Commit | Line | Data |
---|---|---|
a3e9ddb7 CC |
1 | /* |
2 | * Copyright (C) 2008 Google, Inc. | |
3 | * | |
4 | * Based on, but no longer compatible with, the original | |
5 | * OpenBinder.org binder driver interface, which is: | |
6 | * | |
7 | * Copyright (c) 2005 Palmsource, Inc. | |
8 | * | |
9 | * This software is licensed under the terms of the GNU General Public | |
10 | * License version 2, as published by the Free Software Foundation, and | |
11 | * may be copied, distributed, and modified under those terms. | |
12 | * | |
13 | * This program is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
16 | * GNU General Public License for more details. | |
17 | * | |
18 | */ | |
19 | ||
20 | #ifndef _UAPI_LINUX_BINDER_H | |
21 | #define _UAPI_LINUX_BINDER_H | |
22 | ||
23 | #include <linux/ioctl.h> | |
24 | ||
25 | #define B_PACK_CHARS(c1, c2, c3, c4) \ | |
26 | ((((c1)<<24)) | (((c2)<<16)) | (((c3)<<8)) | (c4)) | |
27 | #define B_TYPE_LARGE 0x85 | |
28 | ||
29 | enum { | |
30 | BINDER_TYPE_BINDER = B_PACK_CHARS('s', 'b', '*', B_TYPE_LARGE), | |
31 | BINDER_TYPE_WEAK_BINDER = B_PACK_CHARS('w', 'b', '*', B_TYPE_LARGE), | |
32 | BINDER_TYPE_HANDLE = B_PACK_CHARS('s', 'h', '*', B_TYPE_LARGE), | |
33 | BINDER_TYPE_WEAK_HANDLE = B_PACK_CHARS('w', 'h', '*', B_TYPE_LARGE), | |
34 | BINDER_TYPE_FD = B_PACK_CHARS('f', 'd', '*', B_TYPE_LARGE), | |
35 | }; | |
36 | ||
37 | enum { | |
38 | FLAT_BINDER_FLAG_PRIORITY_MASK = 0xff, | |
39 | FLAT_BINDER_FLAG_ACCEPTS_FDS = 0x100, | |
40 | }; | |
41 | ||
42 | /* | |
43 | * This is the flattened representation of a Binder object for transfer | |
44 | * between processes. The 'offsets' supplied as part of a binder transaction | |
45 | * contains offsets into the data where these structures occur. The Binder | |
46 | * driver takes care of re-writing the structure type and data as it moves | |
47 | * between processes. | |
48 | */ | |
49 | struct flat_binder_object { | |
50 | /* 8 bytes for large_flat_header. */ | |
51 | __u32 type; | |
52 | __u32 flags; | |
53 | ||
54 | /* 8 bytes of data. */ | |
55 | union { | |
56 | void __user *binder; /* local object */ | |
57 | __u32 handle; /* remote object */ | |
58 | }; | |
59 | ||
60 | /* extra data associated with local object */ | |
61 | void __user *cookie; | |
62 | }; | |
63 | ||
64 | /* | |
65 | * On 64-bit platforms where user code may run in 32-bits the driver must | |
66 | * translate the buffer (and local binder) addresses appropriately. | |
67 | */ | |
68 | ||
69 | struct binder_write_read { | |
70 | size_t write_size; /* bytes to write */ | |
71 | size_t write_consumed; /* bytes consumed by driver */ | |
72 | unsigned long write_buffer; | |
73 | size_t read_size; /* bytes to read */ | |
74 | size_t read_consumed; /* bytes consumed by driver */ | |
75 | unsigned long read_buffer; | |
76 | }; | |
77 | ||
78 | /* Use with BINDER_VERSION, driver fills in fields. */ | |
79 | struct binder_version { | |
80 | /* driver protocol version -- increment with incompatible change */ | |
81 | __s32 protocol_version; | |
82 | }; | |
83 | ||
84 | /* This is the current protocol version. */ | |
85 | #define BINDER_CURRENT_PROTOCOL_VERSION 7 | |
86 | ||
87 | #define BINDER_WRITE_READ _IOWR('b', 1, struct binder_write_read) | |
88 | #define BINDER_SET_IDLE_TIMEOUT _IOW('b', 3, __s64) | |
89 | #define BINDER_SET_MAX_THREADS _IOW('b', 5, __u32) | |
90 | #define BINDER_SET_IDLE_PRIORITY _IOW('b', 6, __s32) | |
91 | #define BINDER_SET_CONTEXT_MGR _IOW('b', 7, __s32) | |
92 | #define BINDER_THREAD_EXIT _IOW('b', 8, __s32) | |
93 | #define BINDER_VERSION _IOWR('b', 9, struct binder_version) | |
94 | ||
95 | /* | |
96 | * NOTE: Two special error codes you should check for when calling | |
97 | * in to the driver are: | |
98 | * | |
99 | * EINTR -- The operation has been interupted. This should be | |
100 | * handled by retrying the ioctl() until a different error code | |
101 | * is returned. | |
102 | * | |
103 | * ECONNREFUSED -- The driver is no longer accepting operations | |
