Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 41bd774c authored by Prasad Sodagudi's avatar Prasad Sodagudi
Browse files

Merge remote-tracking branch 'origin/tmp-ddb5463c' into msm-next 



* origin/tmp-ddb5463c:
  ANDROID: binder: sched_param: Include uapi/linux/sched/types.h
  ANDROID: check dir value of xfrm_userpolicy_id
  ANDROID: NFC: Fix possible memory corruption when handling SHDLC I-Frame commands
  ANDROID: nfc: fdp: Fix possible buffer overflow in WCS4000 NFC driver
  ANDROID: NFC: st21nfca: Fix out of bounds kernel access when handling ATR_REQ
  ANDROID: usb: gadget: assign no-op request complete callbacks
  ANDROID: usb: gadget: configfs: fix null ptr in android_disconnect
  ANDROID: uid_sys_stats: Fix implicit declaration of get_cmdline()
  ANDROID: uid_sys_stats: log task io with a debug flag
  ANDROID: Use sk_uid to replace uid get from socket file
  ANDROID: keychord: Fix for a memory leak in keychord.
  ANDROID: keychord: Fix races in keychord_write.
  ANDROID: binder: don't queue async transactions to thread.
  ANDROID: binder: call poll_wait() unconditionally.
  ANDROID: binder: don't enqueue death notifications to thread todo.
  android: configs: move quota-related configs to recommended
  ANDROID: sdcardfs: override credential for ioctl to lower fs
  ANDROID: xt_qtaguid: handle properly request sockets
  ANDROID: cpufreq: interactive governor drops bits in time calculation
  ANDROID: Use %zu to print resid (size_t).
  ANDROID: binder: Don't BUG_ON(!spin_is_locked()).
  ANDROID: keychord: Fix a slab out-of-bounds read.
  Revert "ANDROID: proc: smaps: Allow smaps access for CAP_SYS_RESOURCE"
  ANDROID: android-verity: mark dev as rw for linear target
  ANDROID: sdcardfs: Remove unnecessary lock
  ANDROID: binder: don't check prio permissions on restore.
  ANDROID: Add BINDER_GET_NODE_DEBUG_INFO ioctl
  ANDROID: binder: add RT inheritance flag to node.
  ANDROID: binder: improve priority inheritance.
  ANDROID: binder: add min sched_policy to node.
  ANDROID: binder: add support for RT prio inheritance.
  ANDROID: binder: push new transactions to waiting threads.
  ANDROID: binder: remove proc waitqueue
  FROMLIST: binder: remove global binder lock
  FROMLIST: binder: fix death race conditions
  FROMLIST: binder: protect against stale pointers in print_binder_transaction
  FROMLIST: binder: protect binder_ref with outer lock
  FROMLIST: binder: use inner lock to protect thread accounting
  FROMLIST: binder: protect transaction_stack with inner lock.
  FROMLIST: binder: protect proc->threads with inner_lock
  FROMLIST: binder: protect proc->nodes with inner lock
  FROMLIST: binder: add spinlock to protect binder_node
  FROMLIST: binder: add spinlocks to protect todo lists
  FROMLIST: binder: use inner lock to sync work dq and node counts
  FROMLIST: binder: introduce locking helper functions
  FROMLIST: binder: use node->tmp_refs to ensure node safety
  FROMLIST: binder: refactor binder ref inc/dec for thread safety
  FROMLIST: binder: make sure accesses to proc/thread are safe
  FROMLIST: binder: make sure target_node has strong ref
  FROMLIST: binder: guarantee txn complete / errors delivered in-order
  FROMLIST: binder: refactor binder_pop_transaction
  FROMLIST: binder: use atomic for transaction_log index
  FROMLIST: binder: add more debug info when allocation fails.
  FROMLIST: binder: protect against two threads freeing buffer
  FROMLIST: binder: remove dead code in binder_get_ref_for_node
  FROMLIST: binder: don't modify thread->looper from other threads
  FROMLIST: binder: avoid race conditions when enqueuing txn
  FROMLIST: binder: refactor queue management in binder_thread_read
  FROMLIST: binder: add log information for binder transaction failures
  FROMLIST: binder: make binder_last_id an atomic
  FROMLIST: binder: change binder_stats to atomics
  FROMLIST: binder: add protection for non-perf cases
  FROMLIST: binder: remove binder_debug_no_lock mechanism
  FROMLIST: binder: move binder_alloc to separate file
  FROMLIST: binder: separate out binder_alloc functions
  FROMLIST: binder: remove unneeded cleanup code
  FROMLIST: binder: separate binder allocator structure from binder proc

