iio: add Open Sensor Fusion UART support

Add a binding for the generic Open Sensor Fusion host interface.

Open Sensor Fusion devices report capabilities and samples over an OSF protocol stream. Sensor channels are discovered at runtime from capability reports instead of being described individually in Device Tree.

The protocol version is discovered at runtime from the OSF frame header. OSF GREEN is a product identity, and OSF0 is a wire-format magic value, so neither is used as the Linux compatible string.

Sashiko raises a reasonable question about what you'd do if it turned out your current OSF GREEN doesn't quite comply with the specification or needs some additional quirks. Does it make sense to have a more specific compatible with a fallback to the generic one?

Quoted 10 lines · On Sat, 19 Sep 2026 03:24:39 +0900 Jinseob Kim <[email protected]> wrote:

Add a binding for the generic Open Sensor Fusion host interface.

Open Sensor Fusion devices report capabilities and samples over an OSF protocol stream. Sensor channels are discovered at runtime from capability reports instead of being described individually in Device Tree.

The protocol version is discovered at runtime from the OSF frame header. OSF GREEN is a product identity, and OSF0 is a wire-format magic value, so neither is used as the Linux compatible string.

Sashiko raises a reasonable question about what you'd do if it turned out your current OSF GREEN doesn't quite comply with the specification or needs some additional quirks. Does it make sense to have a more specific compatible with a fallback to the generic one?

Or given this is mostly about device firmware maybe this is fine.

Either way - would be good to add a note on why that doesn't make sense in this patch description.

Thanks,

Jonathan

Document the supported OSF receiver profile, runtime sensor discovery, IIO channel units, scale validation and session lifetime.

Link the project-maintained fixed wire specification instead of duplicating its layouts and compatibility policy. Explain host IIO timestamps and the explicit rebind needed after a changed inventory.

Assisted-by LLM

Signed-off-by Jinseob Kim <[email protected]>

---
 Documentation/iio/index.rst              |  1 +
 Documentation/iio/open-sensor-fusion.rst | 77 ++++++++++++++++++++++++
 MAINTAINERS                              |  1 +
 3 files changed, 79 insertions(+)
 create mode 100644 Documentation/iio/open-sensor-fusion.rst

Documentation/iio/index.rst +1 -0

index b02b879b053a..c2b7963348fd 100644
@@ -40,4 +40,5 @@ Industrial I/O Kernel Drivers
    adxl345
    bno055
    ep93xx_adc
+   open-sensor-fusion
    opt4060

Documentation/iio/open-sensor-fusion.rst new file +16 -0

new file mode 100644
index 000000000000..03ab36aca5f8
@@ -0,0 +1,77 @@
+.. SPDX-License-Identifier: GPL-2.0-only
+
+Open Sensor Fusion
+==================
+
+Open Sensor Fusion is a sensor aggregation hub interface. The Linux IIO driver
+receives device-to-host frames over UART and discovers sensor channels from
+capability reports. Device Tree describes the hub using the
+``opensensorfusion,osf`` compatible; individual sensors are discovered at
+runtime. See the binding in
+``Documentation/devicetree/bindings/iio/opensensorfusion,osf.yaml``.
+
+The OSF Device-to-Host 0.0 specification is maintained by the Open Sensor Fusion
+project. The canonical specification_ defines the wire layout, compatibility
+rules, reserved fields and physical units. This document describes the Linux
+receiver profile and its mapping to IIO.

Documentation/iio/open-sensor-fusion.rst new file +20 -0

+unknown message types are ignored. Unsupported capability entries are skipped
+individually. A CRC-valid application rejection consumes the complete frame;
+an invalid frame candidate is resynchronized without trusting its payload length.
+
+The receive path handles sensor samples, complete capability reports and
+device status. Its limits are 4096 bytes per frame and 16 supported sensor
+descriptors. These are implementation limits, not protocol-wide maxima.
+
+IIO mapping
+-----------
+
+The supported sensor classes map to:
+
+* accelerometer: ``IIO_ACCEL`` X/Y/Z, in m/s^2;
+* gyroscope: ``IIO_ANGL_VEL`` X/Y/Z, in rad/s;
+* magnetometer: ``IIO_MAGN`` X/Y/Z, in gauss;
+* temperature: ``IIO_TEMP``, in millidegrees Celsius.
+
+Each registered channel exposes signed ``RAW`` data and descriptor-derived
+``SCALE``. Multiplying RAW by SCALE gives a value in the channel's IIO unit.

