3 * Android IPC Subsystem
5 * Copyright (C) 2007-2008 Google, Inc.
7 * This software is licensed under the terms of the GNU General Public
8 * License version 2, as published by the Free Software Foundation, and
9 * may be copied, distributed, and modified under those terms.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
20 #include <asm/cacheflush.h>
21 #include <linux/fdtable.h>
22 #include <linux/file.h>
23 #include <linux/freezer.h>
25 #include <linux/list.h>
26 #include <linux/miscdevice.h>
28 #include <linux/module.h>
29 #include <linux/mutex.h>
30 #include <linux/nsproxy.h>
31 #include <linux/poll.h>
32 #include <linux/debugfs.h>
33 #include <linux/rbtree.h>
34 #include <linux/sched.h>
35 #include <linux/seq_file.h>
36 #include <linux/uaccess.h>
37 #include <linux/vmalloc.h>
38 #include <linux/slab.h>
39 #include <linux/pid_namespace.h>
40 #include <linux/security.h>
43 #include "binder_trace.h"
45 static DEFINE_MUTEX(binder_main_lock
);
46 static DEFINE_MUTEX(binder_deferred_lock
);
47 static DEFINE_MUTEX(binder_mmap_lock
);
49 static HLIST_HEAD(binder_procs
);
50 static HLIST_HEAD(binder_deferred_list
);
51 static HLIST_HEAD(binder_dead_nodes
);
53 static struct dentry
*binder_debugfs_dir_entry_root
;
54 static struct dentry
*binder_debugfs_dir_entry_proc
;
55 static struct binder_node
*binder_context_mgr_node
;
56 static kuid_t binder_context_mgr_uid
= INVALID_UID
;
57 static int binder_last_id
;
58 static struct workqueue_struct
*binder_deferred_workqueue
;
60 #define BINDER_DEBUG_ENTRY(name) \
61 static int binder_##name##_open(struct inode *inode, struct file *file) \
63 return single_open(file, binder_##name##_show, inode->i_private); \
66 static const struct file_operations binder_##name##_fops = { \
67 .owner = THIS_MODULE, \
68 .open = binder_##name##_open, \
70 .llseek = seq_lseek, \
71 .release = single_release, \
74 static int binder_proc_show(struct seq_file
*m
, void *unused
);
75 BINDER_DEBUG_ENTRY(proc
);
77 /* This is only defined in include/asm-arm/sizes.h */
83 #define SZ_4M 0x400000
86 #define FORBIDDEN_MMAP_FLAGS (VM_WRITE)
88 #define BINDER_SMALL_BUF_SIZE (PAGE_SIZE * 64)
91 BINDER_DEBUG_USER_ERROR
= 1U << 0,
92 BINDER_DEBUG_FAILED_TRANSACTION
= 1U << 1,
93 BINDER_DEBUG_DEAD_TRANSACTION
= 1U << 2,
94 BINDER_DEBUG_OPEN_CLOSE
= 1U << 3,
95 BINDER_DEBUG_DEAD_BINDER
= 1U << 4,
96 BINDER_DEBUG_DEATH_NOTIFICATION
= 1U << 5,
97 BINDER_DEBUG_READ_WRITE
= 1U << 6,
98 BINDER_DEBUG_USER_REFS
= 1U << 7,
99 BINDER_DEBUG_THREADS
= 1U << 8,
100 BINDER_DEBUG_TRANSACTION
= 1U << 9,
101 BINDER_DEBUG_TRANSACTION_COMPLETE
= 1U << 10,
102 BINDER_DEBUG_FREE_BUFFER
= 1U << 11,
103 BINDER_DEBUG_INTERNAL_REFS
= 1U << 12,
104 BINDER_DEBUG_BUFFER_ALLOC
= 1U << 13,
105 BINDER_DEBUG_PRIORITY_CAP
= 1U << 14,
106 BINDER_DEBUG_BUFFER_ALLOC_ASYNC
= 1U << 15,
108 static uint32_t binder_debug_mask
;
110 module_param_named(debug_mask
, binder_debug_mask
, uint
, S_IWUSR
| S_IRUGO
);
112 static bool binder_debug_no_lock
;
113 module_param_named(proc_no_lock
, binder_debug_no_lock
, bool, S_IWUSR
| S_IRUGO
);
115 static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait
);
116 static int binder_stop_on_user_error
;
118 static int binder_set_stop_on_user_error(const char *val
,
119 struct kernel_param
*kp
)
122 ret
= param_set_int(val
, kp
);
123 if (binder_stop_on_user_error
< 2)
124 wake_up(&binder_user_error_wait
);
127 module_param_call(stop_on_user_error
, binder_set_stop_on_user_error
,
128 param_get_int
, &binder_stop_on_user_error
, S_IWUSR
| S_IRUGO
);
130 #define binder_debug(mask, x...) \
132 if (binder_debug_mask & mask) \
136 #define binder_user_error(x...) \
138 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \
140 if (binder_stop_on_user_error) \
141 binder_stop_on_user_error = 2; \
144 enum binder_stat_types
{
150 BINDER_STAT_TRANSACTION
,
151 BINDER_STAT_TRANSACTION_COMPLETE
,
155 struct binder_stats
{
156 int br
[_IOC_NR(BR_FAILED_REPLY
) + 1];
157 int bc
[_IOC_NR(BC_DEAD_BINDER_DONE
) + 1];
158 int obj_created
[BINDER_STAT_COUNT
];
159 int obj_deleted
[BINDER_STAT_COUNT
];
162 static struct binder_stats binder_stats
;
164 static inline void binder_stats_deleted(enum binder_stat_types type
)
166 binder_stats
.obj_deleted
[type
]++;
169 static inline void binder_stats_created(enum binder_stat_types type
)
171 binder_stats
.obj_created
[type
]++;
174 struct binder_transaction_log_entry
{
186 struct binder_transaction_log
{
189 struct binder_transaction_log_entry entry
[32];
191 static struct binder_transaction_log binder_transaction_log
;
192 static struct binder_transaction_log binder_transaction_log_failed
;
194 static struct binder_transaction_log_entry
*binder_transaction_log_add(
195 struct binder_transaction_log
*log
)
197 struct binder_transaction_log_entry
*e
;
198 e
= &log
->entry
[log
->next
];
199 memset(e
, 0, sizeof(*e
));
201 if (log
->next
== ARRAY_SIZE(log
->entry
)) {
209 struct list_head entry
;
211 BINDER_WORK_TRANSACTION
= 1,
212 BINDER_WORK_TRANSACTION_COMPLETE
,
214 BINDER_WORK_DEAD_BINDER
,
215 BINDER_WORK_DEAD_BINDER_AND_CLEAR
,
216 BINDER_WORK_CLEAR_DEATH_NOTIFICATION
,
222 struct binder_work work
;
224 struct rb_node rb_node
;
225 struct hlist_node dead_node
;
227 struct binder_proc
*proc
;
228 struct hlist_head refs
;
229 int internal_strong_refs
;
231 int local_strong_refs
;
234 unsigned has_strong_ref
:1;
235 unsigned pending_strong_ref
:1;
236 unsigned has_weak_ref
:1;
237 unsigned pending_weak_ref
:1;
238 unsigned has_async_transaction
:1;
239 unsigned accept_fds
:1;
240 unsigned min_priority
:8;
241 struct list_head async_todo
;
244 struct binder_ref_death
{
245 struct binder_work work
;
250 /* Lookups needed: */
251 /* node + proc => ref (transaction) */
252 /* desc + proc => ref (transaction, inc/dec ref) */
253 /* node => refs + procs (proc exit) */
255 struct rb_node rb_node_desc
;
256 struct rb_node rb_node_node
;
257 struct hlist_node node_entry
;
258 struct binder_proc
*proc
;
259 struct binder_node
*node
;
263 struct binder_ref_death
*death
;
266 struct binder_buffer
{
267 struct list_head entry
; /* free and allocated entries by address */
268 struct rb_node rb_node
; /* free entry by size or allocated entry */
271 unsigned allow_user_free
:1;
272 unsigned async_transaction
:1;
273 unsigned debug_id
:29;
275 struct binder_transaction
*transaction
;
277 struct binder_node
*target_node
;
283 enum binder_deferred_state
{
284 BINDER_DEFERRED_PUT_FILES
= 0x01,
285 BINDER_DEFERRED_FLUSH
= 0x02,
286 BINDER_DEFERRED_RELEASE
= 0x04,
290 struct hlist_node proc_node
;
291 struct rb_root threads
;
292 struct rb_root nodes
;
293 struct rb_root refs_by_desc
;
294 struct rb_root refs_by_node
;
296 struct vm_area_struct
*vma
;
297 struct mm_struct
*vma_vm_mm
;
298 struct task_struct
*tsk
;
299 struct files_struct
*files
;
300 struct hlist_node deferred_work_node
;
303 ptrdiff_t user_buffer_offset
;
305 struct list_head buffers
;
306 struct rb_root free_buffers
;
307 struct rb_root allocated_buffers
;
308 size_t free_async_space
;
312 uint32_t buffer_free
;
313 struct list_head todo
;
314 wait_queue_head_t wait
;
315 struct binder_stats stats
;
316 struct list_head delivered_death
;
318 int requested_threads
;
319 int requested_threads_started
;
321 long default_priority
;
322 struct dentry
*debugfs_entry
;
326 BINDER_LOOPER_STATE_REGISTERED
= 0x01,
327 BINDER_LOOPER_STATE_ENTERED
= 0x02,
328 BINDER_LOOPER_STATE_EXITED
= 0x04,
329 BINDER_LOOPER_STATE_INVALID
= 0x08,
330 BINDER_LOOPER_STATE_WAITING
= 0x10,
331 BINDER_LOOPER_STATE_NEED_RETURN
= 0x20
334 struct binder_thread
{
335 struct binder_proc
*proc
;
336 struct rb_node rb_node
;
339 struct binder_transaction
*transaction_stack
;
340 struct list_head todo
;
341 uint32_t return_error
; /* Write failed, return error code in read buf */
342 uint32_t return_error2
; /* Write failed, return error code in read */
343 /* buffer. Used when sending a reply to a dead process that */
344 /* we are also waiting on */
345 wait_queue_head_t wait
;
346 struct binder_stats stats
;
349 struct binder_transaction
{
351 struct binder_work work
;
352 struct binder_thread
*from
;
353 struct binder_transaction
*from_parent
;
354 struct binder_proc
*to_proc
;
355 struct binder_thread
*to_thread
;
356 struct binder_transaction
*to_parent
;
357 unsigned need_reply
:1;
358 /* unsigned is_dead:1; */ /* not used at the moment */
360 struct binder_buffer
*buffer
;
369 binder_defer_work(struct binder_proc
*proc
, enum binder_deferred_state defer
);
371 static int task_get_unused_fd_flags(struct binder_proc
*proc
, int flags
)
373 struct files_struct
*files
= proc
->files
;
374 unsigned long rlim_cur
;
380 if (!lock_task_sighand(proc
->tsk
, &irqs
))
383 rlim_cur
= task_rlimit(proc
->tsk
, RLIMIT_NOFILE
);
384 unlock_task_sighand(proc
->tsk
, &irqs
);
386 return __alloc_fd(files
, 0, rlim_cur
, flags
);
390 * copied from fd_install
392 static void task_fd_install(
393 struct binder_proc
*proc
, unsigned int fd
, struct file
*file
)
396 __fd_install(proc
->files
, fd
, file
);
400 * copied from sys_close
402 static long task_close_fd(struct binder_proc
*proc
, unsigned int fd
)
406 if (proc
->files
== NULL
)
409 retval
= __close_fd(proc
->files
, fd
);
410 /* can't restart close syscall because file table entry was cleared */
411 if (unlikely(retval
== -ERESTARTSYS
||
412 retval
== -ERESTARTNOINTR
||
413 retval
== -ERESTARTNOHAND
||
414 retval
== -ERESTART_RESTARTBLOCK
))
420 static inline void binder_lock(const char *tag
)
422 trace_binder_lock(tag
);
423 mutex_lock(&binder_main_lock
);
424 trace_binder_locked(tag
);
427 static inline void binder_unlock(const char *tag
)
429 trace_binder_unlock(tag
);
430 mutex_unlock(&binder_main_lock
);
433 static void binder_set_nice(long nice
)
436 if (can_nice(current
, nice
)) {
437 set_user_nice(current
, nice
);
440 min_nice
= 20 - current
->signal
->rlim
[RLIMIT_NICE
].rlim_cur
;
441 binder_debug(BINDER_DEBUG_PRIORITY_CAP
,
442 "%d: nice value %ld not allowed use %ld instead\n",
443 current
->pid
, nice
, min_nice
);
444 set_user_nice(current
, min_nice
);
447 binder_user_error("%d RLIMIT_NICE not set\n", current
->pid
);
450 static size_t binder_buffer_size(struct binder_proc
*proc
,
451 struct binder_buffer
*buffer
)
453 if (list_is_last(&buffer
->entry
, &proc
->buffers
))
454 return proc
->buffer
+ proc
->buffer_size
- (void *)buffer
->data
;
456 return (size_t)list_entry(buffer
->entry
.next
,
457 struct binder_buffer
, entry
) - (size_t)buffer
->data
;
460 static void binder_insert_free_buffer(struct binder_proc
*proc
,
461 struct binder_buffer
*new_buffer
)
463 struct rb_node
**p
= &proc
->free_buffers
.rb_node
;
464 struct rb_node
*parent
= NULL
;
465 struct binder_buffer
*buffer
;
467 size_t new_buffer_size
;
469 BUG_ON(!new_buffer
->free
);
471 new_buffer_size
= binder_buffer_size(proc
, new_buffer
);
473 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
474 "%d: add free buffer, size %zd, at %p\n",
475 proc
->pid
, new_buffer_size
, new_buffer
);
479 buffer
= rb_entry(parent
, struct binder_buffer
, rb_node
);
480 BUG_ON(!buffer
->free
);
482 buffer_size
= binder_buffer_size(proc
, buffer
);
484 if (new_buffer_size
