17 Mar, 2017

1 commit

  • As AOSP master is now starting to require a hwbinder device, add it to
    the the default Kconfig. Having the hwbinder device when not needed
    shouldn't hurt anything either.

    Cc: Greg Kroah-Hartman
    Cc: John Stultz
    Cc: Martijn Coenen
    Cc: Arve Hjønnevåg
    Cc: Amit Pundir
    Cc: Serban Constantinescu
    Cc: Dmitry Shmidt
    Cc: Rom Lemarchand
    Cc: Android Kernel Team
    Signed-off-by: Rob Herring
    Signed-off-by: Greg Kroah-Hartman

    Rob Herring
     

02 Mar, 2017

2 commits

  • We are going to split out of , which
    will have to be picked up from other headers and a couple of .c files.

    Create a trivial placeholder file that just
    maps to to make this patch obviously correct and
    bisectable.

    Include the new header in the files that are going to need it.

    Acked-by: Linus Torvalds
    Cc: Mike Galbraith
    Cc: Peter Zijlstra
    Cc: Thomas Gleixner
    Cc: linux-kernel@vger.kernel.org
    Signed-off-by: Ingo Molnar

    Ingo Molnar
     
  • We are going to split out of , which
    will have to be picked up from other headers and a couple of .c files.

    Create a trivial placeholder file that just
    maps to to make this patch obviously correct and
    bisectable.

    The APIs that are going to be moved first are:

    mm_alloc()
    __mmdrop()
    mmdrop()
    mmdrop_async_fn()
    mmdrop_async()
    mmget_not_zero()
    mmput()
    mmput_async()
    get_task_mm()
    mm_access()
    mm_release()

    Include the new header in the files that are going to need it.

    Acked-by: Linus Torvalds
    Cc: Mike Galbraith
    Cc: Peter Zijlstra
    Cc: Thomas Gleixner
    Cc: linux-kernel@vger.kernel.org
    Signed-off-by: Ingo Molnar

    Ingo Molnar
     

25 Feb, 2017

1 commit

  • ->fault(), ->page_mkwrite(), and ->pfn_mkwrite() calls do not need to
    take a vma and vmf parameter when the vma already resides in vmf.

    Remove the vma parameter to simplify things.

    [arnd@arndb.de: fix ARM build]
    Link: http://lkml.kernel.org/r/20170125223558.1451224-1-arnd@arndb.de
    Link: http://lkml.kernel.org/r/148521301778.19116.10840599906674778980.stgit@djiang5-desk3.ch.intel.com
    Signed-off-by: Dave Jiang
    Signed-off-by: Arnd Bergmann
    Reviewed-by: Ross Zwisler
    Cc: Theodore Ts'o
    Cc: Darrick J. Wong
    Cc: Matthew Wilcox
    Cc: Dave Hansen
    Cc: Christoph Hellwig
    Cc: Jan Kara
    Cc: Dan Williams
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Dave Jiang
     

23 Feb, 2017

1 commit

  • There's no users of zap_page_range() who wants non-NULL 'details'.
    Let's drop it.

    Link: http://lkml.kernel.org/r/20170118122429.43661-3-kirill.shutemov@linux.intel.com
    Signed-off-by: Kirill A. Shutemov
    Acked-by: Michal Hocko
    Cc: Tetsuo Handa
    Cc: Peter Zijlstra
    Cc: Rik van Riel
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Kirill A. Shutemov
     

10 Feb, 2017

8 commits

  • This patch introduces a new binder_fd_array object,
    that allows us to support one or more file descriptors
    embedded in a buffer that is scatter-gathered.

    Cc: Greg Kroah-Hartman
    Cc: Martijn Coenen
    Cc: Arve Hjønnevåg
    Cc: Amit Pundir
    Cc: Serban Constantinescu
    Cc: Dmitry Shmidt
    Cc: Rom Lemarchand
    Cc: Android Kernel Team
    Signed-off-by: Martijn Coenen
    Signed-off-by: John Stultz
    Signed-off-by: Greg Kroah-Hartman

    Martijn Coenen
     
  • Previously all data passed over binder needed
    to be serialized, with the exception of Binder
    objects and file descriptors.

    This patchs adds support for scatter-gathering raw
    memory buffers into a binder transaction, avoiding
    the need to first serialize them into a Parcel.

    To remain backwards compatibile with existing
    binder clients, it introduces two new command
    ioctls for this purpose - BC_TRANSACTION_SG and
    BC_REPLY_SG. These commands may only be used with
    the new binder_transaction_data_sg structure,
    which adds a field for the total size of the
    buffers we are scatter-gathering.

