660 return_error = BR_FAILED_REPLY;
a056af42 1661 goto err_translate_failed;
355b0502 1662 }
feba3900
MC		 1663 fp->pad_binder = 0;
1664 fp->fd = target_fd;
355b0502 1665 } break;
def95c73
MC		 1666 case BINDER_TYPE_FDA: {
1667 struct binder_fd_array_object *fda =
1668 to_binder_fd_array_object(hdr);
1669 struct binder_buffer_object *parent =
1670 binder_validate_ptr(t->buffer, fda->parent,
1671 off_start,
1672 offp - off_start);
1673 if (!parent) {
1674 binder_user_error("%d:%d got transaction with invalid parent offset or type\n",
1675 proc->pid, thread->pid);
1676 return_error = BR_FAILED_REPLY;
1677 goto err_bad_parent;
1678 }
1679 if (!binder_validate_fixup(t->buffer, off_start,
1680 parent, fda->parent_offset,
1681 last_fixup_obj,
1682 last_fixup_min_off)) {
1683 binder_user_error("%d:%d got transaction with out-of-order buffer fixup\n",
1684 proc->pid, thread->pid);
1685 return_error = BR_FAILED_REPLY;
1686 goto err_bad_parent;
1687 }
1688 ret = binder_translate_fd_array(fda, parent, t, thread,
1689 in_reply_to);
1690 if (ret < 0) {
1691 return_error = BR_FAILED_REPLY;
1692 goto err_translate_failed;
1693 }
1694 last_fixup_obj = parent;
1695 last_fixup_min_off =
1696 fda->parent_offset + sizeof(u32) * fda->num_fds;
1697 } break;
7980240b
MC		 1698 case BINDER_TYPE_PTR: {
1699 struct binder_buffer_object *bp =
1700 to_binder_buffer_object(hdr);
1701 size_t buf_left = sg_buf_end - sg_bufp;
1702
1703 if (bp->length > buf_left) {
1704 binder_user_error("%d:%d got transaction with too large buffer\n",
1705 proc->pid, thread->pid);
1706 return_error = BR_FAILED_REPLY;
1707 goto err_bad_offset;
1708 }
1709 if (copy_from_user(sg_bufp,
1710 (const void __user *)(uintptr_t)
1711 bp->buffer, bp->length)) {
1712 binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
1713 proc->pid, thread->pid);
1714 return_error = BR_FAILED_REPLY;
1715 goto err_copy_data_failed;
1716 }
1717 /* Fixup buffer pointer to target proc address space */
1718 bp->buffer = (uintptr_t)sg_bufp +
19c98724
TK		 1719 binder_alloc_get_user_buffer_offset(
1720 &target_proc->alloc);
7980240b
MC		 1721 sg_bufp += ALIGN(bp->length, sizeof(u64));
1722
1723 ret = binder_fixup_parent(t, thread, bp, off_start,
1724 offp - off_start,
1725 last_fixup_obj,
1726 last_fixup_min_off);
1727 if (ret < 0) {
1728 return_error = BR_FAILED_REPLY;
1729 goto err_translate_failed;
1730 }
1731 last_fixup_obj = bp;
1732 last_fixup_min_off = 0;
1733 } break;
355b0502 1734 default:
64dcfe6b 1735 binder_user_error("%d:%d got transaction with invalid object type, %x\n",
feba3900 1736 proc->pid, thread->pid, hdr->type);
355b0502
GKH		 1737 return_error = BR_FAILED_REPLY;
1738 goto err_bad_object_type;
1739 }
1740 }
1741 if (reply) {
1742 BUG_ON(t->buffer->async_transaction != 0);
1743 binder_pop_transaction(target_thread, in_reply_to);
1744 } else if (!(t->flags & TF_ONE_WAY)) {
1745 BUG_ON(t->buffer->async_transaction != 0);
1746 t->need_reply = 1;
1747 t->from_parent = thread->transaction_stack;
1748 thread->transaction_stack = t;
1749 } else {
1750 BUG_ON(target_node == NULL);
1751 BUG_ON(t->buffer->async_transaction != 1);
1752 if (target_node->has_async_transaction) {
1753 target_list = &target_node->async_todo;
1754 target_wait = NULL;
1755 } else
1756 target_node->has_async_transaction = 1;
1757 }
1758 t->work.type = BINDER_WORK_TRANSACTION;
1759 list_add_tail(&t->work.entry, target_list);
1760 tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
1761 list_add_tail(&tcomplete->entry, &thread->todo);
00b40d61
RA		 1762 if (target_wait) {
1763 if (reply || !(t->flags & TF_ONE_WAY))
1764 wake_up_interruptible_sync(target_wait);
1765 else
1766 wake_up_interruptible(target_wait);
1767 }
355b0502
GKH		 1768 return;
1769
a056af42 1770err_translate_failed:
355b0502
GKH		 1771err_bad_object_type:
1772err_bad_offset:
def95c73 1773err_bad_parent:
355b0502 1774err_copy_data_failed:
975a1ac9 1775 trace_binder_transaction_failed_buffer_release(t->buffer);
355b0502
GKH		 1776 binder_transaction_buffer_release(target_proc, t->buffer, offp);
1777 t->buffer->transaction = NULL;
19c98724 1778 binder_alloc_free_buf(&target_proc->alloc, t->buffer);
355b0502
GKH		 1779err_binder_alloc_buf_failed:
1780 kfree(tcomplete);
1781 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
1782err_alloc_tcomplete_failed:
1783 kfree(t);
1784 binder_stats_deleted(BINDER_STAT_TRANSACTION);
1785err_alloc_t_failed:
1786err_bad_call_stack:
1787err_empty_call_stack:
1788err_dead_binder:
1789err_invalid_target_handle:
1790err_no_context_mgr_node:
1791 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
da49889d 1792 "%d:%d transaction failed %d, size %lld-%lld\n",
355b0502 1793 proc->pid, thread->pid, return_error,
da49889d 1794 (u64)tr->data_size, (u64)tr->offsets_size);
355b0502
GKH		 1795
1796 {
1797 struct binder_transaction_log_entry *fe;
10f62861 1798
355b0502
GKH		 1799 fe = binder_transaction_log_add(&binder_transaction_log_failed);
1800 *fe = *e;
1801 }
1802
1803 BUG_ON(thread->return_error != BR_OK);
1804 if (in_reply_to) {
1805 thread->return_error = BR_TRANSACTION_COMPLETE;
1806 binder_send_failed_reply(in_reply_to, return_error);
1807 } else
1808 thread->return_error = return_error;
1809}
1810
fb07ebc3
BP		 1811static int binder_thread_write(struct binder_proc *proc,
1812 struct binder_thread *thread,
da49889d
AH		 1813 binder_uintptr_t binder_buffer, size_t size,
1814 binder_size_t *consumed)
355b0502
GKH		 1815{
1816 uint32_t cmd;
342e5c90 1817 struct binder_context *context = proc->context;
da49889d 1818 void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
355b0502
GKH		 1819 void __user *ptr = buffer + *consumed;
1820 void __user *end = buffer + size;
1821
1822 while (ptr < end && thread->return_error == BR_OK) {
1823 if (get_user(cmd, (uint32_t __user *)ptr))
1824 return -EFAULT;
1825 ptr += sizeof(uint32_t);
975a1ac9 1826 trace_binder_command(cmd);
355b0502 1827 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) {
0953c797
BJS		 1828 atomic_inc(&binder_stats.bc[_IOC_NR(cmd)]);
1829 atomic_inc(&proc->stats.bc[_IOC_NR(cmd)]);
1830 atomic_inc(&thread->stats.bc[_IOC_NR(cmd)]);
355b0502
GKH		 1831 }
1832 switch (cmd) {
1833 case BC_INCREFS:
1834 case BC_ACQUIRE:
1835 case BC_RELEASE:
1836 case BC_DECREFS: {
1837 uint32_t target;
c44b1231 1838 struct binder_ref *ref = NULL;
355b0502
GKH		 1839 const char *debug_string;
1840
1841 if (get_user(target, (uint32_t __user *)ptr))
1842 return -EFAULT;
c44b1231 1843
355b0502 1844 ptr += sizeof(uint32_t);
c44b1231 1845 if (target == 0 &&
355b0502 1846 (cmd == BC_INCREFS || cmd == BC_ACQUIRE)) {
c44b1231
TK		 1847 struct binder_node *ctx_mgr_node;
1848
1849 mutex_lock(&context->context_mgr_node_lock);
1850 ctx_mgr_node = context->binder_context_mgr_node;
1851 if (ctx_mgr_node) {
1852 ref = binder_get_ref_for_node(proc,
1853 ctx_mgr_node);
1854 if (ref && ref->desc != target) {
1855 binder_user_error("%d:%d tried to acquire reference to desc 0, got %d instead\n",
1856 proc->pid, thread->pid,
1857 ref->desc);
1858 }
355b0502 1859 }
c44b1231
TK		 1860 mutex_unlock(&context->context_mgr_node_lock);
1861 }
1862 if (ref == NULL)
0a3ffab9
AH		 1863 ref = binder_get_ref(proc, target,
1864 cmd == BC_ACQUIRE ||
1865 cmd == BC_RELEASE);
355b0502 1866 if (ref == NULL) {
56b468fc 1867 binder_user_error("%d:%d refcount change on invalid ref %d\n",
355b0502
GKH		 1868 proc->pid, thread->pid, target);
1869 break;
1870 }
1871 switch (cmd) {
1872 case BC_INCREFS:
1873 debug_string = "IncRefs";
1874 binder_inc_ref(ref, 0, NULL);
1875 break;
1876 case BC_ACQUIRE:
1877 debug_string = "Acquire";
1878 binder_inc_ref(ref, 1, NULL);
1879 break;
1880 case BC_RELEASE:
1881 debug_string = "Release";
1882 binder_dec_ref(ref, 1);
1883 break;
1884 case BC_DECREFS:
1885 default:
1886 debug_string = "DecRefs";
1887 binder_dec_ref(ref, 0);
1888 break;
1889 }
1890 binder_debug(BINDER_DEBUG_USER_REFS,
56b468fc 1891 "%d:%d %s ref %d desc %d s %d w %d for node %d\n",
355b0502
GKH		 1892 proc->pid, thread->pid, debug_string, ref->debug_id,
1893 ref->desc, ref->strong, ref->weak, ref->node->debug_id);
1894 break;
1895 }
1896 case BC_INCREFS_DONE:
1897 case BC_ACQUIRE_DONE: {
da49889d
AH		 1898 binder_uintptr_t node_ptr;
1899 binder_uintptr_t cookie;
355b0502
GKH		 1900 struct binder_node *node;
1901
da49889d 1902 if (get_user(node_ptr, (binder_uintptr_t __user *)ptr))
355b0502 1903 return -EFAULT;
da49889d
AH		 1904 ptr += sizeof(binder_uintptr_t);
1905 if (get_user(cookie, (binder_uintptr_t __user *)ptr))
355b0502 1906 return -EFAULT;
da49889d 1907 ptr += sizeof(binder_uintptr_t);
355b0502
GKH		 1908 node = binder_get_node(proc, node_ptr);
1909 if (node == NULL) {
da49889d 1910 binder_user_error("%d:%d %s u%016llx no match\n",
355b0502
GKH		 1911 proc->pid, thread->pid,
1912 cmd == BC_INCREFS_DONE ?
