projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
import PULS_20180308
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / drivers / staging / android / binder.c
CommitLineData
355b0502
GKH		 1/* binder.c
2 *
3 * Android IPC Subsystem
4 *
5 * Copyright (C) 2007-2008 Google, Inc.
6 *
7 * This software is licensed under the terms of the GNU General Public
8 * License version 2, as published by the Free Software Foundation, and
9 * may be copied, distributed, and modified under those terms.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 */
17
6fa3eb70 18#define DEBUG 1
56b468fc
AS		 19#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
20
355b0502
GKH		 21#include <asm/cacheflush.h>
22#include <linux/fdtable.h>
23#include <linux/file.h>
6fa3eb70 24#include <linux/freezer.h>
355b0502
GKH		 25#include <linux/fs.h>
26#include <linux/list.h>
27#include <linux/miscdevice.h>
28#include <linux/mm.h>
29#include <linux/module.h>
30#include <linux/mutex.h>
31#include <linux/nsproxy.h>
32#include <linux/poll.h>
16b66554 33#include <linux/debugfs.h>
355b0502
GKH		 34#include <linux/rbtree.h>
35#include <linux/sched.h>
5249f488 36#include <linux/seq_file.h>
355b0502
GKH		 37#include <linux/uaccess.h>
38#include <linux/vmalloc.h>
c11a166c 39#include <linux/slab.h>
17cf22c3 40#include <linux/pid_namespace.h>
6fa3eb70
S		 41#include <linux/security.h>
42#include <linux/time.h>
43#include <linux/delay.h>
44#include <linux/kthread.h>
45#include <linux/rtc.h>
46#include <linux/aee.h>
47
48#ifdef CONFIG_MT_PRIO_TRACER
49#include <linux/prio_tracer.h>
50#endif
355b0502
GKH		 51
52#include "binder.h"
975a1ac9 53#include "binder_trace.h"
355b0502 54
975a1ac9 55static DEFINE_MUTEX(binder_main_lock);
355b0502 56static DEFINE_MUTEX(binder_deferred_lock);
bd1eff97 57static DEFINE_MUTEX(binder_mmap_lock);
355b0502
GKH		 58
59static HLIST_HEAD(binder_procs);
60static HLIST_HEAD(binder_deferred_list);
61static HLIST_HEAD(binder_dead_nodes);
62
16b66554
AH		 63static struct dentry *binder_debugfs_dir_entry_root;
64static struct dentry *binder_debugfs_dir_entry_proc;
355b0502 65static struct binder_node *binder_context_mgr_node;
4a2ebb93 66static kuid_t binder_context_mgr_uid = INVALID_UID;
355b0502 67static int binder_last_id;
3c762a49 68static struct workqueue_struct *binder_deferred_workqueue;
6fa3eb70
S		 69static pid_t system_server_pid;
70
71#define RT_PRIO_INHERIT "v1.7"
72#ifdef RT_PRIO_INHERIT
73#include <linux/sched/rt.h>
74#endif
75
76#define MTK_BINDER_DEBUG "v0.1" /* defined for mtk internal added debug code */
77
78/************************************************************************************************************************/
79/* MTK Death Notify | */
80/* Debug Log Prefix | Description */
81/* --------------------------------------------------------------------- */
82/* [DN #1] | Some one requests Death Notify from upper layer. */
83/* [DN #2] | Some one cancels Death Notify from upper layer. */
84/* [DN #3] | Binder Driver sends Death Notify to all requesters' Binder Thread. */
85/* [DN #4] | Some requester's binder_thread_read() handles Death Notify works. */
86/* [DN #5] | Some requester sends confirmation to Binder Driver. (In IPCThreadState.cpp) */
87/* [DN #6] | Finally receive requester's confirmation from upper layer. */
88/************************************************************************************************************************/
89#define MTK_DEATH_NOTIFY_MONITOR "v0.1"
90
91/**
92 * Revision history of binder monitor
93 *
94 * v0.1 - enhance debug log
95 * v0.2 - transaction timeout log
96 * v0.2.1 - buffer allocation debug
97 */
98#ifdef CONFIG_MT_ENG_BUILD
99#define BINDER_MONITOR "v0.2.1" /* BINDER_MONITOR only turn on for eng build */
100#endif
101
102#ifdef BINDER_MONITOR
103#define MAX_SERVICE_NAME_LEN 32
104/************************************************************************************************************************/
105/* Payload layout of addService(): */
106/* | Parcel header | IServiceManager.descriptor | Parcel header | Service name | ... */
107/* (Please refer ServiceManagerNative.java:addService()) */
108/* IServiceManager.descriptor is 'android.os.IServiceManager' interleaved with character '\0'. */
109/* that is, 'a', '\0', 'n', '\0', 'd', '\0', 'r', '\0', 'o', ... */
110/* so the offset of Service name = Parcel header x2 + strlen(android.os.IServiceManager) x2 = 8x2 + 26x2 = 68 */
111/************************************************************************************************************************/
112#define MAGIC_SERVICE_NAME_OFFSET 68
113
114#define MAX_ENG_TRANS_LOG_BUFF_LEN 10240
115
116static int binder_check_buf_pid;
117static int binder_check_buf_tid;
118static unsigned long binder_log_level = 0;
119char aee_msg[512];
120char aee_word[100];
121static int bt_folder = 0;//just for native backtrace
122#define TRANS_LOG_LEN 210
123char large_msg[TRANS_LOG_LEN];
124
125#define BINDER_PERF_EVAL "V0.1"
126#endif
127
128#ifdef BINDER_PERF_EVAL
129/* binder_perf_evalue bitmap
130 * bit: ...3210
131 * ||_ 1: send counter enable
132 * |__ 1: timeout counter enable
133 */
134static unsigned int binder_perf_evalue = 0;
135#define BINDER_PERF_SEND_COUNTER 0x1
136#define BINDER_PERF_TIMEOUT_COUNTER 0x2
137#endif
355b0502 138
5249f488
AH		 139#define BINDER_DEBUG_ENTRY(name) \
140static int binder_##name##_open(struct inode *inode, struct file *file) \
141{ \
16b66554 142 return single_open(file, binder_##name##_show, inode->i_private); \
5249f488
AH		 143} \
144\
145static const struct file_operations binder_##name##_fops = { \
146 .owner = THIS_MODULE, \
147 .open = binder_##name##_open, \
148 .read = seq_read, \
149 .llseek = seq_lseek, \
150 .release = single_release, \
151}
152
6fa3eb70
S		 153#ifdef BINDER_MONITOR
154#define BINDER_DEBUG_SETTING_ENTRY(name) \
155static int binder_##name##_open(struct inode *inode, struct file *file) \
156{ \
157 return single_open(file, binder_##name##_show, inode->i_private); \
158} \
159\
160static const struct file_operations binder_##name##_fops = { \
161 .owner = THIS_MODULE, \
162 .open = binder_##name##_open, \
163 .read = seq_read, \
164 .write = binder_##name##_write, \
165 .llseek = seq_lseek, \
166 .release = single_release, \
167}
168#endif
169
170//LCH add, for binder pages leakage debug
171#ifdef CONFIG_MT_ENG_BUILD
172#define MTK_BINDER_PAGE_USED_RECORD
173#endif
174
175#ifdef MTK_BINDER_PAGE_USED_RECORD
176static unsigned int binder_page_used = 0;
177static unsigned int binder_page_used_peak = 0;
178#endif
179
5249f488
AH		 180static int binder_proc_show(struct seq_file *m, void *unused);
181BINDER_DEBUG_ENTRY(proc);
355b0502
GKH		 182
183/* This is only defined in include/asm-arm/sizes.h */
184#ifndef SZ_1K
185#define SZ_1K 0x400
186#endif
187
188#ifndef SZ_4M
189#define SZ_4M 0x400000
190#endif
191
192#define FORBIDDEN_MMAP_FLAGS (VM_WRITE)
193
194#define BINDER_SMALL_BUF_SIZE (PAGE_SIZE * 64)
195
196enum {
197 BINDER_DEBUG_USER_ERROR = 1U << 0,
198 BINDER_DEBUG_FAILED_TRANSACTION = 1U << 1,
199 BINDER_DEBUG_DEAD_TRANSACTION = 1U << 2,
200 BINDER_DEBUG_OPEN_CLOSE = 1U << 3,
201 BINDER_DEBUG_DEAD_BINDER = 1U << 4,
202 BINDER_DEBUG_DEATH_NOTIFICATION = 1U << 5,
203 BINDER_DEBUG_READ_WRITE = 1U << 6,
204 BINDER_DEBUG_USER_REFS = 1U << 7,
205 BINDER_DEBUG_THREADS = 1U << 8,
206 BINDER_DEBUG_TRANSACTION = 1U << 9,
207 BINDER_DEBUG_TRANSACTION_COMPLETE = 1U << 10,
208 BINDER_DEBUG_FREE_BUFFER = 1U << 11,
209 BINDER_DEBUG_INTERNAL_REFS = 1U << 12,
210 BINDER_DEBUG_BUFFER_ALLOC = 1U << 13,
211 BINDER_DEBUG_PRIORITY_CAP = 1U << 14,
212 BINDER_DEBUG_BUFFER_ALLOC_ASYNC = 1U << 15,
213};
214static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR |
215 BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION;
216module_param_named(debug_mask, binder_debug_mask, uint, S_IWUSR | S_IRUGO);
217
2c52325e 218static bool binder_debug_no_lock;
355b0502
GKH		 219module_param_named(proc_no_lock, binder_debug_no_lock, bool, S_IWUSR | S_IRUGO);
220
221static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait);
222static int binder_stop_on_user_error;
223
224static int binder_set_stop_on_user_error(const char *val,
225 struct kernel_param *kp)
226{
227 int ret;
228 ret = param_set_int(val, kp);
229 if (binder_stop_on_user_error < 2)
230 wake_up(&binder_user_error_wait);
231 return ret;
232}
233module_param_call(stop_on_user_error, binder_set_stop_on_user_error,
234 param_get_int, &binder_stop_on_user_error, S_IWUSR | S_IRUGO);
235
236#define binder_debug(mask, x...) \
237 do { \
238 if (binder_debug_mask & mask) \
258767fe 239 pr_info(x); \
355b0502
GKH		 240 } while (0)
241
6fa3eb70
S		 242#ifdef BINDER_MONITOR
243#define binder_user_error(x...) \
244 do { \
245 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \
246 pr_err(x); \
247 if (binder_stop_on_user_error) \
248 binder_stop_on_user_error = 2; \
249 } while (0)
250#else
355b0502
GKH		 251#define binder_user_error(x...) \
252 do { \
253 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \
258767fe 254 pr_info(x); \
355b0502
GKH		 255 if (binder_stop_on_user_error) \
256 binder_stop_on_user_error = 2; \
257 } while (0)
6fa3eb70 258#endif
355b0502
GKH		 259
260enum binder_stat_types {
261 BINDER_STAT_PROC,
262 BINDER_STAT_THREAD,
263 BINDER_STAT_NODE,
264 BINDER_STAT_REF,
265 BINDER_STAT_DEATH,
266 BINDER_STAT_TRANSACTION,
267 BINDER_STAT_TRANSACTION_COMPLETE,
268 BINDER_STAT_COUNT
269};
270
271struct binder_stats {
272 int br[_IOC_NR(BR_FAILED_REPLY) + 1];
273 int bc[_IOC_NR(BC_DEAD_BINDER_DONE) + 1];
274 int obj_created[BINDER_STAT_COUNT];
275 int obj_deleted[BINDER_STAT_COUNT];
276};
277
278static struct binder_stats binder_stats;
279
280static inline void binder_stats_deleted(enum binder_stat_types type)
281{
282 binder_stats.obj_deleted[type]++;
283}
284
285static inline void binder_stats_created(enum binder_stat_types type)
286{
287 binder_stats.obj_created[type]++;
288}
289
290struct binder_transaction_log_entry {
291 int debug_id;
292 int call_type;
293 int from_proc;
294 int from_thread;
295 int target_handle;
296 int to_proc;
297 int to_thread;
298 int to_node;
299 int data_size;
300 int offsets_size;
6fa3eb70
S		 301#ifdef BINDER_MONITOR
302 unsigned int code;
303 struct timespec timestamp;
304 char service[MAX_SERVICE_NAME_LEN];
305 int fd;
306 struct timeval tv;
307 struct timespec readstamp;
308 struct timespec endstamp;
309#endif
355b0502
GKH		 310};
311struct binder_transaction_log {
312 int next;
313 int full;
6fa3eb70
S		 314#ifdef BINDER_MONITOR
315 unsigned size;
316 struct binder_transaction_log_entry *entry;
317#else
355b0502 318 struct binder_transaction_log_entry entry[32];
6fa3eb70 319#endif
355b0502
GKH		 320};
321static struct binder_transaction_log binder_transaction_log;
322static struct binder_transaction_log binder_transaction_log_failed;
323
324static struct binder_transaction_log_entry *binder_transaction_log_add(
325 struct binder_transaction_log *log)
326{
327 struct binder_transaction_log_entry *e;
328 e = &log->entry[log->next];
329 memset(e, 0, sizeof(*e));
330 log->next++;
6fa3eb70
S		 331#ifdef BINDER_MONITOR
332 if (log->next == log->size) {
333 log->next = 0;
334 log->full = 1;
335 }
336#else
355b0502
GKH		 337 if (log->next == ARRAY_SIZE(log->entry)) {
338 log->next = 0;
339 log->full = 1;
340 }
6fa3eb70 341#endif
355b0502
GKH		 342 return e;
343}
344
6fa3eb70
S		 345#ifdef BINDER_MONITOR
346static struct binder_transaction_log_entry entry_failed[32];
347
348/* log_disable bitmap
349 * bit: 31...43210
350 * | |||||_ 0: log enable / 1: log disable
351 * | ||||__ 1: self resume
352 * | |||____2: manually trigger kernel warning for buffer allocation
353 * | ||____ 3: 1:rt_inherit log enable / 0: rt_inherit log disable
354 * | |
355 */
356static int log_disable;
357#define BINDER_LOG_RESUME 0x2
358#define BINDER_BUF_WARN 0x4
359#ifdef RT_PRIO_INHERIT
360#define BINDER_RT_LOG_ENABLE 0x8
361#endif
362#ifdef CONFIG_MTK_EXTMEM
363extern void* extmem_malloc_page_align(size_t bytes);
364#else
365static struct binder_transaction_log_entry entry_t[MAX_ENG_TRANS_LOG_BUFF_LEN];
366#endif
367#endif
355b0502
GKH		 368struct binder_work {
369 struct list_head entry;
370 enum {
371 BINDER_WORK_TRANSACTION = 1,
372 BINDER_WORK_TRANSACTION_COMPLETE,
373 BINDER_WORK_NODE,
374 BINDER_WORK_DEAD_BINDER,
375 BINDER_WORK_DEAD_BINDER_AND_CLEAR,
376 BINDER_WORK_CLEAR_DEATH_NOTIFICATION,
377 } type;
378};
379
380struct binder_node {
381 int debug_id;
382 struct binder_work work;
383 union {
384 struct rb_node rb_node;
385 struct hlist_node dead_node;
386 };
387 struct binder_proc *proc;
388 struct hlist_head refs;
389 int internal_strong_refs;
390 int local_weak_refs;
391 int local_strong_refs;
6fa3eb70
S		 392 binder_uintptr_t ptr;
393 binder_uintptr_t cookie;
355b0502
GKH		 394 unsigned has_strong_ref:1;
395 unsigned pending_strong_ref:1;
396 unsigned has_weak_ref:1;
397 unsigned pending_weak_ref:1;
398 unsigned has_async_transaction:1;
399 unsigned accept_fds:1;
400 unsigned min_priority:8;
401 struct list_head async_todo;
6fa3eb70
S		 402#ifdef BINDER_MONITOR
403 char name[MAX_SERVICE_NAME_LEN];
404#endif
405#ifdef MTK_BINDER_DEBUG
406 int async_pid;
407#endif
355b0502
GKH		 408};
409
410struct binder_ref_death {
411 struct binder_work work;
6fa3eb70 412 binder_uintptr_t cookie;
355b0502
GKH		 413};
414
415struct binder_ref {
416 /* Lookups needed: */
417 /* node + proc => ref (transaction) */
418 /* desc + proc => ref (transaction, inc/dec ref) */
419 /* node => refs + procs (proc exit) */
420 int debug_id;
421 struct rb_node rb_node_desc;
422 struct rb_node rb_node_node;
423 struct hlist_node node_entry;
424 struct binder_proc *proc;
425 struct binder_node *node;
426 uint32_t desc;
427 int strong;
428 int weak;
429 struct binder_ref_death *death;
430};
431
432struct binder_buffer {
217218f0 433 struct list_head entry; /* free and allocated entries by address */
355b0502
GKH		 434 struct rb_node rb_node; /* free entry by size or allocated entry */
435 /* by address */
436 unsigned free:1;
437 unsigned allow_user_free:1;
438 unsigned async_transaction:1;
439 unsigned debug_id:29;
440
441 struct binder_transaction *transaction;
6fa3eb70
S		 442#ifdef BINDER_MONITOR
443 struct binder_transaction_log_entry *log_entry;
444#endif
355b0502
GKH		 445 struct binder_node *target_node;
446 size_t data_size;
447 size_t offsets_size;
448 uint8_t data[0];
449};
450
451enum binder_deferred_state {
452 BINDER_DEFERRED_PUT_FILES = 0x01,
453 BINDER_DEFERRED_FLUSH = 0x02,
454 BINDER_DEFERRED_RELEASE = 0x04,
455};
456
6fa3eb70
S		 457#ifdef BINDER_MONITOR
458enum wait_on_reason {
459 WAIT_ON_NONE = 0U,
460 WAIT_ON_READ = 1U,
461 WAIT_ON_EXEC = 2U,
462 WAIT_ON_REPLY_READ = 3U
463};
464#endif
465
466#ifdef BINDER_PERF_EVAL
467#define BC_CODE_NR 60
468#define BC_STATS_NR 30
469struct binder_bc_stats {
470 char service[MAX_SERVICE_NAME_LEN];
471 unsigned int code[BC_CODE_NR];
472 unsigned int code_num[BC_CODE_NR];
473};
474struct binder_timeout_stats {
475 unsigned long bto[WAIT_ON_REPLY_READ];
476 struct timespec read_t[32];
477 struct timespec exec_t[32];
478 struct timespec rrply_t[32];
479};
480#endif
481
355b0502
GKH		 482struct binder_proc {
483 struct hlist_node proc_node;
484 struct rb_root threads;
485 struct rb_root nodes;
486 struct rb_root refs_by_desc;
487 struct rb_root refs_by_node;
488 int pid;
489 struct vm_area_struct *vma;
2a90957f 490 struct mm_struct *vma_vm_mm;
355b0502
GKH		 491 struct task_struct *tsk;
492 struct files_struct *files;
493 struct hlist_node deferred_work_node;
494 int deferred_work;
495 void *buffer;
496 ptrdiff_t user_buffer_offset;
497
498 struct list_head buffers;
499 struct rb_root free_buffers;
500 struct rb_root allocated_buffers;
501 size_t free_async_space;
502
503 struct page **pages;
504 size_t buffer_size;
505 uint32_t buffer_free;
506 struct list_head todo;
507 wait_queue_head_t wait;
508 struct binder_stats stats;
509 struct list_head delivered_death;
510 int max_threads;
511 int requested_threads;
512 int requested_threads_started;
513 int ready_threads;
514 long default_priority;
16b66554 515 struct dentry *debugfs_entry;
6fa3eb70
S		 516#ifdef RT_PRIO_INHERIT
517 unsigned long default_rt_prio:16;
518 unsigned long default_policy:16;
519#endif
520#ifdef BINDER_MONITOR
521 struct binder_buffer *large_buffer;
522#endif
523#ifdef BINDER_PERF_EVAL
524 int bc_t;
525 struct binder_bc_stats *bc_stats[BC_STATS_NR];
526 struct binder_timeout_stats to_stats;
527#endif
528#ifdef MTK_BINDER_PAGE_USED_RECORD
529 unsigned int page_used;
530 unsigned int page_used_peak;
531#endif
355b0502
GKH		 532};
533
534enum {
535 BINDER_LOOPER_STATE_REGISTERED = 0x01,
536 BINDER_LOOPER_STATE_ENTERED = 0x02,
537 BINDER_LOOPER_STATE_EXITED = 0x04,
538 BINDER_LOOPER_STATE_INVALID = 0x08,
539 BINDER_LOOPER_STATE_WAITING = 0x10,
540 BINDER_LOOPER_STATE_NEED_RETURN = 0x20
541};
542
543struct binder_thread {
544 struct binder_proc *proc;
545 struct rb_node rb_node;
546 int pid;
547 int looper;
548 struct binder_transaction *transaction_stack;
549 struct list_head todo;
550 uint32_t return_error; /* Write failed, return error code in read buf */
551 uint32_t return_error2; /* Write failed, return error code in read */
552 /* buffer. Used when sending a reply to a dead process that */
553 /* we are also waiting on */
554 wait_queue_head_t wait;
555 struct binder_stats stats;
6fa3eb70
S		 556#ifdef BINDER_PERF_EVAL
557 struct binder_timeout_stats to_stats;
558#endif
559
355b0502
GKH		 560};
561
562struct binder_transaction {
563 int debug_id;
564 struct binder_work work;
565 struct binder_thread *from;
566 struct binder_transaction *from_parent;
567 struct binder_proc *to_proc;
568 struct binder_thread *to_thread;
569 struct binder_transaction *to_parent;
570 unsigned need_reply:1;
571 /* unsigned is_dead:1; */ /* not used at the moment */
572
573 struct binder_buffer *buffer;
6fa3eb70
S		 574 unsigned int code;
575 unsigned int flags;
576 long priority;
577 long saved_priority;
578 kuid_t sender_euid;
579#ifdef RT_PRIO_INHERIT
580 unsigned long rt_prio:16;
581 unsigned long policy:16;
582 unsigned long saved_rt_prio:16;
583 unsigned long saved_policy:16;
584#endif
585#ifdef BINDER_MONITOR
586 struct timespec timestamp;
587
588 enum wait_on_reason wait_on;
589 enum wait_on_reason bark_on;
590 struct rb_node rb_node; /* by bark_time */
591 struct timespec bark_time;
592 struct timespec exe_timestamp;
593 struct timeval tv;
594 char service[MAX_SERVICE_NAME_LEN];
595 pid_t fproc;
596 pid_t fthrd;
597 pid_t tproc;
598 pid_t tthrd;
599 unsigned int log_idx;
600#endif
601};
602
603static void
604binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer);
605static inline void binder_lock(const char *tag);
606static inline void binder_unlock(const char *tag);
607
608#ifdef BINDER_MONITOR
609/* work should be done within how many secs */
610#define WAIT_BUDGET_READ 2
611#define WAIT_BUDGET_EXEC 4
612#define WAIT_BUDGET_MIN min(WAIT_BUDGET_READ, WAIT_BUDGET_EXEC)
613
614static struct rb_root bwdog_transacts;
615
616static const char *binder_wait_on_str[] = {
617 "none",
618 "read",
619 "exec",
620 "rply"
621};
622
623struct binder_timeout_log_entry {
624 enum wait_on_reason r;
625 pid_t from_proc;
626 pid_t from_thrd;
627 pid_t to_proc;
628 pid_t to_thrd;
629 unsigned over_sec;
630 struct timespec ts;
631 struct timeval tv;
632 unsigned int code;
633 char service[MAX_SERVICE_NAME_LEN];
634 int debug_id;
635};
636
637struct binder_timeout_log {
638 int next;
639 int full;
640#ifdef BINDER_PERF_EVAL
641 struct binder_timeout_log_entry entry[256];
642#else
643 struct binder_timeout_log_entry entry[64];
644#endif
645};
646
647static struct binder_timeout_log binder_timeout_log_t;
648
649/**
650 * binder_timeout_log_add - Insert a timeout log
651 */
652static struct binder_timeout_log_entry *binder_timeout_log_add(void)
653{
654 struct binder_timeout_log *log = &binder_timeout_log_t;
655 struct binder_timeout_log_entry *e;
656
657 e = &log->entry[log->next];
658 memset(e, 0, sizeof(*e));
659 log->next++;
660 if (log->next == ARRAY_SIZE(log->entry)) {
661 log->next = 0;
662 log->full = 1;
663 }
664 return e;
665}
666
667/**
668 * binder_print_bwdog - Output info of a timeout transaction
669 * @t: pointer to the timeout transaction
670 * @cur_in: current timespec while going to print
671 * @e: timeout log entry to record
672 * @r: output reason, either while barking or after barked
673 */
674static void binder_print_bwdog(struct binder_transaction *t,
675 struct timespec *cur_in,
676 struct binder_timeout_log_entry *e,
677 enum wait_on_reason r)
678{
679 struct rtc_time tm;
680 struct timespec *startime;
681 struct timespec cur, sub_t;
682
683 if (cur_in && e) {
684 memcpy(&cur, cur_in, sizeof(struct timespec));
685 } else {
686 do_posix_clock_monotonic_gettime(&cur);
687 //monotonic_to_bootbased(&cur);
688 }
689 startime = (r == WAIT_ON_EXEC) ? &t->exe_timestamp : &t->timestamp;
690 sub_t = timespec_sub(cur, *startime);
691
692#ifdef BINDER_PERF_EVAL
693 if ( !(cur_in && e) && (binder_perf_evalue & BINDER_PERF_TIMEOUT_COUNTER))
694 {
695 switch (r)
696 {
697 case WAIT_ON_READ:
698 {
699 if (t->to_proc)
700 {
701 unsigned long proc_t = t->to_proc->to_stats.bto[r - 1] ++;
702 t->to_proc->to_stats.read_t[(proc_t % 32)] = sub_t;
703 }
704 break;
705 }
706 case WAIT_ON_EXEC:
707 {
708 if (t->to_proc)
709 {
710 unsigned long proc_t = t->to_proc->to_stats.bto[r - 1] ++;
711 t->to_proc->to_stats.exec_t[(proc_t % 32)] = sub_t;
712 }
713 if (t->to_thread)
714 {
715 unsigned long thread_t = t->to_thread->to_stats.bto[r - 1] ++;
716 t->to_thread->to_stats.exec_t[(thread_t % 32)] = sub_t;
717 }
718 break;
719 }
720 case WAIT_ON_REPLY_READ:
721 {
722 if (t->to_proc)
723 {
724 unsigned long proc_t = t->to_proc->to_stats.bto[r - 1] ++;
725 t->to_proc->to_stats.rrply_t[(proc_t % 32)] = sub_t;
726 }
727 if (t->to_thread)
728 {
729 unsigned long thread_t = t->to_thread->to_stats.bto[r - 1] ++;
730 t->to_thread->to_stats.rrply_t[(thread_t % 32)] = sub_t;
731 }
732
733 break;
734 }
735 case WAIT_ON_NONE:
736 break;
737 default:
738 break;
739 }
740 }
741#endif
742 rtc_time_to_tm(t->tv.tv_sec, &tm);
743 pr_debug("%d %s %d:%d to %d:%d %s %u.%03ld "
744 "sec (%s) dex_code %u start_at %lu.%03ld android "
745 "%d-%02d-%02d %02d:%02d:%02d.%03lu\n",
746 t->debug_id, binder_wait_on_str[r],
747 t->fproc, t->fthrd, t->tproc, t->tthrd,
748 (cur_in && e) ? "over" : "total",
749 (unsigned)sub_t.tv_sec, (sub_t.tv_nsec / NSEC_PER_MSEC),
750 t->service, t->code,
751
752 (unsigned long)startime->tv_sec,
753 (startime->tv_nsec / NSEC_PER_MSEC),
754 (tm.tm_year + 1900), (tm.tm_mon + 1), tm.tm_mday,
755 tm.tm_hour, tm.tm_min, tm.tm_sec,
756 (unsigned long)(t->tv.tv_usec / USEC_PER_MSEC));
757
758 if (e) {
759 e->over_sec = sub_t.tv_sec;
760 memcpy(&e->ts, startime, sizeof(struct timespec));
761 }
762}
763
764/**
765 * binder_bwdog_safe - Check a transaction is monitor-free or not
766 * @t: pointer to the transaction to check
767 *
768 * Returns 1 means safe.
769 */
770static inline int binder_bwdog_safe(struct binder_transaction *t)
771{
772 return (t->wait_on == WAIT_ON_NONE) ? 1 : 0;
773}
774
775/**
776 * binder_query_bwdog - Check a transaction is queued or not
777 * @t: pointer to the transaction to check
778 *
779 * Returns a pointer points to t, or NULL if it's not queued.
780 */
781static struct rb_node **binder_query_bwdog(struct binder_transaction *t)
782{
783 struct rb_node **p = &bwdog_transacts.rb_node;
784 struct rb_node *parent = NULL;
785 struct binder_transaction *transact = NULL;
786 int comp;
787
788 while (*p) {
789 parent = *p;
790 transact = rb_entry(parent, struct binder_transaction, rb_node);
791
792 comp = timespec_compare(&t->bark_time, &transact->bark_time);
793 if (comp < 0)
794 p = &(*p)->rb_left;
795 else if (comp > 0)
796 p = &(*p)->rb_right;
797 else
798 break;
799 }
800 return p;
801}
802
803/**
804 * binder_queue_bwdog - Queue a transaction to keep tracking
805 * @t: pointer to the transaction being tracked
806 * @budget: seconds, which this transaction can afford
807 */
808static void binder_queue_bwdog(struct binder_transaction *t, time_t budget)
809{
810 struct rb_node **p = &bwdog_transacts.rb_node;
811 struct rb_node *parent = NULL;
812 struct binder_transaction *transact = NULL;
813 int ret;
814
815 do_posix_clock_monotonic_gettime(&t->bark_time);
816 //monotonic_to_bootbased(&t->bark_time);
817 t->bark_time.tv_sec += budget;
818
819 while (*p) {
820 parent = *p;
821 transact = rb_entry(parent, struct binder_transaction, rb_node);
822
823 ret = timespec_compare(&t->bark_time, &transact->bark_time);
824 if (ret < 0)
825 p = &(*p)->rb_left;
826 else if (ret > 0)
827 p = &(*p)->rb_right;
828 else {
829 pr_info("%d found same key\n",
830 t->debug_id);
831 t->bark_time.tv_nsec += 1;
832 p = &(*p)->rb_right;
833 }
834 }
835 rb_link_node(&t->rb_node, parent, p);
836 rb_insert_color(&t->rb_node, &bwdog_transacts);
837}
838
839/**
840 * binder_cancel_bwdog - Cancel a transaction from tracking list
841 * @t: pointer to the transaction being cancelled
842 */
843static void binder_cancel_bwdog(struct binder_transaction *t)
844{
845 struct rb_node **p = NULL;
846
847 if (binder_bwdog_safe(t)) {
848 if (t->bark_on) {
849 binder_print_bwdog(t, NULL, NULL, t->bark_on);
850 t->bark_on = WAIT_ON_NONE;
851 }
852 return;
853 }
854
855 p = binder_query_bwdog(t);
856 if (*p == NULL) {
857 pr_err("%d waits %s, but not queued...\n",
858 t->debug_id, binder_wait_on_str[t->wait_on]);
859 return;
860 }
861
862 rb_erase(&t->rb_node, &bwdog_transacts);
863 t->wait_on = WAIT_ON_NONE;
864}
865
866/**
867 * binder_bwdog_bark -
868 * Barking funcion while timeout. Record target process or thread, which
869 * cannot handle transaction in time, including todo list. Also add a log
870 * entry for AMS reference.
