drivers/android/binder_internal.h

   1 /* SPDX-License-Identifier: GPL-2.0 */
   2
   3 #ifndef _LINUX_BINDER_INTERNAL_H
   4 #define _LINUX_BINDER_INTERNAL_H
   5
   6 #include <linux/export.h>
   7 #include <linux/fs.h>
   8 #include <linux/list.h>
   9 #include <linux/miscdevice.h>
  10 #include <linux/mutex.h>
  11 #include <linux/refcount.h>
  12 #include <linux/stddef.h>
  13 #include <linux/types.h>
  14 #include <linux/uidgid.h>
  15 #include <uapi/linux/android/binderfs.h>
  16 #include "binder_alloc.h"
  17 #include "dbitmap.h"
  18
  19 struct binder_context {
  20         struct binder_node *binder_context_mgr_node;
  21         struct mutex context_mgr_node_lock;
  22         kuid_t binder_context_mgr_uid;
  23         const char *name;
  24 };
  25
  26 /**
  27  * struct binder_device - information about a binder device node
  28  * @hlist:          list of binder devices (only used for devices requested via
  29  *                  CONFIG_ANDROID_BINDER_DEVICES)
  30  * @miscdev:        information about a binder character device node
  31  * @context:        binder context information
  32  * @binderfs_inode: This is the inode of the root dentry of the super block
  33  *                  belonging to a binderfs mount.
  34  */
  35 struct binder_device {
  36         struct hlist_node hlist;
  37         struct miscdevice miscdev;
  38         struct binder_context context;
  39         struct inode *binderfs_inode;
  40         refcount_t ref;
  41 };
  42
  43 /**
  44  * binderfs_mount_opts - mount options for binderfs
  45  * @max: maximum number of allocatable binderfs binder devices
  46  * @stats_mode: enable binder stats in binderfs.
  47  */
  48 struct binderfs_mount_opts {
  49         int max;
  50         int stats_mode;
  51 };
  52
  53 /**
  54  * binderfs_info - information about a binderfs mount
  55  * @ipc_ns:         The ipc namespace the binderfs mount belongs to.
  56  * @control_dentry: This records the dentry of this binderfs mount
  57  *                  binder-control device.
  58  * @root_uid:       uid that needs to be used when a new binder device is
  59  *                  created.
  60  * @root_gid:       gid that needs to be used when a new binder device is
  61  *                  created.
  62  * @mount_opts:     The mount options in use.
  63  * @device_count:   The current number of allocated binder devices.
  64  * @proc_log_dir:   Pointer to the directory dentry containing process-specific
  65  *                  logs.
  66  */
  67 struct binderfs_info {
  68         struct ipc_namespace *ipc_ns;
  69         struct dentry *control_dentry;
  70         kuid_t root_uid;
  71         kgid_t root_gid;
  72         struct binderfs_mount_opts mount_opts;
  73         int device_count;
  74         struct dentry *proc_log_dir;
  75 };
  76
  77 extern const struct file_operations binder_fops;
  78
  79 extern char *binder_devices_param;
  80
  81 #ifdef CONFIG_ANDROID_BINDERFS
  82 extern bool is_binderfs_device(const struct inode *inode);
  83 extern struct dentry *binderfs_create_file(struct dentry *dir, const char *name,
  84                                            const struct file_operations *fops,
  85                                            void *data);
  86 extern void binderfs_remove_file(struct dentry *dentry);
  87 #else
  88 static inline bool is_binderfs_device(const struct inode *inode)
  89 {
  90         return false;
  91 }
  92 static inline struct dentry *binderfs_create_file(struct dentry *dir,
  93                                            const char *name,
  94                                            const struct file_operations *fops,
  95                                            void *data)
  96 {
  97         return NULL;
  98 }
  99 static inline void binderfs_remove_file(struct dentry *dentry) {}
 100 #endif
 101
 102 #ifdef CONFIG_ANDROID_BINDERFS
 103 extern int __init init_binderfs(void);
 104 #else
 105 static inline int __init init_binderfs(void)
 106 {
 107         return 0;
 108 }
