[linux-2.6-block.git] / drivers / android / binder_alloc.h

/* SPDX-License-Identifier: GPL-2.0-only */
/*
 * Copyright (C) 2017 Google, Inc.
 */

#ifndef _LINUX_BINDER_ALLOC_H
#define _LINUX_BINDER_ALLOC_H

#include <linux/rbtree.h>
#include <linux/list.h>
#include <linux/mm.h>
#include <linux/rtmutex.h>
#include <linux/vmalloc.h>
#include <linux/slab.h>
#include <linux/list_lru.h>
#include <uapi/linux/android/binder.h>

extern struct list_lru binder_alloc_lru;
struct binder_transaction;

/**
 * struct binder_buffer - buffer used for binder transactions
 * @entry:              entry alloc->buffers
 * @rb_node:            node for allocated_buffers/free_buffers rb trees
 * @free:               %true if buffer is free
 * @clear_on_free:      %true if buffer must be zeroed after use
 * @allow_user_free:    %true if user is allowed to free buffer
 * @async_transaction:  %true if buffer is in use for an async txn
 * @oneway_spam_suspect: %true if total async allocate size just exceed
 * spamming detect threshold
 * @debug_id:           unique ID for debugging
 * @transaction:        pointer to associated struct binder_transaction
 * @target_node:        struct binder_node associated with this buffer
 * @data_size:          size of @transaction data
 * @offsets_size:       size of array of offsets
 * @extra_buffers_size: size of space for other objects (like sg lists)
 * @user_data:          user pointer to base of buffer space
 * @pid:                pid to attribute the buffer to (caller)
 *
 * Bookkeeping structure for binder transaction buffers
 */
struct binder_buffer {
	struct list_head entry; /* free and allocated entries by address */
	struct rb_node rb_node; /* free entry by size or allocated entry */
				/* by address */
	unsigned free:1;
	unsigned clear_on_free:1;
	unsigned allow_user_free:1;
	unsigned async_transaction:1;
	unsigned oneway_spam_suspect:1;
	unsigned debug_id:27;

	struct binder_transaction *transaction;

	struct binder_node *target_node;
	size_t data_size;
	size_t offsets_size;
	size_t extra_buffers_size;
	void __user *user_data;
	int    pid;
};

/**
 * struct binder_lru_page - page object used for binder shrinker
 * @page_ptr: pointer to physical page in mmap'd space
 * @lru:      entry in binder_alloc_lru
 * @alloc:    binder_alloc for a proc
 */
struct binder_lru_page {
	struct list_head lru;
	struct page *page_ptr;
	struct binder_alloc *alloc;
};

/**
 * struct binder_alloc - per-binder proc state for binder allocator
 * @mutex:              protects binder_alloc fields
 * @vma_addr:           vm_area_struct->vm_start passed to mmap_handler
 *                      (invariant after mmap)
 * @mm:                 copy of task->mm (invariant after open)
 * @buffer:             base of per-proc address space mapped via mmap
 * @buffers:            list of all buffers for this proc
 * @free_buffers:       rb tree of buffers available for allocation
 *                      sorted by size
 * @allocated_buffers:  rb tree of allocated buffers sorted by address
 * @free_async_space:   VA space available for async buffers. This is
 *                      initialized at mmap time to 1/2 the full VA space
 * @pages:              array of binder_lru_page
 * @buffer_size:        size of address space specified via mmap
 * @pid:                pid for associated binder_proc (invariant after init)
 * @pages_high:         high watermark of offset in @pages
 * @oneway_spam_detected: %true if oneway spam detection fired, clear that
 * flag once the async buffer has returned to a healthy state
 *
 * Bookkeeping structure for per-proc address space management for binder
 * buffers. It is normally initialized during binder_init() and binder_mmap()
 * calls. The address space is used for both user-visible buffers and for
 * struct binder_buffer objects used to track the user buffers
 */
struct binder_alloc {
	struct mutex mutex;
	unsigned long vma_addr;
	struct mm_struct *mm;
	void __user *buffer;
	struct list_head buffers;
	struct rb_root free_buffers;
	struct rb_root allocated_buffers;
	size_t free_async_space;
	struct binder_lru_page *pages;
	size_t buffer_size;
	int pid;
	size_t pages_high;
	bool oneway_spam_detected;
};

