1 /* SPDX-License-Identifier: GPL-2.0 */ 2 3 #ifndef _LINUX_BINDER_INTERNAL_H 4 #define _LINUX_BINDER_INTERNAL_H 5 6 #include <linux/export.h> 7 #include <linux/fs.h> 8 #include <linux/list.h> 9 #include <linux/miscdevice.h> 10 #include <linux/mutex.h> 11 #include <linux/refcount.h> 12 #include <linux/stddef.h> 13 #include <linux/types.h> 14 #include <linux/uidgid.h> 15 #include <uapi/linux/android/binderfs.h> 16 #include "binder_alloc.h" 17 18 struct binder_context { 19 struct binder_node *binder_context_mgr_node; 20 struct mutex context_mgr_node_lock; 21 kuid_t binder_context_mgr_uid; 22 const char *name; 23 }; 24 25 /** 26 * struct binder_device - information about a binder device node 27 * @hlist: list of binder devices (only used for devices requested via 28 * CONFIG_ANDROID_BINDER_DEVICES) 29 * @miscdev: information about a binder character device node 30 * @context: binder context information 31 * @binderfs_inode: This is the inode of the root dentry of the super block 32 * belonging to a binderfs mount. 33 */ 34 struct binder_device { 35 struct hlist_node hlist; 36 struct miscdevice miscdev; 37 struct binder_context context; 38 struct inode *binderfs_inode; 39 refcount_t ref; 40 }; 41 42 /** 43 * binderfs_mount_opts - mount options for binderfs 44 * @max: maximum number of allocatable binderfs binder devices 45 * @stats_mode: enable binder stats in binderfs. 46 */ 47 struct binderfs_mount_opts { 48 int max; 49 int stats_mode; 50 }; 51 52 /** 53 * binderfs_info - information about a binderfs mount 54 * @ipc_ns: The ipc namespace the binderfs mount belongs to. 55 * @control_dentry: This records the dentry of this binderfs mount 56 * binder-control device. 57 * @root_uid: uid that needs to be used when a new binder device is 58 * created. 59 * @root_gid: gid that needs to be used when a new binder device is 60 * created. 61 * @mount_opts: The mount options in use. 62 * @device_count: The current number of allocated binder devices. 63 * @proc_log_dir: Pointer to the directory dentry containing process-specific 64 * logs. 65 */ 66 struct binderfs_info { 67 struct ipc_namespace *ipc_ns; 68 struct dentry *control_dentry; 69 kuid_t root_uid; 70 kgid_t root_gid; 71 struct binderfs_mount_opts mount_opts; 72 int device_count; 73 struct dentry *proc_log_dir; 74 }; 75 76 extern const struct file_operations binder_fops; 77 78 extern char *binder_devices_param; 79 80 #ifdef CONFIG_ANDROID_BINDERFS 81 extern bool is_binderfs_device(const struct inode *inode); 82 extern struct dentry *binderfs_create_file(struct dentry *dir, const char *name, 83 const struct file_operations *fops, 84 void *data); 85 extern void binderfs_remove_file(struct dentry *dentry); 86 #else 87 static inline bool is_binderfs_device(const struct inode *inode) 88 { 89 return false; 90 } 91 static inline struct dentry *binderfs_create_file(struct dentry *dir, 92 const char *name, 93 const struct file_operations *fops, 94 void *data) 95 { 96 return NULL; 97 } 98 static inline void binderfs_remove_file(struct dentry *dentry) {} 99 #endif 100 101 #ifdef CONFIG_ANDROID_BINDERFS 102 extern int __init init_binderfs(void); 103 #else 104 static inline int __init init_binderfs(void) 105 { 106 return 0; 107 } 108 #endif 109 110 int binder_stats_show(struct seq_file *m, void *unused); 111 DEFINE_SHOW_ATTRIBUTE(binder_stats); 112 113 int binder_state_show(struct seq_file *m, void *unused); 114 DEFINE_SHOW_ATTRIBUTE(binder_state); 115 116 int binder_transactions_show(struct seq_file *m, void *unused); 117 DEFINE_SHOW_ATTRIBUTE(binder_transactions); 118 119 int binder_transaction_log_show(struct seq_file *m, void *unused); 120 DEFINE_SHOW_ATTRIBUTE(binder_transaction_log); 121 122 struct binder_transaction_log_entry { 123 