< buffer_size
)
485 p
= &parent
->rb_left
;
487 p
= &parent
->rb_right
;
489 rb_link_node(&new_buffer
->rb_node
, parent
, p
);
490 rb_insert_color(&new_buffer
->rb_node
, &proc
->free_buffers
);
493 static void binder_insert_allocated_buffer(struct binder_proc
*proc
,
494 struct binder_buffer
*new_buffer
)
496 struct rb_node
**p
= &proc
->allocated_buffers
.rb_node
;
497 struct rb_node
*parent
= NULL
;
498 struct binder_buffer
*buffer
;
500 BUG_ON(new_buffer
->free
);
504 buffer
= rb_entry(parent
, struct binder_buffer
, rb_node
);
505 BUG_ON(buffer
->free
);
507 if (new_buffer
< buffer
)
508 p
= &parent
->rb_left
;
509 else if (new_buffer
> buffer
)
510 p
= &parent
->rb_right
;
514 rb_link_node(&new_buffer
->rb_node
, parent
, p
);
515 rb_insert_color(&new_buffer
->rb_node
, &proc
->allocated_buffers
);
518 static struct binder_buffer
*binder_buffer_lookup(struct binder_proc
*proc
,
519 void __user
*user_ptr
)
521 struct rb_node
*n
= proc
->allocated_buffers
.rb_node
;
522 struct binder_buffer
*buffer
;
523 struct binder_buffer
*kern_ptr
;
525 kern_ptr
= user_ptr
- proc
->user_buffer_offset
526 - offsetof(struct binder_buffer
, data
);
529 buffer
= rb_entry(n
, struct binder_buffer
, rb_node
);
530 BUG_ON(buffer
->free
);
532 if (kern_ptr
< buffer
)
534 else if (kern_ptr
> buffer
)
542 static int binder_update_page_range(struct binder_proc
*proc
, int allocate
,
543 void *start
, void *end
,
544 struct vm_area_struct
*vma
)
547 unsigned long user_page_addr
;
548 struct vm_struct tmp_area
;
550 struct mm_struct
*mm
;
552 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
553 "%d: %s pages %p-%p\n", proc
->pid
,
554 allocate
? "allocate" : "free", start
, end
);
559 trace_binder_update_page_range(proc
, allocate
, start
, end
);
564 mm
= get_task_mm(proc
->tsk
);
567 down_write(&mm
->mmap_sem
);
569 if (vma
&& mm
!= proc
->vma_vm_mm
) {
570 pr_err("%d: vma mm and task mm mismatch\n",
580 pr_err("%d: binder_alloc_buf failed to map pages in userspace, no vma\n",
585 for (page_addr
= start
; page_addr
< end
; page_addr
+= PAGE_SIZE
) {
587 page
= &proc
->pages
[(page_addr
- proc
->buffer
) / PAGE_SIZE
];
590 *page
= alloc_page(GFP_KERNEL
| __GFP_HIGHMEM
| __GFP_ZERO
);
592 pr_err("%d: binder_alloc_buf failed for page at %p\n",
593 proc
->pid
, page_addr
);
594 goto err_alloc_page_failed
;
596 tmp_area
.addr
= page_addr
;
597 tmp_area
.size
= PAGE_SIZE
+ PAGE_SIZE
/* guard page? */;
598 ret
= map_vm_area(&tmp_area
, PAGE_KERNEL
, page
);
600 pr_err("%d: binder_alloc_buf failed to map page at %p in kernel\n",
601 proc
->pid
, page_addr
);
602 goto err_map_kernel_failed
;
605 (uintptr_t)page_addr
+ proc
->user_buffer_offset
;
606 ret
= vm_insert_page(vma
, user_page_addr
, page
[0]);
608 pr_err("%d: binder_alloc_buf failed to map page at %lx in userspace\n",
609 proc
->pid
, user_page_addr
);
610 goto err_vm_insert_page_failed
;
612 /* vm_insert_page does not seem to increment the refcount */
615 up_write(&mm
->mmap_sem
);
621 for (page_addr
= end
- PAGE_SIZE
; page_addr
>= start
;
622 page_addr
-= PAGE_SIZE
) {
623 page
= &proc
->pages
[(page_addr
- proc
->buffer
) / PAGE_SIZE
];
625 zap_page_range(vma
, (uintptr_t)page_addr
+
626 proc
->user_buffer_offset
, PAGE_SIZE
, NULL
);
627 err_vm_insert_page_failed
:
628 unmap_kernel_range((unsigned long)page_addr
, PAGE_SIZE
);
629 err_map_kernel_failed
:
632 err_alloc_page_failed
:
637 up_write(&mm
->mmap_sem
);
643 static struct binder_buffer
*binder_alloc_buf(struct binder_proc
*proc
,
645 size_t offsets_size
, int is_async
)
647 struct rb_node
*n
= proc
->free_buffers
.rb_node
;
648 struct binder_buffer
*buffer
;
650 struct rb_node
*best_fit
= NULL
;
655 if (proc
->vma
== NULL
) {
656 pr_err("%d: binder_alloc_buf, no vma\n",
661 size
= ALIGN(data_size
, sizeof(void *)) +
662 ALIGN(offsets_size
, sizeof(void *));
664 if (size
< data_size
|| size
< offsets_size
) {
665 binder_user_error("%d: got transaction with invalid size %zd-%zd\n",
666 proc
->pid
, data_size
, offsets_size
);
671 proc
->free_async_space
< size
+ sizeof(struct binder_buffer
)) {
672 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
673 "%d: binder_alloc_buf size %zd failed, no async space left\n",
679 buffer
= rb_entry(n
, struct binder_buffer
, rb_node
);
680 BUG_ON(!buffer
->free
);
681 buffer_size
= binder_buffer_size(proc
, buffer
);
683 if (size
< buffer_size
) {
686 } else if (size
> buffer_size
)
693 if (best_fit
== NULL
) {
694 pr_err("%d: binder_alloc_buf size %zd failed, no address space\n",
699 buffer
= rb_entry(best_fit
, struct binder_buffer
, rb_node
);
700 buffer_size
= binder_buffer_size(proc
, buffer
);
703 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
704 "%d: binder_alloc_buf size %zd got buffer %p size %zd\n",
705 proc
->pid
, size
, buffer
, buffer_size
);
708 (void *)(((uintptr_t)buffer
->data
+ buffer_size
) & PAGE_MASK
);
710 if (size
+ sizeof(struct binder_buffer
) + 4 >= buffer_size
)
711 buffer_size
= size
; /* no room for other buffers */
713 buffer_size
= size
+ sizeof(struct binder_buffer
);
716 (void *)PAGE_ALIGN((uintptr_t)buffer
->data
+ buffer_size
);
717 if (end_page_addr
> has_page_addr
)
718 end_page_addr
= has_page_addr
;
719 if (binder_update_page_range(proc
, 1,
720 (void *)PAGE_ALIGN((uintptr_t)buffer
->data
), end_page_addr
, NULL
))
723 rb_erase(best_fit
, &proc
->free_buffers
);
725 binder_insert_allocated_buffer(proc
, buffer
);
726 if (buffer_size
!= size
) {
727 struct binder_buffer
*new_buffer
= (void *)buffer
->data
+ size
;
728 list_add(&new_buffer
->entry
, &buffer
->entry
);
729 new_buffer
->free
= 1;
730 binder_insert_free_buffer(proc
, new_buffer
);
732 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
733 "%d: binder_alloc_buf size %zd got %p\n",
734 proc
->pid
, size
, buffer
);
735 buffer
->data_size
= data_size
;
736 buffer
->offsets_size
= offsets_size
;
737 buffer
->async_transaction
= is_async
;
739 proc
->free_async_space
-= size
+ sizeof(struct binder_buffer
);
740 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC
,
741 "%d: binder_alloc_buf size %zd async free %zd\n",
742 proc
->pid
, size
, proc
->free_async_space
);
748 static void *buffer_start_page(struct binder_buffer
*buffer
)
750 return (void *)((uintptr_t)buffer
& PAGE_MASK
);
753 static void *buffer_end_page(struct binder_buffer
*buffer
)
755 return (void *)(((uintptr_t)(buffer
+ 1) - 1) & PAGE_MASK
);
758 static void binder_delete_free_buffer(struct binder_proc
*proc
,
759 struct binder_buffer
*buffer
)
761 struct binder_buffer
*prev
, *next
= NULL
;
762 int free_page_end
= 1;
763 int free_page_start
= 1;
765 BUG_ON(proc
->buffers
.next
== &buffer
->entry
);
766 prev
= list_entry(buffer
->entry
.prev
, struct binder_buffer
, entry
);
768 if (buffer_end_page(prev
) == buffer_start_page(buffer
)) {
770 if (buffer_end_page(prev
) == buffer_end_page(buffer
))
772 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
773 "%d: merge free, buffer %p share page with %p\n",
774 proc
->pid
, buffer
, prev
);
777 if (!list_is_last(&buffer
->entry
, &proc
->buffers
)) {
778 next
= list_entry(buffer
->entry
.next
,
779 struct binder_buffer
, entry
);
780 if (buffer_start_page(next
) == buffer_end_page(buffer
)) {
782 if (buffer_start_page(next
) ==
783 buffer_start_page(buffer
))
785 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
786 "%d: merge free, buffer %p share page with %p\n",
787 proc
->pid
, buffer
, prev
);
790 list_del(&buffer
->entry
);
791 if (free_page_start
|| free_page_end
) {
792 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
793 "%d: merge free, buffer %p do not share page%s%s with %p or %p\n",
794 proc
->pid
, buffer
, free_page_start
? "" : " end",
795 free_page_end
? "" : " start", prev
, next
);
796 binder_update_page_range(proc
, 0, free_page_start
?
797 buffer_start_page(buffer
) : buffer_end_page(buffer
),
798 (free_page_end
? buffer_end_page(buffer
) :
799 buffer_start_page(buffer
)) + PAGE_SIZE
, NULL
);
803 static void binder_free_buf(struct binder_proc
*proc
,
804 struct binder_buffer
*buffer
)
806 size_t size
, buffer_size
;
808 buffer_size
= binder_buffer_size(proc
, buffer
);
810 size
= ALIGN(buffer
->data_size
, sizeof(void *)) +
811 ALIGN(buffer
->offsets_size
, sizeof(void *));
813 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
814 "%d: binder_free_buf %p size %zd buffer_size %zd\n",
815 proc
->pid
, buffer
, size
, buffer_size
);
817 BUG_ON(buffer
->free
);
818 BUG_ON(size
> buffer_size
);
819 BUG_ON(buffer
->transaction
!= NULL
);
820 BUG_ON((void *)buffer
< proc
->buffer
);
821 BUG_ON((void *)buffer
> proc
->buffer
+ proc
->buffer_size
);
823 if (buffer
->async_transaction
) {
824 proc
->free_async_space
+= size
+ sizeof(struct binder_buffer
);
826 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC
,
827 "%d: binder_free_buf size %zd async free %zd\n",
828 proc
->pid
, size
, proc
->free_async_space
);
831 binder_update_page_range(proc
, 0,
832 (void *)PAGE_ALIGN((uintptr_t)buffer
->data
),
833 (void *)(((uintptr_t)buffer
->data
+ buffer_size
) & PAGE_MASK
),
835 rb_erase(&buffer
->rb_node
, &proc
->allocated_buffers
);
837 if (!list_is_last(&buffer
->entry
, &proc
->buffers
)) {
838 struct binder_buffer
*next
= list_entry(buffer
->entry
.next
,
839 struct binder_buffer
, entry
);
841 rb_erase(&next
->rb_node
, &proc
->free_buffers
);
842 binder_delete_free_buffer(proc
, next
);
845 if (proc
->buffers
.next
!= &buffer
->entry
) {
846 struct binder_buffer
*prev
= list_entry(buffer
->entry
.prev
,
847 struct binder_buffer
, entry
);
849 binder_delete_free_buffer(proc
, buffer
);
850 rb_erase(&prev
->rb_node
, &proc
->free_buffers
);
854 binder_insert_free_buffer(proc
, buffer
);
857 static struct binder_node
*binder_get_node(struct binder_proc
*proc
,
860 struct rb_node
*n
= proc
->nodes
.rb_node
;
861 struct binder_node
*node
;
864 node
= rb_entry(n
, struct binder_node
, rb_node
);
868 else if (ptr
> node
->ptr
)
876 static struct binder_node
*binder_new_node(struct binder_proc
*proc
,
880 struct rb_node
**p
= &proc
->nodes
.rb_node
;
881 struct rb_node
*parent
= NULL
;
882 struct binder_node
*node
;
886 node
= rb_entry(parent
, struct binder_node
, rb_node
);
890 else if (ptr
> node
->ptr
)
896 node
= kzalloc(sizeof(*node
), GFP_KERNEL
);
899 binder_stats_created(BINDER_STAT_NODE
);
900 rb_link_node(&node
->rb_node
, parent
, p
);
901 rb_insert_color(&node
->rb_node
, &proc
->nodes
);
902 node
->debug_id
= ++binder_last_id
;
905 node
->cookie
= cookie
;
906 node
->work
.type
= BINDER_WORK_NODE
;
907 INIT_LIST_HEAD(&node
->work
.entry
);
908 INIT_LIST_HEAD(&node
->async_todo
);
909 binder_debug(BINDER_DEBUG_INTERNAL_REFS
,
910 "%d:%d node %d u%p c%p created\n",
911 proc
->pid
, current
->pid
, node
->debug_id
,
912 node
->ptr
, node
->cookie
);
916 static int binder_inc_node(struct binder_node
*node
, int strong
, int internal
,
917 struct list_head
*target_list
)
921 if (target_list
== NULL
&&
922 node
->internal_strong_refs
== 0 &&
923 !(node
== binder_context_mgr_node
&&
924 node
->has_strong_ref
)) {
925 pr_err("invalid inc strong node for %d\n",
929 node
->internal_strong_refs
++;
931 node
->local_strong_refs
++;
