[GitHub/LineageOS/android_kernel_samsung_universal7580.git] / include / uapi / linux / android / binder.h

/*
 * Copyright (C) 2008 Google, Inc.
 *
 * Based on, but no longer compatible with, the original
 * OpenBinder.org binder driver interface, which is:
 *
 * Copyright (c) 2005 Palmsource, Inc.
 *
 * This software is licensed under the terms of the GNU General Public
 * License version 2, as published by the Free Software Foundation, and
 * may be copied, distributed, and modified under those terms.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 */

#ifndef _UAPI_LINUX_BINDER_H
#define _UAPI_LINUX_BINDER_H

#include <linux/ioctl.h>

#define B_PACK_CHARS(c1, c2, c3, c4) \
	((((c1)<<24)) | (((c2)<<16)) | (((c3)<<8)) | (c4))
#define B_TYPE_LARGE 0x85

enum {
	BINDER_TYPE_BINDER	= B_PACK_CHARS('s', 'b', '*', B_TYPE_LARGE),
	BINDER_TYPE_WEAK_BINDER	= B_PACK_CHARS('w', 'b', '*', B_TYPE_LARGE),
	BINDER_TYPE_HANDLE	= B_PACK_CHARS('s', 'h', '*', B_TYPE_LARGE),
	BINDER_TYPE_WEAK_HANDLE	= B_PACK_CHARS('w', 'h', '*', B_TYPE_LARGE),
	BINDER_TYPE_FD		= B_PACK_CHARS('f', 'd', '*', B_TYPE_LARGE),
	BINDER_TYPE_FDA		= B_PACK_CHARS('f', 'd', 'a', B_TYPE_LARGE),
	BINDER_TYPE_PTR		= B_PACK_CHARS('p', 't', '*', B_TYPE_LARGE),
};

/**
 * enum flat_binder_object_shifts: shift values for flat_binder_object_flags
 * @FLAT_BINDER_FLAG_SCHED_POLICY_SHIFT: shift for getting scheduler policy.
 *
 */
enum flat_binder_object_shifts {
	FLAT_BINDER_FLAG_SCHED_POLICY_SHIFT = 9,
};

/**
 * enum flat_binder_object_flags - flags for use in flat_binder_object.flags
 */
enum flat_binder_object_flags {
	/**
	 * @FLAT_BINDER_FLAG_PRIORITY_MASK: bit-mask for min scheduler priority
	 *
	 * These bits can be used to set the minimum scheduler priority
	 * at which transactions into this node should run. Valid values
	 * in these bits depend on the scheduler policy encoded in
	 * @FLAT_BINDER_FLAG_SCHED_POLICY_MASK.
	 *
	 * For SCHED_NORMAL/SCHED_BATCH, the valid range is between [-20..19]
	 * For SCHED_FIFO/SCHED_RR, the value can run between [1..99]
	 */
	FLAT_BINDER_FLAG_PRIORITY_MASK = 0xff,
	/**
	 * @FLAT_BINDER_FLAG_ACCEPTS_FDS: whether the node accepts fds.
	 */
	FLAT_BINDER_FLAG_ACCEPTS_FDS = 0x100,
	/**
	 * @FLAT_BINDER_FLAG_SCHED_POLICY_MASK: bit-mask for scheduling policy
	 *
	 * These two bits can be used to set the min scheduling policy at which
	 * transactions on this node should run. These match the UAPI
	 * scheduler policy values, eg:
	 * 00b: SCHED_NORMAL
	 * 01b: SCHED_FIFO
	 * 10b: SCHED_RR
	 * 11b: SCHED_BATCH
	 */
	FLAT_BINDER_FLAG_SCHED_POLICY_MASK =
		3U << FLAT_BINDER_FLAG_SCHED_POLICY_SHIFT,

	/**
	 * @FLAT_BINDER_FLAG_INHERIT_RT: whether the node inherits RT policy
	 *
	 * Only when set, calls into this node will inherit a real-time
	 * scheduling policy from the caller (for synchronous transactions).
	 */
	FLAT_BINDER_FLAG_INHERIT_RT = 0x800,
};

#ifdef BINDER_IPC_32BIT
typedef __u32 binder_size_t;
typedef __u32 binder_uintptr_t;
#else
typedef __u64 binder_size_t;
typedef __u64 binder_uintptr_t;
#endif

/**
 * struct binder_object_header - header shared by all binder metadata objects.
 * @type:	type of the object
 */
struct binder_object_header {
	__u32        type;
};

/*
 * This is the flattened representation of a Binder object for transfer
 * between processes.  The 'offsets' supplied as part of a binder transaction
 * contains offsets into the data where these structures occur.  The Binder
 * driver takes care of re-writing the structure type and data as it moves
 * between processes.
 */
struct flat_binder_object {
	struct binder_object_header	hdr;
	__u32				flags;

	/* 8 bytes of data. */
	union {
		binder_uintptr_t	binder;	/* local object */
		__u32			handle;	/* remote object */
	};

	/* extra data associated with local object */
	binder_uintptr_t	cookie;
};

