Linux Audio

Check our new training course

Loading...
v6.2
   1// SPDX-License-Identifier: GPL-2.0-only
   2/* binder.c
   3 *
   4 * Android IPC Subsystem
   5 *
   6 * Copyright (C) 2007-2008 Google, Inc.
   7 */
   8
   9/*
  10 * Locking overview
  11 *
  12 * There are 3 main spinlocks which must be acquired in the
  13 * order shown:
  14 *
  15 * 1) proc->outer_lock : protects binder_ref
  16 *    binder_proc_lock() and binder_proc_unlock() are
  17 *    used to acq/rel.
  18 * 2) node->lock : protects most fields of binder_node.
  19 *    binder_node_lock() and binder_node_unlock() are
  20 *    used to acq/rel
  21 * 3) proc->inner_lock : protects the thread and node lists
  22 *    (proc->threads, proc->waiting_threads, proc->nodes)
  23 *    and all todo lists associated with the binder_proc
  24 *    (proc->todo, thread->todo, proc->delivered_death and
  25 *    node->async_todo), as well as thread->transaction_stack
  26 *    binder_inner_proc_lock() and binder_inner_proc_unlock()
  27 *    are used to acq/rel
  28 *
  29 * Any lock under procA must never be nested under any lock at the same
  30 * level or below on procB.
  31 *
  32 * Functions that require a lock held on entry indicate which lock
  33 * in the suffix of the function name:
  34 *
  35 * foo_olocked() : requires node->outer_lock
  36 * foo_nlocked() : requires node->lock
  37 * foo_ilocked() : requires proc->inner_lock
  38 * foo_oilocked(): requires proc->outer_lock and proc->inner_lock
  39 * foo_nilocked(): requires node->lock and proc->inner_lock
  40 * ...
  41 */
  42
  43#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  44
  45#include <linux/fdtable.h>
  46#include <linux/file.h>
  47#include <linux/freezer.h>
  48#include <linux/fs.h>
  49#include <linux/list.h>
  50#include <linux/miscdevice.h>
  51#include <linux/module.h>
  52#include <linux/mutex.h>
  53#include <linux/nsproxy.h>
  54#include <linux/poll.h>
  55#include <linux/debugfs.h>
  56#include <linux/rbtree.h>
  57#include <linux/sched/signal.h>
  58#include <linux/sched/mm.h>
  59#include <linux/seq_file.h>
  60#include <linux/string.h>
  61#include <linux/uaccess.h>
  62#include <linux/pid_namespace.h>
  63#include <linux/security.h>
  64#include <linux/spinlock.h>
  65#include <linux/ratelimit.h>
  66#include <linux/syscalls.h>
  67#include <linux/task_work.h>
  68#include <linux/sizes.h>
  69
  70#include <uapi/linux/android/binder.h>
 
  71
  72#include <linux/cacheflush.h>
  73
 
  74#include "binder_internal.h"
  75#include "binder_trace.h"
  76
  77static HLIST_HEAD(binder_deferred_list);
  78static DEFINE_MUTEX(binder_deferred_lock);
  79
  80static HLIST_HEAD(binder_devices);
  81static HLIST_HEAD(binder_procs);
  82static DEFINE_MUTEX(binder_procs_lock);
  83
  84static HLIST_HEAD(binder_dead_nodes);
  85static DEFINE_SPINLOCK(binder_dead_nodes_lock);
  86
  87static struct dentry *binder_debugfs_dir_entry_root;
  88static struct dentry *binder_debugfs_dir_entry_proc;
  89static atomic_t binder_last_id;
  90
  91static int proc_show(struct seq_file *m, void *unused);
  92DEFINE_SHOW_ATTRIBUTE(proc);
  93
 
 
 
 
 
  94#define FORBIDDEN_MMAP_FLAGS                (VM_WRITE)
  95
  96enum {
  97	BINDER_DEBUG_USER_ERROR             = 1U << 0,
  98	BINDER_DEBUG_FAILED_TRANSACTION     = 1U << 1,
  99	BINDER_DEBUG_DEAD_TRANSACTION       = 1U << 2,
 100	BINDER_DEBUG_OPEN_CLOSE             = 1U << 3,
 101	BINDER_DEBUG_DEAD_BINDER            = 1U << 4,
 102	BINDER_DEBUG_DEATH_NOTIFICATION     = 1U << 5,
 103	BINDER_DEBUG_READ_WRITE             = 1U << 6,
 104	BINDER_DEBUG_USER_REFS              = 1U << 7,
 105	BINDER_DEBUG_THREADS                = 1U << 8,
 106	BINDER_DEBUG_TRANSACTION            = 1U << 9,
 107	BINDER_DEBUG_TRANSACTION_COMPLETE   = 1U << 10,
 108	BINDER_DEBUG_FREE_BUFFER            = 1U << 11,
 109	BINDER_DEBUG_INTERNAL_REFS          = 1U << 12,
 110	BINDER_DEBUG_PRIORITY_CAP           = 1U << 13,
 111	BINDER_DEBUG_SPINLOCKS              = 1U << 14,
 112};
 113static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR |
 114	BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION;
 115module_param_named(debug_mask, binder_debug_mask, uint, 0644);
 116
 117char *binder_devices_param = CONFIG_ANDROID_BINDER_DEVICES;
 118module_param_named(devices, binder_devices_param, charp, 0444);
 119
 120static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait);
 121static int binder_stop_on_user_error;
 122
 123static int binder_set_stop_on_user_error(const char *val,
 124					 const struct kernel_param *kp)
 125{
 126	int ret;
 127
 128	ret = param_set_int(val, kp);
 129	if (binder_stop_on_user_error < 2)
 130		wake_up(&binder_user_error_wait);
 131	return ret;
 132}
 133module_param_call(stop_on_user_error, binder_set_stop_on_user_error,
 134	param_get_int, &binder_stop_on_user_error, 0644);
 135
 136static __printf(2, 3) void binder_debug(int mask, const char *format, ...)
 137{
 138	struct va_format vaf;
 139	va_list args;
 140
 141	if (binder_debug_mask & mask) {
 142		va_start(args, format);
 143		vaf.va = &args;
 144		vaf.fmt = format;
 145		pr_info_ratelimited("%pV", &vaf);
 146		va_end(args);
 147	}
 148}
 149
 150#define binder_txn_error(x...) \
 151	binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, x)
 152
 153static __printf(1, 2) void binder_user_error(const char *format, ...)
 154{
 155	struct va_format vaf;
 156	va_list args;
 157
 158	if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) {
 159		va_start(args, format);
 160		vaf.va = &args;
 161		vaf.fmt = format;
 162		pr_info_ratelimited("%pV", &vaf);
 163		va_end(args);
 164	}
 165
 166	if (binder_stop_on_user_error)
 167		binder_stop_on_user_error = 2;
 168}
 169
 170#define binder_set_extended_error(ee, _id, _command, _param) \
 171	do { \
 172		(ee)->id = _id; \
 173		(ee)->command = _command; \
 174		(ee)->param = _param; \
 
 175	} while (0)
 176
 177#define to_flat_binder_object(hdr) \
 178	container_of(hdr, struct flat_binder_object, hdr)
 179
 180#define to_binder_fd_object(hdr) container_of(hdr, struct binder_fd_object, hdr)
 181
 182#define to_binder_buffer_object(hdr) \
 183	container_of(hdr, struct binder_buffer_object, hdr)
 184
 185#define to_binder_fd_array_object(hdr) \
 186	container_of(hdr, struct binder_fd_array_object, hdr)
 187
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 188static struct binder_stats binder_stats;
 189
 190static inline void binder_stats_deleted(enum binder_stat_types type)
 191{
 192	atomic_inc(&binder_stats.obj_deleted[type]);
 193}
 194
 195static inline void binder_stats_created(enum binder_stat_types type)
 196{
 197	atomic_inc(&binder_stats.obj_created[type]);
 198}
 199
 200struct binder_transaction_log_entry {
 201	int debug_id;
 202	int debug_id_done;
 203	int call_type;
 204	int from_proc;
 205	int from_thread;
 206	int target_handle;
 207	int to_proc;
 208	int to_thread;
 209	int to_node;
 210	int data_size;
 211	int offsets_size;
 212	int return_error_line;
 213	uint32_t return_error;
 214	uint32_t return_error_param;
 215	char context_name[BINDERFS_MAX_NAME + 1];
 216};
 217
 218struct binder_transaction_log {
 219	atomic_t cur;
 220	bool full;
 221	struct binder_transaction_log_entry entry[32];
 222};
 223
 224static struct binder_transaction_log binder_transaction_log;
 225static struct binder_transaction_log binder_transaction_log_failed;
 226
 227static struct binder_transaction_log_entry *binder_transaction_log_add(
 228	struct binder_transaction_log *log)
 229{
 230	struct binder_transaction_log_entry *e;
 231	unsigned int cur = atomic_inc_return(&log->cur);
 232
 233	if (cur >= ARRAY_SIZE(log->entry))
 234		log->full = true;
 235	e = &log->entry[cur % ARRAY_SIZE(log->entry)];
 236	WRITE_ONCE(e->debug_id_done, 0);
 237	/*
 238	 * write-barrier to synchronize access to e->debug_id_done.
 239	 * We make sure the initialized 0 value is seen before
 240	 * memset() other fields are zeroed by memset.
 241	 */
 242	smp_wmb();
 243	memset(e, 0, sizeof(*e));
 244	return e;
 245}
 246
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 247enum binder_deferred_state {
 248	BINDER_DEFERRED_FLUSH        = 0x01,
 249	BINDER_DEFERRED_RELEASE      = 0x02,
 250};
 251
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 252enum {
 253	BINDER_LOOPER_STATE_REGISTERED  = 0x01,
 254	BINDER_LOOPER_STATE_ENTERED     = 0x02,
 255	BINDER_LOOPER_STATE_EXITED      = 0x04,
 256	BINDER_LOOPER_STATE_INVALID     = 0x08,
 257	BINDER_LOOPER_STATE_WAITING     = 0x10,
 258	BINDER_LOOPER_STATE_POLL        = 0x20,
 259};
 260
 261/**
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 262 * binder_proc_lock() - Acquire outer lock for given binder_proc
 263 * @proc:         struct binder_proc to acquire
 264 *
 265 * Acquires proc->outer_lock. Used to protect binder_ref
 266 * structures associated with the given proc.
 267 */
 268#define binder_proc_lock(proc) _binder_proc_lock(proc, __LINE__)
 269static void
 270_binder_proc_lock(struct binder_proc *proc, int line)
 271	__acquires(&proc->outer_lock)
 272{
 273	binder_debug(BINDER_DEBUG_SPINLOCKS,
 274		     "%s: line=%d\n", __func__, line);
 275	spin_lock(&proc->outer_lock);
 276}
 277
 278/**
 279 * binder_proc_unlock() - Release spinlock for given binder_proc
 280 * @proc:         struct binder_proc to acquire
 281 *
 282 * Release lock acquired via binder_proc_lock()
 283 */
 284#define binder_proc_unlock(_proc) _binder_proc_unlock(_proc, __LINE__)
 285static void
 286_binder_proc_unlock(struct binder_proc *proc, int line)
 287	__releases(&proc->outer_lock)
 288{
 289	binder_debug(BINDER_DEBUG_SPINLOCKS,
 290		     "%s: line=%d\n", __func__, line);
 291	spin_unlock(&proc->outer_lock);
 292}
 293
 294/**
 295 * binder_inner_proc_lock() - Acquire inner lock for given binder_proc
 296 * @proc:         struct binder_proc to acquire
 297 *
 298 * Acquires proc->inner_lock. Used to protect todo lists
 299 */
 300#define binder_inner_proc_lock(proc) _binder_inner_proc_lock(proc, __LINE__)
 301static void
 302_binder_inner_proc_lock(struct binder_proc *proc, int line)
 303	__acquires(&proc->inner_lock)
 304{
 305	binder_debug(BINDER_DEBUG_SPINLOCKS,
 306		     "%s: line=%d\n", __func__, line);
 307	spin_lock(&proc->inner_lock);
 308}
 309
 310/**
 311 * binder_inner_proc_unlock() - Release inner lock for given binder_proc
 312 * @proc:         struct binder_proc to acquire
 313 *
 314 * Release lock acquired via binder_inner_proc_lock()
 315 */
 316#define binder_inner_proc_unlock(proc) _binder_inner_proc_unlock(proc, __LINE__)
 317static void
 318_binder_inner_proc_unlock(struct binder_proc *proc, int line)
 319	__releases(&proc->inner_lock)
 320{
 321	binder_debug(BINDER_DEBUG_SPINLOCKS,
 322		     "%s: line=%d\n", __func__, line);
 323	spin_unlock(&proc->inner_lock);
 324}
 325
 326/**
 327 * binder_node_lock() - Acquire spinlock for given binder_node
 328 * @node:         struct binder_node to acquire
 329 *
 330 * Acquires node->lock. Used to protect binder_node fields
 331 */
 332#define binder_node_lock(node) _binder_node_lock(node, __LINE__)
 333static void
 334_binder_node_lock(struct binder_node *node, int line)
 335	__acquires(&node->lock)
 336{
 337	binder_debug(BINDER_DEBUG_SPINLOCKS,
 338		     "%s: line=%d\n", __func__, line);
 339	spin_lock(&node->lock);
 340}
 341
 342/**
 343 * binder_node_unlock() - Release spinlock for given binder_proc
 344 * @node:         struct binder_node to acquire
 345 *
 346 * Release lock acquired via binder_node_lock()
 347 */
 348#define binder_node_unlock(node) _binder_node_unlock(node, __LINE__)
 349static void
 350_binder_node_unlock(struct binder_node *node, int line)
 351	__releases(&node->lock)
 352{
 353	binder_debug(BINDER_DEBUG_SPINLOCKS,
 354		     "%s: line=%d\n", __func__, line);
 355	spin_unlock(&node->lock);
 356}
 357
 358/**
 359 * binder_node_inner_lock() - Acquire node and inner locks
 360 * @node:         struct binder_node to acquire
 361 *
 362 * Acquires node->lock. If node->proc also acquires
 363 * proc->inner_lock. Used to protect binder_node fields
 364 */
 365#define binder_node_inner_lock(node) _binder_node_inner_lock(node, __LINE__)
 366static void
 367_binder_node_inner_lock(struct binder_node *node, int line)
 368	__acquires(&node->lock) __acquires(&node->proc->inner_lock)
 369{
 370	binder_debug(BINDER_DEBUG_SPINLOCKS,
 371		     "%s: line=%d\n", __func__, line);
 372	spin_lock(&node->lock);
 373	if (node->proc)
 374		binder_inner_proc_lock(node->proc);
 375	else
 376		/* annotation for sparse */
 377		__acquire(&node->proc->inner_lock);
 378}
 379
 380/**
 381 * binder_node_unlock() - Release node and inner locks
 382 * @node:         struct binder_node to acquire
 383 *
 384 * Release lock acquired via binder_node_lock()
 385 */
 386#define binder_node_inner_unlock(node) _binder_node_inner_unlock(node, __LINE__)
 387static void
 388_binder_node_inner_unlock(struct binder_node *node, int line)
 389	__releases(&node->lock) __releases(&node->proc->inner_lock)
 390{
 391	struct binder_proc *proc = node->proc;
 392
 393	binder_debug(BINDER_DEBUG_SPINLOCKS,
 394		     "%s: line=%d\n", __func__, line);
 395	if (proc)
 396		binder_inner_proc_unlock(proc);
 397	else
 398		/* annotation for sparse */
 399		__release(&node->proc->inner_lock);
 400	spin_unlock(&node->lock);
 401}
 402
 403static bool binder_worklist_empty_ilocked(struct list_head *list)
 404{
 405	return list_empty(list);
 406}
 407
 408/**
 409 * binder_worklist_empty() - Check if no items on the work list
 410 * @proc:       binder_proc associated with list
 411 * @list:	list to check
 412 *
 413 * Return: true if there are no items on list, else false
 414 */
 415static bool binder_worklist_empty(struct binder_proc *proc,
 416				  struct list_head *list)
 417{
 418	bool ret;
 419
 420	binder_inner_proc_lock(proc);
 421	ret = binder_worklist_empty_ilocked(list);
 422	binder_inner_proc_unlock(proc);
 423	return ret;
 424}
 425
 426/**
 427 * binder_enqueue_work_ilocked() - Add an item to the work list
 428 * @work:         struct binder_work to add to list
 429 * @target_list:  list to add work to
 430 *
 431 * Adds the work to the specified list. Asserts that work
 432 * is not already on a list.
 433 *
 434 * Requires the proc->inner_lock to be held.
 435 */
 436static void
 437binder_enqueue_work_ilocked(struct binder_work *work,
 438			   struct list_head *target_list)
 439{
 440	BUG_ON(target_list == NULL);
 441	BUG_ON(work->entry.next && !list_empty(&work->entry));
 442	list_add_tail(&work->entry, target_list);
 443}
 444
 445/**
 446 * binder_enqueue_deferred_thread_work_ilocked() - Add deferred thread work
 447 * @thread:       thread to queue work to
 448 * @work:         struct binder_work to add to list
 449 *
 450 * Adds the work to the todo list of the thread. Doesn't set the process_todo
 451 * flag, which means that (if it wasn't already set) the thread will go to
 452 * sleep without handling this work when it calls read.
 453 *
 454 * Requires the proc->inner_lock to be held.
 455 */
 456static void
 457binder_enqueue_deferred_thread_work_ilocked(struct binder_thread *thread,
 458					    struct binder_work *work)
 459{
 460	WARN_ON(!list_empty(&thread->waiting_thread_node));
 461	binder_enqueue_work_ilocked(work, &thread->todo);
 462}
 463
 464/**
 465 * binder_enqueue_thread_work_ilocked() - Add an item to the thread work list
 466 * @thread:       thread to queue work to
 467 * @work:         struct binder_work to add to list
 468 *
 469 * Adds the work to the todo list of the thread, and enables processing
 470 * of the todo queue.
 471 *
 472 * Requires the proc->inner_lock to be held.
 473 */
 474static void
 475binder_enqueue_thread_work_ilocked(struct binder_thread *thread,
 476				   struct binder_work *work)
 477{
 478	WARN_ON(!list_empty(&thread->waiting_thread_node));
 479	binder_enqueue_work_ilocked(work, &thread->todo);
 480	thread->process_todo = true;
 481}
 482
 483/**
 484 * binder_enqueue_thread_work() - Add an item to the thread work list
 485 * @thread:       thread to queue work to
 486 * @work:         struct binder_work to add to list
 487 *
 488 * Adds the work to the todo list of the thread, and enables processing
 489 * of the todo queue.
 490 */
 491static void
 492binder_enqueue_thread_work(struct binder_thread *thread,
 493			   struct binder_work *work)
 494{
 495	binder_inner_proc_lock(thread->proc);
 496	binder_enqueue_thread_work_ilocked(thread, work);
 497	binder_inner_proc_unlock(thread->proc);
 498}
 499
 500static void
 501binder_dequeue_work_ilocked(struct binder_work *work)
 502{
 503	list_del_init(&work->entry);
 504}
 505
 506/**
 507 * binder_dequeue_work() - Removes an item from the work list
 508 * @proc:         binder_proc associated with list
 509 * @work:         struct binder_work to remove from list
 510 *
 511 * Removes the specified work item from whatever list it is on.
 512 * Can safely be called if work is not on any list.
 513 */
 514static void
 515binder_dequeue_work(struct binder_proc *proc, struct binder_work *work)
 516{
 517	binder_inner_proc_lock(proc);
 518	binder_dequeue_work_ilocked(work);
 519	binder_inner_proc_unlock(proc);
 520}
 521
 522static struct binder_work *binder_dequeue_work_head_ilocked(
 523					struct list_head *list)
 524{
 525	struct binder_work *w;
 526
 527	w = list_first_entry_or_null(list, struct binder_work, entry);
 528	if (w)
 529		list_del_init(&w->entry);
 530	return w;
 531}
 532
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 533static void
 534binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer);
 535static void binder_free_thread(struct binder_thread *thread);
 536static void binder_free_proc(struct binder_proc *proc);
 537static void binder_inc_node_tmpref_ilocked(struct binder_node *node);
 538
 539static bool binder_has_work_ilocked(struct binder_thread *thread,
 540				    bool do_proc_work)
 541{
 542	return thread->process_todo ||
 543		thread->looper_need_return ||
 544		(do_proc_work &&
 545		 !binder_worklist_empty_ilocked(&thread->proc->todo));
 546}
 547
 548static bool binder_has_work(struct binder_thread *thread, bool do_proc_work)
 549{
 550	bool has_work;
 551
 552	binder_inner_proc_lock(thread->proc);
 553	has_work = binder_has_work_ilocked(thread, do_proc_work);
 554	binder_inner_proc_unlock(thread->proc);
 555
 556	return has_work;
 557}
 558
 559static bool binder_available_for_proc_work_ilocked(struct binder_thread *thread)
 560{
 561	return !thread->transaction_stack &&
 562		binder_worklist_empty_ilocked(&thread->todo) &&
 563		(thread->looper & (BINDER_LOOPER_STATE_ENTERED |
 564				   BINDER_LOOPER_STATE_REGISTERED));
 565}
 566
 567static void binder_wakeup_poll_threads_ilocked(struct binder_proc *proc,
 568					       bool sync)
 569{
 570	struct rb_node *n;
 571	struct binder_thread *thread;
 572
 573	for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) {
 574		thread = rb_entry(n, struct binder_thread, rb_node);
 575		if (thread->looper & BINDER_LOOPER_STATE_POLL &&
 576		    binder_available_for_proc_work_ilocked(thread)) {
 577			if (sync)
 578				wake_up_interruptible_sync(&thread->wait);
 579			else
 580				wake_up_interruptible(&thread->wait);
 581		}
 582	}
 583}
 584
 585/**
 586 * binder_select_thread_ilocked() - selects a thread for doing proc work.
 587 * @proc:	process to select a thread from
 588 *
 589 * Note that calling this function moves the thread off the waiting_threads
 590 * list, so it can only be woken up by the caller of this function, or a
 591 * signal. Therefore, callers *should* always wake up the thread this function
 592 * returns.
 593 *
 594 * Return:	If there's a thread currently waiting for process work,
 595 *		returns that thread. Otherwise returns NULL.
 596 */
 597static struct binder_thread *
 598binder_select_thread_ilocked(struct binder_proc *proc)
 599{
 600	struct binder_thread *thread;
 601
 602	assert_spin_locked(&proc->inner_lock);
 603	thread = list_first_entry_or_null(&proc->waiting_threads,
 604					  struct binder_thread,
 605					  waiting_thread_node);
 606
 607	if (thread)
 608		list_del_init(&thread->waiting_thread_node);
 609
 610	return thread;
 611}
 612
 613/**
 614 * binder_wakeup_thread_ilocked() - wakes up a thread for doing proc work.
 615 * @proc:	process to wake up a thread in
 616 * @thread:	specific thread to wake-up (may be NULL)
 617 * @sync:	whether to do a synchronous wake-up
 618 *
 619 * This function wakes up a thread in the @proc process.
 620 * The caller may provide a specific thread to wake-up in
 621 * the @thread parameter. If @thread is NULL, this function
 622 * will wake up threads that have called poll().
 623 *
 624 * Note that for this function to work as expected, callers
 625 * should first call binder_select_thread() to find a thread
 626 * to handle the work (if they don't have a thread already),
 627 * and pass the result into the @thread parameter.
 628 */
 629static void binder_wakeup_thread_ilocked(struct binder_proc *proc,
 630					 struct binder_thread *thread,
 631					 bool sync)
 632{
 633	assert_spin_locked(&proc->inner_lock);
 634
 635	if (thread) {
 636		if (sync)
 637			wake_up_interruptible_sync(&thread->wait);
 638		else
 639			wake_up_interruptible(&thread->wait);
 640		return;
 641	}
 642
 643	/* Didn't find a thread waiting for proc work; this can happen
 644	 * in two scenarios:
 645	 * 1. All threads are busy handling transactions
 646	 *    In that case, one of those threads should call back into
 647	 *    the kernel driver soon and pick up this work.
 648	 * 2. Threads are using the (e)poll interface, in which case
 649	 *    they may be blocked on the waitqueue without having been
 650	 *    added to waiting_threads. For this case, we just iterate
 651	 *    over all threads not handling transaction work, and
 652	 *    wake them all up. We wake all because we don't know whether
 653	 *    a thread that called into (e)poll is handling non-binder
 654	 *    work currently.
 655	 */
 656	binder_wakeup_poll_threads_ilocked(proc, sync);
 657}
 658
 659static void binder_wakeup_proc_ilocked(struct binder_proc *proc)
 660{
 661	struct binder_thread *thread = binder_select_thread_ilocked(proc);
 662
 663	binder_wakeup_thread_ilocked(proc, thread, /* sync = */false);
 664}
 665
 666static void binder_set_nice(long nice)
 667{
 668	long min_nice;
 669
 670	if (can_nice(current, nice)) {
 671		set_user_nice(current, nice);
 672		return;
 673	}
 674	min_nice = rlimit_to_nice(rlimit(RLIMIT_NICE));
 675	binder_debug(BINDER_DEBUG_PRIORITY_CAP,
 676		     "%d: nice value %ld not allowed use %ld instead\n",
 677		      current->pid, nice, min_nice);
 678	set_user_nice(current, min_nice);
 679	if (min_nice <= MAX_NICE)
 680		return;
 681	binder_user_error("%d RLIMIT_NICE not set\n", current->pid);
 682}
 683
 684static struct binder_node *binder_get_node_ilocked(struct binder_proc *proc,
 685						   binder_uintptr_t ptr)
 686{
 687	struct rb_node *n = proc->nodes.rb_node;
 688	struct binder_node *node;
 689
 690	assert_spin_locked(&proc->inner_lock);
 691
 692	while (n) {
 693		node = rb_entry(n, struct binder_node, rb_node);
 694
 695		if (ptr < node->ptr)
 696			n = n->rb_left;
 697		else if (ptr > node->ptr)
 698			n = n->rb_right;
 699		else {
 700			/*
 701			 * take an implicit weak reference
 702			 * to ensure node stays alive until
 703			 * call to binder_put_node()
 704			 */
 705			binder_inc_node_tmpref_ilocked(node);
 706			return node;
 707		}
 708	}
 709	return NULL;
 710}
 711
 712static struct binder_node *binder_get_node(struct binder_proc *proc,
 713					   binder_uintptr_t ptr)
 714{
 715	struct binder_node *node;
 716
 717	binder_inner_proc_lock(proc);
 718	node = binder_get_node_ilocked(proc, ptr);
 719	binder_inner_proc_unlock(proc);
 720	return node;
 721}
 722
 723static struct binder_node *binder_init_node_ilocked(
 724						struct binder_proc *proc,
 725						struct binder_node *new_node,
 726						struct flat_binder_object *fp)
 727{
 728	struct rb_node **p = &proc->nodes.rb_node;
 729	struct rb_node *parent = NULL;
 730	struct binder_node *node;
 731	binder_uintptr_t ptr = fp ? fp->binder : 0;
 732	binder_uintptr_t cookie = fp ? fp->cookie : 0;
 733	__u32 flags = fp ? fp->flags : 0;
 734
 735	assert_spin_locked(&proc->inner_lock);
 736
 737	while (*p) {
 738
 739		parent = *p;
 740		node = rb_entry(parent, struct binder_node, rb_node);
 741
 742		if (ptr < node->ptr)
 743			p = &(*p)->rb_left;
 744		else if (ptr > node->ptr)
 745			p = &(*p)->rb_right;
 746		else {
 747			/*
 748			 * A matching node is already in
 749			 * the rb tree. Abandon the init
 750			 * and return it.
 751			 */
 752			binder_inc_node_tmpref_ilocked(node);
 753			return node;
 754		}
 755	}
 756	node = new_node;
 757	binder_stats_created(BINDER_STAT_NODE);
 758	node->tmp_refs++;
 759	rb_link_node(&node->rb_node, parent, p);
 760	rb_insert_color(&node->rb_node, &proc->nodes);
 761	node->debug_id = atomic_inc_return(&binder_last_id);
 762	node->proc = proc;
 763	node->ptr = ptr;
 764	node->cookie = cookie;
 765	node->work.type = BINDER_WORK_NODE;
 766	node->min_priority = flags & FLAT_BINDER_FLAG_PRIORITY_MASK;
 767	node->accept_fds = !!(flags & FLAT_BINDER_FLAG_ACCEPTS_FDS);
 768	node->txn_security_ctx = !!(flags & FLAT_BINDER_FLAG_TXN_SECURITY_CTX);
 769	spin_lock_init(&node->lock);
 770	INIT_LIST_HEAD(&node->work.entry);
 771	INIT_LIST_HEAD(&node->async_todo);
 772	binder_debug(BINDER_DEBUG_INTERNAL_REFS,
 773		     "%d:%d node %d u%016llx c%016llx created\n",
 774		     proc->pid, current->pid, node->debug_id,
 775		     (u64)node->ptr, (u64)node->cookie);
 776
 777	return node;
 778}
 779
 780static struct binder_node *binder_new_node(struct binder_proc *proc,
 781					   struct flat_binder_object *fp)
 782{
 783	struct binder_node *node;
 784	struct binder_node *new_node = kzalloc(sizeof(*node), GFP_KERNEL);
 785
 786	if (!new_node)
 787		return NULL;
 788	binder_inner_proc_lock(proc);
 789	node = binder_init_node_ilocked(proc, new_node, fp);
 790	binder_inner_proc_unlock(proc);
 791	if (node != new_node)
 792		/*
 793		 * The node was already added by another thread
 794		 */
 795		kfree(new_node);
 796
 797	return node;
 798}
 799
 800static void binder_free_node(struct binder_node *node)
 801{
 802	kfree(node);
 803	binder_stats_deleted(BINDER_STAT_NODE);
 804}
 805
 806static int binder_inc_node_nilocked(struct binder_node *node, int strong,
 807				    int internal,
 808				    struct list_head *target_list)
 809{
 810	struct binder_proc *proc = node->proc;
 811
 812	assert_spin_locked(&node->lock);
 813	if (proc)
 814		assert_spin_locked(&proc->inner_lock);
 815	if (strong) {
 816		if (internal) {
 817			if (target_list == NULL &&
 818			    node->internal_strong_refs == 0 &&
 819			    !(node->proc &&
 820			      node == node->proc->context->binder_context_mgr_node &&
 821			      node->has_strong_ref)) {
 822				pr_err("invalid inc strong node for %d\n",
 823					node->debug_id);
 824				return -EINVAL;
 825			}
 826			node->internal_strong_refs++;
 827		} else
 828			node->local_strong_refs++;
 829		if (!node->has_strong_ref && target_list) {
 830			struct binder_thread *thread = container_of(target_list,
 831						    struct binder_thread, todo);
 832			binder_dequeue_work_ilocked(&node->work);
 833			BUG_ON(&thread->todo != target_list);
 834			binder_enqueue_deferred_thread_work_ilocked(thread,
 835								   &node->work);
 836		}
 837	} else {
 838		if (!internal)
 839			node->local_weak_refs++;
 840		if (!node->has_weak_ref && list_empty(&node->work.entry)) {
 841			if (target_list == NULL) {
 842				pr_err("invalid inc weak node for %d\n",
 843					node->debug_id);
 844				return -EINVAL;
 845			}
 846			/*
 847			 * See comment above
 848			 */
 849			binder_enqueue_work_ilocked(&node->work, target_list);
 850		}
 851	}
 852	return 0;
 853}
 854
 855static int binder_inc_node(struct binder_node *node, int strong, int internal,
 856			   struct list_head *target_list)
 857{
 858	int ret;
 859
 860	binder_node_inner_lock(node);
 861	ret = binder_inc_node_nilocked(node, strong, internal, target_list);
 862	binder_node_inner_unlock(node);
 863
 864	return ret;
 865}
 866
 867static bool binder_dec_node_nilocked(struct binder_node *node,
 868				     int strong, int internal)
 869{
 870	struct binder_proc *proc = node->proc;
 871
 872	assert_spin_locked(&node->lock);
 873	if (proc)
 874		assert_spin_locked(&proc->inner_lock);
 875	if (strong) {
 876		if (internal)
 877			node->internal_strong_refs--;
 878		else
 879			node->local_strong_refs--;
 880		if (node->local_strong_refs || node->internal_strong_refs)
 881			return false;
 882	} else {
 883		if (!internal)
 884			node->local_weak_refs--;
 885		if (node->local_weak_refs || node->tmp_refs ||
 886				!hlist_empty(&node->refs))
 887			return false;
 888	}
 889
 890	if (proc && (node->has_strong_ref || node->has_weak_ref)) {
 891		if (list_empty(&node->work.entry)) {
 892			binder_enqueue_work_ilocked(&node->work, &proc->todo);
 893			binder_wakeup_proc_ilocked(proc);
 894		}
 895	} else {
 896		if (hlist_empty(&node->refs) && !node->local_strong_refs &&
 897		    !node->local_weak_refs && !node->tmp_refs) {
 898			if (proc) {
 899				binder_dequeue_work_ilocked(&node->work);
 900				rb_erase(&node->rb_node, &proc->nodes);
 901				binder_debug(BINDER_DEBUG_INTERNAL_REFS,
 902					     "refless node %d deleted\n",
 903					     node->debug_id);
 904			} else {
 905				BUG_ON(!list_empty(&node->work.entry));
 906				spin_lock(&binder_dead_nodes_lock);
 907				/*
 908				 * tmp_refs could have changed so
 909				 * check it again
 910				 */
 911				if (node->tmp_refs) {
 912					spin_unlock(&binder_dead_nodes_lock);
 913					return false;
 914				}
 915				hlist_del(&node->dead_node);
 916				spin_unlock(&binder_dead_nodes_lock);
 917				binder_debug(BINDER_DEBUG_INTERNAL_REFS,
 918					     "dead node %d deleted\n",
 919					     node->debug_id);
 920			}
 921			return true;
 922		}
 923	}
 924	return false;
 925}
 926
 927static void binder_dec_node(struct binder_node *node, int strong, int internal)
 928{
 929	bool free_node;
 930
 931	binder_node_inner_lock(node);
 932	free_node = binder_dec_node_nilocked(node, strong, internal);
 933	binder_node_inner_unlock(node);
 934	if (free_node)
 935		binder_free_node(node);
 936}
 937
 938static void binder_inc_node_tmpref_ilocked(struct binder_node *node)
 939{
 940	/*
 941	 * No call to binder_inc_node() is needed since we
 942	 * don't need to inform userspace of any changes to
 943	 * tmp_refs
 944	 */
 945	node->tmp_refs++;
 946}
 947
 948/**
 949 * binder_inc_node_tmpref() - take a temporary reference on node
 950 * @node:	node to reference
 951 *
 952 * Take reference on node to prevent the node from being freed
 953 * while referenced only by a local variable. The inner lock is
 954 * needed to serialize with the node work on the queue (which
 955 * isn't needed after the node is dead). If the node is dead
 956 * (node->proc is NULL), use binder_dead_nodes_lock to protect
 957 * node->tmp_refs against dead-node-only cases where the node
 958 * lock cannot be acquired (eg traversing the dead node list to
 959 * print nodes)
 960 */
 961static void binder_inc_node_tmpref(struct binder_node *node)
 962{
 963	binder_node_lock(node);
 964	if (node->proc)
 965		binder_inner_proc_lock(node->proc);
 966	else
 967		spin_lock(&binder_dead_nodes_lock);
 968	binder_inc_node_tmpref_ilocked(node);
 969	if (node->proc)
 970		binder_inner_proc_unlock(node->proc);
 971	else
 972		spin_unlock(&binder_dead_nodes_lock);
 973	binder_node_unlock(node);
 974}
 975
 976/**
 977 * binder_dec_node_tmpref() - remove a temporary reference on node
 978 * @node:	node to reference
 979 *
 980 * Release temporary reference on node taken via binder_inc_node_tmpref()
 981 */
 982static void binder_dec_node_tmpref(struct binder_node *node)
 983{
 984	bool free_node;
 985
 986	binder_node_inner_lock(node);
 987	if (!node->proc)
 988		spin_lock(&binder_dead_nodes_lock);
 989	else
 990		__acquire(&binder_dead_nodes_lock);
 991	node->tmp_refs--;
 992	BUG_ON(node->tmp_refs < 0);
 993	if (!node->proc)
 994		spin_unlock(&binder_dead_nodes_lock);
 995	else
 996		__release(&binder_dead_nodes_lock);
 997	/*
 998	 * Call binder_dec_node() to check if all refcounts are 0
 999	 * and cleanup is needed. Calling with strong=0 and internal=1
1000	 * causes no actual reference to be released in binder_dec_node().
1001	 * If that changes, a change is needed here too.
1002	 */
1003	free_node = binder_dec_node_nilocked(node, 0, 1);
1004	binder_node_inner_unlock(node);
1005	if (free_node)
1006		binder_free_node(node);
1007}
1008
1009static void binder_put_node(struct binder_node *node)
1010{
1011	binder_dec_node_tmpref(node);
1012}
1013
1014static struct binder_ref *binder_get_ref_olocked(struct binder_proc *proc,
1015						 u32 desc, bool need_strong_ref)
1016{
1017	struct rb_node *n = proc->refs_by_desc.rb_node;
1018	struct binder_ref *ref;
1019
1020	while (n) {
1021		ref = rb_entry(n, struct binder_ref, rb_node_desc);
1022
1023		if (desc < ref->data.desc) {
1024			n = n->rb_left;
1025		} else if (desc > ref->data.desc) {
1026			n = n->rb_right;
1027		} else if (need_strong_ref && !ref->data.strong) {
1028			binder_user_error("tried to use weak ref as strong ref\n");
1029			return NULL;
1030		} else {
1031			return ref;
1032		}
1033	}
1034	return NULL;
1035}
1036
1037/**
1038 * binder_get_ref_for_node_olocked() - get the ref associated with given node
1039 * @proc:	binder_proc that owns the ref
1040 * @node:	binder_node of target
1041 * @new_ref:	newly allocated binder_ref to be initialized or %NULL
1042 *
1043 * Look up the ref for the given node and return it if it exists
1044 *
1045 * If it doesn't exist and the caller provides a newly allocated
1046 * ref, initialize the fields of the newly allocated ref and insert
1047 * into the given proc rb_trees and node refs list.
1048 *
1049 * Return:	the ref for node. It is possible that another thread
1050 *		allocated/initialized the ref first in which case the
1051 *		returned ref would be different than the passed-in
1052 *		new_ref. new_ref must be kfree'd by the caller in
1053 *		this case.
1054 */
1055static struct binder_ref *binder_get_ref_for_node_olocked(
1056					struct binder_proc *proc,
1057					struct binder_node *node,
1058					struct binder_ref *new_ref)
1059{
1060	struct binder_context *context = proc->context;
1061	struct rb_node **p = &proc->refs_by_node.rb_node;
1062	struct rb_node *parent = NULL;
1063	struct binder_ref *ref;
1064	struct rb_node *n;
1065
1066	while (*p) {
1067		parent = *p;
1068		ref = rb_entry(parent, struct binder_ref, rb_node_node);
1069
1070		if (node < ref->node)
1071			p = &(*p)->rb_left;
1072		else if (node > ref->node)
1073			p = &(*p)->rb_right;
1074		else
1075			return ref;
1076	}
1077	if (!new_ref)
1078		return NULL;
1079
1080	binder_stats_created(BINDER_STAT_REF);
1081	new_ref->data.debug_id = atomic_inc_return(&binder_last_id);
1082	new_ref->proc = proc;
1083	new_ref->node = node;
1084	rb_link_node(&new_ref->rb_node_node, parent, p);
1085	rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node);
1086
1087	new_ref->data.desc = (node == context->binder_context_mgr_node) ? 0 : 1;
1088	for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) {
1089		ref = rb_entry(n, struct binder_ref, rb_node_desc);
1090		if (ref->data.desc > new_ref->data.desc)
1091			break;
1092		new_ref->data.desc = ref->data.desc + 1;
1093	}
1094
1095	p = &proc->refs_by_desc.rb_node;
1096	while (*p) {
1097		parent = *p;
1098		ref = rb_entry(parent, struct binder_ref, rb_node_desc);
1099
1100		if (new_ref->data.desc < ref->data.desc)
1101			p = &(*p)->rb_left;
1102		else if (new_ref->data.desc > ref->data.desc)
1103			p = &(*p)->rb_right;
1104		else
1105			BUG();
1106	}
1107	rb_link_node(&new_ref->rb_node_desc, parent, p);
1108	rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc);
1109
1110	binder_node_lock(node);
1111	hlist_add_head(&new_ref->node_entry, &node->refs);
1112
1113	binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1114		     "%d new ref %d desc %d for node %d\n",
1115		      proc->pid, new_ref->data.debug_id, new_ref->data.desc,
1116		      node->debug_id);
1117	binder_node_unlock(node);
1118	return new_ref;
1119}
1120
1121static void binder_cleanup_ref_olocked(struct binder_ref *ref)
1122{
1123	bool delete_node = false;
1124
1125	binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1126		     "%d delete ref %d desc %d for node %d\n",
1127		      ref->proc->pid, ref->data.debug_id, ref->data.desc,
1128		      ref->node->debug_id);
1129
1130	rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc);
1131	rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node);
1132
1133	binder_node_inner_lock(ref->node);
1134	if (ref->data.strong)
1135		binder_dec_node_nilocked(ref->node, 1, 1);
1136
1137	hlist_del(&ref->node_entry);
1138	delete_node = binder_dec_node_nilocked(ref->node, 0, 1);
1139	binder_node_inner_unlock(ref->node);
1140	/*
1141	 * Clear ref->node unless we want the caller to free the node
1142	 */
1143	if (!delete_node) {
1144		/*
1145		 * The caller uses ref->node to determine
1146		 * whether the node needs to be freed. Clear
1147		 * it since the node is still alive.
1148		 */
1149		ref->node = NULL;
1150	}
1151
1152	if (ref->death) {
1153		binder_debug(BINDER_DEBUG_DEAD_BINDER,
1154			     "%d delete ref %d desc %d has death notification\n",
1155			      ref->proc->pid, ref->data.debug_id,
1156			      ref->data.desc);
1157		binder_dequeue_work(ref->proc, &ref->death->work);
1158		binder_stats_deleted(BINDER_STAT_DEATH);
1159	}
1160	binder_stats_deleted(BINDER_STAT_REF);
1161}
1162
1163/**
1164 * binder_inc_ref_olocked() - increment the ref for given handle
1165 * @ref:         ref to be incremented
1166 * @strong:      if true, strong increment, else weak
1167 * @target_list: list to queue node work on
1168 *
1169 * Increment the ref. @ref->proc->outer_lock must be held on entry
1170 *
1171 * Return: 0, if successful, else errno
1172 */
1173static int binder_inc_ref_olocked(struct binder_ref *ref, int strong,
1174				  struct list_head *target_list)
1175{
1176	int ret;
1177
1178	if (strong) {
1179		if (ref->data.strong == 0) {
1180			ret = binder_inc_node(ref->node, 1, 1, target_list);
1181			if (ret)
1182				return ret;
1183		}
1184		ref->data.strong++;
1185	} else {
1186		if (ref->data.weak == 0) {
1187			ret = binder_inc_node(ref->node, 0, 1, target_list);
1188			if (ret)
1189				return ret;
1190		}
1191		ref->data.weak++;
1192	}
1193	return 0;
1194}
1195
1196/**
1197 * binder_dec_ref() - dec the ref for given handle
1198 * @ref:	ref to be decremented
1199 * @strong:	if true, strong decrement, else weak
1200 *
1201 * Decrement the ref.
1202 *
1203 * Return: true if ref is cleaned up and ready to be freed
1204 */
1205static bool binder_dec_ref_olocked(struct binder_ref *ref, int strong)
1206{
1207	if (strong) {
1208		if (ref->data.strong == 0) {
1209			binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n",
1210					  ref->proc->pid, ref->data.debug_id,
1211					  ref->data.desc, ref->data.strong,
1212					  ref->data.weak);
1213			return false;
1214		}
1215		ref->data.strong--;
1216		if (ref->data.strong == 0)
1217			binder_dec_node(ref->node, strong, 1);
1218	} else {
1219		if (ref->data.weak == 0) {
1220			binder_user_error("%d invalid dec weak, ref %d desc %d s %d w %d\n",
1221					  ref->proc->pid, ref->data.debug_id,
1222					  ref->data.desc, ref->data.strong,
1223					  ref->data.weak);
1224			return false;
1225		}
1226		ref->data.weak--;
1227	}
1228	if (ref->data.strong == 0 && ref->data.weak == 0) {
1229		binder_cleanup_ref_olocked(ref);
1230		return true;
1231	}
1232	return false;
1233}
1234
1235/**
1236 * binder_get_node_from_ref() - get the node from the given proc/desc
1237 * @proc:	proc containing the ref
1238 * @desc:	the handle associated with the ref
1239 * @need_strong_ref: if true, only return node if ref is strong
1240 * @rdata:	the id/refcount data for the ref
1241 *
1242 * Given a proc and ref handle, return the associated binder_node
1243 *
1244 * Return: a binder_node or NULL if not found or not strong when strong required
1245 */
1246static struct binder_node *binder_get_node_from_ref(
1247		struct binder_proc *proc,
1248		u32 desc, bool need_strong_ref,
1249		struct binder_ref_data *rdata)
1250{
1251	struct binder_node *node;
1252	struct binder_ref *ref;
1253
1254	binder_proc_lock(proc);
1255	ref = binder_get_ref_olocked(proc, desc, need_strong_ref);
1256	if (!ref)
1257		goto err_no_ref;
1258	node = ref->node;
1259	/*
1260	 * Take an implicit reference on the node to ensure
1261	 * it stays alive until the call to binder_put_node()
1262	 */
1263	binder_inc_node_tmpref(node);
1264	if (rdata)
1265		*rdata = ref->data;
1266	binder_proc_unlock(proc);
1267
1268	return node;
1269
1270err_no_ref:
1271	binder_proc_unlock(proc);
1272	return NULL;
1273}
1274
1275/**
1276 * binder_free_ref() - free the binder_ref
1277 * @ref:	ref to free
1278 *
1279 * Free the binder_ref. Free the binder_node indicated by ref->node
1280 * (if non-NULL) and the binder_ref_death indicated by ref->death.
1281 */
1282static void binder_free_ref(struct binder_ref *ref)
1283{
1284	if (ref->node)
1285		binder_free_node(ref->node);
1286	kfree(ref->death);
1287	kfree(ref);
1288}
1289
1290/**
1291 * binder_update_ref_for_handle() - inc/dec the ref for given handle
1292 * @proc:	proc containing the ref
1293 * @desc:	the handle associated with the ref
1294 * @increment:	true=inc reference, false=dec reference
1295 * @strong:	true=strong reference, false=weak reference
1296 * @rdata:	the id/refcount data for the ref
1297 *
1298 * Given a proc and ref handle, increment or decrement the ref
1299 * according to "increment" arg.
1300 *
1301 * Return: 0 if successful, else errno
1302 */
1303static int binder_update_ref_for_handle(struct binder_proc *proc,
1304		uint32_t desc, bool increment, bool strong,
1305		struct binder_ref_data *rdata)
1306{
1307	int ret = 0;
1308	struct binder_ref *ref;
1309	bool delete_ref = false;
1310
1311	binder_proc_lock(proc);
1312	ref = binder_get_ref_olocked(proc, desc, strong);
1313	if (!ref) {
1314		ret = -EINVAL;
1315		goto err_no_ref;
1316	}
1317	if (increment)
1318		ret = binder_inc_ref_olocked(ref, strong, NULL);
1319	else
1320		delete_ref = binder_dec_ref_olocked(ref, strong);
1321
1322	if (rdata)
1323		*rdata = ref->data;
1324	binder_proc_unlock(proc);
1325
1326	if (delete_ref)
1327		binder_free_ref(ref);
1328	return ret;
1329
1330err_no_ref:
1331	binder_proc_unlock(proc);
1332	return ret;
1333}
1334
1335/**
1336 * binder_dec_ref_for_handle() - dec the ref for given handle
1337 * @proc:	proc containing the ref
1338 * @desc:	the handle associated with the ref
1339 * @strong:	true=strong reference, false=weak reference
1340 * @rdata:	the id/refcount data for the ref
1341 *
1342 * Just calls binder_update_ref_for_handle() to decrement the ref.
1343 *
1344 * Return: 0 if successful, else errno
1345 */
1346static int binder_dec_ref_for_handle(struct binder_proc *proc,
1347		uint32_t desc, bool strong, struct binder_ref_data *rdata)
1348{
1349	return binder_update_ref_for_handle(proc, desc, false, strong, rdata);
1350}
1351
1352
1353/**
1354 * binder_inc_ref_for_node() - increment the ref for given proc/node
1355 * @proc:	 proc containing the ref
1356 * @node:	 target node
1357 * @strong:	 true=strong reference, false=weak reference
1358 * @target_list: worklist to use if node is incremented
1359 * @rdata:	 the id/refcount data for the ref
1360 *
1361 * Given a proc and node, increment the ref. Create the ref if it
1362 * doesn't already exist
1363 *
1364 * Return: 0 if successful, else errno
1365 */
1366static int binder_inc_ref_for_node(struct binder_proc *proc,
1367			struct binder_node *node,
1368			bool strong,
1369			struct list_head *target_list,
1370			struct binder_ref_data *rdata)
1371{
1372	struct binder_ref *ref;
1373	struct binder_ref *new_ref = NULL;
1374	int ret = 0;
1375
1376	binder_proc_lock(proc);
1377	ref = binder_get_ref_for_node_olocked(proc, node, NULL);
1378	if (!ref) {
1379		binder_proc_unlock(proc);
1380		new_ref = kzalloc(sizeof(*ref), GFP_KERNEL);
1381		if (!new_ref)
1382			return -ENOMEM;
1383		binder_proc_lock(proc);
1384		ref = binder_get_ref_for_node_olocked(proc, node, new_ref);
1385	}
1386	ret = binder_inc_ref_olocked(ref, strong, target_list);
1387	*rdata = ref->data;
1388	if (ret && ref == new_ref) {
1389		/*
1390		 * Cleanup the failed reference here as the target
1391		 * could now be dead and have already released its
1392		 * references by now. Calling on the new reference
1393		 * with strong=0 and a tmp_refs will not decrement
1394		 * the node. The new_ref gets kfree'd below.
1395		 */
1396		binder_cleanup_ref_olocked(new_ref);
1397		ref = NULL;
1398	}
1399
1400	binder_proc_unlock(proc);
1401	if (new_ref && ref != new_ref)
1402		/*
1403		 * Another thread created the ref first so
1404		 * free the one we allocated
1405		 */
1406		kfree(new_ref);
1407	return ret;
1408}
1409
1410static void binder_pop_transaction_ilocked(struct binder_thread *target_thread,
1411					   struct binder_transaction *t)
1412{
1413	BUG_ON(!target_thread);
1414	assert_spin_locked(&target_thread->proc->inner_lock);
1415	BUG_ON(target_thread->transaction_stack != t);
1416	BUG_ON(target_thread->transaction_stack->from != target_thread);
1417	target_thread->transaction_stack =
1418		target_thread->transaction_stack->from_parent;
1419	t->from = NULL;
1420}
1421
1422/**
1423 * binder_thread_dec_tmpref() - decrement thread->tmp_ref
1424 * @thread:	thread to decrement
1425 *
1426 * A thread needs to be kept alive while being used to create or
1427 * handle a transaction. binder_get_txn_from() is used to safely
1428 * extract t->from from a binder_transaction and keep the thread
1429 * indicated by t->from from being freed. When done with that
1430 * binder_thread, this function is called to decrement the
1431 * tmp_ref and free if appropriate (thread has been released
1432 * and no transaction being processed by the driver)
1433 */
1434static void binder_thread_dec_tmpref(struct binder_thread *thread)
1435{
1436	/*
1437	 * atomic is used to protect the counter value while
1438	 * it cannot reach zero or thread->is_dead is false
1439	 */
1440	binder_inner_proc_lock(thread->proc);
1441	atomic_dec(&thread->tmp_ref);
1442	if (thread->is_dead && !atomic_read(&thread->tmp_ref)) {
1443		binder_inner_proc_unlock(thread->proc);
1444		binder_free_thread(thread);
1445		return;
1446	}
1447	binder_inner_proc_unlock(thread->proc);
1448}
1449
1450/**
1451 * binder_proc_dec_tmpref() - decrement proc->tmp_ref
1452 * @proc:	proc to decrement
1453 *
1454 * A binder_proc needs to be kept alive while being used to create or
1455 * handle a transaction. proc->tmp_ref is incremented when
1456 * creating a new transaction or the binder_proc is currently in-use
1457 * by threads that are being released. When done with the binder_proc,
1458 * this function is called to decrement the counter and free the
1459 * proc if appropriate (proc has been released, all threads have
1460 * been released and not currenly in-use to process a transaction).
1461 */
1462static void binder_proc_dec_tmpref(struct binder_proc *proc)
1463{
1464	binder_inner_proc_lock(proc);
1465	proc->tmp_ref--;
1466	if (proc->is_dead && RB_EMPTY_ROOT(&proc->threads) &&
1467			!proc->tmp_ref) {
1468		binder_inner_proc_unlock(proc);
1469		binder_free_proc(proc);
1470		return;
1471	}
1472	binder_inner_proc_unlock(proc);
1473}
1474
1475/**
1476 * binder_get_txn_from() - safely extract the "from" thread in transaction
1477 * @t:	binder transaction for t->from
1478 *
1479 * Atomically return the "from" thread and increment the tmp_ref
1480 * count for the thread to ensure it stays alive until
1481 * binder_thread_dec_tmpref() is called.
1482 *
1483 * Return: the value of t->from
1484 */
1485static struct binder_thread *binder_get_txn_from(
1486		struct binder_transaction *t)
1487{
1488	struct binder_thread *from;
1489
1490	spin_lock(&t->lock);
1491	from = t->from;
1492	if (from)
1493		atomic_inc(&from->tmp_ref);
1494	spin_unlock(&t->lock);
1495	return from;
1496}
1497
1498/**
1499 * binder_get_txn_from_and_acq_inner() - get t->from and acquire inner lock
1500 * @t:	binder transaction for t->from
1501 *
1502 * Same as binder_get_txn_from() except it also acquires the proc->inner_lock
1503 * to guarantee that the thread cannot be released while operating on it.
1504 * The caller must call binder_inner_proc_unlock() to release the inner lock
1505 * as well as call binder_dec_thread_txn() to release the reference.
1506 *
1507 * Return: the value of t->from
1508 */
1509static struct binder_thread *binder_get_txn_from_and_acq_inner(
1510		struct binder_transaction *t)
1511	__acquires(&t->from->proc->inner_lock)
1512{
1513	struct binder_thread *from;
1514
1515	from = binder_get_txn_from(t);
1516	if (!from) {
1517		__acquire(&from->proc->inner_lock);
1518		return NULL;
1519	}
1520	binder_inner_proc_lock(from->proc);
1521	if (t->from) {
1522		BUG_ON(from != t->from);
1523		return from;
1524	}
1525	binder_inner_proc_unlock(from->proc);
1526	__acquire(&from->proc->inner_lock);
1527	binder_thread_dec_tmpref(from);
1528	return NULL;
1529}
1530
1531/**
1532 * binder_free_txn_fixups() - free unprocessed fd fixups
1533 * @t:	binder transaction for t->from
1534 *
1535 * If the transaction is being torn down prior to being
1536 * processed by the target process, free all of the
1537 * fd fixups and fput the file structs. It is safe to
1538 * call this function after the fixups have been
1539 * processed -- in that case, the list will be empty.
1540 */
1541static void binder_free_txn_fixups(struct binder_transaction *t)
1542{
1543	struct binder_txn_fd_fixup *fixup, *tmp;
1544
1545	list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) {
1546		fput(fixup->file);
1547		if (fixup->target_fd >= 0)
1548			put_unused_fd(fixup->target_fd);
1549		list_del(&fixup->fixup_entry);
1550		kfree(fixup);
1551	}
1552}
1553
1554static void binder_txn_latency_free(struct binder_transaction *t)
1555{
1556	int from_proc, from_thread, to_proc, to_thread;
1557
1558	spin_lock(&t->lock);
1559	from_proc = t->from ? t->from->proc->pid : 0;
1560	from_thread = t->from ? t->from->pid : 0;
1561	to_proc = t->to_proc ? t->to_proc->pid : 0;
1562	to_thread = t->to_thread ? t->to_thread->pid : 0;
1563	spin_unlock(&t->lock);
1564
1565	trace_binder_txn_latency_free(t, from_proc, from_thread, to_proc, to_thread);
1566}
1567
1568static void binder_free_transaction(struct binder_transaction *t)
1569{
1570	struct binder_proc *target_proc = t->to_proc;
1571
1572	if (target_proc) {
1573		binder_inner_proc_lock(target_proc);
1574		target_proc->outstanding_txns--;
1575		if (target_proc->outstanding_txns < 0)
1576			pr_warn("%s: Unexpected outstanding_txns %d\n",
1577				__func__, target_proc->outstanding_txns);
1578		if (!target_proc->outstanding_txns && target_proc->is_frozen)
1579			wake_up_interruptible_all(&target_proc->freeze_wait);
1580		if (t->buffer)
1581			t->buffer->transaction = NULL;
1582		binder_inner_proc_unlock(target_proc);
1583	}
1584	if (trace_binder_txn_latency_free_enabled())
1585		binder_txn_latency_free(t);
1586	/*
1587	 * If the transaction has no target_proc, then
1588	 * t->buffer->transaction has already been cleared.
1589	 */
1590	binder_free_txn_fixups(t);
1591	kfree(t);
1592	binder_stats_deleted(BINDER_STAT_TRANSACTION);
1593}
1594
1595static void binder_send_failed_reply(struct binder_transaction *t,
1596				     uint32_t error_code)
1597{
1598	struct binder_thread *target_thread;
1599	struct binder_transaction *next;
1600
1601	BUG_ON(t->flags & TF_ONE_WAY);
1602	while (1) {
1603		target_thread = binder_get_txn_from_and_acq_inner(t);
1604		if (target_thread) {
1605			binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
1606				     "send failed reply for transaction %d to %d:%d\n",
1607				      t->debug_id,
1608				      target_thread->proc->pid,
1609				      target_thread->pid);
1610
1611			binder_pop_transaction_ilocked(target_thread, t);
1612			if (target_thread->reply_error.cmd == BR_OK) {
1613				target_thread->reply_error.cmd = error_code;
1614				binder_enqueue_thread_work_ilocked(
1615					target_thread,
1616					&target_thread->reply_error.work);
1617				wake_up_interruptible(&target_thread->wait);
1618			} else {
1619				/*
1620				 * Cannot get here for normal operation, but
1621				 * we can if multiple synchronous transactions
1622				 * are sent without blocking for responses.
1623				 * Just ignore the 2nd error in this case.
1624				 */
1625				pr_warn("Unexpected reply error: %u\n",
1626					target_thread->reply_error.cmd);
1627			}
1628			binder_inner_proc_unlock(target_thread->proc);
1629			binder_thread_dec_tmpref(target_thread);
1630			binder_free_transaction(t);
1631			return;
 
