aboutsummaryrefslogtreecommitdiff
path: root/drivers/android
Commit message (Collapse)AuthorAgeFilesLines
* Staging: android: binder: Ratelimit binder debug messagesChris Fries2019-05-021-1/+3
| | | | | | | | | | | | | Ratelimit the binder debug messages, since they can get spammy and flood the entire kernel log. In some cases, enabling serial console with a spammy binder error can cause a watchdog panic (and we don't have reports of this happening with serial console disabled). Bug: 17613664 Change-Id: Iecdb4c3c80ccf00c43459e93c17f5369fd55e6e7 Signed-off-by: Chris Fries <cfries@motorola.com>
* FROMLIST: ANDROID: binder: Add BINDER_GET_NODE_INFO_FOR_REF ioctl.Martijn Coenen2018-11-291-0/+55
| | | | | | | | | | | | | | This allows the context manager to retrieve information about nodes that it holds a reference to, such as the current number of references to those nodes. Such information can for example be used to determine whether the servicemanager is the only process holding a reference to a node. This information can then be passed on to the process holding the node, which can in turn decide whether it wants to shut down to reduce resource usage. Signed-off-by: Martijn Coenen <maco@android.com>
* UPSTREAM: binder: replace "%p" with "%pK"Todd Kjos2018-11-291-4/+4
| | | | | | | | | | | | The format specifier "%p" can leak kernel addresses. Use "%pK" instead. There were 4 remaining cases in binder.c. Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 8ca86f1639ec5890d400fff9211aca22d0a392eb) Change-Id: I309241853c53bcdfa65c17cb05876e786597afdd
* UPSTREAM: binder: free memory on errorChristian Brauner2018-11-291-2/+6
| | | | | | | | | | | | | On binder_init() the devices string is duplicated and smashed into individual device names which are passed along. However, the original duplicated string wasn't freed in case binder_init() failed. Let's free it on error. Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 22eb9476b5d80a393ac0ba235c42bccc90b82c76) Change-Id: I78fdeecf70c31ba4248b3de17130f97546288f84
* UPSTREAM: ANDROID: binder: change down_write to down_readMinchan Kim2018-11-292-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | binder_update_page_range needs down_write of mmap_sem because vm_insert_page need to change vma->vm_flags to VM_MIXEDMAP unless it is set. However, when I profile binder working, it seems every binder buffers should be mapped in advance by binder_mmap. It means we could set VM_MIXEDMAP in binder_mmap time which is already hold a mmap_sem as down_write so binder_update_page_range doesn't need to hold a mmap_sem as down_write. Please use proper API down_read. It would help mmap_sem contention problem as well as fixing down_write abuse. Ganesh Mahendran tested app launching and binder throughput test and he said he couldn't find any problem and I did binder latency test per Greg KH request(Thanks Martijn to teach me how I can do) I cannot find any problem, too. Cc: Ganesh Mahendran <opensource.ganesh@gmail.com> Cc: Joe Perches <joe@perches.com> Cc: Arve Hjønnevåg <arve@android.com> Cc: Todd Kjos <tkjos@google.com> Reviewed-by: Martijn Coenen <maco@android.com> Signed-off-by: Minchan Kim <minchan@kernel.org> Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 720c241924046aff83f5f2323232f34a30a4c281) Change-Id: I8358ceaaab4030f7122c95308dcad59557cad411
* UPSTREAM: ANDROID: binder: correct the cmd print for BINDER_WORK_RETURN_ERROR宋金时2018-11-291-0/+1
| | | | | | | | | | | | | | | When to execute binder_stat_br the e->cmd has been modifying as BR_OK instead of the original return error cmd, in fact we want to know the original return error, such as BR_DEAD_REPLY or BR_FAILED_REPLY, etc. instead of always BR_OK, in order to avoid the value of the e->cmd is always BR_OK, so we need assign the value of the e->cmd to cmd before e->cmd = BR_OK. Signed-off-by: songjinshi <songjinshi@xiaomi.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 838d5565669aa5bb7deb605684a5970d51d5eaf6) Change-Id: I425b32c5419a491c6b9ceee7c00dde6513e0421d