 109 #endif
 110
 111 struct binder_debugfs_entry {
 112         const char *name;
 113         umode_t mode;
 114         const struct file_operations *fops;
 115         void *data;
 116 };
 117
 118 extern const struct binder_debugfs_entry binder_debugfs_entries[];
 119
 120 #define binder_for_each_debugfs_entry(entry)    \
 121         for ((entry) = binder_debugfs_entries;  \
 122              (entry)->name;                     \
 123              (entry)++)
 124
 125 enum binder_stat_types {
 126         BINDER_STAT_PROC,
 127         BINDER_STAT_THREAD,
 128         BINDER_STAT_NODE,
 129         BINDER_STAT_REF,
 130         BINDER_STAT_DEATH,
 131         BINDER_STAT_TRANSACTION,
 132         BINDER_STAT_TRANSACTION_COMPLETE,
 133         BINDER_STAT_FREEZE,
 134         BINDER_STAT_COUNT
 135 };
 136
 137 struct binder_stats {
 138         atomic_t br[_IOC_NR(BR_CLEAR_FREEZE_NOTIFICATION_DONE) + 1];
 139         atomic_t bc[_IOC_NR(BC_FREEZE_NOTIFICATION_DONE) + 1];
 140         atomic_t obj_created[BINDER_STAT_COUNT];
 141         atomic_t obj_deleted[BINDER_STAT_COUNT];
 142 };
 143
 144 /**
 145  * struct binder_work - work enqueued on a worklist
 146  * @entry:             node enqueued on list
 147  * @type:              type of work to be performed
 148  *
 149  * There are separate work lists for proc, thread, and node (async).
 150  */
 151 struct binder_work {
 152         struct list_head entry;
 153
 154         enum binder_work_type {
 155                 BINDER_WORK_TRANSACTION = 1,
 156                 BINDER_WORK_TRANSACTION_COMPLETE,
 157                 BINDER_WORK_TRANSACTION_PENDING,
 158                 BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT,
 159                 BINDER_WORK_RETURN_ERROR,
 160                 BINDER_WORK_NODE,
 161                 BINDER_WORK_DEAD_BINDER,
 162                 BINDER_WORK_DEAD_BINDER_AND_CLEAR,
 163                 BINDER_WORK_CLEAR_DEATH_NOTIFICATION,
 164                 BINDER_WORK_FROZEN_BINDER,
 165                 BINDER_WORK_CLEAR_FREEZE_NOTIFICATION,
 166         } type;
 167 };
 168
 169 struct binder_error {
 170         struct binder_work work;
 171         uint32_t cmd;
 172 };
 173
 174 /**
 175  * struct binder_node - binder node bookkeeping
 176  * @debug_id:             unique ID for debugging
 177  *                        (invariant after initialized)
 178  * @lock:                 lock for node fields
 179  * @work:                 worklist element for node work
 180  *                        (protected by @proc->inner_lock)
 181  * @rb_node:              element for proc->nodes tree
 182  *                        (protected by @proc->inner_lock)
 183  * @dead_node:            element for binder_dead_nodes list
 184  *                        (protected by binder_dead_nodes_lock)
 185  * @proc:                 binder_proc that owns this node
 186  *                        (invariant after initialized)
 187  * @refs:                 list of references on this node
 188  *                        (protected by @lock)
 189  * @internal_strong_refs: used to take strong references when
 190  *                        initiating a transaction
 191  *                        (protected by @proc->inner_lock if @proc
 192  *                        and by @lock)
 193  * @local_weak_refs:      weak user refs from local process
 194  *                        (protected by @proc->inner_lock if @proc
 195  *                        and by @lock)
 196  * @local_strong_refs:    strong user refs from local process
 197  *                        (protected by @proc->inner_lock if @proc
 198  *                        and by @lock)
 199  * @tmp_refs:             temporary kernel refs
 200  *                        (protected by @proc->inner_lock while @proc
 201  *                        is valid, and by binder_dead_nodes_lock
 202  *                        if @proc is NULL. During inc/dec and node release
 203  *                        it is also protected by @lock to provide safety
