drivers/staging/android/binder.c

   1 /* binder.c
   2  *
   3  * Android IPC Subsystem
   4  *
   5  * Copyright (C) 2007-2008 Google, Inc.
   6  *
   7  * This software is licensed under the terms of the GNU General Public
   8  * License version 2, as published by the Free Software Foundation, and
   9  * may be copied, distributed, and modified under those terms.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  */
  17
  18 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  19
  20 #include <asm/cacheflush.h>
  21 #include <linux/fdtable.h>
  22 #include <linux/file.h>
  23 #include <linux/freezer.h>
  24 #include <linux/fs.h>
  25 #include <linux/list.h>
  26 #include <linux/miscdevice.h>
  27 #include <linux/mm.h>
  28 #include <linux/module.h>
  29 #include <linux/mutex.h>
  30 #include <linux/nsproxy.h>
  31 #include <linux/poll.h>
  32 #include <linux/debugfs.h>
  33 #include <linux/rbtree.h>
  34 #include <linux/sched.h>
  35 #include <linux/seq_file.h>
  36 #include <linux/uaccess.h>
  37 #include <linux/vmalloc.h>
  38 #include <linux/slab.h>
  39 #include <linux/pid_namespace.h>
  40
  41 #include "binder.h"
  42 #include "binder_trace.h"
  43
  44 static DEFINE_MUTEX(binder_main_lock);
  45 static DEFINE_MUTEX(binder_deferred_lock);
  46 static DEFINE_MUTEX(binder_mmap_lock);
  47
  48 static HLIST_HEAD(binder_procs);
  49 static HLIST_HEAD(binder_deferred_list);
  50 static HLIST_HEAD(binder_dead_nodes);
  51
  52 static struct dentry *binder_debugfs_dir_entry_root;
  53 static struct dentry *binder_debugfs_dir_entry_proc;
  54 static struct binder_node *binder_context_mgr_node;
  55 static kuid_t binder_context_mgr_uid = INVALID_UID;
  56 static int binder_last_id;
  57 static struct workqueue_struct *binder_deferred_workqueue;
  58
  59 #define BINDER_DEBUG_ENTRY(name) \
  60 static int binder_##name##_open(struct inode *inode, struct file *file) \
  61 { \
  62         return single_open(file, binder_##name##_show, inode->i_private); \
  63 } \
  64 \
  65 static const struct file_operations binder_##name##_fops = { \
  66         .owner = THIS_MODULE, \
  67         .open = binder_##name##_open, \
  68         .read = seq_read, \
  69         .llseek = seq_lseek, \
  70         .release = single_release, \
  71 }
  72
  73 static int binder_proc_show(struct seq_file *m, void *unused);
  74 BINDER_DEBUG_ENTRY(proc);
  75
  76 /* This is only defined in include/asm-arm/sizes.h */
  77 #ifndef SZ_1K
  78 #define SZ_1K                               0x400
  79 #endif
  80
  81 #ifndef SZ_4M
  82 #define SZ_4M                               0x400000
  83 #endif
  84
  85 #define FORBIDDEN_MMAP_FLAGS                (VM_WRITE)
  86
  87 #define BINDER_SMALL_BUF_SIZE (PAGE_SIZE * 64)
  88
  89 enum {
  90         BINDER_DEBUG_USER_ERROR             = 1U << 0,
  91         BINDER_DEBUG_FAILED_TRANSACTION     = 1U << 1,
  92         BINDER_DEBUG_DEAD_TRANSACTION       = 1U << 2,
  93         BINDER_DEBUG_OPEN_CLOSE             = 1U << 3,
  94         BINDER_DEBUG_DEAD_BINDER            = 1U << 4,
  95         BINDER_DEBUG_DEATH_NOTIFICATION     = 1U << 5,
  96         BINDER_DEBUG_READ_WRITE             = 1U << 6,
  97         BINDER_DEBUG_USER_REFS              = 1U << 7,
  98         BINDER_DEBUG_THREADS                = 1U << 8,
  99         BINDER_DEBUG_TRANSACTION            = 1U << 9,
 100         BINDER_DEBUG_TRANSACTION_COMPLETE   = 1U << 10,
 101         BINDER_DEBUG_FREE_BUFFER            = 1U << 11,
 102         BINDER_DEBUG_INTERNAL_REFS          = 1U << 12,
 103         BINDER_DEBUG_BUFFER_ALLOC           = 1U << 13,
 104         BINDER_DEBUG_PRIORITY_CAP           = 1U << 14,
 105         BINDER_DEBUG_BUFFER_ALLOC_ASYNC     = 1U << 15,
 106 };
 107 static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR |
 108         BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION;
 109 module_param_named(debug_mask, binder_debug_mask, uint, S_IWUSR | S_IRUGO);
 110
 111 static bool binder_debug_no_lock;
 112 module_param_named(proc_no_lock, binder_debug_no_lock, bool, S_IWUSR | S_IRUGO);
 113
 114 static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait);
 115 static int binder_stop_on_user_error;
 116
 117 static int binder_set_stop_on_user_error(const char *val,
 118                                          struct kernel_param *kp)
 119 {
 120         int ret;
 121         ret = param_set_int(val, kp);
 122         if (binder_stop_on_user_error < 2)
 123                 wake_up(&binder_user_error_wait);
 124         return ret;
 125 }
 126 module_param_call(stop_on_user_error, binder_set_stop_on_user_error,
 127         param_get_int, &binder_stop_on_user_error, S_IWUSR | S_IRUGO);
 128
 129 #define binder_debug(mask, x...) \
 130         do { \
 131                 if (binder_debug_mask & mask) \
 132                         pr_info(x); \
 133         } while (0)
 134
 135 #define binder_user_error(x...) \
 136         do { \
 137                 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \
 138                         pr_info(x); \
 139                 if (binder_stop_on_user_error) \
 140                         binder_stop_on_user_error = 2; \
 141         } while (0)
 142
 143 enum binder_stat_types {
 144         BINDER_STAT_PROC,
 145         BINDER_STAT_THREAD,
 146         BINDER_STAT_NODE,
 147         BINDER_STAT_REF,
 148         BINDER_STAT_DEATH,
 149         BINDER_STAT_TRANSACTION,
 150         BINDER_STAT_TRANSACTION_COMPLETE,
 151         BINDER_STAT_COUNT
 152 };
 153
 154 struct binder_stats {
 155         int br[_IOC_NR(BR_FAILED_REPLY) + 1];
 156         int bc[_IOC_NR(BC_DEAD_BINDER_DONE) + 1];
 157         int obj_created[BINDER_STAT_COUNT];
 158         int obj_deleted[BINDER_STAT_COUNT];
 159 };
 160
 161 static struct binder_stats binder_stats;
 162
 163 static inline void binder_stats_deleted(enum binder_stat_types type)
 164 {
 165         binder_stats.obj_deleted[type]++;
 166 }
 167
 168 static inline void binder_stats_created(enum binder_stat_types type)
 169 {
 170         binder_stats.obj_created[type]++;
 171 }
 172
 173 struct binder_transaction_log_entry {
 174         int debug_id;
 175         int call_type;
 176         int from_proc;
 177         int from_thread;
 178         int target_handle;
 179         int to_proc;
 180         int to_thread;
 181         int to_node;
 182         int data_size;
 183         int offsets_size;
 184 };
 185 struct binder_transaction_log {
 186         int next;
 187         int full;
 188         struct binder_transaction_log_entry entry[32];
 189 };
 190 static struct binder_transaction_log binder_transaction_log;
 191 static struct binder_transaction_log binder_transaction_log_failed;
 192
 193 static struct binder_transaction_log_entry *binder_transaction_log_add(
 194         struct binder_transaction_log *log)
 195 {
 196         struct binder_transaction_log_entry *e;
 197         e = &log->entry[log->next];
 198         memset(e, 0, sizeof(*e));
 199         log->next++;
 200         if (log->next == ARRAY_SIZE(log->entry)) {
 201                 log->next = 0;
 202                 log->full = 1;
 203         }
 204         return e;
 205 }
 206
 207 struct binder_work {
 208         struct list_head entry;
 209         enum {
 210                 BINDER_WORK_TRANSACTION = 1,
 211                 BINDER_WORK_TRANSACTION_COMPLETE,
 212                 BINDER_WORK_NODE,
 213                 BINDER_WORK_DEAD_BINDER,
 214                 BINDER_WORK_DEAD_BINDER_AND_CLEAR,
 215                 BINDER_WORK_CLEAR_DEATH_NOTIFICATION,
 216         } type;
 217 };
 218
 219 struct binder_node {
 220         int debug_id;
 221         struct binder_work work;
 222         union {
 223                 struct rb_node rb_node;
 224                 struct hlist_node dead_node;
 225         };
 226         struct binder_proc *proc;
 227         struct hlist_head refs;
 228         int internal_strong_refs;
 229         int local_weak_refs;
 230         int local_strong_refs;
 231         void __user *ptr;
 232         void __user *cookie;
 233         unsigned has_strong_ref:1;
 234         unsigned pending_strong_ref:1;
 235         unsigned has_weak_ref:1;
 236         unsigned pending_weak_ref:1;
 237         unsigned has_async_transaction:1;
 238         unsigned accept_fds:1;
 239         unsigned min_priority:8;
 240         struct list_head async_todo;
 241 };
 242
 243 struct binder_ref_death {
 244         struct binder_work work;
 245         void __user *cookie;
 246 };
 247
 248 struct binder_ref {
 249         /* Lookups needed: */
 250         /*   node + proc => ref (transaction) */
 251         /*   desc + proc => ref (transaction, inc/dec ref) */
 252         /*   node => refs + procs (proc exit) */
 253         int debug_id;
 254         struct rb_node rb_node_desc;
 255         struct rb_node rb_node_node;
 256         struct hlist_node node_entry;
 257         struct binder_proc *proc;
 258         struct binder_node *node;
 259         uint32_t desc;
 260         int strong;
 261         int weak;
 262         struct binder_ref_death *death;
 263 };
 264
 265 struct binder_buffer {
 266         struct list_head entry; /* free and allocated entries by address */
 267         struct rb_node rb_node; /* free entry by size or allocated entry */
 268                                 /* by address */
 269         unsigned free:1;
 270         unsigned allow_user_free:1;
 271         unsigned async_transaction:1;
 272         unsigned debug_id:29;
 273
 274         struct binder_transaction *transaction;
 275
 276         struct binder_node *target_node;
 277         size_t data_size;
 278         size_t offsets_size;
 279         uint8_t data[0];
 280 };
 281
 282 enum binder_deferred_state {
 283         BINDER_DEFERRED_PUT_FILES    = 0x01,
 284         BINDER_DEFERRED_FLUSH        = 0x02,
 285         BINDER_DEFERRED_RELEASE      = 0x04,
 286 };
 287
 288 struct binder_proc {
 289         struct hlist_node proc_node;
 290         struct rb_root threads;
 291         struct rb_root nodes;
 292         struct rb_root refs_by_desc;
 293         struct rb_root refs_by_node;
 294         int pid;
 295         struct vm_area_struct *vma;
 296         struct mm_struct *vma_vm_mm;
 297         struct task_struct *tsk;
 298         struct files_struct *files;
 299         struct hlist_node deferred_work_node;
 300         int deferred_work;
 301         void *buffer;
 302         ptrdiff_t user_buffer_offset;
 303
 304         struct list_head buffers;
 305         struct rb_root free_buffers;
 306         struct rb_root allocated_buffers;
 307         size_t free_async_space;
 308
 309         struct page **pages;
 310         size_t buffer_size;
 311         uint32_t buffer_free;
 312         struct list_head todo;
 313         wait_queue_head_t wait;
 314         struct binder_stats stats;
 315         struct list_head delivered_death;
 316         int max_threads;
 317         int requested_threads;
 318         int requested_threads_started;
 319         int ready_threads;
 320         long default_priority;
 321         struct dentry *debugfs_entry;
 322 };
 323
 324 enum {
 325         BINDER_LOOPER_STATE_REGISTERED  = 0x01,
 326         BINDER_LOOPER_STATE_ENTERED     = 0x02,
 327         BINDER_LOOPER_STATE_EXITED      = 0x04,
 328         BINDER_LOOPER_STATE_INVALID     = 0x08,
 329         BINDER_LOOPER_STATE_WAITING     = 0x10,
 330         BINDER_LOOPER_STATE_NEED_RETURN = 0x20
 331 };
 332
 333 struct binder_thread {
 334         struct binder_proc *proc;
 335         struct rb_node rb_node;
 336         int pid;
 337         int looper;
 338         struct binder_transaction *transaction_stack;
 339         struct list_head todo;
 340         uint32_t return_error; /* Write failed, return error code in read buf */
 341         uint32_t return_error2; /* Write failed, return error code in read */
 342                 /* buffer. Used when sending a reply to a dead process that */
 343                 /* we are also waiting on */
 344         wait_queue_head_t wait;
 345         struct binder_stats stats;
 346 };
 347
 348 struct binder_transaction {
 349         int debug_id;
 350         struct binder_work work;
 351         struct binder_thread *from;
 352         struct binder_transaction *from_parent;
 353         struct binder_proc *to_proc;
 354         struct binder_thread *to_thread;
 355         struct binder_transaction *to_parent;
 356         unsigned need_reply:1;
 357         /* unsigned is_dead:1; */       /* not used at the moment */
 358
 359         struct binder_buffer *buffer;
 360         unsigned int    code;
 361         unsigned int    flags;
 362         long    priority;
 363         long    saved_priority;
 364         kuid_t  sender_euid;
 365 };
 366
 367 static void
 368 binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer);
 369
 370 static int task_get_unused_fd_flags(struct binder_proc *proc, int flags)
 371 {
 372         struct files_struct *files = proc->files;
 373         unsigned long rlim_cur;
 374         unsigned long irqs;
 375
 376         if (files == NULL)
 377                 return -ESRCH;
 378
 379         if (!lock_task_sighand(proc->tsk, &irqs))
 380                 return -EMFILE;
 381
 382         rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE);
 383         unlock_task_sighand(proc->tsk, &irqs);
 384
 385         return __alloc_fd(files, 0, rlim_cur, flags);
 386 }
 387
 388 /*
 389  * copied from fd_install
 390  */
 391 static void task_fd_install(
 392         struct binder_proc *proc, unsigned int fd, struct file *file)
 393 {
 394         if (proc->files)
 395                 __fd_install(proc->files, fd, file);
 396 }
 397
 398 /*
 399  * copied from sys_close
 400  */
 401 static long task_close_fd(struct binder_proc *proc, unsigned int fd)
 402 {
 403         int retval;
 404
 405         if (proc->files == NULL)
 406                 return -ESRCH;
 407
 408         retval = __close_fd(proc->files, fd);
 409         /* can't restart close syscall because file table entry was cleared */
 410         if (unlikely(retval == -ERESTARTSYS ||
 411                      retval == -ERESTARTNOINTR ||
 412                      retval == -ERESTARTNOHAND ||
 413                      retval == -ERESTART_RESTARTBLOCK))
 414                 retval = -EINTR;
 415
 416         return retval;
 417 }
 418
 419 static inline void binder_lock(const char *tag)
 420 {
 421         trace_binder_lock(tag);
 422         mutex_lock(&binder_main_lock);
 423         trace_binder_locked(tag);
 424 }
 425
 426 static inline void binder_unlock(const char *tag)
 427 {
 428         trace_binder_unlock(tag);
 429         mutex_unlock(&binder_main_lock);
 430 }
 431
 432 static void binder_set_nice(long nice)
 433 {
 434         long min_nice;
 435         if (can_nice(current, nice)) {
 436                 set_user_nice(current, nice);
 437                 return;
 438         }
 439         min_nice = 20 - current->signal->rlim[RLIMIT_NICE].rlim_cur;
 440         binder_debug(BINDER_DEBUG_PRIORITY_CAP,
 441                      "%d: nice value %ld not allowed use %ld instead\n",
 442                       current->pid, nice, min_nice);
 443         set_user_nice(current, min_nice);
 444         if (min_nice < 20)
 445                 return;
 446         binder_user_error("%d RLIMIT_NICE not set\n", current->pid);
 447 }
 448
 449 static size_t binder_buffer_size(struct binder_proc *proc,
 450                                  struct binder_buffer *buffer)
 451 {
 452         if (list_is_last(&buffer->entry, &proc->buffers))
 453                 return proc->buffer + proc->buffer_size - (void *)buffer->data;
 454         else
 455                 return (size_t)list_entry(buffer->entry.next,
 456                         struct binder_buffer, entry) - (size_t)buffer->data;
 457 }
 458
 459 static void binder_insert_free_buffer(struct binder_proc *proc,
 460                                       struct binder_buffer *new_buffer)
 461 {
 462         struct rb_node **p = &proc->free_buffers.rb_node;
 463         struct rb_node *parent = NULL;
 464         struct binder_buffer *buffer;
 465         size_t buffer_size;
 466         size_t new_buffer_size;
 467
 468         BUG_ON(!new_buffer->free);
 469
 470         new_buffer_size = binder_buffer_size(proc, new_buffer);
 471
 472         binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
 473                      "%d: add free buffer, size %zd, at %p\n",
 474                       proc->pid, new_buffer_size, new_buffer);
 475
 476         while (*p) {
 477                 parent = *p;
 478                 buffer = rb_entry(parent, struct binder_buffer, rb_node);
 479                 BUG_ON(!buffer->free);
 480
 481                 buffer_size = binder_buffer_size(proc, buffer);
 482
 483                 if (new_buffer_size < buffer_size)
 484                         p = &parent->rb_left;
 485                 else
 486                         p = &parent->rb_right;
 487         }
 488         rb_link_node(&new_buffer->rb_node, parent, p);
 489         rb_insert_color(&new_buffer->rb_node, &proc->free_buffers);
 490 }
 491
 492 static void binder_insert_allocated_buffer(struct binder_proc *proc,
 493                                            struct binder_buffer *new_buffer)
 494 {
 495         struct rb_node **p = &proc->allocated_buffers.rb_node;
 496         struct rb_node *parent = NULL;
 497         struct binder_buffer *buffer;
 498
 499         BUG_ON(new_buffer->free);
 500
 501         while (*p) {
 502                 parent = *p;
 503                 buffer = rb_entry(parent, struct binder_buffer, rb_node);
 504                 BUG_ON(buffer->free);
 505
 506                 if (new_buffer < buffer)
 507                         p = &parent->rb_left;
 508                 else if (new_buffer > buffer)
 509                         p = &parent->rb_right;
 510                 else
 511                         BUG();
 512         }
 513         rb_link_node(&new_buffer->rb_node, parent, p);
 514         rb_insert_color(&new_buffer->rb_node, &proc->allocated_buffers);
 515 }
 516
 517 static struct binder_buffer *binder_buffer_lookup(struct binder_proc *proc,
 518                                                   void __user *user_ptr)
 519 {
 520         struct rb_node *n = proc->allocated_buffers.rb_node;
 521         struct binder_buffer *buffer;
 522         struct binder_buffer *kern_ptr;
 523
 524         kern_ptr = user_ptr - proc->user_buffer_offset
 525                 - offsetof(struct binder_buffer, data);
 526
 527         while (n) {
 528                 buffer = rb_entry(n, struct binder_buffer, rb_node);
 529                 BUG_ON(buffer->free);
 530
 531                 if (kern_ptr < buffer)
 532                         n = n->rb_left;
 533                 else if (kern_ptr > buffer)
 534                         n = n->rb_right;
 535                 else
 536                         return buffer;
 537         }
 538         return NULL;
 539 }
 540
 541 static int binder_update_page_range(struct binder_proc *proc, int allocate,
 542                                     void *start, void *end,
 543                                     struct vm_area_struct *vma)
 544 {
 545         void *page_addr;
 546         unsigned long user_page_addr;
 547         struct vm_struct tmp_area;
 548         struct page **page;
 549         struct mm_struct *mm;
 550
 551         binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
 552                      "%d: %s pages %p-%p\n", proc->pid,
