Merge tag 'char-misc-4.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver updates from Greg KH:
 "Here is the big char/misc driver patchset for 4.11-rc1.

  Lots of different driver subsystems updated here: rework for the
  hyperv subsystem to handle new platforms better, mei and w1 and extcon
  driver updates, as well as a number of other "minor" driver updates.

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'char-misc-4.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (169 commits)
  goldfish: Sanitize the broken interrupt handler
  x86/platform/goldfish: Prevent unconditional loading
  vmbus: replace modulus operation with subtraction
  vmbus: constify parameters where possible
  vmbus: expose hv_begin/end_read
  vmbus: remove conditional locking of vmbus_write
  vmbus: add direct isr callback mode
  vmbus: change to per channel tasklet
  vmbus: put related per-cpu variable together
  vmbus: callback is in softirq not workqueue
  binder: Add support for file-descriptor arrays
  binder: Add support for scatter-gather
  binder: Add extra size to allocator
  binder: Refactor binder_transact()
  binder: Support multiple /dev instances
  binder: Deal with contexts in debugfs
  binder: Support multiple context managers
  binder: Split flat_binder_object
  auxdisplay: ht16k33: remove private workqueue
  auxdisplay: ht16k33: rework input device initialization
  ...

11 files changed, 285 insertions, 134 deletions

diff --git a/include/linux/extcon.h b/include/linux/extcon.h
index b871c0cb1f02..7010fb01a81a 100644
--- a/include/linux/extcon.h
+++ b/include/linux/extcon.h
@@ -46,7 +46,18 @@
 #define EXTCON_USB              1
 #define EXTCON_USB_HOST         2
 
-/* Charging external connector */
+/*
+ * Charging external connector
+ *
+ * When one SDP charger connector was reported, we should also report
+ * the USB connector, which means EXTCON_CHG_USB_SDP should always
+ * appear together with EXTCON_USB. The same as ACA charger connector,
+ * EXTCON_CHG_USB_ACA would normally appear with EXTCON_USB_HOST.
+ *
+ * The EXTCON_CHG_USB_SLOW connector can provide at least 500mA of
+ * current at 5V. The EXTCON_CHG_USB_FAST connector can provide at
+ * least 1A of current at 5V.
+ */
 #define EXTCON_CHG_USB_SDP      5       /* Standard Downstream Port */
 #define EXTCON_CHG_USB_DCP      6       /* Dedicated Charging Port */
 #define EXTCON_CHG_USB_CDP      7       /* Charging Downstream Port */
@@ -54,6 +65,7 @@
 #define EXTCON_CHG_USB_FAST     9
 #define EXTCON_CHG_USB_SLOW     10
 #define EXTCON_CHG_WPT          11      /* Wireless Power Transfer */
+#define EXTCON_CHG_USB_PD       12      /* USB Power Delivery */
 
 /* Jack external connector */
 #define EXTCON_JACK_MICROPHONE  20
@@ -160,62 +172,7 @@ union extcon_property_value {
 };
 
