ioctls/binder.c

   1 #include <inttypes.h>
   2 #include <stdlib.h>
   3 #include <linux/ioctl.h>
   4
   5 #define __user
   6 /* drivers/staging/android/binder.h */
   7 /*
   8  * Copyright (C) 2008 Google, Inc.
   9  *
  10  * Based on, but no longer compatible with, the original
  11  * OpenBinder.org binder driver interface, which is:
  12  *
  13  * Copyright (c) 2005 Palmsource, Inc.
  14  *
  15  * This software is licensed under the terms of the GNU General Public
  16  * License version 2, as published by the Free Software Foundation, and
  17  * may be copied, distributed, and modified under those terms.
  18  *
  19  * This program is distributed in the hope that it will be useful,
  20  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22  * GNU General Public License for more details.
  23  *
  24  */
  25
  26 #define B_PACK_CHARS(c1, c2, c3, c4) \
  27         ((((c1)<<24)) | (((c2)<<16)) | (((c3)<<8)) | (c4))
  28 #define B_TYPE_LARGE 0x85
  29
  30 enum {
  31         BINDER_TYPE_BINDER      = B_PACK_CHARS('s', 'b', '*', B_TYPE_LARGE),
  32         BINDER_TYPE_WEAK_BINDER = B_PACK_CHARS('w', 'b', '*', B_TYPE_LARGE),
  33         BINDER_TYPE_HANDLE      = B_PACK_CHARS('s', 'h', '*', B_TYPE_LARGE),
  34         BINDER_TYPE_WEAK_HANDLE = B_PACK_CHARS('w', 'h', '*', B_TYPE_LARGE),
  35         BINDER_TYPE_FD          = B_PACK_CHARS('f', 'd', '*', B_TYPE_LARGE),
  36 };
  37
  38 enum {
  39         FLAT_BINDER_FLAG_PRIORITY_MASK = 0xff,
  40         FLAT_BINDER_FLAG_ACCEPTS_FDS = 0x100,
  41 };
  42
  43 /*
  44  * This is the flattened representation of a Binder object for transfer
  45  * between processes.  The 'offsets' supplied as part of a binder transaction
  46  * contains offsets into the data where these structures occur.  The Binder
  47  * driver takes care of re-writing the structure type and data as it moves
  48  * between processes.
  49  */
  50 struct flat_binder_object {
  51         /* 8 bytes for large_flat_header. */
  52         unsigned long           type;
  53         unsigned long           flags;
  54
  55         /* 8 bytes of data. */
  56         union {
  57                 void __user     *binder;        /* local object */
  58                 signed long     handle;         /* remote object */
  59         };
  60
  61         /* extra data associated with local object */
  62         void __user             *cookie;
  63 };
  64
  65 /*
  66  * On 64-bit platforms where user code may run in 32-bits the driver must
  67  * translate the buffer (and local binder) addresses appropriately.
  68  */
  69
  70 struct binder_write_read {
  71         signed long     write_size;     /* bytes to write */
  72         signed long     write_consumed; /* bytes consumed by driver */
  73         unsigned long   write_buffer;
  74         signed long     read_size;      /* bytes to read */
  75         signed long     read_consumed;  /* bytes consumed by driver */
  76         unsigned long   read_buffer;
  77 };
  78
  79 /* Use with BINDER_VERSION, driver fills in fields. */
  80 struct binder_version {
  81         /* driver protocol version -- increment with incompatible change */
  82         signed long     protocol_version;
  83 };
  84
  85 /* This is the current protocol version. */
  86 #define BINDER_CURRENT_PROTOCOL_VERSION 7
  87
  88 #define BINDER_WRITE_READ               _IOWR('b', 1, struct binder_write_read)
  89 #define BINDER_SET_IDLE_TIMEOUT         _IOW('b', 3, int64_t)
  90 #define BINDER_SET_MAX_THREADS          _IOW('b', 5, size_t)
  91 #define BINDER_SET_IDLE_PRIORITY        _IOW('b', 6, int)
  92 #define BINDER_SET_CONTEXT_MGR          _IOW('b', 7, int)
  93 #define BINDER_THREAD_EXIT              _IOW('b', 8, int)
  94 #define BINDER_VERSION                  _IOWR('b', 9, struct binder_version)
  95
  96 /*
  97  * NOTE: Two special error codes you should check for when calling
  98  * in to the driver are:
  99  *
 100  * EINTR -- The operation has been interupted.  This should be
 101  * handled by retrying the ioctl() until a different error code
 102  * is returned.