871 *
872 * @t: pointer to the transaction, which triggers watchdog
873 * @cur: current kernel timespec
874 */
875static void binder_bwdog_bark(struct binder_transaction *t, struct timespec *cur)
876{
877 struct binder_timeout_log_entry *e;
878
879
880 if (binder_bwdog_safe(t)) {
881 pr_debug("%d watched, but wait nothing\n",
882 t->debug_id);
883 return;
884 }
885
886 e = binder_timeout_log_add();
887 binder_print_bwdog(t, cur, e, t->wait_on);
888
889 e->r = t->wait_on;
890 e->from_proc = t->fproc;
891 e->from_thrd = t->fthrd;
892 e->debug_id = t->debug_id;
893 memcpy(&e->tv, &t->tv, sizeof(struct timeval));
894
895 switch (t->wait_on) {
896 case WAIT_ON_READ: {
897 if (!t->to_proc) {
898 pr_err("%d has NULL target\n",
899 t->debug_id);
900 return;
901 }
902 e->to_proc = t->tproc;
903 e->to_thrd = t->tthrd;
904 e->code = t->code;
905 strcpy(e->service, t->service);
906 break;
907 }
908
909 case WAIT_ON_EXEC: {
910 if (!t->to_thread) {
911 pr_err("%d has NULL target for "
912 "execution\n", t->debug_id);
913 return;
914 }
915 e->to_proc = t->tproc;
916 e->to_thrd = t->tthrd;
917 e->code = t->code;
918 strcpy(e->service, t->service);
919 goto dumpBackTrace;
920 }
921
922 case WAIT_ON_REPLY_READ: {
923 if (!t->to_thread) {
924 pr_err("%d has NULL target thread\n",
925 t->debug_id);
926 return;
927 }
928 e->to_proc = t->tproc;
929 e->to_thrd = t->tthrd;
930 strcpy(e->service, "");
931 break;
932 }
933
934 default: {
935 return;
936 }
937 }
938
939dumpBackTrace:
940 return;
941}
942
943/**
944 * binder_bwdog_thread - Main thread to check timeout list periodically
945 */
946static int binder_bwdog_thread(void *__unused)
947{
948 unsigned long sleep_sec;
949 struct rb_node *n = NULL;
950 struct timespec cur_time;
951 struct binder_transaction *t = NULL;
952
953 for (;;) {
954 binder_lock(__func__);
955 do_posix_clock_monotonic_gettime(&cur_time);
956 //monotonic_to_bootbased(&cur_time);
957
958 for (n = rb_first(&bwdog_transacts); n != NULL; n = rb_next(n)) {
959 t = rb_entry(n, struct binder_transaction, rb_node);
960 if (timespec_compare(&cur_time, &t->bark_time) < 0)
961 break;
962
963 binder_bwdog_bark(t, &cur_time);
964 rb_erase(&t->rb_node, &bwdog_transacts);
965 t->bark_on = t->wait_on;
966 t->wait_on = WAIT_ON_NONE;
967 }
968
969 if (!n)
970 sleep_sec = WAIT_BUDGET_MIN;
971 else
972 sleep_sec = timespec_sub(t->bark_time, cur_time).tv_sec;
973 binder_unlock(__func__);
974
975 msleep(sleep_sec * MSEC_PER_SEC);
976 }
977 pr_debug("%s exit...\n", __func__);
978 return 0;
979}
980
981/**
982 * binder_usermodehelper - Call shell to do some command
983 * @cmd: string of command
984 * @w: wait type
985 */
986static void binder_usermodehelper(char *cmd, int w)
987{
988 int ret;
989 char *envp[] = {"HOME=/", "TERM=linux", "PATH=/sbin:/system/bin", NULL};
990 char *argv[] = {"/system/bin/sh", "-c", "", NULL};
991
992 argv[2] = cmd;
993 pr_debug("%s\n", argv[2]);
994 if ((ret = call_usermodehelper(argv[0], argv, envp, w)) != 0)
995 pr_err("%s: return %d\n", __func__, ret);
996}
997
998/**
999 * find_process_by_pid - convert pid to task_struct
1000 * @pid: pid for convert task
1001 */
1002static inline struct task_struct *find_process_by_pid(pid_t pid)
1003{
1004 return pid ? find_task_by_vpid(pid) : NULL;
1005}
1006/**
1007 * binder_find_buffer_sender - find the sender task_struct of this buffer
1008 * @buf binder buffer
1009 * @tsk task_struct of buf sender
1010 */
1011static struct task_struct *binder_find_buffer_sender(struct binder_buffer *buf)
1012{
1013 struct binder_transaction *t;
1014 struct binder_transaction_log_entry *e;
1015 struct task_struct *tsk;
1016 t = buf->transaction;
1017 if (t && t->fproc)
1018 tsk = find_process_by_pid(t->fproc);
1019
1020 else
1021 {
1022 e = buf->log_entry;
1023 if ((buf->debug_id == e->debug_id) && e->from_proc)
1024 tsk = find_process_by_pid(e->from_proc);
1025 else
1026 tsk = NULL;
1027 }
1028 return tsk;
1029}
1030
1031/**
1032 * copy from /kernel/fs/proc/base.c and modified to get task full name
1033 */
1034static int binder_proc_pid_cmdline(struct task_struct *task, char * buf)
1035{
1036 int res = 0;
1037 unsigned int len;
1038 struct mm_struct *mm;
1039 /*============ add begin =============================*/
1040 char c = ' ';
1041 char *str;
1042 unsigned int size;
1043 char *buffer;
1044
1045 if (NULL == task)
1046 goto out;
1047 /*============ add end ===============================*/
1048 mm = get_task_mm(task);
1049 if (!mm)
1050 goto out;
1051 if (!mm->arg_end)
1052 goto out_mm; /* Shh! No looking before we're done */
1053 /*============ add begin =============================*/
1054 buffer = kzalloc(PAGE_SIZE, GFP_KERNEL);
1055 if (NULL == buffer)
1056 goto out_mm;
1057 /*============ add end ===============================*/
1058
1059 len = mm->arg_end - mm->arg_start;
1060
1061 if (len > PAGE_SIZE)
1062 len = PAGE_SIZE;
1063
1064 res = access_process_vm(task, mm->arg_start, buffer, len, 0);
1065
1066 // If the nul at the end of args has been overwritten, then
1067 // assume application is using setproctitle(3).
1068 if (res > 0 && buffer[res-1] != '\0' && len < PAGE_SIZE) {
1069 len = strnlen(buffer, res);
1070 if (len < res) {
1071 res = len;
1072 } else {
1073 len = mm->env_end - mm->env_start;
1074 if (len > PAGE_SIZE - res)
1075 len = PAGE_SIZE - res;
1076 res += access_process_vm(task, mm->env_start, buffer+res, len, 0);
1077 res = strnlen(buffer, res);
1078 }
1079 }
1080 /*============ add begin =============================*/
1081 str = strchr(buffer, c);
1082 if (NULL != str)
1083 size = (unsigned int)(str - buffer);
1084 else
1085 size = res;
1086 if (size > 256)
1087 size = 256;
1088 snprintf(buf, size, buffer);
1089 kfree(buffer);
1090 /*============ add end ===============================*/
1091out_mm:
1092 mmput(mm);
1093out:
1094 return res;
1095}
1096
1097/**
1098 * binder_print_buf - Print buffer info
1099 * @t: transaction
1100 * @buffer: target buffer
1101 * @dest: dest string pointer
1102 * @success: does this buffer allocate success
1103 * @check: check this log for owner finding
1104 */
1105static void binder_print_buf(struct binder_buffer *buffer, char *dest, int success, int check)
1106{
1107 struct rtc_time tm;
1108 struct binder_transaction *t = buffer->transaction;
1109 char str[TRANS_LOG_LEN];
1110 struct task_struct *sender_tsk;
1111 struct task_struct *rec_tsk;
1112 char sender_name[256], rec_name[256];
1113 int len_s, len_r;
1114 if (NULL == t) {
1115 struct binder_transaction_log_entry *log_entry = buffer->log_entry;
1116 rtc_time_to_tm(log_entry->tv.tv_sec, &tm);
1117 if ((log_entry != NULL) && (buffer->debug_id == log_entry->debug_id))
1118 {
1119 sender_tsk = find_process_by_pid(log_entry->from_proc);
1120 rec_tsk = find_process_by_pid(log_entry->to_proc);
1121 len_s = binder_proc_pid_cmdline(sender_tsk, sender_name);
1122 len_r = binder_proc_pid_cmdline(rec_tsk, rec_name);
1123 snprintf(str, sizeof(str),
1124 "binder:check=%d,success=%d,id=%d,call=%s,type=%s,"
1125 "from=%d,tid=%d,name=%s,to=%d,name=%s,tid=%d,name=%s,"
1126 "size=%zd,node=%d,handle=%d,dex=%u,auf=%d,start=%lu.%03ld,"
1127 "android=%d-%02d-%02d %02d:%02d:%02d.%03lu\n",
1128 check, success, buffer->debug_id,
1129 buffer->async_transaction ? "async" : "sync",
1130 (2 == log_entry->call_type) ? "reply" :
1131 ((1 == log_entry->call_type) ? "async" : "call"),
1132 log_entry->from_proc, log_entry->from_thread,
1133 len_s ? sender_name : ((sender_tsk != NULL) ? sender_tsk->comm : ""),
1134 log_entry->to_proc,
1135 len_r ? rec_name : ((rec_tsk != NULL) ? rec_tsk->comm : ""),
1136 log_entry->to_thread, log_entry->service,
1137 (buffer->data_size + buffer->offsets_size),
1138 log_entry->to_node, log_entry->target_handle, log_entry->code,
1139 buffer->allow_user_free,
1140 (unsigned long)log_entry->timestamp.tv_sec,
1141 (log_entry->timestamp.tv_nsec / NSEC_PER_MSEC),
1142 (tm.tm_year + 1900), (tm.tm_mon + 1), tm.tm_mday,
1143 tm.tm_hour, tm.tm_min, tm.tm_sec,
1144 (unsigned long)(log_entry->tv.tv_usec / USEC_PER_MSEC));
1145 }
1146 else
1147 snprintf(str, sizeof(str), "binder:check=%d,success=%d,id=%d,call=%s, ,"
1148 ",,,,,,,size=%zd,,,,"
1149 "auf=%d,,\n",
1150 check, success, buffer->debug_id,
1151 buffer->async_transaction ? "async" : "sync",
1152 (buffer->data_size + buffer->offsets_size),
1153 buffer->allow_user_free);
1154 }
1155 else
1156 {
1157 rtc_time_to_tm(t->tv.tv_sec, &tm);
1158 sender_tsk = find_process_by_pid(t->fproc);
1159 rec_tsk = find_process_by_pid(t->tproc);
1160 len_s = binder_proc_pid_cmdline(sender_tsk, sender_name);
1161 len_r = binder_proc_pid_cmdline(rec_tsk, rec_name);
1162 snprintf(str, sizeof(str),
1163 "binder:check=%d,success=%d,id=%d,call=%s,type=%s,"
1164 "from=%d,tid=%d,name=%s,to=%d,name=%s,tid=%d,name=%s,"
1165 "size=%zd,,,dex=%u,auf=%d,start=%lu.%03ld,android="
1166 "%d-%02d-%02d %02d:%02d:%02d.%03lu\n",
1167 check, success, t->debug_id,
1168 buffer->async_transaction ? "async" : "sync ",
1169 binder_wait_on_str[t->wait_on],
1170 t->fproc, t->fthrd,
1171 len_s ? sender_name : ((sender_tsk != NULL) ? sender_tsk->comm : ""),
1172 t->tproc,
1173 len_r ? rec_name : ((rec_tsk != NULL) ? rec_tsk->comm : ""),
1174 t->tthrd, t->service,
1175 (buffer->data_size+buffer->offsets_size), t->code,
1176 buffer->allow_user_free,
1177 (unsigned long)t->timestamp.tv_sec,
1178 (t->timestamp.tv_nsec / NSEC_PER_MSEC),
1179 (tm.tm_year + 1900), (tm.tm_mon + 1), tm.tm_mday,
1180 tm.tm_hour, tm.tm_min, tm.tm_sec,
1181 (unsigned long)(t->tv.tv_usec / USEC_PER_MSEC));
1182 }
1183 pr_debug("%s", str);
1184 if (dest != NULL)
1185 strncat(dest, str, sizeof(str));
1186}
1187
1188/**
1189 * binder_check_buf_checked -
1190 * Consider buffer related issue usually makes a series of failure.
1191 * Only care about the first problem time to minimize debug overhead.
1192 */
1193static int binder_check_buf_checked(void)
1194{
1195 return (binder_check_buf_pid == -1);
1196}
1197
1198static size_t binder_buffer_size(struct binder_proc *proc,
1199 struct binder_buffer *buffer);
1200
1201/**
1202 * binder_check_buf - Dump necessary info for buffer usage analysis
1203 * @target_proc: receiver
1204 * @size: requested size
1205 * @is_async: 1 if an async call
1206 */
1207static void binder_check_buf(struct binder_proc *target_proc,
1208 size_t size, int is_async)
1209{
1210 struct rb_node *n;
1211 struct binder_buffer *buffer;
1212 int i;
1213 int large_buffer_count = 0;
1214 size_t tmp_size, threshold;
1215 struct task_struct *sender;
1216 struct task_struct *larger;
1217 char sender_name[256], rec_name[256];
1218 struct timespec exp_timestamp;
1219 struct timeval tv;
1220 struct rtc_time tm;
1221 int db_flag = DB_OPT_BINDER_INFO;
1222 int len_s, len_r;
1223
1224 pr_debug("buffer allocation failed on %d:0 "
1225 "%s from %d:%d size %zd\n",
1226 target_proc->pid,
1227 is_async ? "async" : "call ",
1228 binder_check_buf_pid, binder_check_buf_tid, size);
1229
1230 if (binder_check_buf_checked())
1231 return;
1232 /* check blocked service for async call */
1233 if (is_async) {
1234 pr_debug("buffer allocation failed on %d:0 "
1235 "(%s) async service blocked\n",
1236 target_proc->pid,
1237 target_proc->tsk ? target_proc->tsk->comm : "");
1238 }
355b0502 1239
6fa3eb70
S		 1240 pr_debug("%d:0 pending transactions:\n", target_proc->pid);
1241 threshold = target_proc->buffer_size/16;
1242 for (n = rb_last(&target_proc->allocated_buffers), i = 0;
1243 n; n = rb_prev(n), i++)
1244 {
1245 buffer = rb_entry(n, struct binder_buffer, rb_node);
1246 tmp_size = binder_buffer_size(target_proc, buffer);
1247 BUG_ON(buffer->free);
1248
1249 if (tmp_size > threshold)
1250 {
1251 if ((NULL == target_proc->large_buffer) ||
1252 (target_proc->large_buffer &&
1253 (tmp_size > binder_buffer_size(target_proc, target_proc->large_buffer))))
1254 target_proc->large_buffer = buffer;
1255 large_buffer_count ++;
1256 binder_print_buf(buffer, NULL, 1, 0);
1257 }
1258 else
1259 {
1260 if (i < 20)
1261 binder_print_buf(buffer, NULL, 1, 0);
1262 }
1263 }
1264 pr_debug("%d:0 total pending trans: %d(%d large isze)\n",
1265 target_proc->pid, i, large_buffer_count);
1266
1267 do_posix_clock_monotonic_gettime(&exp_timestamp);
1268 //monotonic_to_bootbased(&exp_timestamp);
1269 do_gettimeofday(&tv);
1270 /* consider time zone. translate to android time */
1271 tv.tv_sec -= (sys_tz.tz_minuteswest * 60);
1272 rtc_time_to_tm(tv.tv_sec, &tm);
1273
1274 sender = find_process_by_pid(binder_check_buf_pid);
1275 len_s = binder_proc_pid_cmdline(sender, sender_name);
1276 len_r = binder_proc_pid_cmdline(target_proc->tsk, rec_name);
1277 if (size > threshold)
1278 {
1279 if (target_proc->large_buffer)
1280 {
1281 pr_debug("on %d:0 the largest pending trans is:\n",
1282 target_proc->pid);
1283 binder_print_buf(target_proc->large_buffer, large_msg, 1, 0);
1284 }
1285 snprintf(aee_word, sizeof(aee_word), "check %s: large binder trans fail on %d:0 size %zd",
1286 len_s ? sender_name : ((sender != NULL) ? sender->comm : ""),
1287 target_proc->pid, size);
1288 snprintf(aee_msg, sizeof(aee_msg), "BINDER_BUF_DEBUG\n%s"
1289 "binder:check=%d,success=%d,,call=%s,,from=%d,tid=%d,"
1290 "name=%s,to=%d,name=%s,,,size=%zd,,,,"
1291 ",start=%lu.%03ld,android="
1292 "%d-%02d-%02d %02d:%02d:%02d.%03lu\n"
1293 "large data size,check sender %d(%s)!\n"
1294 "check kernel log for more info\n",
1295 large_msg, 1, 0, is_async ? "async" : "sync",
1296 binder_check_buf_pid, binder_check_buf_tid,
1297 len_s ? sender_name : ((sender != NULL) ? sender->comm : ""),
1298 target_proc->pid,
1299 len_r ? rec_name :
1300 ((target_proc->tsk != NULL) ? target_proc->tsk->comm : ""),
1301 size,
1302 (unsigned long)exp_timestamp.tv_sec,
1303 (exp_timestamp.tv_nsec / NSEC_PER_MSEC),
1304 (tm.tm_year + 1900), (tm.tm_mon + 1), tm.tm_mday,
1305 tm.tm_hour, tm.tm_min, tm.tm_sec,
1306 (unsigned long)(tv.tv_usec / USEC_PER_MSEC),
1307 binder_check_buf_pid, sender ? sender->comm : "");
1308 }
1309 else
1310 {
1311 if (target_proc->large_buffer)
1312 {
1313 pr_debug("on %d:0 the largest pending trans is:\n",
1314 target_proc->pid);
1315 binder_print_buf(target_proc->large_buffer, large_msg, 1, 1);
1316 larger = binder_find_buffer_sender(target_proc->large_buffer);
1317 snprintf(aee_word, sizeof(aee_word), "check %s: large binder trans",
1318 (larger != NULL) ? larger->comm : "");
1319 snprintf(aee_msg, sizeof(aee_msg), "BINDER_BUF_DEBUG:\n%s"
1320 "binder:check=%d,success=%d,,call=%s,,from=%d,tid=%d,name=%s,"
1321 "to=%d,name=%s,,,size=%zd,,,,"
1322 ",start=%lu.%03ld,android="
1323 "%d-%02d-%02d %02d:%02d:%02d.%03lu\n"
1324 "large data size,check sender %d(%s)!\n"
1325 "check kernel log for more info\n",
1326 large_msg, 0, 0, is_async ? "async" : "sync",
1327 binder_check_buf_pid, binder_check_buf_tid,
1328 len_s ? sender_name : ((sender != NULL) ? sender->comm : ""),
1329 target_proc->pid,
1330 len_r ? rec_name :
1331 ((target_proc->tsk != NULL) ? target_proc->tsk->comm : ""),
1332 size,
1333 (unsigned long)exp_timestamp.tv_sec,
1334 (exp_timestamp.tv_nsec / NSEC_PER_MSEC),
1335 (tm.tm_year + 1900), (tm.tm_mon + 1), tm.tm_mday,
1336 tm.tm_hour, tm.tm_min, tm.tm_sec,
1337 (unsigned long)(tv.tv_usec / USEC_PER_MSEC),
1338 (larger != NULL) ? larger->pid : 0,
1339 (larger != NULL) ? larger->comm : "");
1340
1341 }
1342 else
1343 {
1344 snprintf(aee_word, sizeof(aee_word), "check %s: binder buffer exhaust ",
1345 len_r ? rec_name :
1346 ((target_proc->tsk != NULL) ? target_proc->tsk->comm : ""));
1347 snprintf(aee_msg, sizeof(aee_msg), "BINDER_BUF_DEBUG\n"
1348 "binder:check=%d,success=%d,,call=%s,,from=%d,tid=%d,name=%s,"
1349 "to=%d,name=%s,,,size=%zd,,,,"
1350 ",start=%lu.%03ld,android="
1351 "%d-%02d-%02d %02d:%02d:%02d.%03lu\n"
1352 "%d small trans pending, check receiver %d(%s)!\n"
1353 "check kernel log for more info\n",
1354 1, 0, is_async ? "async" : "sync",
1355 binder_check_buf_pid, binder_check_buf_tid,
1356 len_s ? sender_name : ((sender != NULL) ? sender->comm : ""),
1357 target_proc->pid,
1358 len_r ? rec_name :
1359 ((target_proc->tsk != NULL) ? target_proc->tsk->comm : ""),
1360 size,
1361 (unsigned long)exp_timestamp.tv_sec,
1362 (exp_timestamp.tv_nsec / NSEC_PER_MSEC),
1363 (tm.tm_year + 1900), (tm.tm_mon + 1), tm.tm_mday,
1364 tm.tm_hour, tm.tm_min, tm.tm_sec,
1365 (unsigned long)(tv.tv_usec / USEC_PER_MSEC),
1366 i, target_proc->pid,
1367 target_proc->tsk ? target_proc->tsk->comm : "");
1368 }
355b0502 1369
6fa3eb70
S		 1370 }
1371
1372 binder_check_buf_pid = -1;
1373 binder_check_buf_tid = -1;
1374 aee_kernel_warning_api(__FILE__, __LINE__, db_flag, &aee_word[0],&aee_msg[0]);
1375
1376}
1377#endif
efde99cd 1378static int task_get_unused_fd_flags(struct binder_proc *proc, int flags)
355b0502
GKH		 1379{
1380 struct files_struct *files = proc->files;
355b0502
GKH		 1381 unsigned long rlim_cur;
1382 unsigned long irqs;
1383
1384 if (files == NULL)
1385 return -ESRCH;
1386
dcfadfa4
AV		 1387 if (!lock_task_sighand(proc->tsk, &irqs))
1388 return -EMFILE;
bf202361 1389
dcfadfa4
AV		 1390 rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE);
1391 unlock_task_sighand(proc->tsk, &irqs);
355b0502 1392
dcfadfa4 1393 return __alloc_fd(files, 0, rlim_cur, flags);
355b0502
GKH		 1394}
1395
1396/*
1397 * copied from fd_install
1398 */
1399static void task_fd_install(
1400 struct binder_proc *proc, unsigned int fd, struct file *file)
1401{
f869e8a7
AV		 1402 if (proc->files)
1403 __fd_install(proc->files, fd, file);
355b0502
GKH		 1404}
1405
1406/*
1407 * copied from sys_close
1408 */
1409static long task_close_fd(struct binder_proc *proc, unsigned int fd)
1410{
355b0502
GKH		 1411 int retval;
1412
483ce1d4 1413 if (proc->files == NULL)
355b0502
GKH		 1414 return -ESRCH;
1415
483ce1d4 1416 retval = __close_fd(proc->files, fd);
355b0502
GKH		 1417 /* can't restart close syscall because file table entry was cleared */
1418 if (unlikely(retval == -ERESTARTSYS ||
1419 retval == -ERESTARTNOINTR ||
1420 retval == -ERESTARTNOHAND ||
1421 retval == -ERESTART_RESTARTBLOCK))
1422 retval = -EINTR;
1423
1424 return retval;
355b0502
GKH		 1425}
1426
975a1ac9
AH		 1427static inline void binder_lock(const char *tag)
1428{
1429 trace_binder_lock(tag);
1430 mutex_lock(&binder_main_lock);
1431 trace_binder_locked(tag);
1432}
1433
1434static inline void binder_unlock(const char *tag)
1435{
1436 trace_binder_unlock(tag);
1437 mutex_unlock(&binder_main_lock);
1438}
1439
355b0502
GKH		 1440static void binder_set_nice(long nice)
1441{
1442 long min_nice;
1443 if (can_nice(current, nice)) {
6fa3eb70
S		 1444#ifdef CONFIG_MT_PRIO_TRACER
1445 set_user_nice_binder(current, nice);
1446#else
355b0502 1447 set_user_nice(current, nice);
6fa3eb70 1448#endif
355b0502
GKH		 1449 return;
1450 }
1451 min_nice = 20 - current->signal->rlim[RLIMIT_NICE].rlim_cur;
1452 binder_debug(BINDER_DEBUG_PRIORITY_CAP,
56b468fc
AS		 1453 "%d: nice value %ld not allowed use %ld instead\n",
1454 current->pid, nice, min_nice);
6fa3eb70
S		 1455#ifdef CONFIG_MT_PRIO_TRACER
1456 set_user_nice_binder(current, min_nice);
1457#else
355b0502 1458 set_user_nice(current, min_nice);
6fa3eb70 1459#endif
355b0502
GKH		 1460 if (min_nice < 20)
1461 return;
56b468fc 1462 binder_user_error("%d RLIMIT_NICE not set\n", current->pid);
355b0502
GKH		 1463}
1464
1465static size_t binder_buffer_size(struct binder_proc *proc,
1466 struct binder_buffer *buffer)
1467{
1468 if (list_is_last(&buffer->entry, &proc->buffers))
1469 return proc->buffer + proc->buffer_size - (void *)buffer->data;
1470 else
1471 return (size_t)list_entry(buffer->entry.next,
1472 struct binder_buffer, entry) - (size_t)buffer->data;
1473}
1474
1475static void binder_insert_free_buffer(struct binder_proc *proc,
1476 struct binder_buffer *new_buffer)
1477{
1478 struct rb_node **p = &proc->free_buffers.rb_node;
1479 struct rb_node *parent = NULL;
1480 struct binder_buffer *buffer;
1481 size_t buffer_size;
1482 size_t new_buffer_size;
1483
1484 BUG_ON(!new_buffer->free);
1485
1486 new_buffer_size = binder_buffer_size(proc, new_buffer);
1487
1488 binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
4b9e9796 1489 "%d: add free buffer, size %zd, at %pK\n",
56b468fc 1490 proc->pid, new_buffer_size, new_buffer);
355b0502
GKH		 1491
1492 while (*p) {
1493 parent = *p;
1494 buffer = rb_entry(parent, struct binder_buffer, rb_node);
1495 BUG_ON(!buffer->free);
1496
1497 buffer_size = binder_buffer_size(proc, buffer);
1498
1499 if (new_buffer_size < buffer_size)
1500 p = &parent->rb_left;
1501 else
1502 p = &parent->rb_right;
1503 }
1504 rb_link_node(&new_buffer->rb_node, parent, p);
1505 rb_insert_color(&new_buffer->rb_node, &proc->free_buffers);
1506}
1507
1508static void binder_insert_allocated_buffer(struct binder_proc *proc,
1509 struct binder_buffer *new_buffer)
1510{
1511 struct rb_node **p = &proc->allocated_buffers.rb_node;
1512 struct rb_node *parent = NULL;
1513 struct binder_buffer *buffer;
1514
1515 BUG_ON(new_buffer->free);
1516
1517 while (*p) {
1518 parent = *p;
1519 buffer = rb_entry(parent, struct binder_buffer, rb_node);
1520 BUG_ON(buffer->free);
1521
1522 if (new_buffer < buffer)
1523 p = &parent->rb_left;
1524 else if (new_buffer > buffer)
1525 p = &parent->rb_right;
1526 else
1527 BUG();
1528 }
1529 rb_link_node(&new_buffer->rb_node, parent, p);
1530 rb_insert_color(&new_buffer->rb_node, &proc->allocated_buffers);
1531}
1532
1533static struct binder_buffer *binder_buffer_lookup(struct binder_proc *proc,
6fa3eb70 1534 uintptr_t user_ptr)
355b0502
GKH		 1535{
1536 struct rb_node *n = proc->allocated_buffers.rb_node;
1537 struct binder_buffer *buffer;
1538 struct binder_buffer *kern_ptr;
1539
6fa3eb70
S		 1540 kern_ptr = (struct binder_buffer *)(user_ptr - proc->user_buffer_offset
1541 - offsetof(struct binder_buffer, data));
355b0502
GKH		 1542
1543 while (n) {
1544 buffer = rb_entry(n, struct binder_buffer, rb_node);
1545 BUG_ON(buffer->free);
1546
1547 if (kern_ptr < buffer)
1548 n = n->rb_left;
1549 else if (kern_ptr > buffer)
1550 n = n->rb_right;
1551 else
1552 return buffer;
1553 }
1554 return NULL;
1555}
1556
1557static int binder_update_page_range(struct binder_proc *proc, int allocate,
1558 void *start, void *end,
1559 struct vm_area_struct *vma)
1560{
1561 void *page_addr;
1562 unsigned long user_page_addr;
1563 struct vm_struct tmp_area;
1564 struct page **page;
1565 struct mm_struct *mm;
1566
1567 binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
4b9e9796 1568 "%d: %s pages %pK-%pK\n", proc->pid,
355b0502
GKH		 1569 allocate ? "allocate" : "free", start, end);
1570
1571 if (end <= start)
1572 return 0;
1573
975a1ac9
AH		 1574 trace_binder_update_page_range(proc, allocate, start, end);
1575
355b0502
GKH		 1576 if (vma)
1577 mm = NULL;
1578 else
1579 mm = get_task_mm(proc->tsk);
1580
1581 if (mm) {
1582 down_write(&mm->mmap_sem);
1583 vma = proc->vma;
2a90957f 1584 if (vma && mm != proc->vma_vm_mm) {
56b468fc 1585 pr_err("%d: vma mm and task mm mismatch\n",
bd1eff97
AH		 1586 proc->pid);
1587 vma = NULL;
1588 }
355b0502
GKH		 1589 }
1590
1591 if (allocate == 0)
1592 goto free_range;
1593
1594 if (vma == NULL) {
56b468fc
AS		 1595 pr_err("%d: binder_alloc_buf failed to map pages in userspace, no vma\n",
1596 proc->pid);
355b0502
GKH		 1597 goto err_no_vma;
1598 }
1599
1600 for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) {
1601 int ret;
1602 struct page **page_array_ptr;
1603 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE];
1604
1605 BUG_ON(*page);
585650dc 1606 *page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO);
355b0502 1607 if (*page == NULL) {
4b9e9796 1608 pr_err("%d: binder_alloc_buf failed for page at %pK\n",
56b468fc 1609 proc->pid, page_addr);
355b0502
GKH		 1610 goto err_alloc_page_failed;
1611 }
6fa3eb70
S		 1612#ifdef MTK_BINDER_PAGE_USED_RECORD
1613 binder_page_used++;
1614 proc->page_used++;
1615 if(binder_page_used > binder_page_used_peak)
1616 binder_page_used_peak = binder_page_used;
1617 if (proc->page_used > proc->page_used_peak)
1618 proc->page_used_peak = proc->page_used;
1619#endif
355b0502
GKH		 1620 tmp_area.addr = page_addr;
1621 tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */;
1622 page_array_ptr = page;
1623 ret = map_vm_area(&tmp_area, PAGE_KERNEL, &page_array_ptr);
1624 if (ret) {
4b9e9796 1625 pr_err("%d: binder_alloc_buf failed to map page at %pK in kernel\n",
355b0502
GKH		 1626 proc->pid, page_addr);
1627 goto err_map_kernel_failed;
1628 }
1629 user_page_addr =
1630 (uintptr_t)page_addr + proc->user_buffer_offset;
1631 ret = vm_insert_page(vma, user_page_addr, page[0]);
1632 if (ret) {
56b468fc 1633 pr_err("%d: binder_alloc_buf failed to map page at %lx in userspace\n",
355b0502
GKH		 1634 proc->pid, user_page_addr);
1635 goto err_vm_insert_page_failed;
1636 }
1637 /* vm_insert_page does not seem to increment the refcount */
1638 }
1639 if (mm) {
1640 up_write(&mm->mmap_sem);
1641 mmput(mm);
1642 }
1643 return 0;
1644
1645free_range:
1646 for (page_addr = end - PAGE_SIZE; page_addr >= start;
1647 page_addr -= PAGE_SIZE) {
1648 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE];
1649 if (vma)
1650 zap_page_range(vma, (uintptr_t)page_addr +
1651 proc->user_buffer_offset, PAGE_SIZE, NULL);
1652err_vm_insert_page_failed:
1653 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE);
1654err_map_kernel_failed:
1655 __free_page(*page);
1656 *page = NULL;
6fa3eb70
S		 1657#ifdef MTK_BINDER_PAGE_USED_RECORD
1658 if(binder_page_used > 0)
1659 binder_page_used--;
1660 if (proc->page_used > 0)
1661 proc->page_used--;
1662#endif
355b0502
GKH		 1663err_alloc_page_failed:
1664 ;
1665 }
1666err_no_vma:
1667 if (mm) {
1668 up_write(&mm->mmap_sem);
1669 mmput(mm);
1670 }
1671 return -ENOMEM;
1672}
1673
1674static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc,
1675 size_t data_size,
1676 size_t offsets_size, int is_async)
1677{
1678 struct rb_node *n = proc->free_buffers.rb_node;
1679 struct binder_buffer *buffer;
1680 size_t buffer_size;
1681 struct rb_node *best_fit = NULL;
1682 void *has_page_addr;
1683 void *end_page_addr;
1684 size_t size;
6fa3eb70
S		 1685#ifdef MTK_BINDER_DEBUG
1686 size_t proc_max_size;
1687#endif
355b0502 1688 if (proc->vma == NULL) {
56b468fc 1689 pr_err("%d: binder_alloc_buf, no vma\n",
355b0502
GKH		 1690 proc->pid);
1691 return NULL;
1692 }
1693
1694 size = ALIGN(data_size, sizeof(void *)) +
1695 ALIGN(offsets_size, sizeof(void *));
1696
1697 if (size < data_size || size < offsets_size) {
56b468fc
AS		 1698 binder_user_error("%d: got transaction with invalid size %zd-%zd\n",
1699 proc->pid, data_size, offsets_size);
355b0502
GKH		 1700 return NULL;
1701 }
1702
6fa3eb70
S		 1703#ifdef MTK_BINDER_DEBUG
1704 proc_max_size = (is_async ? (proc->buffer_size/2) : proc->buffer_size);
1705
1706 if(proc_max_size < size + sizeof(struct binder_buffer)){
1707 binder_user_error("%d: got transaction with too large size "
1708 "%s alloc size %zd-%zd allowed size %zd\n", proc->pid,
1709 is_async ? "async" : "sync", data_size, offsets_size,
1710 (proc_max_size - sizeof(struct binder_buffer)));
1711 return NULL;
1712 }
1713#endif
355b0502
GKH		 1714 if (is_async &&
1715 proc->free_async_space < size + sizeof(struct binder_buffer)) {
6fa3eb70
S		 1716#ifdef MTK_BINDER_DEBUG
1717 pr_err("%d: binder_alloc_buf size %zd "
1718 "failed, no async space left (%zd)\n",
1719 proc->pid, size, proc->free_async_space);
1720#else
355b0502 1721 binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
56b468fc
AS		 1722 "%d: binder_alloc_buf size %zd failed, no async space left\n",
1723 proc->pid, size);
6fa3eb70
S		 1724#endif
1725#ifdef BINDER_MONITOR
1726 binder_check_buf(proc, size, 1);
1727#endif
355b0502
GKH		 1728 return NULL;
1729 }
1730
1731 while (n) {
1732 buffer = rb_entry(n, struct binder_buffer, rb_node);
1733 BUG_ON(!buffer->free);
1734 buffer_size = binder_buffer_size(proc, buffer);
1735
1736 if (size < buffer_size) {
1737 best_fit = n;
1738 n = n->rb_left;
1739 } else if (size > buffer_size)
1740 n = n->rb_right;
1741 else {
1742 best_fit = n;
1743 break;
1744 }
1745 }
6fa3eb70
S		 1746#ifdef BINDER_MONITOR
1747 if (log_disable & BINDER_BUF_WARN)
1748 {
1749 if (size > 64)
1750 {
1751 pr_err("%d: binder_alloc_buf size %zd failed, UT auto triggerd!\n",
1752 proc->pid, size);
1753 binder_check_buf(proc, size, 0);
1754 }
1755 }
1756#endif
355b0502 1757 if (best_fit == NULL) {
6fa3eb70
S		 1758 pr_err("%d: binder_alloc_buf size %zd failed, "
1759 "no address space\n", proc->pid, size);
1760#ifdef BINDER_MONITOR
1761 binder_check_buf(proc, size, 0);
1762#endif
355b0502
GKH		 1763 return NULL;
1764 }
1765 if (n == NULL) {
1766 buffer = rb_entry(best_fit, struct binder_buffer, rb_node);
1767 buffer_size = binder_buffer_size(proc, buffer);
1768 }
1769
1770 binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
4b9e9796 1771 "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n",
56b468fc 1772 proc->pid, size, buffer, buffer_size);
355b0502
GKH		 1773
1774 has_page_addr =
1775 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK);
1776 if (n == NULL) {
1777 if (size + sizeof(struct binder_buffer) + 4 >= buffer_size)
1778 buffer_size = size; /* no room for other buffers */
1779 else
1780 buffer_size = size + sizeof(struct binder_buffer);
1781 }
1782 end_page_addr =
1783 (void *)PAGE_ALIGN((uintptr_t)buffer->data + buffer_size);
1784 if (end_page_addr > has_page_addr)
1785 end_page_addr = has_page_addr;
1786 if (binder_update_page_range(proc, 1,
1787 (void *)PAGE_ALIGN((uintptr_t)buffer->data), end_page_addr, NULL))
1788 return NULL;
1789
1790 rb_erase(best_fit, &proc->free_buffers);
1791 buffer->free = 0;
1792 binder_insert_allocated_buffer(proc, buffer);
1793 if (buffer_size != size) {
1794 struct binder_buffer *new_buffer = (void *)buffer->data + size;
1795 list_add(&new_buffer->entry, &buffer->entry);
1796 new_buffer->free = 1;
1797 binder_insert_free_buffer(proc, new_buffer);
1798 }
1799 binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
4b9e9796 1800 "%d: binder_alloc_buf size %zd got %pK\n",
56b468fc 1801 proc->pid, size, buffer);
355b0502
GKH		 1802 buffer->data_size = data_size;
1803 buffer->offsets_size = offsets_size;
1804 buffer->async_transaction = is_async;
1805 if (is_async) {
1806 proc->free_async_space -= size + sizeof(struct binder_buffer);
1807 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
56b468fc
AS		 1808 "%d: binder_alloc_buf size %zd async free %zd\n",
1809 proc->pid, size, proc->free_async_space);
355b0502
GKH		 1810 }
1811
1812 return buffer;
1813}
1814
1815static void *buffer_start_page(struct binder_buffer *buffer)
1816{
1817 return (void *)((uintptr_t)buffer & PAGE_MASK);
1818}
1819
1820static void *buffer_end_page(struct binder_buffer *buffer)
1821{
1822 return (void *)(((uintptr_t)(buffer + 1) - 1) & PAGE_MASK);
1823}
1824
1825static void binder_delete_free_buffer(struct binder_proc *proc,
1826 struct binder_buffer *buffer)
1827{
1828 struct binder_buffer *prev, *next = NULL;
1829 int free_page_end = 1;
1830 int free_page_start = 1;
1831
1832 BUG_ON(proc->buffers.next == &buffer->entry);
1833 prev = list_entry(buffer->entry.prev, struct binder_buffer, entry);
1834 BUG_ON(!prev->free);
1835 if (buffer_end_page(prev) == buffer_start_page(buffer)) {
1836 free_page_start = 0;
1837 if (buffer_end_page(prev) == buffer_end_page(buffer))
1838 free_page_end = 0;
1839 binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
4b9e9796 1840 "%d: merge free, buffer %pK share page with %pK\n",
56b468fc 1841 proc->pid, buffer, prev);
355b0502
GKH		 1842 }
1843
1844 if (!list_is_last(&buffer->entry, &proc->buffers)) {
1845 next = list_entry(buffer->entry.next,
1846 struct binder_buffer, entry);
1847 if (buffer_start_page(next) == buffer_end_page(buffer)) {
1848 free_page_end = 0;
1849 if (buffer_start_page(next) ==
1850 buffer_start_page(buffer))
1851 free_page_start = 0;
1852 binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
4b9e9796 1853 "%d: merge free, buffer %pK share page with %pK\n",
56b468fc 1854 proc->pid, buffer, prev);
355b0502
GKH		 1855 }
1856 }
1857 list_del(&buffer->entry);
1858 if (free_page_start || free_page_end) {
1859 binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
4b9e9796 1860 "%d: merge free, buffer %pK do not share page%s%s with %pK or %pK\n",
355b0502
GKH		 1861 proc->pid, buffer, free_page_start ? "" : " end",
1862 free_page_end ? "" : " start", prev, next);
1863 binder_update_page_range(proc, 0, free_page_start ?
