Re: [PATCH v2] android: binder: fix binder mmap failures

2015-03-01 Thread Amit Pundir 
On 27 February 2015 at 23:14, Andrey Ryabinin  wrote:
> binder_update_page_range() initializes only addr and size
> fields in 'struct vm_struct tmp_area;' and passes it to
> map_vm_area().
>
> Before 71394fe50146 ("mm: vmalloc: add flag preventing guard hole allocation")
> this was because map_vm_area() didn't use any other fields
> in vm_struct except addr and size.
>
> Now get_vm_area_size() (used in map_vm_area()) reads vm_struct's
> flags to determine whether vm area has guard hole or not.
>
> binder_update_page_range() don't initialize flags field, so
> this causes following binder mmap failures:
> ---[ cut here ]
> WARNING: CPU: 0 PID: 1971 at mm/vmalloc.c:130
> vmap_page_range_noflush+0x119/0x144()
> CPU: 0 PID: 1971 Comm: healthd Not tainted 4.0.0-rc1-00399-g7da3fdc-dirty #157
> Hardware name: ARM-Versatile Express
> [] (unwind_backtrace) from [] (show_stack+0x11/0x14)
> [] (show_stack) from [] (dump_stack+0x59/0x7c)
> [] (dump_stack) from [] (warn_slowpath_common+0x55/0x84)
> [] (warn_slowpath_common) from []
> (warn_slowpath_null+0x17/0x1c)
> [] (warn_slowpath_null) from []
> (vmap_page_range_noflush+0x119/0x144)
> [] (vmap_page_range_noflush) from [] 
> (map_vm_area+0x27/0x48)
> [] (map_vm_area) from []
> (binder_update_page_range+0x12f/0x27c)
> [] (binder_update_page_range) from []
> (binder_mmap+0xbf/0x1ac)
> [] (binder_mmap) from [] (mmap_region+0x2eb/0x4d4)
> [] (mmap_region) from [] (do_mmap_pgoff+0x1e7/0x250)
> [] (do_mmap_pgoff) from [] (vm_mmap_pgoff+0x45/0x60)
> [] (vm_mmap_pgoff) from [] (SyS_mmap_pgoff+0x5d/0x80)
> [] (SyS_mmap_pgoff) from [] (ret_fast_syscall+0x1/0x5c)
> ---[ end trace 48c2c4b9a1349e54 ]---
> binder: 1982: binder_alloc_buf failed to map page at f0e0 in kernel
> binder: binder_mmap: 1982 b6bde000-b6cdc000 alloc small buf failed -12
>
> Use map_kernel_range_noflush() instead of map_vm_area() as this is better
> API for binder's purposes and it allows to get rid of 'vm_struct tmp_area' at 
> all.
>
> Fixes: 71394fe50146 ("mm: vmalloc: add flag preventing guard hole allocation")
> Signed-off-by: Andrey Ryabinin 
> Reported-by: Amit Pundir 
> ---
>  Changes since v1:
>- fixed ret check after map_kernel_ranges_noflush().
>
>  drivers/android/binder.c | 10 +-
>  1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> index 33b09b6..6607f3c 100644
> --- a/drivers/android/binder.c
> +++ b/drivers/android/binder.c
> @@ -551,7 +551,6 @@ static int binder_update_page_range(struct binder_proc 
> *proc, int allocate,
>  {
> void *page_addr;
> unsigned long user_page_addr;
> -   struct vm_struct tmp_area;
> struct page **page;
> struct mm_struct *mm;
>
> @@ -600,10 +599,11 @@ static int binder_update_page_range(struct binder_proc 
> *proc, int allocate,
> proc->pid, page_addr);
> goto err_alloc_page_failed;
> }
> -   tmp_area.addr = page_addr;
> -   tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */;
> -   ret = map_vm_area(&tmp_area, PAGE_KERNEL, page);
> -   if (ret) {
> +   ret = map_kernel_range_noflush((unsigned long)page_addr,
> +   PAGE_SIZE, PAGE_KERNEL, page);
> +   flush_cache_vmap((unsigned long)page_addr,
> +   (unsigned long)page_addr + PAGE_SIZE);
> +   if (ret != 1) {
> pr_err("%d: binder_alloc_buf failed to map page at %p 
> in kernel\n",
>proc->pid, page_addr);
> goto err_map_kernel_failed;
> --

Works for me. Thanks.