932 if (!node
->has_strong_ref
&& target_list
) {
933 list_del_init(&node
->work
.entry
);
934 list_add_tail(&node
->work
.entry
, target_list
);
938 node
->local_weak_refs
++;
939 if (!node
->has_weak_ref
&& list_empty(&node
->work
.entry
)) {
940 if (target_list
== NULL
) {
941 pr_err("invalid inc weak node for %d\n",
945 list_add_tail(&node
->work
.entry
, target_list
);
951 static int binder_dec_node(struct binder_node
*node
, int strong
, int internal
)
955 node
->internal_strong_refs
--;
957 node
->local_strong_refs
--;
958 if (node
->local_strong_refs
|| node
->internal_strong_refs
)
962 node
->local_weak_refs
--;
963 if (node
->local_weak_refs
|| !hlist_empty(&node
->refs
))
966 if (node
->proc
&& (node
->has_strong_ref
|| node
->has_weak_ref
)) {
967 if (list_empty(&node
->work
.entry
)) {
968 list_add_tail(&node
->work
.entry
, &node
->proc
->todo
);
969 wake_up_interruptible(&node
->proc
->wait
);
972 if (hlist_empty(&node
->refs
) && !node
->local_strong_refs
&&
973 !node
->local_weak_refs
) {
974 list_del_init(&node
->work
.entry
);
976 rb_erase(&node
->rb_node
, &node
->proc
->nodes
);
977 binder_debug(BINDER_DEBUG_INTERNAL_REFS
,
978 "refless node %d deleted\n",
981 hlist_del(&node
->dead_node
);
982 binder_debug(BINDER_DEBUG_INTERNAL_REFS
,
983 "dead node %d deleted\n",
987 binder_stats_deleted(BINDER_STAT_NODE
);
995 static struct binder_ref
*binder_get_ref(struct binder_proc
*proc
,
998 struct rb_node
*n
= proc
->refs_by_desc
.rb_node
;
999 struct binder_ref
*ref
;
1002 ref
= rb_entry(n
, struct binder_ref
, rb_node_desc
);
1004 if (desc
< ref
->desc
)
1006 else if (desc
> ref
->desc
)
1014 static struct binder_ref
*binder_get_ref_for_node(struct binder_proc
*proc
,
1015 struct binder_node
*node
)
1018 struct rb_node
**p
= &proc
->refs_by_node
.rb_node
;
1019 struct rb_node
*parent
= NULL
;
1020 struct binder_ref
*ref
, *new_ref
;
1024 ref
= rb_entry(parent
, struct binder_ref
, rb_node_node
);
1026 if (node
< ref
->node
)
1028 else if (node
> ref
->node
)
1029 p
= &(*p
)->rb_right
;
1033 new_ref
= kzalloc(sizeof(*ref
), GFP_KERNEL
);
1034 if (new_ref
== NULL
)
1036 binder_stats_created(BINDER_STAT_REF
);
1037 new_ref
->debug_id
= ++binder_last_id
;
1038 new_ref
->proc
= proc
;
1039 new_ref
->node
= node
;
1040 rb_link_node(&new_ref
->rb_node_node
, parent
, p
);
1041 rb_insert_color(&new_ref
->rb_node_node
, &proc
->refs_by_node
);
1043 new_ref
->desc
= (node
== binder_context_mgr_node
) ? 0 : 1;
1044 for (n
= rb_first(&proc
->refs_by_desc
); n
!= NULL
; n
= rb_next(n
)) {
1045 ref
= rb_entry(n
, struct binder_ref
, rb_node_desc
);
1046 if (ref
->desc
> new_ref
->desc
)
1048 new_ref
->desc
= ref
->desc
+ 1;
1051 p
= &proc
->refs_by_desc
.rb_node
;
1054 ref
= rb_entry(parent
, struct binder_ref
, rb_node_desc
);
1056 if (new_ref
->desc
< ref
->desc
)
1058 else if (new_ref
->desc
> ref
->desc
)
1059 p
= &(*p
)->rb_right
;
1063 rb_link_node(&new_ref
->rb_node_desc
, parent
, p
);
1064 rb_insert_color(&new_ref
->rb_node_desc
, &proc
->refs_by_desc
);
1066 hlist_add_head(&new_ref
->node_entry
, &node
->refs
);
1068 binder_debug(BINDER_DEBUG_INTERNAL_REFS
,
1069 "%d new ref %d desc %d for node %d\n",
1070 proc
->pid
, new_ref
->debug_id
, new_ref
->desc
,
1073 binder_debug(BINDER_DEBUG_INTERNAL_REFS
,
1074 "%d new ref %d desc %d for dead node\n",
1075 proc
->pid
, new_ref
->debug_id
, new_ref
->desc
);
1080 static void binder_delete_ref(struct binder_ref
*ref
)
1082 binder_debug(BINDER_DEBUG_INTERNAL_REFS
,
1083 "%d delete ref %d desc %d for node %d\n",
1084 ref
->proc
->pid
, ref
->debug_id
, ref
->desc
,
1085 ref
->node
->debug_id
);
1087 rb_erase(&ref
->rb_node_desc
, &ref
->proc
->refs_by_desc
);
1088 rb_erase(&ref
->rb_node_node
, &ref
->proc
->refs_by_node
);
1090 binder_dec_node(ref
->node
, 1, 1);
1091 hlist_del(&ref
->node_entry
);
1092 binder_dec_node(ref
->node
, 0, 1);
1094 binder_debug(BINDER_DEBUG_DEAD_BINDER
,
1095 "%d delete ref %d desc %d has death notification\n",
1096 ref
->proc
->pid
, ref
->debug_id
, ref
->desc
);
1097 list_del(&ref
->death
->work
.entry
);
1099 binder_stats_deleted(BINDER_STAT_DEATH
);
1102 binder_stats_deleted(BINDER_STAT_REF
);
1105 static int binder_inc_ref(struct binder_ref
*ref
, int strong
,
1106 struct list_head
*target_list
)
1110 if (ref
->strong
== 0) {
1111 ret
= binder_inc_node(ref
->node
, 1, 1, target_list
);
1117 if (ref
->weak
== 0) {
1118 ret
= binder_inc_node(ref
->node
, 0, 1, target_list
);
1128 static int binder_dec_ref(struct binder_ref
**ptr_to_ref
, int strong
)
1130 struct binder_ref
*ref
= *ptr_to_ref
;
1132 if (ref
->strong
== 0) {
1133 binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n",
1134 ref
->proc
->pid
, ref
->debug_id
,
1135 ref
->desc
, ref
->strong
, ref
->weak
);
1139 if (ref
->strong
== 0) {
1141 ret
= binder_dec_node(ref
->node
, strong
, 1);
1146 if (ref
->weak
== 0) {
1147 binder_user_error("%d invalid dec weak, ref %d desc %d s %d w %d\n",
1148 ref
->proc
->pid
, ref
->debug_id
,
1149 ref
->desc
, ref
->strong
, ref
->weak
);
1154 if (ref
->strong
== 0 && ref
->weak
== 0) {
1155 binder_delete_ref(ref
);
1161 static void binder_pop_transaction(struct binder_thread
*target_thread
,
1162 struct binder_transaction
*t
)
1164 if (target_thread
) {
1165 BUG_ON(target_thread
->transaction_stack
!= t
);
1166 BUG_ON(target_thread
->transaction_stack
->from
!= target_thread
);
1167 target_thread
->transaction_stack
=
1168 target_thread
->transaction_stack
->from_parent
;
1173 t
->buffer
->transaction
= NULL
;
1175 binder_stats_deleted(BINDER_STAT_TRANSACTION
);
1178 static void binder_send_failed_reply(struct binder_transaction
*t
,
1179 uint32_t error_code
)
1181 struct binder_thread
*target_thread
;
1182 BUG_ON(t
->flags
& TF_ONE_WAY
);
1184 target_thread
= t
->from
;
1185 if (target_thread
) {
1186 if (target_thread
->return_error
!= BR_OK
&&
1187 target_thread
->return_error2
== BR_OK
) {
1188 target_thread
->return_error2
=
1189 target_thread
->return_error
;
1190 target_thread
->return_error
= BR_OK
;
1192 if (target_thread
->return_error
== BR_OK
) {
1193 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION
,
1194 "send failed reply for transaction %d to %d:%d\n",
1195 t
->debug_id
, target_thread
->proc
->pid
,
1196 target_thread
->pid
);
1198 binder_pop_transaction(target_thread
, t
);
1199 target_thread
->return_error
= error_code
;
1200 wake_up_interruptible(&target_thread
->wait
);
1202 pr_err("reply failed, target thread, %d:%d, has error code %d already\n",
1203 target_thread
->proc
->pid
,
1205 target_thread
->return_error
);
1209 struct binder_transaction
*next
= t
->from_parent
;
1211 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION
,
1212 "send failed reply for transaction %d, target dead\n",
1215 binder_pop_transaction(target_thread
, t
);
1217 binder_debug(BINDER_DEBUG_DEAD_BINDER
,
1218 "reply failed, no target thread at root\n");
1222 binder_debug(BINDER_DEBUG_DEAD_BINDER
,
1223 "reply failed, no target thread -- retry %d\n",
1229 static void binder_transaction_buffer_release(struct binder_proc
*proc
,
1230 struct binder_buffer
*buffer
,
1233 size_t *offp
, *off_end
;
1234 int debug_id
= buffer
->debug_id
;
1236 binder_debug(BINDER_DEBUG_TRANSACTION
,
1237 "%d buffer release %d, size %zd-%zd, failed at %p\n",
1238 proc
->pid
, buffer
->debug_id
,
1239 buffer
->data_size
, buffer
->offsets_size
, failed_at
);
1241 if (buffer
->target_node
)
1242 binder_dec_node(buffer
->target_node
, 1, 0);
1244 offp
= (size_t *)(buffer
->data
+ ALIGN(buffer
->data_size
, sizeof(void *)));
1246 off_end
= failed_at
;
1248 off_end
= (void *)offp
+ buffer
->offsets_size
;
1249 for (; offp
< off_end
; offp
++) {
1250 struct flat_binder_object
*fp
;
1251 if (*offp
> buffer
->data_size
- sizeof(*fp
) ||
1252 buffer
->data_size
< sizeof(*fp
) ||
1253 !IS_ALIGNED(*offp
, sizeof(u32
))) {
1254 pr_err("transaction release %d bad offset %zd, size %zd\n",
1255 debug_id
, *offp
, buffer
->data_size
);
1258 fp
= (struct flat_binder_object
*)(buffer
->data
+ *offp
);
1260 case BINDER_TYPE_BINDER
:
1261 case BINDER_TYPE_WEAK_BINDER
: {
1262 struct binder_node
*node
= binder_get_node(proc
, fp
->binder
);
1264 pr_err("transaction release %d bad node %p\n",
1265 debug_id
, fp
->binder
);
1268 binder_debug(BINDER_DEBUG_TRANSACTION
,
1270 node
->debug_id
, node
->ptr
);
1271 binder_dec_node(node
, fp
->type
== BINDER_TYPE_BINDER
, 0);
1273 case BINDER_TYPE_HANDLE
:
1274 case BINDER_TYPE_WEAK_HANDLE
: {
1275 struct binder_ref
*ref
= binder_get_ref(proc
, fp
->handle
);
1277 pr_err("transaction release %d bad handle %d\n",
1278 debug_id
, fp
->handle
);
1281 binder_debug(BINDER_DEBUG_TRANSACTION
,
1282 " ref %d desc %d (node %d)\n",
1283 ref
->debug_id
, ref
->desc
, ref
->node
->debug_id
);
1284 binder_dec_ref(&ref
, fp
->type
== BINDER_TYPE_HANDLE
);
1287 case BINDER_TYPE_FD
:
1288 binder_debug(BINDER_DEBUG_TRANSACTION
,
1289 " fd %d\n", fp
->handle
);
1291 task_close_fd(proc
, fp
->handle
);
1295 pr_err("transaction release %d bad object type %x\n",
1296 debug_id
, fp
->type
);
1302 static void binder_transaction(struct binder_proc
*proc
,
1303 struct binder_thread
*thread
,
1304 struct binder_transaction_data
*tr
, int reply
)
1306 struct binder_transaction
*t
;
1307 struct binder_work
*tcomplete
;
1308 size_t *offp
, *off_end
;
1309 struct binder_proc
*target_proc
;
1310 struct binder_thread
*target_thread
= NULL
;
1311 struct binder_node
*target_node
= NULL
;
1312 struct list_head
*target_list
;
1313 wait_queue_head_t
*target_wait
;
1314 struct binder_transaction
*in_reply_to
= NULL
;
1315 struct binder_transaction_log_entry
*e
;
1316 uint32_t return_error
;
1318 e
= binder_transaction_log_add(&binder_transaction_log
);
1319 e
->call_type
= reply
? 2 : !!(tr
->flags
& TF_ONE_WAY
);
1320 e
->from_proc
= proc
->pid
;
1321 e
->from_thread
= thread
->pid
;
1322 e
->target_handle
= tr
->target
.handle
;
1323 e
->data_size
= tr
->data_size
;
1324 e
->offsets_size
= tr
->offsets_size
;
1327 in_reply_to
= thread
->transaction_stack
;
1328 if (in_reply_to
== NULL
) {
1329 binder_user_error("%d:%d got reply transaction with no transaction stack\n",
1330 proc
->pid
, thread
->pid
);
1331 return_error
= BR_FAILED_REPLY
;
1332 goto err_empty_call_stack
;
1334 binder_set_nice(in_reply_to
->saved_priority
);
1335 if (in_reply_to
->to_thread
!= thread
) {
1336 binder_user_error("%d:%d got reply transaction with bad transaction stack, transaction %d has target %d:%d\n",
1337 proc
->pid
, thread
->pid
, in_reply_to
->debug_id
,
1338 in_reply_to
->to_proc
?
1339 in_reply_to
->to_proc
->pid
: 0,
1340 in_reply_to
->to_thread
?
1341 in_reply_to
->to_thread
->pid
: 0);
1342 return_error
= BR_FAILED_REPLY
;
1344 goto err_bad_call_stack
;
1346 thread
->transaction_stack
= in_reply_to
->to_parent
;
1347 target_thread
= in_reply_to
->from
;
1348 if (target_thread
== NULL
) {
1349 return_error
= BR_DEAD_REPLY
;
1350 goto err_dead_binder
;
1352 if (target_thread
->transaction_stack
!= in_reply_to
) {
1353 binder_user_error("%d:%d got reply transaction with bad target transaction stack %d, expected %d\n",
1354 proc
->pid
, thread
->pid
,
1355 target_thread
->transaction_stack
?
