Merge tag 'staging-3.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging driver updates from Greg KH:
 "Here's the big staging tree pull request for 3.19-rc1.

  We continued to delete more lines than were added, always a good
  thing, but not at a huge rate this release, only about 70k lines
  removed overall mostly from removing the horrid bcm driver.

  Lots of normal staging driver cleanups and fixes all over the place,
  well over a thousand of them, the shortlog shows all the horrid
  details.

  The "contentious" thing here is the movement of the Android binder
  code out of staging into the "real" part of the kernel.  This is code
  that has been stable for a few years now and is working as-is in the
  tens of millions of devices with no issues.  Yes, the code is horrid,
  and the userspace api leaves a lot to be desired, but it's not going
  to change due to legacy issues that we have no control over.  Because
  so many devices and companies rely on this, and the code is stable,
  might as well promote it out of staging.

  This was all discussed at the Linux Plumbers conference, and everyone
  participating agreed that this was the best way forward.

  There is work happening to replace the binder code with something new
  that is happening right now, but I don't expect to see the results of
  that work for another year at the earliest.  If that ever happens, and
  Android switches over to it, I'll gladly remove this version.

  As for maintainers, I'll be glad to maintain this code, I've been
  doing it for the past few years with no problems.  I'll send a
  MAINTAINERS entry for it before 3.19-final is out, still need to talk
  to the Google developers about if they are willing to help with it or
  not, last I checked they were, which was good.

  All of these patches have been in linux-next for a while with no
  reported issues"

* tag 'staging-3.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (1382 commits)
  Staging: slicoss: Fix long line issues in slicoss.c
  staging: rtl8712: remove unnecessary else after return
  staging: comedi: change some printk calls to pr_err
  staging: rtl8723au: hal: Removed the extra semicolon
  lustre: Deletion of unnecessary checks before three function calls
  staging: lustre: fix sparse warnings: static function declaration
  staging: lustre: fixed sparse warnings related to static declarations
  staging: unisys: remove duplicate header
  staging: unisys: remove unneeded structure
  staging: ft1000 : replace __attribute ((__packed__) with __packed
  drivers: staging: rtl8192e: Include "asm/unaligned.h" instead of "access_ok.h" in "rtl819x_BAProc.c"
  Drivers:staging:rtl8192e: Fixed checkpatch warning
  Drivers:staging:clocking-wizard: Added a newline
  staging: clocking-wizard: check for a valid clk_name pointer
  staging: rtl8723au: Hal_InitPGData() avoid unnecessary typecasts
  staging: rtl8723au: _DisableAnalog(): Avoid zero-init variables unnecessarily
  staging: rtl8723au: Remove unnecessary wrapper _ResetDigitalProcedure1()
  staging: rtl8723au: _ResetDigitalProcedure1_92C() reduce code obfuscation
  staging: rtl8723au: Remove unnecessary wrapper _DisableRFAFEAndResetBB()
  staging: rtl8723au: _DisableRFAFEAndResetBB8192C(): Reduce code obfuscation
  ...

