50 static struct binder_buffer *binder_buffer_next(struct binder_buffer *buffer)  in binder_buffer_next()  argument
52 	return list_entry(buffer->entry.next, struct binder_buffer, entry);  in binder_buffer_next()
55 static struct binder_buffer *binder_buffer_prev(struct binder_buffer *buffer)  in binder_buffer_prev()  argument
57 	return list_entry(buffer->entry.prev, struct binder_buffer, entry);  in binder_buffer_prev()
61 				       struct binder_buffer *buffer)  in binder_alloc_buffer_size()  argument
63 	if (list_is_last(&buffer->entry, &alloc->buffers))  in binder_alloc_buffer_size()
64 		return alloc->vm_start + alloc->buffer_size - buffer->user_data;  in binder_alloc_buffer_size()
65 	return binder_buffer_next(buffer)->user_data - buffer->user_data;  in binder_alloc_buffer_size()
73 	struct binder_buffer *buffer;  in binder_insert_free_buffer()  local
87 		buffer = rb_entry(parent, struct binder_buffer, rb_node);  in binder_insert_free_buffer()
88 		BUG_ON(!buffer->free);  in binder_insert_free_buffer()
90 		buffer_size = binder_alloc_buffer_size(alloc, buffer);  in binder_insert_free_buffer()
106 	struct binder_buffer *buffer;  in binder_insert_allocated_buffer_locked()  local
112 		buffer = rb_entry(parent, struct binder_buffer, rb_node);  in binder_insert_allocated_buffer_locked()
113 		BUG_ON(buffer->free);  in binder_insert_allocated_buffer_locked()
115 		if (new_buffer->user_data < buffer->user_data)  in binder_insert_allocated_buffer_locked()
117 		else if (new_buffer->user_data > buffer->user_data)  in binder_insert_allocated_buffer_locked()
131 	struct binder_buffer *buffer;  in binder_alloc_prepare_to_free_locked()  local
134 		buffer = rb_entry(n, struct binder_buffer, rb_node);  in binder_alloc_prepare_to_free_locked()
135 		BUG_ON(buffer->free);  in binder_alloc_prepare_to_free_locked()
137 		if (user_ptr < buffer->user_data) {  in binder_alloc_prepare_to_free_locked()
139 		} else if (user_ptr > buffer->user_data) {  in binder_alloc_prepare_to_free_locked()
147 			if (!buffer->allow_user_free)  in binder_alloc_prepare_to_free_locked()
149 			buffer->allow_user_free = 0;  in binder_alloc_prepare_to_free_locked()
150 			return buffer;  in binder_alloc_prepare_to_free_locked()
170 	struct binder_buffer *buffer;  in binder_alloc_prepare_to_free()  local
173 	buffer = binder_alloc_prepare_to_free_locked(alloc, user_ptr);  in binder_alloc_prepare_to_free()
175 	return buffer;  in binder_alloc_prepare_to_free()
364 				       struct binder_buffer *buffer,  in binder_install_buffer_pages()  argument
370 	start = buffer->user_data & PAGE_MASK;  in binder_install_buffer_pages()
371 	final = PAGE_ALIGN(buffer->user_data + size);  in binder_install_buffer_pages()
430 	struct binder_buffer *buffer;  in debug_no_space_locked()  local
440 		buffer = rb_entry(n, struct binder_buffer, rb_node);  in debug_no_space_locked()
441 		buffer_size = binder_alloc_buffer_size(alloc, buffer);  in debug_no_space_locked()
449 		buffer = rb_entry(n, struct binder_buffer, rb_node);  in debug_no_space_locked()
450 		buffer_size = binder_alloc_buffer_size(alloc, buffer);  in debug_no_space_locked()
473 	struct binder_buffer *buffer;  in debug_low_async_space_locked()  local
490 		buffer = rb_entry(n, struct binder_buffer, rb_node);  in debug_low_async_space_locked()
