summaryrefslogtreecommitdiff
path: root/drivers/android
AgeCommit message (Collapse)Author
2018-03-09Merge branch 'linux-linaro-lsk-v4.4-android' of ↵Tao Huang
git://git.linaro.org/kernel/linux-linaro-stable.git * linux-linaro-lsk-v4.4-android: (660 commits) ANDROID: keychord: Check for write data size ANDROID: sdcardfs: Set num in extension_details during make_item ANDROID: sdcardfs: Hold i_mutex for i_size_write BACKPORT, FROMGIT: crypto: speck - add test vectors for Speck64-XTS BACKPORT, FROMGIT: crypto: speck - add test vectors for Speck128-XTS BACKPORT, FROMGIT: crypto: arm/speck - add NEON-accelerated implementation of Speck-XTS FROMGIT: crypto: speck - export common helpers BACKPORT, FROMGIT: crypto: speck - add support for the Speck block cipher UPSTREAM: ANDROID: binder: synchronize_rcu() when using POLLFREE. f2fs: updates on v4.16-rc1 BACKPORT: tee: shm: Potential NULL dereference calling tee_shm_register() BACKPORT: tee: shm: don't put_page on null shm->pages BACKPORT: tee: shm: make function __tee_shm_alloc static BACKPORT: tee: optee: check type of registered shared memory BACKPORT: tee: add start argument to shm_register callback BACKPORT: tee: optee: fix header dependencies BACKPORT: tee: shm: inline tee_shm_get_id() BACKPORT: tee: use reference counting for tee_context BACKPORT: tee: optee: enable dynamic SHM support BACKPORT: tee: optee: add optee-specific shared pool implementation ... Conflicts: drivers/irqchip/Kconfig drivers/media/i2c/tc35874x.c drivers/media/v4l2-core/v4l2-compat-ioctl32.c drivers/usb/gadget/function/f_fs.c fs/f2fs/node.c Change-Id: Icecd73a515821b536fa3d81ea91b63d9b3699916
2018-03-05UPSTREAM: ANDROID: binder: synchronize_rcu() when using POLLFREE.Martijn Coenen
To prevent races with ep_remove_waitqueue() removing the waitqueue at the same time. Reported-by: syzbot+a2a3c4909716e271487e@syzkaller.appspotmail.com Signed-off-by: Martijn Coenen <maco@android.com> Cc: stable <stable@vger.kernel.org> # 4.14+ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 5eeb2ca02a2f6084fc57ae5c244a38baab07033a) Change-Id: Ia0089448079c78d0ab0b57303faf838e9e5ee797
2018-03-05UPSTREAM: ANDROID: binder: remove waitqueue when thread exits.Martijn Coenen
binder_poll() passes the thread->wait waitqueue that can be slept on for work. When a thread that uses epoll explicitly exits using BINDER_THREAD_EXIT, the waitqueue is freed, but it is never removed from the corresponding epoll data structure. When the process subsequently exits, the epoll cleanup code tries to access the waitlist, which results in a use-after-free. Prevent this by using POLLFREE when the thread exits. (cherry picked from commit f5cb779ba16334b45ba8946d6bfa6d9834d1527f) Change-Id: Ib34b1cbb8ab2192d78c3d9956b2f963a66ecad2e Signed-off-by: Martijn Coenen <maco@android.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: stable <stable@vger.kernel.org> # 4.14 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-03-05Revert "binder: add missing binder_unlock()"Greg Kroah-Hartman
This reverts commit bf5a6a7256834ad88104d3a99cc935c9ac49b527. There is no binder_unlock() in this branch, so this patch needs to be reverted. Change-Id: I22dca6eee1e93e712b9b1038c42edc29e679aad6 Cc: Guenter Roeck <linux@roeck-us.net> Cc: Eric Biggers <ebiggers@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2018-03-05Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-androidAmit Pundir
Signed-off-by: Amit Pundir <amit.pundir@linaro.org> Conflicts: fs/f2fs/extent_cache.c Pick changes from AOSP Change-Id: Icd8a85ac0c19a8aa25cd2591a12b4e9b85bdf1c5 ("f2fs: catch up to v4.14-rc1") fs/f2fs/namei.c Pick changes from AOSP F2FS backport commit 7d5c08fd9194 ("f2fs: backport from (4c1fad64 - Merge tag 'for-f2fs-4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs)")