Tested-by: Amit Pundir 

> 2.3.0
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majord...@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH v2] android: binder: fix binder mmap failures

2015-02-27 Thread David Rientjes 
On Fri, 27 Feb 2015, Andrey Ryabinin wrote:

> binder_update_page_range() initializes only addr and size
> fields in 'struct vm_struct tmp_area;' and passes it to
> map_vm_area().
> 
> Before 71394fe50146 ("mm: vmalloc: add flag preventing guard hole allocation")
> this was because map_vm_area() didn't use any other fields
> in vm_struct except addr and size.
> 
> Now get_vm_area_size() (used in map_vm_area()) reads vm_struct's
> flags to determine whether vm area has guard hole or not.
> 
> binder_update_page_range() don't initialize flags field, so
> this causes following binder mmap failures:
> ---[ cut here ]
> WARNING: CPU: 0 PID: 1971 at mm/vmalloc.c:130
> vmap_page_range_noflush+0x119/0x144()
> CPU: 0 PID: 1971 Comm: healthd Not tainted 4.0.0-rc1-00399-g7da3fdc-dirty #157
> Hardware name: ARM-Versatile Express
> [] (unwind_backtrace) from [] (show_stack+0x11/0x14)
> [] (show_stack) from [] (dump_stack+0x59/0x7c)
> [] (dump_stack) from [] (warn_slowpath_common+0x55/0x84)
> [] (warn_slowpath_common) from []
> (warn_slowpath_null+0x17/0x1c)
> [] (warn_slowpath_null) from []
> (vmap_page_range_noflush+0x119/0x144)
> [] (vmap_page_range_noflush) from [] 
> (map_vm_area+0x27/0x48)
> [] (map_vm_area) from []
> (binder_update_page_range+0x12f/0x27c)
> [] (binder_update_page_range) from []
> (binder_mmap+0xbf/0x1ac)
> [] (binder_mmap) from [] (mmap_region+0x2eb/0x4d4)
> [] (mmap_region) from [] (do_mmap_pgoff+0x1e7/0x250)
> [] (do_mmap_pgoff) from [] (vm_mmap_pgoff+0x45/0x60)
> [] (vm_mmap_pgoff) from [] (SyS_mmap_pgoff+0x5d/0x80)
> [] (SyS_mmap_pgoff) from [] (ret_fast_syscall+0x1/0x5c)
> ---[ end trace 48c2c4b9a1349e54 ]---
> binder: 1982: binder_alloc_buf failed to map page at f0e0 in kernel
> binder: binder_mmap: 1982 b6bde000-b6cdc000 alloc small buf failed -12
> 
> Use map_kernel_range_noflush() instead of map_vm_area() as this is better
> API for binder's purposes and it allows to get rid of 'vm_struct tmp_area' at 
> all.
> 
> Fixes: 71394fe50146 ("mm: vmalloc: add flag preventing guard hole allocation")
> Signed-off-by: Andrey Ryabinin 
> Reported-by: Amit Pundir 

Acked-by: David Rientjes 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Re: [PATCH v2] android: binder: fix binder mmap failures

