350 Commits

Author SHA1 Message Date
EmanuelCN
cdf9fbb231 MIUI: drivers/android/binder: Boost binder's priority
Signed-off-by: EmanuelCN <emanuelghub@gmail.com>
2025-05-20 21:55:21 +03:00
Chungkai Mei
32bbf7d814 ANDROID: binder: Store previous uclamp by uclamp_req
To restore previous uclamp value, we still need store uclamp_req directly.
Otherwise, saved_priority will store effective uclamp value and restore it
to uclamp_req later.

Bug: 277389699
Change-Id: I7b3e357fcfc3bd955789e85d730713c384d0ade7
Signed-off-by: Chungkai Mei <chungkai@google.com>
Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>
2025-05-20 21:54:40 +03:00
Chungkai Mei
e76106a246 ANDROID: binder: Set default min and max uclamp to 0 and SCHED_CAPACITY_SCALE
Don't use the uclamp of current task as the default uclamp for
binders, because the uclamp of current task influence
binders' placement when not in a transaction.

Just use default value 0 and SCHED_CAPACITY_SCALE for binders'
default uclamp min and max. Also replace set_inherited_uclamp with
set_binder_prio_uclamp

Bug: 277389699
Change-Id: I07c4f40c2689dbc7eb23e7d3e2a2f435353dc25f
Signed-off-by: Chungkai Mei <chungkai@google.com>
Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>
2025-05-20 21:54:40 +03:00
Qais Yousef
f7aeced115 ANDROID: binder: Skip uclamp inheritance if !uclamp_is_used()
uclamp inheritance is not relevant while !uclamp_is_used().

Partially addresses the issue of enabling uclamp_is_used static key
causing a splat because of holding cpus_read_lock() in_atomic() context.

Bug: 259145692
Signed-off-by: Qais Yousef <qyousef@google.com>
Change-Id: Ib752e96e41b2fcace6edcdcec169f1ca56540a9b
Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>
2025-05-20 21:54:40 +03:00
ChungKai Mei
143c5d3363 ANDROID: binder: Add support for uclamp inheritance
We may still have long binder transaction due to
insufficient uclamp, so expand binder_prioity to
inherit uclamp as well.

Bug: 226003124
Signed-off-by: ChungKai Mei <chungkai@google.com>
Change-Id: I307ab812638eeea1ca3e80ae07dee05fb9797dd6
Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>
2025-05-20 21:54:40 +03:00
Juhyung Park
7b0bda0160 binder: Extend kmem cache to binder_task_work_cb and binder_txn_fd_fixup
Signed-off-by: Juhyung Park <qkrwngud825@gmail.com>
Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>
2025-05-20 21:54:40 +03:00
Sultan Alsawaf
968edf5ff8 binder: Reserve caches for small, high-frequency memory allocations
Most of binder's memory allocations are tiny, and they're allocated
and freed extremely frequently. The latency from going through the page
allocator all the time for such small allocations ends up being quite
high, especially when the system is low on memory. Binder is
performance-critical, so this is suboptimal.

Instead of using kzalloc to allocate a struct every time, reserve caches
specifically for allocating each struct quickly.

Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com>
Signed-off-by: Danny Lin <danny@kdrag0n.dev>
Signed-off-by: Juhyung Park <qkrwngud825@gmail.com>
Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>
2025-05-20 21:54:39 +03:00
Juhyung Park
fe078b9b26 binder: Avoid using kzalloc() whenever possible
Those are initialized fully right below, use kmalloc().

Signed-off-by: Juhyung Park <qkrwngud825@gmail.com>
Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>
2025-05-20 21:54:39 +03:00
Andrzej Perczak
83f1fe7c3c binder: Conditionally compile logging
Every binder operation is being logged. This impacts performance and
increases memory footprint. Since binder is critical for Android
operation, doing any logging on production builds isn't best idea.

Quick grep over Android sources revealed that only lshal and dumpsys
binaries use binder_log directory, these are not critical so breaking
them won't hurt much. Anyways, I was able to succesfully run both and
bacis functionality was still there.

Benchmarks showed significant decrease in transaction time with an avg
of 1000ns.

Signed-off-by: Andrzej Perczak <linux@andrzejperczak.com>
Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>
[Helium-Studio: Forwardport to 5.10 binder]
Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>

# Conflicts:
#	drivers/android/Kconfig
2025-05-20 21:54:39 +03:00
Carlos Llamas
0400120fb0 binder: fix descriptor lookup for context manager
In commit 15d9da3f818c ("binder: use bitmap for faster descriptor
lookup"), it was incorrectly assumed that references to the context
manager node should always get descriptor zero assigned to them.

