[GitHub/exynos8895/android_kernel_samsung_universal8895.git] / include / uapi / linux / android / binder.h

/*
 * Copyright (C) 2008 Google, Inc.
 *
 * Based on, but no longer compatible with, the original
 * OpenBinder.org binder driver interface, which is:
 *
 * Copyright (c) 2005 Palmsource, Inc.
 *
 * This software is licensed under the terms of the GNU General Public
 * License version 2, as published by the Free Software Foundation, and
 * may be copied, distributed, and modified under those terms.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 */

#ifndef _UAPI_LINUX_BINDER_H
#define _UAPI_LINUX_BINDER_H

#include <linux/types.h>
#include <linux/ioctl.h>

#define B_PACK_CHARS(c1, c2, c3, c4) \
	((((c1)<<24)) | (((c2)<<16)) | (((c3)<<8)) | (c4))
#define B_TYPE_LARGE 0x85

enum {
	BINDER_TYPE_BINDER	= B_PACK_CHARS('s', 'b', '*', B_TYPE_LARGE),
	BINDER_TYPE_WEAK_BINDER	= B_PACK_CHARS('w', 'b', '*', B_TYPE_LARGE),
	BINDER_TYPE_HANDLE	= B_PACK_CHARS('s', 'h', '*', B_TYPE_LARGE),
	BINDER_TYPE_WEAK_HANDLE	= B_PACK_CHARS('w', 'h', '*', B_TYPE_LARGE),
	BINDER_TYPE_FD		= B_PACK_CHARS('f', 'd', '*', B_TYPE_LARGE),
	BINDER_TYPE_FDA		= B_PACK_CHARS('f', 'd', 'a', B_TYPE_LARGE),
	BINDER_TYPE_PTR		= B_PACK_CHARS('p', 't', '*', B_TYPE_LARGE),
};

/**
 * enum flat_binder_object_shifts: shift values for flat_binder_object_flags
 * @FLAT_BINDER_FLAG_SCHED_POLICY_SHIFT: shift for getting scheduler policy.
 *
 */
enum flat_binder_object_shifts {
	FLAT_BINDER_FLAG_SCHED_POLICY_SHIFT = 9,
};

/**
 * enum flat_binder_object_flags - flags for use in flat_binder_object.flags
 */
enum flat_binder_object_flags {
	/**
	 * @FLAT_BINDER_FLAG_PRIORITY_MASK: bit-mask for min scheduler priority
	 *
	 * These bits can be used to set the minimum scheduler priority
	 * at which transactions into this node should run. Valid values
	 * in these bits depend on the scheduler policy encoded in
	 * @FLAT_BINDER_FLAG_SCHED_POLICY_MASK.
	 *
	 * For SCHED_NORMAL/SCHED_BATCH, the valid range is between [-20..19]
	 * For SCHED_FIFO/SCHED_RR, the value can run between [1..99]
	 */
	FLAT_BINDER_FLAG_PRIORITY_MASK = 0xff,
	/**
	 * @FLAT_BINDER_FLAG_ACCEPTS_FDS: whether the node accepts fds.
	 */
	FLAT_BINDER_FLAG_ACCEPTS_FDS = 0x100,
	/**
	 * @FLAT_BINDER_FLAG_SCHED_POLICY_MASK: bit-mask for scheduling policy
	 *
	 * These two bits can be used to set the min scheduling policy at which
	 * transactions on this node should run. These match the UAPI
	 * scheduler policy values, eg:
	 * 00b: SCHED_NORMAL
	 * 01b: SCHED_FIFO
	 * 10b: SCHED_RR
	 * 11b: SCHED_BATCH
	 */
	FLAT_BINDER_FLAG_SCHED_POLICY_MASK =
		3U << FLAT_BINDER_FLAG_SCHED_POLICY_SHIFT,

	/**
	 * @FLAT_BINDER_FLAG_INHERIT_RT: whether the node inherits RT policy
	 *
	 * Only when set, calls into this node will inherit a real-time
	 * scheduling policy from the caller (for synchronous transactions).
	 */
	FLAT_BINDER_FLAG_INHERIT_RT = 0x800,
	/**
	 * @FLAT_BINDER_FLAG_TXN_SECURITY_CTX: request security contexts
	 *
	 * Only when set, causes senders to include their security
	 * context
	 */
	FLAT_BINDER_FLAG_TXN_SECURITY_CTX = 0x1000,
};

#ifdef BINDER_IPC_32BIT
typedef __u32 binder_size_t;
typedef __u32 binder_uintptr_t;
#else
typedef __u64 binder_size_t;
typedef __u64 binder_uintptr_t;
#endif

/**
 * struct binder_object_header - header shared by all binder metadata objects.
 * @type:	type of the object
 */
struct binder_object_header {
	__u32        type;
};

/*
 * This is the flattened representation of a Binder object for transfer
 * between processes.  The 'offsets' supplied as part of a binder transaction
 * contains offsets into the data where these structures occur.  The Binder
 * driver takes care of re-writing the structure type and data as it moves
 * between processes.
 */
struct flat_binder_object {
	struct binder_object_header	hdr;
	__u32				flags;

	/* 8 bytes of data. */
	union {
		binder_uintptr_t	binder;	/* local object */
		__u32			handle;	/* remote object */
	};

	/* extra data associated with local object */
	binder_uintptr_t	cookie;
};

