logo

oasis-root

Compiled tree of Oasis Linux based on own branch at <https://hacktivis.me/git/oasis/> git clone https://anongit.hacktivis.me/git/oasis-root.git

binder.h (17201B)


  1. /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
  2. /*
  3. * Copyright (C) 2008 Google, Inc.
  4. *
  5. * Based on, but no longer compatible with, the original
  6. * OpenBinder.org binder driver interface, which is:
  7. *
  8. * Copyright (c) 2005 Palmsource, Inc.
  9. *
  10. * This software is licensed under the terms of the GNU General Public
  11. * License version 2, as published by the Free Software Foundation, and
  12. * may be copied, distributed, and modified under those terms.
  13. *
  14. * This program is distributed in the hope that it will be useful,
  15. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  17. * GNU General Public License for more details.
  18. *
  19. */
  20. #ifndef _LINUX_BINDER_H
  21. #define _LINUX_BINDER_H
  22. #include <linux/types.h>
  23. #include <linux/ioctl.h>
  24. #define B_PACK_CHARS(c1, c2, c3, c4) \
  25. ((((c1)<<24)) | (((c2)<<16)) | (((c3)<<8)) | (c4))
  26. #define B_TYPE_LARGE 0x85
  27. enum {
  28. BINDER_TYPE_BINDER = B_PACK_CHARS('s', 'b', '*', B_TYPE_LARGE),
  29. BINDER_TYPE_WEAK_BINDER = B_PACK_CHARS('w', 'b', '*', B_TYPE_LARGE),
  30. BINDER_TYPE_HANDLE = B_PACK_CHARS('s', 'h', '*', B_TYPE_LARGE),
  31. BINDER_TYPE_WEAK_HANDLE = B_PACK_CHARS('w', 'h', '*', B_TYPE_LARGE),
  32. BINDER_TYPE_FD = B_PACK_CHARS('f', 'd', '*', B_TYPE_LARGE),
  33. BINDER_TYPE_FDA = B_PACK_CHARS('f', 'd', 'a', B_TYPE_LARGE),
  34. BINDER_TYPE_PTR = B_PACK_CHARS('p', 't', '*', B_TYPE_LARGE),
  35. };
  36. enum {
  37. FLAT_BINDER_FLAG_PRIORITY_MASK = 0xff,
  38. FLAT_BINDER_FLAG_ACCEPTS_FDS = 0x100,
  39. /**
  40. * @FLAT_BINDER_FLAG_TXN_SECURITY_CTX: request security contexts
  41. *
  42. * Only when set, causes senders to include their security
  43. * context
  44. */
  45. FLAT_BINDER_FLAG_TXN_SECURITY_CTX = 0x1000,
  46. };
  47. #ifdef BINDER_IPC_32BIT
  48. typedef __u32 binder_size_t;
  49. typedef __u32 binder_uintptr_t;
  50. #else
  51. typedef __u64 binder_size_t;
  52. typedef __u64 binder_uintptr_t;
  53. #endif
  54. /**
  55. * struct binder_object_header - header shared by all binder metadata objects.
  56. * @type: type of the object
  57. */
  58. struct binder_object_header {
  59. __u32 type;
  60. };
  61. /*
  62. * This is the flattened representation of a Binder object for transfer
  63. * between processes. The 'offsets' supplied as part of a binder transaction
  64. * contains offsets into the data where these structures occur. The Binder
  65. * driver takes care of re-writing the structure type and data as it moves
  66. * between processes.
  67. */
  68. struct flat_binder_object {
  69. struct binder_object_header hdr;
  70. __u32 flags;
  71. /* 8 bytes of data. */
  72. union {
  73. binder_uintptr_t binder; /* local object */
  74. __u32 handle; /* remote object */
  75. };
  76. /* extra data associated with local object */
  77. binder_uintptr_t cookie;
  78. };
  79. /**
  80. * struct binder_fd_object - describes a filedescriptor to be fixed up.
