51 static struct binder_buffer *binder_buffer_next(struct binder_buffer *buffer)  in binder_buffer_next()  argument
53 	return list_entry(buffer->entry.next, struct binder_buffer, entry);  in binder_buffer_next()
56 static struct binder_buffer *binder_buffer_prev(struct binder_buffer *buffer)  in binder_buffer_prev()  argument
58 	return list_entry(buffer->entry.prev, struct binder_buffer, entry);  in binder_buffer_prev()
62 						 struct binder_buffer *buffer)  in binder_alloc_buffer_size()  argument
64 	if (list_is_last(&buffer->entry, &alloc->buffers))  in binder_alloc_buffer_size()
65 		return alloc->vm_start + alloc->buffer_size - buffer->user_data;  in binder_alloc_buffer_size()
66 	return binder_buffer_next(buffer)->user_data - buffer->user_data;  in binder_alloc_buffer_size()
75 	struct binder_buffer *buffer;  in binder_insert_free_buffer()  local
89 		buffer = rb_entry(parent, struct binder_buffer, rb_node);  in binder_insert_free_buffer()
90 		BUG_ON(!buffer->free);  in binder_insert_free_buffer()
92 		buffer_size = binder_alloc_buffer_size(alloc, buffer);  in binder_insert_free_buffer()
108 	struct binder_buffer *buffer;  in binder_insert_allocated_buffer_locked()  local
114 		buffer = rb_entry(parent, struct binder_buffer, rb_node);  in binder_insert_allocated_buffer_locked()
115 		BUG_ON(buffer->free);  in binder_insert_allocated_buffer_locked()
117 		if (new_buffer->user_data < buffer->user_data)  in binder_insert_allocated_buffer_locked()
119 		else if (new_buffer->user_data > buffer->user_data)  in binder_insert_allocated_buffer_locked()
133 	struct binder_buffer *buffer;  in binder_alloc_prepare_to_free_locked()  local
136 		buffer = rb_entry(n, struct binder_buffer, rb_node);  in binder_alloc_prepare_to_free_locked()
137 		BUG_ON(buffer->free);  in binder_alloc_prepare_to_free_locked()
139 		if (user_ptr < buffer->user_data) {  in binder_alloc_prepare_to_free_locked()
141 		} else if (user_ptr > buffer->user_data) {  in binder_alloc_prepare_to_free_locked()
149 			if (!buffer->allow_user_free)  in binder_alloc_prepare_to_free_locked()
151 			buffer->allow_user_free = 0;  in binder_alloc_prepare_to_free_locked()
152 			return buffer;  in binder_alloc_prepare_to_free_locked()
362 				       struct binder_buffer *buffer,  in binder_install_buffer_pages()  argument
368 	start = buffer->user_data & PAGE_MASK;  in binder_install_buffer_pages()
369 	final = PAGE_ALIGN(buffer->user_data + size);  in binder_install_buffer_pages()
428 	struct binder_buffer *buffer;  in debug_no_space_locked()  local
438 		buffer = rb_entry(n, struct binder_buffer, rb_node);  in debug_no_space_locked()
439 		buffer_size = binder_alloc_buffer_size(alloc, buffer);  in debug_no_space_locked()
447 		buffer = rb_entry(n, struct binder_buffer, rb_node);  in debug_no_space_locked()
448 		buffer_size = binder_alloc_buffer_size(alloc, buffer);  in debug_no_space_locked()
471 	struct binder_buffer *buffer;  in debug_low_async_space_locked()  local
488 		buffer = rb_entry(n, struct binder_buffer, rb_node);  in debug_low_async_space_locked()
489 		if (buffer->pid != pid)  in debug_low_async_space_locked()
491 		if (!buffer->async_transaction)  in debug_low_async_space_locked()
