Loading...
1/* SPDX-License-Identifier: GPL-2.0 */
2
3#ifndef _LINUX_BINDER_INTERNAL_H
4#define _LINUX_BINDER_INTERNAL_H
5
6#include <linux/export.h>
7#include <linux/fs.h>
8#include <linux/list.h>
9#include <linux/miscdevice.h>
10#include <linux/mutex.h>
11#include <linux/refcount.h>
12#include <linux/stddef.h>
13#include <linux/types.h>
14#include <linux/uidgid.h>
15#include <uapi/linux/android/binderfs.h>
16#include "binder_alloc.h"
17
18struct binder_context {
19 struct binder_node *binder_context_mgr_node;
20 struct mutex context_mgr_node_lock;
21 kuid_t binder_context_mgr_uid;
22 const char *name;
23};
24
25/**
26 * struct binder_device - information about a binder device node
27 * @hlist: list of binder devices (only used for devices requested via
28 * CONFIG_ANDROID_BINDER_DEVICES)
29 * @miscdev: information about a binder character device node
30 * @context: binder context information
31 * @binderfs_inode: This is the inode of the root dentry of the super block
32 * belonging to a binderfs mount.
33 */
34struct binder_device {
35 struct hlist_node hlist;
36 struct miscdevice miscdev;
37 struct binder_context context;
38 struct inode *binderfs_inode;
39 refcount_t ref;
40};
41
42/**
43 * binderfs_mount_opts - mount options for binderfs
44 * @max: maximum number of allocatable binderfs binder devices
45 * @stats_mode: enable binder stats in binderfs.
46 */
47struct binderfs_mount_opts {
48 int max;
49 int stats_mode;
50};
51
52/**
53 * binderfs_info - information about a binderfs mount
54 * @ipc_ns: The ipc namespace the binderfs mount belongs to.
55 * @control_dentry: This records the dentry of this binderfs mount
56 * binder-control device.
57 * @root_uid: uid that needs to be used when a new binder device is
58 * created.
59 * @root_gid: gid that needs to be used when a new binder device is
60 * created.
61 * @mount_opts: The mount options in use.
62 * @device_count: The current number of allocated binder devices.
63 * @proc_log_dir: Pointer to the directory dentry containing process-specific
64 * logs.
65 */
66struct binderfs_info {
67 struct ipc_namespace *ipc_ns;
68 struct dentry *control_dentry;
69 kuid_t root_uid;
70 kgid_t root_gid;
71 struct binderfs_mount_opts mount_opts;
72 int device_count;
73 struct dentry *proc_log_dir;
74};
75
76extern const struct file_operations binder_fops;
77
78extern char *binder_devices_param;
79
80#ifdef CONFIG_ANDROID_BINDERFS
81extern bool is_binderfs_device(const struct inode *inode);
82extern struct dentry *binderfs_create_file(struct dentry *dir, const char *name,
83 const struct file_operations *fops,
84 void *data);
85extern void binderfs_remove_file(struct dentry *dentry);
86#else
87static inline bool is_binderfs_device(const struct inode *inode)
88{
89 return false;
90}
91static inline struct dentry *binderfs_create_file(struct dentry *dir,
92 const char *name,
93 const struct file_operations *fops,
94 void *data)
95{
96 return NULL;
97}
98static inline void binderfs_remove_file(struct dentry *dentry) {}
99#endif
100
101#ifdef CONFIG_ANDROID_BINDERFS
102extern int __init init_binderfs(void);
103#else
104static inline int __init init_binderfs(void)
105{
106 return 0;
107}
108#endif
109
110struct binder_debugfs_entry {
111 const char *name;
112 umode_t mode;
113 const struct file_operations *fops;
114 void *data;
115};
116
117extern const struct binder_debugfs_entry binder_debugfs_entries[];
118
119#define binder_for_each_debugfs_entry(entry) \
120 for ((entry) = binder_debugfs_entries; \
121 (entry)->name; \
122 (entry)++)
123
124enum binder_stat_types {
125 BINDER_STAT_PROC,
126 BINDER_STAT_THREAD,
127 BINDER_STAT_NODE,
128 BINDER_STAT_REF,
129 BINDER_STAT_DEATH,
130 BINDER_STAT_TRANSACTION,
131 BINDER_STAT_TRANSACTION_COMPLETE,
132 BINDER_STAT_COUNT
133};
134
135struct binder_stats {
136 atomic_t br[_IOC_NR(BR_ONEWAY_SPAM_SUSPECT) + 1];
137 atomic_t bc[_IOC_NR(BC_REPLY_SG) + 1];
138 atomic_t obj_created[BINDER_STAT_COUNT];
139 atomic_t obj_deleted[BINDER_STAT_COUNT];
140};
141
142/**
143 * struct binder_work - work enqueued on a worklist
144 * @entry: node enqueued on list
145 * @type: type of work to be performed
146 *
147 * There are separate work lists for proc, thread, and node (async).