/**
 * struct binder_fd_object - describes a filedescriptor to be fixed up.
 * @hdr:	common header structure
 * @pad_flags:	padding to remain compatible with old userspace code
 * @pad_binder:	padding to remain compatible with old userspace code
 * @fd:		file descriptor
 * @cookie:	opaque data, used by user-space
 */
struct binder_fd_object {
	struct binder_object_header	hdr;
	__u32				pad_flags;
	union {
		binder_uintptr_t	pad_binder;
		__u32			fd;
	};

	binder_uintptr_t		cookie;
};

/* struct binder_buffer_object - object describing a userspace buffer
 * @hdr:		common header structure
 * @flags:		one or more BINDER_BUFFER_* flags
 * @buffer:		address of the buffer
 * @length:		length of the buffer
 * @parent:		index in offset array pointing to parent buffer
 * @parent_offset:	offset in @parent pointing to this buffer
 *
 * A binder_buffer object represents an object that the
 * binder kernel driver can copy verbatim to the target
 * address space. A buffer itself may be pointed to from
 * within another buffer, meaning that the pointer inside
 * that other buffer needs to be fixed up as well. This
 * can be done by setting the BINDER_BUFFER_FLAG_HAS_PARENT
 * flag in @flags, by setting @parent buffer to the index
 * in the offset array pointing to the parent binder_buffer_object,
 * and by setting @parent_offset to the offset in the parent buffer
 * at which the pointer to this buffer is located.
 */
struct binder_buffer_object {
	struct binder_object_header	hdr;
	__u32				flags;
	binder_uintptr_t		buffer;
	binder_size_t			length;
	binder_size_t			parent;
	binder_size_t			parent_offset;
};

enum {
	BINDER_BUFFER_FLAG_HAS_PARENT = 0x01,
};

/* struct binder_fd_array_object - object describing an array of fds in a buffer
 * @hdr:		common header structure
 * @pad:		padding to ensure correct alignment
 * @num_fds:		number of file descriptors in the buffer
 * @parent:		index in offset array to buffer holding the fd array
 * @parent_offset:	start offset of fd array in the buffer
 *
 * A binder_fd_array object represents an array of file
 * descriptors embedded in a binder_buffer_object. It is
 * different from a regular binder_buffer_object because it
 * describes a list of file descriptors to fix up, not an opaque
 * blob of memory, and hence the kernel needs to treat it differently.
 *
 * An example of how this would be used is with Android's
 * native_handle_t object, which is a struct with a list of integers
 * and a list of file descriptors. The native_handle_t struct itself
 * will be represented by a struct binder_buffer_objct, whereas the
 * embedded list of file descriptors is represented by a
 * struct binder_fd_array_object with that binder_buffer_object as
 * a parent.
 */
struct binder_fd_array_object {
	struct binder_object_header	hdr;
	__u32				pad;
	binder_size_t			num_fds;
	binder_size_t			parent;
	binder_size_t			parent_offset;
};

/*
 * On 64-bit platforms where user code may run in 32-bits the driver must
 * translate the buffer (and local binder) addresses appropriately.
 */

struct binder_write_read {
	binder_size_t		write_size;	/* bytes to write */
	binder_size_t		write_consumed;	/* bytes consumed by driver */
	binder_uintptr_t	write_buffer;
	binder_size_t		read_size;	/* bytes to read */
	binder_size_t		read_consumed;	/* bytes consumed by driver */
	binder_uintptr_t	read_buffer;
};

/* Use with BINDER_VERSION, driver fills in fields. */
struct binder_version {
	/* driver protocol version -- increment with incompatible change */
	__s32       protocol_version;
};

/* This is the current protocol version. */
#ifdef BINDER_IPC_32BIT
#define BINDER_CURRENT_PROTOCOL_VERSION 7
#else
#define BINDER_CURRENT_PROTOCOL_VERSION 8
#endif

/*
 * Use with BINDER_GET_NODE_DEBUG_INFO, driver reads ptr, writes to all fields.
 * Set ptr to NULL for the first call to get the info for the first node, and
 * then repeat the call passing the previously returned value to get the next
 * nodes.  ptr will be 0 when there are no more nodes.
 */
struct binder_node_debug_info {
	binder_uintptr_t ptr;
	binder_uintptr_t cookie;
	__u32            has_strong_ref;
	__u32            has_weak_ref;
};

#define BINDER_WRITE_READ		_IOWR('b', 1, struct binder_write_read)
#define BINDER_SET_IDLE_TIMEOUT		_IOW('b', 3, __s64)
#define BINDER_SET_MAX_THREADS		_IOW('b', 5, __u32)
#define BINDER_SET_IDLE_PRIORITY	_IOW('b', 6, __s32)
#define BINDER_SET_CONTEXT_MGR		_IOW('b', 7, __s32)
#define BINDER_THREAD_EXIT		_IOW('b', 8, __s32)
#define BINDER_VERSION			_IOWR('b', 9, struct binder_version)
#define BINDER_GET_NODE_DEBUG_INFO	_IOWR('b', 11, struct binder_node_debug_info)
#define BINDER_SET_CONTEXT_MGR_EXT	_IOW('b', 13, struct flat_binder_object)
/*
 * NOTE: Two special error codes you should check for when calling
 * in to the driver are:
 *
 * EINTR -- The operation has been interupted.  This should be
 * handled by retrying the ioctl() until a different error code
 * is returned.
 *
 * ECONNREFUSED -- The driver is no longer accepting operations
 * from your process.  That is, the process is being destroyed.
 * You should handle this by exiting from your process.  Note
 * that once this error code is returned, all further calls to
 * the driver from any thread will return this same code.
 */

