binder_internal.h 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625
  1. /* SPDX-License-Identifier: GPL-2.0 */
  2. #ifndef _LINUX_BINDER_INTERNAL_H
  3. #define _LINUX_BINDER_INTERNAL_H
  4. #include <linux/export.h>
  5. #include <linux/fs.h>
  6. #include <linux/list.h>
  7. #include <linux/miscdevice.h>
  8. #include <linux/mutex.h>
  9. #include <linux/refcount.h>
  10. #include <linux/stddef.h>
  11. #include <linux/types.h>
  12. #include <linux/uidgid.h>
  13. #include <uapi/linux/android/binderfs.h>
  14. #include "binder_alloc.h"
  15. struct binder_context {
  16. struct binder_node *binder_context_mgr_node;
  17. struct mutex context_mgr_node_lock;
  18. kuid_t binder_context_mgr_uid;
  19. const char *name;
  20. };
  21. /**
  22. * struct binder_device - information about a binder device node
  23. * @hlist: list of binder devices (only used for devices requested via
  24. * CONFIG_ANDROID_BINDER_DEVICES)
  25. * @miscdev: information about a binder character device node
  26. * @context: binder context information
  27. * @binderfs_inode: This is the inode of the root dentry of the super block
  28. * belonging to a binderfs mount.
  29. */
  30. struct binder_device {
  31. struct hlist_node hlist;
  32. struct miscdevice miscdev;
  33. struct binder_context context;
  34. struct inode *binderfs_inode;
  35. refcount_t ref;
  36. };
  37. /**
  38. * binderfs_mount_opts - mount options for binderfs
  39. * @max: maximum number of allocatable binderfs binder devices
  40. * @stats_mode: enable binder stats in binderfs.
  41. */
  42. struct binderfs_mount_opts {
  43. int max;
  44. int stats_mode;
  45. };
  46. /**
  47. * binderfs_info - information about a binderfs mount
  48. * @ipc_ns: The ipc namespace the binderfs mount belongs to.
  49. * @control_dentry: This records the dentry of this binderfs mount
  50. * binder-control device.
  51. * @root_uid: uid that needs to be used when a new binder device is
  52. * created.
  53. * @root_gid: gid that needs to be used when a new binder device is
  54. * created.
  55. * @mount_opts: The mount options in use.
  56. * @device_count: The current number of allocated binder devices.
  57. * @proc_log_dir: Pointer to the directory dentry containing process-specific
  58. * logs.
  59. */
  60. struct binderfs_info {
  61. struct ipc_namespace *ipc_ns;
  62. struct dentry *control_dentry;
  63. kuid_t root_uid;
  64. kgid_t root_gid;
  65. struct binderfs_mount_opts mount_opts;
  66. int device_count;
  67. struct dentry *proc_log_dir;
  68. };
  69. extern const struct file_operations binder_fops;
  70. extern char *binder_devices_param;
  71. #ifdef CONFIG_ANDROID_BINDERFS
  72. extern bool is_binderfs_device(const struct inode *inode);
  73. extern struct dentry *binderfs_create_file(struct dentry *dir, const char *name,
  74. const struct file_operations *fops,
  75. void *data);
  76. extern void binderfs_remove_file(struct dentry *dentry);
  77. #else
  78. static inline bool is_binderfs_device(const struct inode *inode)
  79. {
  80. return false;
  81. }
  82. static inline struct dentry *binderfs_create_file(struct dentry *dir,
  83. const char *name,
  84. const struct file_operations *fops,
  85. void *data)
  86. {
  87. return NULL;
  88. }
  89. static inline void binderfs_remove_file(struct dentry *dentry) {}
  90. #endif
  91. #ifdef CONFIG_ANDROID_BINDERFS
  92. extern int __init init_binderfs(void);
  93. #else
  94. static inline int __init init_binderfs(void)