104 | * from your process. That is, the process is being destroyed. | |
105 | * You should handle this by exiting from your process. Note | |
106 | * that once this error code is returned, all further calls to | |
107 | * the driver from any thread will return this same code. | |
108 | */ | |
109 | ||
110 | enum transaction_flags { | |
111 | TF_ONE_WAY = 0x01, /* this is a one-way call: async, no return */ | |
112 | TF_ROOT_OBJECT = 0x04, /* contents are the component's root object */ | |
113 | TF_STATUS_CODE = 0x08, /* contents are a 32-bit status code */ | |
114 | TF_ACCEPT_FDS = 0x10, /* allow replies with file descriptors */ | |
115 | }; | |
116 | ||
117 | struct binder_transaction_data { | |
118 | /* The first two are only used for bcTRANSACTION and brTRANSACTION, | |
119 | * identifying the target and contents of the transaction. | |
120 | */ | |
121 | union { | |
122 | __u32 handle; /* target descriptor of command transaction */ | |
123 | void *ptr; /* target descriptor of return transaction */ | |
124 | } target; | |
125 | void *cookie; /* target object cookie */ | |
126 | __u32 code; /* transaction command */ | |
127 | ||
128 | /* General information about the transaction. */ | |
129 | __u32 flags; | |
130 | pid_t sender_pid; | |
131 | uid_t sender_euid; | |
132 | size_t data_size; /* number of bytes of data */ | |
133 | size_t offsets_size; /* number of bytes of offsets */ | |
134 | ||
135 | /* If this transaction is inline, the data immediately | |
136 | * follows here; otherwise, it ends with a pointer to | |
137 | * the data buffer. | |
138 | */ | |
139 | union { | |
140 | struct { | |
141 | /* transaction data */ | |
142 | const void __user *buffer; | |
143 | /* offsets from buffer to flat_binder_object structs */ | |
144 | const void __user *offsets; | |
145 | } ptr; | |
146 | __u8 buf[8]; | |
147 | } data; | |
148 | }; | |
149 | ||
150 | struct binder_ptr_cookie { | |
151 | void *ptr; | |
152 | void *cookie; | |
153 | }; | |
154 | ||
df24a2ea SC |
155 | struct binder_handle_cookie { |
156 | __u32 handle; | |
157 | void *cookie; | |
158 | } __attribute__((packed)); | |
159 | ||
a3e9ddb7 CC |
160 | struct binder_pri_desc { |
161 | __s32 priority; | |
162 | __u32 desc; | |
163 | }; | |
164 | ||
165 | struct binder_pri_ptr_cookie { | |
166 | __s32 priority; | |
167 | void *ptr; | |
168 | void *cookie; | |
169 | }; | |
170 | ||
171 | enum binder_driver_return_protocol { | |
172 | BR_ERROR = _IOR('r', 0, __s32), | |
173 | /* | |
174 | * int: error code | |
175 | */ | |
176 | ||
177 | BR_OK = _IO('r', 1), | |
178 | /* No parameters! */ | |
179 | ||
180 | BR_TRANSACTION = _IOR('r', 2, struct binder_transaction_data), | |
181 | BR_REPLY = _IOR('r', 3, struct binder_transaction_data), | |
182 | /* | |
183 | * binder_transaction_data: the received command. | |
184 | */ | |
185 | ||
186 | BR_ACQUIRE_RESULT = _IOR('r', 4, __s32), | |
187 | /* | |
188 | * not currently supported | |
189 | * int: 0 if the last bcATTEMPT_ACQUIRE was not successful. | |
190 | * Else the remote object has acquired a primary reference. | |
191 | */ | |
192 | ||
193 | BR_DEAD_REPLY = _IO('r', 5), | |
194 | /* | |
195 | * The target of the last transaction (either a bcTRANSACTION or | |
196 | * a bcATTEMPT_ACQUIRE) is no longer with us. No parameters. | |
197 | */ | |
198 | ||
199 | BR_TRANSACTION_COMPLETE = _IO('r', 6), | |
200 | /* | |
201 | * No parameters... always refers to the last transaction requested | |
202 | * (including replies). Note that this will be sent even for | |
203 | * asynchronous transactions. | |
204 | */ | |
205 | ||
206 | BR_INCREFS = _IOR('r', 7, struct binder_ptr_cookie), | |
207 | BR_ACQUIRE = _IOR('r', 8, struct binder_ptr_cookie), | |
208 | BR_RELEASE = _IOR('r', 9, struct binder_ptr_cookie), | |
209 | BR_DECREFS = _IOR('r', 10, struct binder_ptr_cookie), | |
210 | /* | |
211 | * void *: ptr to binder | |
212 | * void *: cookie for binder | |
213 | */ | |
214 | ||