 
1632		}
1633		__release(&target_thread->proc->inner_lock);
1634		next = t->from_parent;
1635
1636		binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
1637			     "send failed reply for transaction %d, target dead\n",
1638			     t->debug_id);
1639
1640		binder_free_transaction(t);
1641		if (next == NULL) {
1642			binder_debug(BINDER_DEBUG_DEAD_BINDER,
1643				     "reply failed, no target thread at root\n");
1644			return;
1645		}
1646		t = next;
1647		binder_debug(BINDER_DEBUG_DEAD_BINDER,
1648			     "reply failed, no target thread -- retry %d\n",
1649			      t->debug_id);
1650	}
1651}
1652
1653/**
1654 * binder_cleanup_transaction() - cleans up undelivered transaction
1655 * @t:		transaction that needs to be cleaned up
1656 * @reason:	reason the transaction wasn't delivered
1657 * @error_code:	error to return to caller (if synchronous call)
1658 */
1659static void binder_cleanup_transaction(struct binder_transaction *t,
1660				       const char *reason,
1661				       uint32_t error_code)
1662{
1663	if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) {
1664		binder_send_failed_reply(t, error_code);
1665	} else {
1666		binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
1667			"undelivered transaction %d, %s\n",
1668			t->debug_id, reason);
1669		binder_free_transaction(t);
1670	}
1671}
1672
1673/**
1674 * binder_get_object() - gets object and checks for valid metadata
1675 * @proc:	binder_proc owning the buffer
1676 * @u:		sender's user pointer to base of buffer
1677 * @buffer:	binder_buffer that we're parsing.
1678 * @offset:	offset in the @buffer at which to validate an object.
1679 * @object:	struct binder_object to read into
1680 *
1681 * Copy the binder object at the given offset into @object. If @u is
1682 * provided then the copy is from the sender's buffer. If not, then
1683 * it is copied from the target's @buffer.
1684 *
1685 * Return:	If there's a valid metadata object at @offset, the
1686 *		size of that object. Otherwise, it returns zero. The object
1687 *		is read into the struct binder_object pointed to by @object.
1688 */
1689static size_t binder_get_object(struct binder_proc *proc,
1690				const void __user *u,
1691				struct binder_buffer *buffer,
1692				unsigned long offset,
1693				struct binder_object *object)
1694{
1695	size_t read_size;
1696	struct binder_object_header *hdr;
1697	size_t object_size = 0;
1698
1699	read_size = min_t(size_t, sizeof(*object), buffer->data_size - offset);
1700	if (offset > buffer->data_size || read_size < sizeof(*hdr))
 
 
1701		return 0;
1702	if (u) {
1703		if (copy_from_user(object, u + offset, read_size))
1704			return 0;
1705	} else {
1706		if (binder_alloc_copy_from_buffer(&proc->alloc, object, buffer,
1707						  offset, read_size))
1708			return 0;
1709	}
1710
1711	/* Ok, now see if we read a complete object. */
1712	hdr = &object->hdr;
1713	switch (hdr->type) {
1714	case BINDER_TYPE_BINDER:
1715	case BINDER_TYPE_WEAK_BINDER:
1716	case BINDER_TYPE_HANDLE:
1717	case BINDER_TYPE_WEAK_HANDLE:
1718		object_size = sizeof(struct flat_binder_object);
1719		break;
1720	case BINDER_TYPE_FD:
1721		object_size = sizeof(struct binder_fd_object);
1722		break;
1723	case BINDER_TYPE_PTR:
1724		object_size = sizeof(struct binder_buffer_object);
1725		break;
1726	case BINDER_TYPE_FDA:
1727		object_size = sizeof(struct binder_fd_array_object);
1728		break;
1729	default:
1730		return 0;
1731	}
1732	if (offset <= buffer->data_size - object_size &&
1733	    buffer->data_size >= object_size)
1734		return object_size;
1735	else
1736		return 0;
1737}
1738
1739/**
1740 * binder_validate_ptr() - validates binder_buffer_object in a binder_buffer.
1741 * @proc:	binder_proc owning the buffer
1742 * @b:		binder_buffer containing the object
1743 * @object:	struct binder_object to read into
1744 * @index:	index in offset array at which the binder_buffer_object is
1745 *		located
1746 * @start_offset: points to the start of the offset array
1747 * @object_offsetp: offset of @object read from @b
1748 * @num_valid:	the number of valid offsets in the offset array
1749 *
1750 * Return:	If @index is within the valid range of the offset array
1751 *		described by @start and @num_valid, and if there's a valid
1752 *		binder_buffer_object at the offset found in index @index
1753 *		of the offset array, that object is returned. Otherwise,
1754 *		%NULL is returned.
1755 *		Note that the offset found in index @index itself is not
1756 *		verified; this function assumes that @num_valid elements
1757 *		from @start were previously verified to have valid offsets.
1758 *		If @object_offsetp is non-NULL, then the offset within
1759 *		@b is written to it.
1760 */
1761static struct binder_buffer_object *binder_validate_ptr(
1762						struct binder_proc *proc,
1763						struct binder_buffer *b,
1764						struct binder_object *object,
1765						binder_size_t index,
1766						binder_size_t start_offset,
1767						binder_size_t *object_offsetp,
1768						binder_size_t num_valid)
1769{
1770	size_t object_size;
1771	binder_size_t object_offset;
1772	unsigned long buffer_offset;
1773
1774	if (index >= num_valid)
1775		return NULL;
1776
1777	buffer_offset = start_offset + sizeof(binder_size_t) * index;
1778	if (binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,
1779					  b, buffer_offset,
1780					  sizeof(object_offset)))
1781		return NULL;
1782	object_size = binder_get_object(proc, NULL, b, object_offset, object);
1783	if (!object_size || object->hdr.type != BINDER_TYPE_PTR)
1784		return NULL;
1785	if (object_offsetp)
1786		*object_offsetp = object_offset;
1787
1788	return &object->bbo;
1789}
1790
1791/**
1792 * binder_validate_fixup() - validates pointer/fd fixups happen in order.
1793 * @proc:		binder_proc owning the buffer
1794 * @b:			transaction buffer
1795 * @objects_start_offset: offset to start of objects buffer
1796 * @buffer_obj_offset:	offset to binder_buffer_object in which to fix up
1797 * @fixup_offset:	start offset in @buffer to fix up
1798 * @last_obj_offset:	offset to last binder_buffer_object that we fixed
1799 * @last_min_offset:	minimum fixup offset in object at @last_obj_offset
1800 *
1801 * Return:		%true if a fixup in buffer @buffer at offset @offset is
1802 *			allowed.
1803 *
1804 * For safety reasons, we only allow fixups inside a buffer to happen
1805 * at increasing offsets; additionally, we only allow fixup on the last
1806 * buffer object that was verified, or one of its parents.
1807 *
1808 * Example of what is allowed:
1809 *
1810 * A
1811 *   B (parent = A, offset = 0)
1812 *   C (parent = A, offset = 16)
1813 *     D (parent = C, offset = 0)
1814 *   E (parent = A, offset = 32) // min_offset is 16 (C.parent_offset)
1815 *
1816 * Examples of what is not allowed:
1817 *
1818 * Decreasing offsets within the same parent:
1819 * A
1820 *   C (parent = A, offset = 16)
1821 *   B (parent = A, offset = 0) // decreasing offset within A
1822 *
1823 * Referring to a parent that wasn't the last object or any of its parents:
1824 * A
1825 *   B (parent = A, offset = 0)
1826 *   C (parent = A, offset = 0)
1827 *   C (parent = A, offset = 16)
1828 *     D (parent = B, offset = 0) // B is not A or any of A's parents
1829 */
1830static bool binder_validate_fixup(struct binder_proc *proc,
1831				  struct binder_buffer *b,
1832				  binder_size_t objects_start_offset,
1833				  binder_size_t buffer_obj_offset,
1834				  binder_size_t fixup_offset,
1835				  binder_size_t last_obj_offset,
1836				  binder_size_t last_min_offset)
1837{
1838	if (!last_obj_offset) {
1839		/* Nothing to fix up in */
1840		return false;
1841	}
1842
1843	while (last_obj_offset != buffer_obj_offset) {
1844		unsigned long buffer_offset;
1845		struct binder_object last_object;
1846		struct binder_buffer_object *last_bbo;
1847		size_t object_size = binder_get_object(proc, NULL, b,
1848						       last_obj_offset,
1849						       &last_object);
1850		if (object_size != sizeof(*last_bbo))
1851			return false;
1852
1853		last_bbo = &last_object.bbo;
1854		/*
1855		 * Safe to retrieve the parent of last_obj, since it
1856		 * was already previously verified by the driver.
1857		 */
1858		if ((last_bbo->flags & BINDER_BUFFER_FLAG_HAS_PARENT) == 0)
1859			return false;
1860		last_min_offset = last_bbo->parent_offset + sizeof(uintptr_t);
1861		buffer_offset = objects_start_offset +
1862			sizeof(binder_size_t) * last_bbo->parent;
1863		if (binder_alloc_copy_from_buffer(&proc->alloc,
1864						  &last_obj_offset,
1865						  b, buffer_offset,
1866						  sizeof(last_obj_offset)))
1867			return false;
1868	}
1869	return (fixup_offset >= last_min_offset);
1870}
1871
1872/**
1873 * struct binder_task_work_cb - for deferred close
1874 *
1875 * @twork:                callback_head for task work
1876 * @fd:                   fd to close
1877 *
1878 * Structure to pass task work to be handled after
1879 * returning from binder_ioctl() via task_work_add().
1880 */
1881struct binder_task_work_cb {
1882	struct callback_head twork;
1883	struct file *file;
1884};
1885
1886/**
1887 * binder_do_fd_close() - close list of file descriptors
1888 * @twork:	callback head for task work
1889 *
1890 * It is not safe to call ksys_close() during the binder_ioctl()
1891 * function if there is a chance that binder's own file descriptor
1892 * might be closed. This is to meet the requirements for using
1893 * fdget() (see comments for __fget_light()). Therefore use
1894 * task_work_add() to schedule the close operation once we have
1895 * returned from binder_ioctl(). This function is a callback
1896 * for that mechanism and does the actual ksys_close() on the
1897 * given file descriptor.
1898 */
1899static void binder_do_fd_close(struct callback_head *twork)
1900{
1901	struct binder_task_work_cb *twcb = container_of(twork,
1902			struct binder_task_work_cb, twork);
1903
1904	fput(twcb->file);
1905	kfree(twcb);
1906}
1907
1908/**
1909 * binder_deferred_fd_close() - schedule a close for the given file-descriptor
1910 * @fd:		file-descriptor to close
1911 *
1912 * See comments in binder_do_fd_close(). This function is used to schedule
1913 * a file-descriptor to be closed after returning from binder_ioctl().
1914 */
1915static void binder_deferred_fd_close(int fd)
1916{
1917	struct binder_task_work_cb *twcb;
1918
1919	twcb = kzalloc(sizeof(*twcb), GFP_KERNEL);
1920	if (!twcb)
1921		return;
1922	init_task_work(&twcb->twork, binder_do_fd_close);
1923	twcb->file = close_fd_get_file(fd);
1924	if (twcb->file) {
1925		// pin it until binder_do_fd_close(); see comments there
1926		get_file(twcb->file);
1927		filp_close(twcb->file, current->files);
1928		task_work_add(current, &twcb->twork, TWA_RESUME);
1929	} else {
1930		kfree(twcb);
1931	}
1932}
1933
1934static void binder_transaction_buffer_release(struct binder_proc *proc,
1935					      struct binder_thread *thread,
1936					      struct binder_buffer *buffer,
1937					      binder_size_t failed_at,
1938					      bool is_failure)
1939{
1940	int debug_id = buffer->debug_id;
1941	binder_size_t off_start_offset, buffer_offset, off_end_offset;
1942
1943	binder_debug(BINDER_DEBUG_TRANSACTION,
1944		     "%d buffer release %d, size %zd-%zd, failed at %llx\n",
1945		     proc->pid, buffer->debug_id,
1946		     buffer->data_size, buffer->offsets_size,
1947		     (unsigned long long)failed_at);
1948
1949	if (buffer->target_node)
1950		binder_dec_node(buffer->target_node, 1, 0);
1951
1952	off_start_offset = ALIGN(buffer->data_size, sizeof(void *));
1953	off_end_offset = is_failure && failed_at ? failed_at :
1954				off_start_offset + buffer->offsets_size;
1955	for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
1956	     buffer_offset += sizeof(binder_size_t)) {
1957		struct binder_object_header *hdr;
1958		size_t object_size = 0;
1959		struct binder_object object;
1960		binder_size_t object_offset;
1961
1962		if (!binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,
1963						   buffer, buffer_offset,
1964						   sizeof(object_offset)))
1965			object_size = binder_get_object(proc, NULL, buffer,
1966							object_offset, &object);
1967		if (object_size == 0) {
1968			pr_err("transaction release %d bad object at offset %lld, size %zd\n",
1969			       debug_id, (u64)object_offset, buffer->data_size);
1970			continue;
1971		}
1972		hdr = &object.hdr;
1973		switch (hdr->type) {
1974		case BINDER_TYPE_BINDER:
1975		case BINDER_TYPE_WEAK_BINDER: {
1976			struct flat_binder_object *fp;
1977			struct binder_node *node;
1978
1979			fp = to_flat_binder_object(hdr);
1980			node = binder_get_node(proc, fp->binder);
1981			if (node == NULL) {
1982				pr_err("transaction release %d bad node %016llx\n",
1983				       debug_id, (u64)fp->binder);
1984				break;
1985			}
1986			binder_debug(BINDER_DEBUG_TRANSACTION,
1987				     "        node %d u%016llx\n",
1988				     node->debug_id, (u64)node->ptr);
1989			binder_dec_node(node, hdr->type == BINDER_TYPE_BINDER,
1990					0);
1991			binder_put_node(node);
1992		} break;
1993		case BINDER_TYPE_HANDLE:
1994		case BINDER_TYPE_WEAK_HANDLE: {
1995			struct flat_binder_object *fp;
1996			struct binder_ref_data rdata;
1997			int ret;
1998
1999			fp = to_flat_binder_object(hdr);
2000			ret = binder_dec_ref_for_handle(proc, fp->handle,
2001				hdr->type == BINDER_TYPE_HANDLE, &rdata);
2002
2003			if (ret) {
2004				pr_err("transaction release %d bad handle %d, ret = %d\n",
2005				 debug_id, fp->handle, ret);
2006				break;
2007			}
2008			binder_debug(BINDER_DEBUG_TRANSACTION,
2009				     "        ref %d desc %d\n",
2010				     rdata.debug_id, rdata.desc);
2011		} break;
2012
2013		case BINDER_TYPE_FD: {
2014			/*
2015			 * No need to close the file here since user-space
2016			 * closes it for successfully delivered
2017			 * transactions. For transactions that weren't
2018			 * delivered, the new fd was never allocated so
2019			 * there is no need to close and the fput on the
2020			 * file is done when the transaction is torn
2021			 * down.
2022			 */
 
 
2023		} break;
2024		case BINDER_TYPE_PTR:
2025			/*
2026			 * Nothing to do here, this will get cleaned up when the
2027			 * transaction buffer gets freed
2028			 */
2029			break;
2030		case BINDER_TYPE_FDA: {
2031			struct binder_fd_array_object *fda;
2032			struct binder_buffer_object *parent;
2033			struct binder_object ptr_object;
2034			binder_size_t fda_offset;
2035			size_t fd_index;
2036			binder_size_t fd_buf_size;
2037			binder_size_t num_valid;
2038
2039			if (is_failure) {
2040				/*
 
2041				 * The fd fixups have not been applied so no
2042				 * fds need to be closed.
2043				 */
2044				continue;
2045			}
2046
2047			num_valid = (buffer_offset - off_start_offset) /
2048						sizeof(binder_size_t);
2049			fda = to_binder_fd_array_object(hdr);
2050			parent = binder_validate_ptr(proc, buffer, &ptr_object,
2051						     fda->parent,
2052						     off_start_offset,
2053						     NULL,
2054						     num_valid);
2055			if (!parent) {
2056				pr_err("transaction release %d bad parent offset\n",
2057				       debug_id);
2058				continue;
2059			}
2060			fd_buf_size = sizeof(u32) * fda->num_fds;
2061			if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {
2062				pr_err("transaction release %d invalid number of fds (%lld)\n",
2063				       debug_id, (u64)fda->num_fds);
2064				continue;
2065			}
2066			if (fd_buf_size > parent->length ||
2067			    fda->parent_offset > parent->length - fd_buf_size) {
2068				/* No space for all file descriptors here. */
2069				pr_err("transaction release %d not enough space for %lld fds in buffer\n",
2070				       debug_id, (u64)fda->num_fds);
2071				continue;
2072			}
2073			/*
2074			 * the source data for binder_buffer_object is visible
2075			 * to user-space and the @buffer element is the user
2076			 * pointer to the buffer_object containing the fd_array.
2077			 * Convert the address to an offset relative to
2078			 * the base of the transaction buffer.
2079			 */
2080			fda_offset =
2081			    (parent->buffer - (uintptr_t)buffer->user_data) +
2082			    fda->parent_offset;
2083			for (fd_index = 0; fd_index < fda->num_fds;
2084			     fd_index++) {
2085				u32 fd;
2086				int err;
2087				binder_size_t offset = fda_offset +
2088					fd_index * sizeof(fd);
2089
2090				err = binder_alloc_copy_from_buffer(
2091						&proc->alloc, &fd, buffer,
2092						offset, sizeof(fd));
2093				WARN_ON(err);
2094				if (!err) {
2095					binder_deferred_fd_close(fd);
2096					/*
2097					 * Need to make sure the thread goes
2098					 * back to userspace to complete the
2099					 * deferred close
2100					 */
2101					if (thread)
2102						thread->looper_need_return = true;
2103				}
2104			}
2105		} break;
2106		default:
2107			pr_err("transaction release %d bad object type %x\n",
2108				debug_id, hdr->type);
2109			break;
2110		}
2111	}
2112}
2113
2114static int binder_translate_binder(struct flat_binder_object *fp,
2115				   struct binder_transaction *t,
2116				   struct binder_thread *thread)
2117{
2118	struct binder_node *node;
2119	struct binder_proc *proc = thread->proc;
2120	struct binder_proc *target_proc = t->to_proc;
2121	struct binder_ref_data rdata;
2122	int ret = 0;
2123
2124	node = binder_get_node(proc, fp->binder);
2125	if (!node) {
2126		node = binder_new_node(proc, fp);
2127		if (!node)
2128			return -ENOMEM;
2129	}
2130	if (fp->cookie != node->cookie) {
2131		binder_user_error("%d:%d sending u%016llx node %d, cookie mismatch %016llx != %016llx\n",
2132				  proc->pid, thread->pid, (u64)fp->binder,
2133				  node->debug_id, (u64)fp->cookie,
2134				  (u64)node->cookie);
2135		ret = -EINVAL;
2136		goto done;
2137	}
2138	if (security_binder_transfer_binder(proc->cred, target_proc->cred)) {
2139		ret = -EPERM;
2140		goto done;
2141	}
2142
2143	ret = binder_inc_ref_for_node(target_proc, node,
2144			fp->hdr.type == BINDER_TYPE_BINDER,
2145			&thread->todo, &rdata);
2146	if (ret)
2147		goto done;
2148
2149	if (fp->hdr.type == BINDER_TYPE_BINDER)
2150		fp->hdr.type = BINDER_TYPE_HANDLE;
2151	else
2152		fp->hdr.type = BINDER_TYPE_WEAK_HANDLE;
2153	fp->binder = 0;
2154	fp->handle = rdata.desc;
2155	fp->cookie = 0;
2156
2157	trace_binder_transaction_node_to_ref(t, node, &rdata);
2158	binder_debug(BINDER_DEBUG_TRANSACTION,
2159		     "        node %d u%016llx -> ref %d desc %d\n",
2160		     node->debug_id, (u64)node->ptr,
2161		     rdata.debug_id, rdata.desc);
2162done:
2163	binder_put_node(node);
2164	return ret;
2165}
2166
2167static int binder_translate_handle(struct flat_binder_object *fp,
2168				   struct binder_transaction *t,
2169				   struct binder_thread *thread)
2170{
2171	struct binder_proc *proc = thread->proc;
2172	struct binder_proc *target_proc = t->to_proc;
2173	struct binder_node *node;
2174	struct binder_ref_data src_rdata;
2175	int ret = 0;
2176
2177	node = binder_get_node_from_ref(proc, fp->handle,
2178			fp->hdr.type == BINDER_TYPE_HANDLE, &src_rdata);
2179	if (!node) {
2180		binder_user_error("%d:%d got transaction with invalid handle, %d\n",
2181				  proc->pid, thread->pid, fp->handle);
2182		return -EINVAL;
2183	}
2184	if (security_binder_transfer_binder(proc->cred, target_proc->cred)) {
2185		ret = -EPERM;
2186		goto done;
2187	}
2188
2189	binder_node_lock(node);
2190	if (node->proc == target_proc) {
2191		if (fp->hdr.type == BINDER_TYPE_HANDLE)
2192			fp->hdr.type = BINDER_TYPE_BINDER;
2193		else
2194			fp->hdr.type = BINDER_TYPE_WEAK_BINDER;
2195		fp->binder = node->ptr;
2196		fp->cookie = node->cookie;
2197		if (node->proc)
2198			binder_inner_proc_lock(node->proc);
2199		else
2200			__acquire(&node->proc->inner_lock);
2201		binder_inc_node_nilocked(node,
2202					 fp->hdr.type == BINDER_TYPE_BINDER,
2203					 0, NULL);
2204		if (node->proc)
2205			binder_inner_proc_unlock(node->proc);
2206		else
2207			__release(&node->proc->inner_lock);
2208		trace_binder_transaction_ref_to_node(t, node, &src_rdata);
2209		binder_debug(BINDER_DEBUG_TRANSACTION,
2210			     "        ref %d desc %d -> node %d u%016llx\n",
2211			     src_rdata.debug_id, src_rdata.desc, node->debug_id,
2212			     (u64)node->ptr);
2213		binder_node_unlock(node);
2214	} else {
2215		struct binder_ref_data dest_rdata;
2216
2217		binder_node_unlock(node);
2218		ret = binder_inc_ref_for_node(target_proc, node,
2219				fp->hdr.type == BINDER_TYPE_HANDLE,
2220				NULL, &dest_rdata);
2221		if (ret)
2222			goto done;
2223
2224		fp->binder = 0;
2225		fp->handle = dest_rdata.desc;
2226		fp->cookie = 0;
2227		trace_binder_transaction_ref_to_ref(t, node, &src_rdata,
2228						    &dest_rdata);
2229		binder_debug(BINDER_DEBUG_TRANSACTION,
2230			     "        ref %d desc %d -> ref %d desc %d (node %d)\n",
2231			     src_rdata.debug_id, src_rdata.desc,
2232			     dest_rdata.debug_id, dest_rdata.desc,
2233			     node->debug_id);
2234	}
2235done:
2236	binder_put_node(node);
2237	return ret;
2238}
2239
2240static int binder_translate_fd(u32 fd, binder_size_t fd_offset,
2241			       struct binder_transaction *t,
2242			       struct binder_thread *thread,
2243			       struct binder_transaction *in_reply_to)
2244{
2245	struct binder_proc *proc = thread->proc;
2246	struct binder_proc *target_proc = t->to_proc;
2247	struct binder_txn_fd_fixup *fixup;
2248	struct file *file;
2249	int ret = 0;
2250	bool target_allows_fd;
2251
2252	if (in_reply_to)
2253		target_allows_fd = !!(in_reply_to->flags & TF_ACCEPT_FDS);
2254	else
2255		target_allows_fd = t->buffer->target_node->accept_fds;
2256	if (!target_allows_fd) {
2257		binder_user_error("%d:%d got %s with fd, %d, but target does not allow fds\n",
2258				  proc->pid, thread->pid,
2259				  in_reply_to ? "reply" : "transaction",
2260				  fd);
2261		ret = -EPERM;
2262		goto err_fd_not_accepted;
2263	}
2264
2265	file = fget(fd);
2266	if (!file) {
2267		binder_user_error("%d:%d got transaction with invalid fd, %d\n",
2268				  proc->pid, thread->pid, fd);
2269		ret = -EBADF;
2270		goto err_fget;
2271	}
2272	ret = security_binder_transfer_file(proc->cred, target_proc->cred, file);
2273	if (ret < 0) {
2274		ret = -EPERM;
2275		goto err_security;
2276	}
2277
2278	/*
2279	 * Add fixup record for this transaction. The allocation
2280	 * of the fd in the target needs to be done from a
2281	 * target thread.
2282	 */
2283	fixup = kzalloc(sizeof(*fixup), GFP_KERNEL);
2284	if (!fixup) {
2285		ret = -ENOMEM;
2286		goto err_alloc;
2287	}
2288	fixup->file = file;
2289	fixup->offset = fd_offset;
2290	fixup->target_fd = -1;
2291	trace_binder_transaction_fd_send(t, fd, fixup->offset);
2292	list_add_tail(&fixup->fixup_entry, &t->fd_fixups);
2293
2294	return ret;
2295
2296err_alloc:
2297err_security:
2298	fput(file);
2299err_fget:
2300err_fd_not_accepted:
2301	return ret;
2302}
2303
2304/**
2305 * struct binder_ptr_fixup - data to be fixed-up in target buffer
2306 * @offset	offset in target buffer to fixup
2307 * @skip_size	bytes to skip in copy (fixup will be written later)
2308 * @fixup_data	data to write at fixup offset
2309 * @node	list node
2310 *
2311 * This is used for the pointer fixup list (pf) which is created and consumed
2312 * during binder_transaction() and is only accessed locally. No
2313 * locking is necessary.
2314 *
2315 * The list is ordered by @offset.
2316 */
2317struct binder_ptr_fixup {
2318	binder_size_t offset;
2319	size_t skip_size;
2320	binder_uintptr_t fixup_data;
2321	struct list_head node;
2322};
2323
2324/**
2325 * struct binder_sg_copy - scatter-gather data to be copied
2326 * @offset		offset in target buffer
2327 * @sender_uaddr	user address in source buffer
2328 * @length		bytes to copy
2329 * @node		list node
2330 *
2331 * This is used for the sg copy list (sgc) which is created and consumed
2332 * during binder_transaction() and is only accessed locally. No
2333 * locking is necessary.
2334 *
2335 * The list is ordered by @offset.
2336 */
2337struct binder_sg_copy {
2338	binder_size_t offset;
2339	const void __user *sender_uaddr;
2340	size_t length;
2341	struct list_head node;
2342};
2343
2344/**
2345 * binder_do_deferred_txn_copies() - copy and fixup scatter-gather data
2346 * @alloc:	binder_alloc associated with @buffer
2347 * @buffer:	binder buffer in target process
2348 * @sgc_head:	list_head of scatter-gather copy list
2349 * @pf_head:	list_head of pointer fixup list
2350 *
2351 * Processes all elements of @sgc_head, applying fixups from @pf_head
2352 * and copying the scatter-gather data from the source process' user
2353 * buffer to the target's buffer. It is expected that the list creation
2354 * and processing all occurs during binder_transaction() so these lists
2355 * are only accessed in local context.
2356 *
2357 * Return: 0=success, else -errno
2358 */
2359static int binder_do_deferred_txn_copies(struct binder_alloc *alloc,
2360					 struct binder_buffer *buffer,
2361					 struct list_head *sgc_head,
2362					 struct list_head *pf_head)
2363{
2364	int ret = 0;
2365	struct binder_sg_copy *sgc, *tmpsgc;
2366	struct binder_ptr_fixup *tmppf;
2367	struct binder_ptr_fixup *pf =
2368		list_first_entry_or_null(pf_head, struct binder_ptr_fixup,
2369					 node);
2370
2371	list_for_each_entry_safe(sgc, tmpsgc, sgc_head, node) {
2372		size_t bytes_copied = 0;
2373
2374		while (bytes_copied < sgc->length) {
2375			size_t copy_size;
2376			size_t bytes_left = sgc->length - bytes_copied;
2377			size_t offset = sgc->offset + bytes_copied;
2378
2379			/*
2380			 * We copy up to the fixup (pointed to by pf)
2381			 */
2382			copy_size = pf ? min(bytes_left, (size_t)pf->offset - offset)
2383				       : bytes_left;
2384			if (!ret && copy_size)
2385				ret = binder_alloc_copy_user_to_buffer(
2386						alloc, buffer,
2387						offset,
2388						sgc->sender_uaddr + bytes_copied,
2389						copy_size);
2390			bytes_copied += copy_size;
2391			if (copy_size != bytes_left) {
2392				BUG_ON(!pf);
2393				/* we stopped at a fixup offset */
2394				if (pf->skip_size) {
2395					/*
2396					 * we are just skipping. This is for
2397					 * BINDER_TYPE_FDA where the translated
2398					 * fds will be fixed up when we get
2399					 * to target context.
2400					 */
2401					bytes_copied += pf->skip_size;
2402				} else {
2403					/* apply the fixup indicated by pf */
2404					if (!ret)
2405						ret = binder_alloc_copy_to_buffer(
2406							alloc, buffer,
2407							pf->offset,
2408							&pf->fixup_data,
2409							sizeof(pf->fixup_data));
2410					bytes_copied += sizeof(pf->fixup_data);
2411				}
2412				list_del(&pf->node);
2413				kfree(pf);
2414				pf = list_first_entry_or_null(pf_head,
2415						struct binder_ptr_fixup, node);
2416			}
2417		}
2418		list_del(&sgc->node);
2419		kfree(sgc);
2420	}
2421	list_for_each_entry_safe(pf, tmppf, pf_head, node) {
2422		BUG_ON(pf->skip_size == 0);
2423		list_del(&pf->node);
2424		kfree(pf);
2425	}
2426	BUG_ON(!list_empty(sgc_head));
2427
2428	return ret > 0 ? -EINVAL : ret;
2429}
2430
2431/**
2432 * binder_cleanup_deferred_txn_lists() - free specified lists
2433 * @sgc_head:	list_head of scatter-gather copy list
2434 * @pf_head:	list_head of pointer fixup list
2435 *
2436 * Called to clean up @sgc_head and @pf_head if there is an
2437 * error.
2438 */
2439static void binder_cleanup_deferred_txn_lists(struct list_head *sgc_head,
2440					      struct list_head *pf_head)
2441{
2442	struct binder_sg_copy *sgc, *tmpsgc;
2443	struct binder_ptr_fixup *pf, *tmppf;
2444
2445	list_for_each_entry_safe(sgc, tmpsgc, sgc_head, node) {
2446		list_del(&sgc->node);
2447		kfree(sgc);
2448	}
2449	list_for_each_entry_safe(pf, tmppf, pf_head, node) {
2450		list_del(&pf->node);
2451		kfree(pf);
2452	}
2453}
2454
2455/**
2456 * binder_defer_copy() - queue a scatter-gather buffer for copy
2457 * @sgc_head:		list_head of scatter-gather copy list
2458 * @offset:		binder buffer offset in target process
2459 * @sender_uaddr:	user address in source process
2460 * @length:		bytes to copy
2461 *
2462 * Specify a scatter-gather block to be copied. The actual copy must
2463 * be deferred until all the needed fixups are identified and queued.
2464 * Then the copy and fixups are done together so un-translated values
2465 * from the source are never visible in the target buffer.
2466 *
2467 * We are guaranteed that repeated calls to this function will have
2468 * monotonically increasing @offset values so the list will naturally
2469 * be ordered.
2470 *
2471 * Return: 0=success, else -errno
2472 */
2473static int binder_defer_copy(struct list_head *sgc_head, binder_size_t offset,
2474			     const void __user *sender_uaddr, size_t length)
2475{
2476	struct binder_sg_copy *bc = kzalloc(sizeof(*bc), GFP_KERNEL);
2477
2478	if (!bc)
2479		return -ENOMEM;
2480
2481	bc->offset = offset;
2482	bc->sender_uaddr = sender_uaddr;
2483	bc->length = length;
2484	INIT_LIST_HEAD(&bc->node);
2485
2486	/*
2487	 * We are guaranteed that the deferred copies are in-order
2488	 * so just add to the tail.
2489	 */
2490	list_add_tail(&bc->node, sgc_head);
2491
2492	return 0;
2493}
2494
2495/**
2496 * binder_add_fixup() - queue a fixup to be applied to sg copy
2497 * @pf_head:	list_head of binder ptr fixup list
2498 * @offset:	binder buffer offset in target process
2499 * @fixup:	bytes to be copied for fixup
2500 * @skip_size:	bytes to skip when copying (fixup will be applied later)
2501 *
2502 * Add the specified fixup to a list ordered by @offset. When copying
2503 * the scatter-gather buffers, the fixup will be copied instead of
2504 * data from the source buffer. For BINDER_TYPE_FDA fixups, the fixup
2505 * will be applied later (in target process context), so we just skip
2506 * the bytes specified by @skip_size. If @skip_size is 0, we copy the
2507 * value in @fixup.
2508 *
2509 * This function is called *mostly* in @offset order, but there are
2510 * exceptions. Since out-of-order inserts are relatively uncommon,
2511 * we insert the new element by searching backward from the tail of
2512 * the list.
2513 *
2514 * Return: 0=success, else -errno
2515 */
2516static int binder_add_fixup(struct list_head *pf_head, binder_size_t offset,
2517			    binder_uintptr_t fixup, size_t skip_size)
2518{
2519	struct binder_ptr_fixup *pf = kzalloc(sizeof(*pf), GFP_KERNEL);
2520	struct binder_ptr_fixup *tmppf;
2521
2522	if (!pf)
2523		return -ENOMEM;
2524
2525	pf->offset = offset;
2526	pf->fixup_data = fixup;
2527	pf->skip_size = skip_size;
2528	INIT_LIST_HEAD(&pf->node);
2529
2530	/* Fixups are *mostly* added in-order, but there are some
2531	 * exceptions. Look backwards through list for insertion point.
2532	 */
2533	list_for_each_entry_reverse(tmppf, pf_head, node) {
2534		if (tmppf->offset < pf->offset) {
2535			list_add(&pf->node, &tmppf->node);
2536			return 0;
2537		}
2538	}
2539	/*
2540	 * if we get here, then the new offset is the lowest so
2541	 * insert at the head
2542	 */
2543	list_add(&pf->node, pf_head);
2544	return 0;
2545}
2546
2547static int binder_translate_fd_array(struct list_head *pf_head,
2548				     struct binder_fd_array_object *fda,
2549				     const void __user *sender_ubuffer,
2550				     struct binder_buffer_object *parent,
2551				     struct binder_buffer_object *sender_uparent,
2552				     struct binder_transaction *t,
2553				     struct binder_thread *thread,
2554				     struct binder_transaction *in_reply_to)
2555{
2556	binder_size_t fdi, fd_buf_size;
2557	binder_size_t fda_offset;
2558	const void __user *sender_ufda_base;
2559	struct binder_proc *proc = thread->proc;
2560	int ret;
2561
2562	if (fda->num_fds == 0)
2563		return 0;
2564
2565	fd_buf_size = sizeof(u32) * fda->num_fds;
2566	if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {
2567		binder_user_error("%d:%d got transaction with invalid number of fds (%lld)\n",
2568				  proc->pid, thread->pid, (u64)fda->num_fds);
2569		return -EINVAL;
2570	}
2571	if (fd_buf_size > parent->length ||
2572	    fda->parent_offset > parent->length - fd_buf_size) {
2573		/* No space for all file descriptors here. */
2574		binder_user_error("%d:%d not enough space to store %lld fds in buffer\n",
2575				  proc->pid, thread->pid, (u64)fda->num_fds);
2576		return -EINVAL;
2577	}
2578	/*
2579	 * the source data for binder_buffer_object is visible
2580	 * to user-space and the @buffer element is the user
2581	 * pointer to the buffer_object containing the fd_array.
2582	 * Convert the address to an offset relative to
2583	 * the base of the transaction buffer.
2584	 */
2585	fda_offset = (parent->buffer - (uintptr_t)t->buffer->user_data) +
2586		fda->parent_offset;
2587	sender_ufda_base = (void __user *)(uintptr_t)sender_uparent->buffer +
2588				fda->parent_offset;
2589
2590	if (!IS_ALIGNED((unsigned long)fda_offset, sizeof(u32)) ||
2591	    !IS_ALIGNED((unsigned long)sender_ufda_base, sizeof(u32))) {
2592		binder_user_error("%d:%d parent offset not aligned correctly.\n",
2593				  proc->pid, thread->pid);
2594		return -EINVAL;
2595	}
2596	ret = binder_add_fixup(pf_head, fda_offset, 0, fda->num_fds * sizeof(u32));
2597	if (ret)
2598		return ret;
2599
2600	for (fdi = 0; fdi < fda->num_fds; fdi++) {
2601		u32 fd;
 
2602		binder_size_t offset = fda_offset + fdi * sizeof(fd);
2603		binder_size_t sender_uoffset = fdi * sizeof(fd);
2604
2605		ret = copy_from_user(&fd, sender_ufda_base + sender_uoffset, sizeof(fd));
 
 
2606		if (!ret)
2607			ret = binder_translate_fd(fd, offset, t, thread,
2608						  in_reply_to);
2609		if (ret)
2610			return ret > 0 ? -EINVAL : ret;
2611	}
2612	return 0;
2613}
2614
2615static int binder_fixup_parent(struct list_head *pf_head,
2616			       struct binder_transaction *t,
2617			       struct binder_thread *thread,
2618			       struct binder_buffer_object *bp,
2619			       binder_size_t off_start_offset,
2620			       binder_size_t num_valid,
2621			       binder_size_t last_fixup_obj_off,
2622			       binder_size_t last_fixup_min_off)
2623{
2624	struct binder_buffer_object *parent;
2625	struct binder_buffer *b = t->buffer;
2626	struct binder_proc *proc = thread->proc;
2627	struct binder_proc *target_proc = t->to_proc;
2628	struct binder_object object;
2629	binder_size_t buffer_offset;
2630	binder_size_t parent_offset;
2631
2632	if (!(bp->flags & BINDER_BUFFER_FLAG_HAS_PARENT))
2633		return 0;
2634
2635	parent = binder_validate_ptr(target_proc, b, &object, bp->parent,
2636				     off_start_offset, &parent_offset,
2637				     num_valid);
2638	if (!parent) {
2639		binder_user_error("%d:%d got transaction with invalid parent offset or type\n",
2640				  proc->pid, thread->pid);
2641		return -EINVAL;
2642	}
2643
2644	if (!binder_validate_fixup(target_proc, b, off_start_offset,
2645				   parent_offset, bp->parent_offset,
2646				   last_fixup_obj_off,
2647				   last_fixup_min_off)) {
2648		binder_user_error("%d:%d got transaction with out-of-order buffer fixup\n",
2649				  proc->pid, thread->pid);
2650		return -EINVAL;
2651	}
2652
2653	if (parent->length < sizeof(binder_uintptr_t) ||
2654	    bp->parent_offset > parent->length - sizeof(binder_uintptr_t)) {
2655		/* No space for a pointer here! */
2656		binder_user_error("%d:%d got transaction with invalid parent offset\n",
2657				  proc->pid, thread->pid);
2658		return -EINVAL;
2659	}
2660	buffer_offset = bp->parent_offset +
2661			(uintptr_t)parent->buffer - (uintptr_t)b->user_data;
2662	return binder_add_fixup(pf_head, buffer_offset, bp->buffer, 0);
2663}
2664
2665/**
2666 * binder_can_update_transaction() - Can a txn be superseded by an updated one?
2667 * @t1: the pending async txn in the frozen process
2668 * @t2: the new async txn to supersede the outdated pending one
2669 *
2670 * Return:  true if t2 can supersede t1
2671 *          false if t2 can not supersede t1
2672 */
2673static bool binder_can_update_transaction(struct binder_transaction *t1,
2674					  struct binder_transaction *t2)
2675{
2676	if ((t1->flags & t2->flags & (TF_ONE_WAY | TF_UPDATE_TXN)) !=
2677	    (TF_ONE_WAY | TF_UPDATE_TXN) || !t1->to_proc || !t2->to_proc)
2678		return false;
2679	if (t1->to_proc->tsk == t2->to_proc->tsk && t1->code == t2->code &&
2680	    t1->flags == t2->flags && t1->buffer->pid == t2->buffer->pid &&
2681	    t1->buffer->target_node->ptr == t2->buffer->target_node->ptr &&
2682	    t1->buffer->target_node->cookie == t2->buffer->target_node->cookie)
2683		return true;
2684	return false;
2685}
2686
2687/**
2688 * binder_find_outdated_transaction_ilocked() - Find the outdated transaction
2689 * @t:		 new async transaction
2690 * @target_list: list to find outdated transaction
2691 *
2692 * Return: the outdated transaction if found
2693 *         NULL if no outdated transacton can be found
2694 *
2695 * Requires the proc->inner_lock to be held.
2696 */
2697static struct binder_transaction *
2698binder_find_outdated_transaction_ilocked(struct binder_transaction *t,
2699					 struct list_head *target_list)
2700{
2701	struct binder_work *w;
2702
2703	list_for_each_entry(w, target_list, entry) {
2704		struct binder_transaction *t_queued;
2705
2706		if (w->type != BINDER_WORK_TRANSACTION)
2707			continue;
2708		t_queued = container_of(w, struct binder_transaction, work);
2709		if (binder_can_update_transaction(t_queued, t))
2710			return t_queued;
2711	}
2712	return NULL;
 
2713}
2714
2715/**
2716 * binder_proc_transaction() - sends a transaction to a process and wakes it up
2717 * @t:		transaction to send
2718 * @proc:	process to send the transaction to
2719 * @thread:	thread in @proc to send the transaction to (may be NULL)
2720 *
2721 * This function queues a transaction to the specified process. It will try
2722 * to find a thread in the target process to handle the transaction and
2723 * wake it up. If no thread is found, the work is queued to the proc
2724 * waitqueue.
2725 *
2726 * If the @thread parameter is not NULL, the transaction is always queued
2727 * to the waitlist of that specific thread.
2728 *
2729 * Return:	0 if the transaction was successfully queued
2730 *		BR_DEAD_REPLY if the target process or thread is dead
2731 *		BR_FROZEN_REPLY if the target process or thread is frozen
2732 */
2733static int binder_proc_transaction(struct binder_transaction *t,
2734				    struct binder_proc *proc,
2735				    struct binder_thread *thread)
2736{
2737	struct binder_node *node = t->buffer->target_node;
2738	bool oneway = !!(t->flags & TF_ONE_WAY);
2739	bool pending_async = false;
2740	struct binder_transaction *t_outdated = NULL;
2741
2742	BUG_ON(!node);
2743	binder_node_lock(node);
2744	if (oneway) {
2745		BUG_ON(thread);
2746		if (node->has_async_transaction)
2747			pending_async = true;
2748		else
2749			node->has_async_transaction = true;
 
2750	}
2751
2752	binder_inner_proc_lock(proc);
2753	if (proc->is_frozen) {
2754		proc->sync_recv |= !oneway;
2755		proc->async_recv |= oneway;
2756	}
2757
2758	if ((proc->is_frozen && !oneway) || proc->is_dead ||
2759			(thread && thread->is_dead)) {
2760		binder_inner_proc_unlock(proc);
2761		binder_node_unlock(node);
2762		return proc->is_frozen ? BR_FROZEN_REPLY : BR_DEAD_REPLY;
2763	}
2764
2765	if (!thread && !pending_async)
2766		thread = binder_select_thread_ilocked(proc);
2767
2768	if (thread) {
2769		binder_enqueue_thread_work_ilocked(thread, &t->work);
2770	} else if (!pending_async) {
2771		binder_enqueue_work_ilocked(&t->work, &proc->todo);
2772	} else {
2773		if ((t->flags & TF_UPDATE_TXN) && proc->is_frozen) {
2774			t_outdated = binder_find_outdated_transaction_ilocked(t,
2775									      &node->async_todo);
2776			if (t_outdated) {
2777				binder_debug(BINDER_DEBUG_TRANSACTION,
2778					     "txn %d supersedes %d\n",
2779					     t->debug_id, t_outdated->debug_id);
2780				list_del_init(&t_outdated->work.entry);
2781				proc->outstanding_txns--;
2782			}
2783		}
2784		binder_enqueue_work_ilocked(&t->work, &node->async_todo);
2785	}
2786
2787	if (!pending_async)
2788		binder_wakeup_thread_ilocked(proc, thread, !oneway /* sync */);
2789
2790	proc->outstanding_txns++;
2791	binder_inner_proc_unlock(proc);
2792	binder_node_unlock(node);
2793
2794	/*
2795	 * To reduce potential contention, free the outdated transaction and
2796	 * buffer after releasing the locks.
2797	 */
2798	if (t_outdated) {
2799		struct binder_buffer *buffer = t_outdated->buffer;
2800
2801		t_outdated->buffer = NULL;
2802		buffer->transaction = NULL;
2803		trace_binder_transaction_update_buffer_release(buffer);
2804		binder_transaction_buffer_release(proc, NULL, buffer, 0, 0);
2805		binder_alloc_free_buf(&proc->alloc, buffer);
2806		kfree(t_outdated);
2807		binder_stats_deleted(BINDER_STAT_TRANSACTION);
2808	}
2809
2810	return 0;
2811}
2812
2813/**
2814 * binder_get_node_refs_for_txn() - Get required refs on node for txn
2815 * @node:         struct binder_node for which to get refs
2816 * @proc:         returns @node->proc if valid
2817 * @error:        if no @proc then returns BR_DEAD_REPLY
2818 *
2819 * User-space normally keeps the node alive when creating a transaction
2820 * since it has a reference to the target. The local strong ref keeps it
2821 * alive if the sending process dies before the target process processes
2822 * the transaction. If the source process is malicious or has a reference
2823 * counting bug, relying on the local strong ref can fail.
2824 *
2825 * Since user-space can cause the local strong ref to go away, we also take
2826 * a tmpref on the node to ensure it survives while we are constructing
2827 * the transaction. We also need a tmpref on the proc while we are
2828 * constructing the transaction, so we take that here as well.
2829 *
2830 * Return: The target_node with refs taken or NULL if no @node->proc is NULL.
2831 * Also sets @proc if valid. If the @node->proc is NULL indicating that the
2832 * target proc has died, @error is set to BR_DEAD_REPLY
2833 */
2834static struct binder_node *binder_get_node_refs_for_txn(
2835		struct binder_node *node,
2836		struct binder_proc **procp,
2837		uint32_t *error)
2838{
2839	struct binder_node *target_node = NULL;
2840
2841	binder_node_inner_lock(node);
2842	if (node->proc) {
2843		target_node = node;
2844		binder_inc_node_nilocked(node, 1, 0, NULL);
2845		binder_inc_node_tmpref_ilocked(node);
2846		node->proc->tmp_ref++;
2847		*procp = node->proc;
2848	} else
2849		*error = BR_DEAD_REPLY;
2850	binder_node_inner_unlock(node);
2851
2852	return target_node;
2853}
2854
2855static void binder_set_txn_from_error(struct binder_transaction *t, int id,
2856				      uint32_t command, int32_t param)
2857{
2858	struct binder_thread *from = binder_get_txn_from_and_acq_inner(t);
2859
2860	if (!from) {
2861		/* annotation for sparse */
2862		__release(&from->proc->inner_lock);
2863		return;
2864	}
2865
2866	/* don't override existing errors */
2867	if (from->ee.command == BR_OK)
2868		binder_set_extended_error(&from->ee, id, command, param);
2869	binder_inner_proc_unlock(from->proc);
2870	binder_thread_dec_tmpref(from);
2871}
2872
2873static void binder_transaction(struct binder_proc *proc,
2874			       struct binder_thread *thread,
2875			       struct binder_transaction_data *tr, int reply,
2876			       binder_size_t extra_buffers_size)
2877{
2878	int ret;
2879	struct binder_transaction *t;
2880	struct binder_work *w;
2881	struct binder_work *tcomplete;
2882	binder_size_t buffer_offset = 0;
2883	binder_size_t off_start_offset, off_end_offset;
2884	binder_size_t off_min;
2885	binder_size_t sg_buf_offset, sg_buf_end_offset;
2886	binder_size_t user_offset = 0;
2887	struct binder_proc *target_proc = NULL;
2888	struct binder_thread *target_thread = NULL;
2889	struct binder_node *target_node = NULL;
2890	struct binder_transaction *in_reply_to = NULL;
2891	struct binder_transaction_log_entry *e;
2892	uint32_t return_error = 0;
2893	uint32_t return_error_param = 0;
2894	uint32_t return_error_line = 0;
2895	binder_size_t last_fixup_obj_off = 0;
2896	binder_size_t last_fixup_min_off = 0;
2897	struct binder_context *context = proc->context;
2898	int t_debug_id = atomic_inc_return(&binder_last_id);
2899	char *secctx = NULL;
2900	u32 secctx_sz = 0;
2901	struct list_head sgc_head;
2902	struct list_head pf_head;
2903	const void __user *user_buffer = (const void __user *)
2904				(uintptr_t)tr->data.ptr.buffer;
2905	INIT_LIST_HEAD(&sgc_head);
2906	INIT_LIST_HEAD(&pf_head);
2907
2908	e = binder_transaction_log_add(&binder_transaction_log);
2909	e->debug_id = t_debug_id;
2910	e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY);
2911	e->from_proc = proc->pid;
2912	e->from_thread = thread->pid;
2913	e->target_handle = tr->target.handle;
2914	e->data_size = tr->data_size;
2915	e->offsets_size = tr->offsets_size;
2916	strscpy(e->context_name, proc->context->name, BINDERFS_MAX_NAME);
2917
2918	binder_inner_proc_lock(proc);
2919	binder_set_extended_error(&thread->ee, t_debug_id, BR_OK, 0);
2920	binder_inner_proc_unlock(proc);
2921
2922	if (reply) {
2923		binder_inner_proc_lock(proc);
2924		in_reply_to = thread->transaction_stack;
2925		if (in_reply_to == NULL) {
2926			binder_inner_proc_unlock(proc);
2927			binder_user_error("%d:%d got reply transaction with no transaction stack\n",
2928					  proc->pid, thread->pid);
2929			return_error = BR_FAILED_REPLY;
2930			return_error_param = -EPROTO;
2931			return_error_line = __LINE__;
2932			goto err_empty_call_stack;
2933		}
2934		if (in_reply_to->to_thread != thread) {
2935			spin_lock(&in_reply_to->lock);
2936			binder_user_error("%d:%d got reply transaction with bad transaction stack, transaction %d has target %d:%d\n",
2937				proc->pid, thread->pid, in_reply_to->debug_id,
2938				in_reply_to->to_proc ?
2939				in_reply_to->to_proc->pid : 0,
2940				in_reply_to->to_thread ?
2941				in_reply_to->to_thread->pid : 0);
2942			spin_unlock(&in_reply_to->lock);
2943			binder_inner_proc_unlock(proc);
2944			return_error = BR_FAILED_REPLY;
2945			return_error_param = -EPROTO;
2946			return_error_line = __LINE__;
2947			in_reply_to = NULL;
2948			goto err_bad_call_stack;
2949		}
2950		thread->transaction_stack = in_reply_to->to_parent;
2951		binder_inner_proc_unlock(proc);
2952		binder_set_nice(in_reply_to->saved_priority);
2953		target_thread = binder_get_txn_from_and_acq_inner(in_reply_to);
2954		if (target_thread == NULL) {
2955			/* annotation for sparse */
2956			__release(&target_thread->proc->inner_lock);
2957			binder_txn_error("%d:%d reply target not found\n",
2958				thread->pid, proc->pid);
2959			return_error = BR_DEAD_REPLY;
2960			return_error_line = __LINE__;
2961			goto err_dead_binder;
2962		}
2963		if (target_thread->transaction_stack != in_reply_to) {
2964			binder_user_error("%d:%d got reply transaction with bad target transaction stack %d, expected %d\n",
2965				proc->pid, thread->pid,
2966				target_thread->transaction_stack ?
2967				target_thread->transaction_stack->debug_id : 0,
2968				in_reply_to->debug_id);
2969			binder_inner_proc_unlock(target_thread->proc);
2970			return_error = BR_FAILED_REPLY;
2971			return_error_param = -EPROTO;
2972			return_error_line = __LINE__;
2973			in_reply_to = NULL;
2974			target_thread = NULL;
2975			goto err_dead_binder;
2976		}
2977		target_proc = target_thread->proc;
2978		target_proc->tmp_ref++;
2979		binder_inner_proc_unlock(target_thread->proc);
2980	} else {
2981		if (tr->target.handle) {
2982			struct binder_ref *ref;
2983
2984			/*
2985			 * There must already be a strong ref
2986			 * on this node. If so, do a strong
2987			 * increment on the node to ensure it
2988			 * stays alive until the transaction is
2989			 * done.
2990			 */
2991			binder_proc_lock(proc);
2992			ref = binder_get_ref_olocked(proc, tr->target.handle,
2993						     true);
2994			if (ref) {
2995				target_node = binder_get_node_refs_for_txn(
2996						ref->node, &target_proc,
2997						&return_error);
2998			} else {
2999				binder_user_error("%d:%d got transaction to invalid handle, %u\n",
3000						  proc->pid, thread->pid, tr->target.handle);
3001				return_error = BR_FAILED_REPLY;
3002			}
3003			binder_proc_unlock(proc);
3004		} else {
3005			mutex_lock(&context->context_mgr_node_lock);
3006			target_node = context->binder_context_mgr_node;
3007			if (target_node)
3008				target_node = binder_get_node_refs_for_txn(
3009						target_node, &target_proc,
3010						&return_error);
3011			else
3012				return_error = BR_DEAD_REPLY;
3013			mutex_unlock(&context->context_mgr_node_lock);
3014			if (target_node && target_proc->pid == proc->pid) {
3015				binder_user_error("%d:%d got transaction to context manager from process owning it\n",
3016						  proc->pid, thread->pid);
3017				return_error = BR_FAILED_REPLY;
3018				return_error_param = -EINVAL;
3019				return_error_line = __LINE__;
3020				goto err_invalid_target_handle;
3021			}
3022		}
3023		if (!target_node) {
3024			binder_txn_error("%d:%d cannot find target node\n",
3025				thread->pid, proc->pid);
3026			/*
3027			 * return_error is set above
3028			 */
3029			return_error_param = -EINVAL;
3030			return_error_line = __LINE__;
3031			goto err_dead_binder;
3032		}
3033		e->to_node = target_node->debug_id;
3034		if (WARN_ON(proc == target_proc)) {
3035			binder_txn_error("%d:%d self transactions not allowed\n",
3036				thread->pid, proc->pid);
3037			return_error = BR_FAILED_REPLY;
3038			return_error_param = -EINVAL;
3039			return_error_line = __LINE__;
3040			goto err_invalid_target_handle;
3041		}
3042		if (security_binder_transaction(proc->cred,
3043						target_proc->cred) < 0) {
3044			binder_txn_error("%d:%d transaction credentials failed\n",
3045				thread->pid, proc->pid);
3046			return_error = BR_FAILED_REPLY;
3047			return_error_param = -EPERM;
3048			return_error_line = __LINE__;
3049			goto err_invalid_target_handle;
3050		}
3051		binder_inner_proc_lock(proc);
3052
3053		w = list_first_entry_or_null(&thread->todo,
3054					     struct binder_work, entry);
3055		if (!(tr->flags & TF_ONE_WAY) && w &&
3056		    w->type == BINDER_WORK_TRANSACTION) {
3057			/*
3058			 * Do not allow new outgoing transaction from a
3059			 * thread that has a transaction at the head of
3060			 * its todo list. Only need to check the head
3061			 * because binder_select_thread_ilocked picks a
3062			 * thread from proc->waiting_threads to enqueue
3063			 * the transaction, and nothing is queued to the
3064			 * todo list while the thread is on waiting_threads.
3065			 */
3066			binder_user_error("%d:%d new transaction not allowed when there is a transaction on thread todo\n",
3067					  proc->pid, thread->pid);
3068			binder_inner_proc_unlock(proc);
3069			return_error = BR_FAILED_REPLY;
3070			return_error_param = -EPROTO;
3071			return_error_line = __LINE__;
3072			goto err_bad_todo_list;
3073		}
3074
3075		if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) {
3076			struct binder_transaction *tmp;
3077
3078			tmp = thread->transaction_stack;
3079			if (tmp->to_thread != thread) {
3080				spin_lock(&tmp->lock);
3081				binder_user_error("%d:%d got new transaction with bad transaction stack, transaction %d has target %d:%d\n",
3082					proc->pid, thread->pid, tmp->debug_id,
3083					tmp->to_proc ? tmp->to_proc->pid : 0,
3084					tmp->to_thread ?
3085					tmp->to_thread->pid : 0);
3086				spin_unlock(&tmp->lock);
3087				binder_inner_proc_unlock(proc);
3088				return_error = BR_FAILED_REPLY;
3089				return_error_param = -EPROTO;
3090				return_error_line = __LINE__;
3091				goto err_bad_call_stack;
3092			}
3093			while (tmp) {
3094				struct binder_thread *from;
3095
3096				spin_lock(&tmp->lock);
3097				from = tmp->from;
3098				if (from && from->proc == target_proc) {
3099					atomic_inc(&from->tmp_ref);
3100					target_thread = from;
3101					spin_unlock(&tmp->lock);
3102					break;
3103				}
3104				spin_unlock(&tmp->lock);
3105				tmp = tmp->from_parent;
3106			}
3107		}
3108		binder_inner_proc_unlock(proc);
3109	}
3110	if (target_thread)
3111		e->to_thread = target_thread->pid;
3112	e->to_proc = target_proc->pid;
3113
3114	/* TODO: reuse incoming transaction for reply */
3115	t = kzalloc(sizeof(*t), GFP_KERNEL);
3116	if (t == NULL) {
3117		binder_txn_error("%d:%d cannot allocate transaction\n",
3118			thread->pid, proc->pid);
3119		return_error = BR_FAILED_REPLY;
3120		return_error_param = -ENOMEM;
3121		return_error_line = __LINE__;
3122		goto err_alloc_t_failed;
3123	}
3124	INIT_LIST_HEAD(&t->fd_fixups);
3125	binder_stats_created(BINDER_STAT_TRANSACTION);
3126	spin_lock_init(&t->lock);
3127
3128	tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL);
3129	if (tcomplete == NULL) {
3130		binder_txn_error("%d:%d cannot allocate work for transaction\n",
3131			thread->pid, proc->pid);
3132		return_error = BR_FAILED_REPLY;
3133		return_error_param = -ENOMEM;
3134		return_error_line = __LINE__;
3135		goto err_alloc_tcomplete_failed;
3136	}
3137	binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE);
3138
3139	t->debug_id = t_debug_id;
3140
3141	if (reply)
3142		binder_debug(BINDER_DEBUG_TRANSACTION,
3143			     "%d:%d BC_REPLY %d -> %d:%d, data %016llx-%016llx size %lld-%lld-%lld\n",
3144			     proc->pid, thread->pid, t->debug_id,
3145			     target_proc->pid, target_thread->pid,
3146			     (u64)tr->data.ptr.buffer,
3147			     (u64)tr->data.ptr.offsets,
3148			     (u64)tr->data_size, (u64)tr->offsets_size,
3149			     (u64)extra_buffers_size);
3150	else
3151		binder_debug(BINDER_DEBUG_TRANSACTION,
3152			     "%d:%d BC_TRANSACTION %d -> %d - node %d, data %016llx-%016llx size %lld-%lld-%lld\n",
3153			     proc->pid, thread->pid, t->debug_id,
3154			     target_proc->pid, target_node->debug_id,
3155			     (u64)tr->data.ptr.buffer,
3156			     (u64)tr->data.ptr.offsets,
3157			     (u64)tr->data_size, (u64)tr->offsets_size,
3158			     (u64)extra_buffers_size);
3159
3160	if (!reply && !(tr->flags & TF_ONE_WAY))
3161		t->from = thread;
3162	else
3163		t->from = NULL;
3164	t->sender_euid = task_euid(proc->tsk);
3165	t->to_proc = target_proc;
3166	t->to_thread = target_thread;
3167	t->code = tr->code;
3168	t->flags = tr->flags;
3169	t->priority = task_nice(current);
3170
3171	if (target_node && target_node->txn_security_ctx) {
3172		u32 secid;
3173		size_t added_size;
3174
3175		security_cred_getsecid(proc->cred, &secid);
3176		ret = security_secid_to_secctx(secid, &secctx, &secctx_sz);
3177		if (ret) {
3178			binder_txn_error("%d:%d failed to get security context\n",
3179				thread->pid, proc->pid);
3180			return_error = BR_FAILED_REPLY;
3181			return_error_param = ret;
3182			return_error_line = __LINE__;
3183			goto err_get_secctx_failed;
3184		}
3185		added_size = ALIGN(secctx_sz, sizeof(u64));
3186		extra_buffers_size += added_size;
3187		if (extra_buffers_size < added_size) {
3188			binder_txn_error("%d:%d integer overflow of extra_buffers_size\n",
3189				thread->pid, proc->pid);
3190			return_error = BR_FAILED_REPLY;
3191			return_error_param = -EINVAL;
3192			return_error_line = __LINE__;
3193			goto err_bad_extra_size;
3194		}
3195	}
3196
3197	trace_binder_transaction(reply, t, target_node);
3198
3199	t->buffer = binder_alloc_new_buf(&target_proc->alloc, tr->data_size,
3200		tr->offsets_size, extra_buffers_size,
3201		!reply && (t->flags & TF_ONE_WAY), current->tgid);
3202	if (IS_ERR(t->buffer)) {
3203		char *s;
3204
3205		ret = PTR_ERR(t->buffer);
3206		s = (ret == -ESRCH) ? ": vma cleared, target dead or dying"
3207			: (ret == -ENOSPC) ? ": no space left"
3208			: (ret == -ENOMEM) ? ": memory allocation failed"
3209			: "";
3210		binder_txn_error("cannot allocate buffer%s", s);
3211
3212		return_error_param = PTR_ERR(t->buffer);
3213		return_error = return_error_param == -ESRCH ?
3214			BR_DEAD_REPLY : BR_FAILED_REPLY;
3215		return_error_line = __LINE__;
3216		t->buffer = NULL;
3217		goto err_binder_alloc_buf_failed;
3218	}
3219	if (secctx) {
3220		int err;
3221		size_t buf_offset = ALIGN(tr->data_size, sizeof(void *)) +
3222				    ALIGN(tr->offsets_size, sizeof(void *)) +
3223				    ALIGN(extra_buffers_size, sizeof(void *)) -
3224				    ALIGN(secctx_sz, sizeof(u64));
3225
3226		t->security_ctx = (uintptr_t)t->buffer->user_data + buf_offset;
3227		err = binder_alloc_copy_to_buffer(&target_proc->alloc,
3228						  t->buffer, buf_offset,
3229						  secctx, secctx_sz);
3230		if (err) {
3231			t->security_ctx = 0;
3232			WARN_ON(1);
3233		}
3234		security_release_secctx(secctx, secctx_sz);
3235		secctx = NULL;
3236	}
3237	t->buffer->debug_id = t->debug_id;
3238	t->buffer->transaction = t;
3239	t->buffer->target_node = target_node;
3240	t->buffer->clear_on_free = !!(t->flags & TF_CLEAR_BUF);
3241	trace_binder_transaction_alloc_buf(t->buffer);
3242
3243	if (binder_alloc_copy_user_to_buffer(
3244				&target_proc->alloc,
 
