RE: [PATCH V2] binder: ipc namespace support for android binder

2018-11-08 Thread 周威
> From: Davidlohr Bueso 
> Sent: Thursday, November 8, 2018 3:00 PM
> 
> On Mon, 29 Oct 2018, chouryzhou(??) wrote:
> >@@ -63,6 +63,12 @@ struct ipc_namespace {
> >unsigned intmq_msg_default;
> >unsigned intmq_msgsize_default;
> >
> >+   /* next fields are for binder */
> >+   struct mutex  binder_procs_lock;
> >+   struct hlist_head binder_procs;
> >+   struct mutex  binder_contexts_lock;
> >+   struct hlist_head binder_contexts;
> 
> I don't think you want a mutex here protecting the binder_contexts list.
> Afaict there is no concurrency going on: you only modify it in when doing
> namespace init and exit (for which you have no serialization); do you even
> need a lock here? Or at least I would think a more lightweight alternative
> (rcu/spinlock/rwlock) would suffice.

Yes, you're right, the binder_contexts is just modified when initing and exiting
namespace, we don't need this lock.
I will update the code you mentioned above.


RE: [PATCH V2] binder: ipc namespace support for android binder

2018-11-08 Thread 周威
> From: Davidlohr Bueso 
> Sent: Thursday, November 8, 2018 3:00 PM
> 
> On Mon, 29 Oct 2018, chouryzhou(??) wrote:
> >@@ -63,6 +63,12 @@ struct ipc_namespace {
> >unsigned intmq_msg_default;
> >unsigned intmq_msgsize_default;
> >
> >+   /* next fields are for binder */
> >+   struct mutex  binder_procs_lock;
> >+   struct hlist_head binder_procs;
> >+   struct mutex  binder_contexts_lock;
> >+   struct hlist_head binder_contexts;
> 
> I don't think you want a mutex here protecting the binder_contexts list.
> Afaict there is no concurrency going on: you only modify it in when doing
> namespace init and exit (for which you have no serialization); do you even
> need a lock here? Or at least I would think a more lightweight alternative
> (rcu/spinlock/rwlock) would suffice.

Yes, you're right, the binder_contexts is just modified when initing and exiting
namespace, we don't need this lock.
I will update the code you mentioned above.


Re: [PATCH V2] binder: ipc namespace support for android binder

2018-11-07 Thread Davidlohr Bueso

On Mon, 29 Oct 2018, chouryzhou(??) wrote:

@@ -63,6 +63,12 @@ struct ipc_namespace {
   unsigned intmq_msg_default;
   unsigned intmq_msgsize_default;

+   /* next fields are for binder */
+   struct mutex  binder_procs_lock;
+   struct hlist_head binder_procs;
+   struct mutex  binder_contexts_lock;
+   struct hlist_head binder_contexts;


I don't think you want a mutex here protecting the binder_contexts list.
Afaict there is no concurrency going on: you only modify it in when doing
namespace init and exit (for which you have no serialization); do you even
need a lock here? Or at least I would think a more lightweight alternative
(rcu/spinlock/rwlock) would suffice.

Thanks,
Davidlohr


Re: [PATCH V2] binder: ipc namespace support for android binder

2018-11-07 Thread Davidlohr Bueso

On Mon, 29 Oct 2018, chouryzhou(??) wrote:

@@ -63,6 +63,12 @@ struct ipc_namespace {
   unsigned intmq_msg_default;
   unsigned intmq_msgsize_default;

+   /* next fields are for binder */
+   struct mutex  binder_procs_lock;
+   struct hlist_head binder_procs;
+   struct mutex  binder_contexts_lock;
+   struct hlist_head binder_contexts;


I don't think you want a mutex here protecting the binder_contexts list.
Afaict there is no concurrency going on: you only modify it in when doing
namespace init and exit (for which you have no serialization); do you even
need a lock here? Or at least I would think a more lightweight alternative
(rcu/spinlock/rwlock) would suffice.

Thanks,
Davidlohr


Re: [PATCH V2] binder: ipc namespace support for android binder

2018-11-07 Thread Davidlohr Bueso

On Wed, 07 Nov 2018, Bueso wrote:


On Mon, 29 Oct 2018, chouryzhou(??) wrote:


+// If init_ipc_ns is not defined elsewhere,
+// we make a fake one here to put our variable.


