56 static struct binder_buffer *binder_buffer_next(struct binder_buffer *buffer)  in binder_buffer_next()  argument
58 	return list_entry(buffer->entry.next, struct binder_buffer, entry);  in binder_buffer_next()
61 static struct binder_buffer *binder_buffer_prev(struct binder_buffer *buffer)  in binder_buffer_prev()  argument
63 	return list_entry(buffer->entry.prev, struct binder_buffer, entry);  in binder_buffer_prev()
67 				       struct binder_buffer *buffer)  in binder_alloc_buffer_size()  argument
69 	if (list_is_last(&buffer->entry, &alloc->buffers))  in binder_alloc_buffer_size()
70 		return (u8 *)alloc->buffer +  in binder_alloc_buffer_size()
71 			alloc->buffer_size - (u8 *)buffer->data;  in binder_alloc_buffer_size()
72 	return (u8 *)binder_buffer_next(buffer)->data - (u8 *)buffer->data;  in binder_alloc_buffer_size()
80 	struct binder_buffer *buffer;  in binder_insert_free_buffer()  local
94 		buffer = rb_entry(parent, struct binder_buffer, rb_node);  in binder_insert_free_buffer()
95 		BUG_ON(!buffer->free);  in binder_insert_free_buffer()
97 		buffer_size = binder_alloc_buffer_size(alloc, buffer);  in binder_insert_free_buffer()
113 	struct binder_buffer *buffer;  in binder_insert_allocated_buffer_locked()  local
119 		buffer = rb_entry(parent, struct binder_buffer, rb_node);  in binder_insert_allocated_buffer_locked()
120 		BUG_ON(buffer->free);  in binder_insert_allocated_buffer_locked()
122 		if (new_buffer->data < buffer->data)  in binder_insert_allocated_buffer_locked()
124 		else if (new_buffer->data > buffer->data)  in binder_insert_allocated_buffer_locked()
138 	struct binder_buffer *buffer;  in binder_alloc_prepare_to_free_locked()  local
144 		buffer = rb_entry(n, struct binder_buffer, rb_node);  in binder_alloc_prepare_to_free_locked()
145 		BUG_ON(buffer->free);  in binder_alloc_prepare_to_free_locked()
147 		if (kern_ptr < buffer->data)  in binder_alloc_prepare_to_free_locked()
149 		else if (kern_ptr > buffer->data)  in binder_alloc_prepare_to_free_locked()
156 			if (buffer->free_in_progress) {  in binder_alloc_prepare_to_free_locked()
163 			buffer->free_in_progress = 1;  in binder_alloc_prepare_to_free_locked()
164 			return buffer;  in binder_alloc_prepare_to_free_locked()
184 	struct binder_buffer *buffer;  in binder_alloc_prepare_to_free()  local
187 	buffer = binder_alloc_prepare_to_free_locked(alloc, user_ptr);  in binder_alloc_prepare_to_free()
189 	return buffer;  in binder_alloc_prepare_to_free()
215 		page = &alloc->pages[(page_addr - alloc->buffer) / PAGE_SIZE];  in binder_update_page_range()
242 		index = (page_addr - alloc->buffer) / PAGE_SIZE;  in binder_update_page_range()
307 		index = (page_addr - alloc->buffer) / PAGE_SIZE;  in binder_update_page_range()
372 	struct binder_buffer *buffer;  in binder_alloc_new_buf_locked()  local
415 		buffer = rb_entry(n, struct binder_buffer, rb_node);  in binder_alloc_new_buf_locked()
416 		BUG_ON(!buffer->free);  in binder_alloc_new_buf_locked()
417 		buffer_size = binder_alloc_buffer_size(alloc, buffer);  in binder_alloc_new_buf_locked()
439 			buffer = rb_entry(n, struct binder_buffer, rb_node);  in binder_alloc_new_buf_locked()
440 			buffer_size = binder_alloc_buffer_size(alloc, buffer);  in binder_alloc_new_buf_locked()
448 			buffer = rb_entry(n, struct binder_buffer, rb_node);  in binder_alloc_new_buf_locked()
449 			buffer_size = binder_alloc_buffer_size(alloc, buffer);  in binder_alloc_new_buf_locked()
466 		buffer = rb_entry(best_fit, struct binder_buffer, rb_node);  in binder_alloc_new_buf_locked()
467 		buffer_size = binder_alloc_buffer_size(alloc, buffer);  in binder_alloc_new_buf_locked()