 struct extcon_cable;
-
-/**
- * struct extcon_dev - An extcon device represents one external connector.
- * @name:               The name of this extcon device. Parent device name is
- *                      used if NULL.
- * @supported_cable:    Array of supported cable names ending with EXTCON_NONE.
- *                      If supported_cable is NULL, cable name related APIs
- *                      are disabled.
- * @mutually_exclusive: Array of mutually exclusive set of cables that cannot
- *                      be attached simultaneously. The array should be
- *                      ending with NULL or be NULL (no mutually exclusive
- *                      cables). For example, if it is { 0x7, 0x30, 0}, then,
- *                      {0, 1}, {0, 1, 2}, {0, 2}, {1, 2}, or {4, 5} cannot
- *                      be attached simulataneously. {0x7, 0} is equivalent to
- *                      {0x3, 0x6, 0x5, 0}. If it is {0xFFFFFFFF, 0}, there
- *                      can be no simultaneous connections.
- * @dev:                Device of this extcon.
- * @state:              Attach/detach state of this extcon. Do not provide at
- *                      register-time.
- * @nh:                 Notifier for the state change events from this extcon
- * @entry:              To support list of extcon devices so that users can
- *                      search for extcon devices based on the extcon name.
- * @lock:
- * @max_supported:      Internal value to store the number of cables.
- * @extcon_dev_type:    Device_type struct to provide attribute_groups
- *                      customized for each extcon device.
- * @cables:             Sysfs subdirectories. Each represents one cable.
- *
- * In most cases, users only need to provide "User initializing data" of
- * this struct when registering an extcon. In some exceptional cases,
- * optional callbacks may be needed. However, the values in "internal data"
- * are overwritten by register function.
- */
-struct extcon_dev {
-        /* Optional user initializing data */
-        const char *name;
-        const unsigned int *supported_cable;
-        const u32 *mutually_exclusive;
-
-        /* Internal data. Please do not set. */
-        struct device dev;
-        struct raw_notifier_head *nh;
-        struct list_head entry;
-        int max_supported;
-        spinlock_t lock;        /* could be called by irq handler */
-        u32 state;
-
-        /* /sys/class/extcon/.../cable.n/... */
-        struct device_type extcon_dev_type;
-        struct extcon_cable *cables;
-
-        /* /sys/class/extcon/.../mutually_exclusive/... */
-        struct attribute_group attr_g_muex;
-        struct attribute **attrs_muex;
-        struct device_attribute *d_attrs_muex;
-};
+struct extcon_dev;
 
 #if IS_ENABLED(CONFIG_EXTCON)
 
diff --git a/include/linux/extcon/extcon-adc-jack.h b/include/linux/extcon/extcon-adc-jack.h
index a0e03b13b449..2aa32075bca1 100644
--- a/include/linux/extcon/extcon-adc-jack.h
+++ b/include/linux/extcon/extcon-adc-jack.h
@@ -59,7 +59,7 @@ struct adc_jack_pdata {
         const char *name;
         const char *consumer_channel;
 
-        const enum extcon *cable_names;
+        const unsigned int *cable_names;
 
         /* The last entry's state should be 0 */
         struct adc_jack_cond *adc_conditions;
diff --git a/include/linux/fpga/fpga-mgr.h b/include/linux/fpga/fpga-mgr.h
index 16551d5eac36..57beb5d09bfc 100644
--- a/include/linux/fpga/fpga-mgr.h
+++ b/include/linux/fpga/fpga-mgr.h
@@ -22,6 +22,7 @@
 #define _LINUX_FPGA_MGR_H
 
 struct fpga_manager;
+struct sg_table;
 
 /**
  * enum fpga_mgr_states - fpga framework states
@@ -88,6 +89,7 @@ struct fpga_image_info {
  * @state: returns an enum value of the FPGA's state
  * @write_init: prepare the FPGA to receive confuration data
  * @write: write count bytes of configuration data to the FPGA
+ * @write_sg: write the scatter list of configuration data to the FPGA
  * @write_complete: set FPGA to operating state after writing is done
  * @fpga_remove: optional: Set FPGA into a specific state during driver remove
  *
@@ -102,6 +104,7 @@ struct fpga_manager_ops {
                           struct fpga_image_info *info,
                           const char *buf, size_t count);
         int (*write)(struct fpga_manager *mgr, const char *buf, size_t count);
+        int (*write_sg)(struct fpga_manager *mgr, struct sg_table *sgt);
         int (*write_complete)(struct fpga_manager *mgr,
                               struct fpga_image_info *info);
         void (*fpga_remove)(struct fpga_manager *mgr);
@@ -129,6 +132,8 @@ struct fpga_manager {
 
 int fpga_mgr_buf_load(struct fpga_manager *mgr, struct fpga_image_info *info,
                       const char *buf, size_t count);
+int fpga_mgr_buf_load_sg(struct fpga_manager *mgr, struct fpga_image_info *info,
+                         struct sg_table *sgt);
 