2018-02-28binder: add missing binder_unlock()Eric Biggers
When commit 4be5a2810489 ("binder: check for binder_thread allocation failure in binder_poll()") was applied to 4.4-stable and 4.9-stable it was forgotten to release the global binder lock in the new error path. The global binder lock wasn't removed until v4.14, by commit a60b890f607d ("binder: remove global binder lock"). Fix the new error path to release the lock. Reported-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-02-25binder: check for binder_thread allocation failure in binder_poll()Eric Biggers
commit f88982679f54f75daa5b8eff3da72508f1e7422f upstream. If the kzalloc() in binder_get_thread() fails, binder_poll() dereferences the resulting NULL pointer. Fix it by returning POLLERR if the memory allocation failed. This bug was found by syzkaller using fault injection. Reported-by: syzbot <syzkaller@googlegroups.com> Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-01-26Merge branch 'linux-linaro-lsk-v4.4-android' of ↵Tao Huang
git://git.linaro.org/kernel/linux-linaro-stable.git * linux-linaro-lsk-v4.4-android: (733 commits) LSK-ANDROID: memcg: Remove wrong ->attach callback LSK-ANDROID: arm64: mm: Fix __create_pgd_mapping() call ANDROID: sdcardfs: Move default_normal to superblock blkdev: Refactoring block io latency histogram codes FROMLIST: arm64: kpti: Fix the interaction between ASID switching and software PAN FROMLIST: arm64: Move post_ttbr_update_workaround to C code FROMLIST: arm64: mm: Rename post_ttbr0_update_workaround sched: EAS: Initialize push_task as NULL to avoid direct reference on out_unlock path fscrypt: updates on 4.15-rc4 ANDROID: uid_sys_stats: fix the comment BACKPORT: tee: indicate privileged dev in gen_caps BACKPORT: tee: optee: sync with new naming of interrupts BACKPORT: tee: tee_shm: Constify dma_buf_ops structures. BACKPORT: tee: optee: interruptible RPC sleep BACKPORT: tee: optee: add const to tee_driver_ops and tee_desc structures BACKPORT: tee.txt: standardize document format BACKPORT: tee: add forward declaration for struct device BACKPORT: tee: optee: fix uninitialized symbol 'parg' BACKPORT: tee: add ARM_SMCCC dependency BACKPORT: selinux: nlmsgtab: add SOCK_DESTROY to the netlink mapping tables ... Conflicts: arch/arm64/kernel/vdso.c drivers/usb/host/xhci-plat.c include/drm/drmP.h include/linux/kasan.h kernel/time/timekeeping.c mm/kasan/kasan.c security/selinux/nlmsgtab.c Also add this commit: 0bcdc0987cce ("time: Fix ktime_get_raw() incorrect base accumulation")
2018-01-22ANDROID: binder: Remove obsolete proc waitqueue.Martijn Coenen
It was no longer being used. Change-Id: I7fc42b76f688a459ad990f59fbd7006b96bb91a6 Signed-off-by: Martijn Coenen <maco@android.com>
2018-01-22UPSTREAM: android: binder: fix type mismatch warningArnd Bergmann
Allowing binder to expose the 64-bit API on 32-bit kernels caused a build warning: drivers/android/binder.c: In function 'binder_transaction_buffer_release': drivers/android/binder.c:2220:15: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] fd_array = (u32 *)(parent_buffer + fda->parent_offset); ^ drivers/android/binder.c: In function 'binder_translate_fd_array': drivers/android/binder.c:2445:13: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] fd_array = (u32 *)(parent_buffer + fda->parent_offset); ^ drivers/android/binder.c: In function 'binder_fixup_parent': drivers/android/binder.c:2511:18: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] This adds extra type casts to avoid the warning. However, there is another problem with the Kconfig option: turning it on or off creates two incompatible ABI versions, a kernel that has this enabled cannot run user space that was built without it or vice versa. A better solution might be to leave the option hidden until the binder code is fixed to deal with both ABI versions. Fixes: e8d2ed7db7c3 ("Revert "staging: Fix build issues with new binder API"") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 1c363eaece2752c5f8b1b874cb4ae435de06aa66) Change-Id: Id09185a6f86905926699e92a2b30201b8a5e83e5
