diff --git a/Documentation/ABI/testing/debugfs-iio-ad9910 b/Documentation/ABI/testing/debugfs-iio-ad9910
new file mode 100644
index 000000000000..7083a20d5a40
--- /dev/null
+++ b/Documentation/ABI/testing/debugfs-iio-ad9910
@@ -0,0 +1,23 @@
+What: /sys/kernel/debug/iio/iio:deviceX/frequency_source
+KernelVersion: 7.3
+Contact: linux-iio@vger.kernel.org
+Description:
+ Read-only. Reports the channel label that is read from the
+
_[Y]_label attribute, which corresponds to the on-chip
+ signal generator that is currently driving the output frequency.
+
+What: /sys/kernel/debug/iio/iio:deviceX/phase_source
+KernelVersion: 7.3
+Contact: linux-iio@vger.kernel.org
+Description:
+ Read-only. Reports the channel label that is read from the
+ _[Y]_label attribute, which corresponds to the on-chip
+ signal generator that is currently driving the output phase.
+
+What: /sys/kernel/debug/iio/iio:deviceX/amplitude_source
+KernelVersion: 7.3
+Contact: linux-iio@vger.kernel.org
+Description:
+ Read-only. Reports the channel label that is read from the
+ _[Y]_label attribute, which corresponds to the on-chip
+ signal generator that is currently driving the output amplitude.
diff --git a/Documentation/ABI/testing/debugfs-iio-backend b/Documentation/ABI/testing/debugfs-iio-backend
index 01ab94469432..2a2f2e5508c0 100644
--- a/Documentation/ABI/testing/debugfs-iio-backend
+++ b/Documentation/ABI/testing/debugfs-iio-backend
@@ -8,13 +8,13 @@ What: /sys/kernel/debug/iio/iio:deviceX/backendY/direct_reg_access
KernelVersion: 6.11
Contact: linux-iio@vger.kernel.org
Description:
- Directly access the registers of backend Y. Typical usage is:
+ Directly access the registers of backend Y. Typical usage is::
- Reading address 0x50
- echo 0x50 > direct_reg_access
- cat direct_reg_access
+ # Reading address 0x50
+ echo 0x50 > direct_reg_access
+ cat direct_reg_access
- Writing address 0x50
- echo 0x50 0x3 > direct_reg_access
- //readback address 0x50
- cat direct_reg_access
+ # Writing address 0x50
+ echo 0x50 0x3 > direct_reg_access
+ # readback address 0x50
+ cat direct_reg_access
diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio
index a4f5595722ad..2b6f57041763 100644
--- a/Documentation/ABI/testing/sysfs-bus-iio
+++ b/Documentation/ABI/testing/sysfs-bus-iio
@@ -442,6 +442,14 @@ What: /sys/bus/iio/devices/iio:deviceX/in_voltageY_i_offset
What: /sys/bus/iio/devices/iio:deviceX/in_voltageY_q_offset
What: /sys/bus/iio/devices/iio:deviceX/in_currentY_offset
What: /sys/bus/iio/devices/iio:deviceX/in_current_offset
+What: /sys/bus/iio/devices/iio:deviceX/in_phaseY_offset
+What: /sys/bus/iio/devices/iio:deviceX/in_phase_offset
+What: /sys/bus/iio/devices/iio:deviceX/out_phaseY_offset
+What: /sys/bus/iio/devices/iio:deviceX/out_phase_offset
+What: /sys/bus/iio/devices/iio:deviceX/in_frequencyY_offset
+What: /sys/bus/iio/devices/iio:deviceX/in_frequency_offset
+What: /sys/bus/iio/devices/iio:deviceX/out_frequencyY_offset
+What: /sys/bus/iio/devices/iio:deviceX/out_frequency_offset
What: /sys/bus/iio/devices/iio:deviceX/in_tempY_offset
What: /sys/bus/iio/devices/iio:deviceX/in_temp_offset
What: /sys/bus/iio/devices/iio:deviceX/in_pressureY_offset
@@ -475,10 +483,22 @@ What: /sys/bus/iio/devices/iio:deviceX/in_voltage_scale
What: /sys/bus/iio/devices/iio:deviceX/in_voltage-voltage_scale
What: /sys/bus/iio/devices/iio:deviceX/out_voltageY_scale
What: /sys/bus/iio/devices/iio:deviceX/out_altvoltageY_scale
+What: /sys/bus/iio/devices/iio:deviceX/in_phaseY_scale
+What: /sys/bus/iio/devices/iio:deviceX/in_phase_scale
+What: /sys/bus/iio/devices/iio:deviceX/out_phaseY_scale
+What: /sys/bus/iio/devices/iio:deviceX/out_phase_scale
+What: /sys/bus/iio/devices/iio:deviceX/in_frequencyY_scale
+What: /sys/bus/iio/devices/iio:deviceX/in_frequency_scale
+What: /sys/bus/iio/devices/iio:deviceX/out_frequencyY_scale
+What: /sys/bus/iio/devices/iio:deviceX/out_frequency_scale
What: /sys/bus/iio/devices/iio:deviceX/in_currentY_scale
What: /sys/bus/iio/devices/iio:deviceX/in_currentY_supply_scale
What: /sys/bus/iio/devices/iio:deviceX/in_current_scale
What: /sys/bus/iio/devices/iio:deviceX/in_current_q_scale
+What: /sys/bus/iio/devices/iio:deviceX/in_altcurrentY_scale
+What: /sys/bus/iio/devices/iio:deviceX/in_altcurrent_scale
+What: /sys/bus/iio/devices/iio:deviceX/out_altcurrentY_scale
+What: /sys/bus/iio/devices/iio:deviceX/out_altcurrent_scale
What: /sys/bus/iio/devices/iio:deviceX/in_accel_scale
What: /sys/bus/iio/devices/iio:deviceX/in_accel_peak_scale
What: /sys/bus/iio/devices/iio:deviceX/in_anglvel_scale
@@ -507,6 +527,7 @@ What: /sys/bus/iio/devices/iio:deviceX/in_intensity_z_scale
What: /sys/bus/iio/devices/iio:deviceX/in_intensity_red_scale
What: /sys/bus/iio/devices/iio:deviceX/in_intensity_green_scale
What: /sys/bus/iio/devices/iio:deviceX/in_intensity_blue_scale
+What: /sys/bus/iio/devices/iio:deviceX/in_intensity_clear_scale
What: /sys/bus/iio/devices/iio:deviceX/in_concentration_co2_scale
What: /sys/bus/iio/devices/iio:deviceX/in_volumeflow_scale
What: /sys/bus/iio/devices/iio:deviceX/in_volumeflowY_scale
@@ -762,6 +783,8 @@ What: /sys/bus/iio/devices/iio:deviceX/out_voltageY_powerdown_mode
What: /sys/bus/iio/devices/iio:deviceX/out_voltage_powerdown_mode
What: /sys/bus/iio/devices/iio:deviceX/out_altvoltageY_powerdown_mode
What: /sys/bus/iio/devices/iio:deviceX/out_altvoltage_powerdown_mode
+What: /sys/bus/iio/devices/iio:deviceX/out_currentY_powerdown_mode
+What: /sys/bus/iio/devices/iio:deviceX/out_current_powerdown_mode
KernelVersion: 2.6.38
Contact: linux-iio@vger.kernel.org
Description:
@@ -774,6 +797,7 @@ Description:
6kohm_to_gnd: connected to ground via a 6kOhm resistor,
7.7kohm_to_gnd: connected to ground via a 7.7kOhm resistor,
10kohm_to_gnd: connected to ground via a 10kOhm resistor,
+ 15kohm_to_gnd: connected to ground via a 15kOhm resistor,
16kohm_to_gnd: connected to ground via a 16kOhm resistor,
20kohm_to_gnd: connected to ground via a 20kOhm resistor,
32kohm_to_gnd: connected to ground via a 32kOhm resistor,
@@ -802,6 +826,10 @@ What: /sys/bus/iio/devices/iio:deviceX/out_voltageY_powerdown
What: /sys/bus/iio/devices/iio:deviceX/out_voltage_powerdown
What: /sys/bus/iio/devices/iio:deviceX/out_altvoltageY_powerdown
What: /sys/bus/iio/devices/iio:deviceX/out_altvoltage_powerdown
+What: /sys/bus/iio/devices/iio:deviceX/out_currentY_powerdown
+What: /sys/bus/iio/devices/iio:deviceX/out_current_powerdown
+What: /sys/bus/iio/devices/iio:deviceX/out_altcurrentY_powerdown
+What: /sys/bus/iio/devices/iio:deviceX/out_altcurrent_powerdown
KernelVersion: 2.6.38
Contact: linux-iio@vger.kernel.org
Description:
@@ -812,6 +840,7 @@ Description:
together.
What: /sys/bus/iio/devices/iio:deviceX/out_altvoltageY_frequency
+What: /sys/bus/iio/devices/iio:deviceX/out_altcurrentY_frequency
KernelVersion: 3.4.0
Contact: linux-iio@vger.kernel.org
Description:
@@ -838,8 +867,10 @@ Description:
all the other channels, since it involves changing the VCO
fundamental output frequency.
+What: /sys/bus/iio/devices/iio:deviceX/in_altcurrentY_phase
What: /sys/bus/iio/devices/iio:deviceX/in_altvoltageY_i_phase
What: /sys/bus/iio/devices/iio:deviceX/in_altvoltageY_q_phase
+What: /sys/bus/iio/devices/iio:deviceX/out_altcurrentY_phase
What: /sys/bus/iio/devices/iio:deviceX/out_altvoltageY_phase
What: /sys/bus/iio/devices/iio:deviceX/out_altvoltageY_i_phase
What: /sys/bus/iio/devices/iio:deviceX/out_altvoltageY_q_phase
@@ -853,6 +884,7 @@ Description:
channel.
What: /sys/bus/iio/devices/iio:deviceX/out_currentY_raw
+What: /sys/bus/iio/devices/iio:deviceX/out_altcurrentY_raw
Date: May 2012
KernelVersion: 3.5
Contact: Johan Hovold
@@ -1739,6 +1771,7 @@ Description:
What: /sys/bus/iio/devices/iio:deviceX/in_currentY_raw
What: /sys/bus/iio/devices/iio:deviceX/in_currentY_supply_raw
+What: /sys/bus/iio/devices/iio:deviceX/in_altcurrentY_raw
KernelVersion: 3.17
Contact: linux-iio@vger.kernel.org
Description:
@@ -2129,7 +2162,9 @@ Description:
Raw counter device counters direction for channel Y.
+What: /sys/bus/iio/devices/iio:deviceX/in_altcurrentY_label
What: /sys/bus/iio/devices/iio:deviceX/in_voltageY_label
+What: /sys/bus/iio/devices/iio:deviceX/out_altcurrentY_label
What: /sys/bus/iio/devices/iio:deviceX/out_voltageY_label
KernelVersion: 5.8
Contact: linux-iio@vger.kernel.org
@@ -2139,6 +2174,50 @@ Description:
specific attributes. This is useful for userspace to be able to
better identify an individual channel.
+What: /sys/bus/iio/devices/iio:deviceX/in_voltageY_parent
+What: /sys/bus/iio/devices/iio:deviceX/out_voltageY_parent
+What: /sys/bus/iio/devices/iio:deviceX/in_altvoltageY_parent
+What: /sys/bus/iio/devices/iio:deviceX/out_altvoltageY_parent
+What: /sys/bus/iio/devices/iio:deviceX/in_currentY_parent
+What: /sys/bus/iio/devices/iio:deviceX/out_currentY_parent
+What: /sys/bus/iio/devices/iio:deviceX/in_altcurrentY_parent
+What: /sys/bus/iio/devices/iio:deviceX/out_altcurrentY_parent
+KernelVersion: 7.3
+Contact: linux-iio@vger.kernel.org
+Description:
+ Read-only attribute containing the sysfs name prefix of the parent
+ channel for hierarchical channel relationships (e.g. "out_altvoltage0").
+ The prefix uniquely identifies the parent channel and can be used by
+ userspace to organize channels in tree-like structures that reflects
+ virtual or logical relationships between them.
+
+ For example, an IIO device may expose a primary output channel as
+ "out_voltage0" together with a set of profile-based or mode-based
+ subchannels used to configure or compose the output signal. These
+ subchannels may carry common attributes such as frequency, phase, etc.
+ They do not represent physical outputs, but rather logical/virtual
+ channels grouping configurations that affect the primary output.
+ Each subchannel exposes a _[Y]_parent attribute reading
+ "out_voltage0", allowing userspace to group controls under the output
+ channel they belong to rather than treating them as unrelated top-level
+ channels.
+
+What: /sys/bus/iio/devices/iio:deviceX/in_frequencyY_raw
+KernelVersion: 7.3
+Contact: linux-iio@vger.kernel.org
+Description:
+ Raw (unscaled) frequency reading from channel Y.
+ Units after application of scale and offset are Hz.
+
+What: /sys/bus/iio/devices/iio:deviceX/out_frequencyY_raw
+KernelVersion: 7.3
+Contact: linux-iio@vger.kernel.org
+Description:
+ Raw (unscaled, no bias etc.) output frequency for channel Y.
+ The number must always be specified and unique if the output
+ corresponds to a single channel. Units after application of
+ scale and offset are Hz.
+
What: /sys/bus/iio/devices/iio:deviceX/in_phaseY_raw
KernelVersion: 4.18
Contact: linux-iio@vger.kernel.org
@@ -2146,6 +2225,15 @@ Description:
Raw (unscaled) phase difference reading from channel Y.
Units after application of scale and offset are radians.
+What: /sys/bus/iio/devices/iio:deviceX/out_phaseY_raw
+KernelVersion: 7.3
+Contact: linux-iio@vger.kernel.org
+Description:
+ Raw (unscaled, no bias etc.) output phase for channel Y.
+ The number must always be specified and unique if the output
+ corresponds to a single channel. Units after application of
+ scale and offset are radians.
+
What: /sys/bus/iio/devices/iio:deviceX/in_massconcentration_pm1_input
What: /sys/bus/iio/devices/iio:deviceX/in_massconcentrationY_pm1_input
What: /sys/bus/iio/devices/iio:deviceX/in_massconcentration_pm2p5_input
@@ -2380,6 +2468,7 @@ Description:
* "sinc4+lp" - Sinc4 + Low Pass Filter.
* "sinc4+sinc1" - Sinc4 + averaging by 8. Low 1st conversion
time.
+ * "sinc4+sinc1+pf1" - Sinc4 + Sinc1 + device specific Post Filter 1.
* "sinc4+rej60" - Sinc4 + 60Hz rejection.
* "sinc5" - The digital sinc5 filter. Excellent noise
performance
@@ -2401,6 +2490,32 @@ Description:
Specifies which filter type apply to the channel. The possible
values are given by the filter_type_available attribute.
+What: /sys/bus/iio/devices/iio:deviceX/in_resistanceY_settlingtime
+What: /sys/bus/iio/devices/iio:deviceX/in_tempY_settlingtime
+What: /sys/bus/iio/devices/iio:deviceX/in_voltageY_settlingtime
+What: /sys/bus/iio/devices/iio:deviceX/in_voltageY-voltageZ_settlingtime
+KernelVersion: 7.4
+Contact: linux-iio@vger.kernel.org
+Description:
+ Set/read total settling time in seconds for a device to settle
+ after starting the first conversion after any settings have
+ changed. The data for the conversion is outputted at the end of
+ this time.
+
+ Depending on the device and how it is used, this settling time
+ may apply to more than just the first conversion, e.g. to every
+ conversion in a single-shot conversion mode or when a device
+ setting changes after each conversion (input chopping).
+
+What: /sys/bus/iio/devices/iio:deviceX/in_resistanceY_settlingtime_available
+What: /sys/bus/iio/devices/iio:deviceX/in_tempY_settlingtime_available
+What: /sys/bus/iio/devices/iio:deviceX/in_voltageY_settlingtime_available
+What: /sys/bus/iio/devices/iio:deviceX/in_voltageY-voltageZ_settlingtime_available
+KernelVersion: 7.4
+Contact: linux-iio@vger.kernel.org
+Description:
+ Available settlingtime values in IIO range or list format.
+
What: /sys/.../events/in_proximity_thresh_either_runningperiod
KernelVersion: 6.6
Contact: linux-iio@vger.kernel.org
diff --git a/Documentation/ABI/testing/sysfs-bus-iio-adc b/Documentation/ABI/testing/sysfs-bus-iio-adc
new file mode 100644
index 000000000000..e1309b371efb
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-bus-iio-adc
@@ -0,0 +1,9 @@
+What: /sys/bus/iio/devices/iio:deviceX/in_resistanceY_burnoutraw
+What: /sys/bus/iio/devices/iio:deviceX/in_voltageY_burnoutraw
+What: /sys/bus/iio/devices/iio:deviceX/in_voltageY-voltageZ_burnoutraw
+KernelVersion: 7.4
+Contact: linux-iio@vger.kernel.org
+Description:
+ Raw value from channel Y read using a single conversion with
+ the channel burnout current enabled. This is typically used
+ for diagnostic purposes to detect an open or shorted input.
diff --git a/Documentation/ABI/testing/sysfs-bus-iio-frequency-ad9910 b/Documentation/ABI/testing/sysfs-bus-iio-frequency-ad9910
new file mode 100644
index 000000000000..4e25f538af4a
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-bus-iio-frequency-ad9910
@@ -0,0 +1,31 @@
+What: /sys/bus/iio/devices/iio:deviceX/out_altcurrentY_dwell_en
+What: /sys/bus/iio/devices/iio:deviceX/out_frequencyY_dwell_en
+What: /sys/bus/iio/devices/iio:deviceX/out_phaseY_dwell_en
+KernelVersion: 7.3
+Contact: linux-iio@vger.kernel.org
+Description:
+ For a channel that produces parametric sweeps, this attribute controls
+ the sweep behavior at the configured limit. It enables dwell mode at a
+ sweep limit when set to 1, i.e., after the sweep is complete the output
+ value stays at the limit. Otherwise (setting this value to 0), the sweep
+ may stop or restart from the initial position, or even continue by
+ reversing the sweep direction.
+
+What: /sys/bus/iio/devices/iio:deviceX/out_altcurrentY_raw_roc
+What: /sys/bus/iio/devices/iio:deviceX/out_frequencyY_raw_roc
+What: /sys/bus/iio/devices/iio:deviceX/out_phaseY_raw_roc
+KernelVersion: 7.3
+Contact: linux-iio@vger.kernel.org
+Description:
+ For a channel that produces parametric sweeps, this attribute controls
+ the rate of change of the parameter in raw units per second (slope).
+ This value may be influenced by the channel sampling_frequency attribute
+ if available. Multiplying this value by the scale attribute of the
+ channel yields the rate of change in physical units per second.
+
+What: /sys/bus/iio/devices/iio:deviceX/out_altcurrentY_raw_roc_available
+KernelVersion: 7.3
+Contact: linux-iio@vger.kernel.org
+Description:
+ Lists the available roc values for the channel. Values are
+ space-separated in ascending order.
diff --git a/Documentation/ABI/testing/sysfs-bus-mhi-devices-loopback b/Documentation/ABI/testing/sysfs-bus-mhi-devices-loopback
new file mode 100644
index 000000000000..5435e65ef056
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-bus-mhi-devices-loopback
@@ -0,0 +1,49 @@
+What: /sys/bus/mhi/devices/mhi_LOOPBACK/tre_size
+Date: August 2026
+KernelVersion: 7.4
+Contact: mhi@lists.linux.dev
+Description:
+ (RW) Size of each Transfer Ring Element (TRE) buffer in bytes
+ used for the loopback test. Valid range is 1 to the value
+ reported by max_tre_size. Default value is 32 bytes.
+
+What: /sys/bus/mhi/devices/mhi_LOOPBACK/max_tre_size
+Date: August 2026
+KernelVersion: 7.4
+Contact: mhi@lists.linux.dev
+Description:
+ (RO) Maximum allowed Transfer Ring Element (TRE) size in bytes.
+ Reading this file returns the upper bound for the tre_size
+ attribute.
+
+What: /sys/bus/mhi/devices/mhi_LOOPBACK/num_tre
+Date: August 2026
+KernelVersion: 7.4
+Contact: mhi@lists.linux.dev
+Description:
+ (RW) Number of Transfer Ring Elements (TREs) to use per
+ loopback test. Must be greater than zero and must not exceed
+ the value reported by max_num_tre. Default value is 1.
+
+What: /sys/bus/mhi/devices/mhi_LOOPBACK/max_num_tre
+Date: August 2026
+KernelVersion: 7.4
+Contact: mhi@lists.linux.dev
+Description:
+ (RO) Maximum number of Transfer Ring Elements (TREs) currently
+ available on the channel ring. Reading this file returns the
+ upper bound for the num_tre attribute.
+
+What: /sys/bus/mhi/devices/mhi_LOOPBACK/start
+Date: August 2026
+KernelVersion: 7.4
+Contact: mhi@lists.linux.dev
+Description:
+ (WO) Write any value to trigger a loopback test. The driver
+ sends random data to the endpoint using the configured tre_size
+ and num_tre parameters, waits for the endpoint to echo it back,
+ and verifies the received data matches what was sent.
+
+ This is a blocking write that returns when the test completes
+ or times out after 5 seconds. The write returns an error code
+ if the test fails or times out.
diff --git a/Documentation/devicetree/bindings/iio/accel/adi,adis16201.yaml b/Documentation/devicetree/bindings/iio/accel/adi,adis16201.yaml
index b6ba7ad1a8d5..3ce5fb1be574 100644
--- a/Documentation/devicetree/bindings/iio/accel/adi,adis16201.yaml
+++ b/Documentation/devicetree/bindings/iio/accel/adi,adis16201.yaml
@@ -4,21 +4,23 @@
$id: http://devicetree.org/schemas/iio/accel/adi,adis16201.yaml#
$schema: http://devicetree.org/meta-schemas/core.yaml#
-title: ADIS16201 Dual Axis Inclinometer and similar
+title: ADIS16201 Inclinometer and similar
maintainers:
- Jonathan Cameron
description: |
- Two similar parts from external interface point of view.
+ Three similar parts from external interface point of view.
SPI interface.
https://www.analog.com/en/products/adis16201.html
+ https://www.analog.com/en/products/adis16203.html
https://www.analog.com/en/products/adis16209.html
properties:
compatible:
enum:
- adi,adis16201
+ - adi,adis16203
- adi,adis16209
reg:
diff --git a/Documentation/devicetree/bindings/iio/accel/adi,adxl367.yaml b/Documentation/devicetree/bindings/iio/accel/adi,adxl367.yaml
index f10d98d34cb8..115170eac058 100644
--- a/Documentation/devicetree/bindings/iio/accel/adi,adxl367.yaml
+++ b/Documentation/devicetree/bindings/iio/accel/adi,adxl367.yaml
@@ -7,7 +7,7 @@ $schema: http://devicetree.org/meta-schemas/core.yaml#
title: Analog Devices ADXL367 3-Axis Digital Accelerometer
maintainers:
- - Cosmin Tanislav
+ - Antoniu Miclaus
description: |
The ADXL367 is an ultralow power, 3-axis MEMS accelerometer.
@@ -33,7 +33,14 @@ properties:
maxItems: 1
interrupts:
- maxItems: 1
+ minItems: 1
+ maxItems: 2
+
+ interrupt-names:
+ minItems: 1
+ items:
+ - enum: [INT1, INT2]
+ - const: INT2
vdd-supply: true
vddio-supply: true
@@ -61,6 +68,7 @@ examples:
reg = <0x53>;
interrupt-parent = <&gpio>;
interrupts = <25 IRQ_TYPE_EDGE_RISING>;
+ interrupt-names = "INT1";
};
};
- |
@@ -76,5 +84,6 @@ examples:
spi-max-frequency = <1000000>;
interrupt-parent = <&gpio>;
interrupts = <25 IRQ_TYPE_EDGE_RISING>;
+ interrupt-names = "INT1";
};
};
diff --git a/Documentation/devicetree/bindings/iio/adc/adi,ad4080.yaml b/Documentation/devicetree/bindings/iio/adc/adi,ad4080.yaml
index db8467b98e67..c8ac92e6f8e1 100644
--- a/Documentation/devicetree/bindings/iio/adc/adi,ad4080.yaml
+++ b/Documentation/devicetree/bindings/iio/adc/adi,ad4080.yaml
@@ -41,6 +41,7 @@ properties:
- adi,ad4880
- adi,ad4883
- adi,ad4884
+ - adi,ad4885
reg:
minItems: 1
@@ -105,6 +106,7 @@ allOf:
- adi,ad4880
- adi,ad4883
- adi,ad4884
+ - adi,ad4885
then:
properties:
reg:
@@ -127,15 +129,15 @@ examples:
#size-cells = <0>;
adc@0 {
- compatible = "adi,ad4080";
- reg = <0>;
- spi-max-frequency = <10000000>;
- vdd33-supply = <&vdd33>;
- vddldo-supply = <&vddldo>;
- vrefin-supply = <&vrefin>;
- clocks = <&cnv>;
- clock-names = "cnv";
- io-backends = <&iio_backend>;
+ compatible = "adi,ad4080";
+ reg = <0>;
+ spi-max-frequency = <10000000>;
+ vdd33-supply = <&vdd33>;
+ vddldo-supply = <&vddldo>;
+ vrefin-supply = <&vrefin>;
+ clocks = <&cnv>;
+ clock-names = "cnv";
+ io-backends = <&iio_backend>;
};
};
- |
@@ -144,15 +146,15 @@ examples:
#size-cells = <0>;
adc@0 {
- compatible = "adi,ad4880";
- reg = <0>, <1>;
- spi-max-frequency = <10000000>;
- vdd33-supply = <&vdd33>;
- vddldo-supply = <&vddldo>;
- vrefin-supply = <&vrefin>;
- clocks = <&cnv>;
- clock-names = "cnv";
- io-backends = <&iio_backend_cha>, <&iio_backend_chb>;
+ compatible = "adi,ad4880";
+ reg = <0>, <1>;
+ spi-max-frequency = <10000000>;
+ vdd33-supply = <&vdd33>;
+ vddldo-supply = <&vddldo>;
+ vrefin-supply = <&vrefin>;
+ clocks = <&cnv>;
+ clock-names = "cnv";
+ io-backends = <&iio_backend_cha>, <&iio_backend_chb>;
};
};
...
diff --git a/Documentation/devicetree/bindings/iio/adc/adi,ad4130.yaml b/Documentation/devicetree/bindings/iio/adc/adi,ad4130.yaml
index cc38617bb829..a4ab6adef1c6 100644
--- a/Documentation/devicetree/bindings/iio/adc/adi,ad4130.yaml
+++ b/Documentation/devicetree/bindings/iio/adc/adi,ad4130.yaml
@@ -8,7 +8,8 @@ $schema: http://devicetree.org/meta-schemas/core.yaml#
title: Analog Devices AD4130 family ADCs
maintainers:
- - Cosmin Tanislav
+ - Marcelo Schmitt
+ - Antoniu Miclaus
description: |
Bindings for the Analog Devices AD4130 family ADCs.
diff --git a/Documentation/devicetree/bindings/iio/adc/adi,ad4851.yaml b/Documentation/devicetree/bindings/iio/adc/adi,ad4851.yaml
index b107322e0ea3..49708ce0b230 100644
--- a/Documentation/devicetree/bindings/iio/adc/adi,ad4851.yaml
+++ b/Documentation/devicetree/bindings/iio/adc/adi,ad4851.yaml
@@ -142,13 +142,13 @@ examples:
io-backends = <&iio_backend>;
channel@0 {
- reg = <0>;
- diff-channels = <0 0>;
- bipolar;
+ reg = <0>;
+ diff-channels = <0 0>;
+ bipolar;
};
channel@1 {
- reg = <1>;
+ reg = <1>;
};
};
};
diff --git a/Documentation/devicetree/bindings/iio/adc/adi,ad7173.yaml b/Documentation/devicetree/bindings/iio/adc/adi,ad7173.yaml
index 62d906e24997..e178007b9a22 100644
--- a/Documentation/devicetree/bindings/iio/adc/adi,ad7173.yaml
+++ b/Documentation/devicetree/bindings/iio/adc/adi,ad7173.yaml
@@ -443,7 +443,7 @@ examples:
#address-cells = <1>;
#size-cells = <0>;
- adc@0 {
+ adc@0 {
compatible = "adi,ad4111";
reg = <0>;
diff --git a/Documentation/devicetree/bindings/iio/adc/adi,ad7768-1.yaml b/Documentation/devicetree/bindings/iio/adc/adi,ad7768-1.yaml
index dfa2d7fa9fb3..7b72d14e104c 100644
--- a/Documentation/devicetree/bindings/iio/adc/adi,ad7768-1.yaml
+++ b/Documentation/devicetree/bindings/iio/adc/adi,ad7768-1.yaml
@@ -238,9 +238,9 @@ examples:
};
regulators {
- vcm_reg: vcm-output {
- regulator-name = "ad7768-1-vcm";
- };
+ vcm_reg: vcm-output {
+ regulator-name = "ad7768-1-vcm";
+ };
};
};
};
diff --git a/Documentation/devicetree/bindings/iio/adc/adi,ad7768.yaml b/Documentation/devicetree/bindings/iio/adc/adi,ad7768.yaml
new file mode 100644
index 000000000000..d8e489fa1f6f
--- /dev/null
+++ b/Documentation/devicetree/bindings/iio/adc/adi,ad7768.yaml
@@ -0,0 +1,270 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/iio/adc/adi,ad7768.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Analog Devices AD7768 and AD7768-4 ADC
+
+maintainers:
+ - Janani Sunil
+
+description: |
+ The AD7768 is an 8-channel, 24-bit simultaneous sampling ADC with configurable
+ power and performance modes. The AD7768-4 is a 4-channel version.
+
+ This binding covers SPI mode only (register access via SPI). Pin control mode,
+ where configuration is set via hardware pins rather than SPI registers, is not
+ supported.
+
+ The io-backend represents the high-speed data output interface, consuming the
+ DOUTx data lines, DCLK (data clock), and DRDY (data ready) signals.
+
+ Datasheet at:
+ https://www.analog.com/media/en/technical-documentation/data-sheets/ad7768-ad7768-4.pdf
+
+ HDL reference design:
+ https://github.com/analogdevicesinc/hdl/tree/main/projects/ad7768evb
+
+properties:
+ compatible:
+ enum:
+ - adi,ad7768
+ - adi,ad7768-4
+
+ reg:
+ maxItems: 1
+
+ clocks:
+ maxItems: 1
+
+ clock-names:
+ description:
+ Describes the type of master clock (MCLK) attached to the XTAL1 and
+ XTAL2/MCLK pins. A CMOS clock is supplied on the XTAL2/MCLK pin, a
+ crystal oscillator is connected between the XTAL1 and XTAL2 pins, and an
+ LVDS differential clock is supplied on the XTAL1/XTAL2 pin pair. CMOS and
+ LVDS clocks must operate from 1.15 MHz to 34 MHz. Crystals must operate
+ from 8 MHz to 34 MHz.
+ enum:
+ - mclk
+ - xtal
+ - lvds
+
+ avdd1-supply:
+ description:
+ Analog supply. Its voltage is used to derive the supply-dependent VCM
+ output level, so it must be a regulator that can report its voltage.
+
+ avss-supply:
+ description:
+ Negative analog supply. If omitted, AVSS is assumed to be at system
+ ground.
+
+ avdd2-supply: true
+
+ iovdd-supply: true
+
+ ref1p-supply: true
+
+ ref1n-supply:
+ description:
+ Negative reference input supply for REF1. If omitted, REF1- is assumed
+ to be connected to ground.
+
+ ref2p-supply: true
+
+ ref2n-supply:
+ description:
+ Negative reference input supply for REF2. If omitted, REF2- is assumed
+ to be connected to ground.
+
+ reset-gpios:
+ maxItems: 1
+ description: GPIO connected to the active-low RESET pin
+
+ start-gpios:
+ maxItems: 1
+ description:
+ GPIO connected to the START pin. An active-low pulse on this pin
+ synchronizes the device to other AD7768 devices. When not used, this
+ pin must be tied to a logic high level through a pull-up resistor.
+ When used, SYNC_OUT must be wired back to SYNC_IN on all devices in
+ the synchronization chain.
+
+ sync-in-gpios:
+ maxItems: 1
+ description:
+ GPIO connected to the SYNC_IN pin. Receives the synchronization pulse
+ generated on SYNC_OUT in response to a START pulse. Must be synchronous
+ to the MCLK clock domain. In multi-device or daisy-chained systems,
+ two successive synchronization pulses must be applied to guarantee all
+ ADCs are synchronized.
+
+ gpio-controller: true
+
+ '#gpio-cells':
+ const: 2
+
+ adi,data-lines-number:
+ $ref: /schemas/types.yaml#/definitions/uint32
+ enum: [1, 2, 4, 8]
+ description:
+ Number of DOUTx lines used for the high-speed data output interface
+ (distinct from the SPI control interface). AD7768 supports 1, 2, or 8
+ lines; AD7768-4 supports 1 or 4 lines. Defaults to the maximum number
+ of lines for the selected variant if omitted.
+
+ regulators:
+ type: object
+ description: Container for the on-chip VCM regulator.
+ additionalProperties: false
+
+ properties:
+ vcm-output:
+ type: object
+ description:
+ Buffered common-mode voltage output on the VCM pin. Use
+ regulator-always-on when no consumer node references this output.
+ Channel 0 must be present and enabled while VCM is used, since
+ putting channel 0 in standby disables the VCM output.
+ $ref: /schemas/regulator/regulator.yaml#
+ unevaluatedProperties: false
+
+ io-backends:
+ maxItems: 1
+
+ '#address-cells':
+ const: 1
+
+ '#size-cells':
+ const: 0
+
+patternProperties:
+ "^channel@[0-7]$":
+ type: object
+ description:
+ Represents the external channels which are connected to the device.
+ AD7768 supports channels 0-7, AD7768-4 supports channels 0-3.
+
+ properties:
+ reg:
+ minimum: 0
+ maximum: 7
+ description: The channel number
+
+ adi,prechargebuf-pos-enable:
+ type: boolean
+ description: Enable positive input precharge buffer
+
+ adi,prechargebuf-neg-enable:
+ type: boolean
+ description: Enable negative input precharge buffer
+
+ adi,refbuf-pos-enable:
+ type: boolean
+ description: Enable positive reference buffer
+
+ adi,refbuf-neg-enable:
+ type: boolean
+ description: Enable negative reference buffer
+
+ required:
+ - reg
+
+ additionalProperties: false
+
+required:
+ - compatible
+ - reg
+ - clocks
+ - clock-names
+ - avdd1-supply
+ - avdd2-supply
+ - iovdd-supply
+ - ref1p-supply
+ - ref2p-supply
+ - io-backends
+
+allOf:
+ - $ref: /schemas/spi/spi-peripheral-props.yaml#
+ - if:
+ properties:
+ compatible:
+ contains:
+ const: adi,ad7768-4
+ then:
+ properties:
+ adi,data-lines-number:
+ enum: [1, 4]
+ patternProperties:
+ "^channel@[0-3]$":
+ properties:
+ reg:
+ maximum: 3
+ "^channel@[4-7]$": false
+ else:
+ properties:
+ adi,data-lines-number:
+ enum: [1, 2, 8]
+
+unevaluatedProperties: false
+
+examples:
+ - |
+ #include
+
+ spi {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ adc@0 {
+ compatible = "adi,ad7768";
+ reg = <0>;
+ spi-max-frequency = <1000000>;
+
+ avdd1-supply = <&avdd1_regulator>;
+ avss-supply = <&avss_regulator>;
+ avdd2-supply = <&avdd2_regulator>;
+ iovdd-supply = <&iovdd_regulator>;
+ ref1p-supply = <&ref1p_regulator>;
+ ref1n-supply = <&ref1n_regulator>;
+ ref2p-supply = <&ref2p_regulator>;
+ ref2n-supply = <&ref2n_regulator>;
+ reset-gpios = <&gpio0 86 GPIO_ACTIVE_LOW>;
+
+ clocks = <&ad7768_mclk>;
+ clock-names = "mclk";
+
+ adi,data-lines-number = <8>;
+ gpio-controller;
+ #gpio-cells = <2>;
+
+ io-backends = <&iio_backend>;
+
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ channel@0 {
+ reg = <0>;
+ adi,prechargebuf-pos-enable;
+ adi,refbuf-pos-enable;
+ };
+
+ channel@1 {
+ reg = <1>;
+ adi,prechargebuf-pos-enable;
+ adi,prechargebuf-neg-enable;
+ adi,refbuf-pos-enable;
+ adi,refbuf-neg-enable;
+ };
+
+ channel@7 {
+ reg = <7>;
+ adi,prechargebuf-pos-enable;
+ adi,refbuf-pos-enable;
+ };
+ };
+ };
+
+...
diff --git a/Documentation/devicetree/bindings/iio/adc/adi,ad7779.yaml b/Documentation/devicetree/bindings/iio/adc/adi,ad7779.yaml
index ba3f7b2bd6cf..37e25a6196e7 100644
--- a/Documentation/devicetree/bindings/iio/adc/adi,ad7779.yaml
+++ b/Documentation/devicetree/bindings/iio/adc/adi,ad7779.yaml
@@ -122,14 +122,14 @@ examples:
#size-cells = <0>;
adc@0 {
- compatible = "adi,ad7779";
- reg = <0>;
- start-gpios = <&gpio0 87 GPIO_ACTIVE_LOW>;
- reset-gpios = <&gpio0 93 GPIO_ACTIVE_LOW>;
- interrupt-parent = <&intc>;
- interrupts = <0 56 IRQ_TYPE_LEVEL_HIGH>;
- interrupt-names = "adc_rdy";
- clocks = <&adc_clk>;
+ compatible = "adi,ad7779";
+ reg = <0>;
+ start-gpios = <&gpio0 87 GPIO_ACTIVE_LOW>;
+ reset-gpios = <&gpio0 93 GPIO_ACTIVE_LOW>;
+ interrupt-parent = <&intc>;
+ interrupts = <0 56 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "adc_rdy";
+ clocks = <&adc_clk>;
};
};
@@ -140,13 +140,13 @@ examples:
#size-cells = <0>;
adc@0 {
- compatible = "adi,ad7779";
- reg = <0>;
- start-gpios = <&gpio0 87 GPIO_ACTIVE_LOW>;
- reset-gpios = <&gpio0 93 GPIO_ACTIVE_LOW>;
- clocks = <&adc_clk>;
- io-backends = <&iio_backend>;
- adi,num-lanes = <4>;
+ compatible = "adi,ad7779";
+ reg = <0>;
+ start-gpios = <&gpio0 87 GPIO_ACTIVE_LOW>;
+ reset-gpios = <&gpio0 93 GPIO_ACTIVE_LOW>;
+ clocks = <&adc_clk>;
+ io-backends = <&iio_backend>;
+ adi,num-lanes = <4>;
};
};
...
diff --git a/Documentation/devicetree/bindings/iio/adc/adi,ade9000.yaml b/Documentation/devicetree/bindings/iio/adc/adi,ade9000.yaml
index f22eba0250ee..0971a29bf372 100644
--- a/Documentation/devicetree/bindings/iio/adc/adi,ade9000.yaml
+++ b/Documentation/devicetree/bindings/iio/adc/adi,ade9000.yaml
@@ -5,21 +5,23 @@
$id: http://devicetree.org/schemas/iio/adc/adi,ade9000.yaml#
$schema: http://devicetree.org/meta-schemas/core.yaml#
-title: Analog Devices ADE9000 High Performance, Polyphase Energy Metering
+title: Analog Devices ADE9000/ADE9078 High Performance, Polyphase Energy Metering
maintainers:
- Antoniu Miclaus
description: |
- The ADE9000 is a highly accurate, fully integrated, multiphase energy and power
- quality monitoring device. Superior analog performance and a digital signal
- processing (DSP) core enable accurate energy monitoring over a wide dynamic
- range. An integrated high end reference ensures low drift over temperature
- with a combined drift of less than ±25 ppm/°C maximum for the entire channel
- including a programmable gain amplifier (PGA) and an analog-to-digital
- converter (ADC).
+ The ADE9000 and ADE9078 are highly accurate, fully integrated, multiphase
+ energy and power quality monitoring devices. Superior analog performance and a
+ digital signal processing (DSP) core enable accurate energy monitoring over a
+ wide dynamic range. An integrated high end reference ensures low drift over
+ temperature with a combined drift of less than ±25 ppm/°C maximum for the
+ entire channel including a programmable gain amplifier (PGA) and an
+ analog-to-digital converter (ADC). The ADE9078 does not provide the on-chip
+ dip/swell detection available on the ADE9000.
https://www.analog.com/media/en/technical-documentation/data-sheets/ADE9000.pdf
+ https://www.analog.com/media/en/technical-documentation/data-sheets/ADE9078.pdf
$ref: /schemas/spi/spi-peripheral-props.yaml#
@@ -27,6 +29,7 @@ properties:
compatible:
enum:
- adi,ade9000
+ - adi,ade9078
reg:
maxItems: 1
@@ -67,6 +70,17 @@ required:
- reg
- vdd-supply
+allOf:
+ - if:
+ properties:
+ compatible:
+ contains:
+ const: adi,ade9078
+ then:
+ properties:
+ spi-max-frequency:
+ maximum: 10000000
+
unevaluatedProperties: false
examples:
@@ -75,20 +89,20 @@ examples:
#include
spi {
- #address-cells = <1>;
- #size-cells = <0>;
+ #address-cells = <1>;
+ #size-cells = <0>;
- adc@0 {
- compatible = "adi,ade9000";
- reg = <0>;
- spi-max-frequency = <7000000>;
+ adc@0 {
+ compatible = "adi,ade9000";
+ reg = <0>;
+ spi-max-frequency = <7000000>;
- #clock-cells = <0>;
- reset-gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
- interrupts = <2 IRQ_TYPE_EDGE_FALLING>, <3 IRQ_TYPE_EDGE_FALLING>, <4 IRQ_TYPE_EDGE_FALLING>;
- interrupt-names = "irq0", "irq1", "dready";
- interrupt-parent = <&gpio>;
- clocks = <&ext_clock_24576khz>;
- vdd-supply = <&vdd_reg>;
- };
+ #clock-cells = <0>;
+ reset-gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+ interrupts = <2 IRQ_TYPE_EDGE_FALLING>, <3 IRQ_TYPE_EDGE_FALLING>, <4 IRQ_TYPE_EDGE_FALLING>;
+ interrupt-names = "irq0", "irq1", "dready";
+ interrupt-parent = <&gpio>;
+ clocks = <&ext_clock_24576khz>;
+ vdd-supply = <&vdd_reg>;
+ };
};
diff --git a/Documentation/devicetree/bindings/iio/adc/adi,max40080.yaml b/Documentation/devicetree/bindings/iio/adc/adi,max40080.yaml
new file mode 100644
index 000000000000..b0ec9159a293
--- /dev/null
+++ b/Documentation/devicetree/bindings/iio/adc/adi,max40080.yaml
@@ -0,0 +1,65 @@
+# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/iio/adc/adi,max40080.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Analog Devices MAX40080 bidirectional current-sense amplifier
+
+maintainers:
+ - Ciprian Hegbeli
+ - Stefan Popa
+
+description: |
+ The MAX40080 is a high-precision, bidirectional current-sense amplifier with
+ an integrated 12-bit ADC and an I2C/SMBus interface. It measures the voltage
+ across an external shunt resistor and the input bus voltage, and stores the
+ results in an internal FIFO.
+
+ Datasheet:
+ https://www.analog.com/max40080
+
+properties:
+ compatible:
+ const: adi,max40080
+
+ reg:
+ maxItems: 1
+
+ "#io-channel-cells":
+ const: 1
+
+ vdd-supply:
+ description: Power supply for the device.
+
+ interrupts:
+ maxItems: 1
+ description: ALERT_ output for overcurrent/undervoltage threshold events.
+
+ shunt-resistor-micro-ohms:
+ description:
+ Value of the current-sense shunt resistor connected between the RS+ and
+ RS- inputs. Used to scale the reported current.
+
+required:
+ - compatible
+ - reg
+ - shunt-resistor-micro-ohms
+ - vdd-supply
+
+additionalProperties: false
+
+examples:
+ - |
+ i2c {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ adc@20 {
+ compatible = "adi,max40080";
+ reg = <0x20>;
+ #io-channel-cells = <1>;
+ vdd-supply = <&vdd>;
+ shunt-resistor-micro-ohms = <100000>;
+ };
+ };
diff --git a/Documentation/devicetree/bindings/iio/adc/axiado,ax3000-saradc.yaml b/Documentation/devicetree/bindings/iio/adc/axiado,ax3000-saradc.yaml
new file mode 100644
index 000000000000..b910852aa56f
--- /dev/null
+++ b/Documentation/devicetree/bindings/iio/adc/axiado,ax3000-saradc.yaml
@@ -0,0 +1,63 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/iio/adc/axiado,ax3000-saradc.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Axiado AX3000/AX3005 Successive Approximation Register ADC
+
+description:
+ The Axiado AX3000/AX3005 SAR ADC is a 10-bit ADC with sixteen input
+ channels on AX3000 and eight input channels on AX3005.
+
+maintainers:
+ - Petar Stepanovic
+ - Akhila Kavi
+ - Prasad Bolisetty
+
+properties:
+ compatible:
+ enum:
+ - axiado,ax3000-saradc
+ - axiado,ax3005-saradc
+
+ reg:
+ maxItems: 1
+
+ clocks:
+ maxItems: 1
+
+ clock-names:
+ const: saradc
+
+ '#io-channel-cells':
+ const: 1
+
+ vref-supply:
+ description: Reference voltage regulator supplying the ADC
+
+required:
+ - compatible
+ - reg
+ - clocks
+ - clock-names
+ - '#io-channel-cells'
+ - vref-supply
+
+additionalProperties: false
+
+examples:
+ - |
+ soc {
+ #address-cells = <2>;
+ #size-cells = <2>;
+
+ adc@806a0000 {
+ compatible = "axiado,ax3000-saradc";
+ reg = <0x0 0x806a0000 0x0 0x400>;
+ clocks = <&pclk>;
+ clock-names = "saradc";
+ vref-supply = <&vref_reg>;
+ #io-channel-cells = <1>;
+ };
+ };
diff --git a/Documentation/devicetree/bindings/iio/adc/lltc,ltc2497.yaml b/Documentation/devicetree/bindings/iio/adc/lltc,ltc2497.yaml
index c884b6e03767..67445ad2bb3b 100644
--- a/Documentation/devicetree/bindings/iio/adc/lltc,ltc2497.yaml
+++ b/Documentation/devicetree/bindings/iio/adc/lltc,ltc2497.yaml
@@ -4,7 +4,7 @@
$id: http://devicetree.org/schemas/iio/adc/lltc,ltc2497.yaml#
$schema: http://devicetree.org/meta-schemas/core.yaml#
-title: Linear Technology / Analog Devices LTC2497 and LTC2309 ADC
+title: Linear Technology / Analog Devices LTC2497 and similar ADCs
maintainers:
- Michael Hennerich
diff --git a/Documentation/devicetree/bindings/iio/adc/maxim,max34408.yaml b/Documentation/devicetree/bindings/iio/adc/maxim,max34408.yaml
index 4cba856e8d47..bad780d1bbfb 100644
--- a/Documentation/devicetree/bindings/iio/adc/maxim,max34408.yaml
+++ b/Documentation/devicetree/bindings/iio/adc/maxim,max34408.yaml
@@ -118,22 +118,22 @@ examples:
#size-cells = <0>;
adc@1e {
- compatible = "maxim,max34409";
- reg = <0x1e>;
- powerdown-gpios = <&gpio0 1 GPIO_ACTIVE_LOW>;
- powerdown-status-gpios = <&gpio0 2 GPIO_ACTIVE_HIGH>;
+ compatible = "maxim,max34409";
+ reg = <0x1e>;
+ powerdown-gpios = <&gpio0 1 GPIO_ACTIVE_LOW>;
+ powerdown-status-gpios = <&gpio0 2 GPIO_ACTIVE_HIGH>;
- #address-cells = <1>;
- #size-cells = <0>;
+ #address-cells = <1>;
+ #size-cells = <0>;
- channel@0 {
- reg = <0x0>;
- maxim,rsense-val-micro-ohms = <5000>;
- };
+ channel@0 {
+ reg = <0x0>;
+ maxim,rsense-val-micro-ohms = <5000>;
+ };
- channel@1 {
- reg = <0x1>;
- maxim,rsense-val-micro-ohms = <10000>;
- };
+ channel@1 {
+ reg = <0x1>;
+ maxim,rsense-val-micro-ohms = <10000>;
+ };
};
};
diff --git a/Documentation/devicetree/bindings/iio/adc/mediatek,mt2701-auxadc.yaml b/Documentation/devicetree/bindings/iio/adc/mediatek,mt2701-auxadc.yaml
index d9e825e5054f..750e1e837fb8 100644
--- a/Documentation/devicetree/bindings/iio/adc/mediatek,mt2701-auxadc.yaml
+++ b/Documentation/devicetree/bindings/iio/adc/mediatek,mt2701-auxadc.yaml
@@ -38,6 +38,7 @@ properties:
- const: mediatek,mt7986-auxadc
- items:
- enum:
+ - mediatek,mt6572-auxadc
- mediatek,mt6893-auxadc
- mediatek,mt8183-auxadc
- mediatek,mt8186-auxadc
diff --git a/Documentation/devicetree/bindings/iio/adc/nxp,lpc1850-adc.yaml b/Documentation/devicetree/bindings/iio/adc/nxp,lpc1850-adc.yaml
index 70b38038a080..1e2df3dd15d1 100644
--- a/Documentation/devicetree/bindings/iio/adc/nxp,lpc1850-adc.yaml
+++ b/Documentation/devicetree/bindings/iio/adc/nxp,lpc1850-adc.yaml
@@ -56,6 +56,6 @@ examples:
clocks = <&ccu1 CLK_APB3_ADC0>;
vref-supply = <®_vdda>;
resets = <&rgu 40>;
- };
+ };
};
...
diff --git a/Documentation/devicetree/bindings/iio/adc/renesas,r9a09g077-adc.yaml b/Documentation/devicetree/bindings/iio/adc/renesas,r9a09g077-adc.yaml
index dc0206b28231..5b496729022e 100644
--- a/Documentation/devicetree/bindings/iio/adc/renesas,r9a09g077-adc.yaml
+++ b/Documentation/devicetree/bindings/iio/adc/renesas,r9a09g077-adc.yaml
@@ -34,8 +34,6 @@ properties:
- description: A/D scan end interrupt for Group C
- description: Window A compare match
- description: Window B compare match
- - description: Compare match
- - description: Compare mismatch
interrupt-names:
items:
@@ -44,8 +42,6 @@ properties:
- const: gcadi
- const: cmpai
- const: cmpbi
- - const: wcmpm
- - const: wcmpum
clocks:
items:
@@ -57,6 +53,18 @@ properties:
- const: adclk
- const: pclk
+ dmas:
+ minItems: 1
+ maxItems: 3
+ description:
+ Must contain a list of references to DMA RX specifiers.
+
+ dma-names:
+ minItems: 1
+ maxItems: 3
+ items:
+ const: rx
+
power-domains:
maxItems: 1
@@ -107,11 +115,9 @@ examples:
,
,
,
- ,
- ,
- ;
+ ;
interrupt-names = "adi", "gbadi", "gcadi",
- "cmpai", "cmpbi", "wcmpm", "wcmpum";
+ "cmpai", "cmpbi";
clocks = <&cpg CPG_CORE R9A09G077_CLK_PCLKL>,
<&cpg CPG_MOD 225>;
clock-names = "adclk", "pclk";
diff --git a/Documentation/devicetree/bindings/iio/adc/renesas,rzg2l-adc.yaml b/Documentation/devicetree/bindings/iio/adc/renesas,rzg2l-adc.yaml
index 40341d541726..f08f5439d127 100644
--- a/Documentation/devicetree/bindings/iio/adc/renesas,rzg2l-adc.yaml
+++ b/Documentation/devicetree/bindings/iio/adc/renesas,rzg2l-adc.yaml
@@ -25,7 +25,9 @@ properties:
- renesas,r9a07g054-adc # RZ/V2L
- const: renesas,rzg2l-adc
- items:
- - const: renesas,r9a08g045-adc # RZ/G3S
+ - enum:
+ - renesas,r9a08g045-adc # RZ/G3S
+ - renesas,r9a08g046-adc1 # RZ/G3L ADC for TSU
reg:
maxItems: 1
@@ -121,6 +123,19 @@ allOf:
reg:
maximum: 7
+ - if:
+ properties:
+ compatible:
+ contains:
+ const: renesas,r9a08g046-adc1
+ then:
+ patternProperties:
+ "^channel@[0-7]$": false
+ "^channel@[8]$":
+ properties:
+ reg:
+ const: 8
+
additionalProperties: false
examples:
diff --git a/Documentation/devicetree/bindings/iio/adc/ti,ads1015.yaml b/Documentation/devicetree/bindings/iio/adc/ti,ads1015.yaml
index 718f633c6e04..777a75c21d7f 100644
--- a/Documentation/devicetree/bindings/iio/adc/ti,ads1015.yaml
+++ b/Documentation/devicetree/bindings/iio/adc/ti,ads1015.yaml
@@ -66,6 +66,11 @@ patternProperties:
- minimum: 0
maximum: 7
+ label:
+ $ref: /schemas/types.yaml#/definitions/string
+ description:
+ A descriptive name for this channel, like "vcc_ram" or "CH3".
+
ti,gain:
$ref: /schemas/types.yaml#/definitions/uint32
minimum: 0
@@ -125,6 +130,7 @@ examples:
reg = <4>;
ti,gain = <3>;
ti,datarate = <5>;
+ label = "CH3";
};
};
};
diff --git a/Documentation/devicetree/bindings/iio/adc/ti,ads1100.yaml b/Documentation/devicetree/bindings/iio/adc/ti,ads1100.yaml
index 970ccab15e1e..28c5e2dd0ad6 100644
--- a/Documentation/devicetree/bindings/iio/adc/ti,ads1100.yaml
+++ b/Documentation/devicetree/bindings/iio/adc/ti,ads1100.yaml
@@ -4,19 +4,23 @@
$id: http://devicetree.org/schemas/iio/adc/ti,ads1100.yaml#
$schema: http://devicetree.org/meta-schemas/core.yaml#
-title: TI ADS1100/ADS1000 single channel I2C analog to digital converter
+title: TI ADS1100 and similar single channel I2C Analog to Digital Converters
maintainers:
- Mike Looijmans
description: |
- Datasheet at: https://www.ti.com/lit/gpn/ads1100
+ Datasheets:
+ - https://www.ti.com/lit/gpn/ads1000
+ - https://www.ti.com/lit/gpn/ads1100
+ - https://www.ti.com/lit/gpn/ads1110
properties:
compatible:
enum:
- - ti,ads1100
- ti,ads1000
+ - ti,ads1100
+ - ti,ads1110
reg:
maxItems: 1
diff --git a/Documentation/devicetree/bindings/iio/adc/ti,ads112c04.yaml b/Documentation/devicetree/bindings/iio/adc/ti,ads112c04.yaml
new file mode 100644
index 000000000000..95a123cd7b67
--- /dev/null
+++ b/Documentation/devicetree/bindings/iio/adc/ti,ads112c04.yaml
@@ -0,0 +1,149 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/iio/adc/ti,ads112c04.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Texas Instruments ADS112C04 ADC
+
+maintainers:
+ - Kyle Hsieh
+
+description:
+ The ADS112C04 (16-bit) are precision analog-to-digital converters (ADCs)
+ with an I2C interface. They feature a flexible input multiplexer, a
+ low-noise programmable gain amplifier (PGA), two programmable excitation
+ current sources, a voltage reference, and a precision temperature sensor.
+
+properties:
+ compatible:
+ enum:
+ - ti,ads112c04
+
+ reg:
+ maxItems: 1
+ description: I2C address of the device.
+
+ interrupts:
+ maxItems: 1
+ description:
+ Data ready (DRDY) interrupt output. DRDY pulses low when a conversion
+ result is ready and returns high once the result is latched, so an
+ edge trigger should be used.
+
+ "#address-cells":
+ const: 1
+
+ "#size-cells":
+ const: 0
+
+ reset-gpios:
+ maxItems: 1
+ description: GPIO connected to the RESET pin. Active low.
+
+ avdd-supply: true
+ dvdd-supply: true
+
+ refp-supply: true
+ refn-supply: true
+
+ ti,refp-refn-resistor-ohms:
+ description: Resistance of the external resistor between REFP and REFN.
+
+patternProperties:
+ "^channel@[0-9a-b]$":
+ $ref: adc.yaml
+ unevaluatedProperties: false
+ properties:
+ reg:
+ items:
+ - maximum: 11
+
+ single-channel:
+ maximum: 3
+
+ diff-channels:
+ items:
+ maximum: 3
+
+ excitation-channels:
+ maxItems: 2
+ items:
+ maximum: 5
+ description:
+ Additionally to AIN0-AIN3, IDAC1/IDAC2 can also be routed to
+ REFP0 (4) and REFN0 (5).