  81. * @hdr: common header structure
  82. * @pad_flags: padding to remain compatible with old userspace code
  83. * @pad_binder: padding to remain compatible with old userspace code
  84. * @fd: file descriptor
  85. * @cookie: opaque data, used by user-space
  86. */
  87. struct binder_fd_object {
  88. struct binder_object_header hdr;
  89. __u32 pad_flags;
  90. union {
  91. binder_uintptr_t pad_binder;
  92. __u32 fd;
  93. };
  94. binder_uintptr_t cookie;
  95. };
  96. /* struct binder_buffer_object - object describing a userspace buffer
  97. * @hdr: common header structure
  98. * @flags: one or more BINDER_BUFFER_* flags
  99. * @buffer: address of the buffer
  100. * @length: length of the buffer
  101. * @parent: index in offset array pointing to parent buffer
  102. * @parent_offset: offset in @parent pointing to this buffer
  103. *
  104. * A binder_buffer object represents an object that the
  105. * binder kernel driver can copy verbatim to the target
  106. * address space. A buffer itself may be pointed to from
  107. * within another buffer, meaning that the pointer inside
  108. * that other buffer needs to be fixed up as well. This
  109. * can be done by setting the BINDER_BUFFER_FLAG_HAS_PARENT
  110. * flag in @flags, by setting @parent buffer to the index
  111. * in the offset array pointing to the parent binder_buffer_object,
  112. * and by setting @parent_offset to the offset in the parent buffer
  113. * at which the pointer to this buffer is located.
  114. */
  115. struct binder_buffer_object {
  116. struct binder_object_header hdr;
  117. __u32 flags;
  118. binder_uintptr_t buffer;
  119. binder_size_t length;
  120. binder_size_t parent;
  121. binder_size_t parent_offset;
  122. };
  123. enum {
  124. BINDER_BUFFER_FLAG_HAS_PARENT = 0x01,
  125. };
  126. /* struct binder_fd_array_object - object describing an array of fds in a buffer
  127. * @hdr: common header structure
  128. * @pad: padding to ensure correct alignment
  129. * @num_fds: number of file descriptors in the buffer
  130. * @parent: index in offset array to buffer holding the fd array
  131. * @parent_offset: start offset of fd array in the buffer
  132. *
  133. * A binder_fd_array object represents an array of file
  134. * descriptors embedded in a binder_buffer_object. It is
  135. * different from a regular binder_buffer_object because it
  136. * describes a list of file descriptors to fix up, not an opaque
  137. * blob of memory, and hence the kernel needs to treat it differently.
  138. *
  139. * An example of how this would be used is with Android's
  140. * native_handle_t object, which is a struct with a list of integers
  141. * and a list of file descriptors. The native_handle_t struct itself
  142. * will be represented by a struct binder_buffer_objct, whereas the
  143. * embedded list of file descriptors is represented by a
  144. * struct binder_fd_array_object with that binder_buffer_object as
  145. * a parent.
  146. */
  147. struct binder_fd_array_object {
  148. struct binder_object_header hdr;
  149. __u32 pad;
  150. binder_size_t num_fds;
  151. binder_size_t parent;
  152. binder_size_t parent_offset;
  153. };
  154. /*
  155. * On 64-bit platforms where user code may run in 32-bits the driver must
  156. * translate the buffer (and local binder) addresses appropriately.
  157. */
  158. struct binder_write_read {
  159. binder_size_t write_size; /* bytes to write */
  160. binder_size_t write_consumed; /* bytes consumed by driver */
  161. binder_uintptr_t write_buffer;
  162. binder_size_t read_size; /* bytes to read */
  163. binder_size_t read_consumed; /* bytes consumed by driver */
  164. binder_uintptr_t read_buffer;
  165. };
  166. /* Use with BINDER_VERSION, driver fills in fields. */
  167. struct binder_version {
  168. /* driver protocol version -- increment with incompatible change */
  169. __s32 protocol_version;
  170. };
  171. /* This is the current protocol version. */
  172. #ifdef BINDER_IPC_32BIT
  173. #define BINDER_CURRENT_PROTOCOL_VERSION 7
  174. #else
  175. #define BINDER_CURRENT_PROTOCOL_VERSION 8
  176. #endif
  177. /*
  178. * Use with BINDER_GET_NODE_DEBUG_INFO, driver reads ptr, writes to all fields.
  179. * Set ptr to NULL for the first call to get the info for the first node, and
  180. * then repeat the call passing the previously returned value to get the next
  181. * nodes. ptr will be 0 when there are no more nodes.