148 */
149struct binder_work {
150 struct list_head entry;
151
152 enum binder_work_type {
153 BINDER_WORK_TRANSACTION = 1,
154 BINDER_WORK_TRANSACTION_COMPLETE,
155 BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT,
156 BINDER_WORK_RETURN_ERROR,
157 BINDER_WORK_NODE,
158 BINDER_WORK_DEAD_BINDER,
159 BINDER_WORK_DEAD_BINDER_AND_CLEAR,
160 BINDER_WORK_CLEAR_DEATH_NOTIFICATION,
161 } type;
162};
163
164struct binder_error {
165 struct binder_work work;
166 uint32_t cmd;
167};
168
169/**
170 * struct binder_node - binder node bookkeeping
171 * @debug_id: unique ID for debugging
172 * (invariant after initialized)
173 * @lock: lock for node fields
174 * @work: worklist element for node work
175 * (protected by @proc->inner_lock)
176 * @rb_node: element for proc->nodes tree
177 * (protected by @proc->inner_lock)
178 * @dead_node: element for binder_dead_nodes list
179 * (protected by binder_dead_nodes_lock)
180 * @proc: binder_proc that owns this node
181 * (invariant after initialized)
182 * @refs: list of references on this node
183 * (protected by @lock)
184 * @internal_strong_refs: used to take strong references when
185 * initiating a transaction
186 * (protected by @proc->inner_lock if @proc
187 * and by @lock)
188 * @local_weak_refs: weak user refs from local process
189 * (protected by @proc->inner_lock if @proc
190 * and by @lock)
191 * @local_strong_refs: strong user refs from local process
192 * (protected by @proc->inner_lock if @proc
193 * and by @lock)
194 * @tmp_refs: temporary kernel refs
195 * (protected by @proc->inner_lock while @proc
196 * is valid, and by binder_dead_nodes_lock
197 * if @proc is NULL. During inc/dec and node release
198 * it is also protected by @lock to provide safety
199 * as the node dies and @proc becomes NULL)
200 * @ptr: userspace pointer for node
201 * (invariant, no lock needed)
202 * @cookie: userspace cookie for node
203 * (invariant, no lock needed)
204 * @has_strong_ref: userspace notified of strong ref
205 * (protected by @proc->inner_lock if @proc
206 * and by @lock)
207 * @pending_strong_ref: userspace has acked notification of strong ref
208 * (protected by @proc->inner_lock if @proc
209 * and by @lock)
210 * @has_weak_ref: userspace notified of weak ref
211 * (protected by @proc->inner_lock if @proc
212 * and by @lock)
213 * @pending_weak_ref: userspace has acked notification of weak ref
214 * (protected by @proc->inner_lock if @proc
215 * and by @lock)
216 * @has_async_transaction: async transaction to node in progress
217 * (protected by @lock)
218 * @accept_fds: file descriptor operations supported for node
219 * (invariant after initialized)
220 * @min_priority: minimum scheduling priority
221 * (invariant after initialized)
222 * @txn_security_ctx: require sender's security context
223 * (invariant after initialized)
224 * @async_todo: list of async work items
225 * (protected by @proc->inner_lock)
226 *
227 * Bookkeeping structure for binder nodes.
228 */
229struct binder_node {
230 int debug_id;
231 spinlock_t lock;
232 struct binder_work work;
233 union {
234 struct rb_node rb_node;
235 struct hlist_node dead_node;
236 };
237 struct binder_proc *proc;
238 struct hlist_head refs;
239 int internal_strong_refs;
240 int local_weak_refs;
241 int local_strong_refs;
242 int tmp_refs;
243 binder_uintptr_t ptr;
244 binder_uintptr_t cookie;
245 struct {
246 /*
247 * bitfield elements protected by
248 * proc inner_lock
249 */
250 u8 has_strong_ref:1;
251 u8 pending_strong_ref:1;
252 u8 has_weak_ref:1;
253 u8 pending_weak_ref:1;
254 };
255 struct {
256 /*
257 * invariant after initialization
258 */
259 u8 accept_fds:1;
260 u8 txn_security_ctx:1;
261 u8 min_priority;
262 };
263 bool has_async_transaction;
264 struct list_head async_todo;
265};
266
267struct binder_ref_death {
268 /**
269 * @work: worklist element for death notifications
270 * (protected by inner_lock of the proc that
271 * this ref belongs to)
272 */
273 struct binder_work work;
274 binder_uintptr_t cookie;
275};
276
277/**
278 * struct binder_ref_data - binder_ref counts and id
279 * @debug_id: unique ID for the ref
280 * @desc: unique userspace handle for ref
281 * @strong: strong ref count (debugging only if not locked)
282 * @weak: weak ref count (debugging only if not locked)
283 *
284 * Structure to hold ref count and ref id information. Since
285 * the actual ref can only be accessed with a lock, this structure
286 * is used to return information about the ref to callers of
287 * ref inc/dec functions.