 
 
 
 
 
 
 
 
 
 
 
 
3245				t->buffer,
3246				ALIGN(tr->data_size, sizeof(void *)),
3247				(const void __user *)
3248					(uintptr_t)tr->data.ptr.offsets,
3249				tr->offsets_size)) {
3250		binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
3251				proc->pid, thread->pid);
3252		return_error = BR_FAILED_REPLY;
3253		return_error_param = -EFAULT;
3254		return_error_line = __LINE__;
3255		goto err_copy_data_failed;
3256	}
3257	if (!IS_ALIGNED(tr->offsets_size, sizeof(binder_size_t))) {
3258		binder_user_error("%d:%d got transaction with invalid offsets size, %lld\n",
3259				proc->pid, thread->pid, (u64)tr->offsets_size);
3260		return_error = BR_FAILED_REPLY;
3261		return_error_param = -EINVAL;
3262		return_error_line = __LINE__;
3263		goto err_bad_offset;
3264	}
3265	if (!IS_ALIGNED(extra_buffers_size, sizeof(u64))) {
3266		binder_user_error("%d:%d got transaction with unaligned buffers size, %lld\n",
3267				  proc->pid, thread->pid,
3268				  (u64)extra_buffers_size);
3269		return_error = BR_FAILED_REPLY;
3270		return_error_param = -EINVAL;
3271		return_error_line = __LINE__;
3272		goto err_bad_offset;
3273	}
3274	off_start_offset = ALIGN(tr->data_size, sizeof(void *));
3275	buffer_offset = off_start_offset;
3276	off_end_offset = off_start_offset + tr->offsets_size;
3277	sg_buf_offset = ALIGN(off_end_offset, sizeof(void *));
3278	sg_buf_end_offset = sg_buf_offset + extra_buffers_size -
3279		ALIGN(secctx_sz, sizeof(u64));
3280	off_min = 0;
3281	for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
3282	     buffer_offset += sizeof(binder_size_t)) {
3283		struct binder_object_header *hdr;
3284		size_t object_size;
3285		struct binder_object object;
3286		binder_size_t object_offset;
3287		binder_size_t copy_size;
3288
3289		if (binder_alloc_copy_from_buffer(&target_proc->alloc,
3290						  &object_offset,
3291						  t->buffer,
3292						  buffer_offset,
3293						  sizeof(object_offset))) {
3294			binder_txn_error("%d:%d copy offset from buffer failed\n",
3295				thread->pid, proc->pid);
3296			return_error = BR_FAILED_REPLY;
3297			return_error_param = -EINVAL;
3298			return_error_line = __LINE__;
3299			goto err_bad_offset;
3300		}
3301
3302		/*
3303		 * Copy the source user buffer up to the next object
3304		 * that will be processed.
3305		 */
3306		copy_size = object_offset - user_offset;
3307		if (copy_size && (user_offset > object_offset ||
3308				binder_alloc_copy_user_to_buffer(
3309					&target_proc->alloc,
3310					t->buffer, user_offset,
3311					user_buffer + user_offset,
3312					copy_size))) {
3313			binder_user_error("%d:%d got transaction with invalid data ptr\n",
3314					proc->pid, thread->pid);
3315			return_error = BR_FAILED_REPLY;
3316			return_error_param = -EFAULT;
3317			return_error_line = __LINE__;
3318			goto err_copy_data_failed;
3319		}
3320		object_size = binder_get_object(target_proc, user_buffer,
3321				t->buffer, object_offset, &object);
3322		if (object_size == 0 || object_offset < off_min) {
3323			binder_user_error("%d:%d got transaction with invalid offset (%lld, min %lld max %lld) or object.\n",
3324					  proc->pid, thread->pid,
3325					  (u64)object_offset,
3326					  (u64)off_min,
3327					  (u64)t->buffer->data_size);
3328			return_error = BR_FAILED_REPLY;
3329			return_error_param = -EINVAL;
3330			return_error_line = __LINE__;
3331			goto err_bad_offset;
3332		}
3333		/*
3334		 * Set offset to the next buffer fragment to be
3335		 * copied
3336		 */
3337		user_offset = object_offset + object_size;
3338
3339		hdr = &object.hdr;
3340		off_min = object_offset + object_size;
3341		switch (hdr->type) {
3342		case BINDER_TYPE_BINDER:
3343		case BINDER_TYPE_WEAK_BINDER: {
3344			struct flat_binder_object *fp;
3345
3346			fp = to_flat_binder_object(hdr);
3347			ret = binder_translate_binder(fp, t, thread);
3348
3349			if (ret < 0 ||
3350			    binder_alloc_copy_to_buffer(&target_proc->alloc,
3351							t->buffer,
3352							object_offset,
3353							fp, sizeof(*fp))) {
3354				binder_txn_error("%d:%d translate binder failed\n",
3355					thread->pid, proc->pid);
3356				return_error = BR_FAILED_REPLY;
3357				return_error_param = ret;
3358				return_error_line = __LINE__;
3359				goto err_translate_failed;
3360			}
3361		} break;
3362		case BINDER_TYPE_HANDLE:
3363		case BINDER_TYPE_WEAK_HANDLE: {
3364			struct flat_binder_object *fp;
3365
3366			fp = to_flat_binder_object(hdr);
3367			ret = binder_translate_handle(fp, t, thread);
3368			if (ret < 0 ||
3369			    binder_alloc_copy_to_buffer(&target_proc->alloc,
3370							t->buffer,
3371							object_offset,
3372							fp, sizeof(*fp))) {
3373				binder_txn_error("%d:%d translate handle failed\n",
3374					thread->pid, proc->pid);
3375				return_error = BR_FAILED_REPLY;
3376				return_error_param = ret;
3377				return_error_line = __LINE__;
3378				goto err_translate_failed;
3379			}
3380		} break;
3381
3382		case BINDER_TYPE_FD: {
3383			struct binder_fd_object *fp = to_binder_fd_object(hdr);
3384			binder_size_t fd_offset = object_offset +
3385				(uintptr_t)&fp->fd - (uintptr_t)fp;
3386			int ret = binder_translate_fd(fp->fd, fd_offset, t,
3387						      thread, in_reply_to);
3388
3389			fp->pad_binder = 0;
3390			if (ret < 0 ||
3391			    binder_alloc_copy_to_buffer(&target_proc->alloc,
3392							t->buffer,
3393							object_offset,
3394							fp, sizeof(*fp))) {
3395				binder_txn_error("%d:%d translate fd failed\n",
3396					thread->pid, proc->pid);
3397				return_error = BR_FAILED_REPLY;
3398				return_error_param = ret;
3399				return_error_line = __LINE__;
3400				goto err_translate_failed;
3401			}
3402		} break;
3403		case BINDER_TYPE_FDA: {
3404			struct binder_object ptr_object;
3405			binder_size_t parent_offset;
3406			struct binder_object user_object;
3407			size_t user_parent_size;
3408			struct binder_fd_array_object *fda =
3409				to_binder_fd_array_object(hdr);
3410			size_t num_valid = (buffer_offset - off_start_offset) /
3411						sizeof(binder_size_t);
3412			struct binder_buffer_object *parent =
3413				binder_validate_ptr(target_proc, t->buffer,
3414						    &ptr_object, fda->parent,
3415						    off_start_offset,
3416						    &parent_offset,
3417						    num_valid);
3418			if (!parent) {
3419				binder_user_error("%d:%d got transaction with invalid parent offset or type\n",
3420						  proc->pid, thread->pid);
3421				return_error = BR_FAILED_REPLY;
3422				return_error_param = -EINVAL;
3423				return_error_line = __LINE__;
3424				goto err_bad_parent;
3425			}
3426			if (!binder_validate_fixup(target_proc, t->buffer,
3427						   off_start_offset,
3428						   parent_offset,
3429						   fda->parent_offset,
3430						   last_fixup_obj_off,
3431						   last_fixup_min_off)) {
3432				binder_user_error("%d:%d got transaction with out-of-order buffer fixup\n",
3433						  proc->pid, thread->pid);
3434				return_error = BR_FAILED_REPLY;
3435				return_error_param = -EINVAL;
3436				return_error_line = __LINE__;
3437				goto err_bad_parent;
3438			}
3439			/*
3440			 * We need to read the user version of the parent
3441			 * object to get the original user offset
3442			 */
3443			user_parent_size =
3444				binder_get_object(proc, user_buffer, t->buffer,
3445						  parent_offset, &user_object);
3446			if (user_parent_size != sizeof(user_object.bbo)) {
3447				binder_user_error("%d:%d invalid ptr object size: %zd vs %zd\n",
3448						  proc->pid, thread->pid,
3449						  user_parent_size,
3450						  sizeof(user_object.bbo));
3451				return_error = BR_FAILED_REPLY;
3452				return_error_param = -EINVAL;
3453				return_error_line = __LINE__;
3454				goto err_bad_parent;
3455			}
3456			ret = binder_translate_fd_array(&pf_head, fda,
3457							user_buffer, parent,
3458							&user_object.bbo, t,
3459							thread, in_reply_to);
3460			if (!ret)
3461				ret = binder_alloc_copy_to_buffer(&target_proc->alloc,
3462								  t->buffer,
3463								  object_offset,
3464								  fda, sizeof(*fda));
3465			if (ret) {
3466				binder_txn_error("%d:%d translate fd array failed\n",
3467					thread->pid, proc->pid);
3468				return_error = BR_FAILED_REPLY;
3469				return_error_param = ret > 0 ? -EINVAL : ret;
3470				return_error_line = __LINE__;
3471				goto err_translate_failed;
3472			}
3473			last_fixup_obj_off = parent_offset;
3474			last_fixup_min_off =
3475				fda->parent_offset + sizeof(u32) * fda->num_fds;
3476		} break;
3477		case BINDER_TYPE_PTR: {
3478			struct binder_buffer_object *bp =
3479				to_binder_buffer_object(hdr);
3480			size_t buf_left = sg_buf_end_offset - sg_buf_offset;
3481			size_t num_valid;
3482
3483			if (bp->length > buf_left) {
3484				binder_user_error("%d:%d got transaction with too large buffer\n",
3485						  proc->pid, thread->pid);
3486				return_error = BR_FAILED_REPLY;
3487				return_error_param = -EINVAL;
3488				return_error_line = __LINE__;
3489				goto err_bad_offset;
3490			}
3491			ret = binder_defer_copy(&sgc_head, sg_buf_offset,
3492				(const void __user *)(uintptr_t)bp->buffer,
3493				bp->length);
3494			if (ret) {
3495				binder_txn_error("%d:%d deferred copy failed\n",
3496					thread->pid, proc->pid);
 
 
 
 
3497				return_error = BR_FAILED_REPLY;
3498				return_error_param = ret;
3499				return_error_line = __LINE__;
3500				goto err_translate_failed;
3501			}
3502			/* Fixup buffer pointer to target proc address space */
3503			bp->buffer = (uintptr_t)
3504				t->buffer->user_data + sg_buf_offset;
3505			sg_buf_offset += ALIGN(bp->length, sizeof(u64));
3506
3507			num_valid = (buffer_offset - off_start_offset) /
3508					sizeof(binder_size_t);
3509			ret = binder_fixup_parent(&pf_head, t,
3510						  thread, bp,
3511						  off_start_offset,
3512						  num_valid,
3513						  last_fixup_obj_off,
3514						  last_fixup_min_off);
3515			if (ret < 0 ||
3516			    binder_alloc_copy_to_buffer(&target_proc->alloc,
3517							t->buffer,
3518							object_offset,
3519							bp, sizeof(*bp))) {
3520				binder_txn_error("%d:%d failed to fixup parent\n",
3521					thread->pid, proc->pid);
3522				return_error = BR_FAILED_REPLY;
3523				return_error_param = ret;
3524				return_error_line = __LINE__;
3525				goto err_translate_failed;
3526			}
3527			last_fixup_obj_off = object_offset;
3528			last_fixup_min_off = 0;
3529		} break;
3530		default:
3531			binder_user_error("%d:%d got transaction with invalid object type, %x\n",
3532				proc->pid, thread->pid, hdr->type);
3533			return_error = BR_FAILED_REPLY;
3534			return_error_param = -EINVAL;
3535			return_error_line = __LINE__;
3536			goto err_bad_object_type;
3537		}
3538	}
3539	/* Done processing objects, copy the rest of the buffer */
3540	if (binder_alloc_copy_user_to_buffer(
3541				&target_proc->alloc,
3542				t->buffer, user_offset,
3543				user_buffer + user_offset,
3544				tr->data_size - user_offset)) {
3545		binder_user_error("%d:%d got transaction with invalid data ptr\n",
3546				proc->pid, thread->pid);
3547		return_error = BR_FAILED_REPLY;
3548		return_error_param = -EFAULT;
3549		return_error_line = __LINE__;
3550		goto err_copy_data_failed;
3551	}
3552
3553	ret = binder_do_deferred_txn_copies(&target_proc->alloc, t->buffer,
3554					    &sgc_head, &pf_head);
3555	if (ret) {
3556		binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
3557				  proc->pid, thread->pid);
3558		return_error = BR_FAILED_REPLY;
3559		return_error_param = ret;
3560		return_error_line = __LINE__;
3561		goto err_copy_data_failed;
3562	}
3563	if (t->buffer->oneway_spam_suspect)
3564		tcomplete->type = BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT;
3565	else
3566		tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
3567	t->work.type = BINDER_WORK_TRANSACTION;
3568
3569	if (reply) {
3570		binder_enqueue_thread_work(thread, tcomplete);
3571		binder_inner_proc_lock(target_proc);
3572		if (target_thread->is_dead) {
3573			return_error = BR_DEAD_REPLY;
3574			binder_inner_proc_unlock(target_proc);
3575			goto err_dead_proc_or_thread;
3576		}
3577		BUG_ON(t->buffer->async_transaction != 0);
3578		binder_pop_transaction_ilocked(target_thread, in_reply_to);
3579		binder_enqueue_thread_work_ilocked(target_thread, &t->work);
3580		target_proc->outstanding_txns++;
3581		binder_inner_proc_unlock(target_proc);
3582		wake_up_interruptible_sync(&target_thread->wait);
3583		binder_free_transaction(in_reply_to);
3584	} else if (!(t->flags & TF_ONE_WAY)) {
3585		BUG_ON(t->buffer->async_transaction != 0);
3586		binder_inner_proc_lock(proc);
3587		/*
3588		 * Defer the TRANSACTION_COMPLETE, so we don't return to
3589		 * userspace immediately; this allows the target process to
3590		 * immediately start processing this transaction, reducing
3591		 * latency. We will then return the TRANSACTION_COMPLETE when
3592		 * the target replies (or there is an error).
3593		 */
3594		binder_enqueue_deferred_thread_work_ilocked(thread, tcomplete);
3595		t->need_reply = 1;
3596		t->from_parent = thread->transaction_stack;
3597		thread->transaction_stack = t;
3598		binder_inner_proc_unlock(proc);
3599		return_error = binder_proc_transaction(t,
3600				target_proc, target_thread);
3601		if (return_error) {
3602			binder_inner_proc_lock(proc);
3603			binder_pop_transaction_ilocked(thread, t);
3604			binder_inner_proc_unlock(proc);
3605			goto err_dead_proc_or_thread;
3606		}
3607	} else {
3608		BUG_ON(target_node == NULL);
3609		BUG_ON(t->buffer->async_transaction != 1);
3610		binder_enqueue_thread_work(thread, tcomplete);
3611		return_error = binder_proc_transaction(t, target_proc, NULL);
3612		if (return_error)
3613			goto err_dead_proc_or_thread;
3614	}
3615	if (target_thread)
3616		binder_thread_dec_tmpref(target_thread);
3617	binder_proc_dec_tmpref(target_proc);
3618	if (target_node)
3619		binder_dec_node_tmpref(target_node);
3620	/*
3621	 * write barrier to synchronize with initialization
3622	 * of log entry
3623	 */
3624	smp_wmb();
3625	WRITE_ONCE(e->debug_id_done, t_debug_id);
3626	return;
3627
3628err_dead_proc_or_thread:
3629	binder_txn_error("%d:%d dead process or thread\n",
3630		thread->pid, proc->pid);
3631	return_error_line = __LINE__;
3632	binder_dequeue_work(proc, tcomplete);
3633err_translate_failed:
3634err_bad_object_type:
3635err_bad_offset:
3636err_bad_parent:
3637err_copy_data_failed:
3638	binder_cleanup_deferred_txn_lists(&sgc_head, &pf_head);
3639	binder_free_txn_fixups(t);
3640	trace_binder_transaction_failed_buffer_release(t->buffer);
3641	binder_transaction_buffer_release(target_proc, NULL, t->buffer,
3642					  buffer_offset, true);
3643	if (target_node)
3644		binder_dec_node_tmpref(target_node);
3645	target_node = NULL;
3646	t->buffer->transaction = NULL;
3647	binder_alloc_free_buf(&target_proc->alloc, t->buffer);
3648err_binder_alloc_buf_failed:
3649err_bad_extra_size:
3650	if (secctx)
3651		security_release_secctx(secctx, secctx_sz);
3652err_get_secctx_failed:
3653	kfree(tcomplete);
3654	binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
3655err_alloc_tcomplete_failed:
3656	if (trace_binder_txn_latency_free_enabled())
3657		binder_txn_latency_free(t);
3658	kfree(t);
3659	binder_stats_deleted(BINDER_STAT_TRANSACTION);
3660err_alloc_t_failed:
3661err_bad_todo_list:
3662err_bad_call_stack:
3663err_empty_call_stack:
3664err_dead_binder:
3665err_invalid_target_handle:
 
 
 
 
3666	if (target_node) {
3667		binder_dec_node(target_node, 1, 0);
3668		binder_dec_node_tmpref(target_node);
3669	}
3670
3671	binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
3672		     "%d:%d transaction %s to %d:%d failed %d/%d/%d, size %lld-%lld line %d\n",
3673		     proc->pid, thread->pid, reply ? "reply" :
3674		     (tr->flags & TF_ONE_WAY ? "async" : "call"),
3675		     target_proc ? target_proc->pid : 0,
3676		     target_thread ? target_thread->pid : 0,
3677		     t_debug_id, return_error, return_error_param,
3678		     (u64)tr->data_size, (u64)tr->offsets_size,
3679		     return_error_line);
3680
3681	if (target_thread)
3682		binder_thread_dec_tmpref(target_thread);
3683	if (target_proc)
3684		binder_proc_dec_tmpref(target_proc);
3685
3686	{
3687		struct binder_transaction_log_entry *fe;
3688
3689		e->return_error = return_error;
3690		e->return_error_param = return_error_param;
3691		e->return_error_line = return_error_line;
3692		fe = binder_transaction_log_add(&binder_transaction_log_failed);
3693		*fe = *e;
3694		/*
3695		 * write barrier to synchronize with initialization
3696		 * of log entry
3697		 */
3698		smp_wmb();
3699		WRITE_ONCE(e->debug_id_done, t_debug_id);
3700		WRITE_ONCE(fe->debug_id_done, t_debug_id);
3701	}
3702
3703	BUG_ON(thread->return_error.cmd != BR_OK);
3704	if (in_reply_to) {
3705		binder_set_txn_from_error(in_reply_to, t_debug_id,
3706				return_error, return_error_param);
3707		thread->return_error.cmd = BR_TRANSACTION_COMPLETE;
3708		binder_enqueue_thread_work(thread, &thread->return_error.work);
3709		binder_send_failed_reply(in_reply_to, return_error);
3710	} else {
3711		binder_inner_proc_lock(proc);
3712		binder_set_extended_error(&thread->ee, t_debug_id,
3713				return_error, return_error_param);
3714		binder_inner_proc_unlock(proc);
3715		thread->return_error.cmd = return_error;
3716		binder_enqueue_thread_work(thread, &thread->return_error.work);
3717	}
3718}
3719
3720/**
3721 * binder_free_buf() - free the specified buffer
3722 * @proc:	binder proc that owns buffer
3723 * @buffer:	buffer to be freed
3724 * @is_failure:	failed to send transaction
3725 *
3726 * If buffer for an async transaction, enqueue the next async
3727 * transaction from the node.
3728 *
3729 * Cleanup buffer and free it.
3730 */
3731static void
3732binder_free_buf(struct binder_proc *proc,
3733		struct binder_thread *thread,
3734		struct binder_buffer *buffer, bool is_failure)
3735{
3736	binder_inner_proc_lock(proc);
3737	if (buffer->transaction) {
3738		buffer->transaction->buffer = NULL;
3739		buffer->transaction = NULL;
3740	}
3741	binder_inner_proc_unlock(proc);
3742	if (buffer->async_transaction && buffer->target_node) {
3743		struct binder_node *buf_node;
3744		struct binder_work *w;
3745
3746		buf_node = buffer->target_node;
3747		binder_node_inner_lock(buf_node);
3748		BUG_ON(!buf_node->has_async_transaction);
3749		BUG_ON(buf_node->proc != proc);
3750		w = binder_dequeue_work_head_ilocked(
3751				&buf_node->async_todo);
3752		if (!w) {
3753			buf_node->has_async_transaction = false;
3754		} else {
3755			binder_enqueue_work_ilocked(
3756					w, &proc->todo);
3757			binder_wakeup_proc_ilocked(proc);
3758		}
3759		binder_node_inner_unlock(buf_node);
3760	}
3761	trace_binder_transaction_buffer_release(buffer);
3762	binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure);
3763	binder_alloc_free_buf(&proc->alloc, buffer);
3764}
3765
3766static int binder_thread_write(struct binder_proc *proc,
3767			struct binder_thread *thread,
3768			binder_uintptr_t binder_buffer, size_t size,
3769			binder_size_t *consumed)
3770{
3771	uint32_t cmd;
3772	struct binder_context *context = proc->context;
3773	void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
3774	void __user *ptr = buffer + *consumed;
3775	void __user *end = buffer + size;
3776
3777	while (ptr < end && thread->return_error.cmd == BR_OK) {
3778		int ret;
3779
3780		if (get_user(cmd, (uint32_t __user *)ptr))
3781			return -EFAULT;
3782		ptr += sizeof(uint32_t);
3783		trace_binder_command(cmd);
3784		if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) {
3785			atomic_inc(&binder_stats.bc[_IOC_NR(cmd)]);
3786			atomic_inc(&proc->stats.bc[_IOC_NR(cmd)]);
3787			atomic_inc(&thread->stats.bc[_IOC_NR(cmd)]);
3788		}
3789		switch (cmd) {
3790		case BC_INCREFS:
3791		case BC_ACQUIRE:
3792		case BC_RELEASE:
3793		case BC_DECREFS: {
3794			uint32_t target;
3795			const char *debug_string;
3796			bool strong = cmd == BC_ACQUIRE || cmd == BC_RELEASE;
3797			bool increment = cmd == BC_INCREFS || cmd == BC_ACQUIRE;
3798			struct binder_ref_data rdata;
3799
3800			if (get_user(target, (uint32_t __user *)ptr))
3801				return -EFAULT;
3802
3803			ptr += sizeof(uint32_t);
3804			ret = -1;
3805			if (increment && !target) {
3806				struct binder_node *ctx_mgr_node;
3807
3808				mutex_lock(&context->context_mgr_node_lock);
3809				ctx_mgr_node = context->binder_context_mgr_node;
3810				if (ctx_mgr_node) {
3811					if (ctx_mgr_node->proc == proc) {
3812						binder_user_error("%d:%d context manager tried to acquire desc 0\n",
3813								  proc->pid, thread->pid);
3814						mutex_unlock(&context->context_mgr_node_lock);
3815						return -EINVAL;
3816					}
3817					ret = binder_inc_ref_for_node(
3818							proc, ctx_mgr_node,
3819							strong, NULL, &rdata);
3820				}
3821				mutex_unlock(&context->context_mgr_node_lock);
3822			}
3823			if (ret)
3824				ret = binder_update_ref_for_handle(
3825						proc, target, increment, strong,
3826						&rdata);
3827			if (!ret && rdata.desc != target) {
3828				binder_user_error("%d:%d tried to acquire reference to desc %d, got %d instead\n",
3829					proc->pid, thread->pid,
3830					target, rdata.desc);
3831			}
3832			switch (cmd) {
3833			case BC_INCREFS:
3834				debug_string = "IncRefs";
3835				break;
3836			case BC_ACQUIRE:
3837				debug_string = "Acquire";
3838				break;
3839			case BC_RELEASE:
3840				debug_string = "Release";
3841				break;
3842			case BC_DECREFS:
3843			default:
3844				debug_string = "DecRefs";
3845				break;
3846			}
3847			if (ret) {
3848				binder_user_error("%d:%d %s %d refcount change on invalid ref %d ret %d\n",
3849					proc->pid, thread->pid, debug_string,
3850					strong, target, ret);
3851				break;
3852			}
3853			binder_debug(BINDER_DEBUG_USER_REFS,
3854				     "%d:%d %s ref %d desc %d s %d w %d\n",
3855				     proc->pid, thread->pid, debug_string,
3856				     rdata.debug_id, rdata.desc, rdata.strong,
3857				     rdata.weak);
3858			break;
3859		}
3860		case BC_INCREFS_DONE:
3861		case BC_ACQUIRE_DONE: {
3862			binder_uintptr_t node_ptr;
3863			binder_uintptr_t cookie;
3864			struct binder_node *node;
3865			bool free_node;
3866
3867			if (get_user(node_ptr, (binder_uintptr_t __user *)ptr))
3868				return -EFAULT;
3869			ptr += sizeof(binder_uintptr_t);
3870			if (get_user(cookie, (binder_uintptr_t __user *)ptr))
3871				return -EFAULT;
3872			ptr += sizeof(binder_uintptr_t);
3873			node = binder_get_node(proc, node_ptr);
3874			if (node == NULL) {
3875				binder_user_error("%d:%d %s u%016llx no match\n",
3876					proc->pid, thread->pid,
3877					cmd == BC_INCREFS_DONE ?
3878					"BC_INCREFS_DONE" :
3879					"BC_ACQUIRE_DONE",
3880					(u64)node_ptr);
3881				break;
3882			}
3883			if (cookie != node->cookie) {
3884				binder_user_error("%d:%d %s u%016llx node %d cookie mismatch %016llx != %016llx\n",
3885					proc->pid, thread->pid,
3886					cmd == BC_INCREFS_DONE ?
3887					"BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
3888					(u64)node_ptr, node->debug_id,
3889					(u64)cookie, (u64)node->cookie);
3890				binder_put_node(node);
3891				break;
3892			}
3893			binder_node_inner_lock(node);
3894			if (cmd == BC_ACQUIRE_DONE) {
3895				if (node->pending_strong_ref == 0) {
3896					binder_user_error("%d:%d BC_ACQUIRE_DONE node %d has no pending acquire request\n",
3897						proc->pid, thread->pid,
3898						node->debug_id);
3899					binder_node_inner_unlock(node);
3900					binder_put_node(node);
3901					break;
3902				}
3903				node->pending_strong_ref = 0;
3904			} else {
3905				if (node->pending_weak_ref == 0) {
3906					binder_user_error("%d:%d BC_INCREFS_DONE node %d has no pending increfs request\n",
3907						proc->pid, thread->pid,
3908						node->debug_id);
3909					binder_node_inner_unlock(node);
3910					binder_put_node(node);
3911					break;
3912				}
3913				node->pending_weak_ref = 0;
3914			}
3915			free_node = binder_dec_node_nilocked(node,
3916					cmd == BC_ACQUIRE_DONE, 0);
3917			WARN_ON(free_node);
3918			binder_debug(BINDER_DEBUG_USER_REFS,
3919				     "%d:%d %s node %d ls %d lw %d tr %d\n",
3920				     proc->pid, thread->pid,
3921				     cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
3922				     node->debug_id, node->local_strong_refs,
3923				     node->local_weak_refs, node->tmp_refs);
3924			binder_node_inner_unlock(node);
3925			binder_put_node(node);
3926			break;
3927		}
3928		case BC_ATTEMPT_ACQUIRE:
3929			pr_err("BC_ATTEMPT_ACQUIRE not supported\n");
3930			return -EINVAL;
3931		case BC_ACQUIRE_RESULT:
3932			pr_err("BC_ACQUIRE_RESULT not supported\n");
3933			return -EINVAL;
3934
3935		case BC_FREE_BUFFER: {
3936			binder_uintptr_t data_ptr;
3937			struct binder_buffer *buffer;
3938
3939			if (get_user(data_ptr, (binder_uintptr_t __user *)ptr))
3940				return -EFAULT;
3941			ptr += sizeof(binder_uintptr_t);
3942
3943			buffer = binder_alloc_prepare_to_free(&proc->alloc,
3944							      data_ptr);
3945			if (IS_ERR_OR_NULL(buffer)) {
3946				if (PTR_ERR(buffer) == -EPERM) {
3947					binder_user_error(
3948						"%d:%d BC_FREE_BUFFER u%016llx matched unreturned or currently freeing buffer\n",
3949						proc->pid, thread->pid,
3950						(u64)data_ptr);
3951				} else {
3952					binder_user_error(
3953						"%d:%d BC_FREE_BUFFER u%016llx no match\n",
3954						proc->pid, thread->pid,
3955						(u64)data_ptr);
3956				}
3957				break;
3958			}
3959			binder_debug(BINDER_DEBUG_FREE_BUFFER,
3960				     "%d:%d BC_FREE_BUFFER u%016llx found buffer %d for %s transaction\n",
3961				     proc->pid, thread->pid, (u64)data_ptr,
3962				     buffer->debug_id,
3963				     buffer->transaction ? "active" : "finished");
3964			binder_free_buf(proc, thread, buffer, false);
3965			break;
3966		}
3967
3968		case BC_TRANSACTION_SG:
3969		case BC_REPLY_SG: {
3970			struct binder_transaction_data_sg tr;
3971
3972			if (copy_from_user(&tr, ptr, sizeof(tr)))
3973				return -EFAULT;
3974			ptr += sizeof(tr);
3975			binder_transaction(proc, thread, &tr.transaction_data,
3976					   cmd == BC_REPLY_SG, tr.buffers_size);
3977			break;
3978		}
3979		case BC_TRANSACTION:
3980		case BC_REPLY: {
3981			struct binder_transaction_data tr;
3982
3983			if (copy_from_user(&tr, ptr, sizeof(tr)))
3984				return -EFAULT;
3985			ptr += sizeof(tr);
3986			binder_transaction(proc, thread, &tr,
3987					   cmd == BC_REPLY, 0);
3988			break;
3989		}
3990
3991		case BC_REGISTER_LOOPER:
3992			binder_debug(BINDER_DEBUG_THREADS,
3993				     "%d:%d BC_REGISTER_LOOPER\n",
3994				     proc->pid, thread->pid);
3995			binder_inner_proc_lock(proc);
3996			if (thread->looper & BINDER_LOOPER_STATE_ENTERED) {
3997				thread->looper |= BINDER_LOOPER_STATE_INVALID;
3998				binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER\n",
3999					proc->pid, thread->pid);
4000			} else if (proc->requested_threads == 0) {
4001				thread->looper |= BINDER_LOOPER_STATE_INVALID;
4002				binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called without request\n",
4003					proc->pid, thread->pid);
4004			} else {
4005				proc->requested_threads--;
4006				proc->requested_threads_started++;
4007			}
4008			thread->looper |= BINDER_LOOPER_STATE_REGISTERED;
4009			binder_inner_proc_unlock(proc);
4010			break;
4011		case BC_ENTER_LOOPER:
4012			binder_debug(BINDER_DEBUG_THREADS,
4013				     "%d:%d BC_ENTER_LOOPER\n",
4014				     proc->pid, thread->pid);
4015			if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) {
4016				thread->looper |= BINDER_LOOPER_STATE_INVALID;
4017				binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n",
4018					proc->pid, thread->pid);
4019			}
4020			thread->looper |= BINDER_LOOPER_STATE_ENTERED;
4021			break;
4022		case BC_EXIT_LOOPER:
4023			binder_debug(BINDER_DEBUG_THREADS,
4024				     "%d:%d BC_EXIT_LOOPER\n",
4025				     proc->pid, thread->pid);
4026			thread->looper |= BINDER_LOOPER_STATE_EXITED;
4027			break;
4028
4029		case BC_REQUEST_DEATH_NOTIFICATION:
4030		case BC_CLEAR_DEATH_NOTIFICATION: {
4031			uint32_t target;
4032			binder_uintptr_t cookie;
4033			struct binder_ref *ref;
4034			struct binder_ref_death *death = NULL;
4035
4036			if (get_user(target, (uint32_t __user *)ptr))
4037				return -EFAULT;
4038			ptr += sizeof(uint32_t);
4039			if (get_user(cookie, (binder_uintptr_t __user *)ptr))
4040				return -EFAULT;
4041			ptr += sizeof(binder_uintptr_t);
4042			if (cmd == BC_REQUEST_DEATH_NOTIFICATION) {
4043				/*
4044				 * Allocate memory for death notification
4045				 * before taking lock
4046				 */
4047				death = kzalloc(sizeof(*death), GFP_KERNEL);
4048				if (death == NULL) {
4049					WARN_ON(thread->return_error.cmd !=
4050						BR_OK);
4051					thread->return_error.cmd = BR_ERROR;
4052					binder_enqueue_thread_work(
4053						thread,
4054						&thread->return_error.work);
4055					binder_debug(
4056						BINDER_DEBUG_FAILED_TRANSACTION,
4057						"%d:%d BC_REQUEST_DEATH_NOTIFICATION failed\n",
4058						proc->pid, thread->pid);
4059					break;
4060				}
4061			}
4062			binder_proc_lock(proc);
4063			ref = binder_get_ref_olocked(proc, target, false);
4064			if (ref == NULL) {
4065				binder_user_error("%d:%d %s invalid ref %d\n",
4066					proc->pid, thread->pid,
4067					cmd == BC_REQUEST_DEATH_NOTIFICATION ?
4068					"BC_REQUEST_DEATH_NOTIFICATION" :
4069					"BC_CLEAR_DEATH_NOTIFICATION",
4070					target);
4071				binder_proc_unlock(proc);
4072				kfree(death);
4073				break;
4074			}
4075
4076			binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
4077				     "%d:%d %s %016llx ref %d desc %d s %d w %d for node %d\n",
4078				     proc->pid, thread->pid,
4079				     cmd == BC_REQUEST_DEATH_NOTIFICATION ?
4080				     "BC_REQUEST_DEATH_NOTIFICATION" :
4081				     "BC_CLEAR_DEATH_NOTIFICATION",
4082				     (u64)cookie, ref->data.debug_id,
4083				     ref->data.desc, ref->data.strong,
4084				     ref->data.weak, ref->node->debug_id);
4085
4086			binder_node_lock(ref->node);
4087			if (cmd == BC_REQUEST_DEATH_NOTIFICATION) {
4088				if (ref->death) {
4089					binder_user_error("%d:%d BC_REQUEST_DEATH_NOTIFICATION death notification already set\n",
4090						proc->pid, thread->pid);
4091					binder_node_unlock(ref->node);
4092					binder_proc_unlock(proc);
4093					kfree(death);
4094					break;
4095				}
4096				binder_stats_created(BINDER_STAT_DEATH);
4097				INIT_LIST_HEAD(&death->work.entry);
4098				death->cookie = cookie;
4099				ref->death = death;
4100				if (ref->node->proc == NULL) {
4101					ref->death->work.type = BINDER_WORK_DEAD_BINDER;
4102
4103					binder_inner_proc_lock(proc);
4104					binder_enqueue_work_ilocked(
4105						&ref->death->work, &proc->todo);
4106					binder_wakeup_proc_ilocked(proc);
4107					binder_inner_proc_unlock(proc);
4108				}
4109			} else {
4110				if (ref->death == NULL) {
4111					binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification not active\n",
4112						proc->pid, thread->pid);
4113					binder_node_unlock(ref->node);
4114					binder_proc_unlock(proc);
4115					break;
4116				}
4117				death = ref->death;
4118				if (death->cookie != cookie) {
4119					binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch %016llx != %016llx\n",
4120						proc->pid, thread->pid,
4121						(u64)death->cookie,
4122						(u64)cookie);
4123					binder_node_unlock(ref->node);
4124					binder_proc_unlock(proc);
4125					break;
4126				}
4127				ref->death = NULL;
4128				binder_inner_proc_lock(proc);
4129				if (list_empty(&death->work.entry)) {
4130					death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;
4131					if (thread->looper &
4132					    (BINDER_LOOPER_STATE_REGISTERED |
4133					     BINDER_LOOPER_STATE_ENTERED))
4134						binder_enqueue_thread_work_ilocked(
4135								thread,
4136								&death->work);
4137					else {
4138						binder_enqueue_work_ilocked(
4139								&death->work,
4140								&proc->todo);
4141						binder_wakeup_proc_ilocked(
4142								proc);
4143					}
4144				} else {
4145					BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER);
4146					death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR;
4147				}
4148				binder_inner_proc_unlock(proc);
4149			}
4150			binder_node_unlock(ref->node);
4151			binder_proc_unlock(proc);
4152		} break;
4153		case BC_DEAD_BINDER_DONE: {
4154			struct binder_work *w;
4155			binder_uintptr_t cookie;
4156			struct binder_ref_death *death = NULL;
4157
4158			if (get_user(cookie, (binder_uintptr_t __user *)ptr))
4159				return -EFAULT;
4160
4161			ptr += sizeof(cookie);
4162			binder_inner_proc_lock(proc);
4163			list_for_each_entry(w, &proc->delivered_death,
4164					    entry) {
4165				struct binder_ref_death *tmp_death =
4166					container_of(w,
4167						     struct binder_ref_death,
4168						     work);
4169
4170				if (tmp_death->cookie == cookie) {
4171					death = tmp_death;
4172					break;
4173				}
4174			}
4175			binder_debug(BINDER_DEBUG_DEAD_BINDER,
4176				     "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
4177				     proc->pid, thread->pid, (u64)cookie,
4178				     death);
4179			if (death == NULL) {
4180				binder_user_error("%d:%d BC_DEAD_BINDER_DONE %016llx not found\n",
4181					proc->pid, thread->pid, (u64)cookie);
4182				binder_inner_proc_unlock(proc);
4183				break;
4184			}
4185			binder_dequeue_work_ilocked(&death->work);
4186			if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) {
4187				death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;
4188				if (thread->looper &
4189					(BINDER_LOOPER_STATE_REGISTERED |
4190					 BINDER_LOOPER_STATE_ENTERED))
4191					binder_enqueue_thread_work_ilocked(
4192						thread, &death->work);
4193				else {
4194					binder_enqueue_work_ilocked(
4195							&death->work,
4196							&proc->todo);
4197					binder_wakeup_proc_ilocked(proc);
4198				}
4199			}
4200			binder_inner_proc_unlock(proc);
4201		} break;
4202
4203		default:
4204			pr_err("%d:%d unknown command %u\n",
4205			       proc->pid, thread->pid, cmd);
4206			return -EINVAL;
4207		}
4208		*consumed = ptr - buffer;
4209	}
4210	return 0;
4211}
4212
4213static void binder_stat_br(struct binder_proc *proc,
4214			   struct binder_thread *thread, uint32_t cmd)
4215{
4216	trace_binder_return(cmd);
4217	if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) {
4218		atomic_inc(&binder_stats.br[_IOC_NR(cmd)]);
4219		atomic_inc(&proc->stats.br[_IOC_NR(cmd)]);
4220		atomic_inc(&thread->stats.br[_IOC_NR(cmd)]);
4221	}
4222}
4223
4224static int binder_put_node_cmd(struct binder_proc *proc,
4225			       struct binder_thread *thread,
4226			       void __user **ptrp,
4227			       binder_uintptr_t node_ptr,
4228			       binder_uintptr_t node_cookie,
4229			       int node_debug_id,
4230			       uint32_t cmd, const char *cmd_name)
4231{
4232	void __user *ptr = *ptrp;
4233
4234	if (put_user(cmd, (uint32_t __user *)ptr))
4235		return -EFAULT;
4236	ptr += sizeof(uint32_t);
4237
4238	if (put_user(node_ptr, (binder_uintptr_t __user *)ptr))
4239		return -EFAULT;
4240	ptr += sizeof(binder_uintptr_t);
4241
4242	if (put_user(node_cookie, (binder_uintptr_t __user *)ptr))
4243		return -EFAULT;
4244	ptr += sizeof(binder_uintptr_t);
4245
4246	binder_stat_br(proc, thread, cmd);
4247	binder_debug(BINDER_DEBUG_USER_REFS, "%d:%d %s %d u%016llx c%016llx\n",
4248		     proc->pid, thread->pid, cmd_name, node_debug_id,
4249		     (u64)node_ptr, (u64)node_cookie);
4250
4251	*ptrp = ptr;
4252	return 0;
4253}
4254
4255static int binder_wait_for_work(struct binder_thread *thread,
4256				bool do_proc_work)
4257{
4258	DEFINE_WAIT(wait);
4259	struct binder_proc *proc = thread->proc;
4260	int ret = 0;
4261
 
4262	binder_inner_proc_lock(proc);
4263	for (;;) {
4264		prepare_to_wait(&thread->wait, &wait, TASK_INTERRUPTIBLE|TASK_FREEZABLE);
4265		if (binder_has_work_ilocked(thread, do_proc_work))
4266			break;
4267		if (do_proc_work)
4268			list_add(&thread->waiting_thread_node,
4269				 &proc->waiting_threads);
4270		binder_inner_proc_unlock(proc);
4271		schedule();
4272		binder_inner_proc_lock(proc);
4273		list_del_init(&thread->waiting_thread_node);
4274		if (signal_pending(current)) {
4275			ret = -EINTR;
4276			break;
4277		}
4278	}
4279	finish_wait(&thread->wait, &wait);
4280	binder_inner_proc_unlock(proc);
 
4281
4282	return ret;
4283}
4284
4285/**
4286 * binder_apply_fd_fixups() - finish fd translation
4287 * @proc:         binder_proc associated @t->buffer
4288 * @t:	binder transaction with list of fd fixups
4289 *
4290 * Now that we are in the context of the transaction target
4291 * process, we can allocate and install fds. Process the
4292 * list of fds to translate and fixup the buffer with the
4293 * new fds first and only then install the files.
4294 *
4295 * If we fail to allocate an fd, skip the install and release
 
4296 * any fds that have already been allocated.
4297 */
4298static int binder_apply_fd_fixups(struct binder_proc *proc,
4299				  struct binder_transaction *t)
4300{
4301	struct binder_txn_fd_fixup *fixup, *tmp;
4302	int ret = 0;
4303
4304	list_for_each_entry(fixup, &t->fd_fixups, fixup_entry) {
4305		int fd = get_unused_fd_flags(O_CLOEXEC);
4306
4307		if (fd < 0) {
4308			binder_debug(BINDER_DEBUG_TRANSACTION,
4309				     "failed fd fixup txn %d fd %d\n",
4310				     t->debug_id, fd);
4311			ret = -ENOMEM;
4312			goto err;
4313		}
4314		binder_debug(BINDER_DEBUG_TRANSACTION,
4315			     "fd fixup txn %d fd %d\n",
4316			     t->debug_id, fd);
4317		trace_binder_transaction_fd_recv(t, fd, fixup->offset);
4318		fixup->target_fd = fd;
 
4319		if (binder_alloc_copy_to_buffer(&proc->alloc, t->buffer,
4320						fixup->offset, &fd,
4321						sizeof(u32))) {
4322			ret = -EINVAL;
4323			goto err;
4324		}
4325	}
4326	list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) {
4327		fd_install(fixup->target_fd, fixup->file);
 
 
 
 
 
 
 
 
 
 
 
 
 
4328		list_del(&fixup->fixup_entry);
4329		kfree(fixup);
4330	}
4331
4332	return ret;
4333
4334err:
4335	binder_free_txn_fixups(t);
4336	return ret;
4337}
4338
4339static int binder_thread_read(struct binder_proc *proc,
4340			      struct binder_thread *thread,
4341			      binder_uintptr_t binder_buffer, size_t size,
4342			      binder_size_t *consumed, int non_block)
4343{
4344	void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
4345	void __user *ptr = buffer + *consumed;
4346	void __user *end = buffer + size;
4347
4348	int ret = 0;
4349	int wait_for_proc_work;
4350
4351	if (*consumed == 0) {
4352		if (put_user(BR_NOOP, (uint32_t __user *)ptr))
4353			return -EFAULT;
4354		ptr += sizeof(uint32_t);
4355	}
4356
4357retry:
4358	binder_inner_proc_lock(proc);
4359	wait_for_proc_work = binder_available_for_proc_work_ilocked(thread);
4360	binder_inner_proc_unlock(proc);
4361
4362	thread->looper |= BINDER_LOOPER_STATE_WAITING;
4363
4364	trace_binder_wait_for_work(wait_for_proc_work,
4365				   !!thread->transaction_stack,
4366				   !binder_worklist_empty(proc, &thread->todo));
4367	if (wait_for_proc_work) {
4368		if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
4369					BINDER_LOOPER_STATE_ENTERED))) {
4370			binder_user_error("%d:%d ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state %x)\n",
4371				proc->pid, thread->pid, thread->looper);
4372			wait_event_interruptible(binder_user_error_wait,
4373						 binder_stop_on_user_error < 2);
4374		}
4375		binder_set_nice(proc->default_priority);
4376	}
4377
4378	if (non_block) {
4379		if (!binder_has_work(thread, wait_for_proc_work))
4380			ret = -EAGAIN;
4381	} else {
4382		ret = binder_wait_for_work(thread, wait_for_proc_work);
4383	}
4384
4385	thread->looper &= ~BINDER_LOOPER_STATE_WAITING;
4386
4387	if (ret)
4388		return ret;
4389
4390	while (1) {
4391		uint32_t cmd;
4392		struct binder_transaction_data_secctx tr;
4393		struct binder_transaction_data *trd = &tr.transaction_data;
4394		struct binder_work *w = NULL;
4395		struct list_head *list = NULL;
4396		struct binder_transaction *t = NULL;
4397		struct binder_thread *t_from;
4398		size_t trsize = sizeof(*trd);
4399
4400		binder_inner_proc_lock(proc);
4401		if (!binder_worklist_empty_ilocked(&thread->todo))
4402			list = &thread->todo;
4403		else if (!binder_worklist_empty_ilocked(&proc->todo) &&
4404			   wait_for_proc_work)
4405			list = &proc->todo;
4406		else {
4407			binder_inner_proc_unlock(proc);
4408
4409			/* no data added */
4410			if (ptr - buffer == 4 && !thread->looper_need_return)
4411				goto retry;
4412			break;
4413		}
4414
4415		if (end - ptr < sizeof(tr) + 4) {
4416			binder_inner_proc_unlock(proc);
4417			break;
4418		}
4419		w = binder_dequeue_work_head_ilocked(list);
4420		if (binder_worklist_empty_ilocked(&thread->todo))
4421			thread->process_todo = false;
4422
4423		switch (w->type) {
4424		case BINDER_WORK_TRANSACTION: {
4425			binder_inner_proc_unlock(proc);
4426			t = container_of(w, struct binder_transaction, work);
4427		} break;
4428		case BINDER_WORK_RETURN_ERROR: {
4429			struct binder_error *e = container_of(
4430					w, struct binder_error, work);
4431
4432			WARN_ON(e->cmd == BR_OK);
4433			binder_inner_proc_unlock(proc);
4434			if (put_user(e->cmd, (uint32_t __user *)ptr))
4435				return -EFAULT;
4436			cmd = e->cmd;
4437			e->cmd = BR_OK;
4438			ptr += sizeof(uint32_t);
4439
4440			binder_stat_br(proc, thread, cmd);
4441		} break;
4442		case BINDER_WORK_TRANSACTION_COMPLETE:
4443		case BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT: {
4444			if (proc->oneway_spam_detection_enabled &&
4445				   w->type == BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT)
4446				cmd = BR_ONEWAY_SPAM_SUSPECT;
4447			else
4448				cmd = BR_TRANSACTION_COMPLETE;
4449			binder_inner_proc_unlock(proc);
 
4450			kfree(w);
4451			binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
4452			if (put_user(cmd, (uint32_t __user *)ptr))
4453				return -EFAULT;
4454			ptr += sizeof(uint32_t);
4455
4456			binder_stat_br(proc, thread, cmd);
4457			binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE,
4458				     "%d:%d BR_TRANSACTION_COMPLETE\n",
4459				     proc->pid, thread->pid);
4460		} break;
4461		case BINDER_WORK_NODE: {
4462			struct binder_node *node = container_of(w, struct binder_node, work);
4463			int strong, weak;
4464			binder_uintptr_t node_ptr = node->ptr;
4465			binder_uintptr_t node_cookie = node->cookie;
4466			int node_debug_id = node->debug_id;
4467			int has_weak_ref;
4468			int has_strong_ref;
4469			void __user *orig_ptr = ptr;
4470
4471			BUG_ON(proc != node->proc);
4472			strong = node->internal_strong_refs ||
4473					node->local_strong_refs;
4474			weak = !hlist_empty(&node->refs) ||
4475					node->local_weak_refs ||
4476					node->tmp_refs || strong;
4477			has_strong_ref = node->has_strong_ref;
4478			has_weak_ref = node->has_weak_ref;
4479
4480			if (weak && !has_weak_ref) {
4481				node->has_weak_ref = 1;
4482				node->pending_weak_ref = 1;
4483				node->local_weak_refs++;
4484			}
4485			if (strong && !has_strong_ref) {
4486				node->has_strong_ref = 1;
4487				node->pending_strong_ref = 1;
4488				node->local_strong_refs++;
4489			}
4490			if (!strong && has_strong_ref)
4491				node->has_strong_ref = 0;
4492			if (!weak && has_weak_ref)
4493				node->has_weak_ref = 0;
4494			if (!weak && !strong) {
4495				binder_debug(BINDER_DEBUG_INTERNAL_REFS,
4496					     "%d:%d node %d u%016llx c%016llx deleted\n",
4497					     proc->pid, thread->pid,
4498					     node_debug_id,
4499					     (u64)node_ptr,
4500					     (u64)node_cookie);
4501				rb_erase(&node->rb_node, &proc->nodes);
4502				binder_inner_proc_unlock(proc);
4503				binder_node_lock(node);
4504				/*
4505				 * Acquire the node lock before freeing the
4506				 * node to serialize with other threads that
4507				 * may have been holding the node lock while
4508				 * decrementing this node (avoids race where
4509				 * this thread frees while the other thread
4510				 * is unlocking the node after the final
4511				 * decrement)
4512				 */
4513				binder_node_unlock(node);
4514				binder_free_node(node);
4515			} else
4516				binder_inner_proc_unlock(proc);
4517
4518			if (weak && !has_weak_ref)
4519				ret = binder_put_node_cmd(
4520						proc, thread, &ptr, node_ptr,
4521						node_cookie, node_debug_id,
4522						BR_INCREFS, "BR_INCREFS");
4523			if (!ret && strong && !has_strong_ref)
4524				ret = binder_put_node_cmd(
4525						proc, thread, &ptr, node_ptr,
4526						node_cookie, node_debug_id,
4527						BR_ACQUIRE, "BR_ACQUIRE");
4528			if (!ret && !strong && has_strong_ref)
4529				ret = binder_put_node_cmd(
4530						proc, thread, &ptr, node_ptr,
4531						node_cookie, node_debug_id,
4532						BR_RELEASE, "BR_RELEASE");
4533			if (!ret && !weak && has_weak_ref)
4534				ret = binder_put_node_cmd(
4535						proc, thread, &ptr, node_ptr,
4536						node_cookie, node_debug_id,
4537						BR_DECREFS, "BR_DECREFS");
4538			if (orig_ptr == ptr)
4539				binder_debug(BINDER_DEBUG_INTERNAL_REFS,
4540					     "%d:%d node %d u%016llx c%016llx state unchanged\n",
4541					     proc->pid, thread->pid,
4542					     node_debug_id,
4543					     (u64)node_ptr,
4544					     (u64)node_cookie);
4545			if (ret)
4546				return ret;
4547		} break;
4548		case BINDER_WORK_DEAD_BINDER:
4549		case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
4550		case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
4551			struct binder_ref_death *death;
4552			uint32_t cmd;
4553			binder_uintptr_t cookie;
4554
4555			death = container_of(w, struct binder_ref_death, work);
4556			if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION)
4557				cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE;
4558			else
4559				cmd = BR_DEAD_BINDER;
4560			cookie = death->cookie;
4561
4562			binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
4563				     "%d:%d %s %016llx\n",
4564				      proc->pid, thread->pid,
4565				      cmd == BR_DEAD_BINDER ?
4566				      "BR_DEAD_BINDER" :
4567				      "BR_CLEAR_DEATH_NOTIFICATION_DONE",
4568				      (u64)cookie);
4569			if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) {
4570				binder_inner_proc_unlock(proc);
4571				kfree(death);
4572				binder_stats_deleted(BINDER_STAT_DEATH);
4573			} else {
4574				binder_enqueue_work_ilocked(
4575						w, &proc->delivered_death);
4576				binder_inner_proc_unlock(proc);
4577			}
4578			if (put_user(cmd, (uint32_t __user *)ptr))
4579				return -EFAULT;
4580			ptr += sizeof(uint32_t);
4581			if (put_user(cookie,
4582				     (binder_uintptr_t __user *)ptr))
4583				return -EFAULT;
4584			ptr += sizeof(binder_uintptr_t);
4585			binder_stat_br(proc, thread, cmd);
4586			if (cmd == BR_DEAD_BINDER)
4587				goto done; /* DEAD_BINDER notifications can cause transactions */
4588		} break;
4589		default:
4590			binder_inner_proc_unlock(proc);
4591			pr_err("%d:%d: bad work type %d\n",
4592			       proc->pid, thread->pid, w->type);
4593			break;
4594		}
4595
4596		if (!t)
4597			continue;
4598
4599		BUG_ON(t->buffer == NULL);
4600		if (t->buffer->target_node) {
4601			struct binder_node *target_node = t->buffer->target_node;
4602
4603			trd->target.ptr = target_node->ptr;
4604			trd->cookie =  target_node->cookie;
4605			t->saved_priority = task_nice(current);
4606			if (t->priority < target_node->min_priority &&
4607			    !(t->flags & TF_ONE_WAY))
4608				binder_set_nice(t->priority);
4609			else if (!(t->flags & TF_ONE_WAY) ||
4610				 t->saved_priority > target_node->min_priority)
4611				binder_set_nice(target_node->min_priority);
4612			cmd = BR_TRANSACTION;
4613		} else {
4614			trd->target.ptr = 0;
4615			trd->cookie = 0;
4616			cmd = BR_REPLY;
4617		}
4618		trd->code = t->code;
4619		trd->flags = t->flags;
4620		trd->sender_euid = from_kuid(current_user_ns(), t->sender_euid);
4621
4622		t_from = binder_get_txn_from(t);
4623		if (t_from) {
4624			struct task_struct *sender = t_from->proc->tsk;
4625
4626			trd->sender_pid =
4627				task_tgid_nr_ns(sender,
4628						task_active_pid_ns(current));
4629		} else {
4630			trd->sender_pid = 0;
4631		}
4632
4633		ret = binder_apply_fd_fixups(proc, t);
4634		if (ret) {
4635			struct binder_buffer *buffer = t->buffer;
4636			bool oneway = !!(t->flags & TF_ONE_WAY);
4637			int tid = t->debug_id;
4638
4639			if (t_from)
4640				binder_thread_dec_tmpref(t_from);
4641			buffer->transaction = NULL;
4642			binder_cleanup_transaction(t, "fd fixups failed",
4643						   BR_FAILED_REPLY);
4644			binder_free_buf(proc, thread, buffer, true);
4645			binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
4646				     "%d:%d %stransaction %d fd fixups failed %d/%d, line %d\n",
4647				     proc->pid, thread->pid,
4648				     oneway ? "async " :
4649					(cmd == BR_REPLY ? "reply " : ""),
4650				     tid, BR_FAILED_REPLY, ret, __LINE__);
4651			if (cmd == BR_REPLY) {
4652				cmd = BR_FAILED_REPLY;
4653				if (put_user(cmd, (uint32_t __user *)ptr))
4654					return -EFAULT;
4655				ptr += sizeof(uint32_t);
4656				binder_stat_br(proc, thread, cmd);
4657				break;
4658			}
4659			continue;
4660		}
4661		trd->data_size = t->buffer->data_size;
4662		trd->offsets_size = t->buffer->offsets_size;
4663		trd->data.ptr.buffer = (uintptr_t)t->buffer->user_data;
4664		trd->data.ptr.offsets = trd->data.ptr.buffer +
4665					ALIGN(t->buffer->data_size,
4666					    sizeof(void *));
4667
4668		tr.secctx = t->security_ctx;
4669		if (t->security_ctx) {
4670			cmd = BR_TRANSACTION_SEC_CTX;
4671			trsize = sizeof(tr);
4672		}
4673		if (put_user(cmd, (uint32_t __user *)ptr)) {
4674			if (t_from)
4675				binder_thread_dec_tmpref(t_from);
4676
4677			binder_cleanup_transaction(t, "put_user failed",
4678						   BR_FAILED_REPLY);
4679
4680			return -EFAULT;
4681		}
4682		ptr += sizeof(uint32_t);
4683		if (copy_to_user(ptr, &tr, trsize)) {
4684			if (t_from)
4685				binder_thread_dec_tmpref(t_from);
4686
4687			binder_cleanup_transaction(t, "copy_to_user failed",
4688						   BR_FAILED_REPLY);
4689
4690			return -EFAULT;
4691		}
4692		ptr += trsize;
4693
4694		trace_binder_transaction_received(t);
4695		binder_stat_br(proc, thread, cmd);
4696		binder_debug(BINDER_DEBUG_TRANSACTION,
4697			     "%d:%d %s %d %d:%d, cmd %u size %zd-%zd ptr %016llx-%016llx\n",
4698			     proc->pid, thread->pid,
4699			     (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" :
4700				(cmd == BR_TRANSACTION_SEC_CTX) ?
4701				     "BR_TRANSACTION_SEC_CTX" : "BR_REPLY",
4702			     t->debug_id, t_from ? t_from->proc->pid : 0,
4703			     t_from ? t_from->pid : 0, cmd,
4704			     t->buffer->data_size, t->buffer->offsets_size,
4705			     (u64)trd->data.ptr.buffer,
4706			     (u64)trd->data.ptr.offsets);
4707
4708		if (t_from)
4709			binder_thread_dec_tmpref(t_from);
4710		t->buffer->allow_user_free = 1;
4711		if (cmd != BR_REPLY && !(t->flags & TF_ONE_WAY)) {
4712			binder_inner_proc_lock(thread->proc);
4713			t->to_parent = thread->transaction_stack;
4714			t->to_thread = thread;
4715			thread->transaction_stack = t;
4716			binder_inner_proc_unlock(thread->proc);
4717		} else {
4718			binder_free_transaction(t);
4719		}
4720		break;
4721	}
4722
4723done:
4724
4725	*consumed = ptr - buffer;
4726	binder_inner_proc_lock(proc);
4727	if (proc->requested_threads == 0 &&
4728	    list_empty(&thread->proc->waiting_threads) &&
4729	    proc->requested_threads_started < proc->max_threads &&
4730	    (thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
4731	     BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */
4732	     /*spawn a new thread if we leave this out */) {
4733		proc->requested_threads++;
4734		binder_inner_proc_unlock(proc);
4735		binder_debug(BINDER_DEBUG_THREADS,
4736			     "%d:%d BR_SPAWN_LOOPER\n",
4737			     proc->pid, thread->pid);
4738		if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer))
4739			return -EFAULT;
4740		binder_stat_br(proc, thread, BR_SPAWN_LOOPER);
4741	} else
4742		binder_inner_proc_unlock(proc);
4743	return 0;
4744}
4745
4746static void binder_release_work(struct binder_proc *proc,
4747				struct list_head *list)
4748{
4749	struct binder_work *w;
4750	enum binder_work_type wtype;
4751
4752	while (1) {
4753		binder_inner_proc_lock(proc);
4754		w = binder_dequeue_work_head_ilocked(list);
4755		wtype = w ? w->type : 0;
4756		binder_inner_proc_unlock(proc);
4757		if (!w)
4758			return;
4759
4760		switch (wtype) {
4761		case BINDER_WORK_TRANSACTION: {
4762			struct binder_transaction *t;
4763
4764			t = container_of(w, struct binder_transaction, work);
4765
4766			binder_cleanup_transaction(t, "process died.",
4767						   BR_DEAD_REPLY);
4768		} break;
4769		case BINDER_WORK_RETURN_ERROR: {
4770			struct binder_error *e = container_of(
4771					w, struct binder_error, work);
4772
4773			binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
4774				"undelivered TRANSACTION_ERROR: %u\n",
4775				e->cmd);
4776		} break;
4777		case BINDER_WORK_TRANSACTION_COMPLETE: {
4778			binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
4779				"undelivered TRANSACTION_COMPLETE\n");
4780			kfree(w);
4781			binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
4782		} break;
4783		case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
4784		case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
4785			struct binder_ref_death *death;
4786
4787			death = container_of(w, struct binder_ref_death, work);
4788			binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
4789				"undelivered death notification, %016llx\n",
4790				(u64)death->cookie);
4791			kfree(death);
4792			binder_stats_deleted(BINDER_STAT_DEATH);
4793		} break;
4794		case BINDER_WORK_NODE:
4795			break;
4796		default:
4797			pr_err("unexpected work type, %d, not freed\n",
4798			       wtype);
4799			break;
4800		}
4801	}
4802
4803}
4804
4805static struct binder_thread *binder_get_thread_ilocked(
4806		struct binder_proc *proc, struct binder_thread *new_thread)
4807{
4808	struct binder_thread *thread = NULL;
4809	struct rb_node *parent = NULL;
4810	struct rb_node **p = &proc->threads.rb_node;
4811
4812	while (*p) {
4813		parent = *p;
4814		thread = rb_entry(parent, struct binder_thread, rb_node);
4815
4816		if (current->pid < thread->pid)
4817			p = &(*p)->rb_left;
4818		else if (current->pid > thread->pid)
4819			p = &(*p)->rb_right;
4820		else
4821			return thread;
4822	}
4823	if (!new_thread)
4824		return NULL;
4825	thread = new_thread;
4826	binder_stats_created(BINDER_STAT_THREAD);
4827	thread->proc = proc;
4828	thread->pid = current->pid;
4829	atomic_set(&thread->tmp_ref, 0);
4830	init_waitqueue_head(&thread->wait);
4831	INIT_LIST_HEAD(&thread->todo);
4832	rb_link_node(&thread->rb_node, parent, p);
4833	rb_insert_color(&thread->rb_node, &proc->threads);
4834	thread->looper_need_return = true;
4835	thread->return_error.work.type = BINDER_WORK_RETURN_ERROR;
4836	thread->return_error.cmd = BR_OK;
4837	thread->reply_error.work.type = BINDER_WORK_RETURN_ERROR;
4838	thread->reply_error.cmd = BR_OK;
4839	thread->ee.command = BR_OK;
4840	INIT_LIST_HEAD(&new_thread->waiting_thread_node);
4841	return thread;
4842}
4843
4844static struct binder_thread *binder_get_thread(struct binder_proc *proc)
4845{
4846	struct binder_thread *thread;
4847	struct binder_thread *new_thread;
4848
4849	binder_inner_proc_lock(proc);
4850	thread = binder_get_thread_ilocked(proc, NULL);
4851	binder_inner_proc_unlock(proc);
4852	if (!thread) {
4853		new_thread = kzalloc(sizeof(*thread), GFP_KERNEL);
4854		if (new_thread == NULL)
4855			return NULL;
4856		binder_inner_proc_lock(proc);
4857		thread = binder_get_thread_ilocked(proc, new_thread);
4858		binder_inner_proc_unlock(proc);
4859		if (thread != new_thread)
4860			kfree(new_thread);
4861	}
4862	return thread;
4863}
4864
4865static void binder_free_proc(struct binder_proc *proc)
4866{
4867	struct binder_device *device;
4868
4869	BUG_ON(!list_empty(&proc->todo));
4870	BUG_ON(!list_empty(&proc->delivered_death));
4871	if (proc->outstanding_txns)
4872		pr_warn("%s: Unexpected outstanding_txns %d\n",
4873			__func__, proc->outstanding_txns);
4874	device = container_of(proc->context, struct binder_device, context);
4875	if (refcount_dec_and_test(&device->ref)) {
4876		kfree(proc->context->name);
4877		kfree(device);
4878	}
4879	binder_alloc_deferred_release(&proc->alloc);
4880	put_task_struct(proc->tsk);
4881	put_cred(proc->cred);
4882	binder_stats_deleted(BINDER_STAT_PROC);
4883	kfree(proc);
4884}
4885
4886static void binder_free_thread(struct binder_thread *thread)
4887{
4888	BUG_ON(!list_empty(&thread->todo));
4889	binder_stats_deleted(BINDER_STAT_THREAD);
4890	binder_proc_dec_tmpref(thread->proc);
4891	kfree(thread);
4892}
4893
4894static int binder_thread_release(struct binder_proc *proc,
4895				 struct binder_thread *thread)
4896{
4897	struct binder_transaction *t;
4898	struct binder_transaction *send_reply = NULL;
4899	int active_transactions = 0;
4900	struct binder_transaction *last_t = NULL;
4901
4902	binder_inner_proc_lock(thread->proc);
4903	/*
4904	 * take a ref on the proc so it survives
4905	 * after we remove this thread from proc->threads.
4906	 * The corresponding dec is when we actually
4907	 * free the thread in binder_free_thread()
4908	 */
4909	proc->tmp_ref++;
4910	/*
4911	 * take a ref on this thread to ensure it
4912	 * survives while we are releasing it
4913	 */
4914	atomic_inc(&thread->tmp_ref);
4915	rb_erase(&thread->rb_node, &proc->threads);
4916	t = thread->transaction_stack;
4917	if (t) {
4918		spin_lock(&t->lock);
4919		if (t->to_thread == thread)
4920			send_reply = t;
4921	} else {
4922		__acquire(&t->lock);
4923	}
4924	thread->is_dead = true;
4925
4926	while (t) {
4927		last_t = t;
4928		active_transactions++;
4929		binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
4930			     "release %d:%d transaction %d %s, still active\n",
4931			      proc->pid, thread->pid,
4932			     t->debug_id,
4933			     (t->to_thread == thread) ? "in" : "out");
4934
4935		if (t->to_thread == thread) {
4936			thread->proc->outstanding_txns--;
4937			t->to_proc = NULL;
4938			t->to_thread = NULL;
4939			if (t->buffer) {
4940				t->buffer->transaction = NULL;
4941				t->buffer = NULL;
4942			}
4943			t = t->to_parent;
4944		} else if (t->from == thread) {
4945			t->from = NULL;
4946			t = t->from_parent;
4947		} else
4948			BUG();
4949		spin_unlock(&last_t->lock);
4950		if (t)
4951			spin_lock(&t->lock);
4952		else
4953			__acquire(&t->lock);
4954	}
4955	/* annotation for sparse, lock not acquired in last iteration above */
4956	__release(&t->lock);
4957
4958	/*
4959	 * If this thread used poll, make sure we remove the waitqueue from any
4960	 * poll data structures holding it.
 