 int fpga_mgr_firmware_load(struct fpga_manager *mgr,
                            struct fpga_image_info *info,
diff --git a/include/linux/fsi.h b/include/linux/fsi.h
new file mode 100644
index 000000000000..273cbf6400ea
--- /dev/null
+++ b/include/linux/fsi.h
@@ -0,0 +1,50 @@
+/* FSI device & driver interfaces
+ *
+ * Copyright (C) IBM Corporation 2016
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef LINUX_FSI_H
+#define LINUX_FSI_H
+
+#include <linux/device.h>
+
+struct fsi_device {
+        struct device           dev;
+        u8                      engine_type;
+        u8                      version;
+};
+
+struct fsi_device_id {
+        u8      engine_type;
+        u8      version;
+};
+
+#define FSI_VERSION_ANY         0
+
+#define FSI_DEVICE(t) \
+        .engine_type = (t), .version = FSI_VERSION_ANY,
+
+#define FSI_DEVICE_VERSIONED(t, v) \
+        .engine_type = (t), .version = (v),
+
+
+struct fsi_driver {
+        struct device_driver            drv;
+        const struct fsi_device_id      *id_table;
+};
+
+#define to_fsi_dev(devp) container_of(devp, struct fsi_device, dev)
+#define to_fsi_drv(drvp) container_of(drvp, struct fsi_driver, drv)
+
+extern struct bus_type fsi_bus_type;
+
+#endif /* LINUX_FSI_H */
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index 183efde54269..62bbf3c1aa4a 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -32,11 +32,10 @@
 #include <linux/scatterlist.h>
 #include <linux/list.h>
 #include <linux/timer.h>
-#include <linux/workqueue.h>
 #include <linux/completion.h>
 #include <linux/device.h>
 #include <linux/mod_devicetable.h>
-
+#include <linux/interrupt.h>
 
 #define MAX_PAGE_BUFFER_COUNT                           32
 #define MAX_MULTIPAGE_BUFFER_COUNT                      32 /* 128K */
@@ -139,8 +138,8 @@ struct hv_ring_buffer_info {
  * for the specified ring buffer
  */
 static inline void
-hv_get_ringbuffer_availbytes(struct hv_ring_buffer_info *rbi,
-                          u32 *read, u32 *write)
+hv_get_ringbuffer_availbytes(const struct hv_ring_buffer_info *rbi,
+                             u32 *read, u32 *write)
 {
         u32 read_loc, write_loc, dsize;
 
@@ -154,7 +153,7 @@ hv_get_ringbuffer_availbytes(struct hv_ring_buffer_info *rbi,
         *read = dsize - *write;
 }
 
-static inline u32 hv_get_bytes_to_read(struct hv_ring_buffer_info *rbi)
+static inline u32 hv_get_bytes_to_read(const struct hv_ring_buffer_info *rbi)
 {
         u32 read_loc, write_loc, dsize, read;
 
@@ -168,7 +167,7 @@ static inline u32 hv_get_bytes_to_read(struct hv_ring_buffer_info *rbi)
         return read;
 }
 
-static inline u32 hv_get_bytes_to_write(struct hv_ring_buffer_info *rbi)
+static inline u32 hv_get_bytes_to_write(const struct hv_ring_buffer_info *rbi)
 {
         u32 read_loc, write_loc, dsize, write;
 
@@ -641,6 +640,7 @@ struct vmbus_channel_msginfo {
 
         /* Synchronize the request/response if needed */
         struct completion  waitevent;
+        struct vmbus_channel *waiting_channel;
         union {
                 struct vmbus_channel_version_supported version_supported;
                 struct vmbus_channel_open_result open_result;
@@ -683,11 +683,6 @@ struct hv_input_signal_event_buffer {
         struct hv_input_signal_event event;
 };
 
-enum hv_signal_policy {
-        HV_SIGNAL_POLICY_DEFAULT = 0,
-        HV_SIGNAL_POLICY_EXPLICIT,
-};
-
 enum hv_numa_policy {
         HV_BALANCED = 0,
         HV_LOCALIZED,
@@ -747,26 +742,27 @@ struct vmbus_channel {
 
         struct vmbus_close_msg close_msg;
 