However, if the context manager dies and a new process takes its place,
then assigning descriptor zero to the new context manager might lead to
collisions, as there could still be references to the older node. This
issue was reported by syzbot with the following trace:

  kernel BUG at drivers/android/binder.c:1173!
  Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
  Modules linked in:
  CPU: 1 PID: 447 Comm: binder-util Not tainted 6.10.0-rc6-00348-g31643d84b8c3 #10
  Hardware name: linux,dummy-virt (DT)
  pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
  pc : binder_inc_ref_for_node+0x500/0x544
  lr : binder_inc_ref_for_node+0x1e4/0x544
  sp : ffff80008112b940
  x29: ffff80008112b940 x28: ffff0e0e40310780 x27: 0000000000000000
  x26: 0000000000000001 x25: ffff0e0e40310738 x24: ffff0e0e4089ba34
  x23: ffff0e0e40310b00 x22: ffff80008112bb50 x21: ffffaf7b8f246970
  x20: ffffaf7b8f773f08 x19: ffff0e0e4089b800 x18: 0000000000000000
  x17: 0000000000000000 x16: 0000000000000000 x15: 000000002de4aa60
  x14: 0000000000000000 x13: 2de4acf000000000 x12: 0000000000000020
  x11: 0000000000000018 x10: 0000000000000020 x9 : ffffaf7b90601000
  x8 : ffff0e0e48739140 x7 : 0000000000000000 x6 : 000000000000003f
  x5 : ffff0e0e40310b28 x4 : 0000000000000000 x3 : ffff0e0e40310720
  x2 : ffff0e0e40310728 x1 : 0000000000000000 x0 : ffff0e0e40310710
  Call trace:
   binder_inc_ref_for_node+0x500/0x544
   binder_transaction+0xf68/0x2620
   binder_thread_write+0x5bc/0x139c
   binder_ioctl+0xef4/0x10c8
  [...]

This patch adds back the previous behavior of assigning the next
non-zero descriptor if references to previous context managers still
exist. It amends both strategies, the newer dbitmap code and also the
legacy slow_desc_lookup_olocked(), by allowing them to start looking
for available descriptors at a given offset.

Fixes: 15d9da3f818c ("binder: use bitmap for faster descriptor lookup")
Cc: stable@vger.kernel.org
Reported-and-tested-by: syzbot+3dae065ca76952a67257@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/000000000000c1c0a0061d1e6979@google.com/
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240722150512.4192473-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>
2025-05-20 21:54:39 +03:00
Carlos Llamas
5f359fe5ac binder: use bitmap for faster descriptor lookup
When creating new binder references, the driver assigns a descriptor id
that is shared with userspace. Regrettably, the driver needs to keep the
descriptors small enough to accommodate userspace potentially using them
as Vector indexes. Currently, the driver performs a linear search on the
rb-tree of references to find the smallest available descriptor id. This
approach, however, scales poorly as the number of references grows.

This patch introduces the usage of bitmaps to boost the performance of
descriptor assignments. This optimization results in notable performance
gains, particularly in processes with a large number of references. The
following benchmark with 100,000 references showcases the difference in
latency between the dbitmap implementation and the legacy approach:

  [  587.145098] get_ref_desc_olocked: 15us (dbitmap on)
  [  602.788623] get_ref_desc_olocked: 47343us (dbitmap off)

Note the bitmap size is dynamically adjusted in line with the number of
references, ensuring efficient memory usage. In cases where growing the
bitmap is not possible, the driver falls back to the slow legacy method.

A previous attempt to solve this issue was proposed in [1]. However,
such method involved adding new ioctls which isn't great, plus older
userspace code would not have benefited from the optimizations either.

Link: https://lore.kernel.org/all/20240417191418.1341988-1-cmllamas@google.com/ [1]
Cc: Tim Murray <timmurray@google.com>
Cc: Arve Hjønnevåg <arve@android.com>
Cc: Alice Ryhl <aliceryhl@google.com>
Cc: Martijn Coenen <maco@android.com>
Cc: Todd Kjos <tkjos@android.com>
Cc: John Stultz <jstultz@google.com>
Cc: Steven Moreland <smoreland@google.com>
Suggested-by: Nick Chen <chenjia3@oppo.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240612042535.1556708-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>
2025-05-20 21:54:39 +03:00
Lei Liu
b7a8641301 binder_alloc: Replace kcalloc with kvcalloc to mitigate OOM issues
In binder_alloc, there is a frequent need for order3 memory allocation,
especially on small-memory mobile devices, which can lead to OOM and
cause foreground applications to be killed, resulting in flashbacks.

We use kvcalloc to allocate memory, which can reduce system OOM
occurrences, as well as decrease the time and probability of failure for
order3 memory allocations. Additionally, It has little impact on the
throughput of the binder. (as verified by Google's binder_benchmark
testing tool).