 553                      allocate ? "allocate" : "free", start, end);
 554
 555         if (end <= start)
 556                 return 0;
 557
 558         trace_binder_update_page_range(proc, allocate, start, end);
 559
 560         if (vma)
 561                 mm = NULL;
 562         else
 563                 mm = get_task_mm(proc->tsk);
 564
 565         if (mm) {
 566                 down_write(&mm->mmap_sem);
 567                 vma = proc->vma;
 568                 if (vma && mm != proc->vma_vm_mm) {
 569                         pr_err("%d: vma mm and task mm mismatch\n",
 570                                 proc->pid);
 571                         vma = NULL;
 572                 }
 573         }
 574
 575         if (allocate == 0)
 576                 goto free_range;
 577
 578         if (vma == NULL) {
 579                 pr_err("%d: binder_alloc_buf failed to map pages in userspace, no vma\n",
 580                         proc->pid);
 581                 goto err_no_vma;
 582         }
 583
 584         for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) {
 585                 int ret;
 586                 struct page **page_array_ptr;
 587                 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE];
 588
 589                 BUG_ON(*page);
 590                 *page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO);
 591                 if (*page == NULL) {
 592                         pr_err("%d: binder_alloc_buf failed for page at %p\n",
 593                                 proc->pid, page_addr);
 594                         goto err_alloc_page_failed;
 595                 }
 596                 tmp_area.addr = page_addr;
 597                 tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */;
 598                 page_array_ptr = page;
 599                 ret = map_vm_area(&tmp_area, PAGE_KERNEL, &page_array_ptr);
 600                 if (ret) {
 601                         pr_err("%d: binder_alloc_buf failed to map page at %p in kernel\n",
 602                                proc->pid, page_addr);
 603                         goto err_map_kernel_failed;
 604                 }
 605                 user_page_addr =
 606                         (uintptr_t)page_addr + proc->user_buffer_offset;
 607                 ret = vm_insert_page(vma, user_page_addr, page[0]);
 608                 if (ret) {
 609                         pr_err("%d: binder_alloc_buf failed to map page at %lx in userspace\n",
 610                                proc->pid, user_page_addr);
 611                         goto err_vm_insert_page_failed;
 612                 }
 613                 /* vm_insert_page does not seem to increment the refcount */
 614         }
 615         if (mm) {
 616                 up_write(&mm->mmap_sem);
 617                 mmput(mm);
 618         }
 619         return 0;
 620
 621 free_range:
 622         for (page_addr = end - PAGE_SIZE; page_addr >= start;
 623              page_addr -= PAGE_SIZE) {
 624                 page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE];
 625                 if (vma)
 626                         zap_page_range(vma, (uintptr_t)page_addr +
 627                                 proc->user_buffer_offset, PAGE_SIZE, NULL);
 628 err_vm_insert_page_failed:
 629                 unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE);
 630 err_map_kernel_failed:
 631                 __free_page(*page);
 632                 *page = NULL;
 633 err_alloc_page_failed:
 634                 ;
 635         }
 636 err_no_vma:
 637         if (mm) {
 638                 up_write(&mm->mmap_sem);
 639                 mmput(mm);
 640         }
 641         return -ENOMEM;
 642 }
 643
 644 static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc,
 645                                               size_t data_size,
 646                                               size_t offsets_size, int is_async)
 647 {
 648         struct rb_node *n = proc->free_buffers.rb_node;
 649         struct binder_buffer *buffer;
 650         size_t buffer_size;
 651         struct rb_node *best_fit = NULL;
 652         void *has_page_addr;
 653         void *end_page_addr;
 654         size_t size;
 655
 656         if (proc->vma == NULL) {
 657                 pr_err("%d: binder_alloc_buf, no vma\n",
 658                        proc->pid);
 659                 return NULL;
 660         }
 661
 662         size = ALIGN(data_size, sizeof(void *)) +
 663                 ALIGN(offsets_size, sizeof(void *));
 664
 665         if (size < data_size || size < offsets_size) {
 666                 binder_user_error("%d: got transaction with invalid size %zd-%zd\n",
 667                                 proc->pid, data_size, offsets_size);
 668                 return NULL;
 669         }
 670
 671         if (is_async &&
 672             proc->free_async_space < size + sizeof(struct binder_buffer)) {
 673                 binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
 674                              "%d: binder_alloc_buf size %zd failed, no async space left\n",
 675                               proc->pid, size);
 676                 return NULL;
 677         }
 678
 679         while (n) {
 680                 buffer = rb_entry(n, struct binder_buffer, rb_node);
 681                 BUG_ON(!buffer->free);
 682                 buffer_size = binder_buffer_size(proc, buffer);
 683
 684                 if (size < buffer_size) {
 685                         best_fit = n;
 686                         n = n->rb_left;
 687                 } else if (size > buffer_size)
 688                         n = n->rb_right;
 689                 else {
 690                         best_fit = n;
 691                         break;
 692                 }
 693         }
 694         if (best_fit == NULL) {
 695                 pr_err("%d: binder_alloc_buf size %zd failed, no address space\n",
 696                         proc->pid, size);
 697                 return NULL;
 698         }
 699         if (n == NULL) {
 700                 buffer = rb_entry(best_fit, struct binder_buffer, rb_node);
 701                 buffer_size = binder_buffer_size(proc, buffer);
 702         }
 703
 704         binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
 705                      "%d: binder_alloc_buf size %zd got buffer %p size %zd\n",
 706                       proc->pid, size, buffer, buffer_size);
 707
 708         has_page_addr =
 709                 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK);
 710         if (n == NULL) {
 711                 if (size + sizeof(struct binder_buffer) + 4 >= buffer_size)
 712                         buffer_size = size; /* no room for other buffers */
 713                 else
 714                         buffer_size = size + sizeof(struct binder_buffer);
 715         }
 716         end_page_addr =
 717                 (void *)PAGE_ALIGN((uintptr_t)buffer->data + buffer_size);
 718         if (end_page_addr > has_page_addr)
 719                 end_page_addr = has_page_addr;
 720         if (binder_update_page_range(proc, 1,
 721             (void *)PAGE_ALIGN((uintptr_t)buffer->data), end_page_addr, NULL))
 722                 return NULL;
 723
 724         rb_erase(best_fit, &proc->free_buffers);
 725         buffer->free = 0;
 726         binder_insert_allocated_buffer(proc, buffer);
 727         if (buffer_size != size) {
 728                 struct binder_buffer *new_buffer = (void *)buffer->data + size;
 729                 list_add(&new_buffer->entry, &buffer->entry);
 730                 new_buffer->free = 1;
 731                 binder_insert_free_buffer(proc, new_buffer);
 732         }
 733         binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
 734                      "%d: binder_alloc_buf size %zd got %p\n",
 735                       proc->pid, size, buffer);
 736         buffer->data_size = data_size;
 737         buffer->offsets_size = offsets_size;
 738         buffer->async_transaction = is_async;
 739         if (is_async) {
 740                 proc->free_async_space -= size + sizeof(struct binder_buffer);
 741                 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
 742                              "%d: binder_alloc_buf size %zd async free %zd\n",
 743                               proc->pid, size, proc->free_async_space);
 744         }
 745
 746         return buffer;
 747 }
 748
 749 static void *buffer_start_page(struct binder_buffer *buffer)
 750 {
 751         return (void *)((uintptr_t)buffer & PAGE_MASK);
 752 }
 753
 754 static void *buffer_end_page(struct binder_buffer *buffer)
 755 {
 756         return (void *)(((uintptr_t)(buffer + 1) - 1) & PAGE_MASK);
 757 }
 758
 759 static void binder_delete_free_buffer(struct binder_proc *proc,
 760                                       struct binder_buffer *buffer)
 761 {
 762         struct binder_buffer *prev, *next = NULL;
 763         int free_page_end = 1;
 764         int free_page_start = 1;
 765
 766         BUG_ON(proc->buffers.next == &buffer->entry);
 767         prev = list_entry(buffer->entry.prev, struct binder_buffer, entry);
 768         BUG_ON(!prev->free);
 769         if (buffer_end_page(prev) == buffer_start_page(buffer)) {
 770                 free_page_start = 0;
 771                 if (buffer_end_page(prev) == buffer_end_page(buffer))
 772                         free_page_end = 0;
 773                 binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
 774                              "%d: merge free, buffer %p share page with %p\n",
 775                               proc->pid, buffer, prev);
 776         }
 777
 778         if (!list_is_last(&buffer->entry, &proc->buffers)) {
 779                 next = list_entry(buffer->entry.next,
 780                                   struct binder_buffer, entry);
 781                 if (buffer_start_page(next) == buffer_end_page(buffer)) {
 782                         free_page_end = 0;
 783                         if (buffer_start_page(next) ==
 784                             buffer_start_page(buffer))
 785                                 free_page_start = 0;
 786                         binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
 787                                      "%d: merge free, buffer %p share page with %p\n",
 788                                       proc->pid, buffer, prev);
 789                 }
 790         }
 791         list_del(&buffer->entry);
 792         if (free_page_start || free_page_end) {
 793                 binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
 794                              "%d: merge free, buffer %p do not share page%s%s with with %p or %p\n",
 795                              proc->pid, buffer, free_page_start ? "" : " end",
 796                              free_page_end ? "" : " start", prev, next);
 797                 binder_update_page_range(proc, 0, free_page_start ?
 798                         buffer_start_page(buffer) : buffer_end_page(buffer),
 799                         (free_page_end ? buffer_end_page(buffer) :
 800                         buffer_start_page(buffer)) + PAGE_SIZE, NULL);
 801         }
 802 }
 803
 804 static void binder_free_buf(struct binder_proc *proc,
 805                             struct binder_buffer *buffer)
 806 {
 807         size_t size, buffer_size;
 808
 809         buffer_size = binder_buffer_size(proc, buffer);
 810
 811         size = ALIGN(buffer->data_size, sizeof(void *)) +
 812                 ALIGN(buffer->offsets_size, sizeof(void *));
 813
 814         binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
 815                      "%d: binder_free_buf %p size %zd buffer_size %zd\n",
 816                       proc->pid, buffer, size, buffer_size);
 817
 818         BUG_ON(buffer->free);
 819         BUG_ON(size > buffer_size);
 820         BUG_ON(buffer->transaction != NULL);
 821         BUG_ON((void *)buffer < proc->buffer);
 822         BUG_ON((void *)buffer > proc->buffer + proc->buffer_size);
 823
 824         if (buffer->async_transaction) {
 825                 proc->free_async_space += size + sizeof(struct binder_buffer);
 826
 827                 binder_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
 828                              "%d: binder_free_buf size %zd async free %zd\n",
 829                               proc->pid, size, proc->free_async_space);
 830         }
 831
 832         binder_update_page_range(proc, 0,
 833                 (void *)PAGE_ALIGN((uintptr_t)buffer->data),
 834                 (void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK),
 835                 NULL);
 836         rb_erase(&buffer->rb_node, &proc->allocated_buffers);
 837         buffer->free = 1;
 838         if (!list_is_last(&buffer->entry, &proc->buffers)) {
 839                 struct binder_buffer *next = list_entry(buffer->entry.next,
 840                                                 struct binder_buffer, entry);
 841                 if (next->free) {
 842                         rb_erase(&next->rb_node, &proc->free_buffers);
 843                         binder_delete_free_buffer(proc, next);
 844                 }
 845         }
 846         if (proc->buffers.next != &buffer->entry) {
 847                 struct binder_buffer *prev = list_entry(buffer->entry.prev,
 848                                                 struct binder_buffer, entry);
 849                 if (prev->free) {
 850                         binder_delete_free_buffer(proc, buffer);
 851                         rb_erase(&prev->rb_node, &proc->free_buffers);
 852                         buffer = prev;
 853                 }
 854         }
 855         binder_insert_free_buffer(proc, buffer);
 856 }
 857
 858 static struct binder_node *binder_get_node(struct binder_proc *proc,
 859                                            void __user *ptr)
 860 {
 861         struct rb_node *n = proc->nodes.rb_node;
 862         struct binder_node *node;
 863
 864         while (n) {
 865                 node = rb_entry(n, struct binder_node, rb_node);
 866
 867                 if (ptr < node->ptr)
 868                         n = n->rb_left;
 869                 else if (ptr > node->ptr)
 870                         n = n->rb_right;
 871                 else
 872                         return node;
 873         }
 874         return NULL;
 875 }
 876
 877 static struct binder_node *binder_new_node(struct binder_proc *proc,
 878                                            void __user *ptr,
 879                                            void __user *cookie)
 880 {
 881         struct rb_node **p = &proc->nodes.rb_node;
 882         struct rb_node *parent = NULL;
 883         struct binder_node *node;
 884
 885         while (*p) {
 886                 parent = *p;
 887                 node = rb_entry(parent, struct binder_node, rb_node);
 888
 889                 if (ptr < node->ptr)
 890                         p = &(*p)->rb_left;
 891                 else if (ptr > node->ptr)
 892                         p = &(*p)->rb_right;
 893                 else
 894                         return NULL;
 895         }
 896
 897         node = kzalloc(sizeof(*node), GFP_KERNEL);
 898         if (node == NULL)
 899                 return NULL;
 900         binder_stats_created(BINDER_STAT_NODE);
 901         rb_link_node(&node->rb_node, parent, p);
 902         rb_insert_color(&node->rb_node, &proc->nodes);
 903         node->debug_id = ++binder_last_id;
 904         node->proc = proc;
 905         node->ptr = ptr;
 906         node->cookie = cookie;
 907         node->work.type = BINDER_WORK_NODE;
 908         INIT_LIST_HEAD(&node->work.entry);
 909         INIT_LIST_HEAD(&node->async_todo);
 910         binder_debug(BINDER_DEBUG_INTERNAL_REFS,
 911                      "%d:%d node %d u%p c%p created\n",
 912                      proc->pid, current->pid, node->debug_id,
 913                      node->ptr, node->cookie);
 914         return node;
 915 }
 916
 917 static int binder_inc_node(struct binder_node *node, int strong, int internal,
 918                            struct list_head *target_list)
 919 {
 920         if (strong) {
 921                 if (internal) {
 922                         if (target_list == NULL &&
 923                             node->internal_strong_refs == 0 &&
 924                             !(node == binder_context_mgr_node &&
 925                             node->has_strong_ref)) {
 926                                 pr_err("invalid inc strong node for %d\n",
 927                                         node->debug_id);
 928                                 return -EINVAL;
 929                         }
 930                         node->internal_strong_refs++;
 931                 } else
 932                         node->local_strong_refs++;
 933                 if (!node->has_strong_ref && target_list) {
 934                         list_del_init(&node->work.entry);
 935                         list_add_tail(&node->work.entry, target_list);
 936                 }
 937         } else {
 938                 if (!internal)
 939                         node->local_weak_refs++;
 940                 if (!node->has_weak_ref && list_empty(&node->work.entry)) {
 941                         if (target_list == NULL) {
 942                                 pr_err("invalid inc weak node for %d\n",
 943                                         node->debug_id);
 944                                 return -EINVAL;
 945                         }
 946                         list_add_tail(&node->work.entry, target_list);
 947                 }
 948         }
 949         return 0;
 950 }
 951
 952 static int binder_dec_node(struct binder_node *node, int strong, int internal)
 953 {
 954         if (strong) {
 955                 if (internal)
 956                         node->internal_strong_refs--;
 957                 else
 958                         node->local_strong_refs--;
 959                 if (node->local_strong_refs || node->internal_strong_refs)
 960                         return 0;
 961         } else {
 962                 if (!internal)
 963                         node->local_weak_refs--;
 964                 if (node->local_weak_refs || !hlist_empty(&node->refs))
 965                         return 0;
 966         }
 967         if (node->proc && (node->has_strong_ref || node->has_weak_ref)) {
 968                 if (list_empty(&node->work.entry)) {
 969                         list_add_tail(&node->work.entry, &node->proc->todo);
 970                         wake_up_interruptible(&node->proc->wait);
 971                 }
 972         } else {
 973                 if (hlist_empty(&node->refs) && !node->local_strong_refs &&
 974                     !node->local_weak_refs) {
 975                         list_del_init(&node->work.entry);
 976                         if (node->proc) {
 977                                 rb_erase(&node->rb_node, &node->proc->nodes);
 978                                 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
 979                                              "refless node %d deleted\n",
 980                                              node->debug_id);
 981                         } else {
 982                                 hlist_del(&node->dead_node);
 983                                 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
 984                                              "dead node %d deleted\n",
 985                                              node->debug_id);
 986                         }
 987                         kfree(node);