2017-12-15Revert "ANDROID: binder: Add thread->process_todo flag."Tao Huang
This reverts commit 6c70907428dd5f2b44c9e7b06f18411f81f9119b. Which unable to pass VtsKernelBinderTest#BinderDriverInterfaceTest.Transaction_IPC64_64bit VtsKernelBinderTest#BinderDriverInterfaceTest.Transaction_IPC64_32bit frameworks/native/libs/binder/tests/binderDriverInterfaceTest.cpp:84 Value of: ret Actual: -1 Expected: expect_ret Which is: 0 Google Test trace: frameworks/native/libs/binder/tests/binderDriverInterfaceTest.cpp:252: 1st WriteRead frameworks/native/libs/binder/tests/binderDriverInterfaceTest.cpp:87 Value of: (*__errno()) Actual: 11 Expected: expect_errno Which is: 0 Google Test trace: frameworks/native/libs/binder/tests/binderDriverInterfaceTest.cpp:252: 1st WriteRead Change-Id: I982d7a2a8690c9d1ae7533e91bf7d41e814cdc54 Signed-off-by: Tao Huang <huangtao@rock-chips.com>
2017-12-15Revert "ANDROID: binder: clarify deferred thread work."Tao Huang
This reverts commit 3f883f9b5cf0d8361f28cabba13c36da68f0ed85. Change-Id: I7b597f826bf975ac2221ee4558c8164408f3fc1b Signed-off-by: Tao Huang <huangtao@rock-chips.com>
2017-11-20FROMLIST: binder: fix proc->files use-after-freeTodd Kjos
(from https://patchwork.kernel.org/patch/10058587/) proc->files cleanup is initiated by binder_vma_close. Therefore a reference on the binder_proc is not enough to prevent the files_struct from being released while the binder_proc still has a reference. This can lead to an attempt to dereference the stale pointer obtained from proc->files prior to proc->files cleanup. This has been seen once in task_get_unused_fd_flags() when __alloc_fd() is called with a stale "files". The fix is to always use get_files_struct() to obtain struct_files so that the refcount on the files_struct is used to prevent a premature free. proc->files is removed since we get it every time. Bug: 69164715 Change-Id: I6431027d3d569e76913935c21885201505627982 Signed-off-by: Todd Kjos <tkjos@google.com>
2017-11-20ANDROID: binder: clarify deferred thread work.Martijn Coenen
Rename the function to more accurately reflect what it does, and add a comment explaining why we use it. Change-Id: I8d011c017dfc6e24b5b54fc462578f8e153e5926 Signed-off-by: Martijn Coenen <maco@android.com>
2017-11-20ANDROID: binder: Add thread->process_todo flag.Martijn Coenen
This flag determines whether the thread should currently process the work in the thread->todo worklist. The prime usecase for this is improving the performance of synchronous transactions: all synchronous transactions post a BR_TRANSACTION_COMPLETE to the calling thread, but there's no reason to return that command to userspace right away - userspace anyway needs to wait for the reply. Likewise, a synchronous transaction that contains a binder object can cause a BC_ACQUIRE/BC_INCREFS to be returned to userspace; since the caller must anyway hold a strong/weak ref for the duration of the call, postponing these commands until the reply comes in is not a problem. Note that this flag is not used to determine whether a thread can handle process work; a thread should never pick up process work when thread work is still pending. Before patch: ------------------------------------------------------------------ Benchmark Time CPU Iterations ------------------------------------------------------------------ BM_sendVec_binderize/4 45959 ns 20288 ns 34351 BM_sendVec_binderize/8 45603 ns 20080 ns 34909 BM_sendVec_binderize/16 45528 ns 20113 ns 34863 BM_sendVec_binderize/32 45551 ns 20122 ns 34881 BM_sendVec_binderize/64 45701 ns 20183 ns 34864 BM_sendVec_binderize/128 45824 ns 20250 ns 34576 BM_sendVec_binderize/256 45695 ns 20171 ns 34759 BM_sendVec_binderize/512 45743 ns 20211 ns 34489 BM_sendVec_binderize/1024 46169 ns 20430 ns 34081 After patch: ------------------------------------------------------------------ Benchmark Time CPU Iterations ------------------------------------------------------------------ BM_sendVec_binderize/4 42939 ns 17262 ns 40653 BM_sendVec_binderize/8 42823 ns 17243 ns 40671 BM_sendVec_binderize/16 42898 ns 17243 ns 40594 BM_sendVec_binderize/32 42838 ns 17267 ns 40527 BM_sendVec_binderize/64 42854 ns 17249 ns 40379 BM_sendVec_binderize/128 42881 ns 17288 ns 40427 BM_sendVec_binderize/256 42917 ns 17297 ns 40429 BM_sendVec_binderize/512 43184 ns 17395 ns 40411 BM_sendVec_binderize/1024 43119 ns 17357 ns 40432 Signed-off-by: Martijn Coenen <maco@android.com> Change-Id: Ia70287066d62aba64e98ac44ff1214e37ca75693
2017-11-20ANDROID: binder: show high watermark of alloc->pages.Martijn Coenen
Show the high watermark of the index into the alloc->pages array, to facilitate sizing the buffer on a per-process basis. Change-Id: I2b40cd16628e0ee45216c51dc9b3c5b0c862032e Signed-off-by: Martijn Coenen <maco@android.com>
2017-11-20FROMLIST: android: binder: Change binder_shrinker to staticSherry Yang
(from https://patchwork.kernel.org/patch/9990321/) binder_shrinker struct is not used anywhere outside of binder_alloc.c and should be static. Bug: 63926541 Change-Id: I7a13d4ddbaaf3721cddfe1d860e34c7be80dd082 Acked-by: Arve Hjønnevåg <arve@android.com> Signed-off-by: Sherry Yang <sherryy@android.com>
2017-11-20FROMLIST: android: binder: Fix null ptr dereference in debug msgSherry Yang
(from https://patchwork.kernel.org/patch/9990323/) Don't access next->data in kernel debug message when the next buffer is null. Bug: 36007193 Change-Id: Ib8240d7e9a7087a2256e88c0ae84b9df0f2d0224 Acked-by: Arve Hjønnevåg <arve@android.com> Signed-off-by: Sherry Yang <sherryy@android.com>
2017-10-15ANDROID: binder: fix node sched policy calculationGanesh Mahendran
We should use FLAT_BINDER_FLAG_SCHED_POLICY_MASK as the mask to calculate sched policy. Change-Id: Ic252fd7c68495830690130d792802c02f99fc8fc Signed-off-by: Ganesh Mahendran <opensource.ganesh@gmail.com>
2017-10-15ANDROID: binder: init desired_prio.sched_policy before use itGanesh Mahendran
In function binder_transaction_priority(), we access desired_prio before initialzing it. This patch fix this. Change-Id: I9d14d50f9a128010476a65b52631630899a44633 Signed-off-by: Ganesh Mahendran <opensource.ganesh@gmail.com>
2017-10-15ANDROID: binder: fix transaction leak.Martijn Coenen
If a call to put_user() fails, we failed to properly free a transaction and send a failed reply (if necessary). Bug: 63117588 Test: binderLibTest Change-Id: Ia98db8cd82ce354a4cdc8811c969988d585c7e31 Signed-off-by: Martijn Coenen <maco@android.com>
2017-10-15ANDROID: binder: Add tracing for binder priority inheritance.Martijn Coenen
Bug: 34461621 Change-Id: I5ebb1c0c49fd42a89ee250a1d70221f767c82c7c Signed-off-by: Martijn Coenen <maco@google.com>
2017-10-15FROMLIST: binder: fix use-after-free in binder_transaction()Todd Kjos