Change-Id: I23c21ac3b02d6fc00ab5d5e7507c7379cc8a2502
Signed-off-by: default avatarPrasad Sodagudi <psodagud@codeaurora.org>
parents f8aab440 ddb5463c

drivers/android/Makefile

+1 −1
Original line number Diff line number Diff line 
ccflags-y += -I$(src)			# needed for trace events



obj-$(CONFIG_ANDROID_BINDER_IPC)	+= binder.o
 
obj-$(CONFIG_ANDROID_BINDER_IPC)	+= binder.o binder_alloc.o

drivers/android/binder.c

+2644 −1239

File changed.

Preview size limit exceeded, changes collapsed.

drivers/android/binder_alloc.c

0 → 100644
+802 −0

File added.

Preview size limit exceeded, changes collapsed.

drivers/android/binder_alloc.h

0 → 100644
+163 −0
Original line number Diff line number Diff line 
/*

 * Copyright (C) 2017 Google, Inc.

 *

 * This software is licensed under the terms of the GNU General Public

 * License version 2, as published by the Free Software Foundation, and

 * may be copied, distributed, and modified under those terms.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 */



#ifndef _LINUX_BINDER_ALLOC_H

#define _LINUX_BINDER_ALLOC_H



#include <linux/rbtree.h>

#include <linux/list.h>

#include <linux/mm.h>

#include <linux/rtmutex.h>

#include <linux/vmalloc.h>

#include <linux/slab.h>



struct binder_transaction;



/**

 * struct binder_buffer - buffer used for binder transactions

 * @entry:              entry alloc->buffers

 * @rb_node:            node for allocated_buffers/free_buffers rb trees

 * @free:               true if buffer is free

 * @allow_user_free:    describe the second member of struct blah,

 * @async_transaction:  describe the second member of struct blah,

 * @debug_id:           describe the second member of struct blah,

 * @transaction:        describe the second member of struct blah,

 * @target_node:        describe the second member of struct blah,

 * @data_size:          describe the second member of struct blah,

 * @offsets_size:       describe the second member of struct blah,

 * @extra_buffers_size: describe the second member of struct blah,

 * @data:i              describe the second member of struct blah,

 *

 * Bookkeeping structure for binder transaction buffers

 */

struct binder_buffer {

	struct list_head entry; /* free and allocated entries by address */

	struct rb_node rb_node; /* free entry by size or allocated entry */

				/* by address */

	unsigned free:1;

	unsigned allow_user_free:1;

	unsigned async_transaction:1;

	unsigned free_in_progress:1;

	unsigned debug_id:28;



	struct binder_transaction *transaction;



	struct binder_node *target_node;

	size_t data_size;

	size_t offsets_size;

	size_t extra_buffers_size;

	uint8_t data[0];

};



/**

 * struct binder_alloc - per-binder proc state for binder allocator

 * @vma:                vm_area_struct passed to mmap_handler

 *                      (invarient after mmap)

 * @tsk:                tid for task that called init for this proc

 *                      (invariant after init)

 * @vma_vm_mm:          copy of vma->vm_mm (invarient after mmap)

 * @buffer:             base of per-proc address space mapped via mmap

 * @user_buffer_offset: offset between user and kernel VAs for buffer

 * @buffers:            list of all buffers for this proc

 * @free_buffers:       rb tree of buffers available for allocation

 *                      sorted by size

 * @allocated_buffers:  rb tree of allocated buffers sorted by address

 * @free_async_space:   VA space available for async buffers. This is

 *                      initialized at mmap time to 1/2 the full VA space

 * @pages:              array of physical page addresses for each

 *                      page of mmap'd space

 * @buffer_size:        size of address space specified via mmap

 * @pid:                pid for associated binder_proc (invariant after init)