  182. */
  183. struct binder_node_debug_info {
  184. binder_uintptr_t ptr;
  185. binder_uintptr_t cookie;
  186. __u32 has_strong_ref;
  187. __u32 has_weak_ref;
  188. };
  189. struct binder_node_info_for_ref {
  190. __u32 handle;
  191. __u32 strong_count;
  192. __u32 weak_count;
  193. __u32 reserved1;
  194. __u32 reserved2;
  195. __u32 reserved3;
  196. };
  197. struct binder_freeze_info {
  198. __u32 pid;
  199. __u32 enable;
  200. __u32 timeout_ms;
  201. };
  202. struct binder_frozen_status_info {
  203. __u32 pid;
  204. /* process received sync transactions since last frozen
  205. * bit 0: received sync transaction after being frozen
  206. * bit 1: new pending sync transaction during freezing
  207. */
  208. __u32 sync_recv;
  209. /* process received async transactions since last frozen */
  210. __u32 async_recv;
  211. };
  212. struct binder_frozen_state_info {
  213. binder_uintptr_t cookie;
  214. __u32 is_frozen;
  215. __u32 reserved;
  216. };
  217. /* struct binder_extened_error - extended error information
  218. * @id: identifier for the failed operation
  219. * @command: command as defined by binder_driver_return_protocol
  220. * @param: parameter holding a negative errno value
  221. *
  222. * Used with BINDER_GET_EXTENDED_ERROR. This extends the error information
  223. * returned by the driver upon a failed operation. Userspace can pull this
  224. * data to properly handle specific error scenarios.
  225. */
  226. struct binder_extended_error {
  227. __u32 id;
  228. __u32 command;
  229. __s32 param;
  230. };
  231. enum {
  232. BINDER_WRITE_READ = _IOWR('b', 1, struct binder_write_read),
  233. BINDER_SET_IDLE_TIMEOUT = _IOW('b', 3, __s64),
  234. BINDER_SET_MAX_THREADS = _IOW('b', 5, __u32),
  235. BINDER_SET_IDLE_PRIORITY = _IOW('b', 6, __s32),
  236. BINDER_SET_CONTEXT_MGR = _IOW('b', 7, __s32),
  237. BINDER_THREAD_EXIT = _IOW('b', 8, __s32),
  238. BINDER_VERSION = _IOWR('b', 9, struct binder_version),
  239. BINDER_GET_NODE_DEBUG_INFO = _IOWR('b', 11, struct binder_node_debug_info),
  240. BINDER_GET_NODE_INFO_FOR_REF = _IOWR('b', 12, struct binder_node_info_for_ref),
  241. BINDER_SET_CONTEXT_MGR_EXT = _IOW('b', 13, struct flat_binder_object),
  242. BINDER_FREEZE = _IOW('b', 14, struct binder_freeze_info),
  243. BINDER_GET_FROZEN_INFO = _IOWR('b', 15, struct binder_frozen_status_info),
  244. BINDER_ENABLE_ONEWAY_SPAM_DETECTION = _IOW('b', 16, __u32),
  245. BINDER_GET_EXTENDED_ERROR = _IOWR('b', 17, struct binder_extended_error),
  246. };
  247. /*
  248. * NOTE: Two special error codes you should check for when calling
  249. * in to the driver are:
  250. *
  251. * EINTR -- The operation has been interupted. This should be
  252. * handled by retrying the ioctl() until a different error code
  253. * is returned.
  254. *
  255. * ECONNREFUSED -- The driver is no longer accepting operations
  256. * from your process. That is, the process is being destroyed.
  257. * You should handle this by exiting from your process. Note
  258. * that once this error code is returned, all further calls to
  259. * the driver from any thread will return this same code.
  260. */
  261. enum transaction_flags {
  262. TF_ONE_WAY = 0x01, /* this is a one-way call: async, no return */
  263. TF_ROOT_OBJECT = 0x04, /* contents are the component's root object */
  264. TF_STATUS_CODE = 0x08, /* contents are a 32-bit status code */
  265. TF_ACCEPT_FDS = 0x10, /* allow replies with file descriptors */
  266. TF_CLEAR_BUF = 0x20, /* clear buffer on txn complete */
  267. TF_UPDATE_TXN = 0x40, /* update the outdated pending async txn */
  268. };
  269. struct binder_transaction_data {
  270. /* The first two are only used for bcTRANSACTION and brTRANSACTION,
  271. * identifying the target and contents of the transaction.
  272. */
  273. union {
  274. /* target descriptor of command transaction */
  275. __u32 handle;
  276. /* target descriptor of return transaction */
  277. binder_uintptr_t ptr;
  278. } target;
  279. binder_uintptr_t cookie; /* target object cookie */
  280. __u32 code; /* transaction command */
  281. /* General information about the transaction. */
  282. __u32 flags;
  283. __kernel_pid_t sender_pid;
  284. __kernel_uid32_t sender_euid;
  285. binder_size_t data_size; /* number of bytes of data */
  286. binder_size_t offsets_size; /* number of bytes of offsets */
  287. /* If this transaction is inline, the data immediately
  288. * follows here; otherwise, it ends with a pointer to
  289. * the data buffer.