/**
 * struct binder_fd_object - describes a filedescriptor to be fixed up.
 * @hdr:	common header structure
 * @pad_flags:	padding to remain compatible with old userspace code
 * @pad_binder:	padding to remain compatible with old userspace code
 * @fd:		file descriptor
 * @cookie:	opaque data, used by user-space
 */
struct binder_fd_object {
	struct binder_object_header	hdr;
	__u32				pad_flags;
	union {
		binder_uintptr_t	pad_binder;
		__u32			fd;
	};

	binder_uintptr_t		cookie;
};

/* struct binder_buffer_object - object describing a userspace buffer
 * @hdr:		common header structure
 * @flags:		one or more BINDER_BUFFER_* flags
 * @buffer:		address of the buffer
 * @length:		length of the buffer
 * @parent:		index in offset array pointing to parent buffer
 * @parent_offset:	offset in @parent pointing to this buffer
 *
 * A binder_buffer object represents an object that the
 * binder kernel driver can copy verbatim to the target
 * address space. A buffer itself may be pointed to from
 * within another buffer, meaning that the pointer inside
 * that other buffer needs to be fixed up as well. This
 * can be done by setting the BINDER_BUFFER_FLAG_HAS_PARENT
 * flag in @flags, by setting @parent buffer to the index
 * in the offset array pointing to the parent binder_buffer_object,
 * and by setting @parent_offset to the offset in the parent buffer
 * at which the pointer to this buffer is located.
 */
struct binder_buffer_object {
	struct binder_object_header	hdr;
	__u32				flags;
	binder_uintptr_t		buffer;
	binder_size_t			length;
	binder_size_t			parent;
	binder_size_t			parent_offset;
};

enum {
	BINDER_BUFFER_FLAG_HAS_PARENT = 0x01,
};

/* struct binder_fd_array_object - object describing an array of fds in a buffer
 * @hdr:		common header structure
 * @num_fds:		number of file descriptors in the buffer
 * @parent:		index in offset array to buffer holding the fd array
 * @parent_offset:	start offset of fd array in the buffer
 *
 * A binder_fd_array object represents an array of file
 * descriptors embedded in a binder_buffer_object. It is
 * different from a regular binder_buffer_object because it
 * describes a list of file descriptors to fix up, not an opaque
 * blob of memory, and hence the kernel needs to treat it differently.
 *
 * An example of how this would be used is with Android's
 * native_handle_t object, which is a struct with a list of integers
 * and a list of file descriptors. The native_handle_t struct itself
 * will be represented by a struct binder_buffer_objct, whereas the
 * embedded list of file descriptors is represented by a
 * struct binder_fd_array_object with that binder_buffer_object as
 * a parent.
 */
struct binder_fd_array_object {
	struct binder_object_header	hdr;
	binder_size_t			num_fds;
	binder_size_t			parent;
	binder_size_t			parent_offset;
};

/*
 * On 64-bit platforms where user code may run in 32-bits the driver must
 * translate the buffer (and local binder) addresses appropriately.
 */

struct binder_write_read {
	binder_size_t		write_size;	/* bytes to write */
	binder_size_t		write_consumed;	/* bytes consumed by driver */
	binder_uintptr_t	write_buffer;
	binder_size_t		read_size;	/* bytes to read */
	binder_size_t		read_consumed;	/* bytes consumed by driver */
	binder_uintptr_t	read_buffer;
};

/* Use with BINDER_VERSION, driver fills in fields. */
struct binder_version {
	/* driver protocol version -- increment with incompatible change */
	__s32	protocol_version;
};

/* This is the current protocol version. */
#ifdef BINDER_IPC_32BIT
#define BINDER_CURRENT_PROTOCOL_VERSION 7
#else
#define BINDER_CURRENT_PROTOCOL_VERSION 8
#endif

/*
 * Use with BINDER_GET_NODE_DEBUG_INFO, driver reads ptr, writes to all fields.
 * Set ptr to NULL for the first call to get the info for the first node, and
 * then repeat the call passing the previously returned value to get the next
 * nodes.  ptr will be 0 when there are no more nodes.
 */
struct binder_node_debug_info {
	binder_uintptr_t ptr;
	binder_uintptr_t cookie;
	__u32            has_strong_ref;
	__u32            has_weak_ref;
};

struct binder_node_info_for_ref {
	__u32            handle;
	__u32            strong_count;
	__u32            weak_count;
	__u32            reserved1;
	__u32            reserved2;
	__u32            reserved3;
};

#define BINDER_WRITE_READ		_IOWR('b', 1, struct binder_write_read)
#define	BINDER_SET_IDLE_TIMEOUT		_IOW('b', 3, __s64)
#define	BINDER_SET_MAX_THREADS		_IOW('b', 5, __u32)
#define	BINDER_SET_IDLE_PRIORITY	_IOW('b', 6, __s32)
#define	BINDER_SET_CONTEXT_MGR		_IOW('b', 7, __s32)
#define	BINDER_THREAD_EXIT		_IOW('b', 8, __s32)
#define BINDER_VERSION			_IOWR('b', 9, struct binder_version)
#define BINDER_GET_NODE_DEBUG_INFO	_IOWR('b', 11, struct binder_node_debug_info)
#define BINDER_GET_NODE_INFO_FOR_REF	_IOWR('b', 12, struct binder_node_info_for_ref)