1913 "BC_INCREFS_DONE" :
1914 "BC_ACQUIRE_DONE",
da49889d 1915 (u64)node_ptr);
355b0502
GKH		 1916 break;
1917 }
1918 if (cookie != node->cookie) {
da49889d 1919 binder_user_error("%d:%d %s u%016llx node %d cookie mismatch %016llx != %016llx\n",
355b0502
GKH		 1920 proc->pid, thread->pid,
1921 cmd == BC_INCREFS_DONE ?
1922 "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
da49889d
AH		 1923 (u64)node_ptr, node->debug_id,
1924 (u64)cookie, (u64)node->cookie);
355b0502
GKH		 1925 break;
1926 }
1927 if (cmd == BC_ACQUIRE_DONE) {
1928 if (node->pending_strong_ref == 0) {
56b468fc 1929 binder_user_error("%d:%d BC_ACQUIRE_DONE node %d has no pending acquire request\n",
355b0502
GKH		 1930 proc->pid, thread->pid,
1931 node->debug_id);
1932 break;
1933 }
1934 node->pending_strong_ref = 0;
1935 } else {
1936 if (node->pending_weak_ref == 0) {
56b468fc 1937 binder_user_error("%d:%d BC_INCREFS_DONE node %d has no pending increfs request\n",
355b0502
GKH		 1938 proc->pid, thread->pid,
1939 node->debug_id);
1940 break;
1941 }
1942 node->pending_weak_ref = 0;
1943 }
1944 binder_dec_node(node, cmd == BC_ACQUIRE_DONE, 0);
1945 binder_debug(BINDER_DEBUG_USER_REFS,
56b468fc 1946 "%d:%d %s node %d ls %d lw %d\n",
355b0502
GKH		 1947 proc->pid, thread->pid,
1948 cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
1949 node->debug_id, node->local_strong_refs, node->local_weak_refs);
1950 break;
1951 }
1952 case BC_ATTEMPT_ACQUIRE:
56b468fc 1953 pr_err("BC_ATTEMPT_ACQUIRE not supported\n");
355b0502
GKH		 1954 return -EINVAL;
1955 case BC_ACQUIRE_RESULT:
56b468fc 1956 pr_err("BC_ACQUIRE_RESULT not supported\n");
355b0502
GKH		 1957 return -EINVAL;
1958
1959 case BC_FREE_BUFFER: {
da49889d 1960 binder_uintptr_t data_ptr;
355b0502
GKH		 1961 struct binder_buffer *buffer;
1962
da49889d 1963 if (get_user(data_ptr, (binder_uintptr_t __user *)ptr))
355b0502 1964 return -EFAULT;
da49889d 1965 ptr += sizeof(binder_uintptr_t);
355b0502 1966
19c98724
TK		 1967 buffer = binder_alloc_buffer_lookup(&proc->alloc,
1968 data_ptr);
355b0502 1969 if (buffer == NULL) {
da49889d
AH		 1970 binder_user_error("%d:%d BC_FREE_BUFFER u%016llx no match\n",
1971 proc->pid, thread->pid, (u64)data_ptr);
355b0502
GKH		 1972 break;
1973 }
1974 if (!buffer->allow_user_free) {
da49889d
AH		 1975 binder_user_error("%d:%d BC_FREE_BUFFER u%016llx matched unreturned buffer\n",
1976 proc->pid, thread->pid, (u64)data_ptr);
355b0502
GKH		 1977 break;
1978 }
1979 binder_debug(BINDER_DEBUG_FREE_BUFFER,
da49889d
AH		 1980 "%d:%d BC_FREE_BUFFER u%016llx found buffer %d for %s transaction\n",
1981 proc->pid, thread->pid, (u64)data_ptr,
1982 buffer->debug_id,
355b0502
GKH		 1983 buffer->transaction ? "active" : "finished");
1984
1985 if (buffer->transaction) {
1986 buffer->transaction->buffer = NULL;
1987 buffer->transaction = NULL;
1988 }
1989 if (buffer->async_transaction && buffer->target_node) {
1990 BUG_ON(!buffer->target_node->has_async_transaction);
1991 if (list_empty(&buffer->target_node->async_todo))
1992 buffer->target_node->has_async_transaction = 0;
1993 else
1994 list_move_tail(buffer->target_node->async_todo.next, &thread->todo);
1995 }
975a1ac9 1996 trace_binder_transaction_buffer_release(buffer);
355b0502 1997 binder_transaction_buffer_release(proc, buffer, NULL);
19c98724 1998 binder_alloc_free_buf(&proc->alloc, buffer);
355b0502
GKH		 1999 break;
2000 }
2001
7980240b
MC		 2002 case BC_TRANSACTION_SG:
2003 case BC_REPLY_SG: {
2004 struct binder_transaction_data_sg tr;
2005
2006 if (copy_from_user(&tr, ptr, sizeof(tr)))
2007 return -EFAULT;
2008 ptr += sizeof(tr);
2009 binder_transaction(proc, thread, &tr.transaction_data,
2010 cmd == BC_REPLY_SG, tr.buffers_size);
2011 break;
2012 }
355b0502
GKH		 2013 case BC_TRANSACTION:
2014 case BC_REPLY: {
2015 struct binder_transaction_data tr;
2016
2017 if (copy_from_user(&tr, ptr, sizeof(tr)))
2018 return -EFAULT;
2019 ptr += sizeof(tr);
4bfac80a
MC		 2020 binder_transaction(proc, thread, &tr,
2021 cmd == BC_REPLY, 0);
355b0502
GKH		 2022 break;
2023 }
2024
2025 case BC_REGISTER_LOOPER:
2026 binder_debug(BINDER_DEBUG_THREADS,
56b468fc 2027 "%d:%d BC_REGISTER_LOOPER\n",
355b0502
GKH		 2028 proc->pid, thread->pid);
2029 if (thread->looper & BINDER_LOOPER_STATE_ENTERED) {
2030 thread->looper |= BINDER_LOOPER_STATE_INVALID;
56b468fc 2031 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER\n",
355b0502
GKH		 2032 proc->pid, thread->pid);
2033 } else if (proc->requested_threads == 0) {
2034 thread->looper |= BINDER_LOOPER_STATE_INVALID;
56b468fc 2035 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called without request\n",
355b0502
GKH		 2036 proc->pid, thread->pid);
2037 } else {
2038 proc->requested_threads--;
2039 proc->requested_threads_started++;
2040 }
2041 thread->looper |= BINDER_LOOPER_STATE_REGISTERED;
2042 break;
2043 case BC_ENTER_LOOPER:
2044 binder_debug(BINDER_DEBUG_THREADS,
56b468fc 2045 "%d:%d BC_ENTER_LOOPER\n",
355b0502
GKH		 2046 proc->pid, thread->pid);
2047 if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) {
2048 thread->looper |= BINDER_LOOPER_STATE_INVALID;
56b468fc 2049 binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n",
355b0502
GKH		 2050 proc->pid, thread->pid);
2051 }
2052 thread->looper |= BINDER_LOOPER_STATE_ENTERED;
2053 break;
2054 case BC_EXIT_LOOPER:
2055 binder_debug(BINDER_DEBUG_THREADS,
56b468fc 2056 "%d:%d BC_EXIT_LOOPER\n",
355b0502
GKH		 2057 proc->pid, thread->pid);
2058 thread->looper |= BINDER_LOOPER_STATE_EXITED;
2059 break;
2060
2061 case BC_REQUEST_DEATH_NOTIFICATION:
2062 case BC_CLEAR_DEATH_NOTIFICATION: {
2063 uint32_t target;
da49889d 2064 binder_uintptr_t cookie;
355b0502
GKH		 2065 struct binder_ref *ref;
2066 struct binder_ref_death *death;
2067
2068 if (get_user(target, (uint32_t __user *)ptr))
2069 return -EFAULT;
2070 ptr += sizeof(uint32_t);
da49889d 2071 if (get_user(cookie, (binder_uintptr_t __user *)ptr))
355b0502 2072 return -EFAULT;
da49889d 2073 ptr += sizeof(binder_uintptr_t);
0a3ffab9 2074 ref = binder_get_ref(proc, target, false);
355b0502 2075 if (ref == NULL) {
56b468fc 2076 binder_user_error("%d:%d %s invalid ref %d\n",
355b0502
GKH		 2077 proc->pid, thread->pid,
2078 cmd == BC_REQUEST_DEATH_NOTIFICATION ?
2079 "BC_REQUEST_DEATH_NOTIFICATION" :
2080 "BC_CLEAR_DEATH_NOTIFICATION",
2081 target);
2082 break;
2083 }
2084
2085 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
da49889d 2086 "%d:%d %s %016llx ref %d desc %d s %d w %d for node %d\n",
355b0502
GKH		 2087 proc->pid, thread->pid,
2088 cmd == BC_REQUEST_DEATH_NOTIFICATION ?