Supported descriptors must advertise a nonzero scale.

Documentation/iio/open-sensor-fusion.rst new file +21 -0

+A sample's channel count, format and scale must match its registered descriptor
+before it can update the latest RAW cache or be published to a buffer. A
+rejected sample preserves previously accepted data.
+
+Repeated reports are compared by sensor type and index, independently of entry
+order. Reserved padding, advisory flags and unsupported additions do not change
+the supported inventory. A supported key appearing or disappearing, or a
+change in its channel count, format or scale, faults the bound session.
+
+After a session fault, new cache updates and buffer publication stop, and
+direct RAW reads fail. Existing IIO devices remain until driver teardown.
+An equivalent report does not clear the fault; explicit unbind/rebind starts
+fresh discovery. No fault-specific userspace ABI is exposed.
+
+Timestamps
+----------
+
+Buffered samples use the selected IIO host clock when they are pushed into
+the buffer. The device timestamp is not correlated with that clock and is not
+used as the IIO buffer timestamp. Device timestamp or sequence discontinuities
+alone do not start a new host session.

MAINTAINERS +1 -0

index 9463b8111d52..26b9b2862724 100644
@@ -20515,6 +20515,7 @@ OPEN SENSOR FUSION
 M:	Jinseob Kim <[email protected]>
 S:	Maintained
 F:	Documentation/devicetree/bindings/iio/opensensorfusion,osf.yaml
+F:	Documentation/iio/open-sensor-fusion.rst
 K:	opensensorfusion
 
 OPENCOMPUTE PTP CLOCK DRIVER

Quoted 9 lines · On Sat, 19 Sep 2026 03:24:40 +0900 Jinseob Kim <[email protected]> wrote:

Document the supported OSF receiver profile, runtime sensor discovery, IIO channel units, scale validation and session lifetime.

Link the project-maintained fixed wire specification instead of duplicating its layouts and compatibility policy. Explain host IIO timestamps and the explicit rebind needed after a changed inventory.

Assisted-by LLM

Signed-off-by Jinseob Kim <[email protected]>

Hi Jinseob,

Just a couple of minor things inline.

Thanks,

Jonathan

Quoted 39 lines

---
 Documentation/iio/index.rst              |  1 +
 Documentation/iio/open-sensor-fusion.rst | 77 ++++++++++++++++++++++++
 MAINTAINERS                              |  1 +
 3 files changed, 79 insertions(+)
 create mode 100644 Documentation/iio/open-sensor-fusion.rst

Documentation/iio/index.rst +1 -0

index b02b879b053a..c2b7963348fd 100644
@@ -40,4 +40,5 @@ Industrial I/O Kernel Drivers
    adxl345
    bno055
    ep93xx_adc
+   open-sensor-fusion
    opt4060

Documentation/iio/open-sensor-fusion.rst new file +16 -0

new file mode 100644
index 000000000000..03ab36aca5f8
@@ -0,0 +1,77 @@
+.. SPDX-License-Identifier: GPL-2.0-only
+
+Open Sensor Fusion
+==================
+
+Open Sensor Fusion is a sensor aggregation hub interface. The Linux IIO driver
+receives device-to-host frames over UART and discovers sensor channels from
+capability reports. Device Tree describes the hub using the
+``opensensorfusion,osf`` compatible; individual sensors are discovered at
+runtime. See the binding in
+``Documentation/devicetree/bindings/iio/opensensorfusion,osf.yaml``.
+
+The OSF Device-to-Host 0.0 specification is maintained by the Open Sensor Fusion
+project. The canonical specification_ defines the wire layout, compatibility
+rules, reserved fields and physical units. This document describes the Linux
+receiver profile and its mapping to IIO.

Documentation/iio/open-sensor-fusion.rst line 26

Quoted 10 lines

Documentation/iio/open-sensor-fusion.rst new file +10 -0

+
+.. _specification: https://github.com/opensensorfusion/opensensorfusion-protocol/blob/ca9cdea1ae550c2b4d6f29f87877adae99470744/spec/osf-d2h-0.0.md
+
+Supported receive profile
+-------------------------
+
+The driver supports the fixed OSF0 frame layout with protocol major version 0.
+Compatible minor versions use the same known message layouts. The decoder
+requires exact lengths for known messages, validates CRC and bounds before
+interpreting payloads, and tolerates reserved padding. Unsupported majors and

If you spin again "Unsupported major versions and.."