int debug_id; 124 int debug_id_done; 125 int call_type; 126 int from_proc; 127 int from_thread; 128 int target_handle; 129 int to_proc; 130 int to_thread; 131 int to_node; 132 int data_size; 133 int offsets_size; 134 int return_error_line; 135 uint32_t return_error; 136 uint32_t return_error_param; 137 char context_name[BINDERFS_MAX_NAME + 1]; 138 }; 139 140 struct binder_transaction_log { 141 atomic_t cur; 142 bool full; 143 struct binder_transaction_log_entry entry[32]; 144 }; 145 146 enum binder_stat_types { 147 BINDER_STAT_PROC, 148 BINDER_STAT_THREAD, 149 BINDER_STAT_NODE, 150 BINDER_STAT_REF, 151 BINDER_STAT_DEATH, 152 BINDER_STAT_TRANSACTION, 153 BINDER_STAT_TRANSACTION_COMPLETE, 154 BINDER_STAT_COUNT 155 }; 156 157 struct binder_stats { 158 atomic_t br[_IOC_NR(BR_FAILED_REPLY) + 1]; 159 atomic_t bc[_IOC_NR(BC_REPLY_SG) + 1]; 160 atomic_t obj_created[BINDER_STAT_COUNT]; 161 atomic_t obj_deleted[BINDER_STAT_COUNT]; 162 }; 163 164 /** 165 * struct binder_work - work enqueued on a worklist 166 * @entry: node enqueued on list 167 * @type: type of work to be performed 168 * 169 * There are separate work lists for proc, thread, and node (async). 170 */ 171 struct binder_work { 172 struct list_head entry; 173 174 enum binder_work_type { 175 BINDER_WORK_TRANSACTION = 1, 176 BINDER_WORK_TRANSACTION_COMPLETE, 177 BINDER_WORK_RETURN_ERROR, 178 BINDER_WORK_NODE, 179 BINDER_WORK_DEAD_BINDER, 180 BINDER_WORK_DEAD_BINDER_AND_CLEAR, 181 BINDER_WORK_CLEAR_DEATH_NOTIFICATION, 182 } type; 183 }; 184 185 struct binder_error { 186 struct binder_work work; 187 uint32_t cmd; 188 }; 189 190 /** 191 * struct binder_node - binder node bookkeeping 192 * @debug_id: unique ID for debugging 193 * (invariant after initialized) 194 * @lock: lock for node fields 195 * @work: worklist element for node work 196 * (protected by @proc->inner_lock) 197 * @rb_node: element for proc->nodes tree 198 * (protected by @proc->inner_lock) 199 * @dead_node: element for binder_dead_nodes list 200 * (protected by binder_dead_nodes_lock) 201 * @proc: binder_proc that owns this node 202 * (invariant after initialized) 203 * @refs: list of references on this node 204 * (protected by @lock) 205 * @internal_strong_refs: used to take strong references when 206 * initiating a transaction 207 * (protected by @proc->inner_lock if @proc 208 * and by @lock) 209 * @local_weak_refs: weak user refs from local process 210 * (protected by @proc->inner_lock if @proc 211 * and by @lock) 212 * @local_strong_refs: strong user refs from local process 213 * (protected by @proc->inner_lock if @proc 214 * and by @lock) 215 * @tmp_refs: temporary kernel refs 216 * (protected by @proc->inner_lock while @proc 217 * is valid, and by binder_dead_nodes_lock 218 * if @proc is NULL. During inc/dec and node release 219 * it is also protected by @lock to provide safety 220 * as the node dies and @proc becomes NULL) 221 * @ptr: userspace pointer for node 222 * (invariant, no lock needed) 223 * @cookie: userspace cookie for node 224 * (invariant, no lock needed) 225 * @has_strong_ref: userspace notified of strong ref 226 * (protected by @proc->inner_lock if @proc 227 * and by @lock) 228 * @pending_strong_ref: userspace has acked notification of strong ref 229 * (protected by @proc->inner_lock if @proc 230 * and by @lock) 231 * @has_weak_ref: userspace notified of weak ref 232 * (protected by @proc->inner_lock if @proc 233 * and by @lock) 234 * @pending_weak_ref: userspace has acked notification of weak ref 235 * (protected by @proc->inner_lock if @proc 236 * and by @lock) 237 * @has_async_transaction: async transaction to node in progress 238 * (protected by @lock) 239 * @accept_fds: file descriptor operations supported for node 240 * (invariant after initialized) 241 * @min_priority: minimum scheduling priority 242 * (invariant after initialized) 243 * @txn_security_ctx: require sender's security context 244 * (invariant after initialized) 245 * @async_todo: list of async work items 246 * (protected by @proc->inner_lock) 247 * 248 * Bookkeeping structure for binder nodes. 