+
+ excitation-current-nanoamp:
+ enum: [10000, 50000, 100000, 250000, 500000, 1000000, 1500000]
+
+ burn-out-current-nanoamp:
+ const: 10000
+
+ reference-sources:
+ items:
+ - enum: [internal, external, avdd]
+ default: [ internal ]
+
+ dependencies:
+ excitation-channels: [ excitation-current-nanoamp ]
+ excitation-current-nanoamp: [ excitation-channels ]
+
+ oneOf:
+ - required: [ single-channel ]
+ - required: [ diff-channels ]
+
+required:
+ - compatible
+ - reg
+ - avdd-supply
+ - dvdd-supply
+
+dependencies:
+ refn-supply: [ refp-supply ]
+
+oneOf:
+ - required:
+ - refp-supply
+ - required:
+ - ti,refp-refn-resistor-ohms
+ - properties:
+ refp-supply: false
+ refn-supply: false
+ ti,refp-refn-resistor-ohms: false
+
+unevaluatedProperties: false
+
+examples:
+ - |
+ #include
+ #include
+ i2c {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ adc@40 {
+ compatible = "ti,ads112c04";
+ reg = <0x40>;
+ interrupt-parent = <&gpio>;
+ interrupts = <12 IRQ_TYPE_EDGE_FALLING>;
+
+ reset-gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+ avdd-supply = <&vdd_3v3_reg>;
+ dvdd-supply = <&vdd_3v3_reg>;
+ refp-supply = <&vref_reg>;
+
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ channel@0 {
+ reg = <0>;
+ diff-channels = <0>, <1>;
+ };
+
+ channel@1 {
+ reg = <1>;
+ single-channel = <2>;
+ };
+ };
+ };
diff --git a/Documentation/devicetree/bindings/iio/adc/ti,ads1298.yaml b/Documentation/devicetree/bindings/iio/adc/ti,ads1298.yaml
index 71f9f9b745cb..afcc683db149 100644
--- a/Documentation/devicetree/bindings/iio/adc/ti,ads1298.yaml
+++ b/Documentation/devicetree/bindings/iio/adc/ti,ads1298.yaml
@@ -65,15 +65,15 @@ examples:
#size-cells = <0>;
adc@1 {
- reg = <1>;
- compatible = "ti,ads1298";
- label = "ads1298-1-ecg";
- avdd-supply = <®_iso_5v_a>;
- clocks = <&clk_ads1298>;
- interrupt-parent = <&gpio0>;
- interrupts = <78 IRQ_TYPE_EDGE_FALLING>;
- spi-max-frequency = <20000000>;
- spi-cpha;
+ reg = <1>;
+ compatible = "ti,ads1298";
+ label = "ads1298-1-ecg";
+ avdd-supply = <®_iso_5v_a>;
+ clocks = <&clk_ads1298>;
+ interrupt-parent = <&gpio0>;
+ interrupts = <78 IRQ_TYPE_EDGE_FALLING>;
+ spi-max-frequency = <20000000>;
+ spi-cpha;
};
};
...
diff --git a/Documentation/devicetree/bindings/iio/addac/adi,ad74115.yaml b/Documentation/devicetree/bindings/iio/addac/adi,ad74115.yaml
index 2a04906531fb..6aa86cb56032 100644
--- a/Documentation/devicetree/bindings/iio/addac/adi,ad74115.yaml
+++ b/Documentation/devicetree/bindings/iio/addac/adi,ad74115.yaml
@@ -7,7 +7,8 @@ $schema: http://devicetree.org/meta-schemas/core.yaml#
title: Analog Devices AD74115H device
maintainers:
- - Cosmin Tanislav
+ - Marcelo Schmitt
+ - Antoniu Miclaus
description: |
The AD74115H is a single-channel software configurable input/output
diff --git a/Documentation/devicetree/bindings/iio/addac/adi,ad74413r.yaml b/Documentation/devicetree/bindings/iio/addac/adi,ad74413r.yaml
index 590ea7936ad7..5318a00e7669 100644
--- a/Documentation/devicetree/bindings/iio/addac/adi,ad74413r.yaml
+++ b/Documentation/devicetree/bindings/iio/addac/adi,ad74413r.yaml
@@ -7,7 +7,8 @@ $schema: http://devicetree.org/meta-schemas/core.yaml#
title: Analog Devices AD74412R/AD74413R device
maintainers:
- - Cosmin Tanislav
+ - Marcelo Schmitt
+ - Antoniu Miclaus
description: |
The AD74412R and AD74413R are quad-channel software configurable input/output
diff --git a/Documentation/devicetree/bindings/iio/dac/adi,ad3530r.yaml b/Documentation/devicetree/bindings/iio/dac/adi,ad3530r.yaml
index 2fe098619772..bf0278335583 100644
--- a/Documentation/devicetree/bindings/iio/dac/adi,ad3530r.yaml
+++ b/Documentation/devicetree/bindings/iio/dac/adi,ad3530r.yaml
@@ -10,13 +10,13 @@ maintainers:
- Kim Seer Paller
description: |
- The AD3530/AD3530R (8-channel), AD3531/AD3531R (4-channel), and AD3532/AD3532R
- (16-channel) are low-power, 16-bit, buffered voltage output digital-to-analog
- converters (DACs) with software-programmable gain controls, providing
- full-scale output spans of 2.5V or 5V for reference voltages of 2.5V. These
- devices operate from a single 2.7V to 5.5V supply and are guaranteed monotonic
- by design. The "R" variants include a 2.5V, 5ppm/°C internal reference, which
- is disabled by default.
+ The AD3530/AD3530R (8-channel), AD3531/AD3531R (4-channel), AD3532/AD3532R
+ (16-channel), 16-bit and AD3536R (16-channel), 12-bit are low-power, buffered
+ voltage output digital-to-analog converters (DACs) with software-programmable
+ gain controls, providing full-scale output spans of 2.5V or 5V for reference
+ voltages of 2.5V. These devices operate from a single 2.7V to 5.5V supply and
+ are guaranteed monotonic by design. The "R" variants include a 2.5V, 5ppm/°C
+ internal reference, which is disabled by default.
Datasheet can be found here:
https://www.analog.com/media/en/technical-documentation/data-sheets/ad3530_ad530r.pdf
https://www.analog.com/media/en/technical-documentation/data-sheets/ad3531-ad3531r.pdf
@@ -31,6 +31,7 @@ properties:
- adi,ad3531r
- adi,ad3532
- adi,ad3532r
+ - adi,ad3536r
reg:
maxItems: 1
diff --git a/Documentation/devicetree/bindings/iio/dac/adi,ad5529r.yaml b/Documentation/devicetree/bindings/iio/dac/adi,ad5529r.yaml
new file mode 100644
index 000000000000..9c390d460e5f
--- /dev/null
+++ b/Documentation/devicetree/bindings/iio/dac/adi,ad5529r.yaml
@@ -0,0 +1,254 @@
+# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/iio/dac/adi,ad5529r.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Analog Devices AD5529R 16-Channel 12/16-bit High Voltage DAC
+
+maintainers:
+ - Janani Sunil
+
+description: |
+ The AD5529R is a 16-channel, 12-bit or 16-bit, high voltage, buffered voltage
+ output digital-to-analog converter (DAC) with an integrated precision reference.
+ The device operates from unipolar and bipolar supplies. It is guaranteed
+ monotonic and has built-in rail-to-rail output buffers that can source or
+ sink up to 25mA.
+
+ Specifications:
+ * 16 independent 12-bit or 16-bit DAC channels
+ * Independently programmable output ranges: 0V to 5V, 0V to 10V, 0V to 20V,
+ 0V to 40V, ±5V, ±10V, ±15V, and ±20V
+ * The device supports SPI communication with Mode 0 and Mode 3.
+ * 4.096V precision reference, 12ppm/°C maximum
+ * Built-in function generation: Toggle, Sinusoidal Dither, and Ramp waveforms
+ * Multiplexer for output voltage, load current sense and die temperature
+
+ Datasheet: https://www.analog.com/media/en/technical-documentation/data-sheets/ad5529r.pdf
+
+properties:
+ compatible:
+ enum:
+ - adi,ad5529r-16 # 16-bit variant
+ - adi,ad5529r-12 # 12-bit variant
+
+ reg:
+ maxItems: 1
+
+ spi-max-frequency:
+ maximum: 25000000
+ description:
+ Maximum SPI frequency. The device supports SPI Mode 0 and Mode 3.
+ Read operations are limited to 25MHz maximum.
+
+ reset-gpios:
+ maxItems: 1
+ description:
+ GPIO connected to the RESET pin. Active low. When asserted low,
+ performs a power-on reset and initializes the device to its default state.
+
+ clear-gpios:
+ maxItems: 1
+ description:
+ GPIO connected to the CLEAR pin. Active low. When asserted low,
+ clears all DAC data registers without affecting configuration settings.
+
+ interrupts:
+ maxItems: 1
+ description:
+ Interrupt connected to the ALARM pin. Active low interrupt output
+ for overtemperature conditions, SPI CRC errors, and function completion.
+
+ pwms:
+ minItems: 1
+ maxItems: 4
+ description:
+ PWM signals connected to the TG0-TG3 toggle pins. Pulsing these pins
+ based on trigger edge settings allows selected DACs to be updated
+ synchronously for digital function generation.
+
+ pwm-names:
+ minItems: 1
+ maxItems: 4
+ items:
+ enum: [ tg0, tg1, tg2, tg3 ]
+
+ io-channels:
+ maxItems: 1
+ description:
+ ADC channel connected to the MUXOUT pin for monitoring output voltage,
+ load current sense, and die temperature.
+
+ io-channel-names:
+ const: muxout
+
+ vdd-io-supply:
+ description: Digital power supply (1.08V to 1.98V)
+
+ vdd-5v-supply:
+ description: Analog power supply (4.75V to 5.25V)
+
+ vdd-hv0-supply:
+ description:
+ High voltage positive supply (7V to 45V) for channels 0 to 3.
+
+ vdd-hv1-supply:
+ description:
+ High voltage positive supply (7V to 45V) for channels 4 to 7.
+
+ vdd-hv2-supply:
+ description:
+ High voltage positive supply (7V to 45V) for channels 8 to 11.
+
+ vdd-hv3-supply:
+ description:
+ High voltage positive supply (7V to 45V) for channels 12 to 15.
+
+ vss-hv0-supply:
+ description:
+ High voltage negative supply (-22.5V to 0V) for channels 0 to 3.
+
+ vss-hv1-supply:
+ description:
+ High voltage negative supply (-22.5V to 0V) for channels 4 to 7.
+
+ vss-hv2-supply:
+ description:
+ High voltage negative supply (-22.5V to 0V) for channels 8 to 11.
+
+ vss-hv3-supply:
+ description:
+ High voltage negative supply (-22.5V to 0V) for channels 12 to 15.
+
+ vref-supply:
+ description:
+ External voltage reference supply (4.056V to 4.136V, typically 4.096V).
+ When specified, the device uses external reference mode and the VREF pin
+ becomes an input. The device uses the internal 4.096V precision reference
+ otherwise.
+
+ spi-device-addr:
+ minItems: 1
+ maxItems: 4
+ items:
+ enum: [0, 1, 2, 3]
+ default: 0
+ description:
+ Hardware address of each device, selected by the ID0 and ID1 pins.
+ Up to four AD5529R devices can share a single SPI chip select.
+
+ "#address-cells":
+ const: 1
+
+ "#size-cells":
+ const: 0
+
+patternProperties:
+ "^channel@([0-9a-f]{1,2})$":
+ $ref: dac.yaml
+ type: object
+ description: Child nodes for individual channel configuration
+
+ properties:
+ reg:
+ description:
+ Flattened channel number across all AD5529R devices sharing the chip
+ select. Within each 16-channel block, the physical channel number is reg % 16.
+ minimum: 0
+ maximum: 63
+
+ output-range-microvolt:
+ description:
+ Output voltage range for this channel as [min, max] in
+ microvolts.
+ oneOf:
+ - items:
+ - const: 0
+ default: 0
+ - enum: [5000000, 10000000, 20000000, 40000000]
+ default: 5000000
+ - items:
+ - const: -5000000
+ - const: 5000000
+ - items:
+ - const: -10000000
+ - const: 10000000
+ - items:
+ - const: -15000000
+ - const: 15000000
+ - items:
+ - const: -20000000
+ - const: 20000000
+
+ required:
+ - reg
+
+ additionalProperties: false
+
+required:
+ - compatible
+ - reg
+ - vdd-io-supply
+ - vdd-5v-supply
+ - vdd-hv0-supply
+ - vdd-hv1-supply
+ - vdd-hv2-supply
+ - vdd-hv3-supply
+
+dependencies:
+ spi-cpha: [ spi-cpol ]
+ spi-cpol: [ spi-cpha ]
+
+allOf:
+ - $ref: /schemas/spi/spi-peripheral-props.yaml#
+
+unevaluatedProperties: false
+
+examples:
+ - |
+ #include
+
+ spi {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ dac@0 {
+ compatible = "adi,ad5529r-16";
+ reg = <0>;
+ spi-max-frequency = <25000000>;
+ spi-device-addr = <0>;
+
+ vdd-io-supply = <&vdd_io_regulator>;
+ vdd-5v-supply = <&vdd_5v_regulator>;
+ vdd-hv0-supply = <&vdd_hv0_regulator>;
+ vdd-hv1-supply = <&vdd_hv1_regulator>;
+ vdd-hv2-supply = <&vdd_hv2_regulator>;
+ vdd-hv3-supply = <&vdd_hv3_regulator>;
+ vss-hv0-supply = <&vss_hv0_regulator>;
+ vss-hv1-supply = <&vss_hv1_regulator>;
+ vss-hv2-supply = <&vss_hv2_regulator>;
+ vss-hv3-supply = <&vss_hv3_regulator>;
+
+ reset-gpios = <&gpio0 87 GPIO_ACTIVE_LOW>;
+
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ channel@0 {
+ reg = <0>;
+ output-range-microvolt = <0 5000000>;
+ };
+
+ channel@1 {
+ reg = <1>;
+ output-range-microvolt = <(-10000000) 10000000>;
+ };
+
+ channel@2 {
+ reg = <2>;
+ output-range-microvolt = <0 40000000>;
+ };
+ };
+ };
+...
diff --git a/Documentation/devicetree/bindings/iio/dac/adi,ad5710r.yaml b/Documentation/devicetree/bindings/iio/dac/adi,ad5710r.yaml
new file mode 100644
index 000000000000..cdcc3da4f4ea
--- /dev/null
+++ b/Documentation/devicetree/bindings/iio/dac/adi,ad5710r.yaml
@@ -0,0 +1,145 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/iio/dac/adi,ad5710r.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Analog Devices AD5710R/AD5711R 8-channel 12-/16-bit Configurable IDAC/VDAC
+
+maintainers:
+ - Kim Seer Paller
+
+description: |
+ The AD5710R (16-bit) and AD5711R (12-bit) are 8-channel, low-power,
+ configurable current/voltage output digital-to-analog converters (DACs) with
+ an on-chip 2.5V, 3ppm/°C reference. Each channel can be independently
+ configured as a voltage output (0V to VREF or 0V to 2 x VREF) or a current
+ output (0mA to 50mA). These devices operate from a single 2.7V to 5.5V
+ supply and are guaranteed monotonic by design.
+
+ Datasheet can be found here:
+ https://www.analog.com/media/en/technical-documentation/data-sheets/ad5711r-ad5710r.pdf
+
+properties:
+ compatible:
+ enum:
+ - adi,ad5710r
+ - adi,ad5711r
+
+ reg:
+ maxItems: 1
+
+ spi-max-frequency:
+ maximum: 20000000
+
+ '#address-cells':
+ const: 1
+
+ '#size-cells':
+ const: 0
+
+ vdd-supply:
+ description: Power Supply Input.
+
+ iovdd-supply:
+ description: Digital Power Supply Input.
+
+ io-channels:
+ description:
+ ADC channel used to monitor internal die temperature, output voltages, and
+ current of a selected channel via the MUXOUT pin.
+ maxItems: 1
+
+ ref-supply:
+ description:
+ Reference Input/Output. The voltage at the REF pin sets the full-scale
+ range of all channels. If not provided the internal reference is used and
+ also provided on the VREF pin.
+
+ reset-gpios:
+ description:
+ Active low signal that is falling edge sensitive. When it is deasserted,
+ the digital core initialization is performed and all DAC registers except
+ the Interface Configuration A register are reset to their default values.
+ maxItems: 1
+
+ ldac-gpios:
+ description:
+ LDAC pin to be used as a hardware trigger to update the DAC channels. If
+ not present, the DAC channels are updated by Software LDAC.
+ maxItems: 1
+
+ adi,range-double:
+ description:
+ Configure the output range for all channels. If the property is present,
+ the output will range from 0V to 2 x Vref. If the property is not present,
+ the output will range from 0V to Vref.
+ type: boolean
+
+patternProperties:
+ "^channel@[0-7]$":
+ $ref: /schemas/iio/dac/dac.yaml#
+ type: object
+ description:
+ Represents the external channels which are connected to the DAC.
+
+ properties:
+ reg:
+ description: Channel number
+ minimum: 0
+ maximum: 7
+
+ adi,ch-func:
+ description:
+ Channel output type. The values are defined in
+ . Use
+ CH_FUNC_VOLTAGE_OUTPUT (1) for voltage output or
+ CH_FUNC_CURRENT_OUTPUT (2) for current output.
+ $ref: /schemas/types.yaml#/definitions/uint32
+ enum: [1, 2]
+
+ required:
+ - reg
+ - adi,ch-func
+
+ unevaluatedProperties: false
+
+required:
+ - compatible
+ - reg
+ - vdd-supply
+ - iovdd-supply
+
+allOf:
+ - $ref: /schemas/spi/spi-peripheral-props.yaml#
+
+unevaluatedProperties: false
+
+examples:
+ - |
+ #include
+
+ spi {
+ #address-cells = <1>;
+ #size-cells = <0>;
+ dac@0 {
+ compatible = "adi,ad5710r";
+ reg = <0>;
+ spi-max-frequency = <1000000>;
+ vdd-supply = <&vdd>;
+ iovdd-supply = <&iovdd>;
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ channel@0 {
+ reg = <0>;
+ adi,ch-func = ;
+ };
+
+ channel@1 {
+ reg = <1>;
+ adi,ch-func = ;
+ };
+ };
+ };
+...
diff --git a/Documentation/devicetree/bindings/iio/dac/microchip,mcp47feb02.yaml b/Documentation/devicetree/bindings/iio/dac/microchip,mcp47feb02.yaml
index d131f136bd15..a86d094f0d4b 100644
--- a/Documentation/devicetree/bindings/iio/dac/microchip,mcp47feb02.yaml
+++ b/Documentation/devicetree/bindings/iio/dac/microchip,mcp47feb02.yaml
@@ -4,58 +4,92 @@
$id: http://devicetree.org/schemas/iio/dac/microchip,mcp47feb02.yaml#
$schema: http://devicetree.org/meta-schemas/core.yaml#
-title: Microchip MCP47F(E/V)B(0/1/2)(1/2/4/8) DAC with I2C Interface Families
+title: Microchip MCP4(7/8)F(E/V)B(0/1/2)(1/2/4/8) DAC with I2C/SPI Interface Families
maintainers:
- Ariana Lazar
description: |
- Datasheet for MCP47FEB01, MCP47FEB11, MCP47FEB21, MCP47FEB02, MCP47FEB12,
- MCP47FEB22 can be found here:
- https://ww1.microchip.com/downloads/aemDocuments/documents/OTH/ProductDocuments/DataSheets/20005375A.pdf
- Datasheet for MCP47FVB01, MCP47FVB11, MCP47FVB21, MCP47FVB02, MCP47FVB12,
- MCP47FVB22 can be found here:
- https://ww1.microchip.com/downloads/aemDocuments/documents/OTH/ProductDocuments/DataSheets/20005405A.pdf
- Datasheet for MCP47FEB04, MCP47FEB14, MCP47FEB24, MCP47FEB08, MCP47FEB18,
- MCP47FEB28, MCP47FVB04, MCP47FVB14, MCP47FVB24, MCP47FVB08, MCP47FVB18,
- MCP47FVB28 can be found here:
- https://ww1.microchip.com/downloads/aemDocuments/documents/MSLD/ProductDocuments/DataSheets/MCP47FXBX48-Data-Sheet-DS200006368A.pdf
+ Datasheets for MCP47F(E/V)B(0/1/2)(1/2/4/8) DAC with I2C Interface Families:
+ Datasheet for MCP47FEB01, MCP47FEB02, MCP47FEB11, MCP47FEB12, MCP47FEB21,
+ MCP47FEB22 can be found here:
+ https://ww1.microchip.com/downloads/aemDocuments/documents/OTH/ProductDocuments/DataSheets/20005375A.pdf
+ Datasheet for MCP47FVB01, MCP47FVB02, MCP47FVB11, MCP47FVB12, MCP47FVB21,
+ MCP47FVB22 can be found here:
+ https://ww1.microchip.com/downloads/aemDocuments/documents/OTH/ProductDocuments/DataSheets/20005405A.pdf
+ Datasheet for MCP47FEB04, MCP47FEB08, MCP47FEB14, MCP47FEB18, MCP47FEB24,
+ MCP47FEB28, MCP47FVB04, MCP47FVB08, MCP47FVB14, MCP47FVB18, MCP47FVB24,
+ MCP47FVB28 can be found here:
+ https://ww1.microchip.com/downloads/aemDocuments/documents/MSLD/ProductDocuments/DataSheets/MCP47FXBX48-Data-Sheet-DS200006368A.pdf
+ Datasheets for MCP48F(E/V)B(0/1/2)(1/2/4/8) DAC with SPI Interface Families:
+ Datasheet for MCP48FEB01, MCP48FEB02, MCP48FEB11, MCP48FEB12, MCP48FEB21,
+ MCP48FEB22 can be found here:
+ https://ww1.microchip.com/downloads/aemDocuments/documents/OTH/ProductDocuments/DataSheets/20005429B.pdf
+ Datasheet for MCP48FVB01, MCP48FVB02, MCP48FVB11, MCP48FVB12, MCP48FVB21,
+ MCP48FVB22 can be found here:
+ https://ww1.microchip.com/downloads/aemDocuments/documents/OTH/ProductDocuments/DataSheets/20005466A.pdf
+ Datasheet for MCP48FEB04, MCP48FEB14, MCP48FEB24, MCP48FEB08, MCP48FEB18,
+ MCP48FEB28, MCP48FVB04, MCP48FVB14, MCP48FVB24, MCP48FVB08, MCP48FVB18,
+ MCP48FVB28 can be found here:
+ https://ww1.microchip.com/downloads/aemDocuments/documents/MSLD/ProductDocuments/DataSheets/MCP48FXBX4-8-Family-Data-Sheet-DS20006362A.pdf
- +------------+--------------+-------------+-------------+------------+
- | Device | Resolution | Channels | Vref number | Memory |
- |------------|--------------|-------------|-------------|------------|
- | MCP47FEB01 | 8-bit | 1 | 1 | EEPROM |
- | MCP47FEB11 | 10-bit | 1 | 1 | EEPROM |
- | MCP47FEB21 | 12-bit | 1 | 1 | EEPROM |
- |------------|--------------|-------------|-------------|------------|
- | MCP47FEB02 | 8-bit | 2 | 1 | EEPROM |
- | MCP47FEB12 | 10-bit | 2 | 1 | EEPROM |
- | MCP47FEB22 | 12-bit | 2 | 1 | EEPROM |
- |------------|--------------|-------------|-------------|------------|
- | MCP47FVB01 | 8-bit | 1 | 1 | RAM |
- | MCP47FVB11 | 10-bit | 1 | 1 | RAM |
- | MCP47FVB21 | 12-bit | 1 | 1 | RAM |
- |------------|--------------|-------------|-------------|------------|
- | MCP47FVB02 | 8-bit | 2 | 1 | RAM |
- | MCP47FVB12 | 10-bit | 2 | 1 | RAM |
- | MCP47FVB22 | 12-bit | 2 | 1 | RAM |
- |------------|--------------|-------------|-------------|------------|
- | MCP47FVB04 | 8-bit | 4 | 2 | RAM |
- | MCP47FVB14 | 10-bit | 4 | 2 | RAM |
- | MCP47FVB24 | 12-bit | 4 | 2 | RAM |
- |------------|--------------|-------------|-------------|------------|
- | MCP47FVB08 | 8-bit | 8 | 2 | RAM |
- | MCP47FVB18 | 10-bit | 8 | 2 | RAM |
- | MCP47FVB28 | 12-bit | 8 | 2 | RAM |
- |------------|--------------|-------------|-------------|------------|
- | MCP47FEB04 | 8-bit | 4 | 2 | EEPROM |
- | MCP47FEB14 | 10-bit | 4 | 2 | EEPROM |
- | MCP47FEB24 | 12-bit | 4 | 2 | EEPROM |
- |------------|--------------|-------------|-------------|------------|
- | MCP47FEB08 | 8-bit | 8 | 2 | EEPROM |
- | MCP47FEB18 | 10-bit | 8 | 2 | EEPROM |
- | MCP47FEB28 | 12-bit | 8 | 2 | EEPROM |
- +------------+--------------+-------------+-------------+------------+
+ +------------+--------------+-------------+-------------+------------+------------+
+ | Device | Resolution | Channels | Vref number | Memory | Interface |
+ |------------|--------------|-------------|-------------|------------|------------|
+ | MCP47FEB01 | | 1 | 1 | EEPROM | I2C |
+ | MCP47FEB02 | | 2 | 1 | EEPROM | I2C |
+ | MCP47FEB04 | | 4 | 2 | EEPROM | I2C |
+ | MCP47FEB08 | 8-bit | 8 | 2 | EEPROM | I2C |
+ | MCP48FEB01 | | 1 | 1 | EEPROM | SPI |
+ | MCP48FEB02 | | 2 | 1 | EEPROM | SPI |
+ | MCP48FEB04 | | 4 | 2 | EEPROM | SPI |
+ | MCP48FEB08 | | 8 | 2 | EEPROM | SPI |
+ |------------|--------------|-------------|-------------|------------|------------|
+ | MCP47FEB11 | | 1 | 1 | EEPROM | I2C |
+ | MCP47FEB12 | | 2 | 1 | EEPROM | I2C |
+ | MCP47FEB14 | | 4 | 2 | EEPROM | I2C |
+ | MCP47FEB18 | 10-bit | 8 | 2 | EEPROM | I2C |
+ | MCP48FEB11 | | 1 | 1 | EEPROM | SPI |
+ | MCP48FEB12 | | 2 | 1 | EEPROM | SPI |
+ | MCP48FEB14 | | 4 | 2 | EEPROM | SPI |
+ | MCP48FEB18 | | 8 | 2 | EEPROM | SPI |
+ |------------|--------------|-------------|-------------|------------|------------|
+ | MCP47FEB21 | | 1 | 1 | EEPROM | I2C |
+ | MCP47FEB22 | | 2 | 1 | EEPROM | I2C |
+ | MCP47FEB24 | | 4 | 2 | EEPROM | I2C |
+ | MCP47FEB28 | 12-bit | 8 | 2 | EEPROM | I2C |
+ | MCP48FEB21 | | 1 | 1 | EEPROM | SPI |
+ | MCP48FEB22 | | 2 | 1 | EEPROM | SPI |
+ | MCP48FEB24 | | 4 | 2 | EEPROM | SPI |
+ | MCP48FEB28 | | 8 | 2 | EEPROM | SPI |
+ |------------|--------------|-------------|-------------|------------|------------|
+ | MCP47FVB01 | | 1 | 1 | RAM | I2C |
+ | MCP47FVB02 | | 2 | 1 | RAM | I2C |
+ | MCP47FVB04 | | 4 | 2 | RAM | I2C |
+ | MCP47FVB08 | 8-bit | 8 | 2 | RAM | I2C |
+ | MCP48FVB01 | | 1 | 1 | RAM | SPI |
+ | MCP48FVB02 | | 2 | 1 | RAM | SPI |
+ | MCP48FVB04 | | 4 | 2 | RAM | SPI |
+ | MCP48FVB08 | | 8 | 2 | RAM | SPI |
+ |------------|--------------|-------------|-------------|------------|------------|
+ | MCP47FVB11 | | 1 | 1 | RAM | I2C |
+ | MCP47FVB12 | | 2 | 1 | RAM | I2C |
+ | MCP47FVB14 | | 4 | 2 | RAM | I2C |
+ | MCP47FVB18 | 10-bit | 8 | 2 | RAM | I2C |
+ | MCP48FVB11 | | 1 | 1 | RAM | SPI |
+ | MCP48FVB12 | | 2 | 1 | RAM | SPI |
+ | MCP48FVB14 | | 4 | 2 | RAM | SPI |
+ | MCP48FVB18 | | 8 | 2 | RAM | SPI |
+ |------------|--------------|-------------|-------------|------------|------------|
+ | MCP47FVB21 | | 1 | 1 | RAM | I2C |
+ | MCP47FVB22 | | 2 | 1 | RAM | I2C |
+ | MCP47FVB24 | | 4 | 2 | RAM | I2C |
+ | MCP47FVB28 | 12-bit | 8 | 2 | RAM | I2C |
+ | MCP48FVB21 | | 1 | 1 | RAM | SPI |
+ | MCP48FVB22 | | 2 | 1 | RAM | SPI |
+ | MCP48FVB24 | | 4 | 2 | RAM | SPI |
+ | MCP48FVB28 | | 8 | 2 | RAM | SPI |
+ +------------+--------------+-------------+-------------+------------+------------+
properties:
compatible:
@@ -84,10 +118,37 @@ properties:
- microchip,mcp47feb08
- microchip,mcp47feb18
- microchip,mcp47feb28
+ - microchip,mcp48feb01
+ - microchip,mcp48feb02
+ - microchip,mcp48feb04
+ - microchip,mcp48feb08
+ - microchip,mcp48feb11
+ - microchip,mcp48feb12
+ - microchip,mcp48feb14
+ - microchip,mcp48feb18
+ - microchip,mcp48feb21
+ - microchip,mcp48feb22
+ - microchip,mcp48feb24
+ - microchip,mcp48feb28
+ - microchip,mcp48fvb01
+ - microchip,mcp48fvb02
+ - microchip,mcp48fvb04
+ - microchip,mcp48fvb08
+ - microchip,mcp48fvb11
+ - microchip,mcp48fvb12
+ - microchip,mcp48fvb14
+ - microchip,mcp48fvb18
+ - microchip,mcp48fvb21
+ - microchip,mcp48fvb22
+ - microchip,mcp48fvb24
+ - microchip,mcp48fvb28
reg:
maxItems: 1
+ spi-max-frequency:
+ maximum: 10000000
+
"#address-cells":
const: 1
@@ -178,6 +239,21 @@ required:
- vdd-supply
allOf:
+ - if:
+ properties:
+ compatible:
+ contains:
+ pattern: "^microchip,mcp48f[ev]b[0-2][1248]$"
+ then:
+ $ref: /schemas/spi/spi-peripheral-props.yaml#
+ dependencies:
+ spi-cpha: [ spi-cpol ]
+ spi-cpol: [ spi-cpha ]
+ else:
+ properties:
+ spi-max-frequency: false
+ spi-cpha: false
+ spi-cpol: false
- if:
properties:
compatible:
@@ -189,6 +265,12 @@ allOf:
- microchip,mcp47fvb01
- microchip,mcp47fvb11
- microchip,mcp47fvb21
+ - microchip,mcp48feb01
+ - microchip,mcp48feb11
+ - microchip,mcp48feb21
+ - microchip,mcp48fvb01
+ - microchip,mcp48fvb11
+ - microchip,mcp48fvb21
then:
properties:
lat1-gpios: false
@@ -211,6 +293,12 @@ allOf:
- microchip,mcp47fvb02
- microchip,mcp47fvb12
- microchip,mcp47fvb22
+ - microchip,mcp48feb02
+ - microchip,mcp48feb12
+ - microchip,mcp48feb22
+ - microchip,mcp48fvb02
+ - microchip,mcp48fvb12
+ - microchip,mcp48fvb22
then:
properties:
lat1-gpios: false
@@ -233,6 +321,12 @@ allOf:
- microchip,mcp47feb04
- microchip,mcp47feb14
- microchip,mcp47feb24
+ - microchip,mcp48feb04
+ - microchip,mcp48feb14
+ - microchip,mcp48feb24
+ - microchip,mcp48fvb04
+ - microchip,mcp48fvb14
+ - microchip,mcp48fvb24
then:
patternProperties:
"^channel@[0-3]$":
@@ -251,6 +345,12 @@ allOf:
- microchip,mcp47feb08
- microchip,mcp47feb18
- microchip,mcp47feb28
+ - microchip,mcp48feb08
+ - microchip,mcp48feb18
+ - microchip,mcp48feb28
+ - microchip,mcp48fvb08
+ - microchip,mcp48fvb18
+ - microchip,mcp48fvb28
then:
patternProperties:
"^channel@[0-7]$":
@@ -272,7 +372,7 @@ allOf:
properties:
microchip,vref1-buffered: false
-additionalProperties: false
+unevaluatedProperties: false
examples:
- |
@@ -299,4 +399,29 @@ examples:
};
};
};
+ - |
+ spi {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ dac@0 {
+ compatible = "microchip,mcp48feb02";
+ reg = <0x0>;
+ vdd-supply = <&vdac_vdd>;
+ vref-supply = <&vref_reg>;
+ spi-max-frequency = <10000000>;
+
+ #address-cells = <1>;
+ #size-cells = <0>;
+ channel@0 {
+ reg = <0>;
+ label = "Adjustable_voltage_ch0";
+ };
+
+ channel@1 {
+ reg = <0x1>;
+ label = "Adjustable_voltage_ch1";
+ };
+ };
+ };
...
diff --git a/Documentation/devicetree/bindings/iio/frequency/adi,ad9910.yaml b/Documentation/devicetree/bindings/iio/frequency/adi,ad9910.yaml
new file mode 100644
index 000000000000..4eebbd388b27
--- /dev/null
+++ b/Documentation/devicetree/bindings/iio/frequency/adi,ad9910.yaml
@@ -0,0 +1,209 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/iio/frequency/adi,ad9910.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Analog Devices AD9910 Direct Digital Synthesizer
+
+maintainers:
+ - Rodrigo Alencar
+
+description: >
+ The AD9910 is a 1 GSPS direct digital synthesizer (DDS) with an integrated
+ 14-bit DAC. It features single tone mode with 8 configurable profiles,
+ a digital ramp generator, RAM control, OSK, and a parallel data port for
+ high-speed streaming.
+
+ https://www.analog.com/en/products/ad9910.html
+
+properties:
+ compatible:
+ const: adi,ad9910
+
+ reg:
+ maxItems: 1
+
+ spi-max-frequency:
+ maximum: 70000000
+
+ clocks:
+ minItems: 1
+ items:
+ - description: Reference clock (REF_CLK).
+ - description: Optional synchronization clock (SYNC_IN).
+
+ clock-names:
+ minItems: 1
+ items:
+ - const: ref_clk
+ - const: sync_in
+
+ '#clock-cells':
+ const: 1
+
+ clock-output-names:
+ items:
+ - const: sync_clk
+ - const: pdclk
+ - const: sync_out
+
+ interrupts:
+ minItems: 1
+ maxItems: 2
+ description:
+ Requires interrupt-names property with the same number of items. The
+ supported interrupts are 'drover' (digital ramp generator limit) and
+ 'ram_swp_ovr' (end of RAM sweep).
+
+ interrupt-names:
+ minItems: 1
+ maxItems: 2
+ items:
+ enum: [ drover, ram_swp_ovr ]
+
+ dvdd-io33-supply:
+ description: 3.3V Digital I/O supply.
+
+ avdd33-supply:
+ description: 3.3V Analog DAC supply.
+
+ dvdd18-supply:
+ description: 1.8V Digital Core supply.
+
+ avdd18-supply:
+ description: 1.8V Analog Core supply.
+
+ reset-gpios:
+ maxItems: 1
+ description:
+ GPIOs controlling the Main Device reset.
+
+ io-reset-gpios:
+ maxItems: 1
+ description:
+ GPIO controlling the I/O_RESET pin.
+
+ powerdown-gpios:
+ maxItems: 1
+ description:
+ GPIO controlling the EXT_PWR_DWN pin.
+
+ update-gpios:
+ maxItems: 1
+ description:
+ GPIO controlling the I/O_UPDATE pin.
+
+ profile-gpios:
+ minItems: 3
+ maxItems: 3
+ description:
+ GPIOs controlling the PROFILE[2:0] pins for profile selection.
+
+ sync-err-gpios:
+ maxItems: 1
+ description:
+ GPIO used to read SYNC_SMP_ERR pin status.
+
+ lock-detect-gpios:
+ maxItems: 1
+ description:
+ GPIO used to read PLL_LOCK pin status.
+
+ pwms:
+ maxItems: 1
+ description:
+ PWM used to drive the DRCTL pin, which controls the digital ramp
+ generator slope direction.
+
+ pwm-names:
+ items:
+ - const: drctl
+
+ adi,pll-enable:
+ type: boolean
+ description:
+ Enables the internal PLL. Applicable when external loop filter components
+ are connected to the PLL_LOOP_FILTER pin and low reference clock
+ frequencies are used, often provided by a crystal or by a single-ended
+ on-board oscillator.
+
+ adi,charge-pump-current-microamp:
+ minimum: 212
+ maximum: 387
+ default: 212
+ description:
+ PLL charge pump current in microamps. Only applicable when the internal
+ PLL is enabled. The value is rounded to the nearest supported step. This
+ value depends mostly on the loop filter design.
+
+ adi,refclk-out-drive-strength:
+ $ref: /schemas/types.yaml#/definitions/string
+ enum: [ disabled, low, medium, high ]
+ default: disabled
+ description:
+ Reference clock output (DRV0) drive strength. Only applicable when
+ the internal PLL is enabled.
+
+dependencies:
+ adi,charge-pump-current-microamp: [ 'adi,pll-enable' ]
+ adi,refclk-out-drive-strength: [ 'adi,pll-enable' ]
+ lock-detect-gpios: [ 'adi,pll-enable' ]
+ interrupts: [ interrupt-names ]
+ pwms: [ pwm-names ]
+
+required:
+ - compatible
+ - reg
+ - clocks
+ - clock-names
+ - '#clock-cells'
+ - dvdd-io33-supply
+ - avdd33-supply
+ - dvdd18-supply
+ - avdd18-supply
+
+allOf:
+ - $ref: /schemas/spi/spi-peripheral-props.yaml#
+
+unevaluatedProperties: false
+
+examples:
+ - |
+ #include
+ spi {
+ #address-cells = <1>;
+ #size-cells = <0>;
+ dds@0 {
+ compatible = "adi,ad9910";
+ reg = <0>;
+ spi-max-frequency = <1000000>;
+
+ #clock-cells = <1>;
+ clock-output-names = "sync_clk", "pdclk", "sync_out";
+
+ clocks = <&ad9910_refclk>;
+ clock-names = "ref_clk";
+
+ dvdd-io33-supply = <&vdd_io33>;
+ avdd33-supply = <&vdd_a33>;
+ dvdd18-supply = <&vdd_d18>;
+ avdd18-supply = <&vdd_a18>;
+
+ reset-gpios = <&gpio 0 GPIO_ACTIVE_HIGH>;
+ io-reset-gpios = <&gpio 1 GPIO_ACTIVE_HIGH>;
+ powerdown-gpios = <&gpio 2 GPIO_ACTIVE_HIGH>;
+ update-gpios = <&gpio 3 GPIO_ACTIVE_HIGH>;
+ profile-gpios = <&gpio 4 GPIO_ACTIVE_HIGH>,
+ <&gpio 5 GPIO_ACTIVE_HIGH>,
+ <&gpio 6 GPIO_ACTIVE_HIGH>;
+
+ pwms = <&pwm 0 1000000 0>;
+ pwm-names = "drctl";
+
+ adi,pll-enable;
+ adi,charge-pump-current-microamp = <387>;
+ adi,refclk-out-drive-strength = "disabled";
+ };
+ };
+...
diff --git a/Documentation/devicetree/bindings/iio/imu/invensense,icm42600.yaml b/Documentation/devicetree/bindings/iio/imu/invensense,icm42600.yaml
index 81b6e85decd5..9e22b603d47f 100644
--- a/Documentation/devicetree/bindings/iio/imu/invensense,icm42600.yaml
+++ b/Documentation/devicetree/bindings/iio/imu/invensense,icm42600.yaml
@@ -26,16 +26,20 @@ description: |
properties:
compatible:
- enum:
- - invensense,icm42600
- - invensense,icm42602
- - invensense,icm42605
- - invensense,icm42607
- - invensense,icm42607p
- - invensense,icm42622
- - invensense,icm42631
- - invensense,icm42686
- - invensense,icm42688
+ oneOf:
+ - enum:
+ - invensense,icm42600
+ - invensense,icm42602
+ - invensense,icm42605
+ - invensense,icm42607
+ - invensense,icm42607p
+ - invensense,icm42622
+ - invensense,icm42631
+ - invensense,icm42686
+ - invensense,icm42688
+ - items:
+ - const: invensense,icm42630
+ - const: invensense,icm42631
reg:
maxItems: 1
diff --git a/Documentation/devicetree/bindings/iio/light/adux1020.yaml b/Documentation/devicetree/bindings/iio/light/adux1020.yaml
index d7d14f2f1c20..83abe984a1da 100644
--- a/Documentation/devicetree/bindings/iio/light/adux1020.yaml
+++ b/Documentation/devicetree/bindings/iio/light/adux1020.yaml
@@ -40,10 +40,10 @@ examples:
#size-cells = <0>;
adux1020@64 {
- compatible = "adi,adux1020";
- reg = <0x64>;
- interrupt-parent = <&msmgpio>;
- interrupts = <24 IRQ_TYPE_LEVEL_HIGH>;
+ compatible = "adi,adux1020";
+ reg = <0x64>;
+ interrupt-parent = <&msmgpio>;
+ interrupts = <24 IRQ_TYPE_LEVEL_HIGH>;
};
};
...
diff --git a/Documentation/devicetree/bindings/iio/light/amstaos,tsl2591.yaml b/Documentation/devicetree/bindings/iio/light/amstaos,tsl2591.yaml
index 83b88c6a243d..512625d625a8 100644
--- a/Documentation/devicetree/bindings/iio/light/amstaos,tsl2591.yaml
+++ b/Documentation/devicetree/bindings/iio/light/amstaos,tsl2591.yaml
@@ -45,6 +45,6 @@ examples:
compatible = "amstaos,tsl2591";
reg = <0x29>;
interrupts = <20 IRQ_TYPE_EDGE_FALLING>;
- };
+ };
};
...
diff --git a/Documentation/devicetree/bindings/iio/light/capella,cm32181.yaml b/Documentation/devicetree/bindings/iio/light/capella,cm32181.yaml
new file mode 100644
index 000000000000..e64085a9cb2b
--- /dev/null
+++ b/Documentation/devicetree/bindings/iio/light/capella,cm32181.yaml
@@ -0,0 +1,44 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/iio/light/capella,cm32181.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Capella CM32181 ambient light sensor
+
+maintainers:
+ - Kevin Tsai
+
+properties:
+ compatible:
+ const: capella,cm32181
+
+ reg:
+ maxItems: 1
+
+ vdd-supply: true
+
+ interrupts:
+ maxItems: 1
+
+required:
+ - compatible
+ - reg
+
+additionalProperties: false
+
+examples:
+ - |
+ #include
+ i2c {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ light-sensor@10 {
+ compatible = "capella,cm32181";
+ reg = <0x10>;
+ vdd-supply = <&vdd_3v3>;
+ interrupt-parent = <&gpio>;
+ interrupts = <17 IRQ_TYPE_EDGE_RISING>;
+ };
+ };
diff --git a/Documentation/devicetree/bindings/iio/light/isl29018.yaml b/Documentation/devicetree/bindings/iio/light/isl29018.yaml
index 0ea278b07d1c..9524f0a1d195 100644
--- a/Documentation/devicetree/bindings/iio/light/isl29018.yaml
+++ b/Documentation/devicetree/bindings/iio/light/isl29018.yaml
@@ -50,9 +50,9 @@ examples:
#size-cells = <0>;
sensor@44 {
- compatible = "isil,isl29018";
- reg = <0x44>;
- interrupts-extended = <&msmgpio 61 IRQ_TYPE_LEVEL_HIGH>;
+ compatible = "isil,isl29018";
+ reg = <0x44>;
+ interrupts-extended = <&msmgpio 61 IRQ_TYPE_LEVEL_HIGH>;
};
};
...
diff --git a/Documentation/devicetree/bindings/iio/light/liteon,ltr501.yaml b/Documentation/devicetree/bindings/iio/light/liteon,ltr501.yaml
index c8074f180a79..20abd7da080d 100644
--- a/Documentation/devicetree/bindings/iio/light/liteon,ltr501.yaml
+++ b/Documentation/devicetree/bindings/iio/light/liteon,ltr501.yaml
@@ -9,15 +9,14 @@ title: LiteON LTR501 I2C Proximity and Light sensor
maintainers:
- Nikita Travkin
-allOf:
- - $ref: ../common.yaml#
-
properties:
compatible:
enum:
+ - liteon,ltr301
+ - liteon,ltr303
+ - liteon,ltr329
- liteon,ltr501
- liteon,ltr559
- - liteon,ltr301
reg:
maxItems: 1
@@ -36,6 +35,31 @@ required:
- compatible
- reg
+allOf:
+ - $ref: ../common.yaml#
+
+ - if:
+ properties:
+ compatible:
+ contains:
+ enum:
+ - liteon,ltr329
+ then:
+ properties:
+ interrupts: false
+
+ - if:
+ properties:
+ compatible:
+ contains:
+ enum:
+ - liteon,ltr301
+ - liteon,ltr303
+ - liteon,ltr329
+ then:
+ properties:
+ proximity-near-level: false
+
examples:
- |
#include
diff --git a/Documentation/devicetree/bindings/iio/light/noa1305.yaml b/Documentation/devicetree/bindings/iio/light/noa1305.yaml
index fe7bfe1adbda..e1c64c151932 100644
--- a/Documentation/devicetree/bindings/iio/light/noa1305.yaml
+++ b/Documentation/devicetree/bindings/iio/light/noa1305.yaml
@@ -39,8 +39,8 @@ examples:
#size-cells = <0>;
light@39 {
- compatible = "onnn,noa1305";
- reg = <0x39>;
+ compatible = "onnn,noa1305";
+ reg = <0x39>;
};
};
...
diff --git a/Documentation/devicetree/bindings/iio/light/stk33xx.yaml b/Documentation/devicetree/bindings/iio/light/stk33xx.yaml
index e4341fdced98..f655a570aac7 100644
--- a/Documentation/devicetree/bindings/iio/light/stk33xx.yaml
+++ b/Documentation/devicetree/bindings/iio/light/stk33xx.yaml
@@ -4,14 +4,14 @@
$id: http://devicetree.org/schemas/iio/light/stk33xx.yaml#
$schema: http://devicetree.org/meta-schemas/core.yaml#
-title: |
- Sensortek STK33xx I2C Ambient Light and Proximity sensor
+title: Sensortek STK33xx/STK36C61 I2C Ambient Light and Proximity sensor
maintainers:
- Jonathan Cameron
-description: |
- Ambient light and proximity sensor over an i2c interface.
+description:
+ Ambient light and proximity sensor over an i2c interface. The STK36C61
+ additionally provides RGBC colour channels.
allOf:
- $ref: ../common.yaml#
@@ -26,6 +26,7 @@ properties:
- items:
- enum:
- sensortek,stk3013
+ - sensortek,stk36c61
- const: sensortek,stk3310
reg:
@@ -52,11 +53,11 @@ examples:
#size-cells = <0>;
stk3310@48 {
- compatible = "sensortek,stk3310";
- reg = <0x48>;
- proximity-near-level = <25>;
- interrupt-parent = <&gpio1>;
- interrupts = <5 IRQ_TYPE_LEVEL_LOW>;
+ compatible = "sensortek,stk3310";
+ reg = <0x48>;
+ proximity-near-level = <25>;
+ interrupt-parent = <&gpio1>;
+ interrupts = <5 IRQ_TYPE_LEVEL_LOW>;
};
};
...
diff --git a/Documentation/devicetree/bindings/iio/light/tsl2583.yaml b/Documentation/devicetree/bindings/iio/light/tsl2583.yaml
index 7b92ba8cbb9f..aed4ab710e46 100644
--- a/Documentation/devicetree/bindings/iio/light/tsl2583.yaml
+++ b/Documentation/devicetree/bindings/iio/light/tsl2583.yaml
@@ -41,8 +41,8 @@ examples:
#size-cells = <0>;
light-sensor@29 {
- compatible = "amstaos,tsl2581";
- reg = <0x29>;
+ compatible = "amstaos,tsl2581";
+ reg = <0x29>;
};
};
...
diff --git a/Documentation/devicetree/bindings/iio/light/tsl2772.yaml b/Documentation/devicetree/bindings/iio/light/tsl2772.yaml
index 9921ccaa64a0..38a3c82cb879 100644
--- a/Documentation/devicetree/bindings/iio/light/tsl2772.yaml
+++ b/Documentation/devicetree/bindings/iio/light/tsl2772.yaml
@@ -74,13 +74,13 @@ examples:
#size-cells = <0>;
sensor@39 {
- compatible = "amstaos,tsl2772";
- reg = <0x39>;
- interrupts-extended = <&msmgpio 61 IRQ_TYPE_EDGE_FALLING>;
- vdd-supply = <&pm8941_l17>;
- vddio-supply = <&pm8941_lvs1>;
- amstaos,proximity-diodes = <0>;
- led-max-microamp = <100000>;
+ compatible = "amstaos,tsl2772";
+ reg = <0x39>;
+ interrupts-extended = <&msmgpio 61 IRQ_TYPE_EDGE_FALLING>;
+ vdd-supply = <&pm8941_l17>;
+ vddio-supply = <&pm8941_lvs1>;
+ amstaos,proximity-diodes = <0>;
+ led-max-microamp = <100000>;
};
};
...
diff --git a/Documentation/devicetree/bindings/iio/light/vishay,veml6030.yaml b/Documentation/devicetree/bindings/iio/light/vishay,veml6030.yaml
index 0041e1db6838..2eb1932f7b14 100644
--- a/Documentation/devicetree/bindings/iio/light/vishay,veml6030.yaml
+++ b/Documentation/devicetree/bindings/iio/light/vishay,veml6030.yaml
@@ -4,7 +4,8 @@
$id: http://devicetree.org/schemas/iio/light/vishay,veml6030.yaml#
$schema: http://devicetree.org/meta-schemas/core.yaml#
-title: VEML3235, VEML3328, VEML6030, VEML6035 and VEML7700 Ambient Light Sensors (ALS)
+title: VEML3235, VEML3328, VEML6030, VEML6031x00 series, VEML6035
+ and VEML7700 Ambient Light Sensors (ALS)
maintainers:
- Rishi Gupta
@@ -23,6 +24,8 @@ description: |
https://www.vishay.com/docs/80131/veml3235.pdf
https://www.vishay.com/docs/84968/veml3328.pdf
https://www.vishay.com/docs/84366/veml6030.pdf
+ https://www.vishay.com/docs/80007/veml6031x00.pdf
+ https://www.vishay.com/docs/80008/veml6031x01.pdf
https://www.vishay.com/docs/84889/veml6035.pdf
https://www.vishay.com/docs/84286/veml7700.pdf
@@ -32,6 +35,10 @@ properties:
- vishay,veml3235
- vishay,veml3328
- vishay,veml6030
+ - vishay,veml6031x00
+ - vishay,veml6031x01
+ - vishay,veml60311x00
+ - vishay,veml60311x01
- vishay,veml6035
- vishay,veml7700
@@ -69,6 +76,8 @@ allOf:
properties:
compatible:
enum:
+ - vishay,veml6031x00
+ - vishay,veml6031x01
- vishay,veml6035
then:
properties:
@@ -82,6 +91,8 @@ allOf:
enum:
- vishay,veml3235
- vishay,veml3328
+ - vishay,veml60311x00
+ - vishay,veml60311x01
- vishay,veml7700
then:
properties:
@@ -101,10 +112,10 @@ examples:
#size-cells = <0>;
light-sensor@10 {
- compatible = "vishay,veml6030";
- reg = <0x10>;
- interrupts = <12 IRQ_TYPE_LEVEL_LOW>;
- vdd-supply = <&vdd>;
+ compatible = "vishay,veml6030";
+ reg = <0x10>;
+ interrupts = <12 IRQ_TYPE_LEVEL_LOW>;
+ vdd-supply = <&vdd>;
};
};
...
diff --git a/Documentation/devicetree/bindings/iio/pressure/infineon,dps310.yaml b/Documentation/devicetree/bindings/iio/pressure/infineon,dps310.yaml
index e5d1e6c48939..1912a1b0b4ba 100644
--- a/Documentation/devicetree/bindings/iio/pressure/infineon,dps310.yaml
+++ b/Documentation/devicetree/bindings/iio/pressure/infineon,dps310.yaml
@@ -45,10 +45,10 @@ examples:
#size-cells = <0>;
dps: pressure-sensor@76 {
- compatible = "infineon,dps310";
- reg = <0x76>;
- #io-channel-cells = <0>;
- vdd-supply = <&vref1>;
- vddio-supply = <&vref2>;
+ compatible = "infineon,dps310";
+ reg = <0x76>;
+ #io-channel-cells = <0>;
+ vdd-supply = <&vref1>;
+ vddio-supply = <&vref2>;
};
};
diff --git a/Documentation/devicetree/bindings/iio/proximity/pulsedlight,lidar-lite-v2.yaml b/Documentation/devicetree/bindings/iio/proximity/pulsedlight,lidar-lite-v2.yaml
new file mode 100644
index 000000000000..dd739319b9eb
--- /dev/null
+++ b/Documentation/devicetree/bindings/iio/proximity/pulsedlight,lidar-lite-v2.yaml
@@ -0,0 +1,71 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/iio/proximity/pulsedlight,lidar-lite-v2.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Pulsedlight/Garmin LIDAR-Lite range-finding sensors
+
+maintainers:
+ - Matt Ranostay
+ - Rodrigo Gobbi
+
+description: |
+ This binding covers the I2C interface of the Pulsedlight/Garmin
+ LIDAR-Lite v2 and v3 laser rangefinders.
+
+ Besides I2C, the mode control pin can also trigger acquisitions and
+ report the measured distance through a PWM signal, without using I2C
+ at all. That usage is bidirectional and non-cyclic, and is not
+ described by this binding. The same pin can also be used, while I2C
+ remains the active interface, as a plain status output signalling
+ when an acquisition has completed.
+
+ Datasheets:
+ https://static.garmin.com/pumac/LIDAR_Lite_v3_Operation_Manual_and_Technical_Specifications.pdf
+ https://github.com/PulsedLight3D/LIDAR-Lite-Documentation/blob/master/Docs/LIDAR-Lite-v2-Docs.pdf
+
+properties:
+ compatible:
+ oneOf:
+ - items:
+ - enum:
+ - grmn,lidar-lite-v3
+ - const: pulsedlight,lidar-lite-v2
+ - const: pulsedlight,lidar-lite-v2
+
+ reg:
+ maxItems: 1
+
+ powerdown-gpios:
+ description: GPIO that can be driven low to shut off power to the device.
+ maxItems: 1
+
+ vdd-supply: true
+
+ interrupts:
+ description:
+ Mode control pin used as a status output, driven while the device is
+ busy performing an acquisition. Can be used to signal completion
+ instead of polling over I2C.
+ maxItems: 1
+
+required:
+ - compatible
+ - reg
+ - vdd-supply
+
+additionalProperties: false
+
+examples:
+ - |
+ i2c {
+ #address-cells = <1>;
+ #size-cells = <0>;
+ lidar@62 {
+ compatible = "grmn,lidar-lite-v3", "pulsedlight,lidar-lite-v2";
+ reg = <0x62>;
+ vdd-supply = <&vdd_5v0>;
+ };
+ };
+...
diff --git a/Documentation/devicetree/bindings/iio/proximity/vishay,vcnl3020.yaml b/Documentation/devicetree/bindings/iio/proximity/vishay,vcnl3020.yaml
index fbd3a2e32280..f84aece886ab 100644
--- a/Documentation/devicetree/bindings/iio/proximity/vishay,vcnl3020.yaml
+++ b/Documentation/devicetree/bindings/iio/proximity/vishay,vcnl3020.yaml
@@ -57,8 +57,8 @@ examples:
#size-cells = <0>;
proximity@13 {
- compatible = "vishay,vcnl3020";
- reg = <0x13>;
- vishay,led-current-microamp = <200000>;
+ compatible = "vishay,vcnl3020";
+ reg = <0x13>;
+ vishay,led-current-microamp = <200000>;
};
};
diff --git a/Documentation/devicetree/bindings/iio/temperature/adi,ltc2983.yaml b/Documentation/devicetree/bindings/iio/temperature/adi,ltc2983.yaml
index 13e5f29f0588..09b809f01550 100644
--- a/Documentation/devicetree/bindings/iio/temperature/adi,ltc2983.yaml
+++ b/Documentation/devicetree/bindings/iio/temperature/adi,ltc2983.yaml
@@ -17,6 +17,7 @@ description: |
- LTC2986
- LTM2985
+ https://www.analog.com/media/en/technical-documentation/data-sheets/adt7604.pdf
https://www.analog.com/media/en/technical-documentation/data-sheets/2983fc.pdf
https://www.analog.com/media/en/technical-documentation/data-sheets/2984fb.pdf
https://www.analog.com/media/en/technical-documentation/data-sheets/29861fa.pdf
diff --git a/Documentation/devicetree/bindings/interconnect/qcom,kuno-rpmh.yaml b/Documentation/devicetree/bindings/interconnect/qcom,kuno-rpmh.yaml
new file mode 100644
index 000000000000..20d169b31142
--- /dev/null
+++ b/Documentation/devicetree/bindings/interconnect/qcom,kuno-rpmh.yaml
@@ -0,0 +1,118 @@
+# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/interconnect/qcom,kuno-rpmh.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Qualcomm RPMh Network-On-Chip Interconnect on Kuno SoC
+
+maintainers:
+ - Hardeep Sharma
+
+description: |
+ RPMh interconnect providers support system bandwidth requirements through
+ RPMh hardware accelerators known as Bus Clock Manager (BCM). The provider is
+ able to communicate with the BCM through the Resource State Coordinator (RSC)
+ associated with each execution environment. Provider nodes must point to at
+ least one RPMh device child node pertaining to their RSC and each provider
+ can map to multiple RPMh resources.