2089 "BC_REQUEST_DEATH_NOTIFICATION" :
2090 "BC_CLEAR_DEATH_NOTIFICATION",
da49889d 2091 (u64)cookie, ref->debug_id, ref->desc,
355b0502
GKH		 2092 ref->strong, ref->weak, ref->node->debug_id);
2093
2094 if (cmd == BC_REQUEST_DEATH_NOTIFICATION) {
2095 if (ref->death) {
56b468fc 2096 binder_user_error("%d:%d BC_REQUEST_DEATH_NOTIFICATION death notification already set\n",
355b0502
GKH		 2097 proc->pid, thread->pid);
2098 break;
2099 }
2100 death = kzalloc(sizeof(*death), GFP_KERNEL);
2101 if (death == NULL) {
2102 thread->return_error = BR_ERROR;
2103 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
56b468fc 2104 "%d:%d BC_REQUEST_DEATH_NOTIFICATION failed\n",
355b0502
GKH		 2105 proc->pid, thread->pid);
2106 break;
2107 }
2108 binder_stats_created(BINDER_STAT_DEATH);
2109 INIT_LIST_HEAD(&death->work.entry);
2110 death->cookie = cookie;
2111 ref->death = death;
2112 if (ref->node->proc == NULL) {
2113 ref->death->work.type = BINDER_WORK_DEAD_BINDER;
2114 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) {
2115 list_add_tail(&ref->death->work.entry, &thread->todo);
2116 } else {
2117 list_add_tail(&ref->death->work.entry, &proc->todo);
2118 wake_up_interruptible(&proc->wait);
2119 }
2120 }
2121 } else {
2122 if (ref->death == NULL) {
56b468fc 2123 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification not active\n",
355b0502
GKH		 2124 proc->pid, thread->pid);
2125 break;
2126 }
2127 death = ref->death;
2128 if (death->cookie != cookie) {
da49889d 2129 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch %016llx != %016llx\n",
355b0502 2130 proc->pid, thread->pid,
da49889d
AH		 2131 (u64)death->cookie,
2132 (u64)cookie);
355b0502
GKH		 2133 break;
2134 }
2135 ref->death = NULL;
2136 if (list_empty(&death->work.entry)) {
2137 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;
2138 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) {
2139 list_add_tail(&death->work.entry, &thread->todo);
2140 } else {
2141 list_add_tail(&death->work.entry, &proc->todo);
2142 wake_up_interruptible(&proc->wait);
2143 }
2144 } else {
2145 BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER);
2146 death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR;
2147 }
2148 }
2149 } break;
2150 case BC_DEAD_BINDER_DONE: {
2151 struct binder_work *w;
da49889d 2152 binder_uintptr_t cookie;
355b0502 2153 struct binder_ref_death *death = NULL;
10f62861 2154
da49889d 2155 if (get_user(cookie, (binder_uintptr_t __user *)ptr))
355b0502
GKH		 2156 return -EFAULT;
2157
7a64cd88 2158 ptr += sizeof(cookie);
355b0502
GKH		 2159 list_for_each_entry(w, &proc->delivered_death, entry) {
2160 struct binder_ref_death *tmp_death = container_of(w, struct binder_ref_death, work);
10f62861 2161
355b0502
GKH		 2162 if (tmp_death->cookie == cookie) {
2163 death = tmp_death;
2164 break;
2165 }
2166 }
2167 binder_debug(BINDER_DEBUG_DEAD_BINDER,
da49889d
AH		 2168 "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",
2169 proc->pid, thread->pid, (u64)cookie,
2170 death);
355b0502 2171 if (death == NULL) {
da49889d
AH		 2172 binder_user_error("%d:%d BC_DEAD_BINDER_DONE %016llx not found\n",
2173 proc->pid, thread->pid, (u64)cookie);
355b0502
GKH		 2174 break;
2175 }
2176
2177 list_del_init(&death->work.entry);
2178 if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) {
2179 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;
2180 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) {
2181 list_add_tail(&death->work.entry, &thread->todo);
2182 } else {
2183 list_add_tail(&death->work.entry, &proc->todo);
2184 wake_up_interruptible(&proc->wait);
2185 }
2186 }
2187 } break;
2188
2189 default:
56b468fc 2190 pr_err("%d:%d unknown command %d\n",
355b0502
GKH		 2191 proc->pid, thread->pid, cmd);
2192 return -EINVAL;
2193 }
2194 *consumed = ptr - buffer;
2195 }
2196 return 0;
2197}
2198
fb07ebc3
BP		 2199static void binder_stat_br(struct binder_proc *proc,
2200 struct binder_thread *thread, uint32_t cmd)
355b0502 2201{
975a1ac9 2202 trace_binder_return(cmd);
355b0502 2203 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) {
0953c797
BJS		 2204 atomic_inc(&binder_stats.br[_IOC_NR(cmd)]);
2205 atomic_inc(&proc->stats.br[_IOC_NR(cmd)]);
2206 atomic_inc(&thread->stats.br[_IOC_NR(cmd)]);
355b0502
GKH		 2207 }
2208}
2209
2210static int binder_has_proc_work(struct binder_proc *proc,
2211 struct binder_thread *thread)
2212{
2213 return !list_empty(&proc->todo) ||
2214 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN);
2215}
2216
2217static int binder_has_thread_work(struct binder_thread *thread)
2218{
2219 return !list_empty(&thread->todo) || thread->return_error != BR_OK ||
2220 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN);
2221}
2222
2223static int binder_thread_read(struct binder_proc *proc,
2224 struct binder_thread *thread,
da49889d
AH		 2225 binder_uintptr_t binder_buffer, size_t size,
2226 binder_size_t *consumed, int non_block)
355b0502 2227{
da49889d 2228 void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
355b0502
GKH		 2229 void __user *ptr = buffer + *consumed;
2230 void __user *end = buffer + size;
2231
2232 int ret = 0;
2233 int wait_for_proc_work;
2234
2235 if (*consumed == 0) {
2236 if (put_user(BR_NOOP, (uint32_t __user *)ptr))
2237 return -EFAULT;
2238 ptr += sizeof(uint32_t);
2239 }
2240
2241retry:
2242 wait_for_proc_work = thread->transaction_stack == NULL &&
2243 list_empty(&thread->todo);
2244
2245 if (thread->return_error != BR_OK && ptr < end) {
2246 if (thread->return_error2 != BR_OK) {
2247 if (put_user(thread->return_error2, (uint32_t __user *)ptr))
2248 return -EFAULT;
2249 ptr += sizeof(uint32_t);
89334ab4 2250 binder_stat_br(proc, thread, thread->return_error2);
355b0502
GKH		 2251 if (ptr == end)
2252 goto done;
2253 thread->return_error2 = BR_OK;
2254 }
2255 if (put_user(thread->return_error, (uint32_t __user *)ptr))
2256 return -EFAULT;
2257 ptr += sizeof(uint32_t);
89334ab4 2258 binder_stat_br(proc, thread, thread->return_error);
355b0502
GKH		 2259 thread->return_error = BR_OK;
2260 goto done;
2261 }
2262
2263
2264 thread->looper |= BINDER_LOOPER_STATE_WAITING;
2265 if (wait_for_proc_work)
2266 proc->ready_threads++;
975a1ac9
AH		 2267
2268 binder_unlock(__func__);
2269
2270 trace_binder_wait_for_work(wait_for_proc_work,
2271 !!thread->transaction_stack,
2272 !list_empty(&thread->todo));
355b0502
GKH		 2273 if (wait_for_proc_work) {
2274 if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
2275 BINDER_LOOPER_STATE_ENTERED))) {
56b468fc 2276 binder_user_error("%d:%d ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state %x)\n",
355b0502
GKH		 2277 proc->pid, thread->pid, thread->looper);
2278 wait_event_interruptible(binder_user_error_wait,
2279 binder_stop_on_user_error < 2);
2280 }
2281 binder_set_nice(proc->default_priority);
2282 if (non_block) {
2283 if (!binder_has_proc_work(proc, thread))
2284 ret = -EAGAIN;
2285 } else
e2610b26 2286 ret = wait_event_freezable_exclusive(proc->wait, binder_has_proc_work(proc, thread));
355b0502
GKH		 2287 } else {
2288 if (non_block) {
2289 if (!binder_has_thread_work(thread))
2290 ret = -EAGAIN;
2291 } else
e2610b26 2292 ret = wait_event_freezable(thread->wait, binder_has_thread_work(thread));
355b0502 2293 }
975a1ac9
AH		 2294
2295 binder_lock(__func__);
2296
355b0502
GKH		 2297 if (wait_for_proc_work)
2298 proc->ready_threads--;
2299 thread->looper &= ~BINDER_LOOPER_STATE_WAITING;
2300
2301 if (ret)
2302 return ret;
2303
2304 while (1) {
2305 uint32_t cmd;
2306 struct binder_transaction_data tr;
2307 struct binder_work *w;
2308 struct binder_transaction *t = NULL;
2309
395262a9
DV		 2310 if (!list_empty(&thread->todo)) {
2311 w = list_first_entry(&thread->todo, struct binder_work,
2312 entry);
2313 } else if (!list_empty(&proc->todo) && wait_for_proc_work) {
2314 w = list_first_entry(&proc->todo, struct binder_work,
2315 entry);
2316 } else {
2317 /* no data added */
2318 if (ptr - buffer == 4 &&
2319 !(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN))
355b0502
GKH		 2320 goto retry;
2321 break;
2322 }
2323
2324 if (end - ptr < sizeof(tr) + 4)
2325 break;
2326
2327 switch (w->type) {
2328 case BINDER_WORK_TRANSACTION: {
2329 t = container_of(w, struct binder_transaction, work);
2330 } break;
2331 case BINDER_WORK_TRANSACTION_COMPLETE: {
2332 cmd = BR_TRANSACTION_COMPLETE;
2333 if (put_user(cmd, (uint32_t __user *)ptr))
2334 return -EFAULT;
2335 ptr += sizeof(uint32_t);
2336
2337 binder_stat_br(proc, thread, cmd);
2338 binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE,
56b468fc 2339 "%d:%d BR_TRANSACTION_COMPLETE\n",
355b0502
GKH		 2340 proc->pid, thread->pid);
2341
2342 list_del(&w->entry);
2343 kfree(w);
2344 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
2345 } break;
2346 case BINDER_WORK_NODE: {
2347 struct binder_node *node = container_of(w, struct binder_node, work);
2348 uint32_t cmd = BR_NOOP;
2349 const char *cmd_name;
2350 int strong = node->internal_strong_refs || node->local_strong_refs;
2351 int weak = !hlist_empty(&node->refs) || node->local_weak_refs || strong;
10f62861 2352
355b0502
GKH		 2353 if (weak && !node->has_weak_ref) {
2354 cmd = BR_INCREFS;
2355 cmd_name = "BR_INCREFS";
2356 node->has_weak_ref = 1;
2357 node->pending_weak_ref = 1;
2358 node->local_weak_refs++;
2359 } else if (strong && !node->has_strong_ref) {
2360 cmd = BR_ACQUIRE;
2361 cmd_name = "BR_ACQUIRE";
2362 node->has_strong_ref = 1;
2363 node->pending_strong_ref = 1;
2364 node->local_strong_refs++;
2365 } else if (!strong && node->has_strong_ref) {
2366 cmd = BR_RELEASE;
2367 cmd_name = "BR_RELEASE";
2368 node->has_strong_ref = 0;
2369 } else if (!weak && node->has_weak_ref) {
2370 cmd = BR_DECREFS;
2371 cmd_name = "BR_DECREFS";
2372 node->has_weak_ref = 0;
2373 }
2374 if (cmd != BR_NOOP) {
2375 if (put_user(cmd, (uint32_t __user *)ptr))
2376 return -EFAULT;
2377 ptr += sizeof(uint32_t);
da49889d
AH		 2378 if (put_user(node->ptr,
2379 (binder_uintptr_t __user *)ptr))
355b0502 2380 return -EFAULT;
da49889d
AH		 2381 ptr += sizeof(binder_uintptr_t);
2382 if (put_user(node->cookie,
2383 (binder_uintptr_t __user *)ptr))
355b0502 2384 return -EFAULT;
da49889d 2385 ptr += sizeof(binder_uintptr_t);
355b0502
GKH		 2386
2387 binder_stat_br(proc, thread, cmd);
2388 binder_debug(BINDER_DEBUG_USER_REFS,
da49889d
AH		 2389 "%d:%d %s %d u%016llx c%016llx\n",
2390 proc->pid, thread->pid, cmd_name,
2391 node->debug_id,
2392 (u64)node->ptr, (u64)node->cookie);
355b0502
GKH		 2393 } else {
2394 list_del_init(&w->entry);
2395 if (!weak && !strong) {
2396 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
da49889d
AH		 2397 "%d:%d node %d u%016llx c%016llx deleted\n",
2398 proc->pid, thread->pid,
2399 node->debug_id,
2400 (u64)node->ptr,
2401 (u64)node->cookie);
355b0502
GKH		 2402 rb_erase(&node->rb_node, &proc->nodes);
2403 kfree(node);
2404 binder_stats_deleted(BINDER_STAT_NODE);
2405 } else {
2406 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
da49889d
AH		 2407 "%d:%d node %d u%016llx c%016llx state unchanged\n",
2408 proc->pid, thread->pid,
2409 node->debug_id,
2410 (u64)node->ptr,
2411 (u64)node->cookie);
355b0502
GKH		 2412 }
2413 }
2414 } break;
2415 case BINDER_WORK_DEAD_BINDER:
2416 case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
2417 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
2418 struct binder_ref_death *death;
2419 uint32_t cmd;
2420
2421 death = container_of(w, struct binder_ref_death, work);
2422 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION)
2423 cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE;
2424 else
2425 cmd = BR_DEAD_BINDER;
2426 if (put_user(cmd, (uint32_t __user *)ptr))
2427 return -EFAULT;
2428 ptr += sizeof(uint32_t);
da49889d
AH		 2429 if (put_user(death->cookie,
2430 (binder_uintptr_t __user *)ptr))
355b0502 2431 return -EFAULT;
da49889d 2432 ptr += sizeof(binder_uintptr_t);
89334ab4 2433 binder_stat_br(proc, thread, cmd);
355b0502 2434 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
da49889d 2435 "%d:%d %s %016llx\n",
355b0502
GKH		 2436 proc->pid, thread->pid,
2437 cmd == BR_DEAD_BINDER ?