493 		total_alloc_size += binder_alloc_buffer_size(alloc, buffer);  in debug_low_async_space_locked()
523 	struct binder_buffer *buffer;  in binder_alloc_new_buf_locked()  local
532 		buffer = ERR_PTR(-ENOSPC);  in binder_alloc_new_buf_locked()
537 		buffer = rb_entry(n, struct binder_buffer, rb_node);  in binder_alloc_new_buf_locked()
538 		BUG_ON(!buffer->free);  in binder_alloc_new_buf_locked()
539 		buffer_size = binder_alloc_buffer_size(alloc, buffer);  in binder_alloc_new_buf_locked()
557 		buffer = ERR_PTR(-ENOSPC);  in binder_alloc_new_buf_locked()
563 		buffer = rb_entry(best_fit, struct binder_buffer, rb_node);  in binder_alloc_new_buf_locked()
564 		buffer_size = binder_alloc_buffer_size(alloc, buffer);  in binder_alloc_new_buf_locked()
567 		new_buffer->user_data = buffer->user_data + size;  in binder_alloc_new_buf_locked()
568 		list_add(&new_buffer->entry, &buffer->entry);  in binder_alloc_new_buf_locked()
576 		      alloc->pid, size, buffer, buffer_size);  in binder_alloc_new_buf_locked()
584 	next_used_page = (buffer->user_data + buffer_size) & PAGE_MASK;  in binder_alloc_new_buf_locked()
585 	curr_last_page = PAGE_ALIGN(buffer->user_data + size);  in binder_alloc_new_buf_locked()
586 	binder_lru_freelist_del(alloc, PAGE_ALIGN(buffer->user_data),  in binder_alloc_new_buf_locked()
589 	rb_erase(&buffer->rb_node, &alloc->free_buffers);  in binder_alloc_new_buf_locked()
590 	buffer->free = 0;  in binder_alloc_new_buf_locked()
591 	buffer->allow_user_free = 0;  in binder_alloc_new_buf_locked()
592 	binder_insert_allocated_buffer_locked(alloc, buffer);  in binder_alloc_new_buf_locked()
593 	buffer->async_transaction = is_async;  in binder_alloc_new_buf_locked()
594 	buffer->oneway_spam_suspect = false;  in binder_alloc_new_buf_locked()
601 			buffer->oneway_spam_suspect = true;  in binder_alloc_new_buf_locked()
607 	return buffer;  in binder_alloc_new_buf_locked()
653 	struct binder_buffer *buffer, *next;  in binder_alloc_new_buf()  local
680 	buffer = binder_alloc_new_buf_locked(alloc, next, size, is_async);  in binder_alloc_new_buf()
681 	if (IS_ERR(buffer)) {  in binder_alloc_new_buf()
686 	buffer->data_size = data_size;  in binder_alloc_new_buf()
687 	buffer->offsets_size = offsets_size;  in binder_alloc_new_buf()
688 	buffer->extra_buffers_size = extra_buffers_size;  in binder_alloc_new_buf()
689 	buffer->pid = current->tgid;  in binder_alloc_new_buf()
692 	ret = binder_install_buffer_pages(alloc, buffer, size);  in binder_alloc_new_buf()
694 		binder_alloc_free_buf(alloc, buffer);  in binder_alloc_new_buf()
695 		buffer = ERR_PTR(ret);  in binder_alloc_new_buf()
698 	return buffer;  in binder_alloc_new_buf()
702 static unsigned long buffer_start_page(struct binder_buffer *buffer)  in buffer_start_page()  argument
704 	return buffer->user_data & PAGE_MASK;  in buffer_start_page()
707 static unsigned long prev_buffer_end_page(struct binder_buffer *buffer)  in prev_buffer_end_page()  argument
709 	return (buffer->user_data - 1) & PAGE_MASK;  in prev_buffer_end_page()
713 				      struct binder_buffer *buffer)  in binder_delete_free_buffer()  argument
717 	if (PAGE_ALIGNED(buffer->user_data))  in binder_delete_free_buffer()
