binder.c 167 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
/* binder.c
 *
 * Android IPC Subsystem
 *
 * Copyright (C) 2007-2008 Google, Inc.
 *
 * This software is licensed under the terms of the GNU General Public
 * License version 2, as published by the Free Software Foundation, and
 * may be copied, distributed, and modified under those terms.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 */

18 19 20 21 22 23 24 25 26 27 28 29 30
/*
 * Locking overview
 *
 * There are 3 main spinlocks which must be acquired in the
 * order shown:
 *
 * 1) proc->outer_lock : protects binder_ref
 *    binder_proc_lock() and binder_proc_unlock() are
 *    used to acq/rel.
 * 2) node->lock : protects most fields of binder_node.
 *    binder_node_lock() and binder_node_unlock() are
 *    used to acq/rel
 * 3) proc->inner_lock : protects the thread and node lists
31 32 33 34
 *    (proc->threads, proc->waiting_threads, proc->nodes)
 *    and all todo lists associated with the binder_proc
 *    (proc->todo, thread->todo, proc->delivered_death and
 *    node->async_todo), as well as thread->transaction_stack
35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51
 *    binder_inner_proc_lock() and binder_inner_proc_unlock()
 *    are used to acq/rel
 *
 * Any lock under procA must never be nested under any lock at the same
 * level or below on procB.
 *
 * Functions that require a lock held on entry indicate which lock
 * in the suffix of the function name:
 *
 * foo_olocked() : requires node->outer_lock
 * foo_nlocked() : requires node->lock
 * foo_ilocked() : requires proc->inner_lock
 * foo_oilocked(): requires proc->outer_lock and proc->inner_lock
 * foo_nilocked(): requires node->lock and proc->inner_lock
 * ...
 */

52 53
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

54 55
#include <linux/fdtable.h>
#include <linux/file.h>
56
#include <linux/freezer.h>
57 58 59 60 61 62 63
#include <linux/fs.h>
#include <linux/list.h>
#include <linux/miscdevice.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/nsproxy.h>
#include <linux/poll.h>
64
#include <linux/debugfs.h>
65
#include <linux/rbtree.h>
66
#include <linux/sched/signal.h>
67
#include <linux/sched/mm.h>
68
#include <linux/seq_file.h>
69
#include <linux/uaccess.h>
70
#include <linux/pid_namespace.h>
71
#include <linux/security.h>
72
#include <linux/spinlock.h>
73
#include <linux/ratelimit.h>
74
#include <linux/syscalls.h>
75

76
#include <uapi/linux/android/binder.h>
77 78 79

#include <asm/cacheflush.h>

80
#include "binder_alloc.h"
81
#include "binder_trace.h"
82

83
static HLIST_HEAD(binder_deferred_list);
84 85
static DEFINE_MUTEX(binder_deferred_lock);

86
static HLIST_HEAD(binder_devices);
87
static HLIST_HEAD(binder_procs);
88 89
static DEFINE_MUTEX(binder_procs_lock);

90
static HLIST_HEAD(binder_dead_nodes);
91
static DEFINE_SPINLOCK(binder_dead_nodes_lock);
92

93 94
static struct dentry *binder_debugfs_dir_entry_root;
static struct dentry *binder_debugfs_dir_entry_proc;
95
static atomic_t binder_last_id;
96

97 98 99
#define BINDER_DEBUG_ENTRY(name) \
static int binder_##name##_open(struct inode *inode, struct file *file) \
{ \
100
	return single_open(file, binder_##name##_show, inode->i_private); \
101 102 103 104 105 106 107 108 109 110 111 112
} \
\
static const struct file_operations binder_##name##_fops = { \
	.owner = THIS_MODULE, \
	.open = binder_##name##_open, \
	.read = seq_read, \
	.llseek = seq_lseek, \
	.release = single_release, \
}

static int binder_proc_show(struct seq_file *m, void *unused);
BINDER_DEBUG_ENTRY(proc);
113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138

/* This is only defined in include/asm-arm/sizes.h */
#ifndef SZ_1K
#define SZ_1K                               0x400
#endif

#ifndef SZ_4M
#define SZ_4M                               0x400000
#endif

#define FORBIDDEN_MMAP_FLAGS                (VM_WRITE)

enum {
	BINDER_DEBUG_USER_ERROR             = 1U << 0,
	BINDER_DEBUG_FAILED_TRANSACTION     = 1U << 1,
	BINDER_DEBUG_DEAD_TRANSACTION       = 1U << 2,
	BINDER_DEBUG_OPEN_CLOSE             = 1U << 3,
	BINDER_DEBUG_DEAD_BINDER            = 1U << 4,
	BINDER_DEBUG_DEATH_NOTIFICATION     = 1U << 5,
	BINDER_DEBUG_READ_WRITE             = 1U << 6,
	BINDER_DEBUG_USER_REFS              = 1U << 7,
	BINDER_DEBUG_THREADS                = 1U << 8,
	BINDER_DEBUG_TRANSACTION            = 1U << 9,
	BINDER_DEBUG_TRANSACTION_COMPLETE   = 1U << 10,
	BINDER_DEBUG_FREE_BUFFER            = 1U << 11,
	BINDER_DEBUG_INTERNAL_REFS          = 1U << 12,
139
	BINDER_DEBUG_PRIORITY_CAP           = 1U << 13,
140
	BINDER_DEBUG_SPINLOCKS              = 1U << 14,
141 142 143
};
static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR |
	BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION;
144
module_param_named(debug_mask, binder_debug_mask, uint, 0644);
145

146 147 148
static char *binder_devices_param = CONFIG_ANDROID_BINDER_DEVICES;
module_param_named(devices, binder_devices_param, charp, 0444);

149 150 151 152
static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait);
static int binder_stop_on_user_error;

static int binder_set_stop_on_user_error(const char *val,
153
					 const struct kernel_param *kp)
154 155
{
	int ret;
156