491 		if (buffer->pid != pid)  in debug_low_async_space_locked()
493 		if (!buffer->async_transaction)  in debug_low_async_space_locked()
495 		total_alloc_size += binder_alloc_buffer_size(alloc, buffer);  in debug_low_async_space_locked()
525 	struct binder_buffer *buffer;  in binder_alloc_new_buf_locked()  local
534 		buffer = ERR_PTR(-ENOSPC);  in binder_alloc_new_buf_locked()
539 		buffer = rb_entry(n, struct binder_buffer, rb_node);  in binder_alloc_new_buf_locked()
540 		BUG_ON(!buffer->free);  in binder_alloc_new_buf_locked()
541 		buffer_size = binder_alloc_buffer_size(alloc, buffer);  in binder_alloc_new_buf_locked()
559 		buffer = ERR_PTR(-ENOSPC);  in binder_alloc_new_buf_locked()
565 		buffer = rb_entry(best_fit, struct binder_buffer, rb_node);  in binder_alloc_new_buf_locked()
566 		buffer_size = binder_alloc_buffer_size(alloc, buffer);  in binder_alloc_new_buf_locked()
569 		new_buffer->user_data = buffer->user_data + size;  in binder_alloc_new_buf_locked()
570 		list_add(&new_buffer->entry, &buffer->entry);  in binder_alloc_new_buf_locked()
578 		      alloc->pid, size, buffer, buffer_size);  in binder_alloc_new_buf_locked()
586 	next_used_page = (buffer->user_data + buffer_size) & PAGE_MASK;  in binder_alloc_new_buf_locked()
587 	curr_last_page = PAGE_ALIGN(buffer->user_data + size);  in binder_alloc_new_buf_locked()
588 	binder_lru_freelist_del(alloc, PAGE_ALIGN(buffer->user_data),  in binder_alloc_new_buf_locked()
591 	rb_erase(&buffer->rb_node, &alloc->free_buffers);  in binder_alloc_new_buf_locked()
592 	buffer->free = 0;  in binder_alloc_new_buf_locked()
593 	buffer->allow_user_free = 0;  in binder_alloc_new_buf_locked()
594 	binder_insert_allocated_buffer_locked(alloc, buffer);  in binder_alloc_new_buf_locked()
595 	buffer->async_transaction = is_async;  in binder_alloc_new_buf_locked()
596 	buffer->oneway_spam_suspect = false;  in binder_alloc_new_buf_locked()
603 			buffer->oneway_spam_suspect = true;  in binder_alloc_new_buf_locked()
609 	return buffer;  in binder_alloc_new_buf_locked()
655 	struct binder_buffer *buffer, *next;  in binder_alloc_new_buf()  local
682 	buffer = binder_alloc_new_buf_locked(alloc, next, size, is_async);  in binder_alloc_new_buf()
683 	if (IS_ERR(buffer)) {  in binder_alloc_new_buf()
688 	buffer->data_size = data_size;  in binder_alloc_new_buf()
689 	buffer->offsets_size = offsets_size;  in binder_alloc_new_buf()
690 	buffer->extra_buffers_size = extra_buffers_size;  in binder_alloc_new_buf()
691 	buffer->pid = current->tgid;  in binder_alloc_new_buf()
694 	ret = binder_install_buffer_pages(alloc, buffer, size);  in binder_alloc_new_buf()
696 		binder_alloc_free_buf(alloc, buffer);  in binder_alloc_new_buf()
697 		buffer = ERR_PTR(ret);  in binder_alloc_new_buf()
700 	return buffer;  in binder_alloc_new_buf()
703 static unsigned long buffer_start_page(struct binder_buffer *buffer)  in buffer_start_page()  argument
705 	return buffer->user_data & PAGE_MASK;  in buffer_start_page()
708 static unsigned long prev_buffer_end_page(struct binder_buffer *buffer)  in prev_buffer_end_page()  argument
710 	return (buffer->user_data - 1) & PAGE_MASK;  in prev_buffer_end_page()
714 				      struct binder_buffer *buffer)  in binder_delete_free_buffer()  argument