1864 buffer_start_page(buffer) : buffer_end_page(buffer),
1865 (free_page_end ? buffer_end_page(buffer) :
1866 buffer_start_page(buffer)) + PAGE_SIZE, NULL);
1867 }
1868}
1869
1870static void binder_free_buf(struct binder_proc *proc,
1871 struct binder_buffer *buffer)
1872{
1873 size_t size, buffer_size;
1874
1875 buffer_size = binder_buffer_size(proc, buffer);
1876
1877 size = ALIGN(buffer->data_size, sizeof(void *)) +
1878 ALIGN(buffer->offsets_size, sizeof(void *));
1879
1880 binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
4b9e9796 1881 "%d: binder_free_buf %pK size %zd buffer_size %zd\n",
56b468fc 1882 proc->pid, buffer, size, buffer_size);
355b0502
GKH		 1883
1884 BUG_ON(buffer->free);
1885 BUG_ON(size > buffer_size);
1886 BUG_ON(buffer->transaction != NULL);
1887 BUG_ON((void *)buffer < proc->buffer);
1888 BUG_ON((void *)buffer > proc->buffer + proc->buffer_size);
6fa3eb70
S		 1889#ifdef BINDER_MONITOR
1890 buffer->log_entry = NULL;
1891#endif
355b0502
GKH		 1892
1893 if (buffer->async_transaction) {
1894 proc->free_async_space += size + sizeof(struct binder_buffer);
1895
1896 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
56b468fc
AS		 1897 "%d: binder_free_buf size %zd async free %zd\n",
1898 proc->pid, size, proc->free_async_space);
355b0502
GKH		 1899 }
1900
1901 binder_update_page_range(proc, 0,
1902 (void *)PAGE_ALIGN((uintptr_t)buffer->data),
1903 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK),
1904 NULL);
1905 rb_erase(&buffer->rb_node, &proc->allocated_buffers);
1906 buffer->free = 1;
1907 if (!list_is_last(&buffer->entry, &proc->buffers)) {
1908 struct binder_buffer *next = list_entry(buffer->entry.next,
1909 struct binder_buffer, entry);
1910 if (next->free) {
1911 rb_erase(&next->rb_node, &proc->free_buffers);
1912 binder_delete_free_buffer(proc, next);
1913 }
1914 }
1915 if (proc->buffers.next != &buffer->entry) {
1916 struct binder_buffer *prev = list_entry(buffer->entry.prev,
1917 struct binder_buffer, entry);
1918 if (prev->free) {
1919 binder_delete_free_buffer(proc, buffer);
1920 rb_erase(&prev->rb_node, &proc->free_buffers);
1921 buffer = prev;
1922 }
1923 }
1924 binder_insert_free_buffer(proc, buffer);
1925}
1926
1927static struct binder_node *binder_get_node(struct binder_proc *proc,
6fa3eb70 1928 binder_uintptr_t ptr)
355b0502
GKH		 1929{
1930 struct rb_node *n = proc->nodes.rb_node;
1931 struct binder_node *node;
1932
1933 while (n) {
1934 node = rb_entry(n, struct binder_node, rb_node);
1935
1936 if (ptr < node->ptr)
1937 n = n->rb_left;
1938 else if (ptr > node->ptr)
1939 n = n->rb_right;
1940 else
1941 return node;
1942 }
1943 return NULL;
1944}
1945
1946static struct binder_node *binder_new_node(struct binder_proc *proc,
6fa3eb70
S		 1947 binder_uintptr_t ptr,
1948 binder_uintptr_t cookie)
355b0502
GKH		 1949{
1950 struct rb_node **p = &proc->nodes.rb_node;
1951 struct rb_node *parent = NULL;
1952 struct binder_node *node;
1953
1954 while (*p) {
1955 parent = *p;
1956 node = rb_entry(parent, struct binder_node, rb_node);
1957
1958 if (ptr < node->ptr)
1959 p = &(*p)->rb_left;
1960 else if (ptr > node->ptr)
1961 p = &(*p)->rb_right;
1962 else
1963 return NULL;
1964 }
1965
1966 node = kzalloc(sizeof(*node), GFP_KERNEL);
1967 if (node == NULL)
1968 return NULL;
1969 binder_stats_created(BINDER_STAT_NODE);
1970 rb_link_node(&node->rb_node, parent, p);
1971 rb_insert_color(&node->rb_node, &proc->nodes);
1972 node->debug_id = ++binder_last_id;
1973 node->proc = proc;
1974 node->ptr = ptr;
1975 node->cookie = cookie;
1976 node->work.type = BINDER_WORK_NODE;
1977 INIT_LIST_HEAD(&node->work.entry);
1978 INIT_LIST_HEAD(&node->async_todo);
1979 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
6fa3eb70 1980 "%d:%d node %d u%016llx c%016llx created\n",
355b0502 1981 proc->pid, current->pid, node->debug_id,
6fa3eb70 1982 (u64)node->ptr, (u64)node->cookie);
355b0502
GKH		 1983 return node;
1984}
1985
1986static int binder_inc_node(struct binder_node *node, int strong, int internal,
1987 struct list_head *target_list)
1988{
1989 if (strong) {
1990 if (internal) {
1991 if (target_list == NULL &&
1992 node->internal_strong_refs == 0 &&
1993 !(node == binder_context_mgr_node &&
1994 node->has_strong_ref)) {
56b468fc
AS		 1995 pr_err("invalid inc strong node for %d\n",
1996 node->debug_id);
355b0502
GKH		 1997 return -EINVAL;
1998 }
1999 node->internal_strong_refs++;
2000 } else
2001 node->local_strong_refs++;
2002 if (!node->has_strong_ref && target_list) {
2003 list_del_init(&node->work.entry);
2004 list_add_tail(&node->work.entry, target_list);
2005 }
2006 } else {
2007 if (!internal)
2008 node->local_weak_refs++;
2009 if (!node->has_weak_ref && list_empty(&node->work.entry)) {
2010 if (target_list == NULL) {
56b468fc
AS		 2011 pr_err("invalid inc weak node for %d\n",
2012 node->debug_id);
355b0502
GKH		 2013 return -EINVAL;
2014 }
2015 list_add_tail(&node->work.entry, target_list);
2016 }
2017 }
2018 return 0;
2019}
2020
2021static int binder_dec_node(struct binder_node *node, int strong, int internal)
2022{
2023 if (strong) {
2024 if (internal)
2025 node->internal_strong_refs--;
2026 else
2027 node->local_strong_refs--;
2028 if (node->local_strong_refs || node->internal_strong_refs)
2029 return 0;
2030 } else {
2031 if (!internal)
2032 node->local_weak_refs--;
2033 if (node->local_weak_refs || !hlist_empty(&node->refs))
2034 return 0;
2035 }
2036 if (node->proc && (node->has_strong_ref || node->has_weak_ref)) {
2037 if (list_empty(&node->work.entry)) {
2038 list_add_tail(&node->work.entry, &node->proc->todo);
2039 wake_up_interruptible(&node->proc->wait);
2040 }
2041 } else {
2042 if (hlist_empty(&node->refs) && !node->local_strong_refs &&
2043 !node->local_weak_refs) {
2044 list_del_init(&node->work.entry);
2045 if (node->proc) {
2046 rb_erase(&node->rb_node, &node->proc->nodes);
2047 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
56b468fc 2048 "refless node %d deleted\n",
355b0502
GKH		 2049 node->debug_id);
2050 } else {
2051 hlist_del(&node->dead_node);
2052 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
56b468fc 2053 "dead node %d deleted\n",
355b0502
GKH		 2054 node->debug_id);
2055 }
2056 kfree(node);
2057 binder_stats_deleted(BINDER_STAT_NODE);
2058 }
2059 }
2060
2061 return 0;
2062}
2063
2064
2065static struct binder_ref *binder_get_ref(struct binder_proc *proc,
4b9e9796 2066 uint32_t desc, bool need_strong_ref)
355b0502
GKH		 2067{
2068 struct rb_node *n = proc->refs_by_desc.rb_node;
2069 struct binder_ref *ref;
2070
2071 while (n) {
2072 ref = rb_entry(n, struct binder_ref, rb_node_desc);
2073
4b9e9796 2074 if (desc < ref->desc) {
355b0502 2075 n = n->rb_left;
4b9e9796 2076 } else if (desc > ref->desc) {
355b0502 2077 n = n->rb_right;
4b9e9796
S		 2078 } else if (need_strong_ref && !ref->strong) {
2079 binder_user_error("tried to use weak ref as strong ref\n");
2080 return NULL;
2081 } else {
355b0502 2082 return ref;
4b9e9796 2083 }
355b0502
GKH		 2084 }
2085 return NULL;
2086}
2087
2088static struct binder_ref *binder_get_ref_for_node(struct binder_proc *proc,
2089 struct binder_node *node)
2090{
2091 struct rb_node *n;
2092 struct rb_node **p = &proc->refs_by_node.rb_node;
2093 struct rb_node *parent = NULL;
2094 struct binder_ref *ref, *new_ref;
2095
2096 while (*p) {
2097 parent = *p;
2098 ref = rb_entry(parent, struct binder_ref, rb_node_node);
2099
2100 if (node < ref->node)
2101 p = &(*p)->rb_left;
2102 else if (node > ref->node)
2103 p = &(*p)->rb_right;
2104 else
2105 return ref;
2106 }
2107 new_ref = kzalloc(sizeof(*ref), GFP_KERNEL);
2108 if (new_ref == NULL)
2109 return NULL;
2110 binder_stats_created(BINDER_STAT_REF);
2111 new_ref->debug_id = ++binder_last_id;
2112 new_ref->proc = proc;
2113 new_ref->node = node;
2114 rb_link_node(&new_ref->rb_node_node, parent, p);
2115 rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node);
2116
2117 new_ref->desc = (node == binder_context_mgr_node) ? 0 : 1;
2118 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) {
2119 ref = rb_entry(n, struct binder_ref, rb_node_desc);
2120 if (ref->desc > new_ref->desc)
2121 break;
2122 new_ref->desc = ref->desc + 1;
2123 }
2124
2125 p = &proc->refs_by_desc.rb_node;
2126 while (*p) {
2127 parent = *p;
2128 ref = rb_entry(parent, struct binder_ref, rb_node_desc);
2129
2130 if (new_ref->desc < ref->desc)
2131 p = &(*p)->rb_left;
2132 else if (new_ref->desc > ref->desc)
2133 p = &(*p)->rb_right;
2134 else
2135 BUG();
2136 }
2137 rb_link_node(&new_ref->rb_node_desc, parent, p);
2138 rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc);
2139 if (node) {
2140 hlist_add_head(&new_ref->node_entry, &node->refs);
2141
2142 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
56b468fc
AS		 2143 "%d new ref %d desc %d for node %d\n",
2144 proc->pid, new_ref->debug_id, new_ref->desc,
2145 node->debug_id);
355b0502
GKH		 2146 } else {
2147 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
56b468fc
AS		 2148 "%d new ref %d desc %d for dead node\n",
2149 proc->pid, new_ref->debug_id, new_ref->desc);
355b0502
GKH		 2150 }
2151 return new_ref;
2152}
2153
2154static void binder_delete_ref(struct binder_ref *ref)
2155{
2156 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
56b468fc
AS		 2157 "%d delete ref %d desc %d for node %d\n",
2158 ref->proc->pid, ref->debug_id, ref->desc,
2159 ref->node->debug_id);
355b0502
GKH		 2160
2161 rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc);
2162 rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node);
2163 if (ref->strong)
2164 binder_dec_node(ref->node, 1, 1);
2165 hlist_del(&ref->node_entry);
2166 binder_dec_node(ref->node, 0, 1);
2167 if (ref->death) {
2168 binder_debug(BINDER_DEBUG_DEAD_BINDER,
56b468fc
AS		 2169 "%d delete ref %d desc %d has death notification\n",
2170 ref->proc->pid, ref->debug_id, ref->desc);
355b0502
GKH		 2171 list_del(&ref->death->work.entry);
2172 kfree(ref->death);
2173 binder_stats_deleted(BINDER_STAT_DEATH);
2174 }
2175 kfree(ref);
2176 binder_stats_deleted(BINDER_STAT_REF);
2177}
2178
2179static int binder_inc_ref(struct binder_ref *ref, int strong,
2180 struct list_head *target_list)
2181{
2182 int ret;
2183 if (strong) {
2184 if (ref->strong == 0) {
2185 ret = binder_inc_node(ref->node, 1, 1, target_list);
2186 if (ret)
2187 return ret;
2188 }
2189 ref->strong++;
2190 } else {
2191 if (ref->weak == 0) {
2192 ret = binder_inc_node(ref->node, 0, 1, target_list);
2193 if (ret)
2194 return ret;
2195 }
2196 ref->weak++;
2197 }
2198 return 0;
2199}
2200
2201
2202static int binder_dec_ref(struct binder_ref *ref, int strong)
2203{
2204 if (strong) {
2205 if (ref->strong == 0) {
56b468fc 2206 binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n",
355b0502
GKH		 2207 ref->proc->pid, ref->debug_id,
2208 ref->desc, ref->strong, ref->weak);
2209 return -EINVAL;
2210 }
2211 ref->strong--;
2212 if (ref->strong == 0) {
2213 int ret;
2214 ret = binder_dec_node(ref->node, strong, 1);
2215 if (ret)
2216 return ret;
2217 }
2218 } else {
2219 if (ref->weak == 0) {
56b468fc 2220 binder_user_error("%d invalid dec weak, ref %d desc %d s %d w %d\n",
355b0502
GKH		 2221 ref->proc->pid, ref->debug_id,
2222 ref->desc, ref->strong, ref->weak);
2223 return -EINVAL;
2224 }
2225 ref->weak--;
2226 }
2227 if (ref->strong == 0 && ref->weak == 0)
2228 binder_delete_ref(ref);
2229 return 0;
2230}
2231
2232static void binder_pop_transaction(struct binder_thread *target_thread,
2233 struct binder_transaction *t)
2234{
2235 if (target_thread) {
2236 BUG_ON(target_thread->transaction_stack != t);
2237 BUG_ON(target_thread->transaction_stack->from != target_thread);
2238 target_thread->transaction_stack =
2239 target_thread->transaction_stack->from_parent;
2240 t->from = NULL;
2241 }
2242 t->need_reply = 0;
2243 if (t->buffer)
2244 t->buffer->transaction = NULL;
6fa3eb70
S		 2245#ifdef BINDER_MONITOR
2246 binder_cancel_bwdog(t);
2247#endif
355b0502
GKH		 2248 kfree(t);
2249 binder_stats_deleted(BINDER_STAT_TRANSACTION);
2250}
2251
2252static void binder_send_failed_reply(struct binder_transaction *t,
2253 uint32_t error_code)
2254{
2255 struct binder_thread *target_thread;
2256 BUG_ON(t->flags & TF_ONE_WAY);
2257 while (1) {
2258 target_thread = t->from;
2259 if (target_thread) {
2260 if (target_thread->return_error != BR_OK &&
2261 target_thread->return_error2 == BR_OK) {
2262 target_thread->return_error2 =
2263 target_thread->return_error;
2264 target_thread->return_error = BR_OK;
2265 }
2266 if (target_thread->return_error == BR_OK) {
2267 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
56b468fc 2268 "send failed reply for transaction %d to %d:%d\n",
355b0502
GKH		 2269 t->debug_id, target_thread->proc->pid,
2270 target_thread->pid);
2271
2272 binder_pop_transaction(target_thread, t);
2273 target_thread->return_error = error_code;
2274 wake_up_interruptible(&target_thread->wait);
2275 } else {
56b468fc
AS		 2276 pr_err("reply failed, target thread, %d:%d, has error code %d already\n",
2277 target_thread->proc->pid,
355b0502
GKH		 2278 target_thread->pid,
2279 target_thread->return_error);
2280 }
2281 return;
2282 } else {
2283 struct binder_transaction *next = t->from_parent;
2284
2285 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
56b468fc 2286 "send failed reply for transaction %d, target dead\n",
355b0502
GKH		 2287 t->debug_id);
2288
2289 binder_pop_transaction(target_thread, t);
2290 if (next == NULL) {
2291 binder_debug(BINDER_DEBUG_DEAD_BINDER,
56b468fc 2292 "reply failed, no target thread at root\n");
355b0502
GKH		 2293 return;
2294 }
2295 t = next;
2296 binder_debug(BINDER_DEBUG_DEAD_BINDER,
56b468fc
AS		 2297 "reply failed, no target thread -- retry %d\n",
2298 t->debug_id);
355b0502
GKH		 2299 }
2300 }
2301}
2302
2303static void binder_transaction_buffer_release(struct binder_proc *proc,
2304 struct binder_buffer *buffer,
6fa3eb70 2305 binder_size_t *failed_at)
355b0502 2306{
6fa3eb70 2307 binder_size_t *offp, *off_end;
355b0502
GKH		 2308 int debug_id = buffer->debug_id;
2309
2310 binder_debug(BINDER_DEBUG_TRANSACTION,
4b9e9796 2311 "%d buffer release %d, size %zd-%zd, failed at %pK\n",
355b0502
GKH		 2312 proc->pid, buffer->debug_id,
2313 buffer->data_size, buffer->offsets_size, failed_at);
2314
2315 if (buffer->target_node)
2316 binder_dec_node(buffer->target_node, 1, 0);
2317
6fa3eb70
S		 2318 offp = (binder_size_t *)(buffer->data +
2319 ALIGN(buffer->data_size, sizeof(void *)));
355b0502
GKH		 2320 if (failed_at)
2321 off_end = failed_at;
2322 else
2323 off_end = (void *)offp + buffer->offsets_size;
2324 for (; offp < off_end; offp++) {
2325 struct flat_binder_object *fp;
2326 if (*offp > buffer->data_size - sizeof(*fp) ||
2327 buffer->data_size < sizeof(*fp) ||
6fa3eb70
S		 2328 !IS_ALIGNED(*offp, sizeof(u32))) {
2329 pr_err("transaction release %d bad offset %lld, size %zd\n",
2330 debug_id, (u64)*offp, buffer->data_size);
355b0502
GKH		 2331 continue;
2332 }
2333 fp = (struct flat_binder_object *)(buffer->data + *offp);
2334 switch (fp->type) {
2335 case BINDER_TYPE_BINDER:
2336 case BINDER_TYPE_WEAK_BINDER: {
2337 struct binder_node *node = binder_get_node(proc, fp->binder);
2338 if (node == NULL) {
6fa3eb70
S		 2339 pr_err("transaction release %d bad node %016llx\n",
2340 debug_id, (u64)fp->binder);
355b0502
GKH		 2341 break;
2342 }
2343 binder_debug(BINDER_DEBUG_TRANSACTION,
6fa3eb70
S		 2344 " node %d u%016llx\n",
2345 node->debug_id, (u64)node->ptr);
355b0502
GKH		 2346 binder_dec_node(node, fp->type == BINDER_TYPE_BINDER, 0);
2347 } break;
2348 case BINDER_TYPE_HANDLE:
2349 case BINDER_TYPE_WEAK_HANDLE: {
4b9e9796
S		 2350 struct binder_ref *ref = binder_get_ref(proc, fp->handle,
2351 fp->type == BINDER_TYPE_HANDLE);
355b0502 2352 if (ref == NULL) {
6fa3eb70 2353 pr_err("transaction release %d bad handle %d\n",
56b468fc 2354 debug_id, fp->handle);
355b0502
GKH		 2355 break;
2356 }
2357 binder_debug(BINDER_DEBUG_TRANSACTION,
2358 " ref %d desc %d (node %d)\n",
2359 ref->debug_id, ref->desc, ref->node->debug_id);
2360 binder_dec_ref(ref, fp->type == BINDER_TYPE_HANDLE);
2361 } break;
2362
2363 case BINDER_TYPE_FD:
2364 binder_debug(BINDER_DEBUG_TRANSACTION,
6fa3eb70 2365 " fd %d\n", fp->handle);
355b0502
GKH		 2366 if (failed_at)
2367 task_close_fd(proc, fp->handle);
2368 break;
2369
2370 default:
6fa3eb70 2371 pr_err("transaction release %d bad object type %x\n",
56b468fc 2372 debug_id, fp->type);
355b0502
GKH		 2373 break;
2374 }
2375 }
2376}
2377
6fa3eb70
S		 2378#ifdef RT_PRIO_INHERIT
2379static void mt_sched_setscheduler_nocheck(struct task_struct *p, int policy, struct sched_param *param)
2380{
2381 int ret;
2382 if (policy == SCHED_FIFO || policy == SCHED_RR)
2383 param->sched_priority |= MT_ALLOW_RT_PRIO_BIT;
2384
2385 #ifdef CONFIG_MT_PRIO_TRACER
2386 ret = sched_setscheduler_nocheck_binder(p, policy, param);
2387 #else
2388 ret = sched_setscheduler_nocheck(p, policy, param);
2389 #endif
2390 if (ret)
2391 pr_err("set scheduler fail, error code: %d\n", ret);
2392}
2393#endif
2394
2395#ifdef BINDER_MONITOR
2396/* binder_update_transaction_time - update read/exec done time for transaction
2397** step:
2398** 0: start // not used
2399** 1: read
2400** 2: reply
2401*/
2402static void binder_update_transaction_time(struct binder_transaction_log *t_log,
2403 struct binder_transaction *bt, int step)
2404{
2405 if (step < 1 || step > 2) {
2406 pr_err("update trans time fail, wrong step value for id %d\n",
2407 bt->debug_id);
2408 return;
2409 }
2410
2411 if ((NULL == bt) || (bt->log_idx == -1) || (bt->log_idx > (t_log->size - 1)))
2412 return;
2413 if (t_log->entry[bt->log_idx].debug_id == bt->debug_id) {
2414 if (step == 1)
2415 do_posix_clock_monotonic_gettime(&t_log->entry[bt->log_idx].readstamp);
2416 else if (step == 2)
2417 do_posix_clock_monotonic_gettime(&t_log->entry[bt->log_idx].endstamp);
2418 }
2419}
2420/* binder_update_transaction_tid - update to thread pid transaction
2421*/
2422static void binder_update_transaction_ttid(struct binder_transaction_log *t_log,
2423 struct binder_transaction *bt)
2424{
2425 if ((NULL == bt) || (NULL == t_log))
2426 return;
2427 if ((bt->log_idx == -1) || (bt->log_idx > (t_log->size - 1)))
2428 return;
2429 if (bt->tthrd < 0)
2430 return;
2431 if ((t_log->entry[bt->log_idx].debug_id == bt->debug_id) &&
2432 (t_log->entry[bt->log_idx].to_thread == 0)){
2433 t_log->entry[bt->log_idx].to_thread = bt->tthrd;
2434 }
2435}
2436
2437#endif
2438
355b0502
GKH		 2439static void binder_transaction(struct binder_proc *proc,
2440 struct binder_thread *thread,
2441 struct binder_transaction_data *tr, int reply)
2442{
2443 struct binder_transaction *t;
2444 struct binder_work *tcomplete;
6fa3eb70
S		 2445 binder_size_t *offp, *off_end;
2446 binder_size_t off_min;
355b0502
GKH		 2447 struct binder_proc *target_proc;
2448 struct binder_thread *target_thread = NULL;
2449 struct binder_node *target_node = NULL;
2450 struct list_head *target_list;
2451 wait_queue_head_t *target_wait;
2452 struct binder_transaction *in_reply_to = NULL;
2453 struct binder_transaction_log_entry *e;
2454 uint32_t return_error;
2455
6fa3eb70
S		 2456#ifdef BINDER_MONITOR
2457 struct binder_transaction_log_entry log_entry;
2458 unsigned int log_idx = -1;
2459
2460 if ((reply && (tr->data_size < (proc->buffer_size/16))) || log_disable)
2461 e = &log_entry;
2462 else
2463 {
2464 e = binder_transaction_log_add(&binder_transaction_log);
2465 if (binder_transaction_log.next)
2466 log_idx = binder_transaction_log.next - 1;
2467 else
2468 log_idx = binder_transaction_log.size - 1;
2469 }
2470#else
355b0502 2471 e = binder_transaction_log_add(&binder_transaction_log);
6fa3eb70 2472#endif
355b0502
GKH		 2473 e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY);
2474 e->from_proc = proc->pid;
2475 e->from_thread = thread->pid;
2476 e->target_handle = tr->target.handle;
2477 e->data_size = tr->data_size;
2478 e->offsets_size = tr->offsets_size;
6fa3eb70
S		 2479#ifdef BINDER_MONITOR
2480 e->code = tr->code;
2481 /* fd 0 is also valid... set initial value to -1 */
2482 e->fd = -1;
2483 do_posix_clock_monotonic_gettime(&e->timestamp);
2484 //monotonic_to_bootbased(&e->timestamp);
2485
2486 do_gettimeofday(&e->tv);
2487 /* consider time zone. translate to android time */
2488 e->tv.tv_sec -= (sys_tz.tz_minuteswest * 60);
2489#endif
355b0502
GKH		 2490
2491 if (reply) {
2492 in_reply_to = thread->transaction_stack;
2493 if (in_reply_to == NULL) {
56b468fc 2494 binder_user_error("%d:%d got reply transaction with no transaction stack\n",
6fa3eb70 2495 proc->pid, thread->pid);
355b0502
GKH		 2496 return_error = BR_FAILED_REPLY;
2497 goto err_empty_call_stack;
2498 }
6fa3eb70
S		 2499#ifdef BINDER_MONITOR
2500 binder_cancel_bwdog(in_reply_to);
2501#endif
355b0502 2502 binder_set_nice(in_reply_to->saved_priority);
6fa3eb70
S		 2503#ifdef RT_PRIO_INHERIT
2504 if (rt_task(current) && (MAX_RT_PRIO != in_reply_to->saved_rt_prio) &&
2505 !(thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
2506 BINDER_LOOPER_STATE_ENTERED))) {
2507 struct sched_param param = {
2508 .sched_priority = in_reply_to->saved_rt_prio,
2509 };
2510 mt_sched_setscheduler_nocheck(current,
2511 in_reply_to->saved_policy, &param);
2512#ifdef BINDER_MONITOR
2513 if (log_disable & BINDER_RT_LOG_ENABLE)
2514 {
2515 pr_debug("reply reset %d sched_policy from %d to %d rt_prio from %d to %d\n",
2516 proc->pid, in_reply_to->policy, in_reply_to->saved_policy,
2517 in_reply_to->rt_prio, in_reply_to->saved_rt_prio);
2518 }
2519#endif
2520 }
2521#endif
355b0502 2522 if (in_reply_to->to_thread != thread) {
56b468fc 2523 binder_user_error("%d:%d got reply transaction with bad transaction stack, transaction %d has target %d:%d\n",
355b0502
GKH		 2524 proc->pid, thread->pid, in_reply_to->debug_id,
2525 in_reply_to->to_proc ?