 
4961	 */
4962	if (thread->looper & BINDER_LOOPER_STATE_POLL)
4963		wake_up_pollfree(&thread->wait);
 
 
4964
4965	binder_inner_proc_unlock(thread->proc);
4966
4967	/*
4968	 * This is needed to avoid races between wake_up_pollfree() above and
4969	 * someone else removing the last entry from the queue for other reasons
4970	 * (e.g. ep_remove_wait_queue() being called due to an epoll file
4971	 * descriptor being closed).  Such other users hold an RCU read lock, so
4972	 * we can be sure they're done after we call synchronize_rcu().
4973	 */
4974	if (thread->looper & BINDER_LOOPER_STATE_POLL)
4975		synchronize_rcu();
4976
4977	if (send_reply)
4978		binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
4979	binder_release_work(proc, &thread->todo);
4980	binder_thread_dec_tmpref(thread);
4981	return active_transactions;
4982}
4983
4984static __poll_t binder_poll(struct file *filp,
4985				struct poll_table_struct *wait)
4986{
4987	struct binder_proc *proc = filp->private_data;
4988	struct binder_thread *thread = NULL;
4989	bool wait_for_proc_work;
4990
4991	thread = binder_get_thread(proc);
4992	if (!thread)
4993		return POLLERR;
4994
4995	binder_inner_proc_lock(thread->proc);
4996	thread->looper |= BINDER_LOOPER_STATE_POLL;
4997	wait_for_proc_work = binder_available_for_proc_work_ilocked(thread);
4998
4999	binder_inner_proc_unlock(thread->proc);
5000
5001	poll_wait(filp, &thread->wait, wait);
5002
5003	if (binder_has_work(thread, wait_for_proc_work))
5004		return EPOLLIN;
5005
5006	return 0;
5007}
5008
5009static int binder_ioctl_write_read(struct file *filp,
5010				unsigned int cmd, unsigned long arg,
5011				struct binder_thread *thread)
5012{
5013	int ret = 0;
5014	struct binder_proc *proc = filp->private_data;
5015	unsigned int size = _IOC_SIZE(cmd);
5016	void __user *ubuf = (void __user *)arg;
5017	struct binder_write_read bwr;
5018
5019	if (size != sizeof(struct binder_write_read)) {
5020		ret = -EINVAL;
5021		goto out;
5022	}
5023	if (copy_from_user(&bwr, ubuf, sizeof(bwr))) {
5024		ret = -EFAULT;
5025		goto out;
5026	}
5027	binder_debug(BINDER_DEBUG_READ_WRITE,
5028		     "%d:%d write %lld at %016llx, read %lld at %016llx\n",
5029		     proc->pid, thread->pid,
5030		     (u64)bwr.write_size, (u64)bwr.write_buffer,
5031		     (u64)bwr.read_size, (u64)bwr.read_buffer);
5032
5033	if (bwr.write_size > 0) {
5034		ret = binder_thread_write(proc, thread,
5035					  bwr.write_buffer,
5036					  bwr.write_size,
5037					  &bwr.write_consumed);
5038		trace_binder_write_done(ret);
5039		if (ret < 0) {
5040			bwr.read_consumed = 0;
5041			if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
5042				ret = -EFAULT;
5043			goto out;
5044		}
5045	}
5046	if (bwr.read_size > 0) {
5047		ret = binder_thread_read(proc, thread, bwr.read_buffer,
5048					 bwr.read_size,
5049					 &bwr.read_consumed,
5050					 filp->f_flags & O_NONBLOCK);
5051		trace_binder_read_done(ret);
5052		binder_inner_proc_lock(proc);
5053		if (!binder_worklist_empty_ilocked(&proc->todo))
5054			binder_wakeup_proc_ilocked(proc);
5055		binder_inner_proc_unlock(proc);
5056		if (ret < 0) {
5057			if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
5058				ret = -EFAULT;
5059			goto out;
5060		}
5061	}
5062	binder_debug(BINDER_DEBUG_READ_WRITE,
5063		     "%d:%d wrote %lld of %lld, read return %lld of %lld\n",
5064		     proc->pid, thread->pid,
5065		     (u64)bwr.write_consumed, (u64)bwr.write_size,
5066		     (u64)bwr.read_consumed, (u64)bwr.read_size);
5067	if (copy_to_user(ubuf, &bwr, sizeof(bwr))) {
5068		ret = -EFAULT;
5069		goto out;
5070	}
5071out:
5072	return ret;
5073}
5074
5075static int binder_ioctl_set_ctx_mgr(struct file *filp,
5076				    struct flat_binder_object *fbo)
5077{
5078	int ret = 0;
5079	struct binder_proc *proc = filp->private_data;
5080	struct binder_context *context = proc->context;
5081	struct binder_node *new_node;
5082	kuid_t curr_euid = current_euid();
5083
5084	mutex_lock(&context->context_mgr_node_lock);
5085	if (context->binder_context_mgr_node) {
5086		pr_err("BINDER_SET_CONTEXT_MGR already set\n");
5087		ret = -EBUSY;
5088		goto out;
5089	}
5090	ret = security_binder_set_context_mgr(proc->cred);
5091	if (ret < 0)
5092		goto out;
5093	if (uid_valid(context->binder_context_mgr_uid)) {
5094		if (!uid_eq(context->binder_context_mgr_uid, curr_euid)) {
5095			pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n",
5096			       from_kuid(&init_user_ns, curr_euid),
5097			       from_kuid(&init_user_ns,
5098					 context->binder_context_mgr_uid));
5099			ret = -EPERM;
5100			goto out;
5101		}
5102	} else {
5103		context->binder_context_mgr_uid = curr_euid;
5104	}
5105	new_node = binder_new_node(proc, fbo);
5106	if (!new_node) {
5107		ret = -ENOMEM;
5108		goto out;
5109	}
5110	binder_node_lock(new_node);
5111	new_node->local_weak_refs++;
5112	new_node->local_strong_refs++;
5113	new_node->has_strong_ref = 1;
5114	new_node->has_weak_ref = 1;
5115	context->binder_context_mgr_node = new_node;
5116	binder_node_unlock(new_node);
5117	binder_put_node(new_node);
5118out:
5119	mutex_unlock(&context->context_mgr_node_lock);
5120	return ret;
5121}
5122
5123static int binder_ioctl_get_node_info_for_ref(struct binder_proc *proc,
5124		struct binder_node_info_for_ref *info)
5125{
5126	struct binder_node *node;
5127	struct binder_context *context = proc->context;
5128	__u32 handle = info->handle;
5129
5130	if (info->strong_count || info->weak_count || info->reserved1 ||
5131	    info->reserved2 || info->reserved3) {
5132		binder_user_error("%d BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero.",
5133				  proc->pid);
5134		return -EINVAL;
5135	}
5136
5137	/* This ioctl may only be used by the context manager */
5138	mutex_lock(&context->context_mgr_node_lock);
5139	if (!context->binder_context_mgr_node ||
5140		context->binder_context_mgr_node->proc != proc) {
5141		mutex_unlock(&context->context_mgr_node_lock);
5142		return -EPERM;
5143	}
5144	mutex_unlock(&context->context_mgr_node_lock);
5145
5146	node = binder_get_node_from_ref(proc, handle, true, NULL);
5147	if (!node)
5148		return -EINVAL;
5149
5150	info->strong_count = node->local_strong_refs +
5151		node->internal_strong_refs;
5152	info->weak_count = node->local_weak_refs;
5153
5154	binder_put_node(node);
5155
5156	return 0;
5157}
5158
5159static int binder_ioctl_get_node_debug_info(struct binder_proc *proc,
5160				struct binder_node_debug_info *info)
5161{
5162	struct rb_node *n;
5163	binder_uintptr_t ptr = info->ptr;
5164
5165	memset(info, 0, sizeof(*info));
5166
5167	binder_inner_proc_lock(proc);
5168	for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) {
5169		struct binder_node *node = rb_entry(n, struct binder_node,
5170						    rb_node);
5171		if (node->ptr > ptr) {
5172			info->ptr = node->ptr;
5173			info->cookie = node->cookie;
5174			info->has_strong_ref = node->has_strong_ref;
5175			info->has_weak_ref = node->has_weak_ref;
5176			break;
5177		}
5178	}
5179	binder_inner_proc_unlock(proc);
5180
5181	return 0;
5182}
5183
5184static bool binder_txns_pending_ilocked(struct binder_proc *proc)
5185{
5186	struct rb_node *n;
5187	struct binder_thread *thread;
5188
5189	if (proc->outstanding_txns > 0)
5190		return true;
5191
5192	for (n = rb_first(&proc->threads); n; n = rb_next(n)) {
5193		thread = rb_entry(n, struct binder_thread, rb_node);
5194		if (thread->transaction_stack)
5195			return true;
5196	}
5197	return false;
5198}
5199
5200static int binder_ioctl_freeze(struct binder_freeze_info *info,
5201			       struct binder_proc *target_proc)
5202{
5203	int ret = 0;
5204
5205	if (!info->enable) {
5206		binder_inner_proc_lock(target_proc);
5207		target_proc->sync_recv = false;
5208		target_proc->async_recv = false;
5209		target_proc->is_frozen = false;
5210		binder_inner_proc_unlock(target_proc);
5211		return 0;
5212	}
5213
5214	/*
5215	 * Freezing the target. Prevent new transactions by
5216	 * setting frozen state. If timeout specified, wait
5217	 * for transactions to drain.
5218	 */
5219	binder_inner_proc_lock(target_proc);
5220	target_proc->sync_recv = false;
5221	target_proc->async_recv = false;
5222	target_proc->is_frozen = true;
5223	binder_inner_proc_unlock(target_proc);
5224
5225	if (info->timeout_ms > 0)
5226		ret = wait_event_interruptible_timeout(
5227			target_proc->freeze_wait,
5228			(!target_proc->outstanding_txns),
5229			msecs_to_jiffies(info->timeout_ms));
5230
5231	/* Check pending transactions that wait for reply */
5232	if (ret >= 0) {
5233		binder_inner_proc_lock(target_proc);
5234		if (binder_txns_pending_ilocked(target_proc))
5235			ret = -EAGAIN;
5236		binder_inner_proc_unlock(target_proc);
5237	}
5238
5239	if (ret < 0) {
5240		binder_inner_proc_lock(target_proc);
5241		target_proc->is_frozen = false;
5242		binder_inner_proc_unlock(target_proc);
5243	}
5244
5245	return ret;
5246}
5247
5248static int binder_ioctl_get_freezer_info(
5249				struct binder_frozen_status_info *info)
5250{
5251	struct binder_proc *target_proc;
5252	bool found = false;
5253	__u32 txns_pending;
5254
5255	info->sync_recv = 0;
5256	info->async_recv = 0;
5257
5258	mutex_lock(&binder_procs_lock);
5259	hlist_for_each_entry(target_proc, &binder_procs, proc_node) {
5260		if (target_proc->pid == info->pid) {
5261			found = true;
5262			binder_inner_proc_lock(target_proc);
5263			txns_pending = binder_txns_pending_ilocked(target_proc);
5264			info->sync_recv |= target_proc->sync_recv |
5265					(txns_pending << 1);
5266			info->async_recv |= target_proc->async_recv;
5267			binder_inner_proc_unlock(target_proc);
5268		}
5269	}
5270	mutex_unlock(&binder_procs_lock);
5271
5272	if (!found)
5273		return -EINVAL;
5274
5275	return 0;
5276}
5277
5278static int binder_ioctl_get_extended_error(struct binder_thread *thread,
5279					   void __user *ubuf)
5280{
5281	struct binder_extended_error ee;
5282
5283	binder_inner_proc_lock(thread->proc);
5284	ee = thread->ee;
5285	binder_set_extended_error(&thread->ee, 0, BR_OK, 0);
5286	binder_inner_proc_unlock(thread->proc);
5287
5288	if (copy_to_user(ubuf, &ee, sizeof(ee)))
5289		return -EFAULT;
5290
5291	return 0;
5292}
5293
5294static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
5295{
5296	int ret;
5297	struct binder_proc *proc = filp->private_data;
5298	struct binder_thread *thread;
5299	unsigned int size = _IOC_SIZE(cmd);
5300	void __user *ubuf = (void __user *)arg;
5301
5302	/*pr_info("binder_ioctl: %d:%d %x %lx\n",
5303			proc->pid, current->pid, cmd, arg);*/
5304
5305	binder_selftest_alloc(&proc->alloc);
5306
5307	trace_binder_ioctl(cmd, arg);
5308
5309	ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
5310	if (ret)
5311		goto err_unlocked;
5312
5313	thread = binder_get_thread(proc);
5314	if (thread == NULL) {
5315		ret = -ENOMEM;
5316		goto err;
5317	}
5318
5319	switch (cmd) {
5320	case BINDER_WRITE_READ:
5321		ret = binder_ioctl_write_read(filp, cmd, arg, thread);
5322		if (ret)
5323			goto err;
5324		break;
5325	case BINDER_SET_MAX_THREADS: {
5326		int max_threads;
5327
5328		if (copy_from_user(&max_threads, ubuf,
5329				   sizeof(max_threads))) {
5330			ret = -EINVAL;
5331			goto err;
5332		}
5333		binder_inner_proc_lock(proc);
5334		proc->max_threads = max_threads;
5335		binder_inner_proc_unlock(proc);
5336		break;
5337	}
5338	case BINDER_SET_CONTEXT_MGR_EXT: {
5339		struct flat_binder_object fbo;
5340
5341		if (copy_from_user(&fbo, ubuf, sizeof(fbo))) {
5342			ret = -EINVAL;
5343			goto err;
5344		}
5345		ret = binder_ioctl_set_ctx_mgr(filp, &fbo);
5346		if (ret)
5347			goto err;
5348		break;
5349	}
5350	case BINDER_SET_CONTEXT_MGR:
5351		ret = binder_ioctl_set_ctx_mgr(filp, NULL);
5352		if (ret)
5353			goto err;
5354		break;
5355	case BINDER_THREAD_EXIT:
5356		binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n",
5357			     proc->pid, thread->pid);
5358		binder_thread_release(proc, thread);
5359		thread = NULL;
5360		break;
5361	case BINDER_VERSION: {
5362		struct binder_version __user *ver = ubuf;
5363
5364		if (size != sizeof(struct binder_version)) {
5365			ret = -EINVAL;
5366			goto err;
5367		}
5368		if (put_user(BINDER_CURRENT_PROTOCOL_VERSION,
5369			     &ver->protocol_version)) {
5370			ret = -EINVAL;
5371			goto err;
5372		}
5373		break;
5374	}
5375	case BINDER_GET_NODE_INFO_FOR_REF: {
5376		struct binder_node_info_for_ref info;
5377
5378		if (copy_from_user(&info, ubuf, sizeof(info))) {
5379			ret = -EFAULT;
5380			goto err;
5381		}
5382
5383		ret = binder_ioctl_get_node_info_for_ref(proc, &info);
5384		if (ret < 0)
5385			goto err;
5386
5387		if (copy_to_user(ubuf, &info, sizeof(info))) {
5388			ret = -EFAULT;
5389			goto err;
5390		}
5391
5392		break;
5393	}
5394	case BINDER_GET_NODE_DEBUG_INFO: {
5395		struct binder_node_debug_info info;
5396
5397		if (copy_from_user(&info, ubuf, sizeof(info))) {
5398			ret = -EFAULT;
5399			goto err;
5400		}
5401
5402		ret = binder_ioctl_get_node_debug_info(proc, &info);
5403		if (ret < 0)
5404			goto err;
5405
5406		if (copy_to_user(ubuf, &info, sizeof(info))) {
5407			ret = -EFAULT;
5408			goto err;
5409		}
5410		break;
5411	}
5412	case BINDER_FREEZE: {
5413		struct binder_freeze_info info;
5414		struct binder_proc **target_procs = NULL, *target_proc;
5415		int target_procs_count = 0, i = 0;
5416
5417		ret = 0;
5418
5419		if (copy_from_user(&info, ubuf, sizeof(info))) {
5420			ret = -EFAULT;
5421			goto err;
5422		}
5423
5424		mutex_lock(&binder_procs_lock);
5425		hlist_for_each_entry(target_proc, &binder_procs, proc_node) {
5426			if (target_proc->pid == info.pid)
5427				target_procs_count++;
5428		}
5429
5430		if (target_procs_count == 0) {
5431			mutex_unlock(&binder_procs_lock);
5432			ret = -EINVAL;
5433			goto err;
5434		}
5435
5436		target_procs = kcalloc(target_procs_count,
5437				       sizeof(struct binder_proc *),
5438				       GFP_KERNEL);
5439
5440		if (!target_procs) {
5441			mutex_unlock(&binder_procs_lock);
5442			ret = -ENOMEM;
5443			goto err;
5444		}
5445
5446		hlist_for_each_entry(target_proc, &binder_procs, proc_node) {
5447			if (target_proc->pid != info.pid)
5448				continue;
5449
5450			binder_inner_proc_lock(target_proc);
5451			target_proc->tmp_ref++;
5452			binder_inner_proc_unlock(target_proc);
5453
5454			target_procs[i++] = target_proc;
5455		}
5456		mutex_unlock(&binder_procs_lock);
5457
5458		for (i = 0; i < target_procs_count; i++) {
5459			if (ret >= 0)
5460				ret = binder_ioctl_freeze(&info,
5461							  target_procs[i]);
5462
5463			binder_proc_dec_tmpref(target_procs[i]);
5464		}
5465
5466		kfree(target_procs);
5467
5468		if (ret < 0)
5469			goto err;
5470		break;
5471	}
5472	case BINDER_GET_FROZEN_INFO: {
5473		struct binder_frozen_status_info info;
5474
5475		if (copy_from_user(&info, ubuf, sizeof(info))) {
5476			ret = -EFAULT;
5477			goto err;
5478		}
5479
5480		ret = binder_ioctl_get_freezer_info(&info);
5481		if (ret < 0)
5482			goto err;
5483
5484		if (copy_to_user(ubuf, &info, sizeof(info))) {
5485			ret = -EFAULT;
5486			goto err;
5487		}
5488		break;
5489	}
5490	case BINDER_ENABLE_ONEWAY_SPAM_DETECTION: {
5491		uint32_t enable;
5492
5493		if (copy_from_user(&enable, ubuf, sizeof(enable))) {
5494			ret = -EFAULT;
5495			goto err;
5496		}
5497		binder_inner_proc_lock(proc);
5498		proc->oneway_spam_detection_enabled = (bool)enable;
5499		binder_inner_proc_unlock(proc);
5500		break;
5501	}
5502	case BINDER_GET_EXTENDED_ERROR:
5503		ret = binder_ioctl_get_extended_error(thread, ubuf);
5504		if (ret < 0)
5505			goto err;
5506		break;
5507	default:
5508		ret = -EINVAL;
5509		goto err;
5510	}
5511	ret = 0;
5512err:
5513	if (thread)
5514		thread->looper_need_return = false;
5515	wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
5516	if (ret && ret != -EINTR)
5517		pr_info("%d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret);
5518err_unlocked:
5519	trace_binder_ioctl_done(ret);
5520	return ret;
5521}
5522
5523static void binder_vma_open(struct vm_area_struct *vma)
5524{
5525	struct binder_proc *proc = vma->vm_private_data;
5526
5527	binder_debug(BINDER_DEBUG_OPEN_CLOSE,
5528		     "%d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
5529		     proc->pid, vma->vm_start, vma->vm_end,
5530		     (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
5531		     (unsigned long)pgprot_val(vma->vm_page_prot));
5532}
5533
5534static void binder_vma_close(struct vm_area_struct *vma)
5535{
5536	struct binder_proc *proc = vma->vm_private_data;
5537
5538	binder_debug(BINDER_DEBUG_OPEN_CLOSE,
5539		     "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
5540		     proc->pid, vma->vm_start, vma->vm_end,
5541		     (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
5542		     (unsigned long)pgprot_val(vma->vm_page_prot));
5543	binder_alloc_vma_close(&proc->alloc);
5544}
5545
5546static vm_fault_t binder_vm_fault(struct vm_fault *vmf)
5547{
5548	return VM_FAULT_SIGBUS;
5549}
5550
5551static const struct vm_operations_struct binder_vm_ops = {
5552	.open = binder_vma_open,
5553	.close = binder_vma_close,
5554	.fault = binder_vm_fault,
5555};
5556
5557static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
5558{
 
5559	struct binder_proc *proc = filp->private_data;
 
5560
5561	if (proc->tsk != current->group_leader)
5562		return -EINVAL;
5563
5564	binder_debug(BINDER_DEBUG_OPEN_CLOSE,
5565		     "%s: %d %lx-%lx (%ld K) vma %lx pagep %lx\n",
5566		     __func__, proc->pid, vma->vm_start, vma->vm_end,
5567		     (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
5568		     (unsigned long)pgprot_val(vma->vm_page_prot));
5569
5570	if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) {
5571		pr_err("%s: %d %lx-%lx %s failed %d\n", __func__,
5572		       proc->pid, vma->vm_start, vma->vm_end, "bad vm_flags", -EPERM);
5573		return -EPERM;
5574	}
5575	vma->vm_flags |= VM_DONTCOPY | VM_MIXEDMAP;
5576	vma->vm_flags &= ~VM_MAYWRITE;
5577
5578	vma->vm_ops = &binder_vm_ops;
5579	vma->vm_private_data = proc;
5580
5581	return binder_alloc_mmap_handler(&proc->alloc, vma);
 
 
 
 
 
 
 
 
5582}
5583
5584static int binder_open(struct inode *nodp, struct file *filp)
5585{
5586	struct binder_proc *proc, *itr;
5587	struct binder_device *binder_dev;
5588	struct binderfs_info *info;
5589	struct dentry *binder_binderfs_dir_entry_proc = NULL;
5590	bool existing_pid = false;
5591
5592	binder_debug(BINDER_DEBUG_OPEN_CLOSE, "%s: %d:%d\n", __func__,
5593		     current->group_leader->pid, current->pid);
5594
5595	proc = kzalloc(sizeof(*proc), GFP_KERNEL);
5596	if (proc == NULL)
5597		return -ENOMEM;
5598	spin_lock_init(&proc->inner_lock);
5599	spin_lock_init(&proc->outer_lock);
5600	get_task_struct(current->group_leader);
5601	proc->tsk = current->group_leader;
5602	proc->cred = get_cred(filp->f_cred);
5603	INIT_LIST_HEAD(&proc->todo);
5604	init_waitqueue_head(&proc->freeze_wait);
5605	proc->default_priority = task_nice(current);
5606	/* binderfs stashes devices in i_private */
5607	if (is_binderfs_device(nodp)) {
5608		binder_dev = nodp->i_private;
5609		info = nodp->i_sb->s_fs_info;
5610		binder_binderfs_dir_entry_proc = info->proc_log_dir;
5611	} else {
5612		binder_dev = container_of(filp->private_data,
5613					  struct binder_device, miscdev);
5614	}
5615	refcount_inc(&binder_dev->ref);
5616	proc->context = &binder_dev->context;
5617	binder_alloc_init(&proc->alloc);
5618
5619	binder_stats_created(BINDER_STAT_PROC);
5620	proc->pid = current->group_leader->pid;
5621	INIT_LIST_HEAD(&proc->delivered_death);
5622	INIT_LIST_HEAD(&proc->waiting_threads);
5623	filp->private_data = proc;
5624
5625	mutex_lock(&binder_procs_lock);
5626	hlist_for_each_entry(itr, &binder_procs, proc_node) {
5627		if (itr->pid == proc->pid) {
5628			existing_pid = true;
5629			break;
5630		}
5631	}
5632	hlist_add_head(&proc->proc_node, &binder_procs);
5633	mutex_unlock(&binder_procs_lock);
5634
5635	if (binder_debugfs_dir_entry_proc && !existing_pid) {
5636		char strbuf[11];
5637
5638		snprintf(strbuf, sizeof(strbuf), "%u", proc->pid);
5639		/*
5640		 * proc debug entries are shared between contexts.
5641		 * Only create for the first PID to avoid debugfs log spamming
5642		 * The printing code will anyway print all contexts for a given
5643		 * PID so this is not a problem.
 
5644		 */
5645		proc->debugfs_entry = debugfs_create_file(strbuf, 0444,
5646			binder_debugfs_dir_entry_proc,
5647			(void *)(unsigned long)proc->pid,
5648			&proc_fops);
5649	}
5650
5651	if (binder_binderfs_dir_entry_proc && !existing_pid) {
5652		char strbuf[11];
5653		struct dentry *binderfs_entry;
5654
5655		snprintf(strbuf, sizeof(strbuf), "%u", proc->pid);
5656		/*
5657		 * Similar to debugfs, the process specific log file is shared
5658		 * between contexts. Only create for the first PID.
5659		 * This is ok since same as debugfs, the log file will contain
5660		 * information on all contexts of a given PID.
 
 
 
5661		 */
5662		binderfs_entry = binderfs_create_file(binder_binderfs_dir_entry_proc,
5663			strbuf, &proc_fops, (void *)(unsigned long)proc->pid);
5664		if (!IS_ERR(binderfs_entry)) {
5665			proc->binderfs_entry = binderfs_entry;
5666		} else {
5667			int error;
5668
5669			error = PTR_ERR(binderfs_entry);
5670			pr_warn("Unable to create file %s in binderfs (error %d)\n",
5671				strbuf, error);
 
 
5672		}
5673	}
5674
5675	return 0;
5676}
5677
5678static int binder_flush(struct file *filp, fl_owner_t id)
5679{
5680	struct binder_proc *proc = filp->private_data;
5681
5682	binder_defer_work(proc, BINDER_DEFERRED_FLUSH);
5683
5684	return 0;
5685}
5686
5687static void binder_deferred_flush(struct binder_proc *proc)
5688{
5689	struct rb_node *n;
5690	int wake_count = 0;
5691
5692	binder_inner_proc_lock(proc);
5693	for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) {
5694		struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node);
5695
5696		thread->looper_need_return = true;
5697		if (thread->looper & BINDER_LOOPER_STATE_WAITING) {
5698			wake_up_interruptible(&thread->wait);
5699			wake_count++;
5700		}
5701	}
5702	binder_inner_proc_unlock(proc);
5703
5704	binder_debug(BINDER_DEBUG_OPEN_CLOSE,
5705		     "binder_flush: %d woke %d threads\n", proc->pid,
5706		     wake_count);
5707}
5708
5709static int binder_release(struct inode *nodp, struct file *filp)
5710{
5711	struct binder_proc *proc = filp->private_data;
5712
5713	debugfs_remove(proc->debugfs_entry);
5714
5715	if (proc->binderfs_entry) {
5716		binderfs_remove_file(proc->binderfs_entry);
5717		proc->binderfs_entry = NULL;
5718	}
5719
5720	binder_defer_work(proc, BINDER_DEFERRED_RELEASE);
5721
5722	return 0;
5723}
5724
5725static int binder_node_release(struct binder_node *node, int refs)
5726{
5727	struct binder_ref *ref;
5728	int death = 0;
5729	struct binder_proc *proc = node->proc;
5730
5731	binder_release_work(proc, &node->async_todo);
5732
5733	binder_node_lock(node);
5734	binder_inner_proc_lock(proc);
5735	binder_dequeue_work_ilocked(&node->work);
5736	/*
5737	 * The caller must have taken a temporary ref on the node,
5738	 */
5739	BUG_ON(!node->tmp_refs);
5740	if (hlist_empty(&node->refs) && node->tmp_refs == 1) {
5741		binder_inner_proc_unlock(proc);
5742		binder_node_unlock(node);
5743		binder_free_node(node);
5744
5745		return refs;
5746	}
5747
5748	node->proc = NULL;
5749	node->local_strong_refs = 0;
5750	node->local_weak_refs = 0;
5751	binder_inner_proc_unlock(proc);
5752
5753	spin_lock(&binder_dead_nodes_lock);
5754	hlist_add_head(&node->dead_node, &binder_dead_nodes);
5755	spin_unlock(&binder_dead_nodes_lock);
5756
5757	hlist_for_each_entry(ref, &node->refs, node_entry) {
5758		refs++;
5759		/*
5760		 * Need the node lock to synchronize
5761		 * with new notification requests and the
5762		 * inner lock to synchronize with queued
5763		 * death notifications.
5764		 */
5765		binder_inner_proc_lock(ref->proc);
5766		if (!ref->death) {
5767			binder_inner_proc_unlock(ref->proc);
5768			continue;
5769		}
5770
5771		death++;
5772
5773		BUG_ON(!list_empty(&ref->death->work.entry));
5774		ref->death->work.type = BINDER_WORK_DEAD_BINDER;
5775		binder_enqueue_work_ilocked(&ref->death->work,
5776					    &ref->proc->todo);
5777		binder_wakeup_proc_ilocked(ref->proc);
5778		binder_inner_proc_unlock(ref->proc);
5779	}
5780
5781	binder_debug(BINDER_DEBUG_DEAD_BINDER,
5782		     "node %d now dead, refs %d, death %d\n",
5783		     node->debug_id, refs, death);
5784	binder_node_unlock(node);
5785	binder_put_node(node);
5786
5787	return refs;
5788}
5789
5790static void binder_deferred_release(struct binder_proc *proc)
5791{
5792	struct binder_context *context = proc->context;
5793	struct rb_node *n;
5794	int threads, nodes, incoming_refs, outgoing_refs, active_transactions;
5795
5796	mutex_lock(&binder_procs_lock);
5797	hlist_del(&proc->proc_node);
5798	mutex_unlock(&binder_procs_lock);
5799
5800	mutex_lock(&context->context_mgr_node_lock);
5801	if (context->binder_context_mgr_node &&
5802	    context->binder_context_mgr_node->proc == proc) {
5803		binder_debug(BINDER_DEBUG_DEAD_BINDER,
5804			     "%s: %d context_mgr_node gone\n",
5805			     __func__, proc->pid);
5806		context->binder_context_mgr_node = NULL;
5807	}
5808	mutex_unlock(&context->context_mgr_node_lock);
5809	binder_inner_proc_lock(proc);
5810	/*
5811	 * Make sure proc stays alive after we
5812	 * remove all the threads
5813	 */
5814	proc->tmp_ref++;
5815
5816	proc->is_dead = true;
5817	proc->is_frozen = false;
5818	proc->sync_recv = false;
5819	proc->async_recv = false;
5820	threads = 0;
5821	active_transactions = 0;
5822	while ((n = rb_first(&proc->threads))) {
5823		struct binder_thread *thread;
5824
5825		thread = rb_entry(n, struct binder_thread, rb_node);
5826		binder_inner_proc_unlock(proc);
5827		threads++;
5828		active_transactions += binder_thread_release(proc, thread);
5829		binder_inner_proc_lock(proc);
5830	}
5831
5832	nodes = 0;
5833	incoming_refs = 0;
5834	while ((n = rb_first(&proc->nodes))) {
5835		struct binder_node *node;
5836
5837		node = rb_entry(n, struct binder_node, rb_node);
5838		nodes++;
5839		/*
5840		 * take a temporary ref on the node before
5841		 * calling binder_node_release() which will either
5842		 * kfree() the node or call binder_put_node()
5843		 */
5844		binder_inc_node_tmpref_ilocked(node);
5845		rb_erase(&node->rb_node, &proc->nodes);
5846		binder_inner_proc_unlock(proc);
5847		incoming_refs = binder_node_release(node, incoming_refs);
5848		binder_inner_proc_lock(proc);
5849	}
5850	binder_inner_proc_unlock(proc);
5851
5852	outgoing_refs = 0;
5853	binder_proc_lock(proc);
5854	while ((n = rb_first(&proc->refs_by_desc))) {
5855		struct binder_ref *ref;
5856
5857		ref = rb_entry(n, struct binder_ref, rb_node_desc);
5858		outgoing_refs++;
5859		binder_cleanup_ref_olocked(ref);
5860		binder_proc_unlock(proc);
5861		binder_free_ref(ref);
5862		binder_proc_lock(proc);
5863	}
5864	binder_proc_unlock(proc);
5865
5866	binder_release_work(proc, &proc->todo);
5867	binder_release_work(proc, &proc->delivered_death);
5868
5869	binder_debug(BINDER_DEBUG_OPEN_CLOSE,
5870		     "%s: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d\n",
5871		     __func__, proc->pid, threads, nodes, incoming_refs,
5872		     outgoing_refs, active_transactions);
5873
5874	binder_proc_dec_tmpref(proc);
5875}
5876
5877static void binder_deferred_func(struct work_struct *work)
5878{
5879	struct binder_proc *proc;
5880
5881	int defer;
5882
5883	do {
5884		mutex_lock(&binder_deferred_lock);
5885		if (!hlist_empty(&binder_deferred_list)) {
5886			proc = hlist_entry(binder_deferred_list.first,
5887					struct binder_proc, deferred_work_node);
5888			hlist_del_init(&proc->deferred_work_node);
5889			defer = proc->deferred_work;
5890			proc->deferred_work = 0;
5891		} else {
5892			proc = NULL;
5893			defer = 0;
5894		}
5895		mutex_unlock(&binder_deferred_lock);
5896
5897		if (defer & BINDER_DEFERRED_FLUSH)
5898			binder_deferred_flush(proc);
5899
5900		if (defer & BINDER_DEFERRED_RELEASE)
5901			binder_deferred_release(proc); /* frees proc */
5902	} while (proc);
5903}
5904static DECLARE_WORK(binder_deferred_work, binder_deferred_func);
5905
5906static void
5907binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer)
5908{
5909	mutex_lock(&binder_deferred_lock);
5910	proc->deferred_work |= defer;
5911	if (hlist_unhashed(&proc->deferred_work_node)) {
5912		hlist_add_head(&proc->deferred_work_node,
5913				&binder_deferred_list);
5914		schedule_work(&binder_deferred_work);
5915	}
5916	mutex_unlock(&binder_deferred_lock);
5917}
5918
5919static void print_binder_transaction_ilocked(struct seq_file *m,
5920					     struct binder_proc *proc,
5921					     const char *prefix,
5922					     struct binder_transaction *t)
5923{
5924	struct binder_proc *to_proc;
5925	struct binder_buffer *buffer = t->buffer;
5926
5927	spin_lock(&t->lock);
5928	to_proc = t->to_proc;
5929	seq_printf(m,
5930		   "%s %d: %pK from %d:%d to %d:%d code %x flags %x pri %ld r%d",
5931		   prefix, t->debug_id, t,
5932		   t->from ? t->from->proc->pid : 0,
5933		   t->from ? t->from->pid : 0,
5934		   to_proc ? to_proc->pid : 0,
5935		   t->to_thread ? t->to_thread->pid : 0,
5936		   t->code, t->flags, t->priority, t->need_reply);
5937	spin_unlock(&t->lock);
5938
5939	if (proc != to_proc) {
5940		/*
5941		 * Can only safely deref buffer if we are holding the
5942		 * correct proc inner lock for this node
5943		 */
5944		seq_puts(m, "\n");
5945		return;
5946	}
5947
5948	if (buffer == NULL) {
5949		seq_puts(m, " buffer free\n");
5950		return;
5951	}
5952	if (buffer->target_node)
5953		seq_printf(m, " node %d", buffer->target_node->debug_id);
5954	seq_printf(m, " size %zd:%zd data %pK\n",
5955		   buffer->data_size, buffer->offsets_size,
5956		   buffer->user_data);
5957}
5958
5959static void print_binder_work_ilocked(struct seq_file *m,
5960				     struct binder_proc *proc,
5961				     const char *prefix,
5962				     const char *transaction_prefix,
5963				     struct binder_work *w)
5964{
5965	struct binder_node *node;
5966	struct binder_transaction *t;
5967
5968	switch (w->type) {
5969	case BINDER_WORK_TRANSACTION:
5970		t = container_of(w, struct binder_transaction, work);
5971		print_binder_transaction_ilocked(
5972				m, proc, transaction_prefix, t);
5973		break;
5974	case BINDER_WORK_RETURN_ERROR: {
5975		struct binder_error *e = container_of(
5976				w, struct binder_error, work);
5977
5978		seq_printf(m, "%stransaction error: %u\n",
5979			   prefix, e->cmd);
5980	} break;
5981	case BINDER_WORK_TRANSACTION_COMPLETE:
5982		seq_printf(m, "%stransaction complete\n", prefix);
5983		break;
5984	case BINDER_WORK_NODE:
5985		node = container_of(w, struct binder_node, work);
5986		seq_printf(m, "%snode work %d: u%016llx c%016llx\n",
5987			   prefix, node->debug_id,
5988			   (u64)node->ptr, (u64)node->cookie);
5989		break;
5990	case BINDER_WORK_DEAD_BINDER:
5991		seq_printf(m, "%shas dead binder\n", prefix);
5992		break;
5993	case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
5994		seq_printf(m, "%shas cleared dead binder\n", prefix);
5995		break;
5996	case BINDER_WORK_CLEAR_DEATH_NOTIFICATION:
5997		seq_printf(m, "%shas cleared death notification\n", prefix);
5998		break;
5999	default:
6000		seq_printf(m, "%sunknown work: type %d\n", prefix, w->type);
6001		break;
6002	}
6003}
6004
6005static void print_binder_thread_ilocked(struct seq_file *m,
6006					struct binder_thread *thread,
6007					int print_always)
6008{
6009	struct binder_transaction *t;
6010	struct binder_work *w;
6011	size_t start_pos = m->count;
6012	size_t header_pos;
6013
6014	seq_printf(m, "  thread %d: l %02x need_return %d tr %d\n",
6015			thread->pid, thread->looper,
6016			thread->looper_need_return,
6017			atomic_read(&thread->tmp_ref));
6018	header_pos = m->count;
6019	t = thread->transaction_stack;
6020	while (t) {
6021		if (t->from == thread) {
6022			print_binder_transaction_ilocked(m, thread->proc,
6023					"    outgoing transaction", t);
6024			t = t->from_parent;
6025		} else if (t->to_thread == thread) {
6026			print_binder_transaction_ilocked(m, thread->proc,
6027						 "    incoming transaction", t);
6028			t = t->to_parent;
6029		} else {
6030			print_binder_transaction_ilocked(m, thread->proc,
6031					"    bad transaction", t);
6032			t = NULL;
6033		}
6034	}
6035	list_for_each_entry(w, &thread->todo, entry) {
6036		print_binder_work_ilocked(m, thread->proc, "    ",
6037					  "    pending transaction", w);
6038	}
6039	if (!print_always && m->count == header_pos)
6040		m->count = start_pos;
6041}
6042
6043static void print_binder_node_nilocked(struct seq_file *m,
6044				       struct binder_node *node)
6045{
6046	struct binder_ref *ref;
6047	struct binder_work *w;
6048	int count;
6049
6050	count = 0;
6051	hlist_for_each_entry(ref, &node->refs, node_entry)
6052		count++;
6053
6054	seq_printf(m, "  node %d: u%016llx c%016llx hs %d hw %d ls %d lw %d is %d iw %d tr %d",
6055		   node->debug_id, (u64)node->ptr, (u64)node->cookie,
6056		   node->has_strong_ref, node->has_weak_ref,
6057		   node->local_strong_refs, node->local_weak_refs,
6058		   node->internal_strong_refs, count, node->tmp_refs);
6059	if (count) {
6060		seq_puts(m, " proc");
6061		hlist_for_each_entry(ref, &node->refs, node_entry)
6062			seq_printf(m, " %d", ref->proc->pid);
6063	}
6064	seq_puts(m, "\n");
6065	if (node->proc) {
6066		list_for_each_entry(w, &node->async_todo, entry)
6067			print_binder_work_ilocked(m, node->proc, "    ",
6068					  "    pending async transaction", w);
6069	}
6070}
6071
6072static void print_binder_ref_olocked(struct seq_file *m,
6073				     struct binder_ref *ref)
6074{
6075	binder_node_lock(ref->node);
6076	seq_printf(m, "  ref %d: desc %d %snode %d s %d w %d d %pK\n",
6077		   ref->data.debug_id, ref->data.desc,
6078		   ref->node->proc ? "" : "dead ",
6079		   ref->node->debug_id, ref->data.strong,
6080		   ref->data.weak, ref->death);
6081	binder_node_unlock(ref->node);
6082}
6083
6084static void print_binder_proc(struct seq_file *m,
6085			      struct binder_proc *proc, int print_all)
6086{
6087	struct binder_work *w;
6088	struct rb_node *n;
6089	size_t start_pos = m->count;
6090	size_t header_pos;
6091	struct binder_node *last_node = NULL;
6092
6093	seq_printf(m, "proc %d\n", proc->pid);
6094	seq_printf(m, "context %s\n", proc->context->name);
6095	header_pos = m->count;
6096
6097	binder_inner_proc_lock(proc);
6098	for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n))
6099		print_binder_thread_ilocked(m, rb_entry(n, struct binder_thread,
6100						rb_node), print_all);
6101
6102	for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) {
6103		struct binder_node *node = rb_entry(n, struct binder_node,
6104						    rb_node);
6105		if (!print_all && !node->has_async_transaction)
6106			continue;
6107
6108		/*
6109		 * take a temporary reference on the node so it
6110		 * survives and isn't removed from the tree
6111		 * while we print it.
6112		 */
6113		binder_inc_node_tmpref_ilocked(node);
6114		/* Need to drop inner lock to take node lock */
6115		binder_inner_proc_unlock(proc);
6116		if (last_node)
6117			binder_put_node(last_node);
6118		binder_node_inner_lock(node);
6119		print_binder_node_nilocked(m, node);
6120		binder_node_inner_unlock(node);
6121		last_node = node;
6122		binder_inner_proc_lock(proc);
6123	}
6124	binder_inner_proc_unlock(proc);
6125	if (last_node)
6126		binder_put_node(last_node);
6127
6128	if (print_all) {
6129		binder_proc_lock(proc);
6130		for (n = rb_first(&proc->refs_by_desc);
6131		     n != NULL;
6132		     n = rb_next(n))
6133			print_binder_ref_olocked(m, rb_entry(n,
6134							    struct binder_ref,
6135							    rb_node_desc));
6136		binder_proc_unlock(proc);
6137	}
6138	binder_alloc_print_allocated(m, &proc->alloc);
6139	binder_inner_proc_lock(proc);
6140	list_for_each_entry(w, &proc->todo, entry)
6141		print_binder_work_ilocked(m, proc, "  ",
6142					  "  pending transaction", w);
6143	list_for_each_entry(w, &proc->delivered_death, entry) {
6144		seq_puts(m, "  has delivered dead binder\n");
6145		break;
6146	}
6147	binder_inner_proc_unlock(proc);
6148	if (!print_all && m->count == header_pos)
6149		m->count = start_pos;
6150}
6151
6152static const char * const binder_return_strings[] = {
6153	"BR_ERROR",
6154	"BR_OK",
6155	"BR_TRANSACTION",
6156	"BR_REPLY",
6157	"BR_ACQUIRE_RESULT",
6158	"BR_DEAD_REPLY",
6159	"BR_TRANSACTION_COMPLETE",
6160	"BR_INCREFS",
6161	"BR_ACQUIRE",
6162	"BR_RELEASE",
6163	"BR_DECREFS",
6164	"BR_ATTEMPT_ACQUIRE",
6165	"BR_NOOP",
6166	"BR_SPAWN_LOOPER",
6167	"BR_FINISHED",
6168	"BR_DEAD_BINDER",
6169	"BR_CLEAR_DEATH_NOTIFICATION_DONE",
6170	"BR_FAILED_REPLY",
6171	"BR_FROZEN_REPLY",
6172	"BR_ONEWAY_SPAM_SUSPECT",
6173};
6174
6175static const char * const binder_command_strings[] = {
6176	"BC_TRANSACTION",
6177	"BC_REPLY",
6178	"BC_ACQUIRE_RESULT",
6179	"BC_FREE_BUFFER",
6180	"BC_INCREFS",
6181	"BC_ACQUIRE",
6182	"BC_RELEASE",
6183	"BC_DECREFS",
6184	"BC_INCREFS_DONE",
6185	"BC_ACQUIRE_DONE",
6186	"BC_ATTEMPT_ACQUIRE",
6187	"BC_REGISTER_LOOPER",
6188	"BC_ENTER_LOOPER",
6189	"BC_EXIT_LOOPER",
6190	"BC_REQUEST_DEATH_NOTIFICATION",
6191	"BC_CLEAR_DEATH_NOTIFICATION",
6192	"BC_DEAD_BINDER_DONE",
6193	"BC_TRANSACTION_SG",
6194	"BC_REPLY_SG",
6195};
6196
6197static const char * const binder_objstat_strings[] = {
6198	"proc",
6199	"thread",
6200	"node",
6201	"ref",
6202	"death",
6203	"transaction",
6204	"transaction_complete"
6205};
6206
6207static void print_binder_stats(struct seq_file *m, const char *prefix,
6208			       struct binder_stats *stats)
6209{
6210	int i;
6211
6212	BUILD_BUG_ON(ARRAY_SIZE(stats->bc) !=
6213		     ARRAY_SIZE(binder_command_strings));
6214	for (i = 0; i < ARRAY_SIZE(stats->bc); i++) {
6215		int temp = atomic_read(&stats->bc[i]);
6216
6217		if (temp)
6218			seq_printf(m, "%s%s: %d\n", prefix,
6219				   binder_command_strings[i], temp);
6220	}
6221
6222	BUILD_BUG_ON(ARRAY_SIZE(stats->br) !=
6223		     ARRAY_SIZE(binder_return_strings));
6224	for (i = 0; i < ARRAY_SIZE(stats->br); i++) {
6225		int temp = atomic_read(&stats->br[i]);
6226
6227		if (temp)
6228			seq_printf(m, "%s%s: %d\n", prefix,
6229				   binder_return_strings[i], temp);
6230	}
6231
6232	BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) !=
6233		     ARRAY_SIZE(binder_objstat_strings));
6234	BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) !=
6235		     ARRAY_SIZE(stats->obj_deleted));
6236	for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) {
6237		int created = atomic_read(&stats->obj_created[i]);
6238		int deleted = atomic_read(&stats->obj_deleted[i]);
6239
6240		if (created || deleted)
6241			seq_printf(m, "%s%s: active %d total %d\n",
6242				prefix,
6243				binder_objstat_strings[i],
6244				created - deleted,
6245				created);
6246	}
6247}
6248
6249static void print_binder_proc_stats(struct seq_file *m,
6250				    struct binder_proc *proc)
6251{
6252	struct binder_work *w;
6253	struct binder_thread *thread;
6254	struct rb_node *n;
6255	int count, strong, weak, ready_threads;
6256	size_t free_async_space =
6257		binder_alloc_get_free_async_space(&proc->alloc);
6258
6259	seq_printf(m, "proc %d\n", proc->pid);
6260	seq_printf(m, "context %s\n", proc->context->name);
6261	count = 0;
6262	ready_threads = 0;
6263	binder_inner_proc_lock(proc);
6264	for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n))
6265		count++;
6266
6267	list_for_each_entry(thread, &proc->waiting_threads, waiting_thread_node)
6268		ready_threads++;
6269
6270	seq_printf(m, "  threads: %d\n", count);
6271	seq_printf(m, "  requested threads: %d+%d/%d\n"
6272			"  ready threads %d\n"
6273			"  free async space %zd\n", proc->requested_threads,
6274			proc->requested_threads_started, proc->max_threads,
6275			ready_threads,
6276			free_async_space);
6277	count = 0;
6278	for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n))
6279		count++;
6280	binder_inner_proc_unlock(proc);
6281	seq_printf(m, "  nodes: %d\n", count);
6282	count = 0;
6283	strong = 0;
6284	weak = 0;
6285	binder_proc_lock(proc);
6286	for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) {
6287		struct binder_ref *ref = rb_entry(n, struct binder_ref,
6288						  rb_node_desc);
6289		count++;
6290		strong += ref->data.strong;
6291		weak += ref->data.weak;
6292	}
6293	binder_proc_unlock(proc);
6294	seq_printf(m, "  refs: %d s %d w %d\n", count, strong, weak);
6295
6296	count = binder_alloc_get_allocated_count(&proc->alloc);
6297	seq_printf(m, "  buffers: %d\n", count);
6298
6299	binder_alloc_print_pages(m, &proc->alloc);
6300
6301	count = 0;
6302	binder_inner_proc_lock(proc);
6303	list_for_each_entry(w, &proc->todo, entry) {
6304		if (w->type == BINDER_WORK_TRANSACTION)
6305			count++;
6306	}
6307	binder_inner_proc_unlock(proc);
6308	seq_printf(m, "  pending transactions: %d\n", count);
6309
6310	print_binder_stats(m, "  ", &proc->stats);
6311}
6312
6313static int state_show(struct seq_file *m, void *unused)
 