718 	if (PAGE_ALIGNED(buffer->user_data))  in binder_delete_free_buffer()
721 	BUG_ON(alloc->buffers.next == &buffer->entry);  in binder_delete_free_buffer()
722 	prev = binder_buffer_prev(buffer);  in binder_delete_free_buffer()
724 	if (prev_buffer_end_page(prev) == buffer_start_page(buffer))  in binder_delete_free_buffer()
727 	if (!list_is_last(&buffer->entry, &alloc->buffers)) {  in binder_delete_free_buffer()
728 		next = binder_buffer_next(buffer);  in binder_delete_free_buffer()
729 		if (buffer_start_page(next) == buffer_start_page(buffer))  in binder_delete_free_buffer()
733 	binder_lru_freelist_add(alloc, buffer_start_page(buffer),  in binder_delete_free_buffer()
734 				buffer_start_page(buffer) + PAGE_SIZE);  in binder_delete_free_buffer()
736 	list_del(&buffer->entry);  in binder_delete_free_buffer()
737 	kfree(buffer);  in binder_delete_free_buffer()
741 				   struct binder_buffer *buffer)  in binder_free_buf_locked()  argument
745 	buffer_size = binder_alloc_buffer_size(alloc, buffer);  in binder_free_buf_locked()
747 	size = ALIGN(buffer->data_size, sizeof(void *)) +  in binder_free_buf_locked()
748 		ALIGN(buffer->offsets_size, sizeof(void *)) +  in binder_free_buf_locked()
749 		ALIGN(buffer->extra_buffers_size, sizeof(void *));  in binder_free_buf_locked()
753 		      alloc->pid, buffer, size, buffer_size);  in binder_free_buf_locked()
755 	BUG_ON(buffer->free);  in binder_free_buf_locked()
757 	BUG_ON(buffer->transaction != NULL);  in binder_free_buf_locked()
758 	BUG_ON(buffer->user_data < alloc->vm_start);  in binder_free_buf_locked()
759 	BUG_ON(buffer->user_data > alloc->vm_start + alloc->buffer_size);  in binder_free_buf_locked()
761 	if (buffer->async_transaction) {  in binder_free_buf_locked()
768 	binder_lru_freelist_add(alloc, PAGE_ALIGN(buffer->user_data),  in binder_free_buf_locked()
769 				(buffer->user_data + buffer_size) & PAGE_MASK);  in binder_free_buf_locked()
771 	rb_erase(&buffer->rb_node, &alloc->allocated_buffers);  in binder_free_buf_locked()
772 	buffer->free = 1;  in binder_free_buf_locked()
773 	if (!list_is_last(&buffer->entry, &alloc->buffers)) {  in binder_free_buf_locked()
774 		struct binder_buffer *next = binder_buffer_next(buffer);  in binder_free_buf_locked()
781 	if (alloc->buffers.next != &buffer->entry) {  in binder_free_buf_locked()
782 		struct binder_buffer *prev = binder_buffer_prev(buffer);  in binder_free_buf_locked()
785 			binder_delete_free_buffer(alloc, buffer);  in binder_free_buf_locked()
787 			buffer = prev;  in binder_free_buf_locked()
790 	binder_insert_free_buffer(alloc, buffer);  in binder_free_buf_locked()
813 					  struct binder_buffer *buffer,  in binder_alloc_get_page()  argument
818 		(buffer->user_data - alloc->vm_start);  in binder_alloc_get_page()
835 				   struct binder_buffer *buffer)  in binder_alloc_clear_buf()  argument
837 	size_t bytes = binder_alloc_buffer_size(alloc, buffer);  in binder_alloc_clear_buf()
845 		page = binder_alloc_get_page(alloc, buffer,  in binder_alloc_clear_buf()
862 			    struct binder_buffer *buffer)  in binder_alloc_free_buf()  argument
872 	if (buffer->clear_on_free) {  in binder_alloc_free_buf()
873 		binder_alloc_clear_buf(alloc, buffer);  in binder_alloc_free_buf()