(from https://patchwork.kernel.org/patch/9978801/) User-space normally keeps the node alive when creating a transaction since it has a reference to the target. The local strong ref keeps it alive if the sending process dies before the target process processes the transaction. If the source process is malicious or has a reference counting bug, this can fail. In this case, when we attempt to decrement the node in the failure path, the node has already been freed. This is fixed by taking a tmpref on the node while constructing the transaction. To avoid re-acquiring the node lock and inner proc lock to increment the proc's tmpref, a helper is used that does the ref increments on both the node and proc. Bug: 66899329 Change-Id: Iad40e1e0bccee88234900494fb52a510a37fe8d7 Signed-off-by: Todd Kjos <tkjos@google.com>
2017-10-15FROMLIST: android: binder: Don't get mm from taskSherry Yang
(from https://patchwork.kernel.org/patch/9954125/) Use binder_alloc struct's mm_struct rather than getting a reference to the mm struct through get_task_mm to avoid a potential deadlock between lru lock, task lock and dentry lock, since a thread can be holding the task lock and the dentry lock while trying to acquire the lru lock. Test: ran binderLibTest, throughputtest, interfacetest and mempressure w/lockdep Bug: 63926541 Change-Id: Icc661404eb7a4a2ecc5234b1bf8f0104665f9b45 Acked-by: Arve Hjønnevåg <arve@android.com> Signed-off-by: Sherry Yang <sherryy@android.com>
2017-10-15FROMLIST: android: binder: Remove unused vma argumentSherry Yang
(from https://patchwork.kernel.org/patch/9954123/) The vma argument in update_page_range is no longer used after 74310e06 ("android: binder: Move buffer out of area shared with user space"), since mmap_handler no longer calls update_page_range with a vma. Test: ran binderLibTest, throughputtest, interfacetest and mempressure Bug: 36007193 Change-Id: Ibd6f24c11750f8f7e6ed56e40dd18c08e02ace25 Acked-by: Arve Hjønnevåg <arve@android.com> Signed-off-by: Sherry Yang <sherryy@android.com>
2017-10-15FROMLIST: android: binder: Drop lru lock in isolate callbackSherry Yang
(from https://patchwork.kernel.org/patch/9945123/) Drop the global lru lock in isolate callback before calling zap_page_range which calls cond_resched, and re-acquire the global lru lock before returning. Also change return code to LRU_REMOVED_RETRY. Use mmput_async when fail to acquire mmap sem in an atomic context. Fix "BUG: sleeping function called from invalid context" errors when CONFIG_DEBUG_ATOMIC_SLEEP is enabled. Bug: 63926541 Change-Id: I45dbada421b715abed9a66d03d30ae2285671ca1 Fixes: f2517eb76f1f2 ("android: binder: Add global lru shrinker to binder") Reported-by: Kyle Yan <kyan@codeaurora.org> Acked-by: Arve Hjønnevåg <arve@android.com> Signed-off-by: Sherry Yang <sherryy@android.com>
2017-09-18FROMLIST: binder: fix an ret value overrideXu YiPing
(from https://patchwork.kernel.org/patch/9939409/) commit 372e3147df70 ("binder: guarantee txn complete / errors delivered in-order") incorrectly defined a local ret value. This ret value will be invalid when out of the if block Change-Id: If7bd963ac7e67d135aa949133263aac27bf15d1a Signed-off-by: Xu YiPing <xuyiping@hislicon.com> Signed-off-by: Todd Kjos <tkjos@google.com>
2017-09-18FROMLIST: binder: fix memory corruption in binder_transaction binderXu YiPing
(from https://patchwork.kernel.org/patch/9939405/) commit 7a4408c6bd3e ("binder: make sure accesses to proc/thread are safe") made a change to enqueue tcomplete to thread->todo before enqueuing the transaction. However, in err_dead_proc_or_thread case, the tcomplete is directly freed, without dequeued. It may cause the thread->todo list to be corrupted. So, dequeue it before freeing. Bug: 65333488 Change-Id: Id063a4db18deaa634f4d44aa6ebca47bea32537a Signed-off-by: Xu YiPing <xuyiping@hisilicon.com> Signed-off-by: Todd Kjos <tkjos@google.com>
2017-09-18FROMLIST: android: binder: Add page usage in binder statsSherry Yang