We have conducted multiple tests on an 8GB memory phone, kvcalloc has
little performance degradation and resolves frequent OOM issues, Below
is a partial excerpt of the test data.

throughput(TH_PUT) = (size * Iterations)/Time
kcalloc->kvcalloc:

Sample with kcalloc():
adb shell stop/ kcalloc /8+256G
---------------------------------------------------------------------
Benchmark                Time     CPU   Iterations  TH-PUT  TH-PUTCPU
                         (ns)     (ns)              (GB/s)    (GB/s)
---------------------------------------------------------------------
BM_sendVec_binder4      39126    18550    38894    3.976282  8.38684
BM_sendVec_binder8      38924    18542    37786    7.766108  16.3028
BM_sendVec_binder16     38328    18228    36700    15.32039  32.2141
BM_sendVec_binder32     38154    18215    38240    32.07213  67.1798
BM_sendVec_binder64     39093    18809    36142    59.16885  122.977
BM_sendVec_binder128    40169    19188    36461    116.1843  243.2253
BM_sendVec_binder256    40695    19559    35951    226.1569  470.5484
BM_sendVec_binder512    41446    20211    34259    423.2159  867.8743
BM_sendVec_binder1024   44040    22939    28904    672.0639  1290.278
BM_sendVec_binder2048   47817    25821    26595    1139.063  2109.393
BM_sendVec_binder4096   54749    30905    22742    1701.423  3014.115
BM_sendVec_binder8192   68316    42017    16684    2000.634  3252.858
BM_sendVec_binder16384  95435    64081    10961    1881.752  2802.469
BM_sendVec_binder32768  148232  107504     6510    1439.093  1984.295
BM_sendVec_binder65536  326499  229874     3178    637.8991  906.0329
NORAML TEST                                 SUM    10355.79  17188.15
stressapptest eat 2G                        SUM    10088.39  16625.97

Sample with kvcalloc():
adb shell stop/ kvcalloc /8+256G
----------------------------------------------------------------------
Benchmark                Time     CPU   Iterations  TH-PUT  TH-PUTCPU
                         (ns)     (ns)              (GB/s)    (GB/s)
----------------------------------------------------------------------
BM_sendVec_binder4       39673    18832    36598    3.689965  7.773577
BM_sendVec_binder8       39869    18969    37188    7.462038  15.68369
BM_sendVec_binder16      39774    18896    36627    14.73405  31.01355
BM_sendVec_binder32      40225    19125    36995    29.43045  61.90013
BM_sendVec_binder64      40549    19529    35148    55.47544  115.1862
BM_sendVec_binder128     41580    19892    35384    108.9262  227.6871
BM_sendVec_binder256     41584    20059    34060    209.6806  434.6857
BM_sendVec_binder512     42829    20899    32493    388.4381  796.0389
BM_sendVec_binder1024    45037    23360    29251    665.0759  1282.236
BM_sendVec_binder2048    47853    25761    27091    1159.433  2153.735
BM_sendVec_binder4096    55574    31745    22405    1651.328  2890.877
BM_sendVec_binder8192    70706    43693    16400    1900.105  3074.836
BM_sendVec_binder16384   96161    64362    10793    1838.921  2747.468
BM_sendVec_binder32768  147875   107292     6296    1395.147  1922.858
BM_sendVec_binder65536  330324   232296     3053    605.7126  861.3209
NORAML TEST                                 SUM     10033.56  16623.35
stressapptest eat 2G                        SUM      9958.43  16497.55

Signed-off-by: Lei Liu <liulei.rjpt@vivo.com>
Acked-by: Carlos Llamas <cmllamas@google.com>

Bug: 350604214
Bug: 331900628
Link: https://lore.kernel.org/all/20240619113841.3362-1-liulei.rjpt@vivo.com/

Change-Id: I46e19121d03466e9f1ac42c8c7731c92b9eb9bbf
Signed-off-by: Lei Liu <liulei.rjpt@vivo.corp-partner.google.com>
Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>
2025-05-20 21:54:39 +03:00
Sean Du
34617ec7c6 binder: Fix compilation on 4.14
Helium-Studio: This is a squash of the following commits:
86429a2403
ff225d3e91
fc245aac49

Co-authored-by: Cyber Knight <cyberknight755@gmail.com>
Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>
2025-05-20 21:54:39 +03:00
Helium-Studio
9fab75510d binder: Checkout to android13-5.10-lts
* HEAD: 76b049b586

Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>

# Conflicts:
#	drivers/android/binder.c
#	drivers/android/binder_alloc.c
#	drivers/android/binder_alloc.h
#	drivers/android/binder_internal.h
#	drivers/android/binderfs.c
#	include/uapi/linux/android/binder.h
2025-05-20 21:54:38 +03:00
kondors1995
373d5574ec Merge branch 'linux-4.14.y' of https://github.com/openela/kernel-lts into 15.0 2024-10-20 18:10:19 +03:00
Carlos Llamas
080400d003 binder: fix hang of unregistered readers
commit 31643d84b8c3d9c846aa0e20bc033e46c68c7e7d upstream.

With the introduction of binder_available_for_proc_work_ilocked() in
commit 1b77e9dcc3 ("ANDROID: binder: remove proc waitqueue") a binder
thread can only "wait_for_proc_work" after its thread->looper has been
marked as BINDER_LOOPER_STATE_{ENTERED|REGISTERED}.

This means an unregistered reader risks waiting indefinitely for work
since it never gets added to the proc->waiting_threads. If there are no
further references to its waitqueue either the task will hang. The same
applies to readers using the (e)poll interface.