720 	BUG_ON(alloc->buffers.next == &buffer->entry);  in binder_delete_free_buffer()
721 	prev = binder_buffer_prev(buffer);  in binder_delete_free_buffer()
723 	if (prev_buffer_end_page(prev) == buffer_start_page(buffer))  in binder_delete_free_buffer()
726 	if (!list_is_last(&buffer->entry, &alloc->buffers)) {  in binder_delete_free_buffer()
727 		next = binder_buffer_next(buffer);  in binder_delete_free_buffer()
728 		if (buffer_start_page(next) == buffer_start_page(buffer))  in binder_delete_free_buffer()
732 	binder_lru_freelist_add(alloc, buffer_start_page(buffer),  in binder_delete_free_buffer()
733 				buffer_start_page(buffer) + PAGE_SIZE);  in binder_delete_free_buffer()
735 	list_del(&buffer->entry);  in binder_delete_free_buffer()
736 	kfree(buffer);  in binder_delete_free_buffer()
740 				   struct binder_buffer *buffer)  in binder_free_buf_locked()  argument
744 	buffer_size = binder_alloc_buffer_size(alloc, buffer);  in binder_free_buf_locked()
746 	size = ALIGN(buffer->data_size, sizeof(void *)) +  in binder_free_buf_locked()
747 		ALIGN(buffer->offsets_size, sizeof(void *)) +  in binder_free_buf_locked()
748 		ALIGN(buffer->extra_buffers_size, sizeof(void *));  in binder_free_buf_locked()
752 		      alloc->pid, buffer, size, buffer_size);  in binder_free_buf_locked()
754 	BUG_ON(buffer->free);  in binder_free_buf_locked()
756 	BUG_ON(buffer->transaction != NULL);  in binder_free_buf_locked()
757 	BUG_ON(buffer->user_data < alloc->vm_start);  in binder_free_buf_locked()
758 	BUG_ON(buffer->user_data > alloc->vm_start + alloc->buffer_size);  in binder_free_buf_locked()
760 	if (buffer->async_transaction) {  in binder_free_buf_locked()
767 	binder_lru_freelist_add(alloc, PAGE_ALIGN(buffer->user_data),  in binder_free_buf_locked()
768 				(buffer->user_data + buffer_size) & PAGE_MASK);  in binder_free_buf_locked()
770 	rb_erase(&buffer->rb_node, &alloc->allocated_buffers);  in binder_free_buf_locked()
771 	buffer->free = 1;  in binder_free_buf_locked()
772 	if (!list_is_last(&buffer->entry, &alloc->buffers)) {  in binder_free_buf_locked()
773 		struct binder_buffer *next = binder_buffer_next(buffer);  in binder_free_buf_locked()
780 	if (alloc->buffers.next != &buffer->entry) {  in binder_free_buf_locked()
781 		struct binder_buffer *prev = binder_buffer_prev(buffer);  in binder_free_buf_locked()
784 			binder_delete_free_buffer(alloc, buffer);  in binder_free_buf_locked()
786 			buffer = prev;  in binder_free_buf_locked()
789 	binder_insert_free_buffer(alloc, buffer);  in binder_free_buf_locked()
812 					  struct binder_buffer *buffer,  in binder_alloc_get_page()  argument
817 		(buffer->user_data - alloc->vm_start);  in binder_alloc_get_page()
834 				   struct binder_buffer *buffer)  in binder_alloc_clear_buf()  argument
836 	size_t bytes = binder_alloc_buffer_size(alloc, buffer);  in binder_alloc_clear_buf()
844 		page = binder_alloc_get_page(alloc, buffer,  in binder_alloc_clear_buf()
861 			    struct binder_buffer *buffer)  in binder_alloc_free_buf()  argument
871 	if (buffer->clear_on_free) {  in binder_alloc_free_buf()
872 		binder_alloc_clear_buf(alloc, buffer);  in binder_alloc_free_buf()
873 		buffer->clear_on_free = false;  in binder_alloc_free_buf()