1356 target_thread
->transaction_stack
->debug_id
: 0,
1357 in_reply_to
->debug_id
);
1358 return_error
= BR_FAILED_REPLY
;
1360 target_thread
= NULL
;
1361 goto err_dead_binder
;
1363 target_proc
= target_thread
->proc
;
1365 if (tr
->target
.handle
) {
1366 struct binder_ref
*ref
;
1367 ref
= binder_get_ref(proc
, tr
->target
.handle
);
1369 binder_user_error("%d:%d got transaction to invalid handle\n",
1370 proc
->pid
, thread
->pid
);
1371 return_error
= BR_FAILED_REPLY
;
1372 goto err_invalid_target_handle
;
1374 target_node
= ref
->node
;
1376 target_node
= binder_context_mgr_node
;
1377 if (target_node
== NULL
) {
1378 return_error
= BR_DEAD_REPLY
;
1379 goto err_no_context_mgr_node
;
1382 e
->to_node
= target_node
->debug_id
;
1383 target_proc
= target_node
->proc
;
1384 if (target_proc
== NULL
) {
1385 return_error
= BR_DEAD_REPLY
;
1386 goto err_dead_binder
;
1388 if (security_binder_transaction(proc
->tsk
, target_proc
->tsk
) < 0) {
1389 return_error
= BR_FAILED_REPLY
;
1390 goto err_invalid_target_handle
;
1392 if (!(tr
->flags
& TF_ONE_WAY
) && thread
->transaction_stack
) {
1393 struct binder_transaction
*tmp
;
1394 tmp
= thread
->transaction_stack
;
1395 if (tmp
->to_thread
!= thread
) {
1396 binder_user_error("%d:%d got new transaction with bad transaction stack, transaction %d has target %d:%d\n",
1397 proc
->pid
, thread
->pid
, tmp
->debug_id
,
1398 tmp
->to_proc
? tmp
->to_proc
->pid
: 0,
1400 tmp
->to_thread
->pid
: 0);
1401 return_error
= BR_FAILED_REPLY
;
1402 goto err_bad_call_stack
;
1405 if (tmp
->from
&& tmp
->from
->proc
== target_proc
)
1406 target_thread
= tmp
->from
;
1407 tmp
= tmp
->from_parent
;
1411 if (target_thread
) {
1412 e
->to_thread
= target_thread
->pid
;
1413 target_list
= &target_thread
->todo
;
1414 target_wait
= &target_thread
->wait
;
1416 target_list
= &target_proc
->todo
;
1417 target_wait
= &target_proc
->wait
;
1419 e
->to_proc
= target_proc
->pid
;
1421 /* TODO: reuse incoming transaction for reply */
1422 t
= kzalloc(sizeof(*t
), GFP_KERNEL
);
1424 return_error
= BR_FAILED_REPLY
;
1425 goto err_alloc_t_failed
;
1427 binder_stats_created(BINDER_STAT_TRANSACTION
);
1429 tcomplete
= kzalloc(sizeof(*tcomplete
), GFP_KERNEL
);
1430 if (tcomplete
== NULL
) {
1431 return_error
= BR_FAILED_REPLY
;
1432 goto err_alloc_tcomplete_failed
;
1434 binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE
);
1436 t
->debug_id
= ++binder_last_id
;
1437 e
->debug_id
= t
->debug_id
;
1440 binder_debug(BINDER_DEBUG_TRANSACTION
,
1441 "%d:%d BC_REPLY %d -> %d:%d, data %p-%p size %zd-%zd\n",
1442 proc
->pid
, thread
->pid
, t
->debug_id
,
1443 target_proc
->pid
, target_thread
->pid
,
1444 tr
->data
.ptr
.buffer
, tr
->data
.ptr
.offsets
,
1445 tr
->data_size
, tr
->offsets_size
);
1447 binder_debug(BINDER_DEBUG_TRANSACTION
,
1448 "%d:%d BC_TRANSACTION %d -> %d - node %d, data %p-%p size %zd-%zd\n",
1449 proc
->pid
, thread
->pid
, t
->debug_id
,
1450 target_proc
->pid
, target_node
->debug_id
,
1451 tr
->data
.ptr
.buffer
, tr
->data
.ptr
.offsets
,
1452 tr
->data_size
, tr
->offsets_size
);
1454 if (!reply
&& !(tr
->flags
& TF_ONE_WAY
))
1458 t
->sender_euid
= proc
->tsk
->cred
->euid
;
1459 t
->to_proc
= target_proc
;
1460 t
->to_thread
= target_thread
;
1462 t
->flags
= tr
->flags
;
1463 t
->priority
= task_nice(current
);
1465 trace_binder_transaction(reply
, t
, target_node
);
1467 t
->buffer
= binder_alloc_buf(target_proc
, tr
->data_size
,
1468 tr
->offsets_size
, !reply
&& (t
->flags
& TF_ONE_WAY
));
1469 if (t
->buffer
== NULL
) {
1470 return_error
= BR_FAILED_REPLY
;
1471 goto err_binder_alloc_buf_failed
;
1473 t
->buffer
->allow_user_free
= 0;
1474 t
->buffer
->debug_id
= t
->debug_id
;
1475 t
->buffer
->transaction
= t
;
1476 t
->buffer
->target_node
= target_node
;
1477 trace_binder_transaction_alloc_buf(t
->buffer
);
1479 binder_inc_node(target_node
, 1, 0, NULL
);
1481 offp
= (size_t *)(t
->buffer
->data
+ ALIGN(tr
->data_size
, sizeof(void *)));
1483 if (copy_from_user(t
->buffer
->data
, tr
->data
.ptr
.buffer
, tr
->data_size
)) {
1484 binder_user_error("%d:%d got transaction with invalid data ptr\n",
1485 proc
->pid
, thread
->pid
);
1486 return_error
= BR_FAILED_REPLY
;
1487 goto err_copy_data_failed
;
1489 if (copy_from_user(offp
, tr
->data
.ptr
.offsets
, tr
->offsets_size
)) {
1490 binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
1491 proc
->pid
, thread
->pid
);
1492 return_error
= BR_FAILED_REPLY
;
1493 goto err_copy_data_failed
;
1495 if (!IS_ALIGNED(tr
->offsets_size
, sizeof(size_t))) {
1496 binder_user_error("%d:%d got transaction with invalid offsets size, %zd\n",
1497 proc
->pid
, thread
->pid
, tr
->offsets_size
);
1498 return_error
= BR_FAILED_REPLY
;
1499 goto err_bad_offset
;
1501 off_end
= (void *)offp
+ tr
->offsets_size
;
1502 for (; offp
< off_end
; offp
++) {
1503 struct flat_binder_object
*fp
;
1504 if (*offp
> t
->buffer
->data_size
- sizeof(*fp
) ||
1505 t
->buffer
->data_size
< sizeof(*fp
) ||
1506 !IS_ALIGNED(*offp
, sizeof(u32
))) {
1507 binder_user_error("%d:%d got transaction with invalid offset, %zd\n",
1508 proc
->pid
, thread
->pid
, *offp
);
1509 return_error
= BR_FAILED_REPLY
;
1510 goto err_bad_offset
;
1512 fp
= (struct flat_binder_object
*)(t
->buffer
->data
+ *offp
);
1514 case BINDER_TYPE_BINDER
:
1515 case BINDER_TYPE_WEAK_BINDER
: {
1516 struct binder_ref
*ref
;
1517 struct binder_node
*node
= binder_get_node(proc
, fp
->binder
);
1519 node
= binder_new_node(proc
, fp
->binder
, fp
->cookie
);
1521 return_error
= BR_FAILED_REPLY
;
1522 goto err_binder_new_node_failed
;
1524 node
->min_priority
= fp
->flags
& FLAT_BINDER_FLAG_PRIORITY_MASK
;
1525 node
->accept_fds
= !!(fp
->flags
& FLAT_BINDER_FLAG_ACCEPTS_FDS
);
1527 if (fp
->cookie
!= node
->cookie
) {
1528 binder_user_error("%d:%d sending u%p node %d, cookie mismatch %p != %p\n",
1529 proc
->pid
, thread
->pid
,
1530 fp
->binder
, node
->debug_id
,
1531 fp
->cookie
, node
->cookie
);
1532 goto err_binder_get_ref_for_node_failed
;
1534 if (security_binder_transfer_binder(proc
->tsk
, target_proc
->tsk
)) {
1535 return_error
= BR_FAILED_REPLY
;
1536 goto err_binder_get_ref_for_node_failed
;
1538 ref
= binder_get_ref_for_node(target_proc
, node
);
1540 return_error
= BR_FAILED_REPLY
;
1541 goto err_binder_get_ref_for_node_failed
;
1543 if (fp
->type
== BINDER_TYPE_BINDER
)
1544 fp
->type
= BINDER_TYPE_HANDLE
;
1546 fp
->type
= BINDER_TYPE_WEAK_HANDLE
;
1547 fp
->handle
= ref
->desc
;
1548 binder_inc_ref(ref
, fp
->type
== BINDER_TYPE_HANDLE
,
1551 trace_binder_transaction_node_to_ref(t
, node
, ref
);
1552 binder_debug(BINDER_DEBUG_TRANSACTION
,
1553 " node %d u%p -> ref %d desc %d\n",
1554 node
->debug_id
, node
->ptr
, ref
->debug_id
,
1557 case BINDER_TYPE_HANDLE
:
1558 case BINDER_TYPE_WEAK_HANDLE
: {
1559 struct binder_ref
*ref
= binder_get_ref(proc
, fp
->handle
);
1561 binder_user_error("%d:%d got transaction with invalid handle, %d\n",
1563 thread
->pid
, fp
->handle
);
1564 return_error
= BR_FAILED_REPLY
;
1565 goto err_binder_get_ref_failed
;
1567 if (security_binder_transfer_binder(proc
->tsk
, target_proc
->tsk
)) {
1568 return_error
= BR_FAILED_REPLY
;
1569 goto err_binder_get_ref_failed
;
1571 if (ref
->node
->proc
== target_proc
) {
1572 if (fp
->type
== BINDER_TYPE_HANDLE
)
1573 fp
->type
= BINDER_TYPE_BINDER
;
1575 fp
->type
= BINDER_TYPE_WEAK_BINDER
;
1576 fp
->binder
= ref
->node
->ptr
;
1577 fp
->cookie
= ref
->node
->cookie
;
1578 binder_inc_node(ref
->node
, fp
->type
== BINDER_TYPE_BINDER
, 0, NULL
);
1579 trace_binder_transaction_ref_to_node(t
, ref
);
1580 binder_debug(BINDER_DEBUG_TRANSACTION
,
1581 " ref %d desc %d -> node %d u%p\n",
1582 ref
->debug_id
, ref
->desc
, ref
->node
->debug_id
,
1585 struct binder_ref
*new_ref
;
1586 new_ref
= binder_get_ref_for_node(target_proc
, ref
->node
);
1587 if (new_ref
== NULL
) {
1588 return_error
= BR_FAILED_REPLY
;
1589 goto err_binder_get_ref_for_node_failed
;
1591 fp
->handle
= new_ref
->desc
;
1592 binder_inc_ref(new_ref
, fp
->type
== BINDER_TYPE_HANDLE
, NULL
);
1593 trace_binder_transaction_ref_to_ref(t
, ref
,
1595 binder_debug(BINDER_DEBUG_TRANSACTION
,
1596 " ref %d desc %d -> ref %d desc %d (node %d)\n",
1597 ref
->debug_id
, ref
->desc
, new_ref
->debug_id
,
1598 new_ref
->desc
, ref
->node
->debug_id
);
1602 case BINDER_TYPE_FD
: {
1607 if (!(in_reply_to
->flags
& TF_ACCEPT_FDS
)) {
1608 binder_user_error("%d:%d got reply with fd, %d, but target does not allow fds\n",
1609 proc
->pid
, thread
->pid
, fp
->handle
);
1610 return_error
= BR_FAILED_REPLY
;
1611 goto err_fd_not_allowed
;
1613 } else if (!target_node
->accept_fds
) {
1614 binder_user_error("%d:%d got transaction with fd, %d, but target does not allow fds\n",
1615 proc
->pid
, thread
->pid
, fp
->handle
);
1616 return_error
= BR_FAILED_REPLY
;
1617 goto err_fd_not_allowed
;
1620 file
= fget(fp
->handle
);
1622 binder_user_error("%d:%d got transaction with invalid fd, %d\n",
1623 proc
->pid
, thread
->pid
, fp
->handle
);
1624 return_error
= BR_FAILED_REPLY
;
1625 goto err_fget_failed
;
1627 if (security_binder_transfer_file(proc
->tsk
, target_proc
->tsk
, file
) < 0) {
1629 return_error
= BR_FAILED_REPLY
;
1630 goto err_get_unused_fd_failed
;
1632 target_fd
= task_get_unused_fd_flags(target_proc
, O_CLOEXEC
);
1633 if (target_fd
< 0) {
1635 return_error
= BR_FAILED_REPLY
;
1636 goto err_get_unused_fd_failed
;
1638 task_fd_install(target_proc
, target_fd
, file
);
1639 trace_binder_transaction_fd(t
, fp
->handle
, target_fd
);
1640 binder_debug(BINDER_DEBUG_TRANSACTION
,
1641 " fd %d -> %d\n", fp
->handle
, target_fd
);
1643 fp
->handle
= target_fd
;
1647 binder_user_error("%d:%d got transaction with invalid object type, %x\n",
1648 proc
->pid
, thread
->pid
, fp
->type
);
1649 return_error
= BR_FAILED_REPLY
;
1650 goto err_bad_object_type
;
1654 BUG_ON(t
->buffer
->async_transaction
!= 0);
1655 binder_pop_transaction(target_thread
, in_reply_to
);
1656 } else if (!(t
->flags
& TF_ONE_WAY
)) {
1657 BUG_ON(t
->buffer
->async_transaction
!= 0);
1659 t
->from_parent
= thread
->transaction_stack
;
1660 thread
->transaction_stack
= t
;
1662 BUG_ON(target_node
== NULL
);
1663 BUG_ON(t
->buffer
->async_transaction
!= 1);
1664 if (target_node
->has_async_transaction
) {
1665 target_list
= &target_node
->async_todo
;
1668 target_node
->has_async_transaction
= 1;
1670 t
->work
.type
= BINDER_WORK_TRANSACTION
;
1671 list_add_tail(&t
->work
.entry
, target_list
);
1672 tcomplete
->type
= BINDER_WORK_TRANSACTION_COMPLETE
;
1673 list_add_tail(&tcomplete
->entry
, &thread
->todo
);
1675 wake_up_interruptible(target_wait
);
1678 err_get_unused_fd_failed
:
1681 err_binder_get_ref_for_node_failed
:
1682 err_binder_get_ref_failed
:
1683 err_binder_new_node_failed
:
1684 err_bad_object_type
:
1686 err_copy_data_failed
:
1687 trace_binder_transaction_failed_buffer_release(t
->buffer
);
1688 binder_transaction_buffer_release(target_proc
, t
->buffer
, offp
);
1689 t
->buffer
->transaction
= NULL
;
1690 binder_free_buf(target_proc
, t
->buffer
);
1691 err_binder_alloc_buf_failed
:
1693 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE
);
1694 err_alloc_tcomplete_failed
:
1696 binder_stats_deleted(BINDER_STAT_TRANSACTION
);
1699 err_empty_call_stack
:
1701 err_invalid_target_handle
:
1702 err_no_context_mgr_node
:
1703 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION
,
1704 "%d:%d transaction failed %d, size %zd-%zd\n",
1705 proc
->pid
, thread
->pid
, return_error
,
1706 tr
->data_size
, tr
->offsets_size
);
1709 struct binder_transaction_log_entry
*fe
;
1710 fe
= binder_transaction_log_add(&binder_transaction_log_failed
);
1714 BUG_ON(thread
->return_error
!= BR_OK
);
1716 thread
->return_error
= BR_TRANSACTION_COMPLETE
;
1717 binder_send_failed_reply(in_reply_to
, return_error
);
1719 thread
->return_error
= return_error
;
1722 int binder_thread_write(struct binder_proc
*proc
, struct binder_thread
*thread
,
1723 void __user
*buffer
, size_t size
, size_t *consumed
)
1726 void __user
*ptr
= buffer
+ *consumed
;
1727 void __user
*end
= buffer
+ size
;
1729 while (ptr
< end
&& thread
->return_error
== BR_OK
) {
1730 if (get_user(cmd
, (uint32_t __user
*)ptr
))
1732 ptr
+= sizeof(uint32_t);
1733 trace_binder_command(cmd
);
1734 if (_IOC_NR(cmd
) < ARRAY_SIZE(binder_stats
.bc
)) {
1735 binder_stats
.bc
[_IOC_NR(cmd
)]++;
1736 proc
->stats
.bc
[_IOC_NR(cmd
)]++;
1737 thread
->stats
.bc
[_IOC_NR(cmd
)]++;
1745 struct binder_ref
*ref
;
1746 const char *debug_string
;
1748 if (get_user(target
, (uint32_t __user
*)ptr
))
1750 ptr
+= sizeof(uint32_t);
1751 if (target
== 0 && binder_context_mgr_node
&&
1752 (cmd
== BC_INCREFS
|| cmd
== BC_ACQUIRE
)) {
1753 ref
= binder_get_ref_for_node(proc
,
1754 binder_context_mgr_node
);
1755 if (ref
->desc
!= target
) {
1756 binder_user_error("%d:%d tried to acquire reference to desc 0, got %d instead\n",
1757 proc
->pid
, thread
->pid
,
1761 ref
= binder_get_ref(proc
, target
);
1763 binder_user_error("%d:%d refcount change on invalid ref %d\n",
1764 proc
->pid
, thread
->pid
, target
);
1769 debug_string
= "IncRefs";
1770 binder_inc_ref(ref
, 0, NULL
);
1773 debug_string
= "Acquire";
1774 binder_inc_ref(ref
, 1, NULL
);
1777 debug_string
= "Release";
1778 binder_dec_ref(&ref
, 1);
1782 debug_string
= "DecRefs";
1783 binder_dec_ref(&ref
, 0);
1787 binder_debug(BINDER_DEBUG_USER_REFS
,
1788 "binder: %d:%d %s ref deleted",
1789 proc
->pid
, thread
->pid
, debug_string
);
1791 binder_debug(BINDER_DEBUG_USER_REFS
,
1792 "binder: %d:%d %s ref %d desc %d s %d w %d for node %d\n",
1793 proc
->pid
, thread
->pid
, debug_string
,
1794 ref
->debug_id
, ref
->desc
, ref
->strong
,
1795 ref
->weak
, ref
->node
->debug_id
);
1799 case BC_INCREFS_DONE
:
1800 case BC_ACQUIRE_DONE
: {
1801 void __user
*node_ptr
;
1803 struct binder_node
*node
;
1805 if (get_user(node_ptr
, (void * __user
*)ptr
))
1807 ptr
+= sizeof(void *);
1808 if (get_user(cookie
, (void * __user
*)ptr
))
1810 ptr
+= sizeof(void *);
1811 node
= binder_get_node(proc
, node_ptr
);
1813 binder_user_error("%d:%d %s u%p no match\n",
1814 proc
->pid
, thread
->pid
,
1815 cmd
== BC_INCREFS_DONE
?
1821 if (cookie
!= node
->cookie
) {
1822 binder_user_error("%d:%d %s u%p node %d cookie mismatch %p != %p\n",
1823 proc
->pid
, thread
->pid
,
1824 cmd
== BC_INCREFS_DONE
?