6314{
6315	struct binder_proc *proc;
6316	struct binder_node *node;
6317	struct binder_node *last_node = NULL;
6318
6319	seq_puts(m, "binder state:\n");
6320
6321	spin_lock(&binder_dead_nodes_lock);
6322	if (!hlist_empty(&binder_dead_nodes))
6323		seq_puts(m, "dead nodes:\n");
6324	hlist_for_each_entry(node, &binder_dead_nodes, dead_node) {
6325		/*
6326		 * take a temporary reference on the node so it
6327		 * survives and isn't removed from the list
6328		 * while we print it.
6329		 */
6330		node->tmp_refs++;
6331		spin_unlock(&binder_dead_nodes_lock);
6332		if (last_node)
6333			binder_put_node(last_node);
6334		binder_node_lock(node);
6335		print_binder_node_nilocked(m, node);
6336		binder_node_unlock(node);
6337		last_node = node;
6338		spin_lock(&binder_dead_nodes_lock);
6339	}
6340	spin_unlock(&binder_dead_nodes_lock);
6341	if (last_node)
6342		binder_put_node(last_node);
6343
6344	mutex_lock(&binder_procs_lock);
6345	hlist_for_each_entry(proc, &binder_procs, proc_node)
6346		print_binder_proc(m, proc, 1);
6347	mutex_unlock(&binder_procs_lock);
6348
6349	return 0;
6350}
6351
6352static int stats_show(struct seq_file *m, void *unused)
6353{
6354	struct binder_proc *proc;
6355
6356	seq_puts(m, "binder stats:\n");
6357
6358	print_binder_stats(m, "", &binder_stats);
6359
6360	mutex_lock(&binder_procs_lock);
6361	hlist_for_each_entry(proc, &binder_procs, proc_node)
6362		print_binder_proc_stats(m, proc);
6363	mutex_unlock(&binder_procs_lock);
6364
6365	return 0;
6366}
6367
6368static int transactions_show(struct seq_file *m, void *unused)
6369{
6370	struct binder_proc *proc;
6371
6372	seq_puts(m, "binder transactions:\n");
6373	mutex_lock(&binder_procs_lock);
6374	hlist_for_each_entry(proc, &binder_procs, proc_node)
6375		print_binder_proc(m, proc, 0);
6376	mutex_unlock(&binder_procs_lock);
6377
6378	return 0;
6379}
6380
6381static int proc_show(struct seq_file *m, void *unused)
6382{
6383	struct binder_proc *itr;
6384	int pid = (unsigned long)m->private;
6385
6386	mutex_lock(&binder_procs_lock);
6387	hlist_for_each_entry(itr, &binder_procs, proc_node) {
6388		if (itr->pid == pid) {
6389			seq_puts(m, "binder proc state:\n");
6390			print_binder_proc(m, itr, 1);
6391		}
6392	}
6393	mutex_unlock(&binder_procs_lock);
6394
6395	return 0;
6396}
6397
6398static void print_binder_transaction_log_entry(struct seq_file *m,
6399					struct binder_transaction_log_entry *e)
6400{
6401	int debug_id = READ_ONCE(e->debug_id_done);
6402	/*
6403	 * read barrier to guarantee debug_id_done read before
6404	 * we print the log values
6405	 */
6406	smp_rmb();
6407	seq_printf(m,
6408		   "%d: %s from %d:%d to %d:%d context %s node %d handle %d size %d:%d ret %d/%d l=%d",
6409		   e->debug_id, (e->call_type == 2) ? "reply" :
6410		   ((e->call_type == 1) ? "async" : "call "), e->from_proc,
6411		   e->from_thread, e->to_proc, e->to_thread, e->context_name,
6412		   e->to_node, e->target_handle, e->data_size, e->offsets_size,
6413		   e->return_error, e->return_error_param,
6414		   e->return_error_line);
6415	/*
6416	 * read-barrier to guarantee read of debug_id_done after
6417	 * done printing the fields of the entry
6418	 */
6419	smp_rmb();
6420	seq_printf(m, debug_id && debug_id == READ_ONCE(e->debug_id_done) ?
6421			"\n" : " (incomplete)\n");
6422}
6423
6424static int transaction_log_show(struct seq_file *m, void *unused)
6425{
6426	struct binder_transaction_log *log = m->private;
6427	unsigned int log_cur = atomic_read(&log->cur);
6428	unsigned int count;
6429	unsigned int cur;
6430	int i;
6431
6432	count = log_cur + 1;
6433	cur = count < ARRAY_SIZE(log->entry) && !log->full ?
6434		0 : count % ARRAY_SIZE(log->entry);
6435	if (count > ARRAY_SIZE(log->entry) || log->full)
6436		count = ARRAY_SIZE(log->entry);
6437	for (i = 0; i < count; i++) {
6438		unsigned int index = cur++ % ARRAY_SIZE(log->entry);
6439
6440		print_binder_transaction_log_entry(m, &log->entry[index]);
6441	}
6442	return 0;
6443}
6444
6445const struct file_operations binder_fops = {
6446	.owner = THIS_MODULE,
6447	.poll = binder_poll,
6448	.unlocked_ioctl = binder_ioctl,
6449	.compat_ioctl = compat_ptr_ioctl,
6450	.mmap = binder_mmap,
6451	.open = binder_open,
6452	.flush = binder_flush,
6453	.release = binder_release,
6454};
6455
6456DEFINE_SHOW_ATTRIBUTE(state);
6457DEFINE_SHOW_ATTRIBUTE(stats);
6458DEFINE_SHOW_ATTRIBUTE(transactions);
6459DEFINE_SHOW_ATTRIBUTE(transaction_log);
6460
6461const struct binder_debugfs_entry binder_debugfs_entries[] = {
6462	{
6463		.name = "state",
6464		.mode = 0444,
6465		.fops = &state_fops,
6466		.data = NULL,
6467	},
6468	{
6469		.name = "stats",
6470		.mode = 0444,
6471		.fops = &stats_fops,
6472		.data = NULL,
6473	},
6474	{
6475		.name = "transactions",
6476		.mode = 0444,
6477		.fops = &transactions_fops,
6478		.data = NULL,
6479	},
6480	{
6481		.name = "transaction_log",
6482		.mode = 0444,
6483		.fops = &transaction_log_fops,
6484		.data = &binder_transaction_log,
6485	},
6486	{
6487		.name = "failed_transaction_log",
6488		.mode = 0444,
6489		.fops = &transaction_log_fops,
6490		.data = &binder_transaction_log_failed,
6491	},
6492	{} /* terminator */
6493};
6494
6495static int __init init_binder_device(const char *name)
6496{
6497	int ret;
6498	struct binder_device *binder_device;
6499
6500	binder_device = kzalloc(sizeof(*binder_device), GFP_KERNEL);
6501	if (!binder_device)
6502		return -ENOMEM;
6503
6504	binder_device->miscdev.fops = &binder_fops;
6505	binder_device->miscdev.minor = MISC_DYNAMIC_MINOR;
6506	binder_device->miscdev.name = name;
6507
6508	refcount_set(&binder_device->ref, 1);
6509	binder_device->context.binder_context_mgr_uid = INVALID_UID;
6510	binder_device->context.name = name;
6511	mutex_init(&binder_device->context.context_mgr_node_lock);
6512
6513	ret = misc_register(&binder_device->miscdev);
6514	if (ret < 0) {
6515		kfree(binder_device);
6516		return ret;
6517	}
6518
6519	hlist_add_head(&binder_device->hlist, &binder_devices);
6520
6521	return ret;
6522}
6523
6524static int __init binder_init(void)
6525{
6526	int ret;
6527	char *device_name, *device_tmp;
6528	struct binder_device *device;
6529	struct hlist_node *tmp;
6530	char *device_names = NULL;
6531
6532	ret = binder_alloc_shrinker_init();
6533	if (ret)
6534		return ret;
6535
6536	atomic_set(&binder_transaction_log.cur, ~0U);
6537	atomic_set(&binder_transaction_log_failed.cur, ~0U);
6538
6539	binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL);
6540	if (binder_debugfs_dir_entry_root) {
6541		const struct binder_debugfs_entry *db_entry;
6542
6543		binder_for_each_debugfs_entry(db_entry)
6544			debugfs_create_file(db_entry->name,
6545					    db_entry->mode,
6546					    binder_debugfs_dir_entry_root,
6547					    db_entry->data,
6548					    db_entry->fops);
6549
6550		binder_debugfs_dir_entry_proc = debugfs_create_dir("proc",
6551						 binder_debugfs_dir_entry_root);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
6552	}
6553
6554	if (!IS_ENABLED(CONFIG_ANDROID_BINDERFS) &&
6555	    strcmp(binder_devices_param, "") != 0) {
6556		/*
6557		* Copy the module_parameter string, because we don't want to
6558		* tokenize it in-place.
6559		 */
6560		device_names = kstrdup(binder_devices_param, GFP_KERNEL);
6561		if (!device_names) {
6562			ret = -ENOMEM;
6563			goto err_alloc_device_names_failed;
6564		}
6565
6566		device_tmp = device_names;
6567		while ((device_name = strsep(&device_tmp, ","))) {
6568			ret = init_binder_device(device_name);
6569			if (ret)
6570				goto err_init_binder_device_failed;
6571		}
6572	}
6573
6574	ret = init_binderfs();
6575	if (ret)
6576		goto err_init_binder_device_failed;
6577
6578	return ret;
6579
6580err_init_binder_device_failed:
6581	hlist_for_each_entry_safe(device, tmp, &binder_devices, hlist) {
6582		misc_deregister(&device->miscdev);
6583		hlist_del(&device->hlist);
6584		kfree(device);
6585	}
6586
6587	kfree(device_names);
6588
6589err_alloc_device_names_failed:
6590	debugfs_remove_recursive(binder_debugfs_dir_entry_root);
6591
6592	return ret;
6593}
6594
6595device_initcall(binder_init);
6596
6597#define CREATE_TRACE_POINTS
6598#include "binder_trace.h"
6599
6600MODULE_LICENSE("GPL v2");
v5.4
   1// SPDX-License-Identifier: GPL-2.0-only
   2/* binder.c
   3 *
   4 * Android IPC Subsystem
   5 *
   6 * Copyright (C) 2007-2008 Google, Inc.
   7 */
   8
   9/*
  10 * Locking overview
  11 *
  12 * There are 3 main spinlocks which must be acquired in the
  13 * order shown:
  14 *
  15 * 1) proc->outer_lock : protects binder_ref
  16 *    binder_proc_lock() and binder_proc_unlock() are
  17 *    used to acq/rel.
  18 * 2) node->lock : protects most fields of binder_node.
  19 *    binder_node_lock() and binder_node_unlock() are
  20 *    used to acq/rel
  21 * 3) proc->inner_lock : protects the thread and node lists
  22 *    (proc->threads, proc->waiting_threads, proc->nodes)
  23 *    and all todo lists associated with the binder_proc
  24 *    (proc->todo, thread->todo, proc->delivered_death and
  25 *    node->async_todo), as well as thread->transaction_stack
  26 *    binder_inner_proc_lock() and binder_inner_proc_unlock()
  27 *    are used to acq/rel
  28 *
  29 * Any lock under procA must never be nested under any lock at the same
  30 * level or below on procB.
  31 *
  32 * Functions that require a lock held on entry indicate which lock
  33 * in the suffix of the function name:
  34 *
  35 * foo_olocked() : requires node->outer_lock
  36 * foo_nlocked() : requires node->lock
  37 * foo_ilocked() : requires proc->inner_lock
  38 * foo_oilocked(): requires proc->outer_lock and proc->inner_lock
  39 * foo_nilocked(): requires node->lock and proc->inner_lock
  40 * ...
  41 */
  42
  43#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  44
  45#include <linux/fdtable.h>
  46#include <linux/file.h>
  47#include <linux/freezer.h>
  48#include <linux/fs.h>
  49#include <linux/list.h>
  50#include <linux/miscdevice.h>
  51#include <linux/module.h>
  52#include <linux/mutex.h>
  53#include <linux/nsproxy.h>
  54#include <linux/poll.h>
  55#include <linux/debugfs.h>
  56#include <linux/rbtree.h>
  57#include <linux/sched/signal.h>
  58#include <linux/sched/mm.h>
  59#include <linux/seq_file.h>
  60#include <linux/string.h>
  61#include <linux/uaccess.h>
  62#include <linux/pid_namespace.h>
  63#include <linux/security.h>
  64#include <linux/spinlock.h>
  65#include <linux/ratelimit.h>
  66#include <linux/syscalls.h>
  67#include <linux/task_work.h>
 
  68
  69#include <uapi/linux/android/binder.h>
  70#include <uapi/linux/android/binderfs.h>
  71
  72#include <asm/cacheflush.h>
  73
  74#include "binder_alloc.h"
  75#include "binder_internal.h"
  76#include "binder_trace.h"
  77
  78static HLIST_HEAD(binder_deferred_list);
  79static DEFINE_MUTEX(binder_deferred_lock);
  80
  81static HLIST_HEAD(binder_devices);
  82static HLIST_HEAD(binder_procs);
  83static DEFINE_MUTEX(binder_procs_lock);
  84
  85static HLIST_HEAD(binder_dead_nodes);
  86static DEFINE_SPINLOCK(binder_dead_nodes_lock);
  87
  88static struct dentry *binder_debugfs_dir_entry_root;
  89static struct dentry *binder_debugfs_dir_entry_proc;
  90static atomic_t binder_last_id;
  91
  92static int proc_show(struct seq_file *m, void *unused);
  93DEFINE_SHOW_ATTRIBUTE(proc);
  94
  95/* This is only defined in include/asm-arm/sizes.h */
  96#ifndef SZ_1K
  97#define SZ_1K                               0x400
  98#endif
  99
 100#define FORBIDDEN_MMAP_FLAGS                (VM_WRITE)
 101
 102enum {
 103	BINDER_DEBUG_USER_ERROR             = 1U << 0,
 104	BINDER_DEBUG_FAILED_TRANSACTION     = 1U << 1,
 105	BINDER_DEBUG_DEAD_TRANSACTION       = 1U << 2,
 106	BINDER_DEBUG_OPEN_CLOSE             = 1U << 3,
 107	BINDER_DEBUG_DEAD_BINDER            = 1U << 4,
 108	BINDER_DEBUG_DEATH_NOTIFICATION     = 1U << 5,
 109	BINDER_DEBUG_READ_WRITE             = 1U << 6,
 110	BINDER_DEBUG_USER_REFS              = 1U << 7,
 111	BINDER_DEBUG_THREADS                = 1U << 8,
 112	BINDER_DEBUG_TRANSACTION            = 1U << 9,
 113	BINDER_DEBUG_TRANSACTION_COMPLETE   = 1U << 10,
 114	BINDER_DEBUG_FREE_BUFFER            = 1U << 11,
 115	BINDER_DEBUG_INTERNAL_REFS          = 1U << 12,
 116	BINDER_DEBUG_PRIORITY_CAP           = 1U << 13,
 117	BINDER_DEBUG_SPINLOCKS              = 1U << 14,
 118};
 119static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR |
 120	BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION;
 121module_param_named(debug_mask, binder_debug_mask, uint, 0644);
 122
 123char *binder_devices_param = CONFIG_ANDROID_BINDER_DEVICES;
 124module_param_named(devices, binder_devices_param, charp, 0444);
 125
 126static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait);
 127static int binder_stop_on_user_error;
 128
 129static int binder_set_stop_on_user_error(const char *val,
 130					 const struct kernel_param *kp)
 131{
 132	int ret;
 133
 134	ret = param_set_int(val, kp);
 135	if (binder_stop_on_user_error < 2)
 136		wake_up(&binder_user_error_wait);
 137	return ret;
 138}
 139module_param_call(stop_on_user_error, binder_set_stop_on_user_error,
 140	param_get_int, &binder_stop_on_user_error, 0644);
 141
 142#define binder_debug(mask, x...) \
 143	do { \
 144		if (binder_debug_mask & mask) \
 145			pr_info_ratelimited(x); \
 146	} while (0)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 147
 148#define binder_user_error(x...) \
 149	do { \
 150		if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \
 151			pr_info_ratelimited(x); \
 152		if (binder_stop_on_user_error) \
 153			binder_stop_on_user_error = 2; \
 154	} while (0)
 155
 156#define to_flat_binder_object(hdr) \
 157	container_of(hdr, struct flat_binder_object, hdr)
 158
 159#define to_binder_fd_object(hdr) container_of(hdr, struct binder_fd_object, hdr)
 160
 161#define to_binder_buffer_object(hdr) \
 162	container_of(hdr, struct binder_buffer_object, hdr)
 163
 164#define to_binder_fd_array_object(hdr) \
 165	container_of(hdr, struct binder_fd_array_object, hdr)
 166
 167enum binder_stat_types {
 168	BINDER_STAT_PROC,
 169	BINDER_STAT_THREAD,
 170	BINDER_STAT_NODE,
 171	BINDER_STAT_REF,
 172	BINDER_STAT_DEATH,
 173	BINDER_STAT_TRANSACTION,
 174	BINDER_STAT_TRANSACTION_COMPLETE,
 175	BINDER_STAT_COUNT
 176};
 177
 178struct binder_stats {
 179	atomic_t br[_IOC_NR(BR_FAILED_REPLY) + 1];
 180	atomic_t bc[_IOC_NR(BC_REPLY_SG) + 1];
 181	atomic_t obj_created[BINDER_STAT_COUNT];
 182	atomic_t obj_deleted[BINDER_STAT_COUNT];
 183};
 184
 185static struct binder_stats binder_stats;
 186
 187static inline void binder_stats_deleted(enum binder_stat_types type)
 188{
 189	atomic_inc(&binder_stats.obj_deleted[type]);
 190}
 191
 192static inline void binder_stats_created(enum binder_stat_types type)
 193{
 194	atomic_inc(&binder_stats.obj_created[type]);
 195}
 196
 197struct binder_transaction_log binder_transaction_log;
 198struct binder_transaction_log binder_transaction_log_failed;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 199
 200static struct binder_transaction_log_entry *binder_transaction_log_add(
 201	struct binder_transaction_log *log)
 202{
 203	struct binder_transaction_log_entry *e;
 204	unsigned int cur = atomic_inc_return(&log->cur);
 205
 206	if (cur >= ARRAY_SIZE(log->entry))
 207		log->full = true;
 208	e = &log->entry[cur % ARRAY_SIZE(log->entry)];
 209	WRITE_ONCE(e->debug_id_done, 0);
 210	/*
 211	 * write-barrier to synchronize access to e->debug_id_done.
 212	 * We make sure the initialized 0 value is seen before
 213	 * memset() other fields are zeroed by memset.
 214	 */
 215	smp_wmb();
 216	memset(e, 0, sizeof(*e));
 217	return e;
 218}
 219
 220/**
 221 * struct binder_work - work enqueued on a worklist
 222 * @entry:             node enqueued on list
 223 * @type:              type of work to be performed
 224 *
 225 * There are separate work lists for proc, thread, and node (async).
 226 */
 227struct binder_work {
 228	struct list_head entry;
 229
 230	enum {
 231		BINDER_WORK_TRANSACTION = 1,
 232		BINDER_WORK_TRANSACTION_COMPLETE,
 233		BINDER_WORK_RETURN_ERROR,
 234		BINDER_WORK_NODE,
 235		BINDER_WORK_DEAD_BINDER,
 236		BINDER_WORK_DEAD_BINDER_AND_CLEAR,
 237		BINDER_WORK_CLEAR_DEATH_NOTIFICATION,
 238	} type;
 239};
 240
 241struct binder_error {
 242	struct binder_work work;
 243	uint32_t cmd;
 244};
 245
 246/**
 247 * struct binder_node - binder node bookkeeping
 248 * @debug_id:             unique ID for debugging
 249 *                        (invariant after initialized)
 250 * @lock:                 lock for node fields
 251 * @work:                 worklist element for node work
 252 *                        (protected by @proc->inner_lock)
 253 * @rb_node:              element for proc->nodes tree
 254 *                        (protected by @proc->inner_lock)
 255 * @dead_node:            element for binder_dead_nodes list
 256 *                        (protected by binder_dead_nodes_lock)
 257 * @proc:                 binder_proc that owns this node
 258 *                        (invariant after initialized)
 259 * @refs:                 list of references on this node
 260 *                        (protected by @lock)
 261 * @internal_strong_refs: used to take strong references when
 262 *                        initiating a transaction
 263 *                        (protected by @proc->inner_lock if @proc
 264 *                        and by @lock)
 265 * @local_weak_refs:      weak user refs from local process
 266 *                        (protected by @proc->inner_lock if @proc
 267 *                        and by @lock)
 268 * @local_strong_refs:    strong user refs from local process
 269 *                        (protected by @proc->inner_lock if @proc
 270 *                        and by @lock)
 271 * @tmp_refs:             temporary kernel refs
 272 *                        (protected by @proc->inner_lock while @proc
 273 *                        is valid, and by binder_dead_nodes_lock
 274 *                        if @proc is NULL. During inc/dec and node release
 275 *                        it is also protected by @lock to provide safety
 276 *                        as the node dies and @proc becomes NULL)
 277 * @ptr:                  userspace pointer for node
 278 *                        (invariant, no lock needed)
 279 * @cookie:               userspace cookie for node
 280 *                        (invariant, no lock needed)
 281 * @has_strong_ref:       userspace notified of strong ref
 282 *                        (protected by @proc->inner_lock if @proc
 283 *                        and by @lock)
 284 * @pending_strong_ref:   userspace has acked notification of strong ref
 285 *                        (protected by @proc->inner_lock if @proc
 286 *                        and by @lock)
 287 * @has_weak_ref:         userspace notified of weak ref
 288 *                        (protected by @proc->inner_lock if @proc
 289 *                        and by @lock)
 290 * @pending_weak_ref:     userspace has acked notification of weak ref
 291 *                        (protected by @proc->inner_lock if @proc
 292 *                        and by @lock)
 293 * @has_async_transaction: async transaction to node in progress
 294 *                        (protected by @lock)
 295 * @accept_fds:           file descriptor operations supported for node
 296 *                        (invariant after initialized)
 297 * @min_priority:         minimum scheduling priority
 298 *                        (invariant after initialized)
 299 * @txn_security_ctx:     require sender's security context
 300 *                        (invariant after initialized)
 301 * @async_todo:           list of async work items
 302 *                        (protected by @proc->inner_lock)
 303 *
 304 * Bookkeeping structure for binder nodes.
 305 */
 306struct binder_node {
 307	int debug_id;
 308	spinlock_t lock;
 309	struct binder_work work;
 310	union {
 311		struct rb_node rb_node;
 312		struct hlist_node dead_node;
 313	};
 314	struct binder_proc *proc;
 315	struct hlist_head refs;
 316	int internal_strong_refs;
 317	int local_weak_refs;
 318	int local_strong_refs;
 319	int tmp_refs;
 320	binder_uintptr_t ptr;
 321	binder_uintptr_t cookie;
 322	struct {
 323		/*
 324		 * bitfield elements protected by
 325		 * proc inner_lock
 326		 */
 327		u8 has_strong_ref:1;
 328		u8 pending_strong_ref:1;
 329		u8 has_weak_ref:1;
 330		u8 pending_weak_ref:1;
 331	};
 332	struct {
 333		/*
 334		 * invariant after initialization
 335		 */
 336		u8 accept_fds:1;
 337		u8 txn_security_ctx:1;
 338		u8 min_priority;
 339	};
 340	bool has_async_transaction;
 341	struct list_head async_todo;
 342};
 343
 344struct binder_ref_death {
 345	/**
 346	 * @work: worklist element for death notifications
 347	 *        (protected by inner_lock of the proc that
 348	 *        this ref belongs to)
 349	 */
 350	struct binder_work work;
 351	binder_uintptr_t cookie;
 352};
 353
 354/**
 355 * struct binder_ref_data - binder_ref counts and id
 356 * @debug_id:        unique ID for the ref
 357 * @desc:            unique userspace handle for ref
 358 * @strong:          strong ref count (debugging only if not locked)
 359 * @weak:            weak ref count (debugging only if not locked)
 360 *
 361 * Structure to hold ref count and ref id information. Since
 362 * the actual ref can only be accessed with a lock, this structure
 363 * is used to return information about the ref to callers of
 364 * ref inc/dec functions.
 365 */
 366struct binder_ref_data {
 367	int debug_id;
 368	uint32_t desc;
 369	int strong;
 370	int weak;
 371};
 372
 373/**
 374 * struct binder_ref - struct to track references on nodes
 375 * @data:        binder_ref_data containing id, handle, and current refcounts
 376 * @rb_node_desc: node for lookup by @data.desc in proc's rb_tree
 377 * @rb_node_node: node for lookup by @node in proc's rb_tree
 378 * @node_entry:  list entry for node->refs list in target node
 379 *               (protected by @node->lock)
 380 * @proc:        binder_proc containing ref
 381 * @node:        binder_node of target node. When cleaning up a
 382 *               ref for deletion in binder_cleanup_ref, a non-NULL
 383 *               @node indicates the node must be freed
 384 * @death:       pointer to death notification (ref_death) if requested
 385 *               (protected by @node->lock)
 386 *
 387 * Structure to track references from procA to target node (on procB). This
 388 * structure is unsafe to access without holding @proc->outer_lock.
 389 */
 390struct binder_ref {
 391	/* Lookups needed: */
 392	/*   node + proc => ref (transaction) */
 393	/*   desc + proc => ref (transaction, inc/dec ref) */
 394	/*   node => refs + procs (proc exit) */
 395	struct binder_ref_data data;
 396	struct rb_node rb_node_desc;
 397	struct rb_node rb_node_node;
 398	struct hlist_node node_entry;
 399	struct binder_proc *proc;
 400	struct binder_node *node;
 401	struct binder_ref_death *death;
 402};
 403
 404enum binder_deferred_state {
 405	BINDER_DEFERRED_FLUSH        = 0x01,
 406	BINDER_DEFERRED_RELEASE      = 0x02,
 407};
 408
 409/**
 410 * struct binder_proc - binder process bookkeeping
 411 * @proc_node:            element for binder_procs list
 412 * @threads:              rbtree of binder_threads in this proc
 413 *                        (protected by @inner_lock)
 414 * @nodes:                rbtree of binder nodes associated with
 415 *                        this proc ordered by node->ptr
 416 *                        (protected by @inner_lock)
 417 * @refs_by_desc:         rbtree of refs ordered by ref->desc
 418 *                        (protected by @outer_lock)
 419 * @refs_by_node:         rbtree of refs ordered by ref->node
 420 *                        (protected by @outer_lock)
 421 * @waiting_threads:      threads currently waiting for proc work
 422 *                        (protected by @inner_lock)
 423 * @pid                   PID of group_leader of process
 424 *                        (invariant after initialized)
 425 * @tsk                   task_struct for group_leader of process
 426 *                        (invariant after initialized)
 427 * @deferred_work_node:   element for binder_deferred_list
 428 *                        (protected by binder_deferred_lock)
 429 * @deferred_work:        bitmap of deferred work to perform
 430 *                        (protected by binder_deferred_lock)
 431 * @is_dead:              process is dead and awaiting free
 432 *                        when outstanding transactions are cleaned up
 433 *                        (protected by @inner_lock)
 434 * @todo:                 list of work for this process
 435 *                        (protected by @inner_lock)
 436 * @stats:                per-process binder statistics
 437 *                        (atomics, no lock needed)
 438 * @delivered_death:      list of delivered death notification
 439 *                        (protected by @inner_lock)
 440 * @max_threads:          cap on number of binder threads
 441 *                        (protected by @inner_lock)
 442 * @requested_threads:    number of binder threads requested but not
 443 *                        yet started. In current implementation, can
 444 *                        only be 0 or 1.
 445 *                        (protected by @inner_lock)
 446 * @requested_threads_started: number binder threads started
 447 *                        (protected by @inner_lock)
 448 * @tmp_ref:              temporary reference to indicate proc is in use
 449 *                        (protected by @inner_lock)
 450 * @default_priority:     default scheduler priority
 451 *                        (invariant after initialized)
 452 * @debugfs_entry:        debugfs node
 453 * @alloc:                binder allocator bookkeeping
 454 * @context:              binder_context for this proc
 455 *                        (invariant after initialized)
 456 * @inner_lock:           can nest under outer_lock and/or node lock
 457 * @outer_lock:           no nesting under innor or node lock
 458 *                        Lock order: 1) outer, 2) node, 3) inner
 459 * @binderfs_entry:       process-specific binderfs log file
 460 *
 461 * Bookkeeping structure for binder processes
 462 */
 463struct binder_proc {
 464	struct hlist_node proc_node;
 465	struct rb_root threads;
 466	struct rb_root nodes;
 467	struct rb_root refs_by_desc;
 468	struct rb_root refs_by_node;
 469	struct list_head waiting_threads;
 470	int pid;
 471	struct task_struct *tsk;
 472	struct hlist_node deferred_work_node;
 473	int deferred_work;
 474	bool is_dead;
 475
 476	struct list_head todo;
 477	struct binder_stats stats;
 478	struct list_head delivered_death;
 479	int max_threads;
 480	int requested_threads;
 481	int requested_threads_started;
 482	int tmp_ref;
 483	long default_priority;
 484	struct dentry *debugfs_entry;
 485	struct binder_alloc alloc;
 486	struct binder_context *context;
 487	spinlock_t inner_lock;
 488	spinlock_t outer_lock;
 489	struct dentry *binderfs_entry;
 490};
 491
 492enum {
 493	BINDER_LOOPER_STATE_REGISTERED  = 0x01,
 494	BINDER_LOOPER_STATE_ENTERED     = 0x02,
 495	BINDER_LOOPER_STATE_EXITED      = 0x04,
 496	BINDER_LOOPER_STATE_INVALID     = 0x08,
 497	BINDER_LOOPER_STATE_WAITING     = 0x10,
 498	BINDER_LOOPER_STATE_POLL        = 0x20,
 499};
 500
 501/**
 502 * struct binder_thread - binder thread bookkeeping
 503 * @proc:                 binder process for this thread
 504 *                        (invariant after initialization)
 505 * @rb_node:              element for proc->threads rbtree
 506 *                        (protected by @proc->inner_lock)
 507 * @waiting_thread_node:  element for @proc->waiting_threads list
 508 *                        (protected by @proc->inner_lock)
 509 * @pid:                  PID for this thread
 510 *                        (invariant after initialization)
 511 * @looper:               bitmap of looping state
 512 *                        (only accessed by this thread)
 513 * @looper_needs_return:  looping thread needs to exit driver
 514 *                        (no lock needed)
 515 * @transaction_stack:    stack of in-progress transactions for this thread
 516 *                        (protected by @proc->inner_lock)
 517 * @todo:                 list of work to do for this thread
 518 *                        (protected by @proc->inner_lock)
 519 * @process_todo:         whether work in @todo should be processed
 520 *                        (protected by @proc->inner_lock)
 521 * @return_error:         transaction errors reported by this thread
 522 *                        (only accessed by this thread)
 523 * @reply_error:          transaction errors reported by target thread
 524 *                        (protected by @proc->inner_lock)
 525 * @wait:                 wait queue for thread work
 526 * @stats:                per-thread statistics
 527 *                        (atomics, no lock needed)
 528 * @tmp_ref:              temporary reference to indicate thread is in use
 529 *                        (atomic since @proc->inner_lock cannot
 530 *                        always be acquired)
 531 * @is_dead:              thread is dead and awaiting free
 532 *                        when outstanding transactions are cleaned up
 533 *                        (protected by @proc->inner_lock)
 534 *
 535 * Bookkeeping structure for binder threads.
 536 */
 537struct binder_thread {
 538	struct binder_proc *proc;
 539	struct rb_node rb_node;
 540	struct list_head waiting_thread_node;
 541	int pid;
 542	int looper;              /* only modified by this thread */
 543	bool looper_need_return; /* can be written by other thread */
 544	struct binder_transaction *transaction_stack;
 545	struct list_head todo;
 546	bool process_todo;
 547	struct binder_error return_error;
 548	struct binder_error reply_error;
 549	wait_queue_head_t wait;
 550	struct binder_stats stats;
 551	atomic_t tmp_ref;
 552	bool is_dead;
 553};
 554
 555/**
 556 * struct binder_txn_fd_fixup - transaction fd fixup list element
 557 * @fixup_entry:          list entry
 558 * @file:                 struct file to be associated with new fd
 559 * @offset:               offset in buffer data to this fixup
 560 *
 561 * List element for fd fixups in a transaction. Since file
 562 * descriptors need to be allocated in the context of the
 563 * target process, we pass each fd to be processed in this
 564 * struct.
 565 */
 566struct binder_txn_fd_fixup {
 567	struct list_head fixup_entry;
 568	struct file *file;
 569	size_t offset;
 570};
 571
 572struct binder_transaction {
 573	int debug_id;
 574	struct binder_work work;
 575	struct binder_thread *from;
 576	struct binder_transaction *from_parent;
 577	struct binder_proc *to_proc;
 578	struct binder_thread *to_thread;
 579	struct binder_transaction *to_parent;
 580	unsigned need_reply:1;
 581	/* unsigned is_dead:1; */	/* not used at the moment */
 582
 583	struct binder_buffer *buffer;
 584	unsigned int	code;
 585	unsigned int	flags;
 586	long	priority;
 587	long	saved_priority;
 588	kuid_t	sender_euid;
 589	struct list_head fd_fixups;
 590	binder_uintptr_t security_ctx;
 591	/**
 592	 * @lock:  protects @from, @to_proc, and @to_thread
 593	 *
 594	 * @from, @to_proc, and @to_thread can be set to NULL
 595	 * during thread teardown
 596	 */
 597	spinlock_t lock;
 598};
 599
 600/**
 601 * struct binder_object - union of flat binder object types
 602 * @hdr:   generic object header
 603 * @fbo:   binder object (nodes and refs)
 604 * @fdo:   file descriptor object
 605 * @bbo:   binder buffer pointer
 606 * @fdao:  file descriptor array
 607 *
 608 * Used for type-independent object copies
 609 */
 610struct binder_object {
 611	union {
 612		struct binder_object_header hdr;
 613		struct flat_binder_object fbo;
 614		struct binder_fd_object fdo;
 615		struct binder_buffer_object bbo;
 616		struct binder_fd_array_object fdao;
 617	};
 618};
 619
 620/**
 621 * binder_proc_lock() - Acquire outer lock for given binder_proc
 622 * @proc:         struct binder_proc to acquire
 623 *
 624 * Acquires proc->outer_lock. Used to protect binder_ref
 625 * structures associated with the given proc.
 626 */
 627#define binder_proc_lock(proc) _binder_proc_lock(proc, __LINE__)
 628static void
 629_binder_proc_lock(struct binder_proc *proc, int line)
 630	__acquires(&proc->outer_lock)
 631{
 632	binder_debug(BINDER_DEBUG_SPINLOCKS,
 633		     "%s: line=%d\n", __func__, line);
 634	spin_lock(&proc->outer_lock);
 635}
 636
 637/**
 638 * binder_proc_unlock() - Release spinlock for given binder_proc
 639 * @proc:         struct binder_proc to acquire
 640 *
 641 * Release lock acquired via binder_proc_lock()
 642 */
 643#define binder_proc_unlock(_proc) _binder_proc_unlock(_proc, __LINE__)
 644static void
 645_binder_proc_unlock(struct binder_proc *proc, int line)
 646	__releases(&proc->outer_lock)
 647{
 648	binder_debug(BINDER_DEBUG_SPINLOCKS,
 649		     "%s: line=%d\n", __func__, line);
 650	spin_unlock(&proc->outer_lock);
 651}
 652
 653/**
 654 * binder_inner_proc_lock() - Acquire inner lock for given binder_proc
 655 * @proc:         struct binder_proc to acquire
 656 *
 657 * Acquires proc->inner_lock. Used to protect todo lists
 658 */
 659#define binder_inner_proc_lock(proc) _binder_inner_proc_lock(proc, __LINE__)
 660static void
 661_binder_inner_proc_lock(struct binder_proc *proc, int line)
 662	__acquires(&proc->inner_lock)
 663{
 664	binder_debug(BINDER_DEBUG_SPINLOCKS,
 665		     "%s: line=%d\n", __func__, line);
 666	spin_lock(&proc->inner_lock);
 667}
 668
 669/**
 670 * binder_inner_proc_unlock() - Release inner lock for given binder_proc
 671 * @proc:         struct binder_proc to acquire
 672 *
 673 * Release lock acquired via binder_inner_proc_lock()
 674 */
 675#define binder_inner_proc_unlock(proc) _binder_inner_proc_unlock(proc, __LINE__)
 676static void
 677_binder_inner_proc_unlock(struct binder_proc *proc, int line)
 678	__releases(&proc->inner_lock)
 679{
 680	binder_debug(BINDER_DEBUG_SPINLOCKS,
 681		     "%s: line=%d\n", __func__, line);
 682	spin_unlock(&proc->inner_lock);
 683}
 684
 685/**
 686 * binder_node_lock() - Acquire spinlock for given binder_node
 687 * @node:         struct binder_node to acquire
 688 *
 689 * Acquires node->lock. Used to protect binder_node fields
 690 */
 691#define binder_node_lock(node) _binder_node_lock(node, __LINE__)
 692static void
 693_binder_node_lock(struct binder_node *node, int line)
 694	__acquires(&node->lock)
 695{
 696	binder_debug(BINDER_DEBUG_SPINLOCKS,
 697		     "%s: line=%d\n", __func__, line);
 698	spin_lock(&node->lock);
 699}
 700
 701/**
 702 * binder_node_unlock() - Release spinlock for given binder_proc
 703 * @node:         struct binder_node to acquire
 704 *
 705 * Release lock acquired via binder_node_lock()
 706 */
 707#define binder_node_unlock(node) _binder_node_unlock(node, __LINE__)
 708static void
 709_binder_node_unlock(struct binder_node *node, int line)
 710	__releases(&node->lock)
 711{
 712	binder_debug(BINDER_DEBUG_SPINLOCKS,
 713		     "%s: line=%d\n", __func__, line);
 714	spin_unlock(&node->lock);
 715}
 716
 717/**
 718 * binder_node_inner_lock() - Acquire node and inner locks
 719 * @node:         struct binder_node to acquire
 720 *
 721 * Acquires node->lock. If node->proc also acquires
 722 * proc->inner_lock. Used to protect binder_node fields
 723 */
 724#define binder_node_inner_lock(node) _binder_node_inner_lock(node, __LINE__)
 725static void
 726_binder_node_inner_lock(struct binder_node *node, int line)
 727	__acquires(&node->lock) __acquires(&node->proc->inner_lock)
 728{
 729	binder_debug(BINDER_DEBUG_SPINLOCKS,
 730		     "%s: line=%d\n", __func__, line);
 731	spin_lock(&node->lock);
 732	if (node->proc)
 733		binder_inner_proc_lock(node->proc);
 734	else
 735		/* annotation for sparse */
 736		__acquire(&node->proc->inner_lock);
 737}
 738
 739/**
 740 * binder_node_unlock() - Release node and inner locks
 741 * @node:         struct binder_node to acquire
 742 *
 743 * Release lock acquired via binder_node_lock()
 744 */
 745#define binder_node_inner_unlock(node) _binder_node_inner_unlock(node, __LINE__)
 746static void
 747_binder_node_inner_unlock(struct binder_node *node, int line)
 748	__releases(&node->lock) __releases(&node->proc->inner_lock)
 749{
 750	struct binder_proc *proc = node->proc;
 751
 752	binder_debug(BINDER_DEBUG_SPINLOCKS,
 753		     "%s: line=%d\n", __func__, line);
 754	if (proc)
 755		binder_inner_proc_unlock(proc);
 756	else
 757		/* annotation for sparse */
 758		__release(&node->proc->inner_lock);
 759	spin_unlock(&node->lock);
 760}
 761
 762static bool binder_worklist_empty_ilocked(struct list_head *list)
 763{
 764	return list_empty(list);
 765}
 766
 767/**
 768 * binder_worklist_empty() - Check if no items on the work list
 769 * @proc:       binder_proc associated with list
 770 * @list:	list to check
 771 *
 772 * Return: true if there are no items on list, else false
 773 */
 774static bool binder_worklist_empty(struct binder_proc *proc,
 775				  struct list_head *list)
 776{
 777	bool ret;
 778
 779	binder_inner_proc_lock(proc);
 780	ret = binder_worklist_empty_ilocked(list);
 781	binder_inner_proc_unlock(proc);
 782	return ret;
 783}
 784
 785/**
 786 * binder_enqueue_work_ilocked() - Add an item to the work list
 787 * @work:         struct binder_work to add to list
 788 * @target_list:  list to add work to
 789 *
 790 * Adds the work to the specified list. Asserts that work
 791 * is not already on a list.
 792 *
 793 * Requires the proc->inner_lock to be held.
 794 */
 795static void
 796binder_enqueue_work_ilocked(struct binder_work *work,
 797			   struct list_head *target_list)
 798{
 799	BUG_ON(target_list == NULL);
 800	BUG_ON(work->entry.next && !list_empty(&work->entry));
 801	list_add_tail(&work->entry, target_list);
 802}
 803
 804/**
 805 * binder_enqueue_deferred_thread_work_ilocked() - Add deferred thread work
 806 * @thread:       thread to queue work to
 807 * @work:         struct binder_work to add to list
 808 *
 809 * Adds the work to the todo list of the thread. Doesn't set the process_todo
 810 * flag, which means that (if it wasn't already set) the thread will go to
 811 * sleep without handling this work when it calls read.
 812 *
 813 * Requires the proc->inner_lock to be held.
 814 */
 815static void
 816binder_enqueue_deferred_thread_work_ilocked(struct binder_thread *thread,
 817					    struct binder_work *work)
 818{
 819	WARN_ON(!list_empty(&thread->waiting_thread_node));
 820	binder_enqueue_work_ilocked(work, &thread->todo);
 821}
 822
 823/**
 824 * binder_enqueue_thread_work_ilocked() - Add an item to the thread work list
 825 * @thread:       thread to queue work to
 826 * @work:         struct binder_work to add to list
 827 *
 828 * Adds the work to the todo list of the thread, and enables processing
 829 * of the todo queue.
 830 *
 831 * Requires the proc->inner_lock to be held.
 832 */
 833static void
 834binder_enqueue_thread_work_ilocked(struct binder_thread *thread,
 835				   struct binder_work *work)
 836{
 837	WARN_ON(!list_empty(&thread->waiting_thread_node));
 838	binder_enqueue_work_ilocked(work, &thread->todo);
 839	thread->process_todo = true;
 840}
 841
 842/**
 843 * binder_enqueue_thread_work() - Add an item to the thread work list
 844 * @thread:       thread to queue work to
 845 * @work:         struct binder_work to add to list
 846 *
 847 * Adds the work to the todo list of the thread, and enables processing
 848 * of the todo queue.
 849 */
 850static void
 851binder_enqueue_thread_work(struct binder_thread *thread,
 852			   struct binder_work *work)
 853{
 854	binder_inner_proc_lock(thread->proc);
 855	binder_enqueue_thread_work_ilocked(thread, work);
 856	binder_inner_proc_unlock(thread->proc);
 857}
 858
 859static void
 860binder_dequeue_work_ilocked(struct binder_work *work)
 861{
 862	list_del_init(&work->entry);
 863}
 864
 865/**
 866 * binder_dequeue_work() - Removes an item from the work list
 867 * @proc:         binder_proc associated with list
 868 * @work:         struct binder_work to remove from list
 869 *
 870 * Removes the specified work item from whatever list it is on.
 871 * Can safely be called if work is not on any list.
 872 */
 873static void
 874binder_dequeue_work(struct binder_proc *proc, struct binder_work *work)
 875{
 876	binder_inner_proc_lock(proc);
 877	binder_dequeue_work_ilocked(work);
 878	binder_inner_proc_unlock(proc);
 879}
 880
 881static struct binder_work *binder_dequeue_work_head_ilocked(
 882					struct list_head *list)
 883{
 884	struct binder_work *w;
 885
 886	w = list_first_entry_or_null(list, struct binder_work, entry);
 887	if (w)
 888		list_del_init(&w->entry);
 889	return w;
 890}
 891
 892/**
 893 * binder_dequeue_work_head() - Dequeues the item at head of list
 894 * @proc:         binder_proc associated with list
 895 * @list:         list to dequeue head
 896 *
 897 * Removes the head of the list if there are items on the list
 898 *
 899 * Return: pointer dequeued binder_work, NULL if list was empty
 900 */
 901static struct binder_work *binder_dequeue_work_head(
 902					struct binder_proc *proc,
 903					struct list_head *list)
 904{
 905	struct binder_work *w;
 906
 907	binder_inner_proc_lock(proc);
 908	w = binder_dequeue_work_head_ilocked(list);
 909	binder_inner_proc_unlock(proc);
 910	return w;
 911}
 912
 913static void
 914binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer);
 915static void binder_free_thread(struct binder_thread *thread);
 916static void binder_free_proc(struct binder_proc *proc);
 917static void binder_inc_node_tmpref_ilocked(struct binder_node *node);
 918
 919static bool binder_has_work_ilocked(struct binder_thread *thread,
 920				    bool do_proc_work)
 921{
 922	return thread->process_todo ||
 923		thread->looper_need_return ||
 924		(do_proc_work &&
 925		 !binder_worklist_empty_ilocked(&thread->proc->todo));
 926}
 927
 928static bool binder_has_work(struct binder_thread *thread, bool do_proc_work)
 929{
 930	bool has_work;
 931
 932	binder_inner_proc_lock(thread->proc);
 933	has_work = binder_has_work_ilocked(thread, do_proc_work);
 934	binder_inner_proc_unlock(thread->proc);
 935
 936	return has_work;
 937}
 938
 939static bool binder_available_for_proc_work_ilocked(struct binder_thread *thread)
 940{
 941	return !thread->transaction_stack &&
 942		binder_worklist_empty_ilocked(&thread->todo) &&
 943		(thread->looper & (BINDER_LOOPER_STATE_ENTERED |
 944				   BINDER_LOOPER_STATE_REGISTERED));
 945}
 946
 947static void binder_wakeup_poll_threads_ilocked(struct binder_proc *proc,
 948					       bool sync)
 949{
 950	struct rb_node *n;
 951	struct binder_thread *thread;
 952
 953	for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) {
 954		thread = rb_entry(n, struct binder_thread, rb_node);
 955		if (thread->looper & BINDER_LOOPER_STATE_POLL &&
 956		    binder_available_for_proc_work_ilocked(thread)) {
 957			if (sync)
 958				wake_up_interruptible_sync(&thread->wait);
 959			else
 960				wake_up_interruptible(&thread->wait);
 961		}
 962	}
 963}
 964
 965/**
 966 * binder_select_thread_ilocked() - selects a thread for doing proc work.
 967 * @proc:	process to select a thread from
 968 *
 969 * Note that calling this function moves the thread off the waiting_threads
 970 * list, so it can only be woken up by the caller of this function, or a
 971 * signal. Therefore, callers *should* always wake up the thread this function
 972 * returns.
 973 *
 974 * Return:	If there's a thread currently waiting for process work,
 975 *		returns that thread. Otherwise returns NULL.
 976 */
 977static struct binder_thread *
 978binder_select_thread_ilocked(struct binder_proc *proc)
 979{
 980	struct binder_thread *thread;
 981
 982	assert_spin_locked(&proc->inner_lock);
 983	thread = list_first_entry_or_null(&proc->waiting_threads,
 984					  struct binder_thread,
 985					  waiting_thread_node);
 986
 987	if (thread)
 988		list_del_init(&thread->waiting_thread_node);
 989
 990	return thread;
 991}
 992
 993/**
 994 * binder_wakeup_thread_ilocked() - wakes up a thread for doing proc work.
 995 * @proc:	process to wake up a thread in
 996 * @thread:	specific thread to wake-up (may be NULL)
 997 * @sync:	whether to do a synchronous wake-up
 998 *
 999 * This function wakes up a thread in the @proc process.
1000 * The caller may provide a specific thread to wake-up in
1001 * the @thread parameter. If @thread is NULL, this function
1002 * will wake up threads that have called poll().
1003 *
1004 * Note that for this function to work as expected, callers
1005 * should first call binder_select_thread() to find a thread
1006 * to handle the work (if they don't have a thread already),
1007 * and pass the result into the @thread parameter.
1008 */
1009static void binder_wakeup_thread_ilocked(struct binder_proc *proc,
1010					 struct binder_thread *thread,
1011					 bool sync)
1012{
1013	assert_spin_locked(&proc->inner_lock);
1014
1015	if (thread) {
1016		if (sync)
1017			wake_up_interruptible_sync(&thread->wait);
1018		else
1019			wake_up_interruptible(&thread->wait);
1020		return;
1021	}
1022
1023	/* Didn't find a thread waiting for proc work; this can happen
1024	 * in two scenarios:
1025	 * 1. All threads are busy handling transactions
1026	 *    In that case, one of those threads should call back into
1027	 *    the kernel driver soon and pick up this work.
1028	 * 2. Threads are using the (e)poll interface, in which case
1029	 *    they may be blocked on the waitqueue without having been
1030	 *    added to waiting_threads. For this case, we just iterate
1031	 *    over all threads not handling transaction work, and
1032	 *    wake them all up. We wake all because we don't know whether
1033	 *    a thread that called into (e)poll is handling non-binder
1034	 *    work currently.
1035	 */
1036	binder_wakeup_poll_threads_ilocked(proc, sync);
1037}
1038
1039static void binder_wakeup_proc_ilocked(struct binder_proc *proc)
1040{
1041	struct binder_thread *thread = binder_select_thread_ilocked(proc);
1042
1043	binder_wakeup_thread_ilocked(proc, thread, /* sync = */false);
1044}
1045
1046static void binder_set_nice(long nice)
1047{
1048	long min_nice;
1049
1050	if (can_nice(current, nice)) {
1051		set_user_nice(current, nice);
1052		return;
1053	}
1054	min_nice = rlimit_to_nice(rlimit(RLIMIT_NICE));
1055	binder_debug(BINDER_DEBUG_PRIORITY_CAP,
1056		     "%d: nice value %ld not allowed use %ld instead\n",
1057		      current->pid, nice, min_nice);
1058	set_user_nice(current, min_nice);
1059	if (min_nice <= MAX_NICE)
1060		return;
1061	binder_user_error("%d RLIMIT_NICE not set\n", current->pid);
1062}
1063
1064static struct binder_node *binder_get_node_ilocked(struct binder_proc *proc,
1065						   binder_uintptr_t ptr)
1066{
1067	struct rb_node *n = proc->nodes.rb_node;
1068	struct binder_node *node;
1069
1070	assert_spin_locked(&proc->inner_lock);
1071
1072	while (n) {
1073		node = rb_entry(n, struct binder_node, rb_node);
1074
1075		if (ptr < node->ptr)
1076			n = n->rb_left;
1077		else if (ptr > node->ptr)
1078			n = n->rb_right;
1079		else {
1080			/*
1081			 * take an implicit weak reference
1082			 * to ensure node stays alive until
1083			 * call to binder_put_node()
1084			 */
1085			binder_inc_node_tmpref_ilocked(node);
1086			return node;
1087		}
1088	}
1089	return NULL;
1090}
1091
1092static struct binder_node *binder_get_node(struct binder_proc *proc,
1093					   binder_uintptr_t ptr)
1094{
1095	struct binder_node *node;
1096
1097	binder_inner_proc_lock(proc);
1098	node = binder_get_node_ilocked(proc, ptr);
1099	binder_inner_proc_unlock(proc);
1100	return node;
1101}
1102
1103static struct binder_node *binder_init_node_ilocked(
1104						struct binder_proc *proc,
1105						struct binder_node *new_node,
1106						struct flat_binder_object *fp)
1107{
1108	struct rb_node **p = &proc->nodes.rb_node;
1109	struct rb_node *parent = NULL;
1110	struct binder_node *node;
1111	binder_uintptr_t ptr = fp ? fp->binder : 0;
1112	binder_uintptr_t cookie = fp ? fp->cookie : 0;
1113	__u32 flags = fp ? fp->flags : 0;
1114
1115	assert_spin_locked(&proc->inner_lock);
1116
1117	while (*p) {
1118
1119		parent = *p;
1120		node = rb_entry(parent, struct binder_node, rb_node);
1121
1122		if (ptr < node->ptr)
1123			p = &(*p)->rb_left;
1124		else if (ptr > node->ptr)
1125			p = &(*p)->rb_right;
1126		else {
1127			/*
1128			 * A matching node is already in
1129			 * the rb tree. Abandon the init
1130			 * and return it.
1131			 */
1132			binder_inc_node_tmpref_ilocked(node);
1133			return node;
1134		}
1135	}
1136	node = new_node;
1137	binder_stats_created(BINDER_STAT_NODE);
1138	node->tmp_refs++;
1139	rb_link_node(&node->rb_node, parent, p);
1140	rb_insert_color(&node->rb_node, &proc->nodes);
1141	node->debug_id = atomic_inc_return(&binder_last_id);
1142	node->proc = proc;
1143	node->ptr = ptr;
1144	node->cookie = cookie;
1145	node->work.type = BINDER_WORK_NODE;
1146	node->min_priority = flags & FLAT_BINDER_FLAG_PRIORITY_MASK;
1147	node->accept_fds = !!(flags & FLAT_BINDER_FLAG_ACCEPTS_FDS);
1148	node->txn_security_ctx = !!(flags & FLAT_BINDER_FLAG_TXN_SECURITY_CTX);
1149	spin_lock_init(&node->lock);
1150	INIT_LIST_HEAD(&node->work.entry);
1151	INIT_LIST_HEAD(&node->async_todo);
1152	binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1153		     "%d:%d node %d u%016llx c%016llx created\n",
1154		     proc->pid, current->pid, node->debug_id,
1155		     (u64)node->ptr, (u64)node->cookie);
1156
1157	return node;
1158}
1159
1160static struct binder_node *binder_new_node(struct binder_proc *proc,
1161					   struct flat_binder_object *fp)
1162{
1163	struct binder_node *node;
1164	struct binder_node *new_node = kzalloc(sizeof(*node), GFP_KERNEL);
1165
1166	if (!new_node)
1167		return NULL;
1168	binder_inner_proc_lock(proc);
1169	node = binder_init_node_ilocked(proc, new_node, fp);
1170	binder_inner_proc_unlock(proc);
1171	if (node != new_node)
1172		/*
1173		 * The node was already added by another thread
1174		 */
1175		kfree(new_node);
1176
1177	return node;
1178}
1179
1180static void binder_free_node(struct binder_node *node)
1181{
1182	kfree(node);
1183	binder_stats_deleted(BINDER_STAT_NODE);
1184}
1185
1186static int binder_inc_node_nilocked(struct binder_node *node, int strong,
1187				    int internal,
1188				    struct list_head *target_list)
1189{
1190	struct binder_proc *proc = node->proc;
1191
1192	assert_spin_locked(&node->lock);
1193	if (proc)
1194		assert_spin_locked(&proc->inner_lock);
1195	if (strong) {
1196		if (internal) {
1197			if (target_list == NULL &&
1198			    node->internal_strong_refs == 0 &&
1199			    !(node->proc &&
1200			      node == node->proc->context->binder_context_mgr_node &&
1201			      node->has_strong_ref)) {
1202				pr_err("invalid inc strong node for %d\n",
1203					node->debug_id);
1204				return -EINVAL;
1205			}
1206			node->internal_strong_refs++;
1207		} else
1208			node->local_strong_refs++;
1209		if (!node->has_strong_ref && target_list) {
1210			struct binder_thread *thread = container_of(target_list,
1211						    struct binder_thread, todo);
1212			binder_dequeue_work_ilocked(&node->work);
1213			BUG_ON(&thread->todo != target_list);
1214			binder_enqueue_deferred_thread_work_ilocked(thread,
1215								   &node->work);
1216		}
1217	} else {
1218		if (!internal)
1219			node->local_weak_refs++;
1220		if (!node->has_weak_ref && list_empty(&node->work.entry)) {
1221			if (target_list == NULL) {
1222				pr_err("invalid inc weak node for %d\n",
1223					node->debug_id);
1224				return -EINVAL;
1225			}
1226			/*
1227			 * See comment above
1228			 */
1229			binder_enqueue_work_ilocked(&node->work, target_list);
1230		}
1231	}
1232	return 0;
1233}
1234
1235static int binder_inc_node(struct binder_node *node, int strong, int internal,
1236			   struct list_head *target_list)
1237{
1238	int ret;
1239
1240	binder_node_inner_lock(node);
1241	ret = binder_inc_node_nilocked(node, strong, internal, target_list);
1242	binder_node_inner_unlock(node);
1243
1244	return ret;
1245}
1246
1247static bool binder_dec_node_nilocked(struct binder_node *node,
1248				     int strong, int internal)
1249{
1250	struct binder_proc *proc = node->proc;
1251
1252	assert_spin_locked(&node->lock);
1253	if (proc)
1254		assert_spin_locked(&proc->inner_lock);
1255	if (strong) {
1256		if (internal)
1257			node->internal_strong_refs--;
1258		else
1259			node->local_strong_refs--;
1260		if (node->local_strong_refs || node->internal_strong_refs)
1261			return false;
1262	} else {
1263		if (!internal)
1264			node->local_weak_refs--;
1265		if (node->local_weak_refs || node->tmp_refs ||
1266				!hlist_empty(&node->refs))
1267			return false;
1268	}
1269
1270	if (proc && (node->has_strong_ref || node->has_weak_ref)) {
1271		if (list_empty(&node->work.entry)) {
1272			binder_enqueue_work_ilocked(&node->work, &proc->todo);
1273			binder_wakeup_proc_ilocked(proc);
1274		}
1275	} else {
1276		if (hlist_empty(&node->refs) && !node->local_strong_refs &&
1277		    !node->local_weak_refs && !node->tmp_refs) {
1278			if (proc) {
1279				binder_dequeue_work_ilocked(&node->work);
1280				rb_erase(&node->rb_node, &proc->nodes);
1281				binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1282					     "refless node %d deleted\n",
1283					     node->debug_id);
1284			} else {
1285				BUG_ON(!list_empty(&node->work.entry));
1286				spin_lock(&binder_dead_nodes_lock);
1287				/*
1288				 * tmp_refs could have changed so
1289				 * check it again
1290				 */
1291				if (node->tmp_refs) {
1292					spin_unlock(&binder_dead_nodes_lock);
1293					return false;
1294				}
1295				hlist_del(&node->dead_node);
1296				spin_unlock(&binder_dead_nodes_lock);
1297				binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1298					     "dead node %d deleted\n",
1299					     node->debug_id);
1300			}
1301			return true;
1302		}
1303	}
1304	return false;
1305}
1306
1307static void binder_dec_node(struct binder_node *node, int strong, int internal)
1308{
1309	bool free_node;
1310
1311	binder_node_inner_lock(node);
1312	free_node = binder_dec_node_nilocked(node, strong, internal);
1313	binder_node_inner_unlock(node);
1314	if (free_node)
1315		binder_free_node(node);
1316}
1317
1318static void binder_inc_node_tmpref_ilocked(struct binder_node *node)
1319{
1320	/*
1321	 * No call to binder_inc_node() is needed since we
1322	 * don't need to inform userspace of any changes to
1323	 * tmp_refs
1324	 */
1325	node->tmp_refs++;
1326}
1327
1328/**
1329 * binder_inc_node_tmpref() - take a temporary reference on node
1330 * @node:	node to reference
1331 *
1332 * Take reference on node to prevent the node from being freed
1333 * while referenced only by a local variable. The inner lock is
1334 * needed to serialize with the node work on the queue (which
1335 * isn't needed after the node is dead). If the node is dead
1336 * (node->proc is NULL), use binder_dead_nodes_lock to protect
1337 * node->tmp_refs against dead-node-only cases where the node
1338 * lock cannot be acquired (eg traversing the dead node list to
1339 * print nodes)
1340 */
1341static void binder_inc_node_tmpref(struct binder_node *node)
1342{
1343	binder_node_lock(node);
1344	if (node->proc)
1345		binder_inner_proc_lock(node->proc);
1346	else
1347		spin_lock(&binder_dead_nodes_lock);
1348	binder_inc_node_tmpref_ilocked(node);
1349	if (node->proc)
1350		binder_inner_proc_unlock(node->proc);
1351	else
1352		spin_unlock(&binder_dead_nodes_lock);
1353	binder_node_unlock(node);
1354}
1355
1356/**
1357 * binder_dec_node_tmpref() - remove a temporary reference on node
1358 * @node:	node to reference
1359 *
1360 * Release temporary reference on node taken via binder_inc_node_tmpref()
1361 */
1362static void binder_dec_node_tmpref(struct binder_node *node)
1363{
1364	bool free_node;
1365
1366	binder_node_inner_lock(node);
1367	if (!node->proc)
1368		spin_lock(&binder_dead_nodes_lock);
1369	else
1370		__acquire(&binder_dead_nodes_lock);
1371	node->tmp_refs--;
1372	BUG_ON(node->tmp_refs < 0);
1373	if (!node->proc)
1374		spin_unlock(&binder_dead_nodes_lock);
1375	else
1376		__release(&binder_dead_nodes_lock);
1377	/*
1378	 * Call binder_dec_node() to check if all refcounts are 0
1379	 * and cleanup is needed. Calling with strong=0 and internal=1
1380	 * causes no actual reference to be released in binder_dec_node().
1381	 * If that changes, a change is needed here too.
1382	 */
1383	free_node = binder_dec_node_nilocked(node, 0, 1);
1384	binder_node_inner_unlock(node);
1385	if (free_node)
1386		binder_free_node(node);
1387}
1388
1389static void binder_put_node(struct binder_node *node)
1390{
1391	binder_dec_node_tmpref(node);
1392}
1393
1394static struct binder_ref *binder_get_ref_olocked(struct binder_proc *proc,
1395						 u32 desc, bool need_strong_ref)
1396{
1397	struct rb_node *n = proc->refs_by_desc.rb_node;
1398	struct binder_ref *ref;
1399
1400	while (n) {
1401		ref = rb_entry(n, struct binder_ref, rb_node_desc);
1402
1403		if (desc < ref->data.desc) {
1404			n = n->rb_left;
1405		} else if (desc > ref->data.desc) {
1406			n = n->rb_right;
1407		} else if (need_strong_ref && !ref->data.strong) {
1408			binder_user_error("tried to use weak ref as strong ref\n");
1409			return NULL;
1410		} else {
1411			return ref;
1412		}
1413	}
1414	return NULL;
1415}
1416
1417/**
1418 * binder_get_ref_for_node_olocked() - get the ref associated with given node
1419 * @proc:	binder_proc that owns the ref
1420 * @node:	binder_node of target
1421 * @new_ref:	newly allocated binder_ref to be initialized or %NULL
1422 *
1423 * Look up the ref for the given node and return it if it exists
1424 *
1425 * If it doesn't exist and the caller provides a newly allocated
1426 * ref, initialize the fields of the newly allocated ref and insert
1427 * into the given proc rb_trees and node refs list.
1428 *
1429 * Return:	the ref for node. It is possible that another thread
1430 *		allocated/initialized the ref first in which case the
1431 *		returned ref would be different than the passed-in
1432 *		new_ref. new_ref must be kfree'd by the caller in
1433 *		this case.
1434 */
1435static struct binder_ref *binder_get_ref_for_node_olocked(
1436					struct binder_proc *proc,
1437					struct binder_node *node,
1438					struct binder_ref *new_ref)
1439{
1440	struct binder_context *context = proc->context;
1441	struct rb_node **p = &proc->refs_by_node.rb_node;
1442	struct rb_node *parent = NULL;
1443	struct binder_ref *ref;
1444	struct rb_node *n;
1445
1446	while (*p) {
1447		parent = *p;
1448		ref = rb_entry(parent, struct binder_ref, rb_node_node);
1449
1450		if (node < ref->node)
1451			p = &(*p)->rb_left;
1452		else if (node > ref->node)
1453			p = &(*p)->rb_right;
1454		else
1455			return ref;
1456	}
1457	if (!new_ref)
1458		return NULL;
1459
1460	binder_stats_created(BINDER_STAT_REF);
1461	new_ref->data.debug_id = atomic_inc_return(&binder_last_id);
1462	new_ref->proc = proc;
1463	new_ref->node = node;
1464	rb_link_node(&new_ref->rb_node_node, parent, p);
1465	rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node);
1466
1467	new_ref->data.desc = (node == context->binder_context_mgr_node) ? 0 : 1;
1468	for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) {
1469		ref = rb_entry(n, struct binder_ref, rb_node_desc);
1470		if (ref->data.desc > new_ref->data.desc)
1471			break;
1472		new_ref->data.desc = ref->data.desc + 1;
1473	}
1474
1475	p = &proc->refs_by_desc.rb_node;
1476	while (*p) {
1477		parent = *p;
1478		ref = rb_entry(parent, struct binder_ref, rb_node_desc);
1479
1480		if (new_ref->data.desc < ref->data.desc)
1481			p = &(*p)->rb_left;
1482		else if (new_ref->data.desc > ref->data.desc)
1483			p = &(*p)->rb_right;
1484		else
1485			BUG();
1486	}
1487	rb_link_node(&new_ref->rb_node_desc, parent, p);
1488	rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc);
1489
1490	binder_node_lock(node);
1491	hlist_add_head(&new_ref->node_entry, &node->refs);
1492
1493	binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1494		     "%d new ref %d desc %d for node %d\n",
1495		      proc->pid, new_ref->data.debug_id, new_ref->data.desc,
1496		      node->debug_id);
1497	binder_node_unlock(node);
1498	return new_ref;
1499}
1500
1501static void binder_cleanup_ref_olocked(struct binder_ref *ref)
1502{
1503	bool delete_node = false;
1504
1505	binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1506		     "%d delete ref %d desc %d for node %d\n",
1507		      ref->proc->pid, ref->data.debug_id, ref->data.desc,
1508		      ref->node->debug_id);
1509
1510	rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc);
1511	rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node);
1512
1513	binder_node_inner_lock(ref->node);
1514	if (ref->data.strong)
1515		binder_dec_node_nilocked(ref->node, 1, 1);
1516
1517	hlist_del(&ref->node_entry);
1518	delete_node = binder_dec_node_nilocked(ref->node, 0, 1);
1519	binder_node_inner_unlock(ref->node);
1520	/*
1521	 * Clear ref->node unless we want the caller to free the node
1522	 */
1523	if (!delete_node) {
1524		/*
1525		 * The caller uses ref->node to determine
1526		 * whether the node needs to be freed. Clear
1527		 * it since the node is still alive.
1528		 */
1529		ref->node = NULL;
1530	}
1531
1532	if (ref->death) {
1533		binder_debug(BINDER_DEBUG_DEAD_BINDER,
1534			     "%d delete ref %d desc %d has death notification\n",
1535			      ref->proc->pid, ref->data.debug_id,
1536			      ref->data.desc);
1537		binder_dequeue_work(ref->proc, &ref->death->work);
1538		binder_stats_deleted(BINDER_STAT_DEATH);
1539	}
1540	binder_stats_deleted(BINDER_STAT_REF);
1541}
1542
1543/**
1544 * binder_inc_ref_olocked() - increment the ref for given handle
1545 * @ref:         ref to be incremented
1546 * @strong:      if true, strong increment, else weak
1547 * @target_list: list to queue node work on
1548 *
1549 * Increment the ref. @ref->proc->outer_lock must be held on entry
1550 *
1551 * Return: 0, if successful, else errno
1552 */
1553static int binder_inc_ref_olocked(struct binder_ref *ref, int strong,
1554				  struct list_head *target_list)
1555{
1556	int ret;
1557
1558	if (strong) {
1559		if (ref->data.strong == 0) {
1560			ret = binder_inc_node(ref->node, 1, 1, target_list);
1561			if (ret)
1562				return ret;
1563		}
1564		ref->data.strong++;
1565	} else {
1566		if (ref->data.weak == 0) {
1567			ret = binder_inc_node(ref->node, 0, 1, target_list);
1568			if (ret)
1569				return ret;
1570		}
1571		ref->data.weak++;
1572	}
1573	return 0;
1574}
1575
1576/**
1577 * binder_dec_ref() - dec the ref for given handle
1578 * @ref:	ref to be decremented
1579 * @strong:	if true, strong decrement, else weak
1580 *
1581 * Decrement the ref.
1582 *
1583 * Return: true if ref is cleaned up and ready to be freed
1584 */
1585static bool binder_dec_ref_olocked(struct binder_ref *ref, int strong)
1586{
1587	if (strong) {
1588		if (ref->data.strong == 0) {
1589			binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n",
1590					  ref->proc->pid, ref->data.debug_id,
1591					  ref->data.desc, ref->data.strong,
1592					  ref->data.weak);
1593			return false;
1594		}
1595		ref->data.strong--;
1596		if (ref->data.strong == 0)
1597			binder_dec_node(ref->node, strong, 1);
1598	} else {
1599		if (ref->data.weak == 0) {
1600			binder_user_error("%d invalid dec weak, ref %d desc %d s %d w %d\n",
1601					  ref->proc->pid, ref->data.debug_id,
1602					  ref->data.desc, ref->data.strong,
1603					  ref->data.weak);
1604			return false;
1605		}
1606		ref->data.weak--;
1607	}
1608	if (ref->data.strong == 0 && ref->data.weak == 0) {
1609		binder_cleanup_ref_olocked(ref);
1610		return true;
1611	}
1612	return false;
1613}
1614
1615/**
1616 * binder_get_node_from_ref() - get the node from the given proc/desc
1617 * @proc:	proc containing the ref
1618 * @desc:	the handle associated with the ref
1619 * @need_strong_ref: if true, only return node if ref is strong
1620 * @rdata:	the id/refcount data for the ref
1621 *
1622 * Given a proc and ref handle, return the associated binder_node
1623 *
1624 * Return: a binder_node or NULL if not found or not strong when strong required
1625 */
1626static struct binder_node *binder_get_node_from_ref(
1627		struct binder_proc *proc,
1628		u32 desc, bool need_strong_ref,
1629		struct binder_ref_data *rdata)
1630{
1631	struct binder_node *node;
1632	struct binder_ref *ref;
1633
1634	binder_proc_lock(proc);
1635	ref = binder_get_ref_olocked(proc, desc, need_strong_ref);
1636	if (!ref)
1637		goto err_no_ref;
1638	node = ref->node;
1639	/*
1640	 * Take an implicit reference on the node to ensure
1641	 * it stays alive until the call to binder_put_node()
1642	 */
1643	binder_inc_node_tmpref(node);
1644	if (rdata)
1645		*rdata = ref->data;
1646	binder_proc_unlock(proc);
1647
1648	return node;
1649
1650err_no_ref:
1651	binder_proc_unlock(proc);
1652	return NULL;
1653}
1654
1655/**
1656 * binder_free_ref() - free the binder_ref
1657 * @ref:	ref to free
1658 *
1659 * Free the binder_ref. Free the binder_node indicated by ref->node
1660 * (if non-NULL) and the binder_ref_death indicated by ref->death.
1661 */
1662static void binder_free_ref(struct binder_ref *ref)
1663{
1664	if (ref->node)
1665		binder_free_node(ref->node);
1666	kfree(ref->death);
1667	kfree(ref);
1668}
1669
1670/**
1671 * binder_update_ref_for_handle() - inc/dec the ref for given handle
1672 * @proc:	proc containing the ref
1673 * @desc:	the handle associated with the ref
1674 * @increment:	true=inc reference, false=dec reference
1675 * @strong:	true=strong reference, false=weak reference
1676 * @rdata:	the id/refcount data for the ref
1677 *
1678 * Given a proc and ref handle, increment or decrement the ref
1679 * according to "increment" arg.
1680 *
1681 * Return: 0 if successful, else errno
1682 */
1683static int binder_update_ref_for_handle(struct binder_proc *proc,
1684		uint32_t desc, bool increment, bool strong,
1685		struct binder_ref_data *rdata)
1686{
1687	int ret = 0;
1688	struct binder_ref *ref;
1689	bool delete_ref = false;
1690
1691	binder_proc_lock(proc);
1692	ref = binder_get_ref_olocked(proc, desc, strong);
1693	if (!ref) {
1694		ret = -EINVAL;
1695		goto err_no_ref;
1696	}
1697	if (increment)
1698		ret = binder_inc_ref_olocked(ref, strong, NULL);
1699	else
1700		delete_ref = binder_dec_ref_olocked(ref, strong);
1701
1702	if (rdata)
1703		*rdata = ref->data;
1704	binder_proc_unlock(proc);
1705
1706	if (delete_ref)
1707		binder_free_ref(ref);
1708	return ret;
1709
1710err_no_ref:
1711	binder_proc_unlock(proc);
1712	return ret;
1713}
1714
1715/**
1716 * binder_dec_ref_for_handle() - dec the ref for given handle
1717 * @proc:	proc containing the ref
1718 * @desc:	the handle associated with the ref
1719 * @strong:	true=strong reference, false=weak reference
1720 * @rdata:	the id/refcount data for the ref
1721 *
1722 * Just calls binder_update_ref_for_handle() to decrement the ref.
1723 *
1724 * Return: 0 if successful, else errno
1725 */
1726static int binder_dec_ref_for_handle(struct binder_proc *proc,
1727		uint32_t desc, bool strong, struct binder_ref_data *rdata)
1728{
1729	return binder_update_ref_for_handle(proc, desc, false, strong, rdata);
1730}
1731
1732
1733/**
1734 * binder_inc_ref_for_node() - increment the ref for given proc/node
1735 * @proc:	 proc containing the ref
1736 * @node:	 target node
1737 * @strong:	 true=strong reference, false=weak reference
1738 * @target_list: worklist to use if node is incremented
1739 * @rdata:	 the id/refcount data for the ref
1740 *
1741 * Given a proc and node, increment the ref. Create the ref if it
1742 * doesn't already exist
1743 *
1744 * Return: 0 if successful, else errno
1745 */
1746static int binder_inc_ref_for_node(struct binder_proc *proc,
1747			struct binder_node *node,
1748			bool strong,
1749			struct list_head *target_list,
1750			struct binder_ref_data *rdata)
1751{
1752	struct binder_ref *ref;
1753	struct binder_ref *new_ref = NULL;
1754	int ret = 0;
1755
1756	binder_proc_lock(proc);
1757	ref = binder_get_ref_for_node_olocked(proc, node, NULL);
1758	if (!ref) {
1759		binder_proc_unlock(proc);
1760		new_ref = kzalloc(sizeof(*ref), GFP_KERNEL);
1761		if (!new_ref)
1762			return -ENOMEM;
1763		binder_proc_lock(proc);
1764		ref = binder_get_ref_for_node_olocked(proc, node, new_ref);
1765	}
1766	ret = binder_inc_ref_olocked(ref, strong, target_list);
1767	*rdata = ref->data;
 
