3 * Android IPC Subsystem
5 * Copyright (C) 2007-2008 Google, Inc.
7 * This software is licensed under the terms of the GNU General Public
8 * License version 2, as published by the Free Software Foundation, and
9 * may be copied, distributed, and modified under those terms.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
20 #include <asm/cacheflush.h>
21 #include <linux/fdtable.h>
22 #include <linux/file.h>
24 #include <linux/list.h>
25 #include <linux/miscdevice.h>
27 #include <linux/module.h>
28 #include <linux/mutex.h>
29 #include <linux/nsproxy.h>
30 #include <linux/poll.h>
31 #include <linux/debugfs.h>
32 #include <linux/rbtree.h>
33 #include <linux/sched.h>
34 #include <linux/seq_file.h>
35 #include <linux/uaccess.h>
36 #include <linux/vmalloc.h>
37 #include <linux/slab.h>
38 #include <linux/pid_namespace.h>
41 #include "binder_trace.h"
43 static DEFINE_MUTEX(binder_main_lock
);
44 static DEFINE_MUTEX(binder_deferred_lock
);
45 static DEFINE_MUTEX(binder_mmap_lock
);
47 static HLIST_HEAD(binder_procs
);
48 static HLIST_HEAD(binder_deferred_list
);
49 static HLIST_HEAD(binder_dead_nodes
);
51 static struct dentry
*binder_debugfs_dir_entry_root
;
52 static struct dentry
*binder_debugfs_dir_entry_proc
;
53 static struct binder_node
*binder_context_mgr_node
;
54 static kuid_t binder_context_mgr_uid
= INVALID_UID
;
55 static int binder_last_id
;
56 static struct workqueue_struct
*binder_deferred_workqueue
;
58 #define BINDER_DEBUG_ENTRY(name) \
59 static int binder_##name##_open(struct inode *inode, struct file *file) \
61 return single_open(file, binder_##name##_show, inode->i_private); \
64 static const struct file_operations binder_##name##_fops = { \
65 .owner = THIS_MODULE, \
66 .open = binder_##name##_open, \
68 .llseek = seq_lseek, \
69 .release = single_release, \
72 static int binder_proc_show(struct seq_file
*m
, void *unused
);
73 BINDER_DEBUG_ENTRY(proc
);
75 /* This is only defined in include/asm-arm/sizes.h */
81 #define SZ_4M 0x400000
84 #define FORBIDDEN_MMAP_FLAGS (VM_WRITE)
86 #define BINDER_SMALL_BUF_SIZE (PAGE_SIZE * 64)
89 BINDER_DEBUG_USER_ERROR
= 1U << 0,
90 BINDER_DEBUG_FAILED_TRANSACTION
= 1U << 1,
91 BINDER_DEBUG_DEAD_TRANSACTION
= 1U << 2,
92 BINDER_DEBUG_OPEN_CLOSE
= 1U << 3,
93 BINDER_DEBUG_DEAD_BINDER
= 1U << 4,
94 BINDER_DEBUG_DEATH_NOTIFICATION
= 1U << 5,
95 BINDER_DEBUG_READ_WRITE
= 1U << 6,
96 BINDER_DEBUG_USER_REFS
= 1U << 7,
97 BINDER_DEBUG_THREADS
= 1U << 8,
98 BINDER_DEBUG_TRANSACTION
= 1U << 9,
99 BINDER_DEBUG_TRANSACTION_COMPLETE
= 1U << 10,
100 BINDER_DEBUG_FREE_BUFFER
= 1U << 11,
101 BINDER_DEBUG_INTERNAL_REFS
= 1U << 12,
102 BINDER_DEBUG_BUFFER_ALLOC
= 1U << 13,
103 BINDER_DEBUG_PRIORITY_CAP
= 1U << 14,
104 BINDER_DEBUG_BUFFER_ALLOC_ASYNC
= 1U << 15,
106 static uint32_t binder_debug_mask
= BINDER_DEBUG_USER_ERROR
|
107 BINDER_DEBUG_FAILED_TRANSACTION
| BINDER_DEBUG_DEAD_TRANSACTION
;
108 module_param_named(debug_mask
, binder_debug_mask
, uint
, S_IWUSR
| S_IRUGO
);
110 static bool binder_debug_no_lock
;
111 module_param_named(proc_no_lock
, binder_debug_no_lock
, bool, S_IWUSR
| S_IRUGO
);
113 static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait
);
114 static int binder_stop_on_user_error
;
116 static int binder_set_stop_on_user_error(const char *val
,
117 struct kernel_param
*kp
)
120 ret
= param_set_int(val
, kp
);
121 if (binder_stop_on_user_error
< 2)
122 wake_up(&binder_user_error_wait
);
125 module_param_call(stop_on_user_error
, binder_set_stop_on_user_error
,
126 param_get_int
, &binder_stop_on_user_error
, S_IWUSR
| S_IRUGO
);
128 #define binder_debug(mask, x...) \
130 if (binder_debug_mask & mask) \
134 #define binder_user_error(x...) \
136 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \
138 if (binder_stop_on_user_error) \
139 binder_stop_on_user_error = 2; \
142 enum binder_stat_types
{
148 BINDER_STAT_TRANSACTION
,
149 BINDER_STAT_TRANSACTION_COMPLETE
,
153 struct binder_stats
{
154 int br
[_IOC_NR(BR_FAILED_REPLY
) + 1];
155 int bc
[_IOC_NR(BC_DEAD_BINDER_DONE
) + 1];
156 int obj_created
[BINDER_STAT_COUNT
];
157 int obj_deleted
[BINDER_STAT_COUNT
];
160 static struct binder_stats binder_stats
;
162 static inline void binder_stats_deleted(enum binder_stat_types type
)
164 binder_stats
.obj_deleted
[type
]++;
167 static inline void binder_stats_created(enum binder_stat_types type
)
169 binder_stats
.obj_created
[type
]++;
172 struct binder_transaction_log_entry
{
184 struct binder_transaction_log
{
187 struct binder_transaction_log_entry entry
[32];
189 static struct binder_transaction_log binder_transaction_log
;
190 static struct binder_transaction_log binder_transaction_log_failed
;
192 static struct binder_transaction_log_entry
*binder_transaction_log_add(
193 struct binder_transaction_log
*log
)
195 struct binder_transaction_log_entry
*e
;
196 e
= &log
->entry
[log
->next
];
197 memset(e
, 0, sizeof(*e
));
199 if (log
->next
== ARRAY_SIZE(log
->entry
)) {
207 struct list_head entry
;
209 BINDER_WORK_TRANSACTION
= 1,
210 BINDER_WORK_TRANSACTION_COMPLETE
,
212 BINDER_WORK_DEAD_BINDER
,
213 BINDER_WORK_DEAD_BINDER_AND_CLEAR
,
214 BINDER_WORK_CLEAR_DEATH_NOTIFICATION
,
220 struct binder_work work
;
222 struct rb_node rb_node
;
223 struct hlist_node dead_node
;
225 struct binder_proc
*proc
;
226 struct hlist_head refs
;
227 int internal_strong_refs
;
229 int local_strong_refs
;
232 unsigned has_strong_ref
:1;
233 unsigned pending_strong_ref
:1;
234 unsigned has_weak_ref
:1;
235 unsigned pending_weak_ref
:1;
236 unsigned has_async_transaction
:1;
237 unsigned accept_fds
:1;
238 unsigned min_priority
:8;
239 struct list_head async_todo
;
242 struct binder_ref_death
{
243 struct binder_work work
;
248 /* Lookups needed: */
249 /* node + proc => ref (transaction) */
250 /* desc + proc => ref (transaction, inc/dec ref) */
251 /* node => refs + procs (proc exit) */
253 struct rb_node rb_node_desc
;
254 struct rb_node rb_node_node
;
255 struct hlist_node node_entry
;
256 struct binder_proc
*proc
;
257 struct binder_node
*node
;
261 struct binder_ref_death
*death
;
264 struct binder_buffer
{
265 struct list_head entry
; /* free and allocated entries by address */
266 struct rb_node rb_node
; /* free entry by size or allocated entry */
269 unsigned allow_user_free
:1;
270 unsigned async_transaction
:1;
271 unsigned debug_id
:29;
273 struct binder_transaction
*transaction
;
275 struct binder_node
*target_node
;
281 enum binder_deferred_state
{
282 BINDER_DEFERRED_PUT_FILES
= 0x01,
283 BINDER_DEFERRED_FLUSH
= 0x02,
284 BINDER_DEFERRED_RELEASE
= 0x04,
288 struct hlist_node proc_node
;
289 struct rb_root threads
;
290 struct rb_root nodes
;
291 struct rb_root refs_by_desc
;
292 struct rb_root refs_by_node
;
294 struct vm_area_struct
*vma
;
295 struct mm_struct
*vma_vm_mm
;
296 struct task_struct
*tsk
;
297 struct files_struct
*files
;
298 struct hlist_node deferred_work_node
;
301 ptrdiff_t user_buffer_offset
;
303 struct list_head buffers
;
304 struct rb_root free_buffers
;
305 struct rb_root allocated_buffers
;
306 size_t free_async_space
;
310 uint32_t buffer_free
;
311 struct list_head todo
;
312 wait_queue_head_t wait
;
313 struct binder_stats stats
;
314 struct list_head delivered_death
;
316 int requested_threads
;
317 int requested_threads_started
;
319 long default_priority
;
320 struct dentry
*debugfs_entry
;
324 BINDER_LOOPER_STATE_REGISTERED
= 0x01,
325 BINDER_LOOPER_STATE_ENTERED
= 0x02,
326 BINDER_LOOPER_STATE_EXITED
= 0x04,
327 BINDER_LOOPER_STATE_INVALID
= 0x08,
328 BINDER_LOOPER_STATE_WAITING
= 0x10,
329 BINDER_LOOPER_STATE_NEED_RETURN
= 0x20
332 struct binder_thread
{
333 struct binder_proc
*proc
;
334 struct rb_node rb_node
;
337 struct binder_transaction
*transaction_stack
;
338 struct list_head todo
;
339 uint32_t return_error
; /* Write failed, return error code in read buf */
340 uint32_t return_error2
; /* Write failed, return error code in read */
341 /* buffer. Used when sending a reply to a dead process that */
342 /* we are also waiting on */
343 wait_queue_head_t wait
;
344 struct binder_stats stats
;
347 struct binder_transaction
{
349 struct binder_work work
;
350 struct binder_thread
*from
;
351 struct binder_transaction
*from_parent
;
352 struct binder_proc
*to_proc
;
353 struct binder_thread
*to_thread
;
354 struct binder_transaction
*to_parent
;
355 unsigned need_reply
:1;
356 /* unsigned is_dead:1; */ /* not used at the moment */
358 struct binder_buffer
*buffer
;
367 binder_defer_work(struct binder_proc
*proc
, enum binder_deferred_state defer
);
369 static int task_get_unused_fd_flags(struct binder_proc
*proc
, int flags
)
371 struct files_struct
*files
= proc
->files
;
372 unsigned long rlim_cur
;
378 if (!lock_task_sighand(proc
->tsk
, &irqs
))
381 rlim_cur
= task_rlimit(proc
->tsk
, RLIMIT_NOFILE
);
382 unlock_task_sighand(proc
->tsk
, &irqs
);
384 return __alloc_fd(files
, 0, rlim_cur
, flags
);
388 * copied from fd_install
390 static void task_fd_install(
391 struct binder_proc
*proc
, unsigned int fd
, struct file
*file
)
394 __fd_install(proc
->files
, fd
, file
);
398 * copied from sys_close
400 static long task_close_fd(struct binder_proc
*proc
, unsigned int fd
)
404 if (proc
->files
== NULL
)
407 retval
= __close_fd(proc
->files
, fd
);
408 /* can't restart close syscall because file table entry was cleared */
409 if (unlikely(retval
== -ERESTARTSYS
||
410 retval
== -ERESTARTNOINTR
||
411 retval
== -ERESTARTNOHAND
||
412 retval
== -ERESTART_RESTARTBLOCK
))
418 static inline void binder_lock(const char *tag
)
420 trace_binder_lock(tag
);
421 mutex_lock(&binder_main_lock
);
422 trace_binder_locked(tag
);
425 static inline void binder_unlock(const char *tag
)
427 trace_binder_unlock(tag
);
428 mutex_unlock(&binder_main_lock
);
431 static void binder_set_nice(long nice
)
434 if (can_nice(current
, nice
)) {
435 set_user_nice(current
, nice
);
438 min_nice
= 20 - current
->signal
->rlim
[RLIMIT_NICE
].rlim_cur
;
439 binder_debug(BINDER_DEBUG_PRIORITY_CAP
,
440 "%d: nice value %ld not allowed use %ld instead\n",
441 current
->pid
, nice
, min_nice
);
442 set_user_nice(current
, min_nice
);
445 binder_user_error("%d RLIMIT_NICE not set\n", current
->pid
);
448 static size_t binder_buffer_size(struct binder_proc
*proc
,
449 struct binder_buffer
*buffer
)
451 if (list_is_last(&buffer
->entry
, &proc
->buffers
))
452 return proc
->buffer
+ proc
->buffer_size
- (void *)buffer
->data
;
454 return (size_t)list_entry(buffer
->entry
.next
,
455 struct binder_buffer
, entry
) - (size_t)buffer
->data
;
458 static void binder_insert_free_buffer(struct binder_proc
*proc
,
459 struct binder_buffer
*new_buffer
)
461 struct rb_node
**p
= &proc
->free_buffers
.rb_node
;
462 struct rb_node
*parent
= NULL
;
463 struct binder_buffer
*buffer
;
465 size_t new_buffer_size
;
467 BUG_ON(!new_buffer
->free
);
469 new_buffer_size
= binder_buffer_size(proc
, new_buffer
);
471 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
472 "%d: add free buffer, size %zd, at %p\n",
473 proc
->pid
, new_buffer_size
, new_buffer
);
477 buffer
= rb_entry(parent
, struct binder_buffer
, rb_node
);
478 BUG_ON(!buffer
->free
);
480 buffer_size
= binder_buffer_size(proc
, buffer
);