1825 "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
1826 node_ptr
, node
->debug_id
,
1827 cookie
, node
->cookie
);
1830 if (cmd
== BC_ACQUIRE_DONE
) {
1831 if (node
->pending_strong_ref
== 0) {
1832 binder_user_error("%d:%d BC_ACQUIRE_DONE node %d has no pending acquire request\n",
1833 proc
->pid
, thread
->pid
,
1837 node
->pending_strong_ref
= 0;
1839 if (node
->pending_weak_ref
== 0) {
1840 binder_user_error("%d:%d BC_INCREFS_DONE node %d has no pending increfs request\n",
1841 proc
->pid
, thread
->pid
,
1845 node
->pending_weak_ref
= 0;
1847 binder_dec_node(node
, cmd
== BC_ACQUIRE_DONE
, 0);
1848 binder_debug(BINDER_DEBUG_USER_REFS
,
1849 "%d:%d %s node %d ls %d lw %d\n",
1850 proc
->pid
, thread
->pid
,
1851 cmd
== BC_INCREFS_DONE
? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
1852 node
->debug_id
, node
->local_strong_refs
, node
->local_weak_refs
);
1855 case BC_ATTEMPT_ACQUIRE
:
1856 pr_err("BC_ATTEMPT_ACQUIRE not supported\n");
1858 case BC_ACQUIRE_RESULT
:
1859 pr_err("BC_ACQUIRE_RESULT not supported\n");
1862 case BC_FREE_BUFFER
: {
1863 void __user
*data_ptr
;
1864 struct binder_buffer
*buffer
;
1866 if (get_user(data_ptr
, (void * __user
*)ptr
))
1868 ptr
+= sizeof(void *);
1870 buffer
= binder_buffer_lookup(proc
, data_ptr
);
1871 if (buffer
== NULL
) {
1872 binder_user_error("%d:%d BC_FREE_BUFFER u%p no match\n",
1873 proc
->pid
, thread
->pid
, data_ptr
);
1876 if (!buffer
->allow_user_free
) {
1877 binder_user_error("%d:%d BC_FREE_BUFFER u%p matched unreturned buffer\n",
1878 proc
->pid
, thread
->pid
, data_ptr
);
1881 binder_debug(BINDER_DEBUG_FREE_BUFFER
,
1882 "%d:%d BC_FREE_BUFFER u%p found buffer %d for %s transaction\n",
1883 proc
->pid
, thread
->pid
, data_ptr
, buffer
->debug_id
,
1884 buffer
->transaction
? "active" : "finished");
1886 if (buffer
->transaction
) {
1887 buffer
->transaction
->buffer
= NULL
;
1888 buffer
->transaction
= NULL
;
1890 if (buffer
->async_transaction
&& buffer
->target_node
) {
1891 BUG_ON(!buffer
->target_node
->has_async_transaction
);
1892 if (list_empty(&buffer
->target_node
->async_todo
))
1893 buffer
->target_node
->has_async_transaction
= 0;
1895 list_move_tail(buffer
->target_node
->async_todo
.next
, &thread
->proc
->todo
);
1896 wake_up_interruptible(&thread
->proc
->wait
);
1900 trace_binder_transaction_buffer_release(buffer
);
1901 binder_transaction_buffer_release(proc
, buffer
, NULL
);
1902 binder_free_buf(proc
, buffer
);
1906 case BC_TRANSACTION
:
1908 struct binder_transaction_data tr
;
1910 if (copy_from_user(&tr
, ptr
, sizeof(tr
)))
1913 binder_transaction(proc
, thread
, &tr
, cmd
== BC_REPLY
);
1917 case BC_REGISTER_LOOPER
:
1918 binder_debug(BINDER_DEBUG_THREADS
,
1919 "%d:%d BC_REGISTER_LOOPER\n",
1920 proc
->pid
, thread
->pid
);
1921 if (thread
->looper
& BINDER_LOOPER_STATE_ENTERED
) {
1922 thread
->looper
|= BINDER_LOOPER_STATE_INVALID
;
1923 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER\n",
1924 proc
->pid
, thread
->pid
);
1925 } else if (proc
->requested_threads
== 0) {
1926 thread
->looper
|= BINDER_LOOPER_STATE_INVALID
;
1927 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called without request\n",
1928 proc
->pid
, thread
->pid
);
1930 proc
->requested_threads
--;
1931 proc
->requested_threads_started
++;
1933 thread
->looper
|= BINDER_LOOPER_STATE_REGISTERED
;
1935 case BC_ENTER_LOOPER
:
1936 binder_debug(BINDER_DEBUG_THREADS
,
1937 "%d:%d BC_ENTER_LOOPER\n",
1938 proc
->pid
, thread
->pid
);
1939 if (thread
->looper
& BINDER_LOOPER_STATE_REGISTERED
) {
1940 thread
->looper
|= BINDER_LOOPER_STATE_INVALID
;
1941 binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n",
1942 proc
->pid
, thread
->pid
);
1944 thread
->looper
|= BINDER_LOOPER_STATE_ENTERED
;
1946 case BC_EXIT_LOOPER
:
1947 binder_debug(BINDER_DEBUG_THREADS
,
1948 "%d:%d BC_EXIT_LOOPER\n",
1949 proc
->pid
, thread
->pid
);
1950 thread
->looper
|= BINDER_LOOPER_STATE_EXITED
;
1953 case BC_REQUEST_DEATH_NOTIFICATION
:
1954 case BC_CLEAR_DEATH_NOTIFICATION
: {
1956 void __user
*cookie
;
1957 struct binder_ref
*ref
;
1958 struct binder_ref_death
*death
;
1960 if (get_user(target
, (uint32_t __user
*)ptr
))
1962 ptr
+= sizeof(uint32_t);
1963 if (get_user(cookie
, (void __user
* __user
*)ptr
))
1965 ptr
+= sizeof(void *);
1966 ref
= binder_get_ref(proc
, target
);
1968 binder_user_error("%d:%d %s invalid ref %d\n",
1969 proc
->pid
, thread
->pid
,
1970 cmd
== BC_REQUEST_DEATH_NOTIFICATION
?
1971 "BC_REQUEST_DEATH_NOTIFICATION" :
1972 "BC_CLEAR_DEATH_NOTIFICATION",
1977 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION
,
1978 "%d:%d %s %p ref %d desc %d s %d w %d for node %d\n",
1979 proc
->pid
, thread
->pid
,
1980 cmd
== BC_REQUEST_DEATH_NOTIFICATION
?
1981 "BC_REQUEST_DEATH_NOTIFICATION" :
1982 "BC_CLEAR_DEATH_NOTIFICATION",
1983 cookie
, ref
->debug_id
, ref
->desc
,
1984 ref
->strong
, ref
->weak
, ref
->node
->debug_id
);
1986 if (cmd
== BC_REQUEST_DEATH_NOTIFICATION
) {
1988 binder_user_error("%d:%d BC_REQUEST_DEATH_NOTIFICATION death notification already set\n",
1989 proc
->pid
, thread
->pid
);
1992 death
= kzalloc(sizeof(*death
), GFP_KERNEL
);
1993 if (death
== NULL
) {
1994 thread
->return_error
= BR_ERROR
;
1995 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION
,
1996 "%d:%d BC_REQUEST_DEATH_NOTIFICATION failed\n",
1997 proc
->pid
, thread
->pid
);
2000 binder_stats_created(BINDER_STAT_DEATH
);
2001 INIT_LIST_HEAD(&death
->work
.entry
);
2002 death
->cookie
= cookie
;
2004 if (ref
->node
->proc
== NULL
) {
2005 ref
->death
->work
.type
= BINDER_WORK_DEAD_BINDER
;
2006 if (thread
->looper
& (BINDER_LOOPER_STATE_REGISTERED
| BINDER_LOOPER_STATE_ENTERED
)) {
2007 list_add_tail(&ref
->death
->work
.entry
, &thread
->todo
);
2009 list_add_tail(&ref
->death
->work
.entry
, &proc
->todo
);
2010 wake_up_interruptible(&proc
->wait
);
2014 if (ref
->death
== NULL
) {
2015 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification not active\n",
2016 proc
->pid
, thread
->pid
);
2020 if (death
->cookie
!= cookie
) {
2021 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch %p != %p\n",
2022 proc
->pid
, thread
->pid
,
2023 death
->cookie
, cookie
);
2027 if (list_empty(&death
->work
.entry
)) {
2028 death
->work
.type
= BINDER_WORK_CLEAR_DEATH_NOTIFICATION
;
2029 if (thread
->looper
& (BINDER_LOOPER_STATE_REGISTERED
| BINDER_LOOPER_STATE_ENTERED
)) {
2030 list_add_tail(&death
->work
.entry
, &thread
->todo
);
2032 list_add_tail(&death
->work
.entry
, &proc
->todo
);
2033 wake_up_interruptible(&proc
->wait
);
2036 BUG_ON(death
->work
.type
!= BINDER_WORK_DEAD_BINDER
);
2037 death
->work
.type
= BINDER_WORK_DEAD_BINDER_AND_CLEAR
;
2041 case BC_DEAD_BINDER_DONE
: {
2042 struct binder_work
*w
;
2043 void __user
*cookie
;
2044 struct binder_ref_death
*death
= NULL
;
2045 if (get_user(cookie
, (void __user
* __user
*)ptr
))
2048 ptr
+= sizeof(cookie
);
2049 list_for_each_entry(w
, &proc
->delivered_death
, entry
) {
2050 struct binder_ref_death
*tmp_death
= container_of(w
, struct binder_ref_death
, work
);
2051 if (tmp_death
->cookie
== cookie
) {
2056 binder_debug(BINDER_DEBUG_DEAD_BINDER
,
2057 "%d:%d BC_DEAD_BINDER_DONE %p found %p\n",
2058 proc
->pid
, thread
->pid
, cookie
, death
);
2059 if (death
== NULL
) {
2060 binder_user_error("%d:%d BC_DEAD_BINDER_DONE %p not found\n",
2061 proc
->pid
, thread
->pid
, cookie
);
2065 list_del_init(&death
->work
.entry
);
2066 if (death
->work
.type
== BINDER_WORK_DEAD_BINDER_AND_CLEAR
) {
2067 death
->work
.type
= BINDER_WORK_CLEAR_DEATH_NOTIFICATION
;
2068 if (thread
->looper
& (BINDER_LOOPER_STATE_REGISTERED
| BINDER_LOOPER_STATE_ENTERED
)) {
2069 list_add_tail(&death
->work
.entry
, &thread
->todo
);
2071 list_add_tail(&death
->work
.entry
, &proc
->todo
);
2072 wake_up_interruptible(&proc
->wait
);
2078 pr_err("%d:%d unknown command %d\n",
2079 proc
->pid
, thread
->pid
, cmd
);
2082 *consumed
= ptr
- buffer
;
2087 static void binder_stat_br(struct binder_proc
*proc
,
2088 struct binder_thread
*thread
, uint32_t cmd
)
2090 trace_binder_return(cmd
);
2091 if (_IOC_NR(cmd
) < ARRAY_SIZE(binder_stats
.br
)) {
2092 binder_stats
.br
[_IOC_NR(cmd
)]++;
2093 proc
->stats
.br
[_IOC_NR(cmd
)]++;
2094 thread
->stats
.br
[_IOC_NR(cmd
)]++;
2098 static int binder_has_proc_work(struct binder_proc
*proc
,
2099 struct binder_thread
*thread
)
2101 return !list_empty(&proc
->todo
) ||
2102 (thread
->looper
& BINDER_LOOPER_STATE_NEED_RETURN
);
2105 static int binder_has_thread_work(struct binder_thread
*thread
)
2107 return !list_empty(&thread
->todo
) || thread
->return_error
!= BR_OK
||
2108 (thread
->looper
& BINDER_LOOPER_STATE_NEED_RETURN
);
2111 static int binder_thread_read(struct binder_proc
*proc
,
2112 struct binder_thread
*thread
,
2113 void __user
*buffer
, size_t size
,
2114 size_t *consumed
, int non_block
)
2116 void __user
*ptr
= buffer
+ *consumed
;
2117 void __user
*end
= buffer
+ size
;
2120 int wait_for_proc_work
;
2122 if (*consumed
== 0) {
2123 if (put_user(BR_NOOP
, (uint32_t __user
*)ptr
))
2125 ptr
+= sizeof(uint32_t);
2129 wait_for_proc_work
= thread
->transaction_stack
== NULL
&&
2130 list_empty(&thread
->todo
);
2132 if (thread
->return_error
!= BR_OK
&& ptr
< end
) {
2133 if (thread
->return_error2
!= BR_OK
) {
2134 if (put_user(thread
->return_error2
, (uint32_t __user
*)ptr
))
2136 ptr
+= sizeof(uint32_t);
2137 binder_stat_br(proc
, thread
, thread
->return_error2
);
2140 thread
->return_error2
= BR_OK
;
2142 if (put_user(thread
->return_error
, (uint32_t __user
*)ptr
))
2144 ptr
+= sizeof(uint32_t);
2145 binder_stat_br(proc
, thread
, thread
->return_error
);
2146 thread
->return_error
= BR_OK
;
2151 thread
->looper
|= BINDER_LOOPER_STATE_WAITING
;
2152 if (wait_for_proc_work
)
2153 proc
->ready_threads
++;
2155 binder_unlock(__func__
);
2157 trace_binder_wait_for_work(wait_for_proc_work
,
2158 !!thread
->transaction_stack
,
2159 !list_empty(&thread
->todo
));
2160 if (wait_for_proc_work
) {
2161 if (!(thread
->looper
& (BINDER_LOOPER_STATE_REGISTERED
|
2162 BINDER_LOOPER_STATE_ENTERED
))) {
2163 binder_user_error("%d:%d ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state %x)\n",
2164 proc
->pid
, thread
->pid
, thread
->looper
);
2165 wait_event_interruptible(binder_user_error_wait
,
2166 binder_stop_on_user_error
< 2);
2168 binder_set_nice(proc
->default_priority
);
2170 if (!binder_has_proc_work(proc
, thread
))
2173 ret
= wait_event_freezable_exclusive(proc
->wait
, binder_has_proc_work(proc
, thread
));
2176 if (!binder_has_thread_work(thread
))
2179 ret
= wait_event_freezable(thread
->wait
, binder_has_thread_work(thread
));
2182 binder_lock(__func__
);
2184 if (wait_for_proc_work
)
2185 proc
->ready_threads
--;
2186 thread
->looper
&= ~BINDER_LOOPER_STATE_WAITING
;
2193 struct binder_transaction_data tr
;
2194 struct binder_work
*w
;
2195 struct binder_transaction
*t
= NULL
;
2197 if (!list_empty(&thread
->todo
))
2198 w
= list_first_entry(&thread
->todo
, struct binder_work
, entry
);
2199 else if (!list_empty(&proc
->todo
) && wait_for_proc_work
)
2200 w
= list_first_entry(&proc
->todo
, struct binder_work
, entry
);
2202 if (ptr
- buffer
== 4 && !(thread
->looper
& BINDER_LOOPER_STATE_NEED_RETURN
)) /* no data added */
2207 if (end
- ptr
< sizeof(tr
) + 4)
2211 case BINDER_WORK_TRANSACTION
: {
2212 t
= container_of(w
, struct binder_transaction
, work
);
2214 case BINDER_WORK_TRANSACTION_COMPLETE
: {
2215 cmd
= BR_TRANSACTION_COMPLETE
;
2216 if (put_user(cmd
, (uint32_t __user
*)ptr
))
2218 ptr
+= sizeof(uint32_t);
2220 binder_stat_br(proc
, thread
, cmd
);
2221 binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE
,
2222 "%d:%d BR_TRANSACTION_COMPLETE\n",
2223 proc
->pid
, thread
->pid
);
2225 list_del(&w
->entry
);
2227 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE
);
2229 case BINDER_WORK_NODE
: {
2230 struct binder_node
*node
= container_of(w
, struct binder_node
, work
);
2231 uint32_t cmd
= BR_NOOP
;
2232 const char *cmd_name
;
2233 int strong
= node
->internal_strong_refs
|| node
->local_strong_refs
;
2234 int weak
= !hlist_empty(&node
->refs
) || node
->local_weak_refs
|| strong
;
2235 if (weak
&& !node
->has_weak_ref
) {
2237 cmd_name
= "BR_INCREFS";
2238 node
->has_weak_ref
= 1;
2239 node
->pending_weak_ref
= 1;
2240 node
->local_weak_refs
++;
2241 } else if (strong
&& !node
->has_strong_ref
) {
2243 cmd_name
= "BR_ACQUIRE";
2244 node
->has_strong_ref
= 1;
2245 node
->pending_strong_ref
= 1;
2246 node
->local_strong_refs
++;
2247 } else if (!strong
&& node
->has_strong_ref
) {
2249 cmd_name
= "BR_RELEASE";
2250 node
->has_strong_ref
= 0;
2251 } else if (!weak
&& node
->has_weak_ref
) {
2253 cmd_name
= "BR_DECREFS";
2254 node
->has_weak_ref
= 0;
2256 if (cmd
!= BR_NOOP
) {
2257 if (put_user(cmd
, (uint32_t __user
*)ptr
))
2259 ptr
+= sizeof(uint32_t);
2260 if (put_user(node
->ptr
, (void * __user
*)ptr
))
2262 ptr
+= sizeof(void *);
2263 if (put_user(node
->cookie
, (void * __user
*)ptr
))
2265 ptr
+= sizeof(void *);
2267 binder_stat_br(proc
, thread
, cmd
);
2268 binder_debug(BINDER_DEBUG_USER_REFS
,
2269 "%d:%d %s %d u%p c%p\n",
2270 proc
->pid
, thread
->pid
, cmd_name
, node
->debug_id
, node
->ptr
, node
->cookie
);
2272 list_del_init(&w
->entry
);
2273 if (!weak
&& !strong
) {
2274 binder_debug(BINDER_DEBUG_INTERNAL_REFS
,
2275 "%d:%d node %d u%p c%p deleted\n",
2276 proc
->pid
, thread
->pid
, node
->debug_id
,
2277 node
->ptr
, node
->cookie
);
2278 rb_erase(&node
->rb_node
, &proc
->nodes
);
2280 binder_stats_deleted(BINDER_STAT_NODE
);
2282 binder_debug(BINDER_DEBUG_INTERNAL_REFS
,
2283 "%d:%d node %d u%p c%p state unchanged\n",
2284 proc
->pid
, thread
->pid
, node
->debug_id
, node
->ptr
,
2289 case BINDER_WORK_DEAD_BINDER
:
2290 case BINDER_WORK_DEAD_BINDER_AND_CLEAR
:
2291 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION
: {
2292 struct binder_ref_death
*death
;
2295 death
= container_of(w
, struct binder_ref_death
, work
);
2296 if (w
->type
== BINDER_WORK_CLEAR_DEATH_NOTIFICATION
)
2297 cmd
= BR_CLEAR_DEATH_NOTIFICATION_DONE
;
2299 cmd
= BR_DEAD_BINDER
;
2300 if (put_user(cmd
, (uint32_t __user
*)ptr
))
2302 ptr
+= sizeof(uint32_t);
2303 if (put_user(death
->cookie
, (void * __user
*)ptr
))
2305 ptr
+= sizeof(void *);
2306 binder_stat_br(proc
, thread
, cmd
);
2307 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION
,
2309 proc
->pid
, thread
->pid
,
2310 cmd
== BR_DEAD_BINDER
?