* UPSTREAM: ANDROID: binder: remove 32-bit binder interface.Martijn Coenen2018-11-292-18/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | New devices launching with Android P need to use the 64-bit binder interface, even on 32-bit SoCs [0]. This change removes the Kconfig option to select the 32-bit binder interface. We don't think this will affect existing userspace for the following reasons: 1) The latest Android common tree is 4.14, so we don't believe any Android devices are on kernels >4.14. 2) Android devices launch on an LTS release and stick with it, so we wouldn't expect devices running on <= 4.14 now to upgrade to 4.17 or later. But even if they did, they'd rebuild the world (kernel + userspace) anyway. 3) Other userspaces like 'anbox' are already using the 64-bit interface. Note that this change doesn't remove the 32-bit UAPI itself; the reason for that is that Android userspace always uses the latest UAPI headers from upstream, and userspace retains 32-bit support for devices that are upgrading. This will be removed as well in 2-3 years, at which point we can remove the code from the UAPI as well. Finally, this change introduces build errors on archs where 64-bit get_user/put_user is not supported, so make binder unavailable on m68k (which wouldn't want it anyway). [0]: https://android-review.googlesource.com/c/platform/build/+/595193 Signed-off-by: Martijn Coenen <maco@android.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 1190b4e38f97023154e6b3bef61b251aa5f970d0) Change-Id: I73dadf1d7b45a42bb18be5d5d3f5c090e61866de
* UPSTREAM: ANDROID: binder: re-order some conditionsDan Carpenter2018-11-291-2/+2
| | | | | | | | | | | | | | | | It doesn't make any difference to runtime but I've switched these two checks to make my static checker happy. The problem is that "buffer->data_size" is user controlled and if it's less than "sizeo(*hdr)" then that means "offset" can be more than "buffer->data_size". It's just cleaner to check it in the other order. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Martijn Coenen <maco@android.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 361f2ddbb0c9f9b4f336025a7bd0212cea4a34f0) Change-Id: I098d525ba63d125caa9840e6e1d5004bf70edc3c
* UPSTREAM: android: binder: use VM_ALLOC to get vm areaGanesh Mahendran2018-11-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | VM_IOREMAP is used to access hardware through a mechanism called I/O mapped memory. Android binder is a IPC machanism which will not access I/O memory. And VM_IOREMAP has alignment requiement which may not needed in binder. __get_vm_area_node() { ... if (flags & VM_IOREMAP) align = 1ul << clamp_t(int, fls_long(size), PAGE_SHIFT, IOREMAP_MAX_ORDER); ... } This patch will save some kernel vm area, especially for 32bit os. In 32bit OS, kernel vm area is only 240MB. We may got below error when launching a app: <3>[ 4482.440053] binder_alloc: binder_alloc_mmap_handler: 15728 8ce67000-8cf65000 get_vm_area failed -12 <3>[ 4483.218817] binder_alloc: binder_alloc_mmap_handler: 15745 8ce67000-8cf65000 get_vm_area failed -12 Signed-off-by: Ganesh Mahendran <opensource.ganesh@gmail.com> Acked-by: Martijn Coenen <maco@android.com> Acked-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> ---- V3: update comments V2: update comments Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit aac6830ec1cb681544212838911cdc57f2638216) Change-Id: Ide458abc6a4d3ec07973733aa223c4247eef20e6
* UPSTREAM: android: binder: Use true and false for boolean valuesGustavo A. R. Silva2018-11-291-3/+3
| | | | | | | | | | | | | | | Assign true or false to boolean variables instead of an integer value. This issue was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Cc: Todd Kjos <tkjos@android.com> Cc: Martijn Coenen <maco@android.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 197410ad884eb18b31d48e9d8e64cb5a9e326f2f) Change-Id: I30bed831d6b6ff2e9e3e521ccc5d6836f0b30944 Signed-off-by: Moyster <oysterized@gmail.com>