 988                         binder_stats_deleted(BINDER_STAT_NODE);
 989                 }
 990         }
 991
 992         return 0;
 993 }
 994
 995
 996 static struct binder_ref *binder_get_ref(struct binder_proc *proc,
 997                                          uint32_t desc)
 998 {
 999         struct rb_node *n = proc->refs_by_desc.rb_node;
1000         struct binder_ref *ref;
1001
1002         while (n) {
1003                 ref = rb_entry(n, struct binder_ref, rb_node_desc);
1004
1005                 if (desc < ref->desc)
1006                         n = n->rb_left;
1007                 else if (desc > ref->desc)
1008                         n = n->rb_right;
1009                 else
1010                         return ref;
1011         }
1012         return NULL;
1013 }
1014
1015 static struct binder_ref *binder_get_ref_for_node(struct binder_proc *proc,
1016                                                   struct binder_node *node)
1017 {
1018         struct rb_node *n;
1019         struct rb_node **p = &proc->refs_by_node.rb_node;
1020         struct rb_node *parent = NULL;
1021         struct binder_ref *ref, *new_ref;
1022
1023         while (*p) {
1024                 parent = *p;
1025                 ref = rb_entry(parent, struct binder_ref, rb_node_node);
1026
1027                 if (node < ref->node)
1028                         p = &(*p)->rb_left;
1029                 else if (node > ref->node)
1030                         p = &(*p)->rb_right;
1031                 else
1032                         return ref;
1033         }
1034         new_ref = kzalloc(sizeof(*ref), GFP_KERNEL);
1035         if (new_ref == NULL)
1036                 return NULL;
1037         binder_stats_created(BINDER_STAT_REF);
1038         new_ref->debug_id = ++binder_last_id;
1039         new_ref->proc = proc;
1040         new_ref->node = node;
1041         rb_link_node(&new_ref->rb_node_node, parent, p);
1042         rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node);
1043
1044         new_ref->desc = (node == binder_context_mgr_node) ? 0 : 1;
1045         for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) {
1046                 ref = rb_entry(n, struct binder_ref, rb_node_desc);
1047                 if (ref->desc > new_ref->desc)
1048                         break;
1049                 new_ref->desc = ref->desc + 1;
1050         }
1051
1052         p = &proc->refs_by_desc.rb_node;
1053         while (*p) {
1054                 parent = *p;
1055                 ref = rb_entry(parent, struct binder_ref, rb_node_desc);
1056
1057                 if (new_ref->desc < ref->desc)
1058                         p = &(*p)->rb_left;
1059                 else if (new_ref->desc > ref->desc)
1060                         p = &(*p)->rb_right;
1061                 else
1062                         BUG();
1063         }
1064         rb_link_node(&new_ref->rb_node_desc, parent, p);
1065         rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc);
1066         if (node) {
1067                 hlist_add_head(&new_ref->node_entry, &node->refs);
1068
1069                 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1070                              "%d new ref %d desc %d for node %d\n",
1071                               proc->pid, new_ref->debug_id, new_ref->desc,
1072                               node->debug_id);
1073         } else {
1074                 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1075                              "%d new ref %d desc %d for dead node\n",
1076                               proc->pid, new_ref->debug_id, new_ref->desc);
1077         }
1078         return new_ref;
1079 }
1080
1081 static void binder_delete_ref(struct binder_ref *ref)
1082 {
1083         binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1084                      "%d delete ref %d desc %d for node %d\n",
1085                       ref->proc->pid, ref->debug_id, ref->desc,
1086                       ref->node->debug_id);
1087
1088         rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc);
1089         rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node);
1090         if (ref->strong)
1091                 binder_dec_node(ref->node, 1, 1);
1092         hlist_del(&ref->node_entry);
1093         binder_dec_node(ref->node, 0, 1);
1094         if (ref->death) {
1095                 binder_debug(BINDER_DEBUG_DEAD_BINDER,
1096                              "%d delete ref %d desc %d has death notification\n",
1097                               ref->proc->pid, ref->debug_id, ref->desc);
1098                 list_del(&ref->death->work.entry);
1099                 kfree(ref->death);
1100                 binder_stats_deleted(BINDER_STAT_DEATH);
1101         }
1102         kfree(ref);
1103         binder_stats_deleted(BINDER_STAT_REF);
1104 }
1105
1106 static int binder_inc_ref(struct binder_ref *ref, int strong,
1107                           struct list_head *target_list)
1108 {
1109         int ret;
1110         if (strong) {
1111                 if (ref->strong == 0) {
1112                         ret = binder_inc_node(ref->node, 1, 1, target_list);
1113                         if (ret)
1114                                 return ret;
1115                 }
1116                 ref->strong++;
1117         } else {
1118                 if (ref->weak == 0) {
1119                         ret = binder_inc_node(ref->node, 0, 1, target_list);
1120                         if (ret)
1121                                 return ret;
1122                 }
1123                 ref->weak++;
1124         }
1125         return 0;
1126 }
1127
1128
1129 static int binder_dec_ref(struct binder_ref *ref, int strong)
1130 {
1131         if (strong) {
1132                 if (ref->strong == 0) {
1133                         binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n",
1134                                           ref->proc->pid, ref->debug_id,
1135                                           ref->desc, ref->strong, ref->weak);
1136                         return -EINVAL;
1137                 }
1138                 ref->strong--;
1139                 if (ref->strong == 0) {
1140                         int ret;
1141                         ret = binder_dec_node(ref->node, strong, 1);
1142                         if (ret)
1143                                 return ret;
1144                 }
1145         } else {
1146                 if (ref->weak == 0) {
1147                         binder_user_error("%d invalid dec weak, ref %d desc %d s %d w %d\n",
1148                                           ref->proc->pid, ref->debug_id,
1149                                           ref->desc, ref->strong, ref->weak);
1150                         return -EINVAL;
1151                 }
1152                 ref->weak--;
1153         }
1154         if (ref->strong == 0 && ref->weak == 0)
1155                 binder_delete_ref(ref);
1156         return 0;
1157 }
1158
1159 static void binder_pop_transaction(struct binder_thread *target_thread,
1160                                    struct binder_transaction *t)
1161 {
1162         if (target_thread) {
1163                 BUG_ON(target_thread->transaction_stack != t);
1164                 BUG_ON(target_thread->transaction_stack->from != target_thread);
1165                 target_thread->transaction_stack =
1166                         target_thread->transaction_stack->from_parent;
1167                 t->from = NULL;
1168         }
1169         t->need_reply = 0;
1170         if (t->buffer)
1171                 t->buffer->transaction = NULL;
1172         kfree(t);
1173         binder_stats_deleted(BINDER_STAT_TRANSACTION);
1174 }
1175
1176 static void binder_send_failed_reply(struct binder_transaction *t,
1177                                      uint32_t error_code)
1178 {
1179         struct binder_thread *target_thread;
1180         BUG_ON(t->flags & TF_ONE_WAY);
1181         while (1) {
1182                 target_thread = t->from;
1183                 if (target_thread) {
1184                         if (target_thread->return_error != BR_OK &&
1185                            target_thread->return_error2 == BR_OK) {
1186                                 target_thread->return_error2 =
1187                                         target_thread->return_error;
1188                                 target_thread->return_error = BR_OK;
1189                         }
1190                         if (target_thread->return_error == BR_OK) {
1191                                 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
1192                                              "send failed reply for transaction %d to %d:%d\n",
1193                                               t->debug_id, target_thread->proc->pid,
1194                                               target_thread->pid);
1195
1196                                 binder_pop_transaction(target_thread, t);
1197                                 target_thread->return_error = error_code;
1198                                 wake_up_interruptible(&target_thread->wait);
1199                         } else {
1200                                 pr_err("reply failed, target thread, %d:%d, has error code %d already\n",
1201                                         target_thread->proc->pid,
1202                                         target_thread->pid,
1203                                         target_thread->return_error);
1204                         }
1205                         return;
1206                 } else {
1207                         struct binder_transaction *next = t->from_parent;
1208
1209                         binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
1210                                      "send failed reply for transaction %d, target dead\n",
1211                                      t->debug_id);
1212
1213                         binder_pop_transaction(target_thread, t);
1214                         if (next == NULL) {
1215                                 binder_debug(BINDER_DEBUG_DEAD_BINDER,
1216                                              "reply failed, no target thread at root\n");
1217                                 return;
1218                         }
1219                         t = next;
1220                         binder_debug(BINDER_DEBUG_DEAD_BINDER,
1221                                      "reply failed, no target thread -- retry %d\n",
1222                                       t->debug_id);
1223                 }
1224         }
1225 }
1226
1227 static void binder_transaction_buffer_release(struct binder_proc *proc,
1228                                               struct binder_buffer *buffer,
1229                                               size_t *failed_at)
1230 {
1231         size_t *offp, *off_end;
1232         int debug_id = buffer->debug_id;
1233
1234         binder_debug(BINDER_DEBUG_TRANSACTION,
1235                      "%d buffer release %d, size %zd-%zd, failed at %p\n",
1236                      proc->pid, buffer->debug_id,
1237                      buffer->data_size, buffer->offsets_size, failed_at);
1238
1239         if (buffer->target_node)
1240                 binder_dec_node(buffer->target_node, 1, 0);
1241
1242         offp = (size_t *)(buffer->data + ALIGN(buffer->data_size, sizeof(void *)));
1243         if (failed_at)
1244                 off_end = failed_at;
1245         else
1246                 off_end = (void *)offp + buffer->offsets_size;
1247         for (; offp < off_end; offp++) {
1248                 struct flat_binder_object *fp;
1249                 if (*offp > buffer->data_size - sizeof(*fp) ||
1250                     buffer->data_size < sizeof(*fp) ||
1251                     !IS_ALIGNED(*offp, sizeof(void *))) {
1252                         pr_err("transaction release %d bad offset %zd, size %zd\n",
1253                          debug_id, *offp, buffer->data_size);
1254                         continue;
1255                 }
1256                 fp = (struct flat_binder_object *)(buffer->data + *offp);
1257                 switch (fp->type) {
1258                 case BINDER_TYPE_BINDER:
1259                 case BINDER_TYPE_WEAK_BINDER: {
1260                         struct binder_node *node = binder_get_node(proc, fp->binder);
1261                         if (node == NULL) {
1262                                 pr_err("transaction release %d bad node %p\n",
1263                                         debug_id, fp->binder);
1264                                 break;
1265                         }
1266                         binder_debug(BINDER_DEBUG_TRANSACTION,
1267                                      "        node %d u%p\n",
1268                                      node->debug_id, node->ptr);
1269                         binder_dec_node(node, fp->type == BINDER_TYPE_BINDER, 0);
1270                 } break;
1271                 case BINDER_TYPE_HANDLE:
1272                 case BINDER_TYPE_WEAK_HANDLE: {
1273                         struct binder_ref *ref = binder_get_ref(proc, fp->handle);
1274                         if (ref == NULL) {
1275                                 pr_err("transaction release %d bad handle %ld\n",
1276                                  debug_id, fp->handle);
1277                                 break;
1278                         }
1279                         binder_debug(BINDER_DEBUG_TRANSACTION,
1280                                      "        ref %d desc %d (node %d)\n",
1281                                      ref->debug_id, ref->desc, ref->node->debug_id);
1282                         binder_dec_ref(ref, fp->type == BINDER_TYPE_HANDLE);
1283                 } break;
1284
1285                 case BINDER_TYPE_FD:
1286                         binder_debug(BINDER_DEBUG_TRANSACTION,
1287                                      "        fd %ld\n", fp->handle);
1288                         if (failed_at)
1289                                 task_close_fd(proc, fp->handle);
1290                         break;
1291
1292                 default:
1293                         pr_err("transaction release %d bad object type %lx\n",
1294                                 debug_id, fp->type);
1295                         break;
1296                 }
1297         }
1298 }
1299
1300 static void binder_transaction(struct binder_proc *proc,
1301                                struct binder_thread *thread,
1302                                struct binder_transaction_data *tr, int reply)
1303 {
1304         struct binder_transaction *t;
1305         struct binder_work *tcomplete;
1306         size_t *offp, *off_end;
1307         struct binder_proc *target_proc;
1308         struct binder_thread *target_thread = NULL;
1309         struct binder_node *target_node = NULL;
1310         struct list_head *target_list;
1311         wait_queue_head_t *target_wait;
1312         struct binder_transaction *in_reply_to = NULL;
1313         struct binder_transaction_log_entry *e;
1314         uint32_t return_error;
1315
1316         e = binder_transaction_log_add(&binder_transaction_log);
1317         e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY);
1318         e->from_proc = proc->pid;
1319         e->from_thread = thread->pid;
1320         e->target_handle = tr->target.handle;
1321         e->data_size = tr->data_size;
1322         e->offsets_size = tr->offsets_size;
1323
1324         if (reply) {
1325                 in_reply_to = thread->transaction_stack;
1326                 if (in_reply_to == NULL) {
1327                         binder_user_error("%d:%d got reply transaction with no transaction stack\n",
1328                                           proc->pid, thread->pid);
1329                         return_error = BR_FAILED_REPLY;
1330                         goto err_empty_call_stack;
1331                 }
1332                 binder_set_nice(in_reply_to->saved_priority);
1333                 if (in_reply_to->to_thread != thread) {
1334                         binder_user_error("%d:%d got reply transaction with bad transaction stack, transaction %d has target %d:%d\n",
1335                                 proc->pid, thread->pid, in_reply_to->debug_id,
1336                                 in_reply_to->to_proc ?
1337                                 in_reply_to->to_proc->pid : 0,
1338                                 in_reply_to->to_thread ?
1339                                 in_reply_to->to_thread->pid : 0);
1340                         return_error = BR_FAILED_REPLY;
1341                         in_reply_to = NULL;
1342                         goto err_bad_call_stack;
1343                 }
1344                 thread->transaction_stack = in_reply_to->to_parent;
1345                 target_thread = in_reply_to->from;
1346                 if (target_thread == NULL) {
1347                         return_error = BR_DEAD_REPLY;
1348                         goto err_dead_binder;
1349                 }
1350                 if (target_thread->transaction_stack != in_reply_to) {
1351                         binder_user_error("%d:%d got reply transaction with bad target transaction stack %d, expected %d\n",
1352                                 proc->pid, thread->pid,
1353                                 target_thread->transaction_stack ?
1354                                 target_thread->transaction_stack->debug_id : 0,
1355                                 in_reply_to->debug_id);
1356                         return_error = BR_FAILED_REPLY;
1357                         in_reply_to = NULL;
1358                         target_thread = NULL;
1359                         goto err_dead_binder;
1360                 }
1361                 target_proc = target_thread->proc;
1362         } else {
1363                 if (tr->target.handle) {
1364                         struct binder_ref *ref;
1365                         ref = binder_get_ref(proc, tr->target.handle);
1366                         if (ref == NULL) {
1367                                 binder_user_error("%d:%d got transaction to invalid handle\n",
1368                                         proc->pid, thread->pid);
1369                                 return_error = BR_FAILED_REPLY;
1370                                 goto err_invalid_target_handle;
1371                         }
1372                         target_node = ref->node;
1373                 } else {
1374                         target_node = binder_context_mgr_node;
1375                         if (target_node == NULL) {
1376                                 return_error = BR_DEAD_REPLY;
1377                                 goto err_no_context_mgr_node;
1378                         }
1379                 }
1380                 e->to_node = target_node->debug_id;
1381                 target_proc = target_node->proc;
1382                 if (target_proc == NULL) {
1383                         return_error = BR_DEAD_REPLY;
1384                         goto err_dead_binder;
1385                 }
1386                 if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) {
1387                         struct binder_transaction *tmp;
1388                         tmp = thread->transaction_stack;
1389                         if (tmp->to_thread != thread) {
1390                                 binder_user_error("%d:%d got new transaction with bad transaction stack, transaction %d has target %d:%d\n",
1391                                         proc->pid, thread->pid, tmp->debug_id,
1392                                         tmp->to_proc ? tmp->to_proc->pid : 0,
1393                                         tmp->to_thread ?