/*
 * NOTE: Two special error codes you should check for when calling
 * in to the driver are:
 *
 * EINTR -- The operation has been interupted.  This should be
 * handled by retrying the ioctl() until a different error code
 * is returned.
 *
 * ECONNREFUSED -- The driver is no longer accepting operations
 * from your process.  That is, the process is being destroyed.
 * You should handle this by exiting from your process.  Note
 * that once this error code is returned, all further calls to
 * the driver from any thread will return this same code.
 */

enum transaction_flags {
	TF_ONE_WAY	= 0x01,	/* this is a one-way call: async, no return */
	TF_ROOT_OBJECT	= 0x04,	/* contents are the component's root object */
	TF_STATUS_CODE	= 0x08,	/* contents are a 32-bit status code */
	TF_ACCEPT_FDS	= 0x10,	/* allow replies with file descriptors */
};

struct binder_transaction_data {
	/* The first two are only used for bcTRANSACTION and brTRANSACTION,
	 * identifying the target and contents of the transaction.
	 */
	union {
		/* target descriptor of command transaction */
		__u32	handle;
		/* target descriptor of return transaction */
		binder_uintptr_t ptr;
	} target;
	binder_uintptr_t	cookie;	/* target object cookie */
	__u32		code;		/* transaction command */

	/* General information about the transaction. */
	__u32		flags;
	pid_t		sender_pid;
	uid_t		sender_euid;
	binder_size_t	data_size;	/* number of bytes of data */
	binder_size_t	offsets_size;	/* number of bytes of offsets */

	/* If this transaction is inline, the data immediately
	 * follows here; otherwise, it ends with a pointer to
	 * the data buffer.
	 */
	union {
		struct {
			/* transaction data */
			binder_uintptr_t	buffer;
			/* offsets from buffer to flat_binder_object structs */
			binder_uintptr_t	offsets;
		} ptr;
		__u8	buf[8];
	} data;
};

struct binder_transaction_data_sg {
	struct binder_transaction_data transaction_data;
	binder_size_t buffers_size;
};

struct binder_ptr_cookie {
	binder_uintptr_t ptr;
	binder_uintptr_t cookie;
};

struct binder_handle_cookie {
	__u32 handle;
	binder_uintptr_t cookie;
} __attribute__((packed));

struct binder_pri_desc {
	__s32 priority;
	__u32 desc;
};

struct binder_pri_ptr_cookie {
	__s32 priority;
	binder_uintptr_t ptr;
	binder_uintptr_t cookie;
};

enum binder_driver_return_protocol {
	BR_ERROR = _IOR('r', 0, __s32),
	/*
	 * int: error code
	 */

	BR_OK = _IO('r', 1),
	/* No parameters! */

	BR_TRANSACTION = _IOR('r', 2, struct binder_transaction_data),
	BR_REPLY = _IOR('r', 3, struct binder_transaction_data),
	/*
	 * binder_transaction_data: the received command.
	 */

	BR_ACQUIRE_RESULT = _IOR('r', 4, __s32),
	/*
	 * not currently supported
	 * int: 0 if the last bcATTEMPT_ACQUIRE was not successful.
	 * Else the remote object has acquired a primary reference.
	 */

	BR_DEAD_REPLY = _IO('r', 5),
	/*
	 * The target of the last transaction (either a bcTRANSACTION or
	 * a bcATTEMPT_ACQUIRE) is no longer with us.  No parameters.
	 */

	BR_TRANSACTION_COMPLETE = _IO('r', 6),
	/*
	 * No parameters... always refers to the last transaction requested
	 * (including replies).  Note that this will be sent even for
	 * asynchronous transactions.
	 */

	BR_INCREFS = _IOR('r', 7, struct binder_ptr_cookie),
	BR_ACQUIRE = _IOR('r', 8, struct binder_ptr_cookie),
	BR_RELEASE = _IOR('r', 9, struct binder_ptr_cookie),
	BR_DECREFS = _IOR('r', 10, struct binder_ptr_cookie),
	/*
	 * void *:	ptr to binder
	 * void *: cookie for binder
	 */

	BR_ATTEMPT_ACQUIRE = _IOR('r', 11, struct binder_pri_ptr_cookie),
	/*
	 * not currently supported
	 * int:	priority
	 * void *: ptr to binder
	 * void *: cookie for binder
	 */

	BR_NOOP = _IO('r', 12),
	/*
	 * No parameters.  Do nothing and examine the next command.  It exists
	 * primarily so that we can replace it with a BR_SPAWN_LOOPER command.
	 */

	BR_SPAWN_LOOPER = _IO('r', 13),
	/*
	 * No parameters.  The driver has determined that a process has no
	 * threads waiting to service incoming transactions.  When a process
	 * receives this command, it must spawn a new service thread and
	 * register it via bcENTER_LOOPER.
	 */

	BR_FINISHED = _IO('r', 14),
	/*
	 * not currently supported
	 * stop threadpool thread
	 */

	BR_DEAD_BINDER = _IOR('r', 15, binder_uintptr_t),
	/*
	 * void *: cookie
	 */
	BR_CLEAR_DEATH_NOTIFICATION_DONE = _IOR('r', 16, binder_uintptr_t),
	/*
	 * void *: cookie
	 */