2526 in_reply_to->to_proc->pid : 0,
2527 in_reply_to->to_thread ?
2528 in_reply_to->to_thread->pid : 0);
2529 return_error = BR_FAILED_REPLY;
2530 in_reply_to = NULL;
2531 goto err_bad_call_stack;
2532 }
2533 thread->transaction_stack = in_reply_to->to_parent;
2534 target_thread = in_reply_to->from;
2535 if (target_thread == NULL) {
6fa3eb70
S		 2536#ifdef MTK_BINDER_DEBUG
2537 binder_user_error("%d:%d got reply transaction "
2538 "with bad transaction reply_from, "
2539 "transaction %d has target %d:%d\n",
2540 proc->pid, thread->pid, in_reply_to->debug_id,
2541 in_reply_to->to_proc ?
2542 in_reply_to->to_proc->pid : 0,
2543 in_reply_to->to_thread ?
2544 in_reply_to->to_thread->pid : 0);
2545#endif
355b0502
GKH		 2546 return_error = BR_DEAD_REPLY;
2547 goto err_dead_binder;
2548 }
2549 if (target_thread->transaction_stack != in_reply_to) {
56b468fc 2550 binder_user_error("%d:%d got reply transaction with bad target transaction stack %d, expected %d\n",
355b0502
GKH		 2551 proc->pid, thread->pid,
2552 target_thread->transaction_stack ?
2553 target_thread->transaction_stack->debug_id : 0,
2554 in_reply_to->debug_id);
2555 return_error = BR_FAILED_REPLY;
2556 in_reply_to = NULL;
2557 target_thread = NULL;
2558 goto err_dead_binder;
2559 }
2560 target_proc = target_thread->proc;
6fa3eb70
S		 2561#ifdef BINDER_MONITOR
2562 e->service[0] = '\0';
2563#endif
355b0502
GKH		 2564 } else {
2565 if (tr->target.handle) {
2566 struct binder_ref *ref;
4b9e9796 2567 ref = binder_get_ref(proc, tr->target.handle, true);
355b0502 2568 if (ref == NULL) {
56b468fc 2569 binder_user_error("%d:%d got transaction to invalid handle\n",
355b0502
GKH		 2570 proc->pid, thread->pid);
2571 return_error = BR_FAILED_REPLY;
2572 goto err_invalid_target_handle;
2573 }
2574 target_node = ref->node;
2575 } else {
2576 target_node = binder_context_mgr_node;
2577 if (target_node == NULL) {
6fa3eb70
S		 2578#ifdef MTK_BINDER_DEBUG
2579 binder_user_error("%d:%d "
2580 "binder_context_mgr_node is NULL\n",
2581 proc->pid, thread->pid);
2582#endif
355b0502
GKH		 2583 return_error = BR_DEAD_REPLY;
2584 goto err_no_context_mgr_node;
2585 }
2586 }
2587 e->to_node = target_node->debug_id;
6fa3eb70
S		 2588#ifdef BINDER_MONITOR
2589 strcpy(e->service, target_node->name);
2590#endif
355b0502
GKH		 2591 target_proc = target_node->proc;
2592 if (target_proc == NULL) {
6fa3eb70
S		 2593#ifdef MTK_BINDER_DEBUG
2594 binder_user_error("%d:%d target_proc is NULL\n",
2595 proc->pid, thread->pid);
2596#endif
355b0502
GKH		 2597 return_error = BR_DEAD_REPLY;
2598 goto err_dead_binder;
2599 }
6fa3eb70
S		 2600 if (security_binder_transaction(proc->tsk, target_proc->tsk) < 0) {
2601 return_error = BR_FAILED_REPLY;
2602 goto err_invalid_target_handle;
2603 }
355b0502
GKH		 2604 if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) {
2605 struct binder_transaction *tmp;
2606 tmp = thread->transaction_stack;
2607 if (tmp->to_thread != thread) {
56b468fc 2608 binder_user_error("%d:%d got new transaction with bad transaction stack, transaction %d has target %d:%d\n",
355b0502
GKH		 2609 proc->pid, thread->pid, tmp->debug_id,
2610 tmp->to_proc ? tmp->to_proc->pid : 0,
2611 tmp->to_thread ?
2612 tmp->to_thread->pid : 0);
2613 return_error = BR_FAILED_REPLY;
2614 goto err_bad_call_stack;
2615 }
2616 while (tmp) {
2617 if (tmp->from && tmp->from->proc == target_proc)
2618 target_thread = tmp->from;
2619 tmp = tmp->from_parent;
2620 }
2621 }
2622 }
2623 if (target_thread) {
2624 e->to_thread = target_thread->pid;
2625 target_list = &target_thread->todo;
2626 target_wait = &target_thread->wait;
2627 } else {
2628 target_list = &target_proc->todo;
2629 target_wait = &target_proc->wait;
2630 }
2631 e->to_proc = target_proc->pid;
2632
2633 /* TODO: reuse incoming transaction for reply */
2634 t = kzalloc(sizeof(*t), GFP_KERNEL);
2635 if (t == NULL) {
6fa3eb70
S		 2636#ifdef MTK_BINDER_DEBUG
2637 binder_user_error("%d:%d transaction allocation failed\n",
2638 proc->pid, thread->pid);
2639#endif
355b0502
GKH		 2640 return_error = BR_FAILED_REPLY;
2641 goto err_alloc_t_failed;
2642 }
6fa3eb70
S		 2643#ifdef BINDER_MONITOR
2644 memcpy(&t->timestamp, &e->timestamp, sizeof(struct timespec));
2645 //do_gettimeofday(&t->tv);
2646 /* consider time zone. translate to android time */
2647 //t->tv.tv_sec -= (sys_tz.tz_minuteswest * 60);
2648 memcpy(&t->tv, &e->tv, sizeof(struct timeval));
2649 if (!reply)
2650 strcpy(t->service, target_node->name);
2651#endif
355b0502
GKH		 2652 binder_stats_created(BINDER_STAT_TRANSACTION);
2653
2654 tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL);
2655 if (tcomplete == NULL) {
6fa3eb70
S		 2656#ifdef MTK_BINDER_DEBUG
2657 binder_user_error("%d:%d tcomplete allocation failed\n",
2658 proc->pid, thread->pid);
2659#endif
355b0502
GKH		 2660 return_error = BR_FAILED_REPLY;
2661 goto err_alloc_tcomplete_failed;
2662 }
2663 binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE);
2664
2665 t->debug_id = ++binder_last_id;
2666 e->debug_id = t->debug_id;
2667
6fa3eb70
S		 2668#ifdef BINDER_PERF_EVAL
2669 if (!reply && (binder_perf_evalue & BINDER_PERF_SEND_COUNTER))
2670 {
2671 int i, j;
2672 int err_code = 0;
2673 proc->bc_t++;
2674 for (i = 0; i < BC_STATS_NR; i++)
2675 {
2676 if (proc->bc_stats[i] == NULL)
2677 proc->bc_stats[i] = kzalloc(sizeof(struct binder_bc_stats), GFP_KERNEL);
2678 if (proc->bc_stats[i] == NULL) {
2679 pr_err("perf_e kzalloc fail for proc %d bc_stats[%d]\n", proc->pid, i);
2680 err_code = 1;
2681 goto out_err;
2682 }
2683 if(!strcmp(proc->bc_stats[i]->service, "") &&
2684 (0 == proc->bc_stats[i]->code[0]))
2685 {
2686 strcpy(proc->bc_stats[i]->service, e->service);
2687 break;
2688 }
2689 else if (!strcmp(proc->bc_stats[i]->service, e->service))
2690 break;
2691 else
2692 continue;
2693 }
2694 if (BC_STATS_NR == i){
2695 pr_err("perf_e bc_Stats array size"
2696 " is not enough\n");
2697 err_code = 2;
2698 goto out_err;
2699 }
2700 for (j = 0; j < BC_CODE_NR; j++)
2701 {
2702 if (0 == proc->bc_stats[i]->code[j])
2703 {
2704 proc->bc_stats[i]->code[j] = e->code;
2705 proc->bc_stats[i]->code_num[j]++;
2706 break;
2707 }
2708 else if (proc->bc_stats[i]->code[j] == e->code)
2709 {
2710 proc->bc_stats[i]->code_num[j]++;
2711 break;
2712 }
2713 else
2714 continue;
2715 }
2716 if (BC_CODE_NR == j) {
2717 pr_err("perf_e bc_code array size"
2718 " is not enough\n");
2719 err_code = 3;
2720 }
2721out_err:
2722 pr_err("perf_e update proc %d bc_stats error %d\n", proc->pid, err_code);
2723 }
2724#endif
355b0502
GKH		 2725 if (reply)
2726 binder_debug(BINDER_DEBUG_TRANSACTION,
6fa3eb70 2727 "%d:%d BC_REPLY %d -> %d:%d, data %016llx-%016llx size %lld-%lld\n",
355b0502
GKH		 2728 proc->pid, thread->pid, t->debug_id,
2729 target_proc->pid, target_thread->pid,
6fa3eb70
S		 2730 (u64)tr->data.ptr.buffer,
2731 (u64)tr->data.ptr.offsets,
2732 (u64)tr->data_size, (u64)tr->offsets_size);
355b0502
GKH		 2733 else
2734 binder_debug(BINDER_DEBUG_TRANSACTION,
6fa3eb70 2735 "%d:%d BC_TRANSACTION %d -> %d - node %d, data %016llx-%016llx size %lld-%lld\n",
355b0502
GKH		 2736 proc->pid, thread->pid, t->debug_id,
2737 target_proc->pid, target_node->debug_id,
6fa3eb70
S		 2738 (u64)tr->data.ptr.buffer,
2739 (u64)tr->data.ptr.offsets,
2740 (u64)tr->data_size, (u64)tr->offsets_size);
2741
2742#ifdef BINDER_MONITOR
2743 t->fproc = proc->pid;
2744 t->fthrd = thread->pid;
2745 t->tproc = target_proc->pid;
2746 t->tthrd = target_thread ? target_thread->pid : 0;
2747 t->log_idx = log_idx;
2748
2749 if (!binder_check_buf_checked())
2750 {
2751 binder_check_buf_pid = proc->pid;
2752 binder_check_buf_tid = thread->pid;
2753 }
2754#endif
355b0502
GKH		 2755 if (!reply && !(tr->flags & TF_ONE_WAY))
2756 t->from = thread;
2757 else
2758 t->from = NULL;
2759 t->sender_euid = proc->tsk->cred->euid;
2760 t->to_proc = target_proc;
2761 t->to_thread = target_thread;
2762 t->code = tr->code;
2763 t->flags = tr->flags;
2764 t->priority = task_nice(current);
6fa3eb70
S		 2765#ifdef RT_PRIO_INHERIT
2766 t->rt_prio = current->rt_priority;
2767 t->policy = current->policy;
2768 t->saved_rt_prio = MAX_RT_PRIO;
2769#endif
975a1ac9
AH		 2770
2771 trace_binder_transaction(reply, t, target_node);
2772
355b0502
GKH		 2773 t->buffer = binder_alloc_buf(target_proc, tr->data_size,
2774 tr->offsets_size, !reply && (t->flags & TF_ONE_WAY));
2775 if (t->buffer == NULL) {
6fa3eb70
S		 2776#ifdef MTK_BINDER_DEBUG
2777 binder_user_error("%d:%d buffer allocation failed "
2778 "on %d:0\n", proc->pid, thread->pid, target_proc->pid);
2779#endif
355b0502
GKH		 2780 return_error = BR_FAILED_REPLY;
2781 goto err_binder_alloc_buf_failed;
2782 }
2783 t->buffer->allow_user_free = 0;
2784 t->buffer->debug_id = t->debug_id;
2785 t->buffer->transaction = t;
6fa3eb70
S		 2786#ifdef BINDER_MONITOR
2787 t->buffer->log_entry = e;
2788#endif
355b0502 2789 t->buffer->target_node = target_node;
975a1ac9 2790 trace_binder_transaction_alloc_buf(t->buffer);
355b0502
GKH		 2791 if (target_node)
2792 binder_inc_node(target_node, 1, 0, NULL);
2793
6fa3eb70
S		 2794 offp = (binder_size_t *)(t->buffer->data +
2795 ALIGN(tr->data_size, sizeof(void *)));
355b0502 2796
6fa3eb70
S		 2797 if (copy_from_user(t->buffer->data, (const void __user *)(uintptr_t)
2798 tr->data.ptr.buffer, tr->data_size)) {
56b468fc
AS		 2799 binder_user_error("%d:%d got transaction with invalid data ptr\n",
2800 proc->pid, thread->pid);
355b0502
GKH		 2801 return_error = BR_FAILED_REPLY;
2802 goto err_copy_data_failed;
2803 }
6fa3eb70
S		 2804 if (copy_from_user(offp, (const void __user *)(uintptr_t)
2805 tr->data.ptr.offsets, tr->offsets_size)) {
56b468fc
AS		 2806 binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
2807 proc->pid, thread->pid);
355b0502
GKH		 2808 return_error = BR_FAILED_REPLY;
2809 goto err_copy_data_failed;
2810 }
6fa3eb70
S		 2811 if (!IS_ALIGNED(tr->offsets_size, sizeof(binder_size_t))) {
2812 binder_user_error("%d:%d got transaction with invalid offsets size, %lld\n",
2813 proc->pid, thread->pid, (u64)tr->offsets_size);
355b0502
GKH		 2814 return_error = BR_FAILED_REPLY;
2815 goto err_bad_offset;
2816 }
2817 off_end = (void *)offp + tr->offsets_size;
6fa3eb70 2818 off_min = 0;
355b0502
GKH		 2819 for (; offp < off_end; offp++) {
2820 struct flat_binder_object *fp;
2821 if (*offp > t->buffer->data_size - sizeof(*fp) ||
6fa3eb70 2822 *offp < off_min ||
355b0502 2823 t->buffer->data_size < sizeof(*fp) ||
6fa3eb70
S		 2824 !IS_ALIGNED(*offp, sizeof(u32))) {
2825 binder_user_error("%d:%d got transaction with invalid offset, %lld (min %lld, max %lld)\n",
2826 proc->pid, thread->pid, (u64)*offp,
2827 (u64)off_min,
2828 (u64)(t->buffer->data_size -
2829 sizeof(*fp)));
355b0502
GKH		 2830 return_error = BR_FAILED_REPLY;
2831 goto err_bad_offset;
2832 }
2833 fp = (struct flat_binder_object *)(t->buffer->data + *offp);
6fa3eb70 2834 off_min = *offp + sizeof(struct flat_binder_object);
355b0502
GKH		 2835 switch (fp->type) {
2836 case BINDER_TYPE_BINDER:
2837 case BINDER_TYPE_WEAK_BINDER: {
2838 struct binder_ref *ref;
2839 struct binder_node *node = binder_get_node(proc, fp->binder);
2840 if (node == NULL) {
2841 node = binder_new_node(proc, fp->binder, fp->cookie);
2842 if (node == NULL) {
6fa3eb70
S		 2843#ifdef MTK_BINDER_DEBUG
2844 binder_user_error("%d:%d create new node failed\n",
2845 proc->pid, thread->pid);
2846#endif
355b0502
GKH		 2847 return_error = BR_FAILED_REPLY;
2848 goto err_binder_new_node_failed;
2849 }
2850 node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK;
2851 node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS);
6fa3eb70
S		 2852#ifdef BINDER_MONITOR
2853 {
2854 unsigned int i, len = 0;
2855 char *tmp;
2856 /* this is an addService() transaction identified by:
2857 * fp->type == BINDER_TYPE_BINDER && tr->target.handle == 0
2858 */
2859 if (tr->target.handle == 0) {
2860 /* hack into addService() payload:
2861 * service name string is located at MAGIC_SERVICE_NAME_OFFSET,
2862 * and interleaved with character '\0'.
2863 * for example, 'p', '\0', 'h', '\0', 'o', '\0', 'n', '\0', 'e'
2864 */
2865 for (i = 0; (2 * i) < tr->data_size; i++) {
2866 if ((2 * i) < MAGIC_SERVICE_NAME_OFFSET)
2867 continue;
2868 /* prevent array index overflow */
2869 if (len >= (MAX_SERVICE_NAME_LEN - 1))
2870 break;
2871 tmp = (char *)(uintptr_t)(tr->data.ptr.buffer + (2 * i));
2872 len += sprintf((node->name) + len, "%c", *tmp);
2873 }
2874 node->name[len] = '\0';
2875 } else {
2876 node->name[0] = '\0';
2877 }
2878 /* via addService of activity service, identify
2879 * system_server's process id.
2880 */
2881 if (!strcmp(node->name, "activity")) {
2882 system_server_pid = proc->pid;
2883 pr_debug("system_server %d\n", system_server_pid);
2884 }
2885 }
2886#endif
355b0502
GKH		 2887 }
2888 if (fp->cookie != node->cookie) {
6fa3eb70 2889 binder_user_error("%d:%d sending u%016llx node %d, cookie mismatch %016llx != %016llx\n",
355b0502 2890 proc->pid, thread->pid,
6fa3eb70
S		 2891 (u64)fp->binder, node->debug_id,
2892 (u64)fp->cookie, (u64)node->cookie);
2893 goto err_binder_get_ref_for_node_failed;
2894 }
2895 if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
2896 return_error = BR_FAILED_REPLY;
355b0502
GKH		 2897 goto err_binder_get_ref_for_node_failed;
2898 }
2899 ref = binder_get_ref_for_node(target_proc, node);
2900 if (ref == NULL) {
6fa3eb70
S		 2901#ifdef MTK_BINDER_DEBUG
2902 binder_user_error("%d:%d get binder ref failed\n",
2903 proc->pid, thread->pid);
2904#endif
355b0502
GKH		 2905 return_error = BR_FAILED_REPLY;
2906 goto err_binder_get_ref_for_node_failed;
2907 }
2908 if (fp->type == BINDER_TYPE_BINDER)
2909 fp->type = BINDER_TYPE_HANDLE;
2910 else
2911 fp->type = BINDER_TYPE_WEAK_HANDLE;
4b9e9796 2912 fp->binder = 0;
355b0502 2913 fp->handle = ref->desc;
4b9e9796 2914 fp->cookie = 0;
355b0502
GKH		 2915 binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE,
2916 &thread->todo);
2917
975a1ac9 2918 trace_binder_transaction_node_to_ref(t, node, ref);
355b0502 2919 binder_debug(BINDER_DEBUG_TRANSACTION,
6fa3eb70
S		 2920 " node %d u%016llx -> ref %d desc %d\n",
2921 node->debug_id, (u64)node->ptr,
2922 ref->debug_id, ref->desc);
355b0502
GKH		 2923 } break;
2924 case BINDER_TYPE_HANDLE:
2925 case BINDER_TYPE_WEAK_HANDLE: {
4b9e9796
S		 2926 struct binder_ref *ref = binder_get_ref(proc, fp->handle,
2927 fp->type == BINDER_TYPE_HANDLE);
355b0502 2928 if (ref == NULL) {
6fa3eb70 2929 binder_user_error("%d:%d got transaction with invalid handle, %d\n",
56b468fc
AS		 2930 proc->pid,
2931 thread->pid, fp->handle);
355b0502
GKH		 2932 return_error = BR_FAILED_REPLY;
2933 goto err_binder_get_ref_failed;
2934 }
6fa3eb70
S		 2935 if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
2936 return_error = BR_FAILED_REPLY;
2937 goto err_binder_get_ref_failed;
2938 }
355b0502
GKH		 2939 if (ref->node->proc == target_proc) {
2940 if (fp->type == BINDER_TYPE_HANDLE)
2941 fp->type = BINDER_TYPE_BINDER;
2942 else
2943 fp->type = BINDER_TYPE_WEAK_BINDER;
2944 fp->binder = ref->node->ptr;
2945 fp->cookie = ref->node->cookie;
2946 binder_inc_node(ref->node, fp->type == BINDER_TYPE_BINDER, 0, NULL);
975a1ac9 2947 trace_binder_transaction_ref_to_node(t, ref);
355b0502 2948 binder_debug(BINDER_DEBUG_TRANSACTION,
6fa3eb70 2949 " ref %d desc %d -> node %d u%016llx\n",
355b0502 2950 ref->debug_id, ref->desc, ref->node->debug_id,
6fa3eb70 2951 (u64)ref->node->ptr);
355b0502
GKH		 2952 } else {
2953 struct binder_ref *new_ref;
2954 new_ref = binder_get_ref_for_node(target_proc, ref->node);
2955 if (new_ref == NULL) {
6fa3eb70
S		 2956#ifdef MTK_BINDER_DEBUG
2957 binder_user_error("%d:%d get new binder ref failed\n",
2958 proc->pid, thread->pid);
2959#endif
355b0502
GKH		 2960 return_error = BR_FAILED_REPLY;
2961 goto err_binder_get_ref_for_node_failed;
2962 }
4b9e9796 2963 fp->binder = 0;
355b0502 2964 fp->handle = new_ref->desc;
4b9e9796 2965 fp->cookie = 0;
355b0502 2966 binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL);
975a1ac9
AH		 2967 trace_binder_transaction_ref_to_ref(t, ref,
2968 new_ref);
355b0502
GKH		 2969 binder_debug(BINDER_DEBUG_TRANSACTION,
2970 " ref %d desc %d -> ref %d desc %d (node %d)\n",
2971 ref->debug_id, ref->desc, new_ref->debug_id,
2972 new_ref->desc, ref->node->debug_id);
2973 }
2974 } break;
2975
2976 case BINDER_TYPE_FD: {
2977 int target_fd;
2978 struct file *file;
2979
2980 if (reply) {
2981 if (!(in_reply_to->flags & TF_ACCEPT_FDS)) {
6fa3eb70 2982 binder_user_error("%d:%d got reply with fd, %d, but target does not allow fds\n",
355b0502
GKH		 2983 proc->pid, thread->pid, fp->handle);
2984 return_error = BR_FAILED_REPLY;
2985 goto err_fd_not_allowed;
2986 }
2987 } else if (!target_node->accept_fds) {
6fa3eb70 2988 binder_user_error("%d:%d got transaction with fd, %d, but target does not allow fds\n",
355b0502
GKH		 2989 proc->pid, thread->pid, fp->handle);
2990 return_error = BR_FAILED_REPLY;
2991 goto err_fd_not_allowed;
2992 }
2993
2994 file = fget(fp->handle);
2995 if (file == NULL) {
6fa3eb70 2996 binder_user_error("%d:%d got transaction with invalid fd, %d\n",
355b0502
GKH		 2997 proc->pid, thread->pid, fp->handle);
2998 return_error = BR_FAILED_REPLY;
2999 goto err_fget_failed;
3000 }
6fa3eb70
S		 3001 if (security_binder_transfer_file(proc->tsk, target_proc->tsk, file) < 0) {
3002 fput(file);
3003 return_error = BR_FAILED_REPLY;
3004 goto err_get_unused_fd_failed;
3005 }
355b0502
GKH		 3006 target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC);
3007 if (target_fd < 0) {
3008 fput(file);
6fa3eb70
S		 3009#ifdef MTK_BINDER_DEBUG
3010 binder_user_error("%d:%d to %d failed due to %d no unused fd available(%d:%s fd leak?), %d\n",
3011 proc->pid, thread->pid,
3012 target_proc->pid, target_proc->pid, target_proc->pid,
3013 target_proc->tsk ? target_proc->tsk->comm : "",
3014 target_fd);
3015#endif
355b0502
GKH		 3016 return_error = BR_FAILED_REPLY;
3017 goto err_get_unused_fd_failed;
3018 }
3019 task_fd_install(target_proc, target_fd, file);
975a1ac9 3020 trace_binder_transaction_fd(t, fp->handle, target_fd);
355b0502 3021 binder_debug(BINDER_DEBUG_TRANSACTION,
6fa3eb70 3022 " fd %d -> %d\n", fp->handle, target_fd);
355b0502 3023 /* TODO: fput? */
4b9e9796 3024 fp->binder = 0;
355b0502 3025 fp->handle = target_fd;
6fa3eb70
S		 3026#ifdef BINDER_MONITOR
3027 e->fd = target_fd;
3028#endif
355b0502
GKH		 3029 } break;
3030
3031 default:
6fa3eb70 3032 binder_user_error("%d:%d got transaction with invalid object type, %x\n",
355b0502
GKH		 3033 proc->pid, thread->pid, fp->type);
3034 return_error = BR_FAILED_REPLY;
3035 goto err_bad_object_type;
3036 }
3037 }
3038 if (reply) {
3039 BUG_ON(t->buffer->async_transaction != 0);
6fa3eb70
S		 3040#ifdef BINDER_MONITOR
3041 binder_update_transaction_time(&binder_transaction_log,in_reply_to, 2);
3042#endif
355b0502
GKH		 3043 binder_pop_transaction(target_thread, in_reply_to);
3044 } else if (!(t->flags & TF_ONE_WAY)) {
3045 BUG_ON(t->buffer->async_transaction != 0);
3046 t->need_reply = 1;
3047 t->from_parent = thread->transaction_stack;
3048 thread->transaction_stack = t;
3049 } else {
3050 BUG_ON(target_node == NULL);
3051 BUG_ON(t->buffer->async_transaction != 1);
3052 if (target_node->has_async_transaction) {
3053 target_list = &target_node->async_todo;
3054 target_wait = NULL;
3055 } else
3056 target_node->has_async_transaction = 1;
3057 }
3058 t->work.type = BINDER_WORK_TRANSACTION;
3059 list_add_tail(&t->work.entry, target_list);
3060 tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
3061 list_add_tail(&tcomplete->entry, &thread->todo);
6fa3eb70
S		 3062#ifdef RT_PRIO_INHERIT
3063 if (target_wait) {
3064 unsigned long flag;
3065 wait_queue_t *curr, *next;
3066 bool is_lock = false;
3067
3068 spin_lock_irqsave(&target_wait->lock, flag);
3069 is_lock = true;
3070 list_for_each_entry_safe(curr, next, &target_wait->task_list, task_list) {
3071 unsigned flags = curr->flags;
3072 struct task_struct *tsk = curr->private;
3073 if (tsk == NULL) {
3074 spin_unlock_irqrestore(&target_wait->lock, flag);
3075 is_lock = false;
3076 wake_up_interruptible(target_wait);
3077 break;
3078 }
3079# ifdef MTK_BINDER_DEBUG
3080 if (tsk->state == TASK_UNINTERRUPTIBLE) {
3081 pr_err("from %d:%d to %d:%d target "
3082 "thread state: %ld\n",
3083 proc->pid, thread->pid,
3084 tsk->tgid, tsk->pid, tsk->state);
3085 show_stack(tsk, NULL);
3086 }
3087# endif
3088 if (!reply && (t->policy == SCHED_RR || t->policy == SCHED_FIFO)&&
3089 t->rt_prio > tsk->rt_priority &&
3090 !(t->flags & TF_ONE_WAY)) {
3091 struct sched_param param = {
3092 .sched_priority = t->rt_prio,
3093 };
3094
3095 t->saved_rt_prio = tsk->rt_priority;
3096 t->saved_policy = tsk->policy;
3097 mt_sched_setscheduler_nocheck(tsk, t->policy, &param);
3098#ifdef BINDER_MONITOR
3099 if (log_disable & BINDER_RT_LOG_ENABLE)
3100 {
3101 pr_debug("write set %d sched_policy from %d to %d rt_prio from %d to %d\n",
3102 tsk->pid, t->saved_policy, t->policy,
3103 t->saved_rt_prio, t->rt_prio);
3104 }
3105#endif
3106 }
3107 if (curr->func(curr, TASK_INTERRUPTIBLE, 0, NULL) &&
3108 (flags & WQ_FLAG_EXCLUSIVE))
3109 break;
3110 }
3111 if (is_lock)
3112 spin_unlock_irqrestore(&target_wait->lock, flag);
3113 }
3114#else
355b0502
GKH		 3115 if (target_wait)
3116 wake_up_interruptible(target_wait);
6fa3eb70
S		 3117#endif
3118
3119#ifdef BINDER_MONITOR
3120 t->wait_on = reply ? WAIT_ON_REPLY_READ : WAIT_ON_READ;
3121 binder_queue_bwdog(t, (time_t)WAIT_BUDGET_READ);
3122#endif
355b0502
GKH		 3123 return;
3124
3125err_get_unused_fd_failed:
3126err_fget_failed:
3127err_fd_not_allowed:
3128err_binder_get_ref_for_node_failed:
3129err_binder_get_ref_failed:
3130err_binder_new_node_failed:
3131err_bad_object_type:
3132err_bad_offset:
3133err_copy_data_failed:
975a1ac9 3134 trace_binder_transaction_failed_buffer_release(t->buffer);
355b0502
GKH		 3135 binder_transaction_buffer_release(target_proc, t->buffer, offp);
3136 t->buffer->transaction = NULL;
3137 binder_free_buf(target_proc, t->buffer);
3138err_binder_alloc_buf_failed:
3139 kfree(tcomplete);
3140 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
3141err_alloc_tcomplete_failed:
6fa3eb70
S		 3142#ifdef BINDER_MONITOR
3143 binder_cancel_bwdog(t);
3144#endif
355b0502
GKH		 3145 kfree(t);
3146 binder_stats_deleted(BINDER_STAT_TRANSACTION);
3147err_alloc_t_failed:
3148err_bad_call_stack:
3149err_empty_call_stack:
3150err_dead_binder:
3151err_invalid_target_handle:
3152err_no_context_mgr_node:
3153 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
6fa3eb70 3154 "%d:%d transaction failed %d, size %lld-%lld\n",
355b0502 3155 proc->pid, thread->pid, return_error,
6fa3eb70 3156 (u64)tr->data_size, (u64)tr->offsets_size);
355b0502
GKH		 3157
3158 {
3159 struct binder_transaction_log_entry *fe;
3160 fe = binder_transaction_log_add(&binder_transaction_log_failed);
3161 *fe = *e;
3162 }
3163
3164 BUG_ON(thread->return_error != BR_OK);
3165 if (in_reply_to) {
3166 thread->return_error = BR_TRANSACTION_COMPLETE;
3167 binder_send_failed_reply(in_reply_to, return_error);
3168 } else
3169 thread->return_error = return_error;
3170}
3171
3172int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread,
6fa3eb70
S		 3173 binder_uintptr_t binder_buffer, size_t size,
3174 binder_size_t *consumed)
355b0502
GKH		 3175{
3176 uint32_t cmd;
6fa3eb70 3177 void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
355b0502
GKH		 3178 void __user *ptr = buffer + *consumed;
3179 void __user *end = buffer + size;
3180
3181 while (ptr < end && thread->return_error == BR_OK) {
3182 if (get_user(cmd, (uint32_t __user *)ptr))
3183 return -EFAULT;
3184 ptr += sizeof(uint32_t);
975a1ac9 3185 trace_binder_command(cmd);
355b0502
GKH		 3186 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) {
3187 binder_stats.bc[_IOC_NR(cmd)]++;
3188 proc->stats.bc[_IOC_NR(cmd)]++;
3189 thread->stats.bc[_IOC_NR(cmd)]++;
3190 }
3191 switch (cmd) {
3192 case BC_INCREFS:
3193 case BC_ACQUIRE:
3194 case BC_RELEASE:
3195 case BC_DECREFS: {
3196 uint32_t target;
3197 struct binder_ref *ref;
3198 const char *debug_string;
3199
3200 if (get_user(target, (uint32_t __user *)ptr))
3201 return -EFAULT;
3202 ptr += sizeof(uint32_t);
3203 if (target == 0 && binder_context_mgr_node &&
3204 (cmd == BC_INCREFS || cmd == BC_ACQUIRE)) {
3205 ref = binder_get_ref_for_node(proc,
3206 binder_context_mgr_node);
3207 if (ref->desc != target) {
56b468fc 3208 binder_user_error("%d:%d tried to acquire reference to desc 0, got %d instead\n",
355b0502
GKH		 3209 proc->pid, thread->pid,
3210 ref->desc);
3211 }
3212 } else
4b9e9796
S		 3213 ref = binder_get_ref(proc, target,
3214 cmd == BC_ACQUIRE ||
3215 cmd == BC_RELEASE);
355b0502 3216 if (ref == NULL) {
56b468fc 3217 binder_user_error("%d:%d refcount change on invalid ref %d\n",
355b0502
GKH		 3218 proc->pid, thread->pid, target);
3219 break;
3220 }
3221 switch (cmd) {
3222 case BC_INCREFS:
3223 debug_string = "IncRefs";
3224 binder_inc_ref(ref, 0, NULL);
3225 break;
3226 case BC_ACQUIRE:
3227 debug_string = "Acquire";
3228 binder_inc_ref(ref, 1, NULL);
3229 break;
3230 case BC_RELEASE:
3231 debug_string = "Release";
3232 binder_dec_ref(ref, 1);
3233 break;
3234 case BC_DECREFS:
3235 default:
3236 debug_string = "DecRefs";
3237 binder_dec_ref(ref, 0);
3238 break;
3239 }
3240 binder_debug(BINDER_DEBUG_USER_REFS,
56b468fc 3241 "%d:%d %s ref %d desc %d s %d w %d for node %d\n",
355b0502
GKH		 3242 proc->pid, thread->pid, debug_string, ref->debug_id,
3243 ref->desc, ref->strong, ref->weak, ref->node->debug_id);
3244 break;
3245 }
3246 case BC_INCREFS_DONE:
3247 case BC_ACQUIRE_DONE: {
6fa3eb70
S		 3248 binder_uintptr_t node_ptr;
3249 binder_uintptr_t cookie;
355b0502
GKH		 3250 struct binder_node *node;
3251
6fa3eb70 3252 if (get_user(node_ptr, (binder_uintptr_t __user *)ptr))
355b0502 3253 return -EFAULT;
6fa3eb70
S		 3254 ptr += sizeof(binder_uintptr_t);
3255 if (get_user(cookie, (binder_uintptr_t __user *)ptr))
355b0502 3256 return -EFAULT;
6fa3eb70 3257 ptr += sizeof(binder_uintptr_t);
355b0502
GKH		 3258 node = binder_get_node(proc, node_ptr);
3259 if (node == NULL) {
6fa3eb70 3260 binder_user_error("%d:%d %s u%016llx no match\n",
355b0502
GKH		 3261 proc->pid, thread->pid,
3262 cmd == BC_INCREFS_DONE ?