Quoted 20 lines

Documentation/iio/open-sensor-fusion.rst new file +20 -0

+unknown message types are ignored. Unsupported capability entries are skipped
+individually. A CRC-valid application rejection consumes the complete frame;
+an invalid frame candidate is resynchronized without trusting its payload length.
+
+The receive path handles sensor samples, complete capability reports and
+device status. Its limits are 4096 bytes per frame and 16 supported sensor
+descriptors. These are implementation limits, not protocol-wide maxima.
+
+IIO mapping
+-----------
+
+The supported sensor classes map to:
+
+* accelerometer: ``IIO_ACCEL`` X/Y/Z, in m/s^2;
+* gyroscope: ``IIO_ANGL_VEL`` X/Y/Z, in rad/s;
+* magnetometer: ``IIO_MAGN`` X/Y/Z, in gauss;
+* temperature: ``IIO_TEMP``, in millidegrees Celsius.
+
+Each registered channel exposes signed ``RAW`` data and descriptor-derived
+``SCALE``. Multiplying RAW by SCALE gives a value in the channel's IIO unit.

Documentation/iio/open-sensor-fusion.rst

Quoted 10 lines

Documentation/iio/open-sensor-fusion.rst new file +10 -0

+Buffered samples use signed 32-bit values with native CPU endianness. Active
+channels are packed into the scan, with initialized padding before an optional
+64-bit timestamp.
+
+Discovery and session lifetime
+------------------------------
+
+The driver validates all supported descriptors before registering IIO devices.
+An empty or entirely unsupported initial report leaves discovery open for a
+later supported report.

So if the device can send multiple discovery reports, this implies if we recognise something in the first one we will stop looking at later ones? That seems odd given if we don't recognise anything we keep looking. If I'm reading too much into this text, then please tweak it to make it clear why this doesn't matter.

Quoted 34 lines

Supported descriptors must advertise a nonzero scale.

Documentation/iio/open-sensor-fusion.rst new file +21 -0

+A sample's channel count, format and scale must match its registered descriptor
+before it can update the latest RAW cache or be published to a buffer. A
+rejected sample preserves previously accepted data.
+
+Repeated reports are compared by sensor type and index, independently of entry
+order. Reserved padding, advisory flags and unsupported additions do not change
+the supported inventory. A supported key appearing or disappearing, or a
+change in its channel count, format or scale, faults the bound session.
+
+After a session fault, new cache updates and buffer publication stop, and
+direct RAW reads fail. Existing IIO devices remain until driver teardown.
+An equivalent report does not clear the fault; explicit unbind/rebind starts
+fresh discovery. No fault-specific userspace ABI is exposed.
+
+Timestamps
+----------
+
+Buffered samples use the selected IIO host clock when they are pushed into
+the buffer. The device timestamp is not correlated with that clock and is not
+used as the IIO buffer timestamp. Device timestamp or sequence discontinuities
+alone do not start a new host session.

MAINTAINERS +1 -0

index 9463b8111d52..26b9b2862724 100644
@@ -20515,6 +20515,7 @@ OPEN SENSOR FUSION
 M:   Jinseob Kim <[email protected]>
 S:   Maintained
 F:   Documentation/devicetree/bindings/iio/opensensorfusion,osf.yaml
+F:   Documentation/iio/open-sensor-fusion.rst
 K:   opensensorfusion
 
 OPENCOMPUTE PTP CLOCK DRIVER

Add helpers for decoding Open Sensor Fusion frame headers and supported message payloads.

Validate the fixed OSF0 envelope, payload bounds and CRC before exposing decoded frame contents. Require exact known payload lengths and decode capability entries structurally so the core can apply support policy. Tolerate reserved padding as required by the fixed protocol contract.

Use explicit little-endian wire storage sizes and designated initializers for decoded output structures.