3 files changed, 355 insertions, 0 deletions

diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
index d8e1716707ba..cea258f1d9d2 100644
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -1,4 +1,5 @@
 # UAPI Header export list
+header-y += android/
 header-y += byteorder/
 header-y += can/
 header-y += caif/
diff --git a/include/uapi/linux/android/Kbuild b/include/uapi/linux/android/Kbuild
new file mode 100644
index 000000000000..ca011eec252a
--- /dev/null
+++ b/include/uapi/linux/android/Kbuild
@@ -0,0 +1,2 @@
+# UAPI Header export list
+header-y += binder.h
diff --git a/include/uapi/linux/android/binder.h b/include/uapi/linux/android/binder.h
new file mode 100644
index 000000000000..41420e341e75
--- /dev/null
+++ b/include/uapi/linux/android/binder.h
@@ -0,0 +1,352 @@
+/*
+ * Copyright (C) 2008 Google, Inc.
+ *
+ * Based on, but no longer compatible with, the original
+ * OpenBinder.org binder driver interface, which is:
+ *
+ * Copyright (c) 2005 Palmsource, Inc.
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#ifndef _UAPI_LINUX_BINDER_H
+#define _UAPI_LINUX_BINDER_H
+
+#include <linux/types.h>
+#include <linux/ioctl.h>
+
+#define B_PACK_CHARS(c1, c2, c3, c4) \
+        ((((c1)<<24)) | (((c2)<<16)) | (((c3)<<8)) | (c4))
+#define B_TYPE_LARGE 0x85
+
+enum {
+        BINDER_TYPE_BINDER      = B_PACK_CHARS('s', 'b', '*', B_TYPE_LARGE),
+        BINDER_TYPE_WEAK_BINDER = B_PACK_CHARS('w', 'b', '*', B_TYPE_LARGE),
+        BINDER_TYPE_HANDLE      = B_PACK_CHARS('s', 'h', '*', B_TYPE_LARGE),
+        BINDER_TYPE_WEAK_HANDLE = B_PACK_CHARS('w', 'h', '*', B_TYPE_LARGE),
+        BINDER_TYPE_FD          = B_PACK_CHARS('f', 'd', '*', B_TYPE_LARGE),
+};
+
+enum {
+        FLAT_BINDER_FLAG_PRIORITY_MASK = 0xff,
+        FLAT_BINDER_FLAG_ACCEPTS_FDS = 0x100,
+};
+
+#ifdef BINDER_IPC_32BIT
+typedef __u32 binder_size_t;
+typedef __u32 binder_uintptr_t;
+#else
+typedef __u64 binder_size_t;
+typedef __u64 binder_uintptr_t;
+#endif
+
+/*
+ * This is the flattened representation of a Binder object for transfer
+ * between processes.  The 'offsets' supplied as part of a binder transaction
+ * contains offsets into the data where these structures occur.  The Binder
+ * driver takes care of re-writing the structure type and data as it moves
+ * between processes.
+ */
+struct flat_binder_object {
+        /* 8 bytes for large_flat_header. */
+        __u32           type;
+        __u32           flags;
+
+        /* 8 bytes of data. */
+        union {
+                binder_uintptr_t        binder; /* local object */
+                __u32                   handle; /* remote object */
+        };
+
+        /* extra data associated with local object */
+        binder_uintptr_t        cookie;
+};
+
+/*
+ * On 64-bit platforms where user code may run in 32-bits the driver must
+ * translate the buffer (and local binder) addresses appropriately.
+ */
+
+struct binder_write_read {
+        binder_size_t           write_size;     /* bytes to write */
+        binder_size_t           write_consumed; /* bytes consumed by driver */
+        binder_uintptr_t        write_buffer;
+        binder_size_t           read_size;      /* bytes to read */
+        binder_size_t           read_consumed;  /* bytes consumed by driver */
+        binder_uintptr_t        read_buffer;
+};
+
+/* Use with BINDER_VERSION, driver fills in fields. */
+struct binder_version {
+        /* driver protocol version -- increment with incompatible change */
+        __s32       protocol_version;
+};
+
+/* This is the current protocol version. */
+#ifdef BINDER_IPC_32BIT
+#define BINDER_CURRENT_PROTOCOL_VERSION 7
+#else
+#define BINDER_CURRENT_PROTOCOL_VERSION 8
+#endif
+
+#define BINDER_WRITE_READ               _IOWR('b', 1, struct binder_write_read)
+#define BINDER_SET_IDLE_TIMEOUT         _IOW('b', 3, __s64)
+#define BINDER_SET_MAX_THREADS          _IOW('b', 5, __u32)
+#define BINDER_SET_IDLE_PRIORITY        _IOW('b', 6, __s32)
+#define BINDER_SET_CONTEXT_MGR          _IOW('b', 7, __s32)
+#define BINDER_THREAD_EXIT              _IOW('b', 8, __s32)
