linux-kernel - Re: Using page-fault handler in binder

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJuCfpEGBquOjEBFD87DEHqWc0TZ8TkLHRh6RAjR=1wFPbMNHw@mail.gmail.com>
Date:   Thu, 20 Apr 2023 14:35:00 -0700
From:   Suren Baghdasaryan <surenb@...gle.com>
To:     Carlos Llamas <cmllamas@...gle.com>
Cc:     linux-mm@...ck.org, tkjos@...gle.com, linux-kernel@...r.kernel.org,
        kernel-team@...roid.com
Subject: Re: Using page-fault handler in binder

On Thu, Apr 20, 2023 at 1:34 PM Carlos Llamas <cmllamas@...gle.com> wrote:
>
> Hi,
>
> I'm trying to remove the current page handling in binder and switch to
> using ->fault() and other mm/ infrastructure. See, we currently allocate
> and insert pages manually into vmas, so dropping this boilerplate code
> seems like a great idea to me. Before starting on this though, I could
> use some pointers on some of the implementation details.
>
> In binder the messages are not buffered. What happens is that a server
> task mmaps a region and then allows clients to write their user data
> directly into this _remote_ vma. This is currently achieved by caching
> pointers to every page allocated in the server's region.
>
> Instead of caching page pointers, I believe binder could make use of
> get_user_pages_remote() and trigger a page fault as needed. Basically,
> implement something similar to access_remote_vm() but that instead does
> a copy_from_user(). However, I don't see many in-tree users of these
> routines, so I wonder if I'm overlooking something in this approach?

Sounds doable but there might be GUP details I'm missing...

>
> One more reason for the page caching in binder is being able to free
> pages from the shrinker's callback. Unused pages are added to an LRU
> list and we manually zap/free them when they are reclaimed. It is not
> evident to me how can binder mark a range within the vma region as
> reclaimable?

I think you would have to release the individual pages using
put_page(). Also note that get_user_pages_remote() is being
deprecated, see:
https://elixir.bootlin.com/linux/latest/source/mm/gup.c#L2171

>
> Any pointers are appreciated!
>
> --
> Carlos Llamas