* UPSTREAM: android: binder: Use octal permissionsHarsh Shandilya2018-11-291-8/+8
| | | | | | | | | | | | | | | | | | checkpatch warns against the use of symbolic permissions, this patch migrates all symbolic permissions in the binder driver to octal permissions. Test: debugfs nodes created by binder have the same unix permissions prior to and after this patch was applied. Signed-off-by: Harsh Shandilya <harsh@prjkt.io> Cc: "Arve Hjønnevåg" <arve@android.com> Cc: Todd Kjos <tkjos@android.com> Cc: Martijn Coenen <maco@android.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 21d02ddf716669e182a13b69b4dd928cf8ef5e0f) Change-Id: I8152fe280ead1d04d89593e813a722f9eb5def27
* UPSTREAM: android: binder: Prefer __func__ to using hardcoded function nameElad Wexler2018-11-291-2/+2
| | | | | | | | | | Coding style fixup Signed-off-by: Elad Wexler <elad.wexler@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 00c41cddebde8d1a635bf81a7b255b7e56fd0d15) Change-Id: I795e2a9f525c4a8df5cd0a81842a88529ba54f21
* UPSTREAM: ANDROID: binder: make binder_alloc_new_buf_locked static and ↵Xiongwei Song2018-11-291-5/+6
| | | | | | | | | | | | | | | | | | | indent its arguments The function binder_alloc_new_buf_locked() is only used in this file, so make it static. Also clean up sparse warning: drivers/android/binder_alloc.c:330:23: warning: no previous prototype for ‘binder_alloc_new_buf_locked’ [-Wmissing-prototypes] In addition, the line of the function name exceeds 80 characters when add static for this function, hence indent its arguments anew. Signed-off-by: Xiongwei Song <sxwjean@gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 3f827245463a57f5ef64a665e1ca64eed0da00a5) Change-Id: I6b379df815d30f9b3e9f1dd50334375123b25bbc
* UPSTREAM: ANDROID: binder: prevent transactions into own process.Martijn Coenen2018-11-291-0/+8
| | | | | | | | | | | | | This can't happen with normal nodes (because you can't get a ref to a node you own), but it could happen with the context manager; to make the behavior consistent with regular nodes, reject transactions into the context manager by the process owning it. Reported-by: syzbot+09e05aba06723a94d43d@syzkaller.appspotmail.com Signed-off-by: Martijn Coenen <maco@android.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 7aa135fcf26377f92dc0680a57566b4c7f3e281b)
* UPSTREAM: ANDROID: binder: remove WARN() for redundant txn errorTodd Kjos2018-11-291-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | binder_send_failed_reply() is called when a synchronous transaction fails. It reports an error to the thread that is waiting for the completion. Given that the transaction is synchronous, there should never be more than 1 error response to that thread -- this was being asserted with a WARN(). However, when exercising the driver with syzbot tests, cases were observed where multiple "synchronous" requests were sent without waiting for responses, so it is possible that multiple errors would be reported to the thread. This testing was conducted with panic_on_warn set which forced the crash. This is easily reproduced by sending back-to-back "synchronous" transactions without checking for any response (eg, set read_size to 0): bwr.write_buffer = (uintptr_t)&bc1; bwr.write_size = sizeof(bc1); bwr.read_buffer = (uintptr_t)&br; bwr.read_size = 0; ioctl(fd, BINDER_WRITE_READ, &bwr); sleep(1); bwr2.write_buffer = (uintptr_t)&bc2; bwr2.write_size = sizeof(bc2); bwr2.read_buffer = (uintptr_t)&br; bwr2.read_size = 0; ioctl(fd, BINDER_WRITE_READ, &bwr2); sleep(1); The first transaction is sent to the servicemanager and the reply fails because no VMA is set up by this client. After binder_send_failed_reply() is called, the BINDER_WORK_RETURN_ERROR is sitting on the thread's todo list since the