482 if (new_buffer_size
< buffer_size
)
483 p
= &parent
->rb_left
;
485 p
= &parent
->rb_right
;
487 rb_link_node(&new_buffer
->rb_node
, parent
, p
);
488 rb_insert_color(&new_buffer
->rb_node
, &proc
->free_buffers
);
491 static void binder_insert_allocated_buffer(struct binder_proc
*proc
,
492 struct binder_buffer
*new_buffer
)
494 struct rb_node
**p
= &proc
->allocated_buffers
.rb_node
;
495 struct rb_node
*parent
= NULL
;
496 struct binder_buffer
*buffer
;
498 BUG_ON(new_buffer
->free
);
502 buffer
= rb_entry(parent
, struct binder_buffer
, rb_node
);
503 BUG_ON(buffer
->free
);
505 if (new_buffer
< buffer
)
506 p
= &parent
->rb_left
;
507 else if (new_buffer
> buffer
)
508 p
= &parent
->rb_right
;
512 rb_link_node(&new_buffer
->rb_node
, parent
, p
);
513 rb_insert_color(&new_buffer
->rb_node
, &proc
->allocated_buffers
);
516 static struct binder_buffer
*binder_buffer_lookup(struct binder_proc
*proc
,
517 void __user
*user_ptr
)
519 struct rb_node
*n
= proc
->allocated_buffers
.rb_node
;
520 struct binder_buffer
*buffer
;
521 struct binder_buffer
*kern_ptr
;
523 kern_ptr
= user_ptr
- proc
->user_buffer_offset
524 - offsetof(struct binder_buffer
, data
);
527 buffer
= rb_entry(n
, struct binder_buffer
, rb_node
);
528 BUG_ON(buffer
->free
);
530 if (kern_ptr
< buffer
)
532 else if (kern_ptr
> buffer
)
540 static int binder_update_page_range(struct binder_proc
*proc
, int allocate
,
541 void *start
, void *end
,
542 struct vm_area_struct
*vma
)
545 unsigned long user_page_addr
;
546 struct vm_struct tmp_area
;
548 struct mm_struct
*mm
;
550 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
551 "%d: %s pages %p-%p\n", proc
->pid
,
552 allocate
? "allocate" : "free", start
, end
);
557 trace_binder_update_page_range(proc
, allocate
, start
, end
);
562 mm
= get_task_mm(proc
->tsk
);
565 down_write(&mm
->mmap_sem
);
567 if (vma
&& mm
!= proc
->vma_vm_mm
) {
568 pr_err("%d: vma mm and task mm mismatch\n",
578 pr_err("%d: binder_alloc_buf failed to map pages in userspace, no vma\n",
583 for (page_addr
= start
; page_addr
< end
; page_addr
+= PAGE_SIZE
) {
585 struct page
**page_array_ptr
;
586 page
= &proc
->pages
[(page_addr
- proc
->buffer
) / PAGE_SIZE
];
589 *page
= alloc_page(GFP_KERNEL
| __GFP_HIGHMEM
| __GFP_ZERO
);
591 pr_err("%d: binder_alloc_buf failed for page at %p\n",
592 proc
->pid
, page_addr
);
593 goto err_alloc_page_failed
;
595 tmp_area
.addr
= page_addr
;
596 tmp_area
.size
= PAGE_SIZE
+ PAGE_SIZE
/* guard page? */;
597 page_array_ptr
= page
;
598 ret
= map_vm_area(&tmp_area
, PAGE_KERNEL
, &page_array_ptr
);
600 pr_err("%d: binder_alloc_buf failed to map page at %p in kernel\n",
601 proc
->pid
, page_addr
);
602 goto err_map_kernel_failed
;
605 (uintptr_t)page_addr
+ proc
->user_buffer_offset
;
606 ret
= vm_insert_page(vma
, user_page_addr
, page
[0]);
608 pr_err("%d: binder_alloc_buf failed to map page at %lx in userspace\n",
609 proc
->pid
, user_page_addr
);
610 goto err_vm_insert_page_failed
;
612 /* vm_insert_page does not seem to increment the refcount */
615 up_write(&mm
->mmap_sem
);
621 for (page_addr
= end
- PAGE_SIZE
; page_addr
>= start
;
622 page_addr
-= PAGE_SIZE
) {
623 page
= &proc
->pages
[(page_addr
- proc
->buffer
) / PAGE_SIZE
];
625 zap_page_range(vma
, (uintptr_t)page_addr
+
626 proc
->user_buffer_offset
, PAGE_SIZE
, NULL
);
627 err_vm_insert_page_failed
:
628 unmap_kernel_range((unsigned long)page_addr
, PAGE_SIZE
);
629 err_map_kernel_failed
:
632 err_alloc_page_failed
:
637 up_write(&mm
->mmap_sem
);
643 static struct binder_buffer
*binder_alloc_buf(struct binder_proc
*proc
,
645 size_t offsets_size
, int is_async
)
647 struct rb_node
*n
= proc
->free_buffers
.rb_node
;
648 struct binder_buffer
*buffer
;
650 struct rb_node
*best_fit
= NULL
;
655 if (proc
->vma
== NULL
) {
656 pr_err("%d: binder_alloc_buf, no vma\n",
661 size
= ALIGN(data_size
, sizeof(void *)) +
662 ALIGN(offsets_size
, sizeof(void *));
664 if (size
< data_size
|| size
< offsets_size
) {
665 binder_user_error("%d: got transaction with invalid size %zd-%zd\n",
666 proc
->pid
, data_size
, offsets_size
);
671 proc
->free_async_space
< size
+ sizeof(struct binder_buffer
)) {
672 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
673 "%d: binder_alloc_buf size %zd failed, no async space left\n",
679 buffer
= rb_entry(n
, struct binder_buffer
, rb_node
);
680 BUG_ON(!buffer
->free
);
681 buffer_size
= binder_buffer_size(proc
, buffer
);
683 if (size
< buffer_size
) {
686 } else if (size
> buffer_size
)
693 if (best_fit
== NULL
) {
694 pr_err("%d: binder_alloc_buf size %zd failed, no address space\n",
699 buffer
= rb_entry(best_fit
, struct binder_buffer
, rb_node
);
700 buffer_size
= binder_buffer_size(proc
, buffer
);
703 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
704 "%d: binder_alloc_buf size %zd got buffer %p size %zd\n",
705 proc
->pid
, size
, buffer
, buffer_size
);
708 (void *)(((uintptr_t)buffer
->data
+ buffer_size
) & PAGE_MASK
);
710 if (size
+ sizeof(struct binder_buffer
) + 4 >= buffer_size
)
711 buffer_size
= size
; /* no room for other buffers */
713 buffer_size
= size
+ sizeof(struct binder_buffer
);
716 (void *)PAGE_ALIGN((uintptr_t)buffer
->data
+ buffer_size
);
717 if (end_page_addr
> has_page_addr
)
718 end_page_addr
= has_page_addr
;
719 if (binder_update_page_range(proc
, 1,
720 (void *)PAGE_ALIGN((uintptr_t)buffer
->data
), end_page_addr
, NULL
))
723 rb_erase(best_fit
, &proc
->free_buffers
);
725 binder_insert_allocated_buffer(proc
, buffer
);
726 if (buffer_size
!= size
) {
727 struct binder_buffer
*new_buffer
= (void *)buffer
->data
+ size
;
728 list_add(&new_buffer
->entry
, &buffer
->entry
);
729 new_buffer
->free
= 1;
730 binder_insert_free_buffer(proc
, new_buffer
);
732 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
733 "%d: binder_alloc_buf size %zd got %p\n",
734 proc
->pid
, size
, buffer
);
735 buffer
->data_size
= data_size
;
736 buffer
->offsets_size
= offsets_size
;
737 buffer
->async_transaction
= is_async
;
739 proc
->free_async_space
-= size
+ sizeof(struct binder_buffer
);
740 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC
,
741 "%d: binder_alloc_buf size %zd async free %zd\n",
742 proc
->pid
, size
, proc
->free_async_space
);
748 static void *buffer_start_page(struct binder_buffer
*buffer
)
750 return (void *)((uintptr_t)buffer
& PAGE_MASK
);
753 static void *buffer_end_page(struct binder_buffer
*buffer
)
755 return (void *)(((uintptr_t)(buffer
+ 1) - 1) & PAGE_MASK
);
758 static void binder_delete_free_buffer(struct binder_proc
*proc
,
759 struct binder_buffer
*buffer
)
761 struct binder_buffer
*prev
, *next
= NULL
;
762 int free_page_end
= 1;
763 int free_page_start
= 1;
765 BUG_ON(proc
->buffers
.next
== &buffer
->entry
);
766 prev
= list_entry(buffer
->entry
.prev
, struct binder_buffer
, entry
);
768 if (buffer_end_page(prev
) == buffer_start_page(buffer
)) {
770 if (buffer_end_page(prev
) == buffer_end_page(buffer
))
772 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
773 "%d: merge free, buffer %p share page with %p\n",
774 proc
->pid
, buffer
, prev
);
777 if (!list_is_last(&buffer
->entry
, &proc
->buffers
)) {
778 next
= list_entry(buffer
->entry
.next
,
779 struct binder_buffer
, entry
);
780 if (buffer_start_page(next
) == buffer_end_page(buffer
)) {
782 if (buffer_start_page(next
) ==
783 buffer_start_page(buffer
))
785 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
786 "%d: merge free, buffer %p share page with %p\n",
787 proc
->pid
, buffer
, prev
);
790 list_del(&buffer
->entry
);
791 if (free_page_start
|| free_page_end
) {
792 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
793 "%d: merge free, buffer %p do not share page%s%s with with %p or %p\n",
794 proc
->pid
, buffer
, free_page_start
? "" : " end",
795 free_page_end
? "" : " start", prev
, next
);
796 binder_update_page_range(proc
, 0, free_page_start
?
797 buffer_start_page(buffer
) : buffer_end_page(buffer
),
798 (free_page_end
? buffer_end_page(buffer
) :
799 buffer_start_page(buffer
)) + PAGE_SIZE
, NULL
);
803 static void binder_free_buf(struct binder_proc
*proc
,
804 struct binder_buffer
*buffer
)
806 size_t size
, buffer_size
;
808 buffer_size
= binder_buffer_size(proc
, buffer
);
810 size
= ALIGN(buffer
->data_size
, sizeof(void *)) +
811 ALIGN(buffer
->offsets_size
, sizeof(void *));
813 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
814 "%d: binder_free_buf %p size %zd buffer_size %zd\n",
815 proc
->pid
, buffer
, size
, buffer_size
);
817 BUG_ON(buffer
->free
);
818 BUG_ON(size
> buffer_size
);
819 BUG_ON(buffer
->transaction
!= NULL
);
820 BUG_ON((void *)buffer
< proc
->buffer
);
821 BUG_ON((void *)buffer
> proc
->buffer
+ proc
->buffer_size
);
823 if (buffer
->async_transaction
) {
824 proc
->free_async_space
+= size
+ sizeof(struct binder_buffer
);
826 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC
,
827 "%d: binder_free_buf size %zd async free %zd\n",
828 proc
->pid
, size
, proc
->free_async_space
);
831 binder_update_page_range(proc
, 0,
832 (void *)PAGE_ALIGN((uintptr_t)buffer
->data
),
833 (void *)(((uintptr_t)buffer
->data
+ buffer_size
) & PAGE_MASK
),
835 rb_erase(&buffer
->rb_node
, &proc
->allocated_buffers
);
837 if (!list_is_last(&buffer
->entry
, &proc
->buffers
)) {
838 struct binder_buffer
*next
= list_entry(buffer
->entry
.next
,
839 struct binder_buffer
, entry
);
841 rb_erase(&next
->rb_node
, &proc
->free_buffers
);
842 binder_delete_free_buffer(proc
, next
);
845 if (proc
->buffers
.next
!= &buffer
->entry
) {
846 struct binder_buffer
*prev
= list_entry(buffer
->entry
.prev
,
847 struct binder_buffer
, entry
);
849 binder_delete_free_buffer(proc
, buffer
);
850 rb_erase(&prev
->rb_node
, &proc
->free_buffers
);
854 binder_insert_free_buffer(proc
, buffer
);
857 static struct binder_node
*binder_get_node(struct binder_proc
*proc
,
860 struct rb_node
*n
= proc
->nodes
.rb_node
;
861 struct binder_node
*node
;
864 node
= rb_entry(n
, struct binder_node
, rb_node
);
868 else if (ptr
> node
->ptr
)
876 static struct binder_node
*binder_new_node(struct binder_proc
*proc
,
880 struct rb_node
**p
= &proc
->nodes
.rb_node
;
881 struct rb_node
*parent
= NULL
;
882 struct binder_node
*node
;
886 node
= rb_entry(parent
, struct binder_node
, rb_node
);
890 else if (ptr
> node
->ptr
)
896 node
= kzalloc(sizeof(*node
), GFP_KERNEL
);
899 binder_stats_created(BINDER_STAT_NODE
);
900 rb_link_node(&node
->rb_node
, parent
, p
);
901 rb_insert_color(&node
->rb_node
, &proc
->nodes
);
902 node
->debug_id
= ++binder_last_id
;
905 node
->cookie
= cookie
;
906 node
->work
.type
= BINDER_WORK_NODE
;
907 INIT_LIST_HEAD(&node
->work
.entry
);
908 INIT_LIST_HEAD(&node
->async_todo
);
909 binder_debug(BINDER_DEBUG_INTERNAL_REFS
,
910 "%d:%d node %d u%p c%p created\n",
911 proc
->pid
, current
->pid
, node
->debug_id
,
912 node
->ptr
, node
->cookie
);
916 static int binder_inc_node(struct binder_node
*node
, int strong
, int internal
,
917 struct list_head
*target_list
)
921 if (target_list
== NULL
&&
922 node
->internal_strong_refs
== 0 &&
923 !(node
== binder_context_mgr_node
&&
924 node
->has_strong_ref
)) {
925 pr_err("invalid inc strong node for %d\n",