472 		      alloc->pid, size, buffer, buffer_size);  in binder_alloc_new_buf_locked()
475 		(void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK);  in binder_alloc_new_buf_locked()
478 		(void *)PAGE_ALIGN((uintptr_t)buffer->data + size);  in binder_alloc_new_buf_locked()
482 	    (void *)PAGE_ALIGN((uintptr_t)buffer->data), end_page_addr);  in binder_alloc_new_buf_locked()
489 		new_buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);  in binder_alloc_new_buf_locked()
495 		new_buffer->data = (u8 *)buffer->data + size;  in binder_alloc_new_buf_locked()
496 		list_add(&new_buffer->entry, &buffer->entry);  in binder_alloc_new_buf_locked()
502 	buffer->free = 0;  in binder_alloc_new_buf_locked()
503 	buffer->free_in_progress = 0;  in binder_alloc_new_buf_locked()
504 	binder_insert_allocated_buffer_locked(alloc, buffer);  in binder_alloc_new_buf_locked()
507 		      alloc->pid, size, buffer);  in binder_alloc_new_buf_locked()
508 	buffer->data_size = data_size;  in binder_alloc_new_buf_locked()
509 	buffer->offsets_size = offsets_size;  in binder_alloc_new_buf_locked()
510 	buffer->async_transaction = is_async;  in binder_alloc_new_buf_locked()
511 	buffer->extra_buffers_size = extra_buffers_size;  in binder_alloc_new_buf_locked()
518 	return buffer;  in binder_alloc_new_buf_locked()
522 				 (void *)PAGE_ALIGN((uintptr_t)buffer->data),  in binder_alloc_new_buf_locked()
548 	struct binder_buffer *buffer;  in binder_alloc_new_buf()  local
551 	buffer = binder_alloc_new_buf_locked(alloc, data_size, offsets_size,  in binder_alloc_new_buf()
554 	return buffer;  in binder_alloc_new_buf()
557 static void *buffer_start_page(struct binder_buffer *buffer)  in buffer_start_page()  argument
559 	return (void *)((uintptr_t)buffer->data & PAGE_MASK);  in buffer_start_page()
562 static void *prev_buffer_end_page(struct binder_buffer *buffer)  in prev_buffer_end_page()  argument
564 	return (void *)(((uintptr_t)(buffer->data) - 1) & PAGE_MASK);  in prev_buffer_end_page()
568 				      struct binder_buffer *buffer)  in binder_delete_free_buffer()  argument
572 	BUG_ON(alloc->buffers.next == &buffer->entry);  in binder_delete_free_buffer()
573 	prev = binder_buffer_prev(buffer);  in binder_delete_free_buffer()
575 	if (prev_buffer_end_page(prev) == buffer_start_page(buffer)) {  in binder_delete_free_buffer()
579 				   alloc->pid, buffer->data, prev->data);  in binder_delete_free_buffer()
582 	if (!list_is_last(&buffer->entry, &alloc->buffers)) {  in binder_delete_free_buffer()
583 		next = binder_buffer_next(buffer);  in binder_delete_free_buffer()
584 		if (buffer_start_page(next) == buffer_start_page(buffer)) {  in binder_delete_free_buffer()
589 					   buffer->data,  in binder_delete_free_buffer()
594 	if (PAGE_ALIGNED(buffer->data)) {  in binder_delete_free_buffer()
597 				   alloc->pid, buffer->data);  in binder_delete_free_buffer()
604 				   alloc->pid, buffer->data,  in binder_delete_free_buffer()
606 		binder_update_page_range(alloc, 0, buffer_start_page(buffer),  in binder_delete_free_buffer()
607 					 buffer_start_page(buffer) + PAGE_SIZE);  in binder_delete_free_buffer()
609 	list_del(&buffer->entry);  in binder_delete_free_buffer()
610 	kfree(buffer);  in binder_delete_free_buffer()
614 				   struct binder_buffer *buffer)  in binder_free_buf_locked()  argument
618 	buffer_size = binder_alloc_buffer_size(alloc, buffer);  in binder_free_buf_locked()
620 	size = ALIGN(buffer->data_size, sizeof(void *)) +  in binder_free_buf_locked()
621 		ALIGN(buffer->offsets_size, sizeof(void *)) +  in binder_free_buf_locked()
622 		ALIGN(buffer->extra_buffers_size, sizeof(void *));  in binder_free_buf_locked()
