drivers/android/binder/deferred_close.rs

Source file repositories/reference/linux-study-clean/drivers/android/binder/deferred_close.rs

File Facts

System
Linux kernel
Corpus path
drivers/android/binder/deferred_close.rs
Extension
.rs
Size
9334 bytes
Lines
205
Domain
Driver Families
Bucket
drivers/android
Inferred role
Driver Families: implementation source
Status
source implementation candidate

Why This File Exists

Repeatable hardware-adapter layer. Deep compatibility for every driver is out of scope; this atlas records patterns, probe lifecycles, bus glue, IRQ/DMA usage, and links back to core abstractions.

Dependency Surface

Detected Declarations

Annotated Snippet

struct DeferredFdCloserInner {
    twork: MaybeUninit<bindings::callback_head>,
    file: *mut bindings::file,
}

impl DeferredFdCloser {
    /// Create a new [`DeferredFdCloser`].
    pub(crate) fn new(flags: Flags) -> Result<Self, AllocError> {
        Ok(Self {
            // INVARIANT: The `file` pointer is null, so the type invariant does not apply.
            inner: KBox::new(
                DeferredFdCloserInner {
                    twork: MaybeUninit::uninit(),
                    file: core::ptr::null_mut(),
                },
                flags,
            )?,
        })
    }

    /// Schedule a task work that closes the file descriptor when this task returns to userspace.
    ///
    /// Fails if this is called from a context where we cannot run work when returning to
    /// userspace. (E.g., from a kthread.)
    pub(crate) fn close_fd(self, fd: u32) -> Result<(), DeferredFdCloseError> {
        use bindings::task_work_notify_mode_TWA_RESUME as TWA_RESUME;

        // In this method, we schedule the task work before closing the file. This is because
        // scheduling a task work is fallible, and we need to know whether it will fail before we
        // attempt to close the file.

        // Task works are not available on kthreads.
        let current = kernel::current!();

        // Check if this is a kthread.
        // SAFETY: Reading `flags` from a task is always okay.
        if unsafe { ((*current.as_ptr()).flags & bindings::PF_KTHREAD) != 0 } {
            return Err(DeferredFdCloseError::TaskWorkUnavailable);
        }

        // Transfer ownership of the box's allocation to a raw pointer. This disables the
        // destructor, so we must manually convert it back to a KBox to drop it.
        //
        // Until we convert it back to a `KBox`, there are no aliasing requirements on this
        // pointer.
        let inner = KBox::into_raw(self.inner);

        // The `callback_head` field is first in the struct, so this cast correctly gives us a
        // pointer to the field.
        let callback_head = inner.cast::<bindings::callback_head>();
        // SAFETY: This pointer offset operation does not go out-of-bounds.
        let file_field = unsafe { core::ptr::addr_of_mut!((*inner).file) };

        let current = current.as_ptr();

        // SAFETY: This function currently has exclusive access to the `DeferredFdCloserInner`, so
        // it is okay for us to perform unsynchronized writes to its `callback_head` field.
        unsafe { bindings::init_task_work(callback_head, Some(Self::do_close_fd)) };

        // SAFETY: This inserts the `DeferredFdCloserInner` into the task workqueue for the current
        // task. If this operation is successful, then this transfers exclusive ownership of the
        // `callback_head` field to the C side until it calls `do_close_fd`, and we don't touch or
        // invalidate the field during that time.
        //
        // When the C side calls `do_close_fd`, the safety requirements of that method are
        // satisfied because when a task work is executed, the callback is given ownership of the
        // pointer.
        //
        // The file pointer is currently null. If it is changed to be non-null before `do_close_fd`
        // is called, then that change happens due to the write at the end of this function, and
        // that write has a safety comment that explains why the refcount can be dropped when
        // `do_close_fd` runs.
        let res = unsafe { bindings::task_work_add(current, callback_head, TWA_RESUME) };

        if res != 0 {
            // SAFETY: Scheduling the task work failed, so we still have ownership of the box, so
            // we may destroy it.
            unsafe { drop(KBox::from_raw(inner)) };

            return Err(DeferredFdCloseError::TaskWorkUnavailable);
        }

        // This removes the fd from the fd table in `current`. The file is not fully closed until
        // `filp_close` is called. We are given ownership of one refcount to the file.
        //
        // SAFETY: This is safe no matter what `fd` is. If the `fd` is valid (that is, if the
        // pointer is non-null), then we call `filp_close` on the returned pointer as required by
        // `file_close_fd`.
        let file = unsafe { bindings::file_close_fd(fd) };
        if file.is_null() {

Annotation

Implementation Notes