929 node
->internal_strong_refs
++;
931 node
->local_strong_refs
++;
932 if (!node
->has_strong_ref
&& target_list
) {
933 list_del_init(&node
->work
.entry
);
934 list_add_tail(&node
->work
.entry
, target_list
);
938 node
->local_weak_refs
++;
939 if (!node
->has_weak_ref
&& list_empty(&node
->work
.entry
)) {
940 if (target_list
== NULL
) {
941 pr_err("invalid inc weak node for %d\n",
945 list_add_tail(&node
->work
.entry
, target_list
);
951 static int binder_dec_node(struct binder_node
*node
, int strong
, int internal
)
955 node
->internal_strong_refs
--;
957 node
->local_strong_refs
--;
958 if (node
->local_strong_refs
|| node
->internal_strong_refs
)
962 node
->local_weak_refs
--;
963 if (node
->local_weak_refs
|| !hlist_empty(&node
->refs
))
966 if (node
->proc
&& (node
->has_strong_ref
|| node
->has_weak_ref
)) {
967 if (list_empty(&node
->work
.entry
)) {
968 list_add_tail(&node
->work
.entry
, &node
->proc
->todo
);
969 wake_up_interruptible(&node
->proc
->wait
);
972 if (hlist_empty(&node
->refs
) && !node
->local_strong_refs
&&
973 !node
->local_weak_refs
) {
974 list_del_init(&node
->work
.entry
);
976 rb_erase(&node
->rb_node
, &node
->proc
->nodes
);
977 binder_debug(BINDER_DEBUG_INTERNAL_REFS
,
978 "refless node %d deleted\n",
981 hlist_del(&node
->dead_node
);
982 binder_debug(BINDER_DEBUG_INTERNAL_REFS
,
983 "dead node %d deleted\n",
987 binder_stats_deleted(BINDER_STAT_NODE
);
995 static struct binder_ref
*binder_get_ref(struct binder_proc
*proc
,
998 struct rb_node
*n
= proc
->refs_by_desc
.rb_node
;
999 struct binder_ref
*ref
;
1002 ref
= rb_entry(n
, struct binder_ref
, rb_node_desc
);
1004 if (desc
< ref
->desc
)
1006 else if (desc
> ref
->desc
)
1014 static struct binder_ref
*binder_get_ref_for_node(struct binder_proc
*proc
,
1015 struct binder_node
*node
)
1018 struct rb_node
**p
= &proc
->refs_by_node
.rb_node
;
1019 struct rb_node
*parent
= NULL
;
1020 struct binder_ref
*ref
, *new_ref
;
1024 ref
= rb_entry(parent
, struct binder_ref
, rb_node_node
);
1026 if (node
< ref
->node
)
1028 else if (node
> ref
->node
)
1029 p
= &(*p
)->rb_right
;
1033 new_ref
= kzalloc(sizeof(*ref
), GFP_KERNEL
);
1034 if (new_ref
== NULL
)
1036 binder_stats_created(BINDER_STAT_REF
);
1037 new_ref
->debug_id
= ++binder_last_id
;
1038 new_ref
->proc
= proc
;
1039 new_ref
->node
= node
;
1040 rb_link_node(&new_ref
->rb_node_node
, parent
, p
);
1041 rb_insert_color(&new_ref
->rb_node_node
, &proc
->refs_by_node
);
1043 new_ref
->desc
= (node
== binder_context_mgr_node
) ? 0 : 1;
1044 for (n
= rb_first(&proc
->refs_by_desc
); n
!= NULL
; n
= rb_next(n
)) {
1045 ref
= rb_entry(n
, struct binder_ref
, rb_node_desc
);
1046 if (ref
->desc
> new_ref
->desc
)
1048 new_ref
->desc
= ref
->desc
+ 1;
1051 p
= &proc
->refs_by_desc
.rb_node
;
1054 ref
= rb_entry(parent
, struct binder_ref
, rb_node_desc
);
1056 if (new_ref
->desc
< ref
->desc
)
1058 else if (new_ref
->desc
> ref
->desc
)
1059 p
= &(*p
)->rb_right
;
1063 rb_link_node(&new_ref
->rb_node_desc
, parent
, p
);
1064 rb_insert_color(&new_ref
->rb_node_desc
, &proc
->refs_by_desc
);
1066 hlist_add_head(&new_ref
->node_entry
, &node
->refs
);
1068 binder_debug(BINDER_DEBUG_INTERNAL_REFS
,
1069 "%d new ref %d desc %d for node %d\n",
1070 proc
->pid
, new_ref
->debug_id
, new_ref
->desc
,
1073 binder_debug(BINDER_DEBUG_INTERNAL_REFS
,
1074 "%d new ref %d desc %d for dead node\n",
1075 proc
->pid
, new_ref
->debug_id
, new_ref
->desc
);
1080 static void binder_delete_ref(struct binder_ref
*ref
)
1082 binder_debug(BINDER_DEBUG_INTERNAL_REFS
,
1083 "%d delete ref %d desc %d for node %d\n",
1084 ref
->proc
->pid
, ref
->debug_id
, ref
->desc
,
1085 ref
->node
->debug_id
);
1087 rb_erase(&ref
->rb_node_desc
, &ref
->proc
->refs_by_desc
);
1088 rb_erase(&ref
->rb_node_node
, &ref
->proc
->refs_by_node
);
1090 binder_dec_node(ref
->node
, 1, 1);
1091 hlist_del(&ref
->node_entry
);
1092 binder_dec_node(ref
->node
, 0, 1);
1094 binder_debug(BINDER_DEBUG_DEAD_BINDER
,
1095 "%d delete ref %d desc %d has death notification\n",
1096 ref
->proc
->pid
, ref
->debug_id
, ref
->desc
);
1097 list_del(&ref
->death
->work
.entry
);
1099 binder_stats_deleted(BINDER_STAT_DEATH
);
1102 binder_stats_deleted(BINDER_STAT_REF
);
1105 static int binder_inc_ref(struct binder_ref
*ref
, int strong
,
1106 struct list_head
*target_list
)
1110 if (ref
->strong
== 0) {
1111 ret
= binder_inc_node(ref
->node
, 1, 1, target_list
);
1117 if (ref
->weak
== 0) {
1118 ret
= binder_inc_node(ref
->node
, 0, 1, target_list
);
1128 static int binder_dec_ref(struct binder_ref
*ref
, int strong
)
1131 if (ref
->strong
== 0) {
1132 binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n",
1133 ref
->proc
->pid
, ref
->debug_id
,
1134 ref
->desc
, ref
->strong
, ref
->weak
);
1138 if (ref
->strong
== 0) {
1140 ret
= binder_dec_node(ref
->node
, strong
, 1);
1145 if (ref
->weak
== 0) {
1146 binder_user_error("%d invalid dec weak, ref %d desc %d s %d w %d\n",
1147 ref
->proc
->pid
, ref
->debug_id
,
1148 ref
->desc
, ref
->strong
, ref
->weak
);
1153 if (ref
->strong
== 0 && ref
->weak
== 0)
1154 binder_delete_ref(ref
);
1158 static void binder_pop_transaction(struct binder_thread
*target_thread
,
1159 struct binder_transaction
*t
)
1161 if (target_thread
) {
1162 BUG_ON(target_thread
->transaction_stack
!= t
);
1163 BUG_ON(target_thread
->transaction_stack
->from
!= target_thread
);
1164 target_thread
->transaction_stack
=
1165 target_thread
->transaction_stack
->from_parent
;
1170 t
->buffer
->transaction
= NULL
;
1172 binder_stats_deleted(BINDER_STAT_TRANSACTION
);
1175 static void binder_send_failed_reply(struct binder_transaction
*t
,
1176 uint32_t error_code
)
1178 struct binder_thread
*target_thread
;
1179 BUG_ON(t
->flags
& TF_ONE_WAY
);
1181 target_thread
= t
->from
;
1182 if (target_thread
) {
1183 if (target_thread
->return_error
!= BR_OK
&&
1184 target_thread
->return_error2
== BR_OK
) {
1185 target_thread
->return_error2
=
1186 target_thread
->return_error
;
1187 target_thread
->return_error
= BR_OK
;
1189 if (target_thread
->return_error
== BR_OK
) {
1190 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION
,
1191 "send failed reply for transaction %d to %d:%d\n",
1192 t
->debug_id
, target_thread
->proc
->pid
,
1193 target_thread
->pid
);
1195 binder_pop_transaction(target_thread
, t
);
1196 target_thread
->return_error
= error_code
;
1197 wake_up_interruptible(&target_thread
->wait
);
1199 pr_err("reply failed, target thread, %d:%d, has error code %d already\n",
1200 target_thread
->proc
->pid
,
1202 target_thread
->return_error
);
1206 struct binder_transaction
*next
= t
->from_parent
;
1208 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION
,
1209 "send failed reply for transaction %d, target dead\n",
1212 binder_pop_transaction(target_thread
, t
);
1214 binder_debug(BINDER_DEBUG_DEAD_BINDER
,
1215 "reply failed, no target thread at root\n");
1219 binder_debug(BINDER_DEBUG_DEAD_BINDER
,
1220 "reply failed, no target thread -- retry %d\n",
1226 static void binder_transaction_buffer_release(struct binder_proc
*proc
,
1227 struct binder_buffer
*buffer
,
1230 size_t *offp
, *off_end
;
1231 int debug_id
= buffer
->debug_id
;
1233 binder_debug(BINDER_DEBUG_TRANSACTION
,
1234 "%d buffer release %d, size %zd-%zd, failed at %p\n",
1235 proc
->pid
, buffer
->debug_id
,
1236 buffer
->data_size
, buffer
->offsets_size
, failed_at
);
1238 if (buffer
->target_node
)
1239 binder_dec_node(buffer
->target_node
, 1, 0);
1241 offp
= (size_t *)(buffer
->data
+ ALIGN(buffer
->data_size
, sizeof(void *)));
1243 off_end
= failed_at
;
1245 off_end
= (void *)offp
+ buffer
->offsets_size
;
1246 for (; offp
< off_end
; offp
++) {
1247 struct flat_binder_object
*fp
;
1248 if (*offp
> buffer
->data_size
- sizeof(*fp
) ||
1249 buffer
->data_size
< sizeof(*fp
) ||
1250 !IS_ALIGNED(*offp
, sizeof(void *))) {
1251 pr_err("transaction release %d bad offset %zd, size %zd\n",
1252 debug_id
, *offp
, buffer
->data_size
);
1255 fp
= (struct flat_binder_object
*)(buffer
->data
+ *offp
);
1257 case BINDER_TYPE_BINDER
:
1258 case BINDER_TYPE_WEAK_BINDER
: {
1259 struct binder_node
*node
= binder_get_node(proc
, fp
->binder
);
1261 pr_err("transaction release %d bad node %p\n",
1262 debug_id
, fp
->binder
);
1265 binder_debug(BINDER_DEBUG_TRANSACTION
,
1267 node
->debug_id
, node
->ptr
);
1268 binder_dec_node(node
, fp
->type
== BINDER_TYPE_BINDER
, 0);
1270 case BINDER_TYPE_HANDLE
:
1271 case BINDER_TYPE_WEAK_HANDLE
: {
1272 struct binder_ref
*ref
= binder_get_ref(proc
, fp
->handle
);
1274 pr_err("transaction release %d bad handle %ld\n",
1275 debug_id
, fp
->handle
);
1278 binder_debug(BINDER_DEBUG_TRANSACTION
,
1279 " ref %d desc %d (node %d)\n",
1280 ref
->debug_id
, ref
->desc
, ref
->node
->debug_id
);
1281 binder_dec_ref(ref
, fp
->type
== BINDER_TYPE_HANDLE
);
1284 case BINDER_TYPE_FD
:
1285 binder_debug(BINDER_DEBUG_TRANSACTION
,
1286 " fd %ld\n", fp
->handle
);
1288 task_close_fd(proc
, fp
->handle
);
1292 pr_err("transaction release %d bad object type %lx\n",
1293 debug_id
, fp
->type
);
1299 static void binder_transaction(struct binder_proc
*proc
,
1300 struct binder_thread
*thread
,
1301 struct binder_transaction_data
*tr
, int reply
)
1303 struct binder_transaction
*t
;
1304 struct binder_work
*tcomplete
;
1305 size_t *offp
, *off_end
;
1306 struct binder_proc
*target_proc
;
1307 struct binder_thread
*target_thread
= NULL
;
1308 struct binder_node
*target_node
= NULL
;
1309 struct list_head
*target_list
;
1310 wait_queue_head_t
*target_wait
;
1311 struct binder_transaction
*in_reply_to
= NULL
;
1312 struct binder_transaction_log_entry
*e
;
1313 uint32_t return_error
;
1315 e
= binder_transaction_log_add(&binder_transaction_log
);
1316 e
->call_type
= reply
? 2 : !!(tr
->flags
& TF_ONE_WAY
);
1317 e
->from_proc
= proc
->pid
;
1318 e
->from_thread
= thread
->pid
;
1319 e
->target_handle
= tr
->target
.handle
;
1320 e
->data_size
= tr
->data_size
;
1321 e
->offsets_size
= tr
->offsets_size
;
1324 in_reply_to
= thread
->transaction_stack
;
1325 if (in_reply_to
== NULL
) {
1326 binder_user_error("%d:%d got reply transaction with no transaction stack\n",
1327 proc
->pid
, thread
->pid
);
1328 return_error
= BR_FAILED_REPLY
;
1329 goto err_empty_call_stack
;
1331 binder_set_nice(in_reply_to
->saved_priority
);
1332 if (in_reply_to
->to_thread
!= thread
) {
1333 binder_user_error("%d:%d got reply transaction with bad transaction stack, transaction %d has target %d:%d\n",
1334 proc
->pid
, thread
->pid
, in_reply_to
->debug_id
,
1335 in_reply_to
->to_proc
?
1336 in_reply_to
->to_proc
->pid
: 0,
1337 in_reply_to
->to_thread
?
1338 in_reply_to
->to_thread
->pid
: 0);
1339 return_error
= BR_FAILED_REPLY
;
1341 goto err_bad_call_stack
;
1343 thread
->transaction_stack
= in_reply_to
->to_parent
;
1344 target_thread
= in_reply_to
->from
;
1345 if (target_thread
== NULL
) {
1346 return_error
= BR_DEAD_REPLY
;
1347 goto err_dead_binder
;
1349 if (target_thread
->transaction_stack
!= in_reply_to
) {
1350 binder_user_error("%d:%d got reply transaction with bad target transaction stack %d, expected %d\n",
1351 proc
->pid
, thread
->pid
,
1352 target_thread
->transaction_stack
?
