586 lines · c
1/* SPDX-License-Identifier: GPL-2.0 */2 3#ifndef _LINUX_BINDER_INTERNAL_H4#define _LINUX_BINDER_INTERNAL_H5 6#include <linux/export.h>7#include <linux/fs.h>8#include <linux/list.h>9#include <linux/miscdevice.h>10#include <linux/mutex.h>11#include <linux/refcount.h>12#include <linux/stddef.h>13#include <linux/types.h>14#include <linux/uidgid.h>15#include <uapi/linux/android/binderfs.h>16#include "binder_alloc.h"17#include "dbitmap.h"18 19struct binder_context {20 struct binder_node *binder_context_mgr_node;21 struct mutex context_mgr_node_lock;22 kuid_t binder_context_mgr_uid;23 const char *name;24};25 26/**27 * struct binder_device - information about a binder device node28 * @hlist: list of binder devices (only used for devices requested via29 * CONFIG_ANDROID_BINDER_DEVICES)30 * @miscdev: information about a binder character device node31 * @context: binder context information32 * @binderfs_inode: This is the inode of the root dentry of the super block33 * belonging to a binderfs mount.34 */35struct binder_device {36 struct hlist_node hlist;37 struct miscdevice miscdev;38 struct binder_context context;39 struct inode *binderfs_inode;40 refcount_t ref;41};42 43/**44 * binderfs_mount_opts - mount options for binderfs45 * @max: maximum number of allocatable binderfs binder devices46 * @stats_mode: enable binder stats in binderfs.47 */48struct binderfs_mount_opts {49 int max;50 int stats_mode;51};52 53/**54 * binderfs_info - information about a binderfs mount55 * @ipc_ns: The ipc namespace the binderfs mount belongs to.56 * @control_dentry: This records the dentry of this binderfs mount57 * binder-control device.58 * @root_uid: uid that needs to be used when a new binder device is59 * created.60 * @root_gid: gid that needs to be used when a new binder device is61 * created.62 * @mount_opts: The mount options in use.63 * @device_count: The current number of allocated binder devices.64 * @proc_log_dir: Pointer to the directory dentry containing process-specific65 * logs.66 */67struct binderfs_info {68 struct ipc_namespace *ipc_ns;69 struct dentry *control_dentry;70 kuid_t root_uid;71 kgid_t root_gid;72 struct binderfs_mount_opts mount_opts;73 int device_count;74 struct dentry *proc_log_dir;75};76 77extern const struct file_operations binder_fops;78 79extern char *binder_devices_param;80 81#ifdef CONFIG_ANDROID_BINDERFS82extern bool is_binderfs_device(const struct inode *inode);83extern struct dentry *binderfs_create_file(struct dentry *dir, const char *name,84 const struct file_operations *fops,85 void *data);86extern void binderfs_remove_file(struct dentry *dentry);87#else88static inline bool is_binderfs_device(const struct inode *inode)89{90 return false;91}92static inline struct dentry *binderfs_create_file(struct dentry *dir,93 const char *name,94 const struct file_operations *fops,95 void *data)96{97 return NULL;98}99static inline void binderfs_remove_file(struct dentry *dentry) {}100#endif101 102#ifdef CONFIG_ANDROID_BINDERFS103extern int __init init_binderfs(void);104#else105static inline int __init init_binderfs(void)106{107 return 0;108}109#endif110 111struct binder_debugfs_entry {112 const char *name;113 umode_t mode;114 const struct file_operations *fops;115 void *data;116};117 118extern const struct binder_debugfs_entry binder_debugfs_entries[];119 120#define binder_for_each_debugfs_entry(entry) \121 for ((entry) = binder_debugfs_entries; \122 (entry)->name; \123 (entry)++)124 125enum binder_stat_types {126 BINDER_STAT_PROC,127 BINDER_STAT_THREAD,128 BINDER_STAT_NODE,129 BINDER_STAT_REF,130 BINDER_STAT_DEATH,131 BINDER_STAT_TRANSACTION,132 BINDER_STAT_TRANSACTION_COMPLETE,133 BINDER_STAT_FREEZE,134 BINDER_STAT_COUNT135};136 137struct binder_stats {138 atomic_t