3263 "BC_INCREFS_DONE" :
3264 "BC_ACQUIRE_DONE",
6fa3eb70 3265 (u64)node_ptr);
355b0502
GKH		 3266 break;
3267 }
3268 if (cookie != node->cookie) {
6fa3eb70 3269 binder_user_error("%d:%d %s u%016llx node %d cookie mismatch %016llx != %016llx\n",
355b0502
GKH		 3270 proc->pid, thread->pid,
3271 cmd == BC_INCREFS_DONE ?
3272 "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
6fa3eb70
S		 3273 (u64)node_ptr, node->debug_id,
3274 (u64)cookie, (u64)node->cookie);
355b0502
GKH		 3275 break;
3276 }
3277 if (cmd == BC_ACQUIRE_DONE) {
3278 if (node->pending_strong_ref == 0) {
56b468fc 3279 binder_user_error("%d:%d BC_ACQUIRE_DONE node %d has no pending acquire request\n",
355b0502
GKH		 3280 proc->pid, thread->pid,
3281 node->debug_id);
3282 break;
3283 }
3284 node->pending_strong_ref = 0;
3285 } else {
3286 if (node->pending_weak_ref == 0) {
56b468fc 3287 binder_user_error("%d:%d BC_INCREFS_DONE node %d has no pending increfs request\n",
355b0502
GKH		 3288 proc->pid, thread->pid,
3289 node->debug_id);
3290 break;
3291 }
3292 node->pending_weak_ref = 0;
3293 }
3294 binder_dec_node(node, cmd == BC_ACQUIRE_DONE, 0);
3295 binder_debug(BINDER_DEBUG_USER_REFS,
56b468fc 3296 "%d:%d %s node %d ls %d lw %d\n",
355b0502
GKH		 3297 proc->pid, thread->pid,
3298 cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
3299 node->debug_id, node->local_strong_refs, node->local_weak_refs);
3300 break;
3301 }
3302 case BC_ATTEMPT_ACQUIRE:
56b468fc 3303 pr_err("BC_ATTEMPT_ACQUIRE not supported\n");
355b0502
GKH		 3304 return -EINVAL;
3305 case BC_ACQUIRE_RESULT:
56b468fc 3306 pr_err("BC_ACQUIRE_RESULT not supported\n");
355b0502
GKH		 3307 return -EINVAL;
3308
3309 case BC_FREE_BUFFER: {
6fa3eb70 3310 binder_uintptr_t data_ptr;
355b0502
GKH		 3311 struct binder_buffer *buffer;
3312
6fa3eb70 3313 if (get_user(data_ptr, (binder_uintptr_t __user *)ptr))
355b0502 3314 return -EFAULT;
6fa3eb70 3315 ptr += sizeof(binder_uintptr_t);
355b0502
GKH		 3316
3317 buffer = binder_buffer_lookup(proc, data_ptr);
3318 if (buffer == NULL) {
6fa3eb70
S		 3319 binder_user_error("%d:%d BC_FREE_BUFFER u%016llx no match\n",
3320 proc->pid, thread->pid, (u64)data_ptr);
355b0502
GKH		 3321 break;
3322 }
3323 if (!buffer->allow_user_free) {
6fa3eb70
S		 3324 binder_user_error("%d:%d BC_FREE_BUFFER u%016llx matched unreturned buffer\n",
3325 proc->pid, thread->pid, (u64)data_ptr);
355b0502
GKH		 3326 break;
3327 }
3328 binder_debug(BINDER_DEBUG_FREE_BUFFER,
6fa3eb70
S		 3329 "%d:%d BC_FREE_BUFFER u%016llx found buffer %d for %s transaction\n",
3330 proc->pid, thread->pid, (u64)data_ptr, buffer->debug_id,
355b0502
GKH		 3331 buffer->transaction ? "active" : "finished");
3332
3333 if (buffer->transaction) {
3334 buffer->transaction->buffer = NULL;
3335 buffer->transaction = NULL;
3336 }
3337 if (buffer->async_transaction && buffer->target_node) {
3338 BUG_ON(!buffer->target_node->has_async_transaction);
3339 if (list_empty(&buffer->target_node->async_todo))
6fa3eb70
S		 3340#ifdef MTK_BINDER_DEBUG
3341 {
3342#endif
355b0502 3343 buffer->target_node->has_async_transaction = 0;
6fa3eb70
S		 3344#ifdef MTK_BINDER_DEBUG
3345 buffer->target_node->async_pid = 0;
3346 }
3347#endif
355b0502 3348 else
6fa3eb70
S		 3349#ifdef MTK_BINDER_DEBUG
3350 {
3351#endif
355b0502 3352 list_move_tail(buffer->target_node->async_todo.next, &thread->todo);
6fa3eb70
S		 3353#ifdef MTK_BINDER_DEBUG
3354 buffer->target_node->async_pid = thread->pid;
3355 }
3356#endif
355b0502 3357 }
975a1ac9 3358 trace_binder_transaction_buffer_release(buffer);
355b0502
GKH		 3359 binder_transaction_buffer_release(proc, buffer, NULL);
3360 binder_free_buf(proc, buffer);
3361 break;
3362 }
3363
3364 case BC_TRANSACTION:
3365 case BC_REPLY: {
3366 struct binder_transaction_data tr;
3367
3368 if (copy_from_user(&tr, ptr, sizeof(tr)))
3369 return -EFAULT;
3370 ptr += sizeof(tr);
3371 binder_transaction(proc, thread, &tr, cmd == BC_REPLY);
3372 break;
3373 }
3374
3375 case BC_REGISTER_LOOPER:
3376 binder_debug(BINDER_DEBUG_THREADS,
56b468fc 3377 "%d:%d BC_REGISTER_LOOPER\n",
355b0502
GKH		 3378 proc->pid, thread->pid);
3379 if (thread->looper & BINDER_LOOPER_STATE_ENTERED) {
3380 thread->looper |= BINDER_LOOPER_STATE_INVALID;
56b468fc 3381 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER\n",
355b0502
GKH		 3382 proc->pid, thread->pid);
3383 } else if (proc->requested_threads == 0) {
3384 thread->looper |= BINDER_LOOPER_STATE_INVALID;
56b468fc 3385 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called without request\n",
355b0502
GKH		 3386 proc->pid, thread->pid);
3387 } else {
3388 proc->requested_threads--;
3389 proc->requested_threads_started++;
3390 }
3391 thread->looper |= BINDER_LOOPER_STATE_REGISTERED;
3392 break;
3393 case BC_ENTER_LOOPER:
3394 binder_debug(BINDER_DEBUG_THREADS,
56b468fc 3395 "%d:%d BC_ENTER_LOOPER\n",
355b0502
GKH		 3396 proc->pid, thread->pid);
3397 if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) {
3398 thread->looper |= BINDER_LOOPER_STATE_INVALID;
56b468fc 3399 binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n",
355b0502
GKH		 3400 proc->pid, thread->pid);
3401 }
3402 thread->looper |= BINDER_LOOPER_STATE_ENTERED;
3403 break;
3404 case BC_EXIT_LOOPER:
3405 binder_debug(BINDER_DEBUG_THREADS,
56b468fc 3406 "%d:%d BC_EXIT_LOOPER\n",
355b0502
GKH		 3407 proc->pid, thread->pid);
3408 thread->looper |= BINDER_LOOPER_STATE_EXITED;
3409 break;
3410
3411 case BC_REQUEST_DEATH_NOTIFICATION:
3412 case BC_CLEAR_DEATH_NOTIFICATION: {
3413 uint32_t target;
6fa3eb70 3414 binder_uintptr_t cookie;
355b0502
GKH		 3415 struct binder_ref *ref;
3416 struct binder_ref_death *death;
3417
3418 if (get_user(target, (uint32_t __user *)ptr))
3419 return -EFAULT;
3420 ptr += sizeof(uint32_t);
6fa3eb70 3421 if (get_user(cookie, (binder_uintptr_t __user *)ptr))
355b0502 3422 return -EFAULT;
6fa3eb70 3423 ptr += sizeof(binder_uintptr_t);
4b9e9796 3424 ref = binder_get_ref(proc, target, false);
355b0502 3425 if (ref == NULL) {
56b468fc 3426 binder_user_error("%d:%d %s invalid ref %d\n",
355b0502
GKH		 3427 proc->pid, thread->pid,
3428 cmd == BC_REQUEST_DEATH_NOTIFICATION ?
3429 "BC_REQUEST_DEATH_NOTIFICATION" :
3430 "BC_CLEAR_DEATH_NOTIFICATION",
3431 target);
3432 break;
3433 }
6fa3eb70
S		 3434#ifdef MTK_DEATH_NOTIFY_MONITOR
3435 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
3436 "[DN #%s]binder: %d:%d %s %d(%s) cookie 0x%016llx\n",
3437 cmd == BC_REQUEST_DEATH_NOTIFICATION ? "1" : "2",
3438 proc->pid, thread->pid,
3439 cmd == BC_REQUEST_DEATH_NOTIFICATION ?
3440 "BC_REQUEST_DEATH_NOTIFICATION" :
3441 "BC_CLEAR_DEATH_NOTIFICATION",
3442 ref->node->proc ? ref->node->proc->pid : 0,
3443#ifdef BINDER_MONITOR
3444 ref->node ? ref->node->name : "",
3445#else
3446 "",
3447#endif
3448 (u64)cookie);
3449#else
355b0502 3450 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
6fa3eb70 3451 "%d:%d %s %016llx ref %d desc %d s %d w %d for node %d\n",
355b0502
GKH		 3452 proc->pid, thread->pid,
3453 cmd == BC_REQUEST_DEATH_NOTIFICATION ?
3454 "BC_REQUEST_DEATH_NOTIFICATION" :
3455 "BC_CLEAR_DEATH_NOTIFICATION",
6fa3eb70 3456 (u64)cookie, ref->debug_id, ref->desc,
355b0502 3457 ref->strong, ref->weak, ref->node->debug_id);
6fa3eb70 3458#endif
355b0502
GKH		 3459
3460 if (cmd == BC_REQUEST_DEATH_NOTIFICATION) {
3461 if (ref->death) {
56b468fc 3462 binder_user_error("%d:%d BC_REQUEST_DEATH_NOTIFICATION death notification already set\n",
355b0502
GKH		 3463 proc->pid, thread->pid);
3464 break;
3465 }
3466 death = kzalloc(sizeof(*death), GFP_KERNEL);
3467 if (death == NULL) {
3468 thread->return_error = BR_ERROR;
3469 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
56b468fc 3470 "%d:%d BC_REQUEST_DEATH_NOTIFICATION failed\n",
355b0502
GKH		 3471 proc->pid, thread->pid);
3472 break;
3473 }
3474 binder_stats_created(BINDER_STAT_DEATH);
3475 INIT_LIST_HEAD(&death->work.entry);
3476 death->cookie = cookie;
3477 ref->death = death;
3478 if (ref->node->proc == NULL) {
3479 ref->death->work.type = BINDER_WORK_DEAD_BINDER;
3480 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) {
3481 list_add_tail(&ref->death->work.entry, &thread->todo);
3482 } else {
3483 list_add_tail(&ref->death->work.entry, &proc->todo);
3484 wake_up_interruptible(&proc->wait);
3485 }
3486 }
3487 } else {
3488 if (ref->death == NULL) {
56b468fc 3489 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification not active\n",
355b0502
GKH		 3490 proc->pid, thread->pid);
3491 break;
3492 }
3493 death = ref->death;
3494 if (death->cookie != cookie) {
6fa3eb70 3495 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch %016llx != %016llx\n",
355b0502 3496 proc->pid, thread->pid,
6fa3eb70 3497 (u64)death->cookie, (u64)cookie);
355b0502
GKH		 3498 break;
3499 }
3500 ref->death = NULL;
3501 if (list_empty(&death->work.entry)) {
3502 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;
3503 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) {
3504 list_add_tail(&death->work.entry, &thread->todo);
3505 } else {
3506 list_add_tail(&death->work.entry, &proc->todo);
3507 wake_up_interruptible(&proc->wait);
3508 }
3509 } else {
3510 BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER);
3511 death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR;
3512 }
3513 }
3514 } break;
3515 case BC_DEAD_BINDER_DONE: {
3516 struct binder_work *w;
6fa3eb70 3517 binder_uintptr_t cookie;
355b0502 3518 struct binder_ref_death *death = NULL;
6fa3eb70 3519 if (get_user(cookie, (binder_uintptr_t __user *)ptr))
355b0502
GKH		 3520 return -EFAULT;
3521
6fa3eb70
S		 3522#ifdef MTK_DEATH_NOTIFY_MONITOR
3523 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
3524 "[DN #6]binder: %d:%d cookie 0x%016llx\n", proc->pid, thread->pid, (u64)cookie);
3525#endif
3526
355b0502
GKH		 3527 ptr += sizeof(void *);
3528 list_for_each_entry(w, &proc->delivered_death, entry) {
3529 struct binder_ref_death *tmp_death = container_of(w, struct binder_ref_death, work);
3530 if (tmp_death->cookie == cookie) {
3531 death = tmp_death;
3532 break;
3533 }
3534 }
3535 binder_debug(BINDER_DEBUG_DEAD_BINDER,
4b9e9796 3536 "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
6fa3eb70 3537 proc->pid, thread->pid, (u64)cookie, death);
355b0502 3538 if (death == NULL) {
6fa3eb70
S		 3539 binder_user_error("%d:%d BC_DEAD_BINDER_DONE %016llx not found\n",
3540 proc->pid, thread->pid, (u64)cookie);
355b0502
GKH		 3541 break;
3542 }
3543
3544 list_del_init(&death->work.entry);
3545 if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) {
3546 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;
3547 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) {
3548 list_add_tail(&death->work.entry, &thread->todo);
3549 } else {
3550 list_add_tail(&death->work.entry, &proc->todo);
3551 wake_up_interruptible(&proc->wait);
3552 }
3553 }
3554 } break;
3555
3556 default:
56b468fc 3557 pr_err("%d:%d unknown command %d\n",
355b0502
GKH		 3558 proc->pid, thread->pid, cmd);
3559 return -EINVAL;
3560 }
3561 *consumed = ptr - buffer;
3562 }
3563 return 0;
3564}
3565
3566void binder_stat_br(struct binder_proc *proc, struct binder_thread *thread,
3567 uint32_t cmd)
3568{
975a1ac9 3569 trace_binder_return(cmd);
355b0502
GKH		 3570 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) {
3571 binder_stats.br[_IOC_NR(cmd)]++;
3572 proc->stats.br[_IOC_NR(cmd)]++;
3573 thread->stats.br[_IOC_NR(cmd)]++;
3574 }
3575}
3576
3577static int binder_has_proc_work(struct binder_proc *proc,
3578 struct binder_thread *thread)
3579{
3580 return !list_empty(&proc->todo) ||
3581 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN);
3582}
3583
3584static int binder_has_thread_work(struct binder_thread *thread)
3585{
3586 return !list_empty(&thread->todo) || thread->return_error != BR_OK ||
3587 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN);
3588}
3589
3590static int binder_thread_read(struct binder_proc *proc,
3591 struct binder_thread *thread,
6fa3eb70
S		 3592 binder_uintptr_t binder_buffer, size_t size,
3593 binder_size_t *consumed, int non_block)
355b0502 3594{
6fa3eb70 3595 void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
355b0502
GKH		 3596 void __user *ptr = buffer + *consumed;
3597 void __user *end = buffer + size;
3598
3599 int ret = 0;
3600 int wait_for_proc_work;
3601
3602 if (*consumed == 0) {
3603 if (put_user(BR_NOOP, (uint32_t __user *)ptr))
3604 return -EFAULT;
3605 ptr += sizeof(uint32_t);
3606 }
3607
3608retry:
3609 wait_for_proc_work = thread->transaction_stack == NULL &&
3610 list_empty(&thread->todo);
3611
3612 if (thread->return_error != BR_OK && ptr < end) {
3613 if (thread->return_error2 != BR_OK) {
3614 if (put_user(thread->return_error2, (uint32_t __user *)ptr))
3615 return -EFAULT;
3616 ptr += sizeof(uint32_t);
6fa3eb70
S		 3617 pr_err("read put err2 %u to user %p, thread error %u:%u\n",
3618 thread->return_error2, ptr, thread->return_error, thread->return_error2);
89334ab4 3619 binder_stat_br(proc, thread, thread->return_error2);
355b0502
GKH		 3620 if (ptr == end)
3621 goto done;
3622 thread->return_error2 = BR_OK;
3623 }
3624 if (put_user(thread->return_error, (uint32_t __user *)ptr))
3625 return -EFAULT;
3626 ptr += sizeof(uint32_t);
6fa3eb70
S		 3627 pr_err("read put err %u to user %p, thread error %u:%u\n",
3628 thread->return_error, ptr, thread->return_error, thread->return_error2);
89334ab4 3629 binder_stat_br(proc, thread, thread->return_error);
355b0502
GKH		 3630 thread->return_error = BR_OK;
3631 goto done;
3632 }
3633
3634
3635 thread->looper |= BINDER_LOOPER_STATE_WAITING;
3636 if (wait_for_proc_work)
3637 proc->ready_threads++;
975a1ac9
AH		 3638
3639 binder_unlock(__func__);
3640
3641 trace_binder_wait_for_work(wait_for_proc_work,
3642 !!thread->transaction_stack,
3643 !list_empty(&thread->todo));
355b0502
GKH		 3644 if (wait_for_proc_work) {
3645 if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
3646 BINDER_LOOPER_STATE_ENTERED))) {
56b468fc 3647 binder_user_error("%d:%d ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state %x)\n",
355b0502
GKH		 3648 proc->pid, thread->pid, thread->looper);
3649 wait_event_interruptible(binder_user_error_wait,
3650 binder_stop_on_user_error < 2);
3651 }
6fa3eb70
S		 3652#ifdef RT_PRIO_INHERIT
3653 /* disable preemption to prevent from schedule-out immediately */
3654 preempt_disable();
3655#endif
355b0502 3656 binder_set_nice(proc->default_priority);
6fa3eb70
S		 3657#ifdef RT_PRIO_INHERIT
3658 if (rt_task(current) && !binder_has_proc_work(proc, thread)) {
3659 /* make sure binder has no work before setting priority back*/
3660 struct sched_param param = {
3661 .sched_priority = proc->default_rt_prio,
3662 };
3663#ifdef BINDER_MONITOR
3664 if (log_disable & BINDER_RT_LOG_ENABLE)
3665 {
3666 pr_debug("enter threadpool reset %d sched_policy from %u to %d rt_prio from %u to %d\n",
3667 current->pid, current->policy, proc->default_policy,
3668 current->rt_priority, proc->default_rt_prio);
3669 }
3670#endif
3671 mt_sched_setscheduler_nocheck(current,
3672 proc->default_policy, &param);
3673 }
3674 preempt_enable_no_resched();
3675#endif
355b0502
GKH		 3676 if (non_block) {
3677 if (!binder_has_proc_work(proc, thread))
3678 ret = -EAGAIN;
3679 } else
6fa3eb70 3680 ret = wait_event_freezable_exclusive(proc->wait, binder_has_proc_work(proc, thread));
355b0502
GKH		 3681 } else {
3682 if (non_block) {
3683 if (!binder_has_thread_work(thread))
3684 ret = -EAGAIN;
3685 } else
6fa3eb70 3686 ret = wait_event_freezable(thread->wait, binder_has_thread_work(thread));
355b0502 3687 }
975a1ac9
AH		 3688
3689 binder_lock(__func__);
3690
355b0502
GKH		 3691 if (wait_for_proc_work)
3692 proc->ready_threads--;
3693 thread->looper &= ~BINDER_LOOPER_STATE_WAITING;
3694
3695 if (ret)
3696 return ret;
3697
3698 while (1) {
3699 uint32_t cmd;
3700 struct binder_transaction_data tr;
3701 struct binder_work *w;
3702 struct binder_transaction *t = NULL;
3703
3704 if (!list_empty(&thread->todo))
3705 w = list_first_entry(&thread->todo, struct binder_work, entry);
3706 else if (!list_empty(&proc->todo) && wait_for_proc_work)
3707 w = list_first_entry(&proc->todo, struct binder_work, entry);
3708 else {
3709 if (ptr - buffer == 4 && !(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN)) /* no data added */
3710 goto retry;
3711 break;
3712 }
3713
3714 if (end - ptr < sizeof(tr) + 4)
3715 break;
3716
3717 switch (w->type) {
3718 case BINDER_WORK_TRANSACTION: {
3719 t = container_of(w, struct binder_transaction, work);
6fa3eb70
S		 3720#ifdef BINDER_MONITOR
3721 binder_cancel_bwdog(t);
3722#endif
355b0502
GKH		 3723 } break;
3724 case BINDER_WORK_TRANSACTION_COMPLETE: {
3725 cmd = BR_TRANSACTION_COMPLETE;
3726 if (put_user(cmd, (uint32_t __user *)ptr))
3727 return -EFAULT;
3728 ptr += sizeof(uint32_t);
3729
3730 binder_stat_br(proc, thread, cmd);
3731 binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE,
56b468fc 3732 "%d:%d BR_TRANSACTION_COMPLETE\n",
355b0502
GKH		 3733 proc->pid, thread->pid);
3734
3735 list_del(&w->entry);
3736 kfree(w);
3737 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
3738 } break;
3739 case BINDER_WORK_NODE: {
3740 struct binder_node *node = container_of(w, struct binder_node, work);
3741 uint32_t cmd = BR_NOOP;
3742 const char *cmd_name;
3743 int strong = node->internal_strong_refs || node->local_strong_refs;
3744 int weak = !hlist_empty(&node->refs) || node->local_weak_refs || strong;
3745 if (weak && !node->has_weak_ref) {
3746 cmd = BR_INCREFS;
3747 cmd_name = "BR_INCREFS";
3748 node->has_weak_ref = 1;
3749 node->pending_weak_ref = 1;
3750 node->local_weak_refs++;
3751 } else if (strong && !node->has_strong_ref) {
3752 cmd = BR_ACQUIRE;
3753 cmd_name = "BR_ACQUIRE";
3754 node->has_strong_ref = 1;
3755 node->pending_strong_ref = 1;
3756 node->local_strong_refs++;
3757 } else if (!strong && node->has_strong_ref) {
3758 cmd = BR_RELEASE;
3759 cmd_name = "BR_RELEASE";
3760 node->has_strong_ref = 0;
3761 } else if (!weak && node->has_weak_ref) {
3762 cmd = BR_DECREFS;
3763 cmd_name = "BR_DECREFS";
3764 node->has_weak_ref = 0;
3765 }
3766 if (cmd != BR_NOOP) {
3767 if (put_user(cmd, (uint32_t __user *)ptr))
3768 return -EFAULT;
3769 ptr += sizeof(uint32_t);
6fa3eb70
S		 3770 if (put_user(node->ptr,
3771 (binder_uintptr_t __user *)ptr))
355b0502 3772 return -EFAULT;
6fa3eb70
S		 3773 ptr += sizeof(binder_uintptr_t);
3774 if (put_user(node->cookie,
3775 (binder_uintptr_t __user *)ptr))
355b0502 3776 return -EFAULT;
6fa3eb70 3777 ptr += sizeof(binder_uintptr_t);
355b0502
GKH		 3778
3779 binder_stat_br(proc, thread, cmd);
3780 binder_debug(BINDER_DEBUG_USER_REFS,
6fa3eb70
S		 3781 "%d:%d %s %d u%016llx c%016llx\n",
3782 proc->pid, thread->pid, cmd_name,
3783 node->debug_id,
3784 (u64)node->ptr, (u64)node->cookie);
355b0502
GKH		 3785 } else {
3786 list_del_init(&w->entry);
3787 if (!weak && !strong) {
3788 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
6fa3eb70 3789 "%d:%d node %d u%016llx c%016llx deleted\n",
355b0502 3790 proc->pid, thread->pid, node->debug_id,
6fa3eb70 3791 (u64)node->ptr, (u64)node->cookie);
355b0502
GKH		 3792 rb_erase(&node->rb_node, &proc->nodes);
3793 kfree(node);
3794 binder_stats_deleted(BINDER_STAT_NODE);
3795 } else {
3796 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
6fa3eb70
S		 3797 "%d:%d node %d u%016llx c%016llx state unchanged\n",
3798 proc->pid, thread->pid, node->debug_id,
3799 (u64)node->ptr, (u64)node->cookie);
355b0502
GKH		 3800 }
3801 }
3802 } break;
3803 case BINDER_WORK_DEAD_BINDER:
3804 case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
3805 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
3806 struct binder_ref_death *death;
3807 uint32_t cmd;
3808
3809 death = container_of(w, struct binder_ref_death, work);
6fa3eb70
S		 3810
3811#ifdef MTK_DEATH_NOTIFY_MONITOR
3812 switch (w->type) {
3813 case BINDER_WORK_DEAD_BINDER:
3814 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
3815 "[DN #4]binder: %d:%d BINDER_WORK_DEAD_BINDER cookie 0x%016llx\n",
3816 proc->pid, thread->pid, (u64)death->cookie);
3817 break;
3818 case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
3819 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
3820 "[DN #4]binder: %d:%d BINDER_WORK_DEAD_BINDER_AND_CLEAR cookie "
3821 "0x%016llx\n", proc->pid, thread->pid, (u64)death->cookie);
3822 break;
3823 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION:
3824 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
3825 "[DN #4]binder: %d:%d BINDER_WORK_CLEAR_DEATH_NOTIFICATION cookie "
3826 "0x%016llx\n", proc->pid, thread->pid, (u64)death->cookie);
3827 break;
3828 default:
3829 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
3830 "[DN #4]binder: %d:%d UNKNOWN-%d cookie 0x%016llx\n",
3831 proc->pid, thread->pid, w->type, (u64)death->cookie);
3832 break;
3833 }
3834#endif
3835
355b0502
GKH		 3836 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION)
3837 cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE;
3838 else
3839 cmd = BR_DEAD_BINDER;
3840 if (put_user(cmd, (uint32_t __user *)ptr))
3841 return -EFAULT;
3842 ptr += sizeof(uint32_t);
6fa3eb70
S		 3843 if (put_user(death->cookie,
3844 (binder_uintptr_t __user *)ptr))
355b0502 3845 return -EFAULT;
6fa3eb70 3846 ptr += sizeof(binder_uintptr_t);
89334ab4 3847 binder_stat_br(proc, thread, cmd);
355b0502 3848 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
6fa3eb70 3849 "%d:%d %s %016llx\n",
355b0502
GKH		 3850 proc->pid, thread->pid,
3851 cmd == BR_DEAD_BINDER ?