#ifdef CONFIG_ANDROID_BINDER_IPC_SELFTEST
void binder_selftest_alloc(struct binder_alloc *alloc);
#else
static inline void binder_selftest_alloc(struct binder_alloc *alloc) {}
#endif
enum lru_status binder_alloc_free_page(struct list_head *item,
				       struct list_lru_one *lru,
				       spinlock_t *lock, void *cb_arg);
extern struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc,
						  size_t data_size,
						  size_t offsets_size,
						  size_t extra_buffers_size,
						  int is_async,
						  int pid);
extern void binder_alloc_init(struct binder_alloc *alloc);
extern int binder_alloc_shrinker_init(void);
extern void binder_alloc_vma_close(struct binder_alloc *alloc);
extern struct binder_buffer *
binder_alloc_prepare_to_free(struct binder_alloc *alloc,
			     uintptr_t user_ptr);
extern void binder_alloc_free_buf(struct binder_alloc *alloc,
				  struct binder_buffer *buffer);
extern int binder_alloc_mmap_handler(struct binder_alloc *alloc,
				     struct vm_area_struct *vma);
extern void binder_alloc_deferred_release(struct binder_alloc *alloc);
extern int binder_alloc_get_allocated_count(struct binder_alloc *alloc);
extern void binder_alloc_print_allocated(struct seq_file *m,
					 struct binder_alloc *alloc);
void binder_alloc_print_pages(struct seq_file *m,
			      struct binder_alloc *alloc);

/**
 * binder_alloc_get_free_async_space() - get free space available for async
 * @alloc:	binder_alloc for this proc
 *
 * Return:	the bytes remaining in the address-space for async transactions
 */
static inline size_t
binder_alloc_get_free_async_space(struct binder_alloc *alloc)
{
	size_t free_async_space;

	mutex_lock(&alloc->mutex);
	free_async_space = alloc->free_async_space;
	mutex_unlock(&alloc->mutex);
	return free_async_space;
}

unsigned long
binder_alloc_copy_user_to_buffer(struct binder_alloc *alloc,
				 struct binder_buffer *buffer,
				 binder_size_t buffer_offset,
				 const void __user *from,
				 size_t bytes);

int binder_alloc_copy_to_buffer(struct binder_alloc *alloc,
				struct binder_buffer *buffer,
				binder_size_t buffer_offset,
				void *src,
				size_t bytes);

int binder_alloc_copy_from_buffer(struct binder_alloc *alloc,
				  void *dest,
				  struct binder_buffer *buffer,
				  binder_size_t buffer_offset,
				  size_t bytes);