  95. {
  96. return 0;
  97. }
  98. #endif
  99. int binder_stats_show(struct seq_file *m, void *unused);
  100. DEFINE_SHOW_ATTRIBUTE(binder_stats);
  101. int binder_state_show(struct seq_file *m, void *unused);
  102. DEFINE_SHOW_ATTRIBUTE(binder_state);
  103. int binder_transactions_show(struct seq_file *m, void *unused);
  104. DEFINE_SHOW_ATTRIBUTE(binder_transactions);
  105. int binder_transaction_log_show(struct seq_file *m, void *unused);
  106. DEFINE_SHOW_ATTRIBUTE(binder_transaction_log);
  107. struct binder_transaction_log_entry {
  108. int debug_id;
  109. int debug_id_done;
  110. int call_type;
  111. int from_proc;
  112. int from_thread;
  113. int target_handle;
  114. int to_proc;
  115. int to_thread;
  116. int to_node;
  117. int data_size;
  118. int offsets_size;
  119. int return_error_line;
  120. uint32_t return_error;
  121. uint32_t return_error_param;
  122. char context_name[BINDERFS_MAX_NAME + 1];
  123. };
  124. struct binder_transaction_log {
  125. atomic_t cur;
  126. bool full;
  127. struct binder_transaction_log_entry entry[32];
  128. };
  129. enum binder_stat_types {
  130. BINDER_STAT_PROC,
  131. BINDER_STAT_THREAD,
  132. BINDER_STAT_NODE,
  133. BINDER_STAT_REF,
  134. BINDER_STAT_DEATH,
  135. BINDER_STAT_TRANSACTION,
  136. BINDER_STAT_TRANSACTION_COMPLETE,
  137. BINDER_STAT_COUNT
  138. };
  139. struct binder_stats {
  140. atomic_t br[_IOC_NR(BR_ONEWAY_SPAM_SUSPECT) + 1];
  141. atomic_t bc[_IOC_NR(BC_REPLY_SG) + 1];
  142. atomic_t obj_created[BINDER_STAT_COUNT];
  143. atomic_t obj_deleted[BINDER_STAT_COUNT];
  144. };
  145. /**
  146. * struct binder_work - work enqueued on a worklist
  147. * @entry: node enqueued on list
  148. * @type: type of work to be performed
  149. *
  150. * There are separate work lists for proc, thread, and node (async).
  151. */
  152. struct binder_work {
  153. struct list_head entry;
  154. enum binder_work_type {
  155. BINDER_WORK_TRANSACTION = 1,
  156. BINDER_WORK_TRANSACTION_COMPLETE,
  157. BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT,
  158. BINDER_WORK_RETURN_ERROR,
  159. BINDER_WORK_NODE,
  160. BINDER_WORK_DEAD_BINDER,
  161. BINDER_WORK_DEAD_BINDER_AND_CLEAR,
  162. BINDER_WORK_CLEAR_DEATH_NOTIFICATION,
  163. } type;
  164. };
  165. struct binder_error {
  166. struct binder_work work;
  167. uint32_t cmd;
  168. };
  169. /**
  170. * struct binder_node - binder node bookkeeping
  171. * @debug_id: unique ID for debugging
  172. * (invariant after initialized)
  173. * @lock: lock for node fields
  174. * @work: worklist element for node work
  175. * (protected by @proc->inner_lock)
  176. * @rb_node: element for proc->nodes tree
  177. * (protected by @proc->inner_lock)
  178. * @dead_node: element for binder_dead_nodes list
  179. * (protected by binder_dead_nodes_lock)
  180. * @proc: binder_proc that owns this node
  181. * (invariant after initialized)
  182. * @refs: list of references on this node
  183. * (protected by @lock)
  184. * @internal_strong_refs: used to take strong references when
  185. * initiating a transaction
  186. * (protected by @proc->inner_lock if @proc
  187. * and by @lock)
  188. * @local_weak_refs: weak user refs from local process
  189. * (protected by @proc->inner_lock if @proc
  190. * and by @lock)
  191. * @local_strong_refs: strong user refs from local process
  192. * (protected by @proc->inner_lock if @proc
  193. * and by @lock)