br[_IOC_NR(BR_CLEAR_FREEZE_NOTIFICATION_DONE) + 1];139 atomic_t bc[_IOC_NR(BC_FREEZE_NOTIFICATION_DONE) + 1];140 atomic_t obj_created[BINDER_STAT_COUNT];141 atomic_t obj_deleted[BINDER_STAT_COUNT];142};143 144/**145 * struct binder_work - work enqueued on a worklist146 * @entry: node enqueued on list147 * @type: type of work to be performed148 *149 * There are separate work lists for proc, thread, and node (async).150 */151struct binder_work {152 struct list_head entry;153 154 enum binder_work_type {155 BINDER_WORK_TRANSACTION = 1,156 BINDER_WORK_TRANSACTION_COMPLETE,157 BINDER_WORK_TRANSACTION_PENDING,158 BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT,159 BINDER_WORK_RETURN_ERROR,160 BINDER_WORK_NODE,161 BINDER_WORK_DEAD_BINDER,162 BINDER_WORK_DEAD_BINDER_AND_CLEAR,163 BINDER_WORK_CLEAR_DEATH_NOTIFICATION,164 BINDER_WORK_FROZEN_BINDER,165 BINDER_WORK_CLEAR_FREEZE_NOTIFICATION,166 } type;167};168 169struct binder_error {170 struct binder_work work;171 uint32_t cmd;172};173 174/**175 * struct binder_node - binder node bookkeeping176 * @debug_id: unique ID for debugging177 * (invariant after initialized)178 * @lock: lock for node fields179 * @work: worklist element for node work180 * (protected by @proc->inner_lock)181 * @rb_node: element for proc->nodes tree182 * (protected by @proc->inner_lock)183 * @dead_node: element for binder_dead_nodes list184 * (protected by binder_dead_nodes_lock)185 * @proc: binder_proc that owns this node186 * (invariant after initialized)187 * @refs: list of references on this node188 * (protected by @lock)189 * @internal_strong_refs: used to take strong references when190 * initiating a transaction191 * (protected by @proc->inner_lock if @proc192 * and by @lock)193 * @local_weak_refs: weak user refs from local process194 * (protected by @proc->inner_lock if @proc195 * and by @lock)196 * @local_strong_refs: strong user refs from local process197 * (protected by @proc->inner_lock if @proc198 * and by @lock)199 * @tmp_refs: temporary kernel refs200 * (protected by @proc->inner_lock while @proc201 * is valid, and by binder_dead_nodes_lock202 * if @proc is NULL. During inc/dec and node release203 * it is also protected by @lock to provide safety204 * as the node dies and @proc becomes NULL)205 * @ptr: userspace pointer for node206 * (invariant, no lock needed)207 * @cookie: userspace cookie for node208 * (invariant, no lock needed)209 * @has_strong_ref: userspace notified of strong ref210 * (protected by @proc->inner_lock if @proc211 * and by @lock)212 * @pending_strong_ref: userspace has acked notification of strong ref213 * (protected by @proc->inner_lock if @proc214 * and by @lock)215 * @has_weak_ref: userspace notified of weak ref216 * (protected by @proc->inner_lock if @proc217 * and by @lock)218 * @pending_weak_ref: userspace has acked notification of weak ref219 * (protected by @proc->inner_lock if @proc220 * and by @lock)221 * @has_async_transaction: async transaction to node in progress222 * (protected by @lock)223 * @accept_fds: file descriptor operations supported for node224 * (invariant after initialized)225 * @min_priority: minimum scheduling priority226 * (invariant after initialized)227 * @txn_security_ctx: require sender's security context228 * (invariant after initialized)229 * @async_todo: list of async work items230 * (protected by @proc->inner_lock)231 *232 * Bookkeeping structure for binder nodes.233 */234struct binder_node {235 int debug_id;236 spinlock_t lock;237 struct binder_work work;238 union {239 struct rb_node rb_node;240 struct hlist_node dead_node;241 };242 struct binder_proc *proc;243 struct hlist_head refs;244 int internal_strong_refs;245 int local_weak_refs;246 int local_strong_refs;247 int tmp_refs;248 binder_uintptr_t