1353 target_thread
->transaction_stack
->debug_id
: 0,
1354 in_reply_to
->debug_id
);
1355 return_error
= BR_FAILED_REPLY
;
1357 target_thread
= NULL
;
1358 goto err_dead_binder
;
1360 target_proc
= target_thread
->proc
;
1362 if (tr
->target
.handle
) {
1363 struct binder_ref
*ref
;
1364 ref
= binder_get_ref(proc
, tr
->target
.handle
);
1366 binder_user_error("%d:%d got transaction to invalid handle\n",
1367 proc
->pid
, thread
->pid
);
1368 return_error
= BR_FAILED_REPLY
;
1369 goto err_invalid_target_handle
;
1371 target_node
= ref
->node
;
1373 target_node
= binder_context_mgr_node
;
1374 if (target_node
== NULL
) {
1375 return_error
= BR_DEAD_REPLY
;
1376 goto err_no_context_mgr_node
;
1379 e
->to_node
= target_node
->debug_id
;
1380 target_proc
= target_node
->proc
;
1381 if (target_proc
== NULL
) {
1382 return_error
= BR_DEAD_REPLY
;
1383 goto err_dead_binder
;
1385 if (!(tr
->flags
& TF_ONE_WAY
) && thread
->transaction_stack
) {
1386 struct binder_transaction
*tmp
;
1387 tmp
= thread
->transaction_stack
;
1388 if (tmp
->to_thread
!= thread
) {
1389 binder_user_error("%d:%d got new transaction with bad transaction stack, transaction %d has target %d:%d\n",
1390 proc
->pid
, thread
->pid
, tmp
->debug_id
,
1391 tmp
->to_proc
? tmp
->to_proc
->pid
: 0,
1393 tmp
->to_thread
->pid
: 0);
1394 return_error
= BR_FAILED_REPLY
;
1395 goto err_bad_call_stack
;
1398 if (tmp
->from
&& tmp
->from
->proc
== target_proc
)
1399 target_thread
= tmp
->from
;
1400 tmp
= tmp
->from_parent
;
1404 if (target_thread
) {
1405 e
->to_thread
= target_thread
->pid
;
1406 target_list
= &target_thread
->todo
;
1407 target_wait
= &target_thread
->wait
;
1409 target_list
= &target_proc
->todo
;
1410 target_wait
= &target_proc
->wait
;
1412 e
->to_proc
= target_proc
->pid
;
1414 /* TODO: reuse incoming transaction for reply */
1415 t
= kzalloc(sizeof(*t
), GFP_KERNEL
);
1417 return_error
= BR_FAILED_REPLY
;
1418 goto err_alloc_t_failed
;
1420 binder_stats_created(BINDER_STAT_TRANSACTION
);
1422 tcomplete
= kzalloc(sizeof(*tcomplete
), GFP_KERNEL
);
1423 if (tcomplete
== NULL
) {
1424 return_error
= BR_FAILED_REPLY
;
1425 goto err_alloc_tcomplete_failed
;
1427 binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE
);
1429 t
->debug_id
= ++binder_last_id
;
1430 e
->debug_id
= t
->debug_id
;
1433 binder_debug(BINDER_DEBUG_TRANSACTION
,
1434 "%d:%d BC_REPLY %d -> %d:%d, data %p-%p size %zd-%zd\n",
1435 proc
->pid
, thread
->pid
, t
->debug_id
,
1436 target_proc
->pid
, target_thread
->pid
,
1437 tr
->data
.ptr
.buffer
, tr
->data
.ptr
.offsets
,
1438 tr
->data_size
, tr
->offsets_size
);
1440 binder_debug(BINDER_DEBUG_TRANSACTION
,
1441 "%d:%d BC_TRANSACTION %d -> %d - node %d, data %p-%p size %zd-%zd\n",
1442 proc
->pid
, thread
->pid
, t
->debug_id
,
1443 target_proc
->pid
, target_node
->debug_id
,
1444 tr
->data
.ptr
.buffer
, tr
->data
.ptr
.offsets
,
1445 tr
->data_size
, tr
->offsets_size
);
1447 if (!reply
&& !(tr
->flags
& TF_ONE_WAY
))
1451 t
->sender_euid
= proc
->tsk
->cred
->euid
;
1452 t
->to_proc
= target_proc
;
1453 t
->to_thread
= target_thread
;
1455 t
->flags
= tr
->flags
;
1456 t
->priority
= task_nice(current
);
1458 trace_binder_transaction(reply
, t
, target_node
);
1460 t
->buffer
= binder_alloc_buf(target_proc
, tr
->data_size
,
1461 tr
->offsets_size
, !reply
&& (t
->flags
& TF_ONE_WAY
));
1462 if (t
->buffer
== NULL
) {
1463 return_error
= BR_FAILED_REPLY
;
1464 goto err_binder_alloc_buf_failed
;
1466 t
->buffer
->allow_user_free
= 0;
1467 t
->buffer
->debug_id
= t
->debug_id
;
1468 t
->buffer
->transaction
= t
;
1469 t
->buffer
->target_node
= target_node
;
1470 trace_binder_transaction_alloc_buf(t
->buffer
);
1472 binder_inc_node(target_node
, 1, 0, NULL
);
1474 offp
= (size_t *)(t
->buffer
->data
+ ALIGN(tr
->data_size
, sizeof(void *)));
1476 if (copy_from_user(t
->buffer
->data
, tr
->data
.ptr
.buffer
, tr
->data_size
)) {
1477 binder_user_error("%d:%d got transaction with invalid data ptr\n",
1478 proc
->pid
, thread
->pid
);
1479 return_error
= BR_FAILED_REPLY
;
1480 goto err_copy_data_failed
;
1482 if (copy_from_user(offp
, tr
->data
.ptr
.offsets
, tr
->offsets_size
)) {
1483 binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
1484 proc
->pid
, thread
->pid
);
1485 return_error
= BR_FAILED_REPLY
;
1486 goto err_copy_data_failed
;
1488 if (!IS_ALIGNED(tr
->offsets_size
, sizeof(size_t))) {
1489 binder_user_error("%d:%d got transaction with invalid offsets size, %zd\n",
1490 proc
->pid
, thread
->pid
, tr
->offsets_size
);
1491 return_error
= BR_FAILED_REPLY
;
1492 goto err_bad_offset
;
1494 off_end
= (void *)offp
+ tr
->offsets_size
;
1495 for (; offp
< off_end
; offp
++) {
1496 struct flat_binder_object
*fp
;
1497 if (*offp
> t
->buffer
->data_size
- sizeof(*fp
) ||
1498 t
->buffer
->data_size
< sizeof(*fp
) ||
1499 !IS_ALIGNED(*offp
, sizeof(void *))) {
1500 binder_user_error("%d:%d got transaction with invalid offset, %zd\n",
1501 proc
->pid
, thread
->pid
, *offp
);
1502 return_error
= BR_FAILED_REPLY
;
1503 goto err_bad_offset
;
1505 fp
= (struct flat_binder_object
*)(t
->buffer
->data
+ *offp
);
1507 case BINDER_TYPE_BINDER
:
1508 case BINDER_TYPE_WEAK_BINDER
: {
1509 struct binder_ref
*ref
;
1510 struct binder_node
*node
= binder_get_node(proc
, fp
->binder
);
1512 node
= binder_new_node(proc
, fp
->binder
, fp
->cookie
);
1514 return_error
= BR_FAILED_REPLY
;
1515 goto err_binder_new_node_failed
;
1517 node
->min_priority
= fp
->flags
& FLAT_BINDER_FLAG_PRIORITY_MASK
;
1518 node
->accept_fds
= !!(fp
->flags
& FLAT_BINDER_FLAG_ACCEPTS_FDS
);
1520 if (fp
->cookie
!= node
->cookie
) {
1521 binder_user_error("%d:%d sending u%p node %d, cookie mismatch %p != %p\n",
1522 proc
->pid
, thread
->pid
,
1523 fp
->binder
, node
->debug_id
,
1524 fp
->cookie
, node
->cookie
);
1525 goto err_binder_get_ref_for_node_failed
;
1527 ref
= binder_get_ref_for_node(target_proc
, node
);
1529 return_error
= BR_FAILED_REPLY
;
1530 goto err_binder_get_ref_for_node_failed
;
1532 if (fp
->type
== BINDER_TYPE_BINDER
)
1533 fp
->type
= BINDER_TYPE_HANDLE
;
1535 fp
->type
= BINDER_TYPE_WEAK_HANDLE
;
1536 fp
->handle
= ref
->desc
;
1537 binder_inc_ref(ref
, fp
->type
== BINDER_TYPE_HANDLE
,
1540 trace_binder_transaction_node_to_ref(t
, node
, ref
);
1541 binder_debug(BINDER_DEBUG_TRANSACTION
,
1542 " node %d u%p -> ref %d desc %d\n",
1543 node
->debug_id
, node
->ptr
, ref
->debug_id
,
1546 case BINDER_TYPE_HANDLE
:
1547 case BINDER_TYPE_WEAK_HANDLE
: {
1548 struct binder_ref
*ref
= binder_get_ref(proc
, fp
->handle
);
1550 binder_user_error("%d:%d got transaction with invalid handle, %ld\n",
1552 thread
->pid
, fp
->handle
);
1553 return_error
= BR_FAILED_REPLY
;
1554 goto err_binder_get_ref_failed
;
1556 if (ref
->node
->proc
== target_proc
) {
1557 if (fp
->type
== BINDER_TYPE_HANDLE
)
1558 fp
->type
= BINDER_TYPE_BINDER
;
1560 fp
->type
= BINDER_TYPE_WEAK_BINDER
;
1561 fp
->binder
= ref
->node
->ptr
;
1562 fp
->cookie
= ref
->node
->cookie
;
1563 binder_inc_node(ref
->node
, fp
->type
== BINDER_TYPE_BINDER
, 0, NULL
);
1564 trace_binder_transaction_ref_to_node(t
, ref
);
1565 binder_debug(BINDER_DEBUG_TRANSACTION
,
1566 " ref %d desc %d -> node %d u%p\n",
1567 ref
->debug_id
, ref
->desc
, ref
->node
->debug_id
,
1570 struct binder_ref
*new_ref
;
1571 new_ref
= binder_get_ref_for_node(target_proc
, ref
->node
);
1572 if (new_ref
== NULL
) {
1573 return_error
= BR_FAILED_REPLY
;
1574 goto err_binder_get_ref_for_node_failed
;
1576 fp
->handle
= new_ref
->desc
;
1577 binder_inc_ref(new_ref
, fp
->type
== BINDER_TYPE_HANDLE
, NULL
);
1578 trace_binder_transaction_ref_to_ref(t
, ref
,
1580 binder_debug(BINDER_DEBUG_TRANSACTION
,
1581 " ref %d desc %d -> ref %d desc %d (node %d)\n",
1582 ref
->debug_id
, ref
->desc
, new_ref
->debug_id
,
1583 new_ref
->desc
, ref
->node
->debug_id
);
1587 case BINDER_TYPE_FD
: {
1592 if (!(in_reply_to
->flags
& TF_ACCEPT_FDS
)) {
1593 binder_user_error("%d:%d got reply with fd, %ld, but target does not allow fds\n",
1594 proc
->pid
, thread
->pid
, fp
->handle
);
1595 return_error
= BR_FAILED_REPLY
;
1596 goto err_fd_not_allowed
;
1598 } else if (!target_node
->accept_fds
) {
1599 binder_user_error("%d:%d got transaction with fd, %ld, but target does not allow fds\n",
1600 proc
->pid
, thread
->pid
, fp
->handle
);
1601 return_error
= BR_FAILED_REPLY
;
1602 goto err_fd_not_allowed
;
1605 file
= fget(fp
->handle
);
1607 binder_user_error("%d:%d got transaction with invalid fd, %ld\n",
1608 proc
->pid
, thread
->pid
, fp
->handle
);
1609 return_error
= BR_FAILED_REPLY
;
1610 goto err_fget_failed
;
1612 target_fd
= task_get_unused_fd_flags(target_proc
, O_CLOEXEC
);
1613 if (target_fd
< 0) {
1615 return_error
= BR_FAILED_REPLY
;
1616 goto err_get_unused_fd_failed
;
1618 task_fd_install(target_proc
, target_fd
, file
);
1619 trace_binder_transaction_fd(t
, fp
->handle
, target_fd
);
1620 binder_debug(BINDER_DEBUG_TRANSACTION
,
1621 " fd %ld -> %d\n", fp
->handle
, target_fd
);
1623 fp
->handle
= target_fd
;
1627 binder_user_error("%d:%d got transaction with invalid object type, %lx\n",
1628 proc
->pid
, thread
->pid
, fp
->type
);
1629 return_error
= BR_FAILED_REPLY
;
1630 goto err_bad_object_type
;
1634 BUG_ON(t
->buffer
->async_transaction
!= 0);
1635 binder_pop_transaction(target_thread
, in_reply_to
);
1636 } else if (!(t
->flags
& TF_ONE_WAY
)) {
1637 BUG_ON(t
->buffer
->async_transaction
!= 0);
1639 t
->from_parent
= thread
->transaction_stack
;
1640 thread
->transaction_stack
= t
;
1642 BUG_ON(target_node
== NULL
);
1643 BUG_ON(t
->buffer
->async_transaction
!= 1);
1644 if (target_node
->has_async_transaction
) {
1645 target_list
= &target_node
->async_todo
;
1648 target_node
->has_async_transaction
= 1;
1650 t
->work
.type
= BINDER_WORK_TRANSACTION
;
1651 list_add_tail(&t
->work
.entry
, target_list
);
1652 tcomplete
->type
= BINDER_WORK_TRANSACTION_COMPLETE
;
1653 list_add_tail(&tcomplete
->entry
, &thread
->todo
);
1655 wake_up_interruptible(target_wait
);
1658 err_get_unused_fd_failed
:
1661 err_binder_get_ref_for_node_failed
:
1662 err_binder_get_ref_failed
:
1663 err_binder_new_node_failed
:
1664 err_bad_object_type
:
1666 err_copy_data_failed
:
1667 trace_binder_transaction_failed_buffer_release(t
->buffer
);
1668 binder_transaction_buffer_release(target_proc
, t
->buffer
, offp
);
1669 t
->buffer
->transaction
= NULL
;
1670 binder_free_buf(target_proc
, t
->buffer
);
1671 err_binder_alloc_buf_failed
:
1673 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE
);
1674 err_alloc_tcomplete_failed
:
1676 binder_stats_deleted(BINDER_STAT_TRANSACTION
);
1679 err_empty_call_stack
:
1681 err_invalid_target_handle
:
1682 err_no_context_mgr_node
:
1683 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION
,
1684 "%d:%d transaction failed %d, size %zd-%zd\n",
1685 proc
->pid
, thread
->pid
, return_error
,
1686 tr
->data_size
, tr
->offsets_size
);
1689 struct binder_transaction_log_entry
*fe
;
1690 fe
= binder_transaction_log_add(&binder_transaction_log_failed
);
1694 BUG_ON(thread
->return_error
!= BR_OK
);
1696 thread
->return_error
= BR_TRANSACTION_COMPLETE
;
1697 binder_send_failed_reply(in_reply_to
, return_error
);
1699 thread
->return_error
= return_error
;
1702 int binder_thread_write(struct binder_proc
*proc
, struct binder_thread
*thread
,
1703 void __user
*buffer
, int size
, signed long *consumed
)
1706 void __user
*ptr
= buffer
+ *consumed
;
1707 void __user
*end
= buffer
+ size
;
1709 while (ptr
< end
&& thread
->return_error
== BR_OK
) {
1710 if (get_user(cmd
, (uint32_t __user
*)ptr
))
1712 ptr
+= sizeof(uint32_t);
1713 trace_binder_command(cmd
);
1714 if (_IOC_NR(cmd
) < ARRAY_SIZE(binder_stats
.bc
)) {
1715 binder_stats
.bc
[_IOC_NR(cmd
)]++;
1716 proc
->stats
.bc
[_IOC_NR(cmd
)]++;
1717 thread
->stats
.bc
[_IOC_NR(cmd
)]++;
1725 struct binder_ref
*ref
;
1726 const char *debug_string
;
1728 if (get_user(target
, (uint32_t __user
*)ptr
))
1730 ptr
+= sizeof(uint32_t);
1731 if (target
== 0 && binder_context_mgr_node
&&
1732 (cmd
== BC_INCREFS
|| cmd
== BC_ACQUIRE
)) {
1733 ref
= binder_get_ref_for_node(proc
,
1734 binder_context_mgr_node
);
1735 if (ref
->desc
!= target
) {
1736 binder_user_error("%d:%d tried to acquire reference to desc 0, got %d instead\n",
1737 proc
->pid
, thread
->pid
,
1741 ref
= binder_get_ref(proc
, target
);
1743 binder_user_error("%d:%d refcount change on invalid ref %d\n",
1744 proc
->pid
, thread
->pid
, target
);
1749 debug_string
= "IncRefs";
1750 binder_inc_ref(ref
, 0, NULL
);
1753 debug_string
= "Acquire";
1754 binder_inc_ref(ref
, 1, NULL
);
1757 debug_string
= "Release";
1758 binder_dec_ref(ref
, 1);
1762 debug_string
= "DecRefs";
1763 binder_dec_ref(ref
, 0);
1766 binder_debug(BINDER_DEBUG_USER_REFS
,
1767 "%d:%d %s ref %d desc %d s %d w %d for node %d\n",
1768 proc
->pid
, thread
->pid
, debug_string
, ref
->debug_id
,
1769 ref
->desc
, ref
->strong
, ref
->weak
, ref
->node
->debug_id
);
1772 case BC_INCREFS_DONE
:
1773 case BC_ACQUIRE_DONE
: {
1774 void __user
*node_ptr
;
1776 struct binder_node
*node
;
1778 if (get_user(node_ptr
, (void * __user
*)ptr
))
1780 ptr
+= sizeof(void *);
1781 if (get_user(cookie
, (void * __user
*)ptr
))
1783 ptr
+= sizeof(void *);
1784 node
= binder_get_node(proc
, node_ptr
);
1786 binder_user_error("%d:%d %s u%p no match\n",
1787 proc
->pid
, thread
->pid
,
1788 cmd
== BC_INCREFS_DONE
?
1794 if (cookie
!= node
->cookie
) {
1795 binder_user_error("%d:%d %s u%p node %d cookie mismatch %p != %p\n",
1796 proc
->pid
, thread
->pid
,
1797 cmd
== BC_INCREFS_DONE
?