157 158 159 160 161 162
	ret = param_set_int(val, kp);
	if (binder_stop_on_user_error < 2)
		wake_up(&binder_user_error_wait);
	return ret;
}
module_param_call(stop_on_user_error, binder_set_stop_on_user_error,
163
	param_get_int, &binder_stop_on_user_error, 0644);
164 165 166 167

#define binder_debug(mask, x...) \
	do { \
		if (binder_debug_mask & mask) \
168
			pr_info_ratelimited(x); \
169 170 171 172 173
	} while (0)

#define binder_user_error(x...) \
	do { \
		if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \
174
			pr_info_ratelimited(x); \
175 176 177 178
		if (binder_stop_on_user_error) \
			binder_stop_on_user_error = 2; \
	} while (0)

179 180 181 182 183
#define to_flat_binder_object(hdr) \
	container_of(hdr, struct flat_binder_object, hdr)

#define to_binder_fd_object(hdr) container_of(hdr, struct binder_fd_object, hdr)

184 185 186
#define to_binder_buffer_object(hdr) \
	container_of(hdr, struct binder_buffer_object, hdr)

187 188 189
#define to_binder_fd_array_object(hdr) \
	container_of(hdr, struct binder_fd_array_object, hdr)

190 191 192 193 194 195 196 197 198 199 200 201
enum binder_stat_types {
	BINDER_STAT_PROC,
	BINDER_STAT_THREAD,
	BINDER_STAT_NODE,
	BINDER_STAT_REF,
	BINDER_STAT_DEATH,
	BINDER_STAT_TRANSACTION,
	BINDER_STAT_TRANSACTION_COMPLETE,
	BINDER_STAT_COUNT
};

struct binder_stats {
202 203 204 205
	atomic_t br[_IOC_NR(BR_FAILED_REPLY) + 1];
	atomic_t bc[_IOC_NR(BC_REPLY_SG) + 1];
	atomic_t obj_created[BINDER_STAT_COUNT];
	atomic_t obj_deleted[BINDER_STAT_COUNT];
206 207 208 209 210 211
};

static struct binder_stats binder_stats;

static inline void binder_stats_deleted(enum binder_stat_types type)
{
212
	atomic_inc(&binder_stats.obj_deleted[type]);
213 214 215 216
}

static inline void binder_stats_created(enum binder_stat_types type)
{
217
	atomic_inc(&binder_stats.obj_created[type]);
218 219 220 221
}

struct binder_transaction_log_entry {
	int debug_id;
222
	int debug_id_done;
223 224 225 226 227 228 229 230 231
	int call_type;
	int from_proc;
	int from_thread;
	int target_handle;
	int to_proc;
	int to_thread;
	int to_node;
	int data_size;
	int offsets_size;
232 233 234
	int return_error_line;
	uint32_t return_error;
	uint32_t return_error_param;
235
	const char *context_name;
236 237
};
struct binder_transaction_log {
238 239
	atomic_t cur;
	bool full;
240 241 242 243 244 245 246 247 248
	struct binder_transaction_log_entry entry[32];
};
static struct binder_transaction_log binder_transaction_log;
static struct binder_transaction_log binder_transaction_log_failed;

static struct binder_transaction_log_entry *binder_transaction_log_add(
	struct binder_transaction_log *log)
{
	struct binder_transaction_log_entry *e;
249
	unsigned int cur = atomic_inc_return(&log->cur);
250

251
	if (cur >= ARRAY_SIZE(log->entry))
252
		log->full = true;
253 254 255 256 257 258 259 260 261
	e = &log->entry[cur % ARRAY_SIZE(log->entry)];
	WRITE_ONCE(e->debug_id_done, 0);
	/*
	 * write-barrier to synchronize access to e->debug_id_done.
	 * We make sure the initialized 0 value is seen before
	 * memset() other fields are zeroed by memset.
	 */
	smp_wmb();
	memset(e, 0, sizeof(*e));
262 263 264
	return e;
}

265 266
struct binder_context {
	struct binder_node *binder_context_mgr_node;
267 268
	struct mutex context_mgr_node_lock;

269
	kuid_t binder_context_mgr_uid;
270
	const char *name;
271 272
};

273 274 275 276
struct binder_device {
	struct hlist_node hlist;
	struct miscdevice miscdev;
	struct binder_context context;
277 278
};

279 280 281 282 283 284 285
/**
 * struct binder_work - work enqueued on a worklist
 * @entry:             node enqueued on list
 * @type:              type of work to be performed
 *
 * There are separate work lists for proc, thread, and node (async).
 */
286 287
struct binder_work {
	struct list_head entry;
288

289 290 291
	enum {
		BINDER_WORK_TRANSACTION = 1,
		BINDER_WORK_TRANSACTION_COMPLETE,
292
		BINDER_WORK_RETURN_ERROR,
293 294 295 296 297 298 299
		BINDER_WORK_NODE,
		BINDER_WORK_DEAD_BINDER,
		BINDER_WORK_DEAD_BINDER_AND_CLEAR,
		BINDER_WORK_CLEAR_DEATH_NOTIFICATION,
	} type;
};

300 301 302 303 304
struct binder_error {
	struct binder_work work;
	uint32_t cmd;
};