    Because memory buffers may contain pointers to
    other buffers, we allow callers to specify
    a parent buffer and an offset into it, to indicate
    this is a location pointing to the buffer that
    we are fixing up. The kernel will then take care
    of fixing up the pointer to that buffer as well.

    Cc: Greg Kroah-Hartman
    Cc: Martijn Coenen
    Cc: Arve Hjønnevåg
    Cc: Amit Pundir
    Cc: Serban Constantinescu
    Cc: Dmitry Shmidt
    Cc: Rom Lemarchand
    Cc: Android Kernel Team
    Signed-off-by: Martijn Coenen
    [jstultz: Fold in small fix from Amit Pundir ]
    Signed-off-by: John Stultz
    Signed-off-by: Greg Kroah-Hartman

    Martijn Coenen
     
  • The binder_buffer allocator currently only allocates
    space for the data and offsets buffers of a Parcel.
    This change allows for requesting an additional chunk
    of data in the buffer, which can for example be used
    to hold additional meta-data about the transaction
    (eg a security context).

    Cc: Greg Kroah-Hartman
    Cc: Martijn Coenen
    Cc: Arve Hjønnevåg
    Cc: Amit Pundir
    Cc: Serban Constantinescu
    Cc: Dmitry Shmidt
    Cc: Rom Lemarchand
    Cc: Android Kernel Team
    Signed-off-by: Martijn Coenen
    Signed-off-by: John Stultz
    Signed-off-by: Greg Kroah-Hartman

    Martijn Coenen
     
  • Moved handling of fixup for binder objects,
    handles and file descriptors into separate
    functions.

    Cc: Greg Kroah-Hartman
    Cc: Martijn Coenen
    Cc: Arve Hjønnevåg
    Cc: Amit Pundir
    Cc: Serban Constantinescu
    Cc: Dmitry Shmidt
    Cc: Rom Lemarchand
    Cc: Android Kernel Team
    Signed-off-by: Martijn Coenen
    Signed-off-by: John Stultz
    Signed-off-by: Greg Kroah-Hartman

    Martijn Coenen
     
  • Add a new module parameter 'devices', that can be
    used to specify the names of the binder device
    nodes we want to populate in /dev.

    Each device node has its own context manager, and
    is therefore logically separated from all the other
    device nodes.

    The config option CONFIG_ANDROID_BINDER_DEVICES can
    be used to set the default value of the parameter.

    This approach was favored over using IPC namespaces,
    mostly because we require a single process to be a
    part of multiple binder contexts, which seemed harder
    to achieve with namespaces.

    Cc: Greg Kroah-Hartman
    Cc: Martijn Coenen
    Cc: Arve Hjønnevåg
    Cc: Amit Pundir
    Cc: Serban Constantinescu
    Cc: Dmitry Shmidt
    Cc: Rom Lemarchand
    Cc: Android Kernel Team
    Signed-off-by: Martijn Coenen
    [jstultz: minor checkpatch warning fix]
    Signed-off-by: John Stultz
    Signed-off-by: Greg Kroah-Hartman

    Martijn Coenen
     
  • Properly print the context in debugfs entries.

    Cc: Greg Kroah-Hartman
    Cc: Martijn Coenen
    Cc: Arve Hjønnevåg
    Cc: Amit Pundir
    Cc: Serban Constantinescu
    Cc: Dmitry Shmidt
    Cc: Rom Lemarchand
    Cc: Android Kernel Team
    Signed-off-by: Martijn Coenen
    Signed-off-by: John Stultz
    Signed-off-by: Greg Kroah-Hartman

    Martijn Coenen
     
  • Move the context manager state into a separate
    struct context, and allow for each process to have
    its own context associated with it.

    Cc: Greg Kroah-Hartman
    Cc: Martijn Coenen
    Cc: Arve Hjønnevåg
    Cc: Amit Pundir
    Cc: Serban Constantinescu
    Cc: Dmitry Shmidt
    Cc: Rom Lemarchand
    Cc: Android Kernel Team
    Signed-off-by: Martijn Coenen
    [jstultz: Minor checkpatch fix]
    Signed-off-by: John Stultz
    Signed-off-by: Greg Kroah-Hartman

    Martijn Coenen
     
  • flat_binder_object is used for both handling
    binder objects and file descriptors, even though
    the two are mostly independent. Since we'll
    have more fixup objects in binder in the future,
    instead of extending flat_binder_object again,
    split out file descriptors to their own object
    while retaining backwards compatibility to
    existing user-space clients. All binder objects
    just share a header.