288 */
289struct binder_ref_data {
290 int debug_id;
291 uint32_t desc;
292 int strong;
293 int weak;
294};
295
296/**
297 * struct binder_ref - struct to track references on nodes
298 * @data: binder_ref_data containing id, handle, and current refcounts
299 * @rb_node_desc: node for lookup by @data.desc in proc's rb_tree
300 * @rb_node_node: node for lookup by @node in proc's rb_tree
301 * @node_entry: list entry for node->refs list in target node
302 * (protected by @node->lock)
303 * @proc: binder_proc containing ref
304 * @node: binder_node of target node. When cleaning up a
305 * ref for deletion in binder_cleanup_ref, a non-NULL
306 * @node indicates the node must be freed
307 * @death: pointer to death notification (ref_death) if requested
308 * (protected by @node->lock)
309 *
310 * Structure to track references from procA to target node (on procB). This
311 * structure is unsafe to access without holding @proc->outer_lock.
312 */
313struct binder_ref {
314 /* Lookups needed: */
315 /* node + proc => ref (transaction) */
316 /* desc + proc => ref (transaction, inc/dec ref) */
317 /* node => refs + procs (proc exit) */
318 struct binder_ref_data data;
319 struct rb_node rb_node_desc;
320 struct rb_node rb_node_node;
321 struct hlist_node node_entry;
322 struct binder_proc *proc;
323 struct binder_node *node;
324 struct binder_ref_death *death;
325};
326
327/**
328 * struct binder_proc - binder process bookkeeping
329 * @proc_node: element for binder_procs list
330 * @threads: rbtree of binder_threads in this proc
331 * (protected by @inner_lock)
332 * @nodes: rbtree of binder nodes associated with
333 * this proc ordered by node->ptr
334 * (protected by @inner_lock)
335 * @refs_by_desc: rbtree of refs ordered by ref->desc
336 * (protected by @outer_lock)
337 * @refs_by_node: rbtree of refs ordered by ref->node
338 * (protected by @outer_lock)
339 * @waiting_threads: threads currently waiting for proc work
340 * (protected by @inner_lock)
341 * @pid PID of group_leader of process
342 * (invariant after initialized)
343 * @tsk task_struct for group_leader of process
344 * (invariant after initialized)
345 * @cred struct cred associated with the `struct file`
346 * in binder_open()
347 * (invariant after initialized)
348 * @deferred_work_node: element for binder_deferred_list
349 * (protected by binder_deferred_lock)
350 * @deferred_work: bitmap of deferred work to perform
351 * (protected by binder_deferred_lock)
352 * @outstanding_txns: number of transactions to be transmitted before
353 * processes in freeze_wait are woken up
354 * (protected by @inner_lock)
355 * @is_dead: process is dead and awaiting free
356 * when outstanding transactions are cleaned up
357 * (protected by @inner_lock)
358 * @is_frozen: process is frozen and unable to service
359 * binder transactions
360 * (protected by @inner_lock)
361 * @sync_recv: process received sync transactions since last frozen
362 * bit 0: received sync transaction after being frozen
363 * bit 1: new pending sync transaction during freezing
364 * (protected by @inner_lock)
365 * @async_recv: process received async transactions since last frozen
366 * (protected by @inner_lock)
367 * @freeze_wait: waitqueue of processes waiting for all outstanding
368 * transactions to be processed
369 * (protected by @inner_lock)
370 * @todo: list of work for this process
371 * (protected by @inner_lock)
372 * @stats: per-process binder statistics
373 * (atomics, no lock needed)
374 * @delivered_death: list of delivered death notification
375 * (protected by @inner_lock)
376 * @max_threads: cap on number of binder threads
377 * (protected by @inner_lock)
378 * @requested_threads: number of binder threads requested but not
379 * yet started. In current implementation, can
380 * only be 0 or 1.
381 * (protected by @inner_lock)
382 * @requested_threads_started: number binder threads started
383 * (protected by @inner_lock)
384 * @tmp_ref: temporary reference to indicate proc is in use
385 * (protected by @inner_lock)
386 * @default_priority: default scheduler priority
387 * (invariant after initialized)
388 * @debugfs_entry: debugfs node
389 * @alloc: binder allocator bookkeeping
390 * @context: binder_context for this proc
391 * (invariant after initialized)
392 * @inner_lock: can nest under outer_lock and/or node lock
393 * @outer_lock: no nesting under innor or node lock
394 * Lock order: 1) outer, 2) node, 3) inner
395 * @binderfs_entry: process-specific binderfs log file
396 * @oneway_spam_detection_enabled: process enabled oneway spam detection
397 * or not
398 *
399 * Bookkeeping structure for binder processes
400 */
401struct binder_proc {
402 struct hlist_node proc_node;
403 struct rb_root threads;
404 struct rb_root nodes;
405 struct rb_root refs_by_desc;
406 struct rb_root refs_by_node;
407 struct list_head waiting_threads;
408 int pid;
409 struct task_struct *tsk;
410 const struct cred *cred;
411 struct hlist_node deferred_work_node;
412 int deferred_work;
413 int outstanding_txns;
414 bool is_dead;
415 bool is_frozen;
416 bool sync_recv;
417 bool async_recv;
418 wait_queue_head_t freeze_wait;
419
420 struct list_head todo;
421 struct binder_stats stats;
422 struct list_head delivered_death;
423 int max_threads;
424 int requested_threads;
425 int requested_threads_started;
426 int tmp_ref;
427 long default_priority;
428 struct dentry *debugfs_entry;
