1 /* SPDX-License-Identifier: GPL-2.0 */
2 
3 #ifndef _LINUX_BINDER_INTERNAL_H
4 #define _LINUX_BINDER_INTERNAL_H
5 
6 #include <linux/export.h>
7 #include <linux/fs.h>
8 #include <linux/list.h>
9 #include <linux/miscdevice.h>
10 #include <linux/mutex.h>
11 #include <linux/refcount.h>
12 #include <linux/stddef.h>
13 #include <linux/types.h>
14 #include <linux/uidgid.h>
15 #include <uapi/linux/android/binderfs.h>
16 #include "binder_alloc.h"
17 
18 struct binder_context {
19 	struct binder_node *binder_context_mgr_node;
20 	struct mutex context_mgr_node_lock;
21 	kuid_t binder_context_mgr_uid;
22 	const char *name;
23 };
24 
25 /**
26  * struct binder_device - information about a binder device node
27  * @hlist:          list of binder devices (only used for devices requested via
28  *                  CONFIG_ANDROID_BINDER_DEVICES)
29  * @miscdev:        information about a binder character device node
30  * @context:        binder context information
31  * @binderfs_inode: This is the inode of the root dentry of the super block
32  *                  belonging to a binderfs mount.
33  */
34 struct binder_device {
35 	struct hlist_node hlist;
36 	struct miscdevice miscdev;
37 	struct binder_context context;
38 	struct inode *binderfs_inode;
39 	refcount_t ref;
40 };
41 
42 /**
43  * binderfs_mount_opts - mount options for binderfs
44  * @max: maximum number of allocatable binderfs binder devices
45  * @stats_mode: enable binder stats in binderfs.
46  */
47 struct binderfs_mount_opts {
48 	int max;
49 	int stats_mode;
50 };
51 
52 /**
53  * binderfs_info - information about a binderfs mount
54  * @ipc_ns:         The ipc namespace the binderfs mount belongs to.
55  * @control_dentry: This records the dentry of this binderfs mount
56  *                  binder-control device.
57  * @root_uid:       uid that needs to be used when a new binder device is
58  *                  created.
59  * @root_gid:       gid that needs to be used when a new binder device is
60  *                  created.
61  * @mount_opts:     The mount options in use.
62  * @device_count:   The current number of allocated binder devices.
63  * @proc_log_dir:   Pointer to the directory dentry containing process-specific
64  *                  logs.
65  */
66 struct binderfs_info {
67 	struct ipc_namespace *ipc_ns;
68 	struct dentry *control_dentry;
69 	kuid_t root_uid;
70 	kgid_t root_gid;
71 	struct binderfs_mount_opts mount_opts;
72 	int device_count;
73 	struct dentry *proc_log_dir;
74 };
75 
76 extern const struct file_operations binder_fops;
77 
78 extern char *binder_devices_param;
79 
80 #ifdef CONFIG_ANDROID_BINDERFS
81 extern bool is_binderfs_device(const struct inode *inode);
82 extern struct dentry *binderfs_create_file(struct dentry *dir, const char *name,
83 					   const struct file_operations *fops,
84 					   void *data);
85 extern void binderfs_remove_file(struct dentry *dentry);
86 #else
87 static inline bool is_binderfs_device(const struct inode *inode)
88 {
89 	return false;
90 }
91 static inline struct dentry *binderfs_create_file(struct dentry *dir,
92 					   const char *name,
93 					   const struct file_operations *fops,
94 					   void *data)
95 {
96 	return NULL;
97 }
98 static inline void binderfs_remove_file(struct dentry *dentry) {}
99 #endif
100 
101 #ifdef CONFIG_ANDROID_BINDERFS
102 extern int __init init_binderfs(void);
103 #else
104 static inline int __init init_binderfs(void)
105 {
106 	return 0;
107 }
108 #endif
109 
110 struct binder_debugfs_entry {
111 	const char *name;
112 	umode_t mode;
113 	const struct file_operations *fops;
114 	void *data;
115 };
116 
117 extern const struct binder_debugfs_entry binder_debugfs_entries[];
118 
119 #define binder_for_each_debugfs_entry(entry)	\
120 	for ((entry) = binder_debugfs_entries;	\
121 	     (entry)->name;			\
122 	     (entry)++)
123 
124 enum binder_stat_types {
125 	BINDER_STAT_PROC,
126 	BINDER_STAT_THREAD,
127 	BINDER_STAT_NODE,
128 	BINDER_STAT_REF,
129 	BINDER_STAT_DEATH,
130 	BINDER_STAT_TRANSACTION,
131 	BINDER_STAT_TRANSACTION_COMPLETE,
132 	BINDER_STAT_COUNT
133 };
134 
135 struct binder_stats {
136 	atomic_t br[_IOC_NR(BR_TRANSACTION_PENDING_FROZEN) + 1];
137 	atomic_t bc[_IOC_NR(BC_REPLY_SG) + 1];
138 	atomic_t obj_created[BINDER_STAT_COUNT];
139 	atomic_t obj_deleted[BINDER_STAT_COUNT];
140 };
141 
142 /**
143  * struct binder_work - work enqueued on a worklist
144  * @entry:             node enqueued on list
145  * @type:              type of work to be performed
146  *
147  * There are separate work lists for proc, thread, and node (async).