    Cc: Greg Kroah-Hartman
    Cc: Martijn Coenen
    Cc: Arve Hjønnevåg
    Cc: Amit Pundir
    Cc: Serban Constantinescu
    Cc: Dmitry Shmidt
    Cc: Rom Lemarchand
    Cc: Android Kernel Team
    Signed-off-by: Martijn Coenen
    Signed-off-by: John Stultz
    Signed-off-by: Greg Kroah-Hartman

    Martijn Coenen
     

25 Oct, 2016

2 commits


15 Aug, 2016

1 commit

  • The workqueue is being used to run deferred work for the android binder.

    The "binder_deferred_workqueue" queues only a single work item and hence
    does not require ordering. Also, this workqueue is not being used on a
    memory recliam path. Hence, the singlethreaded workqueue has been
    replaced with the use of system_wq.

    System workqueues have been able to handle high level of concurrency
    for a long time now and hence it's not required to have a singlethreaded
    workqueue just to gain concurrency. Unlike a dedicated per-cpu workqueue
    created with create_singlethread_workqueue(), system_wq allows multiple
    work items to overlap executions even on the same CPU; however, a
    per-cpu workqueue doesn't have any CPU locality or global ordering
    guarantee unless the target CPU is explicitly specified and thus the
    increase of local concurrency shouldn't make any difference.

    Signed-off-by: Bhaktipriya Shridhar
    Signed-off-by: Greg Kroah-Hartman

    Bhaktipriya Shridhar
     

02 Mar, 2016

1 commit


23 Feb, 2016

1 commit


21 Feb, 2016

1 commit

  • There's one point was missed in the patch commit da49889deb34 ("staging:
    binder: Support concurrent 32 bit and 64 bit processes."). When configure
    BINDER_IPC_32BIT, the size of binder_uintptr_t was 32bits, but size of
    void * is 64bit on 64bit system. Correct it here.

    Signed-off-by: Lisa Du
    Signed-off-by: Nicolas Boichat
    Fixes: da49889deb34 ("staging: binder: Support concurrent 32 bit and 64 bit processes.")
    Cc:
    Acked-by: Olof Johansson
    Signed-off-by: Greg Kroah-Hartman

    Lisa Du
     

12 Feb, 2016

2 commits

  • If a /d/binder/proc/[pid] entry is kept open after linux has
    torn down the associated process, binder_proc_show can deference
    an invalid binder_proc that has been stashed in the debugfs
    inode. Validate that the binder_proc ptr passed into binder_proc_show
    has not been freed by looking for it within the global process list
    whilst the global lock is held. If the ptr is not valid, print nothing.

    Cc: Colin Cross
    Cc: Arve Hjønnevåg
    Cc: Dmitry Shmidt
    Cc: Rom Lemarchand
    Cc: Serban Constantinescu
    Cc: Greg Kroah-Hartman
    Cc: Android Kernel Team
    Signed-off-by: Dmitry Shmidt
    [jstultz: Minor commit message tweaks]
    Signed-off-by: John Stultz
    Signed-off-by: Greg Kroah-Hartman

    Riley Andrews
     
  • Make sure offsets don't point to overlapping flat_binder_object
    structs.

    Cc: Colin Cross
    Cc: Arve Hjønnevåg
    Cc: Dmitry Shmidt
    Cc: Rom Lemarchand
    Cc: Serban Constantinescu
    Cc: Greg Kroah-Hartman
    Cc: Android Kernel Team
    Signed-off-by: Dmitry Shmidt
    Signed-off-by: John Stultz
    Signed-off-by: Greg Kroah-Hartman

    Arve Hjønnevåg
     

08 Feb, 2016

1 commit

  • Sanity check at binder ioctl function,
    Only allow the shared mm_struct to use the same binder-object
    to do binder operate.

    And add proc->vma_vm_mm = current->mm at the open function.
    The libbinder do ioctl before mmap called.

    V2: Fix compile error for error commit
    V3: Change the condition to proc->vma_vm_mm

    Signed-off-by: Chen Feng
    Signed-off-by: Wei Dong
    Signed-off-by: Junmin Zhao
    Reviewed-by: Zhuangluan Su
    Signed-off-by: Greg Kroah-Hartman

    Chen Feng
     

11 Sep, 2015

1 commit

  • With two exceptions (drm/qxl and drm/radeon) all vm_operations_struct
    structs should be constant.