 *

 * Bookkeeping structure for per-proc address space management for binder

 * buffers. It is normally initialized during binder_init() and binder_mmap()

 * calls. The address space is used for both user-visible buffers and for

 * struct binder_buffer objects used to track the user buffers

 */

struct binder_alloc {

	struct mutex mutex;

	struct task_struct *tsk;

	struct vm_area_struct *vma;

	struct mm_struct *vma_vm_mm;

	void *buffer;

	ptrdiff_t user_buffer_offset;

	struct list_head buffers;

	struct rb_root free_buffers;

	struct rb_root allocated_buffers;

	size_t free_async_space;

	struct page **pages;

	size_t buffer_size;

	uint32_t buffer_free;

	int pid;

};



extern struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc,

						  size_t data_size,

						  size_t offsets_size,

						  size_t extra_buffers_size,

						  int is_async);

extern void binder_alloc_init(struct binder_alloc *alloc);

extern void binder_alloc_vma_close(struct binder_alloc *alloc);

extern struct binder_buffer *

binder_alloc_prepare_to_free(struct binder_alloc *alloc,

			     uintptr_t user_ptr);

extern void binder_alloc_free_buf(struct binder_alloc *alloc,

				  struct binder_buffer *buffer);

extern int binder_alloc_mmap_handler(struct binder_alloc *alloc,

				     struct vm_area_struct *vma);

extern void binder_alloc_deferred_release(struct binder_alloc *alloc);

extern int binder_alloc_get_allocated_count(struct binder_alloc *alloc);

extern void binder_alloc_print_allocated(struct seq_file *m,

					 struct binder_alloc *alloc);



/**

 * binder_alloc_get_free_async_space() - get free space available for async

 * @alloc:	binder_alloc for this proc

 *

 * Return:	the bytes remaining in the address-space for async transactions

 */

static inline size_t

binder_alloc_get_free_async_space(struct binder_alloc *alloc)

{

	size_t free_async_space;



	mutex_lock(&alloc->mutex);

	free_async_space = alloc->free_async_space;

	mutex_unlock(&alloc->mutex);

	return free_async_space;

}



/**

 * binder_alloc_get_user_buffer_offset() - get offset between kernel/user addrs

 * @alloc:	binder_alloc for this proc

 *

 * Return:	the offset between kernel and user-space addresses to use for

 * virtual address conversion

 */

static inline ptrdiff_t

binder_alloc_get_user_buffer_offset(struct binder_alloc *alloc)

{

	/*

	 * user_buffer_offset is constant if vma is set and

	 * undefined if vma is not set. It is possible to

	 * get here with !alloc->vma if the target process

	 * is dying while a transaction is being initiated.

	 * Returning the old value is ok in this case and

	 * the transaction will fail.

	 */

	return alloc->user_buffer_offset;

}



#endif /* _LINUX_BINDER_ALLOC_H */

drivers/android/binder_trace.h

+22 −19
Original line number Diff line number Diff line
@@ -23,7 +23,8 @@ 
struct binder_buffer;

struct binder_node;

struct binder_proc;

struct binder_ref;

struct binder_alloc;

struct binder_ref_data;

struct binder_thread;

struct binder_transaction;
@@ -146,8 +147,8 @@ TRACE_EVENT(binder_transaction_received, 


TRACE_EVENT(binder_transaction_node_to_ref,

	TP_PROTO(struct binder_transaction *t, struct binder_node *node,

		 struct binder_ref *ref),

	TP_ARGS(t, node, ref),

		 struct binder_ref_data *rdata),

	TP_ARGS(t, node, rdata),



	TP_STRUCT__entry(

		__field(int, debug_id)
@@ -160,8 +161,8 @@ TRACE_EVENT(binder_transaction_node_to_ref, 
		__entry->debug_id = t->debug_id;