 204  *                        as the node dies and @proc becomes NULL)
 205  * @ptr:                  userspace pointer for node
 206  *                        (invariant, no lock needed)
 207  * @cookie:               userspace cookie for node
 208  *                        (invariant, no lock needed)
 209  * @has_strong_ref:       userspace notified of strong ref
 210  *                        (protected by @proc->inner_lock if @proc
 211  *                        and by @lock)
 212  * @pending_strong_ref:   userspace has acked notification of strong ref
 213  *                        (protected by @proc->inner_lock if @proc
 214  *                        and by @lock)
 215  * @has_weak_ref:         userspace notified of weak ref
 216  *                        (protected by @proc->inner_lock if @proc
 217  *                        and by @lock)
 218  * @pending_weak_ref:     userspace has acked notification of weak ref
 219  *                        (protected by @proc->inner_lock if @proc
 220  *                        and by @lock)
 221  * @has_async_transaction: async transaction to node in progress
 222  *                        (protected by @lock)
 223  * @accept_fds:           file descriptor operations supported for node
 224  *                        (invariant after initialized)
 225  * @min_priority:         minimum scheduling priority
 226  *                        (invariant after initialized)
 227  * @txn_security_ctx:     require sender's security context
 228  *                        (invariant after initialized)
 229  * @async_todo:           list of async work items
 230  *                        (protected by @proc->inner_lock)
 231  *
 232  * Bookkeeping structure for binder nodes.
 233  */
 234 struct binder_node {
 235         int debug_id;
 236         spinlock_t lock;
 237         struct binder_work work;
 238         union {
 239                 struct rb_node rb_node;
 240                 struct hlist_node dead_node;
 241         };
 242         struct binder_proc *proc;
 243         struct hlist_head refs;
 244         int internal_strong_refs;
 245         int local_weak_refs;
 246         int local_strong_refs;
 247         int tmp_refs;
 248         binder_uintptr_t ptr;
 249         binder_uintptr_t cookie;
 250         struct {
 251                 /*
 252                  * bitfield elements protected by
 253                  * proc inner_lock
 254                  */
 255                 u8 has_strong_ref:1;
 256                 u8 pending_strong_ref:1;
 257                 u8 has_weak_ref:1;
 258                 u8 pending_weak_ref:1;
 259         };
 260         struct {
 261                 /*
 262                  * invariant after initialization
 263                  */
 264                 u8 accept_fds:1;
 265                 u8 txn_security_ctx:1;
 266                 u8 min_priority;
 267         };
 268         bool has_async_transaction;
 269         struct list_head async_todo;
 270 };
 271
 272 struct binder_ref_death {
 273         /**
 274          * @work: worklist element for death notifications
 275          *        (protected by inner_lock of the proc that
 276          *        this ref belongs to)
 277          */
 278         struct binder_work work;
 279         binder_uintptr_t cookie;
 280 };
 281
 282 struct binder_ref_freeze {
 283         struct binder_work work;
 284         binder_uintptr_t cookie;
 285         bool is_frozen:1;
 286         bool sent:1;
 287         bool resend:1;
 288 };
 289
 290 /**
 291  * struct binder_ref_data - binder_ref counts and id
 292  * @debug_id:        unique ID for the ref
 293  * @desc:            unique userspace handle for ref
 294  * @strong:          strong ref count (debugging only if not locked)
 295  * @weak:            weak ref count (debugging only if not locked)
 296  *
 297  * Structure to hold ref count and ref id information. Since
 298  * the actual ref can only be accessed with a lock, this structure
 299  * is used to return information about the ref to callers of
 300  * ref inc/dec functions.