+
+ See also: include/dt-bindings/interconnect/qcom,kuno.h
+
+properties:
+ compatible:
+ enum:
+ - qcom,kuno-aggre-noc
+ - qcom,kuno-clk-virt
+ - qcom,kuno-cnoc-main
+ - qcom,kuno-dc-noc
+ - qcom,kuno-mc-virt
+ - qcom,kuno-mem-noc
+ - qcom,kuno-pcie-anoc
+ - qcom,kuno-system-noc
+
+ reg:
+ maxItems: 1
+
+ clocks:
+ minItems: 1
+ maxItems: 2
+
+required:
+ - compatible
+
+allOf:
+ - $ref: qcom,rpmh-common.yaml#
+ - if:
+ properties:
+ compatible:
+ contains:
+ enum:
+ - qcom,kuno-clk-virt
+ - qcom,kuno-mc-virt
+ then:
+ properties:
+ reg: false
+ else:
+ required:
+ - reg
+
+ - if:
+ properties:
+ compatible:
+ contains:
+ const: qcom,kuno-aggre-noc
+ then:
+ properties:
+ clocks:
+ items:
+ - description: System NoC USB SF AXI clock
+ - description: IPA clock
+
+ - if:
+ properties:
+ compatible:
+ contains:
+ const: qcom,kuno-system-noc
+ then:
+ properties:
+ clocks:
+ items:
+ - description: IPA clock
+
+ - if:
+ properties:
+ compatible:
+ contains:
+ enum:
+ - qcom,kuno-aggre-noc
+ - qcom,kuno-system-noc
+ then:
+ required:
+ - clocks
+ else:
+ properties:
+ clocks: false
+
+unevaluatedProperties: false
+
+examples:
+ - |
+ #include
+ #include
+
+ clk_virt: interconnect-0 {
+ compatible = "qcom,kuno-clk-virt";
+ #interconnect-cells = <1>;
+ qcom,bcm-voters = <&apps_bcm_voter>;
+ };
+
+ aggre_noc: interconnect@1640000 {
+ compatible = "qcom,kuno-aggre-noc";
+ reg = <0x01640000 0x33400>;
+ clocks = <&gcc GCC_SYS_NOC_USB_SF_AXI_CLK>,
+ <&rpmhcc RPMH_IPA_CLK>;
+ #interconnect-cells = <1>;
+ qcom,bcm-voters = <&apps_bcm_voter>;
+ };
+...
diff --git a/Documentation/devicetree/bindings/interconnect/qcom,osm-l3.yaml b/Documentation/devicetree/bindings/interconnect/qcom,osm-l3.yaml
index 3b8ebe17a976..cd6685683bab 100644
--- a/Documentation/devicetree/bindings/interconnect/qcom,osm-l3.yaml
+++ b/Documentation/devicetree/bindings/interconnect/qcom,osm-l3.yaml
@@ -31,6 +31,7 @@ properties:
- items:
- enum:
- qcom,eliza-epss-l3
+ - qcom,milos-epss-l3
- qcom,sa8775p-epss-l3
- qcom,sc7280-epss-l3
- qcom,sc8280xp-epss-l3
diff --git a/Documentation/devicetree/bindings/mfd/mediatek,mt6397.yaml b/Documentation/devicetree/bindings/mfd/mediatek,mt6397.yaml
index 3cbc0dc12c31..d2de227ae7a6 100644
--- a/Documentation/devicetree/bindings/mfd/mediatek,mt6397.yaml
+++ b/Documentation/devicetree/bindings/mfd/mediatek,mt6397.yaml
@@ -159,6 +159,23 @@ properties:
required:
- compatible
+ efuse:
+ type: object
+ unevaluatedProperties: false
+ description:
+ The efuse is responsible for storing calibration data, such as thermal
+ sensor calibration.
+
+ properties:
+ compatible:
+ const: mediatek,mt6323-efuse
+
+ nvmem-layout:
+ $ref: /schemas/nvmem/layouts/nvmem-layout.yaml#
+
+ required:
+ - compatible
+
leds:
type: object
additionalProperties: false
@@ -307,6 +324,10 @@ examples:
interrupt-controller;
#interrupt-cells = <2>;
+ efuse {
+ compatible = "mediatek,mt6323-efuse";
+ };
+
leds {
compatible = "mediatek,mt6323-led";
#address-cells = <1>;
diff --git a/Documentation/devicetree/bindings/misc/pci1179,0220.yaml b/Documentation/devicetree/bindings/misc/pci1179,0220.yaml
new file mode 100644
index 000000000000..c92c8d3d33f7
--- /dev/null
+++ b/Documentation/devicetree/bindings/misc/pci1179,0220.yaml
@@ -0,0 +1,146 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/misc/pci1179,0220.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Toshiba TC9564 internal PCI endpoint function
+
+maintainers:
+ - Alex Elder
+ - Daniel Thompson
+
+description: >
+ The Toshiba TC9564 is specialized SoC that implements a PCIe switch
+ as well as an Ethernet AVB/TSN bridge. In addition to these, the SoC
+ implements other functions, including a reset and clock controller,
+ an address translation unit, and a few other devices.
+
+ The PCI switch has three downstream ports. The first two are exposed
+ externally, while the third is used by an internal PCIe endpoint. The
+ internal endpoint implements two PCIe functions, and attached to each
+ of these is a 10 Gbps capable Synopsys Ethernet controller and an
+ interrupt controller that converts internal "wired" interrupts into
+ MSIs delivered to the host.
+
+ PCIe BARs provide access to registers that manage almost all IP blocks.
+ The SoC is modeled using a PCI endpoint bus. The IP blocks are bound
+ to platform drivers that access the hardware using MMIO through the
+ PCI BARs.
+
+ ------------------------------------
+ | Host |
+ -----........---------------...-----
+ | | | |
+ | PCIe | |I2C|
+ | | | |
+ ----------+........+-------------+...+-------------------------------
+ | |upstream| | | ---------------- |
+ | Toshiba | Port 0 | | +-------+ PCIe pwrctrl | |
+ | TC9564 ----++---- | I2C | ---------------- |
+ | SoC || |controller| ---------------- |
+ | || | +-------+ GPIO | |
+ | || | | | controller | |
+ | ------++------ ------------ ---------------- |
+ | | US | |
+ | | | ---------------------------------------- |
+ | | DS3+====+ downstream port 3 | |
+ | | | |--------------------------------------| |
+ | | PCIe | | embedded PCIe endpoint | |
+ | | switch | |~~~~~~~~~~~~~~~~~~~++~~~~~~~~~~~~~~~~~| |
+ | | | | PCIe function 0 || PCIe function 1 | |
+ | | | |-------------------||-----------------| |
+ | | | | BAR || BAR || BAR || BAR | BAR | BAR | |
+ | | | | 0 || 2 || 4 || 0 | 2 | 4 | |
+ | | DS1 DS2 | ---.------.------.--++--------------.--- |
+ | --++------++-- : : : : |
+ | || || : ---.-- :....... : |
+ | || || : |SRAM| : : : |
+ | || || : ------ : ---.--- : |
+ | || || : ....: |clock| ....: |
+ | || || : : : ------- : : |
+ | || || ------.---- -.- : -.- : |
+ | || || |translate| |M| :....... |M| : |
+ | || || ----------- |S| : : |S| : |
+ | || || |I| : ---.--- |I| : |
+ | || || |G| : |reset| |G| : |
+ | || || |E| : ------- |E| : |
+ | --------++-- --++-------- |N| : |N| : |
+ | |downstream| |downstream| ------.---- ------.---- |
+ | | port 1 | | port 2 | | XGMAC 0 | | XGMAC 1 | |
+ --+..........+--+..........+----------+.......+-----------+.....+----
+ | | | |
+ |USXGMII| |SGMII|
+ | | | |
+ --+.......+-- ---+.....+---
+ | Ethernet | | Ethernet |
+ | PHY | | PHY |
+ ------------- -------------
+
+allOf:
+ - $ref: /schemas/pci/pci-ep-bus.yaml
+
+properties:
+ compatible:
+ const: pci1179,0220 # Toshiba TC9564 (a.k.a. Qualcomm QPS615)
+
+ reg:
+ maxItems: 1
+ description: PCI Bus/Device/Function config space address
+
+unevaluatedProperties: false
+
+required:
+ - compatible
+ - reg
+ - '#address-cells'
+ - '#size-cells'
+ - ranges
+
+examples:
+ - |
+ pcie@0,0 {
+ reg = <0x0 0x0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+ device_type = "pci";
+ ranges = <0x83000000 0x0 0x0 0x0 0x0 0x1fd00000>;
+
+ dev@0,0 {
+ compatible = "pci1179,0220";
+ reg = <0x0 0x0 0x0 0x0 0x0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+ /* Ranges will be updated dynamically */
+ ranges = <0x0 0x0 0x0 0x83000000 0x0 0x0 0x0 0x4000>,
+ <0x2 0x0 0x0 0x83000000 0x0 0x4000 0x0 0x80000>,
+ <0x4 0x0 0x0 0x83000000 0x0 0x84000 0x0 0x200000>;
+
+ pci-ep-bus@4 {
+ compatible = "simple-bus";
+ #address-cells = <1>;
+ #size-cells = <1>;
+ /* Map 0x0-0x1fffff to BAR 4 */
+ ranges = <0x0 0x4 0x0 0x0 0x200000>;
+ };
+ };
+
+ dev@0,1 {
+ compatible = "pci1179,0220";
+ reg = <0x100 0x0 0x0 0x0 0x0>;
+ #address-cells = <3>;
+ #size-cells = <2>;
+ /* Ranges will be updated dynamically */
+ ranges = <0x0 0x0 0x0 0x83000100 0x0 0x0 0x0 0x4000>,
+ <0x2 0x0 0x0 0x83000100 0x0 0x4000 0x0 0x80000>,
+ <0x4 0x0 0x0 0x83000100 0x0 0x84000 0x0 0x200000>;
+
+ pci-ep-bus@4 {
+ compatible = "simple-bus";
+ #address-cells = <1>;
+ #size-cells = <1>;
+ /* Map 0x0-0x1fffff to BAR 4 */
+ ranges = <0x0 0x4 0x0 0x0 0x200000>;
+ };
+ };
+ };
diff --git a/Documentation/devicetree/bindings/nvmem/qcom,qfprom.yaml b/Documentation/devicetree/bindings/nvmem/qcom,qfprom.yaml
index bc0a0898b9e4..566304ed4c78 100644
--- a/Documentation/devicetree/bindings/nvmem/qcom,qfprom.yaml
+++ b/Documentation/devicetree/bindings/nvmem/qcom,qfprom.yaml
@@ -31,6 +31,7 @@ properties:
- qcom,ipq9574-qfprom
- qcom,ipq9650-qfprom
- qcom,kaanapali-qfprom
+ - qcom,maili-qfprom
- qcom,milos-qfprom
- qcom,msm8226-qfprom
- qcom,msm8916-qfprom
diff --git a/Documentation/devicetree/bindings/nvmem/socionext,uniphier-efuse.yaml b/Documentation/devicetree/bindings/nvmem/socionext,uniphier-efuse.yaml
index e27cbae2d63a..d26b3d2a3eba 100644
--- a/Documentation/devicetree/bindings/nvmem/socionext,uniphier-efuse.yaml
+++ b/Documentation/devicetree/bindings/nvmem/socionext,uniphier-efuse.yaml
@@ -16,7 +16,11 @@ allOf:
properties:
compatible:
- const: socionext,uniphier-efuse
+ oneOf:
+ - const: socionext,uniphier-efuse
+ - items:
+ - const: ti,am62p-efuse
+ - const: socionext,uniphier-efuse
reg:
maxItems: 1
diff --git a/Documentation/devicetree/bindings/spi/spi-peripheral-props.yaml b/Documentation/devicetree/bindings/spi/spi-peripheral-props.yaml
index a0f32565d090..8f4b4b202e1d 100644
--- a/Documentation/devicetree/bindings/spi/spi-peripheral-props.yaml
+++ b/Documentation/devicetree/bindings/spi/spi-peripheral-props.yaml
@@ -150,6 +150,13 @@ properties:
minItems: 2
maxItems: 4
+ spi-device-addr:
+ $ref: /schemas/types.yaml#/definitions/uint32-array
+ description:
+ Device addresses used when multiple peripherals share a single chip
+ select. The array allows one logical peripheral to comprise multiple
+ physical devices, with one address per physical device.
+
st,spi-midi-ns:
deprecated: true
description: |
diff --git a/Documentation/devicetree/bindings/trivial-devices.yaml b/Documentation/devicetree/bindings/trivial-devices.yaml
index 3b7876c5a45d..8cad8494e8d8 100644
--- a/Documentation/devicetree/bindings/trivial-devices.yaml
+++ b/Documentation/devicetree/bindings/trivial-devices.yaml
@@ -62,6 +62,8 @@ properties:
# Aosong temperature & humidity sensors with I2C interface
- aosong,aht10
- aosong,aht20
+ - aosong,am2315
+ - aosong,am2320
- aosong,dht20
# Arduino microcontroller interface over SPI on UnoQ board
- arduino,unoq-mcu
@@ -79,8 +81,6 @@ properties:
- atmel,atsha204a
# BPA-RS600: Power Supply
- blutek,bpa-rs600
- # CM32181: Ambient Light Sensor
- - capella,cm32181
# CM3232: Ambient Light Sensor
- capella,cm3232
# CM3323: Ambient Light Sensor
@@ -402,8 +402,6 @@ properties:
- onnn,adt7462
# 48-Lane, 12-Port PCI Express Gen 2 (5.0 GT/s) Switch
- plx,pex8648
- # Pulsedlight LIDAR range-finding sensor
- - pulsedlight,lidar-lite-v2
# Renesas HS3001 Temperature and Relative Humidity Sensors
- renesas,hs3001
# Renesas ISL29501 time-of-flight sensor
diff --git a/Documentation/iio/ad7768.rst b/Documentation/iio/ad7768.rst
new file mode 100644
index 000000000000..9f5fbcae7173
--- /dev/null
+++ b/Documentation/iio/ad7768.rst
@@ -0,0 +1,275 @@
+.. SPDX-License-Identifier: GPL-2.0-only
+
+=============
+AD7768 driver
+=============
+
+ADC driver for Analog Devices Inc. AD7768 and AD7768-4 devices. The module name
+is ``ad7768``.
+
+Supported devices
+=================
+
+The following chips are supported by this driver:
+
+* `AD7768 `_ -
+ 8-channel, 24-bit simultaneous sampling ADC
+* `AD7768-4 `_ -
+ 4-channel, 24-bit simultaneous sampling ADC
+
+Supported features
+==================
+
+Clock sources
+-------------
+
+The master clock source is selected using the ``clock-names`` device tree
+property:
+
+* ``mclk`` selects a CMOS clock on XTAL2/MCLK. CLK_SEL must be low and XTAL1
+ must be connected to DGND.
+* ``xtal`` selects a crystal connected between XTAL1 and XTAL2. CLK_SEL must
+ be high. The driver drives FILTER/GPIO4 high and keeps channel 4 on the
+ AD7768 or channel 2 on the AD7768-4 enabled to maintain crystal excitation.
+* ``lvds`` selects a differential clock on XTAL1 and XTAL2. CLK_SEL must be
+ high. The driver drives FILTER/GPIO4 low before enabling the LVDS input.
+
+GPIO4 is reserved when ``xtal`` or ``lvds`` is selected.
+
+Power modes
+-----------
+
+The AD7768 family supports three power and performance modes:
+
+* **Low power mode** - Optimized for lowest power consumption
+* **Median mode** - Balanced power and performance
+* **Fast mode** - Highest performance with maximum sampling rates
+
+The driver initializes the device in fast mode and uses the maximum fast-mode
+output data rate as the default sampling frequency.
+
+When buffered capture starts, the driver selects the lowest-noise mode that can
+produce the requested output data rates for all enabled channels. Where output
+data rates overlap, fast mode is preferred over median mode, and median mode is
+preferred over low power mode. This prioritizes the lower RMS noise and higher
+dynamic range offered by a faster mode at the same output data rate.
+
+Data output configuration
+-------------------------
+
+The devices support flexible serial data output configurations:
+
+AD7768 data lines
+^^^^^^^^^^^^^^^^^
+
+* 1 data line (DOUT0) - Standard single-lane output
+* 2 data lines (DOUT0, DOUT1) - Dual-lane output for higher throughput
+* 8 data lines (DOUT0-DOUT7) - Maximum throughput, one line per channel
+
+AD7768-4 data lines
+^^^^^^^^^^^^^^^^^^^
+
+* 1 data line (DOUT0) - Standard single-lane output
+* 4 data lines (DOUT0-DOUT3) - Maximum throughput, one line per channel
+
+The number of data lines can be configured via the ``adi,data-lines-number``
+device tree property. If omitted, the driver uses the maximum supported by the
+selected variant: eight lines for AD7768 and four lines for AD7768-4.
+
+Channel configuration
+---------------------
+
+Each channel can be individually configured with:
+
+Channel modes
+^^^^^^^^^^^^^
+
+* **Mode A** - First set of filter and decimation settings
+* **Mode B** - Second set of filter and decimation settings
+
+The hardware provides two mode profiles (A and B), each holding one
+(frequency, filter) combination. When buffered capture is started,
+enabled channels are grouped by their configured (frequency, filter)
+pair. Up to two distinct groups are supported; the driver automatically
+assigns each group to a mode slot and programs the hardware accordingly.
+If the enabled channels request more than two distinct pairs, buffer setup
+fails and capture does not start.
+
+Precharge and reference buffers
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Per-channel buffer control for optimal signal integrity:
+
+* Positive input precharge buffer (``adi,prechargebuf-pos-enable``)
+* Negative input precharge buffer (``adi,prechargebuf-neg-enable``)
+* Positive reference buffer (``adi,refbuf-pos-enable``)
+* Negative reference buffer (``adi,refbuf-neg-enable``)
+
+Common mode voltage
+-------------------
+
+The VCM pin provides a buffered common-mode voltage output used to bias
+the analog inputs. The driver exposes this as a standard voltage regulator
+provider under a ``regulators`` subnode in the device tree. Supported
+output voltage levels are:
+
+* (AVDD1 - AVSS) / 2 - Mid-supply (hardware default), reported as half the
+ voltage provided by ``avdd1-supply``
+* 1,650,000 µV - 1.65V
+* 2,500,000 µV - 2.5V
+* 2,140,000 µV - 2.14V
+
+The regulator can be enabled and disabled at runtime using the standard
+regulator framework interfaces.
+
+The VCM circuitry is associated with channel 0. When VCM is used externally,
+``channel@0`` must be present in the device tree and channel 0 must remain
+enabled in the active scan mask. Placing channel 0 in standby disables the VCM
+output.
+
+Filter types
+------------
+
+Two digital filter types are available:
+
+* **Wideband** - Optimized for wide bandwidth applications
+* **Sinc5** - Fifth-order sinc filter for high rejection of out-of-band noise
+
+IIO backend support
+-------------------
+
+The driver integrates with IIO backends (e.g., AXI ADC) for high-speed data
+capture and DMA operations. Features include:
+
+* Automatic channel enable/disable based on scan mask
+* CRC on data interface. CRC replaces the header every 4th output sample.
+* High-throughput buffered data acquisition
+
+GPIO controller
+---------------
+
+The AD7768 includes a 5-pin GPIO controller for auxiliary digital I/O
+operations. The GPIO pins can be configured as inputs or outputs.
+
+GPIO4 is reserved when a crystal or LVDS master clock is used. GPIO0 through
+GPIO3 remain available in these configurations.
+
+Device attributes
+=================
+
+The following IIO attributes are available for each enabled channel:
+
+Voltage scale
+-------------
+
+.. list-table::
+ :header-rows: 1
+ :widths: 40 60
+
+ * - Attribute
+ - Description
+ * - ``in_voltage_scale``
+ - Scale in millivolts per least significant bit for signed 24-bit data,
+ calculated as twice the differential reference voltage used by channel
+ N divided by 2\ :sup:`24`.
+
+Sampling frequency
+------------------
+
+.. list-table::
+ :header-rows: 1
+ :widths: 40 60
+
+ * - Attribute
+ - Description
+ * - ``in_voltage_sampling_frequency``
+ - Requested sampling frequency in Hz for channel N. Enabled channels are
+ grouped into up to two profiles at capture time.
+ * - ``in_voltage_sampling_frequency_available``
+ - Available sampling frequencies in Hz for channel N across all power
+ modes, based on the master clock frequency. Buffer setup fails if no
+ single power mode supports the frequencies requested by all enabled
+ channels.
+
+Filter configuration
+---------------------
+
+.. list-table::
+ :header-rows: 1
+ :widths: 40 60
+
+ * - Attribute
+ - Description
+ * - ``in_voltage_filter_type``
+ - Requested filter type for channel N: "wideband" or "sinc5". It is
+ grouped with sampling frequency at capture time.
+ * - ``in_voltage_filter_type_available``
+ - Available filter types for channel N: "wideband sinc5".
+
+Per-channel calibration
+-----------------------
+
+.. list-table::
+ :header-rows: 1
+ :widths: 40 60
+
+ * - Attribute
+ - Description
+ * - ``in_voltage_calibbias``
+ - Signed 24-bit two's complement channel offset register value.
+ * - ``in_voltage_calibscale``
+ - Raw unsigned 24-bit channel gain register value.
+ * - ``in_voltage_convdelay``
+ - Per-channel conversion delay. The driver exposes the sync phase offset
+ value in seconds with picosecond precision. Resolution and valid range
+ depend on the decimation ratio in use (see datasheet
+ Table 32).
+
+Device buffers
+==============
+
+This driver supports IIO buffered data acquisition through IIO backends.
+When used with compatible backends like the AXI ADC, it provides:
+
+* High-speed simultaneous sampling across all enabled channels
+* Hardware-driven data capture
+* DMA-based data transfer for minimal CPU overhead
+* CRC error detection
+
+See :doc:`iio_devbuf` for more information about IIO device buffers.
+
+Example usage
+=============
+
+.. code-block:: bash
+
+ # Read current sampling frequency for channel 0
+ cat /sys/bus/iio/devices/iio:device0/in_voltage0_sampling_frequency
+
+ # Update sampling frequency for channel 0
+ echo 8000 > /sys/bus/iio/devices/iio:device0/in_voltage0_sampling_frequency
+
+ # Read current filter type for channel 0
+ cat /sys/bus/iio/devices/iio:device0/in_voltage0_filter_type
+
+ # List available filter types for channel 0
+ cat /sys/bus/iio/devices/iio:device0/in_voltage0_filter_type_available
+
+ # Update filter type for channel 0 to wideband
+ echo wideband > /sys/bus/iio/devices/iio:device0/in_voltage0_filter_type
+
+ # Buffer setup fails if enabled channels request more than two distinct
+ # (sampling frequency, filter type) combinations.
+
+ # Read calibration scale for channel 0
+ cat /sys/bus/iio/devices/iio:device0/in_voltage0_calibscale
+
+ # Read conversion delay for channel 0
+ cat /sys/bus/iio/devices/iio:device0/in_voltage0_convdelay
+
+
+Unimplemented features
+======================
+
+* CRC message every 16 samples (CRC_SEL configuration) - currently only
+ supports CRC every 4 samples
diff --git a/Documentation/iio/ad9910.rst b/Documentation/iio/ad9910.rst
new file mode 100644
index 000000000000..aab569f561db
--- /dev/null
+++ b/Documentation/iio/ad9910.rst
@@ -0,0 +1,792 @@
+.. SPDX-License-Identifier: GPL-2.0-only
+
+=============
+AD9910 driver
+=============
+
+Direct Digital Synthesizer (DDS) driver for the Analog Devices Inc. AD9910.
+The module name is ``ad9910``.
+
+* `AD9910 `_
+
+The AD9910 is a 1 GSPS DDS with a 14-bit DAC, controlled over SPI. The driver
+exposes the device through a hierarchy of typed IIO output channels. The root
+``phy`` channel controls the system clock and full-scale output current.
+Sub-channels provide independent control over single tone profiles, parallel
+port modulation, digital ramp generation (DRG), RAM playback and output shift
+keying (OSK).
+
+
+Channel hierarchy
+=================
+
+The driver exposes the following IIO output channels, each identified by a
+unique channel number and a human-readable label. The ``phy`` channel is the
+root of the hierarchy. Changing its ``sampling_frequency`` reconfigures the
+system clock (SYSCLK) which affects all other channels.
+
+.. flat-table::
+ :header-rows: 1
+
+ * - Channel
+ - Label
+ - Parent
+ - Description
+
+ * - ``out_altcurrent100``
+ - ``phy``
+ -
+ - Physical output: system clock and full-scale output current (:math:`I_{FS}`).
+ See `Physical channel`_.
+
+ * - ``out_altcurrent110`` ... ``out_altcurrent117``
+ - ``profile0`` ... ``profile7``
+ - ``phy``
+ - Single tone control: frequency, phase, amplitude, enable.
+ See `Single Tone mode`_.
+
+ * - ``out_altcurrent120``
+ - ``parallel_amplitude``
+ - ``phy``
+ - Parallel port amplitude channel.
+ See `Parallel Port mode`_.
+
+ * - ``out_phase120``
+ - ``parallel_phase``
+ - ``phy``
+ - Parallel port phase channel.
+
+ * - ``out_frequency120``
+ - ``parallel_frequency``
+ - ``phy``
+ - Parallel port frequency channel: ``scale`` sets the FM gain
+ (power-of-2 multiplier), ``offset`` sets the base FTW.
+
+ * - ``out_altcurrent121``
+ - ``parallel_polar_amplitude``
+ - ``phy``
+ - Parallel polar amplitude channel: ``scale`` is the amplitude
+ resolution, ``offset`` is the amplitude bias (lower 6 bits of ASF).
+
+ * - ``out_phase121``
+ - ``parallel_polar_phase``
+ - ``phy``
+ - Parallel polar phase channel: ``scale`` is the phase resolution,
+ ``offset`` is the phase bias (lower 8 bits of POW).
+
+ * - ``out_frequency130``
+ - ``drg_frequency``
+ - ``phy``
+ - DRG frequency channel: ``en`` selects and enables the DRG with
+ frequency as the ramp target.
+ See `Digital ramp generator (DRG)`_.
+
+ * - ``out_frequency131``
+ - ``drg_rising_frequency``
+ - ``drg_frequency``
+ - DRG frequency rising-ramp parameters: limit code, dwell enable,
+ ramp clock, rate of change.
+
+ * - ``out_frequency132``
+ - ``drg_falling_frequency``
+ - ``drg_frequency``
+ - DRG frequency falling-ramp parameters: limit code, dwell enable,
+ ramp clock, rate of change.
+
+ * - ``out_phase130``
+ - ``drg_phase``
+ - ``phy``
+ - DRG phase channel: ``en`` selects and enables the DRG with phase
+ as the ramp target.
+ See `Digital ramp generator (DRG)`_.
+
+ * - ``out_phase131``
+ - ``drg_rising_phase``
+ - ``drg_phase``
+ - DRG phase rising-ramp parameters: limit code, dwell enable, ramp clock,
+ rate of change.
+
+ * - ``out_phase132``
+ - ``drg_falling_phase``
+ - ``drg_phase``
+ - DRG phase falling-ramp parameters: limit code, dwell enable, ramp clock,
+ rate of change.
+
+ * - ``out_altcurrent130``
+ - ``drg_amplitude``
+ - ``phy``
+ - DRG amplitude channel: ``en`` selects and enables the DRG with
+ amplitude as the ramp target.
+ See `Digital ramp generator (DRG)`_.
+
+ * - ``out_altcurrent131``
+ - ``drg_rising_amplitude``
+ - ``drg_amplitude``
+ - DRG amplitude rising-ramp parameters: limit code, dwell enable,
+ ramp clock, rate of change.
+
+ * - ``out_altcurrent132``
+ - ``drg_falling_amplitude``
+ - ``drg_amplitude``
+ - DRG amplitude falling-ramp parameters: limit code, dwell enable,
+ ramp clock, rate of change.
+
+ * - ``out_altcurrent140``
+ - ``ram``
+ - ``phy``
+ - RAM playback: enable, frequency, phase and sampling frequency for
+ the active profile. See `RAM mode`_.
+
+ * - ``out_altcurrent150``
+ - ``osk``
+ - ``phy``
+ - Output shift keying (OSK): enable, amplitude code, ramp rate,
+ rate of change. See `Output Shift Keying (OSK)`_.
+
+DDS modes
+=========
+
+The AD9910 supports multiple modes of operation that can be configured
+independently or in combination. Each DDS core parameter (frequency, phase
+and amplitude) can come from different sources, but only one is active at a
+time. This activation depends on a priority list, which is based on the enable
+and destination configurations for such modes. The following tables are
+extracted from the AD9910 datasheet and summarize the control parameters for
+each mode and their priority when multiple sources are enabled simultaneously:
+
+.. flat-table:: DDS Frequency Control
+ :header-rows: 1
+
+ * - Priority
+ - Data Source
+ - Conditions
+
+ * - Highest Priority
+ - RAM
+ - RAM enabled and data destination is frequency
+
+ * -
+ - DRG
+ - DRG enabled and data destination is frequency
+
+ * -
+ - Parallel data and Frequency Tuning Word, FTW (frequency_offset)
+ - Parallel data port enabled and data destination is frequency
+
+ * -
+ - FTW register (frequency)
+ - RAM enabled and data destination is not frequency
+
+ * - Lowest Priority
+ - FTW (frequency) in single tone channel for the active profile
+ - All other cases
+
+.. flat-table:: DDS Phase Control
+ :header-rows: 1
+
+ * - Priority
+ - Data Source
+ - Conditions
+
+ * - Highest Priority
+ - RAM
+ - RAM enabled and data destination is phase or polar
+
+ * -
+ - DRG
+ - DRG enabled and data destination is phase
+
+ * -
+ - Parallel data port
+ - Parallel data port enabled and data destination is phase
+
+ * -
+ - Parallel data port and Phase Offset Word, POW register LSBs (phase_offset)
+ - Parallel data port enabled and data destination is polar
+
+ * -
+ - POW register (phase)
+ - RAM enabled and destination is not phase nor polar
+
+ * - Lowest Priority
+ - POW (phase) in single tone channel for the active profile
+ - All other cases
+
+.. flat-table:: DDS Amplitude Control
+ :header-rows: 1
+
+ * - Priority
+ - Data Source
+ - Conditions
+
+ * - Highest Priority
+ - Amplitude Scale Factor, ASF register and OSK generator
+ - OSK enabled
+
+ * -
+ - RAM
+ - RAM enabled and data destination is amplitude or polar
+
+ * -
+ - DRG
+ - DRG enabled and data destination is amplitude
+
+ * -
+ - Parallel data port
+ - Parallel data port enabled and data destination is amplitude
+
+ * -
+ - Parallel data port and ASF register LSBs (scale_offset)
+ - Parallel data port enabled and data destination is polar
+
+ * - Lowest Priority
+ - ASF (scale) in single tone channel for the active profile
+ - (Amplitude scale is already enabled by default)
+
+While debugging or testing, the debug attributes ``frequency_source``,
+``phase_source`` and ``amplitude_source`` can be used to read the label of
+the channel that is actively controlling the correspondent DDS parameter,
+which reflects the priority list described above.
+
+Single Tone mode
+----------------
+
+Single tone is the baseline operating mode. The ``profileY`` channels
+provide enable, frequency, phase and amplitude control:
+
+.. flat-table::
+ :header-rows: 1
+
+ * - Attribute
+ - Unit
+ - Description
+
+ * - ``en``
+ - boolean (0 or 1)
+ - Enable/disable profile Y. Only one profile can be active at a
+ time. When enabling a profile it disables the current active profile.
+ Disabling an active profile brings the device to a powered down state.
+
+ * - ``frequency``
+ - Hz
+ - Output frequency. Range :math:`[0, f_{SYSCLK} / 2)`. Stored in the
+ profile's frequency tuning word (FTW).
+
+ * - ``phase``
+ - rad
+ - Phase offset. Range :math:`[0, 2\pi)`. Stored in the profile's phase
+ offset word (POW).
+
+ * - ``raw``
+ - integer
+ - Amplitude scale factor code. Range :math:`[0, 16383]`. Stored in the
+ profile's amplitude scale factor (ASF) register. The physical output
+ amplitude is ``raw * scale`` where ``scale`` is read from the ``phy``
+ channel.
+
+Profile switching is allowed while RAM mode is enabled. In that case single
+tone parameters are stored in a shadow register and are not written to
+hardware until RAM mode is disabled.
+
+Usage examples
+^^^^^^^^^^^^^^
+
+Configure a 100 MHz tone in profile 2 and set it as the active profile:
+
+.. code-block:: bash
+
+ echo 100000000 > /sys/bus/iio/devices/iio\:device0/out_altcurrent112_frequency
+ echo 0 > /sys/bus/iio/devices/iio\:device0/out_altcurrent112_phase
+ echo 16383 > /sys/bus/iio/devices/iio\:device0/out_altcurrent112_raw
+
+ # Activate profile 2
+ echo 1 > /sys/bus/iio/devices/iio\:device0/out_altcurrent112_en
+
+Read back the current single tone frequency:
+
+.. code-block:: bash
+
+ cat /sys/bus/iio/devices/iio\:device0/out_altcurrent112_frequency
+
+Parallel Port mode
+------------------
+
+The parallel port allows real-time modulation of DDS parameters through a
+16-bit external data bus. The driver exposes separate typed channels for each
+modulation target.
+
+Non-polar modulation
+^^^^^^^^^^^^^^^^^^^^
+
+In non-polar mode each DDS parameter is controlled by an independent 16-bit bus
+input. The parallel port channels expose the resolution and base offset of their
+respective bus inputs:
+
+.. flat-table::
+ :header-rows: 1
+
+ * - Channel
+ - Attribute
+ - Unit
+ - Description
+
+ * - ``out_phase120``
+ - ``scale``
+ - rad
+ - Phase resolution per parallel bus LSB. Fixed at :math:`\pi / 2^{15}`
+ rad/LSB (full 16-bit POW resolution).
+
+ * - ``out_frequency120``
+ - ``scale``
+ - Hz
+ - Outputs the frequency scale evaluated as
+ :math:`f_{SYSCLK} \cdot FM / 2^{32}`. Assuming that :math:`f_{SYSCLK}` is
+ fixed, it is used to configure the modulation gain :math:`FM`, which is a
+ power-of-2 multiplier in range :math:`[1, 32768]`. Writing to this
+ attribute rounds up to the nearest :math:`FM` power of 2.
+
+ * - ``out_frequency120``
+ - ``offset``
+ - Hz
+ - Outputs the frequency offset in raw units evaluated as :math:`FTW / FM`.
+ Assuming that :math:`FM` is fixed, it is used to configure the FTW
+ register, which is a 32-bit unsigned integer.
+
+Polar modulation
+^^^^^^^^^^^^^^^^
+
+In polar mode a single 16-bit bus word carries both amplitude (high byte)
+and phase (low byte). The ``parallel_polar_amplitude`` and
+``parallel_polar_phase`` channels configure the bias applied to the low-order
+bits of the ASF and POW registers respectively:
+
+.. flat-table::
+ :header-rows: 1
+
+ * - Channel
+ - Attribute
+ - Unit
+ - Description
+
+ * - ``out_altcurrent121``
+ - ``scale``
+ - mA/LSB
+ - Full-scale amplitude resolution (read-only, fixed at :math:`I_{FS} / 2^{8}`).
+
+ * - ``out_altcurrent121``
+ - ``offset``
+ - fractional (raw units)
+ - Amplitude bias. Lower 6 bits of ASF register. Range :math:`[0, 1)`.
+
+ * - ``out_phase121``
+ - ``scale``
+ - rad/LSB
+ - Phase resolution (read-only, fixed at :math:`\pi / 2^{7}`).
+
+ * - ``out_phase121``
+ - ``offset``
+ - fractional (raw units)
+ - Phase bias. Lower 8 bits of POW register. Range :math:`[0, 1)`.
+
+Usage examples
+^^^^^^^^^^^^^^
+
+Set parallel port frequency modulation with a modulation gain of 16 and a 50 MHz
+offset:
+
+.. code-block:: bash
+
+ # f_SYSCLK = 1 GHz, FM = 16
+ # frequency scale = f_SYSCLK * FM / 2^32 = 3.725290298
+ echo 3.725290298 > /sys/bus/iio/devices/iio\:device0/out_frequency120_scale
+ # frequency offset = 50 MHz / scale = 50e6 / 13421772.8
+ echo 13421772.8 > /sys/bus/iio/devices/iio\:device0/out_frequency120_offset
+
+One should choose a frequency scale that allows all the desired frequencies
+to be represented in the 16-bit bus range, i.e.,
+:math:`scale = (f_{max} - f_{min}) / 2^{16}`.
+
+
+Digital ramp generator (DRG)
+----------------------------
+
+The DRG produces linear frequency, phase or amplitude sweeps using dedicated
+hardware. The active ramp target (destination) is selected by enabling the
+corresponding typed channel at channel number 130:
+
+- ``out_frequency130`` (label ``drg_frequency``) — ramp targets frequency
+- ``out_phase130`` (label ``drg_phase``) — ramp targets phase
+- ``out_altcurrent130`` (label ``drg_amplitude``) — ramp targets amplitude
+
+Writing ``en=1`` to one of these channels enables the DRG and switches its
+destination. Writing ``en=0`` disables the DRG if the channel is the current
+active destination; writing to an already-inactive destination is a no-op.
+
+Each destination channel also exposes a read-only ``scale`` attribute
+reporting the physical quantity per ramp register LSB, which allows converting
+raw limit codes to physical values.
+
+The six ramp channels:
+
+- ``out_frequency131`` (label ``drg_rising_frequency``)
+- ``out_frequency132`` (label ``drg_falling_frequency``)
+- ``out_phase131`` (label ``drg_rising_phase``)
+- ``out_phase132`` (label ``drg_falling_phase``)
+- ``out_altcurrent131`` (label ``drg_rising_amplitude``)
+- ``out_altcurrent132`` (label ``drg_falling_amplitude``)
+
+configure ascending and descending ramp parameters.
+
+Destination channel attributes
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. flat-table::
+ :header-rows: 1
+
+ * - Attribute
+ - Unit
+ - Description
+
+ * - ``en``
+ - boolean
+ - Enable the DRG with this channel as the active destination. Only one
+ destination can be active at a time.
+
+ * - ``scale``
+ - Hz/LSB, rad/LSB or mA/LSB
+ - Read-only. Physical quantity per raw units. Multiply a ramp
+ rising/falling channel ``raw`` value by this scale to get the physical
+ ramp target.
+
+Ramp channel attributes
+^^^^^^^^^^^^^^^^^^^^^^^
+
+.. flat-table::
+ :header-rows: 1
+
+ * - Attribute
+ - Unit
+ - Description
+
+ * - ``dwell_en``
+ - boolean
+ - Enable dwell at the ramp limit. When disabled, the ramp
+ auto-transitions at this limit without waiting for the DRCTL pin.
+ Disabling both creates a bidirectional continuous ramp (triangular
+ pattern). Other combinations create single-shot ramps at the DRCTL
+ pin transition.
+
+ * - ``raw``
+ - integer (64-bit)
+ - Ramp limit expressed as a raw DRG register code in
+ :math:`[0, 2^{32}-1]`. The physical value is ``raw * scale`` where
+ ``scale`` is read from the active destination channel.
+
+ * - ``sampling_frequency``
+ - Hz
+ - Ramp clock rate. Controlled by an integer divider; the written value
+ is adjusted to the nearest supported rate.
+
+ * - ``raw_roc``
+ - /s
+ - Rate of change. Number of register codes advanced per second, computed
+ from the hardware step size and the current ramp clock. Writing
+ requires ``sampling_frequency`` to be configured first.
+
+Usage examples
+^^^^^^^^^^^^^^
+
+Configure a frequency sweep from 40 MHz to 60 MHz with a rate of change of
+25 GHz/s:
+
+.. code-block:: bash
+
+ # Disable dwell on both limits for a bidirectional continuous ramp
+ echo 0 > /sys/bus/iio/devices/iio\:device0/out_frequency131_dwell_en
+ echo 0 > /sys/bus/iio/devices/iio\:device0/out_frequency132_dwell_en
+
+ # Set ramp rate at 250 MHz
+ echo 250000000 > /sys/bus/iio/devices/iio\:device0/out_frequency131_sampling_frequency
+ echo 250000000 > /sys/bus/iio/devices/iio\:device0/out_frequency132_sampling_frequency
+
+ # read the frequency scale to convert physical values to raw units
+ cat /sys/bus/iio/devices/iio\:device0/out_frequency130_scale
+ 0.232830643650
+
+ # 40 MHz / 0.232830643650 = 171798692
+ echo 171798692 > /sys/bus/iio/devices/iio\:device0/out_frequency131_raw
+ # 60 MHz / 0.232830643650 = 257698038
+ echo 257698038 > /sys/bus/iio/devices/iio\:device0/out_frequency132_raw
+
+ # 25 GHz/s / 0.232830643650 = 107374182402
+ echo 107374182402 > /sys/bus/iio/devices/iio\:device0/out_frequency131_raw_roc
+ echo 107374182402 > /sys/bus/iio/devices/iio\:device0/out_frequency132_raw_roc
+
+ # Enable the DRG with frequency as the destination
+ echo 1 > /sys/bus/iio/devices/iio\:device0/out_frequency130_en
+
+RAM mode
+--------
+
+The AD9910 contains a 1024 x 32-bit RAM that can be loaded with waveform data
+and played back to modulate frequency, phase, amplitude, or polar (phase +
+amplitude) parameters.
+
+RAM control channel attributes
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. flat-table::
+ :header-rows: 1
+
+ * - Attribute
+ - Unit
+ - Description
+
+ * - ``en``
+ - boolean
+ - Enable/disable RAM playback. Toggling swaps profile registers between
+ single tone and RAM configurations across all 8 profiles.
+
+ * - ``frequency``
+ - Hz
+ - Frequency tuning word used as the single tone frequency when
+ RAM destination is not ``frequency``. Range: :math:`[0, f_{SYSCLK} / 2)`.
+
+ * - ``phase``
+ - rad
+ - Phase offset word used as the single tone phase when RAM destination
+ is not ``phase``. Range: :math:`[0, 2\pi)`.
+
+ * - ``sampling_frequency``
+ - Hz
+ - RAM playback step rate of the active profile, which controls how fast
+ the address counter advances. Controlled by an integer divider; the
+ written value is adjusted to the nearest supported rate.
+
+Loading RAM data
+^^^^^^^^^^^^^^^^
+
+RAM data is loaded through the firmware upload framework. The driver registers
+a firmware upload sysfs entry named ``iio_deviceX:ram``. The firmware data
+follows a binary format (version 1) with an 80-byte header followed by data
+words. All fields are big-endian.
+
+.. flat-table:: RAM firmware header (80 bytes)
+ :header-rows: 1
+
+ * - Offset
+ - Size
+ - Field
+ - Description
+
+ * - 0
+ - 4
+ - ``magic``
+ - Magic number: ``0x00AD9910``
+
+ * - 4
+ - 2
+ - ``version``
+ - Format version: ``0x0001``
+
+ * - 6
+ - 2
+ - ``wcount``
+ - Number of 32-bit RAM data words (0--1024)
+
+ * - 8
+ - 4
+ - ``crc``
+ - CRC32 checksum over ``cfr1``, ``profiles`` and ``words``
+
+ * - 12
+ - 4
+ - ``cfr1``
+ - CFR1 register value. Only RAM-relevant bits are used:
+ bits [30:29] set data destination (00: frequency, 01: phase,
+ 10: amplitude, 11: polar); bits [20:17] set internal profile
+ control (see datasheet Table 14)
+
+ * - 16
+ - 64
+ - ``profiles[0..7]``
+ - 8 sets of 8-byte RAM profile configurations (see below)
+
+ * - 80
+ - 4 x wcount
+ - ``words[]``
+ - RAM data words in reverse order
+
+Each 8-byte profile entry contains:
+
+.. flat-table:: RAM profile entry (8 bytes)
+ :header-rows: 1
+
+ * - Bits
+ - Field
+ - Description
+
+ * - [55:40]
+ - Address step rate
+ - Controls playback speed for this profile
+
+ * - [39:30]
+ - End address
+ - Last RAM address for this profile
+
+ * - [23:14]
+ - Start address
+ - First RAM address for this profile
+
+ * - [5]
+ - No-dwell high
+ - No-dwell at high limit (ramp-up mode)
+
+ * - [3]
+ - Zero-crossing
+ - Zero-crossing enable (direct-switch mode)
+
+ * - [2:0]
+ - Operating mode
+ - 000: direct switch, 001: ramp-up, 010: bidirectional,
+ 011: bidirectional continuous, 100: ramp-up continuous
+
+Usage examples
+^^^^^^^^^^^^^^
+
+Configure RAM mode with firmware data and enable it:
+
+.. code-block:: bash
+
+ # Load RAM data via firmware upload
+ echo 1 > /sys/class/firmware/iio\:device0\:ram/loading
+ cat ad9910-ram.bin > /sys/class/firmware/iio\:device0\:ram/data
+ echo 0 > /sys/class/firmware/iio\:device0\:ram/loading
+
+ # Enable RAM mode
+ echo 1 > /sys/bus/iio/devices/iio\:device0/out_altcurrent140_en
+
+Output Shift Keying (OSK)
+-------------------------
+
+OSK controls the output amplitude envelope, allowing the output to be ramped
+on/off rather than switched abruptly.
+
+.. flat-table::
+ :header-rows: 1
+
+ * - Attribute
+ - Unit
+ - Description
+
+ * - ``en``
+ - boolean (0 or 1)
+ - Enable/disable OSK.
+
+ * - ``raw``
+ - integer
+ - Target amplitude code. 14-bit ASF field. Range: :math:`[0, 16383]`.
+ The physical output amplitude is ``raw * scale`` where ``scale`` is read
+ from the ``phy`` channel.
+
+ * - ``raw_roc``
+ - /s
+ - Amplitude ramp rate. Writing a non-zero value enables automatic OSK
+ and selects the closest hardware step size. Writing ``0`` disables
+ automatic ramping (manual control via ``raw``). Writing the maximum
+ available value enables pin-controlled immediate transition.
+
+ * - ``raw_roc_available``
+ - /s
+ - Lists the available ``raw_roc`` values based on the current
+ ``sampling_frequency``. The first value is always ``0`` (disabled) and
+ the last value corresponds to pin-controlled immediate mode.
+
+ * - ``sampling_frequency``
+ - Hz
+ - OSK ramp clock. Controlled by an integer divider; the written value
+ is adjusted to the nearest supported rate.
+
+Usage examples
+^^^^^^^^^^^^^^
+
+Enable OSK with automatic ramping:
+
+.. code-block:: bash
+
+ # Set ramp rate 1MHz
+ echo 1000000 > /sys/bus/iio/devices/iio\:device0/out_altcurrent150_sampling_frequency
+
+ # Check available rate of change values
+ cat /sys/bus/iio/devices/iio\:device0/out_altcurrent150_raw_roc_available
+ 0 1000000 2000000 4000000 8000000 16383000000
+
+ # Enable automatic OSK with a rate of change of 8000000 raw units/s
+ echo 8000000 > /sys/bus/iio/devices/iio\:device0/out_altcurrent150_raw_roc
+
+ # Enable OSK
+ echo 1 > /sys/bus/iio/devices/iio\:device0/out_altcurrent150_en
+
+Enable pin-controlled immediate OSK:
+
+.. code-block:: bash
+
+ # Enable OSK in manual mode (no ramp)
+ echo 0 > /sys/bus/iio/devices/iio\:device0/out_altcurrent150_raw_roc
+ echo 1 > /sys/bus/iio/devices/iio\:device0/out_altcurrent150_en
+
+ # Set target amplitude to full scale
+ echo 16383 > /sys/bus/iio/devices/iio\:device0/out_altcurrent150_raw
+
+Physical channel
+================
+
+The ``phy`` channel provides device-level control:
+
+.. flat-table::
+ :header-rows: 1
+
+ * - Attribute
+ - Unit
+ - Description
+
+ * - ``sampling_frequency``
+ - Hz
+ - System clock (SYSCLK) frequency. When the internal PLL is enabled
+ (via the ``adi,pll-enable`` devicetree property), configures the PLL
+ multiplier (Range: :math:`[420, 1000]` MHz). Without PLL, the reference
+ clock can only be divided by 2.
+
+ * - ``scale``
+ - mA/LSB
+ - Full-scale DAC output current per amplitude code LSB, which is evaluated
+ as :math:`I_{FS} / 2^{14}`. Shared across all ``altcurrent`` channels.
+ Setting this attribute reconfigures the auxiliary DAC full-scale code and
+ updates the effective amplitude resolution for single tone profiles,
+ DRG amplitude ramps and OSK.
+
+ * - ``powerdown``
+ - boolean (0 or 1)
+ - Software power-down. Writing 1 powers down the digital core, DAC,
+ reference clock input and auxiliary DAC simultaneously.
+
+Usage examples
+--------------
+
+Set the system clock to 1 GHz:
+
+.. code-block:: bash
+
+ echo 1000000000 > /sys/bus/iio/devices/iio\:device0/out_altcurrent100_sampling_frequency
+
+Read current system clock frequency:
+
+.. code-block:: bash
+
+ cat /sys/bus/iio/devices/iio\:device0/out_altcurrent100_sampling_frequency
+
+Power down the device:
+
+.. code-block:: bash
+
+ echo 1 > /sys/bus/iio/devices/iio\:device0/out_altcurrent100_powerdown
diff --git a/Documentation/iio/ade9000.rst b/Documentation/iio/ade9000.rst
index c9ff702a4251..f41660005223 100644
--- a/Documentation/iio/ade9000.rst
+++ b/Documentation/iio/ade9000.rst
@@ -1,24 +1,30 @@
.. SPDX-License-Identifier: GPL-2.0
-===============
-ADE9000 driver
-===============
+======================
+ADE9000/ADE9078 driver
+======================
-This driver supports Analog Device's ADE9000 energy measurement IC on SPI bus.
+This driver supports Analog Devices' ADE9000 and ADE9078 energy measurement
+ICs on SPI bus.
1. Supported devices
====================
* `ADE9000 `_
+* `ADE9078 `_
-The ADE9000 is a highly accurate, fully integrated, multiphase energy and power
-quality monitoring device. Superior analog performance and a digital signal
-processing (DSP) core enable accurate energy monitoring over a wide dynamic
-range. An integrated high end reference ensures low drift over temperature
-with a combined drift of less than ±25 ppm/°C maximum for the entire channel
-including a programmable gain amplifier (PGA) and an analog-to-digital
+The ADE9000 and ADE9078 are highly accurate, fully integrated, multiphase energy
+and power quality monitoring devices. Superior analog performance and a digital
+signal processing (DSP) core enable accurate energy monitoring over a wide
+dynamic range. An integrated high end reference ensures low drift over
+temperature with a combined drift of less than ±25 ppm/°C maximum for the entire
+channel including a programmable gain amplifier (PGA) and an analog-to-digital
converter (ADC).
+The ADE9078 does not provide the on-chip dip/swell (sag) detection available on
+the ADE9000, so the RMS voltage swell/dip events described below are only
+available on the ADE9000.
+
2. Device attributes
====================
diff --git a/Documentation/iio/adis16475.rst b/Documentation/iio/adis16475.rst
index 89a388490ab7..0e004f016199 100644
--- a/Documentation/iio/adis16475.rst
+++ b/Documentation/iio/adis16475.rst
@@ -4,7 +4,7 @@
ADIS16475 driver
================
-This driver supports Analog Device's IMUs on SPI bus.
+This driver supports Analog Devices' IMUs on SPI bus.
1. Supported devices
====================
diff --git a/Documentation/iio/adis16480.rst b/Documentation/iio/adis16480.rst
index cce5f3e01741..7c259070aaaf 100644
--- a/Documentation/iio/adis16480.rst
+++ b/Documentation/iio/adis16480.rst
@@ -4,7 +4,7 @@
ADIS16480 driver
================
-This driver supports Analog Device's IMUs on SPI bus.
+This driver supports Analog Devices' IMUs on SPI bus.
1. Supported devices
====================
diff --git a/Documentation/iio/adis16550.rst b/Documentation/iio/adis16550.rst
index c9bbc0a857b0..c0d5a975e6ca 100644
--- a/Documentation/iio/adis16550.rst
+++ b/Documentation/iio/adis16550.rst
@@ -4,7 +4,7 @@
ADIS16550 driver
================
-This driver supports Analog Device's IMUs on SPI bus.
+This driver supports Analog Devices' IMUs on SPI bus.
1. Supported devices
====================
diff --git a/Documentation/iio/adxl313.rst b/Documentation/iio/adxl313.rst
index 3641193bf647..c448f10745e7 100644
--- a/Documentation/iio/adxl313.rst
+++ b/Documentation/iio/adxl313.rst
@@ -4,7 +4,7 @@
ADXL313 driver
===============
-This driver supports Analog Device's ADXL313 on SPI/I2C bus.
+This driver supports Analog Devices' ADXL313 on SPI/I2C bus.
1. Supported devices
====================
diff --git a/Documentation/iio/adxl345.rst b/Documentation/iio/adxl345.rst
index 0aa33a852412..28c71fbd45e5 100644
--- a/Documentation/iio/adxl345.rst
+++ b/Documentation/iio/adxl345.rst
@@ -4,7 +4,7 @@
ADXL345 driver
===============
-This driver supports Analog Device's ADXL345/375 on SPI/I2C bus.
+This driver supports Analog Devices' ADXL345/375 on SPI/I2C bus.
1. Supported Devices
====================
diff --git a/Documentation/iio/adxl380.rst b/Documentation/iio/adxl380.rst
index 654d4c0e84a1..969ded211cc9 100644
--- a/Documentation/iio/adxl380.rst
+++ b/Documentation/iio/adxl380.rst
@@ -4,7 +4,7 @@
ADXL380 driver
===============
-This driver supports Analog Device's ADXL380/382 on SPI/I2C bus.
+This driver supports Analog Devices' ADXL380/382 on SPI/I2C bus.
1. Supported devices
====================
@@ -39,13 +39,13 @@ specific device folder path ``/sys/bus/iio/devices/iio:deviceX``.