-        /* Channel callback are invoked in this workqueue context */
-        /* HANDLE dataWorkQueue; */
-
+        /* Channel callback's invoked in softirq context */
+        struct tasklet_struct callback_event;
         void (*onchannel_callback)(void *context);
         void *channel_callback_context;
 
         /*
-         * A channel can be marked for efficient (batched)
-         * reading:
-         * If batched_reading is set to "true", we read until the
-         * channel is empty and hold off interrupts from the host
-         * during the entire read process.
-         * If batched_reading is set to "false", the client is not
-         * going to perform batched reading.
-         *
-         * By default we will enable batched reading; specific
-         * drivers that don't want this behavior can turn it off.
+         * A channel can be marked for one of three modes of reading:
+         *   BATCHED - callback called from taslket and should read
+         *            channel until empty. Interrupts from the host
+         *            are masked while read is in process (default).
+         *   DIRECT - callback called from tasklet (softirq).
+         *   ISR - callback called in interrupt context and must
+         *         invoke its own deferred processing.
+         *         Host interrupts are disabled and must be re-enabled
+         *         when ring is empty.
          */
-
-        bool batched_reading;
+        enum hv_callback_mode {
+                HV_CALL_BATCHED,
+                HV_CALL_DIRECT,
+                HV_CALL_ISR
+        } callback_mode;
 
         bool is_dedicated_interrupt;
         struct hv_input_signal_event_buffer sig_buf;
@@ -850,23 +846,6 @@ struct vmbus_channel {
          */
         struct list_head percpu_list;
         /*
-         * Host signaling policy: The default policy will be
-         * based on the ring buffer state. We will also support
-         * a policy where the client driver can have explicit
-         * signaling control.
-         */
-        enum hv_signal_policy  signal_policy;
-        /*
-         * On the channel send side, many of the VMBUS
-         * device drivers explicity serialize access to the
-         * outgoing ring buffer. Give more control to the
-         * VMBUS device drivers in terms how to serialize
-         * accesss to the outgoing ring buffer.
-         * The default behavior will be to aquire the
-         * ring lock to preserve the current behavior.
-         */
-        bool acquire_ring_lock;
-        /*
          * For performance critical channels (storage, networking
          * etc,), Hyper-V has a mechanism to enhance the throughput
          * at the expense of latency:
@@ -906,32 +885,22 @@ struct vmbus_channel {
 
 };
 
-static inline void set_channel_lock_state(struct vmbus_channel *c, bool state)
-{
-        c->acquire_ring_lock = state;
-}
-
 static inline bool is_hvsock_channel(const struct vmbus_channel *c)
 {
         return !!(c->offermsg.offer.chn_flags &
                   VMBUS_CHANNEL_TLNPI_PROVIDER_OFFER);
 }
 
-static inline void set_channel_signal_state(struct vmbus_channel *c,
-                                            enum hv_signal_policy policy)
-{
-        c->signal_policy = policy;
-}
-
 static inline void set_channel_affinity_state(struct vmbus_channel *c,
                                               enum hv_numa_policy policy)
 {
         c->affinity_policy = policy;
 }
 
-static inline void set_channel_read_state(struct vmbus_channel *c, bool state)
+static inline void set_channel_read_mode(struct vmbus_channel *c,
+                                        enum hv_callback_mode mode)
 {
-        c->batched_reading = state;
+        c->callback_mode = mode;
 }
 
 static inline void set_per_channel_state(struct vmbus_channel *c, void *s)
@@ -1054,8 +1023,7 @@ extern int vmbus_sendpacket_ctl(struct vmbus_channel *channel,
                                   u32 bufferLen,
                                   u64 requestid,
                                   enum vmbus_packet_type type,
-                                  u32 flags,
-                                  bool kick_q);
+                                  u32 flags);
 
 extern int vmbus_sendpacket_pagebuffer(struct vmbus_channel *channel,
                                             struct hv_page_buffer pagebuffers[],
@@ -1070,8 +1038,7 @@ extern int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
                                            void *buffer,
                                            u32 bufferlen,
                                            u64 requestid,
-                                           u32 flags,
-                                           bool kick_q);
+                                           u32 flags);
 
 extern int vmbus_sendpacket_multipagebuffer(struct vmbus_channel *channel,
                                         struct hv_multipage_buffer *mpb,
@@ -1458,9 +1425,10 @@ struct hyperv_service_callback {
 };
 