2438 "BR_DEAD_BINDER" :
2439 "BR_CLEAR_DEATH_NOTIFICATION_DONE",
da49889d 2440 (u64)death->cookie);
355b0502
GKH		 2441
2442 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) {
2443 list_del(&w->entry);
2444 kfree(death);
2445 binder_stats_deleted(BINDER_STAT_DEATH);
2446 } else
2447 list_move(&w->entry, &proc->delivered_death);
2448 if (cmd == BR_DEAD_BINDER)
2449 goto done; /* DEAD_BINDER notifications can cause transactions */
2450 } break;
2451 }
2452
2453 if (!t)
2454 continue;
2455
2456 BUG_ON(t->buffer == NULL);
2457 if (t->buffer->target_node) {
2458 struct binder_node *target_node = t->buffer->target_node;
10f62861 2459
355b0502
GKH		 2460 tr.target.ptr = target_node->ptr;
2461 tr.cookie = target_node->cookie;
2462 t->saved_priority = task_nice(current);
2463 if (t->priority < target_node->min_priority &&
2464 !(t->flags & TF_ONE_WAY))
2465 binder_set_nice(t->priority);
2466 else if (!(t->flags & TF_ONE_WAY) ||
2467 t->saved_priority > target_node->min_priority)
2468 binder_set_nice(target_node->min_priority);
2469 cmd = BR_TRANSACTION;
2470 } else {
da49889d
AH		 2471 tr.target.ptr = 0;
2472 tr.cookie = 0;
355b0502
GKH		 2473 cmd = BR_REPLY;
2474 }
2475 tr.code = t->code;
2476 tr.flags = t->flags;
4a2ebb93 2477 tr.sender_euid = from_kuid(current_user_ns(), t->sender_euid);
355b0502
GKH		 2478
2479 if (t->from) {
2480 struct task_struct *sender = t->from->proc->tsk;
10f62861 2481
355b0502 2482 tr.sender_pid = task_tgid_nr_ns(sender,
17cf22c3 2483 task_active_pid_ns(current));
355b0502
GKH		 2484 } else {
2485 tr.sender_pid = 0;
2486 }
2487
2488 tr.data_size = t->buffer->data_size;
2489 tr.offsets_size = t->buffer->offsets_size;
19c98724
TK		 2490 tr.data.ptr.buffer = (binder_uintptr_t)
2491 ((uintptr_t)t->buffer->data +
2492 binder_alloc_get_user_buffer_offset(&proc->alloc));
355b0502
GKH		 2493 tr.data.ptr.offsets = tr.data.ptr.buffer +
2494 ALIGN(t->buffer->data_size,
2495 sizeof(void *));
2496
2497 if (put_user(cmd, (uint32_t __user *)ptr))
2498 return -EFAULT;
2499 ptr += sizeof(uint32_t);
2500 if (copy_to_user(ptr, &tr, sizeof(tr)))
2501 return -EFAULT;
2502 ptr += sizeof(tr);
2503
975a1ac9 2504 trace_binder_transaction_received(t);
355b0502
GKH		 2505 binder_stat_br(proc, thread, cmd);
2506 binder_debug(BINDER_DEBUG_TRANSACTION,
da49889d 2507 "%d:%d %s %d %d:%d, cmd %d size %zd-%zd ptr %016llx-%016llx\n",
355b0502
GKH		 2508 proc->pid, thread->pid,
2509 (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" :
2510 "BR_REPLY",
2511 t->debug_id, t->from ? t->from->proc->pid : 0,
2512 t->from ? t->from->pid : 0, cmd,
2513 t->buffer->data_size, t->buffer->offsets_size,
da49889d 2514 (u64)tr.data.ptr.buffer, (u64)tr.data.ptr.offsets);
355b0502
GKH		 2515
2516 list_del(&t->work.entry);
2517 t->buffer->allow_user_free = 1;
2518 if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) {
2519 t->to_parent = thread->transaction_stack;
2520 t->to_thread = thread;
2521 thread->transaction_stack = t;
2522 } else {
2523 t->buffer->transaction = NULL;
2524 kfree(t);
2525 binder_stats_deleted(BINDER_STAT_TRANSACTION);
2526 }
2527 break;
2528 }
2529
2530done:
2531
2532 *consumed = ptr - buffer;
2533 if (proc->requested_threads + proc->ready_threads == 0 &&
2534 proc->requested_threads_started < proc->max_threads &&
2535 (thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
2536 BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */
2537 /*spawn a new thread if we leave this out */) {
2538 proc->requested_threads++;
2539 binder_debug(BINDER_DEBUG_THREADS,
56b468fc 2540 "%d:%d BR_SPAWN_LOOPER\n",
355b0502
GKH		 2541 proc->pid, thread->pid);
2542 if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer))
2543 return -EFAULT;
89334ab4 2544 binder_stat_br(proc, thread, BR_SPAWN_LOOPER);
355b0502
GKH		 2545 }
2546 return 0;
2547}
2548
2549static void binder_release_work(struct list_head *list)
2550{
2551 struct binder_work *w;
10f62861 2552
355b0502
GKH		 2553 while (!list_empty(list)) {
2554 w = list_first_entry(list, struct binder_work, entry);
2555 list_del_init(&w->entry);
2556 switch (w->type) {
2557 case BINDER_WORK_TRANSACTION: {
2558 struct binder_transaction *t;
2559
2560 t = container_of(w, struct binder_transaction, work);
675d66b0
AH		 2561 if (t->buffer->target_node &&
2562 !(t->flags & TF_ONE_WAY)) {
355b0502 2563 binder_send_failed_reply(t, BR_DEAD_REPLY);
675d66b0
AH		 2564 } else {
2565 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
56b468fc 2566 "undelivered transaction %d\n",
675d66b0
AH		 2567 t->debug_id);
2568 t->buffer->transaction = NULL;
2569 kfree(t);
2570 binder_stats_deleted(BINDER_STAT_TRANSACTION);
2571 }
355b0502
GKH		 2572 } break;
2573 case BINDER_WORK_TRANSACTION_COMPLETE: {
675d66b0 2574 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
56b468fc 2575 "undelivered TRANSACTION_COMPLETE\n");
355b0502
GKH		 2576 kfree(w);
2577 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
2578 } break;
675d66b0
AH		 2579 case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
2580 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
2581 struct binder_ref_death *death;
2582
2583 death = container_of(w, struct binder_ref_death, work);
2584 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
da49889d
AH		 2585 "undelivered death notification, %016llx\n",
2586 (u64)death->cookie);
675d66b0
AH		 2587 kfree(death);
2588 binder_stats_deleted(BINDER_STAT_DEATH);
2589 } break;
355b0502 2590 default:
56b468fc 2591 pr_err("unexpected work type, %d, not freed\n",
675d66b0 2592 w->type);
355b0502
GKH		 2593 break;
2594 }
2595 }
2596
2597}
2598
2599static struct binder_thread *binder_get_thread(struct binder_proc *proc)
2600{
2601 struct binder_thread *thread = NULL;
2602 struct rb_node *parent = NULL;
2603 struct rb_node **p = &proc->threads.rb_node;
2604
2605 while (*p) {
2606 parent = *p;
2607 thread = rb_entry(parent, struct binder_thread, rb_node);
2608
2609 if (current->pid < thread->pid)
2610 p = &(*p)->rb_left;
2611 else if (current->pid > thread->pid)
2612 p = &(*p)->rb_right;
2613 else
2614 break;
2615 }
2616 if (*p == NULL) {
2617 thread = kzalloc(sizeof(*thread), GFP_KERNEL);
2618 if (thread == NULL)
2619 return NULL;
2620 binder_stats_created(BINDER_STAT_THREAD);
2621 thread->proc = proc;
2622 thread->pid = current->pid;
2623 init_waitqueue_head(&thread->wait);
2624 INIT_LIST_HEAD(&thread->todo);
2625 rb_link_node(&thread->rb_node, parent, p);
2626 rb_insert_color(&thread->rb_node, &proc->threads);
2627 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN;
2628 thread->return_error = BR_OK;
2629 thread->return_error2 = BR_OK;
2630 }
2631 return thread;
2632}
2633
2634static int binder_free_thread(struct binder_proc *proc,
2635 struct binder_thread *thread)
2636{
2637 struct binder_transaction *t;
2638 struct binder_transaction *send_reply = NULL;
2639 int active_transactions = 0;
2640
2641 rb_erase(&thread->rb_node, &proc->threads);
2642 t = thread->transaction_stack;
2643 if (t && t->to_thread == thread)
2644 send_reply = t;
2645 while (t) {
2646 active_transactions++;
2647 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
56b468fc
AS		 2648 "release %d:%d transaction %d %s, still active\n",
2649 proc->pid, thread->pid,
355b0502
GKH		 2650 t->debug_id,
2651 (t->to_thread == thread) ? "in" : "out");
2652
2653 if (t->to_thread == thread) {
2654 t->to_proc = NULL;
2655 t->to_thread = NULL;
2656 if (t->buffer) {
2657 t->buffer->transaction = NULL;
2658 t->buffer = NULL;
2659 }
2660 t = t->to_parent;
2661 } else if (t->from == thread) {
2662 t->from = NULL;
2663 t = t->from_parent;
2664 } else
2665 BUG();
2666 }
2667 if (send_reply)
2668 binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
2669 binder_release_work(&thread->todo);
2670 kfree(thread);
2671 binder_stats_deleted(BINDER_STAT_THREAD);
2672 return active_transactions;
2673}
2674
2675static unsigned int binder_poll(struct file *filp,
2676 struct poll_table_struct *wait)
2677{
2678 struct binder_proc *proc = filp->private_data;
2679 struct binder_thread *thread = NULL;
2680 int wait_for_proc_work;
2681
975a1ac9
AH		 2682 binder_lock(__func__);
2683
355b0502
GKH		 2684 thread = binder_get_thread(proc);
2685
2686 wait_for_proc_work = thread->transaction_stack == NULL &&
2687 list_empty(&thread->todo) && thread->return_error == BR_OK;
975a1ac9
AH		 2688
2689 binder_unlock(__func__);
355b0502
GKH		 2690
2691 if (wait_for_proc_work) {
2692 if (binder_has_proc_work(proc, thread))
2693 return POLLIN;
2694 poll_wait(filp, &proc->wait, wait);
2695 if (binder_has_proc_work(proc, thread))
2696 return POLLIN;
2697 } else {
2698 if (binder_has_thread_work(thread))
2699 return POLLIN;
2700 poll_wait(filp, &thread->wait, wait);
2701 if (binder_has_thread_work(thread))
2702 return POLLIN;
2703 }
2704 return 0;
2705}
2706
78260ac6
TR		 2707static int binder_ioctl_write_read(struct file *filp,
2708 unsigned int cmd, unsigned long arg,
2709 struct binder_thread *thread)
2710{
2711 int ret = 0;
2712 struct binder_proc *proc = filp->private_data;
2713 unsigned int size = _IOC_SIZE(cmd);
2714 void __user *ubuf = (void __user *)arg;
2715 struct binder_write_read bwr;
2716
2717 if (size != sizeof(struct binder_write_read)) {
2718 ret = -EINVAL;
2719 goto out;
2720 }
2721 if (copy_from_user(&bwr, ubuf, sizeof(bwr))) {
2722 ret = -EFAULT;
2723 goto out;
2724 }
2725 binder_debug(BINDER_DEBUG_READ_WRITE,
2726 "%d:%d write %lld at %016llx, read %lld at %016llx\n",
2727 proc->pid, thread->pid,
2728 (u64)bwr.write_size, (u64)bwr.write_buffer,
