xref: /linux/drivers/android/binder_internal.h (revision 6861d27cf590d20a95b5d0724ac3768583b62947)
1 /* SPDX-License-Identifier: GPL-2.0 */
2 
3 #ifndef _LINUX_BINDER_INTERNAL_H
4 #define _LINUX_BINDER_INTERNAL_H
5 
6 #include <linux/export.h>
7 #include <linux/fs.h>
8 #include <linux/list.h>
9 #include <linux/miscdevice.h>
10 #include <linux/mutex.h>
11 #include <linux/refcount.h>
12 #include <linux/stddef.h>
13 #include <linux/types.h>
14 #include <linux/uidgid.h>
15 #include <uapi/linux/android/binderfs.h>
16 #include "binder_alloc.h"
17 
18 struct binder_context {
19 	struct binder_node *binder_context_mgr_node;
20 	struct mutex context_mgr_node_lock;
21 	kuid_t binder_context_mgr_uid;
22 	const char *name;
23 };
24 
25 /**
26  * struct binder_device - information about a binder device node
27  * @hlist:          list of binder devices (only used for devices requested via
28  *                  CONFIG_ANDROID_BINDER_DEVICES)
29  * @miscdev:        information about a binder character device node
30  * @context:        binder context information
31  * @binderfs_inode: This is the inode of the root dentry of the super block
32  *                  belonging to a binderfs mount.
33  */
34 struct binder_device {
35 	struct hlist_node hlist;
36 	struct miscdevice miscdev;
37 	struct binder_context context;
38 	struct inode *binderfs_inode;
39 	refcount_t ref;
40 };
41 
42 /**
43  * binderfs_mount_opts - mount options for binderfs
44  * @max: maximum number of allocatable binderfs binder devices
45  * @stats_mode: enable binder stats in binderfs.
46  */
47 struct binderfs_mount_opts {
48 	int max;
49 	int stats_mode;
50 };
51 
52 /**
53  * binderfs_info - information about a binderfs mount
54  * @ipc_ns:         The ipc namespace the binderfs mount belongs to.
55  * @control_dentry: This records the dentry of this binderfs mount
56  *                  binder-control device.
57  * @root_uid:       uid that needs to be used when a new binder device is
58  *                  created.
59  * @root_gid:       gid that needs to be used when a new binder device is
60  *                  created.
61  * @mount_opts:     The mount options in use.
62  * @device_count:   The current number of allocated binder devices.
63  * @proc_log_dir:   Pointer to the directory dentry containing process-specific
64  *                  logs.
65  */
66 struct binderfs_info {
67 	struct ipc_namespace *ipc_ns;
68 	struct dentry *control_dentry;
69 	kuid_t root_uid;
70 	kgid_t root_gid;
71 	struct binderfs_mount_opts mount_opts;
72 	int device_count;
73 	struct dentry *proc_log_dir;
74 };
75 
76 extern const struct file_operations binder_fops;
77 
78 extern char *binder_devices_param;
79 
80 #ifdef CONFIG_ANDROID_BINDERFS
81 extern bool is_binderfs_device(const struct inode *inode);
82 extern struct dentry *binderfs_create_file(struct dentry *dir, const char *name,
83 					   const struct file_operations *fops,
84 					   void *data);
85 extern void binderfs_remove_file(struct dentry *dentry);
86 #else
87 static inline bool is_binderfs_device(const struct inode *inode)
88 {
89 	return false;
90 }
91 static inline struct dentry *binderfs_create_file(struct dentry *dir,
92 					   const char *name,
93 					   const struct file_operations *fops,
94 					   void *data)
95 {
96 	return NULL;
97 }
98 static inline void binderfs_remove_file(struct dentry *dentry) {}
99 #endif
100 
101 #ifdef CONFIG_ANDROID_BINDERFS
102 extern int __init init_binderfs(void);
103 #else
104 static inline int __init init_binderfs(void)
105 {
106 	return 0;
107 }
108 #endif
109 
110 int binder_stats_show(struct seq_file *m, void *unused);
111 DEFINE_SHOW_ATTRIBUTE(binder_stats);
112 
113 int binder_state_show(struct seq_file *m, void *unused);
114 DEFINE_SHOW_ATTRIBUTE(binder_state);
115 
116 int binder_transactions_show(struct seq_file *m, void *unused);
117 DEFINE_SHOW_ATTRIBUTE(binder_transactions);
118 
119 int binder_transaction_log_show(struct seq_file *m, void *unused);
120 DEFINE_SHOW_ATTRIBUTE(binder_transaction_log);
121 
122 struct binder_transaction_log_entry {
123 	int debug_id;
124 	int debug_id_done;
125 	int call_type;
126 	int from_proc;
127 	int from_thread;
128 	int target_handle;
129 	int to_proc;
130 	int to_thread;
131 	int to_node;
132 	int data_size;
133 	int offsets_size;
134 	int return_error_line;
135 	uint32_t return_error;
136 	uint32_t return_error_param;
137 	char context_name[BINDERFS_MAX_NAME + 1];
138 };
139 
140 struct binder_transaction_log {
141 	atomic_t cur;
142 	bool full;
143 	struct binder_transaction_log_entry entry[32];
144 };
145 
146 enum binder_stat_types {