/*
* comments like this please
*/


Actually, just drop the comment altogether. Forward declaring does not merit it.

Thanks,
Davidlohr


Re: [PATCH V2] binder: ipc namespace support for android binder

2018-11-07 Thread Davidlohr Bueso

On Wed, 07 Nov 2018, Bueso wrote:


On Mon, 29 Oct 2018, chouryzhou(??) wrote:


+// If init_ipc_ns is not defined elsewhere,
+// we make a fake one here to put our variable.


/*
* comments like this please
*/


Actually, just drop the comment altogether. Forward declaring does not merit it.

Thanks,
Davidlohr


Re: [PATCH V2] binder: ipc namespace support for android binder

2018-11-07 Thread Davidlohr Bueso

On Mon, 29 Oct 2018, chouryzhou(??) wrote:


+// If init_ipc_ns is not defined elsewhere,
+// we make a fake one here to put our variable.


/*
* comments like this please
*/


+#if !defined(CONFIG_SYSVIPC) &&  !defined(CONFIG_POSIX_MQUEUE)
+struct ipc_namespace init_ipc_ns;

...

--- a/include/linux/ipc_namespace.h
+++ b/include/linux/ipc_namespace.h
@@ -63,6 +63,12 @@ struct ipc_namespace {
   unsigned intmq_msg_default;
   unsigned intmq_msgsize_default;

+   /* next fields are for binder */
+   struct mutex  binder_procs_lock;
+   struct hlist_head binder_procs;
+   struct mutex  binder_contexts_lock;
+   struct hlist_head binder_contexts;


Please make the above inside #ifdef CONFIG_ANDROID_BINDER_IPC.

Thanks,
Davidlohr


Re: [PATCH V2] binder: ipc namespace support for android binder

2018-11-07 Thread Davidlohr Bueso

On Mon, 29 Oct 2018, chouryzhou(??) wrote:


+// If init_ipc_ns is not defined elsewhere,
+// we make a fake one here to put our variable.


/*
* comments like this please
*/


+#if !defined(CONFIG_SYSVIPC) &&  !defined(CONFIG_POSIX_MQUEUE)
+struct ipc_namespace init_ipc_ns;

...

--- a/include/linux/ipc_namespace.h
+++ b/include/linux/ipc_namespace.h
@@ -63,6 +63,12 @@ struct ipc_namespace {
   unsigned intmq_msg_default;
   unsigned intmq_msgsize_default;

+   /* next fields are for binder */
+   struct mutex  binder_procs_lock;
+   struct hlist_head binder_procs;
+   struct mutex  binder_contexts_lock;
+   struct hlist_head binder_contexts;


Please make the above inside #ifdef CONFIG_ANDROID_BINDER_IPC.

Thanks,
Davidlohr


RE: [PATCH V2] binder: ipc namespace support for android binder

2018-11-07 Thread 周威
> -Original Message-
> From: Andrew Morton 
> Sent: Thursday, November 8, 2018 6:38 AM
> To: chouryzhou(周威) 
> Cc: gre...@linuxfoundation.org; a...@android.com; tk...@android.com;
> d...@stgolabs.net; de...@driverdev.osuosl.org; linux-kernel@vger.kernel.org
> Subject: Re: [PATCH V2] binder: ipc namespace support for android
> binder
> 
> On Wed, 7 Nov 2018 01:48:12 + chouryzhou(周威)
>  wrote:
> 
> > > > --- a/ipc/namespace.c
> > > > +++ b/ipc/namespace.c
> > > > @@ -56,6 +56,9 @@ static struct ipc_namespace *create_ipc_ns(struct
> > > user_namespace *user_ns,
> > > > ns->ucounts = ucounts;
> > > >
> > > > err = mq_init_ns(ns);
> > > > +   if (err)
> > > > +   goto fail_put;
> > > > +   err = binder_init_ns(ns);
> > > > if (err)
> > > > goto fail_put;
> > > >
> > >
> > > Don't we need an mq_put_mnt() if binder_init_ns() fails?
> > >
> > > free_ipc_ns() seems to have forgotten about that too.  In which case it
> > > must be madly leaking mounts so probably I'm wrong.  Confused.
> > >
> >
> > mq_init_ns will do clean job if it failed, and as do binder_init_ns.
> 
> My point is that if mq_init_ns() succeeds and binder_init_ns() fails,
> we don't undo the effects of mq_init_ns()?