2729 (u64)bwr.read_size, (u64)bwr.read_buffer);
2730
2731 if (bwr.write_size > 0) {
2732 ret = binder_thread_write(proc, thread,
2733 bwr.write_buffer,
2734 bwr.write_size,
2735 &bwr.write_consumed);
2736 trace_binder_write_done(ret);
2737 if (ret < 0) {
2738 bwr.read_consumed = 0;
2739 if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
2740 ret = -EFAULT;
2741 goto out;
2742 }
2743 }
2744 if (bwr.read_size > 0) {
2745 ret = binder_thread_read(proc, thread, bwr.read_buffer,
2746 bwr.read_size,
2747 &bwr.read_consumed,
2748 filp->f_flags & O_NONBLOCK);
2749 trace_binder_read_done(ret);
2750 if (!list_empty(&proc->todo))
2751 wake_up_interruptible(&proc->wait);
2752 if (ret < 0) {
2753 if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
2754 ret = -EFAULT;
2755 goto out;
2756 }
2757 }
2758 binder_debug(BINDER_DEBUG_READ_WRITE,
2759 "%d:%d wrote %lld of %lld, read return %lld of %lld\n",
2760 proc->pid, thread->pid,
2761 (u64)bwr.write_consumed, (u64)bwr.write_size,
2762 (u64)bwr.read_consumed, (u64)bwr.read_size);
2763 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) {
2764 ret = -EFAULT;
2765 goto out;
2766 }
2767out:
2768 return ret;
2769}
2770
2771static int binder_ioctl_set_ctx_mgr(struct file *filp)
2772{
2773 int ret = 0;
2774 struct binder_proc *proc = filp->private_data;
342e5c90 2775 struct binder_context *context = proc->context;
c44b1231 2776 struct binder_node *new_node;
78260ac6
TR		 2777 kuid_t curr_euid = current_euid();
2778
c44b1231 2779 mutex_lock(&context->context_mgr_node_lock);
342e5c90 2780 if (context->binder_context_mgr_node) {
78260ac6
TR		 2781 pr_err("BINDER_SET_CONTEXT_MGR already set\n");
2782 ret = -EBUSY;
2783 goto out;
2784 }
79af7307
SS		 2785 ret = security_binder_set_context_mgr(proc->tsk);
2786 if (ret < 0)
2787 goto out;
342e5c90
MC		 2788 if (uid_valid(context->binder_context_mgr_uid)) {
2789 if (!uid_eq(context->binder_context_mgr_uid, curr_euid)) {
78260ac6
TR		 2790 pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n",
2791 from_kuid(&init_user_ns, curr_euid),
2792 from_kuid(&init_user_ns,
342e5c90 2793 context->binder_context_mgr_uid));
78260ac6
TR		 2794 ret = -EPERM;
2795 goto out;
2796 }
2797 } else {
342e5c90 2798 context->binder_context_mgr_uid = curr_euid;
78260ac6 2799 }
c44b1231
TK		 2800 new_node = binder_new_node(proc, 0, 0);
2801 if (!new_node) {
78260ac6
TR		 2802 ret = -ENOMEM;
2803 goto out;
2804 }
c44b1231
TK		 2805 new_node->local_weak_refs++;
2806 new_node->local_strong_refs++;
2807 new_node->has_strong_ref = 1;
2808 new_node->has_weak_ref = 1;
2809 context->binder_context_mgr_node = new_node;
78260ac6 2810out:
c44b1231 2811 mutex_unlock(&context->context_mgr_node_lock);
78260ac6
TR		 2812 return ret;
2813}
2814
355b0502
GKH		 2815static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
2816{
2817 int ret;
2818 struct binder_proc *proc = filp->private_data;
2819 struct binder_thread *thread;
2820 unsigned int size = _IOC_SIZE(cmd);
2821 void __user *ubuf = (void __user *)arg;
2822
78260ac6
TR		 2823 /*pr_info("binder_ioctl: %d:%d %x %lx\n",
2824 proc->pid, current->pid, cmd, arg);*/
355b0502 2825
975a1ac9
AH		 2826 trace_binder_ioctl(cmd, arg);
2827
355b0502
GKH		 2828 ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
2829 if (ret)
975a1ac9 2830 goto err_unlocked;
355b0502 2831
975a1ac9 2832 binder_lock(__func__);
355b0502
GKH		 2833 thread = binder_get_thread(proc);
2834 if (thread == NULL) {
2835 ret = -ENOMEM;
2836 goto err;
2837 }
2838
2839 switch (cmd) {
78260ac6
TR		 2840 case BINDER_WRITE_READ:
2841 ret = binder_ioctl_write_read(filp, cmd, arg, thread);
2842 if (ret)
355b0502 2843 goto err;
355b0502 2844 break;
355b0502
GKH		 2845 case BINDER_SET_MAX_THREADS:
2846 if (copy_from_user(&proc->max_threads, ubuf, sizeof(proc->max_threads))) {
2847 ret = -EINVAL;
2848 goto err;
2849 }
2850 break;
2851 case BINDER_SET_CONTEXT_MGR:
78260ac6
TR		 2852 ret = binder_ioctl_set_ctx_mgr(filp);
2853 if (ret)
355b0502 2854 goto err;
355b0502
GKH		 2855 break;
2856 case BINDER_THREAD_EXIT:
56b468fc 2857 binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n",
355b0502
GKH		 2858 proc->pid, thread->pid);
2859 binder_free_thread(proc, thread);
2860 thread = NULL;
2861 break;
36c89c0a
MM		 2862 case BINDER_VERSION: {
2863 struct binder_version __user *ver = ubuf;
2864
355b0502
GKH		 2865 if (size != sizeof(struct binder_version)) {
2866 ret = -EINVAL;
2867 goto err;
2868 }
36c89c0a
MM		 2869 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION,
2870 &ver->protocol_version)) {
355b0502
GKH		 2871 ret = -EINVAL;
2872 goto err;
2873 }
2874 break;
36c89c0a 2875 }
355b0502
GKH		 2876 default:
2877 ret = -EINVAL;
2878 goto err;
2879 }
2880 ret = 0;
2881err:
2882 if (thread)
2883 thread->looper &= ~BINDER_LOOPER_STATE_NEED_RETURN;
975a1ac9 2884 binder_unlock(__func__);
355b0502
GKH		 2885 wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
2886 if (ret && ret != -ERESTARTSYS)
56b468fc 2887 pr_info("%d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret);
975a1ac9
AH		 2888err_unlocked:
2889 trace_binder_ioctl_done(ret);
355b0502
GKH		 2890 return ret;
2891}
2892
2893static void binder_vma_open(struct vm_area_struct *vma)
2894{
2895 struct binder_proc *proc = vma->vm_private_data;
10f62861 2896
355b0502 2897 binder_debug(BINDER_DEBUG_OPEN_CLOSE,
56b468fc 2898 "%d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
355b0502
GKH		 2899 proc->pid, vma->vm_start, vma->vm_end,
2900 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
2901 (unsigned long)pgprot_val(vma->vm_page_prot));
355b0502
GKH		 2902}
2903
2904static void binder_vma_close(struct vm_area_struct *vma)
2905{
2906 struct binder_proc *proc = vma->vm_private_data;
10f62861 2907
355b0502 2908 binder_debug(BINDER_DEBUG_OPEN_CLOSE,
56b468fc 2909 "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
355b0502
GKH		 2910 proc->pid, vma->vm_start, vma->vm_end,
2911 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
2912 (unsigned long)pgprot_val(vma->vm_page_prot));
19c98724 2913 binder_alloc_vma_close(&proc->alloc);
355b0502
GKH		 2914 binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
2915}
2916
11bac800 2917static int binder_vm_fault(struct vm_fault *vmf)
ddac7d5f
VM		 2918{
2919 return VM_FAULT_SIGBUS;
2920}
2921
7cbea8dc 2922static const struct vm_operations_struct binder_vm_ops = {
355b0502
GKH		 2923 .open = binder_vma_open,
2924 .close = binder_vma_close,
ddac7d5f 2925 .fault = binder_vm_fault,
355b0502
GKH		 2926};
2927
19c98724
TK		 2928static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
2929{
2930 int ret;
2931 struct binder_proc *proc = filp->private_data;
2932 const char *failure_string;
2933
2934 if (proc->tsk != current->group_leader)
2935 return -EINVAL;
2936
2937 if ((vma->vm_end - vma->vm_start) > SZ_4M)
2938 vma->vm_end = vma->vm_start + SZ_4M;
2939
2940 binder_debug(BINDER_DEBUG_OPEN_CLOSE,
2941 "%s: %d %lx-%lx (%ld K) vma %lx pagep %lx\n",
2942 __func__, proc->pid, vma->vm_start, vma->vm_end,
2943 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
2944 (unsigned long)pgprot_val(vma->vm_page_prot));
2945
2946 if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) {
2947 ret = -EPERM;
2948 failure_string = "bad vm_flags";
2949 goto err_bad_arg;
2950 }
2951 vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE;
2952 vma->vm_ops = &binder_vm_ops;
2953 vma->vm_private_data = proc;
2954
2955 ret = binder_alloc_mmap_handler(&proc->alloc, vma);
2956 if (ret)
2957 return ret;
2958 proc->files = get_files_struct(current);
2959 return 0;
2960
355b0502 2961err_bad_arg:
258767fe 2962 pr_err("binder_mmap: %d %lx-%lx %s failed %d\n",
355b0502
GKH		 2963 proc->pid, vma->vm_start, vma->vm_end, failure_string, ret);
2964 return ret;
2965}
2966
2967static int binder_open(struct inode *nodp, struct file *filp)
2968{
2969 struct binder_proc *proc;
ac4812c5 2970 struct binder_device *binder_dev;
355b0502
GKH		 2971
2972 binder_debug(BINDER_DEBUG_OPEN_CLOSE, "binder_open: %d:%d\n",
2973 current->group_leader->pid, current->pid);
2974
2975 proc = kzalloc(sizeof(*proc), GFP_KERNEL);
2976 if (proc == NULL)
2977 return -ENOMEM;
c4ea41ba
TK		 2978 get_task_struct(current->group_leader);
2979 proc->tsk = current->group_leader;
355b0502
GKH		 2980 INIT_LIST_HEAD(&proc->todo);
2981 init_waitqueue_head(&proc->wait);
2982 proc->default_priority = task_nice(current);
ac4812c5
MC		 2983 binder_dev = container_of(filp->private_data, struct binder_device,
2984 miscdev);
2985 proc->context = &binder_dev->context;
19c98724 2986 binder_alloc_init(&proc->alloc);
975a1ac9
AH		 2987
2988 binder_lock(__func__);
2989
355b0502 2990 binder_stats_created(BINDER_STAT_PROC);
355b0502
GKH		 2991 proc->pid = current->group_leader->pid;
2992 INIT_LIST_HEAD(&proc->delivered_death);
2993 filp->private_data = proc;
975a1ac9
AH		 2994
2995 binder_unlock(__func__);
355b0502 2996
c44b1231
TK		 2997 mutex_lock(&binder_procs_lock);
2998 hlist_add_head(&proc->proc_node, &binder_procs);
2999 mutex_unlock(&binder_procs_lock);
3000
16b66554 3001 if (binder_debugfs_dir_entry_proc) {
355b0502 3002 char strbuf[11];
10f62861 3003
355b0502 3004 snprintf(strbuf, sizeof(strbuf), "%u", proc->pid);
14db3181
MC		 3005 /*
3006 * proc debug entries are shared between contexts, so
3007 * this will fail if the process tries to open the driver
3008 * again with a different context. The priting code will
3009 * anyway print all contexts that a given PID has, so this
3010 * is not a problem.