305 306 307 308 309 310
/**
 * struct binder_node - binder node bookkeeping
 * @debug_id:             unique ID for debugging
 *                        (invariant after initialized)
 * @lock:                 lock for node fields
 * @work:                 worklist element for node work
311
 *                        (protected by @proc->inner_lock)
312
 * @rb_node:              element for proc->nodes tree
313
 *                        (protected by @proc->inner_lock)
314 315 316 317 318
 * @dead_node:            element for binder_dead_nodes list
 *                        (protected by binder_dead_nodes_lock)
 * @proc:                 binder_proc that owns this node
 *                        (invariant after initialized)
 * @refs:                 list of references on this node
319
 *                        (protected by @lock)
320 321
 * @internal_strong_refs: used to take strong references when
 *                        initiating a transaction
322 323
 *                        (protected by @proc->inner_lock if @proc
 *                        and by @lock)
324
 * @local_weak_refs:      weak user refs from local process
325 326
 *                        (protected by @proc->inner_lock if @proc
 *                        and by @lock)
327
 * @local_strong_refs:    strong user refs from local process
328 329
 *                        (protected by @proc->inner_lock if @proc
 *                        and by @lock)
330
 * @tmp_refs:             temporary kernel refs
331 332 333 334 335
 *                        (protected by @proc->inner_lock while @proc
 *                        is valid, and by binder_dead_nodes_lock
 *                        if @proc is NULL. During inc/dec and node release
 *                        it is also protected by @lock to provide safety
 *                        as the node dies and @proc becomes NULL)
336 337 338 339 340
 * @ptr:                  userspace pointer for node
 *                        (invariant, no lock needed)
 * @cookie:               userspace cookie for node
 *                        (invariant, no lock needed)
 * @has_strong_ref:       userspace notified of strong ref
341 342
 *                        (protected by @proc->inner_lock if @proc
 *                        and by @lock)
343
 * @pending_strong_ref:   userspace has acked notification of strong ref
344 345
 *                        (protected by @proc->inner_lock if @proc
 *                        and by @lock)
346
 * @has_weak_ref:         userspace notified of weak ref
347 348
 *                        (protected by @proc->inner_lock if @proc
 *                        and by @lock)
349
 * @pending_weak_ref:     userspace has acked notification of weak ref
350 351
 *                        (protected by @proc->inner_lock if @proc
 *                        and by @lock)
352
 * @has_async_transaction: async transaction to node in progress
353
 *                        (protected by @lock)
354 355 356 357 358
 * @accept_fds:           file descriptor operations supported for node
 *                        (invariant after initialized)
 * @min_priority:         minimum scheduling priority
 *                        (invariant after initialized)
 * @async_todo:           list of async work items
359
 *                        (protected by @proc->inner_lock)
360 361 362
 *
 * Bookkeeping structure for binder nodes.
 */
363 364
struct binder_node {
	int debug_id;
365
	spinlock_t lock;
366 367 368 369 370 371 372 373 374 375
	struct binder_work work;
	union {
		struct rb_node rb_node;
		struct hlist_node dead_node;
	};
	struct binder_proc *proc;
	struct hlist_head refs;
	int internal_strong_refs;
	int local_weak_refs;
	int local_strong_refs;
376
	int tmp_refs;
377 378
	binder_uintptr_t ptr;
	binder_uintptr_t cookie;
379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396
	struct {
		/*
		 * bitfield elements protected by
		 * proc inner_lock
		 */
		u8 has_strong_ref:1;
		u8 pending_strong_ref:1;
		u8 has_weak_ref:1;
		u8 pending_weak_ref:1;
	};
	struct {
		/*
		 * invariant after initialization
		 */
		u8 accept_fds:1;
		u8 min_priority;
	};
	bool has_async_transaction;
397 398 399 400
	struct list_head async_todo;
};

struct binder_ref_death {
401 402 403 404 405
	/**
	 * @work: worklist element for death notifications
	 *        (protected by inner_lock of the proc that
	 *        this ref belongs to)
	 */
406
	struct binder_work work;
407
	binder_uintptr_t cookie;
408 409
};

410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434
/**
 * struct binder_ref_data - binder_ref counts and id
 * @debug_id:        unique ID for the ref
 * @desc:            unique userspace handle for ref
 * @strong:          strong ref count (debugging only if not locked)
 * @weak:            weak ref count (debugging only if not locked)
 *
 * Structure to hold ref count and ref id information. Since
 * the actual ref can only be accessed with a lock, this structure
 * is used to return information about the ref to callers of
 * ref inc/dec functions.
 */
struct binder_ref_data {
	int debug_id;
	uint32_t desc;
	int strong;
	int weak;
};

/**
 * struct binder_ref - struct to track references on nodes
 * @data:        binder_ref_data containing id, handle, and current refcounts
 * @rb_node_desc: node for lookup by @data.desc in proc's rb_tree
 * @rb_node_node: node for lookup by @node in proc's rb_tree
 * @node_entry:  list entry for node->refs list in target node
435
 *               (protected by @node->lock)
436 437 438 439 440
 * @proc:        binder_proc containing ref
 * @node:        binder_node of target node. When cleaning up a
 *               ref for deletion in binder_cleanup_ref, a non-NULL
 *               @node indicates the node must be freed
 * @death:       pointer to death notification (ref_death) if requested
441
 *               (protected by @node->lock)
442 443 444 445
 *
 * Structure to track references from procA to target node (on procB). This
 * structure is unsafe to access without holding @proc->outer_lock.
 */
446 447 448 449 450
struct binder_ref {
	/* Lookups needed: */
	/*   node + proc => ref (transaction) */
	/*   desc + proc => ref (transaction, inc/dec ref) */
	/*   node => refs + procs (proc exit) */
451
	struct binder_ref_data data;
452 453 454 455 456 457 458 459 460
	struct rb_node rb_node_desc;
	struct rb_node rb_node_node;
	struct hlist_node node_entry;
	struct binder_proc *proc;
	struct binder_node *node;
	struct binder_ref_death *death;
};

enum binder_deferred_state {
461 462
	BINDER_DEFERRED_FLUSH        = 0x01,
	BINDER_DEFERRED_RELEASE      = 0x02,
463 464
};