		__entry->node_debug_id = node->debug_id;

		__entry->node_ptr = node->ptr;

		__entry->ref_debug_id = ref->debug_id;

		__entry->ref_desc = ref->desc;

		__entry->ref_debug_id = rdata->debug_id;

		__entry->ref_desc = rdata->desc;

	),

	TP_printk("transaction=%d node=%d src_ptr=0x%016llx ==> dest_ref=%d dest_desc=%d",

		  __entry->debug_id, __entry->node_debug_id,
@@ -170,8 +171,9 @@ TRACE_EVENT(binder_transaction_node_to_ref, 
);



TRACE_EVENT(binder_transaction_ref_to_node,

	TP_PROTO(struct binder_transaction *t, struct binder_ref *ref),

	TP_ARGS(t, ref),

	TP_PROTO(struct binder_transaction *t, struct binder_node *node,

		 struct binder_ref_data *rdata),

	TP_ARGS(t, node, rdata),



	TP_STRUCT__entry(

		__field(int, debug_id)
@@ -182,10 +184,10 @@ TRACE_EVENT(binder_transaction_ref_to_node, 
	),

	TP_fast_assign(

		__entry->debug_id = t->debug_id;

		__entry->ref_debug_id = ref->debug_id;

		__entry->ref_desc = ref->desc;

		__entry->node_debug_id = ref->node->debug_id;

		__entry->node_ptr = ref->node->ptr;

		__entry->ref_debug_id = rdata->debug_id;

		__entry->ref_desc = rdata->desc;

		__entry->node_debug_id = node->debug_id;

		__entry->node_ptr = node->ptr;

	),

	TP_printk("transaction=%d node=%d src_ref=%d src_desc=%d ==> dest_ptr=0x%016llx",

		  __entry->debug_id, __entry->node_debug_id,
@@ -194,9 +196,10 @@ TRACE_EVENT(binder_transaction_ref_to_node, 
);



TRACE_EVENT(binder_transaction_ref_to_ref,

	TP_PROTO(struct binder_transaction *t, struct binder_ref *src_ref,

		 struct binder_ref *dest_ref),

	TP_ARGS(t, src_ref, dest_ref),

	TP_PROTO(struct binder_transaction *t, struct binder_node *node,

		 struct binder_ref_data *src_ref,

		 struct binder_ref_data *dest_ref),

	TP_ARGS(t, node, src_ref, dest_ref),



	TP_STRUCT__entry(

		__field(int, debug_id)
@@ -208,7 +211,7 @@ TRACE_EVENT(binder_transaction_ref_to_ref, 
	),

	TP_fast_assign(

		__entry->debug_id = t->debug_id;

		__entry->node_debug_id = src_ref->node->debug_id;

		__entry->node_debug_id = node->debug_id;

		__entry->src_ref_debug_id = src_ref->debug_id;

		__entry->src_ref_desc = src_ref->desc;

		__entry->dest_ref_debug_id = dest_ref->debug_id;
@@ -268,9 +271,9 @@ DEFINE_EVENT(binder_buffer_class, binder_transaction_failed_buffer_release, 
	TP_ARGS(buffer));



TRACE_EVENT(binder_update_page_range,

	TP_PROTO(struct binder_proc *proc, bool allocate,

	TP_PROTO(struct binder_alloc *alloc, bool allocate,

		 void *start, void *end),

	TP_ARGS(proc, allocate, start, end),

	TP_ARGS(alloc, allocate, start, end),

	TP_STRUCT__entry(

		__field(int, proc)

		__field(bool, allocate)
@@ -278,9 +281,9 @@ TRACE_EVENT(binder_update_page_range, 
		__field(size_t, size)

	),

	TP_fast_assign(

		__entry->proc = proc->pid;

		__entry->proc = alloc->pid;

		__entry->allocate = allocate;

		__entry->offset = start - proc->buffer;

		__entry->offset = start - alloc->buffer;

		__entry->size = end - start;

	),

	TP_printk("proc=%d allocate=%d offset=%zu size=%zu",