read_size was 0 and the client is not waiting for a response. The 2nd transaction is sent and the BINDER_WORK_RETURN_ERROR has not been consumed, so the thread's reply_error.cmd is still set (normally cleared when the BINDER_WORK_RETURN_ERROR is handled). Therefore when the servicemanager attempts to reply to the 2nd failed transaction, the error is already set and it triggers this warning. This is a user error since it is not waiting for the synchronous transaction to complete. If it ever does check, it will see an error. Changed the WARN() to a pr_warn(). Signed-off-by: Todd Kjos <tkjos@android.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit e46a3b3ba7509cb7fda0e07bc7c63a2cd90f579b) Change-Id: I3365b0775ceee37bdb1d868e3ce066c260aa88ea
* UPSTREAM: ANDROID: binder: synchronize_rcu() when using POLLFREE.Martijn Coenen2018-11-291-0/+9
| | | | | | | | | | | | | To prevent races with ep_remove_waitqueue() removing the waitqueue at the same time. Reported-by: syzbot+a2a3c4909716e271487e@syzkaller.appspotmail.com Signed-off-by: Martijn Coenen <maco@android.com> Cc: stable <stable@vger.kernel.org> # 4.14+ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 5eeb2ca02a2f6084fc57ae5c244a38baab07033a) Change-Id: Ia0089448079c78d0ab0b57303faf838e9e5ee797
* UPSTREAM: ANDROID: binder: remove waitqueue when thread exits.Martijn Coenen2018-11-291-0/+12
| | | | | | | | | | | | | | | | | | | | | binder_poll() passes the thread->wait waitqueue that can be slept on for work. When a thread that uses epoll explicitly exits using BINDER_THREAD_EXIT, the waitqueue is freed, but it is never removed from the corresponding epoll data structure. When the process subsequently exits, the epoll cleanup code tries to access the waitlist, which results in a use-after-free. Prevent this by using POLLFREE when the thread exits. (cherry picked from commit f5cb779ba16334b45ba8946d6bfa6d9834d1527f) Change-Id: Ib34b1cbb8ab2192d78c3d9956b2f963a66ecad2e Signed-off-by: Martijn Coenen <maco@android.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: stable <stable@vger.kernel.org> # 4.14 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
* ANDROID: binder: Remove obsolete proc waitqueue.Martijn Coenen2017-12-211-3/+0
| | | | | | | It was no longer being used. Change-Id: I7fc42b76f688a459ad990f59fbd7006b96bb91a6 Signed-off-by: Martijn Coenen <maco@android.com>
* UPSTREAM: android: binder: fix type mismatch warningArnd Bergmann2017-12-141-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allowing binder to expose the 64-bit API on 32-bit kernels caused a build warning: drivers/android/binder.c: In function 'binder_transaction_buffer_release': drivers/android/binder.c:2220:15: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] fd_array = (u32 *)(parent_buffer + fda->parent_offset); ^ drivers/android/binder.c: In function 'binder_translate_fd_array': drivers/android/binder.c:2445:13: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] fd_array = (u32 *)(parent_buffer + fda->parent_offset); ^ drivers/android/binder.c: In function 'binder_fixup_parent': drivers/android/binder.c:2511:18: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast] This adds extra type casts to avoid the warning. However, there is another problem with the Kconfig option: turning it on or off creates two incompatible ABI versions, a kernel that has this enabled cannot run user space that was built without it or vice versa. A better solution might be to leave the option hidden until the binder code is fixed to deal with both ABI versions. Fixes: e8d2ed7db7c3 ("Revert "staging: Fix build issues with new binder API"") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 1c363eaece2752c5f8b1b874cb4ae435de06aa66) Change-Id: Id09185a6f86905926699e92a2b30201b8a5e83e5
* binder: fix proc->files use-after-freeTodd Kjos2017-12-141-13/+31