465 466 467 468
/**
 * struct binder_proc - binder process bookkeeping
 * @proc_node:            element for binder_procs list
 * @threads:              rbtree of binder_threads in this proc
469
 *                        (protected by @inner_lock)
470 471
 * @nodes:                rbtree of binder nodes associated with
 *                        this proc ordered by node->ptr
472
 *                        (protected by @inner_lock)
473
 * @refs_by_desc:         rbtree of refs ordered by ref->desc
474
 *                        (protected by @outer_lock)
475
 * @refs_by_node:         rbtree of refs ordered by ref->node
476
 *                        (protected by @outer_lock)
477 478
 * @waiting_threads:      threads currently waiting for proc work
 *                        (protected by @inner_lock)
479 480 481 482 483 484 485 486 487 488
 * @pid                   PID of group_leader of process
 *                        (invariant after initialized)
 * @tsk                   task_struct for group_leader of process
 *                        (invariant after initialized)
 * @deferred_work_node:   element for binder_deferred_list
 *                        (protected by binder_deferred_lock)
 * @deferred_work:        bitmap of deferred work to perform
 *                        (protected by binder_deferred_lock)
 * @is_dead:              process is dead and awaiting free
 *                        when outstanding transactions are cleaned up
489
 *                        (protected by @inner_lock)
490
 * @todo:                 list of work for this process
491
 *                        (protected by @inner_lock)
492 493 494
 * @stats:                per-process binder statistics
 *                        (atomics, no lock needed)
 * @delivered_death:      list of delivered death notification
495
 *                        (protected by @inner_lock)
496
 * @max_threads:          cap on number of binder threads
497
 *                        (protected by @inner_lock)
498 499 500
 * @requested_threads:    number of binder threads requested but not
 *                        yet started. In current implementation, can
 *                        only be 0 or 1.
501
 *                        (protected by @inner_lock)
502
 * @requested_threads_started: number binder threads started
503
 *                        (protected by @inner_lock)
504
 * @tmp_ref:              temporary reference to indicate proc is in use
505
 *                        (protected by @inner_lock)
506 507 508 509 510 511 512 513 514 515 516 517
 * @default_priority:     default scheduler priority
 *                        (invariant after initialized)
 * @debugfs_entry:        debugfs node
 * @alloc:                binder allocator bookkeeping
 * @context:              binder_context for this proc
 *                        (invariant after initialized)
 * @inner_lock:           can nest under outer_lock and/or node lock
 * @outer_lock:           no nesting under innor or node lock
 *                        Lock order: 1) outer, 2) node, 3) inner
 *
 * Bookkeeping structure for binder processes
 */
518 519 520 521 522 523
struct binder_proc {
	struct hlist_node proc_node;
	struct rb_root threads;
	struct rb_root nodes;
	struct rb_root refs_by_desc;
	struct rb_root refs_by_node;
524
	struct list_head waiting_threads;
525 526 527 528
	int pid;
	struct task_struct *tsk;
	struct hlist_node deferred_work_node;
	int deferred_work;
529
	bool is_dead;
530 531 532 533 534 535 536

	struct list_head todo;
	struct binder_stats stats;
	struct list_head delivered_death;
	int max_threads;
	int requested_threads;
	int requested_threads_started;
537
	int tmp_ref;
538
	long default_priority;
539
	struct dentry *debugfs_entry;
540
	struct binder_alloc alloc;
541
	struct binder_context *context;
542 543
	spinlock_t inner_lock;
	spinlock_t outer_lock;
544 545 546 547 548 549 550 551
};

enum {
	BINDER_LOOPER_STATE_REGISTERED  = 0x01,
	BINDER_LOOPER_STATE_ENTERED     = 0x02,
	BINDER_LOOPER_STATE_EXITED      = 0x04,
	BINDER_LOOPER_STATE_INVALID     = 0x08,
	BINDER_LOOPER_STATE_WAITING     = 0x10,
552
	BINDER_LOOPER_STATE_POLL        = 0x20,
553 554
};

555 556 557 558 559
/**
 * struct binder_thread - binder thread bookkeeping
 * @proc:                 binder process for this thread
 *                        (invariant after initialization)
 * @rb_node:              element for proc->threads rbtree
560
 *                        (protected by @proc->inner_lock)
561 562
 * @waiting_thread_node:  element for @proc->waiting_threads list
 *                        (protected by @proc->inner_lock)
563 564 565 566 567 568 569
 * @pid:                  PID for this thread
 *                        (invariant after initialization)
 * @looper:               bitmap of looping state
 *                        (only accessed by this thread)
 * @looper_needs_return:  looping thread needs to exit driver
 *                        (no lock needed)
 * @transaction_stack:    stack of in-progress transactions for this thread
570
 *                        (protected by @proc->inner_lock)
571
 * @todo:                 list of work to do for this thread
572
 *                        (protected by @proc->inner_lock)
573 574
 * @process_todo:         whether work in @todo should be processed
 *                        (protected by @proc->inner_lock)
575 576 577
 * @return_error:         transaction errors reported by this thread
 *                        (only accessed by this thread)
 * @reply_error:          transaction errors reported by target thread
578
 *                        (protected by @proc->inner_lock)
579 580 581 582 583 584 585 586
 * @wait:                 wait queue for thread work
 * @stats:                per-thread statistics
 *                        (atomics, no lock needed)
 * @tmp_ref:              temporary reference to indicate thread is in use
 *                        (atomic since @proc->inner_lock cannot
 *                        always be acquired)
 * @is_dead:              thread is dead and awaiting free
 *                        when outstanding transactions are cleaned up
587
 *                        (protected by @proc->inner_lock)
588 589 590
 *
 * Bookkeeping structure for binder threads.
 */
591 592 593
struct binder_thread {
	struct binder_proc *proc;
	struct rb_node rb_node;
594
	struct list_head waiting_thread_node;
595
	int pid;
596 597
	int looper;              /* only modified by this thread */
	bool looper_need_return; /* can be written by other thread */
598 599
	struct binder_transaction *transaction_stack;
	struct list_head todo;
600
	bool process_todo;
601 602
	struct binder_error return_error;
	struct binder_error reply_error;
603 604
	wait_queue_head_t wait;
	struct binder_stats stats;
605 606
	atomic_t tmp_ref;
	bool is_dead;
607 608
};