429 struct binder_alloc alloc;
430 struct binder_context *context;
431 spinlock_t inner_lock;
432 spinlock_t outer_lock;
433 struct dentry *binderfs_entry;
434 bool oneway_spam_detection_enabled;
435};
436
437/**
438 * struct binder_thread - binder thread bookkeeping
439 * @proc: binder process for this thread
440 * (invariant after initialization)
441 * @rb_node: element for proc->threads rbtree
442 * (protected by @proc->inner_lock)
443 * @waiting_thread_node: element for @proc->waiting_threads list
444 * (protected by @proc->inner_lock)
445 * @pid: PID for this thread
446 * (invariant after initialization)
447 * @looper: bitmap of looping state
448 * (only accessed by this thread)
449 * @looper_needs_return: looping thread needs to exit driver
450 * (no lock needed)
451 * @transaction_stack: stack of in-progress transactions for this thread
452 * (protected by @proc->inner_lock)
453 * @todo: list of work to do for this thread
454 * (protected by @proc->inner_lock)
455 * @process_todo: whether work in @todo should be processed
456 * (protected by @proc->inner_lock)
457 * @return_error: transaction errors reported by this thread
458 * (only accessed by this thread)
459 * @reply_error: transaction errors reported by target thread
460 * (protected by @proc->inner_lock)
461 * @ee: extended error information from this thread
462 * (protected by @proc->inner_lock)
463 * @wait: wait queue for thread work
464 * @stats: per-thread statistics
465 * (atomics, no lock needed)
466 * @tmp_ref: temporary reference to indicate thread is in use
467 * (atomic since @proc->inner_lock cannot
468 * always be acquired)
469 * @is_dead: thread is dead and awaiting free
470 * when outstanding transactions are cleaned up
471 * (protected by @proc->inner_lock)
472 *
473 * Bookkeeping structure for binder threads.
474 */
475struct binder_thread {
476 struct binder_proc *proc;
477 struct rb_node rb_node;
478 struct list_head waiting_thread_node;
479 int pid;
480 int looper; /* only modified by this thread */
481 bool looper_need_return; /* can be written by other thread */
482 struct binder_transaction *transaction_stack;
483 struct list_head todo;
484 bool process_todo;
485 struct binder_error return_error;
486 struct binder_error reply_error;
487 struct binder_extended_error ee;
488 wait_queue_head_t wait;
489 struct binder_stats stats;
490 atomic_t tmp_ref;
491 bool is_dead;
492};
493
494/**
495 * struct binder_txn_fd_fixup - transaction fd fixup list element
496 * @fixup_entry: list entry
497 * @file: struct file to be associated with new fd
498 * @offset: offset in buffer data to this fixup
499 * @target_fd: fd to use by the target to install @file
500 *
501 * List element for fd fixups in a transaction. Since file
502 * descriptors need to be allocated in the context of the
503 * target process, we pass each fd to be processed in this
504 * struct.
505 */
506struct binder_txn_fd_fixup {
507 struct list_head fixup_entry;
508 struct file *file;
509 size_t offset;
510 int target_fd;
511};
512
513struct binder_transaction {
514 int debug_id;
515 struct binder_work work;
516 struct binder_thread *from;
517 struct binder_transaction *from_parent;
518 struct binder_proc *to_proc;
519 struct binder_thread *to_thread;
520 struct binder_transaction *to_parent;
521 unsigned need_reply:1;
522 /* unsigned is_dead:1; */ /* not used at the moment */
523
524 struct binder_buffer *buffer;
525 unsigned int code;
526 unsigned int flags;
527 long priority;
528 long saved_priority;
529 kuid_t sender_euid;
530 struct list_head fd_fixups;
531 binder_uintptr_t security_ctx;
532 /**
533 * @lock: protects @from, @to_proc, and @to_thread
534 *
535 * @from, @to_proc, and @to_thread can be set to NULL
536 * during thread teardown
537 */
538 spinlock_t lock;
539};
540
541/**
542 * struct binder_object - union of flat binder object types
543 * @hdr: generic object header
544 * @fbo: binder object (nodes and refs)
545 * @fdo: file descriptor object
546 * @bbo: binder buffer pointer
547 * @fdao: file descriptor array
548 *
549 * Used for type-independent object copies
550 */
551struct binder_object {
552 union {
553 struct binder_object_header hdr;
554 struct flat_binder_object fbo;
555 struct binder_fd_object fdo;
556 struct binder_buffer_object bbo;
557 struct binder_fd_array_object fdao;
558 };
559};
560
561#endif /* _LINUX_BINDER_INTERNAL_H */
1/* SPDX-License-Identifier: GPL-2.0 */
2
3#ifndef _LINUX_BINDER_INTERNAL_H
4#define _LINUX_BINDER_INTERNAL_H
5
6#include <linux/export.h>
7#include <linux/fs.h>
8#include <linux/list.h>
9#include <linux/miscdevice.h>
10#include <linux/mutex.h>
11#include <linux/refcount.h>
12#include <linux/stddef.h>
13#include <linux/types.h>
14#include <linux/uidgid.h>
15#include <uapi/linux/android/binderfs.h>
16#include "binder_alloc.h"
17#include "dbitmap.h"
18
19struct binder_context {
20 struct binder_node *binder_context_mgr_node;
21 struct mutex context_mgr_node_lock;
22 kuid_t binder_context_mgr_uid;
23 const char *name;
24};
25
26/**
27 * struct binder_device - information about a binder device node
28 * @hlist: list of binder devices (only used for devices requested via
29 * CONFIG_ANDROID_BINDER_DEVICES)
30 * @miscdev: information about a binder character device node
31 * @context: binder context information
32 * @binderfs_inode: This is the inode of the root dentry of the super block
33 * belonging to a binderfs mount.
