Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d7a51e2f authored by Martijn Coenen's avatar Martijn Coenen Committed by Trilok Soni
Browse files

android: binder: add extra size to allocator. 



The binder_buffer allocator currently only allocates
space for the data and offsets buffers of a Parcel.
This change allows for requesting an additional chunk
of data in the buffer, which can for example be used
to hold additional meta-data about the transaction
(eg a security context).

Change-Id: Iabf59a64ff66a0457a9aa7077aef219c3dc05ba8
Signed-off-by: default avatarMartijn Coenen <maco@google.com>
Git-commit: d7c114e9
Git-repo: https://git.linaro.org/kernel/linux-linaro-stable


Signed-off-by: default avatarNeeraj Upadhyay <neeraju@codeaurora.org>
parent ed43f909

drivers/android/binder.c

+28 −13
Original line number Diff line number Diff line
@@ -303,6 +303,7 @@ struct binder_buffer { 
	struct binder_node *target_node;

	size_t data_size;

	size_t offsets_size;

	size_t extra_buffers_size;

	uint8_t data[0];

};
@@ -741,7 +742,9 @@ err_no_vma: 


static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc,

					      size_t data_size,

					      size_t offsets_size, int is_async)

					      size_t offsets_size,

					      size_t extra_buffers_size,

					      int is_async)

{

	struct rb_node *n = proc->free_buffers.rb_node;

	struct binder_buffer *buffer;
@@ -749,7 +752,7 @@ static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc, 
	struct rb_node *best_fit = NULL;

	void *has_page_addr;

	void *end_page_addr;

	size_t size;

	size_t size, data_offsets_size;



	if (proc->vma == NULL) {

		pr_err("%d: binder_alloc_buf, no vma\n",
@@ -757,15 +760,20 @@ static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc, 
		return NULL;

	}



	size = ALIGN(data_size, sizeof(void *)) +

	data_offsets_size = ALIGN(data_size, sizeof(void *)) +

		ALIGN(offsets_size, sizeof(void *));



	if (size < data_size || size < offsets_size) {

	if (data_offsets_size < data_size || data_offsets_size < offsets_size) {

		binder_user_error("%d: got transaction with invalid size %zd-%zd\n",

				proc->pid, data_size, offsets_size);

		return NULL;

	}



	size = data_offsets_size + ALIGN(extra_buffers_size, sizeof(void *));

	if (size < data_offsets_size || size < extra_buffers_size) {

		binder_user_error("%d: got transaction with invalid extra_buffers_size %zd\n",

				  proc->pid, extra_buffers_size);

		return NULL;

	}

	if (is_async &&

	    proc->free_async_space < size + sizeof(struct binder_buffer)) {

		binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
@@ -834,6 +842,7 @@ static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc, 
		      proc->pid, size, buffer);

	buffer->data_size = data_size;

	buffer->offsets_size = offsets_size;

	buffer->extra_buffers_size = extra_buffers_size;

	buffer->async_transaction = is_async;

	if (is_async) {

		proc->free_async_space -= size + sizeof(struct binder_buffer);
@@ -908,7 +917,8 @@ static void binder_free_buf(struct binder_proc *proc, 
	buffer_size = binder_buffer_size(proc, buffer);



	size = ALIGN(buffer->data_size, sizeof(void *)) +

		ALIGN(buffer->offsets_size, sizeof(void *));

		ALIGN(buffer->offsets_size, sizeof(void *)) +

		ALIGN(buffer->extra_buffers_size, sizeof(void *));



	binder_debug(BINDER_DEBUG_BUFFER_ALLOC,

		     "%d: binder_free_buf %p size %zd buffer_size %zd\n",
@@ -1627,7 +1637,8 @@ err_fd_not_accepted: 


static void binder_transaction(struct binder_proc *proc,

			       struct binder_thread *thread,

			       struct binder_transaction_data *tr, int reply)

			       struct binder_transaction_data *tr, int reply,

			       binder_size_t extra_buffers_size)

{

	int ret;

	struct binder_transaction *t;
@@ -1771,20 +1782,22 @@ static void binder_transaction(struct binder_proc *proc, 


	if (reply)

		binder_debug(BINDER_DEBUG_TRANSACTION,

			     "%d:%d BC_REPLY %d -> %d:%d, data %016llx-%016llx size %lld-%lld\n",

			     "%d:%d BC_REPLY %d -> %d:%d, data %016llx-%016llx size %lld-%lld-%lld\n",

			     proc->pid, thread->pid, t->debug_id,

			     target_proc->pid, target_thread->pid,

			     (u64)tr->data.ptr.buffer,

			     (u64)tr->data.ptr.offsets,

			     (u64)tr->data_size, (u64)tr->offsets_size);

			     (u64)tr->data_size, (u64)tr->offsets_size,

			     (u64)extra_buffers_size);

	else

		binder_debug(BINDER_DEBUG_TRANSACTION,

			     "%d:%d BC_TRANSACTION %d -> %d - node %d, data %016llx-%016llx size %lld-%lld\n",

			     "%d:%d BC_TRANSACTION %d -> %d - node %d, data %016llx-%016llx size %lld-%lld-%lld\n",

			     proc->pid, thread->pid, t->debug_id,

			     target_proc->pid, target_node->debug_id,

			     (u64)tr->data.ptr.buffer,

			     (u64)tr->data.ptr.offsets,

			     (u64)tr->data_size, (u64)tr->offsets_size);

			     (u64)tr->data_size, (u64)tr->offsets_size,

			     (u64)extra_buffers_size);



	if (!reply && !(tr->flags & TF_ONE_WAY))

		t->from = thread;
@@ -1800,7 +1813,8 @@ static void binder_transaction(struct binder_proc *proc, 
	trace_binder_transaction(reply, t, target_node);



	t->buffer = binder_alloc_buf(target_proc, tr->data_size,

		tr->offsets_size, !reply && (t->flags & TF_ONE_WAY));

		tr->offsets_size, extra_buffers_size,

		!reply && (t->flags & TF_ONE_WAY));

	if (t->buffer == NULL) {

		return_error = BR_FAILED_REPLY;

		goto err_binder_alloc_buf_failed;
@@ -2158,7 +2172,8 @@ static int binder_thread_write(struct binder_proc *proc, 
			if (copy_from_user_preempt_disabled(&tr, ptr, sizeof(tr)))

				return -EFAULT;

			ptr += sizeof(tr);

			binder_transaction(proc, thread, &tr, cmd == BC_REPLY);

			binder_transaction(proc, thread, &tr,

					   cmd == BC_REPLY, 0);

			break;

		}