147 	BINDER_STAT_PROC,
148 	BINDER_STAT_THREAD,
149 	BINDER_STAT_NODE,
150 	BINDER_STAT_REF,
151 	BINDER_STAT_DEATH,
152 	BINDER_STAT_TRANSACTION,
153 	BINDER_STAT_TRANSACTION_COMPLETE,
154 	BINDER_STAT_COUNT
155 };
156 
157 struct binder_stats {
158 	atomic_t br[_IOC_NR(BR_FAILED_REPLY) + 1];
159 	atomic_t bc[_IOC_NR(BC_REPLY_SG) + 1];
160 	atomic_t obj_created[BINDER_STAT_COUNT];
161 	atomic_t obj_deleted[BINDER_STAT_COUNT];
162 };
163 
164 /**
165  * struct binder_work - work enqueued on a worklist
166  * @entry:             node enqueued on list
167  * @type:              type of work to be performed
168  *
169  * There are separate work lists for proc, thread, and node (async).
170  */
171 struct binder_work {
172 	struct list_head entry;
173 
174 	enum binder_work_type {
175 		BINDER_WORK_TRANSACTION = 1,
176 		BINDER_WORK_TRANSACTION_COMPLETE,
177 		BINDER_WORK_RETURN_ERROR,
178 		BINDER_WORK_NODE,
179 		BINDER_WORK_DEAD_BINDER,
180 		BINDER_WORK_DEAD_BINDER_AND_CLEAR,
181 		BINDER_WORK_CLEAR_DEATH_NOTIFICATION,
182 	} type;
183 };
184 
185 struct binder_error {
186 	struct binder_work work;
187 	uint32_t cmd;
188 };
189 
190 /**
191  * struct binder_node - binder node bookkeeping
192  * @debug_id:             unique ID for debugging
193  *                        (invariant after initialized)
194  * @lock:                 lock for node fields
195  * @work:                 worklist element for node work
196  *                        (protected by @proc->inner_lock)
197  * @rb_node:              element for proc->nodes tree
198  *                        (protected by @proc->inner_lock)
199  * @dead_node:            element for binder_dead_nodes list
200  *                        (protected by binder_dead_nodes_lock)
201  * @proc:                 binder_proc that owns this node
202  *                        (invariant after initialized)
203  * @refs:                 list of references on this node
204  *                        (protected by @lock)
205  * @internal_strong_refs: used to take strong references when
206  *                        initiating a transaction
207  *                        (protected by @proc->inner_lock if @proc
208  *                        and by @lock)
209  * @local_weak_refs:      weak user refs from local process
210  *                        (protected by @proc->inner_lock if @proc
211  *                        and by @lock)
212  * @local_strong_refs:    strong user refs from local process
213  *                        (protected by @proc->inner_lock if @proc
214  *                        and by @lock)
215  * @tmp_refs:             temporary kernel refs
216  *                        (protected by @proc->inner_lock while @proc
217  *                        is valid, and by binder_dead_nodes_lock
218  *                        if @proc is NULL. During inc/dec and node release
219  *                        it is also protected by @lock to provide safety
220  *                        as the node dies and @proc becomes NULL)
221  * @ptr:                  userspace pointer for node
222  *                        (invariant, no lock needed)
223  * @cookie:               userspace cookie for node
224  *                        (invariant, no lock needed)
225  * @has_strong_ref:       userspace notified of strong ref
226  *                        (protected by @proc->inner_lock if @proc
227  *                        and by @lock)
228  * @pending_strong_ref:   userspace has acked notification of strong ref
229  *                        (protected by @proc->inner_lock if @proc
230  *                        and by @lock)
231  * @has_weak_ref:         userspace notified of weak ref
232  *                        (protected by @proc->inner_lock if @proc
233  *                        and by @lock)
234  * @pending_weak_ref:     userspace has acked notification of weak ref
235  *                        (protected by @proc->inner_lock if @proc
236  *                        and by @lock)
237  * @has_async_transaction: async transaction to node in progress
238  *                        (protected by @lock)
239  * @accept_fds:           file descriptor operations supported for node
240  *                        (invariant after initialized)
241  * @min_priority:         minimum scheduling priority
242  *                        (invariant after initialized)
243  * @txn_security_ctx:     require sender's security context
244  *                        (invariant after initialized)
245  * @async_todo:           list of async work items
246  *                        (protected by @proc->inner_lock)
247  *
248  * Bookkeeping structure for binder nodes.