 103  *
 104  * ECONNREFUSED -- The driver is no longer accepting operations
 105  * from your process.  That is, the process is being destroyed.
 106  * You should handle this by exiting from your process.  Note
 107  * that once this error code is returned, all further calls to
 108  * the driver from any thread will return this same code.
 109  */
 110
 111 enum transaction_flags {
 112         TF_ONE_WAY      = 0x01, /* this is a one-way call: async, no return */
 113         TF_ROOT_OBJECT  = 0x04, /* contents are the component's root object */
 114         TF_STATUS_CODE  = 0x08, /* contents are a 32-bit status code */
 115         TF_ACCEPT_FDS   = 0x10, /* allow replies with file descriptors */
 116 };
 117
 118 struct binder_transaction_data {
 119         /* The first two are only used for bcTRANSACTION and brTRANSACTION,
 120          * identifying the target and contents of the transaction.
 121          */
 122         union {
 123                 size_t  handle; /* target descriptor of command transaction */
 124                 void    *ptr;   /* target descriptor of return transaction */
 125         } target;
 126         void            *cookie;        /* target object cookie */
 127         unsigned int    code;           /* transaction command */
 128
 129         /* General information about the transaction. */
 130         unsigned int    flags;
 131         pid_t           sender_pid;
 132         uid_t           sender_euid;
 133         size_t          data_size;      /* number of bytes of data */
 134         size_t          offsets_size;   /* number of bytes of offsets */
 135
 136         /* If this transaction is inline, the data immediately
 137          * follows here; otherwise, it ends with a pointer to
 138          * the data buffer.
 139          */
 140         union {
 141                 struct {
 142                         /* transaction data */
 143                         const void __user       *buffer;
 144                         /* offsets from buffer to flat_binder_object structs */
 145                         const void __user       *offsets;
 146                 } ptr;
 147                 uint8_t buf[8];
 148         } data;
 149 };
 150
 151 struct binder_ptr_cookie {
 152         void *ptr;
 153         void *cookie;
 154 };
 155
 156 struct binder_pri_desc {
 157         int priority;
 158         int desc;
 159 };
 160
 161 struct binder_pri_ptr_cookie {
 162         int priority;
 163         void *ptr;
 164         void *cookie;
 165 };
 166
 167 enum BinderDriverReturnProtocol {
 168         BR_ERROR = _IOR('r', 0, int),
 169         /*
 170          * int: error code
 171          */
 172
 173         BR_OK = _IO('r', 1),
 174         /* No parameters! */
 175
 176         BR_TRANSACTION = _IOR('r', 2, struct binder_transaction_data),
 177         BR_REPLY = _IOR('r', 3, struct binder_transaction_data),
 178         /*
 179          * binder_transaction_data: the received command.
 180          */
 181
 182         BR_ACQUIRE_RESULT = _IOR('r', 4, int),
 183         /*
 184          * not currently supported
 185          * int: 0 if the last bcATTEMPT_ACQUIRE was not successful.
 186          * Else the remote object has acquired a primary reference.
 187          */
 188
 189         BR_DEAD_REPLY = _IO('r', 5),
 190         /*
 191          * The target of the last transaction (either a bcTRANSACTION or
 192          * a bcATTEMPT_ACQUIRE) is no longer with us.  No parameters.
 193          */
 194
 195         BR_TRANSACTION_COMPLETE = _IO('r', 6),
 196         /*
 197          * No parameters... always refers to the last transaction requested
 198          * (including replies).  Note that this will be sent even for
 199          * asynchronous transactions.