| | | | | | | | | | | | | | | | | proc->files cleanup is initiated by binder_vma_close. Therefore a reference on the binder_proc is not enough to prevent the files_struct from being released while the binder_proc still has a reference. This can lead to an attempt to dereference the stale pointer obtained from proc->files prior to proc->files cleanup. This has been seen once in task_get_unused_fd_flags() when __alloc_fd() is called with a stale "files". The fix is to protect proc->files with a mutex to prevent cleanup while in use. Bug: 69164715 Change-Id: I90fc117e004ecefc5336779cd7cd24faad37bd86 Signed-off-by: Todd Kjos <tkjos@google.com>
* ANDROID: binder: use 64-bit interface on 32-bit kernels.Martijn Coenen2017-10-201-2/+2
| | | | | | | | | | | | | | | There's no good reason to not use the 64-bit interface on 32-bit kernels. Android userspace wants to support generic 32-bit system images, and having to support two binder interfaces on such a single image is practically impossible. Since the majority of deployed Android devices now run a > 4.4 userspace, this seems like a good time to flip the default. Change-Id: I3562784bbee8185cc56bb39809bd677ba27297a3 Signed-off-by: Martijn Coenen <maco@android.com>
* FROMLIST: binder: fix use-after-free in binder_transaction()Todd Kjos2017-10-141-27/+66
| | | | | | | | | | | | | | | | | | | | | | (from https://patchwork.kernel.org/patch/9978801/) User-space normally keeps the node alive when creating a transaction since it has a reference to the target. The local strong ref keeps it alive if the sending process dies before the target process processes the transaction. If the source process is malicious or has a reference counting bug, this can fail. In this case, when we attempt to decrement the node in the failure path, the node has already been freed. This is fixed by taking a tmpref on the node while constructing the transaction. To avoid re-acquiring the node lock and inner proc lock to increment the proc's tmpref, a helper is used that does the ref increments on both the node and proc. Bug: 66899329 Change-Id: Iad40e1e0bccee88234900494fb52a510a37fe8d7 Signed-off-by: Todd Kjos <tkjos@google.com>
* ANDROID: binder: init desired_prio.sched_policy before use itGanesh Mahendran2017-09-281-4/+1
| | | | | | | | | | In function binder_transaction_priority(), we access desired_prio before initialzing it. This patch fix this. Change-Id: I9d14d50f9a128010476a65b52631630899a44633 Signed-off-by: Ganesh Mahendran <opensource.ganesh@gmail.com>
* ANDROID: binder: fix node sched policy calculationGanesh Mahendran2017-09-281-1/+1
| | | | | | | | We should use FLAT_BINDER_FLAG_SCHED_POLICY_MASK as the mask to calculate sched policy. Change-Id: Ic252fd7c68495830690130d792802c02f99fc8fc Signed-off-by: Ganesh Mahendran <opensource.ganesh@gmail.com>
* FROMLIST: binder: fix an ret value overrideXu YiPing2017-09-161-1/+0
| | | | | | | | | | | | (from https://patchwork.kernel.org/patch/9939409/) commit 372e3147df70 ("binder: guarantee txn complete / errors delivered in-order") incorrectly defined a local ret value. This ret value will be invalid when out of the if block Change-Id: If7bd963ac7e67d135aa949133263aac27bf15d1a Signed-off-by: Xu YiPing <xuyiping@hislicon.com> Signed-off-by: Todd Kjos <tkjos@google.com>
* FROMLIST: binder: fix memory corruption in binder_transaction binderXu YiPing2017-09-161-0/+1
| | | | | | | | | | | | | | | | | (from https://patchwork.kernel.org/patch/9939405/) commit 7a4408c6bd3e ("binder: make sure accesses to proc/thread are safe") made a change to enqueue tcomplete to thread->todo before enqueuing the transaction. However, in err_dead_proc_or_thread case, the tcomplete is directly freed, without dequeued. It may cause the thread->todo list to be corrupted. So, dequeue it before freeing. Bug: 65333488 Change-Id: Id063a4db18deaa634f4d44aa6ebca47bea32537a Signed-off-by: Xu YiPing <xuyiping@hisilicon.com> Signed-off-by: Todd Kjos <tkjos@google.com>
* binder: make FIFO inheritance a per-context optionTim Murray2017-09-161-1/+36