I couldn't find the rationale behind this restriction. So this patch
restores the previous behavior of allowing unregistered threads to
"wait_for_proc_work". Note that an error message for this scenario,
which had previously become unreachable, is now re-enabled.

Fixes: 1b77e9dcc3 ("ANDROID: binder: remove proc waitqueue")
Cc: stable@vger.kernel.org
Cc: Martijn Coenen <maco@google.com>
Cc: Arve Hjønnevåg <arve@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240711201452.2017543-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 229670361c29381b0e1677763590e4dbc209ecbe)
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
2024-10-10 10:27:24 +00:00
Lei Liu
cc60ea93d1 FROMLIST: binder_alloc: Replace kcalloc with kvcalloc to mitigate OOM issues
In binder_alloc, there is a frequent need for order3 memory allocation,
especially on small-memory mobile devices, which can lead to OOM and
cause foreground applications to be killed, resulting in flashbacks.

We use kvcalloc to allocate memory, which can reduce system OOM
occurrences, as well as decrease the time and probability of failure for
order3 memory allocations. Additionally, It has little impact on the
throughput of the binder. (as verified by Google's binder_benchmark
testing tool).

We have conducted multiple tests on an 8GB memory phone, kvcalloc has
little performance degradation and resolves frequent OOM issues, Below
is a partial excerpt of the test data.

throughput(TH_PUT) = (size * Iterations)/Time
kcalloc->kvcalloc:

Sample with kcalloc():
adb shell stop/ kcalloc /8+256G
---------------------------------------------------------------------
Benchmark                Time     CPU   Iterations  TH-PUT  TH-PUTCPU
                         (ns)     (ns)              (GB/s)    (GB/s)
---------------------------------------------------------------------
BM_sendVec_binder4      39126    18550    38894    3.976282  8.38684
BM_sendVec_binder8      38924    18542    37786    7.766108  16.3028
BM_sendVec_binder16     38328    18228    36700    15.32039  32.2141
BM_sendVec_binder32     38154    18215    38240    32.07213  67.1798
BM_sendVec_binder64     39093    18809    36142    59.16885  122.977
BM_sendVec_binder128    40169    19188    36461    116.1843  243.2253
BM_sendVec_binder256    40695    19559    35951    226.1569  470.5484
BM_sendVec_binder512    41446    20211    34259    423.2159  867.8743
BM_sendVec_binder1024   44040    22939    28904    672.0639  1290.278
BM_sendVec_binder2048   47817    25821    26595    1139.063  2109.393
BM_sendVec_binder4096   54749    30905    22742    1701.423  3014.115
BM_sendVec_binder8192   68316    42017    16684    2000.634  3252.858
BM_sendVec_binder16384  95435    64081    10961    1881.752  2802.469
BM_sendVec_binder32768  148232  107504     6510    1439.093  1984.295
BM_sendVec_binder65536  326499  229874     3178    637.8991  906.0329
NORAML TEST                                 SUM    10355.79  17188.15
stressapptest eat 2G                        SUM    10088.39  16625.97

Sample with kvcalloc():
adb shell stop/ kvcalloc /8+256G
----------------------------------------------------------------------
Benchmark                Time     CPU   Iterations  TH-PUT  TH-PUTCPU
                         (ns)     (ns)              (GB/s)    (GB/s)
----------------------------------------------------------------------
BM_sendVec_binder4       39673    18832    36598    3.689965  7.773577
BM_sendVec_binder8       39869    18969    37188    7.462038  15.68369
BM_sendVec_binder16      39774    18896    36627    14.73405  31.01355
BM_sendVec_binder32      40225    19125    36995    29.43045  61.90013
BM_sendVec_binder64      40549    19529    35148    55.47544  115.1862
BM_sendVec_binder128     41580    19892    35384    108.9262  227.6871
BM_sendVec_binder256     41584    20059    34060    209.6806  434.6857
BM_sendVec_binder512     42829    20899    32493    388.4381  796.0389
BM_sendVec_binder1024    45037    23360    29251    665.0759  1282.236
BM_sendVec_binder2048    47853    25761    27091    1159.433  2153.735
BM_sendVec_binder4096    55574    31745    22405    1651.328  2890.877
BM_sendVec_binder8192    70706    43693    16400    1900.105  3074.836
BM_sendVec_binder16384   96161    64362    10793    1838.921  2747.468
BM_sendVec_binder32768  147875   107292     6296    1395.147  1922.858
BM_sendVec_binder65536  330324   232296     3053    605.7126  861.3209
NORAML TEST                                 SUM     10033.56  16623.35
stressapptest eat 2G                        SUM      9958.43  16497.55

Signed-off-by: Lei Liu <liulei.rjpt@vivo.com>
Acked-by: Carlos Llamas <cmllamas@google.com>

Bug: 331900628
Link: https://lore.kernel.org/all/20240619113841.3362-1-liulei.rjpt@vivo.com/
Change-Id: Ie66f3e8744ea6031c00f4b6c886719dc9dbc90f1
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-08-03 16:41:23 +03:00
Carlos Llamas
f642f364e2 binder: fix max_thread type inconsistency
commit 42316941335644a98335f209daafa4c122f28983 upstream.