 200          */
 201
 202         BR_INCREFS = _IOR('r', 7, struct binder_ptr_cookie),
 203         BR_ACQUIRE = _IOR('r', 8, struct binder_ptr_cookie),
 204         BR_RELEASE = _IOR('r', 9, struct binder_ptr_cookie),
 205         BR_DECREFS = _IOR('r', 10, struct binder_ptr_cookie),
 206         /*
 207          * void *:      ptr to binder
 208          * void *: cookie for binder
 209          */
 210
 211         BR_ATTEMPT_ACQUIRE = _IOR('r', 11, struct binder_pri_ptr_cookie),
 212         /*
 213          * not currently supported
 214          * int: priority
 215          * void *: ptr to binder
 216          * void *: cookie for binder
 217          */
 218
 219         BR_NOOP = _IO('r', 12),
 220         /*
 221          * No parameters.  Do nothing and examine the next command.  It exists
 222          * primarily so that we can replace it with a BR_SPAWN_LOOPER command.
 223          */
 224
 225         BR_SPAWN_LOOPER = _IO('r', 13),
 226         /*
 227          * No parameters.  The driver has determined that a process has no
 228          * threads waiting to service incomming transactions.  When a process
 229          * receives this command, it must spawn a new service thread and
 230          * register it via bcENTER_LOOPER.
 231          */
 232
 233         BR_FINISHED = _IO('r', 14),
 234         /*
 235          * not currently supported
 236          * stop threadpool thread
 237          */
 238
 239         BR_DEAD_BINDER = _IOR('r', 15, void *),
 240         /*
 241          * void *: cookie
 242          */
 243         BR_CLEAR_DEATH_NOTIFICATION_DONE = _IOR('r', 16, void *),
 244         /*
 245          * void *: cookie
 246          */
 247
 248         BR_FAILED_REPLY = _IO('r', 17),
 249         /*
 250          * The the last transaction (either a bcTRANSACTION or
 251          * a bcATTEMPT_ACQUIRE) failed (e.g. out of memory).  No parameters.
 252          */
 253 };
 254
 255 enum BinderDriverCommandProtocol {
 256         BC_TRANSACTION = _IOW('c', 0, struct binder_transaction_data),
 257         BC_REPLY = _IOW('c', 1, struct binder_transaction_data),
 258         /*
 259          * binder_transaction_data: the sent command.
 260          */
 261
 262         BC_ACQUIRE_RESULT = _IOW('c', 2, int),
 263         /*
 264          * not currently supported
 265          * int:  0 if the last BR_ATTEMPT_ACQUIRE was not successful.
 266          * Else you have acquired a primary reference on the object.
 267          */
 268
 269         BC_FREE_BUFFER = _IOW('c', 3, int),
 270         /*
 271          * void *: ptr to transaction data received on a read
 272          */
 273
 274         BC_INCREFS = _IOW('c', 4, int),
 275         BC_ACQUIRE = _IOW('c', 5, int),
 276         BC_RELEASE = _IOW('c', 6, int),
 277         BC_DECREFS = _IOW('c', 7, int),
 278         /*
 279          * int: descriptor
 280          */
 281
 282         BC_INCREFS_DONE = _IOW('c', 8, struct binder_ptr_cookie),
 283         BC_ACQUIRE_DONE = _IOW('c', 9, struct binder_ptr_cookie),
 284         /*
 285          * void *: ptr to binder
 286          * void *: cookie for binder
 287          */
 288
 289         BC_ATTEMPT_ACQUIRE = _IOW('c', 10, struct binder_pri_desc),
 290         /*
 291          * not currently supported
 292          * int: priority
 293          * int: descriptor
 294          */
 295
 296         BC_REGISTER_LOOPER = _IO('c', 11),
 297         /*
 298          * No parameters.
 299          * Register a spawned looper thread with the device.
 300          */
 301
 302         BC_ENTER_LOOPER = _IO('c', 12),
 303         BC_EXIT_LOOPER = _IO('c', 13),
 304         /*
 305          * No parameters.