2312 "BR_CLEAR_DEATH_NOTIFICATION_DONE",
2315 if (w
->type
== BINDER_WORK_CLEAR_DEATH_NOTIFICATION
) {
2316 list_del(&w
->entry
);
2318 binder_stats_deleted(BINDER_STAT_DEATH
);
2320 list_move(&w
->entry
, &proc
->delivered_death
);
2321 if (cmd
== BR_DEAD_BINDER
)
2322 goto done
; /* DEAD_BINDER notifications can cause transactions */
2329 BUG_ON(t
->buffer
== NULL
);
2330 if (t
->buffer
->target_node
) {
2331 struct binder_node
*target_node
= t
->buffer
->target_node
;
2332 tr
.target
.ptr
= target_node
->ptr
;
2333 tr
.cookie
= target_node
->cookie
;
2334 t
->saved_priority
= task_nice(current
);
2335 if (t
->priority
< target_node
->min_priority
&&
2336 !(t
->flags
& TF_ONE_WAY
))
2337 binder_set_nice(t
->priority
);
2338 else if (!(t
->flags
& TF_ONE_WAY
) ||
2339 t
->saved_priority
> target_node
->min_priority
)
2340 binder_set_nice(target_node
->min_priority
);
2341 cmd
= BR_TRANSACTION
;
2343 tr
.target
.ptr
= NULL
;
2348 tr
.flags
= t
->flags
;
2349 tr
.sender_euid
= from_kuid(current_user_ns(), t
->sender_euid
);
2352 struct task_struct
*sender
= t
->from
->proc
->tsk
;
2353 tr
.sender_pid
= task_tgid_nr_ns(sender
,
2354 task_active_pid_ns(current
));
2359 tr
.data_size
= t
->buffer
->data_size
;
2360 tr
.offsets_size
= t
->buffer
->offsets_size
;
2361 tr
.data
.ptr
.buffer
= (void *)t
->buffer
->data
+
2362 proc
->user_buffer_offset
;
2363 tr
.data
.ptr
.offsets
= tr
.data
.ptr
.buffer
+
2364 ALIGN(t
->buffer
->data_size
,
2367 if (put_user(cmd
, (uint32_t __user
*)ptr
))
2369 ptr
+= sizeof(uint32_t);
2370 if (copy_to_user(ptr
, &tr
, sizeof(tr
)))
2374 trace_binder_transaction_received(t
);
2375 binder_stat_br(proc
, thread
, cmd
);
2376 binder_debug(BINDER_DEBUG_TRANSACTION
,
2377 "%d:%d %s %d %d:%d, cmd %d size %zd-%zd ptr %p-%p\n",
2378 proc
->pid
, thread
->pid
,
2379 (cmd
== BR_TRANSACTION
) ? "BR_TRANSACTION" :
2381 t
->debug_id
, t
->from
? t
->from
->proc
->pid
: 0,
2382 t
->from
? t
->from
->pid
: 0, cmd
,
2383 t
->buffer
->data_size
, t
->buffer
->offsets_size
,
2384 tr
.data
.ptr
.buffer
, tr
.data
.ptr
.offsets
);
2386 list_del(&t
->work
.entry
);
2387 t
->buffer
->allow_user_free
= 1;
2388 if (cmd
== BR_TRANSACTION
&& !(t
->flags
& TF_ONE_WAY
)) {
2389 t
->to_parent
= thread
->transaction_stack
;
2390 t
->to_thread
= thread
;
2391 thread
->transaction_stack
= t
;
2393 t
->buffer
->transaction
= NULL
;
2395 binder_stats_deleted(BINDER_STAT_TRANSACTION
);
2402 *consumed
= ptr
- buffer
;
2403 if (proc
->requested_threads
+ proc
->ready_threads
== 0 &&
2404 proc
->requested_threads_started
< proc
->max_threads
&&
2405 (thread
->looper
& (BINDER_LOOPER_STATE_REGISTERED
|
2406 BINDER_LOOPER_STATE_ENTERED
)) /* the user-space code fails to */
2407 /*spawn a new thread if we leave this out */) {
2408 proc
->requested_threads
++;
2409 binder_debug(BINDER_DEBUG_THREADS
,
2410 "%d:%d BR_SPAWN_LOOPER\n",
2411 proc
->pid
, thread
->pid
);
2412 if (put_user(BR_SPAWN_LOOPER
, (uint32_t __user
*)buffer
))
2414 binder_stat_br(proc
, thread
, BR_SPAWN_LOOPER
);
2419 static void binder_release_work(struct list_head
*list
)
2421 struct binder_work
*w
;
2422 while (!list_empty(list
)) {
2423 w
= list_first_entry(list
, struct binder_work
, entry
);
2424 list_del_init(&w
->entry
);
2426 case BINDER_WORK_TRANSACTION
: {
2427 struct binder_transaction
*t
;
2429 t
= container_of(w
, struct binder_transaction
, work
);
2430 if (t
->buffer
->target_node
&&
2431 !(t
->flags
& TF_ONE_WAY
)) {
2432 binder_send_failed_reply(t
, BR_DEAD_REPLY
);
2434 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION
,
2435 "undelivered transaction %d\n",
2437 t
->buffer
->transaction
= NULL
;
2439 binder_stats_deleted(BINDER_STAT_TRANSACTION
);
2442 case BINDER_WORK_TRANSACTION_COMPLETE
: {
2443 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION
,
2444 "undelivered TRANSACTION_COMPLETE\n");
2446 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE
);
2448 case BINDER_WORK_DEAD_BINDER_AND_CLEAR
:
2449 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION
: {
2450 struct binder_ref_death
*death
;
2452 death
= container_of(w
, struct binder_ref_death
, work
);
2453 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION
,
2454 "undelivered death notification, %p\n",
2457 binder_stats_deleted(BINDER_STAT_DEATH
);
2460 pr_err("unexpected work type, %d, not freed\n",
2468 static struct binder_thread
*binder_get_thread(struct binder_proc
*proc
)
2470 struct binder_thread
*thread
= NULL
;
2471 struct rb_node
*parent
= NULL
;
2472 struct rb_node
**p
= &proc
->threads
.rb_node
;
2476 thread
= rb_entry(parent
, struct binder_thread
, rb_node
);
2478 if (current
->pid
< thread
->pid
)
2480 else if (current
->pid
> thread
->pid
)
2481 p
= &(*p
)->rb_right
;
2486 thread
= kzalloc(sizeof(*thread
), GFP_KERNEL
);
2489 binder_stats_created(BINDER_STAT_THREAD
);
2490 thread
->proc
= proc
;
2491 thread
->pid
= current
->pid
;
2492 init_waitqueue_head(&thread
->wait
);
2493 INIT_LIST_HEAD(&thread
->todo
);
2494 rb_link_node(&thread
->rb_node
, parent
, p
);
2495 rb_insert_color(&thread
->rb_node
, &proc
->threads
);
2496 thread
->looper
|= BINDER_LOOPER_STATE_NEED_RETURN
;
2497 thread
->return_error
= BR_OK
;
2498 thread
->return_error2
= BR_OK
;
2503 static int binder_free_thread(struct binder_proc
*proc
,
2504 struct binder_thread
*thread
)
2506 struct binder_transaction
*t
;
2507 struct binder_transaction
*send_reply
= NULL
;
2508 int active_transactions
= 0;
2510 rb_erase(&thread
->rb_node
, &proc
->threads
);
2511 t
= thread
->transaction_stack
;
2512 if (t
&& t
->to_thread
== thread
)
2515 active_transactions
++;
2516 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION
,
2517 "release %d:%d transaction %d %s, still active\n",
2518 proc
->pid
, thread
->pid
,
2520 (t
->to_thread
== thread
) ? "in" : "out");
2522 if (t
->to_thread
== thread
) {
2524 t
->to_thread
= NULL
;
2526 t
->buffer
->transaction
= NULL
;
2530 } else if (t
->from
== thread
) {
2537 binder_send_failed_reply(send_reply
, BR_DEAD_REPLY
);
2538 binder_release_work(&thread
->todo
);
2540 binder_stats_deleted(BINDER_STAT_THREAD
);
2541 return active_transactions
;
2544 static unsigned int binder_poll(struct file
*filp
,
2545 struct poll_table_struct
*wait
)
2547 struct binder_proc
*proc
= filp
->private_data
;
2548 struct binder_thread
*thread
= NULL
;
2549 int wait_for_proc_work
;
2551 binder_lock(__func__
);
2553 thread
= binder_get_thread(proc
);
2555 wait_for_proc_work
= thread
->transaction_stack
== NULL
&&
2556 list_empty(&thread
->todo
) && thread
->return_error
== BR_OK
;
2558 binder_unlock(__func__
);
2560 if (wait_for_proc_work
) {
2561 if (binder_has_proc_work(proc
, thread
))
2563 poll_wait(filp
, &proc
->wait
, wait
);
2564 if (binder_has_proc_work(proc
, thread
))
2567 if (binder_has_thread_work(thread
))
2569 poll_wait(filp
, &thread
->wait
, wait
);
2570 if (binder_has_thread_work(thread
))
2576 static long binder_ioctl(struct file
*filp
, unsigned int cmd
, unsigned long arg
)
2579 struct binder_proc
*proc
= filp
->private_data
;
2580 struct binder_thread
*thread
;
2581 unsigned int size
= _IOC_SIZE(cmd
);
2582 void __user
*ubuf
= (void __user
*)arg
;
2584 /*pr_info("binder_ioctl: %d:%d %x %lx\n", proc->pid, current->pid, cmd, arg);*/
2586 trace_binder_ioctl(cmd
, arg
);
2588 ret
= wait_event_interruptible(binder_user_error_wait
, binder_stop_on_user_error
< 2);
2592 binder_lock(__func__
);
2593 thread
= binder_get_thread(proc
);
2594 if (thread
== NULL
) {
2600 case BINDER_WRITE_READ
: {
2601 struct binder_write_read bwr
;
2602 if (size
!= sizeof(struct binder_write_read
)) {
2606 if (copy_from_user(&bwr
, ubuf
, sizeof(bwr
))) {
2610 binder_debug(BINDER_DEBUG_READ_WRITE
,
2611 "%d:%d write %zd at %016lx, read %zd at %016lx\n",
2612 proc
->pid
, thread
->pid
, bwr
.write_size
,
2613 bwr
.write_buffer
, bwr
.read_size
, bwr
.read_buffer
);
2615 if (bwr
.write_size
> 0) {
2616 ret
= binder_thread_write(proc
, thread
, (void __user
*)bwr
.write_buffer
, bwr
.write_size
, &bwr
.write_consumed
);
2617 trace_binder_write_done(ret
);
2619 bwr
.read_consumed
= 0;
2620 if (copy_to_user(ubuf
, &bwr
, sizeof(bwr
)))
2625 if (bwr
.read_size
> 0) {
2626 ret
= binder_thread_read(proc
, thread
, (void __user
*)bwr
.read_buffer
, bwr
.read_size
, &bwr
.read_consumed
, filp
->f_flags
& O_NONBLOCK
);
2627 trace_binder_read_done(ret
);
2628 if (!list_empty(&proc
->todo
))
2629 wake_up_interruptible(&proc
->wait
);
2631 if (copy_to_user(ubuf
, &bwr
, sizeof(bwr
)))
2636 binder_debug(BINDER_DEBUG_READ_WRITE
,
2637 "%d:%d wrote %zd of %zd, read return %zd of %zd\n",
2638 proc
->pid
, thread
->pid
, bwr
.write_consumed
, bwr
.write_size
,
2639 bwr
.read_consumed
, bwr
.read_size
);
2640 if (copy_to_user(ubuf
, &bwr
, sizeof(bwr
))) {
2646 case BINDER_SET_MAX_THREADS
:
2647 if (copy_from_user(&proc
->max_threads
, ubuf
, sizeof(proc
->max_threads
))) {
2652 case BINDER_SET_CONTEXT_MGR
:
2653 if (binder_context_mgr_node
!= NULL
) {
2654 pr_err("BINDER_SET_CONTEXT_MGR already set\n");
2658 ret
= security_binder_set_context_mgr(proc
->tsk
);
2661 if (uid_valid(binder_context_mgr_uid
)) {
2662 if (!uid_eq(binder_context_mgr_uid
, current
->cred
->euid
)) {
2663 pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n",
2664 from_kuid(&init_user_ns
, current
->cred
->euid
),
2665 from_kuid(&init_user_ns
, binder_context_mgr_uid
));
2670 binder_context_mgr_uid
= current
->cred
->euid
;
2671 binder_context_mgr_node
= binder_new_node(proc
, NULL
, NULL
);
2672 if (binder_context_mgr_node
== NULL
) {
2676 binder_context_mgr_node
->local_weak_refs
++;
2677 binder_context_mgr_node
->local_strong_refs
++;
2678 binder_context_mgr_node
->has_strong_ref
= 1;
2679 binder_context_mgr_node
->has_weak_ref
= 1;
2681 case BINDER_THREAD_EXIT
:
2682 binder_debug(BINDER_DEBUG_THREADS
, "%d:%d exit\n",
2683 proc
->pid
, thread
->pid
);
2684 binder_free_thread(proc
, thread
);
2687 case BINDER_VERSION
:
2688 if (size
!= sizeof(struct binder_version
)) {
2692 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION
, &((struct binder_version
*)ubuf
)->protocol_version
)) {
2704 thread
->looper
&= ~BINDER_LOOPER_STATE_NEED_RETURN
;
2705 binder_unlock(__func__
);
2706 wait_event_interruptible(binder_user_error_wait
, binder_stop_on_user_error
< 2);
2707 if (ret
&& ret
!= -ERESTARTSYS
)
2708 pr_info("%d:%d ioctl %x %lx returned %d\n", proc
->pid
, current
->pid
, cmd
, arg
, ret
);
2710 trace_binder_ioctl_done(ret
);
2714 static void binder_vma_open(struct vm_area_struct
*vma
)
2716 struct binder_proc
*proc
= vma
->vm_private_data
;
2717 binder_debug(BINDER_DEBUG_OPEN_CLOSE
,
2718 "%d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
2719 proc
->pid
, vma
->vm_start
, vma
->vm_end
,
2720 (vma
->vm_end
- vma
->vm_start
) / SZ_1K
, vma
->vm_flags
,
2721 (unsigned long)pgprot_val(vma
->vm_page_prot
));
2724 static void binder_vma_close(struct vm_area_struct
*vma
)
2726 struct binder_proc
*proc
= vma
->vm_private_data
;
2727 binder_debug(BINDER_DEBUG_OPEN_CLOSE
,