| | | | | | | | | | | | | Add a new ioctl to binder to control whether FIFO inheritance should happen. In particular, hwbinder should inherit FIFO priority from callers, but standard binder threads should not. Test: boots bug 36516194 Signed-off-by: Tim Murray <timmurray@google.com> Change-Id: I8100c4364b7d15d1bf00a8ca5c286e4d4b23ce85
* drivers: merged Android Binder from 4.9Lukas06102017-09-165-1574/+3726
| | | | | Change-Id: I857ef86b2d502293fb8c37398383dceaa21dd29f Signed-off-by: Mister Oyster <oysterized@gmail.com>
* Incorrect the handling of async transactions.songjinshi2017-06-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Consider the following sequence of events: 1. Binder thread A1 receive an async transaction T1 and return to user space to execute 2. Another process's thread A2 request an async transaction T2, T2 and T1 belongs a same target_node, so it will be place to the async_todo of the target_node 3. A1 execute done the T1 and write a BC_FREE_BUFFER to mOut 4. A1 continue execute the processPendingDerefs and destruct a BBinder B1 5. B1's destruct function request a sync BC_TRANSACTION T3 and running into binder driver 6. The BC_FREE_BUFFER will be executed first, it move the T2 to A1's todo 7. Then the T3 will be executed, and it add a BR_TRANSACTION_COMPLETE to A1's todo 8. A1 will read the todo after write done, it will got T2 and return to user space to execute. 9. T3's BR_REPLY be place to A1's todo,now the A1's todo has two BR, first one is BR_TRANSACTION_COMPLETE,another one is BR_REPLY 10. T2 in execute process will request an async transaction T4 and running into binder driver 11. A1 will place the T4 to target list and add a BR_TRANSACTION_COMPLETE to the self's todo,now the A1's todo has three BR,first one is BR_TRANSACTION_COMPLETE,second one is BR_REPLY,the third one is BR_TRANSACTION_COMPLETE 12. A1 will read the todo after write done. it will got BR_TRANSACTION_COMPLETE and BR_REPLY,then return to the user space to execute,because the T4 is an async transaction so it will consume a BR_TRANSACTION_COMPLETE and exit the waitForResponse,then return to the T3's waitForResponse 13. T3 will consume a BR_REPLY and exit the waitForResponse,because it is a sync transaction, now the A1's todo still have a BR_TRANSACTION_COMPLETE 14. A1 continue execute the getAndExecuteCommand and talkWithDriver,it will got a BR_TRANSACTION_COMPLETE and return to user space to execute 15. A1 continue execute executeCommand, it will running into the default label of the switch and return an UNKNOWN_ERROR 16. A1 will check the results of the getAndExecuteCommand,if the UNKNOWN_ERROR occurs it will abort self. So we should move the async transaction to proc's todo when execute the BC_FREE_BUFFER to avoid the BAD CMD issue caused by sync transactions nested async transactions, move to the proc's todo will make the binder thread load balancing, and enhance the parallel capacity, the current binder thread will be execute it if the proc's todo have other transaction and the async transaction will be move to the tail of the proc's todo and waiting for execute of the other binder thread or current binder thread, so always only one binder thread to execute the async transactions, if another binder thread to got the async transaction to execute the current binder thread will idle, if no one another thread to got the async transction, the current thread will got it in the binder_thread_read after binder_thread_write execute done. https://code.google.com/p/android/issues/detail?id=228385 Signed-off-by: songjinshi <songjinshi@xiaomi.com>
* binder: merge aosp-common/3.10 binder drivers (uptodate)Mister Oyster2017-06-182-571/+1375
|
* binder: remove unused varMister Oyster2017-05-291-1/+0
| | | | | | ../../../../../../kernel/meizu/m2note/drivers/android/binder.c:63:14: warning: 'system_server_pid' defined but not used [-Wunused-variable] static pid_t system_server_pid;