 301  */
 302 struct binder_ref_data {
 303         int debug_id;
 304         uint32_t desc;
 305         int strong;
 306         int weak;
 307 };
 308
 309 /**
 310  * struct binder_ref - struct to track references on nodes
 311  * @data:        binder_ref_data containing id, handle, and current refcounts
 312  * @rb_node_desc: node for lookup by @data.desc in proc's rb_tree
 313  * @rb_node_node: node for lookup by @node in proc's rb_tree
 314  * @node_entry:  list entry for node->refs list in target node
 315  *               (protected by @node->lock)
 316  * @proc:        binder_proc containing ref
 317  * @node:        binder_node of target node. When cleaning up a
 318  *               ref for deletion in binder_cleanup_ref, a non-NULL
 319  *               @node indicates the node must be freed
 320  * @death:       pointer to death notification (ref_death) if requested
 321  *               (protected by @node->lock)
 322  * @freeze:      pointer to freeze notification (ref_freeze) if requested
 323  *               (protected by @node->lock)
 324  *
 325  * Structure to track references from procA to target node (on procB). This
 326  * structure is unsafe to access without holding @proc->outer_lock.
 327  */
 328 struct binder_ref {
 329         /* Lookups needed: */
 330         /*   node + proc => ref (transaction) */
 331         /*   desc + proc => ref (transaction, inc/dec ref) */
 332         /*   node => refs + procs (proc exit) */
 333         struct binder_ref_data data;
 334         struct rb_node rb_node_desc;
 335         struct rb_node rb_node_node;
 336         struct hlist_node node_entry;
 337         struct binder_proc *proc;
 338         struct binder_node *node;
 339         struct binder_ref_death *death;
 340         struct binder_ref_freeze *freeze;
 341 };
 342
 343 /**
 344  * struct binder_proc - binder process bookkeeping
 345  * @proc_node:            element for binder_procs list
 346  * @threads:              rbtree of binder_threads in this proc
 347  *                        (protected by @inner_lock)
 348  * @nodes:                rbtree of binder nodes associated with
 349  *                        this proc ordered by node->ptr
 350  *                        (protected by @inner_lock)
 351  * @refs_by_desc:         rbtree of refs ordered by ref->desc
 352  *                        (protected by @outer_lock)
 353  * @refs_by_node:         rbtree of refs ordered by ref->node
 354  *                        (protected by @outer_lock)
 355  * @waiting_threads:      threads currently waiting for proc work
 356  *                        (protected by @inner_lock)
 357  * @pid                   PID of group_leader of process
 358  *                        (invariant after initialized)
 359  * @tsk                   task_struct for group_leader of process
 360  *                        (invariant after initialized)
 361  * @cred                  struct cred associated with the `struct file`
 362  *                        in binder_open()
 363  *                        (invariant after initialized)
 364  * @deferred_work_node:   element for binder_deferred_list
 365  *                        (protected by binder_deferred_lock)
 366  * @deferred_work:        bitmap of deferred work to perform
 367  *                        (protected by binder_deferred_lock)
 368  * @outstanding_txns:     number of transactions to be transmitted before
 369  *                        processes in freeze_wait are woken up
 370  *                        (protected by @inner_lock)
 371  * @is_dead:              process is dead and awaiting free
 372  *                        when outstanding transactions are cleaned up
 373  *                        (protected by @inner_lock)
 374  * @is_frozen:            process is frozen and unable to service
 375  *                        binder transactions
 376  *                        (protected by @inner_lock)
 377  * @sync_recv:            process received sync transactions since last frozen
 378  *                        bit 0: received sync transaction after being frozen
 379  *                        bit 1: new pending sync transaction during freezing
 380  *                        (protected by @inner_lock)
 381  * @async_recv:           process received async transactions since last frozen
 382  *                        (protected by @inner_lock)
 383  * @freeze_wait:          waitqueue of processes waiting for all outstanding
 384  *                        transactions to be processed
 385  *                        (protected by @inner_lock)
 386  * @dmap                  dbitmap to manage available reference descriptors
 387  *                        (protected by @outer_lock)
 388  * @todo:                 list of work for this process
 389  *                        (protected by @inner_lock)
 390  * @stats:                per-process binder statistics
 391  *                        (atomics, no lock needed)
 392  * @delivered_death:      list of delivered death notification
 393  *                        (protected by @inner_lock)
 394  * @delivered_freeze:     list of delivered freeze notification
 395  *                        (protected by @inner_lock)
 396  * @max_threads:          cap on number of binder threads
 397  *                        (protected by @inner_lock)
 398  * @requested_threads:    number of binder threads requested but not
 399  *                        yet started. In current implementation, can
 400  *                        only be 0 or 1.