Assisted-by LLM

Signed-off-by Jinseob Kim <[email protected]>

drivers/iio/opensensorfusion/osf_protocol.c new file +30 -0

new file mode 100644
index 000000000000..e0d7c7a9ebd7
 
+
+int osf_protocol_decode_frame(const u8 *buf, size_t len,
+			      struct osf_frame *frame, size_t *frame_len)
+{
+	u32 expected_crc;
+	u32 actual_crc;
+	u32 payload_len;
+	size_t total_len;
+
+	if (!buf || !frame || !frame_len)
+		return -EINVAL;
+
+	if (len < OSF_FRAME_MIN_LEN)
+		return -EMSGSIZE;
+
+	if (get_unaligned_le32(buf) != OSF_FRAME_MAGIC)
+		return -EPROTO;
+
+	if (get_unaligned_le16(buf + 6) != OSF_FRAME_HEADER_LEN)
+		return -EPROTO;
+
+	payload_len = get_unaligned_le32(buf + 10);
+	if (payload_len > len - OSF_FRAME_MIN_LEN)
+		return -EMSGSIZE;
+
+	total_len = OSF_FRAME_HEADER_LEN + payload_len + OSF_FRAME_CRC_LEN;
+	expected_crc = osf_crc32_ieee(buf, OSF_FRAME_HEADER_LEN + payload_len);
+	actual_crc = get_unaligned_le32(buf + OSF_FRAME_HEADER_LEN + payload_len);
+
+	if (actual_crc != expected_crc)

drivers/iio/opensensorfusion/osf_protocol.c new file +17 -0

+	*frame_len = total_len;
+
+	return 0;
+}
 
+
+int osf_protocol_decode_capability_report(const struct osf_frame *frame,
+					  struct osf_capability_report *report)
+{
+	u16 capability_count;
+	size_t expected_len;
+	const u8 *payload;
+
+	if (!frame || !report || !frame->payload)
+		return -EINVAL;
+
+	if (frame->message_type != OSF_MSG_CAPABILITY_REPORT)
+		return -EPROTO;

drivers/iio/opensensorfusion/osf_protocol.c new file +21 -0

+		return -EMSGSIZE;
+
+	*report = (struct osf_capability_report) {
+		.capability_count = capability_count,
+		.entries = payload + OSF_CAP_REPORT_BASE_LEN,
+	};
+
+	return 0;
+}
+
+int osf_protocol_decode_capability_entry(const struct osf_capability_report
+					 *report, u16 index,
+					 struct osf_capability_entry *entry)
+{
+	const u8 *payload;
+
+	if (!report || !report->entries || !entry)
+		return -EINVAL;
+
+	if (index >= report->capability_count)
+		return -ERANGE;

drivers/iio/opensensorfusion/osf_protocol.c new file +4 -0

+	};
+
+	return 0;
+}

The above fully assigns frame so I'd do similar to you have elsewhere *frame = (struct osf_frame) {
.protocol_major = ...
...
};
Both makes it more readable and makes it clear you aren't leaving any existing data in place.

I don't hugely mind as it's your code + spec to maintain but generally for a spec with records like this I'd expect it to be possible to extend the structure without it being a breaking spec change. As such I'd kind of expect the check to be that the payload_len was at least as big as expected len. Larger would be fine but we'd ignore anything there.

Entirely correctly I think you don't do any checks or reads of reserved values. As such why copy them around? I'd just drop that field from your decoded structures. Not a huge saving but why carry irrelevant data around!

Quoted 8 lines · On Sat, 19 Sep 2026 03:24:41 +0900 Jinseob Kim <[email protected]> wrote:

Add helpers for decoding Open Sensor Fusion frame headers and supported message payloads.

Validate the fixed OSF0 envelope, payload bounds and CRC before exposing decoded frame contents. Require exact known payload lengths and decode capability entries structurally so the core can apply support policy. Tolerate reserved padding as required by the fixed protocol contract.

Quoted 5 lines

Use explicit little-endian wire storage sizes and designated initializers for decoded output structures.

Assisted-by LLM

Signed-off-by Jinseob Kim <[email protected]>

Hi Jinseob

A few things inline. Some are about what I'd kind of expect from how specs are often defined to leave a bit of flexibility and reduce the need to update drivers for new stuff being added.

If you don't want to go that way I don't really mind.

Otherwise main thing here is why carry reserved data to next layer given it is meant to be ignored. Drop it down here in the protocol decode.