1394                                         tmp->to_thread->pid : 0);
1395                                 return_error = BR_FAILED_REPLY;
1396                                 goto err_bad_call_stack;
1397                         }
1398                         while (tmp) {
1399                                 if (tmp->from && tmp->from->proc == target_proc)
1400                                         target_thread = tmp->from;
1401                                 tmp = tmp->from_parent;
1402                         }
1403                 }
1404         }
1405         if (target_thread) {
1406                 e->to_thread = target_thread->pid;
1407                 target_list = &target_thread->todo;
1408                 target_wait = &target_thread->wait;
1409         } else {
1410                 target_list = &target_proc->todo;
1411                 target_wait = &target_proc->wait;
1412         }
1413         e->to_proc = target_proc->pid;
1414
1415         /* TODO: reuse incoming transaction for reply */
1416         t = kzalloc(sizeof(*t), GFP_KERNEL);
1417         if (t == NULL) {
1418                 return_error = BR_FAILED_REPLY;
1419                 goto err_alloc_t_failed;
1420         }
1421         binder_stats_created(BINDER_STAT_TRANSACTION);
1422
1423         tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL);
1424         if (tcomplete == NULL) {
1425                 return_error = BR_FAILED_REPLY;
1426                 goto err_alloc_tcomplete_failed;
1427         }
1428         binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE);
1429
1430         t->debug_id = ++binder_last_id;
1431         e->debug_id = t->debug_id;
1432
1433         if (reply)
1434                 binder_debug(BINDER_DEBUG_TRANSACTION,
1435                              "%d:%d BC_REPLY %d -> %d:%d, data %p-%p size %zd-%zd\n",
1436                              proc->pid, thread->pid, t->debug_id,
1437                              target_proc->pid, target_thread->pid,
1438                              tr->data.ptr.buffer, tr->data.ptr.offsets,
1439                              tr->data_size, tr->offsets_size);
1440         else
1441                 binder_debug(BINDER_DEBUG_TRANSACTION,
1442                              "%d:%d BC_TRANSACTION %d -> %d - node %d, data %p-%p size %zd-%zd\n",
1443                              proc->pid, thread->pid, t->debug_id,
1444                              target_proc->pid, target_node->debug_id,
1445                              tr->data.ptr.buffer, tr->data.ptr.offsets,
1446                              tr->data_size, tr->offsets_size);
1447
1448         if (!reply && !(tr->flags & TF_ONE_WAY))
1449                 t->from = thread;
1450         else
1451                 t->from = NULL;
1452         t->sender_euid = proc->tsk->cred->euid;
1453         t->to_proc = target_proc;
1454         t->to_thread = target_thread;
1455         t->code = tr->code;
1456         t->flags = tr->flags;
1457         t->priority = task_nice(current);
1458
1459         trace_binder_transaction(reply, t, target_node);
1460
1461         t->buffer = binder_alloc_buf(target_proc, tr->data_size,
1462                 tr->offsets_size, !reply && (t->flags & TF_ONE_WAY));
1463         if (t->buffer == NULL) {
1464                 return_error = BR_FAILED_REPLY;
1465                 goto err_binder_alloc_buf_failed;
1466         }
1467         t->buffer->allow_user_free = 0;
1468         t->buffer->debug_id = t->debug_id;
1469         t->buffer->transaction = t;
1470         t->buffer->target_node = target_node;
1471         trace_binder_transaction_alloc_buf(t->buffer);
1472         if (target_node)
1473                 binder_inc_node(target_node, 1, 0, NULL);
1474
1475         offp = (size_t *)(t->buffer->data + ALIGN(tr->data_size, sizeof(void *)));
1476
1477         if (copy_from_user(t->buffer->data, tr->data.ptr.buffer, tr->data_size)) {
1478                 binder_user_error("%d:%d got transaction with invalid data ptr\n",
1479                                 proc->pid, thread->pid);
1480                 return_error = BR_FAILED_REPLY;
1481                 goto err_copy_data_failed;
1482         }
1483         if (copy_from_user(offp, tr->data.ptr.offsets, tr->offsets_size)) {
1484                 binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
1485                                 proc->pid, thread->pid);
1486                 return_error = BR_FAILED_REPLY;
1487                 goto err_copy_data_failed;
1488         }
1489         if (!IS_ALIGNED(tr->offsets_size, sizeof(size_t))) {
1490                 binder_user_error("%d:%d got transaction with invalid offsets size, %zd\n",
1491                                 proc->pid, thread->pid, tr->offsets_size);
1492                 return_error = BR_FAILED_REPLY;
1493                 goto err_bad_offset;
1494         }
1495         off_end = (void *)offp + tr->offsets_size;
1496         for (; offp < off_end; offp++) {
1497                 struct flat_binder_object *fp;
1498                 if (*offp > t->buffer->data_size - sizeof(*fp) ||
1499                     t->buffer->data_size < sizeof(*fp) ||
1500                     !IS_ALIGNED(*offp, sizeof(void *))) {
1501                         binder_user_error("%d:%d got transaction with invalid offset, %zd\n",
1502                                         proc->pid, thread->pid, *offp);
1503                         return_error = BR_FAILED_REPLY;
1504                         goto err_bad_offset;
1505                 }
1506                 fp = (struct flat_binder_object *)(t->buffer->data + *offp);
1507                 switch (fp->type) {
1508                 case BINDER_TYPE_BINDER:
1509                 case BINDER_TYPE_WEAK_BINDER: {
1510                         struct binder_ref *ref;
1511                         struct binder_node *node = binder_get_node(proc, fp->binder);
1512                         if (node == NULL) {
1513                                 node = binder_new_node(proc, fp->binder, fp->cookie);
1514                                 if (node == NULL) {
1515                                         return_error = BR_FAILED_REPLY;
1516                                         goto err_binder_new_node_failed;
1517                                 }
1518                                 node->min_priority = fp->flags & FLAT_BINDER_FLAG_PRIORITY_MASK;
1519                                 node->accept_fds = !!(fp->flags & FLAT_BINDER_FLAG_ACCEPTS_FDS);
1520                         }
1521                         if (fp->cookie != node->cookie) {
1522                                 binder_user_error("%d:%d sending u%p node %d, cookie mismatch %p != %p\n",
1523                                         proc->pid, thread->pid,
1524                                         fp->binder, node->debug_id,
1525                                         fp->cookie, node->cookie);
1526                                 goto err_binder_get_ref_for_node_failed;
1527                         }
1528                         ref = binder_get_ref_for_node(target_proc, node);
1529                         if (ref == NULL) {
1530                                 return_error = BR_FAILED_REPLY;
1531                                 goto err_binder_get_ref_for_node_failed;
1532                         }
1533                         if (fp->type == BINDER_TYPE_BINDER)
1534                                 fp->type = BINDER_TYPE_HANDLE;
1535                         else
1536                                 fp->type = BINDER_TYPE_WEAK_HANDLE;
1537                         fp->handle = ref->desc;
1538                         binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE,
1539                                        &thread->todo);
1540
1541                         trace_binder_transaction_node_to_ref(t, node, ref);
1542                         binder_debug(BINDER_DEBUG_TRANSACTION,
1543                                      "        node %d u%p -> ref %d desc %d\n",
1544                                      node->debug_id, node->ptr, ref->debug_id,
1545                                      ref->desc);
1546                 } break;
1547                 case BINDER_TYPE_HANDLE:
1548                 case BINDER_TYPE_WEAK_HANDLE: {
1549                         struct binder_ref *ref = binder_get_ref(proc, fp->handle);
1550                         if (ref == NULL) {
1551                                 binder_user_error("%d:%d got transaction with invalid handle, %ld\n",
1552                                                 proc->pid,
1553                                                 thread->pid, fp->handle);
1554                                 return_error = BR_FAILED_REPLY;
1555                                 goto err_binder_get_ref_failed;
1556                         }
1557                         if (ref->node->proc == target_proc) {
1558                                 if (fp->type == BINDER_TYPE_HANDLE)
1559                                         fp->type = BINDER_TYPE_BINDER;
1560                                 else
1561                                         fp->type = BINDER_TYPE_WEAK_BINDER;
1562                                 fp->binder = ref->node->ptr;
1563                                 fp->cookie = ref->node->cookie;
1564                                 binder_inc_node(ref->node, fp->type == BINDER_TYPE_BINDER, 0, NULL);
1565                                 trace_binder_transaction_ref_to_node(t, ref);
1566                                 binder_debug(BINDER_DEBUG_TRANSACTION,
1567                                              "        ref %d desc %d -> node %d u%p\n",
1568                                              ref->debug_id, ref->desc, ref->node->debug_id,
1569                                              ref->node->ptr);
1570                         } else {
1571                                 struct binder_ref *new_ref;
1572                                 new_ref = binder_get_ref_for_node(target_proc, ref->node);
1573                                 if (new_ref == NULL) {
1574                                         return_error = BR_FAILED_REPLY;
1575                                         goto err_binder_get_ref_for_node_failed;
1576                                 }
1577                                 fp->handle = new_ref->desc;
1578                                 binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL);
1579                                 trace_binder_transaction_ref_to_ref(t, ref,
1580                                                                     new_ref);
1581                                 binder_debug(BINDER_DEBUG_TRANSACTION,
1582                                              "        ref %d desc %d -> ref %d desc %d (node %d)\n",
1583                                              ref->debug_id, ref->desc, new_ref->debug_id,
1584                                              new_ref->desc, ref->node->debug_id);
1585                         }
1586                 } break;
1587
1588                 case BINDER_TYPE_FD: {
1589                         int target_fd;
1590                         struct file *file;
1591
1592                         if (reply) {
1593                                 if (!(in_reply_to->flags & TF_ACCEPT_FDS)) {
1594                                         binder_user_error("%d:%d got reply with fd, %ld, but target does not allow fds\n",
1595                                                 proc->pid, thread->pid, fp->handle);
1596                                         return_error = BR_FAILED_REPLY;
1597                                         goto err_fd_not_allowed;
1598                                 }
1599                         } else if (!target_node->accept_fds) {
1600                                 binder_user_error("%d:%d got transaction with fd, %ld, but target does not allow fds\n",
1601                                         proc->pid, thread->pid, fp->handle);
1602                                 return_error = BR_FAILED_REPLY;
1603                                 goto err_fd_not_allowed;
1604                         }
1605
1606                         file = fget(fp->handle);
1607                         if (file == NULL) {
1608                                 binder_user_error("%d:%d got transaction with invalid fd, %ld\n",
1609                                         proc->pid, thread->pid, fp->handle);
1610                                 return_error = BR_FAILED_REPLY;
1611                                 goto err_fget_failed;
1612                         }
1613                         target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC);
1614                         if (target_fd < 0) {
1615                                 fput(file);
1616                                 return_error = BR_FAILED_REPLY;
1617                                 goto err_get_unused_fd_failed;
1618                         }
1619                         task_fd_install(target_proc, target_fd, file);
1620                         trace_binder_transaction_fd(t, fp->handle, target_fd);
1621                         binder_debug(BINDER_DEBUG_TRANSACTION,
1622                                      "        fd %ld -> %d\n", fp->handle, target_fd);
1623                         /* TODO: fput? */
1624                         fp->handle = target_fd;
1625                 } break;
1626
1627                 default:
1628                         binder_user_error("%d:%d got transaction with invalid object type, %lx\n",
1629                                 proc->pid, thread->pid, fp->type);
1630                         return_error = BR_FAILED_REPLY;
1631                         goto err_bad_object_type;
1632                 }
1633         }
1634         if (reply) {
1635                 BUG_ON(t->buffer->async_transaction != 0);
1636                 binder_pop_transaction(target_thread, in_reply_to);
1637         } else if (!(t->flags & TF_ONE_WAY)) {
1638                 BUG_ON(t->buffer->async_transaction != 0);
1639                 t->need_reply = 1;
1640                 t->from_parent = thread->transaction_stack;
1641                 thread->transaction_stack = t;
1642         } else {
1643                 BUG_ON(target_node == NULL);
1644                 BUG_ON(t->buffer->async_transaction != 1);
1645                 if (target_node->has_async_transaction) {
1646                         target_list = &target_node->async_todo;
1647                         target_wait = NULL;
1648                 } else
1649                         target_node->has_async_transaction = 1;
1650         }
1651         t->work.type = BINDER_WORK_TRANSACTION;
1652         list_add_tail(&t->work.entry, target_list);
1653         tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
1654         list_add_tail(&tcomplete->entry, &thread->todo);
1655         if (target_wait)
1656                 wake_up_interruptible(target_wait);
1657         return;
1658
1659 err_get_unused_fd_failed:
1660 err_fget_failed:
1661 err_fd_not_allowed:
1662 err_binder_get_ref_for_node_failed:
1663 err_binder_get_ref_failed:
1664 err_binder_new_node_failed:
1665 err_bad_object_type:
1666 err_bad_offset:
1667 err_copy_data_failed:
1668         trace_binder_transaction_failed_buffer_release(t->buffer);
1669         binder_transaction_buffer_release(target_proc, t->buffer, offp);
1670         t->buffer->transaction = NULL;
1671         binder_free_buf(target_proc, t->buffer);
1672 err_binder_alloc_buf_failed:
1673         kfree(tcomplete);
1674         binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
1675 err_alloc_tcomplete_failed:
1676         kfree(t);
1677         binder_stats_deleted(BINDER_STAT_TRANSACTION);
1678 err_alloc_t_failed:
1679 err_bad_call_stack:
1680 err_empty_call_stack:
1681 err_dead_binder:
1682 err_invalid_target_handle:
1683 err_no_context_mgr_node:
1684         binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
1685                      "%d:%d transaction failed %d, size %zd-%zd\n",
1686                      proc->pid, thread->pid, return_error,
1687                      tr->data_size, tr->offsets_size);
1688
1689         {
1690                 struct binder_transaction_log_entry *fe;
1691                 fe = binder_transaction_log_add(&binder_transaction_log_failed);
1692                 *fe = *e;
1693         }
1694
1695         BUG_ON(thread->return_error != BR_OK);
1696         if (in_reply_to) {
1697                 thread->return_error = BR_TRANSACTION_COMPLETE;
1698                 binder_send_failed_reply(in_reply_to, return_error);
1699         } else
1700                 thread->return_error = return_error;
1701 }
1702
1703 int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread,
1704                         void __user *buffer, int size, signed long *consumed)
1705 {
1706         uint32_t cmd;
1707         void __user *ptr = buffer + *consumed;
1708         void __user *end = buffer + size;
1709
1710         while (ptr < end && thread->return_error == BR_OK) {
1711                 if (get_user(cmd, (uint32_t __user *)ptr))
1712                         return -EFAULT;
1713                 ptr += sizeof(uint32_t);
1714                 trace_binder_command(cmd);
1715                 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) {
1716                         binder_stats.bc[_IOC_NR(cmd)]++;
1717                         proc->stats.bc[_IOC_NR(cmd)]++;
1718                         thread->stats.bc[_IOC_NR(cmd)]++;
1719                 }
1720                 switch (cmd) {
1721                 case BC_INCREFS:
1722                 case BC_ACQUIRE:
1723                 case BC_RELEASE:
1724                 case BC_DECREFS: {
1725                         uint32_t target;
1726                         struct binder_ref *ref;
1727                         const char *debug_string;
1728
1729                         if (get_user(target, (uint32_t __user *)ptr))
1730                                 return -EFAULT;
1731                         ptr += sizeof(uint32_t);
1732                         if (target == 0 && binder_context_mgr_node &&
1733                             (cmd == BC_INCREFS || cmd == BC_ACQUIRE)) {
1734                                 ref = binder_get_ref_for_node(proc,
1735                                                binder_context_mgr_node);
1736                                 if (ref->desc != target) {
1737                                         binder_user_error("%d:%d tried to acquire reference to desc 0, got %d instead\n",
1738                                                 proc->pid, thread->pid,
1739                                                 ref->desc);
1740                                 }
1741                         } else
1742                                 ref = binder_get_ref(proc, target);
1743                         if (ref == NULL) {
1744                                 binder_user_error("%d:%d refcount change on invalid ref %d\n",
1745                                         proc->pid, thread->pid, target);
1746                                 break;
1747                         }
1748                         switch (cmd) {
1749                         case BC_INCREFS:
1750                                 debug_string = "IncRefs";
1751                                 binder_inc_ref(ref, 0, NULL);
1752                                 break;
1753                         case BC_ACQUIRE:
1754                                 debug_string = "Acquire";
1755                                 binder_inc_ref(ref, 1, NULL);
1756                                 break;
1757                         case BC_RELEASE:
1758                                 debug_string = "Release";
1759                                 binder_dec_ref(ref, 1);
1760                                 break;
1761                         case BC_DECREFS:
1762                         default:
1763                                 debug_string = "DecRefs";
1764                                 binder_dec_ref(ref, 0);
1765                                 break;
1766                         }
1767                         binder_debug(BINDER_DEBUG_USER_REFS,
1768                                      "%d:%d %s ref %d desc %d s %d w %d for node %d\n",
1769                                      proc->pid, thread->pid, debug_string, ref->debug_id,
1770                                      ref->desc, ref->strong, ref->weak, ref->node->debug_id);
1771                         break;
1772                 }
1773                 case BC_INCREFS_DONE:
1774                 case BC_ACQUIRE_DONE: {
1775                         void __user *node_ptr;
1776                         void *cookie;
1777                         struct binder_node *node;
1778
1779                         if (get_user(node_ptr, (void * __user *)ptr))
1780                                 return -EFAULT;
1781                         ptr += sizeof(void *);
1782                         if (get_user(cookie, (void * __user *)ptr))
1783                                 return -EFAULT;
1784                         ptr += sizeof(void *);
1785                         node = binder_get_node(proc, node_ptr);
1786                         if (node == NULL) {
1787                                 binder_user_error("%d:%d %s u%p no match\n",
1788                                         proc->pid, thread->pid,
1789                                         cmd == BC_INCREFS_DONE ?