enum transaction_flags {
	TF_ONE_WAY	= 0x01,	/* this is a one-way call: async, no return */
	TF_ROOT_OBJECT	= 0x04,	/* contents are the component's root object */
	TF_STATUS_CODE	= 0x08,	/* contents are a 32-bit status code */
	TF_ACCEPT_FDS	= 0x10,	/* allow replies with file descriptors */
};

struct binder_transaction_data {
	/* The first two are only used for bcTRANSACTION and brTRANSACTION,
	 * identifying the target and contents of the transaction.
	 */
	union {
		/* target descriptor of command transaction */
		__u32	handle;
		/* target descriptor of return transaction */
		binder_uintptr_t ptr;
	} target;
	binder_uintptr_t	cookie;	/* target object cookie */
	__u32		code;		/* transaction command */

	/* General information about the transaction. */
	__u32	        flags;
	pid_t		sender_pid;
	uid_t		sender_euid;
	binder_size_t	data_size;	/* number of bytes of data */
	binder_size_t	offsets_size;	/* number of bytes of offsets */

	/* If this transaction is inline, the data immediately
	 * follows here; otherwise, it ends with a pointer to
	 * the data buffer.
	 */
	union {
		struct {
			/* transaction data */
			binder_uintptr_t	buffer;
			/* offsets from buffer to flat_binder_object structs */
			binder_uintptr_t	offsets;
		} ptr;
		__u8	buf[8];
	} data;
};
struct binder_transaction_data_secctx {
	struct binder_transaction_data transaction_data;
	binder_uintptr_t secctx;
};


struct binder_transaction_data_sg {
	struct binder_transaction_data transaction_data;
	binder_size_t buffers_size;
};

struct binder_ptr_cookie {
	binder_uintptr_t ptr;
	binder_uintptr_t cookie;
};

struct binder_handle_cookie {
	__u32 handle;
	binder_uintptr_t cookie;
} __packed;

struct binder_pri_desc {
	__s32 priority;
	__u32 desc;
};

struct binder_pri_ptr_cookie {
	__s32 priority;
	binder_uintptr_t ptr;
	binder_uintptr_t cookie;
};

enum binder_driver_return_protocol {
	BR_ERROR = _IOR('r', 0, __s32),
	/*
	 * int: error code
	 */

	BR_OK = _IO('r', 1),
	/* No parameters! */
	BR_TRANSACTION_SEC_CTX = _IOR('r', 2,
				      struct binder_transaction_data_secctx),
	/*
	 * binder_transaction_data_secctx: the received command.
	 */
	BR_TRANSACTION = _IOR('r', 2, struct binder_transaction_data),
	BR_REPLY = _IOR('r', 3, struct binder_transaction_data),
	/*
	 * binder_transaction_data: the received command.
	 */

	BR_ACQUIRE_RESULT = _IOR('r', 4, __s32),
	/*
	 * not currently supported
	 * int: 0 if the last bcATTEMPT_ACQUIRE was not successful.
	 * Else the remote object has acquired a primary reference.
	 */

	BR_DEAD_REPLY = _IO('r', 5),
	/*
	 * The target of the last transaction (either a bcTRANSACTION or
	 * a bcATTEMPT_ACQUIRE) is no longer with us.  No parameters.
	 */

	BR_TRANSACTION_COMPLETE = _IO('r', 6),
	/*
	 * No parameters... always refers to the last transaction requested
	 * (including replies).  Note that this will be sent even for
	 * asynchronous transactions.
	 */

	BR_INCREFS = _IOR('r', 7, struct binder_ptr_cookie),
	BR_ACQUIRE = _IOR('r', 8, struct binder_ptr_cookie),
	BR_RELEASE = _IOR('r', 9, struct binder_ptr_cookie),
	BR_DECREFS = _IOR('r', 10, struct binder_ptr_cookie),
	/*
	 * void *:	ptr to binder
	 * void *: cookie for binder
	 */

	BR_ATTEMPT_ACQUIRE = _IOR('r', 11, struct binder_pri_ptr_cookie),
	/*
	 * not currently supported
	 * int:	priority
	 * void *: ptr to binder
	 * void *: cookie for binder
	 */

	BR_NOOP = _IO('r', 12),
	/*
	 * No parameters.  Do nothing and examine the next command.  It exists
	 * primarily so that we can replace it with a BR_SPAWN_LOOPER command.
	 */

	BR_SPAWN_LOOPER = _IO('r', 13),
	/*
	 * No parameters.  The driver has determined that a process has no
	 * threads waiting to service incoming transactions.  When a process
	 * receives this command, it must spawn a new service thread and
	 * register it via bcENTER_LOOPER.
	 */

	BR_FINISHED = _IO('r', 14),
	/*
	 * not currently supported
	 * stop threadpool thread
	 */

	BR_DEAD_BINDER = _IOR('r', 15, binder_uintptr_t),
	/*
	 * void *: cookie
	 */
	BR_CLEAR_DEATH_NOTIFICATION_DONE = _IOR('r', 16, binder_uintptr_t),
	/*
	 * void *: cookie
	 */