Oh, mq_put_mnt is called in put_ipc_ns. We should invoke put_ipc_ns if 
binder_init_ns fails. I will update the patch soon. Thank you very much for 
pointing out the issue.


RE: [PATCH V2] binder: ipc namespace support for android binder

2018-11-07 Thread 周威
> -Original Message-
> From: Andrew Morton 
> Sent: Thursday, November 8, 2018 6:38 AM
> To: chouryzhou(周威) 
> Cc: gre...@linuxfoundation.org; a...@android.com; tk...@android.com;
> d...@stgolabs.net; de...@driverdev.osuosl.org; linux-kernel@vger.kernel.org
> Subject: Re: [PATCH V2] binder: ipc namespace support for android
> binder
> 
> On Wed, 7 Nov 2018 01:48:12 + chouryzhou(周威)
>  wrote:
> 
> > > > --- a/ipc/namespace.c
> > > > +++ b/ipc/namespace.c
> > > > @@ -56,6 +56,9 @@ static struct ipc_namespace *create_ipc_ns(struct
> > > user_namespace *user_ns,
> > > > ns->ucounts = ucounts;
> > > >
> > > > err = mq_init_ns(ns);
> > > > +   if (err)
> > > > +   goto fail_put;
> > > > +   err = binder_init_ns(ns);
> > > > if (err)
> > > > goto fail_put;
> > > >
> > >
> > > Don't we need an mq_put_mnt() if binder_init_ns() fails?
> > >
> > > free_ipc_ns() seems to have forgotten about that too.  In which case it
> > > must be madly leaking mounts so probably I'm wrong.  Confused.
> > >
> >
> > mq_init_ns will do clean job if it failed, and as do binder_init_ns.
> 
> My point is that if mq_init_ns() succeeds and binder_init_ns() fails,
> we don't undo the effects of mq_init_ns()?

Oh, mq_put_mnt is called in put_ipc_ns. We should invoke put_ipc_ns if 
binder_init_ns fails. I will update the patch soon. Thank you very much for 
pointing out the issue.


Re: [PATCH V2] binder: ipc namespace support for android binder

2018-11-07 Thread Andrew Morton
On Wed, 7 Nov 2018 01:48:12 + chouryzhou(周威)  wrote:

> > > --- a/ipc/namespace.c
> > > +++ b/ipc/namespace.c
> > > @@ -56,6 +56,9 @@ static struct ipc_namespace *create_ipc_ns(struct
> > user_namespace *user_ns,
> > > ns->ucounts = ucounts;
> > >
> > > err = mq_init_ns(ns);
> > > +   if (err)
> > > +   goto fail_put;
> > > +   err = binder_init_ns(ns);
> > > if (err)
> > > goto fail_put;
> > >
> > 
> > Don't we need an mq_put_mnt() if binder_init_ns() fails?
> > 
> > free_ipc_ns() seems to have forgotten about that too.  In which case it
> > must be madly leaking mounts so probably I'm wrong.  Confused.
> > 
> 
> mq_init_ns will do clean job if it failed, and as do binder_init_ns. 

My point is that if mq_init_ns() succeeds and binder_init_ns() fails,
we don't undo the effects of mq_init_ns()?


Re: [PATCH V2] binder: ipc namespace support for android binder

2018-11-07 Thread Andrew Morton
On Wed, 7 Nov 2018 01:48:12 + chouryzhou(周威)  wrote:

> > > --- a/ipc/namespace.c
> > > +++ b/ipc/namespace.c
> > > @@ -56,6 +56,9 @@ static struct ipc_namespace *create_ipc_ns(struct
> > user_namespace *user_ns,
> > > ns->ucounts = ucounts;
> > >
> > > err = mq_init_ns(ns);
> > > +   if (err)
> > > +   goto fail_put;
> > > +   err = binder_init_ns(ns);
> > > if (err)
> > > goto fail_put;
> > >
> > 
> > Don't we need an mq_put_mnt() if binder_init_ns() fails?
> > 
> > free_ipc_ns() seems to have forgotten about that too.  In which case it
> > must be madly leaking mounts so probably I'm wrong.  Confused.
> > 
> 
> mq_init_ns will do clean job if it failed, and as do binder_init_ns. 