34 */
35struct binder_device {
36 struct hlist_node hlist;
37 struct miscdevice miscdev;
38 struct binder_context context;
39 struct inode *binderfs_inode;
40 refcount_t ref;
41};
42
43/**
44 * binderfs_mount_opts - mount options for binderfs
45 * @max: maximum number of allocatable binderfs binder devices
46 * @stats_mode: enable binder stats in binderfs.
47 */
48struct binderfs_mount_opts {
49 int max;
50 int stats_mode;
51};
52
53/**
54 * binderfs_info - information about a binderfs mount
55 * @ipc_ns: The ipc namespace the binderfs mount belongs to.
56 * @control_dentry: This records the dentry of this binderfs mount
57 * binder-control device.
58 * @root_uid: uid that needs to be used when a new binder device is
59 * created.
60 * @root_gid: gid that needs to be used when a new binder device is
61 * created.
62 * @mount_opts: The mount options in use.
63 * @device_count: The current number of allocated binder devices.
64 * @proc_log_dir: Pointer to the directory dentry containing process-specific
65 * logs.
66 */
67struct binderfs_info {
68 struct ipc_namespace *ipc_ns;
69 struct dentry *control_dentry;
70 kuid_t root_uid;
71 kgid_t root_gid;
72 struct binderfs_mount_opts mount_opts;
73 int device_count;
74 struct dentry *proc_log_dir;
75};
76
77extern const struct file_operations binder_fops;
78
79extern char *binder_devices_param;
80
81#ifdef CONFIG_ANDROID_BINDERFS
82extern bool is_binderfs_device(const struct inode *inode);
83extern struct dentry *binderfs_create_file(struct dentry *dir, const char *name,
84 const struct file_operations *fops,
85 void *data);
86extern void binderfs_remove_file(struct dentry *dentry);
87#else
88static inline bool is_binderfs_device(const struct inode *inode)
89{
90 return false;
91}
92static inline struct dentry *binderfs_create_file(struct dentry *dir,
93 const char *name,
94 const struct file_operations *fops,
95 void *data)
96{
97 return NULL;
98}
99static inline void binderfs_remove_file(struct dentry *dentry) {}
100#endif
101
102#ifdef CONFIG_ANDROID_BINDERFS
103extern int __init init_binderfs(void);
104#else
105static inline int __init init_binderfs(void)
106{
107 return 0;
108}
109#endif
110
111struct binder_debugfs_entry {
112 const char *name;
113 umode_t mode;
114 const struct file_operations *fops;
115 void *data;
116};
117
118extern const struct binder_debugfs_entry binder_debugfs_entries[];
119
120#define binder_for_each_debugfs_entry(entry) \
121 for ((entry) = binder_debugfs_entries; \
122 (entry)->name; \
123 (entry)++)
124
125enum binder_stat_types {
126 BINDER_STAT_PROC,
127 BINDER_STAT_THREAD,
128 BINDER_STAT_NODE,
129 BINDER_STAT_REF,
130 BINDER_STAT_DEATH,
131 BINDER_STAT_TRANSACTION,
132 BINDER_STAT_TRANSACTION_COMPLETE,
133 BINDER_STAT_FREEZE,
134 BINDER_STAT_COUNT
135};
136
137struct binder_stats {
138 atomic_t br[_IOC_NR(BR_CLEAR_FREEZE_NOTIFICATION_DONE) + 1];
139 atomic_t bc[_IOC_NR(BC_FREEZE_NOTIFICATION_DONE) + 1];
140 atomic_t obj_created[BINDER_STAT_COUNT];
141 atomic_t obj_deleted[BINDER_STAT_COUNT];
142};
143
144/**
145 * struct binder_work - work enqueued on a worklist
146 * @entry: node enqueued on list
147 * @type: type of work to be performed
148 *
149 * There are separate work lists for proc, thread, and node (async).