249  */
250 struct binder_node {
251 	int debug_id;
252 	spinlock_t lock;
253 	struct binder_work work;
254 	union {
255 		struct rb_node rb_node;
256 		struct hlist_node dead_node;
257 	};
258 	struct binder_proc *proc;
259 	struct hlist_head refs;
260 	int internal_strong_refs;
261 	int local_weak_refs;
262 	int local_strong_refs;
263 	int tmp_refs;
264 	binder_uintptr_t ptr;
265 	binder_uintptr_t cookie;
266 	struct {
267 		/*
268 		 * bitfield elements protected by
269 		 * proc inner_lock
270 		 */
271 		u8 has_strong_ref:1;
272 		u8 pending_strong_ref:1;
273 		u8 has_weak_ref:1;
274 		u8 pending_weak_ref:1;
275 	};
276 	struct {
277 		/*
278 		 * invariant after initialization
279 		 */
280 		u8 accept_fds:1;
281 		u8 txn_security_ctx:1;
282 		u8 min_priority;
283 	};
284 	bool has_async_transaction;
285 	struct list_head async_todo;
286 };
287 
288 struct binder_ref_death {
289 	/**
290 	 * @work: worklist element for death notifications
291 	 *        (protected by inner_lock of the proc that
292 	 *        this ref belongs to)
293 	 */
294 	struct binder_work work;
295 	binder_uintptr_t cookie;
296 };
297 
298 /**
299  * struct binder_ref_data - binder_ref counts and id
300  * @debug_id:        unique ID for the ref
301  * @desc:            unique userspace handle for ref
302  * @strong:          strong ref count (debugging only if not locked)
303  * @weak:            weak ref count (debugging only if not locked)
304  *
305  * Structure to hold ref count and ref id information. Since
306  * the actual ref can only be accessed with a lock, this structure
307  * is used to return information about the ref to callers of
308  * ref inc/dec functions.
309  */
310 struct binder_ref_data {
311 	int debug_id;
312 	uint32_t desc;
313 	int strong;
314 	int weak;
315 };
316 
317 /**
318  * struct binder_ref - struct to track references on nodes
319  * @data:        binder_ref_data containing id, handle, and current refcounts
320  * @rb_node_desc: node for lookup by @data.desc in proc's rb_tree
321  * @rb_node_node: node for lookup by @node in proc's rb_tree
322  * @node_entry:  list entry for node->refs list in target node
323  *               (protected by @node->lock)
324  * @proc:        binder_proc containing ref
325  * @node:        binder_node of target node. When cleaning up a
326  *               ref for deletion in binder_cleanup_ref, a non-NULL
327  *               @node indicates the node must be freed
328  * @death:       pointer to death notification (ref_death) if requested
329  *               (protected by @node->lock)
330  *
331  * Structure to track references from procA to target node (on procB). This
332  * structure is unsafe to access without holding @proc->outer_lock.