+---------------------------------------------------+----------------------------------------------------------+
| in_accel_scale | Scale for the accelerometer channels. |
+---------------------------------------------------+----------------------------------------------------------+
-| in_accel_filter_high_pass_3db_frequency | Low pass filter bandwidth. |
+| in_accel_filter_high_pass_3db_frequency | High pass filter bandwidth. |
+---------------------------------------------------+----------------------------------------------------------+
-| in_accel_filter_high_pass_3db_frequency_available | Available low pass filter bandwidth configurations. |
+| in_accel_filter_high_pass_3db_frequency_available | Available high pass filter bandwidth configurations. |
+---------------------------------------------------+----------------------------------------------------------+
-| in_accel_filter_low_pass_3db_frequency | High pass filter bandwidth. |
+| in_accel_filter_low_pass_3db_frequency | Low pass filter bandwidth. |
+---------------------------------------------------+----------------------------------------------------------+
-| in_accel_filter_low_pass_3db_frequency_available | Available high pass filter bandwidth configurations. |
+| in_accel_filter_low_pass_3db_frequency_available | Available low pass filter bandwidth configurations. |
+---------------------------------------------------+----------------------------------------------------------+
| in_accel_x_calibbias | Calibration offset for the X-axis accelerometer channel. |
+---------------------------------------------------+----------------------------------------------------------+
diff --git a/Documentation/iio/index.rst b/Documentation/iio/index.rst
index b02b879b053a..d0fb32f4b80f 100644
--- a/Documentation/iio/index.rst
+++ b/Documentation/iio/index.rst
@@ -29,7 +29,9 @@ Industrial I/O Kernel Drivers
ad7380
ad7606
ad7625
+ ad7768
ad7944
+ ad9910
ade9000
adf41513
adis16475
diff --git a/MAINTAINERS b/MAINTAINERS
index bccf83d31ac6..441385cd4884 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -651,6 +651,7 @@ F: drivers/iio/accel/adxl355_spi.c
ADXL367 THREE-AXIS DIGITAL ACCELEROMETER DRIVER
M: Marcelo Schmitt
+M: Antoniu Miclaus
L: linux-iio@vger.kernel.org
S: Supported
W: https://ez.analog.com/linux-software-drivers
@@ -1479,6 +1480,7 @@ L: linux-iio@vger.kernel.org
S: Supported
W: https://ez.analog.com/linux-software-drivers
F: Documentation/devicetree/bindings/iio/dac/adi,ad3530r.yaml
+F: Documentation/devicetree/bindings/iio/dac/adi,ad5710r.yaml
F: drivers/iio/dac/ad3530r.c
ANALOG DEVICES INC AD3552R DRIVER
@@ -1528,6 +1530,7 @@ F: drivers/iio/adc/ad4080.c
ANALOG DEVICES INC AD4130 DRIVER
M: Marcelo Schmitt
+M: Antoniu Miclaus
L: linux-iio@vger.kernel.org
S: Supported
W: https://ez.analog.com/linux-software-drivers
@@ -1582,6 +1585,14 @@ W: https://ez.analog.com/linux-software-drivers
F: Documentation/devicetree/bindings/iio/adc/adi,ad4851.yaml
F: drivers/iio/adc/ad4851.c
+ANALOG DEVICES INC AD5529R DRIVER
+M: Janani Sunil
+L: linux-iio@vger.kernel.org
+S: Supported
+W: https://ez.analog.com/linux-software-drivers
+F: Documentation/devicetree/bindings/iio/dac/adi,ad5529r.yaml
+F: drivers/iio/dac/ad5529r.c
+
ANALOG DEVICES INC AD5706R DRIVER
M: Alexis Czezar Torreno
L: linux-iio@vger.kernel.org
@@ -1633,6 +1644,7 @@ F: drivers/iio/dac/ad7293.c
ANALOG DEVICES INC AD74115 DRIVER
M: Marcelo Schmitt
+M: Antoniu Miclaus
L: linux-iio@vger.kernel.org
S: Supported
W: https://ez.analog.com/linux-software-drivers
@@ -1641,6 +1653,7 @@ F: drivers/iio/addac/ad74115.c
ANALOG DEVICES INC AD74413R DRIVER
M: Marcelo Schmitt
+M: Antoniu Miclaus
L: linux-iio@vger.kernel.org
S: Supported
W: https://ez.analog.com/linux-software-drivers
@@ -1668,6 +1681,15 @@ F: Documentation/devicetree/bindings/iio/adc/adi,ad7768-1.yaml
F: drivers/iio/adc/ad7768-1.c
F: include/dt-bindings/iio/adc/adi,ad7768-1.h
+ANALOG DEVICES INC AD7768 DRIVER
+M: Janani Sunil
+L: linux-iio@vger.kernel.org
+S: Supported
+W: https://ez.analog.com/linux-software-drivers
+F: Documentation/devicetree/bindings/iio/adc/adi,ad7768.yaml
+F: Documentation/iio/ad7768.rst
+F: drivers/iio/adc/ad7768.c
+
ANALOG DEVICES INC AD7780 DRIVER
M: Michael Hennerich
M: Renato Lui Geh
@@ -1713,6 +1735,17 @@ W: https://ez.analog.com/linux-software-drivers
F: Documentation/devicetree/bindings/iio/dac/adi,ad9739a.yaml
F: drivers/iio/dac/ad9739a.c
+ANALOG DEVICES INC AD9910 DRIVER
+M: Rodrigo Alencar
+L: linux-iio@vger.kernel.org
+S: Supported
+W: https://ez.analog.com/linux-software-drivers
+F: Documentation/ABI/testing/debugfs-iio-ad9910
+F: Documentation/ABI/testing/sysfs-bus-iio-frequency-ad9910
+F: Documentation/devicetree/bindings/iio/frequency/adi,ad9910.yaml
+F: Documentation/iio/ad9910.rst
+F: drivers/iio/frequency/ad9910.c
+
ANALOG DEVICES INC MAX22007 DRIVER
M: Janani Sunil
L: linux-iio@vger.kernel.org
@@ -4459,6 +4492,15 @@ S: Orphan
F: Documentation/devicetree/bindings/sound/axentia,*
F: sound/soc/atmel/tse850-pcm5142.c
+AXIADO SARADC DRIVER
+M: Petar Stepanovic
+M: Akhila Kavi
+M: Prasad Bolisetty
+L: linux-iio@vger.kernel.org
+S: Maintained
+F: Documentation/devicetree/bindings/iio/adc/axiado,ax3000-saradc.yaml
+F: drivers/iio/adc/axiado_saradc.c
+
AXIADO SGPIO DRIVER
M: Petar Stepanovic
M: SriNavmani A
@@ -12830,6 +12872,7 @@ R: Nuno Sá
R: Andy Shevchenko
L: linux-iio@vger.kernel.org
S: Maintained
+Q: https://patchwork.kernel.org/project/linux-iio/list/
T: git git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio.git
F: Documentation/ABI/testing/configfs-iio*
F: Documentation/ABI/testing/sysfs-bus-iio*
@@ -12842,6 +12885,13 @@ F: include/dt-bindings/iio/
F: include/linux/iio/
F: tools/iio/
+IIO CORE KUNIT TESTS
+M: Rodrigo Alencar
+L: linux-iio@vger.kernel.org
+S: Maintained
+F: drivers/iio/test/iio-test-channel-prefix.c
+F: drivers/iio/test/iio-test-format.c
+
IIO UNIT CONVERTER
M: Peter Rosin
L: linux-iio@vger.kernel.org
@@ -16280,6 +16330,15 @@ L: linux-iio@vger.kernel.org
S: Supported
F: drivers/iio/temperature/max30208.c
+MAXIM MAX40080 CURRENT SENSE AMPLIFIER DRIVER
+M: Ciprian Hegbeli
+M: Stefan Popa
+L: linux-iio@vger.kernel.org
+S: Supported
+W: https://ez.analog.com/linux-software-drivers
+F: Documentation/devicetree/bindings/iio/adc/adi,max40080.yaml
+F: drivers/iio/adc/max40080.c
+
MAXIM MAX7360 KEYPAD LED MFD DRIVER
M: Mathieu Dubois-Briand
S: Maintained
@@ -16451,7 +16510,7 @@ M: Ariana Lazar
L: linux-iio@vger.kernel.org
S: Supported
F: Documentation/devicetree/bindings/iio/dac/microchip,mcp47feb02.yaml
-F: drivers/iio/dac/mcp47feb02.c
+F: drivers/iio/dac/mcp47feb02*
MCP4821 DAC DRIVER
M: Anshul Dalal
@@ -16872,6 +16931,11 @@ S: Maintained
F: drivers/iio/adc/mt6323-auxadc.c
F: include/dt-bindings/iio/adc/mediatek,mt6323-auxadc.h
+MEDIATEK MT6323 PMIC NVMEM DRIVER
+M: Roman Vivchar
+S: Maintained
+F: drivers/nvmem/mt6323-efuse.c
+
MEDIATEK MT6735 CLOCK & RESET DRIVERS
M: Yassine Oudjana
L: linux-clk@vger.kernel.org
@@ -17812,6 +17876,7 @@ L: linux-arm-msm@vger.kernel.org
S: Maintained
T: git git://git.kernel.org/pub/scm/linux/kernel/git/mani/mhi.git
F: Documentation/ABI/stable/sysfs-bus-mhi
+F: Documentation/ABI/testing/sysfs-bus-mhi-devices-loopback
F: Documentation/mhi/
F: drivers/bus/mhi/
F: drivers/pci/endpoint/functions/pci-epf-mhi.c
@@ -22829,6 +22894,14 @@ F: Documentation/networking/device_drivers/cellular/qualcomm/rmnet.rst
F: drivers/net/ethernet/qualcomm/rmnet/
F: include/linux/if_rmnet.h
+QUALCOMM SPMI CONTROLLER (PMIC ARBITER) DRIVER
+M: Abel Vesa
+M: David Collins
+L: linux-arm-msm@vger.kernel.org
+S: Maintained
+F: Documentation/devicetree/bindings/spmi/qcom,*spmi-pmic-arb*.yaml
+F: drivers/spmi/spmi-pmic-arb.c
+
QUALCOMM TEE (QCOMTEE) DRIVER
M: Amirreza Zarrabi
L: linux-arm-msm@vger.kernel.org
@@ -26118,6 +26191,7 @@ F: tools/spi/
SPMI SUBSYSTEM
M: Stephen Boyd
+M: Abel Vesa
L: linux-kernel@vger.kernel.org
S: Maintained
T: git git://git.kernel.org/pub/scm/linux/kernel/git/sboyd/spmi.git
@@ -27530,6 +27604,13 @@ S: Maintained
F: Documentation/devicetree/bindings/iio/adc/ti,ads1119.yaml
F: drivers/iio/adc/ti-ads1119.c
+TI ADS112C04 ADC DRIVER
+M: Kyle Hsieh
+L: linux-iio@vger.kernel.org
+S: Maintained
+F: Documentation/devicetree/bindings/iio/adc/ti,ads112c04.yaml
+F: drivers/iio/adc/ti-ads112c04.c
+
TI ADS112C14 ADC DRIVER
M: David Lechner
L: linux-iio@vger.kernel.org
@@ -27954,6 +28035,13 @@ F: Documentation/devicetree/bindings/media/i2c/toshiba,tc358743.txt
F: drivers/media/i2c/tc358743*
F: include/media/i2c/tc358743.h
+TOSHIBA TC9564 PCI DRIVER
+M: Alex Elder
+M: Daniel Thompson
+S: Maintained
+F: Documentation/devicetree/bindings/misc/pci1179,0220.yaml
+F: drivers/misc/tc9564-pci.c
+
TOSHIBA WMI HOTKEYS DRIVER
M: Azael Avalos
L: platform-driver-x86@vger.kernel.org
@@ -29435,6 +29523,12 @@ S: Maintained
F: Documentation/devicetree/bindings/iio/light/vishay,veml6030.yaml
F: drivers/iio/light/veml6030.c
+VISHAY VEML6031X00 AMBIENT LIGHT SENSOR DRIVER
+M: Javier Carrasco
+S: Maintained
+F: Documentation/devicetree/bindings/iio/light/vishay,veml6030.yaml
+F: drivers/iio/light/veml6031x00.c
+
VISHAY VEML6046X00 RGBIR COLOR SENSOR DRIVER
M: Andreas Klinger
S: Maintained
diff --git a/drivers/accessibility/speakup/main.c b/drivers/accessibility/speakup/main.c
index e9b7c2761f6f..a7c14531f2ce 100644
--- a/drivers/accessibility/speakup/main.c
+++ b/drivers/accessibility/speakup/main.c
@@ -1980,7 +1980,7 @@ static int handle_goto(struct vc_data *vc, u_char type, u_char ch, u16 key)
maxlen = (*goto_buf >= '0') ? 3 : 4;
if ((ch == '+' || ch == '-') && num == 1)
return 1;
- if (ch >= '0' && ch <= '9' && num < maxlen)
+ if (isdigit(ch) && num < maxlen)
return 1;
if (num < maxlen - 1 || num > maxlen)
goto oops;
diff --git a/drivers/accessibility/speakup/selection.c b/drivers/accessibility/speakup/selection.c
index 1713ce4e0ba5..a04a7e8c307b 100644
--- a/drivers/accessibility/speakup/selection.c
+++ b/drivers/accessibility/speakup/selection.c
@@ -61,6 +61,9 @@ static struct speakup_selection_work speakup_sel_work = {
int speakup_set_selection(struct tty_struct *tty)
{
+ if (!tty)
+ return -ENODEV;
+
/* we get kref here first in order to avoid a subtle race when
* cancelling selection work. getting kref first establishes the
* invariant that if speakup_sel_work.tty is not NULL when
@@ -120,6 +123,9 @@ static struct speakup_selection_work speakup_paste_work = {
int speakup_paste_selection(struct tty_struct *tty)
{
+ if (!tty)
+ return -ENODEV;
+
tty_kref_get(tty);
if (cmpxchg(&speakup_paste_work.tty, NULL, tty)) {
tty_kref_put(tty);
diff --git a/drivers/accessibility/speakup/serialio.c b/drivers/accessibility/speakup/serialio.c
index 3418ea31d28f..c344296be9f6 100644
--- a/drivers/accessibility/speakup/serialio.c
+++ b/drivers/accessibility/speakup/serialio.c
@@ -8,22 +8,8 @@
#include "serialio.h"
#include
-/* WARNING: Do not change this to without testing that
- * SERIAL_PORT_DFNS does get defined to the appropriate value.
- */
-#include
+#include
-#ifndef SERIAL_PORT_DFNS
-#define SERIAL_PORT_DFNS
-#endif
-
-static void start_serial_interrupt(int irq);
-
-static const struct old_serial_port rs_table[] = {
- SERIAL_PORT_DFNS
-};
-
-static const struct old_serial_port *serstate;
static int timeouts;
static int spk_serial_out(struct spk_synth *in_synth, const char ch);
@@ -45,111 +31,6 @@ struct spk_io_ops spk_serial_io_ops = {
};
EXPORT_SYMBOL_GPL(spk_serial_io_ops);
-const struct old_serial_port *spk_serial_init(int index)
-{
- int baud = 9600, quot = 0;
- unsigned int cval = 0;
- int cflag = CREAD | HUPCL | CLOCAL | B9600 | CS8;
- const struct old_serial_port *ser;
- int err;
-
- if (index >= ARRAY_SIZE(rs_table)) {
- pr_info("no port info for ttyS%d\n", index);
- return NULL;
- }
- ser = rs_table + index;
-
- /* Divisor, byte size and parity */
- quot = ser->baud_base / baud;
- cval = cflag & (CSIZE | CSTOPB);
-#if defined(__powerpc__) || defined(__alpha__)
- cval >>= 8;
-#else /* !__powerpc__ && !__alpha__ */
- cval >>= 4;
-#endif /* !__powerpc__ && !__alpha__ */
- if (cflag & PARENB)
- cval |= UART_LCR_PARITY;
- if (!(cflag & PARODD))
- cval |= UART_LCR_EPAR;
- if (synth_request_region(ser->port, 8)) {
- /* try to take it back. */
- pr_info("Ports not available, trying to steal them\n");
- __release_region(&ioport_resource, ser->port, 8);
- err = synth_request_region(ser->port, 8);
- if (err) {
- pr_warn("Unable to allocate port at %x, errno %i",
- ser->port, err);
- return NULL;
- }
- }
-
- /* Disable UART interrupts, set DTR and RTS high
- * and set speed.
- */
- outb(cval | UART_LCR_DLAB, ser->port + UART_LCR); /* set DLAB */
- outb(quot & 0xff, ser->port + UART_DLL); /* LS of divisor */
- outb(quot >> 8, ser->port + UART_DLM); /* MS of divisor */
- outb(cval, ser->port + UART_LCR); /* reset DLAB */
-
- /* Turn off Interrupts */
- outb(0, ser->port + UART_IER);
- outb(UART_MCR_DTR | UART_MCR_RTS, ser->port + UART_MCR);
-
- /* If we read 0xff from the LSR, there is no UART here. */
- if (inb(ser->port + UART_LSR) == 0xff) {
- synth_release_region(ser->port, 8);
- serstate = NULL;
- return NULL;
- }
-
- mdelay(1);
- speakup_info.port_tts = ser->port;
- serstate = ser;
-
- start_serial_interrupt(ser->irq);
-
- return ser;
-}
-
-static irqreturn_t synth_readbuf_handler(int irq, void *dev_id)
-{
- unsigned long flags;
- int c;
-
- spin_lock_irqsave(&speakup_info.spinlock, flags);
- while (inb_p(speakup_info.port_tts + UART_LSR) & UART_LSR_DR) {
- c = inb_p(speakup_info.port_tts + UART_RX);
- synth->read_buff_add((u_char)c);
- }
- spin_unlock_irqrestore(&speakup_info.spinlock, flags);
- return IRQ_HANDLED;
-}
-
-static void start_serial_interrupt(int irq)
-{
- int rv;
-
- if (!synth->read_buff_add)
- return;
-
- rv = request_irq(irq, synth_readbuf_handler, IRQF_SHARED,
- "serial", (void *)synth_readbuf_handler);
-
- if (rv)
- pr_err("Unable to request Speakup serial I R Q\n");
- /* Set MCR */
- outb(UART_MCR_DTR | UART_MCR_RTS | UART_MCR_OUT2,
- speakup_info.port_tts + UART_MCR);
- /* Turn on Interrupts */
- outb(UART_IER_MSI | UART_IER_RLSI | UART_IER_RDI,
- speakup_info.port_tts + UART_IER);
- inb(speakup_info.port_tts + UART_LSR);
- inb(speakup_info.port_tts + UART_RX);
- inb(speakup_info.port_tts + UART_IIR);
- inb(speakup_info.port_tts + UART_MSR);
- outb(1, speakup_info.port_tts + UART_FCR); /* Turn FIFO On */
-}
-
static void spk_serial_send_xchar(struct spk_synth *synth, char ch)
{
int timeout = SPK_XMITR_TIMEOUT;
@@ -169,50 +50,6 @@ static void spk_serial_tiocmset(struct spk_synth *in_synth, unsigned int set, un
outb((old & ~clear) | set, speakup_info.port_tts + UART_MCR);
}
-int spk_serial_synth_probe(struct spk_synth *synth)
-{
- const struct old_serial_port *ser;
- int failed = 0;
-
- if ((synth->ser >= SPK_LO_TTY) && (synth->ser <= SPK_HI_TTY)) {
- ser = spk_serial_init(synth->ser);
- if (!ser) {
- failed = -1;
- } else {
- outb_p(0, ser->port);
- mdelay(1);
- outb_p('\r', ser->port);
- }
- } else {
- failed = -1;
- pr_warn("ttyS%i is an invalid port\n", synth->ser);
- }
- if (failed) {
- pr_info("%s: not found\n", synth->long_name);
- return -ENODEV;
- }
- pr_info("%s: ttyS%i, Driver Version %s\n",
- synth->long_name, synth->ser, synth->version);
- synth->alive = 1;
- return 0;
-}
-EXPORT_SYMBOL_GPL(spk_serial_synth_probe);
-
-void spk_stop_serial_interrupt(void)
-{
- if (speakup_info.port_tts == 0)
- return;
-
- if (!synth->read_buff_add)
- return;
-
- /* Turn off interrupts */
- outb(0, speakup_info.port_tts + UART_IER);
- /* Free IRQ */
- free_irq(serstate->irq, (void *)synth_readbuf_handler);
-}
-EXPORT_SYMBOL_GPL(spk_stop_serial_interrupt);
-
static int spk_serial_wait_for_xmitr(struct spk_synth *in_synth)
{
int tmout = SPK_XMITR_TIMEOUT;
@@ -288,31 +125,3 @@ static int spk_serial_out(struct spk_synth *in_synth, const char ch)
}
return 0;
}
-
-const char *spk_serial_synth_immediate(struct spk_synth *synth,
- const char *buff)
-{
- u_char ch;
-
- while ((ch = *buff)) {
- if (ch == '\n')
- ch = synth->procspeech;
- if (spk_serial_wait_for_xmitr(synth))
- outb(ch, speakup_info.port_tts);
- else
- return buff;
- buff++;
- }
- return NULL;
-}
-EXPORT_SYMBOL_GPL(spk_serial_synth_immediate);
-
-void spk_serial_release(struct spk_synth *synth)
-{
- spk_stop_serial_interrupt();
- if (speakup_info.port_tts == 0)
- return;
- synth_release_region(speakup_info.port_tts, 8);
- speakup_info.port_tts = 0;
-}
-EXPORT_SYMBOL_GPL(spk_serial_release);
diff --git a/drivers/accessibility/speakup/serialio.h b/drivers/accessibility/speakup/serialio.h
index b4f9a1925b81..189c0dd9ce41 100644
--- a/drivers/accessibility/speakup/serialio.h
+++ b/drivers/accessibility/speakup/serialio.h
@@ -8,31 +8,14 @@
#include "spk_priv.h"
-/*
- * this is cut&paste from 8250.h. Get rid of the structure, the definitions
- * and this whole broken driver.
- */
-struct old_serial_port {
- unsigned int uart; /* unused */
- unsigned int baud_base;
- unsigned int port;
- unsigned int irq;
- upf_t flags; /* unused */
-};
-
/* countdown values for serial timeouts in us */
#define SPK_SERIAL_TIMEOUT SPK_SYNTH_TIMEOUT
/* countdown values transmitter/dsr timeouts in us */
#define SPK_XMITR_TIMEOUT 100000
/* countdown values cts timeouts in us */
#define SPK_CTS_TIMEOUT 100000
-/* check ttyS0 ... ttyS3 */
-#define SPK_LO_TTY 0
-#define SPK_HI_TTY 3
/* # of timeouts permitted before disable */
#define NUM_DISABLE_TIMEOUTS 3
-/* buffer timeout in ms */
-#define SPK_TIMEOUT 100
#define spk_serial_tx_busy() \
(!uart_lsr_tx_empty(inb(speakup_info.port_tts + UART_LSR)))
diff --git a/drivers/accessibility/speakup/speakup_acntpc.c b/drivers/accessibility/speakup/speakup_acntpc.c
index a27e6bbf05da..1cc6147cafac 100644
--- a/drivers/accessibility/speakup/speakup_acntpc.c
+++ b/drivers/accessibility/speakup/speakup_acntpc.c
@@ -305,7 +305,6 @@ static int synth_probe(struct spk_synth *synth)
static void accent_release(struct spk_synth *synth)
{
- spk_stop_serial_interrupt();
if (speakup_info.port_tts)
synth_release_region(speakup_info.port_tts - 1,
SYNTH_IO_EXTENT);
diff --git a/drivers/accessibility/speakup/speakup_decpc.c b/drivers/accessibility/speakup/speakup_decpc.c
index 1bf36d1e5477..4837cac8bafa 100644
--- a/drivers/accessibility/speakup/speakup_decpc.c
+++ b/drivers/accessibility/speakup/speakup_decpc.c
@@ -487,7 +487,6 @@ static int synth_probe(struct spk_synth *synth)
static void dtpc_release(struct spk_synth *synth)
{
- spk_stop_serial_interrupt();
if (speakup_info.port_tts)
synth_release_region(speakup_info.port_tts, SYNTH_IO_EXTENT);
speakup_info.port_tts = 0;
diff --git a/drivers/accessibility/speakup/speakup_dtlk.c b/drivers/accessibility/speakup/speakup_dtlk.c
index fa826568937b..0a57f7ea894c 100644
--- a/drivers/accessibility/speakup/speakup_dtlk.c
+++ b/drivers/accessibility/speakup/speakup_dtlk.c
@@ -377,7 +377,6 @@ static int synth_probe(struct spk_synth *synth)
static void dtlk_release(struct spk_synth *synth)
{
- spk_stop_serial_interrupt();
if (speakup_info.port_tts)
synth_release_region(speakup_info.port_tts - 1,
SYNTH_IO_EXTENT);
diff --git a/drivers/accessibility/speakup/speakup_keypc.c b/drivers/accessibility/speakup/speakup_keypc.c
index 9356f6379560..1e2edc5c4b8b 100644
--- a/drivers/accessibility/speakup/speakup_keypc.c
+++ b/drivers/accessibility/speakup/speakup_keypc.c
@@ -306,7 +306,6 @@ static int synth_probe(struct spk_synth *synth)
static void keynote_release(struct spk_synth *synth)
{
- spk_stop_serial_interrupt();
if (synth_port)
synth_release_region(synth_port, SYNTH_IO_EXTENT);
synth_port = 0;
diff --git a/drivers/accessibility/speakup/spk_priv.h b/drivers/accessibility/speakup/spk_priv.h
index 9da57ead17cb..704ff9f120d3 100644
--- a/drivers/accessibility/speakup/spk_priv.h
+++ b/drivers/accessibility/speakup/spk_priv.h
@@ -32,9 +32,6 @@
#define SYNTH_DEFAULT_DEV "ttyS0"
#define SYNTH_DEFAULT_SER 0
-const struct old_serial_port *spk_serial_init(int index);
-void spk_stop_serial_interrupt(void);
-void spk_serial_release(struct spk_synth *synth);
void spk_ttyio_release(struct spk_synth *synth);
void spk_ttyio_register_ldisc(void);
void spk_ttyio_unregister_ldisc(void);
@@ -49,10 +46,7 @@ ssize_t spk_var_show(struct kobject *kobj, struct kobj_attribute *attr,
ssize_t spk_var_store(struct kobject *kobj, struct kobj_attribute *attr,
const char *buf, size_t count);
-int spk_serial_synth_probe(struct spk_synth *synth);
int spk_ttyio_synth_probe(struct spk_synth *synth);
-const char *spk_serial_synth_immediate(struct spk_synth *synth,
- const char *buff);
const char *spk_ttyio_synth_immediate(struct spk_synth *synth,
const char *buff);
void spk_do_catch_up(struct spk_synth *synth);
diff --git a/drivers/accessibility/speakup/varhandlers.c b/drivers/accessibility/speakup/varhandlers.c
index 462f8d879053..c6d3b4cc1af8 100644
--- a/drivers/accessibility/speakup/varhandlers.c
+++ b/drivers/accessibility/speakup/varhandlers.c
@@ -1,5 +1,6 @@
// SPDX-License-Identifier: GPL-2.0
#include
+#include
#include "spk_types.h"
#include "spk_priv.h"
#include "speakup.h"
@@ -265,10 +266,10 @@ int spk_set_string_var(const char *page, struct st_var_header *var, int len)
if (!var->p_val)
var->p_val = var_data->u.s.default_val;
if (var->p_val != var_data->u.s.default_val)
- strcpy((char *)var->p_val, var_data->u.s.default_val);
+ strscpy((char *)var->p_val, var_data->u.s.default_val, MAXVARLEN + 1);
return -ERESTART;
} else if (var->p_val) {
- strcpy((char *)var->p_val, page);
+ strscpy((char *)var->p_val, page, MAXVARLEN + 1);
} else {
return -E2BIG;
}
diff --git a/drivers/android/Kconfig b/drivers/android/Kconfig
index 606a9d07f774..c920d52c0221 100644
--- a/drivers/android/Kconfig
+++ b/drivers/android/Kconfig
@@ -1,10 +1,11 @@
# SPDX-License-Identifier: GPL-2.0
menu "Android"
-config ANDROID_BINDER_IPC
+config ANDROID_BINDER_IPC_RUST
bool "Android Binder IPC Driver"
depends on MMU
depends on NET
+ depends on RUST
default n
help
Binder is used in Android for both communication between processes,
@@ -14,34 +15,9 @@ config ANDROID_BINDER_IPC
Android process, using Binder to identify, invoke and pass arguments
between said processes.
-config ANDROID_BINDER_IPC_RUST
- bool "Rust version of Android Binder IPC Driver"
- depends on RUST && MMU && NET && !ANDROID_BINDER_IPC
- help
- This enables the Rust implementation of the Binder driver.
-
- Binder is used in Android for both communication between processes,
- and remote method invocation.
-
- This means one Android process can call a method/routine in another
- Android process, using Binder to identify, invoke and pass arguments
- between said processes.
-
-config ANDROID_BINDERFS
- bool "Android Binderfs filesystem"
- depends on ANDROID_BINDER_IPC
- default n
- help
- Binderfs is a pseudo-filesystem for the Android Binder IPC driver
- which can be mounted per-ipc namespace allowing to run multiple
- instances of Android.
- Each binderfs mount initially only contains a binder-control device.
- It can be used to dynamically allocate new binder IPC devices via
- ioctls.
-
config ANDROID_BINDER_DEVICES
string "Android Binder devices"
- depends on ANDROID_BINDER_IPC || ANDROID_BINDER_IPC_RUST
+ depends on ANDROID_BINDER_IPC_RUST
default "binder,hwbinder,vndbinder"
help
Default value for the binder.devices parameter.
@@ -51,15 +27,4 @@ config ANDROID_BINDER_DEVICES
created. Each binder device has its own context manager, and is
therefore logically separated from the other devices.
-config ANDROID_BINDER_ALLOC_KUNIT_TEST
- tristate "KUnit Tests for Android Binder Alloc" if !KUNIT_ALL_TESTS
- depends on ANDROID_BINDER_IPC && KUNIT
- default KUNIT_ALL_TESTS
- help
- This feature builds the binder alloc KUnit tests.
-
- Each test case runs using a pared-down binder_alloc struct and
- test-specific freelist, which allows this KUnit module to be loaded
- for testing without interfering with a running system.
-
endmenu
diff --git a/drivers/android/Makefile b/drivers/android/Makefile
index e0c650d3898e..f83d39d16f6e 100644
--- a/drivers/android/Makefile
+++ b/drivers/android/Makefile
@@ -1,7 +1,4 @@
# SPDX-License-Identifier: GPL-2.0-only
ccflags-y += -I$(src) # needed for trace events
-obj-$(CONFIG_ANDROID_BINDERFS) += binderfs.o
-obj-$(CONFIG_ANDROID_BINDER_IPC) += binder.o binder_alloc.o binder_netlink.o
-obj-$(CONFIG_ANDROID_BINDER_ALLOC_KUNIT_TEST) += tests/
obj-$(CONFIG_ANDROID_BINDER_IPC_RUST) += binder/
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
deleted file mode 100644
index bc8bc9ee43a5..000000000000
--- a/drivers/android/binder.c
+++ /dev/null
@@ -1,7187 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-/* binder.c
- *
- * Android IPC Subsystem
- *
- * Copyright (C) 2007-2008 Google, Inc.
- */
-
-/*
- * Locking overview
- *
- * There are 3 main spinlocks which must be acquired in the
- * order shown:
- *
- * 1) proc->outer_lock : protects binder_ref
- * binder_proc_lock() and binder_proc_unlock() are
- * used to acq/rel.
- * 2) node->lock : protects most fields of binder_node.
- * binder_node_lock() and binder_node_unlock() are
- * used to acq/rel
- * 3) proc->inner_lock : protects the thread and node lists
- * (proc->threads, proc->waiting_threads, proc->nodes)
- * and all todo lists associated with the binder_proc
- * (proc->todo, thread->todo, proc->delivered_death and
- * node->async_todo), as well as thread->transaction_stack
- * binder_inner_proc_lock() and binder_inner_proc_unlock()
- * are used to acq/rel
- *
- * Any lock under procA must never be nested under any lock at the same
- * level or below on procB.
- *
- * Functions that require a lock held on entry indicate which lock
- * in the suffix of the function name:
- *
- * foo_olocked() : requires node->outer_lock
- * foo_nlocked() : requires node->lock
- * foo_ilocked() : requires proc->inner_lock
- * foo_oilocked(): requires proc->outer_lock and proc->inner_lock
- * foo_nilocked(): requires node->lock and proc->inner_lock
- * ...
- */
-
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-#include
-
-#include
-
-#include
-
-#include
-
-#include "binder_netlink.h"
-#include "binder_internal.h"
-#include "binder_trace.h"
-
-static HLIST_HEAD(binder_deferred_list);
-static DEFINE_MUTEX(binder_deferred_lock);
-
-static HLIST_HEAD(binder_devices);
-static DEFINE_SPINLOCK(binder_devices_lock);
-
-static HLIST_HEAD(binder_procs);
-static DEFINE_MUTEX(binder_procs_lock);
-
-static HLIST_HEAD(binder_dead_nodes);
-static DEFINE_SPINLOCK(binder_dead_nodes_lock);
-
-static struct dentry *binder_debugfs_dir_entry_root;
-static struct dentry *binder_debugfs_dir_entry_proc;
-static atomic_t binder_last_id;
-
-static int proc_show(struct seq_file *m, void *unused);
-DEFINE_SHOW_ATTRIBUTE(proc);
-
-#define FORBIDDEN_MMAP_FLAGS (VM_WRITE)
-
-enum {
- BINDER_DEBUG_USER_ERROR = 1U << 0,
- BINDER_DEBUG_FAILED_TRANSACTION = 1U << 1,
- BINDER_DEBUG_DEAD_TRANSACTION = 1U << 2,
- BINDER_DEBUG_OPEN_CLOSE = 1U << 3,
- BINDER_DEBUG_DEAD_BINDER = 1U << 4,
- BINDER_DEBUG_DEATH_NOTIFICATION = 1U << 5,
- BINDER_DEBUG_READ_WRITE = 1U << 6,
- BINDER_DEBUG_USER_REFS = 1U << 7,
- BINDER_DEBUG_THREADS = 1U << 8,
- BINDER_DEBUG_TRANSACTION = 1U << 9,
- BINDER_DEBUG_TRANSACTION_COMPLETE = 1U << 10,
- BINDER_DEBUG_FREE_BUFFER = 1U << 11,
- BINDER_DEBUG_INTERNAL_REFS = 1U << 12,
- BINDER_DEBUG_PRIORITY_CAP = 1U << 13,
- BINDER_DEBUG_SPINLOCKS = 1U << 14,
-};
-static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR |
- BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION;
-module_param_named(debug_mask, binder_debug_mask, uint, 0644);
-
-char *binder_devices_param = CONFIG_ANDROID_BINDER_DEVICES;
-module_param_named(devices, binder_devices_param, charp, 0444);
-
-static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait);
-static int binder_stop_on_user_error;
-
-static int binder_set_stop_on_user_error(const char *val,
- const struct kernel_param *kp)
-{
- int ret;
-
- ret = param_set_int(val, kp);
- if (binder_stop_on_user_error < 2)
- wake_up(&binder_user_error_wait);
- return ret;
-}
-module_param_call(stop_on_user_error, binder_set_stop_on_user_error,
- param_get_int, &binder_stop_on_user_error, 0644);
-
-static __printf(2, 3) void binder_debug(int mask, const char *format, ...)
-{
- struct va_format vaf;
- va_list args;
-
- if (binder_debug_mask & mask) {
- va_start(args, format);
- vaf.va = &args;
- vaf.fmt = format;
- pr_info_ratelimited("%pV", &vaf);
- va_end(args);
- }
-}
-
-#define binder_txn_error(x...) \
- binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, x)
-
-static __printf(1, 2) void binder_user_error(const char *format, ...)
-{
- struct va_format vaf;
- va_list args;
-
- if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) {
- va_start(args, format);
- vaf.va = &args;
- vaf.fmt = format;
- pr_info_ratelimited("%pV", &vaf);
- va_end(args);
- }
-
- if (binder_stop_on_user_error)
- binder_stop_on_user_error = 2;
-}
-
-#define binder_set_extended_error(ee, _id, _command, _param) \
- do { \
- (ee)->id = _id; \
- (ee)->command = _command; \
- (ee)->param = _param; \
- } while (0)
-
-#define to_flat_binder_object(hdr) \
- container_of(hdr, struct flat_binder_object, hdr)
-
-#define to_binder_fd_object(hdr) container_of(hdr, struct binder_fd_object, hdr)
-
-#define to_binder_buffer_object(hdr) \
- container_of(hdr, struct binder_buffer_object, hdr)
-
-#define to_binder_fd_array_object(hdr) \
- container_of(hdr, struct binder_fd_array_object, hdr)
-
-static struct binder_stats binder_stats;
-
-static inline void binder_stats_deleted(enum binder_stat_types type)
-{
- atomic_inc(&binder_stats.obj_deleted[type]);
-}
-
-static inline void binder_stats_created(enum binder_stat_types type)
-{
- atomic_inc(&binder_stats.obj_created[type]);
-}
-
-struct binder_transaction_log_entry {
- int debug_id;
- int debug_id_done;
- int call_type;
- int from_proc;
- int from_thread;
- int target_handle;
- int to_proc;
- int to_thread;
- int to_node;
- int data_size;
- int offsets_size;
- int return_error_line;
- uint32_t return_error;
- uint32_t return_error_param;
- char context_name[BINDERFS_MAX_NAME + 1];
-};
-
-struct binder_transaction_log {
- atomic_t cur;
- bool full;
- struct binder_transaction_log_entry entry[32];
-};
-
-static struct binder_transaction_log binder_transaction_log;
-static struct binder_transaction_log binder_transaction_log_failed;
-
-static struct binder_transaction_log_entry *binder_transaction_log_add(
- struct binder_transaction_log *log)
-{
- struct binder_transaction_log_entry *e;
- unsigned int cur = atomic_inc_return(&log->cur);
-
- if (cur >= ARRAY_SIZE(log->entry))
- log->full = true;
- e = &log->entry[cur % ARRAY_SIZE(log->entry)];
- WRITE_ONCE(e->debug_id_done, 0);
- /*
- * write-barrier to synchronize access to e->debug_id_done.
- * We make sure the initialized 0 value is seen before
- * memset() other fields are zeroed by memset.
- */
- smp_wmb();
- memset(e, 0, sizeof(*e));
- return e;
-}
-
-enum binder_deferred_state {
- BINDER_DEFERRED_FLUSH = 0x01,
- BINDER_DEFERRED_RELEASE = 0x02,
-};
-
-enum {
- BINDER_LOOPER_STATE_REGISTERED = 0x01,
- BINDER_LOOPER_STATE_ENTERED = 0x02,
- BINDER_LOOPER_STATE_EXITED = 0x04,
- BINDER_LOOPER_STATE_INVALID = 0x08,
- BINDER_LOOPER_STATE_WAITING = 0x10,
- BINDER_LOOPER_STATE_POLL = 0x20,
-};
-
-/**
- * binder_proc_lock() - Acquire outer lock for given binder_proc
- * @proc: struct binder_proc to acquire
- *
- * Acquires proc->outer_lock. Used to protect binder_ref
- * structures associated with the given proc.
- */
-#define binder_proc_lock(proc) _binder_proc_lock(proc, __LINE__)
-static void
-_binder_proc_lock(struct binder_proc *proc, int line)
- __acquires(&proc->outer_lock)
-{
- binder_debug(BINDER_DEBUG_SPINLOCKS,
- "%s: line=%d\n", __func__, line);
- spin_lock(&proc->outer_lock);
-}
-
-/**
- * binder_proc_unlock() - Release outer lock for given binder_proc
- * @proc: struct binder_proc to acquire
- *
- * Release lock acquired via binder_proc_lock()
- */
-#define binder_proc_unlock(proc) _binder_proc_unlock(proc, __LINE__)
-static void
-_binder_proc_unlock(struct binder_proc *proc, int line)
- __releases(&proc->outer_lock)
-{
- binder_debug(BINDER_DEBUG_SPINLOCKS,
- "%s: line=%d\n", __func__, line);
- spin_unlock(&proc->outer_lock);
-}
-
-/**
- * binder_inner_proc_lock() - Acquire inner lock for given binder_proc
- * @proc: struct binder_proc to acquire
- *
- * Acquires proc->inner_lock. Used to protect todo lists
- */
-#define binder_inner_proc_lock(proc) _binder_inner_proc_lock(proc, __LINE__)
-static void
-_binder_inner_proc_lock(struct binder_proc *proc, int line)
- __acquires(&proc->inner_lock)
-{
- binder_debug(BINDER_DEBUG_SPINLOCKS,
- "%s: line=%d\n", __func__, line);
- spin_lock(&proc->inner_lock);
-}
-
-/**
- * binder_inner_proc_unlock() - Release inner lock for given binder_proc
- * @proc: struct binder_proc to acquire
- *
- * Release lock acquired via binder_inner_proc_lock()
- */
-#define binder_inner_proc_unlock(proc) _binder_inner_proc_unlock(proc, __LINE__)
-static void
-_binder_inner_proc_unlock(struct binder_proc *proc, int line)
- __releases(&proc->inner_lock)
-{
- binder_debug(BINDER_DEBUG_SPINLOCKS,
- "%s: line=%d\n", __func__, line);
- spin_unlock(&proc->inner_lock);
-}
-
-/**
- * binder_node_lock() - Acquire spinlock for given binder_node
- * @node: struct binder_node to acquire
- *
- * Acquires node->lock. Used to protect binder_node fields
- */
-#define binder_node_lock(node) _binder_node_lock(node, __LINE__)
-static void
-_binder_node_lock(struct binder_node *node, int line)
- __acquires(&node->lock)
-{
- binder_debug(BINDER_DEBUG_SPINLOCKS,
- "%s: line=%d\n", __func__, line);
- spin_lock(&node->lock);
-}
-
-/**
- * binder_node_unlock() - Release spinlock for given binder_proc
- * @node: struct binder_node to acquire
- *
- * Release lock acquired via binder_node_lock()
- */
-#define binder_node_unlock(node) _binder_node_unlock(node, __LINE__)
-static void
-_binder_node_unlock(struct binder_node *node, int line)
- __releases(&node->lock)
-{
- binder_debug(BINDER_DEBUG_SPINLOCKS,
- "%s: line=%d\n", __func__, line);
- spin_unlock(&node->lock);
-}
-
-/**
- * binder_node_inner_lock() - Acquire node and inner locks
- * @node: struct binder_node to acquire
- *
- * Acquires node->lock. If node->proc also acquires
- * proc->inner_lock. Used to protect binder_node fields
- */
-#define binder_node_inner_lock(node) _binder_node_inner_lock(node, __LINE__)
-static void
-_binder_node_inner_lock(struct binder_node *node, int line)
- __acquires(&node->lock) __acquires(&node->proc->inner_lock)
-{
- binder_debug(BINDER_DEBUG_SPINLOCKS,
- "%s: line=%d\n", __func__, line);
- spin_lock(&node->lock);
- if (node->proc)
- binder_inner_proc_lock(node->proc);
- else
- /* annotation for sparse */
- __acquire(&node->proc->inner_lock);
-}
-
-/**
- * binder_node_inner_unlock() - Release node and inner locks
- * @node: struct binder_node to acquire
- *
- * Release lock acquired via binder_node_lock()
- */
-#define binder_node_inner_unlock(node) _binder_node_inner_unlock(node, __LINE__)
-static void
-_binder_node_inner_unlock(struct binder_node *node, int line)
- __releases(&node->lock) __releases(&node->proc->inner_lock)
-{
- struct binder_proc *proc = node->proc;
-
- binder_debug(BINDER_DEBUG_SPINLOCKS,
- "%s: line=%d\n", __func__, line);
- if (proc)
- binder_inner_proc_unlock(proc);
- else
- /* annotation for sparse */
- __release(&node->proc->inner_lock);
- spin_unlock(&node->lock);
-}
-
-static bool binder_worklist_empty_ilocked(struct list_head *list)
-{
- return list_empty(list);
-}
-
-/**
- * binder_worklist_empty() - Check if no items on the work list
- * @proc: binder_proc associated with list
- * @list: list to check
- *
- * Return: true if there are no items on list, else false
- */
-static bool binder_worklist_empty(struct binder_proc *proc,
- struct list_head *list)
-{
- bool ret;
-
- binder_inner_proc_lock(proc);
- ret = binder_worklist_empty_ilocked(list);
- binder_inner_proc_unlock(proc);
- return ret;
-}
-
-/**
- * binder_enqueue_work_ilocked() - Add an item to the work list
- * @work: struct binder_work to add to list
- * @target_list: list to add work to
- *
- * Adds the work to the specified list. Asserts that work
- * is not already on a list.
- *
- * Requires the proc->inner_lock to be held.
- */
-static void
-binder_enqueue_work_ilocked(struct binder_work *work,
- struct list_head *target_list)
-{
- BUG_ON(target_list == NULL);
- BUG_ON(work->entry.next && !list_empty(&work->entry));
- list_add_tail(&work->entry, target_list);
-}
-
-/**
- * binder_enqueue_deferred_thread_work_ilocked() - Add deferred thread work
- * @thread: thread to queue work to
- * @work: struct binder_work to add to list
- *
- * Adds the work to the todo list of the thread. Doesn't set the process_todo
- * flag, which means that (if it wasn't already set) the thread will go to
- * sleep without handling this work when it calls read.
- *
- * Requires the proc->inner_lock to be held.
- */
-static void
-binder_enqueue_deferred_thread_work_ilocked(struct binder_thread *thread,
- struct binder_work *work)
-{
- WARN_ON(!list_empty(&thread->waiting_thread_node));
- binder_enqueue_work_ilocked(work, &thread->todo);
-}
-
-/**
- * binder_enqueue_thread_work_ilocked() - Add an item to the thread work list
- * @thread: thread to queue work to
- * @work: struct binder_work to add to list
- *
- * Adds the work to the todo list of the thread, and enables processing
- * of the todo queue.
- *
- * Requires the proc->inner_lock to be held.
- */
-static void
-binder_enqueue_thread_work_ilocked(struct binder_thread *thread,
- struct binder_work *work)
-{
- WARN_ON(!list_empty(&thread->waiting_thread_node));
- binder_enqueue_work_ilocked(work, &thread->todo);
-
- /* (e)poll-based threads require an explicit wakeup signal when
- * queuing their own work; they rely on these events to consume
- * messages without I/O block. Without it, threads risk waiting
- * indefinitely without handling the work.
- */
- if (thread->looper & BINDER_LOOPER_STATE_POLL &&
- thread->pid == current->pid && !thread->process_todo)
- wake_up_interruptible_sync(&thread->wait);
-
- thread->process_todo = true;
-}
-
-/**
- * binder_enqueue_thread_work() - Add an item to the thread work list
- * @thread: thread to queue work to
- * @work: struct binder_work to add to list
- *
- * Adds the work to the todo list of the thread, and enables processing
- * of the todo queue.
- */
-static void
-binder_enqueue_thread_work(struct binder_thread *thread,
- struct binder_work *work)
-{
- binder_inner_proc_lock(thread->proc);
- binder_enqueue_thread_work_ilocked(thread, work);
- binder_inner_proc_unlock(thread->proc);
-}
-
-static void
-binder_dequeue_work_ilocked(struct binder_work *work)
-{
- list_del_init(&work->entry);
-}
-
-/**
- * binder_dequeue_work() - Removes an item from the work list
- * @proc: binder_proc associated with list
- * @work: struct binder_work to remove from list
- *
- * Removes the specified work item from whatever list it is on.
- * Can safely be called if work is not on any list.
- */
-static void
-binder_dequeue_work(struct binder_proc *proc, struct binder_work *work)
-{
- binder_inner_proc_lock(proc);
- binder_dequeue_work_ilocked(work);
- binder_inner_proc_unlock(proc);
-}
-
-static struct binder_work *binder_dequeue_work_head_ilocked(
- struct list_head *list)
-{
- struct binder_work *w;
-
- w = list_first_entry_or_null(list, struct binder_work, entry);
- if (w)
- list_del_init(&w->entry);
- return w;
-}
-
-static void
-binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer);
-static void binder_free_thread(struct binder_thread *thread);
-static void binder_free_proc(struct binder_proc *proc);
-static void binder_inc_node_tmpref_ilocked(struct binder_node *node);
-
-static bool binder_has_work_ilocked(struct binder_thread *thread,
- bool do_proc_work)
-{
- return thread->process_todo ||
- thread->looper_need_return ||
- (do_proc_work &&
- !binder_worklist_empty_ilocked(&thread->proc->todo));
-}
-
-static bool binder_has_work(struct binder_thread *thread, bool do_proc_work)
-{
- bool has_work;
-
- binder_inner_proc_lock(thread->proc);
- has_work = binder_has_work_ilocked(thread, do_proc_work);
- binder_inner_proc_unlock(thread->proc);
-
- return has_work;
-}
-
-static bool binder_available_for_proc_work_ilocked(struct binder_thread *thread)
-{
- return !thread->transaction_stack &&
- binder_worklist_empty_ilocked(&thread->todo);
-}
-
-static void binder_wakeup_poll_threads_ilocked(struct binder_proc *proc,
- bool sync)
-{
- struct rb_node *n;
- struct binder_thread *thread;
-
- for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) {
- thread = rb_entry(n, struct binder_thread, rb_node);
- if (thread->looper & BINDER_LOOPER_STATE_POLL &&
- binder_available_for_proc_work_ilocked(thread)) {
- if (sync)
- wake_up_interruptible_sync(&thread->wait);
- else
- wake_up_interruptible(&thread->wait);
- }
- }
-}
-
-/**
- * binder_select_thread_ilocked() - selects a thread for doing proc work.
- * @proc: process to select a thread from
- *
- * Note that calling this function moves the thread off the waiting_threads
- * list, so it can only be woken up by the caller of this function, or a
- * signal. Therefore, callers *should* always wake up the thread this function
- * returns.
- *
- * Return: If there's a thread currently waiting for process work,
- * returns that thread. Otherwise returns NULL.
- */
-static struct binder_thread *
-binder_select_thread_ilocked(struct binder_proc *proc)
-{
- struct binder_thread *thread;
-
- assert_spin_locked(&proc->inner_lock);
- thread = list_first_entry_or_null(&proc->waiting_threads,
- struct binder_thread,
- waiting_thread_node);
-
- if (thread)
- list_del_init(&thread->waiting_thread_node);
-
- return thread;
-}
-
-/**
- * binder_wakeup_thread_ilocked() - wakes up a thread for doing proc work.
- * @proc: process to wake up a thread in
- * @thread: specific thread to wake-up (may be NULL)
- * @sync: whether to do a synchronous wake-up
- *
- * This function wakes up a thread in the @proc process.
- * The caller may provide a specific thread to wake-up in
- * the @thread parameter. If @thread is NULL, this function
- * will wake up threads that have called poll().
- *
- * Note that for this function to work as expected, callers
- * should first call binder_select_thread() to find a thread
- * to handle the work (if they don't have a thread already),
- * and pass the result into the @thread parameter.
- */
-static void binder_wakeup_thread_ilocked(struct binder_proc *proc,
- struct binder_thread *thread,
- bool sync)
-{
- assert_spin_locked(&proc->inner_lock);
-
- if (thread) {
- if (sync)
- wake_up_interruptible_sync(&thread->wait);
- else
- wake_up_interruptible(&thread->wait);
- return;
- }
-
- /* Didn't find a thread waiting for proc work; this can happen
- * in two scenarios:
- * 1. All threads are busy handling transactions
- * In that case, one of those threads should call back into
- * the kernel driver soon and pick up this work.
- * 2. Threads are using the (e)poll interface, in which case
- * they may be blocked on the waitqueue without having been
- * added to waiting_threads. For this case, we just iterate
- * over all threads not handling transaction work, and
- * wake them all up. We wake all because we don't know whether
- * a thread that called into (e)poll is handling non-binder
- * work currently.
- */
- binder_wakeup_poll_threads_ilocked(proc, sync);
-}
-
-static void binder_wakeup_proc_ilocked(struct binder_proc *proc)
-{
- struct binder_thread *thread = binder_select_thread_ilocked(proc);
-
- binder_wakeup_thread_ilocked(proc, thread, /* sync = */false);
-}
-
-static void binder_set_nice(long nice)
-{
- long min_nice;
-
- if (can_nice(current, nice)) {
- set_user_nice(current, nice);
- return;
- }
- min_nice = rlimit_to_nice(rlimit(RLIMIT_NICE));
- binder_debug(BINDER_DEBUG_PRIORITY_CAP,
- "%d: nice value %ld not allowed use %ld instead\n",
- current->pid, nice, min_nice);
- set_user_nice(current, min_nice);
- if (min_nice <= MAX_NICE)
- return;
- binder_user_error("%d RLIMIT_NICE not set\n", current->pid);
-}
-
-static struct binder_node *binder_get_node_ilocked(struct binder_proc *proc,
- binder_uintptr_t ptr)
-{
- struct rb_node *n = proc->nodes.rb_node;
- struct binder_node *node;
-
- assert_spin_locked(&proc->inner_lock);
-
- while (n) {
- node = rb_entry(n, struct binder_node, rb_node);
-
- if (ptr < node->ptr)
- n = n->rb_left;
- else if (ptr > node->ptr)
- n = n->rb_right;
- else {
- /*
- * take an implicit weak reference
- * to ensure node stays alive until
- * call to binder_put_node()
- */
- binder_inc_node_tmpref_ilocked(node);
- return node;
- }
- }
- return NULL;
-}
-
-static struct binder_node *binder_get_node(struct binder_proc *proc,
- binder_uintptr_t ptr)
-{
- struct binder_node *node;
-
- binder_inner_proc_lock(proc);
- node = binder_get_node_ilocked(proc, ptr);
- binder_inner_proc_unlock(proc);
- return node;
-}
-
-static struct binder_node *binder_init_node_ilocked(
- struct binder_proc *proc,
- struct binder_node *new_node,
- struct flat_binder_object *fp)
-{
- struct rb_node **p = &proc->nodes.rb_node;
- struct rb_node *parent = NULL;
- struct binder_node *node;
- binder_uintptr_t ptr = fp ? fp->binder : 0;
- binder_uintptr_t cookie = fp ? fp->cookie : 0;
- __u32 flags = fp ? fp->flags : 0;
-
- assert_spin_locked(&proc->inner_lock);
-
- while (*p) {
-
- parent = *p;
- node = rb_entry(parent, struct binder_node, rb_node);
-
- if (ptr < node->ptr)
- p = &(*p)->rb_left;
- else if (ptr > node->ptr)
- p = &(*p)->rb_right;
- else {
- /*
- * A matching node is already in
- * the rb tree. Abandon the init
- * and return it.
- */
- binder_inc_node_tmpref_ilocked(node);
- return node;
- }
- }
- node = new_node;
- binder_stats_created(BINDER_STAT_NODE);
- node->tmp_refs++;
- rb_link_node(&node->rb_node, parent, p);
- rb_insert_color(&node->rb_node, &proc->nodes);
- node->debug_id = atomic_inc_return(&binder_last_id);
- node->proc = proc;
- node->ptr = ptr;
- node->cookie = cookie;
- node->work.type = BINDER_WORK_NODE;
- node->min_priority = flags & FLAT_BINDER_FLAG_PRIORITY_MASK;
- node->accept_fds = !!(flags & FLAT_BINDER_FLAG_ACCEPTS_FDS);
- node->txn_security_ctx = !!(flags & FLAT_BINDER_FLAG_TXN_SECURITY_CTX);
- spin_lock_init(&node->lock);
- INIT_LIST_HEAD(&node->work.entry);
- INIT_LIST_HEAD(&node->async_todo);
- binder_debug(BINDER_DEBUG_INTERNAL_REFS,
- "%d:%d node %d u%016llx c%016llx created\n",
- proc->pid, current->pid, node->debug_id,
- (u64)node->ptr, (u64)node->cookie);
-
- return node;
-}
-
-static struct binder_node *binder_new_node(struct binder_proc *proc,
- struct flat_binder_object *fp)
-{
- struct binder_node *node;
- struct binder_node *new_node = kzalloc_obj(*node);
-
- if (!new_node)
- return NULL;
- binder_inner_proc_lock(proc);
- node = binder_init_node_ilocked(proc, new_node, fp);
- binder_inner_proc_unlock(proc);
- if (node != new_node)
- /*
- * The node was already added by another thread
- */
- kfree(new_node);
-
- return node;
-}
-
-static void binder_free_node(struct binder_node *node)
-{
- kfree(node);
- binder_stats_deleted(BINDER_STAT_NODE);
-}
-
-static int binder_inc_node_nilocked(struct binder_node *node, int strong,
- int internal,
- struct list_head *target_list)
-{
- struct binder_proc *proc = node->proc;
-
- assert_spin_locked(&node->lock);
- if (proc)
- assert_spin_locked(&proc->inner_lock);
- if (strong) {
- if (internal) {
- if (target_list == NULL &&
- node->internal_strong_refs == 0 &&
- !(node->proc &&
- node == node->proc->context->binder_context_mgr_node &&
- node->has_strong_ref)) {
- pr_err("invalid inc strong node for %d\n",
- node->debug_id);
- return -EINVAL;
- }
- node->internal_strong_refs++;
- } else
- node->local_strong_refs++;
- if (!node->has_strong_ref && target_list) {
- struct binder_thread *thread = container_of(target_list,
- struct binder_thread, todo);
- binder_dequeue_work_ilocked(&node->work);
- BUG_ON(&thread->todo != target_list);
- binder_enqueue_deferred_thread_work_ilocked(thread,
- &node->work);
- }
- } else {
- if (!internal)
- node->local_weak_refs++;
- if (!node->has_weak_ref && target_list && list_empty(&node->work.entry))
- binder_enqueue_work_ilocked(&node->work, target_list);
- }
- return 0;
-}
-
-static int binder_inc_node(struct binder_node *node, int strong, int internal,
- struct list_head *target_list)
-{
- int ret;
-
- binder_node_inner_lock(node);
- ret = binder_inc_node_nilocked(node, strong, internal, target_list);
- binder_node_inner_unlock(node);
-
- return ret;
-}
-
-static bool binder_dec_node_nilocked(struct binder_node *node,
- int strong, int internal)
-{
- struct binder_proc *proc = node->proc;
-
- assert_spin_locked(&node->lock);
- if (proc)
- assert_spin_locked(&proc->inner_lock);
- if (strong) {
- if (internal)
- node->internal_strong_refs--;
- else
- node->local_strong_refs--;
- if (node->local_strong_refs || node->internal_strong_refs)
- return false;
- } else {
- if (!internal)
- node->local_weak_refs--;
- if (node->local_weak_refs || node->tmp_refs ||
- !hlist_empty(&node->refs))
- return false;
- }
-
- if (proc && (node->has_strong_ref || node->has_weak_ref)) {
- if (list_empty(&node->work.entry)) {
- binder_enqueue_work_ilocked(&node->work, &proc->todo);
- binder_wakeup_proc_ilocked(proc);
- }
- } else {
- if (hlist_empty(&node->refs) && !node->local_strong_refs &&
- !node->local_weak_refs && !node->tmp_refs) {
- if (proc) {
- binder_dequeue_work_ilocked(&node->work);
- rb_erase(&node->rb_node, &proc->nodes);
- binder_debug(BINDER_DEBUG_INTERNAL_REFS,
- "refless node %d deleted\n",
- node->debug_id);
- } else {
- BUG_ON(!list_empty(&node->work.entry));
- spin_lock(&binder_dead_nodes_lock);
- /*
- * tmp_refs could have changed so
- * check it again
- */
- if (node->tmp_refs) {
- spin_unlock(&binder_dead_nodes_lock);
- return false;
- }
- hlist_del(&node->dead_node);
- spin_unlock(&binder_dead_nodes_lock);
- binder_debug(BINDER_DEBUG_INTERNAL_REFS,
- "dead node %d deleted\n",
- node->debug_id);
- }
- return true;
- }
- }
- return false;
-}
-
-static void binder_dec_node(struct binder_node *node, int strong, int internal)
-{
- bool free_node;
-
- binder_node_inner_lock(node);
- free_node = binder_dec_node_nilocked(node, strong, internal);
- binder_node_inner_unlock(node);
- if (free_node)
- binder_free_node(node);
-}
-
-static void binder_inc_node_tmpref_ilocked(struct binder_node *node)
-{
- /*
- * No call to binder_inc_node() is needed since we
- * don't need to inform userspace of any changes to
- * tmp_refs
- */
- node->tmp_refs++;
-}
-
-/**
- * binder_inc_node_tmpref() - take a temporary reference on node
- * @node: node to reference
- *
- * Take reference on node to prevent the node from being freed
- * while referenced only by a local variable. The inner lock is
- * needed to serialize with the node work on the queue (which
- * isn't needed after the node is dead). If the node is dead
- * (node->proc is NULL), use binder_dead_nodes_lock to protect
- * node->tmp_refs against dead-node-only cases where the node
- * lock cannot be acquired (eg traversing the dead node list to
- * print nodes)
- */
-static void binder_inc_node_tmpref(struct binder_node *node)
-{
- binder_node_lock(node);
- if (node->proc)
- binder_inner_proc_lock(node->proc);
- else
- spin_lock(&binder_dead_nodes_lock);
- binder_inc_node_tmpref_ilocked(node);
- if (node->proc)
- binder_inner_proc_unlock(node->proc);
- else
- spin_unlock(&binder_dead_nodes_lock);
- binder_node_unlock(node);
-}
-
-/**
- * binder_dec_node_tmpref() - remove a temporary reference on node
- * @node: node to reference
- *
- * Release temporary reference on node taken via binder_inc_node_tmpref()
- */
-static void binder_dec_node_tmpref(struct binder_node *node)
-{
- bool free_node;
-
- binder_node_inner_lock(node);
- if (!node->proc)
- spin_lock(&binder_dead_nodes_lock);
- else
- __acquire(&binder_dead_nodes_lock);
- node->tmp_refs--;
- BUG_ON(node->tmp_refs < 0);
- if (!node->proc)
- spin_unlock(&binder_dead_nodes_lock);
- else
- __release(&binder_dead_nodes_lock);
- /*
- * Call binder_dec_node() to check if all refcounts are 0
- * and cleanup is needed. Calling with strong=0 and internal=1
- * causes no actual reference to be released in binder_dec_node().
- * If that changes, a change is needed here too.
- */
- free_node = binder_dec_node_nilocked(node, 0, 1);
- binder_node_inner_unlock(node);
- if (free_node)
- binder_free_node(node);
-}
-
-static void binder_put_node(struct binder_node *node)
-{
- binder_dec_node_tmpref(node);
-}
-
-static struct binder_ref *binder_get_ref_olocked(struct binder_proc *proc,
- u32 desc, bool need_strong_ref)
-{
- struct rb_node *n = proc->refs_by_desc.rb_node;
- struct binder_ref *ref;
-
- while (n) {
- ref = rb_entry(n, struct binder_ref, rb_node_desc);
-
- if (desc < ref->data.desc) {
- n = n->rb_left;
- } else if (desc > ref->data.desc) {
- n = n->rb_right;
- } else if (need_strong_ref && !ref->data.strong) {
- binder_user_error("tried to use weak ref as strong ref\n");
- return NULL;
- } else {
- return ref;
- }
- }
- return NULL;
-}
-
-/* Find the smallest unused descriptor the "slow way" */
-static u32 slow_desc_lookup_olocked(struct binder_proc *proc, u32 offset)
-{
- struct binder_ref *ref;
- struct rb_node *n;
- u32 desc;
-
- desc = offset;
- for (n = rb_first(&proc->refs_by_desc); n; n = rb_next(n)) {
- ref = rb_entry(n, struct binder_ref, rb_node_desc);
- if (ref->data.desc > desc)
- break;
- desc = ref->data.desc + 1;
- }
-
- return desc;
-}
-
-/*
- * Find an available reference descriptor ID. The proc->outer_lock might
- * be released in the process, in which case -EAGAIN is returned and the
- * @desc should be considered invalid.