150 */
151struct binder_work {
152 struct list_head entry;
153
154 enum binder_work_type {
155 BINDER_WORK_TRANSACTION = 1,
156 BINDER_WORK_TRANSACTION_COMPLETE,
157 BINDER_WORK_TRANSACTION_PENDING,
158 BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT,
159 BINDER_WORK_RETURN_ERROR,
160 BINDER_WORK_NODE,
161 BINDER_WORK_DEAD_BINDER,
162 BINDER_WORK_DEAD_BINDER_AND_CLEAR,
163 BINDER_WORK_CLEAR_DEATH_NOTIFICATION,
164 BINDER_WORK_FROZEN_BINDER,
165 BINDER_WORK_CLEAR_FREEZE_NOTIFICATION,
166 } type;
167};
168
169struct binder_error {
170 struct binder_work work;
171 uint32_t cmd;
172};
173
174/**
175 * struct binder_node - binder node bookkeeping
176 * @debug_id: unique ID for debugging
177 * (invariant after initialized)
178 * @lock: lock for node fields
179 * @work: worklist element for node work
180 * (protected by @proc->inner_lock)
181 * @rb_node: element for proc->nodes tree
182 * (protected by @proc->inner_lock)
183 * @dead_node: element for binder_dead_nodes list
184 * (protected by binder_dead_nodes_lock)
185 * @proc: binder_proc that owns this node
186 * (invariant after initialized)
187 * @refs: list of references on this node
188 * (protected by @lock)
189 * @internal_strong_refs: used to take strong references when
190 * initiating a transaction
191 * (protected by @proc->inner_lock if @proc
192 * and by @lock)
193 * @local_weak_refs: weak user refs from local process
194 * (protected by @proc->inner_lock if @proc
195 * and by @lock)
196 * @local_strong_refs: strong user refs from local process
197 * (protected by @proc->inner_lock if @proc
198 * and by @lock)
199 * @tmp_refs: temporary kernel refs
200 * (protected by @proc->inner_lock while @proc
201 * is valid, and by binder_dead_nodes_lock
202 * if @proc is NULL. During inc/dec and node release
203 * it is also protected by @lock to provide safety
204 * as the node dies and @proc becomes NULL)
205 * @ptr: userspace pointer for node
206 * (invariant, no lock needed)
207 * @cookie: userspace cookie for node
208 * (invariant, no lock needed)
209 * @has_strong_ref: userspace notified of strong ref
210 * (protected by @proc->inner_lock if @proc
211 * and by @lock)
212 * @pending_strong_ref: userspace has acked notification of strong ref
213 * (protected by @proc->inner_lock if @proc
214 * and by @lock)
215 * @has_weak_ref: userspace notified of weak ref
216 * (protected by @proc->inner_lock if @proc
217 * and by @lock)
218 * @pending_weak_ref: userspace has acked notification of weak ref
219 * (protected by @proc->inner_lock if @proc
220 * and by @lock)
221 * @has_async_transaction: async transaction to node in progress
222 * (protected by @lock)
223 * @accept_fds: file descriptor operations supported for node
224 * (invariant after initialized)
225 * @min_priority: minimum scheduling priority
226 * (invariant after initialized)
227 * @txn_security_ctx: require sender's security context
228 * (invariant after initialized)
229 * @async_todo: list of async work items
230 * (protected by @proc->inner_lock)
231 *
232 * Bookkeeping structure for binder nodes.
233 */
234struct binder_node {
235 int debug_id;
236 spinlock_t lock;
237 struct binder_work work;
238 union {
239 struct rb_node rb_node;
240 struct hlist_node dead_node;
241 };
242 struct binder_proc *proc;
243 struct hlist_head refs;
244 int internal_strong_refs;
245 int local_weak_refs;
246 int local_strong_refs;
247 int tmp_refs;
248 binder_uintptr_t ptr;
249 binder_uintptr_t cookie;
250 struct {
251 /*
252 * bitfield elements protected by
253 * proc inner_lock
254 */
255 u8 has_strong_ref:1;
256 u8 pending_strong_ref:1;
257 u8 has_weak_ref:1;
258 u8 pending_weak_ref:1;
259 };
260 struct {
261 /*
262 * invariant after initialization
263 */
264 u8 accept_fds:1;
265 u8 txn_security_ctx:1;
266 u8 min_priority;
267 };
268 bool has_async_transaction;
269 struct list_head async_todo;
270};
271
272struct binder_ref_death {
273 /**
274 * @work: worklist element for death notifications
275 * (protected by inner_lock of the proc that
276 * this ref belongs to)
277 */
278 struct binder_work work;
279 binder_uintptr_t cookie;
280};
281
282struct binder_ref_freeze {
283 struct binder_work work;
284 binder_uintptr_t cookie;
285 bool is_frozen:1;
286 bool sent:1;
287 bool resend:1;
288};
289
290/**
291 * struct binder_ref_data - binder_ref counts and id
292 * @debug_id: unique ID for the ref
293 * @desc: unique userspace handle for ref
294 * @strong: strong ref count (debugging only if not locked)
295 * @weak: weak ref count (debugging only if not locked)
296 *
297 * Structure to hold ref count and ref id information. Since
298 * the actual ref can only be accessed with a lock, this structure
299 * is used to return information about the ref to callers of
300 * ref inc/dec functions.