3011 */
16b66554 3012 proc->debugfs_entry = debugfs_create_file(strbuf, S_IRUGO,
14db3181
MC		 3013 binder_debugfs_dir_entry_proc,
3014 (void *)(unsigned long)proc->pid,
3015 &binder_proc_fops);
355b0502
GKH		 3016 }
3017
3018 return 0;
3019}
3020
3021static int binder_flush(struct file *filp, fl_owner_t id)
3022{
3023 struct binder_proc *proc = filp->private_data;
3024
3025 binder_defer_work(proc, BINDER_DEFERRED_FLUSH);
3026
3027 return 0;
3028}
3029
3030static void binder_deferred_flush(struct binder_proc *proc)
3031{
3032 struct rb_node *n;
3033 int wake_count = 0;
10f62861 3034
355b0502
GKH		 3035 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) {
3036 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node);
10f62861 3037
355b0502
GKH		 3038 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN;
3039 if (thread->looper & BINDER_LOOPER_STATE_WAITING) {
3040 wake_up_interruptible(&thread->wait);
3041 wake_count++;
3042 }
3043 }
3044 wake_up_interruptible_all(&proc->wait);
3045
3046 binder_debug(BINDER_DEBUG_OPEN_CLOSE,
3047 "binder_flush: %d woke %d threads\n", proc->pid,
3048 wake_count);
3049}
3050
3051static int binder_release(struct inode *nodp, struct file *filp)
3052{
3053 struct binder_proc *proc = filp->private_data;
10f62861 3054
16b66554 3055 debugfs_remove(proc->debugfs_entry);
355b0502
GKH		 3056 binder_defer_work(proc, BINDER_DEFERRED_RELEASE);
3057
3058 return 0;
3059}
3060
008fa749
ME		 3061static int binder_node_release(struct binder_node *node, int refs)
3062{
3063 struct binder_ref *ref;
3064 int death = 0;
3065
3066 list_del_init(&node->work.entry);
3067 binder_release_work(&node->async_todo);
3068
3069 if (hlist_empty(&node->refs)) {
3070 kfree(node);
3071 binder_stats_deleted(BINDER_STAT_NODE);
3072
3073 return refs;
3074 }
3075
3076 node->proc = NULL;
3077 node->local_strong_refs = 0;
3078 node->local_weak_refs = 0;
c44b1231
TK		 3079
3080 spin_lock(&binder_dead_nodes_lock);
008fa749 3081 hlist_add_head(&node->dead_node, &binder_dead_nodes);
c44b1231 3082 spin_unlock(&binder_dead_nodes_lock);
008fa749
ME		 3083
3084 hlist_for_each_entry(ref, &node->refs, node_entry) {
3085 refs++;
3086
3087 if (!ref->death)
e194fd8a 3088 continue;
008fa749
ME		 3089
3090 death++;
3091
3092 if (list_empty(&ref->death->work.entry)) {
3093 ref->death->work.type = BINDER_WORK_DEAD_BINDER;
3094 list_add_tail(&ref->death->work.entry,
3095 &ref->proc->todo);
3096 wake_up_interruptible(&ref->proc->wait);
3097 } else
3098 BUG();
3099 }
3100
008fa749
ME		 3101 binder_debug(BINDER_DEBUG_DEAD_BINDER,
3102 "node %d now dead, refs %d, death %d\n",
3103 node->debug_id, refs, death);
3104
3105 return refs;
3106}
3107
355b0502
GKH		 3108static void binder_deferred_release(struct binder_proc *proc)
3109{
342e5c90 3110 struct binder_context *context = proc->context;
355b0502 3111 struct rb_node *n;
19c98724 3112 int threads, nodes, incoming_refs, outgoing_refs, active_transactions;
355b0502 3113
355b0502
GKH		 3114 BUG_ON(proc->files);
3115
c44b1231 3116 mutex_lock(&binder_procs_lock);
355b0502 3117 hlist_del(&proc->proc_node);
c44b1231 3118 mutex_unlock(&binder_procs_lock);
53413e7d 3119
c44b1231 3120 mutex_lock(&context->context_mgr_node_lock);
342e5c90
MC		 3121 if (context->binder_context_mgr_node &&
3122 context->binder_context_mgr_node->proc == proc) {
355b0502 3123 binder_debug(BINDER_DEBUG_DEAD_BINDER,
c07c933f
ME		 3124 "%s: %d context_mgr_node gone\n",
3125 __func__, proc->pid);
342e5c90 3126 context->binder_context_mgr_node = NULL;
355b0502 3127 }
c44b1231 3128 mutex_unlock(&context->context_mgr_node_lock);
355b0502
GKH		 3129
3130 threads = 0;
3131 active_transactions = 0;
3132 while ((n = rb_first(&proc->threads))) {
53413e7d
ME		 3133 struct binder_thread *thread;
3134
3135 thread = rb_entry(n, struct binder_thread, rb_node);
355b0502
GKH		 3136 threads++;
3137 active_transactions += binder_free_thread(proc, thread);
3138 }
53413e7d 3139
355b0502
GKH		 3140 nodes = 0;
3141 incoming_refs = 0;
3142 while ((n = rb_first(&proc->nodes))) {
53413e7d 3143 struct binder_node *node;
355b0502 3144
53413e7d 3145 node = rb_entry(n, struct binder_node, rb_node);
355b0502
GKH		 3146 nodes++;
3147 rb_erase(&node->rb_node, &proc->nodes);
008fa749 3148 incoming_refs = binder_node_release(node, incoming_refs);
355b0502 3149 }
53413e7d 3150
355b0502
GKH		 3151 outgoing_refs = 0;
3152 while ((n = rb_first(&proc->refs_by_desc))) {
53413e7d
ME		 3153 struct binder_ref *ref;
3154
3155 ref = rb_entry(n, struct binder_ref, rb_node_desc);
355b0502
GKH		 3156 outgoing_refs++;
3157 binder_delete_ref(ref);
3158 }
53413e7d 3159
355b0502 3160 binder_release_work(&proc->todo);
675d66b0 3161 binder_release_work(&proc->delivered_death);
355b0502 3162
19c98724 3163 binder_alloc_deferred_release(&proc->alloc);
355b0502
GKH		 3164 binder_stats_deleted(BINDER_STAT_PROC);
3165
355b0502
GKH		 3166 put_task_struct(proc->tsk);
3167
3168 binder_debug(BINDER_DEBUG_OPEN_CLOSE,
19c98724 3169 "%s: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d\n",
c07c933f 3170 __func__, proc->pid, threads, nodes, incoming_refs,
19c98724 3171 outgoing_refs, active_transactions);
355b0502
GKH		 3172
3173 kfree(proc);
3174}
3175
3176static void binder_deferred_func(struct work_struct *work)
3177{
3178 struct binder_proc *proc;
3179 struct files_struct *files;
3180
3181 int defer;
10f62861 3182
355b0502 3183 do {
975a1ac9 3184 binder_lock(__func__);
355b0502
GKH		 3185 mutex_lock(&binder_deferred_lock);
3186 if (!hlist_empty(&binder_deferred_list)) {
3187 proc = hlist_entry(binder_deferred_list.first,
3188 struct binder_proc, deferred_work_node);
3189 hlist_del_init(&proc->deferred_work_node);
3190 defer = proc->deferred_work;
3191 proc->deferred_work = 0;
3192 } else {
3193 proc = NULL;
3194 defer = 0;
3195 }
3196 mutex_unlock(&binder_deferred_lock);
3197
3198 files = NULL;
3199 if (defer & BINDER_DEFERRED_PUT_FILES) {
3200 files = proc->files;
3201 if (files)
3202 proc->files = NULL;
3203 }
3204
3205 if (defer & BINDER_DEFERRED_FLUSH)
3206 binder_deferred_flush(proc);
3207
3208 if (defer & BINDER_DEFERRED_RELEASE)
3209 binder_deferred_release(proc); /* frees proc */
3210
975a1ac9 3211 binder_unlock(__func__);
355b0502
GKH		 3212 if (files)
3213 put_files_struct(files);
3214 } while (proc);
3215}
3216static DECLARE_WORK(binder_deferred_work, binder_deferred_func);
3217
3218static void
3219binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer)
3220{
3221 mutex_lock(&binder_deferred_lock);
3222 proc->deferred_work |= defer;
3223 if (hlist_unhashed(&proc->deferred_work_node)) {
3224 hlist_add_head(&proc->deferred_work_node,
3225 &binder_deferred_list);
1beba52d 3226 schedule_work(&binder_deferred_work);
355b0502
GKH		 3227 }
3228 mutex_unlock(&binder_deferred_lock);
3229}
3230
5249f488
AH		 3231static void print_binder_transaction(struct seq_file *m, const char *prefix,
3232 struct binder_transaction *t)
3233{
3234 seq_printf(m,
3235 "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d",
3236 prefix, t->debug_id, t,
3237 t->from ? t->from->proc->pid : 0,
3238 t->from ? t->from->pid : 0,
3239 t->to_proc ? t->to_proc->pid : 0,
3240 t->to_thread ? t->to_thread->pid : 0,
3241 t->code, t->flags, t->priority, t->need_reply);
355b0502 3242 if (t->buffer == NULL) {
5249f488
AH		 3243 seq_puts(m, " buffer free\n");
3244 return;
355b0502 3245 }
5249f488
AH		 3246 if (t->buffer->target_node)
3247 seq_printf(m, " node %d",
3248 t->buffer->target_node->debug_id);
3249 seq_printf(m, " size %zd:%zd data %p\n",
3250 t->buffer->data_size, t->buffer->offsets_size,
3251 t->buffer->data);
355b0502
GKH		 3252}
3253
5249f488
AH		 3254static void print_binder_work(struct seq_file *m, const char *prefix,
3255 const char *transaction_prefix,
3256 struct binder_work *w)
355b0502
GKH		 3257{
3258 struct binder_node *node;
3259 struct binder_transaction *t;
3260
3261 switch (w->type) {
3262 case BINDER_WORK_TRANSACTION:
3263 t = container_of(w, struct binder_transaction, work);
5249f488 3264 print_binder_transaction(m, transaction_prefix, t);
355b0502
GKH		 3265 break;
3266 case BINDER_WORK_TRANSACTION_COMPLETE:
5249f488 3267 seq_printf(m, "%stransaction complete\n", prefix);
355b0502
GKH		 3268 break;
3269 case BINDER_WORK_NODE:
3270 node = container_of(w, struct binder_node, work);
da49889d
AH		 3271 seq_printf(m, "%snode work %d: u%016llx c%016llx\n",
3272 prefix, node->debug_id,