My point is that if mq_init_ns() succeeds and binder_init_ns() fails,
we don't undo the effects of mq_init_ns()?


RE: [PATCH V2] binder: ipc namespace support for android binder

2018-11-06 Thread 周威
> -Original Message-
> From: Andrew Morton 
> Sent: Wednesday, November 7, 2018 8:07 AM
> To: chouryzhou(周威) 
> Cc: gre...@linuxfoundation.org; a...@android.com; tk...@android.com;
> d...@stgolabs.net; de...@driverdev.osuosl.org; linux-kernel@vger.kernel.org
> Subject: Re: [PATCH V2] binder: ipc namespace support for android
> binder
> 
> On Mon, 29 Oct 2018 06:18:11 + chouryzhou(周威)
>  wrote:
> 
> >   We are working for running android in container, but we found that binder
> is
> > not isolated by ipc namespace. Since binder is a form of IPC and therefore
> should
> > be tied to ipc namespace. With this patch, we can run more than one android
> > container on one host.
> >   This patch move "binder_procs" and "binder_context" into
> ipc_namespace,
> > driver will find the context from it when opening. Although statistics in
> debugfs
> > remain global.
> >
> > ...
> >
> > --- a/ipc/namespace.c
> > +++ b/ipc/namespace.c
> > @@ -56,6 +56,9 @@ static struct ipc_namespace *create_ipc_ns(struct
> user_namespace *user_ns,
> > ns->ucounts = ucounts;
> >
> > err = mq_init_ns(ns);
> > +   if (err)
> > +   goto fail_put;
> > +   err = binder_init_ns(ns);
> > if (err)
> > goto fail_put;
> >
> 
> Don't we need an mq_put_mnt() if binder_init_ns() fails?
> 
> free_ipc_ns() seems to have forgotten about that too.  In which case it
> must be madly leaking mounts so probably I'm wrong.  Confused.
> 

mq_init_ns will do clean job if it failed, and as do binder_init_ns. 


RE: [PATCH V2] binder: ipc namespace support for android binder

2018-11-06 Thread 周威
> -Original Message-
> From: Andrew Morton 
> Sent: Wednesday, November 7, 2018 8:07 AM
> To: chouryzhou(周威) 
> Cc: gre...@linuxfoundation.org; a...@android.com; tk...@android.com;
> d...@stgolabs.net; de...@driverdev.osuosl.org; linux-kernel@vger.kernel.org
> Subject: Re: [PATCH V2] binder: ipc namespace support for android
> binder
> 
> On Mon, 29 Oct 2018 06:18:11 + chouryzhou(周威)
>  wrote:
> 
> >   We are working for running android in container, but we found that binder
> is
> > not isolated by ipc namespace. Since binder is a form of IPC and therefore
> should
> > be tied to ipc namespace. With this patch, we can run more than one android
> > container on one host.
> >   This patch move "binder_procs" and "binder_context" into
> ipc_namespace,
> > driver will find the context from it when opening. Although statistics in
> debugfs
> > remain global.
> >
> > ...
> >
> > --- a/ipc/namespace.c
> > +++ b/ipc/namespace.c
> > @@ -56,6 +56,9 @@ static struct ipc_namespace *create_ipc_ns(struct
> user_namespace *user_ns,
> > ns->ucounts = ucounts;
> >
> > err = mq_init_ns(ns);
> > +   if (err)
> > +   goto fail_put;
> > +   err = binder_init_ns(ns);
> > if (err)
> > goto fail_put;
> >
> 
> Don't we need an mq_put_mnt() if binder_init_ns() fails?
> 
> free_ipc_ns() seems to have forgotten about that too.  In which case it
> must be madly leaking mounts so probably I'm wrong.  Confused.
> 

mq_init_ns will do clean job if it failed, and as do binder_init_ns. 