215 | BR_ATTEMPT_ACQUIRE = _IOR('r', 11, struct binder_pri_ptr_cookie), | |
216 | /* | |
217 | * not currently supported | |
218 | * int: priority | |
219 | * void *: ptr to binder | |
220 | * void *: cookie for binder | |
221 | */ | |
222 | ||
223 | BR_NOOP = _IO('r', 12), | |
224 | /* | |
225 | * No parameters. Do nothing and examine the next command. It exists | |
226 | * primarily so that we can replace it with a BR_SPAWN_LOOPER command. | |
227 | */ | |
228 | ||
229 | BR_SPAWN_LOOPER = _IO('r', 13), | |
230 | /* | |
231 | * No parameters. The driver has determined that a process has no | |
232 | * threads waiting to service incoming transactions. When a process | |
233 | * receives this command, it must spawn a new service thread and | |
234 | * register it via bcENTER_LOOPER. | |
235 | */ | |
236 | ||
237 | BR_FINISHED = _IO('r', 14), | |
238 | /* | |
239 | * not currently supported | |
240 | * stop threadpool thread | |
241 | */ | |
242 | ||
243 | BR_DEAD_BINDER = _IOR('r', 15, void *), | |
244 | /* | |
245 | * void *: cookie | |
246 | */ | |
247 | BR_CLEAR_DEATH_NOTIFICATION_DONE = _IOR('r', 16, void *), | |
248 | /* | |
249 | * void *: cookie | |
250 | */ | |
251 | ||
252 | BR_FAILED_REPLY = _IO('r', 17), | |
253 | /* | |
254 | * The the last transaction (either a bcTRANSACTION or | |
255 | * a bcATTEMPT_ACQUIRE) failed (e.g. out of memory). No parameters. | |
256 | */ | |
257 | }; | |
258 | ||
259 | enum binder_driver_command_protocol { | |
260 | BC_TRANSACTION = _IOW('c', 0, struct binder_transaction_data), | |
261 | BC_REPLY = _IOW('c', 1, struct binder_transaction_data), | |
262 | /* | |
263 | * binder_transaction_data: the sent command. | |
264 | */ | |
265 | ||
266 | BC_ACQUIRE_RESULT = _IOW('c', 2, __s32), | |
267 | /* | |
268 | * not currently supported | |
269 | * int: 0 if the last BR_ATTEMPT_ACQUIRE was not successful. | |
270 | * Else you have acquired a primary reference on the object. | |
271 | */ | |
272 | ||
273 | BC_FREE_BUFFER = _IOW('c', 3, void *), | |
274 | /* | |
275 | * void *: ptr to transaction data received on a read | |
276 | */ | |
277 | ||
278 | BC_INCREFS = _IOW('c', 4, __u32), | |
279 | BC_ACQUIRE = _IOW('c', 5, __u32), | |
280 | BC_RELEASE = _IOW('c', 6, __u32), | |
281 | BC_DECREFS = _IOW('c', 7, __u32), | |
282 | /* | |
283 | * int: descriptor | |
284 | */ | |
285 | ||
286 | BC_INCREFS_DONE = _IOW('c', 8, struct binder_ptr_cookie), | |
287 | BC_ACQUIRE_DONE = _IOW('c', 9, struct binder_ptr_cookie), | |
288 | /* | |
289 | * void *: ptr to binder | |
290 | * void *: cookie for binder | |
291 | */ | |
292 | ||
293 | BC_ATTEMPT_ACQUIRE = _IOW('c', 10, struct binder_pri_desc), | |
294 | /* | |
295 | * not currently supported | |
296 | * int: priority | |
297 | * int: descriptor | |
298 | */ | |
299 | ||
300 | BC_REGISTER_LOOPER = _IO('c', 11), | |
301 | /* | |
302 | * No parameters. | |
303 | * Register a spawned looper thread with the device. | |
304 | */ | |
305 | ||
306 | BC_ENTER_LOOPER = _IO('c', 12), | |
307 | BC_EXIT_LOOPER = _IO('c', 13), | |
308 | /* | |
309 | * No parameters. | |
310 | * These two commands are sent as an application-level thread | |
311 | * enters and exits the binder loop, respectively. They are | |
312 | * used so the binder can have an accurate count of the number | |
313 | * of looping threads it has available. | |
314 | */ | |
315 | ||
df24a2ea SC |
316 | BC_REQUEST_DEATH_NOTIFICATION = _IOW('c', 14, |
317 | struct binder_handle_cookie), | |
a3e9ddb7 | 318 | /* |
df24a2ea | 319 | * int: handle |
a3e9ddb7 CC |
320 | * void *: cookie |
321 | */ | |
322 | ||
df24a2ea SC |
323 | BC_CLEAR_DEATH_NOTIFICATION = _IOW('c', 15, |
324 | struct binder_handle_cookie), | |
a3e9ddb7 | 325 | /* |
df24a2ea | 326 | * int: handle |
a3e9ddb7 CC |
327 | * void *: cookie |
328 | */ | |
329 | ||
330 | BC_DEAD_BINDER_DONE = _IOW('c', 16, void *), | |
331 | /* | |
332 | * void *: cookie | |
333 | */ | |
334 | }; | |
335 | ||
336 | #endif /* _UAPI_LINUX_BINDER_H */ | |
337 |