- */
-static int get_ref_desc_olocked(struct binder_proc *proc,
- struct binder_node *node,
- u32 *desc)
-{
- struct dbitmap *dmap = &proc->dmap;
- unsigned int nbits, offset;
- unsigned long *new, bit;
-
- /* 0 is reserved for the context manager */
- offset = (node == proc->context->binder_context_mgr_node) ? 0 : 1;
-
- if (!dbitmap_enabled(dmap)) {
- *desc = slow_desc_lookup_olocked(proc, offset);
- return 0;
- }
-
- if (dbitmap_acquire_next_zero_bit(dmap, offset, &bit) == 0) {
- *desc = bit;
- return 0;
- }
-
- /*
- * The dbitmap is full and needs to grow. The proc->outer_lock
- * is briefly released to allocate the new bitmap safely.
- */
- nbits = dbitmap_grow_nbits(dmap);
- binder_proc_unlock(proc);
- new = bitmap_zalloc(nbits, GFP_KERNEL);
- binder_proc_lock(proc);
- dbitmap_grow(dmap, new, nbits);
-
- return -EAGAIN;
-}
-
-/**
- * binder_get_ref_for_node_olocked() - get the ref associated with given node
- * @proc: binder_proc that owns the ref
- * @node: binder_node of target
- * @new_ref: newly allocated binder_ref to be initialized or %NULL
- *
- * Look up the ref for the given node and return it if it exists
- *
- * If it doesn't exist and the caller provides a newly allocated
- * ref, initialize the fields of the newly allocated ref and insert
- * into the given proc rb_trees and node refs list.
- *
- * Return: the ref for node. It is possible that another thread
- * allocated/initialized the ref first in which case the
- * returned ref would be different than the passed-in
- * new_ref. new_ref must be kfree'd by the caller in
- * this case.
- */
-static struct binder_ref *binder_get_ref_for_node_olocked(
- struct binder_proc *proc,
- struct binder_node *node,
- struct binder_ref *new_ref)
-{
- struct binder_ref *ref;
- struct rb_node *parent;
- struct rb_node **p;
- u32 desc;
-
-retry:
- p = &proc->refs_by_node.rb_node;
- parent = NULL;
- while (*p) {
- parent = *p;
- ref = rb_entry(parent, struct binder_ref, rb_node_node);
-
- if (node < ref->node)
- p = &(*p)->rb_left;
- else if (node > ref->node)
- p = &(*p)->rb_right;
- else
- return ref;
- }
- if (!new_ref)
- return NULL;
-
- /* might release the proc->outer_lock */
- if (get_ref_desc_olocked(proc, node, &desc) == -EAGAIN)
- goto retry;
-
- binder_stats_created(BINDER_STAT_REF);
- new_ref->data.debug_id = atomic_inc_return(&binder_last_id);
- new_ref->proc = proc;
- new_ref->node = node;
- rb_link_node(&new_ref->rb_node_node, parent, p);
- rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node);
-
- new_ref->data.desc = desc;
- p = &proc->refs_by_desc.rb_node;
- while (*p) {
- parent = *p;
- ref = rb_entry(parent, struct binder_ref, rb_node_desc);
-
- if (new_ref->data.desc < ref->data.desc)
- p = &(*p)->rb_left;
- else if (new_ref->data.desc > ref->data.desc)
- p = &(*p)->rb_right;
- else
- BUG();
- }
- rb_link_node(&new_ref->rb_node_desc, parent, p);
- rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc);
-
- binder_node_lock(node);
- hlist_add_head(&new_ref->node_entry, &node->refs);
-
- binder_debug(BINDER_DEBUG_INTERNAL_REFS,
- "%d new ref %d desc %d for node %d\n",
- proc->pid, new_ref->data.debug_id, new_ref->data.desc,
- node->debug_id);
- binder_node_unlock(node);
- return new_ref;
-}
-
-static void binder_cleanup_ref_olocked(struct binder_ref *ref)
-{
- struct dbitmap *dmap = &ref->proc->dmap;
- bool delete_node = false;
-
- binder_debug(BINDER_DEBUG_INTERNAL_REFS,
- "%d delete ref %d desc %d for node %d\n",
- ref->proc->pid, ref->data.debug_id, ref->data.desc,
- ref->node->debug_id);
-
- if (dbitmap_enabled(dmap))
- dbitmap_clear_bit(dmap, ref->data.desc);
- rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc);
- rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node);
-
- binder_node_inner_lock(ref->node);
- if (ref->data.strong)
- binder_dec_node_nilocked(ref->node, 1, 1);
-
- hlist_del(&ref->node_entry);
- delete_node = binder_dec_node_nilocked(ref->node, 0, 1);
- binder_node_inner_unlock(ref->node);
- /*
- * Clear ref->node unless we want the caller to free the node
- */
- if (!delete_node) {
- /*
- * The caller uses ref->node to determine
- * whether the node needs to be freed. Clear
- * it since the node is still alive.
- */
- ref->node = NULL;
- }
-
- if (ref->death) {
- binder_debug(BINDER_DEBUG_DEAD_BINDER,
- "%d delete ref %d desc %d has death notification\n",
- ref->proc->pid, ref->data.debug_id,
- ref->data.desc);
- binder_dequeue_work(ref->proc, &ref->death->work);
- binder_stats_deleted(BINDER_STAT_DEATH);
- }
-
- if (ref->freeze) {
- binder_dequeue_work(ref->proc, &ref->freeze->work);
- binder_stats_deleted(BINDER_STAT_FREEZE);
- }
-
- binder_stats_deleted(BINDER_STAT_REF);
-}
-
-/**
- * binder_inc_ref_olocked() - increment the ref for given handle
- * @ref: ref to be incremented
- * @strong: if true, strong increment, else weak
- * @target_list: list to queue node work on
- *
- * Increment the ref. @ref->proc->outer_lock must be held on entry
- *
- * Return: 0, if successful, else errno
- */
-static int binder_inc_ref_olocked(struct binder_ref *ref, int strong,
- struct list_head *target_list)
-{
- int ret;
-
- if (strong) {
- if (ref->data.strong == 0) {
- ret = binder_inc_node(ref->node, 1, 1, target_list);
- if (ret)
- return ret;
- }
- ref->data.strong++;
- } else {
- if (ref->data.weak == 0) {
- ret = binder_inc_node(ref->node, 0, 1, target_list);
- if (ret)
- return ret;
- }
- ref->data.weak++;
- }
- return 0;
-}
-
-/**
- * binder_dec_ref_olocked() - dec the ref for given handle
- * @ref: ref to be decremented
- * @strong: if true, strong decrement, else weak
- *
- * Decrement the ref.
- *
- * Return: %true if ref is cleaned up and ready to be freed.
- */
-static bool binder_dec_ref_olocked(struct binder_ref *ref, int strong)
-{
- if (strong) {
- if (ref->data.strong == 0) {
- binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n",
- ref->proc->pid, ref->data.debug_id,
- ref->data.desc, ref->data.strong,
- ref->data.weak);
- return false;
- }
- ref->data.strong--;
- if (ref->data.strong == 0)
- binder_dec_node(ref->node, strong, 1);
- } else {
- if (ref->data.weak == 0) {
- binder_user_error("%d invalid dec weak, ref %d desc %d s %d w %d\n",
- ref->proc->pid, ref->data.debug_id,
- ref->data.desc, ref->data.strong,
- ref->data.weak);
- return false;
- }
- ref->data.weak--;
- }
- if (ref->data.strong == 0 && ref->data.weak == 0) {
- binder_cleanup_ref_olocked(ref);
- return true;
- }
- return false;
-}
-
-/**
- * binder_get_node_from_ref() - get the node from the given proc/desc
- * @proc: proc containing the ref
- * @desc: the handle associated with the ref
- * @need_strong_ref: if true, only return node if ref is strong
- * @rdata: the id/refcount data for the ref
- *
- * Given a proc and ref handle, return the associated binder_node
- *
- * Return: a binder_node or NULL if not found or not strong when strong required
- */
-static struct binder_node *binder_get_node_from_ref(
- struct binder_proc *proc,
- u32 desc, bool need_strong_ref,
- struct binder_ref_data *rdata)
-{
- struct binder_node *node;
- struct binder_ref *ref;
-
- binder_proc_lock(proc);
- ref = binder_get_ref_olocked(proc, desc, need_strong_ref);
- if (!ref)
- goto err_no_ref;
- node = ref->node;
- /*
- * Take an implicit reference on the node to ensure
- * it stays alive until the call to binder_put_node()
- */
- binder_inc_node_tmpref(node);
- if (rdata)
- *rdata = ref->data;
- binder_proc_unlock(proc);
-
- return node;
-
-err_no_ref:
- binder_proc_unlock(proc);
- return NULL;
-}
-
-/**
- * binder_free_ref() - free the binder_ref
- * @ref: ref to free
- *
- * Free the binder_ref. Free the binder_node indicated by ref->node
- * (if non-NULL) and the binder_ref_death indicated by ref->death.
- */
-static void binder_free_ref(struct binder_ref *ref)
-{
- if (ref->node)
- binder_free_node(ref->node);
- kfree(ref->death);
- kfree(ref->freeze);
- kfree(ref);
-}
-
-/* shrink descriptor bitmap if needed */
-static void try_shrink_dmap(struct binder_proc *proc)
-{
- unsigned long *new;
- int nbits;
-
- binder_proc_lock(proc);
- nbits = dbitmap_shrink_nbits(&proc->dmap);
- binder_proc_unlock(proc);
-
- if (!nbits)
- return;
-
- new = bitmap_zalloc(nbits, GFP_KERNEL);
- binder_proc_lock(proc);
- dbitmap_shrink(&proc->dmap, new, nbits);
- binder_proc_unlock(proc);
-}
-
-/**
- * binder_update_ref_for_handle() - inc/dec the ref for given handle
- * @proc: proc containing the ref
- * @desc: the handle associated with the ref
- * @increment: true=inc reference, false=dec reference
- * @strong: true=strong reference, false=weak reference
- * @rdata: the id/refcount data for the ref
- *
- * Given a proc and ref handle, increment or decrement the ref
- * according to "increment" arg.
- *
- * Return: 0 if successful, else errno
- */
-static int binder_update_ref_for_handle(struct binder_proc *proc,
- uint32_t desc, bool increment, bool strong,
- struct binder_ref_data *rdata)
-{
- int ret = 0;
- struct binder_ref *ref;
- bool delete_ref = false;
-
- binder_proc_lock(proc);
- ref = binder_get_ref_olocked(proc, desc, strong);
- if (!ref) {
- ret = -EINVAL;
- goto err_no_ref;
- }
- if (increment)
- ret = binder_inc_ref_olocked(ref, strong, NULL);
- else
- delete_ref = binder_dec_ref_olocked(ref, strong);
-
- if (rdata)
- *rdata = ref->data;
- binder_proc_unlock(proc);
-
- if (delete_ref) {
- binder_free_ref(ref);
- try_shrink_dmap(proc);
- }
- return ret;
-
-err_no_ref:
- binder_proc_unlock(proc);
- return ret;
-}
-
-/**
- * binder_dec_ref_for_handle() - dec the ref for given handle
- * @proc: proc containing the ref
- * @desc: the handle associated with the ref
- * @strong: true=strong reference, false=weak reference
- * @rdata: the id/refcount data for the ref
- *
- * Just calls binder_update_ref_for_handle() to decrement the ref.
- *
- * Return: 0 if successful, else errno
- */
-static int binder_dec_ref_for_handle(struct binder_proc *proc,
- uint32_t desc, bool strong, struct binder_ref_data *rdata)
-{
- return binder_update_ref_for_handle(proc, desc, false, strong, rdata);
-}
-
-
-/**
- * binder_inc_ref_for_node() - increment the ref for given proc/node
- * @proc: proc containing the ref
- * @node: target node
- * @strong: true=strong reference, false=weak reference
- * @target_list: worklist to use if node is incremented
- * @rdata: the id/refcount data for the ref
- *
- * Given a proc and node, increment the ref. Create the ref if it
- * doesn't already exist
- *
- * Return: 0 if successful, else errno
- */
-static int binder_inc_ref_for_node(struct binder_proc *proc,
- struct binder_node *node,
- bool strong,
- struct list_head *target_list,
- struct binder_ref_data *rdata)
-{
- struct binder_ref *ref;
- struct binder_ref *new_ref = NULL;
- int ret = 0;
-
- binder_proc_lock(proc);
- ref = binder_get_ref_for_node_olocked(proc, node, NULL);
- if (!ref) {
- binder_proc_unlock(proc);
- new_ref = kzalloc_obj(*ref);
- if (!new_ref)
- return -ENOMEM;
- binder_proc_lock(proc);
- ref = binder_get_ref_for_node_olocked(proc, node, new_ref);
- }
- ret = binder_inc_ref_olocked(ref, strong, target_list);
- *rdata = ref->data;
- if (ret && ref == new_ref) {
- /*
- * Cleanup the failed reference here as the target
- * could now be dead and have already released its
- * references by now. Calling on the new reference
- * with strong=0 and a tmp_refs will not decrement
- * the node. The new_ref gets kfree'd below.
- */
- binder_cleanup_ref_olocked(new_ref);
- ref = NULL;
- }
-
- binder_proc_unlock(proc);
- if (new_ref && ref != new_ref)
- /*
- * Another thread created the ref first so
- * free the one we allocated
- */
- kfree(new_ref);
- return ret;
-}
-
-static void binder_pop_transaction_ilocked(struct binder_thread *target_thread,
- struct binder_transaction *t)
-{
- BUG_ON(!target_thread);
- assert_spin_locked(&target_thread->proc->inner_lock);
- BUG_ON(target_thread->transaction_stack != t);
- BUG_ON(target_thread->transaction_stack->from != target_thread);
- target_thread->transaction_stack =
- target_thread->transaction_stack->from_parent;
- t->from = NULL;
-}
-
-/**
- * binder_thread_dec_tmpref() - decrement thread->tmp_ref
- * @thread: thread to decrement
- *
- * A thread needs to be kept alive while being used to create or
- * handle a transaction. binder_get_txn_from() is used to safely
- * extract t->from from a binder_transaction and keep the thread
- * indicated by t->from from being freed. When done with that
- * binder_thread, this function is called to decrement the
- * tmp_ref and free if appropriate (thread has been released
- * and no transaction being processed by the driver)
- */
-static void binder_thread_dec_tmpref(struct binder_thread *thread)
-{
- /*
- * atomic is used to protect the counter value while
- * it cannot reach zero or thread->is_dead is false
- */
- binder_inner_proc_lock(thread->proc);
- atomic_dec(&thread->tmp_ref);
- if (thread->is_dead && !atomic_read(&thread->tmp_ref)) {
- binder_inner_proc_unlock(thread->proc);
- binder_free_thread(thread);
- return;
- }
- binder_inner_proc_unlock(thread->proc);
-}
-
-/**
- * binder_proc_dec_tmpref() - decrement proc->tmp_ref
- * @proc: proc to decrement
- *
- * A binder_proc needs to be kept alive while being used to create or
- * handle a transaction. proc->tmp_ref is incremented when
- * creating a new transaction or the binder_proc is currently in-use
- * by threads that are being released. When done with the binder_proc,
- * this function is called to decrement the counter and free the
- * proc if appropriate (proc has been released, all threads have
- * been released and not currently in-use to process a transaction).
- */
-static void binder_proc_dec_tmpref(struct binder_proc *proc)
-{
- binder_inner_proc_lock(proc);
- proc->tmp_ref--;
- if (proc->is_dead && RB_EMPTY_ROOT(&proc->threads) &&
- !proc->tmp_ref) {
- binder_inner_proc_unlock(proc);
- binder_free_proc(proc);
- return;
- }
- binder_inner_proc_unlock(proc);
-}
-
-/**
- * binder_get_txn_from() - safely extract the "from" thread in transaction
- * @t: binder transaction for t->from
- *
- * Atomically return the "from" thread and increment the tmp_ref
- * count for the thread to ensure it stays alive until
- * binder_thread_dec_tmpref() is called.
- *
- * Return: the value of t->from
- */
-static struct binder_thread *binder_get_txn_from(
- struct binder_transaction *t)
-{
- struct binder_thread *from;
-
- guard(spinlock)(&t->lock);
- from = t->from;
- if (from)
- atomic_inc(&from->tmp_ref);
- return from;
-}
-
-/**
- * binder_get_txn_from_and_acq_inner() - get t->from and acquire inner lock
- * @t: binder transaction for t->from
- *
- * Same as binder_get_txn_from() except it also acquires the proc->inner_lock
- * to guarantee that the thread cannot be released while operating on it.
- * The caller must call binder_inner_proc_unlock() to release the inner lock
- * as well as call binder_dec_thread_txn() to release the reference.
- *
- * Return: the value of t->from
- */
-static struct binder_thread *binder_get_txn_from_and_acq_inner(
- struct binder_transaction *t)
- __acquires(&t->from->proc->inner_lock)
-{
- struct binder_thread *from;
-
- from = binder_get_txn_from(t);
- if (!from) {
- __acquire(&from->proc->inner_lock);
- return NULL;
- }
- binder_inner_proc_lock(from->proc);
- if (t->from) {
- BUG_ON(from != t->from);
- return from;
- }
- binder_inner_proc_unlock(from->proc);
- __acquire(&from->proc->inner_lock);
- binder_thread_dec_tmpref(from);
- return NULL;
-}
-
-/**
- * binder_free_txn_fixups() - free unprocessed fd fixups
- * @t: binder transaction for t->from
- *
- * If the transaction is being torn down prior to being
- * processed by the target process, free all of the
- * fd fixups and fput the file structs. It is safe to
- * call this function after the fixups have been
- * processed -- in that case, the list will be empty.
- */
-static void binder_free_txn_fixups(struct binder_transaction *t)
-{
- struct binder_txn_fd_fixup *fixup, *tmp;
-
- list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) {
- fput(fixup->file);
- if (fixup->target_fd >= 0)
- put_unused_fd(fixup->target_fd);
- list_del(&fixup->fixup_entry);
- kfree(fixup);
- }
-}
-
-static void binder_txn_latency_free(struct binder_transaction *t)
-{
- int from_proc, from_thread, to_proc, to_thread;
-
- spin_lock(&t->lock);
- from_proc = t->from ? t->from->proc->pid : 0;
- from_thread = t->from ? t->from->pid : 0;
- to_proc = t->to_proc ? t->to_proc->pid : 0;
- to_thread = t->to_thread ? t->to_thread->pid : 0;
- spin_unlock(&t->lock);
-
- trace_binder_txn_latency_free(t, from_proc, from_thread, to_proc, to_thread);
-}
-
-static void binder_free_transaction(struct binder_transaction *t)
-{
- struct binder_thread *target_thread;
- struct binder_proc *target_proc;
-
- spin_lock(&t->lock);
- target_proc = t->to_proc;
- target_thread = t->to_thread;
- /*
- * Pin target_thread to keep target_proc alive. Undelivered
- * transactions with !target_thread are safe, as target_proc
- * can only be the current context there.
- */
- if (target_thread)
- atomic_inc(&target_thread->tmp_ref);
- spin_unlock(&t->lock);
-
- if (target_proc) {
- binder_inner_proc_lock(target_proc);
- target_proc->outstanding_txns--;
- if (target_proc->outstanding_txns < 0)
- pr_warn("%s: Unexpected outstanding_txns %d\n",
- __func__, target_proc->outstanding_txns);
- if (!target_proc->outstanding_txns && target_proc->is_frozen)
- wake_up_interruptible_all(&target_proc->freeze_wait);
- if (t->buffer)
- t->buffer->transaction = NULL;
- binder_inner_proc_unlock(target_proc);
- }
-
- if (target_thread)
- binder_thread_dec_tmpref(target_thread);
-
- if (trace_binder_txn_latency_free_enabled())
- binder_txn_latency_free(t);
- /*
- * If the transaction has no target_proc, then
- * t->buffer->transaction has already been cleared.
- */
- binder_free_txn_fixups(t);
- kfree(t);
- binder_stats_deleted(BINDER_STAT_TRANSACTION);
-}
-
-static void binder_send_failed_reply(struct binder_transaction *t,
- uint32_t error_code)
-{
- struct binder_thread *target_thread;
- struct binder_transaction *next;
-
- BUG_ON(t->flags & TF_ONE_WAY);
- while (1) {
- target_thread = binder_get_txn_from_and_acq_inner(t);
- if (target_thread) {
- binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
- "send failed reply for transaction %d to %d:%d\n",
- t->debug_id,
- target_thread->proc->pid,
- target_thread->pid);
-
- binder_pop_transaction_ilocked(target_thread, t);
- if (target_thread->reply_error.cmd == BR_OK) {
- target_thread->reply_error.cmd = error_code;
- binder_enqueue_thread_work_ilocked(
- target_thread,
- &target_thread->reply_error.work);
- wake_up_interruptible(&target_thread->wait);
- } else {
- /*
- * Cannot get here for normal operation, but
- * we can if multiple synchronous transactions
- * are sent without blocking for responses.
- * Just ignore the 2nd error in this case.
- */
- pr_warn("Unexpected reply error: %u\n",
- target_thread->reply_error.cmd);
- }
- binder_inner_proc_unlock(target_thread->proc);
- binder_thread_dec_tmpref(target_thread);
- binder_free_transaction(t);
- return;
- }
- __release(&target_thread->proc->inner_lock);
- next = t->from_parent;
-
- binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
- "send failed reply for transaction %d, target dead\n",
- t->debug_id);
-
- binder_free_transaction(t);
- if (next == NULL) {
- binder_debug(BINDER_DEBUG_DEAD_BINDER,
- "reply failed, no target thread at root\n");
- return;
- }
- t = next;
- binder_debug(BINDER_DEBUG_DEAD_BINDER,
- "reply failed, no target thread -- retry %d\n",
- t->debug_id);
- }
-}
-
-/**
- * binder_cleanup_transaction() - cleans up undelivered transaction
- * @t: transaction that needs to be cleaned up
- * @reason: reason the transaction wasn't delivered
- * @error_code: error to return to caller (if synchronous call)
- */
-static void binder_cleanup_transaction(struct binder_transaction *t,
- const char *reason,
- uint32_t error_code)
-{
- if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) {
- binder_send_failed_reply(t, error_code);
- } else {
- binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
- "undelivered transaction %d, %s\n",
- t->debug_id, reason);
- binder_free_transaction(t);
- }
-}
-
-/**
- * binder_get_object() - gets object and checks for valid metadata
- * @proc: binder_proc owning the buffer
- * @u: sender's user pointer to base of buffer
- * @buffer: binder_buffer that we're parsing.
- * @offset: offset in the @buffer at which to validate an object.
- * @object: struct binder_object to read into
- *
- * Copy the binder object at the given offset into @object. If @u is
- * provided then the copy is from the sender's buffer. If not, then
- * it is copied from the target's @buffer.
- *
- * Return: If there's a valid metadata object at @offset, the
- * size of that object. Otherwise, it returns zero. The object
- * is read into the struct binder_object pointed to by @object.
- */
-static size_t binder_get_object(struct binder_proc *proc,
- const void __user *u,
- struct binder_buffer *buffer,
- unsigned long offset,
- struct binder_object *object)
-{
- size_t read_size;
- struct binder_object_header *hdr;
- size_t object_size = 0;
-
- read_size = min_t(size_t, sizeof(*object), buffer->data_size - offset);
- if (offset > buffer->data_size || read_size < sizeof(*hdr) ||
- !IS_ALIGNED(offset, sizeof(u32)))
- return 0;
-
- if (u) {
- if (copy_from_user(object, u + offset, read_size))
- return 0;
- } else {
- if (binder_alloc_copy_from_buffer(&proc->alloc, object, buffer,
- offset, read_size))
- return 0;
- }
-
- /* Ok, now see if we read a complete object. */
- hdr = &object->hdr;
- switch (hdr->type) {
- case BINDER_TYPE_BINDER:
- case BINDER_TYPE_WEAK_BINDER:
- case BINDER_TYPE_HANDLE:
- case BINDER_TYPE_WEAK_HANDLE:
- object_size = sizeof(struct flat_binder_object);
- break;
- case BINDER_TYPE_FD:
- object_size = sizeof(struct binder_fd_object);
- break;
- case BINDER_TYPE_PTR:
- object_size = sizeof(struct binder_buffer_object);
- break;
- case BINDER_TYPE_FDA:
- object_size = sizeof(struct binder_fd_array_object);
- break;
- default:
- return 0;
- }
- if (offset <= buffer->data_size - object_size &&
- buffer->data_size >= object_size)
- return object_size;
- else
- return 0;
-}
-
-/**
- * binder_validate_ptr() - validates binder_buffer_object in a binder_buffer.
- * @proc: binder_proc owning the buffer
- * @b: binder_buffer containing the object
- * @object: struct binder_object to read into
- * @index: index in offset array at which the binder_buffer_object is
- * located
- * @start_offset: points to the start of the offset array
- * @object_offsetp: offset of @object read from @b
- * @num_valid: the number of valid offsets in the offset array
- *
- * Return: If @index is within the valid range of the offset array
- * described by @start and @num_valid, and if there's a valid
- * binder_buffer_object at the offset found in index @index
- * of the offset array, that object is returned. Otherwise,
- * %NULL is returned.
- * Note that the offset found in index @index itself is not
- * verified; this function assumes that @num_valid elements
- * from @start were previously verified to have valid offsets.
- * If @object_offsetp is non-NULL, then the offset within
- * @b is written to it.
- */
-static struct binder_buffer_object *binder_validate_ptr(
- struct binder_proc *proc,
- struct binder_buffer *b,
- struct binder_object *object,
- binder_size_t index,
- binder_size_t start_offset,
- binder_size_t *object_offsetp,
- binder_size_t num_valid)
-{
- size_t object_size;
- binder_size_t object_offset;
- unsigned long buffer_offset;
-
- if (index >= num_valid)
- return NULL;
-
- buffer_offset = start_offset + sizeof(binder_size_t) * index;
- if (binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,
- b, buffer_offset,
- sizeof(object_offset)))
- return NULL;
- object_size = binder_get_object(proc, NULL, b, object_offset, object);
- if (!object_size || object->hdr.type != BINDER_TYPE_PTR)
- return NULL;
- if (object_offsetp)
- *object_offsetp = object_offset;
-
- return &object->bbo;
-}
-
-/**
- * binder_validate_fixup() - validates pointer/fd fixups happen in order.
- * @proc: binder_proc owning the buffer
- * @b: transaction buffer
- * @objects_start_offset: offset to start of objects buffer
- * @buffer_obj_offset: offset to binder_buffer_object in which to fix up
- * @fixup_offset: start offset in @buffer to fix up
- * @last_obj_offset: offset to last binder_buffer_object that we fixed
- * @last_min_offset: minimum fixup offset in object at @last_obj_offset
- *
- * Return: %true if a fixup in buffer @buffer at offset @offset is
- * allowed.
- *
- * For safety reasons, we only allow fixups inside a buffer to happen
- * at increasing offsets; additionally, we only allow fixup on the last
- * buffer object that was verified, or one of its parents.
- *
- * Example of what is allowed:
- *
- * A
- * B (parent = A, offset = 0)
- * C (parent = A, offset = 16)
- * D (parent = C, offset = 0)
- * E (parent = A, offset = 32) // min_offset is 16 (C.parent_offset)
- *
- * Examples of what is not allowed:
- *
- * Decreasing offsets within the same parent:
- * A
- * C (parent = A, offset = 16)
- * B (parent = A, offset = 0) // decreasing offset within A
- *
- * Referring to a parent that wasn't the last object or any of its parents:
- * A
- * B (parent = A, offset = 0)
- * C (parent = A, offset = 0)
- * C (parent = A, offset = 16)
- * D (parent = B, offset = 0) // B is not A or any of A's parents
- */
-static bool binder_validate_fixup(struct binder_proc *proc,
- struct binder_buffer *b,
- binder_size_t objects_start_offset,
- binder_size_t buffer_obj_offset,
- binder_size_t fixup_offset,
- binder_size_t last_obj_offset,
- binder_size_t last_min_offset)
-{
- if (!last_obj_offset) {
- /* Nothing to fix up in */
- return false;
- }
-
- while (last_obj_offset != buffer_obj_offset) {
- unsigned long buffer_offset;
- struct binder_object last_object;
- struct binder_buffer_object *last_bbo;
- size_t object_size = binder_get_object(proc, NULL, b,
- last_obj_offset,
- &last_object);
- if (object_size != sizeof(*last_bbo))
- return false;
-
- last_bbo = &last_object.bbo;
- /*
- * Safe to retrieve the parent of last_obj, since it
- * was already previously verified by the driver.
- */
- if ((last_bbo->flags & BINDER_BUFFER_FLAG_HAS_PARENT) == 0)
- return false;
- last_min_offset = last_bbo->parent_offset + sizeof(uintptr_t);
- buffer_offset = objects_start_offset +
- sizeof(binder_size_t) * last_bbo->parent;
- if (binder_alloc_copy_from_buffer(&proc->alloc,
- &last_obj_offset,
- b, buffer_offset,
- sizeof(last_obj_offset)))
- return false;
- }
- return (fixup_offset >= last_min_offset);
-}
-
-/**
- * struct binder_task_work_cb - for deferred close
- *
- * @twork: callback_head for task work
- * @file: file to close
- *
- * Structure to pass task work to be handled after
- * returning from binder_ioctl() via task_work_add().
- */
-struct binder_task_work_cb {
- struct callback_head twork;
- struct file *file;
-};
-
-/**
- * binder_do_fd_close() - close list of file descriptors
- * @twork: callback head for task work
- *
- * It is not safe to call ksys_close() during the binder_ioctl()
- * function if there is a chance that binder's own file descriptor
- * might be closed. This is to meet the requirements for using
- * fdget() (see comments for __fget_light()). Therefore use
- * task_work_add() to schedule the close operation once we have
- * returned from binder_ioctl(). This function is a callback
- * for that mechanism and does the actual ksys_close() on the
- * given file descriptor.
- */
-static void binder_do_fd_close(struct callback_head *twork)
-{
- struct binder_task_work_cb *twcb = container_of(twork,
- struct binder_task_work_cb, twork);
-
- fput(twcb->file);
- kfree(twcb);
-}
-
-/**
- * binder_deferred_fd_close() - schedule a close for the given file-descriptor
- * @fd: file-descriptor to close
- *
- * See comments in binder_do_fd_close(). This function is used to schedule
- * a file-descriptor to be closed after returning from binder_ioctl().
- */
-static void binder_deferred_fd_close(int fd)
-{
- struct binder_task_work_cb *twcb;
-
- twcb = kzalloc_obj(*twcb);
- if (!twcb)
- return;
- init_task_work(&twcb->twork, binder_do_fd_close);
- twcb->file = file_close_fd(fd);
- if (twcb->file) {
- // pin it until binder_do_fd_close(); see comments there
- get_file(twcb->file);
- filp_close(twcb->file, current->files);
- task_work_add(current, &twcb->twork, TWA_RESUME);
- } else {
- kfree(twcb);
- }
-}
-
-static void binder_transaction_buffer_release(struct binder_proc *proc,
- struct binder_thread *thread,
- struct binder_buffer *buffer,
- binder_size_t off_end_offset,
- bool is_failure)
-{
- int debug_id = buffer->debug_id;
- binder_size_t off_start_offset, buffer_offset;
-
- binder_debug(BINDER_DEBUG_TRANSACTION,
- "%d buffer release %d, size %zd-%zd, failed at %llx\n",
- proc->pid, buffer->debug_id,
- buffer->data_size, buffer->offsets_size,
- (unsigned long long)off_end_offset);
-
- if (buffer->target_node)
- binder_dec_node(buffer->target_node, 1, 0);
-
- off_start_offset = ALIGN(buffer->data_size, sizeof(void *));
-
- for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
- buffer_offset += sizeof(binder_size_t)) {
- struct binder_object_header *hdr;
- size_t object_size = 0;
- struct binder_object object;
- binder_size_t object_offset;
-
- if (!binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,
- buffer, buffer_offset,
- sizeof(object_offset)))
- object_size = binder_get_object(proc, NULL, buffer,
- object_offset, &object);
- if (object_size == 0) {
- pr_err("transaction release %d bad object at offset %lld, size %zd\n",
- debug_id, (u64)object_offset, buffer->data_size);
- continue;
- }
- hdr = &object.hdr;
- switch (hdr->type) {
- case BINDER_TYPE_BINDER:
- case BINDER_TYPE_WEAK_BINDER: {
- struct flat_binder_object *fp;
- struct binder_node *node;
-
- fp = to_flat_binder_object(hdr);
- node = binder_get_node(proc, fp->binder);
- if (node == NULL) {
- pr_err("transaction release %d bad node %016llx\n",
- debug_id, (u64)fp->binder);
- break;
- }
- binder_debug(BINDER_DEBUG_TRANSACTION,
- " node %d u%016llx\n",
- node->debug_id, (u64)node->ptr);
- binder_dec_node(node, hdr->type == BINDER_TYPE_BINDER,
- 0);
- binder_put_node(node);
- } break;
- case BINDER_TYPE_HANDLE:
- case BINDER_TYPE_WEAK_HANDLE: {
- struct flat_binder_object *fp;
- struct binder_ref_data rdata;
- int ret;
-
- fp = to_flat_binder_object(hdr);
- ret = binder_dec_ref_for_handle(proc, fp->handle,
- hdr->type == BINDER_TYPE_HANDLE, &rdata);
-
- if (ret) {
- pr_err("transaction release %d bad handle %d, ret = %d\n",
- debug_id, fp->handle, ret);
- break;
- }
- binder_debug(BINDER_DEBUG_TRANSACTION,
- " ref %d desc %d\n",
- rdata.debug_id, rdata.desc);
- } break;
-
- case BINDER_TYPE_FD: {
- /*
- * No need to close the file here since user-space
- * closes it for successfully delivered
- * transactions. For transactions that weren't
- * delivered, the new fd was never allocated so
- * there is no need to close and the fput on the
- * file is done when the transaction is torn
- * down.
- */
- } break;
- case BINDER_TYPE_PTR:
- /*
- * Nothing to do here, this will get cleaned up when the
- * transaction buffer gets freed
- */
- break;
- case BINDER_TYPE_FDA: {
- struct binder_fd_array_object *fda;
- struct binder_buffer_object *parent;
- struct binder_object ptr_object;
- binder_size_t fda_offset;
- size_t fd_index;
- binder_size_t fd_buf_size;
- binder_size_t num_valid;
-
- if (is_failure) {
- /*
- * The fd fixups have not been applied so no
- * fds need to be closed.
- */
- continue;
- }
-
- num_valid = (buffer_offset - off_start_offset) /
- sizeof(binder_size_t);
- fda = to_binder_fd_array_object(hdr);
- parent = binder_validate_ptr(proc, buffer, &ptr_object,
- fda->parent,
- off_start_offset,
- NULL,
- num_valid);
- if (!parent) {
- pr_err("transaction release %d bad parent offset\n",
- debug_id);
- continue;
- }
- fd_buf_size = sizeof(u32) * fda->num_fds;
- if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {
- pr_err("transaction release %d invalid number of fds (%lld)\n",
- debug_id, (u64)fda->num_fds);
- continue;
- }
- if (fd_buf_size > parent->length ||
- fda->parent_offset > parent->length - fd_buf_size) {
- /* No space for all file descriptors here. */
- pr_err("transaction release %d not enough space for %lld fds in buffer\n",
- debug_id, (u64)fda->num_fds);
- continue;
- }
- /*
- * the source data for binder_buffer_object is visible
- * to user-space and the @buffer element is the user
- * pointer to the buffer_object containing the fd_array.
- * Convert the address to an offset relative to
- * the base of the transaction buffer.
- */
- fda_offset = parent->buffer - buffer->user_data +
- fda->parent_offset;
- for (fd_index = 0; fd_index < fda->num_fds;
- fd_index++) {
- u32 fd;
- int err;
- binder_size_t offset = fda_offset +
- fd_index * sizeof(fd);
-
- err = binder_alloc_copy_from_buffer(
- &proc->alloc, &fd, buffer,
- offset, sizeof(fd));
- WARN_ON(err);
- if (!err) {
- binder_deferred_fd_close(fd);
- /*
- * Need to make sure the thread goes
- * back to userspace to complete the
- * deferred close
- */
- if (thread)
- thread->looper_need_return = true;
- }
- }
- } break;
- default:
- pr_err("transaction release %d bad object type %x\n",
- debug_id, hdr->type);
- break;
- }
- }
-}
-
-/* Clean up all the objects in the buffer */
-static inline void binder_release_entire_buffer(struct binder_proc *proc,
- struct binder_thread *thread,
- struct binder_buffer *buffer,
- bool is_failure)
-{
- binder_size_t off_end_offset;
-
- off_end_offset = ALIGN(buffer->data_size, sizeof(void *));
- off_end_offset += buffer->offsets_size;
-
- binder_transaction_buffer_release(proc, thread, buffer,
- off_end_offset, is_failure);
-}
-
-static int binder_translate_binder(struct flat_binder_object *fp,
- struct binder_transaction *t,
- struct binder_thread *thread)
-{
- struct binder_node *node;
- struct binder_proc *proc = thread->proc;
- struct binder_proc *target_proc = t->to_proc;
- struct binder_ref_data rdata;
- int ret = 0;
-
- node = binder_get_node(proc, fp->binder);
- if (!node) {
- node = binder_new_node(proc, fp);
- if (!node)
- return -ENOMEM;
- }
- if (fp->cookie != node->cookie) {
- binder_user_error("%d:%d sending u%016llx node %d, cookie mismatch %016llx != %016llx\n",
- proc->pid, thread->pid, (u64)fp->binder,
- node->debug_id, (u64)fp->cookie,
- (u64)node->cookie);
- ret = -EINVAL;
- goto done;
- }
- if (security_binder_transfer_binder(proc->cred, target_proc->cred)) {
- ret = -EPERM;
- goto done;
- }
-
- ret = binder_inc_ref_for_node(target_proc, node,
- fp->hdr.type == BINDER_TYPE_BINDER,
- &thread->todo, &rdata);
- if (ret)
- goto done;
-
- if (fp->hdr.type == BINDER_TYPE_BINDER)
- fp->hdr.type = BINDER_TYPE_HANDLE;
- else
- fp->hdr.type = BINDER_TYPE_WEAK_HANDLE;
- fp->binder = 0;
- fp->handle = rdata.desc;
- fp->cookie = 0;
-
- trace_binder_transaction_node_to_ref(t, node, &rdata);
- binder_debug(BINDER_DEBUG_TRANSACTION,
- " node %d u%016llx -> ref %d desc %d\n",
- node->debug_id, (u64)node->ptr,
- rdata.debug_id, rdata.desc);
-done:
- binder_put_node(node);
- return ret;
-}
-
-static int binder_translate_handle(struct flat_binder_object *fp,
- struct binder_transaction *t,
- struct binder_thread *thread)
-{
- struct binder_proc *proc = thread->proc;
- struct binder_proc *target_proc = t->to_proc;
- struct binder_node *node;
- struct binder_ref_data src_rdata;
- int ret = 0;
-
- node = binder_get_node_from_ref(proc, fp->handle,
- fp->hdr.type == BINDER_TYPE_HANDLE, &src_rdata);
- if (!node) {
- binder_user_error("%d:%d got transaction with invalid handle, %d\n",
- proc->pid, thread->pid, fp->handle);
- return -EINVAL;
- }
- if (security_binder_transfer_binder(proc->cred, target_proc->cred)) {
- ret = -EPERM;
- goto done;
- }
-
- binder_node_lock(node);
- if (node->proc == target_proc) {
- if (fp->hdr.type == BINDER_TYPE_HANDLE)
- fp->hdr.type = BINDER_TYPE_BINDER;
- else
- fp->hdr.type = BINDER_TYPE_WEAK_BINDER;
- fp->binder = node->ptr;
- fp->cookie = node->cookie;
- if (node->proc)
- binder_inner_proc_lock(node->proc);
- else
- __acquire(&node->proc->inner_lock);
- binder_inc_node_nilocked(node,
- fp->hdr.type == BINDER_TYPE_BINDER,
- 0, NULL);
- if (node->proc)
- binder_inner_proc_unlock(node->proc);
- else
- __release(&node->proc->inner_lock);
- trace_binder_transaction_ref_to_node(t, node, &src_rdata);
- binder_debug(BINDER_DEBUG_TRANSACTION,
- " ref %d desc %d -> node %d u%016llx\n",
- src_rdata.debug_id, src_rdata.desc, node->debug_id,
- (u64)node->ptr);
- binder_node_unlock(node);
- } else {
- struct binder_ref_data dest_rdata;
-
- binder_node_unlock(node);
- ret = binder_inc_ref_for_node(target_proc, node,
- fp->hdr.type == BINDER_TYPE_HANDLE,
- NULL, &dest_rdata);
- if (ret)
- goto done;
-
- fp->binder = 0;
- fp->handle = dest_rdata.desc;
- fp->cookie = 0;
- trace_binder_transaction_ref_to_ref(t, node, &src_rdata,
- &dest_rdata);
- binder_debug(BINDER_DEBUG_TRANSACTION,
- " ref %d desc %d -> ref %d desc %d (node %d)\n",
- src_rdata.debug_id, src_rdata.desc,
- dest_rdata.debug_id, dest_rdata.desc,
- node->debug_id);
- }
-done:
- binder_put_node(node);
- return ret;
-}
-
-static int binder_translate_fd(u32 fd, binder_size_t fd_offset,
- struct binder_transaction *t,
- struct binder_thread *thread,
- struct binder_transaction *in_reply_to)
-{
- struct binder_proc *proc = thread->proc;
- struct binder_proc *target_proc = t->to_proc;
- struct binder_txn_fd_fixup *fixup;
- struct file *file;
- int ret = 0;
- bool target_allows_fd;
-
- if (in_reply_to)
- target_allows_fd = !!(in_reply_to->flags & TF_ACCEPT_FDS);
- else
- target_allows_fd = t->buffer->target_node->accept_fds;
- if (!target_allows_fd) {
- binder_user_error("%d:%d got %s with fd, %d, but target does not allow fds\n",
- proc->pid, thread->pid,
- in_reply_to ? "reply" : "transaction",
- fd);
- ret = -EPERM;
- goto err_fd_not_accepted;
- }
-
- file = fget(fd);
- if (!file) {
- binder_user_error("%d:%d got transaction with invalid fd, %d\n",
- proc->pid, thread->pid, fd);
- ret = -EBADF;
- goto err_fget;
- }
- ret = security_binder_transfer_file(proc->cred, target_proc->cred, file);
- if (ret < 0) {
- ret = -EPERM;
- goto err_security;
- }
-
- /*
- * Add fixup record for this transaction. The allocation
- * of the fd in the target needs to be done from a
- * target thread.
- */
- fixup = kzalloc_obj(*fixup);
- if (!fixup) {
- ret = -ENOMEM;
- goto err_alloc;
- }
- fixup->file = file;
- fixup->offset = fd_offset;
- fixup->target_fd = -1;
- trace_binder_transaction_fd_send(t, fd, fixup->offset);
- list_add_tail(&fixup->fixup_entry, &t->fd_fixups);
-
- return ret;
-
-err_alloc:
-err_security:
- fput(file);
-err_fget:
-err_fd_not_accepted:
- return ret;
-}
-
-/**
- * struct binder_ptr_fixup - data to be fixed-up in target buffer
- * @offset: offset in target buffer to fixup
- * @skip_size: bytes to skip in copy (fixup will be written later)
- * @fixup_data: data to write at fixup offset
- * @node: list node
- *
- * This is used for the pointer fixup list (pf) which is created and consumed
- * during binder_transaction() and is only accessed locally. No
- * locking is necessary.
- *
- * The list is ordered by @offset.
- */
-struct binder_ptr_fixup {
- binder_size_t offset;
- size_t skip_size;
- binder_uintptr_t fixup_data;
- struct list_head node;
-};
-
-/**
- * struct binder_sg_copy - scatter-gather data to be copied
- * @offset: offset in target buffer
- * @sender_uaddr: user address in source buffer
- * @length: bytes to copy
- * @node: list node
- *
- * This is used for the sg copy list (sgc) which is created and consumed
- * during binder_transaction() and is only accessed locally. No
- * locking is necessary.
- *
- * The list is ordered by @offset.
- */
-struct binder_sg_copy {
- binder_size_t offset;
- const void __user *sender_uaddr;
- size_t length;
- struct list_head node;
-};
-
-/**
- * binder_do_deferred_txn_copies() - copy and fixup scatter-gather data
- * @alloc: binder_alloc associated with @buffer
- * @buffer: binder buffer in target process
- * @sgc_head: list_head of scatter-gather copy list
- * @pf_head: list_head of pointer fixup list
- *
- * Processes all elements of @sgc_head, applying fixups from @pf_head
- * and copying the scatter-gather data from the source process' user
- * buffer to the target's buffer. It is expected that the list creation
- * and processing all occurs during binder_transaction() so these lists
- * are only accessed in local context.
- *
- * Return: 0=success, else -errno
- */
-static int binder_do_deferred_txn_copies(struct binder_alloc *alloc,
- struct binder_buffer *buffer,
- struct list_head *sgc_head,
- struct list_head *pf_head)
-{
- int ret = 0;
- struct binder_sg_copy *sgc, *tmpsgc;
- struct binder_ptr_fixup *tmppf;
- struct binder_ptr_fixup *pf =
- list_first_entry_or_null(pf_head, struct binder_ptr_fixup,
- node);
-
- list_for_each_entry_safe(sgc, tmpsgc, sgc_head, node) {
- size_t bytes_copied = 0;
-
- while (bytes_copied < sgc->length) {
- size_t copy_size;
- size_t bytes_left = sgc->length - bytes_copied;
- size_t offset = sgc->offset + bytes_copied;
-
- /*
- * We copy up to the fixup (pointed to by pf)
- */
- copy_size = pf ? min(bytes_left, (size_t)pf->offset - offset)
- : bytes_left;
- if (!ret && copy_size)
- ret = binder_alloc_copy_user_to_buffer(
- alloc, buffer,
- offset,
- sgc->sender_uaddr + bytes_copied,
- copy_size);
- bytes_copied += copy_size;
- if (copy_size != bytes_left) {
- BUG_ON(!pf);
- /* we stopped at a fixup offset */
- if (pf->skip_size) {
- /*
- * we are just skipping. This is for
- * BINDER_TYPE_FDA where the translated
- * fds will be fixed up when we get
- * to target context.
- */
- bytes_copied += pf->skip_size;
- } else {
- /* apply the fixup indicated by pf */
- if (!ret)
- ret = binder_alloc_copy_to_buffer(
- alloc, buffer,
- pf->offset,
- &pf->fixup_data,
- sizeof(pf->fixup_data));
- bytes_copied += sizeof(pf->fixup_data);
- }
- list_del(&pf->node);
- kfree(pf);
- pf = list_first_entry_or_null(pf_head,
- struct binder_ptr_fixup, node);
- }
- }
- list_del(&sgc->node);
- kfree(sgc);
- }
- list_for_each_entry_safe(pf, tmppf, pf_head, node) {
- BUG_ON(pf->skip_size == 0);
- list_del(&pf->node);
- kfree(pf);
- }
- BUG_ON(!list_empty(sgc_head));
-
- return ret > 0 ? -EINVAL : ret;
-}
-
-/**
- * binder_cleanup_deferred_txn_lists() - free specified lists
- * @sgc_head: list_head of scatter-gather copy list
- * @pf_head: list_head of pointer fixup list
- *
- * Called to clean up @sgc_head and @pf_head if there is an
- * error.
- */
-static void binder_cleanup_deferred_txn_lists(struct list_head *sgc_head,
- struct list_head *pf_head)
-{
- struct binder_sg_copy *sgc, *tmpsgc;
- struct binder_ptr_fixup *pf, *tmppf;
-
- list_for_each_entry_safe(sgc, tmpsgc, sgc_head, node) {
- list_del(&sgc->node);
- kfree(sgc);
- }
- list_for_each_entry_safe(pf, tmppf, pf_head, node) {
- list_del(&pf->node);
- kfree(pf);
- }
-}
-
-/**
- * binder_defer_copy() - queue a scatter-gather buffer for copy
- * @sgc_head: list_head of scatter-gather copy list
- * @offset: binder buffer offset in target process
- * @sender_uaddr: user address in source process
- * @length: bytes to copy
- *
- * Specify a scatter-gather block to be copied. The actual copy must
- * be deferred until all the needed fixups are identified and queued.
- * Then the copy and fixups are done together so un-translated values
- * from the source are never visible in the target buffer.
- *
- * We are guaranteed that repeated calls to this function will have
- * monotonically increasing @offset values so the list will naturally
- * be ordered.
- *
- * Return: 0=success, else -errno
- */
-static int binder_defer_copy(struct list_head *sgc_head, binder_size_t offset,
- const void __user *sender_uaddr, size_t length)
-{
- struct binder_sg_copy *bc = kzalloc_obj(*bc);
-
- if (!bc)
- return -ENOMEM;
-
- bc->offset = offset;
- bc->sender_uaddr = sender_uaddr;
- bc->length = length;
- INIT_LIST_HEAD(&bc->node);
-
- /*
- * We are guaranteed that the deferred copies are in-order
- * so just add to the tail.
- */
- list_add_tail(&bc->node, sgc_head);
-
- return 0;
-}
-
-/**
- * binder_add_fixup() - queue a fixup to be applied to sg copy
- * @pf_head: list_head of binder ptr fixup list
- * @offset: binder buffer offset in target process
- * @fixup: bytes to be copied for fixup
- * @skip_size: bytes to skip when copying (fixup will be applied later)
- *
- * Add the specified fixup to a list ordered by @offset. When copying
- * the scatter-gather buffers, the fixup will be copied instead of
- * data from the source buffer. For BINDER_TYPE_FDA fixups, the fixup
- * will be applied later (in target process context), so we just skip
- * the bytes specified by @skip_size. If @skip_size is 0, we copy the
- * value in @fixup.
- *
- * This function is called *mostly* in @offset order, but there are
- * exceptions. Since out-of-order inserts are relatively uncommon,
- * we insert the new element by searching backward from the tail of
- * the list.
- *
- * Return: 0=success, else -errno
- */
-static int binder_add_fixup(struct list_head *pf_head, binder_size_t offset,
- binder_uintptr_t fixup, size_t skip_size)
-{
- struct binder_ptr_fixup *pf = kzalloc_obj(*pf);
- struct binder_ptr_fixup *tmppf;
-
- if (!pf)
- return -ENOMEM;
-
- pf->offset = offset;
- pf->fixup_data = fixup;
- pf->skip_size = skip_size;
- INIT_LIST_HEAD(&pf->node);
-
- /* Fixups are *mostly* added in-order, but there are some
- * exceptions. Look backwards through list for insertion point.
- */
- list_for_each_entry_reverse(tmppf, pf_head, node) {
- if (tmppf->offset < pf->offset) {
- list_add(&pf->node, &tmppf->node);
- return 0;
- }
- }
- /*
- * if we get here, then the new offset is the lowest so
- * insert at the head
- */
- list_add(&pf->node, pf_head);
- return 0;
-}
-
-static int binder_translate_fd_array(struct list_head *pf_head,
- struct binder_fd_array_object *fda,
- const void __user *sender_ubuffer,
- struct binder_buffer_object *parent,
- struct binder_buffer_object *sender_uparent,
- struct binder_transaction *t,
- struct binder_thread *thread,
- struct binder_transaction *in_reply_to)
-{
- binder_size_t fdi, fd_buf_size;
- binder_size_t fda_offset;
- const void __user *sender_ufda_base;
- struct binder_proc *proc = thread->proc;
- int ret;
-
- if (fda->num_fds == 0)
- return 0;
-
- fd_buf_size = sizeof(u32) * fda->num_fds;
- if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {
- binder_user_error("%d:%d got transaction with invalid number of fds (%lld)\n",
- proc->pid, thread->pid, (u64)fda->num_fds);
- return -EINVAL;
- }
- if (fd_buf_size > parent->length ||
- fda->parent_offset > parent->length - fd_buf_size) {
- /* No space for all file descriptors here. */
- binder_user_error("%d:%d not enough space to store %lld fds in buffer\n",
- proc->pid, thread->pid, (u64)fda->num_fds);
- return -EINVAL;
- }
- /*
- * the source data for binder_buffer_object is visible
- * to user-space and the @buffer element is the user
- * pointer to the buffer_object containing the fd_array.
- * Convert the address to an offset relative to
- * the base of the transaction buffer.
- */
- fda_offset = parent->buffer - t->buffer->user_data +
- fda->parent_offset;
- sender_ufda_base = (void __user *)(uintptr_t)sender_uparent->buffer +
- fda->parent_offset;
-
- if (!IS_ALIGNED((unsigned long)fda_offset, sizeof(u32)) ||
- !IS_ALIGNED((unsigned long)sender_ufda_base, sizeof(u32))) {
- binder_user_error("%d:%d parent offset not aligned correctly.\n",
- proc->pid, thread->pid);
- return -EINVAL;
- }
- ret = binder_add_fixup(pf_head, fda_offset, 0, fda->num_fds * sizeof(u32));
- if (ret)
- return ret;
-
- for (fdi = 0; fdi < fda->num_fds; fdi++) {
- u32 fd;
- binder_size_t offset = fda_offset + fdi * sizeof(fd);
- binder_size_t sender_uoffset = fdi * sizeof(fd);
-
- ret = copy_from_user(&fd, sender_ufda_base + sender_uoffset, sizeof(fd));
- if (!ret)
- ret = binder_translate_fd(fd, offset, t, thread,
- in_reply_to);
- if (ret)
- return ret > 0 ? -EINVAL : ret;
- }
- return 0;
-}
-
-static int binder_fixup_parent(struct list_head *pf_head,
- struct binder_transaction *t,
- struct binder_thread *thread,
- struct binder_buffer_object *bp,
- binder_size_t off_start_offset,
- binder_size_t num_valid,
- binder_size_t last_fixup_obj_off,
- binder_size_t last_fixup_min_off)
-{
- struct binder_buffer_object *parent;
- struct binder_buffer *b = t->buffer;
- struct binder_proc *proc = thread->proc;
- struct binder_proc *target_proc = t->to_proc;
- struct binder_object object;
- binder_size_t buffer_offset;
- binder_size_t parent_offset;
-
- if (!(bp->flags & BINDER_BUFFER_FLAG_HAS_PARENT))
- return 0;
-
- parent = binder_validate_ptr(target_proc, b, &object, bp->parent,
- off_start_offset, &parent_offset,
- num_valid);
- if (!parent) {
- binder_user_error("%d:%d got transaction with invalid parent offset or type\n",
- proc->pid, thread->pid);
- return -EINVAL;
- }
-
- if (!binder_validate_fixup(target_proc, b, off_start_offset,
- parent_offset, bp->parent_offset,
- last_fixup_obj_off,
- last_fixup_min_off)) {
- binder_user_error("%d:%d got transaction with out-of-order buffer fixup\n",
- proc->pid, thread->pid);
- return -EINVAL;
- }
-
- if (parent->length < sizeof(binder_uintptr_t) ||
- bp->parent_offset > parent->length - sizeof(binder_uintptr_t)) {
- /* No space for a pointer here! */
- binder_user_error("%d:%d got transaction with invalid parent offset\n",
- proc->pid, thread->pid);
- return -EINVAL;
- }
-
- buffer_offset = bp->parent_offset + parent->buffer - b->user_data;
-
- return binder_add_fixup(pf_head, buffer_offset, bp->buffer, 0);
-}
-
-/**
- * binder_can_update_transaction() - Can a txn be superseded by an updated one?
- * @t1: the pending async txn in the frozen process
- * @t2: the new async txn to supersede the outdated pending one
- *
- * Return: true if t2 can supersede t1
- * false if t2 can not supersede t1
- */
-static bool binder_can_update_transaction(struct binder_transaction *t1,
- struct binder_transaction *t2)
-{
- if ((t1->flags & t2->flags & (TF_ONE_WAY | TF_UPDATE_TXN)) !=
- (TF_ONE_WAY | TF_UPDATE_TXN) || !t1->to_proc || !t2->to_proc)
- return false;
- if (t1->to_proc->tsk == t2->to_proc->tsk && t1->code == t2->code &&
- t1->flags == t2->flags && t1->buffer->pid == t2->buffer->pid &&
- t1->buffer->target_node->ptr == t2->buffer->target_node->ptr &&
- t1->buffer->target_node->cookie == t2->buffer->target_node->cookie)
- return true;
- return false;
-}
-
-/**
- * binder_find_outdated_transaction_ilocked() - Find the outdated transaction
- * @t: new async transaction
- * @target_list: list to find outdated transaction
- *
- * Return: the outdated transaction if found
- * NULL if no outdated transacton can be found
- *
- * Requires the proc->inner_lock to be held.
- */
-static struct binder_transaction *
-binder_find_outdated_transaction_ilocked(struct binder_transaction *t,
- struct list_head *target_list)
-{
- struct binder_work *w;
-
- list_for_each_entry(w, target_list, entry) {
- struct binder_transaction *t_queued;
-
- if (w->type != BINDER_WORK_TRANSACTION)
- continue;
- t_queued = container_of(w, struct binder_transaction, work);
- if (binder_can_update_transaction(t_queued, t))
- return t_queued;
- }
- return NULL;
-}
-
-/**
- * binder_proc_transaction() - sends a transaction to a process and wakes it up
- * @t: transaction to send
- * @proc: process to send the transaction to
- * @thread: thread in @proc to send the transaction to (may be NULL)
- *
- * This function queues a transaction to the specified process. It will try
- * to find a thread in the target process to handle the transaction and
- * wake it up. If no thread is found, the work is queued to the proc
- * waitqueue.
- *
- * If the @thread parameter is not NULL, the transaction is always queued
- * to the waitlist of that specific thread.