3273 (u64)node->ptr, (u64)node->cookie);
355b0502
GKH		 3274 break;
3275 case BINDER_WORK_DEAD_BINDER:
5249f488 3276 seq_printf(m, "%shas dead binder\n", prefix);
355b0502
GKH		 3277 break;
3278 case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
5249f488 3279 seq_printf(m, "%shas cleared dead binder\n", prefix);
355b0502
GKH		 3280 break;
3281 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION:
5249f488 3282 seq_printf(m, "%shas cleared death notification\n", prefix);
355b0502
GKH		 3283 break;
3284 default:
5249f488 3285 seq_printf(m, "%sunknown work: type %d\n", prefix, w->type);
355b0502
GKH		 3286 break;
3287 }
355b0502
GKH		 3288}
3289
5249f488
AH		 3290static void print_binder_thread(struct seq_file *m,
3291 struct binder_thread *thread,
3292 int print_always)
355b0502
GKH		 3293{
3294 struct binder_transaction *t;
3295 struct binder_work *w;
5249f488
AH		 3296 size_t start_pos = m->count;
3297 size_t header_pos;
355b0502 3298
5249f488
AH		 3299 seq_printf(m, " thread %d: l %02x\n", thread->pid, thread->looper);
3300 header_pos = m->count;
355b0502
GKH		 3301 t = thread->transaction_stack;
3302 while (t) {
355b0502 3303 if (t->from == thread) {
5249f488
AH		 3304 print_binder_transaction(m,
3305 " outgoing transaction", t);
355b0502
GKH		 3306 t = t->from_parent;
3307 } else if (t->to_thread == thread) {
5249f488
AH		 3308 print_binder_transaction(m,
3309 " incoming transaction", t);
355b0502
GKH		 3310 t = t->to_parent;
3311 } else {
5249f488 3312 print_binder_transaction(m, " bad transaction", t);
355b0502
GKH		 3313 t = NULL;
3314 }
3315 }
3316 list_for_each_entry(w, &thread->todo, entry) {
5249f488 3317 print_binder_work(m, " ", " pending transaction", w);
355b0502 3318 }
5249f488
AH		 3319 if (!print_always && m->count == header_pos)
3320 m->count = start_pos;
355b0502
GKH		 3321}
3322
5249f488 3323static void print_binder_node(struct seq_file *m, struct binder_node *node)
355b0502
GKH		 3324{
3325 struct binder_ref *ref;
355b0502
GKH		 3326 struct binder_work *w;
3327 int count;
3328
3329 count = 0;
b67bfe0d 3330 hlist_for_each_entry(ref, &node->refs, node_entry)
355b0502
GKH		 3331 count++;
3332
da49889d
AH		 3333 seq_printf(m, " node %d: u%016llx c%016llx hs %d hw %d ls %d lw %d is %d iw %d",
3334 node->debug_id, (u64)node->ptr, (u64)node->cookie,
5249f488
AH		 3335 node->has_strong_ref, node->has_weak_ref,
3336 node->local_strong_refs, node->local_weak_refs,
3337 node->internal_strong_refs, count);
355b0502 3338 if (count) {
5249f488 3339 seq_puts(m, " proc");
b67bfe0d 3340 hlist_for_each_entry(ref, &node->refs, node_entry)
5249f488 3341 seq_printf(m, " %d", ref->proc->pid);
355b0502 3342 }
5249f488
AH		 3343 seq_puts(m, "\n");
3344 list_for_each_entry(w, &node->async_todo, entry)
3345 print_binder_work(m, " ",
3346 " pending async transaction", w);
355b0502
GKH		 3347}
3348
5249f488 3349static void print_binder_ref(struct seq_file *m, struct binder_ref *ref)
355b0502 3350{
5249f488
AH		 3351 seq_printf(m, " ref %d: desc %d %snode %d s %d w %d d %p\n",
3352 ref->debug_id, ref->desc, ref->node->proc ? "" : "dead ",
3353 ref->node->debug_id, ref->strong, ref->weak, ref->death);
355b0502
GKH		 3354}
3355
5249f488
AH		 3356static void print_binder_proc(struct seq_file *m,
3357 struct binder_proc *proc, int print_all)
355b0502
GKH		 3358{
3359 struct binder_work *w;
3360 struct rb_node *n;
5249f488
AH		 3361 size_t start_pos = m->count;
3362 size_t header_pos;
3363
3364 seq_printf(m, "proc %d\n", proc->pid);
14db3181 3365 seq_printf(m, "context %s\n", proc->context->name);
5249f488
AH		 3366 header_pos = m->count;
3367
3368 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n))
3369 print_binder_thread(m, rb_entry(n, struct binder_thread,
3370 rb_node), print_all);
3371 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) {
355b0502
GKH		 3372 struct binder_node *node = rb_entry(n, struct binder_node,
3373 rb_node);
3374 if (print_all || node->has_async_transaction)
5249f488 3375 print_binder_node(m, node);
355b0502
GKH		 3376 }
3377 if (print_all) {
3378 for (n = rb_first(&proc->refs_by_desc);
5249f488 3379 n != NULL;
355b0502 3380 n = rb_next(n))
5249f488
AH		 3381 print_binder_ref(m, rb_entry(n, struct binder_ref,
3382 rb_node_desc));
355b0502 3383 }
19c98724 3384 binder_alloc_print_allocated(m, &proc->alloc);
5249f488
AH		 3385 list_for_each_entry(w, &proc->todo, entry)
3386 print_binder_work(m, " ", " pending transaction", w);
355b0502 3387 list_for_each_entry(w, &proc->delivered_death, entry) {
5249f488 3388 seq_puts(m, " has delivered dead binder\n");
355b0502
GKH		 3389 break;
3390 }
5249f488
AH		 3391 if (!print_all && m->count == header_pos)
3392 m->count = start_pos;
355b0502
GKH		 3393}
3394
167bccbd 3395static const char * const binder_return_strings[] = {
355b0502
GKH		 3396 "BR_ERROR",
3397 "BR_OK",
3398 "BR_TRANSACTION",
3399 "BR_REPLY",
3400 "BR_ACQUIRE_RESULT",
3401 "BR_DEAD_REPLY",
3402 "BR_TRANSACTION_COMPLETE",
3403 "BR_INCREFS",
3404 "BR_ACQUIRE",
3405 "BR_RELEASE",
3406 "BR_DECREFS",
3407 "BR_ATTEMPT_ACQUIRE",
3408 "BR_NOOP",
3409 "BR_SPAWN_LOOPER",
3410 "BR_FINISHED",
3411 "BR_DEAD_BINDER",
3412 "BR_CLEAR_DEATH_NOTIFICATION_DONE",
3413 "BR_FAILED_REPLY"
3414};
3415
167bccbd 3416static const char * const binder_command_strings[] = {
355b0502
GKH		 3417 "BC_TRANSACTION",
3418 "BC_REPLY",
3419 "BC_ACQUIRE_RESULT",
3420 "BC_FREE_BUFFER",
3421 "BC_INCREFS",
3422 "BC_ACQUIRE",
3423 "BC_RELEASE",
3424 "BC_DECREFS",
3425 "BC_INCREFS_DONE",
3426 "BC_ACQUIRE_DONE",
3427 "BC_ATTEMPT_ACQUIRE",
3428 "BC_REGISTER_LOOPER",
3429 "BC_ENTER_LOOPER",
3430 "BC_EXIT_LOOPER",
3431 "BC_REQUEST_DEATH_NOTIFICATION",
3432 "BC_CLEAR_DEATH_NOTIFICATION",
7980240b
MC		 3433 "BC_DEAD_BINDER_DONE",
3434 "BC_TRANSACTION_SG",
3435 "BC_REPLY_SG",
355b0502
GKH		 3436};
3437
167bccbd 3438static const char * const binder_objstat_strings[] = {
355b0502
GKH		 3439 "proc",
3440 "thread",
3441 "node",
3442 "ref",
3443 "death",
3444 "transaction",
3445 "transaction_complete"
3446};
3447
5249f488
AH		 3448static void print_binder_stats(struct seq_file *m, const char *prefix,
3449 struct binder_stats *stats)
355b0502
GKH		 3450{
3451 int i;
3452
3453 BUILD_BUG_ON(ARRAY_SIZE(stats->bc) !=
5249f488 3454 ARRAY_SIZE(binder_command_strings));
355b0502 3455 for (i = 0; i < ARRAY_SIZE(stats->bc); i++) {
0953c797
BJS		 3456 int temp = atomic_read(&stats->bc[i]);
3457
3458 if (temp)
5249f488 3459 seq_printf(m, "%s%s: %d\n", prefix,
0953c797 3460 binder_command_strings[i], temp);
355b0502
GKH		 3461 }
3462
3463 BUILD_BUG_ON(ARRAY_SIZE(stats->br) !=
5249f488 3464 ARRAY_SIZE(binder_return_strings));
355b0502 3465 for (i = 0; i < ARRAY_SIZE(stats->br); i++) {
0953c797
BJS		 3466 int temp = atomic_read(&stats->br[i]);
3467
3468 if (temp)
5249f488 3469 seq_printf(m, "%s%s: %d\n", prefix,
0953c797 3470 binder_return_strings[i], temp);
355b0502
GKH		 3471 }
3472
3473 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) !=
5249f488 3474 ARRAY_SIZE(binder_objstat_strings));
355b0502 3475 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) !=
5249f488 3476 ARRAY_SIZE(stats->obj_deleted));
355b0502 3477 for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) {
0953c797
BJS		 3478 int created = atomic_read(&stats->obj_created[i]);
3479 int deleted = atomic_read(&stats->obj_deleted[i]);
3480
3481 if (created || deleted)
3482 seq_printf(m, "%s%s: active %d total %d\n",
3483 prefix,
5249f488 3484 binder_objstat_strings[i],
0953c797
BJS		 3485 created - deleted,
3486 created);
355b0502 3487 }
355b0502
GKH		 3488}
3489
5249f488
AH		 3490static void print_binder_proc_stats(struct seq_file *m,
3491 struct binder_proc *proc)
355b0502
GKH		 3492{
3493 struct binder_work *w;
3494 struct rb_node *n;
3495 int count, strong, weak;
3496
5249f488 3497 seq_printf(m, "proc %d\n", proc->pid);
14db3181 3498 seq_printf(m, "context %s\n", proc->context->name);
355b0502
GKH		 3499 count = 0;
3500 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n))
3501 count++;
5249f488
AH		 3502 seq_printf(m, " threads: %d\n", count);
3503 seq_printf(m, " requested threads: %d+%d/%d\n"
355b0502
GKH		 3504 " ready threads %d\n"
3505 " free async space %zd\n", proc->requested_threads,
3506 proc->requested_threads_started, proc->max_threads,
19c98724
TK		 3507 proc->ready_threads,
3508 binder_alloc_get_free_async_space(&proc->alloc));
355b0502
GKH		 3509 count = 0;