	BR_FAILED_REPLY = _IO('r', 17),
	/*
	 * The the last transaction (either a bcTRANSACTION or
	 * a bcATTEMPT_ACQUIRE) failed (e.g. out of memory).  No parameters.
	 */
};

enum binder_driver_command_protocol {
	BC_TRANSACTION = _IOW('c', 0, struct binder_transaction_data),
	BC_REPLY = _IOW('c', 1, struct binder_transaction_data),
	/*
	 * binder_transaction_data: the sent command.
	 */

	BC_ACQUIRE_RESULT = _IOW('c', 2, __s32),
	/*
	 * not currently supported
	 * int:  0 if the last BR_ATTEMPT_ACQUIRE was not successful.
	 * Else you have acquired a primary reference on the object.
	 */

	BC_FREE_BUFFER = _IOW('c', 3, binder_uintptr_t),
	/*
	 * void *: ptr to transaction data received on a read
	 */

	BC_INCREFS = _IOW('c', 4, __u32),
	BC_ACQUIRE = _IOW('c', 5, __u32),
	BC_RELEASE = _IOW('c', 6, __u32),
	BC_DECREFS = _IOW('c', 7, __u32),
	/*
	 * int:	descriptor
	 */

	BC_INCREFS_DONE = _IOW('c', 8, struct binder_ptr_cookie),
	BC_ACQUIRE_DONE = _IOW('c', 9, struct binder_ptr_cookie),
	/*
	 * void *: ptr to binder
	 * void *: cookie for binder
	 */

	BC_ATTEMPT_ACQUIRE = _IOW('c', 10, struct binder_pri_desc),
	/*
	 * not currently supported
	 * int: priority
	 * int: descriptor
	 */

	BC_REGISTER_LOOPER = _IO('c', 11),
	/*
	 * No parameters.
	 * Register a spawned looper thread with the device.
	 */

	BC_ENTER_LOOPER = _IO('c', 12),
	BC_EXIT_LOOPER = _IO('c', 13),
	/*
	 * No parameters.
	 * These two commands are sent as an application-level thread
	 * enters and exits the binder loop, respectively.  They are
	 * used so the binder can have an accurate count of the number
	 * of looping threads it has available.
	 */

	BC_REQUEST_DEATH_NOTIFICATION = _IOW('c', 14, struct binder_handle_cookie),
	/*
	 * int: handle
	 * void *: cookie
	 */

	BC_CLEAR_DEATH_NOTIFICATION = _IOW('c', 15, struct binder_handle_cookie),
	/*
	 * int: handle
	 * void *: cookie
	 */

	BC_DEAD_BINDER_DONE = _IOW('c', 16, binder_uintptr_t),
	/*
	 * void *: cookie
	 */

	BC_TRANSACTION_SG = _IOW('c', 17, struct binder_transaction_data_sg),
	BC_REPLY_SG = _IOW('c', 18, struct binder_transaction_data_sg),
	/*
	 * binder_transaction_data_sg: the sent command.
	 */
};