301 */
302struct binder_ref_data {
303 int debug_id;
304 uint32_t desc;
305 int strong;
306 int weak;
307};
308
309/**
310 * struct binder_ref - struct to track references on nodes
311 * @data: binder_ref_data containing id, handle, and current refcounts
312 * @rb_node_desc: node for lookup by @data.desc in proc's rb_tree
313 * @rb_node_node: node for lookup by @node in proc's rb_tree
314 * @node_entry: list entry for node->refs list in target node
315 * (protected by @node->lock)
316 * @proc: binder_proc containing ref
317 * @node: binder_node of target node. When cleaning up a
318 * ref for deletion in binder_cleanup_ref, a non-NULL
319 * @node indicates the node must be freed
320 * @death: pointer to death notification (ref_death) if requested
321 * (protected by @node->lock)
322 * @freeze: pointer to freeze notification (ref_freeze) if requested
323 * (protected by @node->lock)
324 *
325 * Structure to track references from procA to target node (on procB). This
326 * structure is unsafe to access without holding @proc->outer_lock.
327 */
328struct binder_ref {
329 /* Lookups needed: */
330 /* node + proc => ref (transaction) */
331 /* desc + proc => ref (transaction, inc/dec ref) */
332 /* node => refs + procs (proc exit) */
333 struct binder_ref_data data;
334 struct rb_node rb_node_desc;
335 struct rb_node rb_node_node;
336 struct hlist_node node_entry;
337 struct binder_proc *proc;
338 struct binder_node *node;
339 struct binder_ref_death *death;
340 struct binder_ref_freeze *freeze;
341};
342
343/**
344 * struct binder_proc - binder process bookkeeping
345 * @proc_node: element for binder_procs list
346 * @threads: rbtree of binder_threads in this proc
347 * (protected by @inner_lock)
348 * @nodes: rbtree of binder nodes associated with
349 * this proc ordered by node->ptr
350 * (protected by @inner_lock)
351 * @refs_by_desc: rbtree of refs ordered by ref->desc
352 * (protected by @outer_lock)
353 * @refs_by_node: rbtree of refs ordered by ref->node
354 * (protected by @outer_lock)
355 * @waiting_threads: threads currently waiting for proc work
356 * (protected by @inner_lock)
357 * @pid PID of group_leader of process
358 * (invariant after initialized)
359 * @tsk task_struct for group_leader of process
360 * (invariant after initialized)
361 * @cred struct cred associated with the `struct file`
362 * in binder_open()
363 * (invariant after initialized)
364 * @deferred_work_node: element for binder_deferred_list
365 * (protected by binder_deferred_lock)
366 * @deferred_work: bitmap of deferred work to perform
367 * (protected by binder_deferred_lock)
368 * @outstanding_txns: number of transactions to be transmitted before
369 * processes in freeze_wait are woken up
370 * (protected by @inner_lock)
371 * @is_dead: process is dead and awaiting free
372 * when outstanding transactions are cleaned up
373 * (protected by @inner_lock)
374 * @is_frozen: process is frozen and unable to service
375 * binder transactions
376 * (protected by @inner_lock)
377 * @sync_recv: process received sync transactions since last frozen
378 * bit 0: received sync transaction after being frozen
379 * bit 1: new pending sync transaction during freezing
380 * (protected by @inner_lock)
381 * @async_recv: process received async transactions since last frozen
382 * (protected by @inner_lock)
383 * @freeze_wait: waitqueue of processes waiting for all outstanding
384 * transactions to be processed
385 * (protected by @inner_lock)
386 * @dmap dbitmap to manage available reference descriptors
387 * (protected by @outer_lock)
388 * @todo: list of work for this process
389 * (protected by @inner_lock)
390 * @stats: per-process binder statistics
391 * (atomics, no lock needed)
392 * @delivered_death: list of delivered death notification
393 * (protected by @inner_lock)
394 * @delivered_freeze: list of delivered freeze notification
395 * (protected by @inner_lock)
396 * @max_threads: cap on number of binder threads
397 * (protected by @inner_lock)
398 * @requested_threads: number of binder threads requested but not
399 * yet started. In current implementation, can
400 * only be 0 or 1.