(from https://patchwork.kernel.org/patch/9928611/) Add the number of active, lru, and free pages for each binder process in binder stats Bug: 63926541 Change-Id: I12618e4eb8ecc08f4f05fe4cba454a88830897f9 Signed-off-by: Sherry Yang <sherryy@android.com>
2017-09-18FROMLIST: android: binder: Add shrinker tracepointsSherry Yang
(from https://patchwork.kernel.org/patch/9928613/) Add tracepoints in binder transaction allocator to record lru hits and alloc/free page. Bug: 63926541 Change-Id: I2e24fe8e7b6534349df4a87ff865a6843ac9a30b Signed-off-by: Sherry Yang <sherryy@android.com>
2017-09-18FROMLIST: android: binder: Add global lru shrinker to binderSherry Yang
(from https://patchwork.kernel.org/patch/9928615/) Hold on to the pages allocated and mapped for transaction buffers until the system is under memory pressure. When that happens, use linux shrinker to free pages. Without using shrinker, patch "android: binder: Move buffer out of area shared with user space" will cause a significant slow down for small transactions that fit into the first page because free list buffer header used to be inlined with buffer data. In addition to prevent the performance regression for small transactions, this patch improves the performance for transactions that take up more than one page. Modify alloc selftest to work with the shrinker change. Test: Run memory intensive applications (Chrome and Camera) to trigger shrinker callbacks. Binder frees memory as expected. Test: Run binderThroughputTest with high memory pressure option enabled. Bug: 63926541 Change-Id: I3abfc43b405e7e0a6228da37e0689a4b944f0e00 Signed-off-by: Sherry Yang <sherryy@android.com>
2017-09-18FROMLIST: android: binder: Move buffer out of area shared with user spaceSherry Yang
(from https://patchwork.kernel.org/patch/9928607/) Binder driver allocates buffer meta data in a region that is mapped in user space. These meta data contain pointers in the kernel. This patch allocates buffer meta data on the kernel heap that is not mapped in user space, and uses a pointer to refer to the data mapped. Also move alloc->buffers initialization from mmap to init since it's now used even when mmap failed or was not called. Bug: 36007193 Change-Id: Id5136048bdb7b796f59de066de7ea7df410498f5 Signed-off-by: Sherry Yang <sherryy@android.com>
2017-09-18FROMLIST: android: binder: Add allocator selftestSherry Yang
(from https://patchwork.kernel.org/patch/9928609/) binder_alloc_selftest tests that alloc_new_buf handles page allocation and deallocation properly when allocate and free buffers. The test allocates 5 buffers of various sizes to cover all possible page alignment cases, and frees the buffers using a list of exhaustive freeing order. Test: boot the device with ANDROID_BINDER_IPC_SELFTEST config option enabled. Allocator selftest passes. Bug: 36007193 Change-Id: I2fe396232b7dfe4bbc50bdba99ca0de9be63cc37 Signed-off-by: Sherry Yang <sherryy@android.com>
2017-09-18FROMLIST: android: binder: Refactor prev and next buffer into a helper functionSherry Yang
(from https://patchwork.kernel.org/patch/9928605/) Use helper functions buffer_next and buffer_prev instead of list_entry to get the next and previous buffers. Bug: 36007193 Change-Id: I422dce84afde3d2138a6d976593b109a9cc49003 Signed-off-by: Sherry Yang <sherryy@android.com>
2017-08-30ANDROID: binder: fix proc->tsk check.Martijn Coenen
commit b2a6d1b999a4c13e5997bb864694e77172d45250 upstream. Commit c4ea41ba195d ("binder: use group leader instead of open thread")' was incomplete and didn't update a check in binder_mmap(), causing all mmap() calls into the binder driver to fail. Signed-off-by: Martijn Coenen <maco@android.com> Tested-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-08-30binder: Use wake up hint for synchronous transactions.Riley Andrews