	BR_FAILED_REPLY = _IO('r', 17),
	/*
	 * The the last transaction (either a bcTRANSACTION or
	 * a bcATTEMPT_ACQUIRE) failed (e.g. out of memory).  No parameters.
	 */
};

enum binder_driver_command_protocol {
	BC_TRANSACTION = _IOW('c', 0, struct binder_transaction_data),
	BC_REPLY = _IOW('c', 1, struct binder_transaction_data),
	/*
	 * binder_transaction_data: the sent command.
	 */

	BC_ACQUIRE_RESULT = _IOW('c', 2, __s32),
	/*
	 * not currently supported
	 * int:  0 if the last BR_ATTEMPT_ACQUIRE was not successful.
	 * Else you have acquired a primary reference on the object.
	 */

	BC_FREE_BUFFER = _IOW('c', 3, binder_uintptr_t),
	/*
	 * void *: ptr to transaction data received on a read
	 */

	BC_INCREFS = _IOW('c', 4, __u32),
	BC_ACQUIRE = _IOW('c', 5, __u32),
	BC_RELEASE = _IOW('c', 6, __u32),
	BC_DECREFS = _IOW('c', 7, __u32),
	/*
	 * int:	descriptor
	 */

	BC_INCREFS_DONE = _IOW('c', 8, struct binder_ptr_cookie),
	BC_ACQUIRE_DONE = _IOW('c', 9, struct binder_ptr_cookie),
	/*
	 * void *: ptr to binder
	 * void *: cookie for binder
	 */

	BC_ATTEMPT_ACQUIRE = _IOW('c', 10, struct binder_pri_desc),
	/*
	 * not currently supported
	 * int: priority
	 * int: descriptor
	 */

	BC_REGISTER_LOOPER = _IO('c', 11),
	/*
	 * No parameters.
	 * Register a spawned looper thread with the device.
	 */

	BC_ENTER_LOOPER = _IO('c', 12),
	BC_EXIT_LOOPER = _IO('c', 13),
	/*
	 * No parameters.
	 * These two commands are sent as an application-level thread
	 * enters and exits the binder loop, respectively.  They are
	 * used so the binder can have an accurate count of the number
	 * of looping threads it has available.
	 */

	BC_REQUEST_DEATH_NOTIFICATION = _IOW('c', 14,
						struct binder_handle_cookie),
	/*
	 * int: handle
	 * void *: cookie
	 */

	BC_CLEAR_DEATH_NOTIFICATION = _IOW('c', 15,
						struct binder_handle_cookie),
	/*
	 * int: handle
	 * void *: cookie
	 */

	BC_DEAD_BINDER_DONE = _IOW('c', 16, binder_uintptr_t),
	/*
	 * void *: cookie
	 */

	BC_TRANSACTION_SG = _IOW('c', 17, struct binder_transaction_data_sg),
	BC_REPLY_SG = _IOW('c', 18, struct binder_transaction_data_sg),
	/*
	 * binder_transaction_data_sg: the sent command.
	 */
};