1790                                         "BC_INCREFS_DONE" :
1791                                         "BC_ACQUIRE_DONE",
1792                                         node_ptr);
1793                                 break;
1794                         }
1795                         if (cookie != node->cookie) {
1796                                 binder_user_error("%d:%d %s u%p node %d cookie mismatch %p != %p\n",
1797                                         proc->pid, thread->pid,
1798                                         cmd == BC_INCREFS_DONE ?
1799                                         "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
1800                                         node_ptr, node->debug_id,
1801                                         cookie, node->cookie);
1802                                 break;
1803                         }
1804                         if (cmd == BC_ACQUIRE_DONE) {
1805                                 if (node->pending_strong_ref == 0) {
1806                                         binder_user_error("%d:%d BC_ACQUIRE_DONE node %d has no pending acquire request\n",
1807                                                 proc->pid, thread->pid,
1808                                                 node->debug_id);
1809                                         break;
1810                                 }
1811                                 node->pending_strong_ref = 0;
1812                         } else {
1813                                 if (node->pending_weak_ref == 0) {
1814                                         binder_user_error("%d:%d BC_INCREFS_DONE node %d has no pending increfs request\n",
1815                                                 proc->pid, thread->pid,
1816                                                 node->debug_id);
1817                                         break;
1818                                 }
1819                                 node->pending_weak_ref = 0;
1820                         }
1821                         binder_dec_node(node, cmd == BC_ACQUIRE_DONE, 0);
1822                         binder_debug(BINDER_DEBUG_USER_REFS,
1823                                      "%d:%d %s node %d ls %d lw %d\n",
1824                                      proc->pid, thread->pid,
1825                                      cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
1826                                      node->debug_id, node->local_strong_refs, node->local_weak_refs);
1827                         break;
1828                 }
1829                 case BC_ATTEMPT_ACQUIRE:
1830                         pr_err("BC_ATTEMPT_ACQUIRE not supported\n");
1831                         return -EINVAL;
1832                 case BC_ACQUIRE_RESULT:
1833                         pr_err("BC_ACQUIRE_RESULT not supported\n");
1834                         return -EINVAL;
1835
1836                 case BC_FREE_BUFFER: {
1837                         void __user *data_ptr;
1838                         struct binder_buffer *buffer;
1839
1840                         if (get_user(data_ptr, (void * __user *)ptr))
1841                                 return -EFAULT;
1842                         ptr += sizeof(void *);
1843
1844                         buffer = binder_buffer_lookup(proc, data_ptr);
1845                         if (buffer == NULL) {
1846                                 binder_user_error("%d:%d BC_FREE_BUFFER u%p no match\n",
1847                                         proc->pid, thread->pid, data_ptr);
1848                                 break;
1849                         }
1850                         if (!buffer->allow_user_free) {
1851                                 binder_user_error("%d:%d BC_FREE_BUFFER u%p matched unreturned buffer\n",
1852                                         proc->pid, thread->pid, data_ptr);
1853                                 break;
1854                         }
1855                         binder_debug(BINDER_DEBUG_FREE_BUFFER,
1856                                      "%d:%d BC_FREE_BUFFER u%p found buffer %d for %s transaction\n",
1857                                      proc->pid, thread->pid, data_ptr, buffer->debug_id,
1858                                      buffer->transaction ? "active" : "finished");
1859
1860                         if (buffer->transaction) {
1861                                 buffer->transaction->buffer = NULL;
1862                                 buffer->transaction = NULL;
1863                         }
1864                         if (buffer->async_transaction && buffer->target_node) {
1865                                 BUG_ON(!buffer->target_node->has_async_transaction);
1866                                 if (list_empty(&buffer->target_node->async_todo))
1867                                         buffer->target_node->has_async_transaction = 0;
1868                                 else
1869                                         list_move_tail(buffer->target_node->async_todo.next, &thread->todo);
1870                         }
1871                         trace_binder_transaction_buffer_release(buffer);
1872                         binder_transaction_buffer_release(proc, buffer, NULL);
1873                         binder_free_buf(proc, buffer);
1874                         break;
1875                 }
1876
1877                 case BC_TRANSACTION:
1878                 case BC_REPLY: {
1879                         struct binder_transaction_data tr;
1880
1881                         if (copy_from_user(&tr, ptr, sizeof(tr)))
1882                                 return -EFAULT;
1883                         ptr += sizeof(tr);
1884                         binder_transaction(proc, thread, &tr, cmd == BC_REPLY);
1885                         break;
1886                 }
1887
1888                 case BC_REGISTER_LOOPER:
1889                         binder_debug(BINDER_DEBUG_THREADS,
1890                                      "%d:%d BC_REGISTER_LOOPER\n",
1891                                      proc->pid, thread->pid);
1892                         if (thread->looper & BINDER_LOOPER_STATE_ENTERED) {
1893                                 thread->looper |= BINDER_LOOPER_STATE_INVALID;
1894                                 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER\n",
1895                                         proc->pid, thread->pid);
1896                         } else if (proc->requested_threads == 0) {
1897                                 thread->looper |= BINDER_LOOPER_STATE_INVALID;
1898                                 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called without request\n",
1899                                         proc->pid, thread->pid);
1900                         } else {
1901                                 proc->requested_threads--;
1902                                 proc->requested_threads_started++;
1903                         }
1904                         thread->looper |= BINDER_LOOPER_STATE_REGISTERED;
1905                         break;
1906                 case BC_ENTER_LOOPER:
1907                         binder_debug(BINDER_DEBUG_THREADS,
1908                                      "%d:%d BC_ENTER_LOOPER\n",
1909                                      proc->pid, thread->pid);
1910                         if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) {
1911                                 thread->looper |= BINDER_LOOPER_STATE_INVALID;
1912                                 binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n",
1913                                         proc->pid, thread->pid);
1914                         }
1915                         thread->looper |= BINDER_LOOPER_STATE_ENTERED;
1916                         break;
1917                 case BC_EXIT_LOOPER:
1918                         binder_debug(BINDER_DEBUG_THREADS,
1919                                      "%d:%d BC_EXIT_LOOPER\n",
1920                                      proc->pid, thread->pid);
1921                         thread->looper |= BINDER_LOOPER_STATE_EXITED;
1922                         break;
1923
1924                 case BC_REQUEST_DEATH_NOTIFICATION:
1925                 case BC_CLEAR_DEATH_NOTIFICATION: {
1926                         uint32_t target;
1927                         void __user *cookie;
1928                         struct binder_ref *ref;
1929                         struct binder_ref_death *death;
1930
1931                         if (get_user(target, (uint32_t __user *)ptr))
1932                                 return -EFAULT;
1933                         ptr += sizeof(uint32_t);
1934                         if (get_user(cookie, (void __user * __user *)ptr))
1935                                 return -EFAULT;
1936                         ptr += sizeof(void *);
1937                         ref = binder_get_ref(proc, target);
1938                         if (ref == NULL) {
1939                                 binder_user_error("%d:%d %s invalid ref %d\n",
1940                                         proc->pid, thread->pid,
1941                                         cmd == BC_REQUEST_DEATH_NOTIFICATION ?
1942                                         "BC_REQUEST_DEATH_NOTIFICATION" :
1943                                         "BC_CLEAR_DEATH_NOTIFICATION",
1944                                         target);
1945                                 break;
1946                         }
1947
1948                         binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
1949                                      "%d:%d %s %p ref %d desc %d s %d w %d for node %d\n",
1950                                      proc->pid, thread->pid,
1951                                      cmd == BC_REQUEST_DEATH_NOTIFICATION ?
1952                                      "BC_REQUEST_DEATH_NOTIFICATION" :
1953                                      "BC_CLEAR_DEATH_NOTIFICATION",
1954                                      cookie, ref->debug_id, ref->desc,
1955                                      ref->strong, ref->weak, ref->node->debug_id);
1956
1957                         if (cmd == BC_REQUEST_DEATH_NOTIFICATION) {
1958                                 if (ref->death) {
1959                                         binder_user_error("%d:%d BC_REQUEST_DEATH_NOTIFICATION death notification already set\n",
1960                                                 proc->pid, thread->pid);
1961                                         break;
1962                                 }
1963                                 death = kzalloc(sizeof(*death), GFP_KERNEL);
1964                                 if (death == NULL) {
1965                                         thread->return_error = BR_ERROR;
1966                                         binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
1967                                                      "%d:%d BC_REQUEST_DEATH_NOTIFICATION failed\n",
1968                                                      proc->pid, thread->pid);
1969                                         break;
1970                                 }
1971                                 binder_stats_created(BINDER_STAT_DEATH);
1972                                 INIT_LIST_HEAD(&death->work.entry);
1973                                 death->cookie = cookie;
1974                                 ref->death = death;
1975                                 if (ref->node->proc == NULL) {
1976                                         ref->death->work.type = BINDER_WORK_DEAD_BINDER;
1977                                         if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) {
1978                                                 list_add_tail(&ref->death->work.entry, &thread->todo);
1979                                         } else {
1980                                                 list_add_tail(&ref->death->work.entry, &proc->todo);
1981                                                 wake_up_interruptible(&proc->wait);
1982                                         }
1983                                 }
1984                         } else {
1985                                 if (ref->death == NULL) {
1986                                         binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification not active\n",
1987                                                 proc->pid, thread->pid);
1988                                         break;
1989                                 }
1990                                 death = ref->death;
1991                                 if (death->cookie != cookie) {
1992                                         binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch %p != %p\n",
1993                                                 proc->pid, thread->pid,
1994                                                 death->cookie, cookie);
1995                                         break;
1996                                 }
1997                                 ref->death = NULL;
1998                                 if (list_empty(&death->work.entry)) {
1999                                         death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;
2000                                         if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) {
2001                                                 list_add_tail(&death->work.entry, &thread->todo);
2002                                         } else {
2003                                                 list_add_tail(&death->work.entry, &proc->todo);
2004                                                 wake_up_interruptible(&proc->wait);
2005                                         }
2006                                 } else {
2007                                         BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER);
2008                                         death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR;
2009                                 }
2010                         }
2011                 } break;
2012                 case BC_DEAD_BINDER_DONE: {
2013                         struct binder_work *w;
2014                         void __user *cookie;
2015                         struct binder_ref_death *death = NULL;
2016                         if (get_user(cookie, (void __user * __user *)ptr))
2017                                 return -EFAULT;
2018
2019                         ptr += sizeof(void *);
2020                         list_for_each_entry(w, &proc->delivered_death, entry) {
2021                                 struct binder_ref_death *tmp_death = container_of(w, struct binder_ref_death, work);
2022                                 if (tmp_death->cookie == cookie) {
2023                                         death = tmp_death;
2024                                         break;
2025                                 }
2026                         }
2027                         binder_debug(BINDER_DEBUG_DEAD_BINDER,
2028                                      "%d:%d BC_DEAD_BINDER_DONE %p found %p\n",
2029                                      proc->pid, thread->pid, cookie, death);
2030                         if (death == NULL) {
2031                                 binder_user_error("%d:%d BC_DEAD_BINDER_DONE %p not found\n",
2032                                         proc->pid, thread->pid, cookie);
2033                                 break;
2034                         }
2035
2036                         list_del_init(&death->work.entry);
2037                         if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) {
2038                                 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;
2039                                 if (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | BINDER_LOOPER_STATE_ENTERED)) {
2040                                         list_add_tail(&death->work.entry, &thread->todo);
2041                                 } else {
2042                                         list_add_tail(&death->work.entry, &proc->todo);
2043                                         wake_up_interruptible(&proc->wait);
2044                                 }
2045                         }
2046                 } break;
2047
2048                 default:
2049                         pr_err("%d:%d unknown command %d\n",
2050                                proc->pid, thread->pid, cmd);
2051                         return -EINVAL;
2052                 }
2053                 *consumed = ptr - buffer;
2054         }
2055         return 0;
2056 }
2057
2058 void binder_stat_br(struct binder_proc *proc, struct binder_thread *thread,
2059                     uint32_t cmd)
2060 {
2061         trace_binder_return(cmd);
2062         if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) {
2063                 binder_stats.br[_IOC_NR(cmd)]++;
2064                 proc->stats.br[_IOC_NR(cmd)]++;
2065                 thread->stats.br[_IOC_NR(cmd)]++;
2066         }
2067 }
2068
2069 static int binder_has_proc_work(struct binder_proc *proc,
2070                                 struct binder_thread *thread)
2071 {
2072         return !list_empty(&proc->todo) ||
2073                 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN);
2074 }
2075
2076 static int binder_has_thread_work(struct binder_thread *thread)
2077 {
2078         return !list_empty(&thread->todo) || thread->return_error != BR_OK ||
2079                 (thread->looper & BINDER_LOOPER_STATE_NEED_RETURN);
2080 }
2081
2082 static int binder_thread_read(struct binder_proc *proc,
2083                               struct binder_thread *thread,
2084                               void  __user *buffer, int size,
2085                               signed long *consumed, int non_block)
2086 {
2087         void __user *ptr = buffer + *consumed;
2088         void __user *end = buffer + size;
2089
2090         int ret = 0;
2091         int wait_for_proc_work;
2092
2093         if (*consumed == 0) {
2094                 if (put_user(BR_NOOP, (uint32_t __user *)ptr))
2095                         return -EFAULT;
2096                 ptr += sizeof(uint32_t);
2097         }
2098
2099 retry:
2100         wait_for_proc_work = thread->transaction_stack == NULL &&
2101                                 list_empty(&thread->todo);
2102
2103         if (thread->return_error != BR_OK && ptr < end) {
2104                 if (thread->return_error2 != BR_OK) {
2105                         if (put_user(thread->return_error2, (uint32_t __user *)ptr))
2106                                 return -EFAULT;
2107                         ptr += sizeof(uint32_t);
2108                         binder_stat_br(proc, thread, thread->return_error2);
2109                         if (ptr == end)
2110                                 goto done;
2111                         thread->return_error2 = BR_OK;
2112                 }
2113                 if (put_user(thread->return_error, (uint32_t __user *)ptr))
2114                         return -EFAULT;
2115                 ptr += sizeof(uint32_t);
2116                 binder_stat_br(proc, thread, thread->return_error);
2117                 thread->return_error = BR_OK;
2118                 goto done;
2119         }
2120
2121
2122         thread->looper |= BINDER_LOOPER_STATE_WAITING;
2123         if (wait_for_proc_work)
2124                 proc->ready_threads++;
2125
2126         binder_unlock(__func__);
2127
2128         trace_binder_wait_for_work(wait_for_proc_work,
2129                                    !!thread->transaction_stack,
2130                                    !list_empty(&thread->todo));
2131         if (wait_for_proc_work) {
2132                 if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
2133                                         BINDER_LOOPER_STATE_ENTERED))) {
2134                         binder_user_error("%d:%d ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state %x)\n",
2135                                 proc->pid, thread->pid, thread->looper);
2136                         wait_event_interruptible(binder_user_error_wait,
2137                                                  binder_stop_on_user_error < 2);
2138                 }
2139                 binder_set_nice(proc->default_priority);
2140                 if (non_block) {
2141                         if (!binder_has_proc_work(proc, thread))
2142                                 ret = -EAGAIN;
2143                 } else
2144                         ret = wait_event_freezable_exclusive(proc->wait, binder_has_proc_work(proc, thread));
2145         } else {
2146                 if (non_block) {
2147                         if (!binder_has_thread_work(thread))
2148                                 ret = -EAGAIN;
2149                 } else
2150                         ret = wait_event_freezable(thread->wait, binder_has_thread_work(thread));
2151         }
2152
2153         binder_lock(__func__);
2154
2155         if (wait_for_proc_work)
2156                 proc->ready_threads--;
2157         thread->looper &= ~BINDER_LOOPER_STATE_WAITING;
2158
2159         if (ret)
2160                 return ret;
2161
2162         while (1) {
2163                 uint32_t cmd;
2164                 struct binder_transaction_data tr;
2165                 struct binder_work *w;
2166                 struct binder_transaction *t = NULL;
2167
2168                 if (!list_empty(&thread->todo))
2169                         w = list_first_entry(&thread->todo, struct binder_work, entry);
2170                 else if (!list_empty(&proc->todo) && wait_for_proc_work)
2171                         w = list_first_entry(&proc->todo, struct binder_work, entry);
2172                 else {
2173                         if (ptr - buffer == 4 && !(thread->looper & BINDER_LOOPER_STATE_NEED_RETURN)) /* no data added */
2174                                 goto retry;
2175                         break;
2176                 }
2177
2178                 if (end - ptr < sizeof(tr) + 4)
2179                         break;
2180
2181                 switch (w->type) {
2182                 case BINDER_WORK_TRANSACTION: {
2183                         t = container_of(w, struct binder_transaction, work);
2184                 } break;
2185                 case BINDER_WORK_TRANSACTION_COMPLETE: {
2186                         cmd = BR_TRANSACTION_COMPLETE;
2187                         if (put_user(cmd, (uint32_t __user *)ptr))
2188                                 return -EFAULT;
2189                         ptr += sizeof(uint32_t);
2190
2191                         binder_stat_br(proc, thread, cmd);
2192                         binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE,
2193                                      "%d:%d BR_TRANSACTION_COMPLETE\n",
2194                                      proc->pid, thread->pid);
2195
2196                         list_del(&w->entry);
2197                         kfree(w);
2198                         binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
2199                 } break;
2200                 case BINDER_WORK_NODE: {
2201                         struct binder_node *node = container_of(w, struct binder_node, work);
2202                         uint32_t cmd = BR_NOOP;
2203                         const char *cmd_name;
2204                         int strong = node->internal_strong_refs || node->local_strong_refs;
2205                         int weak = !hlist_empty(&node->refs) || node->local_weak_refs || strong;
2206                         if (weak && !node->has_weak_ref) {
2207                                 cmd = BR_INCREFS;
2208                                 cmd_name = "BR_INCREFS";
2209                                 node->has_weak_ref = 1;
2210                                 node->pending_weak_ref = 1;
2211                                 node->local_weak_refs++;
2212                         } else if (strong && !node->has_strong_ref) {
2213                                 cmd = BR_ACQUIRE;
2214                                 cmd_name = "BR_ACQUIRE";
2215                                 node->has_strong_ref = 1;
2216                                 node->pending_strong_ref = 1;
2217                                 node->local_strong_refs++;
2218                         } else if (!strong && node->has_strong_ref) {
2219                                 cmd = BR_RELEASE;
2220                                 cmd_name = "BR_RELEASE";
2221                                 node->has_strong_ref = 0;
2222                         } else if (!weak && node->has_weak_ref) {
2223                                 cmd = BR_DECREFS;
2224                                 cmd_name = "BR_DECREFS";
2225                                 node->has_weak_ref = 0;
2226                         }
2227                         if (cmd != BR_NOOP) {
2228                                 if (put_user(cmd, (uint32_t __user *)ptr))
2229                                         return -EFAULT;
2230                                 ptr += sizeof(uint32_t);
2231                                 if (put_user(node->ptr, (void * __user *)ptr))
2232                                         return -EFAULT;
2233                                 ptr += sizeof(void *);
2234                                 if (put_user(node->cookie, (void * __user *)ptr))
2235                                         return -EFAULT;
2236                                 ptr += sizeof(void *);
2237
2238                                 binder_stat_br(proc, thread, cmd);
2239                                 binder_debug(BINDER_DEBUG_USER_REFS,
2240                                              "%d:%d %s %d u%p c%p\n",
2241                                              proc->pid, thread->pid, cmd_name, node->debug_id, node->ptr, node->cookie);
2242                         } else {
2243                                 list_del_init(&w->entry);
2244                                 if (!weak && !strong) {
2245                                         binder_debug(BINDER_DEBUG_INTERNAL_REFS,
2246                                                      "%d:%d node %d u%p c%p deleted\n",
2247                                                      proc->pid, thread->pid, node->debug_id,
2248                                                      node->ptr, node->cookie);
2249                                         rb_erase(&node->rb_node, &proc->nodes);
2250                                         kfree(node);
2251                                         binder_stats_deleted(BINDER_STAT_NODE);
2252                                 } else {
2253                                         binder_debug(BINDER_DEBUG_INTERNAL_REFS,
2254                                                      "%d:%d node %d u%p c%p state unchanged\n",
2255                                                      proc->pid, thread->pid, node->debug_id, node->ptr,
2256                                                      node->cookie);
2257                                 }
2258                         }
2259                 } break;
2260                 case BINDER_WORK_DEAD_BINDER:
2261                 case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
2262                 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
2263                         struct binder_ref_death *death;
2264                         uint32_t cmd;
2265
2266                         death = container_of(w, struct binder_ref_death, work);
2267                         if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION)
2268                                 cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE;
2269                         else
2270                                 cmd = BR_DEAD_BINDER;
2271                         if (put_user(cmd, (uint32_t __user *)ptr))
2272                                 return -EFAULT;
2273                         ptr += sizeof(uint32_t);
2274                         if (put_user(death->cookie, (void * __user *)ptr))
2275                                 return -EFAULT;
2276                         ptr += sizeof(void *);
2277                         binder_stat_br(proc, thread, cmd);
2278                         binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
2279                                      "%d:%d %s %p\n",
2280                                       proc->pid, thread->pid,
2281                                       cmd == BR_DEAD_BINDER ?