  290. */
  291. union {
  292. struct {
  293. /* transaction data */
  294. binder_uintptr_t buffer;
  295. /* offsets from buffer to flat_binder_object structs */
  296. binder_uintptr_t offsets;
  297. } ptr;
  298. __u8 buf[8];
  299. } data;
  300. };
  301. struct binder_transaction_data_secctx {
  302. struct binder_transaction_data transaction_data;
  303. binder_uintptr_t secctx;
  304. };
  305. struct binder_transaction_data_sg {
  306. struct binder_transaction_data transaction_data;
  307. binder_size_t buffers_size;
  308. };
  309. struct binder_ptr_cookie {
  310. binder_uintptr_t ptr;
  311. binder_uintptr_t cookie;
  312. };
  313. struct binder_handle_cookie {
  314. __u32 handle;
  315. binder_uintptr_t cookie;
  316. } __attribute__((packed));
  317. struct binder_pri_desc {
  318. __s32 priority;
  319. __u32 desc;
  320. };
  321. struct binder_pri_ptr_cookie {
  322. __s32 priority;
  323. binder_uintptr_t ptr;
  324. binder_uintptr_t cookie;
  325. };
  326. enum binder_driver_return_protocol {
  327. BR_ERROR = _IOR('r', 0, __s32),
  328. /*
  329. * int: error code
  330. */
  331. BR_OK = _IO('r', 1),
  332. /* No parameters! */
  333. BR_TRANSACTION_SEC_CTX = _IOR('r', 2,
  334. struct binder_transaction_data_secctx),
  335. /*
  336. * binder_transaction_data_secctx: the received command.
  337. */
  338. BR_TRANSACTION = _IOR('r', 2, struct binder_transaction_data),
  339. BR_REPLY = _IOR('r', 3, struct binder_transaction_data),
  340. /*
  341. * binder_transaction_data: the received command.
  342. */
  343. BR_ACQUIRE_RESULT = _IOR('r', 4, __s32),
  344. /*
  345. * not currently supported
  346. * int: 0 if the last bcATTEMPT_ACQUIRE was not successful.
  347. * Else the remote object has acquired a primary reference.
  348. */
  349. BR_DEAD_REPLY = _IO('r', 5),
  350. /*
  351. * The target of the last transaction (either a bcTRANSACTION or
  352. * a bcATTEMPT_ACQUIRE) is no longer with us. No parameters.
  353. */
  354. BR_TRANSACTION_COMPLETE = _IO('r', 6),
  355. /*
  356. * No parameters... always refers to the last transaction requested
  357. * (including replies). Note that this will be sent even for
  358. * asynchronous transactions.
  359. */
  360. BR_INCREFS = _IOR('r', 7, struct binder_ptr_cookie),
  361. BR_ACQUIRE = _IOR('r', 8, struct binder_ptr_cookie),
  362. BR_RELEASE = _IOR('r', 9, struct binder_ptr_cookie),
  363. BR_DECREFS = _IOR('r', 10, struct binder_ptr_cookie),
  364. /*
  365. * void *: ptr to binder
  366. * void *: cookie for binder
  367. */
  368. BR_ATTEMPT_ACQUIRE = _IOR('r', 11, struct binder_pri_ptr_cookie),
  369. /*
  370. * not currently supported
  371. * int: priority
  372. * void *: ptr to binder
  373. * void *: cookie for binder
  374. */
  375. BR_NOOP = _IO('r', 12),
  376. /*
  377. * No parameters. Do nothing and examine the next command. It exists
  378. * primarily so that we can replace it with a BR_SPAWN_LOOPER command.
  379. */
  380. BR_SPAWN_LOOPER = _IO('r', 13),
  381. /*
  382. * No parameters. The driver has determined that a process has no
  383. * threads waiting to service incoming transactions. When a process
  384. * receives this command, it must spawn a new service thread and
  385. * register it via bcENTER_LOOPER.
  386. */
  387. BR_FINISHED = _IO('r', 14),
  388. /*
  389. * not currently supported
  390. * stop threadpool thread
  391. */
  392. BR_DEAD_BINDER = _IOR('r', 15, binder_uintptr_t),
  393. /*
  394. * void *: cookie
  395. */
  396. BR_CLEAR_DEATH_NOTIFICATION_DONE = _IOR('r', 16, binder_uintptr_t),
  397. /*
  398. * void *: cookie
  399. */
  400. BR_FAILED_REPLY = _IO('r', 17),
  401. /*
  402. * The last transaction (either a bcTRANSACTION or
  403. * a bcATTEMPT_ACQUIRE) failed (e.g. out of memory). No parameters.
  404. */
  405. BR_FROZEN_REPLY = _IO('r', 18),
  406. /*
  407. * The target of the last sync transaction (either a bcTRANSACTION or
  408. * a bcATTEMPT_ACQUIRE) is frozen. No parameters.