#endif /* _UAPI_LINUX_BINDER_H */
Commit	Line	Data
3c2a0909 S	1	/*
	2	* Copyright (C) 2008 Google, Inc.
	3	*
	4	* Based on, but no longer compatible with, the original
	5	* OpenBinder.org binder driver interface, which is:
	6	*
	7	* Copyright (c) 2005 Palmsource, Inc.
	8	*
	9	* This software is licensed under the terms of the GNU General Public
	10	* License version 2, as published by the Free Software Foundation, and
	11	* may be copied, distributed, and modified under those terms.
	12	*
	13	* This program is distributed in the hope that it will be useful,
	14	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	15	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	16	* GNU General Public License for more details.
	17	*
	18	*/
	19
	20	#ifndef _UAPI_LINUX_BINDER_H
	21	#define _UAPI_LINUX_BINDER_H
	22
	23	#include <linux/ioctl.h>
	24
	25	#define B_PACK_CHARS(c1, c2, c3, c4) \
	26	((((c1)<<24)) \| (((c2)<<16)) \| (((c3)<<8)) \| (c4))
	27	#define B_TYPE_LARGE 0x85
	28
	29	enum {
	30	BINDER_TYPE_BINDER = B_PACK_CHARS('s', 'b', '*', B_TYPE_LARGE),
	31	BINDER_TYPE_WEAK_BINDER = B_PACK_CHARS('w', 'b', '*', B_TYPE_LARGE),
	32	BINDER_TYPE_HANDLE = B_PACK_CHARS('s', 'h', '*', B_TYPE_LARGE),
	33	BINDER_TYPE_WEAK_HANDLE = B_PACK_CHARS('w', 'h', '*', B_TYPE_LARGE),
	34	BINDER_TYPE_FD = B_PACK_CHARS('f', 'd', '*', B_TYPE_LARGE),
2f82efbc	35	BINDER_TYPE_FDA = B_PACK_CHARS('f', 'd', 'a', B_TYPE_LARGE),
e884979e	36	BINDER_TYPE_PTR = B_PACK_CHARS('p', 't', '*', B_TYPE_LARGE),
3c2a0909 S	37	};
3c2a0909 S	38
fbb541d2 MC	39	/**
	40	* enum flat_binder_object_shifts: shift values for flat_binder_object_flags
	41	* @FLAT_BINDER_FLAG_SCHED_POLICY_SHIFT: shift for getting scheduler policy.
	42	*
	43	*/
	44	enum flat_binder_object_shifts {
	45	FLAT_BINDER_FLAG_SCHED_POLICY_SHIFT = 9,
	46	};
	47
	48	/**
	49	* enum flat_binder_object_flags - flags for use in flat_binder_object.flags
	50	*/
	51	enum flat_binder_object_flags {
	52	/**
	53	* @FLAT_BINDER_FLAG_PRIORITY_MASK: bit-mask for min scheduler priority
	54	*
	55	* These bits can be used to set the minimum scheduler priority
	56	* at which transactions into this node should run. Valid values
	57	* in these bits depend on the scheduler policy encoded in
	58	* @FLAT_BINDER_FLAG_SCHED_POLICY_MASK.
	59	*
	60	* For SCHED_NORMAL/SCHED_BATCH, the valid range is between [-20..19]
	61	* For SCHED_FIFO/SCHED_RR, the value can run between [1..99]
	62	*/
3c2a0909	63	FLAT_BINDER_FLAG_PRIORITY_MASK = 0xff,
fbb541d2 MC	64	/**
	65	* @FLAT_BINDER_FLAG_ACCEPTS_FDS: whether the node accepts fds.
	66	*/
3c2a0909	67	FLAT_BINDER_FLAG_ACCEPTS_FDS = 0x100,
fbb541d2 MC	68	/**
	69	* @FLAT_BINDER_FLAG_SCHED_POLICY_MASK: bit-mask for scheduling policy
	70	*
	71	* These two bits can be used to set the min scheduling policy at which
	72	* transactions on this node should run. These match the UAPI
	73	* scheduler policy values, eg:
	74	* 00b: SCHED_NORMAL
	75	* 01b: SCHED_FIFO
	76	* 10b: SCHED_RR
	77	* 11b: SCHED_BATCH
	78	*/
	79	FLAT_BINDER_FLAG_SCHED_POLICY_MASK =
	80	3U << FLAT_BINDER_FLAG_SCHED_POLICY_SHIFT,
21dfe3eb MC	81
	82	/**
	83	* @FLAT_BINDER_FLAG_INHERIT_RT: whether the node inherits RT policy
	84	*
	85	* Only when set, calls into this node will inherit a real-time
	86	* scheduling policy from the caller (for synchronous transactions).
	87	*/
	88	FLAT_BINDER_FLAG_INHERIT_RT = 0x800,
3c2a0909 S	89	};
3c2a0909 S	90
9c0a1d02 AH	91	#ifdef BINDER_IPC_32BIT
	92	typedef __u32 binder_size_t;
	93	typedef __u32 binder_uintptr_t;
	94	#else
	95	typedef __u64 binder_size_t;
	96	typedef __u64 binder_uintptr_t;
	97	#endif
	98
17f2cab3 MC	99	/**
	100	* struct binder_object_header - header shared by all binder metadata objects.
	101	* @type: type of the object
	102	*/
	103	struct binder_object_header {
	104	__u32 type;
	105	};
	106
3c2a0909 S	107	/*
	108	* This is the flattened representation of a Binder object for transfer
	109	* between processes. The 'offsets' supplied as part of a binder transaction
	110	* contains offsets into the data where these structures occur. The Binder
	111	* driver takes care of re-writing the structure type and data as it moves
	112	* between processes.
	113	*/
	114	struct flat_binder_object {
17f2cab3 MC	115	struct binder_object_header hdr;
17f2cab3 MC	116	__u32 flags;
3c2a0909 S	117
	118	/* 8 bytes of data. */
	119	union {
9c0a1d02 AH	120	binder_uintptr_t binder; /* local object */
9c0a1d02 AH	121	__u32 handle; /* remote object */
3c2a0909 S	122	};
	123
