linux.git/drivers/android, branch v4.14-rc2

ANDROID: binder: don't queue async transactions to thread.

2017-09-01T07:22:50+00:00

This can cause issues with processes using the poll()
interface:

1) client sends two oneway transactions
2) the second one gets queued on async_todo
   (because the server didn't handle the first one
    yet)
3) server returns from poll(), picks up the
   first transaction and does transaction work
4) server is done with the transaction, sends
   BC_FREE_BUFFER, and the second transaction gets
   moved to thread->todo
5) libbinder's handlePolledCommands() only handles
   the commands in the current data buffer, so
   doesn't see the new transaction
6) the server continues running and issues a new
   outgoing transaction. Now, it suddenly finds
   the incoming oneway transaction on its thread
   todo, and returns that to userspace.
7) userspace does not expect this to happen; it
   may be holding a lock while making the outgoing
   transaction, and if handling the incoming
   trasnaction requires taking the same lock,
   userspace will deadlock.

By queueing the async transaction to the proc
workqueue, we make sure it's only picked up when
a thread is ready for proc work.

Signed-off-by: Martijn Coenen 
Signed-off-by: Greg Kroah-Hartman

ANDROID: binder: don't enqueue death notifications to thread todo.

2017-09-01T07:22:50+00:00

This allows userspace to request death notifications without
having to worry about getting an immediate callback on the same
thread; one scenario where this would be problematic is if the
death recipient handler grabs a lock that was already taken
earlier (eg as part of a nested transaction).

Signed-off-by: Martijn Coenen 
Signed-off-by: Greg Kroah-Hartman

ANDROID: binder: Don't BUG_ON(!spin_is_locked()).

2017-09-01T07:21:57+00:00

Because is_spin_locked() always returns false on UP
systems.

Use assert_spin_locked() instead, and remove the
WARN_ON() instances, since those were easy to verify.

Signed-off-by: Martijn Coenen 
Signed-off-by: Greg Kroah-Hartman

ANDROID: binder: Add BINDER_GET_NODE_DEBUG_INFO ioctl

2017-09-01T07:21:12+00:00

The BINDER_GET_NODE_DEBUG_INFO ioctl will return debug info on
a node.  Each successive call reusing the previous return value
will return the next node.  The data will be used by
libmemunreachable to mark the pointers with kernel references
as reachable.

Signed-off-by: Colin Cross 
Signed-off-by: Martijn Coenen 
Signed-off-by: Greg Kroah-Hartman

ANDROID: binder: push new transactions to waiting threads.

2017-09-01T07:20:13+00:00

Instead of pushing new transactions to the process
waitqueue, select a thread that is waiting on proc
work to handle the transaction. This will make it
easier to improve priority inheritance in future
patches, by setting the priority before we wake up
a thread.

If we can't find a waiting thread, submit the work
to the proc waitqueue instead as we did previously.

Signed-off-by: Martijn Coenen 
Signed-off-by: Greg Kroah-Hartman

ANDROID: binder: remove proc waitqueue

2017-09-01T07:20:12+00:00

Removes the process waitqueue, so that threads
can only wait on the thread waitqueue. Whenever
there is process work to do, pick a thread and
wake it up. Having the caller pick a thread is
helpful for things like priority inheritance.

This also fixes an issue with using epoll(),
since we no longer have to block on different
waitqueues.

Signed-off-by: Martijn Coenen 
Signed-off-by: Greg Kroah-Hartman

android: binder: Add page usage in binder stats

2017-09-01T06:53:32+00:00

Add the number of active, lru, and free pages for
each binder process in binder stats

Signed-off-by: Sherry Yang 
Signed-off-by: Greg Kroah-Hartman

android: binder: fixup crash introduced by moving buffer hdr

2017-09-01T06:53:32+00:00

Fix crash introduced by 74310e06be4d74dcf67cd108366710dee5c576d5
(android: binder: Move buffer out of area shared with user space)
when close is called after open without mmap in between.

Reported-by: kernel test robot 
Fixes: 74310e06be4d ("android: binder: Move buffer out of area shared with user space")
Signed-off-by: Sherry Yang 
Signed-off-by: Greg Kroah-Hartman

android: binder: Add shrinker tracepoints

2017-08-28T14:47:17+00:00

Add tracepoints in binder transaction allocator to
record lru hits and alloc/free page.

Signed-off-by: Sherry Yang 
Signed-off-by: Greg Kroah-Hartman

android: binder: Add global lru shrinker to binder

2017-08-28T14:47:17+00:00

Hold on to the pages allocated and mapped for transaction
buffers until the system is under memory pressure. When
that happens, use linux shrinker to free pages. Without
using shrinker, patch "android: binder: Move buffer out
of area shared with user space" will cause a significant
slow down for small transactions that fit into the first
page because free list buffer header used to be inlined
with buffer data.

In addition to prevent the performance regression for
small transactions, this patch improves the performance
for transactions that take up more than one page.

Modify alloc selftest to work with the shrinker change.

Test: Run memory intensive applications (Chrome and Camera)
to trigger shrinker callbacks. Binder frees memory as expected.
Test: Run binderThroughputTest with high memory pressure
option enabled.

Signed-off-by: Sherry Yang 
Signed-off-by: Greg Kroah-Hartman