#endif /* _LINUX_BINDER_ALLOC_H */
Commit	Line	Data
9c92ab61	1	/* SPDX-License-Identifier: GPL-2.0-only */
0c972a05 TK	2	/*
0c972a05 TK	3	* Copyright (C) 2017 Google, Inc.
0c972a05 TK	4	*/
	5
	6	#ifndef _LINUX_BINDER_ALLOC_H
	7	#define _LINUX_BINDER_ALLOC_H
	8
	9	#include <linux/rbtree.h>
	10	#include <linux/list.h>
	11	#include <linux/mm.h>
	12	#include <linux/rtmutex.h>
	13	#include <linux/vmalloc.h>
	14	#include <linux/slab.h>
f2517eb7	15	#include <linux/list_lru.h>
1a7c3d9b	16	#include <uapi/linux/android/binder.h>
0c972a05	17
f2517eb7	18	extern struct list_lru binder_alloc_lru;
0c972a05 TK	19	struct binder_transaction;
	20
	21	/**
	22	* struct binder_buffer - buffer used for binder transactions
	23	* @entry: entry alloc->buffers
	24	* @rb_node: node for allocated_buffers/free_buffers rb trees
7a2670a5	25	* @free: %true if buffer is free
0f966cba	26	* @clear_on_free: %true if buffer must be zeroed after use
7a2670a5 TK	27	* @allow_user_free: %true if user is allowed to free buffer
7a2670a5 TK	28	* @async_transaction: %true if buffer is in use for an async txn
a7dc1e6f HL	29	* @oneway_spam_suspect: %true if total async allocate size just exceed
a7dc1e6f HL	30	* spamming detect threshold
7a2670a5 TK	31	* @debug_id: unique ID for debugging
	32	* @transaction: pointer to associated struct binder_transaction
	33	* @target_node: struct binder_node associated with this buffer
	34	* @data_size: size of @transaction data
	35	* @offsets_size: size of array of offsets
	36	* @extra_buffers_size: size of space for other objects (like sg lists)
bde4a19f	37	* @user_data: user pointer to base of buffer space
261e7818	38	* @pid: pid to attribute the buffer to (caller)
0c972a05 TK	39	*
	40	* Bookkeeping structure for binder transaction buffers
	41	*/
	42	struct binder_buffer {
	43	struct list_head entry; /* free and allocated entries by address */
	44	struct rb_node rb_node; /* free entry by size or allocated entry */
	45	/* by address */
	46	unsigned free:1;
0f966cba	47	unsigned clear_on_free:1;
0c972a05 TK	48	unsigned allow_user_free:1;
0c972a05 TK	49	unsigned async_transaction:1;
a7dc1e6f HL	50	unsigned oneway_spam_suspect:1;
a7dc1e6f HL	51	unsigned debug_id:27;
0c972a05 TK	52
	53	struct binder_transaction *transaction;
	54
	55	struct binder_node *target_node;
	56	size_t data_size;
	57	size_t offsets_size;
	58	size_t extra_buffers_size;
bde4a19f	59	void __user *user_data;
261e7818	60	int pid;
0c972a05 TK	61	};
0c972a05 TK	62
f2517eb7 SY	63	/**
	64	* struct binder_lru_page - page object used for binder shrinker
	65	* @page_ptr: pointer to physical page in mmap'd space
	66	* @lru: entry in binder_alloc_lru
	67	* @alloc: binder_alloc for a proc
	68	*/
	69	struct binder_lru_page {
	70	struct list_head lru;
	71	struct page *page_ptr;
	72	struct binder_alloc *alloc;
	73	};
	74
0c972a05 TK	75	/**
0c972a05 TK	76	* struct binder_alloc - per-binder proc state for binder allocator
7b0dbd94 CL	77	* @mutex: protects binder_alloc fields
7b0dbd94 CL	78	* @vma_addr: vm_area_struct->vm_start passed to mmap_handler
76ff3346	79	* (invariant after mmap)
e66b77e5	80	* @mm: copy of task->mm (invariant after open)
0c972a05	81	* @buffer: base of per-proc address space mapped via mmap
0c972a05 TK	82	* @buffers: list of all buffers for this proc
	83	* @free_buffers: rb tree of buffers available for allocation
	84	* sorted by size
	85	* @allocated_buffers: rb tree of allocated buffers sorted by address
	86	* @free_async_space: VA space available for async buffers. This is
	87	* initialized at mmap time to 1/2 the full VA space
f2517eb7	88	* @pages: array of binder_lru_page
0c972a05 TK	89	* @buffer_size: size of address space specified via mmap
0c972a05 TK	90	* @pid: pid for associated binder_proc (invariant after init)