  194. * @tmp_refs: temporary kernel refs
  195. * (protected by @proc->inner_lock while @proc
  196. * is valid, and by binder_dead_nodes_lock
  197. * if @proc is NULL. During inc/dec and node release
  198. * it is also protected by @lock to provide safety
  199. * as the node dies and @proc becomes NULL)
  200. * @ptr: userspace pointer for node
  201. * (invariant, no lock needed)
  202. * @cookie: userspace cookie for node
  203. * (invariant, no lock needed)
  204. * @has_strong_ref: userspace notified of strong ref
  205. * (protected by @proc->inner_lock if @proc
  206. * and by @lock)
  207. * @pending_strong_ref: userspace has acked notification of strong ref
  208. * (protected by @proc->inner_lock if @proc
  209. * and by @lock)
  210. * @has_weak_ref: userspace notified of weak ref
  211. * (protected by @proc->inner_lock if @proc
  212. * and by @lock)
  213. * @pending_weak_ref: userspace has acked notification of weak ref
  214. * (protected by @proc->inner_lock if @proc
  215. * and by @lock)
  216. * @has_async_transaction: async transaction to node in progress
  217. * (protected by @lock)
  218. * @sched_policy: minimum scheduling policy for node
  219. * (invariant after initialized)
  220. * @accept_fds: file descriptor operations supported for node
  221. * (invariant after initialized)
  222. * @min_priority: minimum scheduling priority
  223. * (invariant after initialized)
  224. * @inherit_rt: inherit RT scheduling policy from caller
  225. * @txn_security_ctx: require sender's security context
  226. * (invariant after initialized)
  227. * @async_todo: list of async work items
  228. * (protected by @proc->inner_lock)
  229. *
  230. * Bookkeeping structure for binder nodes.
  231. */
  232. struct binder_node {
  233. int debug_id;
  234. spinlock_t lock;
  235. struct binder_work work;
  236. union {
  237. struct rb_node rb_node;
  238. struct hlist_node dead_node;
  239. };
  240. struct binder_proc *proc;
  241. struct hlist_head refs;
  242. int internal_strong_refs;
  243. int local_weak_refs;
  244. int local_strong_refs;
  245. int tmp_refs;
  246. binder_uintptr_t ptr;
  247. binder_uintptr_t cookie;
  248. struct {
  249. /*
  250. * bitfield elements protected by
  251. * proc inner_lock
  252. */
  253. u8 has_strong_ref:1;
  254. u8 pending_strong_ref:1;
  255. u8 has_weak_ref:1;
  256. u8 pending_weak_ref:1;
  257. };
  258. struct {
  259. /*
  260. * invariant after initialization
  261. */
  262. u8 sched_policy:2;
  263. u8 inherit_rt:1;
  264. u8 accept_fds:1;
  265. u8 txn_security_ctx:1;
  266. u8 min_priority;
  267. };
  268. bool has_async_transaction;
  269. struct list_head async_todo;
  270. };
  271. struct binder_ref_death {
  272. /**
  273. * @work: worklist element for death notifications
  274. * (protected by inner_lock of the proc that
  275. * this ref belongs to)
  276. */
  277. struct binder_work work;
  278. binder_uintptr_t cookie;
  279. };
  280. /**
  281. * struct binder_ref_data - binder_ref counts and id
  282. * @debug_id: unique ID for the ref
  283. * @desc: unique userspace handle for ref
  284. * @strong: strong ref count (debugging only if not locked)
  285. * @weak: weak ref count (debugging only if not locked)
  286. *
  287. * Structure to hold ref count and ref id information. Since
  288. * the actual ref can only be accessed with a lock, this structure
  289. * is used to return information about the ref to callers of
  290. * ref inc/dec functions.