 #define MAX_SRV_VER     0x7ffffff
-extern bool vmbus_prep_negotiate_resp(struct icmsg_hdr *,
-                                        struct icmsg_negotiate *, u8 *, int,
-                                        int);
+extern bool vmbus_prep_negotiate_resp(struct icmsg_hdr *icmsghdrp, u8 *buf,
+                                const int *fw_version, int fw_vercnt,
+                                const int *srv_version, int srv_vercnt,
+                                int *nego_fw_version, int *nego_srv_version);
 
 void hv_event_tasklet_disable(struct vmbus_channel *channel);
 void hv_event_tasklet_enable(struct vmbus_channel *channel);
@@ -1480,9 +1448,9 @@ void vmbus_set_event(struct vmbus_channel *channel);
 
 /* Get the start of the ring buffer. */
 static inline void *
-hv_get_ring_buffer(struct hv_ring_buffer_info *ring_info)
+hv_get_ring_buffer(const struct hv_ring_buffer_info *ring_info)
 {
-        return (void *)ring_info->ring_buffer->buffer;
+        return ring_info->ring_buffer->buffer;
 }
 
 /*
@@ -1545,6 +1513,36 @@ init_cached_read_index(struct vmbus_channel *channel)
 }
 
 /*
+ * Mask off host interrupt callback notifications
+ */
+static inline void hv_begin_read(struct hv_ring_buffer_info *rbi)
+{
+        rbi->ring_buffer->interrupt_mask = 1;
+
+        /* make sure mask update is not reordered */
+        virt_mb();
+}
+
+/*
+ * Re-enable host callback and return number of outstanding bytes
+ */
+static inline u32 hv_end_read(struct hv_ring_buffer_info *rbi)
+{
+
+        rbi->ring_buffer->interrupt_mask = 0;
+
+        /* make sure mask update is not reordered */
+        virt_mb();
+
+        /*
+         * Now check to see if the ring buffer is still empty.
+         * If it is not, we raced and we need to process new
+         * incoming messages.
+         */
+        return hv_get_bytes_to_read(rbi);
+}
+
+/*
  * An API to support in-place processing of incoming VMBUS packets.
  */
 #define VMBUS_PKT_TRAILER       8
diff --git a/include/linux/miscdevice.h b/include/linux/miscdevice.h
index ed30d5d713e3..0590263c462c 100644
--- a/include/linux/miscdevice.h
+++ b/include/linux/miscdevice.h
@@ -22,6 +22,7 @@
 /*#define ADB_MOUSE_MINOR       10      FIXME OBSOLETE */
 #define WATCHDOG_MINOR          130     /* Watchdog timer     */
 #define TEMP_MINOR              131     /* Temperature Sensor */
+#define APM_MINOR_DEV           134
 #define RTC_MINOR               135
 #define EFI_RTC_MINOR           136     /* EFI Time services */
 #define VHCI_MINOR              137
diff --git a/include/linux/platform_data/ti-aemif.h b/include/linux/platform_data/ti-aemif.h
new file mode 100644
index 000000000000..ac72e115093c
--- /dev/null
+++ b/include/linux/platform_data/ti-aemif.h
@@ -0,0 +1,23 @@
+/*
+ * TI DaVinci AEMIF platform glue.
+ *
+ * Copyright (C) 2017 BayLibre SAS
+ *
+ * Author:
+ *   Bartosz Golaszewski <bgolaszewski@baylibre.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef __TI_DAVINCI_AEMIF_DATA_H__
+#define __TI_DAVINCI_AEMIF_DATA_H__
+
+#include <linux/of_platform.h>
+
+struct aemif_platform_data {
+        struct of_dev_auxdata *dev_lookup;
+};
+
+#endif /* __TI_DAVINCI_AEMIF_DATA_H__ */
diff --git a/include/linux/sram.h b/include/linux/sram.h
new file mode 100644
index 000000000000..c97dcbe8ce25
--- /dev/null
+++ b/include/linux/sram.h
@@ -0,0 +1,27 @@
+/*
+ * Generic SRAM Driver Interface
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation version 2.
+ *
+ * This program is distributed "as is" WITHOUT ANY WARRANTY of any
+ * kind, whether express or implied; without even the implied warranty
+ * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#ifndef __LINUX_SRAM_H__
+#define __LINUX_SRAM_H__
+
+struct gen_pool;
+
+#ifdef CONFIG_SRAM_EXEC
+int sram_exec_copy(struct gen_pool *pool, void *dst, void *src, size_t size);
+#else
+static inline int sram_exec_copy(struct gen_pool *pool, void *dst, void *src,
+                                 size_t size)
+{
+        return -ENODEV;
+}
+#endif /* CONFIG_SRAM_EXEC */
+#endif /* __LINUX_SRAM_H__ */
diff --git a/include/linux/vme.h b/include/linux/vme.h
index 8c589176c2f8..ec5e8bf6118e 100644
--- a/include/linux/vme.h
+++ b/include/linux/vme.h
@@ -108,7 +108,6 @@ struct vme_dev {
 };
 