626 		      alloc->pid, buffer, size, buffer_size);  in binder_free_buf_locked()
628 	BUG_ON(buffer->free);  in binder_free_buf_locked()
630 	BUG_ON(buffer->transaction != NULL);  in binder_free_buf_locked()
631 	BUG_ON(buffer->data < alloc->buffer);  in binder_free_buf_locked()
632 	BUG_ON(buffer->data > alloc->buffer + alloc->buffer_size);  in binder_free_buf_locked()
634 	if (buffer->async_transaction) {  in binder_free_buf_locked()
643 		(void *)PAGE_ALIGN((uintptr_t)buffer->data),  in binder_free_buf_locked()
644 		(void *)(((uintptr_t)buffer->data + buffer_size) & PAGE_MASK));  in binder_free_buf_locked()
646 	rb_erase(&buffer->rb_node, &alloc->allocated_buffers);  in binder_free_buf_locked()
647 	buffer->free = 1;  in binder_free_buf_locked()
648 	if (!list_is_last(&buffer->entry, &alloc->buffers)) {  in binder_free_buf_locked()
649 		struct binder_buffer *next = binder_buffer_next(buffer);  in binder_free_buf_locked()
656 	if (alloc->buffers.next != &buffer->entry) {  in binder_free_buf_locked()
657 		struct binder_buffer *prev = binder_buffer_prev(buffer);  in binder_free_buf_locked()
660 			binder_delete_free_buffer(alloc, buffer);  in binder_free_buf_locked()
662 			buffer = prev;  in binder_free_buf_locked()
665 	binder_insert_free_buffer(alloc, buffer);  in binder_free_buf_locked()
676 			    struct binder_buffer *buffer)  in binder_alloc_free_buf()  argument
679 	binder_free_buf_locked(alloc, buffer);  in binder_alloc_free_buf()
702 	struct binder_buffer *buffer;  in binder_alloc_mmap_handler()  local
705 	if (alloc->buffer) {  in binder_alloc_mmap_handler()
717 	alloc->buffer = area->addr;  in binder_alloc_mmap_handler()
719 		vma->vm_start - (uintptr_t)alloc->buffer;  in binder_alloc_mmap_handler()
725 				(vma->vm_start ^ (uint32_t)alloc->buffer))) {  in binder_alloc_mmap_handler()
728 				vma->vm_end, alloc->buffer);  in binder_alloc_mmap_handler()
743 	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);  in binder_alloc_mmap_handler()
744 	if (!buffer) {  in binder_alloc_mmap_handler()
750 	buffer->data = alloc->buffer;  in binder_alloc_mmap_handler()
751 	list_add(&buffer->entry, &alloc->buffers);  in binder_alloc_mmap_handler()
752 	buffer->free = 1;  in binder_alloc_mmap_handler()
753 	binder_insert_free_buffer(alloc, buffer);  in binder_alloc_mmap_handler()
765 	vfree(alloc->buffer);  in binder_alloc_mmap_handler()
766 	alloc->buffer = NULL;  in binder_alloc_mmap_handler()
782 	struct binder_buffer *buffer;  in binder_alloc_deferred_release()  local
789 		buffer = rb_entry(n, struct binder_buffer, rb_node);  in binder_alloc_deferred_release()
792 		BUG_ON(buffer->transaction);  in binder_alloc_deferred_release()
794 		binder_free_buf_locked(alloc, buffer);  in binder_alloc_deferred_release()
799 		buffer = list_first_entry(&alloc->buffers,  in binder_alloc_deferred_release()
801 		WARN_ON(!buffer->free);  in binder_alloc_deferred_release()
803 		list_del(&buffer->entry);  in binder_alloc_deferred_release()
805 		kfree(buffer);  in binder_alloc_deferred_release()
821 			page_addr = alloc->buffer + i * PAGE_SIZE;  in binder_alloc_deferred_release()
831 		vfree(alloc->buffer);  in binder_alloc_deferred_release()
843 				struct binder_buffer *buffer)  in print_binder_buffer()  argument
846 		   prefix, buffer->debug_id, buffer->data,  in print_binder_buffer()
847 		   buffer->data_size, buffer->offsets_size,  in print_binder_buffer()
848 		   buffer->extra_buffers_size,  in print_binder_buffer()
849 		   buffer->transaction ? "active" : "delivered");  in print_binder_buffer()
964 	page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;  in binder_alloc_free_page()