  291. */
  292. struct binder_ref_data {
  293. int debug_id;
  294. uint32_t desc;
  295. int strong;
  296. int weak;
  297. };
  298. /**
  299. * struct binder_ref - struct to track references on nodes
  300. * @data: binder_ref_data containing id, handle, and current refcounts
  301. * @rb_node_desc: node for lookup by @data.desc in proc's rb_tree
  302. * @rb_node_node: node for lookup by @node in proc's rb_tree
  303. * @node_entry: list entry for node->refs list in target node
  304. * (protected by @node->lock)
  305. * @proc: binder_proc containing ref
  306. * @node: binder_node of target node. When cleaning up a
  307. * ref for deletion in binder_cleanup_ref, a non-NULL
  308. * @node indicates the node must be freed
  309. * @death: pointer to death notification (ref_death) if requested
  310. * (protected by @node->lock)
  311. *
  312. * Structure to track references from procA to target node (on procB). This
  313. * structure is unsafe to access without holding @proc->outer_lock.
  314. */
  315. struct binder_ref {
  316. /* Lookups needed: */
  317. /* node + proc => ref (transaction) */
  318. /* desc + proc => ref (transaction, inc/dec ref) */
  319. /* node => refs + procs (proc exit) */
  320. struct binder_ref_data data;
  321. struct rb_node rb_node_desc;
  322. struct rb_node rb_node_node;
  323. struct hlist_node node_entry;
  324. struct binder_proc *proc;
  325. struct binder_node *node;
  326. struct binder_ref_death *death;
  327. };
  328. /**
  329. * struct binder_priority - scheduler policy and priority
  330. * @sched_policy scheduler policy
  331. * @prio [100..139] for SCHED_NORMAL, [0..99] for FIFO/RT
  332. *
  333. * The binder driver supports inheriting the following scheduler policies:
  334. * SCHED_NORMAL
  335. * SCHED_BATCH
  336. * SCHED_FIFO
  337. * SCHED_RR
  338. */
  339. struct binder_priority {
  340. unsigned int sched_policy;
  341. int prio;
  342. };
  343. /**
  344. * struct binder_proc - binder process bookkeeping
  345. * @proc_node: element for binder_procs list
  346. * @threads: rbtree of binder_threads in this proc
  347. * (protected by @inner_lock)
  348. * @nodes: rbtree of binder nodes associated with
  349. * this proc ordered by node->ptr
  350. * (protected by @inner_lock)
  351. * @refs_by_desc: rbtree of refs ordered by ref->desc
  352. * (protected by @outer_lock)
  353. * @refs_by_node: rbtree of refs ordered by ref->node
  354. * (protected by @outer_lock)
  355. * @waiting_threads: threads currently waiting for proc work
  356. * (protected by @inner_lock)
  357. * @pid PID of group_leader of process
  358. * (invariant after initialized)
  359. * @tsk task_struct for group_leader of process
  360. * (invariant after initialized)
  361. * @deferred_work_node: element for binder_deferred_list
  362. * (protected by binder_deferred_lock)
  363. * @deferred_work: bitmap of deferred work to perform
  364. * (protected by binder_deferred_lock)
  365. * @outstanding_txns: number of transactions to be transmitted before
  366. * processes in freeze_wait are woken up
  367. * (protected by @inner_lock)
  368. * @is_dead: process is dead and awaiting free
  369. * when outstanding transactions are cleaned up
  370. * (protected by @inner_lock)
  371. * @is_frozen: process is frozen and unable to service
  372. * binder transactions
  373. * (protected by @inner_lock)
  374. * @sync_recv: process received sync transactions since last frozen
  375. * bit 0: received sync transaction after being frozen
  376. * bit 1: new pending sync transaction during freezing
  377. * (protected by @inner_lock)
  378. * @async_recv: process received async transactions since last frozen
  379. * (protected by @inner_lock)
  380. * @freeze_wait: waitqueue of processes waiting for all outstanding
  381. * transactions to be processed
  382. * (protected by @inner_lock)
  383. * @todo: list of work for this process
  384. * (protected by @inner_lock)
  385. * @stats: per-process binder statistics
  386. * (atomics, no lock needed)
  387. * @delivered_death: list of delivered death notification
  388. * (protected by @inner_lock)
  389. * @max_threads: cap on number of binder threads
  390. * (protected by @inner_lock)
  391. * @requested_threads: number of binder threads requested but not
  392. * yet started. In current implementation, can
  393. * only be 0 or 1.
