1319 			       struct binder_transaction_data *tr, int reply)  in binder_transaction()  argument
1334 	e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY);  in binder_transaction()
1337 	e->target_handle = tr->target.handle;  in binder_transaction()
1338 	e->data_size = tr->data_size;  in binder_transaction()
1339 	e->offsets_size = tr->offsets_size;  in binder_transaction()
1380 		if (tr->target.handle) {  in binder_transaction()
1383 			ref = binder_get_ref(proc, tr->target.handle);  in binder_transaction()
1409 		if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) {  in binder_transaction()
1462 			     (u64)tr->data.ptr.buffer,  in binder_transaction()
1463 			     (u64)tr->data.ptr.offsets,  in binder_transaction()
1464 			     (u64)tr->data_size, (u64)tr->offsets_size);  in binder_transaction()
1470 			     (u64)tr->data.ptr.buffer,  in binder_transaction()
1471 			     (u64)tr->data.ptr.offsets,  in binder_transaction()
1472 			     (u64)tr->data_size, (u64)tr->offsets_size);  in binder_transaction()
1474 	if (!reply && !(tr->flags & TF_ONE_WAY))  in binder_transaction()
1481 	t->code = tr->code;  in binder_transaction()
1482 	t->flags = tr->flags;  in binder_transaction()
1487 	t->buffer = binder_alloc_buf(target_proc, tr->data_size,  in binder_transaction()
1488 		tr->offsets_size, !reply && (t->flags & TF_ONE_WAY));  in binder_transaction()
1502 				 ALIGN(tr->data_size, sizeof(void *)));  in binder_transaction()
1505 			   tr->data.ptr.buffer, tr->data_size)) {  in binder_transaction()
1512 			   tr->data.ptr.offsets, tr->offsets_size)) {  in binder_transaction()
1518 	if (!IS_ALIGNED(tr->offsets_size, sizeof(binder_size_t))) {  in binder_transaction()
1520 				proc->pid, thread->pid, (u64)tr->offsets_size);  in binder_transaction()
1524 	off_end = (void *)offp + tr->offsets_size;  in binder_transaction()
1738 		     (u64)tr->data_size, (u64)tr->offsets_size);  in binder_transaction()
1935 			struct binder_transaction_data tr;  in binder_thread_write()  local
1937 			if (copy_from_user(&tr, ptr, sizeof(tr)))  in binder_thread_write()
1939 			ptr += sizeof(tr);  in binder_thread_write()
1940 			binder_transaction(proc, thread, &tr, cmd == BC_REPLY);  in binder_thread_write()
2225 		struct binder_transaction_data tr;  in binder_thread_read()  local
2243 		if (end - ptr < sizeof(tr) + 4)  in binder_thread_read()
2379 			tr.target.ptr = target_node->ptr;  in binder_thread_read()
2380 			tr.cookie =  target_node->cookie;  in binder_thread_read()
2390 			tr.target.ptr = 0;  in binder_thread_read()
2391 			tr.cookie = 0;  in binder_thread_read()
2394 		tr.code = t->code;  in binder_thread_read()
2395 		tr.flags = t->flags;  in binder_thread_read()
2396 		tr.sender_euid = from_kuid(current_user_ns(), t->sender_euid);  in binder_thread_read()
2401 			tr.sender_pid = task_tgid_nr_ns(sender,  in binder_thread_read()
2404 			tr.sender_pid = 0;  in binder_thread_read()
2407 		tr.data_size = t->buffer->data_size;  in binder_thread_read()
2408 		tr.offsets_size = t->buffer->offsets_size;  in binder_thread_read()
2409 		tr.data.ptr.buffer = (binder_uintptr_t)(  in binder_thread_read()
2412 		tr.data.ptr.offsets = tr.data.ptr.buffer +  in binder_thread_read()
2419 		if (copy_to_user(ptr, &tr, sizeof(tr)))  in binder_thread_read()
2421 		ptr += sizeof(tr);  in binder_thread_read()
2433 			     (u64)tr.data.ptr.buffer, (u64)tr.data.ptr.offsets);  in binder_thread_read()