	124	/* extra data associated with local object */
9c0a1d02	125	binder_uintptr_t cookie;
3c2a0909 S	126	};
3c2a0909 S	127
17f2cab3 MC	128	/**
	129	* struct binder_fd_object - describes a filedescriptor to be fixed up.
	130	* @hdr: common header structure
	131	* @pad_flags: padding to remain compatible with old userspace code
	132	* @pad_binder: padding to remain compatible with old userspace code
	133	* @fd: file descriptor
	134	* @cookie: opaque data, used by user-space
	135	*/
	136	struct binder_fd_object {
	137	struct binder_object_header hdr;
	138	__u32 pad_flags;
	139	union {
	140	binder_uintptr_t pad_binder;
	141	__u32 fd;
	142	};
	143
	144	binder_uintptr_t cookie;
	145	};
e884979e MC	146
	147	/* struct binder_buffer_object - object describing a userspace buffer
	148	* @hdr: common header structure
	149	* @flags: one or more BINDER_BUFFER_* flags
	150	* @buffer: address of the buffer
	151	* @length: length of the buffer
	152	* @parent: index in offset array pointing to parent buffer
	153	* @parent_offset: offset in @parent pointing to this buffer
	154	*
	155	* A binder_buffer object represents an object that the
	156	* binder kernel driver can copy verbatim to the target
	157	* address space. A buffer itself may be pointed to from
	158	* within another buffer, meaning that the pointer inside
	159	* that other buffer needs to be fixed up as well. This
	160	* can be done by setting the BINDER_BUFFER_FLAG_HAS_PARENT
	161	* flag in @flags, by setting @parent buffer to the index
	162	* in the offset array pointing to the parent binder_buffer_object,
	163	* and by setting @parent_offset to the offset in the parent buffer
	164	* at which the pointer to this buffer is located.
	165	*/
	166	struct binder_buffer_object {
	167	struct binder_object_header hdr;
	168	__u32 flags;
	169	binder_uintptr_t buffer;
	170	binder_size_t length;
	171	binder_size_t parent;
	172	binder_size_t parent_offset;
	173	};
	174
	175	enum {
	176	BINDER_BUFFER_FLAG_HAS_PARENT = 0x01,
	177	};
	178
2f82efbc MC	179	/* struct binder_fd_array_object - object describing an array of fds in a buffer
	180	* @hdr: common header structure
	181	* @num_fds: number of file descriptors in the buffer
	182	* @parent: index in offset array to buffer holding the fd array
	183	* @parent_offset: start offset of fd array in the buffer
	184	*
	185	* A binder_fd_array object represents an array of file
	186	* descriptors embedded in a binder_buffer_object. It is
	187	* different from a regular binder_buffer_object because it
	188	* describes a list of file descriptors to fix up, not an opaque
	189	* blob of memory, and hence the kernel needs to treat it differently.
	190	*
	191	* An example of how this would be used is with Android's
	192	* native_handle_t object, which is a struct with a list of integers
	193	* and a list of file descriptors. The native_handle_t struct itself
	194	* will be represented by a struct binder_buffer_objct, whereas the
	195	* embedded list of file descriptors is represented by a
	196	* struct binder_fd_array_object with that binder_buffer_object as
	197	* a parent.
	198	*/
	199	struct binder_fd_array_object {
	200	struct binder_object_header hdr;
	201	binder_size_t num_fds;
	202	binder_size_t parent;
	203	binder_size_t parent_offset;
	204	};
	205
3c2a0909 S	206	/*
	207	* On 64-bit platforms where user code may run in 32-bits the driver must
	208	* translate the buffer (and local binder) addresses appropriately.
	209	*/
	210
	211	struct binder_write_read {
9c0a1d02 AH	212	binder_size_t write_size; /* bytes to write */
	213	binder_size_t write_consumed; /* bytes consumed by driver */
	214	binder_uintptr_t write_buffer;
	215	binder_size_t read_size; /* bytes to read */
	216	binder_size_t read_consumed; /* bytes consumed by driver */
	217	binder_uintptr_t read_buffer;
3c2a0909 S	218	};
	219
	220	/* Use with BINDER_VERSION, driver fills in fields. */
	221	struct binder_version {
	222	/* driver protocol version -- increment with incompatible change */
	223	__s32 protocol_version;
	224	};
	225
	226	/* This is the current protocol version. */
9c0a1d02	227	#ifdef BINDER_IPC_32BIT
3c2a0909	228	#define BINDER_CURRENT_PROTOCOL_VERSION 7
9c0a1d02 AH	229	#else
	230	#define BINDER_CURRENT_PROTOCOL_VERSION 8
	231	#endif
3c2a0909	232
66266ad3 CC	233	/*
	234	* Use with BINDER_GET_NODE_DEBUG_INFO, driver reads ptr, writes to all fields.
	235	* Set ptr to NULL for the first call to get the info for the first node, and