#endif /* _UAPI_LINUX_BINDER_H */
Commit	Line	Data
a3e9ddb7 CC	1	/*
	2	* Copyright (C) 2008 Google, Inc.
	3	*
	4	* Based on, but no longer compatible with, the original
	5	* OpenBinder.org binder driver interface, which is:
	6	*
	7	* Copyright (c) 2005 Palmsource, Inc.
	8	*
	9	* This software is licensed under the terms of the GNU General Public
	10	* License version 2, as published by the Free Software Foundation, and
	11	* may be copied, distributed, and modified under those terms.
	12	*
	13	* This program is distributed in the hope that it will be useful,
	14	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	15	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	16	* GNU General Public License for more details.
	17	*
	18	*/
	19
	20	#ifndef _UAPI_LINUX_BINDER_H
	21	#define _UAPI_LINUX_BINDER_H
	22
bc2d62a0	23	#include <linux/types.h>
a3e9ddb7 CC	24	#include <linux/ioctl.h>
	25
	26	#define B_PACK_CHARS(c1, c2, c3, c4) \
	27	((((c1)<<24)) \| (((c2)<<16)) \| (((c3)<<8)) \| (c4))
	28	#define B_TYPE_LARGE 0x85
	29
	30	enum {
	31	BINDER_TYPE_BINDER = B_PACK_CHARS('s', 'b', '*', B_TYPE_LARGE),
	32	BINDER_TYPE_WEAK_BINDER = B_PACK_CHARS('w', 'b', '*', B_TYPE_LARGE),
	33	BINDER_TYPE_HANDLE = B_PACK_CHARS('s', 'h', '*', B_TYPE_LARGE),
	34	BINDER_TYPE_WEAK_HANDLE = B_PACK_CHARS('w', 'h', '*', B_TYPE_LARGE),
	35	BINDER_TYPE_FD = B_PACK_CHARS('f', 'd', '*', B_TYPE_LARGE),
e124de38	36	BINDER_TYPE_FDA = B_PACK_CHARS('f', 'd', 'a', B_TYPE_LARGE),
dd9bc4f9	37	BINDER_TYPE_PTR = B_PACK_CHARS('p', 't', '*', B_TYPE_LARGE),
a3e9ddb7 CC	38	};
a3e9ddb7 CC	39
adb68543 MC	40	/**
	41	* enum flat_binder_object_shifts: shift values for flat_binder_object_flags
	42	* @FLAT_BINDER_FLAG_SCHED_POLICY_SHIFT: shift for getting scheduler policy.
	43	*
	44	*/
	45	enum flat_binder_object_shifts {
	46	FLAT_BINDER_FLAG_SCHED_POLICY_SHIFT = 9,
	47	};
	48
	49	/**
	50	* enum flat_binder_object_flags - flags for use in flat_binder_object.flags
	51	*/
	52	enum flat_binder_object_flags {
	53	/**
	54	* @FLAT_BINDER_FLAG_PRIORITY_MASK: bit-mask for min scheduler priority
	55	*
	56	* These bits can be used to set the minimum scheduler priority
	57	* at which transactions into this node should run. Valid values
	58	* in these bits depend on the scheduler policy encoded in
	59	* @FLAT_BINDER_FLAG_SCHED_POLICY_MASK.
	60	*
	61	* For SCHED_NORMAL/SCHED_BATCH, the valid range is between [-20..19]
	62	* For SCHED_FIFO/SCHED_RR, the value can run between [1..99]
	63	*/
a3e9ddb7	64	FLAT_BINDER_FLAG_PRIORITY_MASK = 0xff,
adb68543 MC	65	/**
	66	* @FLAT_BINDER_FLAG_ACCEPTS_FDS: whether the node accepts fds.
	67	*/
a3e9ddb7	68	FLAT_BINDER_FLAG_ACCEPTS_FDS = 0x100,
adb68543 MC	69	/**
	70	* @FLAT_BINDER_FLAG_SCHED_POLICY_MASK: bit-mask for scheduling policy
	71	*
	72	* These two bits can be used to set the min scheduling policy at which
	73	* transactions on this node should run. These match the UAPI
	74	* scheduler policy values, eg:
	75	* 00b: SCHED_NORMAL
	76	* 01b: SCHED_FIFO
	77	* 10b: SCHED_RR
	78	* 11b: SCHED_BATCH
	79	*/
	80	FLAT_BINDER_FLAG_SCHED_POLICY_MASK =
	81	3U << FLAT_BINDER_FLAG_SCHED_POLICY_SHIFT,
39140a0f MC	82
	83	/**
	84	* @FLAT_BINDER_FLAG_INHERIT_RT: whether the node inherits RT policy
	85	*
	86	* Only when set, calls into this node will inherit a real-time
	87	* scheduling policy from the caller (for synchronous transactions).
	88	*/
	89	FLAT_BINDER_FLAG_INHERIT_RT = 0x800,
1cac41cb MB	90	/**
	91	* @FLAT_BINDER_FLAG_TXN_SECURITY_CTX: request security contexts
	92	*
	93	* Only when set, causes senders to include their security
	94	* context
	95	*/
	96	FLAT_BINDER_FLAG_TXN_SECURITY_CTX = 0x1000,
a3e9ddb7 CC	97	};
a3e9ddb7 CC	98
da49889d AH	99	#ifdef BINDER_IPC_32BIT
	100	typedef __u32 binder_size_t;
	101	typedef __u32 binder_uintptr_t;
	102	#else
	103	typedef __u64 binder_size_t;
	104	typedef __u64 binder_uintptr_t;
	105	#endif
	106
ce0c6598 MC	107	/**
	108	* struct binder_object_header - header shared by all binder metadata objects.
	109	* @type: type of the object
	110	*/
	111	struct binder_object_header {
	112	__u32 type;
	113	};
	114
a3e9ddb7 CC	115	/*
	116	* This is the flattened representation of a Binder object for transfer
	117	* between processes. The 'offsets' supplied as part of a binder transaction
	118	* contains offsets into the data where these structures occur. The Binder
	119	* driver takes care of re-writing the structure type and data as it moves
	120	* between processes.
	121	*/
	122	struct flat_binder_object {
ce0c6598 MC	123	struct binder_object_header hdr;
ce0c6598 MC	124	__u32 flags;
a3e9ddb7 CC	125
	126	/* 8 bytes of data. */
	127	union {