+#define BINDER_VERSION                  _IOWR('b', 9, struct binder_version)
+
+/*
+ * NOTE: Two special error codes you should check for when calling
+ * in to the driver are:
+ *
+ * EINTR -- The operation has been interupted.  This should be
+ * handled by retrying the ioctl() until a different error code
+ * is returned.
+ *
+ * ECONNREFUSED -- The driver is no longer accepting operations
+ * from your process.  That is, the process is being destroyed.
+ * You should handle this by exiting from your process.  Note
+ * that once this error code is returned, all further calls to
+ * the driver from any thread will return this same code.
+ */
+
+enum transaction_flags {
+        TF_ONE_WAY      = 0x01, /* this is a one-way call: async, no return */
+        TF_ROOT_OBJECT  = 0x04, /* contents are the component's root object */
+        TF_STATUS_CODE  = 0x08, /* contents are a 32-bit status code */
+        TF_ACCEPT_FDS   = 0x10, /* allow replies with file descriptors */
+};
+
+struct binder_transaction_data {
+        /* The first two are only used for bcTRANSACTION and brTRANSACTION,
+         * identifying the target and contents of the transaction.
+         */
+        union {
+                /* target descriptor of command transaction */
+                __u32   handle;
+                /* target descriptor of return transaction */
+                binder_uintptr_t ptr;
+        } target;
+        binder_uintptr_t        cookie; /* target object cookie */
+        __u32           code;           /* transaction command */
+
+        /* General information about the transaction. */
+        __u32           flags;
+        pid_t           sender_pid;
+        uid_t           sender_euid;
+        binder_size_t   data_size;      /* number of bytes of data */
+        binder_size_t   offsets_size;   /* number of bytes of offsets */
+
+        /* If this transaction is inline, the data immediately
+         * follows here; otherwise, it ends with a pointer to
+         * the data buffer.
+         */
+        union {
+                struct {
+                        /* transaction data */
+                        binder_uintptr_t        buffer;
+                        /* offsets from buffer to flat_binder_object structs */
+                        binder_uintptr_t        offsets;
+                } ptr;
+                __u8    buf[8];
+        } data;
+};
+
+struct binder_ptr_cookie {
+        binder_uintptr_t ptr;
+        binder_uintptr_t cookie;
+};
+
+struct binder_handle_cookie {
+        __u32 handle;
+        binder_uintptr_t cookie;
+} __packed;
+
+struct binder_pri_desc {
+        __s32 priority;
+        __u32 desc;
+};
+
+struct binder_pri_ptr_cookie {
+        __s32 priority;
+        binder_uintptr_t ptr;
+        binder_uintptr_t cookie;
+};
+
+enum binder_driver_return_protocol {
+        BR_ERROR = _IOR('r', 0, __s32),
+        /*
+         * int: error code
+         */
+
+        BR_OK = _IO('r', 1),
+        /* No parameters! */
+
+        BR_TRANSACTION = _IOR('r', 2, struct binder_transaction_data),
+        BR_REPLY = _IOR('r', 3, struct binder_transaction_data),
+        /*
+         * binder_transaction_data: the received command.
+         */
+
+        BR_ACQUIRE_RESULT = _IOR('r', 4, __s32),
+        /*
+         * not currently supported
+         * int: 0 if the last bcATTEMPT_ACQUIRE was not successful.
+         * Else the remote object has acquired a primary reference.
+         */
+
+        BR_DEAD_REPLY = _IO('r', 5),
+        /*
+         * The target of the last transaction (either a bcTRANSACTION or
+         * a bcATTEMPT_ACQUIRE) is no longer with us.  No parameters.
+         */
+
+        BR_TRANSACTION_COMPLETE = _IO('r', 6),
+        /*
+         * No parameters... always refers to the last transaction requested
+         * (including replies).  Note that this will be sent even for
+         * asynchronous transactions.
+         */
+
+        BR_INCREFS = _IOR('r', 7, struct binder_ptr_cookie),
+        BR_ACQUIRE = _IOR('r', 8, struct binder_ptr_cookie),