148  */
149 struct binder_work {
150 	struct list_head entry;
151 
152 	enum binder_work_type {
153 		BINDER_WORK_TRANSACTION = 1,
154 		BINDER_WORK_TRANSACTION_COMPLETE,
155 		BINDER_WORK_TRANSACTION_PENDING,
156 		BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT,
157 		BINDER_WORK_RETURN_ERROR,
158 		BINDER_WORK_NODE,
159 		BINDER_WORK_DEAD_BINDER,
160 		BINDER_WORK_DEAD_BINDER_AND_CLEAR,
161 		BINDER_WORK_CLEAR_DEATH_NOTIFICATION,
162 	} type;
163 };
164 
165 struct binder_error {
166 	struct binder_work work;
167 	uint32_t cmd;
168 };
169 
170 /**
171  * struct binder_node - binder node bookkeeping
172  * @debug_id:             unique ID for debugging
173  *                        (invariant after initialized)
174  * @lock:                 lock for node fields
175  * @work:                 worklist element for node work
176  *                        (protected by @proc->inner_lock)
177  * @rb_node:              element for proc->nodes tree
178  *                        (protected by @proc->inner_lock)
179  * @dead_node:            element for binder_dead_nodes list
180  *                        (protected by binder_dead_nodes_lock)
181  * @proc:                 binder_proc that owns this node
182  *                        (invariant after initialized)
183  * @refs:                 list of references on this node
184  *                        (protected by @lock)
185  * @internal_strong_refs: used to take strong references when
186  *                        initiating a transaction
187  *                        (protected by @proc->inner_lock if @proc
188  *                        and by @lock)
189  * @local_weak_refs:      weak user refs from local process
190  *                        (protected by @proc->inner_lock if @proc
191  *                        and by @lock)
192  * @local_strong_refs:    strong user refs from local process
193  *                        (protected by @proc->inner_lock if @proc
194  *                        and by @lock)
195  * @tmp_refs:             temporary kernel refs
196  *                        (protected by @proc->inner_lock while @proc
197  *                        is valid, and by binder_dead_nodes_lock
198  *                        if @proc is NULL. During inc/dec and node release
199  *                        it is also protected by @lock to provide safety
200  *                        as the node dies and @proc becomes NULL)
201  * @ptr:                  userspace pointer for node
202  *                        (invariant, no lock needed)
203  * @cookie:               userspace cookie for node
204  *                        (invariant, no lock needed)
205  * @has_strong_ref:       userspace notified of strong ref
206  *                        (protected by @proc->inner_lock if @proc
207  *                        and by @lock)
208  * @pending_strong_ref:   userspace has acked notification of strong ref
209  *                        (protected by @proc->inner_lock if @proc
210  *                        and by @lock)
211  * @has_weak_ref:         userspace notified of weak ref
212  *                        (protected by @proc->inner_lock if @proc
213  *                        and by @lock)
214  * @pending_weak_ref:     userspace has acked notification of weak ref
215  *                        (protected by @proc->inner_lock if @proc
216  *                        and by @lock)
217  * @has_async_transaction: async transaction to node in progress
218  *                        (protected by @lock)
219  * @accept_fds:           file descriptor operations supported for node
220  *                        (invariant after initialized)
221  * @min_priority:         minimum scheduling priority
222  *                        (invariant after initialized)
223  * @txn_security_ctx:     require sender's security context
224  *                        (invariant after initialized)
225  * @async_todo:           list of async work items
226  *                        (protected by @proc->inner_lock)
227  *
228  * Bookkeeping structure for binder nodes.