    Signed-off-by: Kirill A. Shutemov
    Reviewed-by: Oleg Nesterov
    Cc: "H. Peter Anvin"
    Cc: Andy Lutomirski
    Cc: Dave Hansen
    Cc: Ingo Molnar
    Cc: Minchan Kim
    Cc: Thomas Gleixner
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Kirill A. Shutemov
     

02 Mar, 2015

1 commit

  • binder_update_page_range() initializes only addr and size
    fields in 'struct vm_struct tmp_area;' and passes it to
    map_vm_area().

    Before 71394fe50146 ("mm: vmalloc: add flag preventing guard hole allocation")
    this was because map_vm_area() didn't use any other fields
    in vm_struct except addr and size.

    Now get_vm_area_size() (used in map_vm_area()) reads vm_struct's
    flags to determine whether vm area has guard hole or not.

    binder_update_page_range() don't initialize flags field, so
    this causes following binder mmap failures:
    -----------[ cut here ]------------
    WARNING: CPU: 0 PID: 1971 at mm/vmalloc.c:130
    vmap_page_range_noflush+0x119/0x144()
    CPU: 0 PID: 1971 Comm: healthd Not tainted 4.0.0-rc1-00399-g7da3fdc-dirty #157
    Hardware name: ARM-Versatile Express
    [] (unwind_backtrace) from [] (show_stack+0x11/0x14)
    [] (show_stack) from [] (dump_stack+0x59/0x7c)
    [] (dump_stack) from [] (warn_slowpath_common+0x55/0x84)
    [] (warn_slowpath_common) from []
    (warn_slowpath_null+0x17/0x1c)
    [] (warn_slowpath_null) from []
    (vmap_page_range_noflush+0x119/0x144)
    [] (vmap_page_range_noflush) from [] (map_vm_area+0x27/0x48)
    [] (map_vm_area) from []
    (binder_update_page_range+0x12f/0x27c)
    [] (binder_update_page_range) from []
    (binder_mmap+0xbf/0x1ac)
    [] (binder_mmap) from [] (mmap_region+0x2eb/0x4d4)
    [] (mmap_region) from [] (do_mmap_pgoff+0x1e7/0x250)
    [] (do_mmap_pgoff) from [] (vm_mmap_pgoff+0x45/0x60)
    [] (vm_mmap_pgoff) from [] (SyS_mmap_pgoff+0x5d/0x80)
    [] (SyS_mmap_pgoff) from [] (ret_fast_syscall+0x1/0x5c)
    ---[ end trace 48c2c4b9a1349e54 ]---
    binder: 1982: binder_alloc_buf failed to map page at f0e00000 in kernel
    binder: binder_mmap: 1982 b6bde000-b6cdc000 alloc small buf failed -12

    Use map_kernel_range_noflush() instead of map_vm_area() as this is better
    API for binder's purposes and it allows to get rid of 'vm_struct tmp_area' at all.

    Fixes: 71394fe50146 ("mm: vmalloc: add flag preventing guard hole allocation")
    Signed-off-by: Andrey Ryabinin
    Reported-by: Amit Pundir
    Tested-by: Amit Pundir
    Acked-by: David Rientjes
    Tested-by: John Stultz
    Signed-off-by: Greg Kroah-Hartman

    Andrey Ryabinin
     

26 Jan, 2015

1 commit

  • Add security hooks to the binder and implement the hooks for SELinux.
    The security hooks enable security modules such as SELinux to implement
    controls over binder IPC. The security hooks include support for
    controlling what process can become the binder context manager
    (binder_set_context_mgr), controlling the ability of a process
    to invoke a binder transaction/IPC to another process (binder_transaction),
    controlling the ability of a process to transfer a binder reference to
    another process (binder_transfer_binder), and controlling the ability
    of a process to transfer an open file to another process (binder_transfer_file).

    These hooks have been included in the Android kernel trees since Android 4.3.

    (Updated to reflect upstream relocation and changes to the binder driver,
    changes to the LSM audit data structures, coding style cleanups, and
    to add inline documentation for the hooks).

    Signed-off-by: Stephen Smalley
    Acked-by: Nick Kralevich
    Acked-by: Jeffrey Vander Stoep
    Signed-off-by: Greg Kroah-Hartman

    Stephen Smalley
     

20 Oct, 2014

2 commits