2728 "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
2729 proc
->pid
, vma
->vm_start
, vma
->vm_end
,
2730 (vma
->vm_end
- vma
->vm_start
) / SZ_1K
, vma
->vm_flags
,
2731 (unsigned long)pgprot_val(vma
->vm_page_prot
));
2733 proc
->vma_vm_mm
= NULL
;
2734 binder_defer_work(proc
, BINDER_DEFERRED_PUT_FILES
);
2737 static int binder_vm_fault(struct vm_area_struct
*vma
, struct vm_fault
*vmf
)
2739 return VM_FAULT_SIGBUS
;
2742 static struct vm_operations_struct binder_vm_ops
= {
2743 .open
= binder_vma_open
,
2744 .close
= binder_vma_close
,
2745 .fault
= binder_vm_fault
,
2748 static int binder_mmap(struct file
*filp
, struct vm_area_struct
*vma
)
2751 struct vm_struct
*area
;
2752 struct binder_proc
*proc
= filp
->private_data
;
2753 const char *failure_string
;
2754 struct binder_buffer
*buffer
;
2756 if (proc
->tsk
!= current
)
2759 if ((vma
->vm_end
- vma
->vm_start
) > SZ_4M
)
2760 vma
->vm_end
= vma
->vm_start
+ SZ_4M
;
2762 binder_debug(BINDER_DEBUG_OPEN_CLOSE
,
2763 "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n",
2764 proc
->pid
, vma
->vm_start
, vma
->vm_end
,
2765 (vma
->vm_end
- vma
->vm_start
) / SZ_1K
, vma
->vm_flags
,
2766 (unsigned long)pgprot_val(vma
->vm_page_prot
));
2768 if (vma
->vm_flags
& FORBIDDEN_MMAP_FLAGS
) {
2770 failure_string
= "bad vm_flags";
2773 vma
->vm_flags
= (vma
->vm_flags
| VM_DONTCOPY
) & ~VM_MAYWRITE
;
2775 mutex_lock(&binder_mmap_lock
);
2778 failure_string
= "already mapped";
2779 goto err_already_mapped
;
2782 area
= get_vm_area(vma
->vm_end
- vma
->vm_start
, VM_IOREMAP
);
2785 failure_string
= "get_vm_area";
2786 goto err_get_vm_area_failed
;
2788 proc
->buffer
= area
->addr
;
2789 proc
->user_buffer_offset
= vma
->vm_start
- (uintptr_t)proc
->buffer
;
2790 mutex_unlock(&binder_mmap_lock
);
2792 #ifdef CONFIG_CPU_CACHE_VIPT
2793 if (cache_is_vipt_aliasing()) {
2794 while (CACHE_COLOUR((vma
->vm_start
^ (uint32_t)proc
->buffer
))) {
2795 pr_info("binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc
->pid
, vma
->vm_start
, vma
->vm_end
, proc
->buffer
);
2796 vma
->vm_start
+= PAGE_SIZE
;
2800 proc
->pages
= kzalloc(sizeof(proc
->pages
[0]) * ((vma
->vm_end
- vma
->vm_start
) / PAGE_SIZE
), GFP_KERNEL
);
2801 if (proc
->pages
== NULL
) {
2803 failure_string
= "alloc page array";
2804 goto err_alloc_pages_failed
;
2806 proc
->buffer_size
= vma
->vm_end
- vma
->vm_start
;
2808 vma
->vm_ops
= &binder_vm_ops
;
2809 vma
->vm_private_data
= proc
;
2811 if (binder_update_page_range(proc
, 1, proc
->buffer
, proc
->buffer
+ PAGE_SIZE
, vma
)) {
2813 failure_string
= "alloc small buf";
2814 goto err_alloc_small_buf_failed
;
2816 buffer
= proc
->buffer
;
2817 INIT_LIST_HEAD(&proc
->buffers
);
2818 list_add(&buffer
->entry
, &proc
->buffers
);
2820 binder_insert_free_buffer(proc
, buffer
);
2821 proc
->free_async_space
= proc
->buffer_size
/ 2;
2823 proc
->files
= get_files_struct(current
);
2825 proc
->vma_vm_mm
= vma
->vm_mm
;
2827 /*pr_info("binder_mmap: %d %lx-%lx maps %p\n",
2828 proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/
2831 err_alloc_small_buf_failed
:
2834 err_alloc_pages_failed
:
2835 mutex_lock(&binder_mmap_lock
);
2836 vfree(proc
->buffer
);
2837 proc
->buffer
= NULL
;
2838 err_get_vm_area_failed
:
2840 mutex_unlock(&binder_mmap_lock
);
2842 pr_err("binder_mmap: %d %lx-%lx %s failed %d\n",
2843 proc
->pid
, vma
->vm_start
, vma
->vm_end
, failure_string
, ret
);
2847 static int binder_open(struct inode
*nodp
, struct file
*filp
)
2849 struct binder_proc
*proc
;
2851 binder_debug(BINDER_DEBUG_OPEN_CLOSE
, "binder_open: %d:%d\n",
2852 current
->group_leader
->pid
, current
->pid
);
2854 proc
= kzalloc(sizeof(*proc
), GFP_KERNEL
);
2857 get_task_struct(current
);
2858 proc
->tsk
= current
;
2859 INIT_LIST_HEAD(&proc
->todo
);
2860 init_waitqueue_head(&proc
->wait
);
2861 proc
->default_priority
= task_nice(current
);
2863 binder_lock(__func__
);
2865 binder_stats_created(BINDER_STAT_PROC
);
2866 hlist_add_head(&proc
->proc_node
, &binder_procs
);
2867 proc
->pid
= current
->group_leader
->pid
;
2868 INIT_LIST_HEAD(&proc
->delivered_death
);
2869 filp
->private_data
= proc
;
2871 binder_unlock(__func__
);
2873 if (binder_debugfs_dir_entry_proc
) {
2875 snprintf(strbuf
, sizeof(strbuf
), "%u", proc
->pid
);
2876 proc
->debugfs_entry
= debugfs_create_file(strbuf
, S_IRUGO
,
2877 binder_debugfs_dir_entry_proc
, proc
, &binder_proc_fops
);
2883 static int binder_flush(struct file
*filp
, fl_owner_t id
)
2885 struct binder_proc
*proc
= filp
->private_data
;
2887 binder_defer_work(proc
, BINDER_DEFERRED_FLUSH
);
2892 static void binder_deferred_flush(struct binder_proc
*proc
)
2896 for (n
= rb_first(&proc
->threads
); n
!= NULL
; n
= rb_next(n
)) {
2897 struct binder_thread
*thread
= rb_entry(n
, struct binder_thread
, rb_node
);
2898 thread
->looper
|= BINDER_LOOPER_STATE_NEED_RETURN
;
2899 if (thread
->looper
& BINDER_LOOPER_STATE_WAITING
) {
2900 wake_up_interruptible(&thread
->wait
);
2904 wake_up_interruptible_all(&proc
->wait
);
2906 binder_debug(BINDER_DEBUG_OPEN_CLOSE
,
2907 "binder_flush: %d woke %d threads\n", proc
->pid
,
2911 static int binder_release(struct inode
*nodp
, struct file
*filp
)
2913 struct binder_proc
*proc
= filp
->private_data
;
2914 debugfs_remove(proc
->debugfs_entry
);
2915 binder_defer_work(proc
, BINDER_DEFERRED_RELEASE
);
2920 static int binder_node_release(struct binder_node
*node
, int refs
)
2922 struct binder_ref
*ref
;
2925 list_del_init(&node
->work
.entry
);
2926 binder_release_work(&node
->async_todo
);
2928 if (hlist_empty(&node
->refs
)) {
2930 binder_stats_deleted(BINDER_STAT_NODE
);
2936 node
->local_strong_refs
= 0;
2937 node
->local_weak_refs
= 0;
2938 hlist_add_head(&node
->dead_node
, &binder_dead_nodes
);
2940 hlist_for_each_entry(ref
, &node
->refs
, node_entry
) {
2948 if (list_empty(&ref
->death
->work
.entry
)) {
2949 ref
->death
->work
.type
= BINDER_WORK_DEAD_BINDER
;
2950 list_add_tail(&ref
->death
->work
.entry
,
2952 wake_up_interruptible(&ref
->proc
->wait
);
2957 binder_debug(BINDER_DEBUG_DEAD_BINDER
,
2958 "node %d now dead, refs %d, death %d\n",
2959 node
->debug_id
, refs
, death
);
2964 static void binder_deferred_release(struct binder_proc
*proc
)
2966 struct binder_transaction
*t
;
2968 int threads
, nodes
, incoming_refs
, outgoing_refs
, buffers
,
2969 active_transactions
, page_count
;
2972 BUG_ON(proc
->files
);
2974 hlist_del(&proc
->proc_node
);
2976 if (binder_context_mgr_node
&& binder_context_mgr_node
->proc
== proc
) {
2977 binder_debug(BINDER_DEBUG_DEAD_BINDER
,
2978 "%s: %d context_mgr_node gone\n",
2979 __func__
, proc
->pid
);
2980 binder_context_mgr_node
= NULL
;
2984 active_transactions
= 0;
2985 while ((n
= rb_first(&proc
->threads
))) {
2986 struct binder_thread
*thread
;
2988 thread
= rb_entry(n
, struct binder_thread
, rb_node
);
2990 active_transactions
+= binder_free_thread(proc
, thread
);
2995 while ((n
= rb_first(&proc
->nodes
))) {
2996 struct binder_node
*node
;
2998 node
= rb_entry(n
, struct binder_node
, rb_node
);
3000 rb_erase(&node
->rb_node
, &proc
->nodes
);
3001 incoming_refs
= binder_node_release(node
, incoming_refs
);
3005 while ((n
= rb_first(&proc
->refs_by_desc
))) {
3006 struct binder_ref
*ref
;
3008 ref
= rb_entry(n
, struct binder_ref
, rb_node_desc
);
3010 binder_delete_ref(ref
);
3013 binder_release_work(&proc
->todo
);
3014 binder_release_work(&proc
->delivered_death
);
3017 while ((n
= rb_first(&proc
->allocated_buffers
))) {
3018 struct binder_buffer
*buffer
;
3020 buffer
= rb_entry(n
, struct binder_buffer
, rb_node
);
3022 t
= buffer
->transaction
;
3025 buffer
->transaction
= NULL
;
3026 pr_err("release proc %d, transaction %d, not freed\n",
3027 proc
->pid
, t
->debug_id
);
3031 binder_free_buf(proc
, buffer
);
3035 binder_stats_deleted(BINDER_STAT_PROC
);
3041 for (i
= 0; i
< proc
->buffer_size
/ PAGE_SIZE
; i
++) {
3044 if (!proc
->pages
[i
])
3047 page_addr
= proc
->buffer
+ i
* PAGE_SIZE
;
3048 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
3049 "%s: %d: page %d at %p not freed\n",
3050 __func__
, proc
->pid
, i
, page_addr
);
3051 unmap_kernel_range((unsigned long)page_addr
, PAGE_SIZE
);
3052 __free_page(proc
->pages
[i
]);
3056 vfree(proc
->buffer
);
3059 put_task_struct(proc
->tsk
);
3061 binder_debug(BINDER_DEBUG_OPEN_CLOSE
,
3062 "%s: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d, buffers %d, pages %d\n",
3063 __func__
, proc
->pid
, threads
, nodes
, incoming_refs
,
3064 outgoing_refs
, active_transactions
, buffers
, page_count
);
3069 static void binder_deferred_func(struct work_struct
*work
)
3071 struct binder_proc
*proc
;
3072 struct files_struct
*files
;
3076 binder_lock(__func__
);
3077 mutex_lock(&binder_deferred_lock
);
3078 if (!hlist_empty(&binder_deferred_list
)) {
3079 proc
= hlist_entry(binder_deferred_list
.first
,
3080 struct binder_proc
, deferred_work_node
);
3081 hlist_del_init(&proc
->deferred_work_node
);
3082 defer
= proc
->deferred_work
;
3083 proc
->deferred_work
= 0;
3088 mutex_unlock(&binder_deferred_lock
);
3091 if (defer
& BINDER_DEFERRED_PUT_FILES
) {
3092 files
= proc
->files
;
3097 if (defer
& BINDER_DEFERRED_FLUSH
)
3098 binder_deferred_flush(proc
);
3100 if (defer
& BINDER_DEFERRED_RELEASE
)
3101 binder_deferred_release(proc
); /* frees proc */
3103 binder_unlock(__func__
);
3105 put_files_struct(files
);
3108 static DECLARE_WORK(binder_deferred_work
, binder_deferred_func
);
3111 binder_defer_work(struct binder_proc
*proc
, enum binder_deferred_state defer
)
3113 mutex_lock(&binder_deferred_lock
);
3114 proc
->deferred_work
|= defer
;
3115 if (hlist_unhashed(&proc
->deferred_work_node
)) {
3116 hlist_add_head(&proc
->deferred_work_node
,
3117 &binder_deferred_list
);
3118 queue_work(binder_deferred_workqueue
, &binder_deferred_work
);
3120 mutex_unlock(&binder_deferred_lock
);
3123 static void print_binder_transaction(struct seq_file
*m
, const char *prefix
,
3124 struct binder_transaction
*t
)
3127 "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d",
3128 prefix
, t
->debug_id
, t
,
3129 t
->from
? t
->from
->proc
->pid
: 0,
3130 t
->from
? t
->from
->pid
: 0,
3131 t
->to_proc
? t
->to_proc
->pid
: 0,
3132 t
->to_thread
? t
->to_thread
->pid
: 0,
3133 t
->code
, t
->flags
, t
->priority
, t
->need_reply
);
3134 if (t
->buffer
== NULL
) {
3135 seq_puts(m
, " buffer free\n");
3138 if (t
->buffer
->target_node
)
3139 seq_printf(m
, " node %d",
3140 t
->buffer
->target_node
->debug_id
);
3141 seq_printf(m
, " size %zd:%zd data %p\n",
3142 t
->buffer
->data_size
, t
->buffer
->offsets_size
,
3146 static void print_binder_buffer(struct seq_file
*m
, const char *prefix
,
3147 struct binder_buffer
*buffer
)
3149 seq_printf(m
, "%s %d: %p size %zd:%zd %s\n",
3150 prefix
, buffer
->debug_id
, buffer
->data
,
3151 buffer
->data_size
, buffer
->offsets_size
,
3152 buffer
->transaction
? "active" : "delivered");
3155 static void print_binder_work(struct seq_file
*m
, const char *prefix
,
3156 const char *transaction_prefix
,
3157 struct binder_work