229  */
230 struct binder_node {
231 	int debug_id;
232 	spinlock_t lock;
233 	struct binder_work work;
234 	union {
235 		struct rb_node rb_node;
236 		struct hlist_node dead_node;
237 	};
238 	struct binder_proc *proc;
239 	struct hlist_head refs;
240 	int internal_strong_refs;
241 	int local_weak_refs;
242 	int local_strong_refs;
243 	int tmp_refs;
244 	binder_uintptr_t ptr;
245 	binder_uintptr_t cookie;
246 	struct {
247 		/*
248 		 * bitfield elements protected by
249 		 * proc inner_lock
250 		 */
251 		u8 has_strong_ref:1;
252 		u8 pending_strong_ref:1;
253 		u8 has_weak_ref:1;
254 		u8 pending_weak_ref:1;
255 	};
256 	struct {
257 		/*
258 		 * invariant after initialization
259 		 */
260 		u8 accept_fds:1;
261 		u8 txn_security_ctx:1;
262 		u8 min_priority;
263 	};
264 	bool has_async_transaction;
265 	struct list_head async_todo;
266 };
267 
268 struct binder_ref_death {
269 	/**
270 	 * @work: worklist element for death notifications
271 	 *        (protected by inner_lock of the proc that
272 	 *        this ref belongs to)
273 	 */
274 	struct binder_work work;
275 	binder_uintptr_t cookie;
276 };
277 
278 /**
279  * struct binder_ref_data - binder_ref counts and id
280  * @debug_id:        unique ID for the ref
281  * @desc:            unique userspace handle for ref
282  * @strong:          strong ref count (debugging only if not locked)
283  * @weak:            weak ref count (debugging only if not locked)
284  *
285  * Structure to hold ref count and ref id information. Since
286  * the actual ref can only be accessed with a lock, this structure
287  * is used to return information about the ref to callers of
288  * ref inc/dec functions.
289  */
290 struct binder_ref_data {
291 	int debug_id;
292 	uint32_t desc;
293 	int strong;
294 	int weak;
295 };
296 
297 /**
298  * struct binder_ref - struct to track references on nodes
299  * @data:        binder_ref_data containing id, handle, and current refcounts
300  * @rb_node_desc: node for lookup by @data.desc in proc's rb_tree
301  * @rb_node_node: node for lookup by @node in proc's rb_tree
302  * @node_entry:  list entry for node->refs list in target node
303  *               (protected by @node->lock)
304  * @proc:        binder_proc containing ref
305  * @node:        binder_node of target node. When cleaning up a
306  *               ref for deletion in binder_cleanup_ref, a non-NULL
307  *               @node indicates the node must be freed
308  * @death:       pointer to death notification (ref_death) if requested
309  *               (protected by @node->lock)
310  *
311  * Structure to track references from procA to target node (on procB). This
312  * structure is unsafe to access without holding @proc->outer_lock.