Re: [PATCH V2] binder: ipc namespace support for android binder

2018-11-06 Thread Andrew Morton
On Mon, 29 Oct 2018 06:18:11 + chouryzhou(周威)  
wrote:

>   We are working for running android in container, but we found that binder is
> not isolated by ipc namespace. Since binder is a form of IPC and therefore 
> should
> be tied to ipc namespace. With this patch, we can run more than one android
> container on one host.
>   This patch move "binder_procs" and "binder_context" into ipc_namespace,
> driver will find the context from it when opening. Althought statistics in 
> debugfs
> remain global.
> 
> ...
>
> --- a/ipc/namespace.c
> +++ b/ipc/namespace.c
> @@ -56,6 +56,9 @@ static struct ipc_namespace *create_ipc_ns(struct 
> user_namespace *user_ns,
> ns->ucounts = ucounts;
>  
> err = mq_init_ns(ns);
> +   if (err)
> +   goto fail_put;
> +   err = binder_init_ns(ns);
> if (err)
> goto fail_put;
>  

Don't we need an mq_put_mnt() if binder_init_ns() fails?

free_ipc_ns() seems to have forgotten about that too.  In which case it
must be madly leaking mounts so probably I'm wrong.  Confused.



Re: [PATCH V2] binder: ipc namespace support for android binder

2018-11-06 Thread Andrew Morton
On Mon, 29 Oct 2018 06:18:11 + chouryzhou(周威)  
wrote:

>   We are working for running android in container, but we found that binder is
> not isolated by ipc namespace. Since binder is a form of IPC and therefore 
> should
> be tied to ipc namespace. With this patch, we can run more than one android
> container on one host.
>   This patch move "binder_procs" and "binder_context" into ipc_namespace,
> driver will find the context from it when opening. Althought statistics in 
> debugfs
> remain global.
> 
> ...
>
> --- a/ipc/namespace.c
> +++ b/ipc/namespace.c
> @@ -56,6 +56,9 @@ static struct ipc_namespace *create_ipc_ns(struct 
> user_namespace *user_ns,
> ns->ucounts = ucounts;
>  
> err = mq_init_ns(ns);
> +   if (err)
> +   goto fail_put;
> +   err = binder_init_ns(ns);
> if (err)
> goto fail_put;
>  

Don't we need an mq_put_mnt() if binder_init_ns() fails?

free_ipc_ns() seems to have forgotten about that too.  In which case it
must be madly leaking mounts so probably I'm wrong.  Confused.



[PATCH V2] binder: ipc namespace support for android binder

2018-10-29 Thread 周威
  We are working for running android in container, but we found that binder is
not isolated by ipc namespace. Since binder is a form of IPC and therefore 
should
be tied to ipc namespace. With this patch, we can run more than one android
container on one host.
  This patch move "binder_procs" and "binder_context" into ipc_namespace,
driver will find the context from it when opening. Althought statistics in 
debugfs
remain global.

Signed-off-by: chouryzhou 
---
 drivers/android/binder.c  | 134 +-
 include/linux/ipc_namespace.h |  14 
 ipc/namespace.c   |   4 +
 3 files changed, 118 insertions(+), 34 deletions(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index cb30a524d16d..98e815e3472d 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -68,6 +68,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -80,13 +81,20 @@
 #include "binder_alloc.h"
 #include "binder_trace.h"
 
+
+// If init_ipc_ns is not defined elsewhere,
+// we make a fake one here to put our variable.
+#if !defined(CONFIG_SYSVIPC) &&  !defined(CONFIG_POSIX_MQUEUE)
+struct ipc_namespace init_ipc_ns;
+#define ipcns  (_ipc_ns)
+#else
+#define ipcns  (current->nsproxy->ipc_ns)
+#endif
+
 static HLIST_HEAD(binder_deferred_list);
 static DEFINE_MUTEX(binder_deferred_lock);
 
 static HLIST_HEAD(binder_devices);
-static HLIST_HEAD(binder_procs);
-static DEFINE_MUTEX(binder_procs_lock);
-
 static HLIST_HEAD(binder_dead_nodes);
 static DEFINE_SPINLOCK(binder_dead_nodes_lock);
 