da49889d AH	128	binder_uintptr_t binder; /* local object */
da49889d AH	129	__u32 handle; /* remote object */
a3e9ddb7 CC	130	};
	131
	132	/* extra data associated with local object */
da49889d	133	binder_uintptr_t cookie;
a3e9ddb7 CC	134	};
a3e9ddb7 CC	135
ce0c6598 MC	136	/**
	137	* struct binder_fd_object - describes a filedescriptor to be fixed up.
	138	* @hdr: common header structure
	139	* @pad_flags: padding to remain compatible with old userspace code
	140	* @pad_binder: padding to remain compatible with old userspace code
	141	* @fd: file descriptor
	142	* @cookie: opaque data, used by user-space
	143	*/
	144	struct binder_fd_object {
	145	struct binder_object_header hdr;
	146	__u32 pad_flags;
	147	union {
	148	binder_uintptr_t pad_binder;
	149	__u32 fd;
	150	};
	151
	152	binder_uintptr_t cookie;
	153	};
dd9bc4f9 MC	154
	155	/* struct binder_buffer_object - object describing a userspace buffer
	156	* @hdr: common header structure
	157	* @flags: one or more BINDER_BUFFER_* flags
	158	* @buffer: address of the buffer
	159	* @length: length of the buffer
	160	* @parent: index in offset array pointing to parent buffer
	161	* @parent_offset: offset in @parent pointing to this buffer
	162	*
	163	* A binder_buffer object represents an object that the
	164	* binder kernel driver can copy verbatim to the target
	165	* address space. A buffer itself may be pointed to from
	166	* within another buffer, meaning that the pointer inside
	167	* that other buffer needs to be fixed up as well. This
	168	* can be done by setting the BINDER_BUFFER_FLAG_HAS_PARENT
	169	* flag in @flags, by setting @parent buffer to the index
	170	* in the offset array pointing to the parent binder_buffer_object,
	171	* and by setting @parent_offset to the offset in the parent buffer
	172	* at which the pointer to this buffer is located.
	173	*/
	174	struct binder_buffer_object {
	175	struct binder_object_header hdr;
	176	__u32 flags;
	177	binder_uintptr_t buffer;
	178	binder_size_t length;
	179	binder_size_t parent;
	180	binder_size_t parent_offset;
	181	};
	182
	183	enum {
	184	BINDER_BUFFER_FLAG_HAS_PARENT = 0x01,
	185	};
	186
e124de38 MC	187	/* struct binder_fd_array_object - object describing an array of fds in a buffer
e124de38 MC	188	* @hdr: common header structure
0fd0992d	189	* @pad: padding to ensure correct alignment
e124de38 MC	190	* @num_fds: number of file descriptors in the buffer
	191	* @parent: index in offset array to buffer holding the fd array
	192	* @parent_offset: start offset of fd array in the buffer
	193	*
	194	* A binder_fd_array object represents an array of file
	195	* descriptors embedded in a binder_buffer_object. It is
	196	* different from a regular binder_buffer_object because it
	197	* describes a list of file descriptors to fix up, not an opaque
	198	* blob of memory, and hence the kernel needs to treat it differently.
	199	*
	200	* An example of how this would be used is with Android's
	201	* native_handle_t object, which is a struct with a list of integers
	202	* and a list of file descriptors. The native_handle_t struct itself
	203	* will be represented by a struct binder_buffer_objct, whereas the
	204	* embedded list of file descriptors is represented by a
	205	* struct binder_fd_array_object with that binder_buffer_object as
	206	* a parent.
	207	*/
	208	struct binder_fd_array_object {
	209	struct binder_object_header hdr;
0fd0992d	210	__u32 pad;
e124de38 MC	211	binder_size_t num_fds;
	212	binder_size_t parent;
	213	binder_size_t parent_offset;
	214	};
	215
a3e9ddb7 CC	216	/*
	217	* On 64-bit platforms where user code may run in 32-bits the driver must
	218	* translate the buffer (and local binder) addresses appropriately.
	219	*/
	220
	221	struct binder_write_read {
da49889d AH	222	binder_size_t write_size; /* bytes to write */
	223	binder_size_t write_consumed; /* bytes consumed by driver */
	224	binder_uintptr_t write_buffer;
	225	binder_size_t read_size; /* bytes to read */
	226	binder_size_t read_consumed; /* bytes consumed by driver */
	227	binder_uintptr_t read_buffer;
a3e9ddb7 CC	228	};
	229
	230	/* Use with BINDER_VERSION, driver fills in fields. */
	231	struct binder_version {
	232	/* driver protocol version -- increment with incompatible change */
	233	__s32 protocol_version;
	234	};
	235
	236	/* This is the current protocol version. */
da49889d	237	#ifdef BINDER_IPC_32BIT
a3e9ddb7	238	#define BINDER_CURRENT_PROTOCOL_VERSION 7
da49889d AH	239	#else
	240	#define BINDER_CURRENT_PROTOCOL_VERSION 8
	241	#endif
a3e9ddb7	242
89ce9d97 CC	243	/*
	244	* Use with BINDER_GET_NODE_DEBUG_INFO, driver reads ptr, writes to all fields.
	245	* Set ptr to NULL for the first call to get the info for the first node, and