- *
- * Return: 0 if the transaction was successfully queued
- * BR_DEAD_REPLY if the target process or thread is dead
- * BR_FROZEN_REPLY if the target process or thread is frozen and
- * the sync transaction was rejected
- * BR_TRANSACTION_PENDING_FROZEN if the target process is frozen
- * and the async transaction was successfully queued
- */
-static int binder_proc_transaction(struct binder_transaction *t,
- struct binder_proc *proc,
- struct binder_thread *thread)
-{
- struct binder_node *node = t->buffer->target_node;
- bool oneway = !!(t->flags & TF_ONE_WAY);
- bool pending_async = false;
- struct binder_transaction *t_outdated = NULL;
- bool frozen = false;
-
- BUG_ON(!node);
- binder_node_lock(node);
- if (oneway) {
- BUG_ON(thread);
- if (node->has_async_transaction)
- pending_async = true;
- else
- node->has_async_transaction = true;
- }
-
- binder_inner_proc_lock(proc);
- if (proc->is_frozen) {
- frozen = true;
- proc->sync_recv |= !oneway;
- proc->async_recv |= oneway;
- }
-
- if ((frozen && !oneway) || proc->is_dead ||
- (thread && thread->is_dead)) {
- binder_inner_proc_unlock(proc);
- binder_node_unlock(node);
- return frozen ? BR_FROZEN_REPLY : BR_DEAD_REPLY;
- }
-
- if (!thread && !pending_async)
- thread = binder_select_thread_ilocked(proc);
-
- if (thread) {
- binder_enqueue_thread_work_ilocked(thread, &t->work);
- } else if (!pending_async) {
- binder_enqueue_work_ilocked(&t->work, &proc->todo);
- } else {
- if ((t->flags & TF_UPDATE_TXN) && frozen) {
- t_outdated = binder_find_outdated_transaction_ilocked(t,
- &node->async_todo);
- if (t_outdated) {
- binder_debug(BINDER_DEBUG_TRANSACTION,
- "txn %d supersedes %d\n",
- t->debug_id, t_outdated->debug_id);
- list_del_init(&t_outdated->work.entry);
- proc->outstanding_txns--;
- }
- }
- binder_enqueue_work_ilocked(&t->work, &node->async_todo);
- }
-
- if (!pending_async)
- binder_wakeup_thread_ilocked(proc, thread, !oneway /* sync */);
-
- proc->outstanding_txns++;
- binder_inner_proc_unlock(proc);
- binder_node_unlock(node);
-
- /*
- * To reduce potential contention, free the outdated transaction and
- * buffer after releasing the locks.
- */
- if (t_outdated) {
- struct binder_buffer *buffer = t_outdated->buffer;
-
- t_outdated->buffer = NULL;
- buffer->transaction = NULL;
- trace_binder_transaction_update_buffer_release(buffer);
- binder_release_entire_buffer(proc, NULL, buffer, true);
- binder_alloc_free_buf(&proc->alloc, buffer);
- binder_free_txn_fixups(t_outdated);
- kfree(t_outdated);
- binder_stats_deleted(BINDER_STAT_TRANSACTION);
- }
-
- if (oneway && frozen)
- return BR_TRANSACTION_PENDING_FROZEN;
-
- return 0;
-}
-
-/**
- * binder_get_node_refs_for_txn() - Get required refs on node for txn
- * @node: struct binder_node for which to get refs
- * @procp: returns @node->proc if valid
- * @error: if no @procp then returns BR_DEAD_REPLY
- *
- * User-space normally keeps the node alive when creating a transaction
- * since it has a reference to the target. The local strong ref keeps it
- * alive if the sending process dies before the target process processes
- * the transaction. If the source process is malicious or has a reference
- * counting bug, relying on the local strong ref can fail.
- *
- * Since user-space can cause the local strong ref to go away, we also take
- * a tmpref on the node to ensure it survives while we are constructing
- * the transaction. We also need a tmpref on the proc while we are
- * constructing the transaction, so we take that here as well.
- *
- * Return: The target_node with refs taken or NULL if no @node->proc is NULL.
- * Also sets @procp if valid. If the @node->proc is NULL indicating that the
- * target proc has died, @error is set to BR_DEAD_REPLY.
- */
-static struct binder_node *binder_get_node_refs_for_txn(
- struct binder_node *node,
- struct binder_proc **procp,
- uint32_t *error)
-{
- struct binder_node *target_node = NULL;
-
- binder_node_inner_lock(node);
- if (node->proc) {
- target_node = node;
- binder_inc_node_nilocked(node, 1, 0, NULL);
- binder_inc_node_tmpref_ilocked(node);
- node->proc->tmp_ref++;
- *procp = node->proc;
- } else
- *error = BR_DEAD_REPLY;
- binder_node_inner_unlock(node);
-
- return target_node;
-}
-
-static void binder_set_txn_from_error(struct binder_transaction *t, int id,
- uint32_t command, int32_t param)
-{
- struct binder_thread *from = binder_get_txn_from_and_acq_inner(t);
-
- if (!from) {
- /* annotation for sparse */
- __release(&from->proc->inner_lock);
- return;
- }
-
- /* don't override existing errors */
- if (from->ee.command == BR_OK)
- binder_set_extended_error(&from->ee, id, command, param);
- binder_inner_proc_unlock(from->proc);
- binder_thread_dec_tmpref(from);
-}
-
-/**
- * binder_netlink_report() - report a transaction failure via netlink
- * @proc: the binder proc sending the transaction
- * @t: the binder transaction that failed
- * @data_size: the user provided data size for the transaction
- * @error: enum binder_driver_return_protocol returned to sender
- *
- * Note that t->buffer is not safe to access here, as it may have been
- * released (or not yet allocated). Callers should guarantee all the
- * transaction items used here are safe to access.
- */
-static void binder_netlink_report(struct binder_proc *proc,
- struct binder_transaction *t,
- u32 data_size,
- u32 error)
-{
- const char *context = proc->context->name;
- struct sk_buff *skb;
- void *hdr;
-
- if (!genl_has_listeners(&binder_nl_family, &init_net,
- BINDER_NLGRP_REPORT))
- return;
-
- trace_binder_netlink_report(context, t, data_size, error);
-
- skb = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_KERNEL);
- if (!skb)
- return;
-
- hdr = genlmsg_put(skb, 0, 0, &binder_nl_family, 0, BINDER_CMD_REPORT);
- if (!hdr)
- goto free_skb;
-
- if (nla_put_u32(skb, BINDER_A_REPORT_ERROR, error) ||
- nla_put_string(skb, BINDER_A_REPORT_CONTEXT, context) ||
- nla_put_u32(skb, BINDER_A_REPORT_FROM_PID, t->from_pid) ||
- nla_put_u32(skb, BINDER_A_REPORT_FROM_TID, t->from_tid))
- goto cancel_skb;
-
- if (t->to_proc &&
- nla_put_u32(skb, BINDER_A_REPORT_TO_PID, t->to_proc->pid))
- goto cancel_skb;
-
- if (t->to_thread &&
- nla_put_u32(skb, BINDER_A_REPORT_TO_TID, t->to_thread->pid))
- goto cancel_skb;
-
- if (t->is_reply && nla_put_flag(skb, BINDER_A_REPORT_IS_REPLY))
- goto cancel_skb;
-
- if (nla_put_u32(skb, BINDER_A_REPORT_FLAGS, t->flags) ||
- nla_put_u32(skb, BINDER_A_REPORT_CODE, t->code) ||
- nla_put_u32(skb, BINDER_A_REPORT_DATA_SIZE, data_size))
- goto cancel_skb;
-
- genlmsg_end(skb, hdr);
- genlmsg_multicast(&binder_nl_family, skb, 0, BINDER_NLGRP_REPORT,
- GFP_KERNEL);
- return;
-
-cancel_skb:
- genlmsg_cancel(skb, hdr);
-free_skb:
- nlmsg_free(skb);
-}
-
-static void binder_transaction(struct binder_proc *proc,
- struct binder_thread *thread,
- struct binder_transaction_data *tr, int reply,
- binder_size_t extra_buffers_size)
-{
- int ret;
- struct binder_transaction *t;
- struct binder_work *w;
- struct binder_work *tcomplete;
- binder_size_t buffer_offset = 0;
- binder_size_t off_start_offset, off_end_offset;
- binder_size_t off_min;
- binder_size_t sg_buf_offset, sg_buf_end_offset;
- binder_size_t user_offset = 0;
- struct binder_proc *target_proc = NULL;
- struct binder_thread *target_thread = NULL;
- struct binder_node *target_node = NULL;
- struct binder_transaction *in_reply_to = NULL;
- struct binder_transaction_log_entry *e;
- uint32_t return_error = 0;
- uint32_t return_error_param = 0;
- uint32_t return_error_line = 0;
- binder_size_t last_fixup_obj_off = 0;
- binder_size_t last_fixup_min_off = 0;
- struct binder_context *context = proc->context;
- int t_debug_id = atomic_inc_return(&binder_last_id);
- ktime_t t_start_time = ktime_get();
- struct lsm_context lsmctx = { };
- size_t lsmctx_aligned_size = 0;
- LIST_HEAD(sgc_head);
- LIST_HEAD(pf_head);
- const void __user *user_buffer = (const void __user *)
- (uintptr_t)tr->data.ptr.buffer;
-
- e = binder_transaction_log_add(&binder_transaction_log);
- e->debug_id = t_debug_id;
- e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY);
- e->from_proc = proc->pid;
- e->from_thread = thread->pid;
- e->target_handle = tr->target.handle;
- e->data_size = tr->data_size;
- e->offsets_size = tr->offsets_size;
- strscpy(e->context_name, proc->context->name, BINDERFS_MAX_NAME);
-
- binder_inner_proc_lock(proc);
- binder_set_extended_error(&thread->ee, t_debug_id, BR_OK, 0);
- binder_inner_proc_unlock(proc);
-
- t = kzalloc_obj(*t);
- if (!t) {
- binder_txn_error("%d:%d cannot allocate transaction\n",
- thread->pid, proc->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = -ENOMEM;
- return_error_line = __LINE__;
- goto err_alloc_t_failed;
- }
- INIT_LIST_HEAD(&t->fd_fixups);
- binder_stats_created(BINDER_STAT_TRANSACTION);
- spin_lock_init(&t->lock);
- t->debug_id = t_debug_id;
- t->start_time = t_start_time;
- t->from_pid = proc->pid;
- t->from_tid = thread->pid;
- t->sender_euid = current_euid();
- t->code = tr->code;
- t->flags = tr->flags;
- t->priority = task_nice(current);
- t->work.type = BINDER_WORK_TRANSACTION;
- t->is_async = !reply && (tr->flags & TF_ONE_WAY);
- t->is_reply = reply;
- if (!reply && !(tr->flags & TF_ONE_WAY))
- t->from = thread;
-
- if (reply) {
- binder_inner_proc_lock(proc);
- in_reply_to = thread->transaction_stack;
- if (in_reply_to == NULL) {
- binder_inner_proc_unlock(proc);
- binder_user_error("%d:%d got reply transaction with no transaction stack\n",
- proc->pid, thread->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EPROTO;
- return_error_line = __LINE__;
- goto err_empty_call_stack;
- }
- if (in_reply_to->to_thread != thread) {
- spin_lock(&in_reply_to->lock);
- binder_user_error("%d:%d got reply transaction with bad transaction stack, transaction %d has target %d:%d\n",
- proc->pid, thread->pid, in_reply_to->debug_id,
- in_reply_to->to_proc ?
- in_reply_to->to_proc->pid : 0,
- in_reply_to->to_thread ?
- in_reply_to->to_thread->pid : 0);
- spin_unlock(&in_reply_to->lock);
- binder_inner_proc_unlock(proc);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EPROTO;
- return_error_line = __LINE__;
- in_reply_to = NULL;
- goto err_bad_call_stack;
- }
- thread->transaction_stack = in_reply_to->to_parent;
- binder_inner_proc_unlock(proc);
- binder_set_nice(in_reply_to->saved_priority);
- target_thread = binder_get_txn_from_and_acq_inner(in_reply_to);
- if (target_thread == NULL) {
- /* annotation for sparse */
- __release(&target_thread->proc->inner_lock);
- binder_txn_error("%d:%d reply target not found\n",
- thread->pid, proc->pid);
- return_error = BR_DEAD_REPLY;
- return_error_line = __LINE__;
- goto err_dead_binder;
- }
- if (target_thread->transaction_stack != in_reply_to) {
- binder_user_error("%d:%d got reply transaction with bad target transaction stack %d, expected %d\n",
- proc->pid, thread->pid,
- target_thread->transaction_stack ?
- target_thread->transaction_stack->debug_id : 0,
- in_reply_to->debug_id);
- binder_inner_proc_unlock(target_thread->proc);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EPROTO;
- return_error_line = __LINE__;
- in_reply_to = NULL;
- target_thread = NULL;
- goto err_dead_binder;
- }
- target_proc = target_thread->proc;
- target_proc->tmp_ref++;
- binder_inner_proc_unlock(target_thread->proc);
- } else {
- if (tr->target.handle) {
- struct binder_ref *ref;
-
- /*
- * There must already be a strong ref
- * on this node. If so, do a strong
- * increment on the node to ensure it
- * stays alive until the transaction is
- * done.
- */
- binder_proc_lock(proc);
- ref = binder_get_ref_olocked(proc, tr->target.handle,
- true);
- if (ref) {
- target_node = binder_get_node_refs_for_txn(
- ref->node, &target_proc,
- &return_error);
- } else {
- binder_user_error("%d:%d got transaction to invalid handle, %u\n",
- proc->pid, thread->pid, tr->target.handle);
- return_error = BR_FAILED_REPLY;
- }
- binder_proc_unlock(proc);
- } else {
- mutex_lock(&context->context_mgr_node_lock);
- target_node = context->binder_context_mgr_node;
- if (target_node)
- target_node = binder_get_node_refs_for_txn(
- target_node, &target_proc,
- &return_error);
- else
- return_error = BR_DEAD_REPLY;
- mutex_unlock(&context->context_mgr_node_lock);
- if (target_node && target_proc->pid == proc->pid) {
- binder_user_error("%d:%d got transaction to context manager from process owning it\n",
- proc->pid, thread->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EINVAL;
- return_error_line = __LINE__;
- goto err_invalid_target_handle;
- }
- }
- if (!target_node) {
- binder_txn_error("%d:%d cannot find target node\n",
- proc->pid, thread->pid);
- /* return_error is set above */
- return_error_param = -EINVAL;
- return_error_line = __LINE__;
- goto err_dead_binder;
- }
- e->to_node = target_node->debug_id;
- if (WARN_ON(proc == target_proc)) {
- binder_txn_error("%d:%d self transactions not allowed\n",
- thread->pid, proc->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EINVAL;
- return_error_line = __LINE__;
- goto err_invalid_target_handle;
- }
- if (security_binder_transaction(proc->cred,
- target_proc->cred) < 0) {
- binder_txn_error("%d:%d transaction credentials failed\n",
- thread->pid, proc->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EPERM;
- return_error_line = __LINE__;
- goto err_invalid_target_handle;
- }
- binder_inner_proc_lock(proc);
-
- w = list_first_entry_or_null(&thread->todo,
- struct binder_work, entry);
- if (!(tr->flags & TF_ONE_WAY) && w &&
- w->type == BINDER_WORK_TRANSACTION) {
- /*
- * Do not allow new outgoing transaction from a
- * thread that has a transaction at the head of
- * its todo list. Only need to check the head
- * because binder_select_thread_ilocked picks a
- * thread from proc->waiting_threads to enqueue
- * the transaction, and nothing is queued to the
- * todo list while the thread is on waiting_threads.
- */
- binder_user_error("%d:%d new transaction not allowed when there is a transaction on thread todo\n",
- proc->pid, thread->pid);
- binder_inner_proc_unlock(proc);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EPROTO;
- return_error_line = __LINE__;
- goto err_bad_todo_list;
- }
-
- if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) {
- struct binder_transaction *tmp;
-
- tmp = thread->transaction_stack;
- if (tmp->to_thread != thread) {
- spin_lock(&tmp->lock);
- binder_user_error("%d:%d got new transaction with bad transaction stack, transaction %d has target %d:%d\n",
- proc->pid, thread->pid, tmp->debug_id,
- tmp->to_proc ? tmp->to_proc->pid : 0,
- tmp->to_thread ?
- tmp->to_thread->pid : 0);
- spin_unlock(&tmp->lock);
- binder_inner_proc_unlock(proc);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EPROTO;
- return_error_line = __LINE__;
- goto err_bad_call_stack;
- }
- while (tmp) {
- struct binder_thread *from;
-
- spin_lock(&tmp->lock);
- from = tmp->from;
- if (from && from->proc == target_proc) {
- atomic_inc(&from->tmp_ref);
- target_thread = from;
- spin_unlock(&tmp->lock);
- break;
- }
- spin_unlock(&tmp->lock);
- tmp = tmp->from_parent;
- }
- }
- binder_inner_proc_unlock(proc);
- }
-
- t->to_proc = target_proc;
- t->to_thread = target_thread;
- if (target_thread)
- e->to_thread = target_thread->pid;
- e->to_proc = target_proc->pid;
-
- tcomplete = kzalloc_obj(*tcomplete);
- if (tcomplete == NULL) {
- binder_txn_error("%d:%d cannot allocate work for transaction\n",
- thread->pid, proc->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = -ENOMEM;
- return_error_line = __LINE__;
- goto err_alloc_tcomplete_failed;
- }
- binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE);
-
- if (reply)
- binder_debug(BINDER_DEBUG_TRANSACTION,
- "%d:%d BC_REPLY %d -> %d:%d, data size %lld-%lld-%lld\n",
- proc->pid, thread->pid, t->debug_id,
- target_proc->pid, target_thread->pid,
- (u64)tr->data_size, (u64)tr->offsets_size,
- (u64)extra_buffers_size);
- else
- binder_debug(BINDER_DEBUG_TRANSACTION,
- "%d:%d BC_TRANSACTION %d -> %d - node %d, data size %lld-%lld-%lld\n",
- proc->pid, thread->pid, t->debug_id,
- target_proc->pid, target_node->debug_id,
- (u64)tr->data_size, (u64)tr->offsets_size,
- (u64)extra_buffers_size);
-
- if (target_node && target_node->txn_security_ctx) {
- u32 secid;
-
- security_cred_getsecid(proc->cred, &secid);
- ret = security_secid_to_secctx(secid, &lsmctx);
- if (ret < 0) {
- binder_txn_error("%d:%d failed to get security context\n",
- thread->pid, proc->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = ret;
- return_error_line = __LINE__;
- goto err_get_secctx_failed;
- }
- lsmctx_aligned_size = ALIGN(lsmctx.len, sizeof(u64));
- extra_buffers_size += lsmctx_aligned_size;
- if (extra_buffers_size < lsmctx_aligned_size) {
- binder_txn_error("%d:%d integer overflow of extra_buffers_size\n",
- thread->pid, proc->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EINVAL;
- return_error_line = __LINE__;
- goto err_bad_extra_size;
- }
- }
-
- trace_binder_transaction(reply, t, target_node);
-
- t->buffer = binder_alloc_new_buf(&target_proc->alloc, tr->data_size,
- tr->offsets_size, extra_buffers_size,
- !reply && (t->flags & TF_ONE_WAY));
- if (IS_ERR(t->buffer)) {
- char *s;
-
- ret = PTR_ERR(t->buffer);
- s = (ret == -ESRCH) ? ": vma cleared, target dead or dying"
- : (ret == -ENOSPC) ? ": no space left"
- : (ret == -ENOMEM) ? ": memory allocation failed"
- : "";
- binder_txn_error("cannot allocate buffer%s", s);
-
- return_error_param = PTR_ERR(t->buffer);
- return_error = return_error_param == -ESRCH ?
- BR_DEAD_REPLY : BR_FAILED_REPLY;
- return_error_line = __LINE__;
- t->buffer = NULL;
- goto err_binder_alloc_buf_failed;
- }
- if (lsmctx.context) {
- int err;
- size_t buf_offset = ALIGN(tr->data_size, sizeof(void *)) +
- ALIGN(tr->offsets_size, sizeof(void *)) +
- ALIGN(extra_buffers_size, sizeof(void *)) -
- lsmctx_aligned_size;
-
- t->security_ctx = t->buffer->user_data + buf_offset;
- err = binder_alloc_copy_to_buffer(&target_proc->alloc,
- t->buffer, buf_offset,
- lsmctx.context, lsmctx.len);
- if (err) {
- t->security_ctx = 0;
- WARN_ON(1);
- }
- security_release_secctx(&lsmctx);
- lsmctx.context = NULL;
- }
- t->buffer->debug_id = t->debug_id;
- t->buffer->transaction = t;
- t->buffer->target_node = target_node;
- t->buffer->clear_on_free = !!(t->flags & TF_CLEAR_BUF);
- trace_binder_transaction_alloc_buf(t->buffer);
-
- if (binder_alloc_copy_user_to_buffer(
- &target_proc->alloc,
- t->buffer,
- ALIGN(tr->data_size, sizeof(void *)),
- (const void __user *)
- (uintptr_t)tr->data.ptr.offsets,
- tr->offsets_size)) {
- binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
- proc->pid, thread->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EFAULT;
- return_error_line = __LINE__;
- goto err_copy_data_failed;
- }
- if (!IS_ALIGNED(tr->offsets_size, sizeof(binder_size_t))) {
- binder_user_error("%d:%d got transaction with invalid offsets size, %lld\n",
- proc->pid, thread->pid, (u64)tr->offsets_size);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EINVAL;
- return_error_line = __LINE__;
- goto err_bad_offset;
- }
- if (!IS_ALIGNED(extra_buffers_size, sizeof(u64))) {
- binder_user_error("%d:%d got transaction with unaligned buffers size, %lld\n",
- proc->pid, thread->pid,
- (u64)extra_buffers_size);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EINVAL;
- return_error_line = __LINE__;
- goto err_bad_offset;
- }
- off_start_offset = ALIGN(tr->data_size, sizeof(void *));
- buffer_offset = off_start_offset;
- off_end_offset = off_start_offset + tr->offsets_size;
- sg_buf_offset = ALIGN(off_end_offset, sizeof(void *));
- sg_buf_end_offset = sg_buf_offset + extra_buffers_size -
- lsmctx_aligned_size;
- off_min = 0;
- for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
- buffer_offset += sizeof(binder_size_t)) {
- struct binder_object_header *hdr;
- size_t object_size;
- struct binder_object object;
- binder_size_t object_offset;
- binder_size_t copy_size;
-
- if (binder_alloc_copy_from_buffer(&target_proc->alloc,
- &object_offset,
- t->buffer,
- buffer_offset,
- sizeof(object_offset))) {
- binder_txn_error("%d:%d copy offset from buffer failed\n",
- thread->pid, proc->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EINVAL;
- return_error_line = __LINE__;
- goto err_bad_offset;
- }
-
- /*
- * Copy the source user buffer up to the next object
- * that will be processed.
- */
- copy_size = object_offset - user_offset;
- if (copy_size && (user_offset > object_offset ||
- object_offset > tr->data_size ||
- binder_alloc_copy_user_to_buffer(
- &target_proc->alloc,
- t->buffer, user_offset,
- user_buffer + user_offset,
- copy_size))) {
- binder_user_error("%d:%d got transaction with invalid data ptr\n",
- proc->pid, thread->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EFAULT;
- return_error_line = __LINE__;
- goto err_copy_data_failed;
- }
- object_size = binder_get_object(target_proc, user_buffer,
- t->buffer, object_offset, &object);
- if (object_size == 0 || object_offset < off_min) {
- binder_user_error("%d:%d got transaction with invalid offset (%lld, min %lld max %lld) or object.\n",
- proc->pid, thread->pid,
- (u64)object_offset,
- (u64)off_min,
- (u64)t->buffer->data_size);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EINVAL;
- return_error_line = __LINE__;
- goto err_bad_offset;
- }
- /*
- * Set offset to the next buffer fragment to be
- * copied
- */
- user_offset = object_offset + object_size;
-
- hdr = &object.hdr;
- off_min = object_offset + object_size;
- switch (hdr->type) {
- case BINDER_TYPE_BINDER:
- case BINDER_TYPE_WEAK_BINDER: {
- struct flat_binder_object *fp;
-
- fp = to_flat_binder_object(hdr);
- ret = binder_translate_binder(fp, t, thread);
-
- if (ret < 0 ||
- binder_alloc_copy_to_buffer(&target_proc->alloc,
- t->buffer,
- object_offset,
- fp, sizeof(*fp))) {
- binder_txn_error("%d:%d translate binder failed\n",
- thread->pid, proc->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = ret;
- return_error_line = __LINE__;
- goto err_translate_failed;
- }
- } break;
- case BINDER_TYPE_HANDLE:
- case BINDER_TYPE_WEAK_HANDLE: {
- struct flat_binder_object *fp;
-
- fp = to_flat_binder_object(hdr);
- ret = binder_translate_handle(fp, t, thread);
- if (ret < 0 ||
- binder_alloc_copy_to_buffer(&target_proc->alloc,
- t->buffer,
- object_offset,
- fp, sizeof(*fp))) {
- binder_txn_error("%d:%d translate handle failed\n",
- thread->pid, proc->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = ret;
- return_error_line = __LINE__;
- goto err_translate_failed;
- }
- } break;
-
- case BINDER_TYPE_FD: {
- struct binder_fd_object *fp = to_binder_fd_object(hdr);
- binder_size_t fd_offset = object_offset +
- (uintptr_t)&fp->fd - (uintptr_t)fp;
- int ret = binder_translate_fd(fp->fd, fd_offset, t,
- thread, in_reply_to);
-
- fp->pad_binder = 0;
- if (ret < 0 ||
- binder_alloc_copy_to_buffer(&target_proc->alloc,
- t->buffer,
- object_offset,
- fp, sizeof(*fp))) {
- binder_txn_error("%d:%d translate fd failed\n",
- thread->pid, proc->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = ret;
- return_error_line = __LINE__;
- goto err_translate_failed;
- }
- } break;
- case BINDER_TYPE_FDA: {
- struct binder_object ptr_object;
- binder_size_t parent_offset;
- struct binder_object user_object;
- size_t user_parent_size;
- struct binder_fd_array_object *fda =
- to_binder_fd_array_object(hdr);
- size_t num_valid = (buffer_offset - off_start_offset) /
- sizeof(binder_size_t);
- struct binder_buffer_object *parent =
- binder_validate_ptr(target_proc, t->buffer,
- &ptr_object, fda->parent,
- off_start_offset,
- &parent_offset,
- num_valid);
- if (!parent) {
- binder_user_error("%d:%d got transaction with invalid parent offset or type\n",
- proc->pid, thread->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EINVAL;
- return_error_line = __LINE__;
- goto err_bad_parent;
- }
- if (!binder_validate_fixup(target_proc, t->buffer,
- off_start_offset,
- parent_offset,
- fda->parent_offset,
- last_fixup_obj_off,
- last_fixup_min_off)) {
- binder_user_error("%d:%d got transaction with out-of-order buffer fixup\n",
- proc->pid, thread->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EINVAL;
- return_error_line = __LINE__;
- goto err_bad_parent;
- }
- /*
- * We need to read the user version of the parent
- * object to get the original user offset
- */
- user_parent_size =
- binder_get_object(proc, user_buffer, t->buffer,
- parent_offset, &user_object);
- if (user_parent_size != sizeof(user_object.bbo)) {
- binder_user_error("%d:%d invalid ptr object size: %zd vs %zd\n",
- proc->pid, thread->pid,
- user_parent_size,
- sizeof(user_object.bbo));
- return_error = BR_FAILED_REPLY;
- return_error_param = -EINVAL;
- return_error_line = __LINE__;
- goto err_bad_parent;
- }
- ret = binder_translate_fd_array(&pf_head, fda,
- user_buffer, parent,
- &user_object.bbo, t,
- thread, in_reply_to);
- if (!ret)
- ret = binder_alloc_copy_to_buffer(&target_proc->alloc,
- t->buffer,
- object_offset,
- fda, sizeof(*fda));
- if (ret) {
- binder_txn_error("%d:%d translate fd array failed\n",
- thread->pid, proc->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = ret > 0 ? -EINVAL : ret;
- return_error_line = __LINE__;
- goto err_translate_failed;
- }
- last_fixup_obj_off = parent_offset;
- last_fixup_min_off =
- fda->parent_offset + sizeof(u32) * fda->num_fds;
- } break;
- case BINDER_TYPE_PTR: {
- struct binder_buffer_object *bp =
- to_binder_buffer_object(hdr);
- size_t buf_left = sg_buf_end_offset - sg_buf_offset;
- size_t num_valid;
-
- if (bp->length > buf_left) {
- binder_user_error("%d:%d got transaction with too large buffer\n",
- proc->pid, thread->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EINVAL;
- return_error_line = __LINE__;
- goto err_bad_offset;
- }
- ret = binder_defer_copy(&sgc_head, sg_buf_offset,
- (const void __user *)(uintptr_t)bp->buffer,
- bp->length);
- if (ret) {
- binder_txn_error("%d:%d deferred copy failed\n",
- thread->pid, proc->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = ret;
- return_error_line = __LINE__;
- goto err_translate_failed;
- }
- /* Fixup buffer pointer to target proc address space */
- bp->buffer = t->buffer->user_data + sg_buf_offset;
- sg_buf_offset += ALIGN(bp->length, sizeof(u64));
-
- num_valid = (buffer_offset - off_start_offset) /
- sizeof(binder_size_t);
- ret = binder_fixup_parent(&pf_head, t,
- thread, bp,
- off_start_offset,
- num_valid,
- last_fixup_obj_off,
- last_fixup_min_off);
- if (ret < 0 ||
- binder_alloc_copy_to_buffer(&target_proc->alloc,
- t->buffer,
- object_offset,
- bp, sizeof(*bp))) {
- binder_txn_error("%d:%d failed to fixup parent\n",
- thread->pid, proc->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = ret;
- return_error_line = __LINE__;
- goto err_translate_failed;
- }
- last_fixup_obj_off = object_offset;
- last_fixup_min_off = 0;
- } break;
- default:
- binder_user_error("%d:%d got transaction with invalid object type, %x\n",
- proc->pid, thread->pid, hdr->type);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EINVAL;
- return_error_line = __LINE__;
- goto err_bad_object_type;
- }
- }
- /* Done processing objects, copy the rest of the buffer */
- if (binder_alloc_copy_user_to_buffer(
- &target_proc->alloc,
- t->buffer, user_offset,
- user_buffer + user_offset,
- tr->data_size - user_offset)) {
- binder_user_error("%d:%d got transaction with invalid data ptr\n",
- proc->pid, thread->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = -EFAULT;
- return_error_line = __LINE__;
- goto err_copy_data_failed;
- }
-
- ret = binder_do_deferred_txn_copies(&target_proc->alloc, t->buffer,
- &sgc_head, &pf_head);
- if (ret) {
- binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
- proc->pid, thread->pid);
- return_error = BR_FAILED_REPLY;
- return_error_param = ret;
- return_error_line = __LINE__;
- goto err_copy_data_failed;
- }
- if (t->buffer->oneway_spam_suspect) {
- tcomplete->type = BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT;
- binder_netlink_report(proc, t, tr->data_size,
- BR_ONEWAY_SPAM_SUSPECT);
- } else {
- tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
- }
-
- if (reply) {
- binder_enqueue_thread_work(thread, tcomplete);
- binder_inner_proc_lock(target_proc);
- if (target_thread->is_dead) {
- return_error = BR_DEAD_REPLY;
- binder_inner_proc_unlock(target_proc);
- goto err_dead_proc_or_thread;
- }
- BUG_ON(t->buffer->async_transaction != 0);
- binder_pop_transaction_ilocked(target_thread, in_reply_to);
- binder_enqueue_thread_work_ilocked(target_thread, &t->work);
- target_proc->outstanding_txns++;
- binder_inner_proc_unlock(target_proc);
- wake_up_interruptible_sync(&target_thread->wait);
- binder_free_transaction(in_reply_to);
- } else if (!(t->flags & TF_ONE_WAY)) {
- BUG_ON(t->buffer->async_transaction != 0);
- binder_inner_proc_lock(proc);
- /*
- * Defer the TRANSACTION_COMPLETE, so we don't return to
- * userspace immediately; this allows the target process to
- * immediately start processing this transaction, reducing
- * latency. We will then return the TRANSACTION_COMPLETE when
- * the target replies (or there is an error).
- */
- binder_enqueue_deferred_thread_work_ilocked(thread, tcomplete);
- t->from_parent = thread->transaction_stack;
- thread->transaction_stack = t;
- binder_inner_proc_unlock(proc);
- return_error = binder_proc_transaction(t,
- target_proc, target_thread);
- if (return_error) {
- binder_inner_proc_lock(proc);
- binder_pop_transaction_ilocked(thread, t);
- binder_inner_proc_unlock(proc);
- goto err_dead_proc_or_thread;
- }
- } else {
- /*
- * Make a transaction copy. It is not safe to access 't' after
- * binder_proc_transaction() reported a pending frozen. The
- * target could thaw and consume the transaction at any point.
- * Instead, use a safe 't_copy' for binder_netlink_report().
- */
- struct binder_transaction t_copy = *t;
-
- BUG_ON(target_node == NULL);
- BUG_ON(t->buffer->async_transaction != 1);
- return_error = binder_proc_transaction(t, target_proc, NULL);
- /*
- * Let the caller know when async transaction reaches a frozen
- * process and is put in a pending queue, waiting for the target
- * process to be unfrozen.
- */
- if (return_error == BR_TRANSACTION_PENDING_FROZEN) {
- tcomplete->type = BINDER_WORK_TRANSACTION_PENDING;
- binder_netlink_report(proc, &t_copy, tr->data_size,
- return_error);
- }
- binder_enqueue_thread_work(thread, tcomplete);
- if (return_error &&
- return_error != BR_TRANSACTION_PENDING_FROZEN)
- goto err_dead_proc_or_thread;
- }
- if (target_thread)
- binder_thread_dec_tmpref(target_thread);
- binder_proc_dec_tmpref(target_proc);
- if (target_node)
- binder_dec_node_tmpref(target_node);
- /*
- * write barrier to synchronize with initialization
- * of log entry
- */
- smp_wmb();
- WRITE_ONCE(e->debug_id_done, t_debug_id);
- return;
-
-err_dead_proc_or_thread:
- binder_txn_error("%d:%d %s process or thread\n",
- proc->pid, thread->pid,
- return_error == BR_FROZEN_REPLY ? "frozen" : "dead");
- return_error_line = __LINE__;
- binder_dequeue_work(proc, tcomplete);
-err_translate_failed:
-err_bad_object_type:
-err_bad_offset:
-err_bad_parent:
-err_copy_data_failed:
- binder_cleanup_deferred_txn_lists(&sgc_head, &pf_head);
- binder_free_txn_fixups(t);
- trace_binder_transaction_failed_buffer_release(t->buffer);
- binder_transaction_buffer_release(target_proc, NULL, t->buffer,
- buffer_offset, true);
- if (target_node)
- binder_dec_node_tmpref(target_node);
- target_node = NULL;
- t->buffer->transaction = NULL;
- binder_alloc_free_buf(&target_proc->alloc, t->buffer);
-err_binder_alloc_buf_failed:
-err_bad_extra_size:
- if (lsmctx.context)
- security_release_secctx(&lsmctx);
-err_get_secctx_failed:
- kfree(tcomplete);
- binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
-err_alloc_tcomplete_failed:
- if (trace_binder_txn_latency_free_enabled())
- binder_txn_latency_free(t);
-err_bad_todo_list:
-err_bad_call_stack:
-err_empty_call_stack:
-err_dead_binder:
-err_invalid_target_handle:
- if (target_node) {
- binder_dec_node(target_node, 1, 0);
- binder_dec_node_tmpref(target_node);
- }
-
- binder_netlink_report(proc, t, tr->data_size, return_error);
- kfree(t);
- binder_stats_deleted(BINDER_STAT_TRANSACTION);
-err_alloc_t_failed:
-
- binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
- "%d:%d transaction %s to %d:%d failed %d/%d/%d, code %u size %lld-%lld line %d\n",
- proc->pid, thread->pid, reply ? "reply" :
- (tr->flags & TF_ONE_WAY ? "async" : "call"),
- target_proc ? target_proc->pid : 0,
- target_thread ? target_thread->pid : 0,
- t_debug_id, return_error, return_error_param,
- tr->code, (u64)tr->data_size, (u64)tr->offsets_size,
- return_error_line);
-
- if (target_thread)
- binder_thread_dec_tmpref(target_thread);
- if (target_proc)
- binder_proc_dec_tmpref(target_proc);
-
- {
- struct binder_transaction_log_entry *fe;
-
- e->return_error = return_error;
- e->return_error_param = return_error_param;
- e->return_error_line = return_error_line;
- fe = binder_transaction_log_add(&binder_transaction_log_failed);
- *fe = *e;
- /*
- * write barrier to synchronize with initialization
- * of log entry
- */
- smp_wmb();
- WRITE_ONCE(e->debug_id_done, t_debug_id);
- WRITE_ONCE(fe->debug_id_done, t_debug_id);
- }
-
- BUG_ON(thread->return_error.cmd != BR_OK);
- if (in_reply_to) {
- binder_set_txn_from_error(in_reply_to, t_debug_id,
- return_error, return_error_param);
- thread->return_error.cmd = BR_TRANSACTION_COMPLETE;
- binder_enqueue_thread_work(thread, &thread->return_error.work);
- binder_send_failed_reply(in_reply_to, return_error);
- } else {
- binder_inner_proc_lock(proc);
- binder_set_extended_error(&thread->ee, t_debug_id,
- return_error, return_error_param);
- binder_inner_proc_unlock(proc);
- thread->return_error.cmd = return_error;
- binder_enqueue_thread_work(thread, &thread->return_error.work);
- }
-}
-
-static int
-binder_request_freeze_notification(struct binder_proc *proc,
- struct binder_thread *thread,
- struct binder_handle_cookie *handle_cookie)
-{
- struct binder_ref_freeze *freeze;
- struct binder_ref *ref;
-
- freeze = kzalloc_obj(*freeze);
- if (!freeze)
- return -ENOMEM;
- binder_proc_lock(proc);
- ref = binder_get_ref_olocked(proc, handle_cookie->handle, false);
- if (!ref) {
- binder_user_error("%d:%d BC_REQUEST_FREEZE_NOTIFICATION invalid ref %d\n",
- proc->pid, thread->pid, handle_cookie->handle);
- binder_proc_unlock(proc);
- kfree(freeze);
- return -EINVAL;
- }
-
- binder_node_lock(ref->node);
- if (ref->freeze) {
- binder_user_error("%d:%d BC_REQUEST_FREEZE_NOTIFICATION already set\n",
- proc->pid, thread->pid);
- binder_node_unlock(ref->node);
- binder_proc_unlock(proc);
- kfree(freeze);
- return -EINVAL;
- }
-
- binder_stats_created(BINDER_STAT_FREEZE);
- INIT_LIST_HEAD(&freeze->work.entry);
- freeze->cookie = handle_cookie->cookie;
- freeze->work.type = BINDER_WORK_FROZEN_BINDER;
- ref->freeze = freeze;
-
- if (ref->node->proc) {
- binder_inner_proc_lock(ref->node->proc);
- freeze->is_frozen = ref->node->proc->is_frozen;
- binder_inner_proc_unlock(ref->node->proc);
-
- binder_inner_proc_lock(proc);
- binder_enqueue_work_ilocked(&freeze->work, &proc->todo);
- binder_wakeup_proc_ilocked(proc);
- binder_inner_proc_unlock(proc);
- }
-
- binder_node_unlock(ref->node);
- binder_proc_unlock(proc);
- return 0;
-}
-
-static int
-binder_clear_freeze_notification(struct binder_proc *proc,
- struct binder_thread *thread,
- struct binder_handle_cookie *handle_cookie)
-{
- struct binder_ref_freeze *freeze;
- struct binder_ref *ref;
-
- binder_proc_lock(proc);
- ref = binder_get_ref_olocked(proc, handle_cookie->handle, false);
- if (!ref) {
- binder_user_error("%d:%d BC_CLEAR_FREEZE_NOTIFICATION invalid ref %d\n",
- proc->pid, thread->pid, handle_cookie->handle);
- binder_proc_unlock(proc);
- return -EINVAL;
- }
-
- binder_node_lock(ref->node);
-
- if (!ref->freeze) {
- binder_user_error("%d:%d BC_CLEAR_FREEZE_NOTIFICATION freeze notification not active\n",
- proc->pid, thread->pid);
- binder_node_unlock(ref->node);
- binder_proc_unlock(proc);
- return -EINVAL;
- }
- freeze = ref->freeze;
- binder_inner_proc_lock(proc);
- if (freeze->cookie != handle_cookie->cookie) {
- binder_user_error("%d:%d BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch %016llx != %016llx\n",
- proc->pid, thread->pid, (u64)freeze->cookie,
- (u64)handle_cookie->cookie);
- binder_inner_proc_unlock(proc);
- binder_node_unlock(ref->node);
- binder_proc_unlock(proc);
- return -EINVAL;
- }
- ref->freeze = NULL;
- /*
- * Take the existing freeze object and overwrite its work type. There are three cases here:
- * 1. No pending notification. In this case just add the work to the queue.
- * 2. A notification was sent and is pending an ack from userspace. Once an ack arrives, we
- * should resend with the new work type.
- * 3. A notification is pending to be sent. Since the work is already in the queue, nothing
- * needs to be done here.
- */
- freeze->work.type = BINDER_WORK_CLEAR_FREEZE_NOTIFICATION;
- if (list_empty(&freeze->work.entry)) {
- binder_enqueue_work_ilocked(&freeze->work, &proc->todo);
- binder_wakeup_proc_ilocked(proc);
- } else if (freeze->sent) {
- freeze->resend = true;
- }
- binder_inner_proc_unlock(proc);
- binder_node_unlock(ref->node);
- binder_proc_unlock(proc);
- return 0;
-}
-
-static int
-binder_freeze_notification_done(struct binder_proc *proc,
- struct binder_thread *thread,
- binder_uintptr_t cookie)
-{
- struct binder_ref_freeze *freeze = NULL;
- struct binder_work *w;
-
- binder_inner_proc_lock(proc);
- list_for_each_entry(w, &proc->delivered_freeze, entry) {
- struct binder_ref_freeze *tmp_freeze =
- container_of(w, struct binder_ref_freeze, work);
-
- if (tmp_freeze->cookie == cookie) {
- freeze = tmp_freeze;
- break;
- }
- }
- if (!freeze) {
- binder_user_error("%d:%d BC_FREEZE_NOTIFICATION_DONE %016llx not found\n",
- proc->pid, thread->pid, (u64)cookie);
- binder_inner_proc_unlock(proc);
- return -EINVAL;
- }
- binder_dequeue_work_ilocked(&freeze->work);
- freeze->sent = false;
- if (freeze->resend) {
- freeze->resend = false;
- binder_enqueue_work_ilocked(&freeze->work, &proc->todo);
- binder_wakeup_proc_ilocked(proc);
- }
- binder_inner_proc_unlock(proc);
- return 0;
-}
-
-/**
- * binder_free_buf() - free the specified buffer
- * @proc: binder proc that owns buffer
- * @thread: binder thread performing the buffer release
- * @buffer: buffer to be freed
- * @is_failure: failed to send transaction
- *
- * If the buffer is for an async transaction, enqueue the next async
- * transaction from the node.
- *
- * Cleanup the buffer and free it.
- */
-static void
-binder_free_buf(struct binder_proc *proc,
- struct binder_thread *thread,
- struct binder_buffer *buffer, bool is_failure)
-{
- binder_inner_proc_lock(proc);
- if (buffer->transaction) {
- buffer->transaction->buffer = NULL;
- buffer->transaction = NULL;
- }
- binder_inner_proc_unlock(proc);
- if (buffer->async_transaction && buffer->target_node) {
- struct binder_node *buf_node;
- struct binder_work *w;
-
- buf_node = buffer->target_node;
- binder_node_inner_lock(buf_node);
- BUG_ON(!buf_node->has_async_transaction);
- BUG_ON(buf_node->proc != proc);
- w = binder_dequeue_work_head_ilocked(
- &buf_node->async_todo);
- if (!w) {
- buf_node->has_async_transaction = false;
- } else {
- binder_enqueue_work_ilocked(
- w, &proc->todo);
- binder_wakeup_proc_ilocked(proc);
- }
- binder_node_inner_unlock(buf_node);
- }
- trace_binder_transaction_buffer_release(buffer);
- binder_release_entire_buffer(proc, thread, buffer, is_failure);
- binder_alloc_free_buf(&proc->alloc, buffer);
-}
-
-static int binder_thread_write(struct binder_proc *proc,
- struct binder_thread *thread,
- binder_uintptr_t binder_buffer, size_t size,
- binder_size_t *consumed)
-{
- uint32_t cmd;
- struct binder_context *context = proc->context;
- void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
- void __user *ptr = buffer + *consumed;
- void __user *end = buffer + size;
-
- while (ptr < end && thread->return_error.cmd == BR_OK) {
- int ret;
-
- if (get_user(cmd, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
- trace_binder_command(cmd);
- if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) {
- atomic_inc(&binder_stats.bc[_IOC_NR(cmd)]);
- atomic_inc(&proc->stats.bc[_IOC_NR(cmd)]);
- atomic_inc(&thread->stats.bc[_IOC_NR(cmd)]);
- }
- switch (cmd) {
- case BC_INCREFS:
- case BC_ACQUIRE:
- case BC_RELEASE:
- case BC_DECREFS: {
- uint32_t target;
- const char *debug_string;
- bool strong = cmd == BC_ACQUIRE || cmd == BC_RELEASE;
- bool increment = cmd == BC_INCREFS || cmd == BC_ACQUIRE;
- struct binder_ref_data rdata;
-
- if (get_user(target, (uint32_t __user *)ptr))
- return -EFAULT;
-
- ptr += sizeof(uint32_t);
- ret = -1;
- if (increment && !target) {
- struct binder_node *ctx_mgr_node;
-
- mutex_lock(&context->context_mgr_node_lock);
- ctx_mgr_node = context->binder_context_mgr_node;
- if (ctx_mgr_node) {
- if (ctx_mgr_node->proc == proc) {
- binder_user_error("%d:%d context manager tried to acquire desc 0\n",
- proc->pid, thread->pid);
- mutex_unlock(&context->context_mgr_node_lock);
- return -EINVAL;
- }
- ret = binder_inc_ref_for_node(
- proc, ctx_mgr_node,
- strong, NULL, &rdata);
- }
- mutex_unlock(&context->context_mgr_node_lock);
- }
- if (ret)
- ret = binder_update_ref_for_handle(
- proc, target, increment, strong,
- &rdata);
- if (!ret && rdata.desc != target) {
- binder_user_error("%d:%d tried to acquire reference to desc %d, got %d instead\n",
- proc->pid, thread->pid,
- target, rdata.desc);
- }
- switch (cmd) {
- case BC_INCREFS:
- debug_string = "IncRefs";
- break;
- case BC_ACQUIRE:
- debug_string = "Acquire";
- break;
- case BC_RELEASE:
- debug_string = "Release";
- break;
- case BC_DECREFS:
- default:
- debug_string = "DecRefs";
- break;
- }
- if (ret) {
- binder_user_error("%d:%d %s %d refcount change on invalid ref %d ret %d\n",
- proc->pid, thread->pid, debug_string,
- strong, target, ret);
- break;
- }
- binder_debug(BINDER_DEBUG_USER_REFS,
- "%d:%d %s ref %d desc %d s %d w %d\n",
- proc->pid, thread->pid, debug_string,
- rdata.debug_id, rdata.desc, rdata.strong,
- rdata.weak);
- break;
- }
- case BC_INCREFS_DONE:
- case BC_ACQUIRE_DONE: {
- binder_uintptr_t node_ptr;
- binder_uintptr_t cookie;
- struct binder_node *node;
- bool free_node;
-
- if (get_user(node_ptr, (binder_uintptr_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(binder_uintptr_t);
- if (get_user(cookie, (binder_uintptr_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(binder_uintptr_t);
- node = binder_get_node(proc, node_ptr);
- if (node == NULL) {
- binder_user_error("%d:%d %s u%016llx no match\n",
- proc->pid, thread->pid,
- cmd == BC_INCREFS_DONE ?
- "BC_INCREFS_DONE" :
- "BC_ACQUIRE_DONE",
- (u64)node_ptr);
- break;
- }
- if (cookie != node->cookie) {
- binder_user_error("%d:%d %s u%016llx node %d cookie mismatch %016llx != %016llx\n",
- proc->pid, thread->pid,
- cmd == BC_INCREFS_DONE ?
- "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
- (u64)node_ptr, node->debug_id,
- (u64)cookie, (u64)node->cookie);
- binder_put_node(node);
- break;
- }
- binder_node_inner_lock(node);
- if (cmd == BC_ACQUIRE_DONE) {
- if (node->pending_strong_ref == 0) {
- binder_user_error("%d:%d BC_ACQUIRE_DONE node %d has no pending acquire request\n",
- proc->pid, thread->pid,
- node->debug_id);
- binder_node_inner_unlock(node);
- binder_put_node(node);
- break;
- }
- node->pending_strong_ref = 0;
- } else {
- if (node->pending_weak_ref == 0) {
- binder_user_error("%d:%d BC_INCREFS_DONE node %d has no pending increfs request\n",
- proc->pid, thread->pid,
- node->debug_id);
- binder_node_inner_unlock(node);
- binder_put_node(node);
- break;
- }
- node->pending_weak_ref = 0;
- }
- free_node = binder_dec_node_nilocked(node,
- cmd == BC_ACQUIRE_DONE, 0);
- WARN_ON(free_node);
- binder_debug(BINDER_DEBUG_USER_REFS,
- "%d:%d %s node %d ls %d lw %d tr %d\n",
- proc->pid, thread->pid,
- cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE",
- node->debug_id, node->local_strong_refs,
- node->local_weak_refs, node->tmp_refs);
- binder_node_inner_unlock(node);
- binder_put_node(node);
- break;
- }
- case BC_ATTEMPT_ACQUIRE:
- pr_err("BC_ATTEMPT_ACQUIRE not supported\n");
- return -EINVAL;
- case BC_ACQUIRE_RESULT:
- pr_err("BC_ACQUIRE_RESULT not supported\n");
- return -EINVAL;
-
- case BC_FREE_BUFFER: {
- binder_uintptr_t data_ptr;
- struct binder_buffer *buffer;
-
- if (get_user(data_ptr, (binder_uintptr_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(binder_uintptr_t);
-
- buffer = binder_alloc_prepare_to_free(&proc->alloc,
- data_ptr);
- if (IS_ERR_OR_NULL(buffer)) {
- if (PTR_ERR(buffer) == -EPERM) {
- binder_user_error(
- "%d:%d BC_FREE_BUFFER matched unreturned or currently freeing buffer at offset %lx\n",
- proc->pid, thread->pid,
- (unsigned long)data_ptr - proc->alloc.vm_start);
- } else {
- binder_user_error(
- "%d:%d BC_FREE_BUFFER no match for buffer at offset %lx\n",
- proc->pid, thread->pid,
- (unsigned long)data_ptr - proc->alloc.vm_start);
- }
- break;
- }
- binder_debug(BINDER_DEBUG_FREE_BUFFER,
- "%d:%d BC_FREE_BUFFER at offset %lx found buffer %d for %s transaction\n",
- proc->pid, thread->pid,
- (unsigned long)data_ptr - proc->alloc.vm_start,
- buffer->debug_id,
- buffer->transaction ? "active" : "finished");
- binder_free_buf(proc, thread, buffer, false);
- break;
- }
-
- case BC_TRANSACTION_SG:
- case BC_REPLY_SG: {
- struct binder_transaction_data_sg tr;
-
- if (copy_from_user(&tr, ptr, sizeof(tr)))
- return -EFAULT;
- ptr += sizeof(tr);
- binder_transaction(proc, thread, &tr.transaction_data,
- cmd == BC_REPLY_SG, tr.buffers_size);
- break;
- }
- case BC_TRANSACTION:
- case BC_REPLY: {
- struct binder_transaction_data tr;
-
- if (copy_from_user(&tr, ptr, sizeof(tr)))
- return -EFAULT;
- ptr += sizeof(tr);
- binder_transaction(proc, thread, &tr,
- cmd == BC_REPLY, 0);
- break;
- }
-
- case BC_REGISTER_LOOPER:
- binder_debug(BINDER_DEBUG_THREADS,
- "%d:%d BC_REGISTER_LOOPER\n",
- proc->pid, thread->pid);
- binder_inner_proc_lock(proc);
- if (thread->looper & BINDER_LOOPER_STATE_ENTERED) {
- thread->looper |= BINDER_LOOPER_STATE_INVALID;
- binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER\n",
- proc->pid, thread->pid);
- } else if (proc->requested_threads == 0) {
- thread->looper |= BINDER_LOOPER_STATE_INVALID;
- binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called without request\n",
- proc->pid, thread->pid);
- } else {
- proc->requested_threads--;
- proc->requested_threads_started++;
- }
- thread->looper |= BINDER_LOOPER_STATE_REGISTERED;
- binder_inner_proc_unlock(proc);
- break;
- case BC_ENTER_LOOPER:
- binder_debug(BINDER_DEBUG_THREADS,
- "%d:%d BC_ENTER_LOOPER\n",
- proc->pid, thread->pid);
- if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) {
- thread->looper |= BINDER_LOOPER_STATE_INVALID;
- binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n",
- proc->pid, thread->pid);
- }
- thread->looper |= BINDER_LOOPER_STATE_ENTERED;
- break;
- case BC_EXIT_LOOPER:
- binder_debug(BINDER_DEBUG_THREADS,
- "%d:%d BC_EXIT_LOOPER\n",
- proc->pid, thread->pid);
- thread->looper |= BINDER_LOOPER_STATE_EXITED;
- break;
-
- case BC_REQUEST_DEATH_NOTIFICATION:
- case BC_CLEAR_DEATH_NOTIFICATION: {
- uint32_t target;
- binder_uintptr_t cookie;
- struct binder_ref *ref;
- struct binder_ref_death *death = NULL;
-
- if (get_user(target, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
- if (get_user(cookie, (binder_uintptr_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(binder_uintptr_t);
- if (cmd == BC_REQUEST_DEATH_NOTIFICATION) {
- /*
- * Allocate memory for death notification
- * before taking lock
- */
- death = kzalloc_obj(*death);
- if (death == NULL) {
- WARN_ON(thread->return_error.cmd !=
- BR_OK);
- thread->return_error.cmd = BR_ERROR;
- binder_enqueue_thread_work(
- thread,
- &thread->return_error.work);
- binder_debug(
- BINDER_DEBUG_FAILED_TRANSACTION,
- "%d:%d BC_REQUEST_DEATH_NOTIFICATION failed\n",
- proc->pid, thread->pid);
- break;
- }
- }
- binder_proc_lock(proc);
- ref = binder_get_ref_olocked(proc, target, false);
- if (ref == NULL) {
- binder_user_error("%d:%d %s invalid ref %d\n",
- proc->pid, thread->pid,
- cmd == BC_REQUEST_DEATH_NOTIFICATION ?
- "BC_REQUEST_DEATH_NOTIFICATION" :
- "BC_CLEAR_DEATH_NOTIFICATION",
- target);
- binder_proc_unlock(proc);
- kfree(death);
- break;
- }
-
- binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
- "%d:%d %s %016llx ref %d desc %d s %d w %d for node %d\n",
- proc->pid, thread->pid,
- cmd == BC_REQUEST_DEATH_NOTIFICATION ?