1798 "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
1799 node_ptr
, node
->debug_id
,
1800 cookie
, node
->cookie
);
1803 if (cmd
== BC_ACQUIRE_DONE
) {
1804 if (node
->pending_strong_ref
== 0) {
1805 binder_user_error("%d:%d BC_ACQUIRE_DONE node %d has no pending acquire request\n",
1806 proc
->pid
, thread
->pid
,
1810 node
->pending_strong_ref
= 0;
1812 if (node
->pending_weak_ref
== 0) {
1813 binder_user_error("%d:%d BC_INCREFS_DONE node %d has no pending increfs request\n",
1814 proc
->pid
, thread
->pid
,
1818 node
->pending_weak_ref
= 0;
1820 binder_dec_node(node
, cmd
== BC_ACQUIRE_DONE
, 0);
1821 binder_debug(BINDER_DEBUG_USER_REFS
,
1822 "%d:%d %s node %d ls %d lw %d\n",
1823 proc
->pid
, thread
->pid
,
1824 cmd
== BC_INCREFS_DONE
? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
1825 node
->debug_id
, node
->local_strong_refs
, node
->local_weak_refs
);
1828 case BC_ATTEMPT_ACQUIRE
:
1829 pr_err("BC_ATTEMPT_ACQUIRE not supported\n");
1831 case BC_ACQUIRE_RESULT
:
1832 pr_err("BC_ACQUIRE_RESULT not supported\n");
1835 case BC_FREE_BUFFER
: {
1836 void __user
*data_ptr
;
1837 struct binder_buffer
*buffer
;
1839 if (get_user(data_ptr
, (void * __user
*)ptr
))
1841 ptr
+= sizeof(void *);
1843 buffer
= binder_buffer_lookup(proc
, data_ptr
);
1844 if (buffer
== NULL
) {
1845 binder_user_error("%d:%d BC_FREE_BUFFER u%p no match\n",
1846 proc
->pid
, thread
->pid
, data_ptr
);
1849 if (!buffer
->allow_user_free
) {
1850 binder_user_error("%d:%d BC_FREE_BUFFER u%p matched unreturned buffer\n",
1851 proc
->pid
, thread
->pid
, data_ptr
);
1854 binder_debug(BINDER_DEBUG_FREE_BUFFER
,
1855 "%d:%d BC_FREE_BUFFER u%p found buffer %d for %s transaction\n",
1856 proc
->pid
, thread
->pid
, data_ptr
, buffer
->debug_id
,
1857 buffer
->transaction
? "active" : "finished");
1859 if (buffer
->transaction
) {
1860 buffer
->transaction
->buffer
= NULL
;
1861 buffer
->transaction
= NULL
;
1863 if (buffer
->async_transaction
&& buffer
->target_node
) {
1864 BUG_ON(!buffer
->target_node
->has_async_transaction
);
1865 if (list_empty(&buffer
->target_node
->async_todo
))
1866 buffer
->target_node
->has_async_transaction
= 0;
1868 list_move_tail(buffer
->target_node
->async_todo
.next
, &thread
->todo
);
1870 trace_binder_transaction_buffer_release(buffer
);
1871 binder_transaction_buffer_release(proc
, buffer
, NULL
);
1872 binder_free_buf(proc
, buffer
);
1876 case BC_TRANSACTION
:
1878 struct binder_transaction_data tr
;
1880 if (copy_from_user(&tr
, ptr
, sizeof(tr
)))
1883 binder_transaction(proc
, thread
, &tr
, cmd
== BC_REPLY
);
1887 case BC_REGISTER_LOOPER
:
1888 binder_debug(BINDER_DEBUG_THREADS
,
1889 "%d:%d BC_REGISTER_LOOPER\n",
1890 proc
->pid
, thread
->pid
);
1891 if (thread
->looper
& BINDER_LOOPER_STATE_ENTERED
) {
1892 thread
->looper
|= BINDER_LOOPER_STATE_INVALID
;
1893 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER\n",
1894 proc
->pid
, thread
->pid
);
1895 } else if (proc
->requested_threads
== 0) {
1896 thread
->looper
|= BINDER_LOOPER_STATE_INVALID
;
1897 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called without request\n",
1898 proc
->pid
, thread
->pid
);
1900 proc
->requested_threads
--;
1901 proc
->requested_threads_started
++;
1903 thread
->looper
|= BINDER_LOOPER_STATE_REGISTERED
;
1905 case BC_ENTER_LOOPER
:
1906 binder_debug(BINDER_DEBUG_THREADS
,
1907 "%d:%d BC_ENTER_LOOPER\n",
1908 proc
->pid
, thread
->pid
);
1909 if (thread
->looper
& BINDER_LOOPER_STATE_REGISTERED
) {
1910 thread
->looper
|= BINDER_LOOPER_STATE_INVALID
;
1911 binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n",
1912 proc
->pid
, thread
->pid
);
1914 thread
->looper
|= BINDER_LOOPER_STATE_ENTERED
;
1916 case BC_EXIT_LOOPER
:
1917 binder_debug(BINDER_DEBUG_THREADS
,
1918 "%d:%d BC_EXIT_LOOPER\n",
1919 proc
->pid
, thread
->pid
);
1920 thread
->looper
|= BINDER_LOOPER_STATE_EXITED
;
1923 case BC_REQUEST_DEATH_NOTIFICATION
:
1924 case BC_CLEAR_DEATH_NOTIFICATION
: {
1926 void __user
*cookie
;
1927 struct binder_ref
*ref
;
1928 struct binder_ref_death
*death
;
1930 if (get_user(target
, (uint32_t __user
*)ptr
))
1932 ptr
+= sizeof(uint32_t);
1933 if (get_user(cookie
, (void __user
* __user
*)ptr
))
1935 ptr
+= sizeof(void *);
1936 ref
= binder_get_ref(proc
, target
);
1938 binder_user_error("%d:%d %s invalid ref %d\n",
1939 proc
->pid
, thread
->pid
,
1940 cmd
== BC_REQUEST_DEATH_NOTIFICATION
?
1941 "BC_REQUEST_DEATH_NOTIFICATION" :
1942 "BC_CLEAR_DEATH_NOTIFICATION",
1947 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION
,
1948 "%d:%d %s %p ref %d desc %d s %d w %d for node %d\n",
1949 proc
->pid
, thread
->pid
,
1950 cmd
== BC_REQUEST_DEATH_NOTIFICATION
?
1951 "BC_REQUEST_DEATH_NOTIFICATION" :
1952 "BC_CLEAR_DEATH_NOTIFICATION",
1953 cookie
, ref
->debug_id
, ref
->desc
,
1954 ref
->strong
, ref
->weak
, ref
->node
->debug_id
);
1956 if (cmd
== BC_REQUEST_DEATH_NOTIFICATION
) {
1958 binder_user_error("%d:%d BC_REQUEST_DEATH_NOTIFICATION death notification already set\n",
1959 proc
->pid
, thread
->pid
);
1962 death
= kzalloc(sizeof(*death
), GFP_KERNEL
);
1963 if (death
== NULL
) {
1964 thread
->return_error
= BR_ERROR
;
1965 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION
,
1966 "%d:%d BC_REQUEST_DEATH_NOTIFICATION failed\n",
1967 proc
->pid
, thread
->pid
);
1970 binder_stats_created(BINDER_STAT_DEATH
);
1971 INIT_LIST_HEAD(&death
->work
.entry
);
1972 death
->cookie
= cookie
;
1974 if (ref
->node
->proc
== NULL
) {
1975 ref
->death
->work
.type
= BINDER_WORK_DEAD_BINDER
;
1976 if (thread
->looper
& (BINDER_LOOPER_STATE_REGISTERED
| BINDER_LOOPER_STATE_ENTERED
)) {
1977 list_add_tail(&ref
->death
->work
.entry
, &thread
->todo
);
1979 list_add_tail(&ref
->death
->work
.entry
, &proc
->todo
);
1980 wake_up_interruptible(&proc
->wait
);
1984 if (ref
->death
== NULL
) {
1985 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification not active\n",
1986 proc
->pid
, thread
->pid
);
1990 if (death
->cookie
!= cookie
) {
1991 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch %p != %p\n",
1992 proc
->pid
, thread
->pid
,
1993 death
->cookie
, cookie
);
1997 if (list_empty(&death
->work
.entry
)) {
1998 death
->work
.type
= BINDER_WORK_CLEAR_DEATH_NOTIFICATION
;
1999 if (thread
->looper
& (BINDER_LOOPER_STATE_REGISTERED
| BINDER_LOOPER_STATE_ENTERED
)) {
2000 list_add_tail(&death
->work
.entry
, &thread
->todo
);
2002 list_add_tail(&death
->work
.entry
, &proc
->todo
);
2003 wake_up_interruptible(&proc
->wait
);
2006 BUG_ON(death
->work
.type
!= BINDER_WORK_DEAD_BINDER
);
2007 death
->work
.type
= BINDER_WORK_DEAD_BINDER_AND_CLEAR
;
2011 case BC_DEAD_BINDER_DONE
: {
2012 struct binder_work
*w
;
2013 void __user
*cookie
;
2014 struct binder_ref_death
*death
= NULL
;
2015 if (get_user(cookie
, (void __user
* __user
*)ptr
))
2018 ptr
+= sizeof(void *);
2019 list_for_each_entry(w
, &proc
->delivered_death
, entry
) {
2020 struct binder_ref_death
*tmp_death
= container_of(w
, struct binder_ref_death
, work
);
2021 if (tmp_death
->cookie
== cookie
) {
2026 binder_debug(BINDER_DEBUG_DEAD_BINDER
,
2027 "%d:%d BC_DEAD_BINDER_DONE %p found %p\n",
2028 proc
->pid
, thread
->pid
, cookie
, death
);
2029 if (death
== NULL
) {
2030 binder_user_error("%d:%d BC_DEAD_BINDER_DONE %p not found\n",
2031 proc
->pid
, thread
->pid
, cookie
);
2035 list_del_init(&death
->work
.entry
);
2036 if (death
->work
.type
== BINDER_WORK_DEAD_BINDER_AND_CLEAR
) {
2037 death
->work
.type
= BINDER_WORK_CLEAR_DEATH_NOTIFICATION
;
2038 if (thread
->looper
& (BINDER_LOOPER_STATE_REGISTERED
| BINDER_LOOPER_STATE_ENTERED
)) {
2039 list_add_tail(&death
->work
.entry
, &thread
->todo
);
2041 list_add_tail(&death
->work
.entry
, &proc
->todo
);
2042 wake_up_interruptible(&proc
->wait
);
2048 pr_err("%d:%d unknown command %d\n",
2049 proc
->pid
, thread
->pid
, cmd
);
2052 *consumed
= ptr
- buffer
;
2057 void binder_stat_br(struct binder_proc
*proc
, struct binder_thread
*thread
,
2060 trace_binder_return(cmd
);
2061 if (_IOC_NR(cmd
) < ARRAY_SIZE(binder_stats
.br
)) {
2062 binder_stats
.br
[_IOC_NR(cmd
)]++;
2063 proc
->stats
.br
[_IOC_NR(cmd
)]++;
2064 thread
->stats
.br
[_IOC_NR(cmd
)]++;
2068 static int binder_has_proc_work(struct binder_proc
*proc
,
2069 struct binder_thread
*thread
)
2071 return !list_empty(&proc
->todo
) ||
2072 (thread
->looper
& BINDER_LOOPER_STATE_NEED_RETURN
);
2075 static int binder_has_thread_work(struct binder_thread
*thread
)
2077 return !list_empty(&thread
->todo
) || thread
->return_error
!= BR_OK
||
2078 (thread
->looper
& BINDER_LOOPER_STATE_NEED_RETURN
);
2081 static int binder_thread_read(struct binder_proc
*proc
,
2082 struct binder_thread
*thread
,
2083 void __user
*buffer
, int size
,
2084 signed long *consumed
, int non_block
)
2086 void __user
*ptr
= buffer
+ *consumed
;
2087 void __user
*end
= buffer
+ size
;
2090 int wait_for_proc_work
;
2092 if (*consumed
== 0) {
2093 if (put_user(BR_NOOP
, (uint32_t __user
*)ptr
))
2095 ptr
+= sizeof(uint32_t);
2099 wait_for_proc_work
= thread
->transaction_stack
== NULL
&&
2100 list_empty(&thread
->todo
);
2102 if (thread
->return_error
!= BR_OK
&& ptr
< end
) {
2103 if (thread
->return_error2
!= BR_OK
) {
2104 if (put_user(thread
->return_error2
, (uint32_t __user
*)ptr
))
2106 ptr
+= sizeof(uint32_t);
2107 binder_stat_br(proc
, thread
, thread
->return_error2
);
2110 thread
->return_error2
= BR_OK
;
2112 if (put_user(thread
->return_error
, (uint32_t __user
*)ptr
))
2114 ptr
+= sizeof(uint32_t);
2115 binder_stat_br(proc
, thread
, thread
->return_error
);
2116 thread
->return_error
= BR_OK
;
2121 thread
->looper
|= BINDER_LOOPER_STATE_WAITING
;
2122 if (wait_for_proc_work
)
2123 proc
->ready_threads
++;
2125 binder_unlock(__func__
);
2127 trace_binder_wait_for_work(wait_for_proc_work
,
2128 !!thread
->transaction_stack
,
2129 !list_empty(&thread
->todo
));
2130 if (wait_for_proc_work
) {
2131 if (!(thread
->looper
& (BINDER_LOOPER_STATE_REGISTERED
|
2132 BINDER_LOOPER_STATE_ENTERED
))) {
2133 binder_user_error("%d:%d ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state %x)\n",
2134 proc
->pid
, thread
->pid
, thread
->looper
);
2135 wait_event_interruptible(binder_user_error_wait
,
2136 binder_stop_on_user_error
< 2);
2138 binder_set_nice(proc
->default_priority
);
2140 if (!binder_has_proc_work(proc
, thread
))
2143 ret
= wait_event_interruptible_exclusive(proc
->wait
, binder_has_proc_work(proc
, thread
));
2146 if (!binder_has_thread_work(thread
))
2149 ret
= wait_event_interruptible(thread
->wait
, binder_has_thread_work(thread
));
2152 binder_lock(__func__
);
2154 if (wait_for_proc_work
)
2155 proc
->ready_threads
--;
2156 thread
->looper
&= ~BINDER_LOOPER_STATE_WAITING
;
2163 struct binder_transaction_data tr
;
2164 struct binder_work
*w
;
2165 struct binder_transaction
*t
= NULL
;
2167 if (!list_empty(&thread
->todo
))
2168 w
= list_first_entry(&thread
->todo
, struct binder_work
, entry
);
2169 else if (!list_empty(&proc
->todo
) && wait_for_proc_work
)
2170 w
= list_first_entry(&proc
->todo
, struct binder_work
, entry
);
2172 if (ptr
- buffer
== 4 && !(thread
->looper
& BINDER_LOOPER_STATE_NEED_RETURN
)) /* no data added */
2177 if (end
- ptr
< sizeof(tr
) + 4)
2181 case BINDER_WORK_TRANSACTION
: {
2182 t
= container_of(w
, struct binder_transaction
, work
);
2184 case BINDER_WORK_TRANSACTION_COMPLETE
: {
2185 cmd
= BR_TRANSACTION_COMPLETE
;
2186 if (put_user(cmd
, (uint32_t __user
*)ptr
))
2188 ptr
+= sizeof(uint32_t);
2190 binder_stat_br(proc
, thread
, cmd
);
2191 binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE
,
2192 "%d:%d BR_TRANSACTION_COMPLETE\n",
2193 proc
->pid
, thread
->pid
);
2195 list_del(&w
->entry
);
2197 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE
);
2199 case BINDER_WORK_NODE
: {
2200 struct binder_node
*node
= container_of(w
, struct binder_node
, work
);
2201 uint32_t cmd
= BR_NOOP
;
2202 const char *cmd_name
;
2203 int strong
= node
->internal_strong_refs
|| node
->local_strong_refs
;
2204 int weak
= !hlist_empty(&node
->refs
) || node
->local_weak_refs
|| strong
;
2205 if (weak
&& !node
->has_weak_ref
) {
2207 cmd_name
= "BR_INCREFS";
2208 node
->has_weak_ref
= 1;
2209 node
->pending_weak_ref
= 1;
2210 node
->local_weak_refs
++;
2211 } else if (strong
&& !node
->has_strong_ref
) {
2213 cmd_name
= "BR_ACQUIRE";
2214 node
->has_strong_ref
= 1;
2215 node
->pending_strong_ref
= 1;
2216 node
->local_strong_refs
++;
2217 } else if (!strong
&& node
->has_strong_ref
) {
2219 cmd_name
= "BR_RELEASE";
2220 node
->has_strong_ref
= 0;
2221 } else if (!weak
&& node
->has_weak_ref
) {
2223 cmd_name
= "BR_DECREFS";
2224 node
->has_weak_ref
= 0;
2226 if (cmd
!= BR_NOOP
) {
2227 if (put_user(cmd
, (uint32_t __user
*)ptr
))
2229 ptr
+= sizeof(uint32_t);
2230 if (put_user(node
->ptr
, (void * __user
*)ptr
))
2232 ptr
+= sizeof(void *);
2233 if (put_user(node
->cookie
, (void * __user
*)ptr
))
2235 ptr
+= sizeof(void *);
2237 binder_stat_br(proc
, thread
, cmd
);
2238 binder_debug(BINDER_DEBUG_USER_REFS
,
2239 "%d:%d %s %d u%p c%p\n",
2240 proc
->pid
, thread
->pid
, cmd_name
, node
->debug_id
, node
->ptr
, node
->cookie
);
2242 list_del_init(&w
->entry
);
2243 if (!weak
&& !strong
) {
2244 binder_debug(BINDER_DEBUG_INTERNAL_REFS
,
2245 "%d:%d node %d u%p c%p deleted\n",
2246 proc
->pid
, thread
->pid
, node
->debug_id
,
2247 node
->ptr
, node
->cookie
);
2248 rb_erase(&node
->rb_node
, &proc
->nodes
);
2250 binder_stats_deleted(BINDER_STAT_NODE
);
2252 binder_debug(BINDER_DEBUG_INTERNAL_REFS
,
2253 "%d:%d node %d u%p c%p state unchanged\n",
2254 proc
->pid
, thread
->pid
, node
->debug_id
, node
->ptr
,
2259 case BINDER_WORK_DEAD_BINDER
:
2260 case BINDER_WORK_DEAD_BINDER_AND_CLEAR
:
2261 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION
: {
2262 struct binder_ref_death
*death
;
2265 death
= container_of(w
, struct binder_ref_death
, work
);
2266 if (w
->type
== BINDER_WORK_CLEAR_DEATH_NOTIFICATION
)
2267 cmd
= BR_CLEAR_DEATH_NOTIFICATION_DONE
;
2269 cmd
= BR_DEAD_BINDER
;
2270 if (put_user(cmd
, (uint32_t __user
*)ptr
))
2272 ptr
+= sizeof(uint32_t);
2273 if (put_user(death
->cookie
, (void * __user
*)ptr
))
2275 ptr
+= sizeof(void *);
2276 binder_stat_br(proc
, thread
, cmd
);
2277 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION
,
2279 proc
->pid
, thread
->pid
,
2280 cmd
== BR_DEAD_BINDER
?
