linux-kernel - Using page-fault handler in binder

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZEGh4mliGHvyWIvo@google.com>
Date:   Thu, 20 Apr 2023 20:34:42 +0000
From:   Carlos Llamas <cmllamas@...gle.com>
To:     linux-mm@...ck.org, surenb@...gle.com, tkjos@...gle.com
Cc:     linux-kernel@...r.kernel.org, kernel-team@...roid.com
Subject: Using page-fault handler in binder

Hi,

I'm trying to remove the current page handling in binder and switch to
using ->fault() and other mm/ infrastructure. See, we currently allocate
and insert pages manually into vmas, so dropping this boilerplate code
seems like a great idea to me. Before starting on this though, I could
use some pointers on some of the implementation details.

In binder the messages are not buffered. What happens is that a server
task mmaps a region and then allows clients to write their user data
directly into this _remote_ vma. This is currently achieved by caching
pointers to every page allocated in the server's region.

Instead of caching page pointers, I believe binder could make use of
get_user_pages_remote() and trigger a page fault as needed. Basically,
implement something similar to access_remote_vm() but that instead does
a copy_from_user(). However, I don't see many in-tree users of these
routines, so I wonder if I'm overlooking something in this approach?

One more reason for the page caching in binder is being able to free
pages from the shrinker's callback. Unused pages are added to an LRU
list and we manually zap/free them when they are reclaimed. It is not
evident to me how can binder mark a range within the vma region as
reclaimable?

Any pointers are appreciated!

--
Carlos Llamas