313  */
314 struct binder_ref {
315 	/* Lookups needed: */
316 	/*   node + proc => ref (transaction) */
317 	/*   desc + proc => ref (transaction, inc/dec ref) */
318 	/*   node => refs + procs (proc exit) */
319 	struct binder_ref_data data;
320 	struct rb_node rb_node_desc;
321 	struct rb_node rb_node_node;
322 	struct hlist_node node_entry;
323 	struct binder_proc *proc;
324 	struct binder_node *node;
325 	struct binder_ref_death *death;
326 };
327 
328 /**
329  * struct binder_proc - binder process bookkeeping
330  * @proc_node:            element for binder_procs list
331  * @threads:              rbtree of binder_threads in this proc
332  *                        (protected by @inner_lock)
333  * @nodes:                rbtree of binder nodes associated with
334  *                        this proc ordered by node->ptr
335  *                        (protected by @inner_lock)
336  * @refs_by_desc:         rbtree of refs ordered by ref->desc
337  *                        (protected by @outer_lock)
338  * @refs_by_node:         rbtree of refs ordered by ref->node
339  *                        (protected by @outer_lock)
340  * @waiting_threads:      threads currently waiting for proc work
341  *                        (protected by @inner_lock)
342  * @pid                   PID of group_leader of process
343  *                        (invariant after initialized)
344  * @tsk                   task_struct for group_leader of process
345  *                        (invariant after initialized)
346  * @cred                  struct cred associated with the `struct file`
347  *                        in binder_open()
348  *                        (invariant after initialized)
349  * @deferred_work_node:   element for binder_deferred_list
350  *                        (protected by binder_deferred_lock)
351  * @deferred_work:        bitmap of deferred work to perform
352  *                        (protected by binder_deferred_lock)
353  * @outstanding_txns:     number of transactions to be transmitted before
354  *                        processes in freeze_wait are woken up
355  *                        (protected by @inner_lock)
356  * @is_dead:              process is dead and awaiting free
357  *                        when outstanding transactions are cleaned up
358  *                        (protected by @inner_lock)
359  * @is_frozen:            process is frozen and unable to service
360  *                        binder transactions
361  *                        (protected by @inner_lock)
362  * @sync_recv:            process received sync transactions since last frozen
363  *                        bit 0: received sync transaction after being frozen
364  *                        bit 1: new pending sync transaction during freezing
365  *                        (protected by @inner_lock)
366  * @async_recv:           process received async transactions since last frozen
367  *                        (protected by @inner_lock)
368  * @freeze_wait:          waitqueue of processes waiting for all outstanding
369  *                        transactions to be processed
370  *                        (protected by @inner_lock)
371  * @todo:                 list of work for this process
372  *                        (protected by @inner_lock)
373  * @stats:                per-process binder statistics
374  *                        (atomics, no lock needed)
375  * @delivered_death:      list of delivered death notification
376  *                        (protected by @inner_lock)
377  * @max_threads:          cap on number of binder threads
378  *                        (protected by @inner_lock)
379  * @requested_threads:    number of binder threads requested but not
380  *                        yet started. In current implementation, can
381  *                        only be 0 or 1.
382  *                        (protected by @inner_lock)
383  * @requested_threads_started: number binder threads started
384  *                        (protected by @inner_lock)
385  * @tmp_ref:              temporary reference to indicate proc is in use
386  *                        (protected by @inner_lock)
387  * @default_priority:     default scheduler priority
388  *                        (invariant after initialized)
389  * @debugfs_entry:        debugfs node
390  * @alloc:                binder allocator bookkeeping
391  * @context:              binder_context for this proc
392  *                        (invariant after initialized)
393  * @inner_lock:           can nest under outer_lock and/or node lock
394  * @outer_lock:           no nesting under innor or node lock
395  *                        Lock order: 1) outer, 2) node, 3) inner
396  * @binderfs_entry:       process-specific binderfs log file
397  * @oneway_spam_detection_enabled: process enabled oneway spam detection
398  *                        or not
399  *
400  * Bookkeeping structure for binder processes
401  */
402 struct binder_proc {
403 	struct hlist_node proc_node;
404 	struct rb_root threads;
405 	struct rb_root nodes;
406 	struct rb_root refs_by_desc;
407 	struct rb_root refs_by_node;
408 	struct list_head waiting_threads;
409 	int pid;
410 	struct task_struct *tsk;
411 	const struct cred *cred;
412 	struct hlist_node deferred_work_node;
413 	int deferred_work;
414 	int outstanding_txns;
415 	bool is_dead;
416 	bool is_frozen;
417 	bool sync_recv;
418 	bool async_recv;
419 	wait_queue_head_t freeze_wait;