2282 "BR_CLEAR_DEATH_NOTIFICATION_DONE",
2285 if (w
->type
== BINDER_WORK_CLEAR_DEATH_NOTIFICATION
) {
2286 list_del(&w
->entry
);
2288 binder_stats_deleted(BINDER_STAT_DEATH
);
2290 list_move(&w
->entry
, &proc
->delivered_death
);
2291 if (cmd
== BR_DEAD_BINDER
)
2292 goto done
; /* DEAD_BINDER notifications can cause transactions */
2299 BUG_ON(t
->buffer
== NULL
);
2300 if (t
->buffer
->target_node
) {
2301 struct binder_node
*target_node
= t
->buffer
->target_node
;
2302 tr
.target
.ptr
= target_node
->ptr
;
2303 tr
.cookie
= target_node
->cookie
;
2304 t
->saved_priority
= task_nice(current
);
2305 if (t
->priority
< target_node
->min_priority
&&
2306 !(t
->flags
& TF_ONE_WAY
))
2307 binder_set_nice(t
->priority
);
2308 else if (!(t
->flags
& TF_ONE_WAY
) ||
2309 t
->saved_priority
> target_node
->min_priority
)
2310 binder_set_nice(target_node
->min_priority
);
2311 cmd
= BR_TRANSACTION
;
2313 tr
.target
.ptr
= NULL
;
2318 tr
.flags
= t
->flags
;
2319 tr
.sender_euid
= from_kuid(current_user_ns(), t
->sender_euid
);
2322 struct task_struct
*sender
= t
->from
->proc
->tsk
;
2323 tr
.sender_pid
= task_tgid_nr_ns(sender
,
2324 task_active_pid_ns(current
));
2329 tr
.data_size
= t
->buffer
->data_size
;
2330 tr
.offsets_size
= t
->buffer
->offsets_size
;
2331 tr
.data
.ptr
.buffer
= (void *)t
->buffer
->data
+
2332 proc
->user_buffer_offset
;
2333 tr
.data
.ptr
.offsets
= tr
.data
.ptr
.buffer
+
2334 ALIGN(t
->buffer
->data_size
,
2337 if (put_user(cmd
, (uint32_t __user
*)ptr
))
2339 ptr
+= sizeof(uint32_t);
2340 if (copy_to_user(ptr
, &tr
, sizeof(tr
)))
2344 trace_binder_transaction_received(t
);
2345 binder_stat_br(proc
, thread
, cmd
);
2346 binder_debug(BINDER_DEBUG_TRANSACTION
,
2347 "%d:%d %s %d %d:%d, cmd %d size %zd-%zd ptr %p-%p\n",
2348 proc
->pid
, thread
->pid
,
2349 (cmd
== BR_TRANSACTION
) ? "BR_TRANSACTION" :
2351 t
->debug_id
, t
->from
? t
->from
->proc
->pid
: 0,
2352 t
->from
? t
->from
->pid
: 0, cmd
,
2353 t
->buffer
->data_size
, t
->buffer
->offsets_size
,
2354 tr
.data
.ptr
.buffer
, tr
.data
.ptr
.offsets
);
2356 list_del(&t
->work
.entry
);
2357 t
->buffer
->allow_user_free
= 1;
2358 if (cmd
== BR_TRANSACTION
&& !(t
->flags
& TF_ONE_WAY
)) {
2359 t
->to_parent
= thread
->transaction_stack
;
2360 t
->to_thread
= thread
;
2361 thread
->transaction_stack
= t
;
2363 t
->buffer
->transaction
= NULL
;
2365 binder_stats_deleted(BINDER_STAT_TRANSACTION
);
2372 *consumed
= ptr
- buffer
;
2373 if (proc
->requested_threads
+ proc
->ready_threads
== 0 &&
2374 proc
->requested_threads_started
< proc
->max_threads
&&
2375 (thread
->looper
& (BINDER_LOOPER_STATE_REGISTERED
|
2376 BINDER_LOOPER_STATE_ENTERED
)) /* the user-space code fails to */
2377 /*spawn a new thread if we leave this out */) {
2378 proc
->requested_threads
++;
2379 binder_debug(BINDER_DEBUG_THREADS
,
2380 "%d:%d BR_SPAWN_LOOPER\n",
2381 proc
->pid
, thread
->pid
);
2382 if (put_user(BR_SPAWN_LOOPER
, (uint32_t __user
*)buffer
))
2384 binder_stat_br(proc
, thread
, BR_SPAWN_LOOPER
);
2389 static void binder_release_work(struct list_head
*list
)
2391 struct binder_work
*w
;
2392 while (!list_empty(list
)) {
2393 w
= list_first_entry(list
, struct binder_work
, entry
);
2394 list_del_init(&w
->entry
);
2396 case BINDER_WORK_TRANSACTION
: {
2397 struct binder_transaction
*t
;
2399 t
= container_of(w
, struct binder_transaction
, work
);
2400 if (t
->buffer
->target_node
&&
2401 !(t
->flags
& TF_ONE_WAY
)) {
2402 binder_send_failed_reply(t
, BR_DEAD_REPLY
);
2404 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION
,
2405 "undelivered transaction %d\n",
2407 t
->buffer
->transaction
= NULL
;
2409 binder_stats_deleted(BINDER_STAT_TRANSACTION
);
2412 case BINDER_WORK_TRANSACTION_COMPLETE
: {
2413 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION
,
2414 "undelivered TRANSACTION_COMPLETE\n");
2416 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE
);
2418 case BINDER_WORK_DEAD_BINDER_AND_CLEAR
:
2419 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION
: {
2420 struct binder_ref_death
*death
;
2422 death
= container_of(w
, struct binder_ref_death
, work
);
2423 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION
,
2424 "undelivered death notification, %p\n",
2427 binder_stats_deleted(BINDER_STAT_DEATH
);
2430 pr_err("unexpected work type, %d, not freed\n",
2438 static struct binder_thread
*binder_get_thread(struct binder_proc
*proc
)
2440 struct binder_thread
*thread
= NULL
;
2441 struct rb_node
*parent
= NULL
;
2442 struct rb_node
**p
= &proc
->threads
.rb_node
;
2446 thread
= rb_entry(parent
, struct binder_thread
, rb_node
);
2448 if (current
->pid
< thread
->pid
)
2450 else if (current
->pid
> thread
->pid
)
2451 p
= &(*p
)->rb_right
;
2456 thread
= kzalloc(sizeof(*thread
), GFP_KERNEL
);
2459 binder_stats_created(BINDER_STAT_THREAD
);
2460 thread
->proc
= proc
;
2461 thread
->pid
= current
->pid
;
2462 init_waitqueue_head(&thread
->wait
);
2463 INIT_LIST_HEAD(&thread
->todo
);
2464 rb_link_node(&thread
->rb_node
, parent
, p
);
2465 rb_insert_color(&thread
->rb_node
, &proc
->threads
);
2466 thread
->looper
|= BINDER_LOOPER_STATE_NEED_RETURN
;
2467 thread
->return_error
= BR_OK
;
2468 thread
->return_error2
= BR_OK
;
2473 static int binder_free_thread(struct binder_proc
*proc
,
2474 struct binder_thread
*thread
)
2476 struct binder_transaction
*t
;
2477 struct binder_transaction
*send_reply
= NULL
;
2478 int active_transactions
= 0;
2480 rb_erase(&thread
->rb_node
, &proc
->threads
);
2481 t
= thread
->transaction_stack
;
2482 if (t
&& t
->to_thread
== thread
)
2485 active_transactions
++;
2486 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION
,
2487 "release %d:%d transaction %d %s, still active\n",
2488 proc
->pid
, thread
->pid
,
2490 (t
->to_thread
== thread
) ? "in" : "out");
2492 if (t
->to_thread
== thread
) {
2494 t
->to_thread
= NULL
;
2496 t
->buffer
->transaction
= NULL
;
2500 } else if (t
->from
== thread
) {
2507 binder_send_failed_reply(send_reply
, BR_DEAD_REPLY
);
2508 binder_release_work(&thread
->todo
);
2510 binder_stats_deleted(BINDER_STAT_THREAD
);
2511 return active_transactions
;
2514 static unsigned int binder_poll(struct file
*filp
,
2515 struct poll_table_struct
*wait
)
2517 struct binder_proc
*proc
= filp
->private_data
;
2518 struct binder_thread
*thread
= NULL
;
2519 int wait_for_proc_work
;
2521 binder_lock(__func__
);
2523 thread
= binder_get_thread(proc
);
2525 wait_for_proc_work
= thread
->transaction_stack
== NULL
&&
2526 list_empty(&thread
->todo
) && thread
->return_error
== BR_OK
;
2528 binder_unlock(__func__
);
2530 if (wait_for_proc_work
) {
2531 if (binder_has_proc_work(proc
, thread
))
2533 poll_wait(filp
, &proc
->wait
, wait
);
2534 if (binder_has_proc_work(proc
, thread
))
2537 if (binder_has_thread_work(thread
))
2539 poll_wait(filp
, &thread
->wait
, wait
);
2540 if (binder_has_thread_work(thread
))
2546 static long binder_ioctl(struct file
*filp
, unsigned int cmd
, unsigned long arg
)
2549 struct binder_proc
*proc
= filp
->private_data
;
2550 struct binder_thread
*thread
;
2551 unsigned int size
= _IOC_SIZE(cmd
);
2552 void __user
*ubuf
= (void __user
*)arg
;
2554 /*pr_info("binder_ioctl: %d:%d %x %lx\n", proc->pid, current->pid, cmd, arg);*/
2556 trace_binder_ioctl(cmd
, arg
);
2558 ret
= wait_event_interruptible(binder_user_error_wait
, binder_stop_on_user_error
< 2);
2562 binder_lock(__func__
);
2563 thread
= binder_get_thread(proc
);
2564 if (thread
== NULL
) {
2570 case BINDER_WRITE_READ
: {
2571 struct binder_write_read bwr
;
2572 if (size
!= sizeof(struct binder_write_read
)) {
2576 if (copy_from_user(&bwr
, ubuf
, sizeof(bwr
))) {
2580 binder_debug(BINDER_DEBUG_READ_WRITE
,
2581 "%d:%d write %ld at %08lx, read %ld at %08lx\n",
2582 proc
->pid
, thread
->pid
, bwr
.write_size
,
2583 bwr
.write_buffer
, bwr
.read_size
, bwr
.read_buffer
);
2585 if (bwr
.write_size
> 0) {
2586 ret
= binder_thread_write(proc
, thread
, (void __user
*)bwr
.write_buffer
, bwr
.write_size
, &bwr
.write_consumed
);
2587 trace_binder_write_done(ret
);
2589 bwr
.read_consumed
= 0;
2590 if (copy_to_user(ubuf
, &bwr
, sizeof(bwr
)))
2595 if (bwr
.read_size
> 0) {
2596 ret
= binder_thread_read(proc
, thread
, (void __user
*)bwr
.read_buffer
, bwr
.read_size
, &bwr
.read_consumed
, filp
->f_flags
& O_NONBLOCK
);
2597 trace_binder_read_done(ret
);
2598 if (!list_empty(&proc
->todo
))
2599 wake_up_interruptible(&proc
->wait
);
2601 if (copy_to_user(ubuf
, &bwr
, sizeof(bwr
)))
2606 binder_debug(BINDER_DEBUG_READ_WRITE
,
2607 "%d:%d wrote %ld of %ld, read return %ld of %ld\n",
2608 proc
->pid
, thread
->pid
, bwr
.write_consumed
, bwr
.write_size
,
2609 bwr
.read_consumed
, bwr
.read_size
);
2610 if (copy_to_user(ubuf
, &bwr
, sizeof(bwr
))) {
2616 case BINDER_SET_MAX_THREADS
:
2617 if (copy_from_user(&proc
->max_threads
, ubuf
, sizeof(proc
->max_threads
))) {
2622 case BINDER_SET_CONTEXT_MGR
:
2623 if (binder_context_mgr_node
!= NULL
) {
2624 pr_err("BINDER_SET_CONTEXT_MGR already set\n");
2628 if (uid_valid(binder_context_mgr_uid
)) {
2629 if (!uid_eq(binder_context_mgr_uid
, current
->cred
->euid
)) {
2630 pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n",
2631 from_kuid(&init_user_ns
, current
->cred
->euid
),
2632 from_kuid(&init_user_ns
, binder_context_mgr_uid
));
2637 binder_context_mgr_uid
= current
->cred
->euid
;
2638 binder_context_mgr_node
= binder_new_node(proc
, NULL
, NULL
);
2639 if (binder_context_mgr_node
== NULL
) {
2643 binder_context_mgr_node
->local_weak_refs
++;
2644 binder_context_mgr_node
->local_strong_refs
++;
2645 binder_context_mgr_node
->has_strong_ref
= 1;
2646 binder_context_mgr_node
->has_weak_ref
= 1;
2648 case BINDER_THREAD_EXIT
:
2649 binder_debug(BINDER_DEBUG_THREADS
, "%d:%d exit\n",
2650 proc
->pid
, thread
->pid
);
2651 binder_free_thread(proc
, thread
);
2654 case BINDER_VERSION
:
2655 if (size
!= sizeof(struct binder_version
)) {
2659 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION
, &((struct binder_version
*)ubuf
)->protocol_version
)) {
2671 thread
->looper
&= ~BINDER_LOOPER_STATE_NEED_RETURN
;
2672 binder_unlock(__func__
);
2673 wait_event_interruptible(binder_user_error_wait
, binder_stop_on_user_error
< 2);
2674 if (ret
&& ret
!= -ERESTARTSYS
)
2675 pr_info("%d:%d ioctl %x %lx returned %d\n", proc
->pid
, current
->pid
, cmd
, arg
, ret
);
2677 trace_binder_ioctl_done(ret
);
2681 static void binder_vma_open(struct vm_area_struct
*vma
)
2683 struct binder_proc
*proc
= vma
->vm_private_data
;
2684 binder_debug(BINDER_DEBUG_OPEN_CLOSE
,
2685 "%d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
2686 proc
->pid
, vma
->vm_start
, vma
->vm_end
,
2687 (vma
->vm_end
- vma
->vm_start
) / SZ_1K
, vma
->vm_flags
,
2688 (unsigned long)pgprot_val(vma
->vm_page_prot
));
2691 static void binder_vma_close(struct vm_area_struct
*vma
)
2693 struct binder_proc
*proc
= vma
->vm_private_data