 
 
 
 
 
 
 
 
 
 
 
1768	binder_proc_unlock(proc);
1769	if (new_ref && ref != new_ref)
1770		/*
1771		 * Another thread created the ref first so
1772		 * free the one we allocated
1773		 */
1774		kfree(new_ref);
1775	return ret;
1776}
1777
1778static void binder_pop_transaction_ilocked(struct binder_thread *target_thread,
1779					   struct binder_transaction *t)
1780{
1781	BUG_ON(!target_thread);
1782	assert_spin_locked(&target_thread->proc->inner_lock);
1783	BUG_ON(target_thread->transaction_stack != t);
1784	BUG_ON(target_thread->transaction_stack->from != target_thread);
1785	target_thread->transaction_stack =
1786		target_thread->transaction_stack->from_parent;
1787	t->from = NULL;
1788}
1789
1790/**
1791 * binder_thread_dec_tmpref() - decrement thread->tmp_ref
1792 * @thread:	thread to decrement
1793 *
1794 * A thread needs to be kept alive while being used to create or
1795 * handle a transaction. binder_get_txn_from() is used to safely
1796 * extract t->from from a binder_transaction and keep the thread
1797 * indicated by t->from from being freed. When done with that
1798 * binder_thread, this function is called to decrement the
1799 * tmp_ref and free if appropriate (thread has been released
1800 * and no transaction being processed by the driver)
1801 */
1802static void binder_thread_dec_tmpref(struct binder_thread *thread)
1803{
1804	/*
1805	 * atomic is used to protect the counter value while
1806	 * it cannot reach zero or thread->is_dead is false
1807	 */
1808	binder_inner_proc_lock(thread->proc);
1809	atomic_dec(&thread->tmp_ref);
1810	if (thread->is_dead && !atomic_read(&thread->tmp_ref)) {
1811		binder_inner_proc_unlock(thread->proc);
1812		binder_free_thread(thread);
1813		return;
1814	}
1815	binder_inner_proc_unlock(thread->proc);
1816}
1817
1818/**
1819 * binder_proc_dec_tmpref() - decrement proc->tmp_ref
1820 * @proc:	proc to decrement
1821 *
1822 * A binder_proc needs to be kept alive while being used to create or
1823 * handle a transaction. proc->tmp_ref is incremented when
1824 * creating a new transaction or the binder_proc is currently in-use
1825 * by threads that are being released. When done with the binder_proc,
1826 * this function is called to decrement the counter and free the
1827 * proc if appropriate (proc has been released, all threads have
1828 * been released and not currenly in-use to process a transaction).
1829 */
1830static void binder_proc_dec_tmpref(struct binder_proc *proc)
1831{
1832	binder_inner_proc_lock(proc);
1833	proc->tmp_ref--;
1834	if (proc->is_dead && RB_EMPTY_ROOT(&proc->threads) &&
1835			!proc->tmp_ref) {
1836		binder_inner_proc_unlock(proc);
1837		binder_free_proc(proc);
1838		return;
1839	}
1840	binder_inner_proc_unlock(proc);
1841}
1842
1843/**
1844 * binder_get_txn_from() - safely extract the "from" thread in transaction
1845 * @t:	binder transaction for t->from
1846 *
1847 * Atomically return the "from" thread and increment the tmp_ref
1848 * count for the thread to ensure it stays alive until
1849 * binder_thread_dec_tmpref() is called.
1850 *
1851 * Return: the value of t->from
1852 */
1853static struct binder_thread *binder_get_txn_from(
1854		struct binder_transaction *t)
1855{
1856	struct binder_thread *from;
1857
1858	spin_lock(&t->lock);
1859	from = t->from;
1860	if (from)
1861		atomic_inc(&from->tmp_ref);
1862	spin_unlock(&t->lock);
1863	return from;
1864}
1865
1866/**
1867 * binder_get_txn_from_and_acq_inner() - get t->from and acquire inner lock
1868 * @t:	binder transaction for t->from
1869 *
1870 * Same as binder_get_txn_from() except it also acquires the proc->inner_lock
1871 * to guarantee that the thread cannot be released while operating on it.
1872 * The caller must call binder_inner_proc_unlock() to release the inner lock
1873 * as well as call binder_dec_thread_txn() to release the reference.
1874 *
1875 * Return: the value of t->from
1876 */
1877static struct binder_thread *binder_get_txn_from_and_acq_inner(
1878		struct binder_transaction *t)
1879	__acquires(&t->from->proc->inner_lock)
1880{
1881	struct binder_thread *from;
1882
1883	from = binder_get_txn_from(t);
1884	if (!from) {
1885		__acquire(&from->proc->inner_lock);
1886		return NULL;
1887	}
1888	binder_inner_proc_lock(from->proc);
1889	if (t->from) {
1890		BUG_ON(from != t->from);
1891		return from;
1892	}
1893	binder_inner_proc_unlock(from->proc);
1894	__acquire(&from->proc->inner_lock);
1895	binder_thread_dec_tmpref(from);
1896	return NULL;
1897}
1898
1899/**
1900 * binder_free_txn_fixups() - free unprocessed fd fixups
1901 * @t:	binder transaction for t->from
1902 *
1903 * If the transaction is being torn down prior to being
1904 * processed by the target process, free all of the
1905 * fd fixups and fput the file structs. It is safe to
1906 * call this function after the fixups have been
1907 * processed -- in that case, the list will be empty.
1908 */
1909static void binder_free_txn_fixups(struct binder_transaction *t)
1910{
1911	struct binder_txn_fd_fixup *fixup, *tmp;
1912
1913	list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) {
1914		fput(fixup->file);
 
 
1915		list_del(&fixup->fixup_entry);
1916		kfree(fixup);
1917	}
1918}
1919
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1920static void binder_free_transaction(struct binder_transaction *t)
1921{
1922	struct binder_proc *target_proc = t->to_proc;
1923
1924	if (target_proc) {
1925		binder_inner_proc_lock(target_proc);
 
 
 
 
 
 
1926		if (t->buffer)
1927			t->buffer->transaction = NULL;
1928		binder_inner_proc_unlock(target_proc);
1929	}
 
 
1930	/*
1931	 * If the transaction has no target_proc, then
1932	 * t->buffer->transaction has already been cleared.
1933	 */
1934	binder_free_txn_fixups(t);
1935	kfree(t);
1936	binder_stats_deleted(BINDER_STAT_TRANSACTION);
1937}
1938
1939static void binder_send_failed_reply(struct binder_transaction *t,
1940				     uint32_t error_code)
1941{
1942	struct binder_thread *target_thread;
1943	struct binder_transaction *next;
1944
1945	BUG_ON(t->flags & TF_ONE_WAY);
1946	while (1) {
1947		target_thread = binder_get_txn_from_and_acq_inner(t);
1948		if (target_thread) {
1949			binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
1950				     "send failed reply for transaction %d to %d:%d\n",
1951				      t->debug_id,
1952				      target_thread->proc->pid,
1953				      target_thread->pid);
1954
1955			binder_pop_transaction_ilocked(target_thread, t);
1956			if (target_thread->reply_error.cmd == BR_OK) {
1957				target_thread->reply_error.cmd = error_code;
1958				binder_enqueue_thread_work_ilocked(
1959					target_thread,
1960					&target_thread->reply_error.work);
1961				wake_up_interruptible(&target_thread->wait);
1962			} else {
1963				/*
1964				 * Cannot get here for normal operation, but
1965				 * we can if multiple synchronous transactions
1966				 * are sent without blocking for responses.
1967				 * Just ignore the 2nd error in this case.
1968				 */
1969				pr_warn("Unexpected reply error: %u\n",
1970					target_thread->reply_error.cmd);
1971			}
1972			binder_inner_proc_unlock(target_thread->proc);
1973			binder_thread_dec_tmpref(target_thread);
1974			binder_free_transaction(t);
1975			return;
1976		} else {
1977			__release(&target_thread->proc->inner_lock);
1978		}
 
1979		next = t->from_parent;
1980
1981		binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
1982			     "send failed reply for transaction %d, target dead\n",
1983			     t->debug_id);
1984
1985		binder_free_transaction(t);
1986		if (next == NULL) {
1987			binder_debug(BINDER_DEBUG_DEAD_BINDER,
1988				     "reply failed, no target thread at root\n");
1989			return;
1990		}
1991		t = next;
1992		binder_debug(BINDER_DEBUG_DEAD_BINDER,
1993			     "reply failed, no target thread -- retry %d\n",
1994			      t->debug_id);
1995	}
1996}
1997
1998/**
1999 * binder_cleanup_transaction() - cleans up undelivered transaction
2000 * @t:		transaction that needs to be cleaned up
2001 * @reason:	reason the transaction wasn't delivered
2002 * @error_code:	error to return to caller (if synchronous call)
2003 */
2004static void binder_cleanup_transaction(struct binder_transaction *t,
2005				       const char *reason,
2006				       uint32_t error_code)
2007{
2008	if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) {
2009		binder_send_failed_reply(t, error_code);
2010	} else {
2011		binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
2012			"undelivered transaction %d, %s\n",
2013			t->debug_id, reason);
2014		binder_free_transaction(t);
2015	}
2016}
2017
2018/**
2019 * binder_get_object() - gets object and checks for valid metadata
2020 * @proc:	binder_proc owning the buffer
 
2021 * @buffer:	binder_buffer that we're parsing.
2022 * @offset:	offset in the @buffer at which to validate an object.
2023 * @object:	struct binder_object to read into
2024 *
2025 * Return:	If there's a valid metadata object at @offset in @buffer, the
 
 
 
 
2026 *		size of that object. Otherwise, it returns zero. The object
2027 *		is read into the struct binder_object pointed to by @object.
2028 */
2029static size_t binder_get_object(struct binder_proc *proc,
 
2030				struct binder_buffer *buffer,
2031				unsigned long offset,
2032				struct binder_object *object)
2033{
2034	size_t read_size;
2035	struct binder_object_header *hdr;
2036	size_t object_size = 0;
2037
2038	read_size = min_t(size_t, sizeof(*object), buffer->data_size - offset);
2039	if (offset > buffer->data_size || read_size < sizeof(*hdr) ||
2040	    binder_alloc_copy_from_buffer(&proc->alloc, object, buffer,
2041					  offset, read_size))
2042		return 0;
 
 
 
 
 
 
 
 
2043
2044	/* Ok, now see if we read a complete object. */
2045	hdr = &object->hdr;
2046	switch (hdr->type) {
2047	case BINDER_TYPE_BINDER:
2048	case BINDER_TYPE_WEAK_BINDER:
2049	case BINDER_TYPE_HANDLE:
2050	case BINDER_TYPE_WEAK_HANDLE:
2051		object_size = sizeof(struct flat_binder_object);
2052		break;
2053	case BINDER_TYPE_FD:
2054		object_size = sizeof(struct binder_fd_object);
2055		break;
2056	case BINDER_TYPE_PTR:
2057		object_size = sizeof(struct binder_buffer_object);
2058		break;
2059	case BINDER_TYPE_FDA:
2060		object_size = sizeof(struct binder_fd_array_object);
2061		break;
2062	default:
2063		return 0;
2064	}
2065	if (offset <= buffer->data_size - object_size &&
2066	    buffer->data_size >= object_size)
2067		return object_size;
2068	else
2069		return 0;
2070}
2071
2072/**
2073 * binder_validate_ptr() - validates binder_buffer_object in a binder_buffer.
2074 * @proc:	binder_proc owning the buffer
2075 * @b:		binder_buffer containing the object
2076 * @object:	struct binder_object to read into
2077 * @index:	index in offset array at which the binder_buffer_object is
2078 *		located
2079 * @start_offset: points to the start of the offset array
2080 * @object_offsetp: offset of @object read from @b
2081 * @num_valid:	the number of valid offsets in the offset array
2082 *
2083 * Return:	If @index is within the valid range of the offset array
2084 *		described by @start and @num_valid, and if there's a valid
2085 *		binder_buffer_object at the offset found in index @index
2086 *		of the offset array, that object is returned. Otherwise,
2087 *		%NULL is returned.
2088 *		Note that the offset found in index @index itself is not
2089 *		verified; this function assumes that @num_valid elements
2090 *		from @start were previously verified to have valid offsets.
2091 *		If @object_offsetp is non-NULL, then the offset within
2092 *		@b is written to it.
2093 */
2094static struct binder_buffer_object *binder_validate_ptr(
2095						struct binder_proc *proc,
2096						struct binder_buffer *b,
2097						struct binder_object *object,
2098						binder_size_t index,
2099						binder_size_t start_offset,
2100						binder_size_t *object_offsetp,
2101						binder_size_t num_valid)
2102{
2103	size_t object_size;
2104	binder_size_t object_offset;
2105	unsigned long buffer_offset;
2106
2107	if (index >= num_valid)
2108		return NULL;
2109
2110	buffer_offset = start_offset + sizeof(binder_size_t) * index;
2111	if (binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,
2112					  b, buffer_offset,
2113					  sizeof(object_offset)))
2114		return NULL;
2115	object_size = binder_get_object(proc, b, object_offset, object);
2116	if (!object_size || object->hdr.type != BINDER_TYPE_PTR)
2117		return NULL;
2118	if (object_offsetp)
2119		*object_offsetp = object_offset;
2120
2121	return &object->bbo;
2122}
2123
2124/**
2125 * binder_validate_fixup() - validates pointer/fd fixups happen in order.
2126 * @proc:		binder_proc owning the buffer
2127 * @b:			transaction buffer
2128 * @objects_start_offset: offset to start of objects buffer
2129 * @buffer_obj_offset:	offset to binder_buffer_object in which to fix up
2130 * @fixup_offset:	start offset in @buffer to fix up
2131 * @last_obj_offset:	offset to last binder_buffer_object that we fixed
2132 * @last_min_offset:	minimum fixup offset in object at @last_obj_offset
2133 *
2134 * Return:		%true if a fixup in buffer @buffer at offset @offset is
2135 *			allowed.
2136 *
2137 * For safety reasons, we only allow fixups inside a buffer to happen
2138 * at increasing offsets; additionally, we only allow fixup on the last
2139 * buffer object that was verified, or one of its parents.
2140 *
2141 * Example of what is allowed:
2142 *
2143 * A
2144 *   B (parent = A, offset = 0)
2145 *   C (parent = A, offset = 16)
2146 *     D (parent = C, offset = 0)
2147 *   E (parent = A, offset = 32) // min_offset is 16 (C.parent_offset)
2148 *
2149 * Examples of what is not allowed:
2150 *
2151 * Decreasing offsets within the same parent:
2152 * A
2153 *   C (parent = A, offset = 16)
2154 *   B (parent = A, offset = 0) // decreasing offset within A
2155 *
2156 * Referring to a parent that wasn't the last object or any of its parents:
2157 * A
2158 *   B (parent = A, offset = 0)
2159 *   C (parent = A, offset = 0)
2160 *   C (parent = A, offset = 16)
2161 *     D (parent = B, offset = 0) // B is not A or any of A's parents
2162 */
2163static bool binder_validate_fixup(struct binder_proc *proc,
2164				  struct binder_buffer *b,
2165				  binder_size_t objects_start_offset,
2166				  binder_size_t buffer_obj_offset,
2167				  binder_size_t fixup_offset,
2168				  binder_size_t last_obj_offset,
2169				  binder_size_t last_min_offset)
2170{
2171	if (!last_obj_offset) {
2172		/* Nothing to fix up in */
2173		return false;
2174	}
2175
2176	while (last_obj_offset != buffer_obj_offset) {
2177		unsigned long buffer_offset;
2178		struct binder_object last_object;
2179		struct binder_buffer_object *last_bbo;
2180		size_t object_size = binder_get_object(proc, b, last_obj_offset,
 
2181						       &last_object);
2182		if (object_size != sizeof(*last_bbo))
2183			return false;
2184
2185		last_bbo = &last_object.bbo;
2186		/*
2187		 * Safe to retrieve the parent of last_obj, since it
2188		 * was already previously verified by the driver.
2189		 */
2190		if ((last_bbo->flags & BINDER_BUFFER_FLAG_HAS_PARENT) == 0)
2191			return false;
2192		last_min_offset = last_bbo->parent_offset + sizeof(uintptr_t);
2193		buffer_offset = objects_start_offset +
2194			sizeof(binder_size_t) * last_bbo->parent;
2195		if (binder_alloc_copy_from_buffer(&proc->alloc,
2196						  &last_obj_offset,
2197						  b, buffer_offset,
2198						  sizeof(last_obj_offset)))
2199			return false;
2200	}
2201	return (fixup_offset >= last_min_offset);
2202}
2203
2204/**
2205 * struct binder_task_work_cb - for deferred close
2206 *
2207 * @twork:                callback_head for task work
2208 * @fd:                   fd to close
2209 *
2210 * Structure to pass task work to be handled after
2211 * returning from binder_ioctl() via task_work_add().
2212 */
2213struct binder_task_work_cb {
2214	struct callback_head twork;
2215	struct file *file;
2216};
2217
2218/**
2219 * binder_do_fd_close() - close list of file descriptors
2220 * @twork:	callback head for task work
2221 *
2222 * It is not safe to call ksys_close() during the binder_ioctl()
2223 * function if there is a chance that binder's own file descriptor
2224 * might be closed. This is to meet the requirements for using
2225 * fdget() (see comments for __fget_light()). Therefore use
2226 * task_work_add() to schedule the close operation once we have
2227 * returned from binder_ioctl(). This function is a callback
2228 * for that mechanism and does the actual ksys_close() on the
2229 * given file descriptor.
2230 */
2231static void binder_do_fd_close(struct callback_head *twork)
2232{
2233	struct binder_task_work_cb *twcb = container_of(twork,
2234			struct binder_task_work_cb, twork);
2235
2236	fput(twcb->file);
2237	kfree(twcb);
2238}
2239
2240/**
2241 * binder_deferred_fd_close() - schedule a close for the given file-descriptor
2242 * @fd:		file-descriptor to close
2243 *
2244 * See comments in binder_do_fd_close(). This function is used to schedule
2245 * a file-descriptor to be closed after returning from binder_ioctl().
2246 */
2247static void binder_deferred_fd_close(int fd)
2248{
2249	struct binder_task_work_cb *twcb;
2250
2251	twcb = kzalloc(sizeof(*twcb), GFP_KERNEL);
2252	if (!twcb)
2253		return;
2254	init_task_work(&twcb->twork, binder_do_fd_close);
2255	__close_fd_get_file(fd, &twcb->file);
2256	if (twcb->file)
2257		task_work_add(current, &twcb->twork, true);
2258	else
 
 
 
2259		kfree(twcb);
 
2260}
2261
2262static void binder_transaction_buffer_release(struct binder_proc *proc,
 
2263					      struct binder_buffer *buffer,
2264					      binder_size_t failed_at,
2265					      bool is_failure)
2266{
2267	int debug_id = buffer->debug_id;
2268	binder_size_t off_start_offset, buffer_offset, off_end_offset;
2269
2270	binder_debug(BINDER_DEBUG_TRANSACTION,
2271		     "%d buffer release %d, size %zd-%zd, failed at %llx\n",
2272		     proc->pid, buffer->debug_id,
2273		     buffer->data_size, buffer->offsets_size,
2274		     (unsigned long long)failed_at);
2275
2276	if (buffer->target_node)
2277		binder_dec_node(buffer->target_node, 1, 0);
2278
2279	off_start_offset = ALIGN(buffer->data_size, sizeof(void *));
2280	off_end_offset = is_failure ? failed_at :
2281				off_start_offset + buffer->offsets_size;
2282	for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
2283	     buffer_offset += sizeof(binder_size_t)) {
2284		struct binder_object_header *hdr;
2285		size_t object_size = 0;
2286		struct binder_object object;
2287		binder_size_t object_offset;
2288
2289		if (!binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,
2290						   buffer, buffer_offset,
2291						   sizeof(object_offset)))
2292			object_size = binder_get_object(proc, buffer,
2293							object_offset, &object);
2294		if (object_size == 0) {
2295			pr_err("transaction release %d bad object at offset %lld, size %zd\n",
2296			       debug_id, (u64)object_offset, buffer->data_size);
2297			continue;
2298		}
2299		hdr = &object.hdr;
2300		switch (hdr->type) {
2301		case BINDER_TYPE_BINDER:
2302		case BINDER_TYPE_WEAK_BINDER: {
2303			struct flat_binder_object *fp;
2304			struct binder_node *node;
2305
2306			fp = to_flat_binder_object(hdr);
2307			node = binder_get_node(proc, fp->binder);
2308			if (node == NULL) {
2309				pr_err("transaction release %d bad node %016llx\n",
2310				       debug_id, (u64)fp->binder);
2311				break;
2312			}
2313			binder_debug(BINDER_DEBUG_TRANSACTION,
2314				     "        node %d u%016llx\n",
2315				     node->debug_id, (u64)node->ptr);
2316			binder_dec_node(node, hdr->type == BINDER_TYPE_BINDER,
2317					0);
2318			binder_put_node(node);
2319		} break;
2320		case BINDER_TYPE_HANDLE:
2321		case BINDER_TYPE_WEAK_HANDLE: {
2322			struct flat_binder_object *fp;
2323			struct binder_ref_data rdata;
2324			int ret;
2325
2326			fp = to_flat_binder_object(hdr);
2327			ret = binder_dec_ref_for_handle(proc, fp->handle,
2328				hdr->type == BINDER_TYPE_HANDLE, &rdata);
2329
2330			if (ret) {
2331				pr_err("transaction release %d bad handle %d, ret = %d\n",
2332				 debug_id, fp->handle, ret);
2333				break;
2334			}
2335			binder_debug(BINDER_DEBUG_TRANSACTION,
2336				     "        ref %d desc %d\n",
2337				     rdata.debug_id, rdata.desc);
2338		} break;
2339
2340		case BINDER_TYPE_FD: {
2341			/*
2342			 * No need to close the file here since user-space
2343			 * closes it for for successfully delivered
2344			 * transactions. For transactions that weren't
2345			 * delivered, the new fd was never allocated so
2346			 * there is no need to close and the fput on the
2347			 * file is done when the transaction is torn
2348			 * down.
2349			 */
2350			WARN_ON(failed_at &&
2351				proc->tsk == current->group_leader);
2352		} break;
2353		case BINDER_TYPE_PTR:
2354			/*
2355			 * Nothing to do here, this will get cleaned up when the
2356			 * transaction buffer gets freed
2357			 */
2358			break;
2359		case BINDER_TYPE_FDA: {
2360			struct binder_fd_array_object *fda;
2361			struct binder_buffer_object *parent;
2362			struct binder_object ptr_object;
2363			binder_size_t fda_offset;
2364			size_t fd_index;
2365			binder_size_t fd_buf_size;
2366			binder_size_t num_valid;
2367
2368			if (proc->tsk != current->group_leader) {
2369				/*
2370				 * Nothing to do if running in sender context
2371				 * The fd fixups have not been applied so no
2372				 * fds need to be closed.
2373				 */
2374				continue;
2375			}
2376
2377			num_valid = (buffer_offset - off_start_offset) /
2378						sizeof(binder_size_t);
2379			fda = to_binder_fd_array_object(hdr);
2380			parent = binder_validate_ptr(proc, buffer, &ptr_object,
2381						     fda->parent,
2382						     off_start_offset,
2383						     NULL,
2384						     num_valid);
2385			if (!parent) {
2386				pr_err("transaction release %d bad parent offset\n",
2387				       debug_id);
2388				continue;
2389			}
2390			fd_buf_size = sizeof(u32) * fda->num_fds;
2391			if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {
2392				pr_err("transaction release %d invalid number of fds (%lld)\n",
2393				       debug_id, (u64)fda->num_fds);
2394				continue;
2395			}
2396			if (fd_buf_size > parent->length ||
2397			    fda->parent_offset > parent->length - fd_buf_size) {
2398				/* No space for all file descriptors here. */
2399				pr_err("transaction release %d not enough space for %lld fds in buffer\n",
2400				       debug_id, (u64)fda->num_fds);
2401				continue;
2402			}
2403			/*
2404			 * the source data for binder_buffer_object is visible
2405			 * to user-space and the @buffer element is the user
2406			 * pointer to the buffer_object containing the fd_array.
2407			 * Convert the address to an offset relative to
2408			 * the base of the transaction buffer.
2409			 */
2410			fda_offset =
2411			    (parent->buffer - (uintptr_t)buffer->user_data) +
2412			    fda->parent_offset;
2413			for (fd_index = 0; fd_index < fda->num_fds;
2414			     fd_index++) {
2415				u32 fd;
2416				int err;
2417				binder_size_t offset = fda_offset +
2418					fd_index * sizeof(fd);
2419
2420				err = binder_alloc_copy_from_buffer(
2421						&proc->alloc, &fd, buffer,
2422						offset, sizeof(fd));
2423				WARN_ON(err);
2424				if (!err)
2425					binder_deferred_fd_close(fd);
 
 
 
 
 
 
 
 
2426			}
2427		} break;
2428		default:
2429			pr_err("transaction release %d bad object type %x\n",
2430				debug_id, hdr->type);
2431			break;
2432		}
2433	}
2434}
2435
2436static int binder_translate_binder(struct flat_binder_object *fp,
2437				   struct binder_transaction *t,
2438				   struct binder_thread *thread)
2439{
2440	struct binder_node *node;
2441	struct binder_proc *proc = thread->proc;
2442	struct binder_proc *target_proc = t->to_proc;
2443	struct binder_ref_data rdata;
2444	int ret = 0;
2445
2446	node = binder_get_node(proc, fp->binder);
2447	if (!node) {
2448		node = binder_new_node(proc, fp);
2449		if (!node)
2450			return -ENOMEM;
2451	}
2452	if (fp->cookie != node->cookie) {
2453		binder_user_error("%d:%d sending u%016llx node %d, cookie mismatch %016llx != %016llx\n",
2454				  proc->pid, thread->pid, (u64)fp->binder,
2455				  node->debug_id, (u64)fp->cookie,
2456				  (u64)node->cookie);
2457		ret = -EINVAL;
2458		goto done;
2459	}
2460	if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
2461		ret = -EPERM;
2462		goto done;
2463	}
2464
2465	ret = binder_inc_ref_for_node(target_proc, node,
2466			fp->hdr.type == BINDER_TYPE_BINDER,
2467			&thread->todo, &rdata);
2468	if (ret)
2469		goto done;
2470
2471	if (fp->hdr.type == BINDER_TYPE_BINDER)
2472		fp->hdr.type = BINDER_TYPE_HANDLE;
2473	else
2474		fp->hdr.type = BINDER_TYPE_WEAK_HANDLE;
2475	fp->binder = 0;
2476	fp->handle = rdata.desc;
2477	fp->cookie = 0;
2478
2479	trace_binder_transaction_node_to_ref(t, node, &rdata);
2480	binder_debug(BINDER_DEBUG_TRANSACTION,
2481		     "        node %d u%016llx -> ref %d desc %d\n",
2482		     node->debug_id, (u64)node->ptr,
2483		     rdata.debug_id, rdata.desc);
2484done:
2485	binder_put_node(node);
2486	return ret;
2487}
2488
2489static int binder_translate_handle(struct flat_binder_object *fp,
2490				   struct binder_transaction *t,
2491				   struct binder_thread *thread)
2492{
2493	struct binder_proc *proc = thread->proc;
2494	struct binder_proc *target_proc = t->to_proc;
2495	struct binder_node *node;
2496	struct binder_ref_data src_rdata;
2497	int ret = 0;
2498
2499	node = binder_get_node_from_ref(proc, fp->handle,
2500			fp->hdr.type == BINDER_TYPE_HANDLE, &src_rdata);
2501	if (!node) {
2502		binder_user_error("%d:%d got transaction with invalid handle, %d\n",
2503				  proc->pid, thread->pid, fp->handle);
2504		return -EINVAL;
2505	}
2506	if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
2507		ret = -EPERM;
2508		goto done;
2509	}
2510
2511	binder_node_lock(node);
2512	if (node->proc == target_proc) {
2513		if (fp->hdr.type == BINDER_TYPE_HANDLE)
2514			fp->hdr.type = BINDER_TYPE_BINDER;
2515		else
2516			fp->hdr.type = BINDER_TYPE_WEAK_BINDER;
2517		fp->binder = node->ptr;
2518		fp->cookie = node->cookie;
2519		if (node->proc)
2520			binder_inner_proc_lock(node->proc);
2521		else
2522			__acquire(&node->proc->inner_lock);
2523		binder_inc_node_nilocked(node,
2524					 fp->hdr.type == BINDER_TYPE_BINDER,
2525					 0, NULL);
2526		if (node->proc)
2527			binder_inner_proc_unlock(node->proc);
2528		else
2529			__release(&node->proc->inner_lock);
2530		trace_binder_transaction_ref_to_node(t, node, &src_rdata);
2531		binder_debug(BINDER_DEBUG_TRANSACTION,
2532			     "        ref %d desc %d -> node %d u%016llx\n",
2533			     src_rdata.debug_id, src_rdata.desc, node->debug_id,
2534			     (u64)node->ptr);
2535		binder_node_unlock(node);
2536	} else {
2537		struct binder_ref_data dest_rdata;
2538
2539		binder_node_unlock(node);
2540		ret = binder_inc_ref_for_node(target_proc, node,
2541				fp->hdr.type == BINDER_TYPE_HANDLE,
2542				NULL, &dest_rdata);
2543		if (ret)
2544			goto done;
2545
2546		fp->binder = 0;
2547		fp->handle = dest_rdata.desc;
2548		fp->cookie = 0;
2549		trace_binder_transaction_ref_to_ref(t, node, &src_rdata,
2550						    &dest_rdata);
2551		binder_debug(BINDER_DEBUG_TRANSACTION,
2552			     "        ref %d desc %d -> ref %d desc %d (node %d)\n",
2553			     src_rdata.debug_id, src_rdata.desc,
2554			     dest_rdata.debug_id, dest_rdata.desc,
2555			     node->debug_id);
2556	}
2557done:
2558	binder_put_node(node);
2559	return ret;
2560}
2561
2562static int binder_translate_fd(u32 fd, binder_size_t fd_offset,
2563			       struct binder_transaction *t,
2564			       struct binder_thread *thread,
2565			       struct binder_transaction *in_reply_to)
2566{
2567	struct binder_proc *proc = thread->proc;
2568	struct binder_proc *target_proc = t->to_proc;
2569	struct binder_txn_fd_fixup *fixup;
2570	struct file *file;
2571	int ret = 0;
2572	bool target_allows_fd;
2573
2574	if (in_reply_to)
2575		target_allows_fd = !!(in_reply_to->flags & TF_ACCEPT_FDS);
2576	else
2577		target_allows_fd = t->buffer->target_node->accept_fds;
2578	if (!target_allows_fd) {
2579		binder_user_error("%d:%d got %s with fd, %d, but target does not allow fds\n",
2580				  proc->pid, thread->pid,
2581				  in_reply_to ? "reply" : "transaction",
2582				  fd);
2583		ret = -EPERM;
2584		goto err_fd_not_accepted;
2585	}
2586
2587	file = fget(fd);
2588	if (!file) {
2589		binder_user_error("%d:%d got transaction with invalid fd, %d\n",
2590				  proc->pid, thread->pid, fd);
2591		ret = -EBADF;
2592		goto err_fget;
2593	}
2594	ret = security_binder_transfer_file(proc->tsk, target_proc->tsk, file);
2595	if (ret < 0) {
2596		ret = -EPERM;
2597		goto err_security;
2598	}
2599
2600	/*
2601	 * Add fixup record for this transaction. The allocation
2602	 * of the fd in the target needs to be done from a
2603	 * target thread.
2604	 */
2605	fixup = kzalloc(sizeof(*fixup), GFP_KERNEL);
2606	if (!fixup) {
2607		ret = -ENOMEM;
2608		goto err_alloc;
2609	}
2610	fixup->file = file;
2611	fixup->offset = fd_offset;
 
2612	trace_binder_transaction_fd_send(t, fd, fixup->offset);
2613	list_add_tail(&fixup->fixup_entry, &t->fd_fixups);
2614
2615	return ret;
2616
2617err_alloc:
2618err_security:
2619	fput(file);
2620err_fget:
2621err_fd_not_accepted:
2622	return ret;
2623}
2624
2625static int binder_translate_fd_array(struct binder_fd_array_object *fda,
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2626				     struct binder_buffer_object *parent,
 
2627				     struct binder_transaction *t,
2628				     struct binder_thread *thread,
2629				     struct binder_transaction *in_reply_to)
2630{
2631	binder_size_t fdi, fd_buf_size;
2632	binder_size_t fda_offset;
 
2633	struct binder_proc *proc = thread->proc;
2634	struct binder_proc *target_proc = t->to_proc;
 
 
 
2635
2636	fd_buf_size = sizeof(u32) * fda->num_fds;
2637	if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {
2638		binder_user_error("%d:%d got transaction with invalid number of fds (%lld)\n",
2639				  proc->pid, thread->pid, (u64)fda->num_fds);
2640		return -EINVAL;
2641	}
2642	if (fd_buf_size > parent->length ||
2643	    fda->parent_offset > parent->length - fd_buf_size) {
2644		/* No space for all file descriptors here. */
2645		binder_user_error("%d:%d not enough space to store %lld fds in buffer\n",
2646				  proc->pid, thread->pid, (u64)fda->num_fds);
2647		return -EINVAL;
2648	}
2649	/*
2650	 * the source data for binder_buffer_object is visible
2651	 * to user-space and the @buffer element is the user
2652	 * pointer to the buffer_object containing the fd_array.
2653	 * Convert the address to an offset relative to
2654	 * the base of the transaction buffer.
2655	 */
2656	fda_offset = (parent->buffer - (uintptr_t)t->buffer->user_data) +
2657		fda->parent_offset;
2658	if (!IS_ALIGNED((unsigned long)fda_offset, sizeof(u32))) {
 
 
 
 
2659		binder_user_error("%d:%d parent offset not aligned correctly.\n",
2660				  proc->pid, thread->pid);
2661		return -EINVAL;
2662	}
 
 
 
 
2663	for (fdi = 0; fdi < fda->num_fds; fdi++) {
2664		u32 fd;
2665		int ret;
2666		binder_size_t offset = fda_offset + fdi * sizeof(fd);
 
2667
2668		ret = binder_alloc_copy_from_buffer(&target_proc->alloc,
2669						    &fd, t->buffer,
2670						    offset, sizeof(fd));
2671		if (!ret)
2672			ret = binder_translate_fd(fd, offset, t, thread,
2673						  in_reply_to);
2674		if (ret < 0)
2675			return ret;
2676	}
2677	return 0;
2678}
2679
2680static int binder_fixup_parent(struct binder_transaction *t,
 
2681			       struct binder_thread *thread,
2682			       struct binder_buffer_object *bp,
2683			       binder_size_t off_start_offset,
2684			       binder_size_t num_valid,
2685			       binder_size_t last_fixup_obj_off,
2686			       binder_size_t last_fixup_min_off)
2687{
2688	struct binder_buffer_object *parent;
2689	struct binder_buffer *b = t->buffer;
2690	struct binder_proc *proc = thread->proc;
2691	struct binder_proc *target_proc = t->to_proc;
2692	struct binder_object object;
2693	binder_size_t buffer_offset;
2694	binder_size_t parent_offset;
2695
2696	if (!(bp->flags & BINDER_BUFFER_FLAG_HAS_PARENT))
2697		return 0;
2698
2699	parent = binder_validate_ptr(target_proc, b, &object, bp->parent,
2700				     off_start_offset, &parent_offset,
2701				     num_valid);
2702	if (!parent) {
2703		binder_user_error("%d:%d got transaction with invalid parent offset or type\n",
2704				  proc->pid, thread->pid);
2705		return -EINVAL;
2706	}
2707
2708	if (!binder_validate_fixup(target_proc, b, off_start_offset,
2709				   parent_offset, bp->parent_offset,
2710				   last_fixup_obj_off,
2711				   last_fixup_min_off)) {
2712		binder_user_error("%d:%d got transaction with out-of-order buffer fixup\n",
2713				  proc->pid, thread->pid);
2714		return -EINVAL;
2715	}
2716
2717	if (parent->length < sizeof(binder_uintptr_t) ||
2718	    bp->parent_offset > parent->length - sizeof(binder_uintptr_t)) {
2719		/* No space for a pointer here! */
2720		binder_user_error("%d:%d got transaction with invalid parent offset\n",
2721				  proc->pid, thread->pid);
2722		return -EINVAL;
2723	}
2724	buffer_offset = bp->parent_offset +
2725			(uintptr_t)parent->buffer - (uintptr_t)b->user_data;
2726	if (binder_alloc_copy_to_buffer(&target_proc->alloc, b, buffer_offset,
2727					&bp->buffer, sizeof(bp->buffer))) {
2728		binder_user_error("%d:%d got transaction with invalid parent offset\n",
2729				  proc->pid, thread->pid);
2730		return -EINVAL;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2731	}
2732
2733	return 0;
2734}
2735
2736/**
2737 * binder_proc_transaction() - sends a transaction to a process and wakes it up
2738 * @t:		transaction to send
2739 * @proc:	process to send the transaction to
2740 * @thread:	thread in @proc to send the transaction to (may be NULL)
2741 *
2742 * This function queues a transaction to the specified process. It will try
2743 * to find a thread in the target process to handle the transaction and
2744 * wake it up. If no thread is found, the work is queued to the proc
2745 * waitqueue.
2746 *
2747 * If the @thread parameter is not NULL, the transaction is always queued
2748 * to the waitlist of that specific thread.
2749 *
2750 * Return:	true if the transactions was successfully queued
2751 *		false if the target process or thread is dead
 
2752 */
2753static bool binder_proc_transaction(struct binder_transaction *t,
2754				    struct binder_proc *proc,
2755				    struct binder_thread *thread)
2756{
2757	struct binder_node *node = t->buffer->target_node;
2758	bool oneway = !!(t->flags & TF_ONE_WAY);
2759	bool pending_async = false;
 
2760
2761	BUG_ON(!node);
2762	binder_node_lock(node);
2763	if (oneway) {
2764		BUG_ON(thread);
2765		if (node->has_async_transaction) {
2766			pending_async = true;
2767		} else {
2768			node->has_async_transaction = true;
2769		}
2770	}
2771
2772	binder_inner_proc_lock(proc);
 
 
 
 
2773
2774	if (proc->is_dead || (thread && thread->is_dead)) {
 
2775		binder_inner_proc_unlock(proc);
2776		binder_node_unlock(node);
2777		return false;
2778	}
2779
2780	if (!thread && !pending_async)
2781		thread = binder_select_thread_ilocked(proc);
2782
2783	if (thread)
2784		binder_enqueue_thread_work_ilocked(thread, &t->work);
2785	else if (!pending_async)
2786		binder_enqueue_work_ilocked(&t->work, &proc->todo);
2787	else
 
 
 
 
 
 
 
 
 
 
 
2788		binder_enqueue_work_ilocked(&t->work, &node->async_todo);
 
2789
2790	if (!pending_async)
2791		binder_wakeup_thread_ilocked(proc, thread, !oneway /* sync */);
2792
 
2793	binder_inner_proc_unlock(proc);
2794	binder_node_unlock(node);
2795
2796	return true;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2797}
2798
2799/**
2800 * binder_get_node_refs_for_txn() - Get required refs on node for txn
2801 * @node:         struct binder_node for which to get refs
2802 * @proc:         returns @node->proc if valid
2803 * @error:        if no @proc then returns BR_DEAD_REPLY
2804 *
2805 * User-space normally keeps the node alive when creating a transaction
2806 * since it has a reference to the target. The local strong ref keeps it
2807 * alive if the sending process dies before the target process processes
2808 * the transaction. If the source process is malicious or has a reference
2809 * counting bug, relying on the local strong ref can fail.
2810 *
2811 * Since user-space can cause the local strong ref to go away, we also take
2812 * a tmpref on the node to ensure it survives while we are constructing
2813 * the transaction. We also need a tmpref on the proc while we are
2814 * constructing the transaction, so we take that here as well.
2815 *
2816 * Return: The target_node with refs taken or NULL if no @node->proc is NULL.
2817 * Also sets @proc if valid. If the @node->proc is NULL indicating that the
2818 * target proc has died, @error is set to BR_DEAD_REPLY
2819 */
2820static struct binder_node *binder_get_node_refs_for_txn(
2821		struct binder_node *node,
2822		struct binder_proc **procp,
2823		uint32_t *error)
2824{
2825	struct binder_node *target_node = NULL;
2826
2827	binder_node_inner_lock(node);
2828	if (node->proc) {
2829		target_node = node;
2830		binder_inc_node_nilocked(node, 1, 0, NULL);
2831		binder_inc_node_tmpref_ilocked(node);
2832		node->proc->tmp_ref++;
2833		*procp = node->proc;
2834	} else
2835		*error = BR_DEAD_REPLY;
2836	binder_node_inner_unlock(node);
2837
2838	return target_node;
2839}
2840
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2841static void binder_transaction(struct binder_proc *proc,
2842			       struct binder_thread *thread,
2843			       struct binder_transaction_data *tr, int reply,
2844			       binder_size_t extra_buffers_size)
2845{
2846	int ret;
2847	struct binder_transaction *t;
2848	struct binder_work *w;
2849	struct binder_work *tcomplete;
2850	binder_size_t buffer_offset = 0;
2851	binder_size_t off_start_offset, off_end_offset;
2852	binder_size_t off_min;
2853	binder_size_t sg_buf_offset, sg_buf_end_offset;
 
2854	struct binder_proc *target_proc = NULL;
2855	struct binder_thread *target_thread = NULL;
2856	struct binder_node *target_node = NULL;
2857	struct binder_transaction *in_reply_to = NULL;
2858	struct binder_transaction_log_entry *e;
2859	uint32_t return_error = 0;
2860	uint32_t return_error_param = 0;
2861	uint32_t return_error_line = 0;
2862	binder_size_t last_fixup_obj_off = 0;
2863	binder_size_t last_fixup_min_off = 0;
2864	struct binder_context *context = proc->context;
2865	int t_debug_id = atomic_inc_return(&binder_last_id);
2866	char *secctx = NULL;
2867	u32 secctx_sz = 0;
 
 
 
 
 
 
2868
2869	e = binder_transaction_log_add(&binder_transaction_log);
2870	e->debug_id = t_debug_id;
2871	e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY);
2872	e->from_proc = proc->pid;
2873	e->from_thread = thread->pid;
2874	e->target_handle = tr->target.handle;
2875	e->data_size = tr->data_size;
2876	e->offsets_size = tr->offsets_size;
2877	strscpy(e->context_name, proc->context->name, BINDERFS_MAX_NAME);
2878
 
 
 
 
2879	if (reply) {
2880		binder_inner_proc_lock(proc);
2881		in_reply_to = thread->transaction_stack;
2882		if (in_reply_to == NULL) {
2883			binder_inner_proc_unlock(proc);
2884			binder_user_error("%d:%d got reply transaction with no transaction stack\n",
2885					  proc->pid, thread->pid);
2886			return_error = BR_FAILED_REPLY;
2887			return_error_param = -EPROTO;
2888			return_error_line = __LINE__;
2889			goto err_empty_call_stack;
2890		}
2891		if (in_reply_to->to_thread != thread) {
2892			spin_lock(&in_reply_to->lock);
2893			binder_user_error("%d:%d got reply transaction with bad transaction stack, transaction %d has target %d:%d\n",
2894				proc->pid, thread->pid, in_reply_to->debug_id,
2895				in_reply_to->to_proc ?
2896				in_reply_to->to_proc->pid : 0,
2897				in_reply_to->to_thread ?
2898				in_reply_to->to_thread->pid : 0);
2899			spin_unlock(&in_reply_to->lock);
2900			binder_inner_proc_unlock(proc);
2901			return_error = BR_FAILED_REPLY;
2902			return_error_param = -EPROTO;
2903			return_error_line = __LINE__;
2904			in_reply_to = NULL;
2905			goto err_bad_call_stack;
2906		}
2907		thread->transaction_stack = in_reply_to->to_parent;
2908		binder_inner_proc_unlock(proc);
2909		binder_set_nice(in_reply_to->saved_priority);
2910		target_thread = binder_get_txn_from_and_acq_inner(in_reply_to);
2911		if (target_thread == NULL) {
2912			/* annotation for sparse */
2913			__release(&target_thread->proc->inner_lock);
 
 
2914			return_error = BR_DEAD_REPLY;
2915			return_error_line = __LINE__;
2916			goto err_dead_binder;
2917		}
2918		if (target_thread->transaction_stack != in_reply_to) {
2919			binder_user_error("%d:%d got reply transaction with bad target transaction stack %d, expected %d\n",
2920				proc->pid, thread->pid,
2921				target_thread->transaction_stack ?
2922				target_thread->transaction_stack->debug_id : 0,
2923				in_reply_to->debug_id);
2924			binder_inner_proc_unlock(target_thread->proc);
2925			return_error = BR_FAILED_REPLY;
2926			return_error_param = -EPROTO;
2927			return_error_line = __LINE__;
2928			in_reply_to = NULL;
2929			target_thread = NULL;
2930			goto err_dead_binder;
2931		}
2932		target_proc = target_thread->proc;
2933		target_proc->tmp_ref++;
2934		binder_inner_proc_unlock(target_thread->proc);
2935	} else {
2936		if (tr->target.handle) {
2937			struct binder_ref *ref;
2938
2939			/*
2940			 * There must already be a strong ref
2941			 * on this node. If so, do a strong
2942			 * increment on the node to ensure it
2943			 * stays alive until the transaction is
2944			 * done.
2945			 */
2946			binder_proc_lock(proc);
2947			ref = binder_get_ref_olocked(proc, tr->target.handle,
2948						     true);
2949			if (ref) {
2950				target_node = binder_get_node_refs_for_txn(
2951						ref->node, &target_proc,
2952						&return_error);
2953			} else {
2954				binder_user_error("%d:%d got transaction to invalid handle\n",
2955						  proc->pid, thread->pid);
2956				return_error = BR_FAILED_REPLY;
2957			}
2958			binder_proc_unlock(proc);
2959		} else {
2960			mutex_lock(&context->context_mgr_node_lock);
2961			target_node = context->binder_context_mgr_node;
2962			if (target_node)
2963				target_node = binder_get_node_refs_for_txn(
2964						target_node, &target_proc,
2965						&return_error);
2966			else
2967				return_error = BR_DEAD_REPLY;
2968			mutex_unlock(&context->context_mgr_node_lock);
2969			if (target_node && target_proc->pid == proc->pid) {
2970				binder_user_error("%d:%d got transaction to context manager from process owning it\n",
2971						  proc->pid, thread->pid);
2972				return_error = BR_FAILED_REPLY;
2973				return_error_param = -EINVAL;
2974				return_error_line = __LINE__;
2975				goto err_invalid_target_handle;
2976			}
2977		}
2978		if (!target_node) {
 
 
2979			/*
2980			 * return_error is set above
2981			 */
2982			return_error_param = -EINVAL;
2983			return_error_line = __LINE__;
2984			goto err_dead_binder;
2985		}
2986		e->to_node = target_node->debug_id;
2987		if (security_binder_transaction(proc->tsk,
2988						target_proc->tsk) < 0) {
 
 
 
 
 
 
 
 
 