2282                                       "BR_DEAD_BINDER" :
2283                                       "BR_CLEAR_DEATH_NOTIFICATION_DONE",
2284                                       death->cookie);
2285
2286                         if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) {
2287                                 list_del(&w->entry);
2288                                 kfree(death);
2289                                 binder_stats_deleted(BINDER_STAT_DEATH);
2290                         } else
2291                                 list_move(&w->entry, &proc->delivered_death);
2292                         if (cmd == BR_DEAD_BINDER)
2293                                 goto done; /* DEAD_BINDER notifications can cause transactions */
2294                 } break;
2295                 }
2296
2297                 if (!t)
2298                         continue;
2299
2300                 BUG_ON(t->buffer == NULL);
2301                 if (t->buffer->target_node) {
2302                         struct binder_node *target_node = t->buffer->target_node;
2303                         tr.target.ptr = target_node->ptr;
2304                         tr.cookie =  target_node->cookie;
2305                         t->saved_priority = task_nice(current);
2306                         if (t->priority < target_node->min_priority &&
2307                             !(t->flags & TF_ONE_WAY))
2308                                 binder_set_nice(t->priority);
2309                         else if (!(t->flags & TF_ONE_WAY) ||
2310                                  t->saved_priority > target_node->min_priority)
2311                                 binder_set_nice(target_node->min_priority);
2312                         cmd = BR_TRANSACTION;
2313                 } else {
2314                         tr.target.ptr = NULL;
2315                         tr.cookie = NULL;
2316                         cmd = BR_REPLY;
2317                 }
2318                 tr.code = t->code;
2319                 tr.flags = t->flags;
2320                 tr.sender_euid = from_kuid(current_user_ns(), t->sender_euid);
2321
2322                 if (t->from) {
2323                         struct task_struct *sender = t->from->proc->tsk;
2324                         tr.sender_pid = task_tgid_nr_ns(sender,
2325                                                         task_active_pid_ns(current));
2326                 } else {
2327                         tr.sender_pid = 0;
2328                 }
2329
2330                 tr.data_size = t->buffer->data_size;
2331                 tr.offsets_size = t->buffer->offsets_size;
2332                 tr.data.ptr.buffer = (void *)t->buffer->data +
2333                                         proc->user_buffer_offset;
2334                 tr.data.ptr.offsets = tr.data.ptr.buffer +
2335                                         ALIGN(t->buffer->data_size,
2336                                             sizeof(void *));
2337
2338                 if (put_user(cmd, (uint32_t __user *)ptr))
2339                         return -EFAULT;
2340                 ptr += sizeof(uint32_t);
2341                 if (copy_to_user(ptr, &tr, sizeof(tr)))
2342                         return -EFAULT;
2343                 ptr += sizeof(tr);
2344
2345                 trace_binder_transaction_received(t);
2346                 binder_stat_br(proc, thread, cmd);
2347                 binder_debug(BINDER_DEBUG_TRANSACTION,
2348                              "%d:%d %s %d %d:%d, cmd %d size %zd-%zd ptr %p-%p\n",
2349                              proc->pid, thread->pid,
2350                              (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" :
2351                              "BR_REPLY",
2352                              t->debug_id, t->from ? t->from->proc->pid : 0,
2353                              t->from ? t->from->pid : 0, cmd,
2354                              t->buffer->data_size, t->buffer->offsets_size,
2355                              tr.data.ptr.buffer, tr.data.ptr.offsets);
2356
2357                 list_del(&t->work.entry);
2358                 t->buffer->allow_user_free = 1;
2359                 if (cmd == BR_TRANSACTION && !(t->flags & TF_ONE_WAY)) {
2360                         t->to_parent = thread->transaction_stack;
2361                         t->to_thread = thread;
2362                         thread->transaction_stack = t;
2363                 } else {
2364                         t->buffer->transaction = NULL;
2365                         kfree(t);
2366                         binder_stats_deleted(BINDER_STAT_TRANSACTION);
2367                 }
2368                 break;
2369         }
2370
2371 done:
2372
2373         *consumed = ptr - buffer;
2374         if (proc->requested_threads + proc->ready_threads == 0 &&
2375             proc->requested_threads_started < proc->max_threads &&
2376             (thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
2377              BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */
2378              /*spawn a new thread if we leave this out */) {
2379                 proc->requested_threads++;
2380                 binder_debug(BINDER_DEBUG_THREADS,
2381                              "%d:%d BR_SPAWN_LOOPER\n",
2382                              proc->pid, thread->pid);
2383                 if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer))
2384                         return -EFAULT;
2385                 binder_stat_br(proc, thread, BR_SPAWN_LOOPER);
2386         }
2387         return 0;
2388 }
2389
2390 static void binder_release_work(struct list_head *list)
2391 {
2392         struct binder_work *w;
2393         while (!list_empty(list)) {
2394                 w = list_first_entry(list, struct binder_work, entry);
2395                 list_del_init(&w->entry);
2396                 switch (w->type) {
2397                 case BINDER_WORK_TRANSACTION: {
2398                         struct binder_transaction *t;
2399
2400                         t = container_of(w, struct binder_transaction, work);
2401                         if (t->buffer->target_node &&
2402                             !(t->flags & TF_ONE_WAY)) {
2403                                 binder_send_failed_reply(t, BR_DEAD_REPLY);
2404                         } else {
2405                                 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
2406                                         "undelivered transaction %d\n",
2407                                         t->debug_id);
2408                                 t->buffer->transaction = NULL;
2409                                 kfree(t);
2410                                 binder_stats_deleted(BINDER_STAT_TRANSACTION);
2411                         }
2412                 } break;
2413                 case BINDER_WORK_TRANSACTION_COMPLETE: {
2414                         binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
2415                                 "undelivered TRANSACTION_COMPLETE\n");
2416                         kfree(w);
2417                         binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
2418                 } break;
2419                 case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
2420                 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
2421                         struct binder_ref_death *death;
2422
2423                         death = container_of(w, struct binder_ref_death, work);
2424                         binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
2425                                 "undelivered death notification, %p\n",
2426                                 death->cookie);
2427                         kfree(death);
2428                         binder_stats_deleted(BINDER_STAT_DEATH);
2429                 } break;
2430                 default:
2431                         pr_err("unexpected work type, %d, not freed\n",
2432                                w->type);
2433                         break;
2434                 }
2435         }
2436
2437 }
2438
2439 static struct binder_thread *binder_get_thread(struct binder_proc *proc)
2440 {
2441         struct binder_thread *thread = NULL;
2442         struct rb_node *parent = NULL;
2443         struct rb_node **p = &proc->threads.rb_node;
2444
2445         while (*p) {
2446                 parent = *p;
2447                 thread = rb_entry(parent, struct binder_thread, rb_node);
2448
2449                 if (current->pid < thread->pid)
2450                         p = &(*p)->rb_left;
2451                 else if (current->pid > thread->pid)
2452                         p = &(*p)->rb_right;
2453                 else
2454                         break;
2455         }
2456         if (*p == NULL) {
2457                 thread = kzalloc(sizeof(*thread), GFP_KERNEL);
2458                 if (thread == NULL)
2459                         return NULL;
2460                 binder_stats_created(BINDER_STAT_THREAD);
2461                 thread->proc = proc;
2462                 thread->pid = current->pid;
2463                 init_waitqueue_head(&thread->wait);
2464                 INIT_LIST_HEAD(&thread->todo);
2465                 rb_link_node(&thread->rb_node, parent, p);
2466                 rb_insert_color(&thread->rb_node, &proc->threads);
2467                 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN;
2468                 thread->return_error = BR_OK;
2469                 thread->return_error2 = BR_OK;
2470         }
2471         return thread;
2472 }
2473
2474 static int binder_free_thread(struct binder_proc *proc,
2475                               struct binder_thread *thread)
2476 {
2477         struct binder_transaction *t;
2478         struct binder_transaction *send_reply = NULL;
2479         int active_transactions = 0;
2480
2481         rb_erase(&thread->rb_node, &proc->threads);
2482         t = thread->transaction_stack;
2483         if (t && t->to_thread == thread)
2484                 send_reply = t;
2485         while (t) {
2486                 active_transactions++;
2487                 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
2488                              "release %d:%d transaction %d %s, still active\n",
2489                               proc->pid, thread->pid,
2490                              t->debug_id,
2491                              (t->to_thread == thread) ? "in" : "out");
2492
2493                 if (t->to_thread == thread) {
2494                         t->to_proc = NULL;
2495                         t->to_thread = NULL;
2496                         if (t->buffer) {
2497                                 t->buffer->transaction = NULL;
2498                                 t->buffer = NULL;
2499                         }
2500                         t = t->to_parent;
2501                 } else if (t->from == thread) {
2502                         t->from = NULL;
2503                         t = t->from_parent;
2504                 } else
2505                         BUG();
2506         }
2507         if (send_reply)
2508                 binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
2509         binder_release_work(&thread->todo);
2510         kfree(thread);
2511         binder_stats_deleted(BINDER_STAT_THREAD);
2512         return active_transactions;
2513 }
2514
2515 static unsigned int binder_poll(struct file *filp,
2516                                 struct poll_table_struct *wait)
2517 {
2518         struct binder_proc *proc = filp->private_data;
2519         struct binder_thread *thread = NULL;
2520         int wait_for_proc_work;
2521
2522         binder_lock(__func__);
2523
2524         thread = binder_get_thread(proc);
2525
2526         wait_for_proc_work = thread->transaction_stack == NULL &&
2527                 list_empty(&thread->todo) && thread->return_error == BR_OK;
2528
2529         binder_unlock(__func__);
2530
2531         if (wait_for_proc_work) {
2532                 if (binder_has_proc_work(proc, thread))
2533                         return POLLIN;
2534                 poll_wait(filp, &proc->wait, wait);
2535                 if (binder_has_proc_work(proc, thread))
2536                         return POLLIN;
2537         } else {
2538                 if (binder_has_thread_work(thread))
2539                         return POLLIN;
2540                 poll_wait(filp, &thread->wait, wait);
2541                 if (binder_has_thread_work(thread))
2542                         return POLLIN;
2543         }
2544         return 0;
2545 }
2546
2547 static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
2548 {
2549         int ret;
2550         struct binder_proc *proc = filp->private_data;
2551         struct binder_thread *thread;
2552         unsigned int size = _IOC_SIZE(cmd);
2553         void __user *ubuf = (void __user *)arg;
2554
2555         /*pr_info("binder_ioctl: %d:%d %x %lx\n", proc->pid, current->pid, cmd, arg);*/
2556
2557         trace_binder_ioctl(cmd, arg);
2558
2559         ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
2560         if (ret)
2561                 goto err_unlocked;
2562
2563         binder_lock(__func__);
2564         thread = binder_get_thread(proc);
2565         if (thread == NULL) {
2566                 ret = -ENOMEM;
2567                 goto err;
2568         }
2569
2570         switch (cmd) {
2571         case BINDER_WRITE_READ: {
2572                 struct binder_write_read bwr;
2573                 if (size != sizeof(struct binder_write_read)) {
2574                         ret = -EINVAL;
2575                         goto err;
2576                 }
2577                 if (copy_from_user(&bwr, ubuf, sizeof(bwr))) {
2578                         ret = -EFAULT;
2579                         goto err;
2580                 }
2581                 binder_debug(BINDER_DEBUG_READ_WRITE,
2582                              "%d:%d write %ld at %08lx, read %ld at %08lx\n",
2583                              proc->pid, thread->pid, bwr.write_size,
2584                              bwr.write_buffer, bwr.read_size, bwr.read_buffer);
2585
2586                 if (bwr.write_size > 0) {
2587                         ret = binder_thread_write(proc, thread, (void __user *)bwr.write_buffer, bwr.write_size, &bwr.write_consumed);
2588                         trace_binder_write_done(ret);
2589                         if (ret < 0) {
2590                                 bwr.read_consumed = 0;
2591                                 if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
2592                                         ret = -EFAULT;
2593                                 goto err;
2594                         }
2595                 }
2596                 if (bwr.read_size > 0) {
2597                         ret = binder_thread_read(proc, thread, (void __user *)bwr.read_buffer, bwr.read_size, &bwr.read_consumed, filp->f_flags & O_NONBLOCK);
2598                         trace_binder_read_done(ret);
2599                         if (!list_empty(&proc->todo))
2600                                 wake_up_interruptible(&proc->wait);
2601                         if (ret < 0) {
2602                                 if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
2603                                         ret = -EFAULT;
2604                                 goto err;
2605                         }
2606                 }
2607                 binder_debug(BINDER_DEBUG_READ_WRITE,
2608                              "%d:%d wrote %ld of %ld, read return %ld of %ld\n",
2609                              proc->pid, thread->pid, bwr.write_consumed, bwr.write_size,
2610                              bwr.read_consumed, bwr.read_size);
2611                 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) {
2612                         ret = -EFAULT;
2613                         goto err;
2614                 }
2615                 break;
2616         }
2617         case BINDER_SET_MAX_THREADS:
2618                 if (copy_from_user(&proc->max_threads, ubuf, sizeof(proc->max_threads))) {
2619                         ret = -EINVAL;
2620                         goto err;
2621                 }
2622                 break;
2623         case BINDER_SET_CONTEXT_MGR:
2624                 if (binder_context_mgr_node != NULL) {
2625                         pr_err("BINDER_SET_CONTEXT_MGR already set\n");
2626                         ret = -EBUSY;
2627                         goto err;
2628                 }
2629                 if (uid_valid(binder_context_mgr_uid)) {
2630                         if (!uid_eq(binder_context_mgr_uid, current->cred->euid)) {
2631                                 pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n",
2632                                        from_kuid(&init_user_ns, current->cred->euid),
2633                                        from_kuid(&init_user_ns, binder_context_mgr_uid));
2634                                 ret = -EPERM;
2635                                 goto err;
2636                         }
2637                 } else
2638                         binder_context_mgr_uid = current->cred->euid;
2639                 binder_context_mgr_node = binder_new_node(proc, NULL, NULL);
2640                 if (binder_context_mgr_node == NULL) {
2641                         ret = -ENOMEM;
2642                         goto err;
2643                 }
2644                 binder_context_mgr_node->local_weak_refs++;
2645                 binder_context_mgr_node->local_strong_refs++;
2646                 binder_context_mgr_node->has_strong_ref = 1;
2647                 binder_context_mgr_node->has_weak_ref = 1;
2648                 break;
2649         case BINDER_THREAD_EXIT:
2650                 binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n",
2651                              proc->pid, thread->pid);
2652                 binder_free_thread(proc, thread);
2653                 thread = NULL;
2654                 break;
2655         case BINDER_VERSION:
2656                 if (size != sizeof(struct binder_version)) {
2657                         ret = -EINVAL;
2658                         goto err;
2659                 }