- "BC_REQUEST_DEATH_NOTIFICATION" :
- "BC_CLEAR_DEATH_NOTIFICATION",
- (u64)cookie, ref->data.debug_id,
- ref->data.desc, ref->data.strong,
- ref->data.weak, ref->node->debug_id);
-
- binder_node_lock(ref->node);
- if (cmd == BC_REQUEST_DEATH_NOTIFICATION) {
- if (ref->death) {
- binder_user_error("%d:%d BC_REQUEST_DEATH_NOTIFICATION death notification already set\n",
- proc->pid, thread->pid);
- binder_node_unlock(ref->node);
- binder_proc_unlock(proc);
- kfree(death);
- break;
- }
- binder_stats_created(BINDER_STAT_DEATH);
- INIT_LIST_HEAD(&death->work.entry);
- death->cookie = cookie;
- ref->death = death;
- if (ref->node->proc == NULL) {
- ref->death->work.type = BINDER_WORK_DEAD_BINDER;
-
- binder_inner_proc_lock(proc);
- binder_enqueue_work_ilocked(
- &ref->death->work, &proc->todo);
- binder_wakeup_proc_ilocked(proc);
- binder_inner_proc_unlock(proc);
- }
- } else {
- if (ref->death == NULL) {
- binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification not active\n",
- proc->pid, thread->pid);
- binder_node_unlock(ref->node);
- binder_proc_unlock(proc);
- break;
- }
- death = ref->death;
- if (death->cookie != cookie) {
- binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch %016llx != %016llx\n",
- proc->pid, thread->pid,
- (u64)death->cookie,
- (u64)cookie);
- binder_node_unlock(ref->node);
- binder_proc_unlock(proc);
- break;
- }
- ref->death = NULL;
- binder_inner_proc_lock(proc);
- if (list_empty(&death->work.entry)) {
- death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;
- if (thread->looper &
- (BINDER_LOOPER_STATE_REGISTERED |
- BINDER_LOOPER_STATE_ENTERED))
- binder_enqueue_thread_work_ilocked(
- thread,
- &death->work);
- else {
- binder_enqueue_work_ilocked(
- &death->work,
- &proc->todo);
- binder_wakeup_proc_ilocked(
- proc);
- }
- } else {
- BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER);
- death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR;
- }
- binder_inner_proc_unlock(proc);
- }
- binder_node_unlock(ref->node);
- binder_proc_unlock(proc);
- } break;
- case BC_DEAD_BINDER_DONE: {
- struct binder_work *w;
- binder_uintptr_t cookie;
- struct binder_ref_death *death = NULL;
-
- if (get_user(cookie, (binder_uintptr_t __user *)ptr))
- return -EFAULT;
-
- ptr += sizeof(cookie);
- binder_inner_proc_lock(proc);
- list_for_each_entry(w, &proc->delivered_death,
- entry) {
- struct binder_ref_death *tmp_death =
- container_of(w,
- struct binder_ref_death,
- work);
-
- if (tmp_death->cookie == cookie) {
- death = tmp_death;
- break;
- }
- }
- binder_debug(BINDER_DEBUG_DEAD_BINDER,
- "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",
- proc->pid, thread->pid, (u64)cookie,
- death);
- if (death == NULL) {
- binder_user_error("%d:%d BC_DEAD_BINDER_DONE %016llx not found\n",
- proc->pid, thread->pid, (u64)cookie);
- binder_inner_proc_unlock(proc);
- break;
- }
- binder_dequeue_work_ilocked(&death->work);
- if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) {
- death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION;
- if (thread->looper &
- (BINDER_LOOPER_STATE_REGISTERED |
- BINDER_LOOPER_STATE_ENTERED))
- binder_enqueue_thread_work_ilocked(
- thread, &death->work);
- else {
- binder_enqueue_work_ilocked(
- &death->work,
- &proc->todo);
- binder_wakeup_proc_ilocked(proc);
- }
- }
- binder_inner_proc_unlock(proc);
- } break;
-
- case BC_REQUEST_FREEZE_NOTIFICATION: {
- struct binder_handle_cookie handle_cookie;
- int error;
-
- if (copy_from_user(&handle_cookie, ptr, sizeof(handle_cookie)))
- return -EFAULT;
- ptr += sizeof(handle_cookie);
- error = binder_request_freeze_notification(proc, thread,
- &handle_cookie);
- if (error)
- return error;
- } break;
-
- case BC_CLEAR_FREEZE_NOTIFICATION: {
- struct binder_handle_cookie handle_cookie;
- int error;
-
- if (copy_from_user(&handle_cookie, ptr, sizeof(handle_cookie)))
- return -EFAULT;
- ptr += sizeof(handle_cookie);
- error = binder_clear_freeze_notification(proc, thread, &handle_cookie);
- if (error)
- return error;
- } break;
-
- case BC_FREEZE_NOTIFICATION_DONE: {
- binder_uintptr_t cookie;
- int error;
-
- if (get_user(cookie, (binder_uintptr_t __user *)ptr))
- return -EFAULT;
-
- ptr += sizeof(cookie);
- error = binder_freeze_notification_done(proc, thread, cookie);
- if (error)
- return error;
- } break;
-
- default:
- pr_err("%d:%d unknown command %u\n",
- proc->pid, thread->pid, cmd);
- return -EINVAL;
- }
- *consumed = ptr - buffer;
- }
- return 0;
-}
-
-static void binder_stat_br(struct binder_proc *proc,
- struct binder_thread *thread, uint32_t cmd)
-{
- trace_binder_return(cmd);
- if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) {
- atomic_inc(&binder_stats.br[_IOC_NR(cmd)]);
- atomic_inc(&proc->stats.br[_IOC_NR(cmd)]);
- atomic_inc(&thread->stats.br[_IOC_NR(cmd)]);
- }
-}
-
-static int binder_put_node_cmd(struct binder_proc *proc,
- struct binder_thread *thread,
- void __user **ptrp,
- binder_uintptr_t node_ptr,
- binder_uintptr_t node_cookie,
- int node_debug_id,
- uint32_t cmd, const char *cmd_name)
-{
- void __user *ptr = *ptrp;
-
- if (put_user(cmd, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
-
- if (put_user(node_ptr, (binder_uintptr_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(binder_uintptr_t);
-
- if (put_user(node_cookie, (binder_uintptr_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(binder_uintptr_t);
-
- binder_stat_br(proc, thread, cmd);
- binder_debug(BINDER_DEBUG_USER_REFS, "%d:%d %s %d u%016llx c%016llx\n",
- proc->pid, thread->pid, cmd_name, node_debug_id,
- (u64)node_ptr, (u64)node_cookie);
-
- *ptrp = ptr;
- return 0;
-}
-
-static int binder_wait_for_work(struct binder_thread *thread,
- bool do_proc_work)
-{
- DEFINE_WAIT(wait);
- struct binder_proc *proc = thread->proc;
- int ret = 0;
-
- binder_inner_proc_lock(proc);
- for (;;) {
- prepare_to_wait(&thread->wait, &wait, TASK_INTERRUPTIBLE|TASK_FREEZABLE);
- if (binder_has_work_ilocked(thread, do_proc_work))
- break;
- if (do_proc_work)
- list_add(&thread->waiting_thread_node,
- &proc->waiting_threads);
- binder_inner_proc_unlock(proc);
- schedule();
- binder_inner_proc_lock(proc);
- list_del_init(&thread->waiting_thread_node);
- if (signal_pending(current)) {
- ret = -EINTR;
- break;
- }
- }
- finish_wait(&thread->wait, &wait);
- binder_inner_proc_unlock(proc);
-
- return ret;
-}
-
-/**
- * binder_apply_fd_fixups() - finish fd translation
- * @proc: binder_proc associated @t->buffer
- * @t: binder transaction with list of fd fixups
- *
- * Now that we are in the context of the transaction target
- * process, we can allocate and install fds. Process the
- * list of fds to translate and fixup the buffer with the
- * new fds first and only then install the files.
- *
- * If we fail to allocate an fd, skip the install and release
- * any fds that have already been allocated.
- *
- * Return: 0 on success, a negative errno code on failure.
- */
-static int binder_apply_fd_fixups(struct binder_proc *proc,
- struct binder_transaction *t)
-{
- struct binder_txn_fd_fixup *fixup, *tmp;
- int ret = 0;
-
- list_for_each_entry(fixup, &t->fd_fixups, fixup_entry) {
- int fd = get_unused_fd_flags(O_CLOEXEC);
-
- if (fd < 0) {
- binder_debug(BINDER_DEBUG_TRANSACTION,
- "failed fd fixup txn %d fd %d\n",
- t->debug_id, fd);
- ret = -ENOMEM;
- goto err;
- }
- binder_debug(BINDER_DEBUG_TRANSACTION,
- "fd fixup txn %d fd %d\n",
- t->debug_id, fd);
- trace_binder_transaction_fd_recv(t, fd, fixup->offset);
- fixup->target_fd = fd;
- if (binder_alloc_copy_to_buffer(&proc->alloc, t->buffer,
- fixup->offset, &fd,
- sizeof(u32))) {
- ret = -EINVAL;
- goto err;
- }
- }
- list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) {
- fd_install(fixup->target_fd, fixup->file);
- list_del(&fixup->fixup_entry);
- kfree(fixup);
- }
-
- return ret;
-
-err:
- binder_free_txn_fixups(t);
- return ret;
-}
-
-static int binder_thread_read(struct binder_proc *proc,
- struct binder_thread *thread,
- binder_uintptr_t binder_buffer, size_t size,
- binder_size_t *consumed, int non_block)
-{
- void __user *buffer = (void __user *)(uintptr_t)binder_buffer;
- void __user *ptr = buffer + *consumed;
- void __user *end = buffer + size;
-
- int ret = 0;
- int wait_for_proc_work;
-
- if (*consumed == 0) {
- if (put_user(BR_NOOP, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
- }
-
-retry:
- binder_inner_proc_lock(proc);
- wait_for_proc_work = binder_available_for_proc_work_ilocked(thread);
- binder_inner_proc_unlock(proc);
-
- thread->looper |= BINDER_LOOPER_STATE_WAITING;
-
- trace_binder_wait_for_work(wait_for_proc_work,
- !!thread->transaction_stack,
- !binder_worklist_empty(proc, &thread->todo));
- if (wait_for_proc_work) {
- if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
- BINDER_LOOPER_STATE_ENTERED))) {
- binder_user_error("%d:%d ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state %x)\n",
- proc->pid, thread->pid, thread->looper);
- wait_event_interruptible(binder_user_error_wait,
- binder_stop_on_user_error < 2);
- }
- binder_set_nice(proc->default_priority);
- }
-
- if (non_block) {
- if (!binder_has_work(thread, wait_for_proc_work))
- ret = -EAGAIN;
- } else {
- ret = binder_wait_for_work(thread, wait_for_proc_work);
- }
-
- thread->looper &= ~BINDER_LOOPER_STATE_WAITING;
-
- if (ret)
- return ret;
-
- while (1) {
- uint32_t cmd;
- struct binder_transaction_data_secctx tr;
- struct binder_transaction_data *trd = &tr.transaction_data;
- struct binder_work *w = NULL;
- struct list_head *list = NULL;
- struct binder_transaction *t = NULL;
- struct binder_thread *t_from;
- size_t trsize = sizeof(*trd);
-
- binder_inner_proc_lock(proc);
- if (!binder_worklist_empty_ilocked(&thread->todo))
- list = &thread->todo;
- else if (!binder_worklist_empty_ilocked(&proc->todo) &&
- wait_for_proc_work)
- list = &proc->todo;
- else {
- binder_inner_proc_unlock(proc);
-
- /* no data added */
- if (ptr - buffer == 4 && !thread->looper_need_return)
- goto retry;
- break;
- }
-
- if (end - ptr < sizeof(tr) + 4) {
- binder_inner_proc_unlock(proc);
- break;
- }
- w = binder_dequeue_work_head_ilocked(list);
- if (binder_worklist_empty_ilocked(&thread->todo))
- thread->process_todo = false;
-
- switch (w->type) {
- case BINDER_WORK_TRANSACTION: {
- binder_inner_proc_unlock(proc);
- t = container_of(w, struct binder_transaction, work);
- } break;
- case BINDER_WORK_RETURN_ERROR: {
- struct binder_error *e = container_of(
- w, struct binder_error, work);
-
- WARN_ON(e->cmd == BR_OK);
- binder_inner_proc_unlock(proc);
- if (put_user(e->cmd, (uint32_t __user *)ptr))
- return -EFAULT;
- cmd = e->cmd;
- e->cmd = BR_OK;
- ptr += sizeof(uint32_t);
-
- binder_stat_br(proc, thread, cmd);
- } break;
- case BINDER_WORK_TRANSACTION_COMPLETE:
- case BINDER_WORK_TRANSACTION_PENDING:
- case BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT: {
- if (proc->oneway_spam_detection_enabled &&
- w->type == BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT)
- cmd = BR_ONEWAY_SPAM_SUSPECT;
- else if (w->type == BINDER_WORK_TRANSACTION_PENDING)
- cmd = BR_TRANSACTION_PENDING_FROZEN;
- else
- cmd = BR_TRANSACTION_COMPLETE;
- binder_inner_proc_unlock(proc);
- kfree(w);
- binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
- if (put_user(cmd, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
-
- binder_stat_br(proc, thread, cmd);
- binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE,
- "%d:%d BR_TRANSACTION_COMPLETE\n",
- proc->pid, thread->pid);
- } break;
- case BINDER_WORK_NODE: {
- struct binder_node *node = container_of(w, struct binder_node, work);
- int strong, weak;
- binder_uintptr_t node_ptr = node->ptr;
- binder_uintptr_t node_cookie = node->cookie;
- int node_debug_id = node->debug_id;
- int has_weak_ref;
- int has_strong_ref;
- void __user *orig_ptr = ptr;
-
- BUG_ON(proc != node->proc);
- strong = node->internal_strong_refs ||
- node->local_strong_refs;
- weak = !hlist_empty(&node->refs) ||
- node->local_weak_refs ||
- node->tmp_refs || strong;
- has_strong_ref = node->has_strong_ref;
- has_weak_ref = node->has_weak_ref;
-
- if (weak && !has_weak_ref) {
- node->has_weak_ref = 1;
- node->pending_weak_ref = 1;
- node->local_weak_refs++;
- }
- if (strong && !has_strong_ref) {
- node->has_strong_ref = 1;
- node->pending_strong_ref = 1;
- node->local_strong_refs++;
- }
- if (!strong && has_strong_ref)
- node->has_strong_ref = 0;
- if (!weak && has_weak_ref)
- node->has_weak_ref = 0;
- if (!weak && !strong) {
- binder_debug(BINDER_DEBUG_INTERNAL_REFS,
- "%d:%d node %d u%016llx c%016llx deleted\n",
- proc->pid, thread->pid,
- node_debug_id,
- (u64)node_ptr,
- (u64)node_cookie);
- rb_erase(&node->rb_node, &proc->nodes);
- binder_inner_proc_unlock(proc);
- binder_node_lock(node);
- /*
- * Acquire the node lock before freeing the
- * node to serialize with other threads that
- * may have been holding the node lock while
- * decrementing this node (avoids race where
- * this thread frees while the other thread
- * is unlocking the node after the final
- * decrement)
- */
- binder_node_unlock(node);
- binder_free_node(node);
- } else
- binder_inner_proc_unlock(proc);
-
- if (weak && !has_weak_ref)
- ret = binder_put_node_cmd(
- proc, thread, &ptr, node_ptr,
- node_cookie, node_debug_id,
- BR_INCREFS, "BR_INCREFS");
- if (!ret && strong && !has_strong_ref)
- ret = binder_put_node_cmd(
- proc, thread, &ptr, node_ptr,
- node_cookie, node_debug_id,
- BR_ACQUIRE, "BR_ACQUIRE");
- if (!ret && !strong && has_strong_ref)
- ret = binder_put_node_cmd(
- proc, thread, &ptr, node_ptr,
- node_cookie, node_debug_id,
- BR_RELEASE, "BR_RELEASE");
- if (!ret && !weak && has_weak_ref)
- ret = binder_put_node_cmd(
- proc, thread, &ptr, node_ptr,
- node_cookie, node_debug_id,
- BR_DECREFS, "BR_DECREFS");
- if (orig_ptr == ptr)
- binder_debug(BINDER_DEBUG_INTERNAL_REFS,
- "%d:%d node %d u%016llx c%016llx state unchanged\n",
- proc->pid, thread->pid,
- node_debug_id,
- (u64)node_ptr,
- (u64)node_cookie);
- if (ret)
- return ret;
- } break;
- case BINDER_WORK_DEAD_BINDER:
- case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
- case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
- struct binder_ref_death *death;
- uint32_t cmd;
- binder_uintptr_t cookie;
-
- death = container_of(w, struct binder_ref_death, work);
- if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION)
- cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE;
- else
- cmd = BR_DEAD_BINDER;
- cookie = death->cookie;
-
- binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION,
- "%d:%d %s %016llx\n",
- proc->pid, thread->pid,
- cmd == BR_DEAD_BINDER ?
- "BR_DEAD_BINDER" :
- "BR_CLEAR_DEATH_NOTIFICATION_DONE",
- (u64)cookie);
- if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) {
- binder_inner_proc_unlock(proc);
- kfree(death);
- binder_stats_deleted(BINDER_STAT_DEATH);
- } else {
- binder_enqueue_work_ilocked(
- w, &proc->delivered_death);
- binder_inner_proc_unlock(proc);
- }
- if (put_user(cmd, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
- if (put_user(cookie,
- (binder_uintptr_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(binder_uintptr_t);
- binder_stat_br(proc, thread, cmd);
- if (cmd == BR_DEAD_BINDER)
- goto done; /* DEAD_BINDER notifications can cause transactions */
- } break;
-
- case BINDER_WORK_FROZEN_BINDER: {
- struct binder_ref_freeze *freeze;
- struct binder_frozen_state_info info;
-
- memset(&info, 0, sizeof(info));
- freeze = container_of(w, struct binder_ref_freeze, work);
- info.is_frozen = freeze->is_frozen;
- info.cookie = freeze->cookie;
- freeze->sent = true;
- binder_enqueue_work_ilocked(w, &proc->delivered_freeze);
- binder_inner_proc_unlock(proc);
-
- if (put_user(BR_FROZEN_BINDER, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
- if (copy_to_user(ptr, &info, sizeof(info)))
- return -EFAULT;
- ptr += sizeof(info);
- binder_stat_br(proc, thread, BR_FROZEN_BINDER);
- goto done; /* BR_FROZEN_BINDER notifications can cause transactions */
- } break;
-
- case BINDER_WORK_CLEAR_FREEZE_NOTIFICATION: {
- struct binder_ref_freeze *freeze =
- container_of(w, struct binder_ref_freeze, work);
- binder_uintptr_t cookie = freeze->cookie;
-
- binder_inner_proc_unlock(proc);
- kfree(freeze);
- binder_stats_deleted(BINDER_STAT_FREEZE);
- if (put_user(BR_CLEAR_FREEZE_NOTIFICATION_DONE, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
- if (put_user(cookie, (binder_uintptr_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(binder_uintptr_t);
- binder_stat_br(proc, thread, BR_CLEAR_FREEZE_NOTIFICATION_DONE);
- } break;
-
- default:
- binder_inner_proc_unlock(proc);
- pr_err("%d:%d: bad work type %d\n",
- proc->pid, thread->pid, w->type);
- break;
- }
-
- if (!t)
- continue;
-
- BUG_ON(t->buffer == NULL);
- if (t->buffer->target_node) {
- struct binder_node *target_node = t->buffer->target_node;
-
- trd->target.ptr = target_node->ptr;
- trd->cookie = target_node->cookie;
- t->saved_priority = task_nice(current);
- if (t->priority < target_node->min_priority &&
- !(t->flags & TF_ONE_WAY))
- binder_set_nice(t->priority);
- else if (!(t->flags & TF_ONE_WAY) ||
- t->saved_priority > target_node->min_priority)
- binder_set_nice(target_node->min_priority);
- cmd = BR_TRANSACTION;
- } else {
- trd->target.ptr = 0;
- trd->cookie = 0;
- cmd = BR_REPLY;
- }
- trd->code = t->code;
- trd->flags = t->flags;
- trd->sender_euid = from_kuid(current_user_ns(), t->sender_euid);
-
- t_from = binder_get_txn_from(t);
- if (t_from) {
- struct task_struct *sender = t_from->proc->tsk;
-
- trd->sender_pid =
- task_tgid_nr_ns(sender,
- task_active_pid_ns(current));
- } else {
- trd->sender_pid = 0;
- }
-
- ret = binder_apply_fd_fixups(proc, t);
- if (ret) {
- struct binder_buffer *buffer = t->buffer;
- bool oneway = !!(t->flags & TF_ONE_WAY);
- int tid = t->debug_id;
-
- if (t_from)
- binder_thread_dec_tmpref(t_from);
- buffer->transaction = NULL;
- binder_cleanup_transaction(t, "fd fixups failed",
- BR_FAILED_REPLY);
- binder_free_buf(proc, thread, buffer, true);
- binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
- "%d:%d %stransaction %d fd fixups failed %d/%d, line %d\n",
- proc->pid, thread->pid,
- oneway ? "async " :
- (cmd == BR_REPLY ? "reply " : ""),
- tid, BR_FAILED_REPLY, ret, __LINE__);
- if (cmd == BR_REPLY) {
- cmd = BR_FAILED_REPLY;
- if (put_user(cmd, (uint32_t __user *)ptr))
- return -EFAULT;
- ptr += sizeof(uint32_t);
- binder_stat_br(proc, thread, cmd);
- break;
- }
- continue;
- }
- trd->data_size = t->buffer->data_size;
- trd->offsets_size = t->buffer->offsets_size;
- trd->data.ptr.buffer = t->buffer->user_data;
- trd->data.ptr.offsets = trd->data.ptr.buffer +
- ALIGN(t->buffer->data_size,
- sizeof(void *));
-
- tr.secctx = t->security_ctx;
- if (t->security_ctx) {
- cmd = BR_TRANSACTION_SEC_CTX;
- trsize = sizeof(tr);
- }
- if (put_user(cmd, (uint32_t __user *)ptr)) {
- if (t_from)
- binder_thread_dec_tmpref(t_from);
-
- binder_cleanup_transaction(t, "put_user failed",
- BR_FAILED_REPLY);
-
- return -EFAULT;
- }
- ptr += sizeof(uint32_t);
- if (copy_to_user(ptr, &tr, trsize)) {
- if (t_from)
- binder_thread_dec_tmpref(t_from);
-
- binder_cleanup_transaction(t, "copy_to_user failed",
- BR_FAILED_REPLY);
-
- return -EFAULT;
- }
- ptr += trsize;
-
- trace_binder_transaction_received(t);
- binder_stat_br(proc, thread, cmd);
- binder_debug(BINDER_DEBUG_TRANSACTION,
- "%d:%d %s %d %d:%d, cmd %u size %zd-%zd\n",
- proc->pid, thread->pid,
- (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" :
- (cmd == BR_TRANSACTION_SEC_CTX) ?
- "BR_TRANSACTION_SEC_CTX" : "BR_REPLY",
- t->debug_id, t_from ? t_from->proc->pid : 0,
- t_from ? t_from->pid : 0, cmd,
- t->buffer->data_size, t->buffer->offsets_size);
-
- if (t_from)
- binder_thread_dec_tmpref(t_from);
- t->buffer->allow_user_free = 1;
- if (cmd != BR_REPLY && !(t->flags & TF_ONE_WAY)) {
- binder_inner_proc_lock(thread->proc);
- t->to_parent = thread->transaction_stack;
- t->to_thread = thread;
- thread->transaction_stack = t;
- binder_inner_proc_unlock(thread->proc);
- } else {
- binder_free_transaction(t);
- }
- break;
- }
-
-done:
-
- *consumed = ptr - buffer;
- binder_inner_proc_lock(proc);
- if (proc->requested_threads == 0 &&
- list_empty(&thread->proc->waiting_threads) &&
- proc->requested_threads_started < proc->max_threads &&
- (thread->looper & (BINDER_LOOPER_STATE_REGISTERED |
- BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */
- /*spawn a new thread if we leave this out */) {
- proc->requested_threads++;
- binder_inner_proc_unlock(proc);
- binder_debug(BINDER_DEBUG_THREADS,
- "%d:%d BR_SPAWN_LOOPER\n",
- proc->pid, thread->pid);
- if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer))
- return -EFAULT;
- binder_stat_br(proc, thread, BR_SPAWN_LOOPER);
- } else
- binder_inner_proc_unlock(proc);
- return 0;
-}
-
-static void binder_release_work(struct binder_proc *proc,
- struct list_head *list)
-{
- struct binder_work *w;
- enum binder_work_type wtype;
-
- while (1) {
- binder_inner_proc_lock(proc);
- w = binder_dequeue_work_head_ilocked(list);
- wtype = w ? w->type : 0;
- binder_inner_proc_unlock(proc);
- if (!w)
- return;
-
- switch (wtype) {
- case BINDER_WORK_TRANSACTION: {
- struct binder_transaction *t;
-
- t = container_of(w, struct binder_transaction, work);
-
- binder_cleanup_transaction(t, "process died.",
- BR_DEAD_REPLY);
- } break;
- case BINDER_WORK_RETURN_ERROR: {
- struct binder_error *e = container_of(
- w, struct binder_error, work);
-
- binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
- "undelivered TRANSACTION_ERROR: %u\n",
- e->cmd);
- } break;
- case BINDER_WORK_TRANSACTION_PENDING:
- case BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT:
- case BINDER_WORK_TRANSACTION_COMPLETE: {
- binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
- "undelivered TRANSACTION_COMPLETE\n");
- kfree(w);
- binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE);
- } break;
- case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
- case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: {
- struct binder_ref_death *death;
-
- death = container_of(w, struct binder_ref_death, work);
- binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
- "undelivered death notification, %016llx\n",
- (u64)death->cookie);
- kfree(death);
- binder_stats_deleted(BINDER_STAT_DEATH);
- } break;
- case BINDER_WORK_NODE:
- break;
- case BINDER_WORK_CLEAR_FREEZE_NOTIFICATION: {
- struct binder_ref_freeze *freeze;
-
- freeze = container_of(w, struct binder_ref_freeze, work);
- binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
- "undelivered freeze notification, %016llx\n",
- (u64)freeze->cookie);
- kfree(freeze);
- binder_stats_deleted(BINDER_STAT_FREEZE);
- } break;
- default:
- pr_err("unexpected work type, %d, not freed\n",
- wtype);
- break;
- }
- }
-
-}
-
-static struct binder_thread *binder_get_thread_ilocked(
- struct binder_proc *proc, struct binder_thread *new_thread)
-{
- struct binder_thread *thread = NULL;
- struct rb_node *parent = NULL;
- struct rb_node **p = &proc->threads.rb_node;
-
- while (*p) {
- parent = *p;
- thread = rb_entry(parent, struct binder_thread, rb_node);
-
- if (current->pid < thread->pid)
- p = &(*p)->rb_left;
- else if (current->pid > thread->pid)
- p = &(*p)->rb_right;
- else
- return thread;
- }
- if (!new_thread)
- return NULL;
- thread = new_thread;
- binder_stats_created(BINDER_STAT_THREAD);
- thread->proc = proc;
- thread->pid = current->pid;
- atomic_set(&thread->tmp_ref, 0);
- init_waitqueue_head(&thread->wait);
- INIT_LIST_HEAD(&thread->todo);
- rb_link_node(&thread->rb_node, parent, p);
- rb_insert_color(&thread->rb_node, &proc->threads);
- thread->looper_need_return = true;
- thread->return_error.work.type = BINDER_WORK_RETURN_ERROR;
- thread->return_error.cmd = BR_OK;
- thread->reply_error.work.type = BINDER_WORK_RETURN_ERROR;
- thread->reply_error.cmd = BR_OK;
- thread->ee.command = BR_OK;
- INIT_LIST_HEAD(&new_thread->waiting_thread_node);
- return thread;
-}
-
-static struct binder_thread *binder_get_thread(struct binder_proc *proc)
-{
- struct binder_thread *thread;
- struct binder_thread *new_thread;
-
- binder_inner_proc_lock(proc);
- thread = binder_get_thread_ilocked(proc, NULL);
- binder_inner_proc_unlock(proc);
- if (!thread) {
- new_thread = kzalloc_obj(*thread);
- if (new_thread == NULL)
- return NULL;
- binder_inner_proc_lock(proc);
- thread = binder_get_thread_ilocked(proc, new_thread);
- binder_inner_proc_unlock(proc);
- if (thread != new_thread)
- kfree(new_thread);
- }
- return thread;
-}
-
-static void binder_free_proc(struct binder_proc *proc)
-{
- struct binder_device *device;
-
- BUG_ON(!list_empty(&proc->todo));
- BUG_ON(!list_empty(&proc->delivered_death));
- if (proc->outstanding_txns)
- pr_warn("%s: Unexpected outstanding_txns %d\n",
- __func__, proc->outstanding_txns);
- device = container_of(proc->context, struct binder_device, context);
- if (refcount_dec_and_test(&device->ref)) {
- binder_remove_device(device);
- kfree(proc->context->name);
- kfree(device);
- }
- binder_alloc_deferred_release(&proc->alloc);
- put_task_struct(proc->tsk);
- put_cred(proc->cred);
- binder_stats_deleted(BINDER_STAT_PROC);
- dbitmap_free(&proc->dmap);
- kfree(proc);
-}
-
-static void binder_free_thread(struct binder_thread *thread)
-{
- BUG_ON(!list_empty(&thread->todo));
- binder_stats_deleted(BINDER_STAT_THREAD);
- binder_proc_dec_tmpref(thread->proc);
- kfree(thread);
-}
-
-static int binder_thread_release(struct binder_proc *proc,
- struct binder_thread *thread)
-{
- struct binder_transaction *t;
- struct binder_transaction *send_reply = NULL;
- int active_transactions = 0;
- struct binder_transaction *last_t = NULL;
-
- binder_inner_proc_lock(thread->proc);
- /*
- * take a ref on the proc so it survives
- * after we remove this thread from proc->threads.
- * The corresponding dec is when we actually
- * free the thread in binder_free_thread()
- */
- proc->tmp_ref++;
- /*
- * take a ref on this thread to ensure it
- * survives while we are releasing it
- */
- atomic_inc(&thread->tmp_ref);
- rb_erase(&thread->rb_node, &proc->threads);
- t = thread->transaction_stack;
- if (t) {
- spin_lock(&t->lock);
- if (t->to_thread == thread)
- send_reply = t;
- } else {
- __acquire(&t->lock);
- }
- thread->is_dead = true;
-
- while (t) {
- last_t = t;
- active_transactions++;
- binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
- "release %d:%d transaction %d %s, still active\n",
- proc->pid, thread->pid,
- t->debug_id,
- (t->to_thread == thread) ? "in" : "out");
-
- if (t->to_thread == thread) {
- thread->proc->outstanding_txns--;
- t->to_proc = NULL;
- t->to_thread = NULL;
- if (t->buffer) {
- t->buffer->transaction = NULL;
- t->buffer = NULL;
- }
- t = t->to_parent;
- } else if (t->from == thread) {
- t->from = NULL;
- t = t->from_parent;
- } else
- BUG();
- spin_unlock(&last_t->lock);
- if (t)
- spin_lock(&t->lock);
- else
- __acquire(&t->lock);
- }
- /* annotation for sparse, lock not acquired in last iteration above */
- __release(&t->lock);
-
- /*
- * If this thread used poll, make sure we remove the waitqueue from any
- * poll data structures holding it.
- */
- if (thread->looper & BINDER_LOOPER_STATE_POLL)
- wake_up_pollfree(&thread->wait);
-
- binder_inner_proc_unlock(thread->proc);
-
- /*
- * This is needed to avoid races between wake_up_pollfree() above and
- * someone else removing the last entry from the queue for other reasons
- * (e.g. ep_remove_wait_queue() being called due to an epoll file
- * descriptor being closed). Such other users hold an RCU read lock, so
- * we can be sure they're done after we call synchronize_rcu().
- */
- if (thread->looper & BINDER_LOOPER_STATE_POLL)
- synchronize_rcu();
-
- if (send_reply)
- binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
- binder_release_work(proc, &thread->todo);
- binder_thread_dec_tmpref(thread);
- return active_transactions;
-}
-
-static __poll_t binder_poll(struct file *filp,
- struct poll_table_struct *wait)
-{
- struct binder_proc *proc = filp->private_data;
- struct binder_thread *thread = NULL;
- bool wait_for_proc_work;
-
- thread = binder_get_thread(proc);
- if (!thread)
- return EPOLLERR;
-
- binder_inner_proc_lock(thread->proc);
- thread->looper |= BINDER_LOOPER_STATE_POLL;
- wait_for_proc_work = binder_available_for_proc_work_ilocked(thread);
-
- binder_inner_proc_unlock(thread->proc);
-
- poll_wait(filp, &thread->wait, wait);
-
- if (binder_has_work(thread, wait_for_proc_work))
- return EPOLLIN;
-
- return 0;
-}
-
-static int binder_ioctl_write_read(struct file *filp, unsigned long arg,
- struct binder_thread *thread)
-{
- int ret = 0;
- struct binder_proc *proc = filp->private_data;
- void __user *ubuf = (void __user *)arg;
- struct binder_write_read bwr;
-
- if (copy_from_user(&bwr, ubuf, sizeof(bwr)))
- return -EFAULT;
-
- binder_debug(BINDER_DEBUG_READ_WRITE,
- "%d:%d write %lld at %016llx, read %lld at %016llx\n",
- proc->pid, thread->pid,
- (u64)bwr.write_size, (u64)bwr.write_buffer,
- (u64)bwr.read_size, (u64)bwr.read_buffer);
-
- if (bwr.write_size > 0) {
- ret = binder_thread_write(proc, thread,
- bwr.write_buffer,
- bwr.write_size,
- &bwr.write_consumed);
- trace_binder_write_done(ret);
- if (ret < 0) {
- bwr.read_consumed = 0;
- goto out;
- }
- }
- if (bwr.read_size > 0) {
- ret = binder_thread_read(proc, thread, bwr.read_buffer,
- bwr.read_size,
- &bwr.read_consumed,
- filp->f_flags & O_NONBLOCK);
- trace_binder_read_done(ret);
- binder_inner_proc_lock(proc);
- if (!binder_worklist_empty_ilocked(&proc->todo))
- binder_wakeup_proc_ilocked(proc);
- binder_inner_proc_unlock(proc);
- if (ret < 0)
- goto out;
- }
- binder_debug(BINDER_DEBUG_READ_WRITE,
- "%d:%d wrote %lld of %lld, read return %lld of %lld\n",
- proc->pid, thread->pid,
- (u64)bwr.write_consumed, (u64)bwr.write_size,
- (u64)bwr.read_consumed, (u64)bwr.read_size);
-out:
- if (copy_to_user(ubuf, &bwr, sizeof(bwr)))
- ret = -EFAULT;
- return ret;
-}
-
-static int binder_ioctl_set_ctx_mgr(struct file *filp,
- struct flat_binder_object *fbo)
-{
- int ret = 0;
- struct binder_proc *proc = filp->private_data;
- struct binder_context *context = proc->context;
- struct binder_node *new_node;
- kuid_t curr_euid = current_euid();
-
- guard(mutex)(&context->context_mgr_node_lock);
- if (context->binder_context_mgr_node) {
- pr_err("BINDER_SET_CONTEXT_MGR already set\n");
- return -EBUSY;
- }
- ret = security_binder_set_context_mgr(proc->cred);
- if (ret < 0)
- return ret;
- if (uid_valid(context->binder_context_mgr_uid)) {
- if (!uid_eq(context->binder_context_mgr_uid, curr_euid)) {
- pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n",
- from_kuid(&init_user_ns, curr_euid),
- from_kuid(&init_user_ns,
- context->binder_context_mgr_uid));
- return -EPERM;
- }
- } else {
- context->binder_context_mgr_uid = curr_euid;
- }
- new_node = binder_new_node(proc, fbo);
- if (!new_node)
- return -ENOMEM;
- binder_node_lock(new_node);
- new_node->local_weak_refs++;
- new_node->local_strong_refs++;
- new_node->has_strong_ref = 1;
- new_node->has_weak_ref = 1;
- context->binder_context_mgr_node = new_node;
- binder_node_unlock(new_node);
- binder_put_node(new_node);
- return ret;
-}
-
-static int binder_ioctl_get_node_info_for_ref(struct binder_proc *proc,
- struct binder_node_info_for_ref *info)
-{
- struct binder_node *node;
- struct binder_context *context = proc->context;
- __u32 handle = info->handle;
-
- if (info->strong_count || info->weak_count || info->reserved1 ||
- info->reserved2 || info->reserved3) {
- binder_user_error("%d BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero.",
- proc->pid);
- return -EINVAL;
- }
-
- /* This ioctl may only be used by the context manager */
- mutex_lock(&context->context_mgr_node_lock);
- if (!context->binder_context_mgr_node ||
- context->binder_context_mgr_node->proc != proc) {
- mutex_unlock(&context->context_mgr_node_lock);
- return -EPERM;
- }
- mutex_unlock(&context->context_mgr_node_lock);
-
- node = binder_get_node_from_ref(proc, handle, true, NULL);
- if (!node)
- return -EINVAL;
-
- info->strong_count = node->local_strong_refs +
- node->internal_strong_refs;
- info->weak_count = node->local_weak_refs;
-
- binder_put_node(node);
-
- return 0;
-}
-
-static int binder_ioctl_get_node_debug_info(struct binder_proc *proc,
- struct binder_node_debug_info *info)
-{
- struct rb_node *n;
- binder_uintptr_t ptr = info->ptr;
-
- memset(info, 0, sizeof(*info));
-
- binder_inner_proc_lock(proc);
- for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) {
- struct binder_node *node = rb_entry(n, struct binder_node,
- rb_node);
- if (node->ptr > ptr) {
- info->ptr = node->ptr;
- info->cookie = node->cookie;
- info->has_strong_ref = node->has_strong_ref;
- info->has_weak_ref = node->has_weak_ref;
- break;
- }
- }
- binder_inner_proc_unlock(proc);
-
- return 0;
-}
-
-static bool binder_txns_pending_ilocked(struct binder_proc *proc)
-{
- struct rb_node *n;
- struct binder_thread *thread;
-
- if (proc->outstanding_txns > 0)
- return true;
-
- for (n = rb_first(&proc->threads); n; n = rb_next(n)) {
- thread = rb_entry(n, struct binder_thread, rb_node);
- if (thread->transaction_stack)
- return true;
- }
- return false;
-}
-
-static void binder_add_freeze_work(struct binder_proc *proc, bool is_frozen)
-{
- struct binder_node *prev = NULL;
- struct rb_node *n;
- struct binder_ref *ref;
-
- binder_inner_proc_lock(proc);
- for (n = rb_first(&proc->nodes); n; n = rb_next(n)) {
- struct binder_node *node;
-
- node = rb_entry(n, struct binder_node, rb_node);
- binder_inc_node_tmpref_ilocked(node);
- binder_inner_proc_unlock(proc);
- if (prev)
- binder_put_node(prev);
- binder_node_lock(node);
- hlist_for_each_entry(ref, &node->refs, node_entry) {
- /*
- * Need the node lock to synchronize
- * with new notification requests and the
- * inner lock to synchronize with queued
- * freeze notifications.
- */
- binder_inner_proc_lock(ref->proc);
- if (!ref->freeze) {
- binder_inner_proc_unlock(ref->proc);
- continue;
- }
- ref->freeze->work.type = BINDER_WORK_FROZEN_BINDER;
- if (list_empty(&ref->freeze->work.entry)) {
- ref->freeze->is_frozen = is_frozen;
- binder_enqueue_work_ilocked(&ref->freeze->work, &ref->proc->todo);
- binder_wakeup_proc_ilocked(ref->proc);
- } else {
- if (ref->freeze->sent && ref->freeze->is_frozen != is_frozen)
- ref->freeze->resend = true;
- ref->freeze->is_frozen = is_frozen;
- }
- binder_inner_proc_unlock(ref->proc);
- }
- prev = node;
- binder_node_unlock(node);
- binder_inner_proc_lock(proc);
- if (proc->is_dead)
- break;
- }
- binder_inner_proc_unlock(proc);
- if (prev)
- binder_put_node(prev);
-}
-
-static int binder_ioctl_freeze(struct binder_freeze_info *info,
- struct binder_proc *target_proc)
-{
- int ret = 0;
-
- if (!info->enable) {
- binder_inner_proc_lock(target_proc);
- target_proc->sync_recv = false;
- target_proc->async_recv = false;
- target_proc->is_frozen = false;
- binder_inner_proc_unlock(target_proc);
- binder_add_freeze_work(target_proc, false);
- return 0;
- }
-
- /*
- * Freezing the target. Prevent new transactions by
- * setting frozen state. If timeout specified, wait
- * for transactions to drain.
- */
- binder_inner_proc_lock(target_proc);
- target_proc->sync_recv = false;
- target_proc->async_recv = false;
- target_proc->is_frozen = true;
- binder_inner_proc_unlock(target_proc);
-
- if (info->timeout_ms > 0)
- ret = wait_event_interruptible_timeout(
- target_proc->freeze_wait,
- (!target_proc->outstanding_txns),
- msecs_to_jiffies(info->timeout_ms));
-
- /* Check pending transactions that wait for reply */
- if (ret >= 0) {
- binder_inner_proc_lock(target_proc);
- if (binder_txns_pending_ilocked(target_proc))
- ret = -EAGAIN;
- binder_inner_proc_unlock(target_proc);
- }
-
- if (ret < 0) {
- binder_inner_proc_lock(target_proc);
- target_proc->is_frozen = false;
- binder_inner_proc_unlock(target_proc);
- } else {
- binder_add_freeze_work(target_proc, true);
- }
-
- return ret;
-}
-
-static int binder_ioctl_get_freezer_info(
- struct binder_frozen_status_info *info)
-{
- struct binder_proc *target_proc;
- bool found = false;
- __u32 txns_pending;
-
- info->sync_recv = 0;
- info->async_recv = 0;
-
- mutex_lock(&binder_procs_lock);
- hlist_for_each_entry(target_proc, &binder_procs, proc_node) {
- if (target_proc->pid == info->pid) {
- found = true;
- binder_inner_proc_lock(target_proc);
- txns_pending = binder_txns_pending_ilocked(target_proc);
- info->sync_recv |= target_proc->sync_recv |
- (txns_pending << 1);
- info->async_recv |= target_proc->async_recv;
- binder_inner_proc_unlock(target_proc);
- }
- }
- mutex_unlock(&binder_procs_lock);
-
- if (!found)
- return -EINVAL;
-
- return 0;
-}
-
-static int binder_ioctl_get_extended_error(struct binder_thread *thread,
- void __user *ubuf)
-{
- struct binder_extended_error ee;
-
- binder_inner_proc_lock(thread->proc);
- ee = thread->ee;
- binder_set_extended_error(&thread->ee, 0, BR_OK, 0);
- binder_inner_proc_unlock(thread->proc);
-
- if (copy_to_user(ubuf, &ee, sizeof(ee)))
- return -EFAULT;
-
- return 0;
-}
-
-static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
-{
- int ret;
- struct binder_proc *proc = filp->private_data;
- struct binder_thread *thread;
- void __user *ubuf = (void __user *)arg;
-
- trace_binder_ioctl(cmd, arg);
-
- ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
- if (ret)
- goto err_unlocked;
-
- thread = binder_get_thread(proc);
- if (thread == NULL) {
- ret = -ENOMEM;
- goto err;
- }
-
- switch (cmd) {
- case BINDER_WRITE_READ:
- ret = binder_ioctl_write_read(filp, arg, thread);
- if (ret)
- goto err;
- break;
- case BINDER_SET_MAX_THREADS: {
- u32 max_threads;
-
- if (copy_from_user(&max_threads, ubuf,
- sizeof(max_threads))) {
- ret = -EINVAL;
- goto err;
- }
- binder_inner_proc_lock(proc);
- proc->max_threads = max_threads;
- binder_inner_proc_unlock(proc);
- break;
- }
- case BINDER_SET_CONTEXT_MGR_EXT: {
- struct flat_binder_object fbo;
-
- if (copy_from_user(&fbo, ubuf, sizeof(fbo))) {
- ret = -EINVAL;
- goto err;
- }
- ret = binder_ioctl_set_ctx_mgr(filp, &fbo);
- if (ret)
- goto err;
- break;
- }
- case BINDER_SET_CONTEXT_MGR:
- ret = binder_ioctl_set_ctx_mgr(filp, NULL);
- if (ret)
- goto err;
- break;
- case BINDER_THREAD_EXIT:
- binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n",
- proc->pid, thread->pid);
- binder_thread_release(proc, thread);
- thread = NULL;
- break;
- case BINDER_VERSION: {
- struct binder_version __user *ver = ubuf;
-
- if (put_user(BINDER_CURRENT_PROTOCOL_VERSION,
- &ver->protocol_version)) {
- ret = -EINVAL;
- goto err;
- }
- break;
- }
- case BINDER_GET_NODE_INFO_FOR_REF: {
- struct binder_node_info_for_ref info;
-
- if (copy_from_user(&info, ubuf, sizeof(info))) {
- ret = -EFAULT;
- goto err;
- }
-
- ret = binder_ioctl_get_node_info_for_ref(proc, &info);
- if (ret < 0)
- goto err;
-
- if (copy_to_user(ubuf, &info, sizeof(info))) {
- ret = -EFAULT;
- goto err;
- }
-
- break;
- }
- case BINDER_GET_NODE_DEBUG_INFO: {
- struct binder_node_debug_info info;
-
- if (copy_from_user(&info, ubuf, sizeof(info))) {
- ret = -EFAULT;
- goto err;
- }
-
- ret = binder_ioctl_get_node_debug_info(proc, &info);
- if (ret < 0)
- goto err;
-
- if (copy_to_user(ubuf, &info, sizeof(info))) {
- ret = -EFAULT;
- goto err;
- }
- break;
- }
- case BINDER_FREEZE: {
- struct binder_freeze_info info;
- struct binder_proc **target_procs = NULL, *target_proc;
- int target_procs_count = 0, i = 0;
-
- ret = 0;
-
- if (copy_from_user(&info, ubuf, sizeof(info))) {
- ret = -EFAULT;
- goto err;
- }
-
- mutex_lock(&binder_procs_lock);
- hlist_for_each_entry(target_proc, &binder_procs, proc_node) {
- if (target_proc->pid == info.pid)
- target_procs_count++;
- }
-
- if (target_procs_count == 0) {
- mutex_unlock(&binder_procs_lock);
- ret = -EINVAL;
- goto err;
- }
-
- target_procs = kzalloc_objs(struct binder_proc *,
- target_procs_count);
-
- if (!target_procs) {
- mutex_unlock(&binder_procs_lock);
- ret = -ENOMEM;
- goto err;
- }
-
- hlist_for_each_entry(target_proc, &binder_procs, proc_node) {
- if (target_proc->pid != info.pid)
- continue;
-
- binder_inner_proc_lock(target_proc);
- target_proc->tmp_ref++;
- binder_inner_proc_unlock(target_proc);
-
- target_procs[i++] = target_proc;
- }
- mutex_unlock(&binder_procs_lock);
-
- for (i = 0; i < target_procs_count; i++) {
- if (ret >= 0)
- ret = binder_ioctl_freeze(&info,
- target_procs[i]);
-
- binder_proc_dec_tmpref(target_procs[i]);
- }
-
- kfree(target_procs);
-
- if (ret < 0)
- goto err;
- break;
- }
- case BINDER_GET_FROZEN_INFO: {
- struct binder_frozen_status_info info;
-
- if (copy_from_user(&info, ubuf, sizeof(info))) {
- ret = -EFAULT;
- goto err;
- }
-
- ret = binder_ioctl_get_freezer_info(&info);
- if (ret < 0)
- goto err;
-
- if (copy_to_user(ubuf, &info, sizeof(info))) {
- ret = -EFAULT;
- goto err;
- }
- break;
- }
- case BINDER_ENABLE_ONEWAY_SPAM_DETECTION: {
- uint32_t enable;
-
- if (copy_from_user(&enable, ubuf, sizeof(enable))) {
- ret = -EFAULT;
- goto err;
- }
- binder_inner_proc_lock(proc);
- proc->oneway_spam_detection_enabled = (bool)enable;
- binder_inner_proc_unlock(proc);
- break;
- }
- case BINDER_GET_EXTENDED_ERROR:
- ret = binder_ioctl_get_extended_error(thread, ubuf);
- if (ret < 0)
- goto err;
- break;
- default:
- ret = -EINVAL;
- goto err;
- }
- ret = 0;
-err:
- if (thread)
- thread->looper_need_return = false;
- wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2);
- if (ret && ret != -EINTR)
- pr_info("%d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret);
-err_unlocked:
- trace_binder_ioctl_done(ret);
- return ret;
-}
-
-static void binder_vma_open(struct vm_area_struct *vma)
-{
- struct binder_proc *proc = vma->vm_private_data;
-
- binder_debug(BINDER_DEBUG_OPEN_CLOSE,
- "%d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
- proc->pid, vma->vm_start, vma->vm_end,
- (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
- (unsigned long)pgprot_val(vma->vm_page_prot));
-}
-
-static void binder_vma_close(struct vm_area_struct *vma)
-{
- struct binder_proc *proc = vma->vm_private_data;
-
- binder_debug(BINDER_DEBUG_OPEN_CLOSE,
- "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n",
- proc->pid, vma->vm_start, vma->vm_end,
- (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
- (unsigned long)pgprot_val(vma->vm_page_prot));
- binder_alloc_vma_close(&proc->alloc);
-}
-
-VISIBLE_IF_KUNIT vm_fault_t binder_vm_fault(struct vm_fault *vmf)
-{
- return VM_FAULT_SIGBUS;
-}
-EXPORT_SYMBOL_IF_KUNIT(binder_vm_fault);
-
-static const struct vm_operations_struct binder_vm_ops = {
- .open = binder_vma_open,
- .close = binder_vma_close,
- .fault = binder_vm_fault,
-};
-
-static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
-{
- struct binder_proc *proc = filp->private_data;
-
- if (!same_thread_group(proc->tsk, current))
- return -EINVAL;
-
- binder_debug(BINDER_DEBUG_OPEN_CLOSE,
- "%s: %d %lx-%lx (%ld K) vma %lx pagep %lx\n",
- __func__, proc->pid, vma->vm_start, vma->vm_end,
- (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
- (unsigned long)pgprot_val(vma->vm_page_prot));
-
- if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) {
- pr_err("%s: %d %lx-%lx %s failed %d\n", __func__,
- proc->pid, vma->vm_start, vma->vm_end, "bad vm_flags", -EPERM);
- return -EPERM;
- }
- vm_flags_mod(vma, VM_DONTCOPY | VM_MIXEDMAP, VM_MAYWRITE);
-
- vma->vm_ops = &binder_vm_ops;
- vma->vm_private_data = proc;
-
- return binder_alloc_mmap_handler(&proc->alloc, vma);
-}
-
-static int binder_open(struct inode *nodp, struct file *filp)
-{
- struct binder_proc *proc, *itr;
- struct binder_device *binder_dev;
- struct binderfs_info *info;
- struct dentry *binder_binderfs_dir_entry_proc = NULL;
- bool existing_pid = false;
-
- binder_debug(BINDER_DEBUG_OPEN_CLOSE, "%s: %d:%d\n", __func__,
- current->tgid, current->pid);
-
- proc = kzalloc_obj(*proc);
- if (proc == NULL)
- return -ENOMEM;
-
- dbitmap_init(&proc->dmap);
- spin_lock_init(&proc->inner_lock);
- spin_lock_init(&proc->outer_lock);
- proc->tsk = get_task_struct(current->group_leader);
- proc->pid = current->tgid;
- proc->cred = get_cred(filp->f_cred);
- INIT_LIST_HEAD(&proc->todo);
- init_waitqueue_head(&proc->freeze_wait);
- proc->default_priority = task_nice(current);
- /* binderfs stashes devices in i_private */
- if (is_binderfs_device(nodp)) {
- binder_dev = nodp->i_private;
- info = nodp->i_sb->s_fs_info;
- binder_binderfs_dir_entry_proc = info->proc_log_dir;
- } else {
- binder_dev = container_of(filp->private_data,
- struct binder_device, miscdev);
- }
- refcount_inc(&binder_dev->ref);
- proc->context = &binder_dev->context;
- binder_alloc_init(&proc->alloc);
-
- binder_stats_created(BINDER_STAT_PROC);
- INIT_LIST_HEAD(&proc->delivered_death);
- INIT_LIST_HEAD(&proc->delivered_freeze);
- INIT_LIST_HEAD(&proc->waiting_threads);
- filp->private_data = proc;
-
- mutex_lock(&binder_procs_lock);
- hlist_for_each_entry(itr, &binder_procs, proc_node) {
- if (itr->pid == proc->pid) {
- existing_pid = true;
- break;
- }
- }
- hlist_add_head(&proc->proc_node, &binder_procs);
- mutex_unlock(&binder_procs_lock);
-
- if (binder_debugfs_dir_entry_proc && !existing_pid) {
- char strbuf[11];
-
- snprintf(strbuf, sizeof(strbuf), "%u", proc->pid);
- /*
- * proc debug entries are shared between contexts.
- * Only create for the first PID to avoid debugfs log spamming
- * The printing code will anyway print all contexts for a given
- * PID so this is not a problem.
- */
- proc->debugfs_entry = debugfs_create_file(strbuf, 0444,
- binder_debugfs_dir_entry_proc,
- (void *)(unsigned long)proc->pid,
- &proc_fops);
- }
-
- if (binder_binderfs_dir_entry_proc && !existing_pid) {
- char strbuf[11];
- struct dentry *binderfs_entry;
-
- snprintf(strbuf, sizeof(strbuf), "%u", proc->pid);
- /*
- * Similar to debugfs, the process specific log file is shared
- * between contexts. Only create for the first PID.
- * This is ok since same as debugfs, the log file will contain
- * information on all contexts of a given PID.
- */
- binderfs_entry = binderfs_create_file(binder_binderfs_dir_entry_proc,
- strbuf, &proc_fops, (void *)(unsigned long)proc->pid);
- if (!IS_ERR(binderfs_entry)) {
- proc->binderfs_entry = binderfs_entry;
- } else {
- int error;
-
- error = PTR_ERR(binderfs_entry);
- pr_warn("Unable to create file %s in binderfs (error %d)\n",
- strbuf, error);
- }
- }
-
- return 0;
-}
-
-static int binder_flush(struct file *filp, fl_owner_t id)
-{
- struct binder_proc *proc = filp->private_data;
-
- binder_defer_work(proc, BINDER_DEFERRED_FLUSH);
-
- return 0;
-}
-
-static void binder_deferred_flush(struct binder_proc *proc)
-{
- struct rb_node *n;
- int wake_count = 0;
-
- binder_inner_proc_lock(proc);
- for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) {
- struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node);
-
- thread->looper_need_return = true;
- if (thread->looper & BINDER_LOOPER_STATE_WAITING) {
- wake_up_interruptible(&thread->wait);
- wake_count++;
- }
- }
- binder_inner_proc_unlock(proc);
-
- binder_debug(BINDER_DEBUG_OPEN_CLOSE,
- "binder_flush: %d woke %d threads\n", proc->pid,
- wake_count);
-}
-
-static int binder_release(struct inode *nodp, struct file *filp)
-{
- struct binder_proc *proc = filp->private_data;
-
- debugfs_remove(proc->debugfs_entry);
-
- if (proc->binderfs_entry) {
- simple_recursive_removal(proc->binderfs_entry, NULL);
- proc->binderfs_entry = NULL;
- }
-
- binder_defer_work(proc, BINDER_DEFERRED_RELEASE);
-
- return 0;
-}
-
-static int binder_node_release(struct binder_node *node, int refs)
-{
- struct binder_ref *ref;
- int death = 0;
- struct binder_proc *proc = node->proc;
-
- binder_release_work(proc, &node->async_todo);
-
- binder_node_lock(node);
- binder_inner_proc_lock(proc);
- binder_dequeue_work_ilocked(&node->work);
- /*
- * The caller must have taken a temporary ref on the node,
- */
- BUG_ON(!node->tmp_refs);
- if (hlist_empty(&node->refs) && node->tmp_refs == 1) {
- binder_inner_proc_unlock(proc);
- binder_node_unlock(node);
- binder_free_node(node);
-
- return refs;
- }
-
- node->proc = NULL;
- node->local_strong_refs = 0;
- node->local_weak_refs = 0;
- binder_inner_proc_unlock(proc);
-
- spin_lock(&binder_dead_nodes_lock);
- hlist_add_head(&node->dead_node, &binder_dead_nodes);
- spin_unlock(&binder_dead_nodes_lock);
-
- hlist_for_each_entry(ref, &node->refs, node_entry) {
- refs++;
- /*
- * Need the node lock to synchronize
- * with new notification requests and the
- * inner lock to synchronize with queued
- * death notifications.