 struct vme_driver {
-        struct list_head node;
         const char *name;
         int (*match)(struct vme_dev *);
         int (*probe)(struct vme_dev *);
diff --git a/include/linux/vmw_vmci_defs.h b/include/linux/vmw_vmci_defs.h
index 1bd31a38c51e..b724ef7005de 100644
--- a/include/linux/vmw_vmci_defs.h
+++ b/include/linux/vmw_vmci_defs.h
@@ -54,13 +54,6 @@
 #define VMCI_IMR_DATAGRAM      0x1
 #define VMCI_IMR_NOTIFICATION  0x2
 
-/* Interrupt type. */
-enum {
-        VMCI_INTR_TYPE_INTX = 0,
-        VMCI_INTR_TYPE_MSI = 1,
-        VMCI_INTR_TYPE_MSIX = 2,
-};
-
 /* Maximum MSI/MSI-X interrupt vectors in the device. */
 #define VMCI_MAX_INTRS 2
 
diff --git a/include/uapi/linux/android/binder.h b/include/uapi/linux/android/binder.h
index 41420e341e75..51f891fb1b18 100644
--- a/include/uapi/linux/android/binder.h
+++ b/include/uapi/linux/android/binder.h
@@ -33,6 +33,8 @@ enum {
         BINDER_TYPE_HANDLE      = B_PACK_CHARS('s', 'h', '*', B_TYPE_LARGE),
         BINDER_TYPE_WEAK_HANDLE = B_PACK_CHARS('w', 'h', '*', B_TYPE_LARGE),
         BINDER_TYPE_FD          = B_PACK_CHARS('f', 'd', '*', B_TYPE_LARGE),
+        BINDER_TYPE_FDA         = B_PACK_CHARS('f', 'd', 'a', B_TYPE_LARGE),
+        BINDER_TYPE_PTR         = B_PACK_CHARS('p', 't', '*', B_TYPE_LARGE),
 };
 
 enum {
@@ -48,6 +50,14 @@ typedef __u64 binder_size_t;
 typedef __u64 binder_uintptr_t;
 #endif
 
+/**
+ * struct binder_object_header - header shared by all binder metadata objects.
+ * @type:       type of the object
+ */
+struct binder_object_header {
+        __u32        type;
+};
+
 /*
  * This is the flattened representation of a Binder object for transfer
  * between processes.  The 'offsets' supplied as part of a binder transaction
@@ -56,9 +66,8 @@ typedef __u64 binder_uintptr_t;
  * between processes.
  */
 struct flat_binder_object {
-        /* 8 bytes for large_flat_header. */
-        __u32           type;
-        __u32           flags;
+        struct binder_object_header     hdr;
+        __u32                           flags;
 
         /* 8 bytes of data. */
         union {
@@ -70,6 +79,84 @@ struct flat_binder_object {
         binder_uintptr_t        cookie;
 };
 