609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625
/**
 * struct binder_txn_fd_fixup - transaction fd fixup list element
 * @fixup_entry:          list entry
 * @file:                 struct file to be associated with new fd
 * @offset:               offset in buffer data to this fixup
 *
 * List element for fd fixups in a transaction. Since file
 * descriptors need to be allocated in the context of the
 * target process, we pass each fd to be processed in this
 * struct.
 */
struct binder_txn_fd_fixup {
	struct list_head fixup_entry;
	struct file *file;
	size_t offset;
};

626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641
struct binder_transaction {
	int debug_id;
	struct binder_work work;
	struct binder_thread *from;
	struct binder_transaction *from_parent;
	struct binder_proc *to_proc;
	struct binder_thread *to_thread;
	struct binder_transaction *to_parent;
	unsigned need_reply:1;
	/* unsigned is_dead:1; */	/* not used at the moment */

	struct binder_buffer *buffer;
	unsigned int	code;
	unsigned int	flags;
	long	priority;
	long	saved_priority;
642
	kuid_t	sender_euid;
643
	struct list_head fd_fixups;
644 645 646 647 648 649 650
	/**
	 * @lock:  protects @from, @to_proc, and @to_thread
	 *
	 * @from, @to_proc, and @to_thread can be set to NULL
	 * during thread teardown
	 */
	spinlock_t lock;
651 652
};

653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743
/**
 * binder_proc_lock() - Acquire outer lock for given binder_proc
 * @proc:         struct binder_proc to acquire
 *
 * Acquires proc->outer_lock. Used to protect binder_ref
 * structures associated with the given proc.
 */
#define binder_proc_lock(proc) _binder_proc_lock(proc, __LINE__)
static void
_binder_proc_lock(struct binder_proc *proc, int line)
{
	binder_debug(BINDER_DEBUG_SPINLOCKS,
		     "%s: line=%d\n", __func__, line);
	spin_lock(&proc->outer_lock);
}

/**
 * binder_proc_unlock() - Release spinlock for given binder_proc
 * @proc:         struct binder_proc to acquire
 *
 * Release lock acquired via binder_proc_lock()
 */
#define binder_proc_unlock(_proc) _binder_proc_unlock(_proc, __LINE__)
static void
_binder_proc_unlock(struct binder_proc *proc, int line)
{
	binder_debug(BINDER_DEBUG_SPINLOCKS,
		     "%s: line=%d\n", __func__, line);
	spin_unlock(&proc->outer_lock);
}

/**
 * binder_inner_proc_lock() - Acquire inner lock for given binder_proc
 * @proc:         struct binder_proc to acquire
 *
 * Acquires proc->inner_lock. Used to protect todo lists
 */
#define binder_inner_proc_lock(proc) _binder_inner_proc_lock(proc, __LINE__)
static void
_binder_inner_proc_lock(struct binder_proc *proc, int line)
{
	binder_debug(BINDER_DEBUG_SPINLOCKS,
		     "%s: line=%d\n", __func__, line);
	spin_lock(&proc->inner_lock);
}

/**
 * binder_inner_proc_unlock() - Release inner lock for given binder_proc
 * @proc:         struct binder_proc to acquire
 *
 * Release lock acquired via binder_inner_proc_lock()
 */
#define binder_inner_proc_unlock(proc) _binder_inner_proc_unlock(proc, __LINE__)
static void
_binder_inner_proc_unlock(struct binder_proc *proc, int line)
{
	binder_debug(BINDER_DEBUG_SPINLOCKS,
		     "%s: line=%d\n", __func__, line);
	spin_unlock(&proc->inner_lock);
}

/**
 * binder_node_lock() - Acquire spinlock for given binder_node
 * @node:         struct binder_node to acquire
 *
 * Acquires node->lock. Used to protect binder_node fields
 */
#define binder_node_lock(node) _binder_node_lock(node, __LINE__)
static void
_binder_node_lock(struct binder_node *node, int line)
{
	binder_debug(BINDER_DEBUG_SPINLOCKS,
		     "%s: line=%d\n", __func__, line);
	spin_lock(&node->lock);
}

/**
 * binder_node_unlock() - Release spinlock for given binder_proc
 * @node:         struct binder_node to acquire
 *
 * Release lock acquired via binder_node_lock()
 */
#define binder_node_unlock(node) _binder_node_unlock(node, __LINE__)
static void
_binder_node_unlock(struct binder_node *node, int line)
{
	binder_debug(BINDER_DEBUG_SPINLOCKS,
		     "%s: line=%d\n", __func__, line);
	spin_unlock(&node->lock);
}

744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780
/**
 * binder_node_inner_lock() - Acquire node and inner locks
 * @node:         struct binder_node to acquire
 *
 * Acquires node->lock. If node->proc also acquires
 * proc->inner_lock. Used to protect binder_node fields
 */
#define binder_node_inner_lock(node) _binder_node_inner_lock(node, __LINE__)
static void
_binder_node_inner_lock(struct binder_node *node, int line)
{
	binder_debug(BINDER_DEBUG_SPINLOCKS,
		     "%s: line=%d\n", __func__, line);
	spin_lock(&node->lock);
	if (node->proc)
		binder_inner_proc_lock(node->proc);
}

/**
 * binder_node_unlock() - Release node and inner locks
 * @node:         struct binder_node to acquire
 *
 * Release lock acquired via binder_node_lock()
 */
#define binder_node_inner_unlock(node) _binder_node_inner_unlock(node, __LINE__)
static void
_binder_node_inner_unlock(struct binder_node *node, int line)
{
	struct binder_proc *proc = node->proc;

	binder_debug(BINDER_DEBUG_SPINLOCKS,
		     "%s: line=%d\n", __func__, line);
	if (proc)
		binder_inner_proc_unlock(proc);
	spin_unlock(&node->lock);
}

781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803
static bool binder_worklist_empty_ilocked(struct list_head *list)
{
	return list_empty(list);
}

/**
 * binder_worklist_empty() - Check if no items on the work list
 * @proc:       binder_proc associated with list
 * @list:	list to check
 *
 * Return: true if there are no items on list, else false
 */
static bool binder_worklist_empty(struct binder_proc *proc,
				  struct list_head *list)
{
	bool ret;

	binder_inner_proc_lock(proc);
	ret = binder_worklist_empty_ilocked(list);
	binder_inner_proc_unlock(proc);
	return ret;
}