	236	* then repeat the call passing the previously returned value to get the next
	237	* nodes. ptr will be 0 when there are no more nodes.
	238	*/
	239	struct binder_node_debug_info {
	240	binder_uintptr_t ptr;
	241	binder_uintptr_t cookie;
	242	__u32 has_strong_ref;
	243	__u32 has_weak_ref;
	244	};
	245
96f60059 MC	246	struct binder_node_info_for_ref {
	247	__u32 handle;
	248	__u32 strong_count;
	249	__u32 weak_count;
	250	__u32 reserved1;
	251	__u32 reserved2;
	252	__u32 reserved3;
	253	};
	254
3c2a0909 S	255	#define BINDER_WRITE_READ _IOWR('b', 1, struct binder_write_read)
	256	#define BINDER_SET_IDLE_TIMEOUT _IOW('b', 3, __s64)
	257	#define BINDER_SET_MAX_THREADS _IOW('b', 5, __u32)
	258	#define BINDER_SET_IDLE_PRIORITY _IOW('b', 6, __s32)
	259	#define BINDER_SET_CONTEXT_MGR _IOW('b', 7, __s32)
	260	#define BINDER_THREAD_EXIT _IOW('b', 8, __s32)
	261	#define BINDER_VERSION _IOWR('b', 9, struct binder_version)
66266ad3	262	#define BINDER_GET_NODE_DEBUG_INFO _IOWR('b', 11, struct binder_node_debug_info)
96f60059	263	#define BINDER_GET_NODE_INFO_FOR_REF _IOWR('b', 12, struct binder_node_info_for_ref)
3c2a0909 S	264
	265	/*
	266	* NOTE: Two special error codes you should check for when calling
	267	* in to the driver are:
	268	*
	269	* EINTR -- The operation has been interupted. This should be
	270	* handled by retrying the ioctl() until a different error code
	271	* is returned.
	272	*
	273	* ECONNREFUSED -- The driver is no longer accepting operations
	274	* from your process. That is, the process is being destroyed.
	275	* You should handle this by exiting from your process. Note
	276	* that once this error code is returned, all further calls to
	277	* the driver from any thread will return this same code.
	278	*/
	279
	280	enum transaction_flags {
	281	TF_ONE_WAY = 0x01, /* this is a one-way call: async, no return */
	282	TF_ROOT_OBJECT = 0x04, /* contents are the component's root object */
	283	TF_STATUS_CODE = 0x08, /* contents are a 32-bit status code */
	284	TF_ACCEPT_FDS = 0x10, /* allow replies with file descriptors */
	285	};
	286
	287	struct binder_transaction_data {
	288	/* The first two are only used for bcTRANSACTION and brTRANSACTION,
	289	* identifying the target and contents of the transaction.
	290	*/
	291	union {
9c0a1d02 AH	292	/* target descriptor of command transaction */
	293	__u32 handle;
	294	/* target descriptor of return transaction */
	295	binder_uintptr_t ptr;
3c2a0909	296	} target;
9c0a1d02	297	binder_uintptr_t cookie; /* target object cookie */
3c2a0909 S	298	__u32 code; /* transaction command */
	299
	300	/* General information about the transaction. */
	301	__u32 flags;
	302	pid_t sender_pid;
	303	uid_t sender_euid;
9c0a1d02 AH	304	binder_size_t data_size; /* number of bytes of data */
9c0a1d02 AH	305	binder_size_t offsets_size; /* number of bytes of offsets */
3c2a0909 S	306
	307	/* If this transaction is inline, the data immediately
	308	* follows here; otherwise, it ends with a pointer to
	309	* the data buffer.
	310	*/
	311	union {
	312	struct {
	313	/* transaction data */
9c0a1d02	314	binder_uintptr_t buffer;
3c2a0909	315	/* offsets from buffer to flat_binder_object structs */
9c0a1d02	316	binder_uintptr_t offsets;
3c2a0909 S	317	} ptr;
	318	__u8 buf[8];
	319	} data;
	320	};
	321
e884979e MC	322	struct binder_transaction_data_sg {
	323	struct binder_transaction_data transaction_data;
	324	binder_size_t buffers_size;
	325	};
	326
3c2a0909	327	struct binder_ptr_cookie {
9c0a1d02 AH	328	binder_uintptr_t ptr;
9c0a1d02 AH	329	binder_uintptr_t cookie;
3c2a0909 S	330	};
	331
	332	struct binder_handle_cookie {
	333	__u32 handle;
9c0a1d02	334	binder_uintptr_t cookie;
3c2a0909 S	335	} __attribute__((packed));
	336
	337	struct binder_pri_desc {
	338	__s32 priority;
	339	__u32 desc;
	340	};
	341
	342	struct binder_pri_ptr_cookie {
	343	__s32 priority;
9c0a1d02 AH	344	binder_uintptr_t ptr;
9c0a1d02 AH	345	binder_uintptr_t cookie;
3c2a0909 S	346	};
	347
	348	enum binder_driver_return_protocol {
	349	BR_ERROR = _IOR('r', 0, __s32),
	350	/*
	351	* int: error code
	352	*/
	353
	354	BR_OK = _IO('r', 1),
	355	/* No parameters! */
	356
	357	BR_TRANSACTION = _IOR('r', 2, struct binder_transaction_data),
	358	BR_REPLY = _IOR('r', 3, struct binder_transaction_data),
	359	/*
	360	* binder_transaction_data: the received command.
	361	*/
	362
	363	BR_ACQUIRE_RESULT = _IOR('r', 4, __s32),
	364	/*
	365	* not currently supported
	366	* int: 0 if the last bcATTEMPT_ACQUIRE was not successful.