249 */ 250 struct binder_node { 251 int debug_id; 252 spinlock_t lock; 253 struct binder_work work; 254 union { 255 struct rb_node rb_node; 256 struct hlist_node dead_node; 257 }; 258 struct binder_proc *proc; 259 struct hlist_head refs; 260 int internal_strong_refs; 261 int local_weak_refs; 262 int local_strong_refs; 263 int tmp_refs; 264 binder_uintptr_t ptr; 265 binder_uintptr_t cookie; 266 struct { 267 /* 268 * bitfield elements protected by 269 * proc inner_lock 270 */ 271 u8 has_strong_ref:1; 272 u8 pending_strong_ref:1; 273 u8 has_weak_ref:1; 274 u8 pending_weak_ref:1; 275 }; 276 struct { 277 /* 278 * invariant after initialization 279 */ 280 u8 accept_fds:1; 281 u8 txn_security_ctx:1; 282 u8 min_priority; 283 }; 284 bool has_async_transaction; 285 struct list_head async_todo; 286 }; 287 288 struct binder_ref_death { 289 /** 290 * @work: worklist element for death notifications 291 * (protected by inner_lock of the proc that 292 * this ref belongs to) 293 */ 294 struct binder_work work; 295 binder_uintptr_t cookie; 296 }; 297 298 /** 299 * struct binder_ref_data - binder_ref counts and id 300 * @debug_id: unique ID for the ref 301 * @desc: unique userspace handle for ref 302 * @strong: strong ref count (debugging only if not locked) 303 * @weak: weak ref count (debugging only if not locked) 304 * 305 * Structure to hold ref count and ref id information. Since 306 * the actual ref can only be accessed with a lock, this structure 307 * is used to return information about the ref to callers of 308 * ref inc/dec functions. 309 */ 310 struct binder_ref_data { 311 int debug_id; 312 uint32_t desc; 313 int strong; 314 int weak; 315 }; 316 317 /** 318 * struct binder_ref - struct to track references on nodes 319 * @data: binder_ref_data containing id, handle, and current refcounts 320 * @rb_node_desc: node for lookup by @data.desc in proc's rb_tree 321 * @rb_node_node: node for lookup by @node in proc's rb_tree 322 * @node_entry: list entry for node->refs list in target node 323 * (protected by @node->lock) 324 * @proc: binder_proc containing ref 325 * @node: binder_node of target node. When cleaning up a 326 * ref for deletion in binder_cleanup_ref, a non-NULL 327 * @node indicates the node must be freed 328 * @death: pointer to death notification (ref_death) if requested 329 * (protected by @node->lock) 330 * 331 * Structure to track references from procA to target node (on procB). This 332 * structure is unsafe to access without holding @proc->outer_lock. 333 */ 334 struct binder_ref { 335 /* Lookups needed: */ 336 /* node + proc => ref (transaction) */ 337 /* desc + proc => ref (transaction, inc/dec ref) */ 338 /* node => refs + procs (proc exit) */ 339 struct binder_ref_data data; 340 struct rb_node rb_node_desc; 341 struct rb_node rb_node_node; 342 struct hlist_node node_entry; 343 struct binder_proc *proc; 344 struct binder_node *node; 345 struct binder_ref_death *death; 346 }; 347 348 /** 349 * struct binder_proc - binder process bookkeeping 350 * @proc_node: element for binder_procs list 351 * @threads: rbtree of binder_threads in this proc 352 * (protected by @inner_lock) 353 * @nodes: rbtree of binder nodes associated with 354 * this proc ordered by node->ptr 355 * (protected by @inner_lock) 356 * @refs_by_desc: rbtree of refs ordered by ref->desc 357 * (protected by @outer_lock) 358 * @refs_by_node: rbtree of refs ordered by ref->node 