The type defined for the BINDER_SET_MAX_THREADS ioctl was changed from
size_t to __u32 in order to avoid incompatibility issues between 32 and
64-bit kernels. However, the internal types used to copy from user and
store the value were never updated. Use u32 to fix the inconsistency.

Fixes: a9350fc859 ("staging: android: binder: fix BINDER_SET_MAX_THREADS declaration")
Reported-by: Arve Hjønnevåg <arve@android.com>
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/r/20240421173750.3117808-1-cmllamas@google.com
[cmllamas: resolve minor conflicts due to missing commit 421518a2740f]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit c437184be3c16f7123e5c59b4c85c1101f4dc96b)
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
2024-07-15 17:44:32 +00:00
Juhyung Park
29b9923ede binder: Extend kmem_cache to binder_task_work_cb and binder_txn_fd_fixup
Change-Id: Ifcbf563b624871f28e9da1d7a367d48e90cab81c
Signed-off-by: Juhyung Park <qkrwngud825@gmail.com>
Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>
2024-05-20 22:55:49 +03:00
Sultan Alsawaf
6c45b998ba binder: Reserve caches for small, high-frequency memory allocations
Most of binder's memory allocations are tiny, and they're allocated
and freed extremely frequently. The latency from going through the page
allocator all the time for such small allocations ends up being quite
high, especially when the system is low on memory. Binder is
performance-critical, so this is suboptimal.

Instead of using kzalloc to allocate a struct every time, reserve caches
specifically for allocating each struct quickly.

Change-Id: Ic63d27213f6a33dda817e959379a07c6384ece29
Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com>
Signed-off-by: Danny Lin <danny@kdrag0n.dev>
Signed-off-by: Juhyung Park <qkrwngud825@gmail.com>
Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>
2024-05-20 22:55:49 +03:00
Juhyung Park
3a0865b503 binder: Avoid redundant zeroing of twcb and fixup
These are initialized properly from the code just below kzalloc().

Replace it with kmalloc().

Change-Id: I0708699817fb6d0a1265bfbec6d3b27cfa00dd34
Signed-off-by: Juhyung Park <qkrwngud825@gmail.com>
Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>
2024-05-20 22:55:49 +03:00
John Dias
9822a21d60 binder: Set binder_(alloc_)debug_mask=0 to suppress logging
* Excessive logging -- not present on angler -- is
   affecting performance, contributing to missed audio
   deadlines and likely other latency-dependent tasks.

Bug: 30375418
[0ctobot: Extend patch to cover binder_alloc_debug_mask]
Co-authored-by: Adam W. Willis <return.of.octobot@gmail.com>

Change-Id: I2acbc34aff0019d24c5c748df583f06f9d01aeb5
Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>
2024-05-20 22:55:49 +03:00
Sultan Alsawaf
2e7321bdca binder: Stub out debug prints by default
Binder code is very hot, so checking frequently to see if a debug
message should be printed is a waste of cycles. We're not debugging
binder, so just stub out the debug prints to compile them out entirely.

Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com>
Change-Id: I66ac2d22bbc8943976b4dffa742e55b4e118d042
Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>
2024-05-20 22:55:48 +03:00
Helium-Studio
037263cbfd binder: Fix 5.10 binder compilation on 4.14
* Taken from 6b161e4ab9 and fc245aac49

Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>
2024-05-20 22:55:48 +03:00
Helium-Studio
6ab788244a binder: Checkout to android13-5.10-lts
* Taken from 7859c5c9eb

Signed-off-by: Helium-Studio <67852324+Helium-Studio@users.noreply.github.com>
2024-05-20 22:55:48 +03:00
Carlos Llamas
aaf0101b79 binder: signal epoll threads of self-work
[ Upstream commit 97830f3c3088638ff90b20dfba2eb4d487bf14d7 ]

In (e)poll mode, threads often depend on I/O events to determine when
data is ready for consumption. Within binder, a thread may initiate a
command via BINDER_WRITE_READ without a read buffer and then make use
of epoll_wait() or similar to consume any responses afterwards.

It is then crucial that epoll threads are signaled via wakeup when they
queue their own work. Otherwise, they risk waiting indefinitely for an
event leaving their work unhandled. What is worse, subsequent commands
won't trigger a wakeup either as the thread has pending work.

Fixes: 457b9a6f09 ("Staging: android: add binder driver")
Cc: Arve Hjønnevåg <arve@android.com>
Cc: Martijn Coenen <maco@android.com>
Cc: Alice Ryhl <aliceryhl@google.com>
Cc: Steven Moreland <smoreland@google.com>
Cc: stable@vger.kernel.org # v4.19+
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240131215347.1808751-1-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
2024-05-06 14:36:44 +00:00
Martijn Coenen
abd2c4dd77 ANDROID: binder: Add thread->process_todo flag.
[ Upstream commit 148ade2c4d4f46b3ecc1ddad1c762371e8708e35 ]

This flag determines whether the thread should currently
process the work in the thread->todo worklist.