* binder: Quiet BinderUma Maheshwari Bhiram2017-05-291-2/+2
| | | | | | | | | | Temporary change to avoid watchdog bark because of excessive failed transaction logging CRs-Fixed: 572081 Change-Id: Id664d65ab9e78627991f8b7d4f4e5e126908c214 Signed-off-by: Uma Maheshwari Bhiram <ubhira@codeaurora.org>
* mtk: binder: remove debug stuff to ease future mergeMister Oyster2017-05-281-2392/+11
|
* mtk: binder: 3.10 updatesMister Oyster2017-05-281-43/+41
|
* Staging: android: binder: Remove support for old 32 bit binder protocol.Arve Hjønnevåg2017-05-072-17/+0
| | | | | | Change-Id: I371072175a298282254a21ea69503b9d75633dc5 Signed-off-by: Arve Hjønnevåg <arve@android.com> Signed-off-by: Mister Oyster <oysterized@gmail.com>
* android: binder: fix duplicate error return.Riley Andrews2017-04-301-1/+1
| | | | | | | | Duplicate errors can be returned to userspace when the thread error code is left set when the read buffer runs out of space. Change-Id: I921effcb6a7d620841177741a5ad5784acc7a907 Signed-off-by: Riley Andrews <riandrews@google.com>
* Security patchesfire8552017-04-161-15/+24
| | | | Signed-off-by: Mister Oyster <oysterized@gmail.com>
* binder: use group leader instead of open threadMartijn Coenen2017-04-111-3/+3
| | | | | | | | | | | | | | | The binder allocator assumes that the thread that called binder_open will never die for the lifetime of that proc. That thread is normally the group_leader, however it may not be. Use the group_leader instead of current. Bug: 35707103 Test: Created test case to open with temporary thread Change-Id: Id693f74b3591f3524a8c6e9508e70f3e5a80c588 Signed-off-by: Todd Kjos <tkjos@google.com> Signed-off-by: Martijn Coenen <maco@android.com>
* binder: blacklist %p kptr_restrictNick Desaulniers2017-04-111-13/+13
| | | | | | | | | Bug: 31495231 Change-Id: Iebc150f6bc939b56e021424ee44fb30ce8d732fd [d-cagle@codeaurora.org: Applied to correct file location] Git-repo: https://android.googlesource.com/kernel/msm.git Git-commit: 0804d7840364fc1a93652632bd43a93c055c658e Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
* binder: blacklist %p kptr_restrictfire8552017-04-111-12/+12
|
* Binder: fix build warningAnmin Hsu2016-12-251-0/+2
| | | | | | | | | | | | | | [Detail] db_flag is not included in CONFIG_MTK_AEE_FEATURE macro define. [Solution] Add CONFIG_MTK_AEE_FEATURE macro define to db_flag [Feature] Binder MTK-Commit-Id: 7c2be71301a506592b997e575103a29f8352ba6c Change-Id: I5bca795883c63980384ab5ce50edd64562acc511 Signed-off-by: mtk09083 <ian.hou@mediatek.com> CR-Id: ALPS02319875
* android: drivers: workaround debugfs race in binderRiley Andrews2016-11-171-17/+9
| | | | | | | | | | | | | If a /d/binder/proc/[pid] entry is kept open after linux has torn down the associated process, binder_proc_show can deference an invalid binder_proc that has been stashed in the debugfs inode. Validate that the binder_proc ptr passed into binder_proc_show has not been freed by looking for it within the global process list whilst the global lock is held. If the ptr is not valid, print nothing. Bug 19587483 Change-Id: Ice878c171db51ef9a4879c2f9299a2deb873d255 Signed-off-by: Riley Andrews <riandrews@android.com>
* ANDROID: binder: Clear binder and cookie when setting handle in flat binder ↵Arve Hjønnevåg2016-11-071-0/+5
| | | | | | | | | | | struct Prevents leaking pointers between processes BUG: 30768347 Change-Id: Id898076926f658a1b8b27a3ccb848756b36de4ca Signed-off-by: Arve Hjønnevåg <arve@android.com> Ticket: PORRIDGE-499
* binder: prevent kptr leak by using %pK format specifierNick Desaulniers2016-11-071-1/+1
| | | | | | | | Works in conjunction with kptr_restrict. Bug: 30143283 Change-Id: I2b3ce22f4e206e74614d51453a1d59b7080ab05a (cherry picked from commit 7905a759cc685b58078483013cc584dc8327d118)
* first commitMeizu OpenSource2016-08-154-0/+6482
generated by cgit v1.2.3 (git 2.39.1) at 2026-03-14 02:06:30 +0000