	246	* then repeat the call passing the previously returned value to get the next
	247	* nodes. ptr will be 0 when there are no more nodes.
	248	*/
	249	struct binder_node_debug_info {
	250	binder_uintptr_t ptr;
	251	binder_uintptr_t cookie;
	252	__u32 has_strong_ref;
	253	__u32 has_weak_ref;
	254	};
	255
a3e9ddb7 CC	256	#define BINDER_WRITE_READ _IOWR('b', 1, struct binder_write_read)
	257	#define BINDER_SET_IDLE_TIMEOUT _IOW('b', 3, __s64)
	258	#define BINDER_SET_MAX_THREADS _IOW('b', 5, __u32)
	259	#define BINDER_SET_IDLE_PRIORITY _IOW('b', 6, __s32)
	260	#define BINDER_SET_CONTEXT_MGR _IOW('b', 7, __s32)
	261	#define BINDER_THREAD_EXIT _IOW('b', 8, __s32)
	262	#define BINDER_VERSION _IOWR('b', 9, struct binder_version)
89ce9d97	263	#define BINDER_GET_NODE_DEBUG_INFO _IOWR('b', 11, struct binder_node_debug_info)
1cac41cb	264	#define BINDER_SET_CONTEXT_MGR_EXT _IOW('b', 13, struct flat_binder_object)
a3e9ddb7 CC	265	/*
	266	* NOTE: Two special error codes you should check for when calling
	267	* in to the driver are:
	268	*
	269	* EINTR -- The operation has been interupted. This should be
	270	* handled by retrying the ioctl() until a different error code
	271	* is returned.
	272	*
	273	* ECONNREFUSED -- The driver is no longer accepting operations
	274	* from your process. That is, the process is being destroyed.
	275	* You should handle this by exiting from your process. Note
	276	* that once this error code is returned, all further calls to
	277	* the driver from any thread will return this same code.
	278	*/
	279
	280	enum transaction_flags {
	281	TF_ONE_WAY = 0x01, /* this is a one-way call: async, no return */
	282	TF_ROOT_OBJECT = 0x04, /* contents are the component's root object */
	283	TF_STATUS_CODE = 0x08, /* contents are a 32-bit status code */
	284	TF_ACCEPT_FDS = 0x10, /* allow replies with file descriptors */
	285	};
	286
	287	struct binder_transaction_data {
	288	/* The first two are only used for bcTRANSACTION and brTRANSACTION,
	289	* identifying the target and contents of the transaction.
	290	*/
	291	union {
da49889d AH	292	/* target descriptor of command transaction */
	293	__u32 handle;
	294	/* target descriptor of return transaction */
	295	binder_uintptr_t ptr;
a3e9ddb7	296	} target;
da49889d	297	binder_uintptr_t cookie; /* target object cookie */
a3e9ddb7 CC	298	__u32 code; /* transaction command */
	299
	300	/* General information about the transaction. */
	301	__u32 flags;
	302	pid_t sender_pid;
	303	uid_t sender_euid;
da49889d AH	304	binder_size_t data_size; /* number of bytes of data */
da49889d AH	305	binder_size_t offsets_size; /* number of bytes of offsets */
a3e9ddb7 CC	306
	307	/* If this transaction is inline, the data immediately
	308	* follows here; otherwise, it ends with a pointer to
	309	* the data buffer.
	310	*/
	311	union {
	312	struct {
	313	/* transaction data */
da49889d	314	binder_uintptr_t buffer;
a3e9ddb7	315	/* offsets from buffer to flat_binder_object structs */
da49889d	316	binder_uintptr_t offsets;
a3e9ddb7 CC	317	} ptr;
	318	__u8 buf[8];
	319	} data;
	320	};
1cac41cb MB	321	struct binder_transaction_data_secctx {
	322	struct binder_transaction_data transaction_data;
	323	binder_uintptr_t secctx;
	324	};
	325
a3e9ddb7	326
dd9bc4f9 MC	327	struct binder_transaction_data_sg {
	328	struct binder_transaction_data transaction_data;
	329	binder_size_t buffers_size;
	330	};
	331
a3e9ddb7	332	struct binder_ptr_cookie {
da49889d AH	333	binder_uintptr_t ptr;
da49889d AH	334	binder_uintptr_t cookie;
a3e9ddb7 CC	335	};
a3e9ddb7 CC	336
df24a2ea SC	337	struct binder_handle_cookie {
df24a2ea SC	338	__u32 handle;
da49889d	339	binder_uintptr_t cookie;
2fd2914a	340	} __packed;
df24a2ea	341
a3e9ddb7 CC	342	struct binder_pri_desc {
	343	__s32 priority;
	344	__u32 desc;
	345	};
	346
	347	struct binder_pri_ptr_cookie {
	348	__s32 priority;
da49889d AH	349	binder_uintptr_t ptr;
da49889d AH	350	binder_uintptr_t cookie;
a3e9ddb7 CC	351	};
	352
	353	enum binder_driver_return_protocol {
	354	BR_ERROR = _IOR('r', 0, __s32),
	355	/*
	356	* int: error code
	357	*/
	358
	359	BR_OK = _IO('r', 1),
	360	/* No parameters! */
1cac41cb MB	361	BR_TRANSACTION_SEC_CTX = _IOR('r', 2,
	362	struct binder_transaction_data_secctx),
	363	/*
	364	* binder_transaction_data_secctx: the received command.
	365	*/
a3e9ddb7 CC	366	BR_TRANSACTION = _IOR('r', 2, struct binder_transaction_data),
	367	BR_REPLY = _IOR('r', 3, struct binder_transaction_data),
	368	/*
	369	* binder_transaction_data: the received command.
	370	*/
	371
	372	BR_ACQUIRE_RESULT = _IOR('r', 4, __s32),
	373	/*
	374	* not currently supported