359 * (protected by @outer_lock) 360 * @waiting_threads: threads currently waiting for proc work 361 * (protected by @inner_lock) 362 * @pid PID of group_leader of process 363 * (invariant after initialized) 364 * @tsk task_struct for group_leader of process 365 * (invariant after initialized) 366 * @deferred_work_node: element for binder_deferred_list 367 * (protected by binder_deferred_lock) 368 * @deferred_work: bitmap of deferred work to perform 369 * (protected by binder_deferred_lock) 370 * @outstanding_txns: number of transactions to be transmitted before 371 * processes in freeze_wait are woken up 372 * (protected by @inner_lock) 373 * @is_dead: process is dead and awaiting free 374 * when outstanding transactions are cleaned up 375 * (protected by @inner_lock) 376 * @is_frozen: process is frozen and unable to service 377 * binder transactions 378 * (protected by @inner_lock) 379 * @sync_recv: process received sync transactions since last frozen 380 * (protected by @inner_lock) 381 * @async_recv: process received async transactions since last frozen 382 * (protected by @inner_lock) 383 * @freeze_wait: waitqueue of processes waiting for all outstanding 384 * transactions to be processed 385 * (protected by @inner_lock) 386 * @todo: list of work for this process 387 * (protected by @inner_lock) 388 * @stats: per-process binder statistics 389 * (atomics, no lock needed) 390 * @delivered_death: list of delivered death notification 391 * (protected by @inner_lock) 392 * @max_threads: cap on number of binder threads 393 * (protected by @inner_lock) 394 * @requested_threads: number of binder threads requested but not 395 * yet started. In current implementation, can 396 * only be 0 or 1. 397 * (protected by @inner_lock) 398 * @requested_threads_started: number binder threads started 399 * (protected by @inner_lock) 400 * @tmp_ref: temporary reference to indicate proc is in use 401 * (protected by @inner_lock) 402 * @default_priority: default scheduler priority 403 * (invariant after initialized) 404 * @debugfs_entry: debugfs node 405 * @alloc: binder allocator bookkeeping 406 * @context: binder_context for this proc 407 * (invariant after initialized) 408 * @inner_lock: can nest under outer_lock and/or node lock 409 * @outer_lock: no nesting under innor or node lock 410 * Lock order: 1) outer, 2) node, 3) inner 411 * @binderfs_entry: process-specific binderfs log file 412 * 413 * Bookkeeping structure for binder processes 414 */ 415 struct binder_proc { 416 struct hlist_node proc_node; 417 struct rb_root threads; 418 struct rb_root nodes; 419 struct rb_root refs_by_desc; 420 struct rb_root refs_by_node; 421 struct list_head waiting_threads; 422 int pid; 423 struct task_struct *tsk; 424 struct hlist_node deferred_work_node; 425 int deferred_work; 426 int outstanding_txns; 427 bool is_dead; 428 bool is_frozen; 429 bool sync_recv; 430 bool async_recv; 431 wait_queue_head_t freeze_wait; 432 433 struct list_head todo; 434 struct binder_stats stats; 435 struct list_head delivered_death; 436 int max_threads; 437 int requested_threads; 438 int requested_threads_started; 439 int tmp_ref; 440 long default_priority; 441 struct dentry *debugfs_entry; 442 struct binder_alloc alloc; 443 struct binder_context *context; 444 spinlock_t inner_lock; 445 spinlock_t outer_lock; 446 struct dentry *binderfs_entry; 447 }; 448 449 /** 450 * struct binder_thread - binder thread bookkeeping 451 * @proc: binder process for this thread 452 * (invariant after initialization) 453 * @rb_node: element for proc->threads rbtree 454 * (protected by @proc->inner_lock) 455 * @waiting_thread_node: element for @proc->waiting_threads list 456 * (protected by @proc->inner_lock) 457 * @pid: PID for this thread 