2660                 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION, &((struct binder_version *)ubuf)->protocol_version)) {
2661                         ret = -EINVAL;
2662                         goto err;
2663                 }
2664                 break;
2665         default:
2666                 ret = -EINVAL;
2667                 goto err;
2668         }
2669         ret = 0;
2670 err:
2671         if (thread)
2672                 thread->looper &= ~BINDER_LOOPER_STATE_NEED_RETURN;
2673         binder_unlock(__func__);
2674         wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
2675         if (ret && ret != -ERESTARTSYS)
2676                 pr_info("%d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret);
2677 err_unlocked:
2678         trace_binder_ioctl_done(ret);
2679         return ret;
2680 }
2681
2682 static void binder_vma_open(struct vm_area_struct *vma)
2683 {
2684         struct binder_proc *proc = vma->vm_private_data;
2685         binder_debug(BINDER_DEBUG_OPEN_CLOSE,
2686                      "%d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
2687                      proc->pid, vma->vm_start, vma->vm_end,
2688                      (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
2689                      (unsigned long)pgprot_val(vma->vm_page_prot));
2690 }
2691
2692 static void binder_vma_close(struct vm_area_struct *vma)
2693 {
2694         struct binder_proc *proc = vma->vm_private_data;
2695         binder_debug(BINDER_DEBUG_OPEN_CLOSE,
2696                      "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
2697                      proc->pid, vma->vm_start, vma->vm_end,
2698                      (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
2699                      (unsigned long)pgprot_val(vma->vm_page_prot));
2700         proc->vma = NULL;
2701         proc->vma_vm_mm = NULL;
2702         binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
2703 }
2704
2705 static struct vm_operations_struct binder_vm_ops = {
2706         .open = binder_vma_open,
2707         .close = binder_vma_close,
2708 };
2709
2710 static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
2711 {
2712         int ret;
2713         struct vm_struct *area;
2714         struct binder_proc *proc = filp->private_data;
2715         const char *failure_string;
2716         struct binder_buffer *buffer;
2717
2718         if (proc->tsk != current)
2719                 return -EINVAL;
2720
2721         if ((vma->vm_end - vma->vm_start) > SZ_4M)
2722                 vma->vm_end = vma->vm_start + SZ_4M;
2723
2724         binder_debug(BINDER_DEBUG_OPEN_CLOSE,
2725                      "binder_mmap: %d %lx-%lx (%ld K) vma %lx pagep %lx\n",
2726                      proc->pid, vma->vm_start, vma->vm_end,
2727                      (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
2728                      (unsigned long)pgprot_val(vma->vm_page_prot));
2729
2730         if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) {
2731                 ret = -EPERM;
2732                 failure_string = "bad vm_flags";
2733                 goto err_bad_arg;
2734         }
2735         vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE;
2736
2737         mutex_lock(&binder_mmap_lock);
2738         if (proc->buffer) {
2739                 ret = -EBUSY;
2740                 failure_string = "already mapped";
2741                 goto err_already_mapped;
2742         }
2743
2744         area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP);
2745         if (area == NULL) {
2746                 ret = -ENOMEM;
2747                 failure_string = "get_vm_area";
2748                 goto err_get_vm_area_failed;
2749         }
2750         proc->buffer = area->addr;
2751         proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer;
2752         mutex_unlock(&binder_mmap_lock);
2753
2754 #ifdef CONFIG_CPU_CACHE_VIPT
2755         if (cache_is_vipt_aliasing()) {
2756                 while (CACHE_COLOUR((vma->vm_start ^ (uint32_t)proc->buffer))) {
2757                         pr_info("binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer);
2758                         vma->vm_start += PAGE_SIZE;
2759                 }
2760         }
2761 #endif
2762         proc->pages = kzalloc(sizeof(proc->pages[0]) * ((vma->vm_end - vma->vm_start) / PAGE_SIZE), GFP_KERNEL);
2763         if (proc->pages == NULL) {
2764                 ret = -ENOMEM;
2765                 failure_string = "alloc page array";
2766                 goto err_alloc_pages_failed;
2767         }
2768         proc->buffer_size = vma->vm_end - vma->vm_start;
2769
2770         vma->vm_ops = &binder_vm_ops;
2771         vma->vm_private_data = proc;
2772
2773         if (binder_update_page_range(proc, 1, proc->buffer, proc->buffer + PAGE_SIZE, vma)) {
2774                 ret = -ENOMEM;
2775                 failure_string = "alloc small buf";
2776                 goto err_alloc_small_buf_failed;
2777         }
2778         buffer = proc->buffer;
2779         INIT_LIST_HEAD(&proc->buffers);
2780         list_add(&buffer->entry, &proc->buffers);
2781         buffer->free = 1;
2782         binder_insert_free_buffer(proc, buffer);
2783         proc->free_async_space = proc->buffer_size / 2;
2784         barrier();
2785         proc->files = get_files_struct(current);
2786         proc->vma = vma;
2787         proc->vma_vm_mm = vma->vm_mm;
2788
2789         /*pr_info("binder_mmap: %d %lx-%lx maps %p\n",
2790                  proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/
2791         return 0;
2792
2793 err_alloc_small_buf_failed:
2794         kfree(proc->pages);
2795         proc->pages = NULL;
2796 err_alloc_pages_failed:
2797         mutex_lock(&binder_mmap_lock);
2798         vfree(proc->buffer);
2799         proc->buffer = NULL;
2800 err_get_vm_area_failed:
2801 err_already_mapped:
2802         mutex_unlock(&binder_mmap_lock);
2803 err_bad_arg:
2804         pr_err("binder_mmap: %d %lx-%lx %s failed %d\n",
2805                proc->pid, vma->vm_start, vma->vm_end, failure_string, ret);
2806         return ret;
2807 }
2808
2809 static int binder_open(struct inode *nodp, struct file *filp)
2810 {
2811         struct binder_proc *proc;
2812
2813         binder_debug(BINDER_DEBUG_OPEN_CLOSE, "binder_open: %d:%d\n",
2814                      current->group_leader->pid, current->pid);
2815
2816         proc = kzalloc(sizeof(*proc), GFP_KERNEL);
2817         if (proc == NULL)
2818                 return -ENOMEM;
2819         get_task_struct(current);
2820         proc->tsk = current;
2821         INIT_LIST_HEAD(&proc->todo);
2822         init_waitqueue_head(&proc->wait);
2823         proc->default_priority = task_nice(current);
2824
2825         binder_lock(__func__);
2826
2827         binder_stats_created(BINDER_STAT_PROC);
2828         hlist_add_head(&proc->proc_node, &binder_procs);
2829         proc->pid = current->group_leader->pid;
2830         INIT_LIST_HEAD(&proc->delivered_death);
2831         filp->private_data = proc;
2832
2833         binder_unlock(__func__);
2834
2835         if (binder_debugfs_dir_entry_proc) {
2836                 char strbuf[11];
2837                 snprintf(strbuf, sizeof(strbuf), "%u", proc->pid);
2838                 proc->debugfs_entry = debugfs_create_file(strbuf, S_IRUGO,
2839                         binder_debugfs_dir_entry_proc, proc, &binder_proc_fops);
2840         }
2841
2842         return 0;
2843 }
2844
2845 static int binder_flush(struct file *filp, fl_owner_t id)
2846 {
2847         struct binder_proc *proc = filp->private_data;
2848
2849         binder_defer_work(proc, BINDER_DEFERRED_FLUSH);
2850
2851         return 0;
2852 }
2853
2854 static void binder_deferred_flush(struct binder_proc *proc)
2855 {
2856         struct rb_node *n;
2857         int wake_count = 0;
2858         for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) {
2859                 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node);
2860                 thread->looper |= BINDER_LOOPER_STATE_NEED_RETURN;
2861                 if (thread->looper & BINDER_LOOPER_STATE_WAITING) {
2862                         wake_up_interruptible(&thread->wait);
2863                         wake_count++;
2864                 }
2865         }
2866         wake_up_interruptible_all(&proc->wait);
2867
2868         binder_debug(BINDER_DEBUG_OPEN_CLOSE,
2869                      "binder_flush: %d woke %d threads\n", proc->pid,
2870                      wake_count);
2871 }
2872
2873 static int binder_release(struct inode *nodp, struct file *filp)
2874 {
2875         struct binder_proc *proc = filp->private_data;
2876         debugfs_remove(proc->debugfs_entry);
2877         binder_defer_work(proc, BINDER_DEFERRED_RELEASE);
2878
2879         return 0;
2880 }
2881
2882 static int binder_node_release(struct binder_node *node, int refs)
2883 {
2884         struct binder_ref *ref;
2885         int death = 0;
2886
2887         list_del_init(&node->work.entry);
2888         binder_release_work(&node->async_todo);
2889
2890         if (hlist_empty(&node->refs)) {
2891                 kfree(node);
2892                 binder_stats_deleted(BINDER_STAT_NODE);
2893
2894                 return refs;
2895         }
2896
2897         node->proc = NULL;
2898         node->local_strong_refs = 0;
2899         node->local_weak_refs = 0;
2900         hlist_add_head(&node->dead_node, &binder_dead_nodes);
2901
2902         hlist_for_each_entry(ref, &node->refs, node_entry) {
2903                 refs++;
2904
2905                 if (!ref->death)
2906                         goto out;
2907
2908                 death++;
2909
2910                 if (list_empty(&ref->death->work.entry)) {
2911                         ref->death->work.type = BINDER_WORK_DEAD_BINDER;
2912                         list_add_tail(&ref->death->work.entry,
2913                                       &ref->proc->todo);
2914                         wake_up_interruptible(&ref->proc->wait);
2915                 } else
2916                         BUG();
2917         }
2918
2919 out:
2920         binder_debug(BINDER_DEBUG_DEAD_BINDER,
2921                      "node %d now dead, refs %d, death %d\n",
2922                      node->debug_id, refs, death);
2923
2924         return refs;
2925 }
2926
2927 static void binder_deferred_release(struct binder_proc *proc)
2928 {
2929         struct binder_transaction *t;
2930         struct rb_node *n;
2931         int threads, nodes, incoming_refs, outgoing_refs, buffers,
2932                 active_transactions, page_count;
2933
2934         BUG_ON(proc->vma);
2935         BUG_ON(proc->files);
2936
2937         hlist_del(&proc->proc_node);
2938
2939         if (binder_context_mgr_node && binder_context_mgr_node->proc == proc) {
2940                 binder_debug(BINDER_DEBUG_DEAD_BINDER,
2941                              "%s: %d context_mgr_node gone\n",
2942                              __func__, proc->pid);
2943                 binder_context_mgr_node = NULL;
2944         }
2945
2946         threads = 0;
2947         active_transactions = 0;
2948         while ((n = rb_first(&proc->threads))) {
2949                 struct binder_thread *thread;
2950
2951                 thread = rb_entry(n, struct binder_thread, rb_node);
2952                 threads++;
2953                 active_transactions += binder_free_thread(proc, thread);
2954         }
2955
2956         nodes = 0;
2957         incoming_refs = 0;
2958         while ((n = rb_first(&proc->nodes))) {
2959                 struct binder_node *node;
2960
2961                 node = rb_entry(n, struct binder_node, rb_node);
2962                 nodes++;
2963                 rb_erase(&node->rb_node, &proc->nodes);
2964                 incoming_refs = binder_node_release(node, incoming_refs);
2965         }
2966
2967         outgoing_refs = 0;
2968         while ((n = rb_first(&proc->refs_by_desc))) {
2969                 struct binder_ref *ref;
2970
2971                 ref = rb_entry(n, struct binder_ref, rb_node_desc);
2972                 outgoing_refs++;
2973                 binder_delete_ref(ref);
2974         }
2975
2976         binder_release_work(&proc->todo);
2977         binder_release_work(&proc->delivered_death);
2978
2979         buffers = 0;
2980         while ((n = rb_first(&proc->allocated_buffers))) {
2981                 struct binder_buffer *buffer;
2982
2983                 buffer = rb_entry(n, struct binder_buffer, rb_node);
2984
2985                 t = buffer->transaction;
2986                 if (t) {
2987                         t->buffer = NULL;
2988                         buffer->transaction = NULL;
2989                         pr_err("release proc %d, transaction %d, not freed\n",
2990                                proc->pid, t->debug_id);
2991                         /*BUG();*/
2992                 }
2993
2994                 binder_free_buf(proc, buffer);
2995                 buffers++;
2996         }
2997
2998         binder_stats_deleted(BINDER_STAT_PROC);
2999
3000         page_count = 0;
3001         if (proc->pages) {
3002                 int i;
3003
3004                 for (i = 0; i < proc->buffer_size / PAGE_SIZE; i++) {
3005                         void *page_addr;
3006
3007                         if (!proc->pages[i])
3008                                 continue;
3009
3010                         page_addr = proc->buffer + i * PAGE_SIZE;
3011                         binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
3012                                      "%s: %d: page %d at %p not freed\n",
3013                                      __func__, proc->pid, i, page_addr);
3014                         unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE);
3015                         __free_page(proc->pages[i]);
3016                         page_count++;
3017                 }
3018                 kfree(proc->pages);
3019                 vfree(proc->buffer);
3020         }
3021
3022         put_task_struct(proc->tsk);
3023
3024         binder_debug(BINDER_DEBUG_OPEN_CLOSE,
3025                      "%s: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d, buffers %d, pages %d\n",
3026                      __func__, proc->pid, threads, nodes, incoming_refs,
3027                      outgoing_refs, active_transactions, buffers, page_count);
3028
3029         kfree(proc);
3030 }
3031
3032 static void binder_deferred_func(struct work_struct *work)
3033 {
3034         struct binder_proc *proc;
3035         struct files_struct *files;
3036
3037         int defer;
3038         do {
3039                 binder_lock(__func__);
3040                 mutex_lock(&binder_deferred_lock);
3041                 if (!hlist_empty(&binder_deferred_list)) {
3042                         proc = hlist_entry(binder_deferred_list.first,
3043                                         struct binder_proc, deferred_work_node);
3044                         hlist_del_init(&proc->deferred_work_node);
3045                         defer = proc->deferred_work;
3046                         proc->deferred_work = 0;
3047                 } else {
3048                         proc = NULL;
3049                         defer = 0;
3050                 }
3051                 mutex_unlock(&binder_deferred_lock);
3052
3053                 files = NULL;
3054                 if (defer & BINDER_DEFERRED_PUT_FILES) {
3055                         files = proc->files;
3056                         if (files)
3057                                 proc->files = NULL;
3058                 }
3059
3060                 if (defer & BINDER_DEFERRED_FLUSH)
3061                         binder_deferred_flush(proc);
3062
3063                 if (defer & BINDER_DEFERRED_RELEASE)
3064                         binder_deferred_release(proc); /* frees proc */
3065
3066                 binder_unlock(__func__);
3067                 if (files)
3068                         put_files_struct(files);
3069         } while (proc);
3070 }
3071 static DECLARE_WORK(binder_deferred_work, binder_deferred_func);
3072
3073 static void
3074 binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer)
3075 {
3076         mutex_lock(&binder_deferred_lock);
3077         proc->deferred_work |= defer;
3078         if (hlist_unhashed(&proc->deferred_work_node)) {
3079                 hlist_add_head(&proc->deferred_work_node,
3080                                 &binder_deferred_list);
3081                 queue_work(binder_deferred_workqueue, &binder_deferred_work);
3082         }
3083         mutex_unlock(&binder_deferred_lock);
3084 }
3085
3086 static void print_binder_transaction(struct seq_file *m, const char *prefix,
3087                                      struct binder_transaction *t)
3088 {
3089         seq_printf(m,
3090                    "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d",
3091                    prefix, t->debug_id, t,
3092                    t->from ? t->from->proc->pid : 0,
3093                    t->from ? t->from->pid : 0,
3094                    t->to_proc ? t->to_proc->pid : 0,
3095                    t->to_thread ? t->to_thread->pid : 0,
3096                    t->code, t->flags, t->priority, t->need_reply);
3097         if (t->buffer == NULL) {
3098                 seq_puts(m, " buffer free\n");
3099                 return;
3100         }
3101         if (t->buffer->target_node)
3102                 seq_printf(m, " node %d",
3103                            t->buffer->target_node->debug_id);
3104         seq_printf(m, " size %zd:%zd data %p\n",
3105                    t->buffer->data_size, t->buffer->offsets_size,
3106                    t->buffer->data);
3107 }
3108
3109 static void print_binder_buffer(struct seq_file *m, const char *prefix,
3110                                 struct binder_buffer *buffer)
3111 {
3112         seq_printf(m, "%s %d: %p size %zd:%zd %s\n",
3113                    prefix, buffer->debug_id, buffer->data,
3114                    buffer->data_size, buffer->offsets_size,
3115                    buffer->transaction ? "active" : "delivered");
3116 }
3117
3118 static void print_binder_work(struct seq_file *m, const char *prefix,