8d9a3ab6	91	* @pages_high: high watermark of offset in @pages
a7dc1e6f HL	92	* @oneway_spam_detected: %true if oneway spam detection fired, clear that
a7dc1e6f HL	93	* flag once the async buffer has returned to a healthy state
0c972a05 TK	94	*
	95	* Bookkeeping structure for per-proc address space management for binder
	96	* buffers. It is normally initialized during binder_init() and binder_mmap()
	97	* calls. The address space is used for both user-visible buffers and for
	98	* struct binder_buffer objects used to track the user buffers
	99	*/
	100	struct binder_alloc {
	101	struct mutex mutex;
a43cfc87	102	unsigned long vma_addr;
e66b77e5	103	struct mm_struct *mm;
bde4a19f	104	void __user *buffer;
0c972a05 TK	105	struct list_head buffers;
	106	struct rb_root free_buffers;
	107	struct rb_root allocated_buffers;
	108	size_t free_async_space;
f2517eb7	109	struct binder_lru_page *pages;
0c972a05	110	size_t buffer_size;
0c972a05	111	int pid;
8d9a3ab6	112	size_t pages_high;
a7dc1e6f	113	bool oneway_spam_detected;
0c972a05 TK	114	};
0c972a05 TK	115
4175e2b4 SY	116	#ifdef CONFIG_ANDROID_BINDER_IPC_SELFTEST
	117	void binder_selftest_alloc(struct binder_alloc *alloc);
	118	#else
	119	static inline void binder_selftest_alloc(struct binder_alloc *alloc) {}
	120	#endif
f2517eb7 SY	121	enum lru_status binder_alloc_free_page(struct list_head *item,
	122	struct list_lru_one *lru,
	123	spinlock_t lock, void cb_arg);
0c972a05 TK	124	extern struct binder_buffer binder_alloc_new_buf(struct binder_alloc alloc,
	125	size_t data_size,
	126	size_t offsets_size,
	127	size_t extra_buffers_size,
261e7818 MC	128	int is_async,
261e7818 MC	129	int pid);
0c972a05	130	extern void binder_alloc_init(struct binder_alloc *alloc);
533dfb25	131	extern int binder_alloc_shrinker_init(void);
0c972a05 TK	132	extern void binder_alloc_vma_close(struct binder_alloc *alloc);
0c972a05 TK	133	extern struct binder_buffer *
53d311cf TK	134	binder_alloc_prepare_to_free(struct binder_alloc *alloc,
53d311cf TK	135	uintptr_t user_ptr);
0c972a05 TK	136	extern void binder_alloc_free_buf(struct binder_alloc *alloc,
	137	struct binder_buffer *buffer);
	138	extern int binder_alloc_mmap_handler(struct binder_alloc *alloc,
	139	struct vm_area_struct *vma);
	140	extern void binder_alloc_deferred_release(struct binder_alloc *alloc);
	141	extern int binder_alloc_get_allocated_count(struct binder_alloc *alloc);
	142	extern void binder_alloc_print_allocated(struct seq_file *m,
	143	struct binder_alloc *alloc);
8ef4665a SY	144	void binder_alloc_print_pages(struct seq_file *m,
8ef4665a SY	145	struct binder_alloc *alloc);
0c972a05 TK	146
	147	/**
	148	* binder_alloc_get_free_async_space() - get free space available for async
	149	* @alloc: binder_alloc for this proc
	150	*
	151	* Return: the bytes remaining in the address-space for async transactions
	152	*/
	153	static inline size_t
	154	binder_alloc_get_free_async_space(struct binder_alloc *alloc)
	155	{
	156	size_t free_async_space;
	157
	158	mutex_lock(&alloc->mutex);
	159	free_async_space = alloc->free_async_space;
	160	mutex_unlock(&alloc->mutex);
	161	return free_async_space;
	162	}
	163
1a7c3d9b TK	164	unsigned long
	165	binder_alloc_copy_user_to_buffer(struct binder_alloc *alloc,
	166	struct binder_buffer *buffer,
	167	binder_size_t buffer_offset,
	168	const void __user *from,
	169	size_t bytes);
	170
bb4a2e48 TK	171	int binder_alloc_copy_to_buffer(struct binder_alloc *alloc,
	172	struct binder_buffer *buffer,
	173	binder_size_t buffer_offset,
	174	void *src,
	175	size_t bytes);
	176
	177	int binder_alloc_copy_from_buffer(struct binder_alloc *alloc,
	178	void *dest,
	179	struct binder_buffer *buffer,
	180	binder_size_t buffer_offset,
	181	size_t bytes);
8ced0c62	182
0c972a05 TK	183	#endif /* _LINUX_BINDER_ALLOC_H */
0c972a05 TK	184