 401  *                        (protected by @inner_lock)
 402  * @requested_threads_started: number binder threads started
 403  *                        (protected by @inner_lock)
 404  * @tmp_ref:              temporary reference to indicate proc is in use
 405  *                        (protected by @inner_lock)
 406  * @default_priority:     default scheduler priority
 407  *                        (invariant after initialized)
 408  * @debugfs_entry:        debugfs node
 409  * @alloc:                binder allocator bookkeeping
 410  * @context:              binder_context for this proc
 411  *                        (invariant after initialized)
 412  * @inner_lock:           can nest under outer_lock and/or node lock
 413  * @outer_lock:           no nesting under innor or node lock
 414  *                        Lock order: 1) outer, 2) node, 3) inner
 415  * @binderfs_entry:       process-specific binderfs log file
 416  * @oneway_spam_detection_enabled: process enabled oneway spam detection
 417  *                        or not
 418  *
 419  * Bookkeeping structure for binder processes
 420  */
 421 struct binder_proc {
 422         struct hlist_node proc_node;
 423         struct rb_root threads;
 424         struct rb_root nodes;
 425         struct rb_root refs_by_desc;
 426         struct rb_root refs_by_node;
 427         struct list_head waiting_threads;
 428         int pid;
 429         struct task_struct *tsk;
 430         const struct cred *cred;
 431         struct hlist_node deferred_work_node;
 432         int deferred_work;
 433         int outstanding_txns;
 434         bool is_dead;
 435         bool is_frozen;
 436         bool sync_recv;
 437         bool async_recv;
 438         wait_queue_head_t freeze_wait;
 439         struct dbitmap dmap;
 440         struct list_head todo;
 441         struct binder_stats stats;
 442         struct list_head delivered_death;
 443         struct list_head delivered_freeze;
 444         u32 max_threads;
 445         int requested_threads;
 446         int requested_threads_started;
 447         int tmp_ref;
 448         long default_priority;
 449         struct dentry *debugfs_entry;
 450         struct binder_alloc alloc;
 451         struct binder_context *context;
 452         spinlock_t inner_lock;
 453         spinlock_t outer_lock;
 454         struct dentry *binderfs_entry;
 455         bool oneway_spam_detection_enabled;
 456 };
 457
 458 /**
 459  * struct binder_thread - binder thread bookkeeping
 460  * @proc:                 binder process for this thread
 461  *                        (invariant after initialization)
 462  * @rb_node:              element for proc->threads rbtree
 463  *                        (protected by @proc->inner_lock)
 464  * @waiting_thread_node:  element for @proc->waiting_threads list
 465  *                        (protected by @proc->inner_lock)
 466  * @pid:                  PID for this thread
 467  *                        (invariant after initialization)
 468  * @looper:               bitmap of looping state
 469  *                        (only accessed by this thread)
 470  * @looper_needs_return:  looping thread needs to exit driver
 471  *                        (no lock needed)
 472  * @transaction_stack:    stack of in-progress transactions for this thread
 473  *                        (protected by @proc->inner_lock)
 474  * @todo:                 list of work to do for this thread
 475  *                        (protected by @proc->inner_lock)
 476  * @process_todo:         whether work in @todo should be processed
 477  *                        (protected by @proc->inner_lock)
 478  * @return_error:         transaction errors reported by this thread
 479  *                        (only accessed by this thread)
 480  * @reply_error:          transaction errors reported by target thread
 481  *                        (protected by @proc->inner_lock)
 482  * @ee:                   extended error information from this thread
 483  *                        (protected by @proc->inner_lock)
 484  * @wait:                 wait queue for thread work
 485  * @stats:                per-thread statistics
 486  *                        (atomics, no lock needed)
 487  * @tmp_ref:              temporary reference to indicate thread is in use
 488  *                        (atomic since @proc->inner_lock cannot
 489  *                        always be acquired)
 490  * @is_dead:              thread is dead and awaiting free
 491  *                        when outstanding transactions are cleaned up
 492  *                        (protected by @proc->inner_lock)
 493  *
 494  * Bookkeeping structure for binder threads.