3852 "BR_DEAD_BINDER" :
3853 "BR_CLEAR_DEATH_NOTIFICATION_DONE",
6fa3eb70 3854 (u64)death->cookie);
355b0502
GKH		 3855
3856 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) {
3857 list_del(&w->entry);
3858 kfree(death);
3859 binder_stats_deleted(BINDER_STAT_DEATH);
3860 } else
3861 list_move(&w->entry, &proc->delivered_death);
3862 if (cmd == BR_DEAD_BINDER)
3863 goto done; /* DEAD_BINDER notifications can cause transactions */
3864 } break;
3865 }
3866
3867 if (!t)
3868 continue;
3869
3870 BUG_ON(t->buffer == NULL);
3871 if (t->buffer->target_node) {
3872 struct binder_node *target_node = t->buffer->target_node;
3873 tr.target.ptr = target_node->ptr;
3874 tr.cookie = target_node->cookie;
3875 t->saved_priority = task_nice(current);
6fa3eb70
S		 3876#ifdef RT_PRIO_INHERIT
3877 /* since we may fail the rt inherit due to target
3878 * wait queue task_list is empty, check again here.
3879 */
3880 if ((SCHED_RR == t->policy || SCHED_FIFO == t->policy) && t->rt_prio > current->rt_priority &&
3881 !(t->flags & TF_ONE_WAY)) {
3882 struct sched_param param = {
3883 .sched_priority = t->rt_prio,
3884 };
3885
3886 t->saved_rt_prio = current->rt_priority;
3887 t->saved_policy = current->policy;
3888 mt_sched_setscheduler_nocheck(current, t->policy, &param);
3889#ifdef BINDER_MONITOR
3890 if (log_disable & BINDER_RT_LOG_ENABLE)
3891 {
3892 pr_debug("read set %d sched_policy from %d to %d rt_prio from %d to %d\n",
3893 proc->pid, t->saved_policy, t->policy,
3894 t->saved_rt_prio, t->rt_prio);
3895 }
3896#endif
3897 }
3898#endif
355b0502
GKH		 3899 if (t->priority < target_node->min_priority &&
3900 !(t->flags & TF_ONE_WAY))
3901 binder_set_nice(t->priority);
3902 else if (!(t->flags & TF_ONE_WAY) ||
3903 t->saved_priority > target_node->min_priority)
3904 binder_set_nice(target_node->min_priority);
3905 cmd = BR_TRANSACTION;
3906 } else {
6fa3eb70
S		 3907 tr.target.ptr = 0;
3908 tr.cookie = 0;
355b0502
GKH		 3909 cmd = BR_REPLY;
3910 }
3911 tr.code = t->code;
3912 tr.flags = t->flags;
4a2ebb93 3913 tr.sender_euid = from_kuid(current_user_ns(), t->sender_euid);
355b0502
GKH		 3914
3915 if (t->from) {
3916 struct task_struct *sender = t->from->proc->tsk;
3917 tr.sender_pid = task_tgid_nr_ns(sender,
17cf22c3 3918 task_active_pid_ns(current));
355b0502
GKH		 3919 } else {
3920 tr.sender_pid = 0;
3921 }
3922
3923 tr.data_size = t->buffer->data_size;
3924 tr.offsets_size = t->buffer->offsets_size;
6fa3eb70
S		 3925 tr.data.ptr.buffer = (binder_uintptr_t)(
3926 (uintptr_t)t->buffer->data +
3927 proc->user_buffer_offset);
355b0502
GKH		 3928 tr.data.ptr.offsets = tr.data.ptr.buffer +
3929 ALIGN(t->buffer->data_size,
3930 sizeof(void *));
3931
3932 if (put_user(cmd, (uint32_t __user *)ptr))
3933 return -EFAULT;
3934 ptr += sizeof(uint32_t);
3935 if (copy_to_user(ptr, &tr, sizeof(tr)))
3936 return -EFAULT;
3937 ptr += sizeof(tr);
3938
975a1ac9 3939 trace_binder_transaction_received(t);
355b0502
GKH		 3940 binder_stat_br(proc, thread, cmd);
3941 binder_debug(BINDER_DEBUG_TRANSACTION,
6fa3eb70 3942 "%d:%d %s %d %d:%d, cmd %d size %zd-%zd ptr %016llx-%016llx\n",
355b0502
GKH		 3943 proc->pid, thread->pid,
3944 (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" :
3945 "BR_REPLY",
3946 t->debug_id, t->from ? t->from->proc->pid : 0,
3947 t->from ? t->from->pid : 0, cmd,
3948 t->buffer->data_size, t->buffer->offsets_size,
6fa3eb70 3949 (u64)tr.data.ptr.buffer, (u64)tr.data.ptr.offsets);
355b0502
GKH		 3950
3951 list_del(&t->work.entry);
3952 t->buffer->allow_user_free = 1;
3953 if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) {
3954 t->to_parent = thread->transaction_stack;
3955 t->to_thread = thread;
3956 thread->transaction_stack = t;
6fa3eb70
S		 3957#ifdef BINDER_MONITOR
3958 do_posix_clock_monotonic_gettime(&t->exe_timestamp);
3959 //monotonic_to_bootbased(&t->exe_timestamp);
3960 do_gettimeofday(&t->tv);
3961 /* consider time zone. translate to android time */
3962 t->tv.tv_sec -= (sys_tz.tz_minuteswest * 60);
3963 t->wait_on = WAIT_ON_EXEC;
3964 t->tthrd = thread->pid;
3965 binder_queue_bwdog(t, (time_t)WAIT_BUDGET_EXEC);
3966 binder_update_transaction_time(&binder_transaction_log, t, 1);
3967 binder_update_transaction_ttid(&binder_transaction_log, t);
3968#endif
355b0502
GKH		 3969 } else {
3970 t->buffer->transaction = NULL;
6fa3eb70
S		 3971#ifdef BINDER_MONITOR
3972 binder_cancel_bwdog(t);
3973 if (cmd == BR_TRANSACTION && (t->flags & TF_ONE_WAY)) {
3974 binder_update_transaction_time(&binder_transaction_log, t, 1);
3975 t->tthrd = thread->pid;
3976 binder_update_transaction_ttid(&binder_transaction_log, t);
3977 }
3978#endif
355b0502
GKH		 3979 kfree(t);
3980 binder_stats_deleted(BINDER_STAT_TRANSACTION);
3981 }
3982 break;
3983 }
3984
3985done:
3986
3987 *consumed = ptr - buffer;
3988 if (proc->requested_threads + proc->ready_threads == 0 &&
3989 proc->requested_threads_started < proc->max_threads &&
3990 (thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
3991 BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */
3992 /*spawn a new thread if we leave this out */) {
3993 proc->requested_threads++;
3994 binder_debug(BINDER_DEBUG_THREADS,
56b468fc 3995 "%d:%d BR_SPAWN_LOOPER\n",
355b0502
GKH		 3996 proc->pid, thread->pid);
3997 if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer))
3998 return -EFAULT;
89334ab4 3999 binder_stat_br(proc, thread, BR_SPAWN_LOOPER);
355b0502
GKH		 4000 }
4001 return 0;
4002}
4003
4004static void binder_release_work(struct list_head *list)
4005{
4006 struct binder_work *w;
4007 while (!list_empty(list)) {
4008 w = list_first_entry(list, struct binder_work, entry);
4009 list_del_init(&w->entry);
4010 switch (w->type) {
4011 case BINDER_WORK_TRANSACTION: {
4012 struct binder_transaction *t;
4013
4014 t = container_of(w, struct binder_transaction, work);
675d66b0
AH		 4015 if (t->buffer->target_node &&
4016 !(t->flags & TF_ONE_WAY)) {
355b0502 4017 binder_send_failed_reply(t, BR_DEAD_REPLY);
675d66b0
AH		 4018 } else {
4019 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
56b468fc 4020 "undelivered transaction %d\n",
675d66b0
AH		 4021 t->debug_id);
4022 t->buffer->transaction = NULL;
6fa3eb70
S		 4023#ifdef BINDER_MONITOR
4024 binder_cancel_bwdog(t);
4025#endif
675d66b0
AH		 4026 kfree(t);
4027 binder_stats_deleted(BINDER_STAT_TRANSACTION);
4028 }
355b0502
GKH		 4029 } break;
4030 case BINDER_WORK_TRANSACTION_COMPLETE: {
675d66b0 4031 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
56b468fc 4032 "undelivered TRANSACTION_COMPLETE\n");
355b0502
GKH		 4033 kfree(w);
4034 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
4035 } break;
675d66b0
AH		 4036 case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
4037 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
4038 struct binder_ref_death *death;
4039
4040 death = container_of(w, struct binder_ref_death, work);
4041 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
6fa3eb70
S		 4042 "undelivered death notification, %016llx\n",
4043 (u64)death->cookie);
675d66b0
AH		 4044 kfree(death);
4045 binder_stats_deleted(BINDER_STAT_DEATH);
4046 } break;
355b0502 4047 default:
56b468fc 4048 pr_err("unexpected work type, %d, not freed\n",
675d66b0 4049 w->type);
355b0502
GKH		 4050 break;
4051 }
4052 }
4053
4054}
4055
4056static struct binder_thread *binder_get_thread(struct binder_proc *proc)
4057{
4058 struct binder_thread *thread = NULL;
4059 struct rb_node *parent = NULL;
4060 struct rb_node **p = &proc->threads.rb_node;
4061
4062 while (*p) {
4063 parent = *p;
4064 thread = rb_entry(parent, struct binder_thread, rb_node);
4065
4066 if (current->pid < thread->pid)
4067 p = &(*p)->rb_left;
4068 else if (current->pid > thread->pid)
4069 p = &(*p)->rb_right;
4070 else
4071 break;
4072 }
4073 if (*p == NULL) {
4074 thread = kzalloc(sizeof(*thread), GFP_KERNEL);
4075 if (thread == NULL)
4076 return NULL;
4077 binder_stats_created(BINDER_STAT_THREAD);
4078 thread->proc = proc;
4079 thread->pid = current->pid;
4080 init_waitqueue_head(&thread->wait);
4081 INIT_LIST_HEAD(&thread->todo);
4082 rb_link_node(&thread->rb_node, parent, p);
4083 rb_insert_color(&thread->rb_node, &proc->threads);
4084 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN;
4085 thread->return_error = BR_OK;
4086 thread->return_error2 = BR_OK;
4087 }
4088 return thread;
4089}
4090
4091static int binder_free_thread(struct binder_proc *proc,
4092 struct binder_thread *thread)
4093{
4094 struct binder_transaction *t;
4095 struct binder_transaction *send_reply = NULL;
4096 int active_transactions = 0;
4097
4098 rb_erase(&thread->rb_node, &proc->threads);
4099 t = thread->transaction_stack;
4100 if (t && t->to_thread == thread)
4101 send_reply = t;
4102 while (t) {
4103 active_transactions++;
4104 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
56b468fc
AS		 4105 "release %d:%d transaction %d %s, still active\n",
4106 proc->pid, thread->pid,
355b0502
GKH		 4107 t->debug_id,
4108 (t->to_thread == thread) ? "in" : "out");
4109
6fa3eb70
S		 4110#ifdef MTK_BINDER_DEBUG
4111 pr_err("%d: %p from %d:%d to %d:%d code %x flags %x "
4112 "pri %ld r%d "
4113#ifdef BINDER_MONITOR
4114 "start %lu.%06lu"
4115#endif
4116 ,
4117 t->debug_id, t,
4118 t->from ? t->from->proc->pid : 0,
4119 t->from ? t->from->pid : 0,
4120 t->to_proc ? t->to_proc->pid : 0,
4121 t->to_thread ? t->to_thread->pid : 0,
4122 t->code, t->flags, t->priority, t->need_reply
4123#ifdef BINDER_MONITOR
4124 , (unsigned long)t->timestamp.tv_sec,
4125 (t->timestamp.tv_nsec / NSEC_PER_USEC)
4126#endif
4127 );
4128#endif
355b0502
GKH		 4129 if (t->to_thread == thread) {
4130 t->to_proc = NULL;
4131 t->to_thread = NULL;
4132 if (t->buffer) {
4133 t->buffer->transaction = NULL;
4134 t->buffer = NULL;
4135 }
4136 t = t->to_parent;
4137 } else if (t->from == thread) {
4138 t->from = NULL;
4139 t = t->from_parent;
4140 } else
4141 BUG();
4142 }
4143 if (send_reply)
4144 binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
4145 binder_release_work(&thread->todo);
4146 kfree(thread);
4147 binder_stats_deleted(BINDER_STAT_THREAD);
4148 return active_transactions;
4149}
4150
4151static unsigned int binder_poll(struct file *filp,
4152 struct poll_table_struct *wait)
4153{
4154 struct binder_proc *proc = filp->private_data;
4155 struct binder_thread *thread = NULL;
4156 int wait_for_proc_work;
4157
975a1ac9
AH		 4158 binder_lock(__func__);
4159
355b0502
GKH		 4160 thread = binder_get_thread(proc);
4161
4162 wait_for_proc_work = thread->transaction_stack == NULL &&
4163 list_empty(&thread->todo) && thread->return_error == BR_OK;
975a1ac9
AH		 4164
4165 binder_unlock(__func__);
355b0502
GKH		 4166
4167 if (wait_for_proc_work) {
4168 if (binder_has_proc_work(proc, thread))
4169 return POLLIN;
4170 poll_wait(filp, &proc->wait, wait);
4171 if (binder_has_proc_work(proc, thread))
4172 return POLLIN;
4173 } else {
4174 if (binder_has_thread_work(thread))
4175 return POLLIN;
4176 poll_wait(filp, &thread->wait, wait);
4177 if (binder_has_thread_work(thread))
4178 return POLLIN;
4179 }
4180 return 0;
4181}
4182
4183static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
4184{
4185 int ret;
4186 struct binder_proc *proc = filp->private_data;
4187 struct binder_thread *thread;
4188 unsigned int size = _IOC_SIZE(cmd);
4189 void __user *ubuf = (void __user *)arg;
4190
258767fe 4191 /*pr_info("binder_ioctl: %d:%d %x %lx\n", proc->pid, current->pid, cmd, arg);*/
355b0502 4192
975a1ac9
AH		 4193 trace_binder_ioctl(cmd, arg);
4194
355b0502
GKH		 4195 ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
4196 if (ret)
975a1ac9 4197 goto err_unlocked;
355b0502 4198
975a1ac9 4199 binder_lock(__func__);
355b0502
GKH		 4200 thread = binder_get_thread(proc);
4201 if (thread == NULL) {
4202 ret = -ENOMEM;
4203 goto err;
4204 }
4205
4206 switch (cmd) {
4207 case BINDER_WRITE_READ: {
4208 struct binder_write_read bwr;
4209 if (size != sizeof(struct binder_write_read)) {
4210 ret = -EINVAL;
4211 goto err;
4212 }
4213 if (copy_from_user(&bwr, ubuf, sizeof(bwr))) {
4214 ret = -EFAULT;
4215 goto err;
4216 }
4217 binder_debug(BINDER_DEBUG_READ_WRITE,
6fa3eb70
S		 4218 "%d:%d write %lld at %016llx, read %lld at %016llx\n",
4219 proc->pid, thread->pid,
4220 (u64)bwr.write_size, (u64)bwr.write_buffer,
4221 (u64)bwr.read_size, (u64)bwr.read_buffer);
355b0502
GKH		 4222
4223 if (bwr.write_size > 0) {
6fa3eb70 4224 ret = binder_thread_write(proc, thread, bwr.write_buffer, bwr.write_size, &bwr.write_consumed);
975a1ac9 4225 trace_binder_write_done(ret);
355b0502
GKH		 4226 if (ret < 0) {
4227 bwr.read_consumed = 0;
4228 if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
4229 ret = -EFAULT;
4230 goto err;
4231 }
4232 }
4233 if (bwr.read_size > 0) {
6fa3eb70 4234 ret = binder_thread_read(proc, thread, bwr.read_buffer, bwr.read_size, &bwr.read_consumed, filp->f_flags & O_NONBLOCK);
975a1ac9 4235 trace_binder_read_done(ret);
6fa3eb70
S		 4236 if (!list_empty(&proc->todo)) {
4237 if (thread->proc != proc) {
4238 int i;
4239 unsigned int *p;
4240 printk(KERN_ERR "binder: "
4241 "thread->proc != proc\n");
4242
4243 printk(KERN_ERR "binder: thread %p\n",
4244 thread);
4245 p = (unsigned int *)thread - 32;
4246 for (i = -4; i <= 3; i++, p+=8) {
4247 printk(KERN_ERR "%p %08x %08x "
4248 "%08x %08x %08x %08x "
4249 "%08x %08x\n",
4250 p, *(p), *(p+1), *(p+2),
4251 *(p+3), *(p+4), *(p+5),
4252 *(p+6), *(p+7));
4253 }
4254
4255 printk(KERN_ERR "binder: thread->proc "
4256 "%p\n", thread->proc);
4257 p = (unsigned int *)thread->proc - 32;
4258 for (i = -4; i <= 5; i++, p+=8) {
4259 printk(KERN_ERR "%p %08x %08x "
4260 "%08x %08x %08x %08x "
4261 "%08x %08x\n",
4262 p, *(p), *(p+1), *(p+2),
4263 *(p+3), *(p+4), *(p+5),
4264 *(p+6), *(p+7));
4265 }
4266
4267 printk(KERN_ERR "binder: proc %p\n",
4268 proc);
4269 p = (unsigned int *)proc - 32;
4270 for (i = -4; i <= 5; i++, p+=8) {
4271 printk(KERN_ERR "%p %08x %08x "
4272 "%08x %08x %08x %08x "
4273 "%08x %08x\n",
4274 p, *(p), *(p+1), *(p+2),
4275 *(p+3), *(p+4), *(p+5),
4276 *(p+6), *(p+7));
4277 }
4278 BUG();
4279 }
355b0502 4280 wake_up_interruptible(&proc->wait);
6fa3eb70 4281 }
355b0502
GKH		 4282 if (ret < 0) {
4283 if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
4284 ret = -EFAULT;
4285 goto err;
4286 }
4287 }
4288 binder_debug(BINDER_DEBUG_READ_WRITE,
6fa3eb70
S		 4289 "%d:%d wrote %lld of %lld, read return %lld of %lld\n",
4290 proc->pid, thread->pid,
4291 (u64)bwr.write_consumed, (u64)bwr.write_size,
4292 (u64)bwr.read_consumed, (u64)bwr.read_size);
355b0502
GKH		 4293 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) {
4294 ret = -EFAULT;
4295 goto err;
4296 }
4297 break;
4298 }
4299 case BINDER_SET_MAX_THREADS:
4300 if (copy_from_user(&proc->max_threads, ubuf, sizeof(proc->max_threads))) {
4301 ret = -EINVAL;
4302 goto err;
4303 }
4304 break;
4305 case BINDER_SET_CONTEXT_MGR:
4306 if (binder_context_mgr_node != NULL) {
56b468fc 4307 pr_err("BINDER_SET_CONTEXT_MGR already set\n");
355b0502
GKH		 4308 ret = -EBUSY;
4309 goto err;
4310 }
6fa3eb70
S		 4311 ret = security_binder_set_context_mgr(proc->tsk);
4312 if (ret < 0)
4313 goto err;
4a2ebb93
EB		 4314 if (uid_valid(binder_context_mgr_uid)) {
4315 if (!uid_eq(binder_context_mgr_uid, current->cred->euid)) {
56b468fc 4316 pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n",
4a2ebb93
EB		 4317 from_kuid(&init_user_ns, current->cred->euid),
4318 from_kuid(&init_user_ns, binder_context_mgr_uid));
355b0502
GKH		 4319 ret = -EPERM;
4320 goto err;
4321 }
4322 } else
4323 binder_context_mgr_uid = current->cred->euid;
6fa3eb70 4324 binder_context_mgr_node = binder_new_node(proc, 0, 0);
355b0502
GKH		 4325 if (binder_context_mgr_node == NULL) {
4326 ret = -ENOMEM;
4327 goto err;
4328 }
6fa3eb70
S		 4329#ifdef BINDER_MONITOR
4330 strcpy(binder_context_mgr_node->name, "servicemanager");
4331 pr_debug("%d:%d set as servicemanager uid %d\n",
4332 proc->pid, thread->pid, binder_context_mgr_uid);
4333#endif
355b0502
GKH		 4334 binder_context_mgr_node->local_weak_refs++;
4335 binder_context_mgr_node->local_strong_refs++;
4336 binder_context_mgr_node->has_strong_ref = 1;
4337 binder_context_mgr_node->has_weak_ref = 1;
4338 break;
4339 case BINDER_THREAD_EXIT:
56b468fc 4340 binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n",
355b0502
GKH		 4341 proc->pid, thread->pid);
4342 binder_free_thread(proc, thread);
4343 thread = NULL;
4344 break;
4345 case BINDER_VERSION:
4346 if (size != sizeof(struct binder_version)) {
4347 ret = -EINVAL;
4348 goto err;
4349 }
4350 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION, &((struct binder_version *)ubuf)->protocol_version)) {
4351 ret = -EINVAL;
4352 goto err;
4353 }
4354 break;
4355 default:
4356 ret = -EINVAL;
4357 goto err;
4358 }
4359 ret = 0;
4360err:
4361 if (thread)
4362 thread->looper &= ~BINDER_LOOPER_STATE_NEED_RETURN;
975a1ac9 4363 binder_unlock(__func__);
355b0502
GKH		 4364 wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
4365 if (ret && ret != -ERESTARTSYS)
56b468fc 4366 pr_info("%d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret);
975a1ac9
AH		 4367err_unlocked:
4368 trace_binder_ioctl_done(ret);
355b0502
GKH		 4369 return ret;
4370}
4371
4372static void binder_vma_open(struct vm_area_struct *vma)
4373{
4374 struct binder_proc *proc = vma->vm_private_data;
4375 binder_debug(BINDER_DEBUG_OPEN_CLOSE,
56b468fc 4376 "%d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
355b0502
GKH		 4377 proc->pid, vma->vm_start, vma->vm_end,
4378 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
4379 (unsigned long)pgprot_val(vma->vm_page_prot));
355b0502
GKH		 4380}
4381
4382static void binder_vma_close(struct vm_area_struct *vma)
4383{
4384 struct binder_proc *proc = vma->vm_private_data;
4385 binder_debug(BINDER_DEBUG_OPEN_CLOSE,
56b468fc 4386 "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
355b0502
GKH		 4387 proc->pid, vma->vm_start, vma->vm_end,
4388 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
4389 (unsigned long)pgprot_val(vma->vm_page_prot));
4390 proc->vma = NULL;
2a90957f 4391 proc->vma_vm_mm = NULL;
355b0502
GKH		 4392 binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
4393}
4394
4395static struct vm_operations_struct binder_vm_ops = {
4396 .open = binder_vma_open,
4397 .close = binder_vma_close,
4398};
4399
4400static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
4401{
4402 int ret;
4403 struct vm_struct *area;
4404 struct binder_proc *proc = filp->private_data;
4405 const char *failure_string;
4406 struct binder_buffer *buffer;
4407
a79f41ed
AV		 4408 if (proc->tsk != current)
4409 return -EINVAL;
4410
355b0502
GKH		 4411 if ((vma->vm_end - vma->vm_start) > SZ_4M)
4412 vma->vm_end = vma->vm_start + SZ_4M;
4413
4414 binder_debug(BINDER_DEBUG_OPEN_CLOSE,
4415 "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n",
4416 proc->pid, vma->vm_start, vma->vm_end,
4417 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
4418 (unsigned long)pgprot_val(vma->vm_page_prot));
4419
4420 if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) {
4421 ret = -EPERM;
4422 failure_string = "bad vm_flags";
4423 goto err_bad_arg;
4424 }
4425 vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE;
4426
bd1eff97 4427 mutex_lock(&binder_mmap_lock);
355b0502
GKH		 4428 if (proc->buffer) {
4429 ret = -EBUSY;
4430 failure_string = "already mapped";
4431 goto err_already_mapped;
4432 }
4433
4434 area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP);
4435 if (area == NULL) {
4436 ret = -ENOMEM;
4437 failure_string = "get_vm_area";
4438 goto err_get_vm_area_failed;
4439 }
4440 proc->buffer = area->addr;
4441 proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer;
bd1eff97 4442 mutex_unlock(&binder_mmap_lock);
355b0502
GKH		 4443
4444#ifdef CONFIG_CPU_CACHE_VIPT
4445 if (cache_is_vipt_aliasing()) {
4446 while (CACHE_COLOUR((vma->vm_start ^ (uint32_t)proc->buffer))) {
4b9e9796 4447 pr_info("binder_mmap: %d %lx-%lx maps %pK bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer);
355b0502
GKH		 4448 vma->vm_start += PAGE_SIZE;
4449 }
4450 }
4451#endif
4452 proc->pages = kzalloc(sizeof(proc->pages[0]) * ((vma->vm_end - vma->vm_start) / PAGE_SIZE), GFP_KERNEL);
4453 if (proc->pages == NULL) {
4454 ret = -ENOMEM;
4455 failure_string = "alloc page array";
4456 goto err_alloc_pages_failed;
4457 }
4458 proc->buffer_size = vma->vm_end - vma->vm_start;
4459
4460 vma->vm_ops = &binder_vm_ops;
4461 vma->vm_private_data = proc;
4462
4463 if (binder_update_page_range(proc, 1, proc->buffer, proc->buffer + PAGE_SIZE, vma)) {
4464 ret = -ENOMEM;
4465 failure_string = "alloc small buf";
4466 goto err_alloc_small_buf_failed;
4467 }
4468 buffer = proc->buffer;
4469 INIT_LIST_HEAD(&proc->buffers);
4470 list_add(&buffer->entry, &proc->buffers);
4471 buffer->free = 1;
4472 binder_insert_free_buffer(proc, buffer);
4473 proc->free_async_space = proc->buffer_size / 2;
4474 barrier();
a79f41ed 4475 proc->files = get_files_struct(current);
355b0502 4476 proc->vma = vma;
2a90957f 4477 proc->vma_vm_mm = vma->vm_mm;
355b0502 4478
4b9e9796 4479 /*pr_info("binder_mmap: %d %lx-%lx maps %pK\n",
355b0502
GKH		 4480 proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/
4481 return 0;
4482
4483err_alloc_small_buf_failed:
4484 kfree(proc->pages);
4485 proc->pages = NULL;
4486err_alloc_pages_failed:
bd1eff97 4487 mutex_lock(&binder_mmap_lock);
355b0502
GKH		 4488 vfree(proc->buffer);
4489 proc->buffer = NULL;
4490err_get_vm_area_failed:
4491err_already_mapped:
bd1eff97 4492 mutex_unlock(&binder_mmap_lock);
355b0502 4493err_bad_arg:
258767fe 4494 pr_err("binder_mmap: %d %lx-%lx %s failed %d\n",
355b0502
GKH		 4495 proc->pid, vma->vm_start, vma->vm_end, failure_string, ret);
4496 return ret;
4497}
4498
4499static int binder_open(struct inode *nodp, struct file *filp)
4500{
4501 struct binder_proc *proc;
4502
4503 binder_debug(BINDER_DEBUG_OPEN_CLOSE, "binder_open: %d:%d\n",
4504 current->group_leader->pid, current->pid);
4505
4506 proc = kzalloc(sizeof(*proc), GFP_KERNEL);
4507 if (proc == NULL)
4508 return -ENOMEM;
4509 get_task_struct(current);
4510 proc->tsk = current;
4511 INIT_LIST_HEAD(&proc->todo);
4512 init_waitqueue_head(&proc->wait);
4513 proc->default_priority = task_nice(current);
6fa3eb70
S		 4514#ifdef RT_PRIO_INHERIT
4515 proc->default_rt_prio = current->rt_priority;
4516 proc->default_policy = current->policy;
4517#endif
975a1ac9
AH		 4518
4519 binder_lock(__func__);
4520
355b0502
GKH		 4521 binder_stats_created(BINDER_STAT_PROC);
4522 hlist_add_head(&proc->proc_node, &binder_procs);
4523 proc->pid = current->group_leader->pid;
4524 INIT_LIST_HEAD(&proc->delivered_death);
4525 filp->private_data = proc;
975a1ac9
AH		 4526
4527 binder_unlock(__func__);
355b0502 4528
16b66554 4529 if (binder_debugfs_dir_entry_proc) {
355b0502
GKH		 4530 char strbuf[11];
4531 snprintf(strbuf, sizeof(strbuf), "%u", proc->pid);
16b66554
AH		 4532 proc->debugfs_entry = debugfs_create_file(strbuf, S_IRUGO,
4533 binder_debugfs_dir_entry_proc, proc, &binder_proc_fops);
355b0502
GKH		 4534 }
4535
4536 return 0;
4537}
4538
4539static int binder_flush(struct file *filp, fl_owner_t id)
4540{
4541 struct binder_proc *proc = filp->private_data;
4542
4543 binder_defer_work(proc, BINDER_DEFERRED_FLUSH);
4544
4545 return 0;
4546}
4547
4548static void binder_deferred_flush(struct binder_proc *proc)
4549{
4550 struct rb_node *n;
4551 int wake_count = 0;
4552 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) {
4553 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node);
4554 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN;
4555 if (thread->looper & BINDER_LOOPER_STATE_WAITING) {
4556 wake_up_interruptible(&thread->wait);
4557 wake_count++;
4558 }
4559 }
4560 wake_up_interruptible_all(&proc->wait);
4561
6fa3eb70
S		 4562#ifdef MTK_BINDER_DEBUG
4563 if (wake_count)
4564 pr_debug("binder_flush: %d woke %d threads\n", proc->pid,
4565 wake_count);
4566#else
355b0502
GKH		 4567 binder_debug(BINDER_DEBUG_OPEN_CLOSE,
4568 "binder_flush: %d woke %d threads\n", proc->pid,
4569 wake_count);
6fa3eb70 4570#endif
355b0502
GKH		 4571}
4572
4573static int binder_release(struct inode *nodp, struct file *filp)
4574{
4575 struct binder_proc *proc = filp->private_data;
16b66554 4576 debugfs_remove(proc->debugfs_entry);
355b0502
GKH		 4577 binder_defer_work(proc, BINDER_DEFERRED_RELEASE);