 306          * These two commands are sent as an application-level thread
 307          * enters and exits the binder loop, respectively.  They are
 308          * used so the binder can have an accurate count of the number
 309          * of looping threads it has available.
 310          */
 311
 312         BC_REQUEST_DEATH_NOTIFICATION = _IOW('c', 14, struct binder_ptr_cookie),
 313         /*
 314          * void *: ptr to binder
 315          * void *: cookie
 316          */
 317
 318         BC_CLEAR_DEATH_NOTIFICATION = _IOW('c', 15, struct binder_ptr_cookie),
 319         /*
 320          * void *: ptr to binder
 321          * void *: cookie
 322          */
 323
 324         BC_DEAD_BINDER_DONE = _IOW('c', 16, void *),
 325         /*
 326          * void *: cookie
 327          */
 328 };
 329
 330 #include "shm.h"
 331 #include "utils.h"
 332 #include "ioctls.h"
 333
 334 static const struct ioctl binder_ioctls[] = {
 335         IOCTL(BINDER_WRITE_READ),
 336         IOCTL(BINDER_SET_IDLE_TIMEOUT),
 337         IOCTL(BINDER_SET_MAX_THREADS),
 338         IOCTL(BINDER_SET_IDLE_PRIORITY),
 339         IOCTL(BINDER_SET_CONTEXT_MGR),
 340         IOCTL(BINDER_THREAD_EXIT),
 341         IOCTL(BINDER_VERSION),
 342
 343         IOCTL(BR_ERROR),
 344         IOCTL(BR_OK),
 345         IOCTL(BR_TRANSACTION),
 346         IOCTL(BR_REPLY),
 347         IOCTL(BR_ACQUIRE_RESULT),
 348         IOCTL(BR_DEAD_REPLY),
 349         IOCTL(BR_TRANSACTION_COMPLETE),
 350         IOCTL(BR_INCREFS),
 351         IOCTL(BR_ACQUIRE),
 352         IOCTL(BR_RELEASE),
 353         IOCTL(BR_DECREFS),
 354         IOCTL(BR_ATTEMPT_ACQUIRE),
 355         IOCTL(BR_NOOP),
 356         IOCTL(BR_SPAWN_LOOPER),
 357         IOCTL(BR_FINISHED),
 358         IOCTL(BR_DEAD_BINDER),
 359         IOCTL(BR_CLEAR_DEATH_NOTIFICATION_DONE),
 360         IOCTL(BR_FAILED_REPLY),
 361
 362         IOCTL(BC_TRANSACTION),
 363         IOCTL(BC_REPLY),
 364         IOCTL(BC_ACQUIRE_RESULT),
 365         IOCTL(BC_FREE_BUFFER),
 366         IOCTL(BC_INCREFS),
 367         IOCTL(BC_ACQUIRE),
 368         IOCTL(BC_RELEASE),
 369         IOCTL(BC_DECREFS),
 370         IOCTL(BC_INCREFS_DONE),
 371         IOCTL(BC_ACQUIRE_DONE),
 372         IOCTL(BC_ATTEMPT_ACQUIRE),
 373         IOCTL(BC_REGISTER_LOOPER),
 374         IOCTL(BC_ENTER_LOOPER),
 375         IOCTL(BC_EXIT_LOOPER),
 376         IOCTL(BC_REQUEST_DEATH_NOTIFICATION),
 377         IOCTL(BC_CLEAR_DEATH_NOTIFICATION),
 378         IOCTL(BC_DEAD_BINDER_DONE),
 379 };
 380
 381 static const char *const binder_miscdevs[] = {
 382         "binder",
 383 };
 384
 385 static const struct ioctl_group binder_grp = {
 386         .devtype = DEV_MISC,
 387         .devs = binder_miscdevs,
 388         .devs_cnt = ARRAY_SIZE(binder_miscdevs),
 389         .sanitise = pick_random_ioctl,
 390         .ioctls = binder_ioctls,
 391         .ioctls_cnt = ARRAY_SIZE(binder_ioctls),
 392 };
 393
 394 REG_IOCTL_GROUP(binder_grp)