 495  */
 496 struct binder_thread {
 497         struct binder_proc *proc;
 498         struct rb_node rb_node;
 499         struct list_head waiting_thread_node;
 500         int pid;
 501         int looper;              /* only modified by this thread */
 502         bool looper_need_return; /* can be written by other thread */
 503         struct binder_transaction *transaction_stack;
 504         struct list_head todo;
 505         bool process_todo;
 506         struct binder_error return_error;
 507         struct binder_error reply_error;
 508         struct binder_extended_error ee;
 509         wait_queue_head_t wait;
 510         struct binder_stats stats;
 511         atomic_t tmp_ref;
 512         bool is_dead;
 513 };
 514
 515 /**
 516  * struct binder_txn_fd_fixup - transaction fd fixup list element
 517  * @fixup_entry:          list entry
 518  * @file:                 struct file to be associated with new fd
 519  * @offset:               offset in buffer data to this fixup
 520  * @target_fd:            fd to use by the target to install @file
 521  *
 522  * List element for fd fixups in a transaction. Since file
 523  * descriptors need to be allocated in the context of the
 524  * target process, we pass each fd to be processed in this
 525  * struct.
 526  */
 527 struct binder_txn_fd_fixup {
 528         struct list_head fixup_entry;
 529         struct file *file;
 530         size_t offset;
 531         int target_fd;
 532 };
 533
 534 struct binder_transaction {
 535         int debug_id;
 536         struct binder_work work;
 537         struct binder_thread *from;
 538         pid_t from_pid;
 539         pid_t from_tid;
 540         struct binder_transaction *from_parent;
 541         struct binder_proc *to_proc;
 542         struct binder_thread *to_thread;
 543         struct binder_transaction *to_parent;
 544         unsigned need_reply:1;
 545         /* unsigned is_dead:1; */       /* not used at the moment */
 546
 547         struct binder_buffer *buffer;
 548         unsigned int    code;
 549         unsigned int    flags;
 550         long    priority;
 551         long    saved_priority;
 552         kuid_t  sender_euid;
 553         ktime_t start_time;
 554         struct list_head fd_fixups;
 555         binder_uintptr_t security_ctx;
 556         /**
 557          * @lock:  protects @from, @to_proc, and @to_thread
 558          *
 559          * @from, @to_proc, and @to_thread can be set to NULL
 560          * during thread teardown
 561          */
 562         spinlock_t lock;
 563 };
 564
 565 /**
 566  * struct binder_object - union of flat binder object types
 567  * @hdr:   generic object header
 568  * @fbo:   binder object (nodes and refs)
 569  * @fdo:   file descriptor object
 570  * @bbo:   binder buffer pointer
 571  * @fdao:  file descriptor array
 572  *
 573  * Used for type-independent object copies
 574  */
 575 struct binder_object {
 576         union {
 577                 struct binder_object_header hdr;
 578                 struct flat_binder_object fbo;
 579                 struct binder_fd_object fdo;
 580                 struct binder_buffer_object bbo;
 581                 struct binder_fd_array_object fdao;
 582         };
 583 };
 584
 585 #endif /* _LINUX_BINDER_INTERNAL_H */