;
2694 binder_debug(BINDER_DEBUG_OPEN_CLOSE
,
2695 "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
2696 proc
->pid
, vma
->vm_start
, vma
->vm_end
,
2697 (vma
->vm_end
- vma
->vm_start
) / SZ_1K
, vma
->vm_flags
,
2698 (unsigned long)pgprot_val(vma
->vm_page_prot
));
2700 proc
->vma_vm_mm
= NULL
;
2701 binder_defer_work(proc
, BINDER_DEFERRED_PUT_FILES
);
2704 static struct vm_operations_struct binder_vm_ops
= {
2705 .open
= binder_vma_open
,
2706 .close
= binder_vma_close
,
2709 static int binder_mmap(struct file
*filp
, struct vm_area_struct
*vma
)
2712 struct vm_struct
*area
;
2713 struct binder_proc
*proc
= filp
->private_data
;
2714 const char *failure_string
;
2715 struct binder_buffer
*buffer
;
2717 if (proc
->tsk
!= current
)
2720 if ((vma
->vm_end
- vma
->vm_start
) > SZ_4M
)
2721 vma
->vm_end
= vma
->vm_start
+ SZ_4M
;
2723 binder_debug(BINDER_DEBUG_OPEN_CLOSE
,
2724 "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n",
2725 proc
->pid
, vma
->vm_start
, vma
->vm_end
,
2726 (vma
->vm_end
- vma
->vm_start
) / SZ_1K
, vma
->vm_flags
,
2727 (unsigned long)pgprot_val(vma
->vm_page_prot
));
2729 if (vma
->vm_flags
& FORBIDDEN_MMAP_FLAGS
) {
2731 failure_string
= "bad vm_flags";
2734 vma
->vm_flags
= (vma
->vm_flags
| VM_DONTCOPY
) & ~VM_MAYWRITE
;
2736 mutex_lock(&binder_mmap_lock
);
2739 failure_string
= "already mapped";
2740 goto err_already_mapped
;
2743 area
= get_vm_area(vma
->vm_end
- vma
->vm_start
, VM_IOREMAP
);
2746 failure_string
= "get_vm_area";
2747 goto err_get_vm_area_failed
;
2749 proc
->buffer
= area
->addr
;
2750 proc
->user_buffer_offset
= vma
->vm_start
- (uintptr_t)proc
->buffer
;
2751 mutex_unlock(&binder_mmap_lock
);
2753 #ifdef CONFIG_CPU_CACHE_VIPT
2754 if (cache_is_vipt_aliasing()) {
2755 while (CACHE_COLOUR((vma
->vm_start
^ (uint32_t)proc
->buffer
))) {
2756 pr_info("binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc
->pid
, vma
->vm_start
, vma
->vm_end
, proc
->buffer
);
2757 vma
->vm_start
+= PAGE_SIZE
;
2761 proc
->pages
= kzalloc(sizeof(proc
->pages
[0]) * ((vma
->vm_end
- vma
->vm_start
) / PAGE_SIZE
), GFP_KERNEL
);
2762 if (proc
->pages
== NULL
) {
2764 failure_string
= "alloc page array";
2765 goto err_alloc_pages_failed
;
2767 proc
->buffer_size
= vma
->vm_end
- vma
->vm_start
;
2769 vma
->vm_ops
= &binder_vm_ops
;
2770 vma
->vm_private_data
= proc
;
2772 if (binder_update_page_range(proc
, 1, proc
->buffer
, proc
->buffer
+ PAGE_SIZE
, vma
)) {
2774 failure_string
= "alloc small buf";
2775 goto err_alloc_small_buf_failed
;
2777 buffer
= proc
->buffer
;
2778 INIT_LIST_HEAD(&proc
->buffers
);
2779 list_add(&buffer
->entry
, &proc
->buffers
);
2781 binder_insert_free_buffer(proc
, buffer
);
2782 proc
->free_async_space
= proc
->buffer_size
/ 2;
2784 proc
->files
= get_files_struct(current
);
2786 proc
->vma_vm_mm
= vma
->vm_mm
;
2788 /*pr_info("binder_mmap: %d %lx-%lx maps %p\n",
2789 proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/
2792 err_alloc_small_buf_failed
:
2795 err_alloc_pages_failed
:
2796 mutex_lock(&binder_mmap_lock
);
2797 vfree(proc
->buffer
);
2798 proc
->buffer
= NULL
;
2799 err_get_vm_area_failed
:
2801 mutex_unlock(&binder_mmap_lock
);
2803 pr_err("binder_mmap: %d %lx-%lx %s failed %d\n",
2804 proc
->pid
, vma
->vm_start
, vma
->vm_end
, failure_string
, ret
);
2808 static int binder_open(struct inode
*nodp
, struct file
*filp
)
2810 struct binder_proc
*proc
;
2812 binder_debug(BINDER_DEBUG_OPEN_CLOSE
, "binder_open: %d:%d\n",
2813 current
->group_leader
->pid
, current
->pid
);
2815 proc
= kzalloc(sizeof(*proc
), GFP_KERNEL
);
2818 get_task_struct(current
);
2819 proc
->tsk
= current
;
2820 INIT_LIST_HEAD(&proc
->todo
);
2821 init_waitqueue_head(&proc
->wait
);
2822 proc
->default_priority
= task_nice(current
);
2824 binder_lock(__func__
);
2826 binder_stats_created(BINDER_STAT_PROC
);
2827 hlist_add_head(&proc
->proc_node
, &binder_procs
);
2828 proc
->pid
= current
->group_leader
->pid
;
2829 INIT_LIST_HEAD(&proc
->delivered_death
);
2830 filp
->private_data
= proc
;
2832 binder_unlock(__func__
);
2834 if (binder_debugfs_dir_entry_proc
) {
2836 snprintf(strbuf
, sizeof(strbuf
), "%u", proc
->pid
);
2837 proc
->debugfs_entry
= debugfs_create_file(strbuf
, S_IRUGO
,
2838 binder_debugfs_dir_entry_proc
, proc
, &binder_proc_fops
);
2844 static int binder_flush(struct file
*filp
, fl_owner_t id
)
2846 struct binder_proc
*proc
= filp
->private_data
;
2848 binder_defer_work(proc
, BINDER_DEFERRED_FLUSH
);
2853 static void binder_deferred_flush(struct binder_proc
*proc
)
2857 for (n
= rb_first(&proc
->threads
); n
!= NULL
; n
= rb_next(n
)) {
2858 struct binder_thread
*thread
= rb_entry(n
, struct binder_thread
, rb_node
);
2859 thread
->looper
|= BINDER_LOOPER_STATE_NEED_RETURN
;
2860 if (thread
->looper
& BINDER_LOOPER_STATE_WAITING
) {
2861 wake_up_interruptible(&thread
->wait
);
2865 wake_up_interruptible_all(&proc
->wait
);
2867 binder_debug(BINDER_DEBUG_OPEN_CLOSE
,
2868 "binder_flush: %d woke %d threads\n", proc
->pid
,
2872 static int binder_release(struct inode
*nodp
, struct file
*filp
)
2874 struct binder_proc
*proc
= filp
->private_data
;
2875 debugfs_remove(proc
->debugfs_entry
);
2876 binder_defer_work(proc
, BINDER_DEFERRED_RELEASE
);
2881 static int binder_node_release(struct binder_node
*node
, int refs
)
2883 struct binder_ref
*ref
;
2886 list_del_init(&node
->work
.entry
);
2887 binder_release_work(&node
->async_todo
);
2889 if (hlist_empty(&node
->refs
)) {
2891 binder_stats_deleted(BINDER_STAT_NODE
);
2897 node
->local_strong_refs
= 0;
2898 node
->local_weak_refs
= 0;
2899 hlist_add_head(&node
->dead_node
, &binder_dead_nodes
);
2901 hlist_for_each_entry(ref
, &node
->refs
, node_entry
) {
2909 if (list_empty(&ref
->death
->work
.entry
)) {
2910 ref
->death
->work
.type
= BINDER_WORK_DEAD_BINDER
;
2911 list_add_tail(&ref
->death
->work
.entry
,
2913 wake_up_interruptible(&ref
->proc
->wait
);
2919 binder_debug(BINDER_DEBUG_DEAD_BINDER
,
2920 "node %d now dead, refs %d, death %d\n",
2921 node
->debug_id
, refs
, death
);
2926 static void binder_deferred_release(struct binder_proc
*proc
)
2928 struct binder_transaction
*t
;
2930 int threads
, nodes
, incoming_refs
, outgoing_refs
, buffers
, active_transactions
, page_count
;
2933 BUG_ON(proc
->files
);
2935 hlist_del(&proc
->proc_node
);
2936 if (binder_context_mgr_node
&& binder_context_mgr_node
->proc
== proc
) {
2937 binder_debug(BINDER_DEBUG_DEAD_BINDER
,
2938 "binder_release: %d context_mgr_node gone\n",
2940 binder_context_mgr_node
= NULL
;
2944 active_transactions
= 0;
2945 while ((n
= rb_first(&proc
->threads
))) {
2946 struct binder_thread
*thread
= rb_entry(n
, struct binder_thread
, rb_node
);
2948 active_transactions
+= binder_free_thread(proc
, thread
);
2952 while ((n
= rb_first(&proc
->nodes
))) {
2953 struct binder_node
*node
= rb_entry(n
, struct binder_node
, rb_node
);
2956 rb_erase(&node
->rb_node
, &proc
->nodes
);
2957 incoming_refs
= binder_node_release(node
, incoming_refs
);
2960 while ((n
= rb_first(&proc
->refs_by_desc
))) {
2961 struct binder_ref
*ref
= rb_entry(n
, struct binder_ref
,
2964 binder_delete_ref(ref
);
2966 binder_release_work(&proc
->todo
);
2967 binder_release_work(&proc
->delivered_death
);
2970 while ((n
= rb_first(&proc
->allocated_buffers
))) {
2971 struct binder_buffer
*buffer
= rb_entry(n
, struct binder_buffer
,
2973 t
= buffer
->transaction
;
2976 buffer
->transaction
= NULL
;
2977 pr_err("release proc %d, transaction %d, not freed\n",
2978 proc
->pid
, t
->debug_id
);
2981 binder_free_buf(proc
, buffer
);
2985 binder_stats_deleted(BINDER_STAT_PROC
);
2990 for (i
= 0; i
< proc
->buffer_size
/ PAGE_SIZE
; i
++) {
2991 if (proc
->pages
[i
]) {
2992 void *page_addr
= proc
->buffer
+ i
* PAGE_SIZE
;
2993 binder_debug(BINDER_DEBUG_BUFFER_ALLOC
,
2994 "binder_release: %d: page %d at %p not freed\n",
2997 unmap_kernel_range((unsigned long)page_addr
,
2999 __free_page(proc
->pages
[i
]);
3004 vfree(proc
->buffer
);
3007 put_task_struct(proc
->tsk
);
3009 binder_debug(BINDER_DEBUG_OPEN_CLOSE
,
3010 "binder_release: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d, buffers %d, pages %d\n",
3011 proc
->pid
, threads
, nodes
, incoming_refs
, outgoing_refs
,
3012 active_transactions
, buffers
, page_count
);
3017 static void binder_deferred_func(struct work_struct
*work
)
3019 struct binder_proc
*proc
;
3020 struct files_struct
*files
;
3024 binder_lock(__func__
);
3025 mutex_lock(&binder_deferred_lock
);
3026 if (!hlist_empty(&binder_deferred_list
)) {
3027 proc
= hlist_entry(binder_deferred_list
.first
,
3028 struct binder_proc
, deferred_work_node
);
3029 hlist_del_init(&proc
->deferred_work_node
);
3030 defer
= proc
->deferred_work
;
3031 proc
->deferred_work
= 0;
3036 mutex_unlock(&binder_deferred_lock
);
3039 if (defer
& BINDER_DEFERRED_PUT_FILES
) {
3040 files
= proc
->files
;
3045 if (defer
& BINDER_DEFERRED_FLUSH
)
3046 binder_deferred_flush(proc
);
3048 if (defer
& BINDER_DEFERRED_RELEASE
)
3049 binder_deferred_release(proc
); /* frees proc */
3051 binder_unlock(__func__
);
3053 put_files_struct(files
);
3056 static DECLARE_WORK(binder_deferred_work
, binder_deferred_func
);
3059 binder_defer_work(struct binder_proc
*proc
, enum binder_deferred_state defer
)
3061 mutex_lock(&binder_deferred_lock
);
3062 proc
->deferred_work
|= defer
;
3063 if (hlist_unhashed(&proc
->deferred_work_node
)) {
3064 hlist_add_head(&proc
->deferred_work_node
,
3065 &binder_deferred_list
);
3066 queue_work(binder_deferred_workqueue
, &binder_deferred_work
);
3068 mutex_unlock(&binder_deferred_lock
);
3071 static void print_binder_transaction(struct seq_file
*m
, const char *prefix
,
3072 struct binder_transaction
*t
)
3075 "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d",
3076 prefix
, t
->debug_id
, t
,
3077 t
->from
? t
->from
->proc
->pid
: 0,
3078 t
->from
? t
->from
->pid
: 0,
3079 t
->to_proc
? t
->to_proc
->pid
: 0,
3080 t
->to_thread
? t
->to_thread
->pid
: 0,
3081 t
->code
, t
->flags
, t
->priority
, t
->need_reply
);
3082 if (t
->buffer
== NULL
) {
3083 seq_puts(m
, " buffer free\n");
3086 if (t
->buffer
->target_node
)
3087 seq_printf(m
, " node %d",
3088 t
->buffer
->target_node
->debug_id
);
3089 seq_printf(m
, " size %zd:%zd data %p\n",
3090 t
->buffer
->data_size
, t
->buffer
->offsets_size
,
3094 static void print_binder_buffer(struct seq_file
*m
, const char *prefix
,
3095 struct binder_buffer
*buffer
)
3097 seq_printf(m
, "%s %d: %p size %zd:%zd %s\n",
3098 prefix
, buffer
->debug_id
, buffer
->data
,
3099 buffer
->data_size
, buffer
->offsets_size
,
3100 buffer
->transaction
? "active" : "delivered");
3103 static void print_binder_work(struct seq_file
*m
, const char *prefix
,
3104 const char *transaction_prefix
,
3105 struct binder_work
*w
)
3107 struct binder_node
*node
;
3108 struct binder_transaction
*t
;
3111 case BINDER_WORK_TRANSACTION
:
3112 t