4578
4579 return 0;
4580}
4581
008fa749
ME		 4582static int binder_node_release(struct binder_node *node, int refs)
4583{
4584 struct binder_ref *ref;
4585 int death = 0;
6fa3eb70
S		 4586#ifdef BINDER_MONITOR
4587 int sys_reg = 0;
4588#endif
4589#if defined(MTK_DEATH_NOTIFY_MONITOR) || defined(MTK_BINDER_DEBUG)
4590 int dead_pid = node->proc ? node->proc->pid : 0;
4591 char dead_pname[TASK_COMM_LEN] = "";
4592 if(node->proc && node->proc->tsk)
4593 strcpy(dead_pname, node->proc->tsk->comm);
4594#endif
008fa749
ME		 4595
4596 list_del_init(&node->work.entry);
4597 binder_release_work(&node->async_todo);
4598
4599 if (hlist_empty(&node->refs)) {
4600 kfree(node);
4601 binder_stats_deleted(BINDER_STAT_NODE);
4602
4603 return refs;
4604 }
4605
4606 node->proc = NULL;
4607 node->local_strong_refs = 0;
4608 node->local_weak_refs = 0;
4609 hlist_add_head(&node->dead_node, &binder_dead_nodes);
4610
4611 hlist_for_each_entry(ref, &node->refs, node_entry) {
4612 refs++;
4613
4614 if (!ref->death)
b3a59abf 4615 continue;
008fa749 4616
6fa3eb70
S		 4617#ifdef MTK_DEATH_NOTIFY_MONITOR
4618 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
4619 "[DN #3]binder: %d:(%s) cookie 0x%016llx\n",
4620 dead_pid,
4621#ifdef BINDER_MONITOR
4622 node->name,
4623#else
4624 dead_pname,
4625#endif
4626 (u64)ref->death->cookie);
4627#endif
4628#ifdef BINDER_MONITOR
4629 if (!sys_reg &&
4630 ref->proc->pid == system_server_pid)
4631 sys_reg = 1;
4632#endif
008fa749
ME		 4633 death++;
4634
4635 if (list_empty(&ref->death->work.entry)) {
4636 ref->death->work.type = BINDER_WORK_DEAD_BINDER;
4637 list_add_tail(&ref->death->work.entry,
6fa3eb70 4638 &ref->proc->todo);
008fa749
ME		 4639 wake_up_interruptible(&ref->proc->wait);
4640 } else
4641 BUG();
4642 }
4643
6fa3eb70
S		 4644#if defined(BINDER_MONITOR) && defined(MTK_BINDER_DEBUG)
4645 if (sys_reg)
4646 pr_debug("%d:%s node %d:%s exits with %d:system_server DeathNotify\n",
4647 dead_pid, dead_pname,
4648 node->debug_id, node->name,
4649 system_server_pid);
4650#endif
4651
008fa749
ME		 4652 binder_debug(BINDER_DEBUG_DEAD_BINDER,
4653 "node %d now dead, refs %d, death %d\n",
4654 node->debug_id, refs, death);
4655
4656 return refs;
4657}
4658
355b0502
GKH		 4659static void binder_deferred_release(struct binder_proc *proc)
4660{
355b0502
GKH		 4661 struct binder_transaction *t;
4662 struct rb_node *n;
53413e7d
ME		 4663 int threads, nodes, incoming_refs, outgoing_refs, buffers,
4664 active_transactions, page_count;
355b0502
GKH		 4665
4666 BUG_ON(proc->vma);
4667 BUG_ON(proc->files);
4668
4669 hlist_del(&proc->proc_node);
53413e7d 4670
355b0502
GKH		 4671 if (binder_context_mgr_node && binder_context_mgr_node->proc == proc) {
4672 binder_debug(BINDER_DEBUG_DEAD_BINDER,
c07c933f
ME		 4673 "%s: %d context_mgr_node gone\n",
4674 __func__, proc->pid);
355b0502
GKH		 4675 binder_context_mgr_node = NULL;
4676 }
4677
4678 threads = 0;
4679 active_transactions = 0;
4680 while ((n = rb_first(&proc->threads))) {
53413e7d
ME		 4681 struct binder_thread *thread;
4682
4683 thread = rb_entry(n, struct binder_thread, rb_node);
355b0502
GKH		 4684 threads++;
4685 active_transactions += binder_free_thread(proc, thread);
4686 }
53413e7d 4687
355b0502
GKH		 4688 nodes = 0;
4689 incoming_refs = 0;
4690 while ((n = rb_first(&proc->nodes))) {
53413e7d 4691 struct binder_node *node;
355b0502 4692
53413e7d 4693 node = rb_entry(n, struct binder_node, rb_node);
355b0502
GKH		 4694 nodes++;
4695 rb_erase(&node->rb_node, &proc->nodes);
008fa749 4696 incoming_refs = binder_node_release(node, incoming_refs);
355b0502 4697 }
53413e7d 4698
355b0502
GKH		 4699 outgoing_refs = 0;
4700 while ((n = rb_first(&proc->refs_by_desc))) {
53413e7d
ME		 4701 struct binder_ref *ref;
4702
4703 ref = rb_entry(n, struct binder_ref, rb_node_desc);
355b0502
GKH		 4704 outgoing_refs++;
4705 binder_delete_ref(ref);
4706 }
53413e7d 4707
355b0502 4708 binder_release_work(&proc->todo);
675d66b0 4709 binder_release_work(&proc->delivered_death);
355b0502 4710
53413e7d 4711 buffers = 0;
355b0502 4712 while ((n = rb_first(&proc->allocated_buffers))) {
53413e7d
ME		 4713 struct binder_buffer *buffer;
4714
4715 buffer = rb_entry(n, struct binder_buffer, rb_node);
4716
355b0502
GKH		 4717 t = buffer->transaction;
4718 if (t) {
4719 t->buffer = NULL;
4720 buffer->transaction = NULL;
56b468fc 4721 pr_err("release proc %d, transaction %d, not freed\n",
355b0502
GKH		 4722 proc->pid, t->debug_id);
4723 /*BUG();*/
6fa3eb70
S		 4724#ifdef MTK_BINDER_DEBUG
4725 pr_err("%d: %p from %d:%d to %d:%d code %x flags %x "
4726 "pri %ld r%d "
4727#ifdef BINDER_MONITOR
4728 "start %lu.%06lu"
4729#endif
4730 ,
4731 t->debug_id, t,
4732 t->from ? t->from->proc->pid : 0,
4733 t->from ? t->from->pid : 0,
4734 t->to_proc ? t->to_proc->pid : 0,
4735 t->to_thread ? t->to_thread->pid : 0,
4736 t->code, t->flags, t->priority, t->need_reply
4737#ifdef BINDER_MONITOR
4738 , (unsigned long)t->timestamp.tv_sec,
4739 (t->timestamp.tv_nsec / NSEC_PER_USEC)
4740#endif
4741 );
4742#endif
355b0502 4743 }
53413e7d 4744
355b0502
GKH		 4745 binder_free_buf(proc, buffer);
4746 buffers++;
4747 }
4748
4749 binder_stats_deleted(BINDER_STAT_PROC);
4750
4751 page_count = 0;
4752 if (proc->pages) {
4753 int i;
53413e7d 4754
355b0502 4755 for (i = 0; i < proc->buffer_size / PAGE_SIZE; i++) {
ba97bc5b
ME		 4756 void *page_addr;
4757
4758 if (!proc->pages[i])
4759 continue;
4760
4761 page_addr = proc->buffer + i * PAGE_SIZE;
4762 binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
4b9e9796 4763 "%s: %d: page %d at %pK not freed\n",
c07c933f 4764 __func__, proc->pid, i, page_addr);
ba97bc5b
ME		 4765 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE);
4766 __free_page(proc->pages[i]);
4767 page_count++;
6fa3eb70
S		 4768#ifdef MTK_BINDER_PAGE_USED_RECORD
4769 if(binder_page_used > 0)
4770 binder_page_used--;
4771 if (proc->page_used > 0)
4772 proc->page_used--;
4773#endif
355b0502
GKH		 4774 }
4775 kfree(proc->pages);
4776 vfree(proc->buffer);
4777 }
4778
4779 put_task_struct(proc->tsk);
4780
4781 binder_debug(BINDER_DEBUG_OPEN_CLOSE,
c07c933f
ME		 4782 "%s: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d, buffers %d, pages %d\n",
4783 __func__, proc->pid, threads, nodes, incoming_refs,
4784 outgoing_refs, active_transactions, buffers, page_count);
355b0502 4785
6fa3eb70
S		 4786#ifdef BINDER_PERF_EVAL
4787 {
4788 int i;
4789 for (i = 0; i < BC_STATS_NR; i++) {
4790 if (proc->bc_stats[i] != NULL) {
4791 kfree(proc->bc_stats[i]);
4792 proc->bc_stats[i] = NULL;
4793 pr_debug("binder_release: release %d bc_stats[%d]\n", proc->pid, i);
4794 }
4795 }
4796 }
4797#endif
355b0502
GKH		 4798 kfree(proc);
4799}
4800
4801static void binder_deferred_func(struct work_struct *work)
4802{
4803 struct binder_proc *proc;
4804 struct files_struct *files;
4805
4806 int defer;
4807 do {
975a1ac9 4808 binder_lock(__func__);
355b0502
GKH		 4809 mutex_lock(&binder_deferred_lock);
4810 if (!hlist_empty(&binder_deferred_list)) {
4811 proc = hlist_entry(binder_deferred_list.first,
4812 struct binder_proc, deferred_work_node);
4813 hlist_del_init(&proc->deferred_work_node);
4814 defer = proc->deferred_work;
4815 proc->deferred_work = 0;
4816 } else {
4817 proc = NULL;
4818 defer = 0;
4819 }
4820 mutex_unlock(&binder_deferred_lock);
4821
4822 files = NULL;
4823 if (defer & BINDER_DEFERRED_PUT_FILES) {
4824 files = proc->files;
4825 if (files)
4826 proc->files = NULL;
4827 }
4828
4829 if (defer & BINDER_DEFERRED_FLUSH)
4830 binder_deferred_flush(proc);
4831
4832 if (defer & BINDER_DEFERRED_RELEASE)
4833 binder_deferred_release(proc); /* frees proc */
4834
975a1ac9 4835 binder_unlock(__func__);
355b0502
GKH		 4836 if (files)
4837 put_files_struct(files);
4838 } while (proc);
4839}
6fa3eb70 4840
355b0502
GKH		 4841static DECLARE_WORK(binder_deferred_work, binder_deferred_func);
4842
4843static void
4844binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer)
4845{
4846 mutex_lock(&binder_deferred_lock);
4847 proc->deferred_work |= defer;
4848 if (hlist_unhashed(&proc->deferred_work_node)) {
4849 hlist_add_head(&proc->deferred_work_node,
4850 &binder_deferred_list);
3c762a49 4851 queue_work(binder_deferred_workqueue, &binder_deferred_work);
355b0502
GKH		 4852 }
4853 mutex_unlock(&binder_deferred_lock);
4854}
4855
5249f488
AH		 4856static void print_binder_transaction(struct seq_file *m, const char *prefix,
4857 struct binder_transaction *t)
4858{
6fa3eb70
S		 4859#ifdef BINDER_MONITOR
4860 struct rtc_time tm;
4861 rtc_time_to_tm(t->tv.tv_sec, &tm);
4862#endif
5249f488 4863 seq_printf(m,
4b9e9796 4864 "%s %d: %pK from %d:%d to %d:%d code %x flags %x pri %ld r%d",
5249f488
AH		 4865 prefix, t->debug_id, t,
4866 t->from ? t->from->proc->pid : 0,
4867 t->from ? t->from->pid : 0,
4868 t->to_proc ? t->to_proc->pid : 0,
4869 t->to_thread ? t->to_thread->pid : 0,
4870 t->code, t->flags, t->priority, t->need_reply);
355b0502 4871 if (t->buffer == NULL) {
6fa3eb70
S		 4872#ifdef BINDER_MONITOR
4873 seq_printf(m, " start %lu.%06lu android %d-%02d-%02d %02d:%02d:%02d.%03lu"
4874 " buffer free\n",
4875 (unsigned long)t->timestamp.tv_sec,
4876 (t->timestamp.tv_nsec / NSEC_PER_USEC),
4877 (tm.tm_year + 1900), (tm.tm_mon + 1), tm.tm_mday,
4878 tm.tm_hour, tm.tm_min, tm.tm_sec,
4879 (unsigned long)(t->tv.tv_usec / USEC_PER_MSEC));
4880#else
5249f488 4881 seq_puts(m, " buffer free\n");
6fa3eb70 4882#endif
5249f488 4883 return;
355b0502 4884 }
5249f488
AH		 4885 if (t->buffer->target_node)
4886 seq_printf(m, " node %d",
4887 t->buffer->target_node->debug_id);
6fa3eb70 4888#ifdef BINDER_MONITOR
4b9e9796 4889 seq_printf(m, " size %zd:%zd data %pK auf %d start %lu.%06lu"
6fa3eb70
S		 4890 " android %d-%02d-%02d %02d:%02d:%02d.%03lu\n",
4891 t->buffer->data_size, t->buffer->offsets_size,
4892 t->buffer->data, t->buffer->allow_user_free,
4893 (unsigned long)t->timestamp.tv_sec,
4894 (t->timestamp.tv_nsec / NSEC_PER_USEC),
4895 (tm.tm_year + 1900), (tm.tm_mon + 1), tm.tm_mday,
4896 tm.tm_hour, tm.tm_min, tm.tm_sec,
4897 (unsigned long)(t->tv.tv_usec / USEC_PER_MSEC));
4898#else
5249f488
AH		 4899 seq_printf(m, " size %zd:%zd data %p\n",
4900 t->buffer->data_size, t->buffer->offsets_size,
4901 t->buffer->data);
6fa3eb70 4902#endif
355b0502
GKH		 4903}
4904
5249f488
AH		 4905static void print_binder_buffer(struct seq_file *m, const char *prefix,
4906 struct binder_buffer *buffer)
355b0502 4907{
4b9e9796 4908 seq_printf(m, "%s %d: %pK size %zd:%zd %s\n",
5249f488
AH		 4909 prefix, buffer->debug_id, buffer->data,
4910 buffer->data_size, buffer->offsets_size,
4911 buffer->transaction ? "active" : "delivered");
355b0502
GKH		 4912}
4913
5249f488
AH		 4914static void print_binder_work(struct seq_file *m, const char *prefix,
4915 const char *transaction_prefix,
4916 struct binder_work *w)
355b0502
GKH		 4917{
4918 struct binder_node *node;
4919 struct binder_transaction *t;
4920
4921 switch (w->type) {
4922 case BINDER_WORK_TRANSACTION:
4923 t = container_of(w, struct binder_transaction, work);
5249f488 4924 print_binder_transaction(m, transaction_prefix, t);
355b0502
GKH		 4925 break;
4926 case BINDER_WORK_TRANSACTION_COMPLETE:
5249f488 4927 seq_printf(m, "%stransaction complete\n", prefix);
355b0502
GKH		 4928 break;
4929 case BINDER_WORK_NODE:
4930 node = container_of(w, struct binder_node, work);
6fa3eb70
S		 4931 seq_printf(m, "%snode work %d: u%016llx c%016llx\n",
4932 prefix, node->debug_id,
4933 (u64)node->ptr, (u64)node->cookie);
355b0502
GKH		 4934 break;
4935 case BINDER_WORK_DEAD_BINDER:
5249f488 4936 seq_printf(m, "%shas dead binder\n", prefix);
355b0502
GKH		 4937 break;
4938 case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
5249f488 4939 seq_printf(m, "%shas cleared dead binder\n", prefix);
355b0502
GKH		 4940 break;
4941 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION:
5249f488 4942 seq_printf(m, "%shas cleared death notification\n", prefix);
355b0502
GKH		 4943 break;
4944 default:
5249f488 4945 seq_printf(m, "%sunknown work: type %d\n", prefix, w->type);
355b0502
GKH		 4946 break;
4947 }
355b0502
GKH		 4948}
4949
5249f488
AH		 4950static void print_binder_thread(struct seq_file *m,
4951 struct binder_thread *thread,
4952 int print_always)
355b0502
GKH		 4953{
4954 struct binder_transaction *t;
4955 struct binder_work *w;
5249f488
AH		 4956 size_t start_pos = m->count;
4957 size_t header_pos;
355b0502 4958
5249f488
AH		 4959 seq_printf(m, " thread %d: l %02x\n", thread->pid, thread->looper);
4960 header_pos = m->count;
355b0502
GKH		 4961 t = thread->transaction_stack;
4962 while (t) {
355b0502 4963 if (t->from == thread) {
5249f488
AH		 4964 print_binder_transaction(m,
4965 " outgoing transaction", t);
355b0502
GKH		 4966 t = t->from_parent;
4967 } else if (t->to_thread == thread) {
5249f488
AH		 4968 print_binder_transaction(m,
4969 " incoming transaction", t);
355b0502
GKH		 4970 t = t->to_parent;
4971 } else {
5249f488 4972 print_binder_transaction(m, " bad transaction", t);
355b0502
GKH		 4973 t = NULL;
4974 }
4975 }
4976 list_for_each_entry(w, &thread->todo, entry) {
5249f488 4977 print_binder_work(m, " ", " pending transaction", w);
355b0502 4978 }
5249f488
AH		 4979 if (!print_always && m->count == header_pos)
4980 m->count = start_pos;
355b0502
GKH		 4981}
4982
5249f488 4983static void print_binder_node(struct seq_file *m, struct binder_node *node)
355b0502
GKH		 4984{
4985 struct binder_ref *ref;
355b0502
GKH		 4986 struct binder_work *w;
4987 int count;
4988
4989 count = 0;
b67bfe0d 4990 hlist_for_each_entry(ref, &node->refs, node_entry)
355b0502
GKH		 4991 count++;
4992
6fa3eb70
S		 4993#ifdef BINDER_MONITOR
4994 seq_printf(m, " node %d (%s): u%016llx c%016llx hs %d hw %d ls %d lw %d is %d iw %d",
4995 node->debug_id, node->name, (u64)node->ptr, (u64)node->cookie,
4996 node->has_strong_ref, node->has_weak_ref,
4997 node->local_strong_refs, node->local_weak_refs,
4998 node->internal_strong_refs, count);
4999#else
5000 seq_printf(m, " node %d: u%016llx c%016llx hs %d hw %d ls %d lw %d is %d iw %d",
5001 node->debug_id, (u64)node->ptr, (u64)node->cookie,
5249f488
AH		 5002 node->has_strong_ref, node->has_weak_ref,
5003 node->local_strong_refs, node->local_weak_refs,
5004 node->internal_strong_refs, count);
6fa3eb70 5005#endif
355b0502 5006 if (count) {
5249f488 5007 seq_puts(m, " proc");
b67bfe0d 5008 hlist_for_each_entry(ref, &node->refs, node_entry)
5249f488 5009 seq_printf(m, " %d", ref->proc->pid);
355b0502 5010 }
5249f488 5011 seq_puts(m, "\n");
6fa3eb70
S		 5012#ifdef MTK_BINDER_DEBUG
5013 if (node->async_pid)
5014 seq_printf(m, " pending async transaction on %d:\n", node->async_pid);
5015#endif
5249f488
AH		 5016 list_for_each_entry(w, &node->async_todo, entry)
5017 print_binder_work(m, " ",
5018 " pending async transaction", w);
355b0502
GKH		 5019}
5020
5249f488 5021static void print_binder_ref(struct seq_file *m, struct binder_ref *ref)
355b0502 5022{
4b9e9796 5023 seq_printf(m, " ref %d: desc %d %snode %d s %d w %d d %pK\n",
5249f488
AH		 5024 ref->debug_id, ref->desc, ref->node->proc ? "" : "dead ",
5025 ref->node->debug_id, ref->strong, ref->weak, ref->death);
355b0502
GKH		 5026}
5027
5249f488
AH		 5028static void print_binder_proc(struct seq_file *m,
5029 struct binder_proc *proc, int print_all)
355b0502
GKH		 5030{
5031 struct binder_work *w;
5032 struct rb_node *n;
5249f488
AH		 5033 size_t start_pos = m->count;
5034 size_t header_pos;
5035
5036 seq_printf(m, "proc %d\n", proc->pid);
5037 header_pos = m->count;
5038
5039 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n))
5040 print_binder_thread(m, rb_entry(n, struct binder_thread,
5041 rb_node), print_all);
5042 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) {
355b0502
GKH		 5043 struct binder_node *node = rb_entry(n, struct binder_node,
5044 rb_node);
5045 if (print_all || node->has_async_transaction)
5249f488 5046 print_binder_node(m, node);
355b0502
GKH		 5047 }
5048 if (print_all) {
5049 for (n = rb_first(&proc->refs_by_desc);
5249f488 5050 n != NULL;
355b0502 5051 n = rb_next(n))
5249f488
AH		 5052 print_binder_ref(m, rb_entry(n, struct binder_ref,
5053 rb_node_desc));
355b0502 5054 }
5249f488
AH		 5055 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n))
5056 print_binder_buffer(m, " buffer",
5057 rb_entry(n, struct binder_buffer, rb_node));
5058 list_for_each_entry(w, &proc->todo, entry)
5059 print_binder_work(m, " ", " pending transaction", w);
355b0502 5060 list_for_each_entry(w, &proc->delivered_death, entry) {
5249f488 5061 seq_puts(m, " has delivered dead binder\n");
355b0502
GKH		 5062 break;
5063 }
5249f488
AH		 5064 if (!print_all && m->count == header_pos)
5065 m->count = start_pos;
355b0502
GKH		 5066}
5067
167bccbd 5068static const char * const binder_return_strings[] = {
355b0502
GKH		 5069 "BR_ERROR",
5070 "BR_OK",
5071 "BR_TRANSACTION",
5072 "BR_REPLY",
5073 "BR_ACQUIRE_RESULT",
5074 "BR_DEAD_REPLY",
5075 "BR_TRANSACTION_COMPLETE",
5076 "BR_INCREFS",
5077 "BR_ACQUIRE",
5078 "BR_RELEASE",
5079 "BR_DECREFS",
5080 "BR_ATTEMPT_ACQUIRE",
5081 "BR_NOOP",
5082 "BR_SPAWN_LOOPER",
5083 "BR_FINISHED",
5084 "BR_DEAD_BINDER",
5085 "BR_CLEAR_DEATH_NOTIFICATION_DONE",
5086 "BR_FAILED_REPLY"
5087};
5088
167bccbd 5089static const char * const binder_command_strings[] = {
355b0502
GKH		 5090 "BC_TRANSACTION",
5091 "BC_REPLY",
5092 "BC_ACQUIRE_RESULT",
5093 "BC_FREE_BUFFER",
5094 "BC_INCREFS",
5095 "BC_ACQUIRE",
5096 "BC_RELEASE",
5097 "BC_DECREFS",
5098 "BC_INCREFS_DONE",
5099 "BC_ACQUIRE_DONE",
5100 "BC_ATTEMPT_ACQUIRE",
5101 "BC_REGISTER_LOOPER",
5102 "BC_ENTER_LOOPER",
5103 "BC_EXIT_LOOPER",
5104 "BC_REQUEST_DEATH_NOTIFICATION",
5105 "BC_CLEAR_DEATH_NOTIFICATION",
5106 "BC_DEAD_BINDER_DONE"
5107};
5108
167bccbd 5109static const char * const binder_objstat_strings[] = {
355b0502
GKH		 5110 "proc",
5111 "thread",
5112 "node",
5113 "ref",
5114 "death",
5115 "transaction",
5116 "transaction_complete"
5117};
5118
5249f488
AH		 5119static void print_binder_stats(struct seq_file *m, const char *prefix,
5120 struct binder_stats *stats)
355b0502
GKH		 5121{
5122 int i;
5123
5124 BUILD_BUG_ON(ARRAY_SIZE(stats->bc) !=
5249f488 5125 ARRAY_SIZE(binder_command_strings));
355b0502
GKH		 5126 for (i = 0; i < ARRAY_SIZE(stats->bc); i++) {
5127 if (stats->bc[i])
5249f488
AH		 5128 seq_printf(m, "%s%s: %d\n", prefix,
5129 binder_command_strings[i], stats->bc[i]);
355b0502
GKH		 5130 }
5131
5132 BUILD_BUG_ON(ARRAY_SIZE(stats->br) !=
5249f488 5133 ARRAY_SIZE(binder_return_strings));
355b0502
GKH		 5134 for (i = 0; i < ARRAY_SIZE(stats->br); i++) {
5135 if (stats->br[i])
5249f488
AH		 5136 seq_printf(m, "%s%s: %d\n", prefix,
5137 binder_return_strings[i], stats->br[i]);
355b0502
GKH		 5138 }
5139
5140 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) !=
5249f488 5141 ARRAY_SIZE(binder_objstat_strings));
355b0502 5142 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) !=
5249f488 5143 ARRAY_SIZE(stats->obj_deleted));
355b0502
GKH		 5144 for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) {
5145 if (stats->obj_created[i] || stats->obj_deleted[i])
5249f488
AH		 5146 seq_printf(m, "%s%s: active %d total %d\n", prefix,
5147 binder_objstat_strings[i],
5148 stats->obj_created[i] - stats->obj_deleted[i],
5149 stats->obj_created[i]);
355b0502 5150 }
355b0502
GKH		 5151}
5152
6fa3eb70
S		 5153#ifdef BINDER_PERF_EVAL
5154static void print_binder_timeout_stats(struct seq_file *m, const char *prefix,
5155 struct binder_timeout_stats *to_stats)
5156{
5157 int i, j;
5158
5159 BUILD_BUG_ON(ARRAY_SIZE(to_stats->bto) !=
5160 (ARRAY_SIZE(binder_wait_on_str) - 1));
5161 for (i = 0; i < ARRAY_SIZE(to_stats->bto); i++)
5162 {
5163 if (to_stats->bto[i])
5164 seq_printf(m, "%s%s: %lu\n", prefix,
5165 binder_wait_on_str[i + 1], to_stats->bto[i]);
5166 }
5167 for (i = 0, j = 0; i < ARRAY_SIZE(to_stats->read_t); i++)
5168 {
5169 struct timespec sub_t = to_stats->read_t[i];
5170 if (sub_t.tv_sec)
5171 {
5172 j++;
5173 if (!i)
5174 seq_printf(m, "%s%s: timeout total time list:\n",
5175 prefix, binder_wait_on_str[WAIT_ON_READ]);
5176
5177 seq_printf(m, " %s%u.%03ld", prefix,
5178 (unsigned)sub_t.tv_sec, (sub_t.tv_nsec / NSEC_PER_MSEC));
5179 }
5180 }
5181 if (j)
5182 seq_printf(m, "\n");
5183 for (i = 0, j = 0; i < ARRAY_SIZE(to_stats->exec_t); i++)
5184 {
5185 struct timespec sub_t = to_stats->exec_t[i];
5186 if (sub_t.tv_sec)
5187 {
5188 j++;
5189 if (!i)
5190 seq_printf(m, "%s%s: timeout total time list:\n",
5191 prefix, binder_wait_on_str[WAIT_ON_EXEC]);
5192
5193 seq_printf(m, " %s%u.%03ld", prefix,
5194 (unsigned)sub_t.tv_sec, (sub_t.tv_nsec / NSEC_PER_MSEC));
5195 }
5196 }
5197 if (j)
5198 seq_printf(m, "\n");
5199 for (i = 0, j = 0; i < ARRAY_SIZE(to_stats->rrply_t); i++)
5200 {
5201 struct timespec sub_t = to_stats->rrply_t[i];
5202 if (sub_t.tv_sec)
5203 {
5204 j++;
5205 if (!i)
5206 seq_printf(m, "%s%s: timeout total time list:\n",
5207 prefix, binder_wait_on_str[WAIT_ON_REPLY_READ]);
5208
5209 seq_printf(m, " %s%u.%03ld", prefix,
5210 (unsigned)sub_t.tv_sec, (sub_t.tv_nsec / NSEC_PER_MSEC));
5211 }
5212 }
5213 if (j)
5214 seq_printf(m, "\n");
5215}
5216
5217static void print_binder_proc_perf_timeout_stats(struct seq_file *m,
5218 struct binder_proc *proc)
5219{
5220 struct rb_node *n;
5221 int i;
5222
5223 int proc_to_counter = 0;
5224 for (i = 0; i < ARRAY_SIZE(proc->to_stats.bto); i++)
5225 {
5226 proc_to_counter += proc->to_stats.bto[i];
5227 if (proc_to_counter > 0)
5228 break;
5229 }
5230 if (proc_to_counter > 0)
5231 {
5232 seq_printf(m, "proc %d(%s) timeout stats:\n",
5233 proc->pid, (proc->tsk != NULL) ? proc->tsk->comm : "");
5234 print_binder_timeout_stats(m, " ", &proc->to_stats);
5235
5236 seq_printf(m, " threads timeout stats:\n");
5237 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n))
5238 {
5239 int thread_to_counter = 0;
5240 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node);
5241 for (i = 0; i < ARRAY_SIZE(thread->to_stats.bto); i++)
5242 {
5243 thread_to_counter += thread->to_stats.bto[i];
5244 if (thread_to_counter > 0)
5245 break;
5246 }
5247 if (thread_to_counter > 0)
5248 {
5249 seq_printf(m, " thread: %d\n", thread->pid);
5250 print_binder_timeout_stats(m, " ", &thread->to_stats);
5251 }
5252 }
5253 }
5254
5255}
5256
5257#endif
5258
5249f488
AH		 5259static void print_binder_proc_stats(struct seq_file *m,
5260 struct binder_proc *proc)
355b0502
GKH		 5261{
5262 struct binder_work *w;
5263 struct rb_node *n;
5264 int count, strong, weak;
5265
5249f488 5266 seq_printf(m, "proc %d\n", proc->pid);
355b0502
GKH		 5267 count = 0;
5268 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n))
5269 count++;
5249f488
AH		 5270 seq_printf(m, " threads: %d\n", count);
5271 seq_printf(m, " requested threads: %d+%d/%d\n"
355b0502
GKH		 5272 " ready threads %d\n"
5273 " free async space %zd\n", proc->requested_threads,
5274 proc->requested_threads_started, proc->max_threads,
5275 proc->ready_threads, proc->free_async_space);
355b0502
GKH		 5276 count = 0;
5277 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n))
5278 count++;
5249f488 5279 seq_printf(m, " nodes: %d\n", count);
355b0502
GKH		 5280 count = 0;
5281 strong = 0;
5282 weak = 0;
5283 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) {
5284 struct binder_ref *ref = rb_entry(n, struct binder_ref,
5285 rb_node_desc);
5286 count++;
5287 strong += ref->strong;
5288 weak += ref->weak;
5289 }
5249f488 5290 seq_printf(m, " refs: %d s %d w %d\n", count, strong, weak);
355b0502
GKH		 5291
5292 count = 0;
5293 for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n))
5294 count++;
5249f488 5295 seq_printf(m, " buffers: %d\n", count);
355b0502
GKH		 5296
5297 count = 0;
5298 list_for_each_entry(w, &proc->todo, entry) {
5299 switch (w->type) {
5300 case BINDER_WORK_TRANSACTION:
5301 count++;
5302 break;
5303 default:
5304 break;
5305 }
5306 }
5249f488 5307 seq_printf(m, " pending transactions: %d\n", count);
355b0502 5308
5249f488 5309 print_binder_stats(m, " ", &proc->stats);
355b0502
GKH		 5310}
5311
5312
5249f488 5313static int binder_state_show(struct seq_file *m, void *unused)
355b0502
GKH		 5314{
5315 struct binder_proc *proc;
355b0502 5316 struct binder_node *node;
355b0502
GKH		 5317 int do_lock = !binder_debug_no_lock;
5318
355b0502 5319 if (do_lock)
975a1ac9 5320 binder_lock(__func__);
355b0502 5321
5249f488 5322 seq_puts(m, "binder state:\n");