  394. * (protected by @inner_lock)
  395. * @requested_threads_started: number binder threads started
  396. * (protected by @inner_lock)
  397. * @tmp_ref: temporary reference to indicate proc is in use
  398. * (protected by @inner_lock)
  399. * @default_priority: default scheduler priority
  400. * (invariant after initialized)
  401. * @debugfs_entry: debugfs node
  402. * @alloc: binder allocator bookkeeping
  403. * @context: binder_context for this proc
  404. * (invariant after initialized)
  405. * @inner_lock: can nest under outer_lock and/or node lock
  406. * @outer_lock: no nesting under innor or node lock
  407. * Lock order: 1) outer, 2) node, 3) inner
  408. * @binderfs_entry: process-specific binderfs log file
  409. * @oneway_spam_detection_enabled: process enabled oneway spam detection
  410. * or not
  411. *
  412. * Bookkeeping structure for binder processes
  413. */
  414. struct binder_proc {
  415. struct hlist_node proc_node;
  416. struct rb_root threads;
  417. struct rb_root nodes;
  418. struct rb_root refs_by_desc;
  419. struct rb_root refs_by_node;
  420. struct list_head waiting_threads;
  421. int pid;
  422. struct task_struct *tsk;
  423. struct hlist_node deferred_work_node;
  424. int deferred_work;
  425. int outstanding_txns;
  426. bool is_dead;
  427. bool is_frozen;
  428. bool sync_recv;
  429. bool async_recv;
  430. wait_queue_head_t freeze_wait;
  431. struct list_head todo;
  432. struct binder_stats stats;
  433. struct list_head delivered_death;
  434. int max_threads;
  435. int requested_threads;
  436. int requested_threads_started;
  437. int tmp_ref;
  438. struct binder_priority default_priority;
  439. struct dentry *debugfs_entry;
  440. struct binder_alloc alloc;
  441. struct binder_context *context;
  442. spinlock_t inner_lock;
  443. spinlock_t outer_lock;
  444. struct dentry *binderfs_entry;
  445. bool oneway_spam_detection_enabled;
  446. };
  447. /**
  448. * struct binder_proc_ext - binder process bookkeeping
  449. * @proc: element for binder_procs list
  450. * @cred struct cred associated with the `struct file`
  451. * in binder_open()
  452. * (invariant after initialized)
  453. *
  454. * Extended binder_proc -- needed to add the "cred" field without
  455. * changing the KMI for binder_proc.
  456. */
  457. struct binder_proc_ext {
  458. struct binder_proc proc;
  459. const struct cred *cred;
  460. };
  461. static inline const struct cred *binder_get_cred(struct binder_proc *proc)
  462. {
  463. struct binder_proc_ext *eproc;
  464. eproc = container_of(proc, struct binder_proc_ext, proc);
  465. return eproc->cred;
  466. }
  467. /**
  468. * struct binder_thread - binder thread bookkeeping
  469. * @proc: binder process for this thread
  470. * (invariant after initialization)
  471. * @rb_node: element for proc->threads rbtree
  472. * (protected by @proc->inner_lock)
  473. * @waiting_thread_node: element for @proc->waiting_threads list
  474. * (protected by @proc->inner_lock)
  475. * @pid: PID for this thread
  476. * (invariant after initialization)
  477. * @looper: bitmap of looping state
  478. * (only accessed by this thread)
  479. * @looper_needs_return: looping thread needs to exit driver
  480. * (no lock needed)
  481. * @transaction_stack: stack of in-progress transactions for this thread
  482. * (protected by @proc->inner_lock)
  483. * @todo: list of work to do for this thread
  484. * (protected by @proc->inner_lock)
  485. * @process_todo: whether work in @todo should be processed
  486. * (protected by @proc->inner_lock)
  487. * @return_error: transaction errors reported by this thread
  488. * (only accessed by this thread)
  489. * @reply_error: transaction errors reported by target thread
  490. * (protected by @proc->inner_lock)
  491. * @wait: wait queue for thread work
  492. * @stats: per-thread statistics
  493. * (atomics, no lock needed)
  494. * @tmp_ref: temporary reference to indicate thread is in use
  495. * (atomic since @proc->inner_lock cannot
  496. * always be acquired)
  497. * @is_dead: thread is dead and awaiting free
  498. * when outstanding transactions are cleaned up
  499. * (protected by @proc->inner_lock)
  500. * @task: struct task_struct for this thread
  501. *
  502. * Bookkeeping structure for binder threads.