commit 00b40d613352c623aaae88a44e5ded7c912909d7 upstream. Use wake_up_interruptible_sync() to hint to the scheduler binder transactions are synchronous wakeups. Disable preemption while waking to avoid ping-ponging on the binder lock. Signed-off-by: Todd Kjos <tkjos@google.com> Signed-off-by: Omprakash Dhyade <odhyade@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-08-30binder: use group leader instead of open threadTodd Kjos
commit c4ea41ba195d01c9af66fb28711a16cc97caa9c5 upstream. The binder allocator assumes that the thread that called binder_open will never die for the lifetime of that proc. That thread is normally the group_leader, however it may not be. Use the group_leader instead of current. Signed-off-by: Todd Kjos <tkjos@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-08-11ANDROID: binder: don't queue async transactions to thread.Martijn Coenen
This can cause issues with processes using the poll() interface: 1) client sends two oneway transactions 2) the second one gets queued on async_todo (because the server didn't handle the first one yet) 3) server returns from poll(), picks up the first transaction and does transaction work 4) server is done with the transaction, sends BC_FREE_BUFFER, and the second transaction gets moved to thread->todo 5) libbinder's handlePolledCommands() only handles the commands in the current data buffer, so doesn't see the new transaction 6) the server continues running and issues a new outgoing transaction. Now, it suddenly finds the incoming oneway transaction on its thread todo, and returns that to userspace. 7) userspace does not expect this to happen; it may be holding a lock while making the outgoing transaction, and if handling the incoming trasnaction requires taking the same lock, userspace will deadlock. By queueing the async transaction to the proc workqueue, we make sure it's only picked up when a thread is ready for proc work. Bug: 38201220 Bug: 63075553 Bug: 63079216 Change-Id: I84268cc112f735d7e3173793873dfdb4b268468b Signed-off-by: Martijn Coenen <maco@android.com>
2017-08-11ANDROID: binder: call poll_wait() unconditionally.Martijn Coenen
Because we're not guaranteed that subsequent calls to poll() will have a poll_table_struct parameter with _qproc set. When _qproc is not set, poll_wait() is a noop, and we won't be woken up correctly. Bug: 64552728 Change-Id: I5b904c9886b6b0994d1631a636f5c5e5f6327950 Test: binderLibTest stops hanging with new test Signed-off-by: Martijn Coenen <maco@android.com>
2017-08-11ANDROID: binder: don't enqueue death notifications to thread todo.Martijn Coenen
This allows userspace to request death notifications without having to worry about getting an immediate callback on the same thread; one scenario where this would be problematic is if the death recipient handler grabs a lock that was already taken earlier (eg as part of a nested transaction). Bug: 23525545 Test: binderLibTest.DeathNotificationThread passes Change-Id: I955e16306fe3110dacb9a391ffff1bf869249495 Signed-off-by: Martijn Coenen <maco@android.com>
2017-08-11ANDROID: binder: Don't BUG_ON(!spin_is_locked()).Martijn Coenen
Because is_spin_locked() always returns false on UP systems. Use assert_spin_locked() instead, and remove the WARN_ON() instances, since those were easy to verify. Bug: 64073116 Change-Id: I9080991c6d67e91928282a3ee64db23e50c7d66a Signed-off-by: Martijn Coenen <maco@android.com>
2017-08-11ANDROID: binder: don't check prio permissions on restore.Martijn Coenen