	367	* Else the remote object has acquired a primary reference.
	368	*/
	369
	370	BR_DEAD_REPLY = _IO('r', 5),
	371	/*
	372	* The target of the last transaction (either a bcTRANSACTION or
	373	* a bcATTEMPT_ACQUIRE) is no longer with us. No parameters.
	374	*/
	375
	376	BR_TRANSACTION_COMPLETE = _IO('r', 6),
	377	/*
	378	* No parameters... always refers to the last transaction requested
	379	* (including replies). Note that this will be sent even for
	380	* asynchronous transactions.
	381	*/
	382
	383	BR_INCREFS = _IOR('r', 7, struct binder_ptr_cookie),
	384	BR_ACQUIRE = _IOR('r', 8, struct binder_ptr_cookie),
	385	BR_RELEASE = _IOR('r', 9, struct binder_ptr_cookie),
	386	BR_DECREFS = _IOR('r', 10, struct binder_ptr_cookie),
	387	/*
	388	* void *: ptr to binder
	389	* void *: cookie for binder
	390	*/
	391
	392	BR_ATTEMPT_ACQUIRE = _IOR('r', 11, struct binder_pri_ptr_cookie),
	393	/*
	394	* not currently supported
	395	* int: priority
	396	* void *: ptr to binder
	397	* void *: cookie for binder
	398	*/
	399
	400	BR_NOOP = _IO('r', 12),
	401	/*
	402	* No parameters. Do nothing and examine the next command. It exists
	403	* primarily so that we can replace it with a BR_SPAWN_LOOPER command.
	404	*/
	405
	406	BR_SPAWN_LOOPER = _IO('r', 13),
	407	/*
	408	* No parameters. The driver has determined that a process has no
	409	* threads waiting to service incoming transactions. When a process
410	* receives this command, it must spawn a new service thread and
411	* register it via bcENTER_LOOPER.
412	*/
413
414	BR_FINISHED = _IO('r', 14),
415	/*
416	* not currently supported
417	* stop threadpool thread
418	*/
419
9c0a1d02	420	BR_DEAD_BINDER = _IOR('r', 15, binder_uintptr_t),
3c2a0909 S	421	/*
	422	* void *: cookie
	423	*/
9c0a1d02	424	BR_CLEAR_DEATH_NOTIFICATION_DONE = _IOR('r', 16, binder_uintptr_t),
3c2a0909 S	425	/*
	426	* void *: cookie
	427	*/
	428
	429	BR_FAILED_REPLY = _IO('r', 17),
	430	/*
	431	* The the last transaction (either a bcTRANSACTION or
	432	* a bcATTEMPT_ACQUIRE) failed (e.g. out of memory). No parameters.
	433	*/
	434	};
	435
	436	enum binder_driver_command_protocol {
	437	BC_TRANSACTION = _IOW('c', 0, struct binder_transaction_data),
	438	BC_REPLY = _IOW('c', 1, struct binder_transaction_data),
	439	/*
	440	* binder_transaction_data: the sent command.
	441	*/
	442
	443	BC_ACQUIRE_RESULT = _IOW('c', 2, __s32),
	444	/*
	445	* not currently supported
	446	* int: 0 if the last BR_ATTEMPT_ACQUIRE was not successful.
	447	* Else you have acquired a primary reference on the object.
	448	*/
	449
9c0a1d02	450	BC_FREE_BUFFER = _IOW('c', 3, binder_uintptr_t),
3c2a0909 S	451	/*
	452	* void *: ptr to transaction data received on a read
	453	*/
	454
	455	BC_INCREFS = _IOW('c', 4, __u32),
	456	BC_ACQUIRE = _IOW('c', 5, __u32),
	457	BC_RELEASE = _IOW('c', 6, __u32),
	458	BC_DECREFS = _IOW('c', 7, __u32),
	459	/*
	460	* int: descriptor
	461	*/
	462
	463	BC_INCREFS_DONE = _IOW('c', 8, struct binder_ptr_cookie),
	464	BC_ACQUIRE_DONE = _IOW('c', 9, struct binder_ptr_cookie),
	465	/*
	466	* void *: ptr to binder
	467	* void *: cookie for binder
	468	*/
	469
	470	BC_ATTEMPT_ACQUIRE = _IOW('c', 10, struct binder_pri_desc),
	471	/*
	472	* not currently supported
	473	* int: priority
	474	* int: descriptor
	475	*/
	476
	477	BC_REGISTER_LOOPER = _IO('c', 11),
	478	/*
	479	* No parameters.
	480	* Register a spawned looper thread with the device.
	481	*/
	482
	483	BC_ENTER_LOOPER = _IO('c', 12),
	484	BC_EXIT_LOOPER = _IO('c', 13),
	485	/*
	486	* No parameters.
	487	* These two commands are sent as an application-level thread
	488	* enters and exits the binder loop, respectively. They are
	489	* used so the binder can have an accurate count of the number
	490	* of looping threads it has available.
	491	*/
	492
	493	BC_REQUEST_DEATH_NOTIFICATION = _IOW('c', 14, struct binder_handle_cookie),
	494	/*
	495	* int: handle
	496	* void *: cookie
	497	*/
	498
	499	BC_CLEAR_DEATH_NOTIFICATION = _IOW('c', 15, struct binder_handle_cookie),
	500	/*
	501	* int: handle
	502	* void *: cookie
	503	*/
	504
9c0a1d02	505	BC_DEAD_BINDER_DONE = _IOW('c', 16, binder_uintptr_t),
3c2a0909 S	506	/*
	507	* void *: cookie
	508	*/
e884979e MC	509
	510	BC_TRANSACTION_SG = _IOW('c', 17, struct binder_transaction_data_sg),
	511	BC_REPLY_SG = _IOW('c', 18, struct binder_transaction_data_sg),
	512	/*
	513	* binder_transaction_data_sg: the sent command.
	514	*/
3c2a0909 S	515	};
	516
	517	#endif /* _UAPI_LINUX_BINDER_H */
	518