876 	binder_free_buf_locked(alloc, buffer);  in binder_alloc_free_buf()
897 	struct binder_buffer *buffer;  in binder_alloc_mmap_handler()  local
928 	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);  in binder_alloc_mmap_handler()
929 	if (!buffer) {  in binder_alloc_mmap_handler()
935 	buffer->user_data = alloc->vm_start;  in binder_alloc_mmap_handler()
936 	list_add(&buffer->entry, &alloc->buffers);  in binder_alloc_mmap_handler()
937 	buffer->free = 1;  in binder_alloc_mmap_handler()
938 	binder_insert_free_buffer(alloc, buffer);  in binder_alloc_mmap_handler()
968 	struct binder_buffer *buffer;  in binder_alloc_deferred_release()  local
975 		buffer = rb_entry(n, struct binder_buffer, rb_node);  in binder_alloc_deferred_release()
978 		BUG_ON(buffer->transaction);  in binder_alloc_deferred_release()
980 		if (buffer->clear_on_free) {  in binder_alloc_deferred_release()
981 			binder_alloc_clear_buf(alloc, buffer);  in binder_alloc_deferred_release()
982 			buffer->clear_on_free = false;  in binder_alloc_deferred_release()
984 		binder_free_buf_locked(alloc, buffer);  in binder_alloc_deferred_release()
989 		buffer = list_first_entry(&alloc->buffers,  in binder_alloc_deferred_release()
991 		WARN_ON(!buffer->free);  in binder_alloc_deferred_release()
993 		list_del(&buffer->entry);  in binder_alloc_deferred_release()
995 		kfree(buffer);  in binder_alloc_deferred_release()
1044 	struct binder_buffer *buffer;  in binder_alloc_print_allocated()  local
1049 		buffer = rb_entry(n, struct binder_buffer, rb_node);  in binder_alloc_print_allocated()
1051 			   buffer->debug_id,  in binder_alloc_print_allocated()
1052 			   buffer->user_data - alloc->vm_start,  in binder_alloc_print_allocated()
1053 			   buffer->data_size, buffer->offsets_size,  in binder_alloc_print_allocated()
1054 			   buffer->extra_buffers_size,  in binder_alloc_print_allocated()
1055 			   buffer->transaction ? "active" : "delivered");  in binder_alloc_print_allocated()
1305 				struct binder_buffer *buffer,  in check_buffer()  argument
1308 	size_t buffer_size = binder_alloc_buffer_size(alloc, buffer);  in check_buffer()
1313 		!buffer->free &&  in check_buffer()
1314 		(!buffer->allow_user_free || !buffer->transaction);  in check_buffer()
1331 				 struct binder_buffer *buffer,  in binder_alloc_copy_user_to_buffer()  argument
1336 	if (!check_buffer(alloc, buffer, buffer_offset, bytes))  in binder_alloc_copy_user_to_buffer()
1346 		page = binder_alloc_get_page(alloc, buffer,  in binder_alloc_copy_user_to_buffer()
1363 				       struct binder_buffer *buffer,  in binder_alloc_do_buffer_copy()  argument
1369 	if (!check_buffer(alloc, buffer, buffer_offset, bytes))  in binder_alloc_do_buffer_copy()
1377 		page = binder_alloc_get_page(alloc, buffer,  in binder_alloc_do_buffer_copy()
1393 				struct binder_buffer *buffer,  in binder_alloc_copy_to_buffer()  argument
1398 	return binder_alloc_do_buffer_copy(alloc, true, buffer, buffer_offset,  in binder_alloc_copy_to_buffer()
1404 				  struct binder_buffer *buffer,  in binder_alloc_copy_from_buffer()  argument
1408 	return binder_alloc_do_buffer_copy(alloc, false, buffer, buffer_offset,  in binder_alloc_copy_from_buffer()