ptr;249 binder_uintptr_t cookie;250 struct {251 /*252 * bitfield elements protected by253 * proc inner_lock254 */255 u8 has_strong_ref:1;256 u8 pending_strong_ref:1;257 u8 has_weak_ref:1;258 u8 pending_weak_ref:1;259 };260 struct {261 /*262 * invariant after initialization263 */264 u8 accept_fds:1;265 u8 txn_security_ctx:1;266 u8 min_priority;267 };268 bool has_async_transaction;269 struct list_head async_todo;270};271 272struct binder_ref_death {273 /**274 * @work: worklist element for death notifications275 * (protected by inner_lock of the proc that276 * this ref belongs to)277 */278 struct binder_work work;279 binder_uintptr_t cookie;280};281 282struct binder_ref_freeze {283 struct binder_work work;284 binder_uintptr_t cookie;285 bool is_frozen:1;286 bool sent:1;287 bool resend:1;288};289 290/**291 * struct binder_ref_data - binder_ref counts and id292 * @debug_id: unique ID for the ref293 * @desc: unique userspace handle for ref294 * @strong: strong ref count (debugging only if not locked)295 * @weak: weak ref count (debugging only if not locked)296 *297 * Structure to hold ref count and ref id information. Since298 * the actual ref can only be accessed with a lock, this structure299 * is used to return information about the ref to callers of300 * ref inc/dec functions.301 */302struct binder_ref_data {303 int debug_id;304 uint32_t desc;305 int strong;306 int weak;307};308 309/**310 * struct binder_ref - struct to track references on nodes311 * @data: binder_ref_data containing id, handle, and current refcounts312 * @rb_node_desc: node for lookup by @data.desc in proc's rb_tree313 * @rb_node_node: node for lookup by @node in proc's rb_tree314 * @node_entry: list entry for node->refs list in target node315 * (protected by @node->lock)316 * @proc: binder_proc containing ref317 * @node: binder_node of target node. When cleaning up a318 * ref for deletion in binder_cleanup_ref, a non-NULL319 * @node indicates the node must be freed320 * @death: pointer to death notification (ref_death) if requested321 * (protected by @node->lock)322 * @freeze: pointer to freeze notification (ref_freeze) if requested323 * (protected by @node->lock)324 *325 * Structure to track references from procA to target node (on procB). This326 * structure is unsafe to access without holding @proc->outer_lock.327 */328struct binder_ref {329 /* Lookups needed: */330 /* node + proc => ref (transaction) */331 /* desc + proc => ref (transaction, inc/dec ref) */332 /* node => refs + procs (proc exit) */333 struct binder_ref_data data;334 struct rb_node rb_node_desc;335 struct rb_node rb_node_node;336 struct hlist_node node_entry;337 struct binder_proc *proc;338 struct binder_node *node;339 struct binder_ref_death *death;340 struct binder_ref_freeze *freeze;341};342 343/**344 * struct binder_proc - binder process bookkeeping345 * @proc_node: element for binder_procs list346 * @threads: rbtree of binder_threads in this proc347 * (protected by @inner_lock)348 * @nodes: rbtree of binder nodes associated with349 * this proc ordered by node->ptr350 * (protected by @inner_lock)351 * @refs_by_desc: rbtree of refs ordered by ref->desc352 * (protected by @outer_lock)353 * @refs_by_node: rbtree of refs ordered by ref->node354 * (protected by @outer_lock)355 * @waiting_threads: threads currently waiting for proc work356 * (protected by @inner_lock)357 * @pid PID of group_leader of process358 * (invariant after initialized)359 * @tsk task_struct for group_leader of process360 * (invariant after initialized)361 * @cred struct cred associated with the `struct file`362 * in binder_open()363 * (invariant after initialized)364 * @deferred_work_node: element for binder_deferred_list365 * (protected by binder_deferred_lock)366 * @deferred_work: bitmap of deferred work to perform367 * (protected by binder_deferred_lock)368 * @outstanding_txns: number of transactions to be transmitted before369 * processes in freeze_wait are woken up370 * (protected by @inner_lock)371 * @is_dead: process is dead and awaiting free372 * when outstanding transactions are cleaned up373 * (protected by @inner_lock)374 * @is_frozen: process is frozen and unable to service375 * binder transactions376 * (protected by @inner_lock)377 * @sync_recv: process received sync transactions since last frozen378 * bit 0: received sync transaction after being frozen379 * bit 1: new pending sync transaction during freezing380 * (protected by @inner_lock)381 * @async_recv: process received async transactions since last frozen382 * (protected by @inner_lock)383 * @freeze_wait: waitqueue of processes waiting for all outstanding384 * transactions to be processed385 * (protected by @inner_lock)386 * @dmap dbitmap to manage available reference descriptors387 * (protected by @outer_lock)388 * @todo: list of work for this process389 * (protected by @inner_lock)390 * @stats: per-process binder statistics391 * (atomics, no lock needed)392 * @delivered_death: list of delivered death notification393 * (protected by @inner_lock)394 * @delivered_freeze: list of delivered freeze notification395 * (protected by @inner_lock)396 * @max_threads: cap on number of binder threads397 * (protected by @inner_lock)398 * @requested_threads: number of binder threads requested but not399 * yet started. In current implementation, can400 * only be 0 or 1.401 * (protected by @inner_lock)402 * @requested_threads_started: number binder threads started403 * (protected by @inner_lock)404 * @tmp_ref: temporary reference to indicate proc is in use405 * (protected by @inner_lock)406 * @default_priority: default scheduler priority407 * (invariant after initialized)408 * @debugfs_entry: debugfs node409 * @alloc: binder allocator bookkeeping410 * @context: binder_context for this proc411 * (invariant after initialized)412 * @inner_lock: can nest under outer_lock and/or node lock413 * @outer_lock: no nesting under innor or node lock414 * Lock order: 1) outer, 2) node, 3) inner415 * @binderfs_entry: process-specific binderfs log file416 * @oneway_spam_detection_enabled: process enabled oneway spam detection417 * or not418 *419 * Bookkeeping structure for binder processes420 */421struct binder_proc {422 struct hlist_node proc_node;423 struct rb_root threads;424 struct rb_root nodes;425 struct rb_root refs_by_desc;426 struct rb_root refs_by_node;427 struct list_head waiting_threads;428 int pid;429 struct task_struct *tsk;430 const struct cred *cred;431 struct hlist_node deferred_work_node;432 int deferred_work;433 int outstanding_txns;434 bool is_dead;435 bool is_frozen;436 bool sync_recv;437 bool async_recv;438 wait_queue_head_t freeze_wait;439 struct dbitmap dmap;440 struct list_head todo;441 struct binder_stats stats;442 struct list_head delivered_death;443 struct list_head delivered_freeze;444 u32 max_threads;445 int requested_threads;446 int requested_threads_started;447 int tmp_ref;448 long default_priority;449 struct dentry *debugfs_entry;450 struct binder_alloc alloc;451 struct binder_context *context;452 spinlock_t inner_lock;453 spinlock_t outer_lock;454 struct dentry *binderfs_entry;455 bool oneway_spam_detection_enabled;456};457 458/**459 * struct binder_thread - binder thread bookkeeping460 * @proc: binder process for this thread461 * (invariant after initialization)462 * @rb_node: element for proc->threads rbtree463 * (protected by @proc->inner_lock)464 * @waiting_thread_node: element for @proc->waiting_threads list465 * (protected by @proc->inner_lock)466 * @pid: PID for this thread467 * (invariant after initialization)468 * @looper: bitmap of looping state469 * (only accessed by this thread)470 * @looper_needs_return: looping thread needs to exit driver471 * (no lock needed)472 * @transaction_stack: stack of in-progress transactions for this thread473 * (protected by @proc->inner_lock)474 * @todo: list of work to do for this thread475 * (protected by @proc->inner_lock)476 * @process_todo: whether work in @todo should be processed477 * (protected by @proc->inner_lock)478 * @return_error: transaction errors reported by this thread479 * (only accessed by this thread)480 * @reply_error: transaction errors reported by target thread481 * (protected by @proc->inner_lock)482 * @ee: extended error information from this thread483 * (protected by @proc->inner_lock)484 * @wait: wait queue for thread work485 * @stats: per-thread statistics486 * (atomics, no lock needed)487 * @tmp_ref: temporary reference to indicate thread is in use488 * (atomic since @proc->inner_lock cannot489 * always be acquired)490 * @is_dead: thread is dead and awaiting free491 * when outstanding transactions are cleaned up492 * (protected by @proc->inner_lock)493 *494 * Bookkeeping structure for binder threads.495 */496struct binder_thread {497 struct binder_proc *proc;498 struct rb_node rb_node;499 struct list_head waiting_thread_node;500 int pid;501 int looper; /* only modified by this thread */502 bool looper_need_return; /* can be written by other thread */503 struct binder_transaction *transaction_stack;504 struct list_head todo;505 bool process_todo;506 struct binder_error return_error;507 struct binder_error reply_error;508 struct binder_extended_error ee;509 wait_queue_head_t wait;510 struct binder_stats stats;511 atomic_t tmp_ref;512 bool is_dead;513};514 515/**516 * struct binder_txn_fd_fixup - transaction fd fixup list element517 * @fixup_entry: list entry518 * @file: struct file to be associated with new fd519 * @offset: offset in buffer data to this fixup520 * @target_fd: fd to use by the target to install @file521 *522 * List element for fd fixups in a transaction. Since file523 * descriptors need to be allocated in the context of the524 * target process, we pass each fd to be processed in this525 * struct.526 */527struct binder_txn_fd_fixup {528 struct list_head fixup_entry;529 struct file *file;530 size_t offset;531 int target_fd;532};533 534struct binder_transaction {535 int debug_id;536 struct binder_work work;537 struct binder_thread *from;538 pid_t from_pid;539 pid_t from_tid;540 struct binder_transaction *from_parent;541 struct binder_proc *to_proc;542 struct binder_thread *to_thread;543 struct binder_transaction *to_parent;544 unsigned need_reply:1;545 /* unsigned is_dead:1; */ /* not used at the moment */546 547 struct binder_buffer *buffer;548 unsigned int code;549 unsigned int flags;550 long priority;551 long saved_priority;552 kuid_t sender_euid;553 ktime_t start_time;554 struct list_head fd_fixups;555 binder_uintptr_t security_ctx;556 /**557 * @lock: protects @from, @to_proc, and @to_thread558 *559 * @from, @to_proc, and @to_thread can be set to NULL560 * during thread teardown561 */562 spinlock_t lock;563};564 565/**566 * struct binder_object - union of flat binder object types567 * @hdr: generic object header568 * @fbo: binder object (nodes and refs)569 * @fdo: file descriptor object570 * @bbo: binder buffer pointer571 * @fdao: file descriptor array572 *573 * Used for type-independent object copies574 */575struct binder_object {576 union {577 struct binder_object_header hdr;578 struct flat_binder_object fbo;579 struct binder_fd_object fdo;580 struct binder_buffer_object bbo;581 struct binder_fd_array_object fdao;582 };583};584 585#endif /* _LINUX_BINDER_INTERNAL_H */586