= container_of(w
, struct binder_transaction
, work
);
3113 print_binder_transaction(m
, transaction_prefix
, t
);
3115 case BINDER_WORK_TRANSACTION_COMPLETE
:
3116 seq_printf(m
, "%stransaction complete\n", prefix
);
3118 case BINDER_WORK_NODE
:
3119 node
= container_of(w
, struct binder_node
, work
);
3120 seq_printf(m
, "%snode work %d: u%p c%p\n",
3121 prefix
, node
->debug_id
, node
->ptr
, node
->cookie
);
3123 case BINDER_WORK_DEAD_BINDER
:
3124 seq_printf(m
, "%shas dead binder\n", prefix
);
3126 case BINDER_WORK_DEAD_BINDER_AND_CLEAR
:
3127 seq_printf(m
, "%shas cleared dead binder\n", prefix
);
3129 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION
:
3130 seq_printf(m
, "%shas cleared death notification\n", prefix
);
3133 seq_printf(m
, "%sunknown work: type %d\n", prefix
, w
->type
);
3138 static void print_binder_thread(struct seq_file
*m
,
3139 struct binder_thread
*thread
,
3142 struct binder_transaction
*t
;
3143 struct binder_work
*w
;
3144 size_t start_pos
= m
->count
;
3147 seq_printf(m
, " thread %d: l %02x\n", thread
->pid
, thread
->looper
);
3148 header_pos
= m
->count
;
3149 t
= thread
->transaction_stack
;
3151 if (t
->from
== thread
) {
3152 print_binder_transaction(m
,
3153 " outgoing transaction", t
);
3155 } else if (t
->to_thread
== thread
) {
3156 print_binder_transaction(m
,
3157 " incoming transaction", t
);
3160 print_binder_transaction(m
, " bad transaction", t
);
3164 list_for_each_entry(w
, &thread
->todo
, entry
) {
3165 print_binder_work(m
, " ", " pending transaction", w
);
3167 if (!print_always
&& m
->count
== header_pos
)
3168 m
->count
= start_pos
;
3171 static void print_binder_node(struct seq_file
*m
, struct binder_node
*node
)
3173 struct binder_ref
*ref
;
3174 struct binder_work
*w
;
3178 hlist_for_each_entry(ref
, &node
->refs
, node_entry
)
3181 seq_printf(m
, " node %d: u%p c%p hs %d hw %d ls %d lw %d is %d iw %d",
3182 node
->debug_id
, node
->ptr
, node
->cookie
,
3183 node
->has_strong_ref
, node
->has_weak_ref
,
3184 node
->local_strong_refs
, node
->local_weak_refs
,
3185 node
->internal_strong_refs
, count
);
3187 seq_puts(m
, " proc");
3188 hlist_for_each_entry(ref
, &node
->refs
, node_entry
)
3189 seq_printf(m
, " %d", ref
->proc
->pid
);
3192 list_for_each_entry(w
, &node
->async_todo
, entry
)
3193 print_binder_work(m
, " ",
3194 " pending async transaction", w
);
3197 static void print_binder_ref(struct seq_file
*m
, struct binder_ref
*ref
)
3199 seq_printf(m
, " ref %d: desc %d %snode %d s %d w %d d %p\n",
3200 ref
->debug_id
, ref
->desc
, ref
->node
->proc
? "" : "dead ",
3201 ref
->node
->debug_id
, ref
->strong
, ref
->weak
, ref
->death
);
3204 static void print_binder_proc(struct seq_file
*m
,
3205 struct binder_proc
*proc
, int print_all
)
3207 struct binder_work
*w
;
3209 size_t start_pos
= m
->count
;
3212 seq_printf(m
, "proc %d\n", proc
->pid
);
3213 header_pos
= m
->count
;
3215 for (n
= rb_first(&proc
->threads
); n
!= NULL
; n
= rb_next(n
))
3216 print_binder_thread(m
, rb_entry(n
, struct binder_thread
,
3217 rb_node
), print_all
);
3218 for (n
= rb_first(&proc
->nodes
); n
!= NULL
; n
= rb_next(n
)) {
3219 struct binder_node
*node
= rb_entry(n
, struct binder_node
,
3221 if (print_all
|| node
->has_async_transaction
)
3222 print_binder_node(m
, node
);
3225 for (n
= rb_first(&proc
->refs_by_desc
);
3228 print_binder_ref(m
, rb_entry(n
, struct binder_ref
,
3231 for (n
= rb_first(&proc
->allocated_buffers
); n
!= NULL
; n
= rb_next(n
))
3232 print_binder_buffer(m
, " buffer",
3233 rb_entry(n
, struct binder_buffer
, rb_node
));
3234 list_for_each_entry(w
, &proc
->todo
, entry
)
3235 print_binder_work(m
, " ", " pending transaction", w
);
3236 list_for_each_entry(w
, &proc
->delivered_death
, entry
) {
3237 seq_puts(m
, " has delivered dead binder\n");
3240 if (!print_all
&& m
->count
== header_pos
)
3241 m
->count
= start_pos
;
3244 static const char * const binder_return_strings
[] = {
3249 "BR_ACQUIRE_RESULT",
3251 "BR_TRANSACTION_COMPLETE",
3256 "BR_ATTEMPT_ACQUIRE",
3261 "BR_CLEAR_DEATH_NOTIFICATION_DONE",
3265 static const char * const binder_command_strings
[] = {
3268 "BC_ACQUIRE_RESULT",
3276 "BC_ATTEMPT_ACQUIRE",
3277 "BC_REGISTER_LOOPER",
3280 "BC_REQUEST_DEATH_NOTIFICATION",
3281 "BC_CLEAR_DEATH_NOTIFICATION",
3282 "BC_DEAD_BINDER_DONE"
3285 static const char * const binder_objstat_strings
[] = {
3292 "transaction_complete"
3295 static void print_binder_stats(struct seq_file
*m
, const char *prefix
,
3296 struct binder_stats
*stats
)
3300 BUILD_BUG_ON(ARRAY_SIZE(stats
->bc
) !=
3301 ARRAY_SIZE(binder_command_strings
));
3302 for (i
= 0; i
< ARRAY_SIZE(stats
->bc
); i
++) {
3304 seq_printf(m
, "%s%s: %d\n", prefix
,
3305 binder_command_strings
[i
], stats
->bc
[i
]);
3308 BUILD_BUG_ON(ARRAY_SIZE(stats
->br
) !=
3309 ARRAY_SIZE(binder_return_strings
));
3310 for (i
= 0; i
< ARRAY_SIZE(stats
->br
); i
++) {
3312 seq_printf(m
, "%s%s: %d\n", prefix
,
3313 binder_return_strings
[i
], stats
->br
[i
]);
3316 BUILD_BUG_ON(ARRAY_SIZE(stats
->obj_created
) !=
3317 ARRAY_SIZE(binder_objstat_strings
));
3318 BUILD_BUG_ON(ARRAY_SIZE(stats
->obj_created
) !=
3319 ARRAY_SIZE(stats
->obj_deleted
));
3320 for (i
= 0; i
< ARRAY_SIZE(stats
->obj_created
); i
++) {
3321 if (stats
->obj_created
[i
] || stats
->obj_deleted
[i
])
3322 seq_printf(m
, "%s%s: active %d total %d\n", prefix
,
3323 binder_objstat_strings
[i
],
3324 stats
->obj_created
[i
] - stats
->obj_deleted
[i
],
3325 stats
->obj_created
[i
]);
3329 static void print_binder_proc_stats(struct seq_file
*m
,
3330 struct binder_proc
*proc
)
3332 struct binder_work
*w
;
3334 int count
, strong
, weak
;
3336 seq_printf(m
, "proc %d\n", proc
->pid
);
3338 for (n
= rb_first(&proc
->threads
); n
!= NULL
; n
= rb_next(n
))
3340 seq_printf(m
, " threads: %d\n", count
);
3341 seq_printf(m
, " requested threads: %d+%d/%d\n"
3342 " ready threads %d\n"
3343 " free async space %zd\n", proc
->requested_threads
,
3344 proc
->requested_threads_started
, proc
->max_threads
,
3345 proc
->ready_threads
, proc
->free_async_space
);
3347 for (n
= rb_first(&proc
->nodes
); n
!= NULL
; n
= rb_next(n
))
3349 seq_printf(m
, " nodes: %d\n", count
);
3353 for (n
= rb_first(&proc
->refs_by_desc
); n
!= NULL
; n
= rb_next(n
)) {
3354 struct binder_ref
*ref
= rb_entry(n
, struct binder_ref
,
3357 strong
+= ref
->strong
;
3360 seq_printf(m
, " refs: %d s %d w %d\n", count
, strong
, weak
);
3363 for (n
= rb_first(&proc
->allocated_buffers
); n
!= NULL
; n
= rb_next(n
))
3365 seq_printf(m
, " buffers: %d\n", count
);
3368 list_for_each_entry(w
, &proc
->todo
, entry
) {
3370 case BINDER_WORK_TRANSACTION
:
3377 seq_printf(m
, " pending transactions: %d\n", count
);
3379 print_binder_stats(m
, " ", &proc
->stats
);
3383 static int binder_state_show(struct seq_file
*m
, void *unused
)
3385 struct binder_proc
*proc
;
3386 struct binder_node
*node
;
3387 int do_lock
= !binder_debug_no_lock
;
3390 binder_lock(__func__
);
3392 seq_puts(m
, "binder state:\n");
3394 if (!hlist_empty(&binder_dead_nodes
))
3395 seq_puts(m
, "dead nodes:\n");
3396 hlist_for_each_entry(node
, &binder_dead_nodes
, dead_node
)
3397 print_binder_node(m
, node
);
3399 hlist_for_each_entry(proc
, &binder_procs
, proc_node
)
3400 print_binder_proc(m
, proc
, 1);
3402 binder_unlock(__func__
);
3406 static int binder_stats_show(struct seq_file
*m
, void *unused
)
3408 struct binder_proc
*proc
;
3409 int do_lock
= !binder_debug_no_lock
;
3412 binder_lock(__func__
);
3414 seq_puts(m
, "binder stats:\n");
3416 print_binder_stats(m
, "", &binder_stats
);
3418 hlist_for_each_entry(proc
, &binder_procs
, proc_node
)
3419 print_binder_proc_stats(m
, proc
);
3421 binder_unlock(__func__
);
3425 static int binder_transactions_show(struct seq_file
*m
, void *unused
)
3427 struct binder_proc
*proc
;
3428 int do_lock
= !binder_debug_no_lock
;
3431 binder_lock(__func__
);
3433 seq_puts(m
, "binder transactions:\n");
3434 hlist_for_each_entry(proc
, &binder_procs
, proc_node
)
3435 print_binder_proc(m
, proc
, 0);
3437 binder_unlock(__func__
);
3441 static int binder_proc_show(struct seq_file
*m
, void *unused
)
3443 struct binder_proc
*proc
= m
->private;
3444 int do_lock
= !binder_debug_no_lock
;
3447 binder_lock(__func__
);
3448 seq_puts(m
, "binder proc state:\n");
3449 print_binder_proc(m
, proc
, 1);
3451 binder_unlock(__func__
);
3455 static void print_binder_transaction_log_entry(struct seq_file
*m
,
3456 struct binder_transaction_log_entry
*e
)
3459 "%d: %s from %d:%d to %d:%d node %d handle %d size %d:%d\n",
3460 e
->debug_id
, (e
->call_type
== 2) ? "reply" :
3461 ((e
->call_type
== 1) ? "async" : "call "), e
->from_proc
,
3462 e
->from_thread
, e
->to_proc
, e
->to_thread
, e
->to_node
,
3463 e
->target_handle
, e
->data_size
, e
->offsets_size
);
3466 static int binder_transaction_log_show(struct seq_file
*m
, void *unused
)
3468 struct binder_transaction_log
*log
= m
->private;
3472 for (i
= log
->next
; i
< ARRAY_SIZE(log
->entry
); i
++)
3473 print_binder_transaction_log_entry(m
, &log
->entry
[i
]);
3475 for (i
= 0; i
< log
->next
; i
++)
3476 print_binder_transaction_log_entry(m
, &log
->entry
[i
]);
3480 static const struct file_operations binder_fops
= {
3481 .owner
= THIS_MODULE
,
3482 .poll
= binder_poll
,
3483 .unlocked_ioctl
= binder_ioctl
,
3484 .mmap
= binder_mmap
,
3485 .open
= binder_open
,
3486 .flush
= binder_flush
,
3487 .release
= binder_release
,
3490 static struct miscdevice binder_miscdev
= {
3491 .minor
= MISC_DYNAMIC_MINOR
,
3493 .fops
= &binder_fops
3496 BINDER_DEBUG_ENTRY(state
);
3497 BINDER_DEBUG_ENTRY(stats
);
3498 BINDER_DEBUG_ENTRY(transactions
);
3499 BINDER_DEBUG_ENTRY(transaction_log
);
3501 static int __init
binder_init(void)
3505 binder_deferred_workqueue
= create_singlethread_workqueue("binder");
3506 if (!binder_deferred_workqueue
)
3509 binder_debugfs_dir_entry_root
= debugfs_create_dir("binder", NULL
);
3510 if (binder_debugfs_dir_entry_root
)
3511 binder_debugfs_dir_entry_proc
= debugfs_create_dir("proc",
3512 binder_debugfs_dir_entry_root
);
3513 ret
= misc_register(&binder_miscdev
);
3514 if (binder_debugfs_dir_entry_root
) {
3515 debugfs_create_file("state",
3517 binder_debugfs_dir_entry_root
,
3519 &binder_state_fops
);
3520 debugfs_create_file("stats",
3522 binder_debugfs_dir_entry_root
,
3524 &binder_stats_fops
);
3525 debugfs_create_file("transactions",
3527 binder_debugfs_dir_entry_root
,
3529 &binder_transactions_fops
);
3530 debugfs_create_file("transaction_log",
3532 binder_debugfs_dir_entry_root
,
3533 &binder_transaction_log
,
3534 &binder_transaction_log_fops
);
3535 debugfs_create_file("failed_transaction_log",
3537 binder_debugfs_dir_entry_root
,
3538 &binder_transaction_log_failed
,
3539 &binder_transaction_log_fops
);
3544 device_initcall(binder_init
);
3546 #define CREATE_TRACE_POINTS
3547 #include "binder_trace.h"
3549 MODULE_LICENSE("GPL v2");