*w
)
3159 struct binder_node
*node
;
3160 struct binder_transaction
*t
;
3163 case BINDER_WORK_TRANSACTION
:
3164 t
= container_of(w
, struct binder_transaction
, work
);
3165 print_binder_transaction(m
, transaction_prefix
, t
);
3167 case BINDER_WORK_TRANSACTION_COMPLETE
:
3168 seq_printf(m
, "%stransaction complete\n", prefix
);
3170 case BINDER_WORK_NODE
:
3171 node
= container_of(w
, struct binder_node
, work
);
3172 seq_printf(m
, "%snode work %d: u%p c%p\n",
3173 prefix
, node
->debug_id
, node
->ptr
, node
->cookie
);
3175 case BINDER_WORK_DEAD_BINDER
:
3176 seq_printf(m
, "%shas dead binder\n", prefix
);
3178 case BINDER_WORK_DEAD_BINDER_AND_CLEAR
:
3179 seq_printf(m
, "%shas cleared dead binder\n", prefix
);
3181 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION
:
3182 seq_printf(m
, "%shas cleared death notification\n", prefix
);
3185 seq_printf(m
, "%sunknown work: type %d\n", prefix
, w
->type
);
3190 static void print_binder_thread(struct seq_file
*m
,
3191 struct binder_thread
*thread
,
3194 struct binder_transaction
*t
;
3195 struct binder_work
*w
;
3196 size_t start_pos
= m
->count
;
3199 seq_printf(m
, " thread %d: l %02x\n", thread
->pid
, thread
->looper
);
3200 header_pos
= m
->count
;
3201 t
= thread
->transaction_stack
;
3203 if (t
->from
== thread
) {
3204 print_binder_transaction(m
,
3205 " outgoing transaction", t
);
3207 } else if (t
->to_thread
== thread
) {
3208 print_binder_transaction(m
,
3209 " incoming transaction", t
);
3212 print_binder_transaction(m
, " bad transaction", t
);
3216 list_for_each_entry(w
, &thread
->todo
, entry
) {
3217 print_binder_work(m
, " ", " pending transaction", w
);
3219 if (!print_always
&& m
->count
== header_pos
)
3220 m
->count
= start_pos
;
3223 static void print_binder_node(struct seq_file
*m
, struct binder_node
*node
)
3225 struct binder_ref
*ref
;
3226 struct binder_work
*w
;
3230 hlist_for_each_entry(ref
, &node
->refs
, node_entry
)
3233 seq_printf(m
, " node %d: u%p c%p hs %d hw %d ls %d lw %d is %d iw %d",
3234 node
->debug_id
, node
->ptr
, node
->cookie
,
3235 node
->has_strong_ref
, node
->has_weak_ref
,
3236 node
->local_strong_refs
, node
->local_weak_refs
,
3237 node
->internal_strong_refs
, count
);
3239 seq_puts(m
, " proc");
3240 hlist_for_each_entry(ref
, &node
->refs
, node_entry
)
3241 seq_printf(m
, " %d", ref
->proc
->pid
);
3244 list_for_each_entry(w
, &node
->async_todo
, entry
)
3245 print_binder_work(m
, " ",
3246 " pending async transaction", w
);
3249 static void print_binder_ref(struct seq_file
*m
, struct binder_ref
*ref
)
3251 seq_printf(m
, " ref %d: desc %d %snode %d s %d w %d d %p\n",
3252 ref
->debug_id
, ref
->desc
, ref
->node
->proc
? "" : "dead ",
3253 ref
->node
->debug_id
, ref
->strong
, ref
->weak
, ref
->death
);
3256 static void print_binder_proc(struct seq_file
*m
,
3257 struct binder_proc
*proc
, int print_all
)
3259 struct binder_work
*w
;
3261 size_t start_pos
= m
->count
;
3264 seq_printf(m
, "proc %d\n", proc
->pid
);
3265 header_pos
= m
->count
;
3267 for (n
= rb_first(&proc
->threads
); n
!= NULL
; n
= rb_next(n
))
3268 print_binder_thread(m
, rb_entry(n
, struct binder_thread
,
3269 rb_node
), print_all
);
3270 for (n
= rb_first(&proc
->nodes
); n
!= NULL
; n
= rb_next(n
)) {
3271 struct binder_node
*node
= rb_entry(n
, struct binder_node
,
3273 if (print_all
|| node
->has_async_transaction
)
3274 print_binder_node(m
, node
);
3277 for (n
= rb_first(&proc
->refs_by_desc
);
3280 print_binder_ref(m
, rb_entry(n
, struct binder_ref
,
3283 for (n
= rb_first(&proc
->allocated_buffers
); n
!= NULL
; n
= rb_next(n
))
3284 print_binder_buffer(m
, " buffer",
3285 rb_entry(n
, struct binder_buffer
, rb_node
));
3286 list_for_each_entry(w
, &proc
->todo
, entry
)
3287 print_binder_work(m
, " ", " pending transaction", w
);
3288 list_for_each_entry(w
, &proc
->delivered_death
, entry
) {
3289 seq_puts(m
, " has delivered dead binder\n");
3292 if (!print_all
&& m
->count
== header_pos
)
3293 m
->count
= start_pos
;
3296 static const char * const binder_return_strings
[] = {
3301 "BR_ACQUIRE_RESULT",
3303 "BR_TRANSACTION_COMPLETE",
3308 "BR_ATTEMPT_ACQUIRE",
3313 "BR_CLEAR_DEATH_NOTIFICATION_DONE",
3317 static const char * const binder_command_strings
[] = {
3320 "BC_ACQUIRE_RESULT",
3328 "BC_ATTEMPT_ACQUIRE",
3329 "BC_REGISTER_LOOPER",
3332 "BC_REQUEST_DEATH_NOTIFICATION",
3333 "BC_CLEAR_DEATH_NOTIFICATION",
3334 "BC_DEAD_BINDER_DONE"
3337 static const char * const binder_objstat_strings
[] = {
3344 "transaction_complete"
3347 static void print_binder_stats(struct seq_file
*m
, const char *prefix
,
3348 struct binder_stats
*stats
)
3352 BUILD_BUG_ON(ARRAY_SIZE(stats
->bc
) !=
3353 ARRAY_SIZE(binder_command_strings
));
3354 for (i
= 0; i
< ARRAY_SIZE(stats
->bc
); i
++) {
3356 seq_printf(m
, "%s%s: %d\n", prefix
,
3357 binder_command_strings
[i
], stats
->bc
[i
]);
3360 BUILD_BUG_ON(ARRAY_SIZE(stats
->br
) !=
3361 ARRAY_SIZE(binder_return_strings
));
3362 for (i
= 0; i
< ARRAY_SIZE(stats
->br
); i
++) {
3364 seq_printf(m
, "%s%s: %d\n", prefix
,
3365 binder_return_strings
[i
], stats
->br
[i
]);
3368 BUILD_BUG_ON(ARRAY_SIZE(stats
->obj_created
) !=
3369 ARRAY_SIZE(binder_objstat_strings
));
3370 BUILD_BUG_ON(ARRAY_SIZE(stats
->obj_created
) !=
3371 ARRAY_SIZE(stats
->obj_deleted
));
3372 for (i
= 0; i
< ARRAY_SIZE(stats
->obj_created
); i
++) {
3373 if (stats
->obj_created
[i
] || stats
->obj_deleted
[i
])
3374 seq_printf(m
, "%s%s: active %d total %d\n", prefix
,
3375 binder_objstat_strings
[i
],
3376 stats
->obj_created
[i
] - stats
->obj_deleted
[i
],
3377 stats
->obj_created
[i
]);
3381 static void print_binder_proc_stats(struct seq_file
*m
,
3382 struct binder_proc
*proc
)
3384 struct binder_work
*w
;
3386 int count
, strong
, weak
;
3388 seq_printf(m
, "proc %d\n", proc
->pid
);
3390 for (n
= rb_first(&proc
->threads
); n
!= NULL
; n
= rb_next(n
))
3392 seq_printf(m
, " threads: %d\n", count
);
3393 seq_printf(m
, " requested threads: %d+%d/%d\n"
3394 " ready threads %d\n"
3395 " free async space %zd\n", proc
->requested_threads
,
3396 proc
->requested_threads_started
, proc
->max_threads
,
3397 proc
->ready_threads
, proc
->free_async_space
);
3399 for (n
= rb_first(&proc
->nodes
); n
!= NULL
; n
= rb_next(n
))
3401 seq_printf(m
, " nodes: %d\n", count
);
3405 for (n
= rb_first(&proc
->refs_by_desc
); n
!= NULL
; n
= rb_next(n
)) {
3406 struct binder_ref
*ref
= rb_entry(n
, struct binder_ref
,
3409 strong
+= ref
->strong
;
3412 seq_printf(m
, " refs: %d s %d w %d\n", count
, strong
, weak
);
3415 for (n
= rb_first(&proc
->allocated_buffers
); n
!= NULL
; n
= rb_next(n
))
3417 seq_printf(m
, " buffers: %d\n", count
);
3420 list_for_each_entry(w
, &proc
->todo
, entry
) {
3422 case BINDER_WORK_TRANSACTION
:
3429 seq_printf(m
, " pending transactions: %d\n", count
);
3431 print_binder_stats(m
, " ", &proc
->stats
);
3435 static int binder_state_show(struct seq_file
*m
, void *unused
)
3437 struct binder_proc
*proc
;
3438 struct binder_node
*node
;
3439 int do_lock
= !binder_debug_no_lock
;
3442 binder_lock(__func__
);
3444 seq_puts(m
, "binder state:\n");
3446 if (!hlist_empty(&binder_dead_nodes
))
3447 seq_puts(m
, "dead nodes:\n");
3448 hlist_for_each_entry(node
, &binder_dead_nodes
, dead_node
)
3449 print_binder_node(m
, node
);
3451 hlist_for_each_entry(proc
, &binder_procs
, proc_node
)
3452 print_binder_proc(m
, proc
, 1);
3454 binder_unlock(__func__
);
3458 static int binder_stats_show(struct seq_file
*m
, void *unused
)
3460 struct binder_proc
*proc
;
3461 int do_lock
= !binder_debug_no_lock
;
3464 binder_lock(__func__
);
3466 seq_puts(m
, "binder stats:\n");
3468 print_binder_stats(m
, "", &binder_stats
);
3470 hlist_for_each_entry(proc
, &binder_procs
, proc_node
)
3471 print_binder_proc_stats(m
, proc
);
3473 binder_unlock(__func__
);
3477 static int binder_transactions_show(struct seq_file
*m
, void *unused
)
3479 struct binder_proc
*proc
;
3480 int do_lock
= !binder_debug_no_lock
;
3483 binder_lock(__func__
);
3485 seq_puts(m
, "binder transactions:\n");
3486 hlist_for_each_entry(proc
, &binder_procs
, proc_node
)
3487 print_binder_proc(m
, proc
, 0);
3489 binder_unlock(__func__
);
3493 static int binder_proc_show(struct seq_file
*m
, void *unused
)
3495 struct binder_proc
*proc
= m
->private;
3496 int do_lock
= !binder_debug_no_lock
;
3499 binder_lock(__func__
);
3500 seq_puts(m
, "binder proc state:\n");
3501 print_binder_proc(m
, proc
, 1);
3503 binder_unlock(__func__
);
3507 static void print_binder_transaction_log_entry(struct seq_file
*m
,
3508 struct binder_transaction_log_entry
*e
)
3511 "%d: %s from %d:%d to %d:%d node %d handle %d size %d:%d\n",
3512 e
->debug_id
, (e
->call_type
== 2) ? "reply" :
3513 ((e
->call_type
== 1) ? "async" : "call "), e
->from_proc
,
3514 e
->from_thread
, e
->to_proc
, e
->to_thread
, e
->to_node
,
3515 e
->target_handle
, e
->data_size
, e
->offsets_size
);
3518 static int binder_transaction_log_show(struct seq_file
*m
, void *unused
)
3520 struct binder_transaction_log
*log
= m
->private;
3524 for (i
= log
->next
; i
< ARRAY_SIZE(log
->entry
); i
++)
3525 print_binder_transaction_log_entry(m
, &log
->entry
[i
]);
3527 for (i
= 0; i
< log
->next
; i
++)
3528 print_binder_transaction_log_entry(m
, &log
->entry
[i
]);
3532 static const struct file_operations binder_fops
= {
3533 .owner
= THIS_MODULE
,
3534 .poll
= binder_poll
,
3535 .unlocked_ioctl
= binder_ioctl
,
3536 .mmap
= binder_mmap
,
3537 .open
= binder_open
,
3538 .flush
= binder_flush
,
3539 .release
= binder_release
,
3542 static struct miscdevice binder_miscdev
= {
3543 .minor
= MISC_DYNAMIC_MINOR
,
3545 .fops
= &binder_fops
3548 BINDER_DEBUG_ENTRY(state
);
3549 BINDER_DEBUG_ENTRY(stats
);
3550 BINDER_DEBUG_ENTRY(transactions
);
3551 BINDER_DEBUG_ENTRY(transaction_log
);
3553 static int __init
binder_init(void)
3557 binder_deferred_workqueue
= create_singlethread_workqueue("binder");
3558 if (!binder_deferred_workqueue
)
3561 binder_debugfs_dir_entry_root
= debugfs_create_dir("binder", NULL
);
3562 if (binder_debugfs_dir_entry_root
)
3563 binder_debugfs_dir_entry_proc
= debugfs_create_dir("proc",
3564 binder_debugfs_dir_entry_root
);
3565 ret
= misc_register(&binder_miscdev
);
3566 if (binder_debugfs_dir_entry_root
) {
3567 debugfs_create_file("state",
3569 binder_debugfs_dir_entry_root
,
3571 &binder_state_fops
);
3572 debugfs_create_file("stats",
3574 binder_debugfs_dir_entry_root
,
3576 &binder_stats_fops
);
3577 debugfs_create_file("transactions",
3579 binder_debugfs_dir_entry_root
,
3581 &binder_transactions_fops
);
3582 debugfs_create_file("transaction_log",
3584 binder_debugfs_dir_entry_root
,
3585 &binder_transaction_log
,
3586 &binder_transaction_log_fops
);
3587 debugfs_create_file("failed_transaction_log",
3589 binder_debugfs_dir_entry_root
,
3590 &binder_transaction_log_failed
,
3591 &binder_transaction_log_fops
);
3596 device_initcall(binder_init
);
3598 #define CREATE_TRACE_POINTS
3599 #include "binder_trace.h"
3601 MODULE_LICENSE("GPL v2");