	375	* int: 0 if the last bcATTEMPT_ACQUIRE was not successful.
	376	* Else the remote object has acquired a primary reference.
	377	*/
	378
	379	BR_DEAD_REPLY = _IO('r', 5),
	380	/*
	381	* The target of the last transaction (either a bcTRANSACTION or
	382	* a bcATTEMPT_ACQUIRE) is no longer with us. No parameters.
	383	*/
	384
	385	BR_TRANSACTION_COMPLETE = _IO('r', 6),
	386	/*
	387	* No parameters... always refers to the last transaction requested
	388	* (including replies). Note that this will be sent even for
	389	* asynchronous transactions.
	390	*/
	391
	392	BR_INCREFS = _IOR('r', 7, struct binder_ptr_cookie),
	393	BR_ACQUIRE = _IOR('r', 8, struct binder_ptr_cookie),
	394	BR_RELEASE = _IOR('r', 9, struct binder_ptr_cookie),
	395	BR_DECREFS = _IOR('r', 10, struct binder_ptr_cookie),
	396	/*
	397	* void *: ptr to binder
	398	* void *: cookie for binder
	399	*/
	400
	401	BR_ATTEMPT_ACQUIRE = _IOR('r', 11, struct binder_pri_ptr_cookie),
	402	/*
	403	* not currently supported
	404	* int: priority
	405	* void *: ptr to binder
	406	* void *: cookie for binder
	407	*/
	408
	409	BR_NOOP = _IO('r', 12),
	410	/*
	411	* No parameters. Do nothing and examine the next command. It exists
	412	* primarily so that we can replace it with a BR_SPAWN_LOOPER command.
	413	*/
	414
	415	BR_SPAWN_LOOPER = _IO('r', 13),
	416	/*
	417	* No parameters. The driver has determined that a process has no
	418	* threads waiting to service incoming transactions. When a process
	419	* receives this command, it must spawn a new service thread and
	420	* register it via bcENTER_LOOPER.
	421	*/
	422
	423	BR_FINISHED = _IO('r', 14),
	424	/*
	425	* not currently supported
	426	* stop threadpool thread
	427	*/
	428
da49889d	429	BR_DEAD_BINDER = _IOR('r', 15, binder_uintptr_t),
a3e9ddb7 CC	430	/*
	431	* void *: cookie
	432	*/
da49889d	433	BR_CLEAR_DEATH_NOTIFICATION_DONE = _IOR('r', 16, binder_uintptr_t),
a3e9ddb7 CC	434	/*
	435	* void *: cookie
	436	*/
	437
	438	BR_FAILED_REPLY = _IO('r', 17),
	439	/*
	440	* The the last transaction (either a bcTRANSACTION or
	441	* a bcATTEMPT_ACQUIRE) failed (e.g. out of memory). No parameters.
	442	*/
	443	};
	444
	445	enum binder_driver_command_protocol {
	446	BC_TRANSACTION = _IOW('c', 0, struct binder_transaction_data),
	447	BC_REPLY = _IOW('c', 1, struct binder_transaction_data),
	448	/*
	449	* binder_transaction_data: the sent command.
	450	*/
	451
	452	BC_ACQUIRE_RESULT = _IOW('c', 2, __s32),
	453	/*
	454	* not currently supported
	455	* int: 0 if the last BR_ATTEMPT_ACQUIRE was not successful.
	456	* Else you have acquired a primary reference on the object.
	457	*/
	458
da49889d	459	BC_FREE_BUFFER = _IOW('c', 3, binder_uintptr_t),
a3e9ddb7 CC	460	/*
	461	* void *: ptr to transaction data received on a read
	462	*/
	463
	464	BC_INCREFS = _IOW('c', 4, __u32),
	465	BC_ACQUIRE = _IOW('c', 5, __u32),
	466	BC_RELEASE = _IOW('c', 6, __u32),
	467	BC_DECREFS = _IOW('c', 7, __u32),
	468	/*
	469	* int: descriptor
	470	*/
	471
	472	BC_INCREFS_DONE = _IOW('c', 8, struct binder_ptr_cookie),
	473	BC_ACQUIRE_DONE = _IOW('c', 9, struct binder_ptr_cookie),
	474	/*
	475	* void *: ptr to binder
	476	* void *: cookie for binder
	477	*/
	478
	479	BC_ATTEMPT_ACQUIRE = _IOW('c', 10, struct binder_pri_desc),
	480	/*
	481	* not currently supported
	482	* int: priority
	483	* int: descriptor
	484	*/
	485
	486	BC_REGISTER_LOOPER = _IO('c', 11),
	487	/*
	488	* No parameters.
	489	* Register a spawned looper thread with the device.
	490	*/
	491
	492	BC_ENTER_LOOPER = _IO('c', 12),
	493	BC_EXIT_LOOPER = _IO('c', 13),
	494	/*
	495	* No parameters.
	496	* These two commands are sent as an application-level thread
	497	* enters and exits the binder loop, respectively. They are
	498	* used so the binder can have an accurate count of the number
	499	* of looping threads it has available.
	500	*/
	501
df24a2ea SC	502	BC_REQUEST_DEATH_NOTIFICATION = _IOW('c', 14,
df24a2ea SC	503	struct binder_handle_cookie),
a3e9ddb7	504	/*
df24a2ea	505	* int: handle
a3e9ddb7 CC	506	* void *: cookie
	507	*/
	508
df24a2ea SC	509	BC_CLEAR_DEATH_NOTIFICATION = _IOW('c', 15,
df24a2ea SC	510	struct binder_handle_cookie),
a3e9ddb7	511	/*
df24a2ea	512	* int: handle
a3e9ddb7 CC	513	* void *: cookie
	514	*/
	515
da49889d	516	BC_DEAD_BINDER_DONE = _IOW('c', 16, binder_uintptr_t),
a3e9ddb7 CC	517	/*
	518	* void *: cookie
	519	*/
dd9bc4f9 MC	520
	521	BC_TRANSACTION_SG = _IOW('c', 17, struct binder_transaction_data_sg),
	522	BC_REPLY_SG = _IOW('c', 18, struct binder_transaction_data_sg),
	523	/*
	524	* binder_transaction_data_sg: the sent command.
	525	*/
a3e9ddb7 CC	526	};
	527
	528	#endif /* _UAPI_LINUX_BINDER_H */
	529