Because we have disabled RT priority inheritance for the regular binder domain, the following can happen: 1) thread A (prio 98) calls into thread B 2) because RT prio inheritance is disabled, thread B runs at the lowest nice (prio 100) instead 3) thread B calls back into A; A will run at prio 100 for the duration of the transaction 4) When thread A is done with the call from B, we will try to restore the prio back to 98. But, we fail because the process doesn't hold CAP_SYS_NICE, neither is RLIMIT_RT_PRIO set. While the proper fix going forward will be to correctly apply CAP_SYS_NICE or RLIMIT_RT_PRIO, for now it seems reasonable to not check permissions on the restore path. Change-Id: Ibede5960c9b7bb786271c001e405de50be64d944 Signed-off-by: Martijn Coenen <maco@android.com>
2017-08-11Add BINDER_GET_NODE_DEBUG_INFO ioctlColin Cross
The BINDER_GET_NODE_DEBUG_INFO ioctl will return debug info on a node. Each successive call reusing the previous return value will return the next node. The data will be used by libmemunreachable to mark the pointers with kernel references as reachable. Bug: 28275695 Change-Id: Idbbafa648a33822dc023862cd92b51a595cf7c1c Signed-off-by: Colin Cross <ccross@android.com> Signed-off-by: Martijn Coenen <maco@android.com>
2017-08-11ANDROID: binder: add RT inheritance flag to node.Martijn Coenen
Allows a binder node to specify whether it wants to inherit real-time scheduling policy from a caller. Change-Id: I375b6094bf441c19f19cba06d5a6be02cd07d714 Signed-off-by: Martijn Coenen <maco@android.com>
2017-08-11ANDROID: binder: improve priority inheritance.Martijn Coenen
By raising the priority of a thread selected for a transaction *before* we wake it up. Delay restoring the priority when doing a reply until after we wake-up the process receiving the reply. Change-Id: Ic332e4e0ed7d2d3ca6ab1034da4629c9eadd3405 Signed-off-by: Martijn Coenen <maco@google.com>
2017-08-11ANDROID: binder: add min sched_policy to node.Martijn Coenen
This change adds flags to flat_binder_object.flags to allow indicating a minimum scheduling policy for the node. It also clarifies the valid value range for the priority bits in the flags. Internally, we use the priority map that the kernel uses, e.g. [0..99] for real-time policies and [100..139] for the SCHED_NORMAL/SCHED_BATCH policies. Bug: 34461621 Bug: 37293077 Change-Id: I12438deecb53df432da18c6fc77460768ae726d2 Signed-off-by: Martijn Coenen <maco@google.com>
2017-08-11ANDROID: binder: add support for RT prio inheritance.Martijn Coenen
Adds support for SCHED_BATCH/SCHED_FIFO/SCHED_RR priority inheritance. Change-Id: I71f356e476be2933713a0ecfa2cc31aa141e2dc6 Signed-off-by: Martijn Coenen <maco@google.com>
2017-08-11ANDROID: binder: push new transactions to waiting threads.Martijn Coenen
Instead of pushing new transactions to the process waitqueue, select a thread that is waiting on proc work to handle the transaction. This will make it easier to improve priority inheritance in future patches, by setting the priority before we wake up a thread. If we can't find a waiting thread, submit the work to the proc waitqueue instead as we did previously. Change-Id: I23cbfcca867bed7b86007e22137d0a8fad4b4001 Signed-off-by: Martijn Coenen <maco@google.com>
2017-08-11ANDROID: binder: remove proc waitqueueMartijn Coenen
Removes the process waitqueue, so that threads can only wait on the thread waitqueue. Whenever there is process work to do, pick a thread and wake it up. This also fixes an issue with using epoll(), since we no longer have to block on different waitqueues. Bug: 34461621 Change-Id: I2950b9de6fa078ee72d53c667a03cbaf587f0849 Signed-off-by: Martijn Coenen <maco@google.com>
2017-08-11FROMLIST: binder: remove global binder lockTodd Kjos
(from https://patchwork.kernel.org/patch/9817773/) Remove global mutex and rely on fine-grained locking Change-Id: Idd1ae2e52d654e5dd76d443a1ff97522e687fd4c Signed-off-by: Todd Kjos <tkjos@google.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-10 23:55:54 +0000