+        BR_RELEASE = _IOR('r', 9, struct binder_ptr_cookie),
+        BR_DECREFS = _IOR('r', 10, struct binder_ptr_cookie),
+        /*
+         * void *:      ptr to binder
+         * void *: cookie for binder
+         */
+
+        BR_ATTEMPT_ACQUIRE = _IOR('r', 11, struct binder_pri_ptr_cookie),
+        /*
+         * not currently supported
+         * int: priority
+         * void *: ptr to binder
+         * void *: cookie for binder
+         */
+
+        BR_NOOP = _IO('r', 12),
+        /*
+         * No parameters.  Do nothing and examine the next command.  It exists
+         * primarily so that we can replace it with a BR_SPAWN_LOOPER command.
+         */
+
+        BR_SPAWN_LOOPER = _IO('r', 13),
+        /*
+         * No parameters.  The driver has determined that a process has no
+         * threads waiting to service incoming transactions.  When a process
+         * receives this command, it must spawn a new service thread and
+         * register it via bcENTER_LOOPER.
+         */
+
+        BR_FINISHED = _IO('r', 14),
+        /*
+         * not currently supported
+         * stop threadpool thread
+         */
+
+        BR_DEAD_BINDER = _IOR('r', 15, binder_uintptr_t),
+        /*
+         * void *: cookie
+         */
+        BR_CLEAR_DEATH_NOTIFICATION_DONE = _IOR('r', 16, binder_uintptr_t),
+        /*
+         * void *: cookie
+         */
+
+        BR_FAILED_REPLY = _IO('r', 17),
+        /*
+         * The the last transaction (either a bcTRANSACTION or
+         * a bcATTEMPT_ACQUIRE) failed (e.g. out of memory).  No parameters.
+         */
+};
+
+enum binder_driver_command_protocol {
+        BC_TRANSACTION = _IOW('c', 0, struct binder_transaction_data),
+        BC_REPLY = _IOW('c', 1, struct binder_transaction_data),
+        /*
+         * binder_transaction_data: the sent command.
+         */
+
+        BC_ACQUIRE_RESULT = _IOW('c', 2, __s32),
+        /*
+         * not currently supported
+         * int:  0 if the last BR_ATTEMPT_ACQUIRE was not successful.
+         * Else you have acquired a primary reference on the object.
+         */
+
+        BC_FREE_BUFFER = _IOW('c', 3, binder_uintptr_t),
+        /*
+         * void *: ptr to transaction data received on a read
+         */
+
+        BC_INCREFS = _IOW('c', 4, __u32),
+        BC_ACQUIRE = _IOW('c', 5, __u32),
+        BC_RELEASE = _IOW('c', 6, __u32),
+        BC_DECREFS = _IOW('c', 7, __u32),
+        /*
+         * int: descriptor
+         */
+
+        BC_INCREFS_DONE = _IOW('c', 8, struct binder_ptr_cookie),
+        BC_ACQUIRE_DONE = _IOW('c', 9, struct binder_ptr_cookie),
+        /*
+         * void *: ptr to binder
+         * void *: cookie for binder
+         */
+
+        BC_ATTEMPT_ACQUIRE = _IOW('c', 10, struct binder_pri_desc),
+        /*
+         * not currently supported
+         * int: priority
+         * int: descriptor
+         */
+
+        BC_REGISTER_LOOPER = _IO('c', 11),
+        /*
+         * No parameters.
+         * Register a spawned looper thread with the device.
+         */
+
+        BC_ENTER_LOOPER = _IO('c', 12),
+        BC_EXIT_LOOPER = _IO('c', 13),
+        /*
+         * No parameters.
+         * These two commands are sent as an application-level thread
+         * enters and exits the binder loop, respectively.  They are
+         * used so the binder can have an accurate count of the number
+         * of looping threads it has available.
+         */
+
+        BC_REQUEST_DEATH_NOTIFICATION = _IOW('c', 14,
+                                                struct binder_handle_cookie),
+        /*
+         * int: handle
+         * void *: cookie
+         */
+
+        BC_CLEAR_DEATH_NOTIFICATION = _IOW('c', 15,
+                                                struct binder_handle_cookie),
+        /*
+         * int: handle
+         * void *: cookie
+         */
+
+        BC_DEAD_BINDER_DONE = _IOW('c', 16, binder_uintptr_t),
+        /*
+         * void *: cookie
+         */
+};
+
+#endif /* _UAPI_LINUX_BINDER_H */
+