804 805 806 807 808 809 810 811 812 813
/**
 * binder_enqueue_work_ilocked() - Add an item to the work list
 * @work:         struct binder_work to add to list
 * @target_list:  list to add work to
 *
 * Adds the work to the specified list. Asserts that work
 * is not already on a list.
 *
 * Requires the proc->inner_lock to be held.
 */
814 815 816 817 818 819 820 821 822 823
static void
binder_enqueue_work_ilocked(struct binder_work *work,
			   struct list_head *target_list)
{
	BUG_ON(target_list == NULL);
	BUG_ON(work->entry.next && !list_empty(&work->entry));
	list_add_tail(&work->entry, target_list);
}

/**
824 825
 * binder_enqueue_deferred_thread_work_ilocked() - Add deferred thread work
 * @thread:       thread to queue work to
826 827
 * @work:         struct binder_work to add to list
 *
828 829 830 831 832
 * Adds the work to the todo list of the thread. Doesn't set the process_todo
 * flag, which means that (if it wasn't already set) the thread will go to
 * sleep without handling this work when it calls read.
 *
 * Requires the proc->inner_lock to be held.
833 834
 */
static void
835 836
binder_enqueue_deferred_thread_work_ilocked(struct binder_thread *thread,
					    struct binder_work *work)
837
{
838
	WARN_ON(!list_empty(&thread->waiting_thread_node));
839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855
	binder_enqueue_work_ilocked(work, &thread->todo);
}

/**
 * binder_enqueue_thread_work_ilocked() - Add an item to the thread work list
 * @thread:       thread to queue work to
 * @work:         struct binder_work to add to list
 *
 * Adds the work to the todo list of the thread, and enables processing
 * of the todo queue.
 *
 * Requires the proc->inner_lock to be held.
 */
static void
binder_enqueue_thread_work_ilocked(struct binder_thread *thread,
				   struct binder_work *work)
{
856
	WARN_ON(!list_empty(&thread->waiting_thread_node));
857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875
	binder_enqueue_work_ilocked(work, &thread->todo);
	thread->process_todo = true;
}

/**
 * binder_enqueue_thread_work() - Add an item to the thread work list
 * @thread:       thread to queue work to
 * @work:         struct binder_work to add to list
 *
 * Adds the work to the todo list of the thread, and enables processing
 * of the todo queue.
 */
static void
binder_enqueue_thread_work(struct binder_thread *thread,
			   struct binder_work *work)
{
	binder_inner_proc_lock(thread->proc);
	binder_enqueue_thread_work_ilocked(thread, work);
	binder_inner_proc_unlock(thread->proc);
876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931
}

static void
binder_dequeue_work_ilocked(struct binder_work *work)
{
	list_del_init(&work->entry);
}

/**
 * binder_dequeue_work() - Removes an item from the work list
 * @proc:         binder_proc associated with list
 * @work:         struct binder_work to remove from list
 *
 * Removes the specified work item from whatever list it is on.
 * Can safely be called if work is not on any list.
 */
static void
binder_dequeue_work(struct binder_proc *proc, struct binder_work *work)
{
	binder_inner_proc_lock(proc);
	binder_dequeue_work_ilocked(work);
	binder_inner_proc_unlock(proc);
}

static struct binder_work *binder_dequeue_work_head_ilocked(
					struct list_head *list)
{
	struct binder_work *w;

	w = list_first_entry_or_null(list, struct binder_work, entry);
	if (w)
		list_del_init(&w->entry);
	return w;
}

/**
 * binder_dequeue_work_head() - Dequeues the item at head of list
 * @proc:         binder_proc associated with list
 * @list:         list to dequeue head
 *
 * Removes the head of the list if there are items on the list
 *
 * Return: pointer dequeued binder_work, NULL if list was empty
 */
static struct binder_work *binder_dequeue_work_head(
					struct binder_proc *proc,
					struct list_head *list)
{
	struct binder_work *w;

	binder_inner_proc_lock(proc);
	w = binder_dequeue_work_head_ilocked(list);
	binder_inner_proc_unlock(proc);
	return w;
}

932 933
static void
binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer);
934 935
static void binder_free_thread(struct binder_thread *thread);
static void binder_free_proc(struct binder_proc *proc);
936
static void binder_inc_node_tmpref_ilocked(struct binder_node *node);
937

938 939 940
static bool binder_has_work_ilocked(struct binder_thread *thread,
				    bool do_proc_work)
{
941
	return thread->process_todo ||
942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983
		thread->looper_need_return ||
		(do_proc_work &&
		 !binder_worklist_empty_ilocked(&thread->proc->todo));
}

static bool binder_has_work(struct binder_thread *thread, bool do_proc_work)
{
	bool has_work;

	binder_inner_proc_lock(thread->proc);
	has_work = binder_has_work_ilocked(thread, do_proc_work);
	binder_inner_proc_unlock(thread->proc);

	return has_work;
}

static bool binder_available_for_proc_work_ilocked(struct binder_thread *thread)
{
	return !thread->transaction_stack &&
		binder_worklist_empty_ilocked(&thread->todo) &&
		(thread->looper & (BINDER_LOOPER_STATE_ENTERED |
				   BINDER_LOOPER_STATE_REGISTERED));
}

static void binder_wakeup_poll_threads_ilocked(struct binder_proc *proc,
					       bool sync)
{
	struct rb_node *n;
	struct binder_thread *thread;

	for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) {
		thread = rb_entry(n, struct binder_thread, rb_node);
		if (thread->looper & BINDER_LOOPER_STATE_POLL &&
		    binder_available_for_proc_work_ilocked(thread)) {
			if (sync)
				wake_up_interruptible_sync(&thread->wait);
			else
				wake_up_interruptible(&thread->wait);
		}
	}
}