458 * (invariant after initialization) 459 * @looper: bitmap of looping state 460 * (only accessed by this thread) 461 * @looper_needs_return: looping thread needs to exit driver 462 * (no lock needed) 463 * @transaction_stack: stack of in-progress transactions for this thread 464 * (protected by @proc->inner_lock) 465 * @todo: list of work to do for this thread 466 * (protected by @proc->inner_lock) 467 * @process_todo: whether work in @todo should be processed 468 * (protected by @proc->inner_lock) 469 * @return_error: transaction errors reported by this thread 470 * (only accessed by this thread) 471 * @reply_error: transaction errors reported by target thread 472 * (protected by @proc->inner_lock) 473 * @wait: wait queue for thread work 474 * @stats: per-thread statistics 475 * (atomics, no lock needed) 476 * @tmp_ref: temporary reference to indicate thread is in use 477 * (atomic since @proc->inner_lock cannot 478 * always be acquired) 479 * @is_dead: thread is dead and awaiting free 480 * when outstanding transactions are cleaned up 481 * (protected by @proc->inner_lock) 482 * 483 * Bookkeeping structure for binder threads. 484 */ 485 struct binder_thread { 486 struct binder_proc *proc; 487 struct rb_node rb_node; 488 struct list_head waiting_thread_node; 489 int pid; 490 int looper; /* only modified by this thread */ 491 bool looper_need_return; /* can be written by other thread */ 492 struct binder_transaction *transaction_stack; 493 struct list_head todo; 494 bool process_todo; 495 struct binder_error return_error; 496 struct binder_error reply_error; 497 wait_queue_head_t wait; 498 struct binder_stats stats; 499 atomic_t tmp_ref; 500 bool is_dead; 501 }; 502 503 /** 504 * struct binder_txn_fd_fixup - transaction fd fixup list element 505 * @fixup_entry: list entry 506 * @file: struct file to be associated with new fd 507 * @offset: offset in buffer data to this fixup 508 * 509 * List element for fd fixups in a transaction. Since file 510 * descriptors need to be allocated in the context of the 511 * target process, we pass each fd to be processed in this 512 * struct. 513 */ 514 struct binder_txn_fd_fixup { 515 struct list_head fixup_entry; 516 struct file *file; 517 size_t offset; 518 }; 519 520 struct binder_transaction { 521 int debug_id; 522 struct binder_work work; 523 struct binder_thread *from; 524 struct binder_transaction *from_parent; 525 struct binder_proc *to_proc; 526 struct binder_thread *to_thread; 527 struct binder_transaction *to_parent; 528 unsigned need_reply:1; 529 /* unsigned is_dead:1; */ /* not used at the moment */ 530 531 struct binder_buffer *buffer; 532 unsigned int code; 533 unsigned int flags; 534 long priority; 535 long saved_priority; 536 kuid_t sender_euid; 537 struct list_head fd_fixups; 538 binder_uintptr_t security_ctx; 539 /** 540 * @lock: protects @from, @to_proc, and @to_thread 541 * 542 * @from, @to_proc, and @to_thread can be set to NULL 543 * during thread teardown 544 */ 545 spinlock_t lock; 546 }; 547 548 /** 549 * struct binder_object - union of flat binder object types 550 * @hdr: generic object header 551 * @fbo: binder object (nodes and refs) 552 * @fdo: file descriptor object 553 * @bbo: binder buffer pointer 554 * @fdao: file descriptor array 555 * 556 * Used for type-independent object copies 557 */ 558 struct binder_object { 559 union { 560 struct binder_object_header hdr; 561 struct flat_binder_object fbo; 562 struct binder_fd_object fdo; 563 struct binder_buffer_object bbo; 564 struct binder_fd_array_object fdao; 565 }; 566 }; 567 568 extern struct binder_transaction_log binder_transaction_log; 569 extern struct binder_transaction_log binder_transaction_log_failed; 570 #endif /* _LINUX_BINDER_INTERNAL_H */ 571