2884 			       struct binder_transaction_data *tr, int reply,  in binder_transaction()  argument
2910 	e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY);  in binder_transaction()
2913 	e->target_handle = tr->target.handle;  in binder_transaction()
2914 	e->data_size = tr->data_size;  in binder_transaction()
2915 	e->offsets_size = tr->offsets_size;  in binder_transaction()
2972 		if (tr->target.handle) {  in binder_transaction()
2983 			ref = binder_get_ref_olocked(proc, tr->target.handle,  in binder_transaction()
3037 		if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) {  in binder_transaction()
3103 			     (u64)tr->data.ptr.buffer,  in binder_transaction()
3104 			     (u64)tr->data.ptr.offsets,  in binder_transaction()
3105 			     (u64)tr->data_size, (u64)tr->offsets_size,  in binder_transaction()
3112 			     (u64)tr->data.ptr.buffer,  in binder_transaction()
3113 			     (u64)tr->data.ptr.offsets,  in binder_transaction()
3114 			     (u64)tr->data_size, (u64)tr->offsets_size,  in binder_transaction()
3117 	if (!reply && !(tr->flags & TF_ONE_WAY))  in binder_transaction()
3124 	t->code = tr->code;  in binder_transaction()
3125 	t->flags = tr->flags;  in binder_transaction()
3161 	t->buffer = binder_alloc_new_buf(&target_proc->alloc, tr->data_size,  in binder_transaction()
3162 		tr->offsets_size, extra_buffers_size,  in binder_transaction()
3176 		size_t buf_offset = ALIGN(tr->data_size, sizeof(void *)) +  in binder_transaction()
3177 				    ALIGN(tr->offsets_size, sizeof(void *)) +  in binder_transaction()
3193 				      ALIGN(tr->data_size, sizeof(void *)));  in binder_transaction()
3197 			   tr->data.ptr.buffer, tr->data_size)) {  in binder_transaction()
3206 			   tr->data.ptr.offsets, tr->offsets_size)) {  in binder_transaction()
3214 	if (!IS_ALIGNED(tr->offsets_size, sizeof(binder_size_t))) {  in binder_transaction()
3216 				proc->pid, thread->pid, (u64)tr->offsets_size);  in binder_transaction()
3231 	off_end = (void *)off_start + tr->offsets_size;  in binder_transaction()
3485 		     (u64)tr->data_size, (u64)tr->offsets_size,  in binder_transaction()
3748 			struct binder_transaction_data_sg tr;  in binder_thread_write()  local
3750 			if (copy_from_user(&tr, ptr, sizeof(tr)))  in binder_thread_write()
3752 			ptr += sizeof(tr);  in binder_thread_write()
3753 			binder_transaction(proc, thread, &tr.transaction_data,  in binder_thread_write()
3754 					   cmd == BC_REPLY_SG, tr.buffers_size);  in binder_thread_write()
3759 			struct binder_transaction_data tr;  in binder_thread_write()  local
3761 			if (copy_from_user(&tr, ptr, sizeof(tr)))  in binder_thread_write()
3763 			ptr += sizeof(tr);  in binder_thread_write()
3764 			binder_transaction(proc, thread, &tr,  in binder_thread_write()
4118 		struct binder_transaction_data_secctx tr;  in binder_thread_read()  local
4119 		struct binder_transaction_data *trd = &tr.transaction_data;  in binder_thread_read()
4141 		if (end - ptr < sizeof(tr) + 4) {  in binder_thread_read()
4356 		tr.secctx = t->security_ctx;  in binder_thread_read()
4359 			trsize = sizeof(tr);  in binder_thread_read()
4371 		if (copy_to_user(ptr, &tr, trsize)) {  in binder_thread_read()