@@ -232,7 +240,7 @@ struct binder_transaction_log_entry {
int return_error_line;
uint32_t return_error;
uint32_t return_error_param;
-   const char *context_name;
+   int context_device;
 };
 struct binder_transaction_log {
atomic_t cur;
@@ -263,19 +271,66 @@ static struct binder_transaction_log_entry 
*binder_transaction_log_add(
 }
 
 struct binder_context {
+   struct hlist_node hlist;
struct binder_node *binder_context_mgr_node;
struct mutex context_mgr_node_lock;
 
kuid_t binder_context_mgr_uid;
-   const char *name;
+   intdevice;
 };
 
 struct binder_device {
struct hlist_node hlist;
struct miscdevice miscdev;
-   struct binder_context context;
 };
 
+void binder_exit_ns(struct ipc_namespace *ns)
+{
+   struct binder_context *context;
+   struct hlist_node *tmp;
+
+   mutex_destroy(>binder_procs_lock);
+   mutex_destroy(>binder_contexts_lock);
+   hlist_for_each_entry_safe(context, tmp, >binder_contexts, hlist) {
+   mutex_destroy(>context_mgr_node_lock);
+   hlist_del(>hlist);
+   kfree(context);
+   }
+}
+
+int binder_init_ns(struct ipc_namespace *ns)
+{
+   int ret;
+   struct binder_device *device;
+
+   mutex_init(>binder_procs_lock);
+   INIT_HLIST_HEAD(>binder_procs);
+   mutex_init(>binder_contexts_lock);
+   INIT_HLIST_HEAD(>binder_contexts);
+
+   hlist_for_each_entry(device, _devices, hlist) {
+   struct binder_context *context;
+
+   context = kzalloc(sizeof(*context), GFP_KERNEL);
+   if (!context) {
+   ret = -ENOMEM;
+   goto err;
+   }
+
+   context->device = device->miscdev.minor;
+   context->binder_context_mgr_uid = INVALID_UID;
+   mutex_init(>context_mgr_node_lock);
+
+   hlist_add_head(>hlist, >binder_contexts);
+   }
+
+   return 0;
+err:
+   binder_exit_ns(ns);
+   return ret;
+}
+
+
 /**
  * struct binder_work - work enqueued on a worklist
  * @entry: node enqueued on list
@@ -2727,7 +2782,7 @@ static void binder_transaction(struct binder_proc *proc,
e->target_handle = tr->target.handle;
e->data_size = tr->data_size;
e->offsets_size = tr->offsets_size;
-   e->context_name = proc->context->name;
+   e->context_device = proc->context->device;
 
if (reply) {
binder_inner_proc_lock(proc);
@@ -4922,6 +4977,7 @@ static int binder_open(struct inode *nodp, struct file 
*filp)
 {
struct binder_proc *proc;
struct binder_device *binder_dev;
+   struct binder_context *context;
 
binder_debug(BINDER_DEBUG_OPEN_CLOSE, "%s: %d:%d\n", __func__,
 current->group_leader->pid, current->pid);
@@ -4937,7 +4993,17 @@ static int binder_open(struct inode *nodp, struct file 
*filp)
proc->default_priority = task_nice(current);
binder_dev = container_of(filp->private_data, struct binder_device,
  miscdev);
-   proc->context = _dev->context;
+   mutex_lock(>binder_contexts_lock);
+   hlist_for_each_entry(context, >binder_contexts, hlist) {
+   if (context->device == binder_dev->miscdev.minor) {
+   proc->context 

[PATCH V2] binder: ipc namespace support for android binder

2018-10-29 Thread 周威
  We are working for running android in container, but we found that binder is
not isolated by ipc namespace. Since binder is a form of IPC and therefore 
should
be tied to ipc namespace. With this patch, we can run more than one android
container on one host.
  This patch move "binder_procs" and "binder_context" into ipc_namespace,
driver will find the context from it when opening. Althought statistics in 
debugfs
remain global.