  409. */
  410. BR_ONEWAY_SPAM_SUSPECT = _IO('r', 19),
  411. /*
  412. * Current process sent too many oneway calls to target, and the last
  413. * asynchronous transaction makes the allocated async buffer size exceed
  414. * detection threshold. No parameters.
  415. */
  416. BR_TRANSACTION_PENDING_FROZEN = _IO('r', 20),
  417. /*
  418. * The target of the last async transaction is frozen. No parameters.
  419. */
  420. BR_FROZEN_BINDER = _IOR('r', 21, struct binder_frozen_state_info),
  421. /*
  422. * The cookie and a boolean (is_frozen) that indicates whether the process
  423. * transitioned into a frozen or an unfrozen state.
  424. */
  425. BR_CLEAR_FREEZE_NOTIFICATION_DONE = _IOR('r', 22, binder_uintptr_t),
  426. /*
  427. * void *: cookie
  428. */
  429. };
  430. enum binder_driver_command_protocol {
  431. BC_TRANSACTION = _IOW('c', 0, struct binder_transaction_data),
  432. BC_REPLY = _IOW('c', 1, struct binder_transaction_data),
  433. /*
  434. * binder_transaction_data: the sent command.
  435. */
  436. BC_ACQUIRE_RESULT = _IOW('c', 2, __s32),
  437. /*
  438. * not currently supported
  439. * int: 0 if the last BR_ATTEMPT_ACQUIRE was not successful.
  440. * Else you have acquired a primary reference on the object.
  441. */
  442. BC_FREE_BUFFER = _IOW('c', 3, binder_uintptr_t),
  443. /*
  444. * void *: ptr to transaction data received on a read
  445. */
  446. BC_INCREFS = _IOW('c', 4, __u32),
  447. BC_ACQUIRE = _IOW('c', 5, __u32),
  448. BC_RELEASE = _IOW('c', 6, __u32),
  449. BC_DECREFS = _IOW('c', 7, __u32),
  450. /*
  451. * int: descriptor
  452. */
  453. BC_INCREFS_DONE = _IOW('c', 8, struct binder_ptr_cookie),
  454. BC_ACQUIRE_DONE = _IOW('c', 9, struct binder_ptr_cookie),
  455. /*
  456. * void *: ptr to binder
  457. * void *: cookie for binder
  458. */
  459. BC_ATTEMPT_ACQUIRE = _IOW('c', 10, struct binder_pri_desc),
  460. /*
  461. * not currently supported
  462. * int: priority
  463. * int: descriptor
  464. */
  465. BC_REGISTER_LOOPER = _IO('c', 11),
  466. /*
  467. * No parameters.
  468. * Register a spawned looper thread with the device.
  469. */
  470. BC_ENTER_LOOPER = _IO('c', 12),
  471. BC_EXIT_LOOPER = _IO('c', 13),
  472. /*
  473. * No parameters.
  474. * These two commands are sent as an application-level thread
  475. * enters and exits the binder loop, respectively. They are
  476. * used so the binder can have an accurate count of the number
  477. * of looping threads it has available.
  478. */
  479. BC_REQUEST_DEATH_NOTIFICATION = _IOW('c', 14,
  480. struct binder_handle_cookie),
  481. /*
  482. * int: handle
  483. * void *: cookie
  484. */
  485. BC_CLEAR_DEATH_NOTIFICATION = _IOW('c', 15,
  486. struct binder_handle_cookie),
  487. /*
  488. * int: handle
  489. * void *: cookie
  490. */
  491. BC_DEAD_BINDER_DONE = _IOW('c', 16, binder_uintptr_t),
  492. /*
  493. * void *: cookie
  494. */
  495. BC_TRANSACTION_SG = _IOW('c', 17, struct binder_transaction_data_sg),
  496. BC_REPLY_SG = _IOW('c', 18, struct binder_transaction_data_sg),
  497. /*
  498. * binder_transaction_data_sg: the sent command.
  499. */
  500. BC_REQUEST_FREEZE_NOTIFICATION =
  501. _IOW('c', 19, struct binder_handle_cookie),
  502. /*
  503. * int: handle
  504. * void *: cookie
  505. */
  506. BC_CLEAR_FREEZE_NOTIFICATION = _IOW('c', 20,
  507. struct binder_handle_cookie),
  508. /*
  509. * int: handle
  510. * void *: cookie
  511. */
  512. BC_FREEZE_NOTIFICATION_DONE = _IOW('c', 21, binder_uintptr_t),
  513. /*
  514. * void *: cookie
  515. */
  516. };
  517. #endif /* _LINUX_BINDER_H */