Introduce a generic netlink multicast event to report binder transaction
failures to userspace. This allows subscribers to monitor these events
and take appropriate actions, such as stopping a misbehaving application
that is spamming a service with huge amount of transactions.
The multicast event contains full details of the failed transactions,
including the sender/target PIDs, payload size and specific error code.
This interface is defined using a YAML spec, from which the UAPI and
kernel headers and source are auto-generated.
Signed-off-by: Li Li <dualli@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20250727182932.2499194-4-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 372832477
(cherry picked from commit 63740349eba78f242bcbf60d5244d7f2b2600853
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-next)
[cmllamas: fix missing t->is_reply, fix ABI header include issue]
Change-Id: I7013f9bba450f7ab3331dd850314a7b62af58818
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Rust does not currently support the kernel-hwaddress sanitizer, so
KASAN_SW_TAGS cannot be enabled (other KASAN variants are supported).
This means that when building with --kasan_sw_tags, Rust gets disabled,
and no rust_binder.ko module is built, which causes a build failure as
it's expected to be available as a GKI module.
Provide a new option to build a dummy module called rust_binder.ko that
can be included in KASAN_SW_TAGS builds.
This approach is used because _ARM64_GKI_MODULES_LIST does not currently
support select(), so we cannot remove rust_binder.ko from the list of
expected modules.
Bug: 419603781
Change-Id: I1e24a2f00e1bd38bb60e9ef40c3189e17ef5a687
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
For now, we only provide the option to only enable C Binder, or to
enable both drivers. When both drivers are enabled, C Binder is always
the default.
We define a separate rust_binder-objs with all of the compilation units
rather than just listing them under obj-$(ANDROID_BINDER_IPC_RUST)
because otherwise five different GKI modules are built when choosing =m
for the config option.
With this commit, Rust Binder works as a built-in module. However it is
not actually enough to use it as a GKI module because GKI modules are
loaded too late in the boot process. That issue is tracked by
b/402049944 and will be fixed in a follow-up.
Bug: 388786466
Change-Id: I04a0b604a756717fff730e6e3eb4496da016a8e5
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
The mark_victim tracepoint is being updated with new fields (uid, comm,
and oom_score_adj). These new fields make it easier, for userspace, to
correlate the OOM event with the specific process, and also making this
out-of-tree driver obsolete.
Bug: 315560026
Change-Id: I783e4ba00b484f1468055e67bd1ad881b7e6d1da
Signed-off-by: Carlos Galo <carlosgalo@google.com>
Android has no-event driven way to know when certain memory conditions
occur, or memory management actions take place. This new memory health
driver will start capturing these cases, starting by keeping track of
out-of-memory (OOM) victims.
To access the list of OOM victims, the driver provides a proc file
named "oom_victim_list" in the "/proc/memhealth" directory. The
proc file supports sequential reading and polling.
Bug: 244232958
Change-Id: Ica5dcb4dc42229d85828f0e495a43d22390927f1
Signed-off-by: Carlos Galo <carlosgalo@google.com>
drivers/staging/android is going away, and systems seem to be relying on
this driver now, so move it into drivers/android/ to make everything
self-contained and prevent merge issues later on.
Bug: 170851792
Bug: 169101608
Cc: Jone Chou <jonechou@google.com>
Cc: Will McVicker <willmcvicker@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib969a7544ea74881da61d7cba1f529a269921049
Add support for vendor hooks. Adds include/trace/hooks
directory for trace definition headers where hooks
can be defined and vendor_hook.c for instantiating
and exporting them for vendor modules.
There are two variants of vendor hooks, both based
on tracepoints:
Normal: this uses the DECLARE_HOOK macro
to create a tracepoint function with the name trace_<name>
where <name> is the unique identifier for the trace.
Restricted: restricted hooks are needed for cases like
scheduler hooks where the attached function must be
called even if the cpu is offline or requires a
non-atomic context. Restricted vendor hooks cannot
be detached, so modules that attach to a restricted
hook can never unload. Also, only 1 attachment is
allowed (any other attempts to attach will fail with
-EBUSY).
For either case, modules attach to the hook by using
register_trace_<name>(func_ptr, NULL).
New hooks should be defined in headers in the
include/trace/hooks/ directory using the
DECLARE_HOOK() or DECLARE_RESTRICTED_HOOK()
macros.
New files added to include/trace/hooks should
be #include'd from drivers/android/vendor_hooks.c.
The EXPORT_TRACEPOINT_SYMBOL_GPL() should be
also added to drivers/android/vendor_hooks.c.
For example, if a new hook, 'android_vh_foo(int &ret)'
is added in do_exit() in exit.c, these changes are
needed:
1. create a new header file include/trace/hooks/foo.h
which contains:
#include <trace/hooks/vendor_hooks.h>
...
DECLARE_HOOK(android_vh_foo,
TP_PROTO(int *retp),
TP_ARGS(retp);
2. in exit.c, add
#include <trace/hooks/foo.h>
...
int ret = 0;
...
android_vh_foo(&ret);
if (ret)
return ret;
...
3. in drivers/android/vendor_hooks.c, add
#include <trace/hooks/foo.h>
...
EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_foo);
The hook can then be attached by adding the registration code
to the module:
#include <trace/hooks/sched.h>
...
static void my_foo(int *retp)
{
*retp = 0;
}
...
rc = register_trace_android_vh_sched_exit(my_foo, NULL);
Bug: 156285741
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I6a7d1c8919dae91c965e2a0450df50eac2d282db
Add SPDX license identifiers to all Make/Kconfig files which:
- Have no license information of any form
These files fall under the project license, GPL v2 only. The resulting SPDX
license identifier is:
GPL-2.0-only
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
As discussed at Linux Plumbers Conference 2018 in Vancouver [1] this is the
implementation of binderfs.
/* Abstract */
binderfs is a backwards-compatible filesystem for Android's binder ipc
mechanism. Each ipc namespace will mount a new binderfs instance. Mounting
binderfs multiple times at different locations in the same ipc namespace
will not cause a new super block to be allocated and hence it will be the
same filesystem instance.
Each new binderfs mount will have its own set of binder devices only
visible in the ipc namespace it has been mounted in. All devices in a new
binderfs mount will follow the scheme binder%d and numbering will always
start at 0.
/* Backwards compatibility */
Devices requested in the Kconfig via CONFIG_ANDROID_BINDER_DEVICES for the
initial ipc namespace will work as before. They will be registered via
misc_register() and appear in the devtmpfs mount. Specifically, the
standard devices binder, hwbinder, and vndbinder will all appear in their
standard locations in /dev. Mounting or unmounting the binderfs mount in
the initial ipc namespace will have no effect on these devices, i.e. they
will neither show up in the binderfs mount nor will they disappear when the
binderfs mount is gone.
/* binder-control */
Each new binderfs instance comes with a binder-control device. No other
devices will be present at first. The binder-control device can be used to
dynamically allocate binder devices. All requests operate on the binderfs
mount the binder-control device resides in.
Assuming a new instance of binderfs has been mounted at /dev/binderfs
via mount -t binderfs binderfs /dev/binderfs. Then a request to create a
new binder device can be made as illustrated in [2].
Binderfs devices can simply be removed via unlink().
/* Implementation details */
- dynamic major number allocation:
When binderfs is registered as a new filesystem it will dynamically
allocate a new major number. The allocated major number will be returned
in struct binderfs_device when a new binder device is allocated.
- global minor number tracking:
Minor are tracked in a global idr struct that is capped at
BINDERFS_MAX_MINOR. The minor number tracker is protected by a global
mutex. This is the only point of contention between binderfs mounts.
- struct binderfs_info:
Each binderfs super block has its own struct binderfs_info that tracks
specific details about a binderfs instance:
- ipc namespace
- dentry of the binder-control device
- root uid and root gid of the user namespace the binderfs instance
was mounted in
- mountable by user namespace root:
binderfs can be mounted by user namespace root in a non-initial user
namespace. The devices will be owned by user namespace root.
- binderfs binder devices without misc infrastructure:
New binder devices associated with a binderfs mount do not use the
full misc_register() infrastructure.
The misc_register() infrastructure can only create new devices in the
host's devtmpfs mount. binderfs does however only make devices appear
under its own mountpoint and thus allocates new character device nodes
from the inode of the root dentry of the super block. This will have
the side-effect that binderfs specific device nodes do not appear in
sysfs. This behavior is similar to devpts allocated pts devices and
has no effect on the functionality of the ipc mechanism itself.
[1]: https://goo.gl/JL2tfX
[2]: program to allocate a new binderfs binder device:
#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#include <linux/android/binder_ctl.h>
int main(int argc, char *argv[])
{
int fd, ret, saved_errno;
size_t len;
struct binderfs_device device = { 0 };
if (argc < 2)
exit(EXIT_FAILURE);
len = strlen(argv[1]);
if (len > BINDERFS_MAX_NAME)
exit(EXIT_FAILURE);
memcpy(device.name, argv[1], len);
fd = open("/dev/binderfs/binder-control", O_RDONLY | O_CLOEXEC);
if (fd < 0) {
printf("%s - Failed to open binder-control device\n",
strerror(errno));
exit(EXIT_FAILURE);
}
ret = ioctl(fd, BINDER_CTL_ADD, &device);
saved_errno = errno;
close(fd);
errno = saved_errno;
if (ret < 0) {
printf("%s - Failed to allocate new binder device\n",
strerror(errno));
exit(EXIT_FAILURE);
}
printf("Allocated new binder device with major %d, minor %d, and "
"name %s\n", device.major, device.minor,
device.name);
exit(EXIT_SUCCESS);
}
Cc: Martijn Coenen <maco@android.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
binder_alloc_selftest tests that alloc_new_buf handles page allocation and
deallocation properly when allocate and free buffers. The test allocates 5
buffers of various sizes to cover all possible page alignment cases, and
frees the buffers using a list of exhaustive freeing order.
Test: boot the device with ANDROID_BINDER_IPC_SELFTEST config option
enabled. Allocator selftest passes.
Signed-off-by: Sherry Yang <sherryy@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Move the binder allocator functionality to its own file
Continuation of splitting the binder allocator from the binder
driver. Split binder_alloc functions from normal binder functions.
Add kernel doc comments to functions declared extern in
binder_alloc.h
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
The Android binder code has been "stable" for many years now. No matter
what comes in the future, we are going to have to support this API, so
might as well move it to the "real" part of the kernel as there's no
real work that needs to be done to the existing code.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Li Li
Alice Ryhl
Carlos Galo
Greg Kroah-Hartman
Todd Kjos
Thomas Gleixner
Christian Brauner
Sherry Yang
Todd Kjos
Greg Kroah-Hartman