874 		buffer->clear_on_free = false;  in binder_alloc_free_buf()
877 	binder_free_buf_locked(alloc, buffer);  in binder_alloc_free_buf()
897 	struct binder_buffer *buffer;  in binder_alloc_mmap_handler()  local
928 	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);  in binder_alloc_mmap_handler()
929 	if (!buffer) {  in binder_alloc_mmap_handler()
935 	buffer->user_data = alloc->vm_start;  in binder_alloc_mmap_handler()
936 	list_add(&buffer->entry, &alloc->buffers);  in binder_alloc_mmap_handler()
937 	buffer->free = 1;  in binder_alloc_mmap_handler()
938 	binder_insert_free_buffer(alloc, buffer);  in binder_alloc_mmap_handler()
968 	struct binder_buffer *buffer;  in binder_alloc_deferred_release()  local
975 		buffer = rb_entry(n, struct binder_buffer, rb_node);  in binder_alloc_deferred_release()
978 		BUG_ON(buffer->transaction);  in binder_alloc_deferred_release()
980 		if (buffer->clear_on_free) {  in binder_alloc_deferred_release()
981 			binder_alloc_clear_buf(alloc, buffer);  in binder_alloc_deferred_release()
982 			buffer->clear_on_free = false;  in binder_alloc_deferred_release()
984 		binder_free_buf_locked(alloc, buffer);  in binder_alloc_deferred_release()
989 		buffer = list_first_entry(&alloc->buffers,  in binder_alloc_deferred_release()
991 		WARN_ON(!buffer->free);  in binder_alloc_deferred_release()
993 		list_del(&buffer->entry);  in binder_alloc_deferred_release()
995 		kfree(buffer);  in binder_alloc_deferred_release()
1043 	struct binder_buffer *buffer;  in binder_alloc_print_allocated()  local
1048 		buffer = rb_entry(n, struct binder_buffer, rb_node);  in binder_alloc_print_allocated()
1050 			   buffer->debug_id,  in binder_alloc_print_allocated()
1051 			   buffer->user_data - alloc->vm_start,  in binder_alloc_print_allocated()
1052 			   buffer->data_size, buffer->offsets_size,  in binder_alloc_print_allocated()
1053 			   buffer->extra_buffers_size,  in binder_alloc_print_allocated()
1054 			   buffer->transaction ? "active" : "delivered");  in binder_alloc_print_allocated()
1296 				struct binder_buffer *buffer,  in check_buffer()  argument
1299 	size_t buffer_size = binder_alloc_buffer_size(alloc, buffer);  in check_buffer()
1304 		!buffer->free &&  in check_buffer()
1305 		(!buffer->allow_user_free || !buffer->transaction);  in check_buffer()
1322 				 struct binder_buffer *buffer,  in binder_alloc_copy_user_to_buffer()  argument
1327 	if (!check_buffer(alloc, buffer, buffer_offset, bytes))  in binder_alloc_copy_user_to_buffer()
1337 		page = binder_alloc_get_page(alloc, buffer,  in binder_alloc_copy_user_to_buffer()
1354 				       struct binder_buffer *buffer,  in binder_alloc_do_buffer_copy()  argument
1360 	if (!check_buffer(alloc, buffer, buffer_offset, bytes))  in binder_alloc_do_buffer_copy()
1368 		page = binder_alloc_get_page(alloc, buffer,  in binder_alloc_do_buffer_copy()
1384 				struct binder_buffer *buffer,  in binder_alloc_copy_to_buffer()  argument
1389 	return binder_alloc_do_buffer_copy(alloc, true, buffer, buffer_offset,  in binder_alloc_copy_to_buffer()
1395 				  struct binder_buffer *buffer,  in binder_alloc_copy_from_buffer()  argument
1399 	return binder_alloc_do_buffer_copy(alloc, false, buffer, buffer_offset,  in binder_alloc_copy_from_buffer()