- */
- binder_inner_proc_lock(ref->proc);
- if (!ref->death) {
- binder_inner_proc_unlock(ref->proc);
- continue;
- }
-
- death++;
-
- BUG_ON(!list_empty(&ref->death->work.entry));
- ref->death->work.type = BINDER_WORK_DEAD_BINDER;
- binder_enqueue_work_ilocked(&ref->death->work,
- &ref->proc->todo);
- binder_wakeup_proc_ilocked(ref->proc);
- binder_inner_proc_unlock(ref->proc);
- }
-
- binder_debug(BINDER_DEBUG_DEAD_BINDER,
- "node %d now dead, refs %d, death %d\n",
- node->debug_id, refs, death);
- binder_node_unlock(node);
- binder_put_node(node);
-
- return refs;
-}
-
-static void binder_deferred_release(struct binder_proc *proc)
-{
- struct binder_context *context = proc->context;
- struct rb_node *n;
- int threads, nodes, incoming_refs, outgoing_refs, active_transactions;
-
- mutex_lock(&binder_procs_lock);
- hlist_del(&proc->proc_node);
- mutex_unlock(&binder_procs_lock);
-
- mutex_lock(&context->context_mgr_node_lock);
- if (context->binder_context_mgr_node &&
- context->binder_context_mgr_node->proc == proc) {
- binder_debug(BINDER_DEBUG_DEAD_BINDER,
- "%s: %d context_mgr_node gone\n",
- __func__, proc->pid);
- context->binder_context_mgr_node = NULL;
- }
- mutex_unlock(&context->context_mgr_node_lock);
- binder_inner_proc_lock(proc);
- /*
- * Make sure proc stays alive after we
- * remove all the threads
- */
- proc->tmp_ref++;
-
- proc->is_dead = true;
- proc->is_frozen = false;
- proc->sync_recv = false;
- proc->async_recv = false;
- threads = 0;
- active_transactions = 0;
- while ((n = rb_first(&proc->threads))) {
- struct binder_thread *thread;
-
- thread = rb_entry(n, struct binder_thread, rb_node);
- binder_inner_proc_unlock(proc);
- threads++;
- active_transactions += binder_thread_release(proc, thread);
- binder_inner_proc_lock(proc);
- }
-
- nodes = 0;
- incoming_refs = 0;
- while ((n = rb_first(&proc->nodes))) {
- struct binder_node *node;
-
- node = rb_entry(n, struct binder_node, rb_node);
- nodes++;
- /*
- * take a temporary ref on the node before
- * calling binder_node_release() which will either
- * kfree() the node or call binder_put_node()
- */
- binder_inc_node_tmpref_ilocked(node);
- rb_erase(&node->rb_node, &proc->nodes);
- binder_inner_proc_unlock(proc);
- incoming_refs = binder_node_release(node, incoming_refs);
- binder_inner_proc_lock(proc);
- }
- binder_inner_proc_unlock(proc);
-
- outgoing_refs = 0;
- binder_proc_lock(proc);
- while ((n = rb_first(&proc->refs_by_desc))) {
- struct binder_ref *ref;
-
- ref = rb_entry(n, struct binder_ref, rb_node_desc);
- outgoing_refs++;
- binder_cleanup_ref_olocked(ref);
- binder_proc_unlock(proc);
- binder_free_ref(ref);
- binder_proc_lock(proc);
- }
- binder_proc_unlock(proc);
-
- binder_release_work(proc, &proc->todo);
- binder_release_work(proc, &proc->delivered_death);
- binder_release_work(proc, &proc->delivered_freeze);
-
- binder_debug(BINDER_DEBUG_OPEN_CLOSE,
- "%s: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d\n",
- __func__, proc->pid, threads, nodes, incoming_refs,
- outgoing_refs, active_transactions);
-
- binder_proc_dec_tmpref(proc);
-}
-
-static void binder_deferred_func(struct work_struct *work)
-{
- struct binder_proc *proc;
-
- int defer;
-
- do {
- mutex_lock(&binder_deferred_lock);
- if (!hlist_empty(&binder_deferred_list)) {
- proc = hlist_entry(binder_deferred_list.first,
- struct binder_proc, deferred_work_node);
- hlist_del_init(&proc->deferred_work_node);
- defer = proc->deferred_work;
- proc->deferred_work = 0;
- } else {
- proc = NULL;
- defer = 0;
- }
- mutex_unlock(&binder_deferred_lock);
-
- if (defer & BINDER_DEFERRED_FLUSH)
- binder_deferred_flush(proc);
-
- if (defer & BINDER_DEFERRED_RELEASE)
- binder_deferred_release(proc); /* frees proc */
- } while (proc);
-}
-static DECLARE_WORK(binder_deferred_work, binder_deferred_func);
-
-static void
-binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer)
-{
- guard(mutex)(&binder_deferred_lock);
- proc->deferred_work |= defer;
- if (hlist_unhashed(&proc->deferred_work_node)) {
- hlist_add_head(&proc->deferred_work_node,
- &binder_deferred_list);
- schedule_work(&binder_deferred_work);
- }
-}
-
-static void print_binder_transaction_ilocked(struct seq_file *m,
- struct binder_proc *proc,
- const char *prefix,
- struct binder_transaction *t)
-{
- struct binder_proc *to_proc;
- struct binder_buffer *buffer = t->buffer;
- ktime_t current_time = ktime_get();
-
- spin_lock(&t->lock);
- to_proc = t->to_proc;
- seq_printf(m,
- "%s %d: %pK from %d:%d to %d:%d code %x flags %x pri %ld a%d r%d elapsed %lldms",
- prefix, t->debug_id, t,
- t->from_pid,
- t->from_tid,
- to_proc ? to_proc->pid : 0,
- t->to_thread ? t->to_thread->pid : 0,
- t->code, t->flags, t->priority, t->is_async, t->is_reply,
- ktime_ms_delta(current_time, t->start_time));
- spin_unlock(&t->lock);
-
- if (proc != to_proc) {
- /*
- * Can only safely deref buffer if we are holding the
- * correct proc inner lock for this node
- */
- seq_puts(m, "\n");
- return;
- }
-
- if (buffer == NULL) {
- seq_puts(m, " buffer free\n");
- return;
- }
- if (buffer->target_node)
- seq_printf(m, " node %d", buffer->target_node->debug_id);
- seq_printf(m, " size %zd:%zd offset %lx\n",
- buffer->data_size, buffer->offsets_size,
- buffer->user_data - proc->alloc.vm_start);
-}
-
-static void print_binder_work_ilocked(struct seq_file *m,
- struct binder_proc *proc,
- const char *prefix,
- const char *transaction_prefix,
- struct binder_work *w, bool hash_ptrs)
-{
- struct binder_node *node;
- struct binder_transaction *t;
-
- switch (w->type) {
- case BINDER_WORK_TRANSACTION:
- t = container_of(w, struct binder_transaction, work);
- print_binder_transaction_ilocked(
- m, proc, transaction_prefix, t);
- break;
- case BINDER_WORK_RETURN_ERROR: {
- struct binder_error *e = container_of(
- w, struct binder_error, work);
-
- seq_printf(m, "%stransaction error: %u\n",
- prefix, e->cmd);
- } break;
- case BINDER_WORK_TRANSACTION_COMPLETE:
- seq_printf(m, "%stransaction complete\n", prefix);
- break;
- case BINDER_WORK_NODE:
- node = container_of(w, struct binder_node, work);
- if (hash_ptrs)
- seq_printf(m, "%snode work %d: u%p c%p\n",
- prefix, node->debug_id,
- (void *)(long)node->ptr,
- (void *)(long)node->cookie);
- else
- seq_printf(m, "%snode work %d: u%016llx c%016llx\n",
- prefix, node->debug_id,
- (u64)node->ptr, (u64)node->cookie);
- break;
- case BINDER_WORK_DEAD_BINDER:
- seq_printf(m, "%shas dead binder\n", prefix);
- break;
- case BINDER_WORK_DEAD_BINDER_AND_CLEAR:
- seq_printf(m, "%shas cleared dead binder\n", prefix);
- break;
- case BINDER_WORK_CLEAR_DEATH_NOTIFICATION:
- seq_printf(m, "%shas cleared death notification\n", prefix);
- break;
- case BINDER_WORK_FROZEN_BINDER:
- seq_printf(m, "%shas frozen binder\n", prefix);
- break;
- case BINDER_WORK_CLEAR_FREEZE_NOTIFICATION:
- seq_printf(m, "%shas cleared freeze notification\n", prefix);
- break;
- default:
- seq_printf(m, "%sunknown work: type %d\n", prefix, w->type);
- break;
- }
-}
-
-static void print_binder_thread_ilocked(struct seq_file *m,
- struct binder_thread *thread,
- bool print_always, bool hash_ptrs)
-{
- struct binder_transaction *t;
- struct binder_work *w;
- size_t start_pos = m->count;
- size_t header_pos;
-
- seq_printf(m, " thread %d: l %02x need_return %d tr %d\n",
- thread->pid, thread->looper,
- thread->looper_need_return,
- atomic_read(&thread->tmp_ref));
- header_pos = m->count;
- t = thread->transaction_stack;
- while (t) {
- if (t->from == thread) {
- print_binder_transaction_ilocked(m, thread->proc,
- " outgoing transaction", t);
- t = t->from_parent;
- } else if (t->to_thread == thread) {
- print_binder_transaction_ilocked(m, thread->proc,
- " incoming transaction", t);
- t = t->to_parent;
- } else {
- print_binder_transaction_ilocked(m, thread->proc,
- " bad transaction", t);
- t = NULL;
- }
- }
- list_for_each_entry(w, &thread->todo, entry) {
- print_binder_work_ilocked(m, thread->proc, " ",
- " pending transaction",
- w, hash_ptrs);
- }
- if (!print_always && m->count == header_pos)
- m->count = start_pos;
-}
-
-static void print_binder_node_nilocked(struct seq_file *m,
- struct binder_node *node,
- bool hash_ptrs)
-{
- struct binder_ref *ref;
- struct binder_work *w;
- int count;
-
- count = hlist_count_nodes(&node->refs);
-
- if (hash_ptrs)
- seq_printf(m, " node %d: u%p c%p", node->debug_id,
- (void *)(long)node->ptr, (void *)(long)node->cookie);
- else
- seq_printf(m, " node %d: u%016llx c%016llx", node->debug_id,
- (u64)node->ptr, (u64)node->cookie);
- seq_printf(m, " hs %d hw %d ls %d lw %d is %d iw %d tr %d",
- node->has_strong_ref, node->has_weak_ref,
- node->local_strong_refs, node->local_weak_refs,
- node->internal_strong_refs, count, node->tmp_refs);
- if (count) {
- seq_puts(m, " proc");
- hlist_for_each_entry(ref, &node->refs, node_entry)
- seq_printf(m, " %d", ref->proc->pid);
- }
- seq_puts(m, "\n");
- if (node->proc) {
- list_for_each_entry(w, &node->async_todo, entry)
- print_binder_work_ilocked(m, node->proc, " ",
- " pending async transaction",
- w, hash_ptrs);
- }
-}
-
-static void print_binder_ref_olocked(struct seq_file *m,
- struct binder_ref *ref)
-{
- binder_node_lock(ref->node);
- seq_printf(m, " ref %d: desc %d %snode %d s %d w %d d %pK\n",
- ref->data.debug_id, ref->data.desc,
- ref->node->proc ? "" : "dead ",
- ref->node->debug_id, ref->data.strong,
- ref->data.weak, ref->death);
- binder_node_unlock(ref->node);
-}
-
-/**
- * print_next_binder_node_ilocked() - Print binder_node from a locked list
- * @m: struct seq_file for output via seq_printf()
- * @proc: struct binder_proc we hold the inner_proc_lock to (if any)
- * @node: struct binder_node to print fields of
- * @prev_node: struct binder_node we hold a temporary reference to (if any)
- * @hash_ptrs: whether to hash @node's binder_uintptr_t fields
- *
- * Helper function to handle synchronization around printing a struct
- * binder_node while iterating through @proc->nodes or the dead nodes list.
- * Caller must hold either @proc->inner_lock (for live nodes) or
- * binder_dead_nodes_lock. This lock will be released during the body of this
- * function, but it will be reacquired before returning to the caller.
- *
- * Return: pointer to the struct binder_node we hold a tmpref on
- */
-static struct binder_node *
-print_next_binder_node_ilocked(struct seq_file *m, struct binder_proc *proc,
- struct binder_node *node,
- struct binder_node *prev_node, bool hash_ptrs)
-{
- /*
- * Take a temporary reference on the node so that isn't freed while
- * we print it.
- */
- binder_inc_node_tmpref_ilocked(node);
- /*
- * Live nodes need to drop the inner proc lock and dead nodes need to
- * drop the binder_dead_nodes_lock before trying to take the node lock.
- */
- if (proc)
- binder_inner_proc_unlock(proc);
- else
- spin_unlock(&binder_dead_nodes_lock);
- if (prev_node)
- binder_put_node(prev_node);
- binder_node_inner_lock(node);
- print_binder_node_nilocked(m, node, hash_ptrs);
- binder_node_inner_unlock(node);
- if (proc)
- binder_inner_proc_lock(proc);
- else
- spin_lock(&binder_dead_nodes_lock);
- return node;
-}
-
-static void print_binder_proc(struct seq_file *m, struct binder_proc *proc,
- bool print_all, bool hash_ptrs)
-{
- struct binder_work *w;
- struct rb_node *n;
- size_t start_pos = m->count;
- size_t header_pos;
- struct binder_node *last_node = NULL;
-
- seq_printf(m, "proc %d\n", proc->pid);
- seq_printf(m, "context %s\n", proc->context->name);
- header_pos = m->count;
-
- binder_inner_proc_lock(proc);
- for (n = rb_first(&proc->threads); n; n = rb_next(n))
- print_binder_thread_ilocked(m, rb_entry(n, struct binder_thread,
- rb_node), print_all, hash_ptrs);
-
- for (n = rb_first(&proc->nodes); n; n = rb_next(n)) {
- struct binder_node *node = rb_entry(n, struct binder_node,
- rb_node);
- if (!print_all && !node->has_async_transaction)
- continue;
-
- last_node = print_next_binder_node_ilocked(m, proc, node,
- last_node,
- hash_ptrs);
- }
- binder_inner_proc_unlock(proc);
- if (last_node)
- binder_put_node(last_node);
-
- if (print_all) {
- binder_proc_lock(proc);
- for (n = rb_first(&proc->refs_by_desc); n; n = rb_next(n))
- print_binder_ref_olocked(m, rb_entry(n,
- struct binder_ref,
- rb_node_desc));
- binder_proc_unlock(proc);
- }
- binder_alloc_print_allocated(m, &proc->alloc);
- binder_inner_proc_lock(proc);
- list_for_each_entry(w, &proc->todo, entry)
- print_binder_work_ilocked(m, proc, " ",
- " pending transaction", w,
- hash_ptrs);
- list_for_each_entry(w, &proc->delivered_death, entry) {
- seq_puts(m, " has delivered dead binder\n");
- break;
- }
- list_for_each_entry(w, &proc->delivered_freeze, entry) {
- seq_puts(m, " has delivered freeze binder\n");
- break;
- }
- binder_inner_proc_unlock(proc);
- if (!print_all && m->count == header_pos)
- m->count = start_pos;
-}
-
-static const char * const binder_return_strings[] = {
- "BR_ERROR",
- "BR_OK",
- "BR_TRANSACTION",
- "BR_REPLY",
- "BR_ACQUIRE_RESULT",
- "BR_DEAD_REPLY",
- "BR_TRANSACTION_COMPLETE",
- "BR_INCREFS",
- "BR_ACQUIRE",
- "BR_RELEASE",
- "BR_DECREFS",
- "BR_ATTEMPT_ACQUIRE",
- "BR_NOOP",
- "BR_SPAWN_LOOPER",
- "BR_FINISHED",
- "BR_DEAD_BINDER",
- "BR_CLEAR_DEATH_NOTIFICATION_DONE",
- "BR_FAILED_REPLY",
- "BR_FROZEN_REPLY",
- "BR_ONEWAY_SPAM_SUSPECT",
- "BR_TRANSACTION_PENDING_FROZEN",
- "BR_FROZEN_BINDER",
- "BR_CLEAR_FREEZE_NOTIFICATION_DONE",
-};
-
-static const char * const binder_command_strings[] = {
- "BC_TRANSACTION",
- "BC_REPLY",
- "BC_ACQUIRE_RESULT",
- "BC_FREE_BUFFER",
- "BC_INCREFS",
- "BC_ACQUIRE",
- "BC_RELEASE",
- "BC_DECREFS",
- "BC_INCREFS_DONE",
- "BC_ACQUIRE_DONE",
- "BC_ATTEMPT_ACQUIRE",
- "BC_REGISTER_LOOPER",
- "BC_ENTER_LOOPER",
- "BC_EXIT_LOOPER",
- "BC_REQUEST_DEATH_NOTIFICATION",
- "BC_CLEAR_DEATH_NOTIFICATION",
- "BC_DEAD_BINDER_DONE",
- "BC_TRANSACTION_SG",
- "BC_REPLY_SG",
- "BC_REQUEST_FREEZE_NOTIFICATION",
- "BC_CLEAR_FREEZE_NOTIFICATION",
- "BC_FREEZE_NOTIFICATION_DONE",
-};
-
-static const char * const binder_objstat_strings[] = {
- "proc",
- "thread",
- "node",
- "ref",
- "death",
- "transaction",
- "transaction_complete",
- "freeze",
-};
-
-static void print_binder_stats(struct seq_file *m, const char *prefix,
- struct binder_stats *stats)
-{
- int i;
-
- BUILD_BUG_ON(ARRAY_SIZE(stats->bc) !=
- ARRAY_SIZE(binder_command_strings));
- for (i = 0; i < ARRAY_SIZE(stats->bc); i++) {
- int temp = atomic_read(&stats->bc[i]);
-
- if (temp)
- seq_printf(m, "%s%s: %d\n", prefix,
- binder_command_strings[i], temp);
- }
-
- BUILD_BUG_ON(ARRAY_SIZE(stats->br) !=
- ARRAY_SIZE(binder_return_strings));
- for (i = 0; i < ARRAY_SIZE(stats->br); i++) {
- int temp = atomic_read(&stats->br[i]);
-
- if (temp)
- seq_printf(m, "%s%s: %d\n", prefix,
- binder_return_strings[i], temp);
- }
-
- BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) !=
- ARRAY_SIZE(binder_objstat_strings));
- BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) !=
- ARRAY_SIZE(stats->obj_deleted));
- for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) {
- int created = atomic_read(&stats->obj_created[i]);
- int deleted = atomic_read(&stats->obj_deleted[i]);
-
- if (created || deleted)
- seq_printf(m, "%s%s: active %d total %d\n",
- prefix,
- binder_objstat_strings[i],
- created - deleted,
- created);
- }
-}
-
-static void print_binder_proc_stats(struct seq_file *m,
- struct binder_proc *proc)
-{
- struct binder_work *w;
- struct binder_thread *thread;
- struct rb_node *n;
- int count, strong, weak, ready_threads;
- size_t free_async_space =
- binder_alloc_get_free_async_space(&proc->alloc);
-
- seq_printf(m, "proc %d\n", proc->pid);
- seq_printf(m, "context %s\n", proc->context->name);
- count = 0;
- ready_threads = 0;
- binder_inner_proc_lock(proc);
- for (n = rb_first(&proc->threads); n; n = rb_next(n))
- count++;
-
- list_for_each_entry(thread, &proc->waiting_threads, waiting_thread_node)
- ready_threads++;
-
- seq_printf(m, " threads: %d\n", count);
- seq_printf(m, " requested threads: %d+%d/%d\n"
- " ready threads %d\n"
- " free async space %zd\n", proc->requested_threads,
- proc->requested_threads_started, proc->max_threads,
- ready_threads,
- free_async_space);
- count = 0;
- for (n = rb_first(&proc->nodes); n; n = rb_next(n))
- count++;
- binder_inner_proc_unlock(proc);
- seq_printf(m, " nodes: %d\n", count);
- count = 0;
- strong = 0;
- weak = 0;
- binder_proc_lock(proc);
- for (n = rb_first(&proc->refs_by_desc); n; n = rb_next(n)) {
- struct binder_ref *ref = rb_entry(n, struct binder_ref,
- rb_node_desc);
- count++;
- strong += ref->data.strong;
- weak += ref->data.weak;
- }
- binder_proc_unlock(proc);
- seq_printf(m, " refs: %d s %d w %d\n", count, strong, weak);
-
- count = binder_alloc_get_allocated_count(&proc->alloc);
- seq_printf(m, " buffers: %d\n", count);
-
- binder_alloc_print_pages(m, &proc->alloc);
-
- count = 0;
- binder_inner_proc_lock(proc);
- list_for_each_entry(w, &proc->todo, entry) {
- if (w->type == BINDER_WORK_TRANSACTION)
- count++;
- }
- binder_inner_proc_unlock(proc);
- seq_printf(m, " pending transactions: %d\n", count);
-
- print_binder_stats(m, " ", &proc->stats);
-}
-
-static void print_binder_state(struct seq_file *m, bool hash_ptrs)
-{
- struct binder_proc *proc;
- struct binder_node *node;
- struct binder_node *last_node = NULL;
-
- seq_puts(m, "binder state:\n");
-
- spin_lock(&binder_dead_nodes_lock);
- if (!hlist_empty(&binder_dead_nodes))
- seq_puts(m, "dead nodes:\n");
- hlist_for_each_entry(node, &binder_dead_nodes, dead_node)
- last_node = print_next_binder_node_ilocked(m, NULL, node,
- last_node,
- hash_ptrs);
- spin_unlock(&binder_dead_nodes_lock);
- if (last_node)
- binder_put_node(last_node);
-
- mutex_lock(&binder_procs_lock);
- hlist_for_each_entry(proc, &binder_procs, proc_node)
- print_binder_proc(m, proc, true, hash_ptrs);
- mutex_unlock(&binder_procs_lock);
-}
-
-static void print_binder_transactions(struct seq_file *m, bool hash_ptrs)
-{
- struct binder_proc *proc;
-
- seq_puts(m, "binder transactions:\n");
- mutex_lock(&binder_procs_lock);
- hlist_for_each_entry(proc, &binder_procs, proc_node)
- print_binder_proc(m, proc, false, hash_ptrs);
- mutex_unlock(&binder_procs_lock);
-}
-
-static int state_show(struct seq_file *m, void *unused)
-{
- print_binder_state(m, false);
- return 0;
-}
-
-static int state_hashed_show(struct seq_file *m, void *unused)
-{
- print_binder_state(m, true);
- return 0;
-}
-
-static int stats_show(struct seq_file *m, void *unused)
-{
- struct binder_proc *proc;
-
- seq_puts(m, "binder stats:\n");
-
- print_binder_stats(m, "", &binder_stats);
-
- mutex_lock(&binder_procs_lock);
- hlist_for_each_entry(proc, &binder_procs, proc_node)
- print_binder_proc_stats(m, proc);
- mutex_unlock(&binder_procs_lock);
-
- return 0;
-}
-
-static int transactions_show(struct seq_file *m, void *unused)
-{
- print_binder_transactions(m, false);
- return 0;
-}
-
-static int transactions_hashed_show(struct seq_file *m, void *unused)
-{
- print_binder_transactions(m, true);
- return 0;
-}
-
-static int proc_show(struct seq_file *m, void *unused)
-{
- struct binder_proc *itr;
- int pid = (unsigned long)m->private;
-
- guard(mutex)(&binder_procs_lock);
- hlist_for_each_entry(itr, &binder_procs, proc_node) {
- if (itr->pid == pid) {
- seq_puts(m, "binder proc state:\n");
- print_binder_proc(m, itr, true, false);
- }
- }
-
- return 0;
-}
-
-static void print_binder_transaction_log_entry(struct seq_file *m,
- struct binder_transaction_log_entry *e)
-{
- int debug_id = READ_ONCE(e->debug_id_done);
- /*
- * read barrier to guarantee debug_id_done read before
- * we print the log values
- */
- smp_rmb();
- seq_printf(m,
- "%d: %s from %d:%d to %d:%d context %s node %d handle %d size %d:%d ret %d/%d l=%d",
- e->debug_id, (e->call_type == 2) ? "reply" :
- ((e->call_type == 1) ? "async" : "call "), e->from_proc,
- e->from_thread, e->to_proc, e->to_thread, e->context_name,
- e->to_node, e->target_handle, e->data_size, e->offsets_size,
- e->return_error, e->return_error_param,
- e->return_error_line);
- /*
- * read-barrier to guarantee read of debug_id_done after
- * done printing the fields of the entry
- */
- smp_rmb();
- seq_printf(m, debug_id && debug_id == READ_ONCE(e->debug_id_done) ?
- "\n" : " (incomplete)\n");
-}
-
-static int transaction_log_show(struct seq_file *m, void *unused)
-{
- struct binder_transaction_log *log = m->private;
- unsigned int log_cur = atomic_read(&log->cur);
- unsigned int count;
- unsigned int cur;
- int i;
-
- count = log_cur + 1;
- cur = count < ARRAY_SIZE(log->entry) && !log->full ?
- 0 : count % ARRAY_SIZE(log->entry);
- if (count > ARRAY_SIZE(log->entry) || log->full)
- count = ARRAY_SIZE(log->entry);
- for (i = 0; i < count; i++) {
- unsigned int index = cur++ % ARRAY_SIZE(log->entry);
-
- print_binder_transaction_log_entry(m, &log->entry[index]);
- }
- return 0;
-}
-
-const struct file_operations binder_fops = {
- .owner = THIS_MODULE,
- .poll = binder_poll,
- .unlocked_ioctl = binder_ioctl,
- .compat_ioctl = compat_ptr_ioctl,
- .mmap = binder_mmap,
- .open = binder_open,
- .flush = binder_flush,
- .release = binder_release,
-};
-
-DEFINE_SHOW_ATTRIBUTE(state);
-DEFINE_SHOW_ATTRIBUTE(state_hashed);
-DEFINE_SHOW_ATTRIBUTE(stats);
-DEFINE_SHOW_ATTRIBUTE(transactions);
-DEFINE_SHOW_ATTRIBUTE(transactions_hashed);
-DEFINE_SHOW_ATTRIBUTE(transaction_log);
-
-const struct binder_debugfs_entry binder_debugfs_entries[] = {
- {
- .name = "state",
- .mode = 0444,
- .fops = &state_fops,
- .data = NULL,
- },
- {
- .name = "state_hashed",
- .mode = 0444,
- .fops = &state_hashed_fops,
- .data = NULL,
- },
- {
- .name = "stats",
- .mode = 0444,
- .fops = &stats_fops,
- .data = NULL,
- },
- {
- .name = "transactions",
- .mode = 0444,
- .fops = &transactions_fops,
- .data = NULL,
- },
- {
- .name = "transactions_hashed",
- .mode = 0444,
- .fops = &transactions_hashed_fops,
- .data = NULL,
- },
- {
- .name = "transaction_log",
- .mode = 0444,
- .fops = &transaction_log_fops,
- .data = &binder_transaction_log,
- },
- {
- .name = "failed_transaction_log",
- .mode = 0444,
- .fops = &transaction_log_fops,
- .data = &binder_transaction_log_failed,
- },
- {} /* terminator */
-};
-
-void binder_add_device(struct binder_device *device)
-{
- guard(spinlock)(&binder_devices_lock);
- hlist_add_head(&device->hlist, &binder_devices);
-}
-
-void binder_remove_device(struct binder_device *device)
-{
- guard(spinlock)(&binder_devices_lock);
- hlist_del_init(&device->hlist);
-}
-
-static int __init init_binder_device(const char *name)
-{
- int ret;
- struct binder_device *binder_device;
-
- binder_device = kzalloc_obj(*binder_device);
- if (!binder_device)
- return -ENOMEM;
-
- binder_device->miscdev.fops = &binder_fops;
- binder_device->miscdev.minor = MISC_DYNAMIC_MINOR;
- binder_device->miscdev.name = name;
-
- refcount_set(&binder_device->ref, 1);
- binder_device->context.binder_context_mgr_uid = INVALID_UID;
- binder_device->context.name = name;
- mutex_init(&binder_device->context.context_mgr_node_lock);
-
- ret = misc_register(&binder_device->miscdev);
- if (ret < 0) {
- kfree(binder_device);
- return ret;
- }
-
- binder_add_device(binder_device);
-
- return ret;
-}
-
-static int __init binder_init(void)
-{
- int ret;
- char *device_name, *device_tmp;
- struct binder_device *device;
- struct hlist_node *tmp;
- char *device_names = NULL;
- const struct binder_debugfs_entry *db_entry;
-
- ret = binder_alloc_shrinker_init();
- if (ret)
- return ret;
-
- atomic_set(&binder_transaction_log.cur, ~0U);
- atomic_set(&binder_transaction_log_failed.cur, ~0U);
-
- binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL);
-
- binder_for_each_debugfs_entry(db_entry)
- debugfs_create_file(db_entry->name,
- db_entry->mode,
- binder_debugfs_dir_entry_root,
- db_entry->data,
- db_entry->fops);
-
- binder_debugfs_dir_entry_proc = debugfs_create_dir("proc",
- binder_debugfs_dir_entry_root);
-
- if (!IS_ENABLED(CONFIG_ANDROID_BINDERFS) &&
- strcmp(binder_devices_param, "") != 0) {
- /*
- * Copy the module_parameter string, because we don't want to
- * tokenize it in-place.
- */
- device_names = kstrdup(binder_devices_param, GFP_KERNEL);
- if (!device_names) {
- ret = -ENOMEM;
- goto err_alloc_device_names_failed;
- }
-
- device_tmp = device_names;
- while ((device_name = strsep(&device_tmp, ","))) {
- ret = init_binder_device(device_name);
- if (ret)
- goto err_init_binder_device_failed;
- }
- }
-
- ret = genl_register_family(&binder_nl_family);
- if (ret)
- goto err_init_binder_device_failed;
-
- ret = init_binderfs();
- if (ret)
- goto err_init_binderfs_failed;
-
- return ret;
-
-err_init_binderfs_failed:
- genl_unregister_family(&binder_nl_family);
-
-err_init_binder_device_failed:
- hlist_for_each_entry_safe(device, tmp, &binder_devices, hlist) {
- misc_deregister(&device->miscdev);
- binder_remove_device(device);
- kfree(device);
- }
-
- kfree(device_names);
-
-err_alloc_device_names_failed:
- debugfs_remove_recursive(binder_debugfs_dir_entry_root);
- binder_alloc_shrinker_exit();
-
- return ret;
-}
-
-device_initcall(binder_init);
-
-#define CREATE_TRACE_POINTS
-#include "binder_trace.h"
diff --git a/drivers/android/binder/Makefile b/drivers/android/binder/Makefile
index 7e0cd9782a8b..fe474628a94e 100644
--- a/drivers/android/binder/Makefile
+++ b/drivers/android/binder/Makefile
@@ -1,8 +1,8 @@
# SPDX-License-Identifier: GPL-2.0-only
ccflags-y += -I$(src) # needed for trace events
-obj-$(CONFIG_ANDROID_BINDER_IPC_RUST) += rust_binder.o
-rust_binder-y := \
+obj-$(CONFIG_ANDROID_BINDER_IPC_RUST) += binder.o
+binder-y := \
rust_binder_main.o \
rust_binderfs.o \
rust_binder_events.o
diff --git a/drivers/android/binder/allocation.rs b/drivers/android/binder/allocation.rs
index 8151ba3ea7f4..927bf47d5d20 100644
--- a/drivers/android/binder/allocation.rs
+++ b/drivers/android/binder/allocation.rs
@@ -20,6 +20,7 @@
defs::*,
node::{Node, NodeRef},
process::Process,
+ trace::trace_transaction_failed_buffer_release,
DArc,
};
@@ -208,7 +209,7 @@ pub(crate) fn translate_fds(&mut self) -> Result {
let num_close_on_free = files.iter().filter(|entry| entry.close_on_free).count();
let mut close_on_free = KVec::with_capacity(num_close_on_free, GFP_KERNEL)?;
- let mut reservations = KVec::with_capacity(files.len(), GFP_KERNEL)?;
+ let mut reservations = KVVec::with_capacity(files.len(), GFP_KERNEL)?;
for file_info in files {
let res = FileDescriptorReservation::get_unused_fd_flags(bindings::O_CLOEXEC)?;
let fd = res.reserved_fd();
@@ -325,6 +326,12 @@ fn deref_mut(&mut self) -> &mut Allocation {
}
}
+impl Drop for NewAllocation {
+ fn drop(&mut self) {
+ trace_transaction_failed_buffer_release(self.debug_id);
+ }
+}
+
/// A view into the beginning of an allocation.
///
/// All attempts to read or write outside of the view will fail. To intentionally access outside of
@@ -503,7 +510,7 @@ pub(crate) fn read_from(reader: &mut UserSliceReader) -> Result {
/// The closure should write the bytes for the object into the provided slice.
pub(crate) fn read_from_inner(reader: R) -> Result
where
- R: FnOnce(&mut [u8; size_of::()]) -> Result<()>,
+ R: FnOnce(&mut [u8; size_of::()]) -> Result,
{
let mut obj = MaybeUninit::::zeroed();
@@ -567,7 +574,7 @@ fn type_to_size(type_: u32) -> Option {
#[derive(Default)]
struct FileList {
- files_to_translate: KVec,
+ files_to_translate: KVVec,
close_on_free: KVec,
}
@@ -581,7 +588,7 @@ struct FileEntry {
}
pub(crate) struct TranslatedFds {
- reservations: KVec,
+ reservations: KVVec,
/// If commit is called, then these fds should be closed. (If commit is not called, then they
/// shouldn't be closed.)
close_on_free: FdsCloseOnFree,
@@ -595,7 +602,7 @@ struct Reservation {
impl TranslatedFds {
pub(crate) fn new() -> Self {
Self {
- reservations: KVec::new(),
+ reservations: KVVec::new(),
close_on_free: FdsCloseOnFree(KVec::new()),
}
}
diff --git a/drivers/android/binder/context.rs b/drivers/android/binder/context.rs
index 431d6007a9b1..927b65ada836 100644
--- a/drivers/android/binder/context.rs
+++ b/drivers/android/binder/context.rs
@@ -134,13 +134,13 @@ pub(crate) fn unset_manager_node(&self) {
}
pub(crate) fn get_manager_node(&self, strong: bool) -> Result {
- self.manager
+ Ok(self
+ .manager
.lock()
.node
.as_ref()
- .ok_or_else(BinderError::new_dead)?
- .clone(strong)
- .map_err(BinderError::from)
+ .ok_or_else(|| BinderError::new_dead())?
+ .clone(strong)?)
}
pub(crate) fn for_each_proc(&self, mut func: F)
diff --git a/drivers/android/binder/defs.rs b/drivers/android/binder/defs.rs
index 8ac9bdd7a499..cc4becd6e168 100644
--- a/drivers/android/binder/defs.rs
+++ b/drivers/android/binder/defs.rs
@@ -77,7 +77,8 @@ macro_rules! pub_no_prefix {
TF_ONE_WAY,
TF_ACCEPT_FDS,
TF_CLEAR_BUF,
- TF_UPDATE_TXN
+ TF_UPDATE_TXN,
+ TF_DEFER_COMPLETE,
);
pub(crate) use uapi::{
diff --git a/drivers/android/binder/error.rs b/drivers/android/binder/error.rs
index 1296072c35d9..89077c5baeaf 100644
--- a/drivers/android/binder/error.rs
+++ b/drivers/android/binder/error.rs
@@ -2,6 +2,7 @@
// Copyright (C) 2025 Google LLC.
+use core::panic::Location;
use kernel::fmt;
use kernel::prelude::*;
@@ -9,62 +10,96 @@
pub(crate) type BinderResult = core::result::Result;
+/// Wraps a `&'static Location` to format it as `filename.rs:line` without the directory prefix.
+#[derive(Copy, Clone)]
+#[repr(transparent)]
+pub(crate) struct ErrorLocation(&'static Location<'static>);
+
+// SAFETY: `ErrorLocation` is `repr(transparent)` over a shared reference, which is part of the
+// option layout optimization guarantee, so all zeroes is a valid representation for `None`.
+unsafe impl pin_init::ZeroableOption for ErrorLocation {}
+
+impl ErrorLocation {
+ #[track_caller]
+ pub(crate) const fn caller() -> Self {
+ Self(Location::caller())
+ }
+}
+
+impl fmt::Display for ErrorLocation {
+ fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+ let file = match self.0.file().rsplit_once('/') {
+ Some((_, file)) => file,
+ None => self.0.file(),
+ };
+ write!(f, "{}:{}", file, self.0.line())
+ }
+}
+
/// An error that will be returned to userspace via the `BINDER_WRITE_READ` ioctl rather than via
/// errno.
pub(crate) struct BinderError {
pub(crate) reply: u32,
pub(crate) source: Option,
+ pub(crate) line: ErrorLocation,
}
impl BinderError {
+ #[track_caller]
pub(crate) fn new_dead() -> Self {
Self {
reply: BR_DEAD_REPLY,
source: None,
+ line: ErrorLocation::caller(),
}
}
+ #[track_caller]
pub(crate) fn new_frozen() -> Self {
Self {
reply: BR_FROZEN_REPLY,
source: None,
+ line: ErrorLocation::caller(),
}
}
+ #[track_caller]
pub(crate) fn new_frozen_oneway() -> Self {
Self {
reply: BR_TRANSACTION_PENDING_FROZEN,
source: None,
+ line: ErrorLocation::caller(),
}
}
-
- pub(crate) fn is_dead(&self) -> bool {
- self.reply == BR_DEAD_REPLY
- }
}
/// Convert an errno into a `BinderError` and store the errno used to construct it. The errno
/// should be stored as the thread's extended error when given to userspace.
impl From for BinderError {
+ #[track_caller]
fn from(source: Error) -> Self {
Self {
reply: BR_FAILED_REPLY,
source: Some(source),
+ line: ErrorLocation::caller(),
}
}
}
impl From for BinderError {
+ #[track_caller]
fn from(source: kernel::fs::file::BadFdError) -> Self {
BinderError::from(Error::from(source))
}
}
impl From for BinderError {
+ #[track_caller]
fn from(_: kernel::alloc::AllocError) -> Self {
Self {
reply: BR_FAILED_REPLY,
source: Some(ENOMEM),
+ line: ErrorLocation::caller(),
}
}
}
diff --git a/drivers/android/binder/freeze.rs b/drivers/android/binder/freeze.rs
index 7fbde3345ced..69e058e6d818 100644
--- a/drivers/android/binder/freeze.rs
+++ b/drivers/android/binder/freeze.rs
@@ -75,10 +75,8 @@ fn new(flags: kernel::alloc::Flags) -> Result {
}
fn init(ua: UninitFM, cookie: FreezeCookie, pid: i32) -> DLArc {
- match ua.pin_init_with(DTRWrap::new(FreezeMessage { cookie, pid })) {
- Ok(msg) => ListArc::from(msg),
- Err(err) => match err {},
- }
+ let Ok(msg) = ua.pin_init_with(DTRWrap::new(FreezeMessage { cookie, pid }));
+ ListArc::from(msg)
}
}
@@ -155,7 +153,7 @@ fn should_sync_wakeup(&self) -> bool {
}
#[inline(never)]
- fn debug_print(&self, m: &SeqFile, prefix: &str, _tprefix: &str) -> Result<()> {
+ fn debug_print(&self, m: &SeqFile, prefix: &str, _tprefix: &str) -> Result {
seq_print!(m, "{}has frozen binder\n", prefix);
Ok(())
}
@@ -177,10 +175,7 @@ pub(crate) fn on_process_cleanup(&self, proc: &Process) -> KVVec> {
}
impl Process {
- pub(crate) fn request_freeze_notif(
- self: &Arc,
- reader: &mut UserSliceReader,
- ) -> Result<()> {
+ pub(crate) fn request_freeze_notif(self: &Arc, reader: &mut UserSliceReader) -> Result {
let hc = reader.read::()?;
let handle = hc.handle;
let cookie = FreezeCookie(hc.cookie);
@@ -272,7 +267,7 @@ pub(crate) fn request_freeze_notif(
Ok(())
}
- pub(crate) fn freeze_notif_done(self: &Arc, reader: &mut UserSliceReader) -> Result<()> {
+ pub(crate) fn freeze_notif_done(self: &Arc, reader: &mut UserSliceReader) -> Result {
let cookie = FreezeCookie(reader.read()?);
let alloc = FreezeMessage::new(GFP_KERNEL)?;
let mut node_refs_guard = self.node_refs.lock();
@@ -313,7 +308,7 @@ pub(crate) fn freeze_notif_done(self: &Arc, reader: &mut UserSliceReader)
Ok(())
}
- pub(crate) fn clear_freeze_notif(self: &Arc, reader: &mut UserSliceReader) -> Result<()> {
+ pub(crate) fn clear_freeze_notif(self: &Arc, reader: &mut UserSliceReader) -> Result {
let hc = reader.read::()?;
let handle = hc.handle;
let cookie = FreezeCookie(hc.cookie);
diff --git a/drivers/android/binder/node.rs b/drivers/android/binder/node.rs
index 0c625a25cb73..efdafc202e27 100644
--- a/drivers/android/binder/node.rs
+++ b/drivers/android/binder/node.rs
@@ -255,11 +255,7 @@ pub(crate) fn has_oneway_transaction(&self, owner_inner: &mut ProcessInner) -> b
}
#[inline(never)]
- pub(crate) fn full_debug_print(
- &self,
- m: &SeqFile,
- owner_inner: &mut ProcessInner,
- ) -> Result<()> {
+ pub(crate) fn full_debug_print(&self, m: &SeqFile, owner_inner: &mut ProcessInner) -> Result {
let inner = self.inner.access_mut(owner_inner);
seq_print!(
m,
@@ -759,7 +755,7 @@ fn should_sync_wakeup(&self) -> bool {
}
#[inline(never)]
- fn debug_print(&self, m: &SeqFile, prefix: &str, _tprefix: &str) -> Result<()> {
+ fn debug_print(&self, m: &SeqFile, prefix: &str, _tprefix: &str) -> Result {
seq_print!(
m,
"{}node work {}: u{:016x} c{:016x}\n",
@@ -1154,7 +1150,7 @@ fn should_sync_wakeup(&self) -> bool {
}
#[inline(never)]
- fn debug_print(&self, m: &SeqFile, prefix: &str, _tprefix: &str) -> Result<()> {
+ fn debug_print(&self, m: &SeqFile, prefix: &str, _tprefix: &str) -> Result {
let inner = self.inner.lock();
let dead_binder = inner.dead && !inner.notification_done;
diff --git a/drivers/android/binder/node/wrapper.rs b/drivers/android/binder/node/wrapper.rs
index 886626ca0d42..edfbccf6e6da 100644
--- a/drivers/android/binder/node/wrapper.rs
+++ b/drivers/android/binder/node/wrapper.rs
@@ -20,10 +20,8 @@ pub(crate) fn new() -> Result {
}
pub(super) fn init(self, node: DArc) -> DLArc {
- match self.inner.pin_init_with(DTRWrap::new(NodeWrapper { node })) {
- Ok(initialized) => ListArc::from(initialized) as DLArc,
- Err(err) => match err {},
- }
+ let Ok(initialized) = self.inner.pin_init_with(DTRWrap::new(NodeWrapper { node }));
+ ListArc::from(initialized) as DLArc
}
}
@@ -96,7 +94,7 @@ fn should_sync_wakeup(&self) -> bool {
}
#[inline(never)]
- fn debug_print(&self, m: &SeqFile, prefix: &str, _tprefix: &str) -> Result<()> {
+ fn debug_print(&self, m: &SeqFile, prefix: &str, _tprefix: &str) -> Result {
seq_print!(
m,
"{}node work {}: u{:016x} c{:016x}\n",
diff --git a/drivers/android/binder/page_range.rs b/drivers/android/binder/page_range.rs
index e2d46b4d1a29..b0c797523bc2 100644
--- a/drivers/android/binder/page_range.rs
+++ b/drivers/android/binder/page_range.rs
@@ -66,7 +66,7 @@ impl Shrinker {
}
/// Register this shrinker with the kernel.
- pub(crate) fn register(&'static self, name: &CStr) -> Result<()> {
+ pub(crate) fn register(&'static self, name: &CStr) -> Result {
// SAFETY: These fields are not yet used, so it's okay to zero them.
unsafe {
self.inner.get().write(ptr::null_mut());
@@ -352,7 +352,7 @@ pub(crate) fn register_with_vma(&self, vma: &virt::VmaNew) -> Result {
/// Make sure that the given pages are allocated and mapped.
///
/// Must not be called from an atomic context.
- pub(crate) fn use_range(&self, start: usize, end: usize) -> Result<()> {
+ pub(crate) fn use_range(&self, start: usize, end: usize) -> Result {
if start >= end {
return Ok(());
}
@@ -398,7 +398,7 @@ pub(crate) fn use_range(&self, start: usize, end: usize) -> Result<()> {
///
/// Assumes that `i` is in bounds.
#[cold]
- unsafe fn use_page_slow(&self, i: usize) -> Result<()> {
+ unsafe fn use_page_slow(&self, i: usize) -> Result {
let new_page = Page::alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO)?;
let mm_mutex = self.mm_lock.lock();
diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs
index 65f719e46c3e..a2216c8f9648 100644
--- a/drivers/android/binder/process.rs
+++ b/drivers/android/binder/process.rs
@@ -548,7 +548,7 @@ pub(crate) fn pid_in_current_ns(&self) -> kernel::task::Pid {
}
#[inline(never)]
- pub(crate) fn debug_print_stats(&self, m: &SeqFile, ctx: &Context) -> Result<()> {
+ pub(crate) fn debug_print_stats(&self, m: &SeqFile, ctx: &Context) -> Result {
seq_print!(m, "proc {}\n", self.pid_in_current_ns());
seq_print!(m, "context {}\n", &*ctx.name);
@@ -596,7 +596,7 @@ pub(crate) fn debug_print_stats(&self, m: &SeqFile, ctx: &Context) -> Result<()>
}
#[inline(never)]
- pub(crate) fn debug_print(&self, m: &SeqFile, ctx: &Context, print_all: bool) -> Result<()> {
+ pub(crate) fn debug_print(&self, m: &SeqFile, ctx: &Context, print_all: bool) -> Result {
seq_print!(m, "proc {}\n", self.pid_in_current_ns());
seq_print!(m, "context {}\n", &*ctx.name);
@@ -686,8 +686,16 @@ pub(crate) fn get_work(&self) -> Option> {
pub(crate) fn get_work_or_register<'a>(
&'a self,
thread: &'a Arc,
+ thread_has_deferred_work: bool,
) -> GetWorkOrRegister<'a> {
let mut inner = self.inner.lock();
+
+ if thread_has_deferred_work && !inner.work.is_empty() {
+ if let Some(work) = thread.pop_work_even_if_deferred() {
+ return GetWorkOrRegister::Work(work);
+ }
+ }
+
// Try to get work from the process queue.
if let Some(work) = inner.work.pop_front() {
return GetWorkOrRegister::Work(work);
@@ -894,11 +902,8 @@ pub(crate) fn insert_or_update_handle(
let (info_proc, info_node) = {
let info_init = NodeRefInfo::new(node_ref, handle, self.into());
- match info.pin_init_with(info_init) {
- Ok(info) => ListArc::pair_from_pin_unique(info),
- // error is infallible
- Err(err) => match err {},
- }
+ let Ok(info) = info.pin_init_with(info_init);
+ ListArc::pair_from_pin_unique(info)
};
// Ensure the process is still alive while we insert a new reference.
@@ -1068,7 +1073,10 @@ pub(crate) fn buffer_alloc(
let (new_alloc, addr) = loop {
let mut inner = self.inner.lock();
- let mapping = inner.mapping.as_mut().ok_or_else(BinderError::new_dead)?;
+ let mapping = inner
+ .mapping
+ .as_mut()
+ .ok_or_else(|| BinderError::new_dead())?;
let alloc_request = match mapping.alloc.reserve_new(reserve_new_args)? {
ReserveNew::Success(new_alloc) => break (new_alloc, mapping.address),
ReserveNew::NeedAlloc(request) => request,
@@ -1208,13 +1216,12 @@ fn get_node_debug_info(&self, data: UserSlice) -> Result {
let ptr = reader.read::()?.ptr;
let mut out = BinderNodeDebugInfo::default();
- {
+ if let Some(start_ptr) = ptr.checked_add(1) {
let inner = self.inner.lock();
- for (node_ptr, node) in &inner.nodes {
- if *node_ptr > ptr {
- node.populate_debug_info(&mut out, &inner);
- break;
- }
+ // cursor_lower_bound retrieves the "key" passed or the next existing larger key
+ if let Some(cursor) = inner.nodes.cursor_lower_bound(&start_ptr) {
+ let (_, node) = cursor.current();
+ node.populate_debug_info(&mut out, &inner);
}
}
@@ -1296,14 +1303,8 @@ pub(crate) fn request_death(
return Ok(());
}
- let death = {
- let death_init = NodeDeath::new(info.node_ref().node.clone(), self.clone(), cookie);
- match death.pin_init_with(death_init) {
- Ok(death) => death,
- // error is infallible
- Err(err) => match err {},
- }
- };
+ let death_init = NodeDeath::new(info.node_ref().node.clone(), self.clone(), cookie);
+ let Ok(death) = death.pin_init_with(death_init);
// Register the death notification.
{
diff --git a/drivers/android/binder/range_alloc/array.rs b/drivers/android/binder/range_alloc/array.rs
index 081d19b09d4b..71bf49f9db0d 100644
--- a/drivers/android/binder/range_alloc/array.rs
+++ b/drivers/android/binder/range_alloc/array.rs
@@ -61,7 +61,7 @@ pub(crate) fn is_full(&self) -> bool {
self.ranges.len() == self.ranges.capacity()
}
- pub(crate) fn debug_print(&self, m: &SeqFile) -> Result<()> {
+ pub(crate) fn debug_print(&self, m: &SeqFile) -> Result {
for range in &self.ranges {
seq_print!(
m,
diff --git a/drivers/android/binder/range_alloc/mod.rs b/drivers/android/binder/range_alloc/mod.rs
index 1f4734468ff1..bb6e0ec9650e 100644
--- a/drivers/android/binder/range_alloc/mod.rs
+++ b/drivers/android/binder/range_alloc/mod.rs
@@ -141,7 +141,7 @@ pub(crate) fn count_buffers(&self) -> usize {
}
}
- pub(crate) fn debug_print(&self, m: &SeqFile) -> Result<()> {
+ pub(crate) fn debug_print(&self, m: &SeqFile) -> Result {
match &self.inner {
Impl::Empty(_size) => Ok(()),
Impl::Array(array) => array.debug_print(m),
diff --git a/drivers/android/binder/range_alloc/tree.rs b/drivers/android/binder/range_alloc/tree.rs
index 3e3b452909ed..f0cd46f223d5 100644
--- a/drivers/android/binder/range_alloc/tree.rs
+++ b/drivers/android/binder/range_alloc/tree.rs
@@ -111,7 +111,7 @@ pub(crate) fn count_buffers(&self) -> usize {
.count()
}
- pub(crate) fn debug_print(&self, m: &SeqFile) -> Result<()> {
+ pub(crate) fn debug_print(&self, m: &SeqFile) -> Result {
for desc in self.tree.values() {
let state = match &desc.state {
Some(state) => &state.0,
diff --git a/drivers/android/binder/rust_binder_events.h b/drivers/android/binder/rust_binder_events.h
index 1a446787c8b3..045ab77aa44b 100644
--- a/drivers/android/binder/rust_binder_events.h
+++ b/drivers/android/binder/rust_binder_events.h
@@ -177,6 +177,48 @@ TRACE_EVENT(binder_return,
"unknown")
);
+
+TRACE_EVENT(binder_transaction_alloc_buf,
+ TP_PROTO(int debug_id, size_t data_size, size_t offsets_size, size_t extra_buffers_size),
+ TP_ARGS(debug_id, data_size, offsets_size, extra_buffers_size),
+ TP_STRUCT__entry(
+ __field(int, debug_id)
+ __field(size_t, data_size)
+ __field(size_t, offsets_size)
+ __field(size_t, extra_buffers_size)
+ ),
+ TP_fast_assign(
+ __entry->debug_id = debug_id;
+ __entry->data_size = data_size;
+ __entry->offsets_size = offsets_size;
+ __entry->extra_buffers_size = extra_buffers_size;
+ ),
+ TP_printk("transaction=%d data_size=%zd offsets_size=%zd extra_buffers_size=%zd",
+ __entry->debug_id, __entry->data_size, __entry->offsets_size,
+ __entry->extra_buffers_size)
+);
+
+DECLARE_EVENT_CLASS(binder_buffer_release_class,
+ TP_PROTO(int debug_id),
+ TP_ARGS(debug_id),
+ TP_STRUCT__entry(
+ __field(int, debug_id)
+ ),
+ TP_fast_assign(
+ __entry->debug_id = debug_id;
+ ),
+ TP_printk("transaction=%d", __entry->debug_id)
+);
+
+#define DEFINE_RBINDER_FUNCTION_BUFFER_EVENT(name) \
+DEFINE_EVENT(binder_buffer_release_class, name, \
+ TP_PROTO(int debug_id), \
+ TP_ARGS(debug_id))
+
+DEFINE_RBINDER_FUNCTION_BUFFER_EVENT(binder_transaction_buffer_release);
+DEFINE_RBINDER_FUNCTION_BUFFER_EVENT(binder_transaction_failed_buffer_release);
+DEFINE_RBINDER_FUNCTION_BUFFER_EVENT(binder_transaction_update_buffer_release);
+
#endif /* _RUST_BINDER_TRACE_H */
/* This part must be outside protection */
diff --git a/drivers/android/binder/rust_binder_internal.h b/drivers/android/binder/rust_binder_internal.h
index 78288fe7964d..50a50df14c77 100644
--- a/drivers/android/binder/rust_binder_internal.h
+++ b/drivers/android/binder/rust_binder_internal.h
@@ -44,6 +44,7 @@ struct binder_device {
int rust_binder_stats_show(struct seq_file *m, void *unused);
int rust_binder_state_show(struct seq_file *m, void *unused);
int rust_binder_transactions_show(struct seq_file *m, void *unused);
+int rust_binder_transaction_log_show(struct seq_file *m, void *unused);
int rust_binder_proc_show(struct seq_file *m, void *pid);
extern const struct file_operations rust_binder_fops;
diff --git a/drivers/android/binder/rust_binder_main.rs b/drivers/android/binder/rust_binder_main.rs
index 955c4c348f73..56c786475237 100644
--- a/drivers/android/binder/rust_binder_main.rs
+++ b/drivers/android/binder/rust_binder_main.rs
@@ -81,7 +81,7 @@ fn default() -> Self {
module! {
type: BinderModule,
- name: "rust_binder",
+ name: "binder",
authors: ["Wedson Almeida Filho", "Alice Ryhl"],
description: "Android Binder",
license: "GPL",
@@ -98,7 +98,12 @@ fn default() -> Self {
fn next_debug_id() -> usize {
static NEXT_DEBUG_ID: Atomic = Atomic::new(0);
- NEXT_DEBUG_ID.fetch_add(1, Relaxed)
+ loop {
+ let id = NEXT_DEBUG_ID.fetch_add(1, Relaxed);
+ if id != 0 {
+ return id;
+ }
+ }
}
/// Provides a single place to write Binder return values via the
@@ -158,7 +163,7 @@ fn do_work(
/// Generally only set to true for non-oneway transactions.
fn should_sync_wakeup(&self) -> bool;
- fn debug_print(&self, m: &SeqFile, prefix: &str, transaction_prefix: &str) -> Result<()>;
+ fn debug_print(&self, m: &SeqFile, prefix: &str, transaction_prefix: &str) -> Result;
}
// Wrapper around a `DeliverToRead` with linked list links.
@@ -274,7 +279,7 @@ fn should_sync_wakeup(&self) -> bool {
false
}
- fn debug_print(&self, m: &SeqFile, prefix: &str, _tprefix: &str) -> Result<()> {
+ fn debug_print(&self, m: &SeqFile, prefix: &str, _tprefix: &str) -> Result {
seq_print!(m, "{}", prefix);
if self.skip.load(Relaxed) {
seq_print!(m, "(skipped) ");
@@ -305,6 +310,9 @@ fn init(_module: &'static kernel::ThisModule) -> Result {
// SAFETY: The module initializer never runs twice, so we only call this once.
unsafe { crate::context::CONTEXTS.init() };
+ crate::transaction::TRANSACTION_LOG.init()?;
+ crate::transaction::FAILED_TRANSACTION_LOG.init()?;
+
let netlink = crate::netlink::BINDER_NL_FAMILY.register()?;
BINDER_SHRINKER.register(c"android-binder")?;
@@ -545,7 +553,28 @@ unsafe impl Sync for AssertSync {}
0
}
-fn rust_binder_transactions_show_impl(m: &SeqFile) -> Result<()> {
+/// # Safety
+/// Only called by binderfs.
+#[no_mangle]
+unsafe extern "C" fn rust_binder_transaction_log_show(
+ ptr: *mut seq_file,
+ _: *mut kernel::ffi::c_void,
+) -> kernel::ffi::c_int {
+ // SAFETY: Accessing the private field of `seq_file` is okay.
+ let is_failed = !unsafe { (*ptr).private }.is_null();
+ // SAFETY: The caller ensures that the pointer is valid and exclusive for the duration in which
+ // this method is called.
+ let m = unsafe { SeqFile::from_raw(ptr) };
+ let log = if is_failed {
+ &transaction::FAILED_TRANSACTION_LOG
+ } else {
+ &transaction::TRANSACTION_LOG
+ };
+ log.debug_print(m);
+ 0
+}
+
+fn rust_binder_transactions_show_impl(m: &SeqFile) -> Result {
seq_print!(m, "binder transactions:\n");
let contexts = context::get_all_contexts()?;
for ctx in contexts {
@@ -558,7 +587,7 @@ fn rust_binder_transactions_show_impl(m: &SeqFile) -> Result<()> {
Ok(())
}
-fn rust_binder_stats_show_impl(m: &SeqFile) -> Result<()> {
+fn rust_binder_stats_show_impl(m: &SeqFile) -> Result {
seq_print!(m, "binder stats:\n");
stats::GLOBAL_STATS.debug_print("", m);
let contexts = context::get_all_contexts()?;
@@ -572,7 +601,7 @@ fn rust_binder_stats_show_impl(m: &SeqFile) -> Result<()> {
Ok(())
}
-fn rust_binder_state_show_impl(m: &SeqFile) -> Result<()> {
+fn rust_binder_state_show_impl(m: &SeqFile) -> Result {
seq_print!(m, "binder state:\n");
let contexts = context::get_all_contexts()?;
for ctx in contexts {
@@ -585,7 +614,7 @@ fn rust_binder_state_show_impl(m: &SeqFile) -> Result<()> {
Ok(())
}
-fn rust_binder_proc_show_impl(m: &SeqFile, pid: Pid) -> Result<()> {
+fn rust_binder_proc_show_impl(m: &SeqFile, pid: Pid) -> Result {
seq_print!(m, "binder proc state:\n");
let contexts = context::get_all_contexts()?;
for ctx in contexts {
diff --git a/drivers/android/binder/rust_binderfs.c b/drivers/android/binder/rust_binderfs.c
index d48895f84596..5f020226720d 100644
--- a/drivers/android/binder/rust_binderfs.c
+++ b/drivers/android/binder/rust_binderfs.c
@@ -46,10 +46,11 @@
DEFINE_SHOW_ATTRIBUTE(rust_binder_stats);
DEFINE_SHOW_ATTRIBUTE(rust_binder_state);
DEFINE_SHOW_ATTRIBUTE(rust_binder_transactions);
+DEFINE_SHOW_ATTRIBUTE(rust_binder_transaction_log);
DEFINE_SHOW_ATTRIBUTE(rust_binder_proc);
char *rust_binder_devices_param = CONFIG_ANDROID_BINDER_DEVICES;
-module_param_named(rust_devices, rust_binder_devices_param, charp, 0444);
+module_param_named(devices, rust_binder_devices_param, charp, 0444);
extern u32 rust_binder_debug_mask;
module_param_named(debug_mask, rust_binder_debug_mask, uint, 0644);
@@ -611,6 +612,24 @@ static int init_binder_logs(struct super_block *sb)
goto out;
}
+ dentry = rust_binderfs_create_file(binder_logs_root_dir,
+ "transaction_log",
+ &rust_binder_transaction_log_fops,
+ (void *)0);
+ if (IS_ERR(dentry)) {
+ ret = PTR_ERR(dentry);
+ goto out;
+ }
+
+ dentry = rust_binderfs_create_file(binder_logs_root_dir,
+ "failed_transaction_log",
+ &rust_binder_transaction_log_fops,
+ (void *)1);
+ if (IS_ERR(dentry)) {
+ ret = PTR_ERR(dentry);
+ goto out;
+ }
+
proc_log_dir = binderfs_create_dir(binder_logs_root_dir, "proc");
if (IS_ERR(proc_log_dir)) {
ret = PTR_ERR(proc_log_dir);
diff --git a/drivers/android/binder/thread.rs b/drivers/android/binder/thread.rs
index e0ed20f510fd..f5965e838a96 100644
--- a/drivers/android/binder/thread.rs
+++ b/drivers/android/binder/thread.rs
@@ -30,6 +30,7 @@
process::{GetWorkOrRegister, Process},
ptr_align,
stats::GLOBAL_STATS,
+ trace::{trace_transaction_alloc_buf, trace_transaction_buffer_release},
transaction::{Transaction, TransactionFlag, TransactionFlags, TransactionInfo},
BinderReturnWriter, DArc, DLArc, DTRWrap, DeliverCode, DeliverToRead,
};
@@ -344,13 +345,13 @@ fn push_reply_work(&mut self, code: u32) -> PushWorkRes {
}
}
- fn push_return_work(&mut self, reply: u32) {
+ fn push_return_work(&mut self, reply: u32) -> PushWorkRes {
if let Ok(work) = ListArc::try_from_arc(self.return_work.clone()) {
work.set_error_code(reply);
- // Not notifying: Reply to current thread.
- let _ = self.push_work(work);
+ self.push_work(work)
} else {
pr_warn_ratelimited!("Thread return work is already in use.\n");
+ PushWorkRes::Ok
}
}
@@ -481,7 +482,7 @@ pub(crate) fn new(id: i32, process: Arc) -> Result> {
}
#[inline(never)]
- pub(crate) fn debug_print(self: &Arc, m: &SeqFile, print_all: bool) -> Result<()> {
+ pub(crate) fn debug_print(self: &Arc, m: &SeqFile, print_all: bool) -> Result {
let inner = self.inner.lock();
if print_all || inner.current_transaction.is_some() || !inner.work_list.is_empty() {
@@ -584,9 +585,21 @@ fn get_work_local(self: &Arc, wait: bool) -> Result