401 * (protected by @inner_lock)
402 * @requested_threads_started: number binder threads started
403 * (protected by @inner_lock)
404 * @tmp_ref: temporary reference to indicate proc is in use
405 * (protected by @inner_lock)
406 * @default_priority: default scheduler priority
407 * (invariant after initialized)
408 * @debugfs_entry: debugfs node
409 * @alloc: binder allocator bookkeeping
410 * @context: binder_context for this proc
411 * (invariant after initialized)
412 * @inner_lock: can nest under outer_lock and/or node lock
413 * @outer_lock: no nesting under innor or node lock
414 * Lock order: 1) outer, 2) node, 3) inner
415 * @binderfs_entry: process-specific binderfs log file
416 * @oneway_spam_detection_enabled: process enabled oneway spam detection
417 * or not
418 *
419 * Bookkeeping structure for binder processes
420 */
421struct binder_proc {
422 struct hlist_node proc_node;
423 struct rb_root threads;
424 struct rb_root nodes;
425 struct rb_root refs_by_desc;
426 struct rb_root refs_by_node;
427 struct list_head waiting_threads;
428 int pid;
429 struct task_struct *tsk;
430 const struct cred *cred;
431 struct hlist_node deferred_work_node;
432 int deferred_work;
433 int outstanding_txns;
434 bool is_dead;
435 bool is_frozen;
436 bool sync_recv;
437 bool async_recv;
438 wait_queue_head_t freeze_wait;
439 struct dbitmap dmap;
440 struct list_head todo;
441 struct binder_stats stats;
442 struct list_head delivered_death;
443 struct list_head delivered_freeze;
444 u32 max_threads;
445 int requested_threads;
446 int requested_threads_started;
447 int tmp_ref;
448 long default_priority;
449 struct dentry *debugfs_entry;
450 struct binder_alloc alloc;
451 struct binder_context *context;
452 spinlock_t inner_lock;
453 spinlock_t outer_lock;
454 struct dentry *binderfs_entry;
455 bool oneway_spam_detection_enabled;
456};
457
458/**
459 * struct binder_thread - binder thread bookkeeping
460 * @proc: binder process for this thread
461 * (invariant after initialization)
462 * @rb_node: element for proc->threads rbtree
463 * (protected by @proc->inner_lock)
464 * @waiting_thread_node: element for @proc->waiting_threads list
465 * (protected by @proc->inner_lock)
466 * @pid: PID for this thread
467 * (invariant after initialization)
468 * @looper: bitmap of looping state
469 * (only accessed by this thread)
470 * @looper_needs_return: looping thread needs to exit driver
471 * (no lock needed)
472 * @transaction_stack: stack of in-progress transactions for this thread
473 * (protected by @proc->inner_lock)
474 * @todo: list of work to do for this thread
475 * (protected by @proc->inner_lock)
476 * @process_todo: whether work in @todo should be processed
477 * (protected by @proc->inner_lock)
478 * @return_error: transaction errors reported by this thread
479 * (only accessed by this thread)
480 * @reply_error: transaction errors reported by target thread
481 * (protected by @proc->inner_lock)
482 * @ee: extended error information from this thread
483 * (protected by @proc->inner_lock)
484 * @wait: wait queue for thread work
485 * @stats: per-thread statistics
486 * (atomics, no lock needed)
487 * @tmp_ref: temporary reference to indicate thread is in use
488 * (atomic since @proc->inner_lock cannot
489 * always be acquired)
490 * @is_dead: thread is dead and awaiting free
491 * when outstanding transactions are cleaned up
492 * (protected by @proc->inner_lock)
493 *
494 * Bookkeeping structure for binder threads.
495 */
496struct binder_thread {
497 struct binder_proc *proc;
498 struct rb_node rb_node;
499 struct list_head waiting_thread_node;
500 int pid;
501 int looper; /* only modified by this thread */
502 bool looper_need_return; /* can be written by other thread */
503 struct binder_transaction *transaction_stack;
504 struct list_head todo;
505 bool process_todo;
506 struct binder_error return_error;
507 struct binder_error reply_error;
508 struct binder_extended_error ee;
509 wait_queue_head_t wait;
510 struct binder_stats stats;
511 atomic_t tmp_ref;
512 bool is_dead;
513};
514
515/**
516 * struct binder_txn_fd_fixup - transaction fd fixup list element
517 * @fixup_entry: list entry
518 * @file: struct file to be associated with new fd
519 * @offset: offset in buffer data to this fixup
520 * @target_fd: fd to use by the target to install @file
521 *
522 * List element for fd fixups in a transaction. Since file
523 * descriptors need to be allocated in the context of the
524 * target process, we pass each fd to be processed in this
525 * struct.
526 */
527struct binder_txn_fd_fixup {
528 struct list_head fixup_entry;
529 struct file *file;
530 size_t offset;
531 int target_fd;
532};
533
534struct binder_transaction {
535 int debug_id;
536 struct binder_work work;
537 struct binder_thread *from;
538 pid_t from_pid;
539 pid_t from_tid;
540 struct binder_transaction *from_parent;
541 struct binder_proc *to_proc;
542 struct binder_thread *to_thread;
543 struct binder_transaction *to_parent;
544 unsigned need_reply:1;
545 /* unsigned is_dead:1; */ /* not used at the moment */
546
547 struct binder_buffer *buffer;
548 unsigned int code;
549 unsigned int flags;
550 long priority;
551 long saved_priority;
552 kuid_t sender_euid;
553 ktime_t start_time;
554 struct list_head fd_fixups;
555 binder_uintptr_t security_ctx;
556 /**
557 * @lock: protects @from, @to_proc, and @to_thread
558 *
559 * @from, @to_proc, and @to_thread can be set to NULL
560 * during thread teardown
561 */
562 spinlock_t lock;
563};
564
565/**
566 * struct binder_object - union of flat binder object types
567 * @hdr: generic object header
568 * @fbo: binder object (nodes and refs)
569 * @fdo: file descriptor object
570 * @bbo: binder buffer pointer
571 * @fdao: file descriptor array
572 *
573 * Used for type-independent object copies
574 */
575struct binder_object {
576 union {
577 struct binder_object_header hdr;
578 struct flat_binder_object fbo;
579 struct binder_fd_object fdo;
580 struct binder_buffer_object bbo;
581 struct binder_fd_array_object fdao;
582 };
583};
584
585#endif /* _LINUX_BINDER_INTERNAL_H */