The prime usecase for this is improving the performance
of synchronous transactions: all synchronous transactions
post a BR_TRANSACTION_COMPLETE to the calling thread,
but there's no reason to return that command to userspace
right away - userspace anyway needs to wait for the reply.

Likewise, a synchronous transaction that contains a binder
object can cause a BC_ACQUIRE/BC_INCREFS to be returned to
userspace; since the caller must anyway hold a strong/weak
ref for the duration of the call, postponing these commands
until the reply comes in is not a problem.

Note that this flag is not used to determine whether a
thread can handle process work; a thread should never pick
up process work when thread work is still pending.

Before patch:
------------------------------------------------------------------
Benchmark                           Time           CPU Iterations
------------------------------------------------------------------
BM_sendVec_binderize/4          45959 ns      20288 ns      34351
BM_sendVec_binderize/8          45603 ns      20080 ns      34909
BM_sendVec_binderize/16         45528 ns      20113 ns      34863
BM_sendVec_binderize/32         45551 ns      20122 ns      34881
BM_sendVec_binderize/64         45701 ns      20183 ns      34864
BM_sendVec_binderize/128        45824 ns      20250 ns      34576
BM_sendVec_binderize/256        45695 ns      20171 ns      34759
BM_sendVec_binderize/512        45743 ns      20211 ns      34489
BM_sendVec_binderize/1024       46169 ns      20430 ns      34081

After patch:
------------------------------------------------------------------
Benchmark                           Time           CPU Iterations
------------------------------------------------------------------
BM_sendVec_binderize/4          42939 ns      17262 ns      40653
BM_sendVec_binderize/8          42823 ns      17243 ns      40671
BM_sendVec_binderize/16         42898 ns      17243 ns      40594
BM_sendVec_binderize/32         42838 ns      17267 ns      40527
BM_sendVec_binderize/64         42854 ns      17249 ns      40379
BM_sendVec_binderize/128        42881 ns      17288 ns      40427
BM_sendVec_binderize/256        42917 ns      17297 ns      40429
BM_sendVec_binderize/512        43184 ns      17395 ns      40411
BM_sendVec_binderize/1024       43119 ns      17357 ns      40432

Signed-off-by: Martijn Coenen <maco@android.com>

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 97830f3c3088 ("binder: signal epoll threads of self-work")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
2024-05-06 14:36:44 +00:00
SK00RUPA
e95d9e4ff3 treewide: Fix LTS mismerges 2024-04-06 14:57:25 +03:00
kondors1995
e6b0b34bb0 Merge branch 'linux-4.14.y' of https://github.com/openela/kernel-lts into 14.0 2024-03-26 18:32:22 +02:00
kondors1995
1f63660633 binder: Fix -Wunused warning
../drivers/android/binder.c:3071:7: warning: unused variable 'err' [-Wunused-variable]
 3071 |                 int err;
2024-02-07 15:49:53 +02:00
John Galt
f676ed7aa6 treewide: revert over inline optimization
For upcoming changes
2024-02-07 15:49:36 +02:00
kondors1995
b81bd3cc3f Revert "FROMGIT: binder: use EPOLLERR from eventpoll.h"
This reverts commit a1d050902d.
2024-02-07 15:48:47 +02:00
kondors1995
5e5fb6cb79 Revert "binder_alloc: Checkout to android13-5.10"
This reverts commit a4d0192fe9.
2024-02-07 15:48:43 +02:00
kondors1995
067b314ffc Revert "binder: Fix build"
This reverts commit 2cc7bbb9a9.
2024-02-07 15:48:43 +02:00
kondors1995
5af2825013 Revert "binder: Adapt to new binder alloc API"
This reverts commit 0adda2e6bd.
2024-02-07 15:48:41 +02:00
Carlos Llamas
09f65d968e binder: fix unused alloc->free_async_space
commit c6d05e0762ab276102246d24affd1e116a46aa0c upstream.

Each transaction is associated with a 'struct binder_buffer' that stores
the metadata about its buffer area. Since commit 74310e06be ("android:
binder: Move buffer out of area shared with user space") this struct is
no longer embedded within the buffer itself but is instead allocated on
the heap to prevent userspace access to this driver-exclusive info.

Unfortunately, the space of this struct is still being accounted for in
the total buffer size calculation, specifically for async transactions.
This results in an additional 104 bytes added to every async buffer
request, and this area is never used.

This wasted space can be substantial. If we consider the maximum mmap
buffer space of SZ_4M, the driver will reserve half of it for async
transactions, or 0x200000. This area should, in theory, accommodate up
to 262,144 buffers of the minimum 8-byte size. However, after adding
the extra 'sizeof(struct binder_buffer)', the total number of buffers
drops to only 18,724, which is a sad 7.14% of the actual capacity.

This patch fixes the buffer size calculation to enable the utilization
of the entire async buffer space. This is expected to reduce the number
of -ENOSPC errors that are seen on the field.

Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space")
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-6-cmllamas@google.com
[cmllamas: fix trivial conflict with missing 261e7818f06e.]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit e2425a67b5ed67496959d0dfb99816f5757164b0)
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
2024-02-02 11:33:45 +00:00
Carlos Llamas
553b9fbf5d binder: fix race between mmput() and do_exit()
commit 9a9ab0d963621d9d12199df9817e66982582d5a5 upstream.

Task A calls binder_update_page_range() to allocate and insert pages on
a remote address space from Task B. For this, Task A pins the remote mm
via mmget_not_zero() first. This can race with Task B do_exit() and the
final mmput() refcount decrement will come from Task A.

  Task A            | Task B
  ------------------+------------------
  mmget_not_zero()  |
                    |  do_exit()
                    |    exit_mm()
                    |      mmput()
  mmput()           |
    exit_mmap()     |
      remove_vma()  |
        fput()      |

In this case, the work of ____fput() from Task B is queued up in Task A
as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup
work gets executed. However, Task A instead sleep, waiting for a reply
from Task B that never comes (it's dead).

This means the binder_deferred_release() is blocked until an unrelated
binder event forces Task A to go back to userspace. All the associated
death notifications will also be delayed until then.

In order to fix this use mmput_async() that will schedule the work in
the corresponding mm->async_put_work WQ instead of Task A.

Fixes: 457b9a6f09 ("Staging: android: add binder driver")
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-4-cmllamas@google.com
[cmllamas: fix trivial conflict with missing d8ed45c5dcd4.]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 95b1d336b0642198b56836b89908d07b9a0c9608)
[fix conflict due to missing commit 720c241924046aff83f5f2323232f34a30a4c281
 ("ANDROID: binder: change down_write to down_read")]
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
2024-02-02 11:33:44 +00:00
Carlos Llamas
d0bbd4afe4 binder: fix async space check for 0-sized buffers
commit 3091c21d3e9322428691ce0b7a0cfa9c0b239eeb upstream.

Move the padding of 0-sized buffers to an earlier stage to account for
this round up during the alloc->free_async_space check.

Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space")
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-5-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 05088b886fea59cc827e5b5cedb66165cf532f72)
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
2024-02-02 11:33:44 +00:00
Carlos Llamas
40db091e8d binder: fix comment on binder_alloc_new_buf() return value
commit e1090371e02b601cbfcea175c2a6cc7c955fa830 upstream.

Update the comments of binder_alloc_new_buf() to reflect that the return
value of the function is now ERR_PTR(-errno) on failure.

No functional changes in this patch.

Cc: stable@vger.kernel.org
Fixes: 57ada2fb22 ("binder: add log information for binder transaction failures")
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-8-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 10cfdc51c399890e535ccc16ed3f58b7c5e8f93e)
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
2024-02-02 11:33:37 +00:00
Kazuki H
0adda2e6bd binder: Adapt to new binder alloc API
Signed-off-by: Kazuki H <kazukih0205@gmail.com>
2024-01-23 15:34:25 +02:00
Kazuki H
2cc7bbb9a9 binder: Fix build
Signed-off-by: Kazuki H <kazukih0205@gmail.com>
2024-01-23 15:34:19 +02:00
Kazuki H
a4d0192fe9 binder_alloc: Checkout to android13-5.10
binder_alloc from android13-5.10 has numerous performance improvements.

Signed-off-by: Kazuki H <kazukih0205@gmail.com>
2024-01-23 15:34:00 +02:00
Carlos Llamas
a1d050902d FROMGIT: binder: use EPOLLERR from eventpoll.h
Use EPOLLERR instead of POLLERR to make sure it is cast to the correct
__poll_t type. This fixes the following sparse issue:

  drivers/android/binder.c:5030:24: warning: incorrect type in return expression (different base types)
  drivers/android/binder.c:5030:24:    expected restricted __poll_t
  drivers/android/binder.c:5030:24:    got int

Fixes: f88982679f54 ("binder: check for binder_thread allocation failure in binder_poll()")
Cc: stable@vger.kernel.org
Cc: Eric Biggers <ebiggers@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-2-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 254650075
(cherry picked from commit 6ac061db9c58ca5b9270b1b3940d2464fb3ff183
 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 char-misc-next)
Change-Id: Ib77d9a6e9059ceab2539c7ef6c93ad74f1eabed8
Signed-off-by: Carlos Llamas <cmllamas@google.com>
2024-01-23 15:01:38 +02:00
Tashfin Shakeer Rhythm
83b6abec90 binder: Do not reserve kmem caches for memory allocations
Among the kmem caches, the duplicate ones get merged with the system kmem
caches that cover basically every allocation size <64K which is a power of
2. In such a case, use of kmem cache is useless. Remove them.