Signed-off-by: chouryzhou 
---
 drivers/android/binder.c  | 134 +-
 include/linux/ipc_namespace.h |  14 
 ipc/namespace.c   |   4 +
 3 files changed, 118 insertions(+), 34 deletions(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index cb30a524d16d..98e815e3472d 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -68,6 +68,7 @@
 #include 
 #include 
 #include 
+#include 
 #include 
 #include 
 #include 
@@ -80,13 +81,20 @@
 #include "binder_alloc.h"
 #include "binder_trace.h"
 
+
+// If init_ipc_ns is not defined elsewhere,
+// we make a fake one here to put our variable.
+#if !defined(CONFIG_SYSVIPC) &&  !defined(CONFIG_POSIX_MQUEUE)
+struct ipc_namespace init_ipc_ns;
+#define ipcns  (_ipc_ns)
+#else
+#define ipcns  (current->nsproxy->ipc_ns)
+#endif
+
 static HLIST_HEAD(binder_deferred_list);
 static DEFINE_MUTEX(binder_deferred_lock);
 
 static HLIST_HEAD(binder_devices);
-static HLIST_HEAD(binder_procs);
-static DEFINE_MUTEX(binder_procs_lock);
-
 static HLIST_HEAD(binder_dead_nodes);
 static DEFINE_SPINLOCK(binder_dead_nodes_lock);
 
@@ -232,7 +240,7 @@ struct binder_transaction_log_entry {
int return_error_line;
uint32_t return_error;
uint32_t return_error_param;
-   const char *context_name;
+   int context_device;
 };
 struct binder_transaction_log {
atomic_t cur;
@@ -263,19 +271,66 @@ static struct binder_transaction_log_entry 
*binder_transaction_log_add(
 }
 
 struct binder_context {
+   struct hlist_node hlist;
struct binder_node *binder_context_mgr_node;
struct mutex context_mgr_node_lock;
 
kuid_t binder_context_mgr_uid;
-   const char *name;
+   intdevice;
 };
 
 struct binder_device {
struct hlist_node hlist;
struct miscdevice miscdev;
-   struct binder_context context;
 };
 
+void binder_exit_ns(struct ipc_namespace *ns)
+{
+   struct binder_context *context;
+   struct hlist_node *tmp;
+
+   mutex_destroy(>binder_procs_lock);
+   mutex_destroy(>binder_contexts_lock);
+   hlist_for_each_entry_safe(context, tmp, >binder_contexts, hlist) {
+   mutex_destroy(>context_mgr_node_lock);
+   hlist_del(>hlist);
+   kfree(context);
+   }
+}
+
+int binder_init_ns(struct ipc_namespace *ns)
+{
+   int ret;
+   struct binder_device *device;
+
+   mutex_init(>binder_procs_lock);
+   INIT_HLIST_HEAD(>binder_procs);
+   mutex_init(>binder_contexts_lock);
+   INIT_HLIST_HEAD(>binder_contexts);
+
+   hlist_for_each_entry(device, _devices, hlist) {
+   struct binder_context *context;
+
+   context = kzalloc(sizeof(*context), GFP_KERNEL);
+   if (!context) {
+   ret = -ENOMEM;
+   goto err;
+   }
+
+   context->device = device->miscdev.minor;
+   context->binder_context_mgr_uid = INVALID_UID;
+   mutex_init(>context_mgr_node_lock);
+
+   hlist_add_head(>hlist, >binder_contexts);
+   }
+
+   return 0;
+err:
+   binder_exit_ns(ns);
+   return ret;
+}
+
+
 /**
  * struct binder_work - work enqueued on a worklist
  * @entry: node enqueued on list
@@ -2727,7 +2782,7 @@ static void binder_transaction(struct binder_proc *proc,
e->target_handle = tr->target.handle;
e->data_size = tr->data_size;
e->offsets_size = tr->offsets_size;
-   e->context_name = proc->context->name;
+   e->context_device = proc->context->device;
 
if (reply) {
binder_inner_proc_lock(proc);
@@ -4922,6 +4977,7 @@ static int binder_open(struct inode *nodp, struct file 
*filp)
 {
struct binder_proc *proc;
struct binder_device *binder_dev;
+   struct binder_context *context;
 
binder_debug(BINDER_DEBUG_OPEN_CLOSE, "%s: %d:%d\n", __func__,
 current->group_leader->pid, current->pid);
@@ -4937,7 +4993,17 @@ static int binder_open(struct inode *nodp, struct file 
*filp)
proc->default_priority = task_nice(current);
binder_dev = container_of(filp->private_data, struct binder_device,
  miscdev);
-   proc->context = _dev->context;
+   mutex_lock(>binder_contexts_lock);
+   hlist_for_each_entry(context, >binder_contexts, hlist) {
+   if (context->device == binder_dev->miscdev.minor) {
+   proc->context