3119                               const char *transaction_prefix,
3120                               struct binder_work *w)
3121 {
3122         struct binder_node *node;
3123         struct binder_transaction *t;
3124
3125         switch (w->type) {
3126         case BINDER_WORK_TRANSACTION:
3127                 t = container_of(w, struct binder_transaction, work);
3128                 print_binder_transaction(m, transaction_prefix, t);
3129                 break;
3130         case BINDER_WORK_TRANSACTION_COMPLETE:
3131                 seq_printf(m, "%stransaction complete\n", prefix);
3132                 break;
3133         case BINDER_WORK_NODE:
3134                 node = container_of(w, struct binder_node, work);
3135                 seq_printf(m, "%snode work %d: u%p c%p\n",
3136                            prefix, node->debug_id, node->ptr, node->cookie);
3137                 break;
3138         case BINDER_WORK_DEAD_BINDER:
3139                 seq_printf(m, "%shas dead binder\n", prefix);
3140                 break;
3141         case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
3142                 seq_printf(m, "%shas cleared dead binder\n", prefix);
3143                 break;
3144         case BINDER_WORK_CLEAR_DEATH_NOTIFICATION:
3145                 seq_printf(m, "%shas cleared death notification\n", prefix);
3146                 break;
3147         default:
3148                 seq_printf(m, "%sunknown work: type %d\n", prefix, w->type);
3149                 break;
3150         }
3151 }
3152
3153 static void print_binder_thread(struct seq_file *m,
3154                                 struct binder_thread *thread,
3155                                 int print_always)
3156 {
3157         struct binder_transaction *t;
3158         struct binder_work *w;
3159         size_t start_pos = m->count;
3160         size_t header_pos;
3161
3162         seq_printf(m, "  thread %d: l %02x\n", thread->pid, thread->looper);
3163         header_pos = m->count;
3164         t = thread->transaction_stack;
3165         while (t) {
3166                 if (t->from == thread) {
3167                         print_binder_transaction(m,
3168                                                  "    outgoing transaction", t);
3169                         t = t->from_parent;
3170                 } else if (t->to_thread == thread) {
3171                         print_binder_transaction(m,
3172                                                  "    incoming transaction", t);
3173                         t = t->to_parent;
3174                 } else {
3175                         print_binder_transaction(m, "    bad transaction", t);
3176                         t = NULL;
3177                 }
3178         }
3179         list_for_each_entry(w, &thread->todo, entry) {
3180                 print_binder_work(m, "    ", "    pending transaction", w);
3181         }
3182         if (!print_always && m->count == header_pos)
3183                 m->count = start_pos;
3184 }
3185
3186 static void print_binder_node(struct seq_file *m, struct binder_node *node)
3187 {
3188         struct binder_ref *ref;
3189         struct binder_work *w;
3190         int count;
3191
3192         count = 0;
3193         hlist_for_each_entry(ref, &node->refs, node_entry)
3194                 count++;
3195
3196         seq_printf(m, "  node %d: u%p c%p hs %d hw %d ls %d lw %d is %d iw %d",
3197                    node->debug_id, node->ptr, node->cookie,
3198                    node->has_strong_ref, node->has_weak_ref,
3199                    node->local_strong_refs, node->local_weak_refs,
3200                    node->internal_strong_refs, count);
3201         if (count) {
3202                 seq_puts(m, " proc");
3203                 hlist_for_each_entry(ref, &node->refs, node_entry)
3204                         seq_printf(m, " %d", ref->proc->pid);
3205         }
3206         seq_puts(m, "\n");
3207         list_for_each_entry(w, &node->async_todo, entry)
3208                 print_binder_work(m, "    ",
3209                                   "    pending async transaction", w);
3210 }
3211
3212 static void print_binder_ref(struct seq_file *m, struct binder_ref *ref)
3213 {
3214         seq_printf(m, "  ref %d: desc %d %snode %d s %d w %d d %p\n",
3215                    ref->debug_id, ref->desc, ref->node->proc ? "" : "dead ",
3216                    ref->node->debug_id, ref->strong, ref->weak, ref->death);
3217 }
3218
3219 static void print_binder_proc(struct seq_file *m,
3220                               struct binder_proc *proc, int print_all)
3221 {
3222         struct binder_work *w;
3223         struct rb_node *n;
3224         size_t start_pos = m->count;
3225         size_t header_pos;
3226
3227         seq_printf(m, "proc %d\n", proc->pid);
3228         header_pos = m->count;
3229
3230         for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n))
3231                 print_binder_thread(m, rb_entry(n, struct binder_thread,
3232                                                 rb_node), print_all);
3233         for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) {
3234                 struct binder_node *node = rb_entry(n, struct binder_node,
3235                                                     rb_node);
3236                 if (print_all || node->has_async_transaction)
3237                         print_binder_node(m, node);
3238         }
3239         if (print_all) {
3240                 for (n = rb_first(&proc->refs_by_desc);
3241                      n != NULL;
3242                      n = rb_next(n))
3243                         print_binder_ref(m, rb_entry(n, struct binder_ref,
3244                                                      rb_node_desc));
3245         }
3246         for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n))
3247                 print_binder_buffer(m, "  buffer",
3248                                     rb_entry(n, struct binder_buffer, rb_node));
3249         list_for_each_entry(w, &proc->todo, entry)
3250                 print_binder_work(m, "  ", "  pending transaction", w);
3251         list_for_each_entry(w, &proc->delivered_death, entry) {
3252                 seq_puts(m, "  has delivered dead binder\n");
3253                 break;
3254         }
3255         if (!print_all && m->count == header_pos)
3256                 m->count = start_pos;
3257 }
3258
3259 static const char * const binder_return_strings[] = {
3260         "BR_ERROR",
3261         "BR_OK",
3262         "BR_TRANSACTION",
3263         "BR_REPLY",
3264         "BR_ACQUIRE_RESULT",
3265         "BR_DEAD_REPLY",
3266         "BR_TRANSACTION_COMPLETE",
3267         "BR_INCREFS",
3268         "BR_ACQUIRE",
3269         "BR_RELEASE",
3270         "BR_DECREFS",
3271         "BR_ATTEMPT_ACQUIRE",
3272         "BR_NOOP",
3273         "BR_SPAWN_LOOPER",
3274         "BR_FINISHED",
3275         "BR_DEAD_BINDER",
3276         "BR_CLEAR_DEATH_NOTIFICATION_DONE",
3277         "BR_FAILED_REPLY"
3278 };
3279
3280 static const char * const binder_command_strings[] = {
3281         "BC_TRANSACTION",
3282         "BC_REPLY",
3283         "BC_ACQUIRE_RESULT",
3284         "BC_FREE_BUFFER",
3285         "BC_INCREFS",
3286         "BC_ACQUIRE",
3287         "BC_RELEASE",
3288         "BC_DECREFS",
3289         "BC_INCREFS_DONE",
3290         "BC_ACQUIRE_DONE",
3291         "BC_ATTEMPT_ACQUIRE",
3292         "BC_REGISTER_LOOPER",
3293         "BC_ENTER_LOOPER",
3294         "BC_EXIT_LOOPER",
3295         "BC_REQUEST_DEATH_NOTIFICATION",
3296         "BC_CLEAR_DEATH_NOTIFICATION",
3297         "BC_DEAD_BINDER_DONE"
3298 };
3299
3300 static const char * const binder_objstat_strings[] = {
3301         "proc",
3302         "thread",
3303         "node",
3304         "ref",
3305         "death",
3306         "transaction",
3307         "transaction_complete"
3308 };
3309
3310 static void print_binder_stats(struct seq_file *m, const char *prefix,
3311                                struct binder_stats *stats)
3312 {
3313         int i;
3314
3315         BUILD_BUG_ON(ARRAY_SIZE(stats->bc) !=
3316                      ARRAY_SIZE(binder_command_strings));
3317         for (i = 0; i < ARRAY_SIZE(stats->bc); i++) {
3318                 if (stats->bc[i])
3319                         seq_printf(m, "%s%s: %d\n", prefix,
3320                                    binder_command_strings[i], stats->bc[i]);
3321         }
3322
3323         BUILD_BUG_ON(ARRAY_SIZE(stats->br) !=
3324                      ARRAY_SIZE(binder_return_strings));
3325         for (i = 0; i < ARRAY_SIZE(stats->br); i++) {
3326                 if (stats->br[i])
3327                         seq_printf(m, "%s%s: %d\n", prefix,
3328                                    binder_return_strings[i], stats->br[i]);
3329         }
3330
3331         BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) !=
3332                      ARRAY_SIZE(binder_objstat_strings));
3333         BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) !=
3334                      ARRAY_SIZE(stats->obj_deleted));
3335         for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) {
3336                 if (stats->obj_created[i] || stats->obj_deleted[i])
3337                         seq_printf(m, "%s%s: active %d total %d\n", prefix,
3338                                 binder_objstat_strings[i],
3339                                 stats->obj_created[i] - stats->obj_deleted[i],
3340                                 stats->obj_created[i]);
3341         }
3342 }
3343
3344 static void print_binder_proc_stats(struct seq_file *m,
3345                                     struct binder_proc *proc)
3346 {
3347         struct binder_work *w;
3348         struct rb_node *n;
3349         int count, strong, weak;
3350
3351         seq_printf(m, "proc %d\n", proc->pid);
3352         count = 0;
3353         for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n))
3354                 count++;
3355         seq_printf(m, "  threads: %d\n", count);
3356         seq_printf(m, "  requested threads: %d+%d/%d\n"
3357                         "  ready threads %d\n"
3358                         "  free async space %zd\n", proc->requested_threads,
3359                         proc->requested_threads_started, proc->max_threads,
3360                         proc->ready_threads, proc->free_async_space);
3361         count = 0;
3362         for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n))
3363                 count++;
3364         seq_printf(m, "  nodes: %d\n", count);
3365         count = 0;
3366         strong = 0;
3367         weak = 0;
3368         for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) {
3369                 struct binder_ref *ref = rb_entry(n, struct binder_ref,
3370                                                   rb_node_desc);
3371                 count++;
3372                 strong += ref->strong;
3373                 weak += ref->weak;
3374         }
3375         seq_printf(m, "  refs: %d s %d w %d\n", count, strong, weak);
3376
3377         count = 0;
3378         for (n = rb_first(&proc->allocated_buffers); n != NULL; n = rb_next(n))
3379                 count++;
3380         seq_printf(m, "  buffers: %d\n", count);
3381
3382         count = 0;
3383         list_for_each_entry(w, &proc->todo, entry) {
3384                 switch (w->type) {
3385                 case BINDER_WORK_TRANSACTION:
3386                         count++;
3387                         break;
3388                 default:
3389                         break;
3390                 }
3391         }
3392         seq_printf(m, "  pending transactions: %d\n", count);
3393
3394         print_binder_stats(m, "  ", &proc->stats);
3395 }
3396
3397
3398 static int binder_state_show(struct seq_file *m, void *unused)
3399 {
3400         struct binder_proc *proc;
3401         struct binder_node *node;
3402         int do_lock = !binder_debug_no_lock;
3403
3404         if (do_lock)
3405                 binder_lock(__func__);
3406
3407         seq_puts(m, "binder state:\n");
3408
3409         if (!hlist_empty(&binder_dead_nodes))
3410                 seq_puts(m, "dead nodes:\n");
3411         hlist_for_each_entry(node, &binder_dead_nodes, dead_node)
3412                 print_binder_node(m, node);
3413
3414         hlist_for_each_entry(proc, &binder_procs, proc_node)
3415                 print_binder_proc(m, proc, 1);
3416         if (do_lock)
3417                 binder_unlock(__func__);
3418         return 0;
3419 }
3420
3421 static int binder_stats_show(struct seq_file *m, void *unused)
3422 {
3423         struct binder_proc *proc;
3424         int do_lock = !binder_debug_no_lock;
3425
3426         if (do_lock)
3427                 binder_lock(__func__);
3428
3429         seq_puts(m, "binder stats:\n");
3430
3431         print_binder_stats(m, "", &binder_stats);
3432
3433         hlist_for_each_entry(proc, &binder_procs, proc_node)
3434                 print_binder_proc_stats(m, proc);
3435         if (do_lock)
3436                 binder_unlock(__func__);
3437         return 0;
3438 }
3439
3440 static int binder_transactions_show(struct seq_file *m, void *unused)
3441 {
3442         struct binder_proc *proc;
3443         int do_lock = !binder_debug_no_lock;
3444
3445         if (do_lock)
3446                 binder_lock(__func__);
3447
3448         seq_puts(m, "binder transactions:\n");
3449         hlist_for_each_entry(proc, &binder_procs, proc_node)
3450                 print_binder_proc(m, proc, 0);
3451         if (do_lock)
3452                 binder_unlock(__func__);
3453         return 0;
3454 }
3455
3456 static int binder_proc_show(struct seq_file *m, void *unused)
3457 {
3458         struct binder_proc *proc = m->private;
3459         int do_lock = !binder_debug_no_lock;
3460
3461         if (do_lock)
3462                 binder_lock(__func__);
3463         seq_puts(m, "binder proc state:\n");
3464         print_binder_proc(m, proc, 1);
3465         if (do_lock)
3466                 binder_unlock(__func__);
3467         return 0;
3468 }
3469
3470 static void print_binder_transaction_log_entry(struct seq_file *m,
3471                                         struct binder_transaction_log_entry *e)
3472 {
3473         seq_printf(m,
3474                    "%d: %s from %d:%d to %d:%d node %d handle %d size %d:%d\n",
3475                    e->debug_id, (e->call_type == 2) ? "reply" :
3476                    ((e->call_type == 1) ? "async" : "call "), e->from_proc,
3477                    e->from_thread, e->to_proc, e->to_thread, e->to_node,
3478                    e->target_handle, e->data_size, e->offsets_size);
3479 }
3480
3481 static int binder_transaction_log_show(struct seq_file *m, void *unused)
3482 {
3483         struct binder_transaction_log *log = m->private;
3484         int i;
3485
3486         if (log->full) {
3487                 for (i = log->next; i < ARRAY_SIZE(log->entry); i++)
3488                         print_binder_transaction_log_entry(m, &log->entry[i]);
3489         }
3490         for (i = 0; i < log->next; i++)
3491                 print_binder_transaction_log_entry(m, &log->entry[i]);
3492         return 0;
3493 }
3494
3495 static const struct file_operations binder_fops = {
3496         .owner = THIS_MODULE,
3497         .poll = binder_poll,
3498         .unlocked_ioctl = binder_ioctl,
3499         .mmap = binder_mmap,
3500         .open = binder_open,
3501         .flush = binder_flush,
3502         .release = binder_release,
3503 };
3504
3505 static struct miscdevice binder_miscdev = {
3506         .minor = MISC_DYNAMIC_MINOR,
3507         .name = "binder",
3508         .fops = &binder_fops
3509 };
3510
3511 BINDER_DEBUG_ENTRY(state);
3512 BINDER_DEBUG_ENTRY(stats);
3513 BINDER_DEBUG_ENTRY(transactions);
3514 BINDER_DEBUG_ENTRY(transaction_log);
3515
3516 static int __init binder_init(void)
3517 {
3518         int ret;
3519
3520         binder_deferred_workqueue = create_singlethread_workqueue("binder");
3521         if (!binder_deferred_workqueue)
3522                 return -ENOMEM;
3523
3524         binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL);
3525         if (binder_debugfs_dir_entry_root)
3526                 binder_debugfs_dir_entry_proc = debugfs_create_dir("proc",
3527                                                  binder_debugfs_dir_entry_root);
3528         ret = misc_register(&binder_miscdev);
3529         if (binder_debugfs_dir_entry_root) {
3530                 debugfs_create_file("state",
3531                                     S_IRUGO,
3532                                     binder_debugfs_dir_entry_root,
3533                                     NULL,
3534                                     &binder_state_fops);
3535                 debugfs_create_file("stats",
3536                                     S_IRUGO,
3537                                     binder_debugfs_dir_entry_root,
3538                                     NULL,
3539                                     &binder_stats_fops);
3540                 debugfs_create_file("transactions",
3541                                     S_IRUGO,
3542                                     binder_debugfs_dir_entry_root,
3543                                     NULL,
3544                                     &binder_transactions_fops);
3545                 debugfs_create_file("transaction_log",
3546                                     S_IRUGO,
3547                                     binder_debugfs_dir_entry_root,
3548                                     &binder_transaction_log,
3549                                     &binder_transaction_log_fops);
3550                 debugfs_create_file("failed_transaction_log",
3551                                     S_IRUGO,
3552                                     binder_debugfs_dir_entry_root,
3553                                     &binder_transaction_log_failed,
3554                                     &binder_transaction_log_fops);
3555         }
3556         return ret;
3557 }
3558
3559 device_initcall(binder_init);
3560
3561 #define CREATE_TRACE_POINTS
3562 #include "binder_trace.h"
3563
3564 MODULE_LICENSE("GPL v2");