3510 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n))
3511 count++;
5249f488 3512 seq_printf(m, " nodes: %d\n", count);
355b0502
GKH		 3513 count = 0;
3514 strong = 0;
3515 weak = 0;
3516 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) {
3517 struct binder_ref *ref = rb_entry(n, struct binder_ref,
3518 rb_node_desc);
3519 count++;
3520 strong += ref->strong;
3521 weak += ref->weak;
3522 }
5249f488 3523 seq_printf(m, " refs: %d s %d w %d\n", count, strong, weak);
355b0502 3524
19c98724 3525 count = binder_alloc_get_allocated_count(&proc->alloc);
5249f488 3526 seq_printf(m, " buffers: %d\n", count);
355b0502
GKH		 3527
3528 count = 0;
3529 list_for_each_entry(w, &proc->todo, entry) {
3530 switch (w->type) {
3531 case BINDER_WORK_TRANSACTION:
3532 count++;
3533 break;
3534 default:
3535 break;
3536 }
3537 }
5249f488 3538 seq_printf(m, " pending transactions: %d\n", count);
355b0502 3539
5249f488 3540 print_binder_stats(m, " ", &proc->stats);
355b0502
GKH		 3541}
3542
3543
5249f488 3544static int binder_state_show(struct seq_file *m, void *unused)
355b0502
GKH		 3545{
3546 struct binder_proc *proc;
355b0502 3547 struct binder_node *node;
355b0502 3548
1cf29cf4 3549 binder_lock(__func__);
355b0502 3550
5249f488 3551 seq_puts(m, "binder state:\n");
355b0502 3552
c44b1231 3553 spin_lock(&binder_dead_nodes_lock);
355b0502 3554 if (!hlist_empty(&binder_dead_nodes))
5249f488 3555 seq_puts(m, "dead nodes:\n");
b67bfe0d 3556 hlist_for_each_entry(node, &binder_dead_nodes, dead_node)
5249f488 3557 print_binder_node(m, node);
c44b1231 3558 spin_unlock(&binder_dead_nodes_lock);
355b0502 3559
c44b1231 3560 mutex_lock(&binder_procs_lock);
b67bfe0d 3561 hlist_for_each_entry(proc, &binder_procs, proc_node)
5249f488 3562 print_binder_proc(m, proc, 1);
c44b1231 3563 mutex_unlock(&binder_procs_lock);
1cf29cf4 3564 binder_unlock(__func__);
5249f488 3565 return 0;
355b0502
GKH		 3566}
3567
5249f488 3568static int binder_stats_show(struct seq_file *m, void *unused)
355b0502
GKH		 3569{
3570 struct binder_proc *proc;
355b0502 3571
1cf29cf4 3572 binder_lock(__func__);
355b0502 3573
5249f488 3574 seq_puts(m, "binder stats:\n");
355b0502 3575
5249f488 3576 print_binder_stats(m, "", &binder_stats);
355b0502 3577
c44b1231 3578 mutex_lock(&binder_procs_lock);
b67bfe0d 3579 hlist_for_each_entry(proc, &binder_procs, proc_node)
5249f488 3580 print_binder_proc_stats(m, proc);
c44b1231 3581 mutex_unlock(&binder_procs_lock);
1cf29cf4 3582 binder_unlock(__func__);
5249f488 3583 return 0;
355b0502
GKH		 3584}
3585
5249f488 3586static int binder_transactions_show(struct seq_file *m, void *unused)
355b0502
GKH		 3587{
3588 struct binder_proc *proc;
355b0502 3589
1cf29cf4 3590 binder_lock(__func__);
355b0502 3591
5249f488 3592 seq_puts(m, "binder transactions:\n");
c44b1231 3593 mutex_lock(&binder_procs_lock);
b67bfe0d 3594 hlist_for_each_entry(proc, &binder_procs, proc_node)
5249f488 3595 print_binder_proc(m, proc, 0);
c44b1231 3596 mutex_unlock(&binder_procs_lock);
1cf29cf4 3597 binder_unlock(__func__);
5249f488 3598 return 0;
355b0502
GKH		 3599}
3600
5249f488 3601static int binder_proc_show(struct seq_file *m, void *unused)
355b0502 3602{
83050a4e 3603 struct binder_proc *itr;
14db3181 3604 int pid = (unsigned long)m->private;
355b0502 3605
1cf29cf4 3606 binder_lock(__func__);
83050a4e 3607
c44b1231 3608 mutex_lock(&binder_procs_lock);
83050a4e 3609 hlist_for_each_entry(itr, &binder_procs, proc_node) {
14db3181
MC		 3610 if (itr->pid == pid) {
3611 seq_puts(m, "binder proc state:\n");
3612 print_binder_proc(m, itr, 1);
83050a4e
RA		 3613 }
3614 }
c44b1231
TK		 3615 mutex_unlock(&binder_procs_lock);
3616
1cf29cf4 3617 binder_unlock(__func__);
5249f488 3618 return 0;
355b0502
GKH		 3619}
3620
5249f488 3621static void print_binder_transaction_log_entry(struct seq_file *m,
355b0502
GKH		 3622 struct binder_transaction_log_entry *e)
3623{
5249f488 3624 seq_printf(m,
14db3181 3625 "%d: %s from %d:%d to %d:%d context %s node %d handle %d size %d:%d\n",
5249f488
AH		 3626 e->debug_id, (e->call_type == 2) ? "reply" :
3627 ((e->call_type == 1) ? "async" : "call "), e->from_proc,
14db3181
MC		 3628 e->from_thread, e->to_proc, e->to_thread, e->context_name,
3629 e->to_node, e->target_handle, e->data_size, e->offsets_size);
355b0502
GKH		 3630}
3631
5249f488 3632static int binder_transaction_log_show(struct seq_file *m, void *unused)
355b0502 3633{
5249f488 3634 struct binder_transaction_log *log = m->private;
355b0502 3635 int i;
355b0502
GKH		 3636
3637 if (log->full) {
5249f488
AH		 3638 for (i = log->next; i < ARRAY_SIZE(log->entry); i++)
3639 print_binder_transaction_log_entry(m, &log->entry[i]);
355b0502 3640 }
5249f488
AH		 3641 for (i = 0; i < log->next; i++)
3642 print_binder_transaction_log_entry(m, &log->entry[i]);
3643 return 0;
355b0502
GKH		 3644}
3645
3646static const struct file_operations binder_fops = {
3647 .owner = THIS_MODULE,
3648 .poll = binder_poll,
3649 .unlocked_ioctl = binder_ioctl,
da49889d 3650 .compat_ioctl = binder_ioctl,
355b0502
GKH		 3651 .mmap = binder_mmap,
3652 .open = binder_open,
3653 .flush = binder_flush,
3654 .release = binder_release,
3655};
3656
5249f488
AH		 3657BINDER_DEBUG_ENTRY(state);
3658BINDER_DEBUG_ENTRY(stats);
3659BINDER_DEBUG_ENTRY(transactions);
3660BINDER_DEBUG_ENTRY(transaction_log);
3661
ac4812c5
MC		 3662static int __init init_binder_device(const char *name)
3663{
3664 int ret;
3665 struct binder_device *binder_device;
3666
3667 binder_device = kzalloc(sizeof(*binder_device), GFP_KERNEL);
3668 if (!binder_device)
3669 return -ENOMEM;
3670
3671 binder_device->miscdev.fops = &binder_fops;
3672 binder_device->miscdev.minor = MISC_DYNAMIC_MINOR;
3673 binder_device->miscdev.name = name;
3674
3675 binder_device->context.binder_context_mgr_uid = INVALID_UID;
3676 binder_device->context.name = name;
c44b1231 3677 mutex_init(&binder_device->context.context_mgr_node_lock);
ac4812c5
MC		 3678
3679 ret = misc_register(&binder_device->miscdev);
3680 if (ret < 0) {
3681 kfree(binder_device);
3682 return ret;
3683 }
3684
3685 hlist_add_head(&binder_device->hlist, &binder_devices);
3686
3687 return ret;
3688}
3689
355b0502
GKH		 3690static int __init binder_init(void)
3691{
3692 int ret;
ac4812c5
MC		 3693 char *device_name, *device_names;
3694 struct binder_device *device;
3695 struct hlist_node *tmp;
355b0502 3696
16b66554
AH		 3697 binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL);
3698 if (binder_debugfs_dir_entry_root)
3699 binder_debugfs_dir_entry_proc = debugfs_create_dir("proc",
3700 binder_debugfs_dir_entry_root);
ac4812c5 3701
16b66554
AH		 3702 if (binder_debugfs_dir_entry_root) {
3703 debugfs_create_file("state",
3704 S_IRUGO,
3705 binder_debugfs_dir_entry_root,
3706 NULL,
3707 &binder_state_fops);
3708 debugfs_create_file("stats",
3709 S_IRUGO,
3710 binder_debugfs_dir_entry_root,
3711 NULL,
3712 &binder_stats_fops);
3713 debugfs_create_file("transactions",
3714 S_IRUGO,
3715 binder_debugfs_dir_entry_root,
3716 NULL,
3717 &binder_transactions_fops);
3718 debugfs_create_file("transaction_log",
3719 S_IRUGO,
3720 binder_debugfs_dir_entry_root,
3721 &binder_transaction_log,
3722 &binder_transaction_log_fops);
3723 debugfs_create_file("failed_transaction_log",
3724 S_IRUGO,
3725 binder_debugfs_dir_entry_root,
3726 &binder_transaction_log_failed,
3727 &binder_transaction_log_fops);
355b0502 3728 }
ac4812c5
MC		 3729
3730 /*
3731 * Copy the module_parameter string, because we don't want to
3732 * tokenize it in-place.
3733 */
3734 device_names = kzalloc(strlen(binder_devices_param) + 1, GFP_KERNEL);
3735 if (!device_names) {
3736 ret = -ENOMEM;
3737 goto err_alloc_device_names_failed;
3738 }
3739 strcpy(device_names, binder_devices_param);
3740
3741 while ((device_name = strsep(&device_names, ","))) {
3742 ret = init_binder_device(device_name);
3743 if (ret)
3744 goto err_init_binder_device_failed;
3745 }
3746
3747 return ret;
3748
3749err_init_binder_device_failed:
3750 hlist_for_each_entry_safe(device, tmp, &binder_devices, hlist) {
3751 misc_deregister(&device->miscdev);
3752 hlist_del(&device->hlist);
3753 kfree(device);
3754 }
3755err_alloc_device_names_failed:
3756 debugfs_remove_recursive(binder_debugfs_dir_entry_root);
3757
355b0502
GKH		 3758 return ret;
3759}
3760
3761device_initcall(binder_init);
3762
975a1ac9
AH		 3763#define CREATE_TRACE_POINTS
3764#include "binder_trace.h"
3765
355b0502 3766MODULE_LICENSE("GPL v2");