984 985 986 987 988 989 990 991 992 993 994 995 996 997
/**
 * binder_select_thread_ilocked() - selects a thread for doing proc work.
 * @proc:	process to select a thread from
 *
 * Note that calling this function moves the thread off the waiting_threads
 * list, so it can only be woken up by the caller of this function, or a
 * signal. Therefore, callers *should* always wake up the thread this function
 * returns.
 *
 * Return:	If there's a thread currently waiting for process work,
 *		returns that thread. Otherwise returns NULL.
 */
static struct binder_thread *
binder_select_thread_ilocked(struct binder_proc *proc)
998 999 1000
{
	struct binder_thread *thread;

1001
	assert_spin_locked(&proc->inner_lock);
1002 1003 1004 1005
	thread = list_first_entry_or_null(&proc->waiting_threads,
					  struct binder_thread,
					  waiting_thread_node);

1006
	if (thread)
1007
		list_del_init(&thread->waiting_thread_node);
1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031

	return thread;
}

/**
 * binder_wakeup_thread_ilocked() - wakes up a thread for doing proc work.
 * @proc:	process to wake up a thread in
 * @thread:	specific thread to wake-up (may be NULL)
 * @sync:	whether to do a synchronous wake-up
 *
 * This function wakes up a thread in the @proc process.
 * The caller may provide a specific thread to wake-up in
 * the @thread parameter. If @thread is NULL, this function
 * will wake up threads that have called poll().
 *
 * Note that for this function to work as expected, callers
 * should first call binder_select_thread() to find a thread
 * to handle the work (if they don't have a thread already),
 * and pass the result into the @thread parameter.
 */
static void binder_wakeup_thread_ilocked(struct binder_proc *proc,
					 struct binder_thread *thread,
					 bool sync)
{
1032
	assert_spin_locked(&proc->inner_lock);
1033 1034

	if (thread) {
1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057
		if (sync)
			wake_up_interruptible_sync(&thread->wait);
		else
			wake_up_interruptible(&thread->wait);
		return;
	}

	/* Didn't find a thread waiting for proc work; this can happen
	 * in two scenarios:
	 * 1. All threads are busy handling transactions
	 *    In that case, one of those threads should call back into
	 *    the kernel driver soon and pick up this work.
	 * 2. Threads are using the (e)poll interface, in which case
	 *    they may be blocked on the waitqueue without having been
	 *    added to waiting_threads. For this case, we just iterate
	 *    over all threads not handling transaction work, and
	 *    wake them all up. We wake all because we don't know whether
	 *    a thread that called into (e)poll is handling non-binder
	 *    work currently.
	 */
	binder_wakeup_poll_threads_ilocked(proc, sync);
}

1058 1059 1060 1061 1062 1063 1064
static void binder_wakeup_proc_ilocked(struct binder_proc *proc)
{
	struct binder_thread *thread = binder_select_thread_ilocked(proc);

	binder_wakeup_thread_ilocked(proc, thread, /* sync = */false);
}

1065 1066 1067
static void binder_set_nice(long nice)
{
	long min_nice;
1068

1069 1070 1071 1072
	if (can_nice(current, nice)) {
		set_user_nice(current, nice);
		return;
	}
1073
	min_nice = rlimit_to_nice(rlimit(RLIMIT_NICE));
1074
	binder_debug(BINDER_DEBUG_PRIORITY_CAP,
1075 1076
		     "%d: nice value %ld not allowed use %ld instead\n",
		      current->pid, nice, min_nice);
1077
	set_user_nice(current, min_nice);
1078
	if (min_nice <= MAX_NICE)
1079
		return;
1080
	binder_user_error("%d RLIMIT_NICE not set\n", current->pid);
1081 1082
}

1083 1084
static struct binder_node *binder_get_node_ilocked(struct binder_proc *proc,
						   binder_uintptr_t ptr)
1085 1086 1087 1088
{
	struct rb_node *n = proc->nodes.rb_node;
	struct binder_node *node;

1089
	assert_spin_locked(&proc->inner_lock);
1090

1091 1092 1093 1094 1095 1096 1097
	while (n) {
		node = rb_entry(n, struct binder_node, rb_node);

		if (ptr < node->ptr)
			n = n->rb_left;
		else if (ptr > node->ptr)
			n = n->rb_right;
1098 1099 1100 1101 1102 1103
		else {
			/*
			 * take an implicit weak reference
			 * to ensure node stays alive until
			 * call to binder_put_node()
			 */
1104
			binder_inc_node_tmpref_ilocked(node);
1105
			return node;
1106
		}
1107 1108 1109 1110
	}
	return NULL;
}

1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125
static struct binder_node *binder_get_node(struct binder_proc *proc,
					   binder_uintptr_t ptr)
{
	struct binder_node *node;

	binder_inner_proc_lock(proc);
	node = binder_get_node_ilocked(proc, ptr);
	binder_inner_proc_unlock(proc);
	return node;
}

static struct binder_node *binder_init_node_ilocked(
						struct binder_proc *proc,
						struct binder_node *new_node,
						struct flat_binder_object *fp)
1126 1127 1128 1129
{
	struct rb_node **p = &proc->nodes.rb_node;
	struct rb_node *parent = NULL;
	struct binder_node *node;
1130 1131 1132
	binder_uintptr_t ptr = fp ? fp->binder : 0;
	binder_uintptr_t cookie = fp ? fp->cookie : 0;
	__u32 flags = fp ? fp->flags : 0;
1133

1134 1135
	assert_spin_locked(&proc->inner_lock);

