1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * Copyright (C) 2017 Google, Inc. 4 */ 5 6 #ifndef _LINUX_BINDER_ALLOC_H 7 #define _LINUX_BINDER_ALLOC_H 8 9 #include <linux/rbtree.h> 10 #include <linux/list.h> 11 #include <linux/mm.h> 12 #include <linux/rtmutex.h> 13 #include <linux/vmalloc.h> 14 #include <linux/slab.h> 15 #include <linux/list_lru.h> 16 #include <uapi/linux/android/binder.h> 17 18 struct binder_transaction; 19 20 /** 21 * struct binder_buffer - buffer used for binder transactions 22 * @entry: entry alloc->buffers 23 * @rb_node: node for allocated_buffers/free_buffers rb trees 24 * @free: %true if buffer is free 25 * @clear_on_free: %true if buffer must be zeroed after use 26 * @allow_user_free: %true if user is allowed to free buffer 27 * @async_transaction: %true if buffer is in use for an async txn 28 * @oneway_spam_suspect: %true if total async allocate size just exceed 29 * spamming detect threshold 30 * @debug_id: unique ID for debugging 31 * @transaction: pointer to associated struct binder_transaction 32 * @target_node: struct binder_node associated with this buffer 33 * @data_size: size of @transaction data 34 * @offsets_size: size of array of offsets 35 * @extra_buffers_size: size of space for other objects (like sg lists) 36 * @user_data: user pointer to base of buffer space 37 * @pid: pid to attribute the buffer to (caller) 38 * 39 * Bookkeeping structure for binder transaction buffers 40 */ 41 struct binder_buffer { 42 struct list_head entry; /* free and allocated entries by address */ 43 struct rb_node rb_node; /* free entry by size or allocated entry */ 44 /* by address */ 45 unsigned free:1; 46 unsigned clear_on_free:1; 47 unsigned allow_user_free:1; 48 unsigned async_transaction:1; 49 unsigned oneway_spam_suspect:1; 50 unsigned debug_id:27; 51 struct binder_transaction *transaction; 52 struct binder_node *target_node; 53 size_t data_size; 54 size_t offsets_size; 55 size_t extra_buffers_size; 56 unsigned long user_data; 57 int pid; 58 }; 59 60 /** 61 * struct binder_shrinker_mdata - binder metadata used to reclaim pages 62 * @lru: LRU entry in binder_freelist 63 * @alloc: binder_alloc owning the page to reclaim 64 * @page_index: offset in @alloc->pages[] into the page to reclaim 65 */ 66 struct binder_shrinker_mdata { 67 struct list_head lru; 68 struct binder_alloc *alloc; 69 unsigned long page_index; 70 }; 71 72 static inline struct list_head *page_to_lru(struct page *p) 73 { 74 struct binder_shrinker_mdata *mdata; 75 76 mdata = (struct binder_shrinker_mdata *)page_private(p); 77 78 return &mdata->lru; 79 } 80 81 /** 82 * struct binder_alloc - per-binder proc state for binder allocator 83 * @mutex: protects binder_alloc fields 84 * @mm: copy of task->mm (invariant after open) 85 * @vm_start: base of per-proc address space mapped via mmap 86 * @buffers: list of all buffers for this proc 87 * @free_buffers: rb tree of buffers available for allocation 88 * sorted by size 89 * @allocated_buffers: rb tree of allocated buffers sorted by address 90 * @free_async_space: VA space available for async buffers. This is 91 * initialized at mmap time to 1/2 the full VA space 92 * @pages: array of struct page * 93 * @freelist: lru list to use for free pages (invariant after init) 94 * @buffer_size: size of address space specified via mmap 95 * @pid: pid for associated binder_proc (invariant after init) 96 * @pages_high: high watermark of offset in @pages 97 * @mapped: whether the vm area is mapped, each binder instance is 98 * allowed a single mapping throughout its lifetime 99 * @oneway_spam_detected: %true if oneway spam detection fired, clear that 100 * flag once the async buffer has returned to a healthy state 101 * 102 * Bookkeeping structure for per-proc address space management for binder 103 * buffers. It is normally initialized during binder_init() and binder_mmap() 104 * calls. The address space is used for both user-visible buffers and for 105 * struct binder_buffer objects used to track the user buffers 106 */ 107 struct binder_alloc { 108 struct mutex mutex; 109 struct mm_struct *mm; 110 unsigned long vm_start; 111 struct list_head buffers; 112 struct rb_root free_buffers; 113 struct rb_root allocated_buffers; 114 size_t free_async_space; 115 struct page **pages; 116 struct list_lru *freelist; 117 size_t buffer_size; 118 int pid; 119 size_t pages_high; 120 bool mapped; 121 bool oneway_spam_detected; 122 }; 123 124 #ifdef CONFIG_ANDROID_BINDER_IPC_SELFTEST 125 void binder_selftest_alloc(struct binder_alloc *alloc); 126 #else 127 static inline void binder_selftest_alloc(struct binder_alloc *alloc) {} 128 #endif 129 enum lru_status binder_alloc_free_page(struct list_head *item, 130 struct list_lru_one *lru, 131 void *cb_arg); 132 struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc, 133 size_t data_size, 134 size_t offsets_size, 135 size_t extra_buffers_size, 136 int is_async); 137 void binder_alloc_init(struct binder_alloc *alloc); 138 int binder_alloc_shrinker_init(void); 139 void binder_alloc_shrinker_exit(void); 140 void binder_alloc_vma_close(struct binder_alloc *alloc); 141 struct binder_buffer * 142 binder_alloc_prepare_to_free(struct binder_alloc *alloc, 143 unsigned long user_ptr); 144 void binder_alloc_free_buf(struct binder_alloc *alloc, 145 struct binder_buffer *buffer); 146 int binder_alloc_mmap_handler(struct binder_alloc *alloc, 147 struct vm_area_struct *vma); 148 void binder_alloc_deferred_release(struct binder_alloc *alloc); 149 int binder_alloc_get_allocated_count(struct binder_alloc *alloc); 150 void binder_alloc_print_allocated(struct seq_file *m, 151 struct binder_alloc *alloc); 152 void binder_alloc_print_pages(struct seq_file *m, 153 struct binder_alloc *alloc); 154 155 /** 156 * binder_alloc_get_free_async_space() - get free space available for async 157 * @alloc: binder_alloc for this proc 158 * 159 * Return: the bytes remaining in the address-space for async transactions 160 */ 161 static inline size_t 162 binder_alloc_get_free_async_space(struct binder_alloc *alloc) 163 { 164 guard(mutex)(&alloc->mutex); 165 return alloc->free_async_space; 166 } 167 168 unsigned long 169 binder_alloc_copy_user_to_buffer(struct binder_alloc *alloc, 170 struct binder_buffer *buffer, 171 binder_size_t buffer_offset, 172 const void __user *from, 173 size_t bytes); 174 175 int binder_alloc_copy_to_buffer(struct binder_alloc *alloc, 176 struct binder_buffer *buffer, 177 binder_size_t buffer_offset, 178 void *src, 179 size_t bytes); 180 181 int binder_alloc_copy_from_buffer(struct binder_alloc *alloc, 182 void *dest, 183 struct binder_buffer *buffer, 184 binder_size_t buffer_offset, 185 size_t bytes); 186 187 #endif /* _LINUX_BINDER_ALLOC_H */ 188 189