420 
421 	struct list_head todo;
422 	struct binder_stats stats;
423 	struct list_head delivered_death;
424 	int max_threads;
425 	int requested_threads;
426 	int requested_threads_started;
427 	int tmp_ref;
428 	long default_priority;
429 	struct dentry *debugfs_entry;
430 	struct binder_alloc alloc;
431 	struct binder_context *context;
432 	spinlock_t inner_lock;
433 	spinlock_t outer_lock;
434 	struct dentry *binderfs_entry;
435 	bool oneway_spam_detection_enabled;
436 };
437 
438 /**
439  * struct binder_thread - binder thread bookkeeping
440  * @proc:                 binder process for this thread
441  *                        (invariant after initialization)
442  * @rb_node:              element for proc->threads rbtree
443  *                        (protected by @proc->inner_lock)
444  * @waiting_thread_node:  element for @proc->waiting_threads list
445  *                        (protected by @proc->inner_lock)
446  * @pid:                  PID for this thread
447  *                        (invariant after initialization)
448  * @looper:               bitmap of looping state
449  *                        (only accessed by this thread)
450  * @looper_needs_return:  looping thread needs to exit driver
451  *                        (no lock needed)
452  * @transaction_stack:    stack of in-progress transactions for this thread
453  *                        (protected by @proc->inner_lock)
454  * @todo:                 list of work to do for this thread
455  *                        (protected by @proc->inner_lock)
456  * @process_todo:         whether work in @todo should be processed
457  *                        (protected by @proc->inner_lock)
458  * @return_error:         transaction errors reported by this thread
459  *                        (only accessed by this thread)
460  * @reply_error:          transaction errors reported by target thread
461  *                        (protected by @proc->inner_lock)
462  * @ee:                   extended error information from this thread
463  *                        (protected by @proc->inner_lock)
464  * @wait:                 wait queue for thread work
465  * @stats:                per-thread statistics
466  *                        (atomics, no lock needed)
467  * @tmp_ref:              temporary reference to indicate thread is in use
468  *                        (atomic since @proc->inner_lock cannot
469  *                        always be acquired)
470  * @is_dead:              thread is dead and awaiting free
471  *                        when outstanding transactions are cleaned up
472  *                        (protected by @proc->inner_lock)
473  *
474  * Bookkeeping structure for binder threads.
475  */
476 struct binder_thread {
477 	struct binder_proc *proc;
478 	struct rb_node rb_node;
479 	struct list_head waiting_thread_node;
480 	int pid;
481 	int looper;              /* only modified by this thread */
482 	bool looper_need_return; /* can be written by other thread */
483 	struct binder_transaction *transaction_stack;
484 	struct list_head todo;
485 	bool process_todo;
486 	struct binder_error return_error;
487 	struct binder_error reply_error;
488 	struct binder_extended_error ee;
489 	wait_queue_head_t wait;
490 	struct binder_stats stats;
491 	atomic_t tmp_ref;
492 	bool is_dead;
493 };
494 
495 /**
496  * struct binder_txn_fd_fixup - transaction fd fixup list element
497  * @fixup_entry:          list entry
498  * @file:                 struct file to be associated with new fd
499  * @offset:               offset in buffer data to this fixup
500  * @target_fd:            fd to use by the target to install @file
501  *
502  * List element for fd fixups in a transaction. Since file
503  * descriptors need to be allocated in the context of the
504  * target process, we pass each fd to be processed in this
505  * struct.
506  */
507 struct binder_txn_fd_fixup {
508 	struct list_head fixup_entry;
509 	struct file *file;
510 	size_t offset;
511 	int target_fd;
512 };
513 
514 struct binder_transaction {
515 	int debug_id;
516 	struct binder_work work;
517 	struct binder_thread *from;
518 	struct binder_transaction *from_parent;
519 	struct binder_proc *to_proc;
520 	struct binder_thread *to_thread;
521 	struct binder_transaction *to_parent;
522 	unsigned need_reply:1;
523 	/* unsigned is_dead:1; */       /* not used at the moment */
524 
525 	struct binder_buffer *buffer;
526 	unsigned int    code;
527 	unsigned int    flags;
528 	long    priority;
529 	long    saved_priority;
530 	kuid_t  sender_euid;
531 	struct list_head fd_fixups;
532 	binder_uintptr_t security_ctx;
533 	/**
534 	 * @lock:  protects @from, @to_proc, and @to_thread
535 	 *
536 	 * @from, @to_proc, and @to_thread can be set to NULL
537 	 * during thread teardown
538 	 */
539 	spinlock_t lock;
540 };
541 
542 /**
543  * struct binder_object - union of flat binder object types
544  * @hdr:   generic object header
545  * @fbo:   binder object (nodes and refs)
546  * @fdo:   file descriptor object
547  * @bbo:   binder buffer pointer
548  * @fdao:  file descriptor array
549  *
550  * Used for type-independent object copies
551  */
552 struct binder_object {
553 	union {
554 		struct binder_object_header hdr;
555 		struct flat_binder_object fbo;
556 		struct binder_fd_object fdo;
557 		struct binder_buffer_object bbo;
558 		struct binder_fd_array_object fdao;
559 	};
560 };
561 
562 #endif /* _LINUX_BINDER_INTERNAL_H */
563