333  */
334 struct binder_ref {
335 	/* Lookups needed: */
336 	/*   node + proc => ref (transaction) */
337 	/*   desc + proc => ref (transaction, inc/dec ref) */
338 	/*   node => refs + procs (proc exit) */
339 	struct binder_ref_data data;
340 	struct rb_node rb_node_desc;
341 	struct rb_node rb_node_node;
342 	struct hlist_node node_entry;
343 	struct binder_proc *proc;
344 	struct binder_node *node;
345 	struct binder_ref_death *death;
346 };
347 
348 /**
349  * struct binder_proc - binder process bookkeeping
350  * @proc_node:            element for binder_procs list
351  * @threads:              rbtree of binder_threads in this proc
352  *                        (protected by @inner_lock)
353  * @nodes:                rbtree of binder nodes associated with
354  *                        this proc ordered by node->ptr
355  *                        (protected by @inner_lock)
356  * @refs_by_desc:         rbtree of refs ordered by ref->desc
357  *                        (protected by @outer_lock)
358  * @refs_by_node:         rbtree of refs ordered by ref->node
359  *                        (protected by @outer_lock)
360  * @waiting_threads:      threads currently waiting for proc work
361  *                        (protected by @inner_lock)
362  * @pid                   PID of group_leader of process
363  *                        (invariant after initialized)
364  * @tsk                   task_struct for group_leader of process
365  *                        (invariant after initialized)
366  * @deferred_work_node:   element for binder_deferred_list
367  *                        (protected by binder_deferred_lock)
368  * @deferred_work:        bitmap of deferred work to perform
369  *                        (protected by binder_deferred_lock)
370  * @outstanding_txns:     number of transactions to be transmitted before
371  *                        processes in freeze_wait are woken up
372  *                        (protected by @inner_lock)
373  * @is_dead:              process is dead and awaiting free
374  *                        when outstanding transactions are cleaned up
375  *                        (protected by @inner_lock)
376  * @is_frozen:            process is frozen and unable to service
377  *                        binder transactions
378  *                        (protected by @inner_lock)
379  * @sync_recv:            process received sync transactions since last frozen
380  *                        (protected by @inner_lock)
381  * @async_recv:           process received async transactions since last frozen
382  *                        (protected by @inner_lock)
383  * @freeze_wait:          waitqueue of processes waiting for all outstanding
384  *                        transactions to be processed
385  *                        (protected by @inner_lock)
386  * @todo:                 list of work for this process
387  *                        (protected by @inner_lock)
388  * @stats:                per-process binder statistics
389  *                        (atomics, no lock needed)
390  * @delivered_death:      list of delivered death notification
391  *                        (protected by @inner_lock)
392  * @max_threads:          cap on number of binder threads
393  *                        (protected by @inner_lock)
394  * @requested_threads:    number of binder threads requested but not
395  *                        yet started. In current implementation, can
396  *                        only be 0 or 1.
397  *                        (protected by @inner_lock)
398  * @requested_threads_started: number binder threads started
399  *                        (protected by @inner_lock)
400  * @tmp_ref:              temporary reference to indicate proc is in use
401  *                        (protected by @inner_lock)
402  * @default_priority:     default scheduler priority
403  *                        (invariant after initialized)
404  * @debugfs_entry:        debugfs node
405  * @alloc:                binder allocator bookkeeping
406  * @context:              binder_context for this proc
407  *                        (invariant after initialized)
408  * @inner_lock:           can nest under outer_lock and/or node lock
409  * @outer_lock:           no nesting under innor or node lock
410  *                        Lock order: 1) outer, 2) node, 3) inner
411  * @binderfs_entry:       process-specific binderfs log file
412  *
413  * Bookkeeping structure for binder processes
414  */
415 struct binder_proc {
416 	struct hlist_node proc_node;
417 	struct rb_root threads;
418 	struct rb_root nodes;
419 	struct rb_root refs_by_desc;
420 	struct rb_root refs_by_node;
421 	struct list_head waiting_threads;
422 	int pid;
423 	struct task_struct *tsk;
424 	struct hlist_node deferred_work_node;
425 	int deferred_work;
426 	int outstanding_txns;
427 	bool is_dead;
428 	bool is_frozen;
429 	bool sync_recv;
430 	bool async_recv;
431 	wait_queue_head_t freeze_wait;
432 
433 	struct list_head todo;
434 	struct binder_stats stats;
435 	struct list_head delivered_death;
436 	int max_threads;
437 	int requested_threads;