Suggested-by: Sultan Alsawaf <sultan@kerneltoast.com>
Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>
2023-09-29 17:34:50 +03:00
kondors1995
7457652193 treewide: Remove perf critical API & its ussage 2023-09-10 13:11:06 +03:00
kondors1995
a0ec600ea2 Merge commit 'b100cba1c0da802ea65002c2a1c9a898c5ca31d8' into dev/13.0 2023-09-02 11:18:02 +03:00
Greg Kroah-Hartman
274c7d23b7 Merge 4.14.324 into android-4.14-stable
Changes in 4.14.324
	lib/mpi: Eliminate unused umul_ppmm definitions for MIPS
	drm/radeon: Fix integer overflow in radeon_cs_parser_init
	ALSA: emu10k1: roll up loops in DSP setup code for Audigy
	quota: Properly disable quotas when add_dquot_ref() fails
	quota: fix warning in dqgrab()
	udf: Fix uninitialized array access for some pathnames
	fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
	MIPS: dec: prom: Address -Warray-bounds warning
	FS: JFS: Fix null-ptr-deref Read in txBegin
	FS: JFS: Check for read-only mounted filesystem in txBegin
	media: v4l2-mem2mem: add lock to protect parameter num_rdy
	media: platform: mediatek: vpu: fix NULL ptr dereference
	gfs2: Fix possible data races in gfs2_show_options()
	pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
	Bluetooth: L2CAP: Fix use-after-free
	drm/amdgpu: Fix potential fence use-after-free v2
	fbdev: mmp: fix value check in mmphw_probe()
	net: xfrm: Fix xfrm_address_filter OOB read
	net: af_key: fix sadb_x_filter validation
	ip6_vti: fix slab-use-after-free in decode_session6
	ip_vti: fix potential slab-use-after-free in decode_session6
	xfrm: add NULL check in xfrm_update_ae_params
	netfilter: nft_dynset: disallow object maps
	team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
	i40e: fix misleading debug logs
	sock: Fix misuse of sk_under_memory_pressure()
	net: do not allow gso_size to be set to GSO_BY_FRAGS
	ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.
	cifs: Release folio lock on fscache read hit.
	mmc: wbsd: fix double mmc_free_host() in wbsd_init()
	serial: 8250: Fix oops for port->pm on uart_change_pm()
	binder: fix memory leak in binder_init()
	test_firmware: prevent race conditions by a correct implementation of locking
	netfilter: set default timeout to 3 secs for sctp shutdown send and recv state
	ASoC: rt5665: add missed regulator_bulk_disable
	af_unix: Fix null-ptr-deref in unix_stream_sendpage().
	net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled
	net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
	net: phy: broadcom: stub c45 read/write for 54810
	tracing: Fix memleak due to race between current_tracer and trace
	sock: annotate data-races around prot->memory_pressure
	igb: Avoid starting unnecessary workqueues
	ipvs: Improve robustness to the ipvs sysctl
	ipvs: fix racy memcpy in proc_do_sync_threshold
	ibmveth: Use dcbf rather than dcbfl
	batman-adv: Trigger events for auto adjusted MTU
	batman-adv: Do not get eth header before batadv_check_management_packet
	batman-adv: Fix TT global entry leak when client roamed back
	batman-adv: Fix batadv_v_ogm_aggr_send memory leak
	lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels
	media: vcodec: Fix potential array out-of-bounds in encoder queue_setup
	x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4
	rtnetlink: Reject negative ifindexes in RTM_NEWLINK
	scsi: snic: Fix double free in snic_tgt_create()
	scsi: core: raid_class: Remove raid_component_add()
	dma-buf/sw_sync: Avoid recursive lock during fence signal
	Linux 4.14.324

Change-Id: I91a1deeaf4c37592b26abd9d9314eff77329c0f0
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-08-30 16:35:16 +00:00
Qi Zheng
486dd742ba binder: fix memory leak in binder_init()
commit adb9743d6a08778b78d62d16b4230346d3508986 upstream.

In binder_init(), the destruction of binder_alloc_shrinker_init() is not
performed in the wrong path, which will cause memory leaks. So this commit
introduces binder_alloc_shrinker_exit() and calls it in the wrong path to
fix that.

Signed-off-by: Qi Zheng <zhengqi.arch@bytedance.com>
Acked-by: Carlos Llamas <cmllamas@google.com>
Fixes: f2517eb76f ("android: binder: Add global lru shrinker to binder")
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/20230625154937.64316-1-qi.zheng@linux.dev
[cmllamas: resolved trivial merge conflicts]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-08-30 16:35:13 +02:00
Juhyung Park
ad8bd8a2da binder: extend kmem cache to binder_task_work_cb and binder_txn_fd_fixup
Signed-off-by: Juhyung Park <qkrwngud825@gmail.com>
Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>
2022-12-20 12:08:16 +02:00
Sultan Alsawaf
177f433520 binder: Reserve caches for small, high-frequency memory allocations
Most of binder's memory allocations are tiny, and they're allocated
and freed extremely frequently. The latency from going through the page
allocator all the time for such small allocations ends up being quite
high, especially when the system is low on memory. Binder is
performance-critical, so this is suboptimal.

Instead of using kzalloc to allocate a struct every time, reserve caches
specifically for allocating each struct quickly.

Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com>
Signed-off-by: Danny Lin <danny@kdrag0n.dev>
[ Tashar02: Fix compilation on k5.10 binder ]
Co-authored-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>
Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>
2022-12-20 12:08:13 +02:00