 
2989			return_error = BR_FAILED_REPLY;
2990			return_error_param = -EPERM;
2991			return_error_line = __LINE__;
2992			goto err_invalid_target_handle;
2993		}
2994		binder_inner_proc_lock(proc);
2995
2996		w = list_first_entry_or_null(&thread->todo,
2997					     struct binder_work, entry);
2998		if (!(tr->flags & TF_ONE_WAY) && w &&
2999		    w->type == BINDER_WORK_TRANSACTION) {
3000			/*
3001			 * Do not allow new outgoing transaction from a
3002			 * thread that has a transaction at the head of
3003			 * its todo list. Only need to check the head
3004			 * because binder_select_thread_ilocked picks a
3005			 * thread from proc->waiting_threads to enqueue
3006			 * the transaction, and nothing is queued to the
3007			 * todo list while the thread is on waiting_threads.
3008			 */
3009			binder_user_error("%d:%d new transaction not allowed when there is a transaction on thread todo\n",
3010					  proc->pid, thread->pid);
3011			binder_inner_proc_unlock(proc);
3012			return_error = BR_FAILED_REPLY;
3013			return_error_param = -EPROTO;
3014			return_error_line = __LINE__;
3015			goto err_bad_todo_list;
3016		}
3017
3018		if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) {
3019			struct binder_transaction *tmp;
3020
3021			tmp = thread->transaction_stack;
3022			if (tmp->to_thread != thread) {
3023				spin_lock(&tmp->lock);
3024				binder_user_error("%d:%d got new transaction with bad transaction stack, transaction %d has target %d:%d\n",
3025					proc->pid, thread->pid, tmp->debug_id,
3026					tmp->to_proc ? tmp->to_proc->pid : 0,
3027					tmp->to_thread ?
3028					tmp->to_thread->pid : 0);
3029				spin_unlock(&tmp->lock);
3030				binder_inner_proc_unlock(proc);
3031				return_error = BR_FAILED_REPLY;
3032				return_error_param = -EPROTO;
3033				return_error_line = __LINE__;
3034				goto err_bad_call_stack;
3035			}
3036			while (tmp) {
3037				struct binder_thread *from;
3038
3039				spin_lock(&tmp->lock);
3040				from = tmp->from;
3041				if (from && from->proc == target_proc) {
3042					atomic_inc(&from->tmp_ref);
3043					target_thread = from;
3044					spin_unlock(&tmp->lock);
3045					break;
3046				}
3047				spin_unlock(&tmp->lock);
3048				tmp = tmp->from_parent;
3049			}
3050		}
3051		binder_inner_proc_unlock(proc);
3052	}
3053	if (target_thread)
3054		e->to_thread = target_thread->pid;
3055	e->to_proc = target_proc->pid;
3056
3057	/* TODO: reuse incoming transaction for reply */
3058	t = kzalloc(sizeof(*t), GFP_KERNEL);
3059	if (t == NULL) {
 
 
3060		return_error = BR_FAILED_REPLY;
3061		return_error_param = -ENOMEM;
3062		return_error_line = __LINE__;
3063		goto err_alloc_t_failed;
3064	}
3065	INIT_LIST_HEAD(&t->fd_fixups);
3066	binder_stats_created(BINDER_STAT_TRANSACTION);
3067	spin_lock_init(&t->lock);
3068
3069	tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL);
3070	if (tcomplete == NULL) {
 
 
3071		return_error = BR_FAILED_REPLY;
3072		return_error_param = -ENOMEM;
3073		return_error_line = __LINE__;
3074		goto err_alloc_tcomplete_failed;
3075	}
3076	binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE);
3077
3078	t->debug_id = t_debug_id;
3079
3080	if (reply)
3081		binder_debug(BINDER_DEBUG_TRANSACTION,
3082			     "%d:%d BC_REPLY %d -> %d:%d, data %016llx-%016llx size %lld-%lld-%lld\n",
3083			     proc->pid, thread->pid, t->debug_id,
3084			     target_proc->pid, target_thread->pid,
3085			     (u64)tr->data.ptr.buffer,
3086			     (u64)tr->data.ptr.offsets,
3087			     (u64)tr->data_size, (u64)tr->offsets_size,
3088			     (u64)extra_buffers_size);
3089	else
3090		binder_debug(BINDER_DEBUG_TRANSACTION,
3091			     "%d:%d BC_TRANSACTION %d -> %d - node %d, data %016llx-%016llx size %lld-%lld-%lld\n",
3092			     proc->pid, thread->pid, t->debug_id,
3093			     target_proc->pid, target_node->debug_id,
3094			     (u64)tr->data.ptr.buffer,
3095			     (u64)tr->data.ptr.offsets,
3096			     (u64)tr->data_size, (u64)tr->offsets_size,
3097			     (u64)extra_buffers_size);
3098
3099	if (!reply && !(tr->flags & TF_ONE_WAY))
3100		t->from = thread;
3101	else
3102		t->from = NULL;
3103	t->sender_euid = task_euid(proc->tsk);
3104	t->to_proc = target_proc;
3105	t->to_thread = target_thread;
3106	t->code = tr->code;
3107	t->flags = tr->flags;
3108	t->priority = task_nice(current);
3109
3110	if (target_node && target_node->txn_security_ctx) {
3111		u32 secid;
3112		size_t added_size;
3113
3114		security_task_getsecid(proc->tsk, &secid);
3115		ret = security_secid_to_secctx(secid, &secctx, &secctx_sz);
3116		if (ret) {
 
 
3117			return_error = BR_FAILED_REPLY;
3118			return_error_param = ret;
3119			return_error_line = __LINE__;
3120			goto err_get_secctx_failed;
3121		}
3122		added_size = ALIGN(secctx_sz, sizeof(u64));
3123		extra_buffers_size += added_size;
3124		if (extra_buffers_size < added_size) {
3125			/* integer overflow of extra_buffers_size */
 
3126			return_error = BR_FAILED_REPLY;
3127			return_error_param = EINVAL;
3128			return_error_line = __LINE__;
3129			goto err_bad_extra_size;
3130		}
3131	}
3132
3133	trace_binder_transaction(reply, t, target_node);
3134
3135	t->buffer = binder_alloc_new_buf(&target_proc->alloc, tr->data_size,
3136		tr->offsets_size, extra_buffers_size,
3137		!reply && (t->flags & TF_ONE_WAY));
3138	if (IS_ERR(t->buffer)) {
3139		/*
3140		 * -ESRCH indicates VMA cleared. The target is dying.
3141		 */
 
 
 
 
 
 
3142		return_error_param = PTR_ERR(t->buffer);
3143		return_error = return_error_param == -ESRCH ?
3144			BR_DEAD_REPLY : BR_FAILED_REPLY;
3145		return_error_line = __LINE__;
3146		t->buffer = NULL;
3147		goto err_binder_alloc_buf_failed;
3148	}
3149	if (secctx) {
3150		int err;
3151		size_t buf_offset = ALIGN(tr->data_size, sizeof(void *)) +
3152				    ALIGN(tr->offsets_size, sizeof(void *)) +
3153				    ALIGN(extra_buffers_size, sizeof(void *)) -
3154				    ALIGN(secctx_sz, sizeof(u64));
3155
3156		t->security_ctx = (uintptr_t)t->buffer->user_data + buf_offset;
3157		err = binder_alloc_copy_to_buffer(&target_proc->alloc,
3158						  t->buffer, buf_offset,
3159						  secctx, secctx_sz);
3160		if (err) {
3161			t->security_ctx = 0;
3162			WARN_ON(1);
3163		}
3164		security_release_secctx(secctx, secctx_sz);
3165		secctx = NULL;
3166	}
3167	t->buffer->debug_id = t->debug_id;
3168	t->buffer->transaction = t;
3169	t->buffer->target_node = target_node;
 
3170	trace_binder_transaction_alloc_buf(t->buffer);
3171
3172	if (binder_alloc_copy_user_to_buffer(
3173				&target_proc->alloc,
3174				t->buffer, 0,
3175				(const void __user *)
3176					(uintptr_t)tr->data.ptr.buffer,
3177				tr->data_size)) {
3178		binder_user_error("%d:%d got transaction with invalid data ptr\n",
3179				proc->pid, thread->pid);
3180		return_error = BR_FAILED_REPLY;
3181		return_error_param = -EFAULT;
3182		return_error_line = __LINE__;
3183		goto err_copy_data_failed;
3184	}
3185	if (binder_alloc_copy_user_to_buffer(
3186				&target_proc->alloc,
3187				t->buffer,
3188				ALIGN(tr->data_size, sizeof(void *)),
3189				(const void __user *)
3190					(uintptr_t)tr->data.ptr.offsets,
3191				tr->offsets_size)) {
3192		binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
3193				proc->pid, thread->pid);
3194		return_error = BR_FAILED_REPLY;
3195		return_error_param = -EFAULT;
3196		return_error_line = __LINE__;
3197		goto err_copy_data_failed;
3198	}
3199	if (!IS_ALIGNED(tr->offsets_size, sizeof(binder_size_t))) {
3200		binder_user_error("%d:%d got transaction with invalid offsets size, %lld\n",
3201				proc->pid, thread->pid, (u64)tr->offsets_size);
3202		return_error = BR_FAILED_REPLY;
3203		return_error_param = -EINVAL;
3204		return_error_line = __LINE__;
3205		goto err_bad_offset;
3206	}
3207	if (!IS_ALIGNED(extra_buffers_size, sizeof(u64))) {
3208		binder_user_error("%d:%d got transaction with unaligned buffers size, %lld\n",
3209				  proc->pid, thread->pid,
3210				  (u64)extra_buffers_size);
3211		return_error = BR_FAILED_REPLY;
3212		return_error_param = -EINVAL;
3213		return_error_line = __LINE__;
3214		goto err_bad_offset;
3215	}
3216	off_start_offset = ALIGN(tr->data_size, sizeof(void *));
3217	buffer_offset = off_start_offset;
3218	off_end_offset = off_start_offset + tr->offsets_size;
3219	sg_buf_offset = ALIGN(off_end_offset, sizeof(void *));
3220	sg_buf_end_offset = sg_buf_offset + extra_buffers_size -
3221		ALIGN(secctx_sz, sizeof(u64));
3222	off_min = 0;
3223	for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
3224	     buffer_offset += sizeof(binder_size_t)) {
3225		struct binder_object_header *hdr;
3226		size_t object_size;
3227		struct binder_object object;
3228		binder_size_t object_offset;
 
3229
3230		if (binder_alloc_copy_from_buffer(&target_proc->alloc,
3231						  &object_offset,
3232						  t->buffer,
3233						  buffer_offset,
3234						  sizeof(object_offset))) {
 
 
3235			return_error = BR_FAILED_REPLY;
3236			return_error_param = -EINVAL;
3237			return_error_line = __LINE__;
3238			goto err_bad_offset;
3239		}
3240		object_size = binder_get_object(target_proc, t->buffer,
3241						object_offset, &object);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3242		if (object_size == 0 || object_offset < off_min) {
3243			binder_user_error("%d:%d got transaction with invalid offset (%lld, min %lld max %lld) or object.\n",
3244					  proc->pid, thread->pid,
3245					  (u64)object_offset,
3246					  (u64)off_min,
3247					  (u64)t->buffer->data_size);
3248			return_error = BR_FAILED_REPLY;
3249			return_error_param = -EINVAL;
3250			return_error_line = __LINE__;
3251			goto err_bad_offset;
3252		}
 
 
 
 
 
3253
3254		hdr = &object.hdr;
3255		off_min = object_offset + object_size;
3256		switch (hdr->type) {
3257		case BINDER_TYPE_BINDER:
3258		case BINDER_TYPE_WEAK_BINDER: {
3259			struct flat_binder_object *fp;
3260
3261			fp = to_flat_binder_object(hdr);
3262			ret = binder_translate_binder(fp, t, thread);
3263
3264			if (ret < 0 ||
3265			    binder_alloc_copy_to_buffer(&target_proc->alloc,
3266							t->buffer,
3267							object_offset,
3268							fp, sizeof(*fp))) {
 
 
3269				return_error = BR_FAILED_REPLY;
3270				return_error_param = ret;
3271				return_error_line = __LINE__;
3272				goto err_translate_failed;
3273			}
3274		} break;
3275		case BINDER_TYPE_HANDLE:
3276		case BINDER_TYPE_WEAK_HANDLE: {
3277			struct flat_binder_object *fp;
3278
3279			fp = to_flat_binder_object(hdr);
3280			ret = binder_translate_handle(fp, t, thread);
3281			if (ret < 0 ||
3282			    binder_alloc_copy_to_buffer(&target_proc->alloc,
3283							t->buffer,
3284							object_offset,
3285							fp, sizeof(*fp))) {
 
 
3286				return_error = BR_FAILED_REPLY;
3287				return_error_param = ret;
3288				return_error_line = __LINE__;
3289				goto err_translate_failed;
3290			}
3291		} break;
3292
3293		case BINDER_TYPE_FD: {
3294			struct binder_fd_object *fp = to_binder_fd_object(hdr);
3295			binder_size_t fd_offset = object_offset +
3296				(uintptr_t)&fp->fd - (uintptr_t)fp;
3297			int ret = binder_translate_fd(fp->fd, fd_offset, t,
3298						      thread, in_reply_to);
3299
3300			fp->pad_binder = 0;
3301			if (ret < 0 ||
3302			    binder_alloc_copy_to_buffer(&target_proc->alloc,
3303							t->buffer,
3304							object_offset,
3305							fp, sizeof(*fp))) {
 
 
3306				return_error = BR_FAILED_REPLY;
3307				return_error_param = ret;
3308				return_error_line = __LINE__;
3309				goto err_translate_failed;
3310			}
3311		} break;
3312		case BINDER_TYPE_FDA: {
3313			struct binder_object ptr_object;
3314			binder_size_t parent_offset;
 
 
3315			struct binder_fd_array_object *fda =
3316				to_binder_fd_array_object(hdr);
3317			size_t num_valid = (buffer_offset - off_start_offset) *
3318						sizeof(binder_size_t);
3319			struct binder_buffer_object *parent =
3320				binder_validate_ptr(target_proc, t->buffer,
3321						    &ptr_object, fda->parent,
3322						    off_start_offset,
3323						    &parent_offset,
3324						    num_valid);
3325			if (!parent) {
3326				binder_user_error("%d:%d got transaction with invalid parent offset or type\n",
3327						  proc->pid, thread->pid);
3328				return_error = BR_FAILED_REPLY;
3329				return_error_param = -EINVAL;
3330				return_error_line = __LINE__;
3331				goto err_bad_parent;
3332			}
3333			if (!binder_validate_fixup(target_proc, t->buffer,
3334						   off_start_offset,
3335						   parent_offset,
3336						   fda->parent_offset,
3337						   last_fixup_obj_off,
3338						   last_fixup_min_off)) {
3339				binder_user_error("%d:%d got transaction with out-of-order buffer fixup\n",
3340						  proc->pid, thread->pid);
3341				return_error = BR_FAILED_REPLY;
3342				return_error_param = -EINVAL;
3343				return_error_line = __LINE__;
3344				goto err_bad_parent;
3345			}
3346			ret = binder_translate_fd_array(fda, parent, t, thread,
3347							in_reply_to);
3348			if (ret < 0) {
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3349				return_error = BR_FAILED_REPLY;
3350				return_error_param = ret;
3351				return_error_line = __LINE__;
3352				goto err_translate_failed;
3353			}
3354			last_fixup_obj_off = parent_offset;
3355			last_fixup_min_off =
3356				fda->parent_offset + sizeof(u32) * fda->num_fds;
3357		} break;
3358		case BINDER_TYPE_PTR: {
3359			struct binder_buffer_object *bp =
3360				to_binder_buffer_object(hdr);
3361			size_t buf_left = sg_buf_end_offset - sg_buf_offset;
3362			size_t num_valid;
3363
3364			if (bp->length > buf_left) {
3365				binder_user_error("%d:%d got transaction with too large buffer\n",
3366						  proc->pid, thread->pid);
3367				return_error = BR_FAILED_REPLY;
3368				return_error_param = -EINVAL;
3369				return_error_line = __LINE__;
3370				goto err_bad_offset;
3371			}
3372			if (binder_alloc_copy_user_to_buffer(
3373						&target_proc->alloc,
3374						t->buffer,
3375						sg_buf_offset,
3376						(const void __user *)
3377							(uintptr_t)bp->buffer,
3378						bp->length)) {
3379				binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
3380						  proc->pid, thread->pid);
3381				return_error_param = -EFAULT;
3382				return_error = BR_FAILED_REPLY;
 
3383				return_error_line = __LINE__;
3384				goto err_copy_data_failed;
3385			}
3386			/* Fixup buffer pointer to target proc address space */
3387			bp->buffer = (uintptr_t)
3388				t->buffer->user_data + sg_buf_offset;
3389			sg_buf_offset += ALIGN(bp->length, sizeof(u64));
3390
3391			num_valid = (buffer_offset - off_start_offset) *
3392					sizeof(binder_size_t);
3393			ret = binder_fixup_parent(t, thread, bp,
 
3394						  off_start_offset,
3395						  num_valid,
3396						  last_fixup_obj_off,
3397						  last_fixup_min_off);
3398			if (ret < 0 ||
3399			    binder_alloc_copy_to_buffer(&target_proc->alloc,
3400							t->buffer,
3401							object_offset,
3402							bp, sizeof(*bp))) {
 
 
3403				return_error = BR_FAILED_REPLY;
3404				return_error_param = ret;
3405				return_error_line = __LINE__;
3406				goto err_translate_failed;
3407			}
3408			last_fixup_obj_off = object_offset;
3409			last_fixup_min_off = 0;
3410		} break;
3411		default:
3412			binder_user_error("%d:%d got transaction with invalid object type, %x\n",
3413				proc->pid, thread->pid, hdr->type);
3414			return_error = BR_FAILED_REPLY;
3415			return_error_param = -EINVAL;
3416			return_error_line = __LINE__;
3417			goto err_bad_object_type;
3418		}
3419	}
3420	tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
3421	t->work.type = BINDER_WORK_TRANSACTION;
3422
3423	if (reply) {
3424		binder_enqueue_thread_work(thread, tcomplete);
3425		binder_inner_proc_lock(target_proc);
3426		if (target_thread->is_dead) {
 
3427			binder_inner_proc_unlock(target_proc);
3428			goto err_dead_proc_or_thread;
3429		}
3430		BUG_ON(t->buffer->async_transaction != 0);
3431		binder_pop_transaction_ilocked(target_thread, in_reply_to);
3432		binder_enqueue_thread_work_ilocked(target_thread, &t->work);
 
3433		binder_inner_proc_unlock(target_proc);
3434		wake_up_interruptible_sync(&target_thread->wait);
3435		binder_free_transaction(in_reply_to);
3436	} else if (!(t->flags & TF_ONE_WAY)) {
3437		BUG_ON(t->buffer->async_transaction != 0);
3438		binder_inner_proc_lock(proc);
3439		/*
3440		 * Defer the TRANSACTION_COMPLETE, so we don't return to
3441		 * userspace immediately; this allows the target process to
3442		 * immediately start processing this transaction, reducing
3443		 * latency. We will then return the TRANSACTION_COMPLETE when
3444		 * the target replies (or there is an error).
3445		 */
3446		binder_enqueue_deferred_thread_work_ilocked(thread, tcomplete);
3447		t->need_reply = 1;
3448		t->from_parent = thread->transaction_stack;
3449		thread->transaction_stack = t;
3450		binder_inner_proc_unlock(proc);
3451		if (!binder_proc_transaction(t, target_proc, target_thread)) {
 
 
3452			binder_inner_proc_lock(proc);
3453			binder_pop_transaction_ilocked(thread, t);
3454			binder_inner_proc_unlock(proc);
3455			goto err_dead_proc_or_thread;
3456		}
3457	} else {
3458		BUG_ON(target_node == NULL);
3459		BUG_ON(t->buffer->async_transaction != 1);
3460		binder_enqueue_thread_work(thread, tcomplete);
3461		if (!binder_proc_transaction(t, target_proc, NULL))
 
3462			goto err_dead_proc_or_thread;
3463	}
3464	if (target_thread)
3465		binder_thread_dec_tmpref(target_thread);
3466	binder_proc_dec_tmpref(target_proc);
3467	if (target_node)
3468		binder_dec_node_tmpref(target_node);
3469	/*
3470	 * write barrier to synchronize with initialization
3471	 * of log entry
3472	 */
3473	smp_wmb();
3474	WRITE_ONCE(e->debug_id_done, t_debug_id);
3475	return;
3476
3477err_dead_proc_or_thread:
3478	return_error = BR_DEAD_REPLY;
 
3479	return_error_line = __LINE__;
3480	binder_dequeue_work(proc, tcomplete);
3481err_translate_failed:
3482err_bad_object_type:
3483err_bad_offset:
3484err_bad_parent:
3485err_copy_data_failed:
 
3486	binder_free_txn_fixups(t);
3487	trace_binder_transaction_failed_buffer_release(t->buffer);
3488	binder_transaction_buffer_release(target_proc, t->buffer,
3489					  buffer_offset, true);
3490	if (target_node)
3491		binder_dec_node_tmpref(target_node);
3492	target_node = NULL;
3493	t->buffer->transaction = NULL;
3494	binder_alloc_free_buf(&target_proc->alloc, t->buffer);
3495err_binder_alloc_buf_failed:
3496err_bad_extra_size:
3497	if (secctx)
3498		security_release_secctx(secctx, secctx_sz);
3499err_get_secctx_failed:
3500	kfree(tcomplete);
3501	binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
3502err_alloc_tcomplete_failed:
 
 
3503	kfree(t);
3504	binder_stats_deleted(BINDER_STAT_TRANSACTION);
3505err_alloc_t_failed:
3506err_bad_todo_list:
3507err_bad_call_stack:
3508err_empty_call_stack:
3509err_dead_binder:
3510err_invalid_target_handle:
3511	if (target_thread)
3512		binder_thread_dec_tmpref(target_thread);
3513	if (target_proc)
3514		binder_proc_dec_tmpref(target_proc);
3515	if (target_node) {
3516		binder_dec_node(target_node, 1, 0);
3517		binder_dec_node_tmpref(target_node);
3518	}
3519
3520	binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
3521		     "%d:%d transaction failed %d/%d, size %lld-%lld line %d\n",
3522		     proc->pid, thread->pid, return_error, return_error_param,
 
 
 
 
3523		     (u64)tr->data_size, (u64)tr->offsets_size,
3524		     return_error_line);
3525
 
 
 
 
 
3526	{
3527		struct binder_transaction_log_entry *fe;
3528
3529		e->return_error = return_error;
3530		e->return_error_param = return_error_param;
3531		e->return_error_line = return_error_line;
3532		fe = binder_transaction_log_add(&binder_transaction_log_failed);
3533		*fe = *e;
3534		/*
3535		 * write barrier to synchronize with initialization
3536		 * of log entry
3537		 */
3538		smp_wmb();
3539		WRITE_ONCE(e->debug_id_done, t_debug_id);
3540		WRITE_ONCE(fe->debug_id_done, t_debug_id);
3541	}
3542
3543	BUG_ON(thread->return_error.cmd != BR_OK);
3544	if (in_reply_to) {
 
 
3545		thread->return_error.cmd = BR_TRANSACTION_COMPLETE;
3546		binder_enqueue_thread_work(thread, &thread->return_error.work);
3547		binder_send_failed_reply(in_reply_to, return_error);
3548	} else {
 
 
 
 
3549		thread->return_error.cmd = return_error;
3550		binder_enqueue_thread_work(thread, &thread->return_error.work);
3551	}
3552}
3553
3554/**
3555 * binder_free_buf() - free the specified buffer
3556 * @proc:	binder proc that owns buffer
3557 * @buffer:	buffer to be freed
 
3558 *
3559 * If buffer for an async transaction, enqueue the next async
3560 * transaction from the node.
3561 *
3562 * Cleanup buffer and free it.
3563 */
3564static void
3565binder_free_buf(struct binder_proc *proc, struct binder_buffer *buffer)
 
 
3566{
3567	binder_inner_proc_lock(proc);
3568	if (buffer->transaction) {
3569		buffer->transaction->buffer = NULL;
3570		buffer->transaction = NULL;
3571	}
3572	binder_inner_proc_unlock(proc);
3573	if (buffer->async_transaction && buffer->target_node) {
3574		struct binder_node *buf_node;
3575		struct binder_work *w;
3576
3577		buf_node = buffer->target_node;
3578		binder_node_inner_lock(buf_node);
3579		BUG_ON(!buf_node->has_async_transaction);
3580		BUG_ON(buf_node->proc != proc);
3581		w = binder_dequeue_work_head_ilocked(
3582				&buf_node->async_todo);
3583		if (!w) {
3584			buf_node->has_async_transaction = false;
3585		} else {
3586			binder_enqueue_work_ilocked(
3587					w, &proc->todo);
3588			binder_wakeup_proc_ilocked(proc);
3589		}
3590		binder_node_inner_unlock(buf_node);
3591	}
3592	trace_binder_transaction_buffer_release(buffer);
3593	binder_transaction_buffer_release(proc, buffer, 0, false);
3594	binder_alloc_free_buf(&proc->alloc, buffer);
3595}
3596
3597static int binder_thread_write(struct binder_proc *proc,
3598			struct binder_thread *thread,
3599			binder_uintptr_t binder_buffer, size_t size,
3600			binder_size_t *consumed)
3601{
3602	uint32_t cmd;
3603	struct binder_context *context = proc->context;
3604	void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
3605	void __user *ptr = buffer + *consumed;
3606	void __user *end = buffer + size;
3607
3608	while (ptr < end && thread->return_error.cmd == BR_OK) {
3609		int ret;
3610
3611		if (get_user(cmd, (uint32_t __user *)ptr))
3612			return -EFAULT;
3613		ptr += sizeof(uint32_t);
3614		trace_binder_command(cmd);
3615		if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) {
3616			atomic_inc(&binder_stats.bc[_IOC_NR(cmd)]);
3617			atomic_inc(&proc->stats.bc[_IOC_NR(cmd)]);
3618			atomic_inc(&thread->stats.bc[_IOC_NR(cmd)]);
3619		}
3620		switch (cmd) {
3621		case BC_INCREFS:
3622		case BC_ACQUIRE:
3623		case BC_RELEASE:
3624		case BC_DECREFS: {
3625			uint32_t target;
3626			const char *debug_string;
3627			bool strong = cmd == BC_ACQUIRE || cmd == BC_RELEASE;
3628			bool increment = cmd == BC_INCREFS || cmd == BC_ACQUIRE;
3629			struct binder_ref_data rdata;
3630
3631			if (get_user(target, (uint32_t __user *)ptr))
3632				return -EFAULT;
3633
3634			ptr += sizeof(uint32_t);
3635			ret = -1;
3636			if (increment && !target) {
3637				struct binder_node *ctx_mgr_node;
 
3638				mutex_lock(&context->context_mgr_node_lock);
3639				ctx_mgr_node = context->binder_context_mgr_node;
3640				if (ctx_mgr_node)
 
 
 
 
 
 
3641					ret = binder_inc_ref_for_node(
3642							proc, ctx_mgr_node,
3643							strong, NULL, &rdata);
 
3644				mutex_unlock(&context->context_mgr_node_lock);
3645			}
3646			if (ret)
3647				ret = binder_update_ref_for_handle(
3648						proc, target, increment, strong,
3649						&rdata);
3650			if (!ret && rdata.desc != target) {
3651				binder_user_error("%d:%d tried to acquire reference to desc %d, got %d instead\n",
3652					proc->pid, thread->pid,
3653					target, rdata.desc);
3654			}
3655			switch (cmd) {
3656			case BC_INCREFS:
3657				debug_string = "IncRefs";
3658				break;
3659			case BC_ACQUIRE:
3660				debug_string = "Acquire";
3661				break;
3662			case BC_RELEASE:
3663				debug_string = "Release";
3664				break;
3665			case BC_DECREFS:
3666			default:
3667				debug_string = "DecRefs";
3668				break;
3669			}
3670			if (ret) {
3671				binder_user_error("%d:%d %s %d refcount change on invalid ref %d ret %d\n",
3672					proc->pid, thread->pid, debug_string,
3673					strong, target, ret);
3674				break;
3675			}
3676			binder_debug(BINDER_DEBUG_USER_REFS,
3677				     "%d:%d %s ref %d desc %d s %d w %d\n",
3678				     proc->pid, thread->pid, debug_string,
3679				     rdata.debug_id, rdata.desc, rdata.strong,
3680				     rdata.weak);
3681			break;
3682		}
3683		case BC_INCREFS_DONE:
3684		case BC_ACQUIRE_DONE: {
3685			binder_uintptr_t node_ptr;
3686			binder_uintptr_t cookie;
3687			struct binder_node *node;
3688			bool free_node;
3689
3690			if (get_user(node_ptr, (binder_uintptr_t __user *)ptr))
3691				return -EFAULT;
3692			ptr += sizeof(binder_uintptr_t);
3693			if (get_user(cookie, (binder_uintptr_t __user *)ptr))
3694				return -EFAULT;
3695			ptr += sizeof(binder_uintptr_t);
3696			node = binder_get_node(proc, node_ptr);
3697			if (node == NULL) {
3698				binder_user_error("%d:%d %s u%016llx no match\n",
3699					proc->pid, thread->pid,
3700					cmd == BC_INCREFS_DONE ?
3701					"BC_INCREFS_DONE" :
3702					"BC_ACQUIRE_DONE",
3703					(u64)node_ptr);
3704				break;
3705			}
3706			if (cookie != node->cookie) {
3707				binder_user_error("%d:%d %s u%016llx node %d cookie mismatch %016llx != %016llx\n",
3708					proc->pid, thread->pid,
3709					cmd == BC_INCREFS_DONE ?
3710					"BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
3711					(u64)node_ptr, node->debug_id,
3712					(u64)cookie, (u64)node->cookie);
3713				binder_put_node(node);
3714				break;
3715			}
3716			binder_node_inner_lock(node);
3717			if (cmd == BC_ACQUIRE_DONE) {
3718				if (node->pending_strong_ref == 0) {
3719					binder_user_error("%d:%d BC_ACQUIRE_DONE node %d has no pending acquire request\n",
3720						proc->pid, thread->pid,
3721						node->debug_id);
3722					binder_node_inner_unlock(node);
3723					binder_put_node(node);
3724					break;
3725				}
3726				node->pending_strong_ref = 0;
3727			} else {
3728				if (node->pending_weak_ref == 0) {
3729					binder_user_error("%d:%d BC_INCREFS_DONE node %d has no pending increfs request\n",
3730						proc->pid, thread->pid,
3731						node->debug_id);
3732					binder_node_inner_unlock(node);
3733					binder_put_node(node);
3734					break;
3735				}
3736				node->pending_weak_ref = 0;
3737			}
3738			free_node = binder_dec_node_nilocked(node,
3739					cmd == BC_ACQUIRE_DONE, 0);
3740			WARN_ON(free_node);
3741			binder_debug(BINDER_DEBUG_USER_REFS,
3742				     "%d:%d %s node %d ls %d lw %d tr %d\n",
3743				     proc->pid, thread->pid,
3744				     cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
3745				     node->debug_id, node->local_strong_refs,
3746				     node->local_weak_refs, node->tmp_refs);
3747			binder_node_inner_unlock(node);
3748			binder_put_node(node);
3749			break;
3750		}
3751		case BC_ATTEMPT_ACQUIRE:
3752			pr_err("BC_ATTEMPT_ACQUIRE not supported\n");
3753			return -EINVAL;
3754		case BC_ACQUIRE_RESULT:
3755			pr_err("BC_ACQUIRE_RESULT not supported\n");
3756			return -EINVAL;
3757
3758		case BC_FREE_BUFFER: {
3759			binder_uintptr_t data_ptr;
3760			struct binder_buffer *buffer;
3761
3762			if (get_user(data_ptr, (binder_uintptr_t __user *)ptr))
3763				return -EFAULT;
3764			ptr += sizeof(binder_uintptr_t);
3765
3766			buffer = binder_alloc_prepare_to_free(&proc->alloc,
3767							      data_ptr);
3768			if (IS_ERR_OR_NULL(buffer)) {
3769				if (PTR_ERR(buffer) == -EPERM) {
3770					binder_user_error(
3771						"%d:%d BC_FREE_BUFFER u%016llx matched unreturned or currently freeing buffer\n",
3772						proc->pid, thread->pid,
3773						(u64)data_ptr);
3774				} else {
3775					binder_user_error(
3776						"%d:%d BC_FREE_BUFFER u%016llx no match\n",
3777						proc->pid, thread->pid,
3778						(u64)data_ptr);
3779				}
3780				break;
3781			}
3782			binder_debug(BINDER_DEBUG_FREE_BUFFER,
3783				     "%d:%d BC_FREE_BUFFER u%016llx found buffer %d for %s transaction\n",
3784				     proc->pid, thread->pid, (u64)data_ptr,
3785				     buffer->debug_id,
3786				     buffer->transaction ? "active" : "finished");
3787			binder_free_buf(proc, buffer);
3788			break;
3789		}
3790
3791		case BC_TRANSACTION_SG:
3792		case BC_REPLY_SG: {
3793			struct binder_transaction_data_sg tr;
3794
3795			if (copy_from_user(&tr, ptr, sizeof(tr)))
3796				return -EFAULT;
3797			ptr += sizeof(tr);
3798			binder_transaction(proc, thread, &tr.transaction_data,
3799					   cmd == BC_REPLY_SG, tr.buffers_size);
3800			break;
3801		}
3802		case BC_TRANSACTION:
3803		case BC_REPLY: {
3804			struct binder_transaction_data tr;
3805
3806			if (copy_from_user(&tr, ptr, sizeof(tr)))
3807				return -EFAULT;
3808			ptr += sizeof(tr);
3809			binder_transaction(proc, thread, &tr,
3810					   cmd == BC_REPLY, 0);
3811			break;
3812		}
3813
3814		case BC_REGISTER_LOOPER:
3815			binder_debug(BINDER_DEBUG_THREADS,
3816				     "%d:%d BC_REGISTER_LOOPER\n",
3817				     proc->pid, thread->pid);
3818			binder_inner_proc_lock(proc);
3819			if (thread->looper & BINDER_LOOPER_STATE_ENTERED) {
3820				thread->looper |= BINDER_LOOPER_STATE_INVALID;
3821				binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER\n",
3822					proc->pid, thread->pid);
3823			} else if (proc->requested_threads == 0) {
3824				thread->looper |= BINDER_LOOPER_STATE_INVALID;
3825				binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called without request\n",
3826					proc->pid, thread->pid);
3827			} else {
3828				proc->requested_threads--;
3829				proc->requested_threads_started++;
3830			}
3831			thread->looper |= BINDER_LOOPER_STATE_REGISTERED;
3832			binder_inner_proc_unlock(proc);
3833			break;
3834		case BC_ENTER_LOOPER:
3835			binder_debug(BINDER_DEBUG_THREADS,
3836				     "%d:%d BC_ENTER_LOOPER\n",
3837				     proc->pid, thread->pid);
3838			if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) {
3839				thread->looper |= BINDER_LOOPER_STATE_INVALID;
3840				binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n",
3841					proc->pid, thread->pid);
3842			}
3843			thread->looper |= BINDER_LOOPER_STATE_ENTERED;
3844			break;
3845		case BC_EXIT_LOOPER:
3846			binder_debug(BINDER_DEBUG_THREADS,
3847				     "%d:%d BC_EXIT_LOOPER\n",
3848				     proc->pid, thread->pid);
3849			thread->looper |= BINDER_LOOPER_STATE_EXITED;
3850			break;
3851
3852		case BC_REQUEST_DEATH_NOTIFICATION:
3853		case BC_CLEAR_DEATH_NOTIFICATION: {
3854			uint32_t target;
3855			binder_uintptr_t cookie;
3856			struct binder_ref *ref;
3857			struct binder_ref_death *death = NULL;
3858
3859			if (get_user(target, (uint32_t __user *)ptr))
3860				return -EFAULT;
3861			ptr += sizeof(uint32_t);
3862			if (get_user(cookie, (binder_uintptr_t __user *)ptr))
3863				return -EFAULT;
3864			ptr += sizeof(binder_uintptr_t);
3865			if (cmd == BC_REQUEST_DEATH_NOTIFICATION) {
3866				/*
3867				 * Allocate memory for death notification
3868				 * before taking lock
3869				 */
3870				death = kzalloc(sizeof(*death), GFP_KERNEL);
3871				if (death == NULL) {
3872					WARN_ON(thread->return_error.cmd !=
3873						BR_OK);
3874					thread->return_error.cmd = BR_ERROR;
3875					binder_enqueue_thread_work(
3876						thread,
3877						&thread->return_error.work);
3878					binder_debug(
3879						BINDER_DEBUG_FAILED_TRANSACTION,
3880						"%d:%d BC_REQUEST_DEATH_NOTIFICATION failed\n",
3881						proc->pid, thread->pid);
3882					break;
3883				}
3884			}
3885			binder_proc_lock(proc);
3886			ref = binder_get_ref_olocked(proc, target, false);
3887			if (ref == NULL) {
3888				binder_user_error("%d:%d %s invalid ref %d\n",
3889					proc->pid, thread->pid,
3890					cmd == BC_REQUEST_DEATH_NOTIFICATION ?
3891					"BC_REQUEST_DEATH_NOTIFICATION" :
3892					"BC_CLEAR_DEATH_NOTIFICATION",
3893					target);
3894				binder_proc_unlock(proc);
3895				kfree(death);
3896				break;
3897			}
3898
3899			binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
3900				     "%d:%d %s %016llx ref %d desc %d s %d w %d for node %d\n",
3901				     proc->pid, thread->pid,
3902				     cmd == BC_REQUEST_DEATH_NOTIFICATION ?
3903				     "BC_REQUEST_DEATH_NOTIFICATION" :
3904				     "BC_CLEAR_DEATH_NOTIFICATION",
3905				     (u64)cookie, ref->data.debug_id,
3906				     ref->data.desc, ref->data.strong,
3907				     ref->data.weak, ref->node->debug_id);
3908
3909			binder_node_lock(ref->node);
3910			if (cmd == BC_REQUEST_DEATH_NOTIFICATION) {
3911				if (ref->death) {
3912					binder_user_error("%d:%d BC_REQUEST_DEATH_NOTIFICATION death notification already set\n",
3913						proc->pid, thread->pid);
3914					binder_node_unlock(ref->node);
3915					binder_proc_unlock(proc);
3916					kfree(death);
3917					break;
3918				}
3919				binder_stats_created(BINDER_STAT_DEATH);
3920				INIT_LIST_HEAD(&death->work.entry);
3921				death->cookie = cookie;
3922				ref->death = death;
3923				if (ref->node->proc == NULL) {
3924					ref->death->work.type = BINDER_WORK_DEAD_BINDER;
3925
3926					binder_inner_proc_lock(proc);
3927					binder_enqueue_work_ilocked(
3928						&ref->death->work, &proc->todo);
3929					binder_wakeup_proc_ilocked(proc);
3930					binder_inner_proc_unlock(proc);
3931				}
3932			} else {
3933				if (ref->death == NULL) {
3934					binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification not active\n",
3935						proc->pid, thread->pid);
3936					binder_node_unlock(ref->node);
3937					binder_proc_unlock(proc);
3938					break;
3939				}
3940				death = ref->death;
3941				if (death->cookie != cookie) {
3942					binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch %016llx != %016llx\n",
3943						proc->pid, thread->pid,
3944						(u64)death->cookie,
3945						(u64)cookie);
3946					binder_node_unlock(ref->node);
3947					binder_proc_unlock(proc);
3948					break;
3949				}
3950				ref->death = NULL;
3951				binder_inner_proc_lock(proc);
3952				if (list_empty(&death->work.entry)) {
3953					death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;
3954					if (thread->looper &
3955					    (BINDER_LOOPER_STATE_REGISTERED |
3956					     BINDER_LOOPER_STATE_ENTERED))
3957						binder_enqueue_thread_work_ilocked(
3958								thread,
3959								&death->work);
3960					else {
3961						binder_enqueue_work_ilocked(
3962								&death->work,
3963								&proc->todo);
3964						binder_wakeup_proc_ilocked(
3965								proc);
3966					}
3967				} else {
3968					BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER);
3969					death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR;
3970				}
3971				binder_inner_proc_unlock(proc);
3972			}
3973			binder_node_unlock(ref->node);
3974			binder_proc_unlock(proc);
3975		} break;
3976		case BC_DEAD_BINDER_DONE: {
3977			struct binder_work *w;
3978			binder_uintptr_t cookie;
3979			struct binder_ref_death *death = NULL;
3980
3981			if (get_user(cookie, (binder_uintptr_t __user *)ptr))
3982				return -EFAULT;
3983
3984			ptr += sizeof(cookie);
3985			binder_inner_proc_lock(proc);
3986			list_for_each_entry(w, &proc->delivered_death,
3987					    entry) {
3988				struct binder_ref_death *tmp_death =
3989					container_of(w,
3990						     struct binder_ref_death,
3991						     work);
3992
3993				if (tmp_death->cookie == cookie) {
3994					death = tmp_death;
3995					break;
3996				}
3997			}
3998			binder_debug(BINDER_DEBUG_DEAD_BINDER,
3999				     "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
4000				     proc->pid, thread->pid, (u64)cookie,
4001				     death);
4002			if (death == NULL) {
4003				binder_user_error("%d:%d BC_DEAD_BINDER_DONE %016llx not found\n",
4004					proc->pid, thread->pid, (u64)cookie);
4005				binder_inner_proc_unlock(proc);
4006				break;
4007			}
4008			binder_dequeue_work_ilocked(&death->work);
4009			if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) {
4010				death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;
4011				if (thread->looper &
4012					(BINDER_LOOPER_STATE_REGISTERED |
4013					 BINDER_LOOPER_STATE_ENTERED))
4014					binder_enqueue_thread_work_ilocked(
4015						thread, &death->work);
4016				else {
4017					binder_enqueue_work_ilocked(
4018							&death->work,
4019							&proc->todo);
4020					binder_wakeup_proc_ilocked(proc);
4021				}
4022			}
4023			binder_inner_proc_unlock(proc);
4024		} break;
4025
4026		default:
4027			pr_err("%d:%d unknown command %d\n",
4028			       proc->pid, thread->pid, cmd);
4029			return -EINVAL;
4030		}
4031		*consumed = ptr - buffer;
4032	}
4033	return 0;
4034}
4035
4036static void binder_stat_br(struct binder_proc *proc,
4037			   struct binder_thread *thread, uint32_t cmd)
4038{
4039	trace_binder_return(cmd);
4040	if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) {
4041		atomic_inc(&binder_stats.br[_IOC_NR(cmd)]);
4042		atomic_inc(&proc->stats.br[_IOC_NR(cmd)]);
4043		atomic_inc(&thread->stats.br[_IOC_NR(cmd)]);
4044	}
4045}
4046
4047static int binder_put_node_cmd(struct binder_proc *proc,
4048			       struct binder_thread *thread,
4049			       void __user **ptrp,
4050			       binder_uintptr_t node_ptr,
4051			       binder_uintptr_t node_cookie,
4052			       int node_debug_id,
4053			       uint32_t cmd, const char *cmd_name)
4054{
4055	void __user *ptr = *ptrp;
4056
4057	if (put_user(cmd, (uint32_t __user *)ptr))
4058		return -EFAULT;
4059	ptr += sizeof(uint32_t);
4060
4061	if (put_user(node_ptr, (binder_uintptr_t __user *)ptr))
4062		return -EFAULT;
4063	ptr += sizeof(binder_uintptr_t);
4064
4065	if (put_user(node_cookie, (binder_uintptr_t __user *)ptr))
4066		return -EFAULT;
4067	ptr += sizeof(binder_uintptr_t);
4068
4069	binder_stat_br(proc, thread, cmd);
4070	binder_debug(BINDER_DEBUG_USER_REFS, "%d:%d %s %d u%016llx c%016llx\n",
4071		     proc->pid, thread->pid, cmd_name, node_debug_id,
4072		     (u64)node_ptr, (u64)node_cookie);
4073
4074	*ptrp = ptr;
4075	return 0;
4076}
4077
4078static int binder_wait_for_work(struct binder_thread *thread,
4079				bool do_proc_work)
4080{
4081	DEFINE_WAIT(wait);
4082	struct binder_proc *proc = thread->proc;
4083	int ret = 0;
4084
4085	freezer_do_not_count();
4086	binder_inner_proc_lock(proc);
4087	for (;;) {
4088		prepare_to_wait(&thread->wait, &wait, TASK_INTERRUPTIBLE);
4089		if (binder_has_work_ilocked(thread, do_proc_work))
4090			break;
4091		if (do_proc_work)
4092			list_add(&thread->waiting_thread_node,
4093				 &proc->waiting_threads);
4094		binder_inner_proc_unlock(proc);
4095		schedule();
4096		binder_inner_proc_lock(proc);
4097		list_del_init(&thread->waiting_thread_node);
4098		if (signal_pending(current)) {
4099			ret = -ERESTARTSYS;
4100			break;
4101		}
4102	}
4103	finish_wait(&thread->wait, &wait);
4104	binder_inner_proc_unlock(proc);
4105	freezer_count();
4106
4107	return ret;
4108}
4109
4110/**
4111 * binder_apply_fd_fixups() - finish fd translation
4112 * @proc:         binder_proc associated @t->buffer
4113 * @t:	binder transaction with list of fd fixups
4114 *
4115 * Now that we are in the context of the transaction target
4116 * process, we can allocate and install fds. Process the
4117 * list of fds to translate and fixup the buffer with the
4118 * new fds.
4119 *
4120 * If we fail to allocate an fd, then free the resources by
4121 * fput'ing files that have not been processed and ksys_close'ing
4122 * any fds that have already been allocated.
4123 */
4124static int binder_apply_fd_fixups(struct binder_proc *proc,
4125				  struct binder_transaction *t)
4126{
4127	struct binder_txn_fd_fixup *fixup, *tmp;
4128	int ret = 0;
4129
4130	list_for_each_entry(fixup, &t->fd_fixups, fixup_entry) {
4131		int fd = get_unused_fd_flags(O_CLOEXEC);
4132
4133		if (fd < 0) {
4134			binder_debug(BINDER_DEBUG_TRANSACTION,
4135				     "failed fd fixup txn %d fd %d\n",
4136				     t->debug_id, fd);
4137			ret = -ENOMEM;
4138			break;
4139		}
4140		binder_debug(BINDER_DEBUG_TRANSACTION,
4141			     "fd fixup txn %d fd %d\n",
4142			     t->debug_id, fd);
4143		trace_binder_transaction_fd_recv(t, fd, fixup->offset);
4144		fd_install(fd, fixup->file);
4145		fixup->file = NULL;
4146		if (binder_alloc_copy_to_buffer(&proc->alloc, t->buffer,
4147						fixup->offset, &fd,
4148						sizeof(u32))) {
4149			ret = -EINVAL;
4150			break;
4151		}
4152	}
4153	list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) {
4154		if (fixup->file) {
4155			fput(fixup->file);
4156		} else if (ret) {
4157			u32 fd;
4158			int err;
4159
4160			err = binder_alloc_copy_from_buffer(&proc->alloc, &fd,
4161							    t->buffer,
4162							    fixup->offset,
4163							    sizeof(fd));
4164			WARN_ON(err);
4165			if (!err)
4166				binder_deferred_fd_close(fd);
4167		}
4168		list_del(&fixup->fixup_entry);
4169		kfree(fixup);
4170	}
4171
4172	return ret;
 
 
 
 
4173}
4174
4175static int binder_thread_read(struct binder_proc *proc,
4176			      struct binder_thread *thread,
4177			      binder_uintptr_t binder_buffer, size_t size,
4178			      binder_size_t *consumed, int non_block)
4179{
4180	void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
4181	void __user *ptr = buffer + *consumed;
4182	void __user *end = buffer + size;
4183
4184	int ret = 0;
4185	int wait_for_proc_work;
4186
4187	if (*consumed == 0) {
4188		if (put_user(BR_NOOP, (uint32_t __user *)ptr))
4189			return -EFAULT;
4190		ptr += sizeof(uint32_t);
4191	}
4192
4193retry:
4194	binder_inner_proc_lock(proc);
4195	wait_for_proc_work = binder_available_for_proc_work_ilocked(thread);
4196	binder_inner_proc_unlock(proc);
4197
4198	thread->looper |= BINDER_LOOPER_STATE_WAITING;
4199
4200	trace_binder_wait_for_work(wait_for_proc_work,
4201				   !!thread->transaction_stack,
4202				   !binder_worklist_empty(proc, &thread->todo));
4203	if (wait_for_proc_work) {
4204		if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
4205					BINDER_LOOPER_STATE_ENTERED))) {
4206			binder_user_error("%d:%d ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state %x)\n",
4207				proc->pid, thread->pid, thread->looper);
4208			wait_event_interruptible(binder_user_error_wait,
4209						 binder_stop_on_user_error < 2);
4210		}
4211		binder_set_nice(proc->default_priority);
4212	}
4213
4214	if (non_block) {
4215		if (!binder_has_work(thread, wait_for_proc_work))
4216			ret = -EAGAIN;
4217	} else {
4218		ret = binder_wait_for_work(thread, wait_for_proc_work);
4219	}
4220
4221	thread->looper &= ~BINDER_LOOPER_STATE_WAITING;
4222
4223	if (ret)
4224		return ret;
4225
4226	while (1) {
4227		uint32_t cmd;
4228		struct binder_transaction_data_secctx tr;
4229		struct binder_transaction_data *trd = &tr.transaction_data;
4230		struct binder_work *w = NULL;
4231		struct list_head *list = NULL;
4232		struct binder_transaction *t = NULL;
4233		struct binder_thread *t_from;
4234		size_t trsize = sizeof(*trd);
4235
4236		binder_inner_proc_lock(proc);
4237		if (!binder_worklist_empty_ilocked(&thread->todo))
4238			list = &thread->todo;
4239		else if (!binder_worklist_empty_ilocked(&proc->todo) &&
4240			   wait_for_proc_work)
4241			list = &proc->todo;
4242		else {
4243			binder_inner_proc_unlock(proc);
4244
4245			/* no data added */
4246			if (ptr - buffer == 4 && !thread->looper_need_return)
4247				goto retry;
4248			break;
4249		}
4250
4251		if (end - ptr < sizeof(tr) + 4) {
4252			binder_inner_proc_unlock(proc);
4253			break;
4254		}
4255		w = binder_dequeue_work_head_ilocked(list);
4256		if (binder_worklist_empty_ilocked(&thread->todo))
4257			thread->process_todo = false;
4258
4259		switch (w->type) {
4260		case BINDER_WORK_TRANSACTION: {
4261			binder_inner_proc_unlock(proc);
4262			t = container_of(w, struct binder_transaction, work);
4263		} break;
4264		case BINDER_WORK_RETURN_ERROR: {
4265			struct binder_error *e = container_of(
4266					w, struct binder_error, work);
4267
4268			WARN_ON(e->cmd == BR_OK);
4269			binder_inner_proc_unlock(proc);
4270			if (put_user(e->cmd, (uint32_t __user *)ptr))
4271				return -EFAULT;
4272			cmd = e->cmd;
4273			e->cmd = BR_OK;
4274			ptr += sizeof(uint32_t);
4275
4276			binder_stat_br(proc, thread, cmd);
4277		} break;
4278		case BINDER_WORK_TRANSACTION_COMPLETE: {
 
 
 
 
 
 
4279			binder_inner_proc_unlock(proc);
4280			cmd = BR_TRANSACTION_COMPLETE;
4281			kfree(w);
4282			binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
4283			if (put_user(cmd, (uint32_t __user *)ptr))
4284				return -EFAULT;
4285			ptr += sizeof(uint32_t);
4286
4287			binder_stat_br(proc, thread, cmd);
4288			binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE,
4289				     "%d:%d BR_TRANSACTION_COMPLETE\n",
4290				     proc->pid, thread->pid);
4291		} break;
4292		case BINDER_WORK_NODE: {
4293			struct binder_node *node = container_of(w, struct binder_node, work);
4294			int strong, weak;
4295			binder_uintptr_t node_ptr = node->ptr;
4296			binder_uintptr_t node_cookie = node->cookie;
4297			int node_debug_id = node->debug_id;
4298			int has_weak_ref;
4299			int has_strong_ref;
4300			void __user *orig_ptr = ptr;
4301
4302			BUG_ON(proc != node->proc);
4303			strong = node->internal_strong_refs ||
4304					node->local_strong_refs;
4305			weak = !hlist_empty(&node->refs) ||
4306					node->local_weak_refs ||
4307					node->tmp_refs || strong;
4308			has_strong_ref = node->has_strong_ref;
4309			has_weak_ref = node->has_weak_ref;
4310
4311			if (weak && !has_weak_ref) {
4312				node->has_weak_ref = 1;
4313				node->pending_weak_ref = 1;
4314				node->local_weak_refs++;
4315			}
4316			if (strong && !has_strong_ref) {
4317				node->has_strong_ref = 1;
4318				node->pending_strong_ref = 1;
4319				node->local_strong_refs++;
4320			}
4321			if (!strong && has_strong_ref)
4322				node->has_strong_ref = 0;
4323			if (!weak && has_weak_ref)
4324				node->has_weak_ref = 0;
4325			if (!weak && !strong) {
4326				binder_debug(BINDER_DEBUG_INTERNAL_REFS,
4327					     "%d:%d node %d u%016llx c%016llx deleted\n",
4328					     proc->pid, thread->pid,
4329					     node_debug_id,
4330					     (u64)node_ptr,
4331					     (u64)node_cookie);
4332				rb_erase(&node->rb_node, &proc->nodes);
4333				binder_inner_proc_unlock(proc);
4334				binder_node_lock(node);
4335				/*
4336				 * Acquire the node lock before freeing the
4337				 * node to serialize with other threads that
4338				 * may have been holding the node lock while
4339				 * decrementing this node (avoids race where
4340				 * this thread frees while the other thread
4341				 * is unlocking the node after the final
4342				 * decrement)
4343				 */
4344				binder_node_unlock(node);
4345				binder_free_node(node);
4346			} else
4347				binder_inner_proc_unlock(proc);
4348
4349			if (weak && !has_weak_ref)
4350				ret = binder_put_node_cmd(
4351						proc, thread, &ptr, node_ptr,
4352						node_cookie, node_debug_id,
4353						BR_INCREFS, "BR_INCREFS");
4354			if (!ret && strong && !has_strong_ref)
4355				ret = binder_put_node_cmd(
4356						proc, thread, &ptr, node_ptr,
4357						node_cookie, node_debug_id,
4358						BR_ACQUIRE, "BR_ACQUIRE");
4359			if (!ret && !strong && has_strong_ref)
4360				ret = binder_put_node_cmd(
4361						proc, thread, &ptr, node_ptr,
4362						node_cookie, node_debug_id,
4363						BR_RELEASE, "BR_RELEASE");
4364			if (!ret && !weak && has_weak_ref)
4365				ret = binder_put_node_cmd(
4366						proc, thread, &ptr, node_ptr,
4367						node_cookie, node_debug_id,
4368						BR_DECREFS, "BR_DECREFS");
4369			if (orig_ptr == ptr)
4370				binder_debug(BINDER_DEBUG_INTERNAL_REFS,
4371					     "%d:%d node %d u%016llx c%016llx state unchanged\n",
4372					     proc->pid, thread->pid,
4373					     node_debug_id,
4374					     (u64)node_ptr,
4375					     (u64)node_cookie);
4376			if (ret)
4377				return ret;
4378		} break;
4379		case BINDER_WORK_DEAD_BINDER:
4380		case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
4381		case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
4382			struct binder_ref_death *death;
4383			uint32_t cmd;
4384			binder_uintptr_t cookie;
4385
4386			death = container_of(w, struct binder_ref_death, work);
4387			if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION)
4388				cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE;
4389			else
4390				cmd = BR_DEAD_BINDER;
4391			cookie = death->cookie;
4392
4393			binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
4394				     "%d:%d %s %016llx\n",
4395				      proc->pid, thread->pid,
4396				      cmd == BR_DEAD_BINDER ?
4397				      "BR_DEAD_BINDER" :
4398				      "BR_CLEAR_DEATH_NOTIFICATION_DONE",
4399				      (u64)cookie);
4400			if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) {
4401				binder_inner_proc_unlock(proc);
4402				kfree(death);
4403				binder_stats_deleted(BINDER_STAT_DEATH);
4404			} else {
4405				binder_enqueue_work_ilocked(
4406						w, &proc->delivered_death);
4407				binder_inner_proc_unlock(proc);
4408			}
4409			if (put_user(cmd, (uint32_t __user *)ptr))
4410				return -EFAULT;
4411			ptr += sizeof(uint32_t);
4412			if (put_user(cookie,
4413				     (binder_uintptr_t __user *)ptr))
4414				return -EFAULT;
4415			ptr += sizeof(binder_uintptr_t);
4416			binder_stat_br(proc, thread, cmd);
4417			if (cmd == BR_DEAD_BINDER)
4418				goto done; /* DEAD_BINDER notifications can cause transactions */
4419		} break;
4420		default:
4421			binder_inner_proc_unlock(proc);
4422			pr_err("%d:%d: bad work type %d\n",
4423			       proc->pid, thread->pid, w->type);
4424			break;
4425		}
4426
4427		if (!t)
4428			continue;
4429
4430		BUG_ON(t->buffer == NULL);
4431		if (t->buffer->target_node) {
4432			struct binder_node *target_node = t->buffer->target_node;
4433
4434			trd->target.ptr = target_node->ptr;
4435			trd->cookie =  target_node->cookie;
4436			t->saved_priority = task_nice(current);
4437			if (t->priority < target_node->min_priority &&
4438			    !(t->flags & TF_ONE_WAY))
4439				binder_set_nice(t->priority);
4440			else if (!(t->flags & TF_ONE_WAY) ||
4441				 t->saved_priority > target_node->min_priority)
4442				binder_set_nice(target_node->min_priority);
4443			cmd = BR_TRANSACTION;
4444		} else {
4445			trd->target.ptr = 0;
4446			trd->cookie = 0;
4447			cmd = BR_REPLY;
4448		}
4449		trd->code = t->code;
4450		trd->flags = t->flags;
4451		trd->sender_euid = from_kuid(current_user_ns(), t->sender_euid);
4452
4453		t_from = binder_get_txn_from(t);
4454		if (t_from) {
4455			struct task_struct *sender = t_from->proc->tsk;
4456
4457			trd->sender_pid =
4458				task_tgid_nr_ns(sender,
4459						task_active_pid_ns(current));
4460		} else {
4461			trd->sender_pid = 0;
4462		}
4463
4464		ret = binder_apply_fd_fixups(proc, t);
4465		if (ret) {
4466			struct binder_buffer *buffer = t->buffer;
4467			bool oneway = !!(t->flags & TF_ONE_WAY);
4468			int tid = t->debug_id;
4469
4470			if (t_from)
4471				binder_thread_dec_tmpref(t_from);
4472			buffer->transaction = NULL;
4473			binder_cleanup_transaction(t, "fd fixups failed",
4474						   BR_FAILED_REPLY);
4475			binder_free_buf(proc, buffer);
4476			binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
4477				     "%d:%d %stransaction %d fd fixups failed %d/%d, line %d\n",
4478				     proc->pid, thread->pid,
4479				     oneway ? "async " :
4480					(cmd == BR_REPLY ? "reply " : ""),
4481				     tid, BR_FAILED_REPLY, ret, __LINE__);
4482			if (cmd == BR_REPLY) {
4483				cmd = BR_FAILED_REPLY;
4484				if (put_user(cmd, (uint32_t __user *)ptr))
4485					return -EFAULT;
4486				ptr += sizeof(uint32_t);
4487				binder_stat_br(proc, thread, cmd);
4488				break;
4489			}
4490			continue;
4491		}
4492		trd->data_size = t->buffer->data_size;
4493		trd->offsets_size = t->buffer->offsets_size;
4494		trd->data.ptr.buffer = (uintptr_t)t->buffer->user_data;
4495		trd->data.ptr.offsets = trd->data.ptr.buffer +
4496					ALIGN(t->buffer->data_size,
4497					    sizeof(void *));
4498
4499		tr.secctx = t->security_ctx;
4500		if (t->security_ctx) {
4501			cmd = BR_TRANSACTION_SEC_CTX;
4502			trsize = sizeof(tr);
4503		}
4504		if (put_user(cmd, (uint32_t __user *)ptr)) {
4505			if (t_from)
4506				binder_thread_dec_tmpref(t_from);
4507
4508			binder_cleanup_transaction(t, "put_user failed",
4509						   BR_FAILED_REPLY);
4510
4511			return -EFAULT;
4512		}
4513		ptr += sizeof(uint32_t);
4514		if (copy_to_user(ptr, &tr, trsize)) {
4515			if (t_from)
4516				binder_thread_dec_tmpref(t_from);
4517
4518			binder_cleanup_transaction(t, "copy_to_user failed",
4519						   BR_FAILED_REPLY);
4520
4521			return -EFAULT;
4522		}
4523		ptr += trsize;
4524
4525		trace_binder_transaction_received(t);
4526		binder_stat_br(proc, thread, cmd);
4527		binder_debug(BINDER_DEBUG_TRANSACTION,
4528			     "%d:%d %s %d %d:%d, cmd %d size %zd-%zd ptr %016llx-%016llx\n",
4529			     proc->pid, thread->pid,
4530			     (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" :
4531				(cmd == BR_TRANSACTION_SEC_CTX) ?
4532				     "BR_TRANSACTION_SEC_CTX" : "BR_REPLY",
4533			     t->debug_id, t_from ? t_from->proc->pid : 0,
4534			     t_from ? t_from->pid : 0, cmd,
4535			     t->buffer->data_size, t->buffer->offsets_size,
4536			     (u64)trd->data.ptr.buffer,
4537			     (u64)trd->data.ptr.offsets);
4538
4539		if (t_from)
4540			binder_thread_dec_tmpref(t_from);
4541		t->buffer->allow_user_free = 1;
4542		if (cmd != BR_REPLY && !(t->flags & TF_ONE_WAY)) {
4543			binder_inner_proc_lock(thread->proc);
4544			t->to_parent = thread->transaction_stack;
4545			t->to_thread = thread;
4546			thread->transaction_stack = t;
4547			binder_inner_proc_unlock(thread->proc);
4548		} else {
4549			binder_free_transaction(t);
4550		}
4551		break;
4552	}
4553
4554done:
4555
4556	*consumed = ptr - buffer;
4557	binder_inner_proc_lock(proc);
4558	if (proc->requested_threads == 0 &&
4559	    list_empty(&thread->proc->waiting_threads) &&
4560	    proc->requested_threads_started < proc->max_threads &&
4561	    (thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
4562	     BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */
4563	     /*spawn a new thread if we leave this out */) {
4564		proc->requested_threads++;
4565		binder_inner_proc_unlock(proc);
4566		binder_debug(BINDER_DEBUG_THREADS,
4567			     "%d:%d BR_SPAWN_LOOPER\n",
4568			     proc->pid, thread->pid);
4569		if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer))
4570			return -EFAULT;
4571		binder_stat_br(proc, thread, BR_SPAWN_LOOPER);
4572	} else
4573		binder_inner_proc_unlock(proc);
4574	return 0;
4575}
4576
4577static void binder_release_work(struct binder_proc *proc,
4578				struct list_head *list)
4579{
4580	struct binder_work *w;
 