2015-02-27 Thread John Stultz 
On Fri, Feb 27, 2015 at 9:44 AM, Andrey Ryabinin  wrote:
> binder_update_page_range() initializes only addr and size
> fields in 'struct vm_struct tmp_area;' and passes it to
> map_vm_area().
>
> Before 71394fe50146 ("mm: vmalloc: add flag preventing guard hole allocation")
> this was because map_vm_area() didn't use any other fields
> in vm_struct except addr and size.
>
> Now get_vm_area_size() (used in map_vm_area()) reads vm_struct's
> flags to determine whether vm area has guard hole or not.
>
> binder_update_page_range() don't initialize flags field, so
> this causes following binder mmap failures:
> ---[ cut here ]
> WARNING: CPU: 0 PID: 1971 at mm/vmalloc.c:130
> vmap_page_range_noflush+0x119/0x144()
> CPU: 0 PID: 1971 Comm: healthd Not tainted 4.0.0-rc1-00399-g7da3fdc-dirty #157
> Hardware name: ARM-Versatile Express
> [] (unwind_backtrace) from [] (show_stack+0x11/0x14)
> [] (show_stack) from [] (dump_stack+0x59/0x7c)
> [] (dump_stack) from [] (warn_slowpath_common+0x55/0x84)
> [] (warn_slowpath_common) from []
> (warn_slowpath_null+0x17/0x1c)
> [] (warn_slowpath_null) from []
> (vmap_page_range_noflush+0x119/0x144)
> [] (vmap_page_range_noflush) from [] 
> (map_vm_area+0x27/0x48)
> [] (map_vm_area) from []
> (binder_update_page_range+0x12f/0x27c)
> [] (binder_update_page_range) from []
> (binder_mmap+0xbf/0x1ac)
> [] (binder_mmap) from [] (mmap_region+0x2eb/0x4d4)
> [] (mmap_region) from [] (do_mmap_pgoff+0x1e7/0x250)
> [] (do_mmap_pgoff) from [] (vm_mmap_pgoff+0x45/0x60)
> [] (vm_mmap_pgoff) from [] (SyS_mmap_pgoff+0x5d/0x80)
> [] (SyS_mmap_pgoff) from [] (ret_fast_syscall+0x1/0x5c)
> ---[ end trace 48c2c4b9a1349e54 ]---
> binder: 1982: binder_alloc_buf failed to map page at f0e0 in kernel
> binder: binder_mmap: 1982 b6bde000-b6cdc000 alloc small buf failed -12
>
> Use map_kernel_range_noflush() instead of map_vm_area() as this is better
> API for binder's purposes and it allows to get rid of 'vm_struct tmp_area' at 
> all.
>
> Fixes: 71394fe50146 ("mm: vmalloc: add flag preventing guard hole allocation")
> Signed-off-by: Andrey Ryabinin 
> Reported-by: Amit Pundir 
> ---
>  Changes since v1:
>- fixed ret check after map_kernel_ranges_noflush().
>
>  drivers/android/binder.c | 10 +-
>  1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> index 33b09b6..6607f3c 100644
> --- a/drivers/android/binder.c
> +++ b/drivers/android/binder.c
> @@ -551,7 +551,6 @@ static int binder_update_page_range(struct binder_proc 
> *proc, int allocate,
>  {
> void *page_addr;
> unsigned long user_page_addr;
> -   struct vm_struct tmp_area;
> struct page **page;
> struct mm_struct *mm;
>
> @@ -600,10 +599,11 @@ static int binder_update_page_range(struct binder_proc 
> *proc, int allocate,
> proc->pid, page_addr);
> goto err_alloc_page_failed;
> }
> -   tmp_area.addr = page_addr;
> -   tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */;
> -   ret = map_vm_area(&tmp_area, PAGE_KERNEL, page);
> -   if (ret) {
> +   ret = map_kernel_range_noflush((unsigned long)page_addr,
> +   PAGE_SIZE, PAGE_KERNEL, page);
> +   flush_cache_vmap((unsigned long)page_addr,
> +   (unsigned long)page_addr + PAGE_SIZE);
> +   if (ret != 1) {
> pr_err("%d: binder_alloc_buf failed to map page at %p 
> in kernel\n",
>proc->pid, page_addr);
> goto err_map_kernel_failed;


This seems to work better. Thanks!