1136
	while (*p) {
1137

1138 1139 1140 1141 1142 1143 1144
		parent = *p;
		node = rb_entry(parent, struct binder_node, rb_node);

		if (ptr < node->ptr)
			p = &(*p)->rb_left;
		else if (ptr > node->ptr)
			p = &(*p)->rb_right;
1145 1146 1147 1148 1149 1150 1151 1152 1153
		else {
			/*
			 * A matching node is already in
			 * the rb tree. Abandon the init
			 * and return it.
			 */
			binder_inc_node_tmpref_ilocked(node);
			return node;
		}
1154
	}
1155
	node = new_node;
1156
	binder_stats_created(BINDER_STAT_NODE);
1157
	node->tmp_refs++;
1158 1159
	rb_link_node(&node->rb_node, parent, p);
	rb_insert_color(&node->rb_node, &proc->nodes);
1160
	node->debug_id = atomic_inc_return(&binder_last_id);
1161 1162 1163 1164
	node->proc = proc;
	node->ptr = ptr;
	node->cookie = cookie;
	node->work.type = BINDER_WORK_NODE;
1165 1166
	node->min_priority = flags & FLAT_BINDER_FLAG_PRIORITY_MASK;
	node->accept_fds = !!(flags & FLAT_BINDER_FLAG_ACCEPTS_FDS);
1167
	spin_lock_init(&node->lock);
1168 1169 1170
	INIT_LIST_HEAD(&node->work.entry);
	INIT_LIST_HEAD(&node->async_todo);
	binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1171
		     "%d:%d node %d u%016llx c%016llx created\n",
1172
		     proc->pid, current->pid, node->debug_id,
1173
		     (u64)node->ptr, (u64)node->cookie);
1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194

	return node;
}

static struct binder_node *binder_new_node(struct binder_proc *proc,
					   struct flat_binder_object *fp)
{
	struct binder_node *node;
	struct binder_node *new_node = kzalloc(sizeof(*node), GFP_KERNEL);

	if (!new_node)
		return NULL;
	binder_inner_proc_lock(proc);
	node = binder_init_node_ilocked(proc, new_node, fp);
	binder_inner_proc_unlock(proc);
	if (node != new_node)
		/*
		 * The node was already added by another thread
		 */
		kfree(new_node);

1195 1196 1197
	return node;
}

1198
static void binder_free_node(struct binder_node *node)
1199
{
1200 1201 1202 1203
	kfree(node);
	binder_stats_deleted(BINDER_STAT_NODE);
}

1204 1205 1206
static int binder_inc_node_nilocked(struct binder_node *node, int strong,
				    int internal,
				    struct list_head *target_list)
1207
{
1208 1209
	struct binder_proc *proc = node->proc;

1210
	assert_spin_locked(&node->lock);
1211
	if (proc)
1212
		assert_spin_locked(&proc->inner_lock);
1213 1214 1215 1216
	if (strong) {
		if (internal) {
			if (target_list == NULL &&
			    node->internal_strong_refs == 0 &&
1217 1218 1219
			    !(node->proc &&
			      node == node->proc->context->binder_context_mgr_node &&
			      node->has_strong_ref)) {
1220 1221
				pr_err("invalid inc strong node for %d\n",
					node->debug_id);
1222 1223 1224 1225 1226 1227
				return -EINVAL;
			}
			node->internal_strong_refs++;
		} else
			node->local_strong_refs++;
		if (!node->has_strong_ref && target_list) {
1228 1229
			struct binder_thread *thread = container_of(target_list,
						    struct binder_thread, todo);
1230
			binder_dequeue_work_ilocked(&node->work);
1231 1232 1233
			BUG_ON(&thread->todo != target_list);
			binder_enqueue_deferred_thread_work_ilocked(thread,
								   &node->work);
1234 1235 1236 1237 1238 1239
		}
	} else {
		if (!internal)
			node->local_weak_refs++;
		if (!node->has_weak_ref && list_empty(&node->work.entry)) {
			if (target_list == NULL) {
1240 1241
				pr_err("invalid inc weak node for %d\n",
					node->debug_id);
1242 1243
				return -EINVAL;
			}
1244 1245 1246
			/*
			 * See comment above
			 */
1247
			binder_enqueue_work_ilocked(&node->work, target_list);
1248 1249 1250 1251 1252
		}
	}
	return 0;
}

1253 1254 1255 1256 1257
static int binder_inc_node(struct binder_node *node, int strong, int internal,
			   struct list_head *target_list)
{
	int ret;

1258 1259 1260
	binder_node_inner_lock(node);
	ret = binder_inc_node_nilocked(node, strong, internal, target_list);
	binder_node_inner_unlock(node);
1261 1262 1263 1264

	return ret;
}

1265 1266
static bool binder_dec_node_nilocked(struct binder_node *node,
				     int strong, int internal)
1267
{
1268 1269
	struct binder_proc *proc = node->proc;

1270
	assert_spin_locked(&node->lock);
1271
	if (proc)
1272
		assert_spin_locked(&proc->inner_lock);
1273 1274 1275 1276 1277 1278
	if (strong) {
		if (internal)
			node->internal_strong_refs--;
		else
			node->local_strong_refs--;
		if (node->local_strong_refs || node->internal_strong_refs)
1279
			return false;
1280 1281 1282
	} else {
		if (!internal)
			node->local_weak_refs--;
1283 1284
		if (node->local_weak_refs || node->tmp_refs ||
				!hlist_empty(&node->refs))
1285
			return false;
1286
	}
1287 1288

	if (proc && (node->has_strong_ref || node->has_weak_ref)) {
1289
		if (list_empty(&node->work.entry)) {
1290
			binder_enqueue_work_ilocked(&node->work, &proc->todo);
1291
			binder_wakeup_proc_ilocked(proc);
1292 1293 1294
		}
	} else {
		if (hlist_empty(&node->refs) && !node->local_strong_refs &&
1295
		    !node->local_weak_refs && !node->tmp_refs) {
1296
			if (proc) {
1297 1298
				binder_dequeue_work_ilocked(&node->work);
				rb_erase(&node->rb_node, &proc->nodes);
1299
				binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1300
					     "refless node %d deleted\n",
1301 1302
					     node->debug_id);
			} else {
1303
				BUG_ON(!list_empty(&node->work.entry));
1304
				spin_lock(&binder_dead_nodes_lock);