  503. */
  504. struct binder_thread {
  505. struct binder_proc *proc;
  506. struct rb_node rb_node;
  507. struct list_head waiting_thread_node;
  508. int pid;
  509. int looper; /* only modified by this thread */
  510. bool looper_need_return; /* can be written by other thread */
  511. struct binder_transaction *transaction_stack;
  512. struct list_head todo;
  513. bool process_todo;
  514. struct binder_error return_error;
  515. struct binder_error reply_error;
  516. wait_queue_head_t wait;
  517. struct binder_stats stats;
  518. atomic_t tmp_ref;
  519. bool is_dead;
  520. struct task_struct *task;
  521. };
  522. /**
  523. * struct binder_txn_fd_fixup - transaction fd fixup list element
  524. * @fixup_entry: list entry
  525. * @file: struct file to be associated with new fd
  526. * @offset: offset in buffer data to this fixup
  527. *
  528. * List element for fd fixups in a transaction. Since file
  529. * descriptors need to be allocated in the context of the
  530. * target process, we pass each fd to be processed in this
  531. * struct.
  532. */
  533. struct binder_txn_fd_fixup {
  534. struct list_head fixup_entry;
  535. struct file *file;
  536. size_t offset;
  537. };
  538. struct binder_transaction {
  539. int debug_id;
  540. struct binder_work work;
  541. struct binder_thread *from;
  542. struct binder_transaction *from_parent;
  543. struct binder_proc *to_proc;
  544. struct binder_thread *to_thread;
  545. struct binder_transaction *to_parent;
  546. unsigned need_reply:1;
  547. /* unsigned is_dead:1; */ /* not used at the moment */
  548. struct binder_buffer *buffer;
  549. unsigned int code;
  550. unsigned int flags;
  551. struct binder_priority priority;
  552. struct binder_priority saved_priority;
  553. bool set_priority_called;
  554. kuid_t sender_euid;
  555. struct list_head fd_fixups;
  556. binder_uintptr_t security_ctx;
  557. /**
  558. * @lock: protects @from, @to_proc, and @to_thread
  559. *
  560. * @from, @to_proc, and @to_thread can be set to NULL
  561. * during thread teardown
  562. */
  563. spinlock_t lock;
  564. ANDROID_VENDOR_DATA(1);
  565. ANDROID_OEM_DATA_ARRAY(1, 2);
  566. };
  567. /**
  568. * struct binder_object - union of flat binder object types
  569. * @hdr: generic object header
  570. * @fbo: binder object (nodes and refs)
  571. * @fdo: file descriptor object
  572. * @bbo: binder buffer pointer
  573. * @fdao: file descriptor array
  574. *
  575. * Used for type-independent object copies
  576. */
  577. struct binder_object {
  578. union {
  579. struct binder_object_header hdr;
  580. struct flat_binder_object fbo;
  581. struct binder_fd_object fdo;
  582. struct binder_buffer_object bbo;
  583. struct binder_fd_array_object fdao;
  584. };
  585. };
  586. extern struct binder_transaction_log binder_transaction_log;
  587. extern struct binder_transaction_log binder_transaction_log_failed;
  588. #endif /* _LINUX_BINDER_INTERNAL_H */