438 	int requested_threads_started;
439 	int tmp_ref;
440 	long default_priority;
441 	struct dentry *debugfs_entry;
442 	struct binder_alloc alloc;
443 	struct binder_context *context;
444 	spinlock_t inner_lock;
445 	spinlock_t outer_lock;
446 	struct dentry *binderfs_entry;
447 };
448 
449 /**
450  * struct binder_thread - binder thread bookkeeping
451  * @proc:                 binder process for this thread
452  *                        (invariant after initialization)
453  * @rb_node:              element for proc->threads rbtree
454  *                        (protected by @proc->inner_lock)
455  * @waiting_thread_node:  element for @proc->waiting_threads list
456  *                        (protected by @proc->inner_lock)
457  * @pid:                  PID for this thread
458  *                        (invariant after initialization)
459  * @looper:               bitmap of looping state
460  *                        (only accessed by this thread)
461  * @looper_needs_return:  looping thread needs to exit driver
462  *                        (no lock needed)
463  * @transaction_stack:    stack of in-progress transactions for this thread
464  *                        (protected by @proc->inner_lock)
465  * @todo:                 list of work to do for this thread
466  *                        (protected by @proc->inner_lock)
467  * @process_todo:         whether work in @todo should be processed
468  *                        (protected by @proc->inner_lock)
469  * @return_error:         transaction errors reported by this thread
470  *                        (only accessed by this thread)
471  * @reply_error:          transaction errors reported by target thread
472  *                        (protected by @proc->inner_lock)
473  * @wait:                 wait queue for thread work
474  * @stats:                per-thread statistics
475  *                        (atomics, no lock needed)
476  * @tmp_ref:              temporary reference to indicate thread is in use
477  *                        (atomic since @proc->inner_lock cannot
478  *                        always be acquired)
479  * @is_dead:              thread is dead and awaiting free
480  *                        when outstanding transactions are cleaned up
481  *                        (protected by @proc->inner_lock)
482  *
483  * Bookkeeping structure for binder threads.
484  */
485 struct binder_thread {
486 	struct binder_proc *proc;
487 	struct rb_node rb_node;
488 	struct list_head waiting_thread_node;
489 	int pid;
490 	int looper;              /* only modified by this thread */
491 	bool looper_need_return; /* can be written by other thread */
492 	struct binder_transaction *transaction_stack;
493 	struct list_head todo;
494 	bool process_todo;
495 	struct binder_error return_error;
496 	struct binder_error reply_error;
497 	wait_queue_head_t wait;
498 	struct binder_stats stats;
499 	atomic_t tmp_ref;
500 	bool is_dead;
501 };
502 
503 /**
504  * struct binder_txn_fd_fixup - transaction fd fixup list element
505  * @fixup_entry:          list entry
506  * @file:                 struct file to be associated with new fd
507  * @offset:               offset in buffer data to this fixup
508  *
509  * List element for fd fixups in a transaction. Since file
510  * descriptors need to be allocated in the context of the
511  * target process, we pass each fd to be processed in this
512  * struct.
513  */
514 struct binder_txn_fd_fixup {
515 	struct list_head fixup_entry;
516 	struct file *file;
517 	size_t offset;
518 };
519 
520 struct binder_transaction {
521 	int debug_id;
522 	struct binder_work work;
523 	struct binder_thread *from;
524 	struct binder_transaction *from_parent;
525 	struct binder_proc *to_proc;
526 	struct binder_thread *to_thread;
527 	struct binder_transaction *to_parent;
528 	unsigned need_reply:1;
529 	/* unsigned is_dead:1; */       /* not used at the moment */
530 
531 	struct binder_buffer *buffer;
532 	unsigned int    code;
533 	unsigned int    flags;
534 	long    priority;
535 	long    saved_priority;
536 	kuid_t  sender_euid;
537 	struct list_head fd_fixups;
538 	binder_uintptr_t security_ctx;
539 	/**
540 	 * @lock:  protects @from, @to_proc, and @to_thread
541 	 *
542 	 * @from, @to_proc, and @to_thread can be set to NULL
543 	 * during thread teardown
544 	 */
545 	spinlock_t lock;
546 };
547 
548 /**
549  * struct binder_object - union of flat binder object types
550  * @hdr:   generic object header
551  * @fbo:   binder object (nodes and refs)
552  * @fdo:   file descriptor object
553  * @bbo:   binder buffer pointer
554  * @fdao:  file descriptor array
555  *
556  * Used for type-independent object copies
557  */
558 struct binder_object {
559 	union {
560 		struct binder_object_header hdr;
561 		struct flat_binder_object fbo;
562 		struct binder_fd_object fdo;
563 		struct binder_buffer_object bbo;
564 		struct binder_fd_array_object fdao;
565 	};
566 };
567 
568 extern struct binder_transaction_log binder_transaction_log;
569 extern struct binder_transaction_log binder_transaction_log_failed;
570 #endif /* _LINUX_BINDER_INTERNAL_H */
571