355b0502
GKH		 5323
5324 if (!hlist_empty(&binder_dead_nodes))
5249f488 5325 seq_puts(m, "dead nodes:\n");
b67bfe0d 5326 hlist_for_each_entry(node, &binder_dead_nodes, dead_node)
5249f488 5327 print_binder_node(m, node);
355b0502 5328
b67bfe0d 5329 hlist_for_each_entry(proc, &binder_procs, proc_node)
5249f488 5330 print_binder_proc(m, proc, 1);
355b0502 5331 if (do_lock)
975a1ac9 5332 binder_unlock(__func__);
5249f488 5333 return 0;
355b0502
GKH		 5334}
5335
5249f488 5336static int binder_stats_show(struct seq_file *m, void *unused)
355b0502
GKH		 5337{
5338 struct binder_proc *proc;
355b0502
GKH		 5339 int do_lock = !binder_debug_no_lock;
5340
355b0502 5341 if (do_lock)
975a1ac9 5342 binder_lock(__func__);
355b0502 5343
5249f488 5344 seq_puts(m, "binder stats:\n");
355b0502 5345
5249f488 5346 print_binder_stats(m, "", &binder_stats);
355b0502 5347
b67bfe0d 5348 hlist_for_each_entry(proc, &binder_procs, proc_node)
5249f488 5349 print_binder_proc_stats(m, proc);
355b0502 5350 if (do_lock)
975a1ac9 5351 binder_unlock(__func__);
5249f488 5352 return 0;
355b0502
GKH		 5353}
5354
6fa3eb70
S		 5355#ifdef BINDER_PERF_EVAL
5356static int binder_perf_stats_show(struct seq_file *m, void *unused)
5357{
5358 struct binder_proc *proc;
5359 int do_lock = !binder_debug_no_lock;
5360
5361 if (do_lock)
5362 binder_lock(__func__);
5363
5364 seq_puts(m, "binder stats:\n");
5365 //print_binder_stats(m, "", &binder_stats);
5366
5367 if (binder_perf_evalue & BINDER_PERF_SEND_COUNTER)
5368 {
5369 seq_puts(m, "binder send transaction stats:\n");
5370 hlist_for_each_entry(proc, &binder_procs, proc_node)
5371 {
5372 if (proc->bc_t)
5373 {
5374 int i, j;
5375 seq_printf(m, "proc %d(%s): %d\n", proc->pid,
5376 proc->tsk ? proc->tsk->comm : "",
5377 proc->bc_t);
5378 for (i = 0; i < BC_STATS_NR; i++)
5379 {
5380 if (proc->bc_stats[i] == NULL)
5381 break;
5382 if (!strcmp(proc->bc_stats[i]->service, "") &&
5383 (0 == proc->bc_stats[i]->code[0]))
5384 break;
5385 seq_printf(m, " service %s\n", proc->bc_stats[i]->service);
5386 for (j = 0; j < BC_CODE_NR; j++)
5387 {
5388 if (0 == proc->bc_stats[i]->code_num[j])
5389 break;
5390 seq_printf(m, " dex %u: %u\n", proc->bc_stats[i]->code[j], proc->bc_stats[i]->code_num[j]);
5391 }
5392 }
5393
5394 }
5395 }
5396
5397 }
5398
5399 if (binder_perf_evalue & BINDER_PERF_TIMEOUT_COUNTER)
5400 {
5401 seq_puts(m, "binder transaction time out stats:\n");
5402 hlist_for_each_entry(proc, &binder_procs, proc_node)
5403 print_binder_proc_perf_timeout_stats(m,proc);
5404 }
5405 if (do_lock)
5406 binder_unlock(__func__);
5407 return 0;
5408}
5409#endif
5249f488 5410static int binder_transactions_show(struct seq_file *m, void *unused)
355b0502
GKH		 5411{
5412 struct binder_proc *proc;
355b0502
GKH		 5413 int do_lock = !binder_debug_no_lock;
5414
355b0502 5415 if (do_lock)
975a1ac9 5416 binder_lock(__func__);
355b0502 5417
5249f488 5418 seq_puts(m, "binder transactions:\n");
b67bfe0d 5419 hlist_for_each_entry(proc, &binder_procs, proc_node)
5249f488 5420 print_binder_proc(m, proc, 0);
355b0502 5421 if (do_lock)
975a1ac9 5422 binder_unlock(__func__);
5249f488 5423 return 0;
355b0502
GKH		 5424}
5425
5249f488 5426static int binder_proc_show(struct seq_file *m, void *unused)
355b0502 5427{
5249f488 5428 struct binder_proc *proc = m->private;
355b0502 5429 int do_lock = !binder_debug_no_lock;
6fa3eb70
S		 5430#ifdef MTK_BINDER_DEBUG
5431 struct binder_proc *tmp_proc;
5432 bool find = false;
5433#endif
355b0502 5434
355b0502 5435 if (do_lock)
975a1ac9 5436 binder_lock(__func__);
5249f488 5437 seq_puts(m, "binder proc state:\n");
6fa3eb70
S		 5438#ifdef MTK_BINDER_DEBUG
5439 hlist_for_each_entry(tmp_proc, &binder_procs, proc_node)
5440 {
5441 if (proc == tmp_proc)
5442 {
5443 find = true;
5444 break;
5445 }
5446 }
5447 if (find == true)
5448#endif
5449 print_binder_proc(m, proc, 1);
5450#ifdef MTK_BINDER_DEBUG
5451 else
5452 pr_debug("show proc addr 0x%p exit\n", proc);
5453#endif
355b0502 5454 if (do_lock)
975a1ac9 5455 binder_unlock(__func__);
5249f488 5456 return 0;
355b0502
GKH		 5457}
5458
5249f488 5459static void print_binder_transaction_log_entry(struct seq_file *m,
355b0502
GKH		 5460 struct binder_transaction_log_entry *e)
5461{
6fa3eb70
S		 5462#ifdef BINDER_MONITOR
5463 char tmp[30];
5464 struct rtc_time tm;
5465 struct timespec sub_read_t, sub_total_t;
5466 unsigned long read_ms =0;
5467 unsigned long total_ms = 0;
5468
5469 memset(&sub_read_t, 0, sizeof(sub_read_t));
5470 memset(&sub_total_t, 0, sizeof(sub_total_t));
5471
5472 if (e->fd != -1)
5473 sprintf(tmp, " (fd %d)", e->fd);
5474 else
5475 tmp[0] = '\0';
5476
5477 if ((e->call_type == 0) && timespec_valid_strict(&e->endstamp) &&
5478 (timespec_compare(&e->endstamp, &e->timestamp) > 0)) {
5479 sub_total_t = timespec_sub(e->endstamp, e->timestamp);
5480 total_ms = ((unsigned long)sub_total_t.tv_sec)*MSEC_PER_SEC +
5481 sub_total_t.tv_nsec / NSEC_PER_MSEC;
5482 }
5483 if ((e->call_type == 1) && timespec_valid_strict(&e->readstamp) &&
5484 (timespec_compare(&e->readstamp, &e->timestamp) > 0)) {
5485 sub_read_t = timespec_sub(e->readstamp, e->timestamp);
5486 read_ms = ((unsigned long)sub_read_t.tv_sec)*MSEC_PER_SEC +
5487 sub_read_t.tv_nsec / NSEC_PER_MSEC;
5488 }
5489
5490 rtc_time_to_tm(e->tv.tv_sec, &tm);
5491 seq_printf(m,
5492 "%d: %s from %d:%d to %d:%d node %d handle %d (%s) size %d:%d%s "
5493 "dex %u start %lu.%06lu android %d-%02d-%02d %02d:%02d:%02d.%03lu read %lu.%06lu %s %lu.%06lu total %lu.%06lums\n",
5494 e->debug_id, (e->call_type == 2) ? "reply" :
5495 ((e->call_type == 1) ? "async" : "call "),
5496 e->from_proc, e->from_thread, e->to_proc, e->to_thread,
5497 e->to_node, e->target_handle, e->service,
5498 e->data_size, e->offsets_size, tmp, e->code,
5499 (unsigned long)e->timestamp.tv_sec,
5500 (e->timestamp.tv_nsec / NSEC_PER_USEC),
5501 (tm.tm_year + 1900), (tm.tm_mon + 1), tm.tm_mday,
5502 tm.tm_hour, tm.tm_min, tm.tm_sec,
5503 (unsigned long)(e->tv.tv_usec / USEC_PER_MSEC),
5504 (unsigned long)e->readstamp.tv_sec,
5505 (e->readstamp.tv_nsec / NSEC_PER_USEC),
5506 (e->call_type == 0) ? "end" : "",
5507 (e->call_type == 0) ? ((unsigned long)e->endstamp.tv_sec) : 0,
5508 (e->call_type == 0) ? (e->endstamp.tv_nsec / NSEC_PER_USEC) : 0,
5509 (e->call_type == 0) ? total_ms : read_ms,
5510 (e->call_type == 0) ? (sub_total_t.tv_nsec % NSEC_PER_MSEC) :
5511 (sub_read_t.tv_nsec % NSEC_PER_MSEC));
5512#else
5249f488
AH		 5513 seq_printf(m,
5514 "%d: %s from %d:%d to %d:%d node %d handle %d size %d:%d\n",
5515 e->debug_id, (e->call_type == 2) ? "reply" :
5516 ((e->call_type == 1) ? "async" : "call "), e->from_proc,
5517 e->from_thread, e->to_proc, e->to_thread, e->to_node,
5518 e->target_handle, e->data_size, e->offsets_size);
6fa3eb70
S		 5519#endif
5520}
5521
5522#ifdef BINDER_MONITOR
5523static void log_resume_func(struct work_struct *w)
5524{
5525 pr_debug("transaction log is self resumed\n");
5526 log_disable = 0;
5527}
5528
5529static DECLARE_DELAYED_WORK(log_resume_work, log_resume_func);
5530
5531static int binder_transaction_log_show(struct seq_file *m, void *unused)
5532{
5533 struct binder_transaction_log *log = m->private;
5534 int i;
5535
5536 if (!log->entry)
5537 return 0;
5538
5539 if (log->full) {
5540 for (i = log->next; i < log->size; i++)
5541 print_binder_transaction_log_entry(m, &log->entry[i]);
5542 }
5543 for (i = 0; i < log->next; i++)
5544 print_binder_transaction_log_entry(m, &log->entry[i]);
5545
5546 if (log_disable & BINDER_LOG_RESUME) {
5547 pr_debug("%d (%s) read transaction log and "
5548 "resume\n",
5549 task_pid_nr(current), current->comm);
5550 cancel_delayed_work(&log_resume_work);
5551 log_disable = 0;
5552 }
5553 return 0;
355b0502 5554}
6fa3eb70 5555#else
355b0502 5556
5249f488 5557static int binder_transaction_log_show(struct seq_file *m, void *unused)
355b0502 5558{
5249f488 5559 struct binder_transaction_log *log = m->private;
355b0502 5560 int i;
355b0502
GKH		 5561
5562 if (log->full) {
5249f488
AH		 5563 for (i = log->next; i < ARRAY_SIZE(log->entry); i++)
5564 print_binder_transaction_log_entry(m, &log->entry[i]);
355b0502 5565 }
5249f488
AH		 5566 for (i = 0; i < log->next; i++)
5567 print_binder_transaction_log_entry(m, &log->entry[i]);
5568 return 0;
355b0502 5569}
6fa3eb70 5570#endif
355b0502
GKH		 5571
5572static const struct file_operations binder_fops = {
5573 .owner = THIS_MODULE,
5574 .poll = binder_poll,
5575 .unlocked_ioctl = binder_ioctl,
6fa3eb70 5576 .compat_ioctl = binder_ioctl,
355b0502
GKH		 5577 .mmap = binder_mmap,
5578 .open = binder_open,
5579 .flush = binder_flush,
5580 .release = binder_release,
5581};
5582
5583static struct miscdevice binder_miscdev = {
5584 .minor = MISC_DYNAMIC_MINOR,
5585 .name = "binder",
5586 .fops = &binder_fops
5587};
5588
6fa3eb70
S		 5589#ifdef BINDER_PERF_EVAL
5590static void binder_perf_timeout_zero_init(struct binder_timeout_stats *to_stats)
5591{
5592 memset(&to_stats->bto[0], 0, sizeof(to_stats->bto));
5593 memset(&to_stats->read_t[0], 0, sizeof(to_stats->read_t));
5594 memset(&to_stats->exec_t[0], 0, sizeof(to_stats->exec_t));
5595 memset(&to_stats->rrply_t[0], 0, sizeof(to_stats->rrply_t));
5596}
5597
5598
5599static void binder_perf_stats_timeout_clean(void)
5600{
5601 struct binder_proc *proc;
5602 struct rb_node *n;
5603 int do_lock = !binder_debug_no_lock;
5604
5605 if (do_lock)
5606 binder_lock(__func__);
5607 hlist_for_each_entry(proc, &binder_procs, proc_node)
5608 {
5609 binder_perf_timeout_zero_init(&proc->to_stats);
5610 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n))
5611 {
5612 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node);
5613 binder_perf_timeout_zero_init(&thread->to_stats);
5614 }
5615 }
5616 if (do_lock)
5617 binder_unlock(__func__);
5618}
5619
5620static void binder_perf_stats_bct_clean(void)
5621{
5622 struct binder_proc *proc;
5623 int do_lock = !binder_debug_no_lock;
5624
5625 if (do_lock)
5626 binder_lock(__func__);
5627 hlist_for_each_entry(proc, &binder_procs, proc_node)
5628 {
5629 int i;
5630 proc->bc_t = 0;
5631 for (i = 0; i < BC_STATS_NR; i++)
5632 {
5633 if (proc->bc_stats[i] != NULL) {
5634 kfree(proc->bc_stats[i]);
5635 proc->bc_stats[i] = NULL;
5636 }
5637 }
5638 }
5639 if (do_lock)
5640 binder_unlock(__func__);
5641}
5642
5643static int binder_perf_evalue_show(struct seq_file *m, void *unused)
5644{
5645 seq_printf(m, " Current binder performance evalue is: %u\n", binder_perf_evalue);
5646 return 0;
5647}
5648
5649static ssize_t binder_perf_evalue_write(struct file *filp, const char *ubuf,
5650 size_t cnt, loff_t *data)
5651{
5652 char buf[32];
5653 size_t copy_size = cnt;
5654 unsigned long val;
5655 int ret;
5656
5657 if (cnt >= sizeof(buf))
5658 copy_size = 32 - 1;
5659 buf[copy_size] = '\0';
5660
5661 if (copy_from_user(&buf, ubuf, copy_size))
5662 return -EFAULT;
5663
5664 printk("[Binder] Set binder perf evalue:%u -> ", binder_perf_evalue);
5665 ret = strict_strtoul(buf, 10, &val);
5666 if (ret < 0 ) {
5667 printk("Null\ninvalid string, need number foramt, err:%d \n",ret);
5668 printk("perf evalue level: 0 ---- 3 \n");
5669 printk(" Less ---- More\n");
5670 return cnt; //string to unsined long fail
5671 }
5672 printk("%lu\n", val);
5673 if (val < 4) {
5674 binder_perf_evalue = val;
5675 if (0 == (val & BINDER_PERF_SEND_COUNTER))
5676 binder_perf_stats_bct_clean();
5677 if (0 == (val & BINDER_PERF_TIMEOUT_COUNTER))
5678 binder_perf_stats_timeout_clean();
5679 } else {
5680 printk("invalid value:%lu, should be 0 ~ 3\n", val);
5681 }
5682 pr_debug("%d (%s) set performance evaluate type %s %s\n",
5683 task_pid_nr(current), current->comm,
5684 (binder_perf_evalue & BINDER_PERF_SEND_COUNTER) ? "sender counter enable" : "",
5685 (binder_perf_evalue & BINDER_PERF_TIMEOUT_COUNTER) ?
5686 "time out counter enable" : "");
5687
5688 return cnt;
5689}
5690#endif
5691#ifdef BINDER_MONITOR
5692static int binder_log_level_show(struct seq_file *m, void *unused)
5693{
5694 seq_printf(m, " Current log level: %lu\n", binder_log_level);
5695 return 0;
5696}
5697
5698static ssize_t binder_log_level_write(struct file *filp, const char *ubuf,
5699 size_t cnt, loff_t *data)
5700{
5701 char buf[32];
5702 size_t copy_size = cnt;
5703 unsigned long val;
5704 int ret;
5705
5706 if (cnt >= sizeof(buf))
5707 copy_size = 32 - 1;
5708 buf[copy_size] = '\0';
5709
5710 if (copy_from_user(&buf, ubuf, copy_size))
5711 return -EFAULT;
5712
5713 printk("[Binder] Set binder log level:%lu -> ", binder_log_level);
5714 ret = strict_strtoul(buf, 10, &val);
5715 if (ret < 0) {
5716 printk("Null\ninvalid string, need number foramt, err:%d \n",ret);
5717 printk("Log Level: 0 ---- 4 \n");
5718 printk(" Less ---- More\n");
5719 return cnt; //string to unsined long fail
5720 }
5721 printk("%lu\n", val);
5722 if (val == 0) {
5723 binder_debug_mask =
5724 BINDER_DEBUG_USER_ERROR | BINDER_DEBUG_FAILED_TRANSACTION |
5725 BINDER_DEBUG_DEAD_TRANSACTION ;
5726 binder_log_level = val;
5727 } else if (val == 1) {
5728 binder_debug_mask =
5729 BINDER_DEBUG_USER_ERROR | BINDER_DEBUG_FAILED_TRANSACTION |
5730 BINDER_DEBUG_DEAD_TRANSACTION | BINDER_DEBUG_DEAD_BINDER |
5731 BINDER_DEBUG_DEATH_NOTIFICATION ;
5732 binder_log_level = val;
5733 } else if (val == 2) {
5734 binder_debug_mask =
5735 BINDER_DEBUG_USER_ERROR | BINDER_DEBUG_FAILED_TRANSACTION |
5736 BINDER_DEBUG_DEAD_TRANSACTION | BINDER_DEBUG_DEAD_BINDER |
5737 BINDER_DEBUG_DEATH_NOTIFICATION |BINDER_DEBUG_THREADS |
5738 BINDER_DEBUG_TRANSACTION | BINDER_DEBUG_TRANSACTION_COMPLETE ;
5739 binder_log_level = val;
5740 } else if (val == 3) {
5741 binder_debug_mask =
5742 BINDER_DEBUG_USER_ERROR | BINDER_DEBUG_FAILED_TRANSACTION |
5743 BINDER_DEBUG_DEAD_TRANSACTION | BINDER_DEBUG_DEAD_BINDER |
5744 BINDER_DEBUG_DEATH_NOTIFICATION | BINDER_DEBUG_THREADS |
5745 BINDER_DEBUG_TRANSACTION | BINDER_DEBUG_TRANSACTION_COMPLETE |
5746 BINDER_DEBUG_OPEN_CLOSE | BINDER_DEBUG_READ_WRITE ;
5747 binder_log_level = val;
5748 } else if (val == 4) {
5749 binder_debug_mask =
5750 BINDER_DEBUG_USER_ERROR | BINDER_DEBUG_FAILED_TRANSACTION |
5751 BINDER_DEBUG_DEAD_TRANSACTION | BINDER_DEBUG_DEAD_BINDER |
5752 BINDER_DEBUG_DEATH_NOTIFICATION | BINDER_DEBUG_THREADS |
5753 BINDER_DEBUG_OPEN_CLOSE | BINDER_DEBUG_READ_WRITE |
5754 BINDER_DEBUG_TRANSACTION | BINDER_DEBUG_TRANSACTION_COMPLETE |
5755 BINDER_DEBUG_USER_REFS | BINDER_DEBUG_INTERNAL_REFS |
5756 BINDER_DEBUG_PRIORITY_CAP |BINDER_DEBUG_FREE_BUFFER |
5757 BINDER_DEBUG_BUFFER_ALLOC ;
5758 binder_log_level = val;
5759 } else {
5760 printk("invalid value:%lu, should be 0 ~ 4\n", val);
5761 }
5762 return cnt;
5763}
5764
5765static void print_binder_timeout_log_entry(struct seq_file *m,
5766 struct binder_timeout_log_entry *e)
5767{
5768 struct rtc_time tm;
5769
5770 rtc_time_to_tm(e->tv.tv_sec, &tm);
5771 seq_printf(m, "%d:%s %d:%d to %d:%d spends %u000 ms (%s) dex_code %u "
5772 "start_at %lu.%03ld android %d-%02d-%02d %02d:%02d:%02d.%03lu\n",
5773 e->debug_id, binder_wait_on_str[e->r],
5774 e->from_proc, e->from_thrd, e->to_proc, e->to_thrd,
5775 e->over_sec, e->service, e->code,
5776 (unsigned long)e->ts.tv_sec,
5777 (e->ts.tv_nsec / NSEC_PER_MSEC),
5778 (tm.tm_year + 1900), (tm.tm_mon + 1), tm.tm_mday,
5779 tm.tm_hour, tm.tm_min, tm.tm_sec,
5780 (unsigned long)(e->tv.tv_usec / USEC_PER_MSEC));
5781}
5782
5783static int binder_timeout_log_show(struct seq_file *m, void *unused)
5784{
5785 struct binder_timeout_log *log = m->private;
5786 int i, latest;
5787 int end_idx = ARRAY_SIZE(log->entry) - 1;
5788
5789 binder_lock(__func__);
5790
5791 latest = log->next ? (log->next - 1) : end_idx;
5792 if (log->next == 0 && !log->full)
5793 goto timeout_log_show_unlock;
5794
5795 if (latest >= ARRAY_SIZE(log->entry) || latest < 0) {
5796 int j;
5797
5798 pr_alert("timeout log index error, "
5799 "log %p latest %d next %d end_idx %d\n",
5800 log, latest, log->next, end_idx);
5801 for (j = -4; j <= 3; j++) {
5802 unsigned int *tmp = (unsigned int *)log + (j * 8);
5803 pr_alert("0x%p %08x %08x %08x %08x "
5804 "%08x %08x %08x %08x\n",
5805 tmp,
5806 *tmp, *(tmp + 1), *(tmp + 2), *(tmp + 3),
5807 *(tmp + 4), *(tmp + 5), *(tmp + 6),
5808 *(tmp + 7));
5809 }
5810 aee_kernel_warning_api(__FILE__, __LINE__, DB_OPT_SWT_JBT_TRACES|DB_OPT_BINDER_INFO, "binder: timeout log index error",
5811 "detect for memory corruption\n\n"
5812 "check kernel log for more details\n");
5813 goto timeout_log_show_unlock;
5814 }
5815
5816 for (i = latest; i >= 0; i--)
5817 print_binder_timeout_log_entry(m, &log->entry[i]);
5818 if (log->full) {
5819 for (i = end_idx; i > latest; i--)
5820 print_binder_timeout_log_entry(m, &log->entry[i]);
5821 }
5822
5823timeout_log_show_unlock:
5824 binder_unlock(__func__);
5825 return 0;
5826}
5827
5828BINDER_DEBUG_SETTING_ENTRY(log_level);
5829#ifdef BINDER_PERF_EVAL
5830BINDER_DEBUG_SETTING_ENTRY(perf_evalue);
5831#endif
5832BINDER_DEBUG_ENTRY(timeout_log);
5833#ifdef BINDER_PERF_EVAL
5834BINDER_DEBUG_ENTRY(perf_stats);
5835#endif
5836
5837static int binder_transaction_log_enable_show(struct seq_file *m, void *unused)
5838{
5839#ifdef BINDER_MONITOR
5840 seq_printf(m, " Current transaciton log is %s %s %s"
5841#ifdef RT_PRIO_INHERIT
5842 " %s"
5843#endif
5844 "\n",
5845 (log_disable & 0x1) ? "disabled" : "enabled",
5846 (log_disable & BINDER_LOG_RESUME) ? "(self resume)" : "",
5847 (log_disable & BINDER_BUF_WARN) ? "(buf warning enabled)" : ""
5848#ifdef RT_PRIO_INHERIT
5849
5850 ,(log_disable & BINDER_RT_LOG_ENABLE) ? "(rt inherit log enabled)" : ""
5851#endif
5852 );
5853#else
5854 seq_printf(m, " Current transaciton log is %s %s\n",
5855 log_disable ? "disabled" : "enabled",
5856 (log_disable & BINDER_LOG_RESUME) ? "(self resume)" : "");
5857#endif
5858 return 0;
5859}
5860
5861static ssize_t binder_transaction_log_enable_write(struct file *filp,
5862 const char *ubuf,
5863 size_t cnt, loff_t *data)
5864{
5865 char buf[32];
5866 size_t copy_size = cnt;
5867 unsigned long val;
5868 int ret;
5869
5870 if (cnt >= sizeof(buf))
5871 copy_size = 32 - 1;
5872
5873 buf[copy_size] = '\0';
5874
5875 if (copy_from_user(&buf, ubuf, copy_size))
5876 return -EFAULT;
5877
5878 ret = strict_strtoul(buf, 10, &val);
5879 if (ret < 0) {
5880 pr_info("failed to switch logging, "
5881 "need number format\n");
5882 return cnt;
5883 }
5884
5885 log_disable = !(val & 0x1);
5886 if (log_disable && (val & BINDER_LOG_RESUME)) {
5887 log_disable |= BINDER_LOG_RESUME;
5888 queue_delayed_work(binder_deferred_workqueue,
5889 &log_resume_work, (120 * HZ));
5890 }
5891#ifdef BINDER_MONITOR
5892 if (val & BINDER_BUF_WARN) {
5893 log_disable |= BINDER_BUF_WARN;
5894 }
5895#ifdef RT_PRIO_INHERIT
5896 if (val & BINDER_RT_LOG_ENABLE) {
5897 log_disable |= BINDER_RT_LOG_ENABLE;
5898 }
5899#endif
5900 pr_info("%d (%s) set transaction log %s %s %s"
5901#ifdef RT_PRIO_INHERIT
5902 " %s"
5903#endif
5904 "\n",
5905 task_pid_nr(current), current->comm,
5906 (log_disable & 0x1) ? "disabled" : "enabled",
5907 (log_disable & BINDER_LOG_RESUME) ?
5908 "(self resume)" : "",
5909 (log_disable & BINDER_BUF_WARN) ? "(buf warning)" : ""
5910#ifdef RT_PRIO_INHERIT
5911 ,(log_disable & BINDER_RT_LOG_ENABLE) ? "(rt inherit log enabled)" : ""
5912#endif
5913 );
5914#else
5915 pr_info("%d (%s) set transaction log %s %s\n",
5916 task_pid_nr(current), current->comm,
5917 log_disable ? "disabled" : "enabled",
5918 (log_disable & BINDER_LOG_RESUME) ?
5919 "(self resume)" : "");
5920#endif
5921 return cnt;
5922}
5923BINDER_DEBUG_SETTING_ENTRY(transaction_log_enable);
5924# endif
5925
5926#ifdef MTK_BINDER_PAGE_USED_RECORD
5927static int binder_page_used_show(struct seq_file *s, void *p)
5928{
5929 struct binder_proc *proc;
5930 int do_lock = !binder_debug_no_lock;
5931 seq_printf(s, "page_used:%d[%dMB]\npage_used_peak:%d[%dMB]\n",
5932 binder_page_used, binder_page_used>>8,
5933 binder_page_used_peak, binder_page_used_peak>>8);
5934
5935 if (do_lock)
5936 binder_lock(__func__);
5937 seq_puts(s, "binder page stats by binder_proc:\n");
5938 hlist_for_each_entry(proc, &binder_procs, proc_node)
5939 {
5940 seq_printf(s, " proc %d(%s):page_used:%d[%dMB] page_used_peak:%d[%dMB]\n",
5941 proc->pid, proc->tsk ? proc->tsk->comm : " ",
5942 proc->page_used, proc->page_used>>8,
5943 proc->page_used_peak, proc->page_used_peak>>8);
5944 }
5945 if (do_lock)
5946 binder_unlock(__func__);
5947
5948 return 0;
5949}
5950
5951BINDER_DEBUG_ENTRY(page_used);
5952#endif
5953
5249f488
AH		 5954BINDER_DEBUG_ENTRY(state);
5955BINDER_DEBUG_ENTRY(stats);
5956BINDER_DEBUG_ENTRY(transactions);
5957BINDER_DEBUG_ENTRY(transaction_log);
5958
355b0502
GKH		 5959static int __init binder_init(void)
5960{
5961 int ret;
6fa3eb70
S		 5962#ifdef BINDER_MONITOR
5963 struct task_struct *th;
5964
5965
5966 th = kthread_create(binder_bwdog_thread, NULL, "binder_watchdog");
5967 if (IS_ERR(th)) {
5968 pr_err("fail to create watchdog thread "
5969 "(err:%li)\n", PTR_ERR(th));
5970 } else {
5971 wake_up_process(th);
5972 }
5973
5974 binder_transaction_log_failed.entry = &entry_failed[0];
5975 binder_transaction_log_failed.size = ARRAY_SIZE(entry_failed);
5976
5977#ifdef CONFIG_MTK_EXTMEM
5978 binder_transaction_log.entry = extmem_malloc_page_align(sizeof(struct binder_transaction_log_entry)*MAX_ENG_TRANS_LOG_BUFF_LEN);
5979 binder_transaction_log.size = MAX_ENG_TRANS_LOG_BUFF_LEN;
5980
5981 if(binder_transaction_log.entry == NULL) {
5982 pr_err("%s[%s] ext emory alloc failed!!!\n", __FILE__, __FUNCTION__);
5983 binder_transaction_log.entry = vmalloc(sizeof(struct binder_transaction_log_entry)*MAX_ENG_TRANS_LOG_BUFF_LEN);
5984 }
5985#else
5986 binder_transaction_log.entry = &entry_t[0];
5987 binder_transaction_log.size = ARRAY_SIZE(entry_t);
5988#endif
5989#endif
355b0502 5990
3c762a49
AH		 5991 binder_deferred_workqueue = create_singlethread_workqueue("binder");
5992 if (!binder_deferred_workqueue)
5993 return -ENOMEM;
5994
16b66554
AH		 5995 binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL);
5996 if (binder_debugfs_dir_entry_root)
5997 binder_debugfs_dir_entry_proc = debugfs_create_dir("proc",
5998 binder_debugfs_dir_entry_root);
355b0502 5999 ret = misc_register(&binder_miscdev);
16b66554
AH		 6000 if (binder_debugfs_dir_entry_root) {
6001 debugfs_create_file("state",
6002 S_IRUGO,
6003 binder_debugfs_dir_entry_root,
6004 NULL,
6005 &binder_state_fops);
6006 debugfs_create_file("stats",
6007 S_IRUGO,
6008 binder_debugfs_dir_entry_root,
6009 NULL,
6010 &binder_stats_fops);
6011 debugfs_create_file("transactions",
6012 S_IRUGO,
6013 binder_debugfs_dir_entry_root,
6014 NULL,
6015 &binder_transactions_fops);
6016 debugfs_create_file("transaction_log",
6017 S_IRUGO,
6018 binder_debugfs_dir_entry_root,
6019 &binder_transaction_log,
6020 &binder_transaction_log_fops);
6021 debugfs_create_file("failed_transaction_log",
6022 S_IRUGO,
6023 binder_debugfs_dir_entry_root,
6024 &binder_transaction_log_failed,
6025 &binder_transaction_log_fops);
6fa3eb70
S		 6026#ifdef BINDER_MONITOR
6027 /* system_server is the main writer, remember to
6028 * change group as "system" for write permission
6029 * via related init.rc */
6030 debugfs_create_file("transaction_log_enable",
6031 (S_IRUGO | S_IWUSR | S_IWGRP),
6032 binder_debugfs_dir_entry_root,
6033 NULL,
6034 &binder_transaction_log_enable_fops);
6035 debugfs_create_file("log_level",
6036 (S_IRUGO | S_IWUSR | S_IWGRP),
6037 binder_debugfs_dir_entry_root,
6038 NULL,
6039 &binder_log_level_fops);
6040 debugfs_create_file("timeout_log",
6041 S_IRUGO,
6042 binder_debugfs_dir_entry_root,
6043 &binder_timeout_log_t,
6044 &binder_timeout_log_fops);
6045#endif
6046#ifdef BINDER_PERF_EVAL
6047 debugfs_create_file("perf_evalue",
6048 (S_IRUGO | S_IWUSR | S_IWGRP),
6049 binder_debugfs_dir_entry_root,
6050 NULL,
6051 &binder_perf_evalue_fops);
6052 debugfs_create_file("perf_stats",
6053 S_IRUGO,
6054 binder_debugfs_dir_entry_root,
6055 NULL,
6056 &binder_perf_stats_fops);
6057
6058#endif
6059#ifdef MTK_BINDER_PAGE_USED_RECORD
6060 debugfs_create_file("page_used",
6061 S_IRUGO,
6062 binder_debugfs_dir_entry_root,
6063 NULL,
6064 &binder_page_used_fops);
6065#endif
355b0502
GKH		 6066 }
6067 return ret;
6068}
6069
6070device_initcall(binder_init);
6071
975a1ac9
AH		 6072#define CREATE_TRACE_POINTS
6073#include "binder_trace.h"
6074
355b0502 6075MODULE_LICENSE("GPL v2");
kernel source for telekom puls (alcatel/mediatek)