Tested-by: John Stultz 

-john
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[PATCH v2] android: binder: fix binder mmap failures

2015-02-27 Thread Andrey Ryabinin 
binder_update_page_range() initializes only addr and size
fields in 'struct vm_struct tmp_area;' and passes it to
map_vm_area().

Before 71394fe50146 ("mm: vmalloc: add flag preventing guard hole allocation")
this was because map_vm_area() didn't use any other fields
in vm_struct except addr and size.

Now get_vm_area_size() (used in map_vm_area()) reads vm_struct's
flags to determine whether vm area has guard hole or not.

binder_update_page_range() don't initialize flags field, so
this causes following binder mmap failures:
---[ cut here ]
WARNING: CPU: 0 PID: 1971 at mm/vmalloc.c:130
vmap_page_range_noflush+0x119/0x144()
CPU: 0 PID: 1971 Comm: healthd Not tainted 4.0.0-rc1-00399-g7da3fdc-dirty #157
Hardware name: ARM-Versatile Express
[] (unwind_backtrace) from [] (show_stack+0x11/0x14)
[] (show_stack) from [] (dump_stack+0x59/0x7c)
[] (dump_stack) from [] (warn_slowpath_common+0x55/0x84)
[] (warn_slowpath_common) from []
(warn_slowpath_null+0x17/0x1c)
[] (warn_slowpath_null) from []
(vmap_page_range_noflush+0x119/0x144)
[] (vmap_page_range_noflush) from [] (map_vm_area+0x27/0x48)
[] (map_vm_area) from []
(binder_update_page_range+0x12f/0x27c)
[] (binder_update_page_range) from []
(binder_mmap+0xbf/0x1ac)
[] (binder_mmap) from [] (mmap_region+0x2eb/0x4d4)
[] (mmap_region) from [] (do_mmap_pgoff+0x1e7/0x250)
[] (do_mmap_pgoff) from [] (vm_mmap_pgoff+0x45/0x60)
[] (vm_mmap_pgoff) from [] (SyS_mmap_pgoff+0x5d/0x80)
[] (SyS_mmap_pgoff) from [] (ret_fast_syscall+0x1/0x5c)
---[ end trace 48c2c4b9a1349e54 ]---
binder: 1982: binder_alloc_buf failed to map page at f0e0 in kernel
binder: binder_mmap: 1982 b6bde000-b6cdc000 alloc small buf failed -12

Use map_kernel_range_noflush() instead of map_vm_area() as this is better
API for binder's purposes and it allows to get rid of 'vm_struct tmp_area' at 
all.

Fixes: 71394fe50146 ("mm: vmalloc: add flag preventing guard hole allocation")
Signed-off-by: Andrey Ryabinin 
Reported-by: Amit Pundir 
---
 Changes since v1:
   - fixed ret check after map_kernel_ranges_noflush().

 drivers/android/binder.c | 10 +-
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 33b09b6..6607f3c 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -551,7 +551,6 @@ static int binder_update_page_range(struct binder_proc 
*proc, int allocate,
 {
void *page_addr;
unsigned long user_page_addr;
-   struct vm_struct tmp_area;
struct page **page;
struct mm_struct *mm;
 
@@ -600,10 +599,11 @@ static int binder_update_page_range(struct binder_proc 
*proc, int allocate,
proc->pid, page_addr);
goto err_alloc_page_failed;
}
-   tmp_area.addr = page_addr;
-   tmp_area.size = PAGE_SIZE + PAGE_SIZE /* guard page? */;
-   ret = map_vm_area(&tmp_area, PAGE_KERNEL, page);
-   if (ret) {
+   ret = map_kernel_range_noflush((unsigned long)page_addr,
+   PAGE_SIZE, PAGE_KERNEL, page);
+   flush_cache_vmap((unsigned long)page_addr,
+   (unsigned long)page_addr + PAGE_SIZE);
+   if (ret != 1) {
pr_err("%d: binder_alloc_buf failed to map page at %p 
in kernel\n",
   proc->pid, page_addr);
goto err_map_kernel_failed;
-- 
2.3.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/