+/**
+ * struct binder_fd_object - describes a filedescriptor to be fixed up.
+ * @hdr:        common header structure
+ * @pad_flags:  padding to remain compatible with old userspace code
+ * @pad_binder: padding to remain compatible with old userspace code
+ * @fd:         file descriptor
+ * @cookie:     opaque data, used by user-space
+ */
+struct binder_fd_object {
+        struct binder_object_header     hdr;
+        __u32                           pad_flags;
+        union {
+                binder_uintptr_t        pad_binder;
+                __u32                   fd;
+        };
+
+        binder_uintptr_t                cookie;
+};
+
+/* struct binder_buffer_object - object describing a userspace buffer
+ * @hdr:                common header structure
+ * @flags:              one or more BINDER_BUFFER_* flags
+ * @buffer:             address of the buffer
+ * @length:             length of the buffer
+ * @parent:             index in offset array pointing to parent buffer
+ * @parent_offset:      offset in @parent pointing to this buffer
+ *
+ * A binder_buffer object represents an object that the
+ * binder kernel driver can copy verbatim to the target
+ * address space. A buffer itself may be pointed to from
+ * within another buffer, meaning that the pointer inside
+ * that other buffer needs to be fixed up as well. This
+ * can be done by setting the BINDER_BUFFER_FLAG_HAS_PARENT
+ * flag in @flags, by setting @parent buffer to the index
+ * in the offset array pointing to the parent binder_buffer_object,
+ * and by setting @parent_offset to the offset in the parent buffer
+ * at which the pointer to this buffer is located.
+ */
+struct binder_buffer_object {
+        struct binder_object_header     hdr;
+        __u32                           flags;
+        binder_uintptr_t                buffer;
+        binder_size_t                   length;
+        binder_size_t                   parent;
+        binder_size_t                   parent_offset;
+};
+
+enum {
+        BINDER_BUFFER_FLAG_HAS_PARENT = 0x01,
+};
+
+/* struct binder_fd_array_object - object describing an array of fds in a buffer
+ * @hdr:                common header structure
+ * @num_fds:            number of file descriptors in the buffer
+ * @parent:             index in offset array to buffer holding the fd array
+ * @parent_offset:      start offset of fd array in the buffer
+ *
+ * A binder_fd_array object represents an array of file
+ * descriptors embedded in a binder_buffer_object. It is
+ * different from a regular binder_buffer_object because it
+ * describes a list of file descriptors to fix up, not an opaque
+ * blob of memory, and hence the kernel needs to treat it differently.
+ *
+ * An example of how this would be used is with Android's
+ * native_handle_t object, which is a struct with a list of integers
+ * and a list of file descriptors. The native_handle_t struct itself
+ * will be represented by a struct binder_buffer_objct, whereas the
+ * embedded list of file descriptors is represented by a
+ * struct binder_fd_array_object with that binder_buffer_object as
+ * a parent.
+ */
+struct binder_fd_array_object {
+        struct binder_object_header     hdr;
+        binder_size_t                   num_fds;
+        binder_size_t                   parent;
+        binder_size_t                   parent_offset;
+};
+
 /*
  * On 64-bit platforms where user code may run in 32-bits the driver must
  * translate the buffer (and local binder) addresses appropriately.
@@ -162,6 +249,11 @@ struct binder_transaction_data {
         } data;
 };
 
+struct binder_transaction_data_sg {
+        struct binder_transaction_data transaction_data;
+        binder_size_t buffers_size;
+};
+
 struct binder_ptr_cookie {
         binder_uintptr_t ptr;
         binder_uintptr_t cookie;
@@ -346,6 +438,12 @@ enum binder_driver_command_protocol {
         /*
          * void *: cookie
          */
+
+        BC_TRANSACTION_SG = _IOW('c', 17, struct binder_transaction_data_sg),
+        BC_REPLY_SG = _IOW('c', 18, struct binder_transaction_data_sg),
+        /*
+         * binder_transaction_data_sg: the sent command.
+         */
 };
 
 #endif /* _UAPI_LINUX_BINDER_H */