4581
4582	while (1) {
4583		w = binder_dequeue_work_head(proc, list);
 
 
 
4584		if (!w)
4585			return;
4586
4587		switch (w->type) {
4588		case BINDER_WORK_TRANSACTION: {
4589			struct binder_transaction *t;
4590
4591			t = container_of(w, struct binder_transaction, work);
4592
4593			binder_cleanup_transaction(t, "process died.",
4594						   BR_DEAD_REPLY);
4595		} break;
4596		case BINDER_WORK_RETURN_ERROR: {
4597			struct binder_error *e = container_of(
4598					w, struct binder_error, work);
4599
4600			binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
4601				"undelivered TRANSACTION_ERROR: %u\n",
4602				e->cmd);
4603		} break;
4604		case BINDER_WORK_TRANSACTION_COMPLETE: {
4605			binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
4606				"undelivered TRANSACTION_COMPLETE\n");
4607			kfree(w);
4608			binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
4609		} break;
4610		case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
4611		case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
4612			struct binder_ref_death *death;
4613
4614			death = container_of(w, struct binder_ref_death, work);
4615			binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
4616				"undelivered death notification, %016llx\n",
4617				(u64)death->cookie);
4618			kfree(death);
4619			binder_stats_deleted(BINDER_STAT_DEATH);
4620		} break;
 
 
4621		default:
4622			pr_err("unexpected work type, %d, not freed\n",
4623			       w->type);
4624			break;
4625		}
4626	}
4627
4628}
4629
4630static struct binder_thread *binder_get_thread_ilocked(
4631		struct binder_proc *proc, struct binder_thread *new_thread)
4632{
4633	struct binder_thread *thread = NULL;
4634	struct rb_node *parent = NULL;
4635	struct rb_node **p = &proc->threads.rb_node;
4636
4637	while (*p) {
4638		parent = *p;
4639		thread = rb_entry(parent, struct binder_thread, rb_node);
4640
4641		if (current->pid < thread->pid)
4642			p = &(*p)->rb_left;
4643		else if (current->pid > thread->pid)
4644			p = &(*p)->rb_right;
4645		else
4646			return thread;
4647	}
4648	if (!new_thread)
4649		return NULL;
4650	thread = new_thread;
4651	binder_stats_created(BINDER_STAT_THREAD);
4652	thread->proc = proc;
4653	thread->pid = current->pid;
4654	atomic_set(&thread->tmp_ref, 0);
4655	init_waitqueue_head(&thread->wait);
4656	INIT_LIST_HEAD(&thread->todo);
4657	rb_link_node(&thread->rb_node, parent, p);
4658	rb_insert_color(&thread->rb_node, &proc->threads);
4659	thread->looper_need_return = true;
4660	thread->return_error.work.type = BINDER_WORK_RETURN_ERROR;
4661	thread->return_error.cmd = BR_OK;
4662	thread->reply_error.work.type = BINDER_WORK_RETURN_ERROR;
4663	thread->reply_error.cmd = BR_OK;
 
4664	INIT_LIST_HEAD(&new_thread->waiting_thread_node);
4665	return thread;
4666}
4667
4668static struct binder_thread *binder_get_thread(struct binder_proc *proc)
4669{
4670	struct binder_thread *thread;
4671	struct binder_thread *new_thread;
4672
4673	binder_inner_proc_lock(proc);
4674	thread = binder_get_thread_ilocked(proc, NULL);
4675	binder_inner_proc_unlock(proc);
4676	if (!thread) {
4677		new_thread = kzalloc(sizeof(*thread), GFP_KERNEL);
4678		if (new_thread == NULL)
4679			return NULL;
4680		binder_inner_proc_lock(proc);
4681		thread = binder_get_thread_ilocked(proc, new_thread);
4682		binder_inner_proc_unlock(proc);
4683		if (thread != new_thread)
4684			kfree(new_thread);
4685	}
4686	return thread;
4687}
4688
4689static void binder_free_proc(struct binder_proc *proc)
4690{
 
 
4691	BUG_ON(!list_empty(&proc->todo));
4692	BUG_ON(!list_empty(&proc->delivered_death));
 
 
 
 
 
 
 
 
4693	binder_alloc_deferred_release(&proc->alloc);
4694	put_task_struct(proc->tsk);
 
4695	binder_stats_deleted(BINDER_STAT_PROC);
4696	kfree(proc);
4697}
4698
4699static void binder_free_thread(struct binder_thread *thread)
4700{
4701	BUG_ON(!list_empty(&thread->todo));
4702	binder_stats_deleted(BINDER_STAT_THREAD);
4703	binder_proc_dec_tmpref(thread->proc);
4704	kfree(thread);
4705}
4706
4707static int binder_thread_release(struct binder_proc *proc,
4708				 struct binder_thread *thread)
4709{
4710	struct binder_transaction *t;
4711	struct binder_transaction *send_reply = NULL;
4712	int active_transactions = 0;
4713	struct binder_transaction *last_t = NULL;
4714
4715	binder_inner_proc_lock(thread->proc);
4716	/*
4717	 * take a ref on the proc so it survives
4718	 * after we remove this thread from proc->threads.
4719	 * The corresponding dec is when we actually
4720	 * free the thread in binder_free_thread()
4721	 */
4722	proc->tmp_ref++;
4723	/*
4724	 * take a ref on this thread to ensure it
4725	 * survives while we are releasing it
4726	 */
4727	atomic_inc(&thread->tmp_ref);
4728	rb_erase(&thread->rb_node, &proc->threads);
4729	t = thread->transaction_stack;
4730	if (t) {
4731		spin_lock(&t->lock);
4732		if (t->to_thread == thread)
4733			send_reply = t;
4734	} else {
4735		__acquire(&t->lock);
4736	}
4737	thread->is_dead = true;
4738
4739	while (t) {
4740		last_t = t;
4741		active_transactions++;
4742		binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
4743			     "release %d:%d transaction %d %s, still active\n",
4744			      proc->pid, thread->pid,
4745			     t->debug_id,
4746			     (t->to_thread == thread) ? "in" : "out");
4747
4748		if (t->to_thread == thread) {
 
4749			t->to_proc = NULL;
4750			t->to_thread = NULL;
4751			if (t->buffer) {
4752				t->buffer->transaction = NULL;
4753				t->buffer = NULL;
4754			}
4755			t = t->to_parent;
4756		} else if (t->from == thread) {
4757			t->from = NULL;
4758			t = t->from_parent;
4759		} else
4760			BUG();
4761		spin_unlock(&last_t->lock);
4762		if (t)
4763			spin_lock(&t->lock);
4764		else
4765			__acquire(&t->lock);
4766	}
4767	/* annotation for sparse, lock not acquired in last iteration above */
4768	__release(&t->lock);
4769
4770	/*
4771	 * If this thread used poll, make sure we remove the waitqueue
4772	 * from any epoll data structures holding it with POLLFREE.
4773	 * waitqueue_active() is safe to use here because we're holding
4774	 * the inner lock.
4775	 */
4776	if ((thread->looper & BINDER_LOOPER_STATE_POLL) &&
4777	    waitqueue_active(&thread->wait)) {
4778		wake_up_poll(&thread->wait, EPOLLHUP | POLLFREE);
4779	}
4780
4781	binder_inner_proc_unlock(thread->proc);
4782
4783	/*
4784	 * This is needed to avoid races between wake_up_poll() above and
4785	 * and ep_remove_waitqueue() called for other reasons (eg the epoll file
4786	 * descriptor being closed); ep_remove_waitqueue() holds an RCU read
4787	 * lock, so we can be sure it's done after calling synchronize_rcu().
 
4788	 */
4789	if (thread->looper & BINDER_LOOPER_STATE_POLL)
4790		synchronize_rcu();
4791
4792	if (send_reply)
4793		binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
4794	binder_release_work(proc, &thread->todo);
4795	binder_thread_dec_tmpref(thread);
4796	return active_transactions;
4797}
4798
4799static __poll_t binder_poll(struct file *filp,
4800				struct poll_table_struct *wait)
4801{
4802	struct binder_proc *proc = filp->private_data;
4803	struct binder_thread *thread = NULL;
4804	bool wait_for_proc_work;
4805
4806	thread = binder_get_thread(proc);
4807	if (!thread)
4808		return POLLERR;
4809
4810	binder_inner_proc_lock(thread->proc);
4811	thread->looper |= BINDER_LOOPER_STATE_POLL;
4812	wait_for_proc_work = binder_available_for_proc_work_ilocked(thread);
4813
4814	binder_inner_proc_unlock(thread->proc);
4815
4816	poll_wait(filp, &thread->wait, wait);
4817
4818	if (binder_has_work(thread, wait_for_proc_work))
4819		return EPOLLIN;
4820
4821	return 0;
4822}
4823
4824static int binder_ioctl_write_read(struct file *filp,
4825				unsigned int cmd, unsigned long arg,
4826				struct binder_thread *thread)
4827{
4828	int ret = 0;
4829	struct binder_proc *proc = filp->private_data;
4830	unsigned int size = _IOC_SIZE(cmd);
4831	void __user *ubuf = (void __user *)arg;
4832	struct binder_write_read bwr;
4833
4834	if (size != sizeof(struct binder_write_read)) {
4835		ret = -EINVAL;
4836		goto out;
4837	}
4838	if (copy_from_user(&bwr, ubuf, sizeof(bwr))) {
4839		ret = -EFAULT;
4840		goto out;
4841	}
4842	binder_debug(BINDER_DEBUG_READ_WRITE,
4843		     "%d:%d write %lld at %016llx, read %lld at %016llx\n",
4844		     proc->pid, thread->pid,
4845		     (u64)bwr.write_size, (u64)bwr.write_buffer,
4846		     (u64)bwr.read_size, (u64)bwr.read_buffer);
4847
4848	if (bwr.write_size > 0) {
4849		ret = binder_thread_write(proc, thread,
4850					  bwr.write_buffer,
4851					  bwr.write_size,
4852					  &bwr.write_consumed);
4853		trace_binder_write_done(ret);
4854		if (ret < 0) {
4855			bwr.read_consumed = 0;
4856			if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
4857				ret = -EFAULT;
4858			goto out;
4859		}
4860	}
4861	if (bwr.read_size > 0) {
4862		ret = binder_thread_read(proc, thread, bwr.read_buffer,
4863					 bwr.read_size,
4864					 &bwr.read_consumed,
4865					 filp->f_flags & O_NONBLOCK);
4866		trace_binder_read_done(ret);
4867		binder_inner_proc_lock(proc);
4868		if (!binder_worklist_empty_ilocked(&proc->todo))
4869			binder_wakeup_proc_ilocked(proc);
4870		binder_inner_proc_unlock(proc);
4871		if (ret < 0) {
4872			if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
4873				ret = -EFAULT;
4874			goto out;
4875		}
4876	}
4877	binder_debug(BINDER_DEBUG_READ_WRITE,
4878		     "%d:%d wrote %lld of %lld, read return %lld of %lld\n",
4879		     proc->pid, thread->pid,
4880		     (u64)bwr.write_consumed, (u64)bwr.write_size,
4881		     (u64)bwr.read_consumed, (u64)bwr.read_size);
4882	if (copy_to_user(ubuf, &bwr, sizeof(bwr))) {
4883		ret = -EFAULT;
4884		goto out;
4885	}
4886out:
4887	return ret;
4888}
4889
4890static int binder_ioctl_set_ctx_mgr(struct file *filp,
4891				    struct flat_binder_object *fbo)
4892{
4893	int ret = 0;
4894	struct binder_proc *proc = filp->private_data;
4895	struct binder_context *context = proc->context;
4896	struct binder_node *new_node;
4897	kuid_t curr_euid = current_euid();
4898
4899	mutex_lock(&context->context_mgr_node_lock);
4900	if (context->binder_context_mgr_node) {
4901		pr_err("BINDER_SET_CONTEXT_MGR already set\n");
4902		ret = -EBUSY;
4903		goto out;
4904	}
4905	ret = security_binder_set_context_mgr(proc->tsk);
4906	if (ret < 0)
4907		goto out;
4908	if (uid_valid(context->binder_context_mgr_uid)) {
4909		if (!uid_eq(context->binder_context_mgr_uid, curr_euid)) {
4910			pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n",
4911			       from_kuid(&init_user_ns, curr_euid),
4912			       from_kuid(&init_user_ns,
4913					 context->binder_context_mgr_uid));
4914			ret = -EPERM;
4915			goto out;
4916		}
4917	} else {
4918		context->binder_context_mgr_uid = curr_euid;
4919	}
4920	new_node = binder_new_node(proc, fbo);
4921	if (!new_node) {
4922		ret = -ENOMEM;
4923		goto out;
4924	}
4925	binder_node_lock(new_node);
4926	new_node->local_weak_refs++;
4927	new_node->local_strong_refs++;
4928	new_node->has_strong_ref = 1;
4929	new_node->has_weak_ref = 1;
4930	context->binder_context_mgr_node = new_node;
4931	binder_node_unlock(new_node);
4932	binder_put_node(new_node);
4933out:
4934	mutex_unlock(&context->context_mgr_node_lock);
4935	return ret;
4936}
4937
4938static int binder_ioctl_get_node_info_for_ref(struct binder_proc *proc,
4939		struct binder_node_info_for_ref *info)
4940{
4941	struct binder_node *node;
4942	struct binder_context *context = proc->context;
4943	__u32 handle = info->handle;
4944
4945	if (info->strong_count || info->weak_count || info->reserved1 ||
4946	    info->reserved2 || info->reserved3) {
4947		binder_user_error("%d BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero.",
4948				  proc->pid);
4949		return -EINVAL;
4950	}
4951
4952	/* This ioctl may only be used by the context manager */
4953	mutex_lock(&context->context_mgr_node_lock);
4954	if (!context->binder_context_mgr_node ||
4955		context->binder_context_mgr_node->proc != proc) {
4956		mutex_unlock(&context->context_mgr_node_lock);
4957		return -EPERM;
4958	}
4959	mutex_unlock(&context->context_mgr_node_lock);
4960
4961	node = binder_get_node_from_ref(proc, handle, true, NULL);
4962	if (!node)
4963		return -EINVAL;
4964
4965	info->strong_count = node->local_strong_refs +
4966		node->internal_strong_refs;
4967	info->weak_count = node->local_weak_refs;
4968
4969	binder_put_node(node);
4970
4971	return 0;
4972}
4973
4974static int binder_ioctl_get_node_debug_info(struct binder_proc *proc,
4975				struct binder_node_debug_info *info)
4976{
4977	struct rb_node *n;
4978	binder_uintptr_t ptr = info->ptr;
4979
4980	memset(info, 0, sizeof(*info));
4981
4982	binder_inner_proc_lock(proc);
4983	for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) {
4984		struct binder_node *node = rb_entry(n, struct binder_node,
4985						    rb_node);
4986		if (node->ptr > ptr) {
4987			info->ptr = node->ptr;
4988			info->cookie = node->cookie;
4989			info->has_strong_ref = node->has_strong_ref;
4990			info->has_weak_ref = node->has_weak_ref;
4991			break;
4992		}
4993	}
4994	binder_inner_proc_unlock(proc);
4995
4996	return 0;
4997}
4998
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
4999static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
5000{
5001	int ret;
5002	struct binder_proc *proc = filp->private_data;
5003	struct binder_thread *thread;
5004	unsigned int size = _IOC_SIZE(cmd);
5005	void __user *ubuf = (void __user *)arg;
5006
5007	/*pr_info("binder_ioctl: %d:%d %x %lx\n",
5008			proc->pid, current->pid, cmd, arg);*/
5009
5010	binder_selftest_alloc(&proc->alloc);
5011
5012	trace_binder_ioctl(cmd, arg);
5013
5014	ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
5015	if (ret)
5016		goto err_unlocked;
5017
5018	thread = binder_get_thread(proc);
5019	if (thread == NULL) {
5020		ret = -ENOMEM;
5021		goto err;
5022	}
5023
5024	switch (cmd) {
5025	case BINDER_WRITE_READ:
5026		ret = binder_ioctl_write_read(filp, cmd, arg, thread);
5027		if (ret)
5028			goto err;
5029		break;
5030	case BINDER_SET_MAX_THREADS: {
5031		int max_threads;
5032
5033		if (copy_from_user(&max_threads, ubuf,
5034				   sizeof(max_threads))) {
5035			ret = -EINVAL;
5036			goto err;
5037		}
5038		binder_inner_proc_lock(proc);
5039		proc->max_threads = max_threads;
5040		binder_inner_proc_unlock(proc);
5041		break;
5042	}
5043	case BINDER_SET_CONTEXT_MGR_EXT: {
5044		struct flat_binder_object fbo;
5045
5046		if (copy_from_user(&fbo, ubuf, sizeof(fbo))) {
5047			ret = -EINVAL;
5048			goto err;
5049		}
5050		ret = binder_ioctl_set_ctx_mgr(filp, &fbo);
5051		if (ret)
5052			goto err;
5053		break;
5054	}
5055	case BINDER_SET_CONTEXT_MGR:
5056		ret = binder_ioctl_set_ctx_mgr(filp, NULL);
5057		if (ret)
5058			goto err;
5059		break;
5060	case BINDER_THREAD_EXIT:
5061		binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n",
5062			     proc->pid, thread->pid);
5063		binder_thread_release(proc, thread);
5064		thread = NULL;
5065		break;
5066	case BINDER_VERSION: {
5067		struct binder_version __user *ver = ubuf;
5068
5069		if (size != sizeof(struct binder_version)) {
5070			ret = -EINVAL;
5071			goto err;
5072		}
5073		if (put_user(BINDER_CURRENT_PROTOCOL_VERSION,
5074			     &ver->protocol_version)) {
5075			ret = -EINVAL;
5076			goto err;
5077		}
5078		break;
5079	}
5080	case BINDER_GET_NODE_INFO_FOR_REF: {
5081		struct binder_node_info_for_ref info;
5082
5083		if (copy_from_user(&info, ubuf, sizeof(info))) {
5084			ret = -EFAULT;
5085			goto err;
5086		}
5087
5088		ret = binder_ioctl_get_node_info_for_ref(proc, &info);
5089		if (ret < 0)
5090			goto err;
5091
5092		if (copy_to_user(ubuf, &info, sizeof(info))) {
5093			ret = -EFAULT;
5094			goto err;
5095		}
5096
5097		break;
5098	}
5099	case BINDER_GET_NODE_DEBUG_INFO: {
5100		struct binder_node_debug_info info;
5101
5102		if (copy_from_user(&info, ubuf, sizeof(info))) {
5103			ret = -EFAULT;
5104			goto err;
5105		}
5106
5107		ret = binder_ioctl_get_node_debug_info(proc, &info);
5108		if (ret < 0)
5109			goto err;
5110
5111		if (copy_to_user(ubuf, &info, sizeof(info))) {
5112			ret = -EFAULT;
5113			goto err;
5114		}
5115		break;
5116	}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
5117	default:
5118		ret = -EINVAL;
5119		goto err;
5120	}
5121	ret = 0;
5122err:
5123	if (thread)
5124		thread->looper_need_return = false;
5125	wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
5126	if (ret && ret != -ERESTARTSYS)
5127		pr_info("%d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret);
5128err_unlocked:
5129	trace_binder_ioctl_done(ret);
5130	return ret;
5131}
5132
5133static void binder_vma_open(struct vm_area_struct *vma)
5134{
5135	struct binder_proc *proc = vma->vm_private_data;
5136
5137	binder_debug(BINDER_DEBUG_OPEN_CLOSE,
5138		     "%d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
5139		     proc->pid, vma->vm_start, vma->vm_end,
5140		     (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
5141		     (unsigned long)pgprot_val(vma->vm_page_prot));
5142}
5143
5144static void binder_vma_close(struct vm_area_struct *vma)
5145{
5146	struct binder_proc *proc = vma->vm_private_data;
5147
5148	binder_debug(BINDER_DEBUG_OPEN_CLOSE,
5149		     "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
5150		     proc->pid, vma->vm_start, vma->vm_end,
5151		     (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
5152		     (unsigned long)pgprot_val(vma->vm_page_prot));
5153	binder_alloc_vma_close(&proc->alloc);
5154}
5155
5156static vm_fault_t binder_vm_fault(struct vm_fault *vmf)
5157{
5158	return VM_FAULT_SIGBUS;
5159}
5160
5161static const struct vm_operations_struct binder_vm_ops = {
5162	.open = binder_vma_open,
5163	.close = binder_vma_close,
5164	.fault = binder_vm_fault,
5165};
5166
5167static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
5168{
5169	int ret;
5170	struct binder_proc *proc = filp->private_data;
5171	const char *failure_string;
5172
5173	if (proc->tsk != current->group_leader)
5174		return -EINVAL;
5175
5176	binder_debug(BINDER_DEBUG_OPEN_CLOSE,
5177		     "%s: %d %lx-%lx (%ld K) vma %lx pagep %lx\n",
5178		     __func__, proc->pid, vma->vm_start, vma->vm_end,
5179		     (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
5180		     (unsigned long)pgprot_val(vma->vm_page_prot));
5181
5182	if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) {
5183		ret = -EPERM;
5184		failure_string = "bad vm_flags";
5185		goto err_bad_arg;
5186	}
5187	vma->vm_flags |= VM_DONTCOPY | VM_MIXEDMAP;
5188	vma->vm_flags &= ~VM_MAYWRITE;
5189
5190	vma->vm_ops = &binder_vm_ops;
5191	vma->vm_private_data = proc;
5192
5193	ret = binder_alloc_mmap_handler(&proc->alloc, vma);
5194	if (ret)
5195		return ret;
5196	return 0;
5197
5198err_bad_arg:
5199	pr_err("%s: %d %lx-%lx %s failed %d\n", __func__,
5200	       proc->pid, vma->vm_start, vma->vm_end, failure_string, ret);
5201	return ret;
5202}
5203
5204static int binder_open(struct inode *nodp, struct file *filp)
5205{
5206	struct binder_proc *proc;
5207	struct binder_device *binder_dev;
5208	struct binderfs_info *info;
5209	struct dentry *binder_binderfs_dir_entry_proc = NULL;
 
5210
5211	binder_debug(BINDER_DEBUG_OPEN_CLOSE, "%s: %d:%d\n", __func__,
5212		     current->group_leader->pid, current->pid);
5213
5214	proc = kzalloc(sizeof(*proc), GFP_KERNEL);
5215	if (proc == NULL)
5216		return -ENOMEM;
5217	spin_lock_init(&proc->inner_lock);
5218	spin_lock_init(&proc->outer_lock);
5219	get_task_struct(current->group_leader);
5220	proc->tsk = current->group_leader;
 
5221	INIT_LIST_HEAD(&proc->todo);
 
5222	proc->default_priority = task_nice(current);
5223	/* binderfs stashes devices in i_private */
5224	if (is_binderfs_device(nodp)) {
5225		binder_dev = nodp->i_private;
5226		info = nodp->i_sb->s_fs_info;
5227		binder_binderfs_dir_entry_proc = info->proc_log_dir;
5228	} else {
5229		binder_dev = container_of(filp->private_data,
5230					  struct binder_device, miscdev);
5231	}
 
5232	proc->context = &binder_dev->context;
5233	binder_alloc_init(&proc->alloc);
5234
5235	binder_stats_created(BINDER_STAT_PROC);
5236	proc->pid = current->group_leader->pid;
5237	INIT_LIST_HEAD(&proc->delivered_death);
5238	INIT_LIST_HEAD(&proc->waiting_threads);
5239	filp->private_data = proc;
5240
5241	mutex_lock(&binder_procs_lock);
 
 
 
 
 
 
5242	hlist_add_head(&proc->proc_node, &binder_procs);
5243	mutex_unlock(&binder_procs_lock);
5244
5245	if (binder_debugfs_dir_entry_proc) {
5246		char strbuf[11];
5247
5248		snprintf(strbuf, sizeof(strbuf), "%u", proc->pid);
5249		/*
5250		 * proc debug entries are shared between contexts, so
5251		 * this will fail if the process tries to open the driver
5252		 * again with a different context. The priting code will
5253		 * anyway print all contexts that a given PID has, so this
5254		 * is not a problem.
5255		 */
5256		proc->debugfs_entry = debugfs_create_file(strbuf, 0444,
5257			binder_debugfs_dir_entry_proc,
5258			(void *)(unsigned long)proc->pid,
5259			&proc_fops);
5260	}
5261
5262	if (binder_binderfs_dir_entry_proc) {
5263		char strbuf[11];
5264		struct dentry *binderfs_entry;
5265
5266		snprintf(strbuf, sizeof(strbuf), "%u", proc->pid);
5267		/*
5268		 * Similar to debugfs, the process specific log file is shared
5269		 * between contexts. If the file has already been created for a
5270		 * process, the following binderfs_create_file() call will
5271		 * fail with error code EEXIST if another context of the same
5272		 * process invoked binder_open(). This is ok since same as
5273		 * debugfs, the log file will contain information on all
5274		 * contexts of a given PID.
5275		 */
5276		binderfs_entry = binderfs_create_file(binder_binderfs_dir_entry_proc,
5277			strbuf, &proc_fops, (void *)(unsigned long)proc->pid);
5278		if (!IS_ERR(binderfs_entry)) {
5279			proc->binderfs_entry = binderfs_entry;
5280		} else {
5281			int error;
5282
5283			error = PTR_ERR(binderfs_entry);
5284			if (error != -EEXIST) {
5285				pr_warn("Unable to create file %s in binderfs (error %d)\n",
5286					strbuf, error);
5287			}
5288		}
5289	}
5290
5291	return 0;
5292}
5293
5294static int binder_flush(struct file *filp, fl_owner_t id)
5295{
5296	struct binder_proc *proc = filp->private_data;
5297
5298	binder_defer_work(proc, BINDER_DEFERRED_FLUSH);
5299
5300	return 0;
5301}
5302
5303static void binder_deferred_flush(struct binder_proc *proc)
5304{
5305	struct rb_node *n;
5306	int wake_count = 0;
5307
5308	binder_inner_proc_lock(proc);
5309	for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) {
5310		struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node);
5311
5312		thread->looper_need_return = true;
5313		if (thread->looper & BINDER_LOOPER_STATE_WAITING) {
5314			wake_up_interruptible(&thread->wait);
5315			wake_count++;
5316		}
5317	}
5318	binder_inner_proc_unlock(proc);
5319
5320	binder_debug(BINDER_DEBUG_OPEN_CLOSE,
5321		     "binder_flush: %d woke %d threads\n", proc->pid,
5322		     wake_count);
5323}
5324
5325static int binder_release(struct inode *nodp, struct file *filp)
5326{
5327	struct binder_proc *proc = filp->private_data;
5328
5329	debugfs_remove(proc->debugfs_entry);
5330
5331	if (proc->binderfs_entry) {
5332		binderfs_remove_file(proc->binderfs_entry);
5333		proc->binderfs_entry = NULL;
5334	}
5335
5336	binder_defer_work(proc, BINDER_DEFERRED_RELEASE);
5337
5338	return 0;
5339}
5340
5341static int binder_node_release(struct binder_node *node, int refs)
5342{
5343	struct binder_ref *ref;
5344	int death = 0;
5345	struct binder_proc *proc = node->proc;
5346
5347	binder_release_work(proc, &node->async_todo);
5348
5349	binder_node_lock(node);
5350	binder_inner_proc_lock(proc);
5351	binder_dequeue_work_ilocked(&node->work);
5352	/*
5353	 * The caller must have taken a temporary ref on the node,
5354	 */
5355	BUG_ON(!node->tmp_refs);
5356	if (hlist_empty(&node->refs) && node->tmp_refs == 1) {
5357		binder_inner_proc_unlock(proc);
5358		binder_node_unlock(node);
5359		binder_free_node(node);
5360
5361		return refs;
5362	}
5363
5364	node->proc = NULL;
5365	node->local_strong_refs = 0;
5366	node->local_weak_refs = 0;
5367	binder_inner_proc_unlock(proc);
5368
5369	spin_lock(&binder_dead_nodes_lock);
5370	hlist_add_head(&node->dead_node, &binder_dead_nodes);
5371	spin_unlock(&binder_dead_nodes_lock);
5372
5373	hlist_for_each_entry(ref, &node->refs, node_entry) {
5374		refs++;
5375		/*
5376		 * Need the node lock to synchronize
5377		 * with new notification requests and the
5378		 * inner lock to synchronize with queued
5379		 * death notifications.
5380		 */
5381		binder_inner_proc_lock(ref->proc);
5382		if (!ref->death) {
5383			binder_inner_proc_unlock(ref->proc);
5384			continue;
5385		}
5386
5387		death++;
5388
5389		BUG_ON(!list_empty(&ref->death->work.entry));
5390		ref->death->work.type = BINDER_WORK_DEAD_BINDER;
5391		binder_enqueue_work_ilocked(&ref->death->work,
5392					    &ref->proc->todo);
5393		binder_wakeup_proc_ilocked(ref->proc);
5394		binder_inner_proc_unlock(ref->proc);
5395	}
5396
5397	binder_debug(BINDER_DEBUG_DEAD_BINDER,
5398		     "node %d now dead, refs %d, death %d\n",
5399		     node->debug_id, refs, death);
5400	binder_node_unlock(node);
5401	binder_put_node(node);
5402
5403	return refs;
5404}
5405
5406static void binder_deferred_release(struct binder_proc *proc)
5407{
5408	struct binder_context *context = proc->context;
5409	struct rb_node *n;
5410	int threads, nodes, incoming_refs, outgoing_refs, active_transactions;
5411
5412	mutex_lock(&binder_procs_lock);
5413	hlist_del(&proc->proc_node);
5414	mutex_unlock(&binder_procs_lock);
5415
5416	mutex_lock(&context->context_mgr_node_lock);
5417	if (context->binder_context_mgr_node &&
5418	    context->binder_context_mgr_node->proc == proc) {
5419		binder_debug(BINDER_DEBUG_DEAD_BINDER,
5420			     "%s: %d context_mgr_node gone\n",
5421			     __func__, proc->pid);
5422		context->binder_context_mgr_node = NULL;
5423	}
5424	mutex_unlock(&context->context_mgr_node_lock);
5425	binder_inner_proc_lock(proc);
5426	/*
5427	 * Make sure proc stays alive after we
5428	 * remove all the threads
5429	 */
5430	proc->tmp_ref++;
5431
5432	proc->is_dead = true;
 
 
 
5433	threads = 0;
5434	active_transactions = 0;
5435	while ((n = rb_first(&proc->threads))) {
5436		struct binder_thread *thread;
5437
5438		thread = rb_entry(n, struct binder_thread, rb_node);
5439		binder_inner_proc_unlock(proc);
5440		threads++;
5441		active_transactions += binder_thread_release(proc, thread);
5442		binder_inner_proc_lock(proc);
5443	}
5444
5445	nodes = 0;
5446	incoming_refs = 0;
5447	while ((n = rb_first(&proc->nodes))) {
5448		struct binder_node *node;
5449
5450		node = rb_entry(n, struct binder_node, rb_node);
5451		nodes++;
5452		/*
5453		 * take a temporary ref on the node before
5454		 * calling binder_node_release() which will either
5455		 * kfree() the node or call binder_put_node()
5456		 */
5457		binder_inc_node_tmpref_ilocked(node);
5458		rb_erase(&node->rb_node, &proc->nodes);
5459		binder_inner_proc_unlock(proc);
5460		incoming_refs = binder_node_release(node, incoming_refs);
5461		binder_inner_proc_lock(proc);
5462	}
5463	binder_inner_proc_unlock(proc);
5464
5465	outgoing_refs = 0;
5466	binder_proc_lock(proc);
5467	while ((n = rb_first(&proc->refs_by_desc))) {
5468		struct binder_ref *ref;
5469
5470		ref = rb_entry(n, struct binder_ref, rb_node_desc);
5471		outgoing_refs++;
5472		binder_cleanup_ref_olocked(ref);
5473		binder_proc_unlock(proc);
5474		binder_free_ref(ref);
5475		binder_proc_lock(proc);
5476	}
5477	binder_proc_unlock(proc);
5478
5479	binder_release_work(proc, &proc->todo);
5480	binder_release_work(proc, &proc->delivered_death);
5481
5482	binder_debug(BINDER_DEBUG_OPEN_CLOSE,
5483		     "%s: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d\n",
5484		     __func__, proc->pid, threads, nodes, incoming_refs,
5485		     outgoing_refs, active_transactions);
5486
5487	binder_proc_dec_tmpref(proc);
5488}
5489
5490static void binder_deferred_func(struct work_struct *work)
5491{
5492	struct binder_proc *proc;
5493
5494	int defer;
5495
5496	do {
5497		mutex_lock(&binder_deferred_lock);
5498		if (!hlist_empty(&binder_deferred_list)) {
5499			proc = hlist_entry(binder_deferred_list.first,
5500					struct binder_proc, deferred_work_node);
5501			hlist_del_init(&proc->deferred_work_node);
5502			defer = proc->deferred_work;
5503			proc->deferred_work = 0;
5504		} else {
5505			proc = NULL;
5506			defer = 0;
5507		}
5508		mutex_unlock(&binder_deferred_lock);
5509
5510		if (defer & BINDER_DEFERRED_FLUSH)
5511			binder_deferred_flush(proc);
5512
5513		if (defer & BINDER_DEFERRED_RELEASE)
5514			binder_deferred_release(proc); /* frees proc */
5515	} while (proc);
5516}
5517static DECLARE_WORK(binder_deferred_work, binder_deferred_func);
5518
5519static void
5520binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer)
5521{
5522	mutex_lock(&binder_deferred_lock);
5523	proc->deferred_work |= defer;
5524	if (hlist_unhashed(&proc->deferred_work_node)) {
5525		hlist_add_head(&proc->deferred_work_node,
5526				&binder_deferred_list);
5527		schedule_work(&binder_deferred_work);
5528	}
5529	mutex_unlock(&binder_deferred_lock);
5530}
5531
5532static void print_binder_transaction_ilocked(struct seq_file *m,
5533					     struct binder_proc *proc,
5534					     const char *prefix,
5535					     struct binder_transaction *t)
5536{
5537	struct binder_proc *to_proc;
5538	struct binder_buffer *buffer = t->buffer;
5539
5540	spin_lock(&t->lock);
5541	to_proc = t->to_proc;
5542	seq_printf(m,
5543		   "%s %d: %pK from %d:%d to %d:%d code %x flags %x pri %ld r%d",
5544		   prefix, t->debug_id, t,
5545		   t->from ? t->from->proc->pid : 0,
5546		   t->from ? t->from->pid : 0,
5547		   to_proc ? to_proc->pid : 0,
5548		   t->to_thread ? t->to_thread->pid : 0,
5549		   t->code, t->flags, t->priority, t->need_reply);
5550	spin_unlock(&t->lock);
5551
5552	if (proc != to_proc) {
5553		/*
5554		 * Can only safely deref buffer if we are holding the
5555		 * correct proc inner lock for this node
5556		 */
5557		seq_puts(m, "\n");
5558		return;
5559	}
5560
5561	if (buffer == NULL) {
5562		seq_puts(m, " buffer free\n");
5563		return;
5564	}
5565	if (buffer->target_node)
5566		seq_printf(m, " node %d", buffer->target_node->debug_id);
5567	seq_printf(m, " size %zd:%zd data %pK\n",
5568		   buffer->data_size, buffer->offsets_size,
5569		   buffer->user_data);
5570}
5571
5572static void print_binder_work_ilocked(struct seq_file *m,
5573				     struct binder_proc *proc,
5574				     const char *prefix,
5575				     const char *transaction_prefix,
5576				     struct binder_work *w)
5577{
5578	struct binder_node *node;
5579	struct binder_transaction *t;
5580
5581	switch (w->type) {
5582	case BINDER_WORK_TRANSACTION:
5583		t = container_of(w, struct binder_transaction, work);
5584		print_binder_transaction_ilocked(
5585				m, proc, transaction_prefix, t);
5586		break;
5587	case BINDER_WORK_RETURN_ERROR: {
5588		struct binder_error *e = container_of(
5589				w, struct binder_error, work);
5590
5591		seq_printf(m, "%stransaction error: %u\n",
5592			   prefix, e->cmd);
5593	} break;
5594	case BINDER_WORK_TRANSACTION_COMPLETE:
5595		seq_printf(m, "%stransaction complete\n", prefix);
5596		break;
5597	case BINDER_WORK_NODE:
5598		node = container_of(w, struct binder_node, work);
5599		seq_printf(m, "%snode work %d: u%016llx c%016llx\n",
5600			   prefix, node->debug_id,
5601			   (u64)node->ptr, (u64)node->cookie);
5602		break;
5603	case BINDER_WORK_DEAD_BINDER:
5604		seq_printf(m, "%shas dead binder\n", prefix);
5605		break;
5606	case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
5607		seq_printf(m, "%shas cleared dead binder\n", prefix);
5608		break;
5609	case BINDER_WORK_CLEAR_DEATH_NOTIFICATION:
5610		seq_printf(m, "%shas cleared death notification\n", prefix);
5611		break;
5612	default:
5613		seq_printf(m, "%sunknown work: type %d\n", prefix, w->type);
5614		break;
5615	}
5616}
5617
5618static void print_binder_thread_ilocked(struct seq_file *m,
5619					struct binder_thread *thread,
5620					int print_always)
5621{
5622	struct binder_transaction *t;
5623	struct binder_work *w;
5624	size_t start_pos = m->count;
5625	size_t header_pos;
5626
5627	seq_printf(m, "  thread %d: l %02x need_return %d tr %d\n",
5628			thread->pid, thread->looper,
5629			thread->looper_need_return,
5630			atomic_read(&thread->tmp_ref));
5631	header_pos = m->count;
5632	t = thread->transaction_stack;
5633	while (t) {
5634		if (t->from == thread) {
5635			print_binder_transaction_ilocked(m, thread->proc,
5636					"    outgoing transaction", t);
5637			t = t->from_parent;
5638		} else if (t->to_thread == thread) {
5639			print_binder_transaction_ilocked(m, thread->proc,
5640						 "    incoming transaction", t);
5641			t = t->to_parent;
5642		} else {
5643			print_binder_transaction_ilocked(m, thread->proc,
5644					"    bad transaction", t);
5645			t = NULL;
5646		}
5647	}
5648	list_for_each_entry(w, &thread->todo, entry) {
5649		print_binder_work_ilocked(m, thread->proc, "    ",
5650					  "    pending transaction", w);
5651	}
5652	if (!print_always && m->count == header_pos)
5653		m->count = start_pos;
5654}
5655
5656static void print_binder_node_nilocked(struct seq_file *m,
5657				       struct binder_node *node)
5658{
5659	struct binder_ref *ref;
5660	struct binder_work *w;
5661	int count;
5662
5663	count = 0;
5664	hlist_for_each_entry(ref, &node->refs, node_entry)
5665		count++;
5666
5667	seq_printf(m, "  node %d: u%016llx c%016llx hs %d hw %d ls %d lw %d is %d iw %d tr %d",
5668		   node->debug_id, (u64)node->ptr, (u64)node->cookie,
5669		   node->has_strong_ref, node->has_weak_ref,
5670		   node->local_strong_refs, node->local_weak_refs,
5671		   node->internal_strong_refs, count, node->tmp_refs);
5672	if (count) {
5673		seq_puts(m, " proc");
5674		hlist_for_each_entry(ref, &node->refs, node_entry)
5675			seq_printf(m, " %d", ref->proc->pid);
5676	}
5677	seq_puts(m, "\n");
5678	if (node->proc) {
5679		list_for_each_entry(w, &node->async_todo, entry)
5680			print_binder_work_ilocked(m, node->proc, "    ",
5681					  "    pending async transaction", w);
5682	}
5683}
5684
5685static void print_binder_ref_olocked(struct seq_file *m,
5686				     struct binder_ref *ref)
5687{
5688	binder_node_lock(ref->node);
5689	seq_printf(m, "  ref %d: desc %d %snode %d s %d w %d d %pK\n",
5690		   ref->data.debug_id, ref->data.desc,
5691		   ref->node->proc ? "" : "dead ",
5692		   ref->node->debug_id, ref->data.strong,
5693		   ref->data.weak, ref->death);
5694	binder_node_unlock(ref->node);
5695}
5696
5697static void print_binder_proc(struct seq_file *m,
5698			      struct binder_proc *proc, int print_all)
5699{
5700	struct binder_work *w;
5701	struct rb_node *n;
5702	size_t start_pos = m->count;
5703	size_t header_pos;
5704	struct binder_node *last_node = NULL;
5705
5706	seq_printf(m, "proc %d\n", proc->pid);
5707	seq_printf(m, "context %s\n", proc->context->name);
5708	header_pos = m->count;
5709
5710	binder_inner_proc_lock(proc);
5711	for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n))
5712		print_binder_thread_ilocked(m, rb_entry(n, struct binder_thread,
5713						rb_node), print_all);
5714
5715	for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) {
5716		struct binder_node *node = rb_entry(n, struct binder_node,
5717						    rb_node);
5718		if (!print_all && !node->has_async_transaction)
5719			continue;
5720
5721		/*
5722		 * take a temporary reference on the node so it
5723		 * survives and isn't removed from the tree
5724		 * while we print it.
5725		 */
5726		binder_inc_node_tmpref_ilocked(node);
5727		/* Need to drop inner lock to take node lock */
5728		binder_inner_proc_unlock(proc);
5729		if (last_node)
5730			binder_put_node(last_node);
5731		binder_node_inner_lock(node);
5732		print_binder_node_nilocked(m, node);
5733		binder_node_inner_unlock(node);
5734		last_node = node;
5735		binder_inner_proc_lock(proc);
5736	}
5737	binder_inner_proc_unlock(proc);
5738	if (last_node)
5739		binder_put_node(last_node);
5740
5741	if (print_all) {
5742		binder_proc_lock(proc);
5743		for (n = rb_first(&proc->refs_by_desc);
5744		     n != NULL;
5745		     n = rb_next(n))
5746			print_binder_ref_olocked(m, rb_entry(n,
5747							    struct binder_ref,
5748							    rb_node_desc));
5749		binder_proc_unlock(proc);
5750	}
5751	binder_alloc_print_allocated(m, &proc->alloc);
5752	binder_inner_proc_lock(proc);
5753	list_for_each_entry(w, &proc->todo, entry)
5754		print_binder_work_ilocked(m, proc, "  ",
5755					  "  pending transaction", w);
5756	list_for_each_entry(w, &proc->delivered_death, entry) {
5757		seq_puts(m, "  has delivered dead binder\n");
5758		break;
5759	}
5760	binder_inner_proc_unlock(proc);
5761	if (!print_all && m->count == header_pos)
5762		m->count = start_pos;
5763}
5764
5765static const char * const binder_return_strings[] = {
5766	"BR_ERROR",
5767	"BR_OK",
5768	"BR_TRANSACTION",
5769	"BR_REPLY",
5770	"BR_ACQUIRE_RESULT",
5771	"BR_DEAD_REPLY",
5772	"BR_TRANSACTION_COMPLETE",
5773	"BR_INCREFS",
5774	"BR_ACQUIRE",
5775	"BR_RELEASE",
5776	"BR_DECREFS",
5777	"BR_ATTEMPT_ACQUIRE",
5778	"BR_NOOP",
5779	"BR_SPAWN_LOOPER",
5780	"BR_FINISHED",
5781	"BR_DEAD_BINDER",
5782	"BR_CLEAR_DEATH_NOTIFICATION_DONE",
5783	"BR_FAILED_REPLY"
 
 
5784};
5785
5786static const char * const binder_command_strings[] = {
5787	"BC_TRANSACTION",
5788	"BC_REPLY",
5789	"BC_ACQUIRE_RESULT",
5790	"BC_FREE_BUFFER",
5791	"BC_INCREFS",
5792	"BC_ACQUIRE",
5793	"BC_RELEASE",
5794	"BC_DECREFS",
5795	"BC_INCREFS_DONE",
5796	"BC_ACQUIRE_DONE",
5797	"BC_ATTEMPT_ACQUIRE",
5798	"BC_REGISTER_LOOPER",
5799	"BC_ENTER_LOOPER",
5800	"BC_EXIT_LOOPER",
5801	"BC_REQUEST_DEATH_NOTIFICATION",
5802	"BC_CLEAR_DEATH_NOTIFICATION",
5803	"BC_DEAD_BINDER_DONE",
5804	"BC_TRANSACTION_SG",
5805	"BC_REPLY_SG",
5806};
5807
5808static const char * const binder_objstat_strings[] = {
5809	"proc",
5810	"thread",
5811	"node",
5812	"ref",
5813	"death",
5814	"transaction",
5815	"transaction_complete"
5816};
5817
5818static void print_binder_stats(struct seq_file *m, const char *prefix,
5819			       struct binder_stats *stats)
5820{
5821	int i;
5822
5823	BUILD_BUG_ON(ARRAY_SIZE(stats->bc) !=
5824		     ARRAY_SIZE(binder_command_strings));
5825	for (i = 0; i < ARRAY_SIZE(stats->bc); i++) {
5826		int temp = atomic_read(&stats->bc[i]);
5827
5828		if (temp)
5829			seq_printf(m, "%s%s: %d\n", prefix,
5830				   binder_command_strings[i], temp);
5831	}
5832
5833	BUILD_BUG_ON(ARRAY_SIZE(stats->br) !=
5834		     ARRAY_SIZE(binder_return_strings));
5835	for (i = 0; i < ARRAY_SIZE(stats->br); i++) {
5836		int temp = atomic_read(&stats->br[i]);
5837
5838		if (temp)
5839			seq_printf(m, "%s%s: %d\n", prefix,
5840				   binder_return_strings[i], temp);
5841	}
5842
5843	BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) !=
5844		     ARRAY_SIZE(binder_objstat_strings));
5845	BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) !=
5846		     ARRAY_SIZE(stats->obj_deleted));
5847	for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) {
5848		int created = atomic_read(&stats->obj_created[i]);
5849		int deleted = atomic_read(&stats->obj_deleted[i]);
5850
5851		if (created || deleted)
5852			seq_printf(m, "%s%s: active %d total %d\n",
5853				prefix,
5854				binder_objstat_strings[i],
5855				created - deleted,
5856				created);
5857	}
5858}
5859
5860static void print_binder_proc_stats(struct seq_file *m,
5861				    struct binder_proc *proc)
5862{
5863	struct binder_work *w;
5864	struct binder_thread *thread;
5865	struct rb_node *n;
5866	int count, strong, weak, ready_threads;
5867	size_t free_async_space =
5868		binder_alloc_get_free_async_space(&proc->alloc);
5869
5870	seq_printf(m, "proc %d\n", proc->pid);
5871	seq_printf(m, "context %s\n", proc->context->name);
5872	count = 0;
5873	ready_threads = 0;
5874	binder_inner_proc_lock(proc);
5875	for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n))
5876		count++;
5877
5878	list_for_each_entry(thread, &proc->waiting_threads, waiting_thread_node)
5879		ready_threads++;
5880
5881	seq_printf(m, "  threads: %d\n", count);
5882	seq_printf(m, "  requested threads: %d+%d/%d\n"
5883			"  ready threads %d\n"
5884			"  free async space %zd\n", proc->requested_threads,
5885			proc->requested_threads_started, proc->max_threads,
5886			ready_threads,
5887			free_async_space);
5888	count = 0;
5889	for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n))
5890		count++;
5891	binder_inner_proc_unlock(proc);
5892	seq_printf(m, "  nodes: %d\n", count);
5893	count = 0;
5894	strong = 0;
5895	weak = 0;
5896	binder_proc_lock(proc);
5897	for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) {
5898		struct binder_ref *ref = rb_entry(n, struct binder_ref,
5899						  rb_node_desc);
5900		count++;
5901		strong += ref->data.strong;
5902		weak += ref->data.weak;
5903	}
5904	binder_proc_unlock(proc);
5905	seq_printf(m, "  refs: %d s %d w %d\n", count, strong, weak);
5906
5907	count = binder_alloc_get_allocated_count(&proc->alloc);
5908	seq_printf(m, "  buffers: %d\n", count);
5909
5910	binder_alloc_print_pages(m, &proc->alloc);
5911
5912	count = 0;
5913	binder_inner_proc_lock(proc);
5914	list_for_each_entry(w, &proc->todo, entry) {
5915		if (w->type == BINDER_WORK_TRANSACTION)
5916			count++;
5917	}
5918	binder_inner_proc_unlock(proc);
5919	seq_printf(m, "  pending transactions: %d\n", count);
5920
5921	print_binder_stats(m, "  ", &proc->stats);
5922}
5923
5924
5925int binder_state_show(struct seq_file *m, void *unused)
5926{
5927	struct binder_proc *proc;
5928	struct binder_node *node;
5929	struct binder_node *last_node = NULL;
5930
5931	seq_puts(m, "binder state:\n");
5932
5933	spin_lock(&binder_dead_nodes_lock);
5934	if (!hlist_empty(&binder_dead_nodes))
5935		seq_puts(m, "dead nodes:\n");
5936	hlist_for_each_entry(node, &binder_dead_nodes, dead_node) {
5937		/*
5938		 * take a temporary reference on the node so it
5939		 * survives and isn't removed from the list
5940		 * while we print it.
5941		 */
5942		node->tmp_refs++;
5943		spin_unlock(&binder_dead_nodes_lock);
5944		if (last_node)
5945			binder_put_node(last_node);
5946		binder_node_lock(node);
5947		print_binder_node_nilocked(m, node);
5948		binder_node_unlock(node);
5949		last_node = node;
5950		spin_lock(&binder_dead_nodes_lock);
5951	}
5952	spin_unlock(&binder_dead_nodes_lock);
5953	if (last_node)
5954		binder_put_node(last_node);
5955
5956	mutex_lock(&binder_procs_lock);
5957	hlist_for_each_entry(proc, &binder_procs, proc_node)
5958		print_binder_proc(m, proc, 1);
5959	mutex_unlock(&binder_procs_lock);
5960
5961	return 0;
5962}
5963
5964int binder_stats_show(struct seq_file *m, void *unused)
5965{
5966	struct binder_proc *proc;
5967
5968	seq_puts(m, "binder stats:\n");
5969
5970	print_binder_stats(m, "", &binder_stats);
5971
5972	mutex_lock(&binder_procs_lock);
5973	hlist_for_each_entry(proc, &binder_procs, proc_node)
5974		print_binder_proc_stats(m, proc);
5975	mutex_unlock(&binder_procs_lock);
5976
5977	return 0;
5978}
5979
5980int binder_transactions_show(struct seq_file *m, void *unused)
5981{
5982	struct binder_proc *proc;
5983
5984	seq_puts(m, "binder transactions:\n");
5985	mutex_lock(&binder_procs_lock);
5986	hlist_for_each_entry(proc, &binder_procs, proc_node)
5987		print_binder_proc(m, proc, 0);
5988	mutex_unlock(&binder_procs_lock);
5989
5990	return 0;
5991}
5992
5993static int proc_show(struct seq_file *m, void *unused)
5994{
5995	struct binder_proc *itr;
5996	int pid = (unsigned long)m->private;
5997
5998	mutex_lock(&binder_procs_lock);
5999	hlist_for_each_entry(itr, &binder_procs, proc_node) {
6000		if (itr->pid == pid) {
6001			seq_puts(m, "binder proc state:\n");
6002			print_binder_proc(m, itr, 1);
6003		}
6004	}
6005	mutex_unlock(&binder_procs_lock);
6006
6007	return 0;
6008}
6009
6010static void print_binder_transaction_log_entry(struct seq_file *m,
6011					struct binder_transaction_log_entry *e)
6012{
6013	int debug_id = READ_ONCE(e->debug_id_done);
6014	/*
6015	 * read barrier to guarantee debug_id_done read before
6016	 * we print the log values
6017	 */
6018	smp_rmb();
6019	seq_printf(m,
6020		   "%d: %s from %d:%d to %d:%d context %s node %d handle %d size %d:%d ret %d/%d l=%d",
6021		   e->debug_id, (e->call_type == 2) ? "reply" :
6022		   ((e->call_type == 1) ? "async" : "call "), e->from_proc,
6023		   e->from_thread, e->to_proc, e->to_thread, e->context_name,
6024		   e->to_node, e->target_handle, e->data_size, e->offsets_size,
6025		   e->return_error, e->return_error_param,
6026		   e->return_error_line);
6027	/*
6028	 * read-barrier to guarantee read of debug_id_done after
6029	 * done printing the fields of the entry
6030	 */
6031	smp_rmb();
6032	seq_printf(m, debug_id && debug_id == READ_ONCE(e->debug_id_done) ?
6033			"\n" : " (incomplete)\n");
6034}
6035
6036int binder_transaction_log_show(struct seq_file *m, void *unused)
6037{
6038	struct binder_transaction_log *log = m->private;
6039	unsigned int log_cur = atomic_read(&log->cur);
6040	unsigned int count;
6041	unsigned int cur;
6042	int i;
6043
6044	count = log_cur + 1;
6045	cur = count < ARRAY_SIZE(log->entry) && !log->full ?
6046		0 : count % ARRAY_SIZE(log->entry);
6047	if (count > ARRAY_SIZE(log->entry) || log->full)
6048		count = ARRAY_SIZE(log->entry);
6049	for (i = 0; i < count; i++) {
6050		unsigned int index = cur++ % ARRAY_SIZE(log->entry);
6051
6052		print_binder_transaction_log_entry(m, &log->entry[index]);
6053	}
6054	return 0;
6055}
6056
6057const struct file_operations binder_fops = {
6058	.owner = THIS_MODULE,
6059	.poll = binder_poll,
6060	.unlocked_ioctl = binder_ioctl,
6061	.compat_ioctl = binder_ioctl,
6062	.mmap = binder_mmap,
6063	.open = binder_open,
6064	.flush = binder_flush,
6065	.release = binder_release,
6066};
6067
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
6068static int __init init_binder_device(const char *name)
6069{
6070	int ret;
6071	struct binder_device *binder_device;
6072
6073	binder_device = kzalloc(sizeof(*binder_device), GFP_KERNEL);
6074	if (!binder_device)
6075		return -ENOMEM;
6076
6077	binder_device->miscdev.fops = &binder_fops;
6078	binder_device->miscdev.minor = MISC_DYNAMIC_MINOR;
6079	binder_device->miscdev.name = name;
6080
 
6081	binder_device->context.binder_context_mgr_uid = INVALID_UID;
6082	binder_device->context.name = name;
6083	mutex_init(&binder_device->context.context_mgr_node_lock);
6084
6085	ret = misc_register(&binder_device->miscdev);
6086	if (ret < 0) {
6087		kfree(binder_device);
6088		return ret;
6089	}
6090
6091	hlist_add_head(&binder_device->hlist, &binder_devices);
6092
6093	return ret;
6094}
6095
6096static int __init binder_init(void)
6097{
6098	int ret;
6099	char *device_name, *device_tmp;
6100	struct binder_device *device;
6101	struct hlist_node *tmp;
6102	char *device_names = NULL;
6103
6104	ret = binder_alloc_shrinker_init();
6105	if (ret)
6106		return ret;
6107
6108	atomic_set(&binder_transaction_log.cur, ~0U);
6109	atomic_set(&binder_transaction_log_failed.cur, ~0U);
6110
6111	binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL);
6112	if (binder_debugfs_dir_entry_root)
 
 
 
 
 
 
 
 
 
6113		binder_debugfs_dir_entry_proc = debugfs_create_dir("proc",
6114						 binder_debugfs_dir_entry_root);
6115
6116	if (binder_debugfs_dir_entry_root) {
6117		debugfs_create_file("state",
6118				    0444,
6119				    binder_debugfs_dir_entry_root,
6120				    NULL,
6121				    &binder_state_fops);
6122		debugfs_create_file("stats",
6123				    0444,
6124				    binder_debugfs_dir_entry_root,
6125				    NULL,
6126				    &binder_stats_fops);
6127		debugfs_create_file("transactions",
6128				    0444,
6129				    binder_debugfs_dir_entry_root,
6130				    NULL,
6131				    &binder_transactions_fops);
6132		debugfs_create_file("transaction_log",
6133				    0444,
6134				    binder_debugfs_dir_entry_root,
6135				    &binder_transaction_log,
6136				    &binder_transaction_log_fops);
6137		debugfs_create_file("failed_transaction_log",
6138				    0444,
6139				    binder_debugfs_dir_entry_root,
6140				    &binder_transaction_log_failed,
6141				    &binder_transaction_log_fops);
6142	}
6143
6144	if (!IS_ENABLED(CONFIG_ANDROID_BINDERFS) &&
6145	    strcmp(binder_devices_param, "") != 0) {
6146		/*
6147		* Copy the module_parameter string, because we don't want to
6148		* tokenize it in-place.
6149		 */
6150		device_names = kstrdup(binder_devices_param, GFP_KERNEL);
6151		if (!device_names) {
6152			ret = -ENOMEM;
6153			goto err_alloc_device_names_failed;
6154		}
6155
6156		device_tmp = device_names;
6157		while ((device_name = strsep(&device_tmp, ","))) {
6158			ret = init_binder_device(device_name);
6159			if (ret)
6160				goto err_init_binder_device_failed;
6161		}
6162	}
6163
6164	ret = init_binderfs();
6165	if (ret)
6166		goto err_init_binder_device_failed;
6167
6168	return ret;
6169
6170err_init_binder_device_failed:
6171	hlist_for_each_entry_safe(device, tmp, &binder_devices, hlist) {
6172		misc_deregister(&device->miscdev);
6173		hlist_del(&device->hlist);
6174		kfree(device);
6175	}
6176
6177	kfree(device_names);
6178
6179err_alloc_device_names_failed:
6180	debugfs_remove_recursive(binder_debugfs_dir_entry_root);
6181
6182	return ret;
6183}
6184
6185device_initcall(binder_init);
6186
6187#define CREATE_TRACE_POINTS
6188#include "binder_trace.h"
6189
6190MODULE_LICENSE("GPL v2");