Thanks,

Jonathan

Quoted 36 lines

drivers/iio/opensensorfusion/osf_protocol.c new file +30 -0

new file mode 100644
index 000000000000..e0d7c7a9ebd7
 
+
+int osf_protocol_decode_frame(const u8 *buf, size_t len,
+                           struct osf_frame *frame, size_t *frame_len)
+{
+     u32 expected_crc;
+     u32 actual_crc;
+     u32 payload_len;
+     size_t total_len;
+
+     if (!buf || !frame || !frame_len)
+             return -EINVAL;
+
+     if (len < OSF_FRAME_MIN_LEN)
+             return -EMSGSIZE;
+
+     if (get_unaligned_le32(buf) != OSF_FRAME_MAGIC)
+             return -EPROTO;
+
+     if (get_unaligned_le16(buf + 6) != OSF_FRAME_HEADER_LEN)
+             return -EPROTO;
+
+     payload_len = get_unaligned_le32(buf + 10);
+     if (payload_len > len - OSF_FRAME_MIN_LEN)
+             return -EMSGSIZE;
+
+     total_len = OSF_FRAME_HEADER_LEN + payload_len + OSF_FRAME_CRC_LEN;
+     expected_crc = osf_crc32_ieee(buf, OSF_FRAME_HEADER_LEN + payload_len);
+     actual_crc = get_unaligned_le32(buf + OSF_FRAME_HEADER_LEN + payload_len);
+
+     if (actual_crc != expected_crc)

drivers/iio/opensensorfusion/osf_protocol.c line 63

Quoted 10 lines

drivers/iio/opensensorfusion/osf_protocol.c new file +10 -0

+             return -EBADMSG;
+
+     frame->protocol_major = buf[4];
+     frame->protocol_minor = buf[5];
+     frame->message_type = get_unaligned_le16(buf + 8);
+     frame->payload_len = payload_len;
+     frame->sequence = get_unaligned_le64(buf + 14);
+     frame->timestamp_us = get_unaligned_le64(buf + 22);
+     frame->flags = get_unaligned_le32(buf + 30);
+     frame->reserved = get_unaligned_le32(buf + 34);

As below. I'm not sure what benefit of keeping reserved around is.

drivers/iio/opensensorfusion/osf_protocol.c line 65

Quoted 2 lines

drivers/iio/opensensorfusion/osf_protocol.c new file +2 -0

+     frame->payload = buf + OSF_FRAME_HEADER_LEN;
+     frame->crc = actual_crc;

The above fully assigns frame so I'd do similar to you have elsewhere

        *frame = (struct osf_frame) {
                .protocol_major = ...
...
        };

Both makes it more readable and makes it clear you aren't leaving any existing data in place.

Quoted 18 lines

drivers/iio/opensensorfusion/osf_protocol.c new file +17 -0

+     *frame_len = total_len;
+
+     return 0;
+}
 
+
+int osf_protocol_decode_capability_report(const struct osf_frame *frame,
+                                       struct osf_capability_report *report)
+{
+     u16 capability_count;
+     size_t expected_len;
+     const u8 *payload;
+
+     if (!frame || !report || !frame->payload)
+             return -EINVAL;
+
+     if (frame->message_type != OSF_MSG_CAPABILITY_REPORT)
+             return -EPROTO;

drivers/iio/opensensorfusion/osf_protocol.c line 180

Quoted 10 lines

drivers/iio/opensensorfusion/osf_protocol.c new file +10 -0

+
+     if (frame->payload_len < OSF_CAP_REPORT_BASE_LEN)
+             return -EMSGSIZE;
+
+     payload = frame->payload;
+     capability_count = get_unaligned_le16(payload);
+
+     expected_len = OSF_CAP_REPORT_BASE_LEN +
+                    capability_count * OSF_CAP_SENSOR_ENTRY_LEN;
+     if (frame->payload_len != expected_len)

I don't hugely mind as it's your code + spec to maintain but generally for a spec with records like this I'd expect it to be possible to extend
the structure without it being a breaking spec change. As such
I'd kind of expect the check to be that the payload_len was at least as big as expected len. Larger would be fine but we'd ignore anything there.

Quoted 21 lines

drivers/iio/opensensorfusion/osf_protocol.c new file +21 -0

+             return -EMSGSIZE;
+
+     *report = (struct osf_capability_report) {
+             .capability_count = capability_count,
+             .entries = payload + OSF_CAP_REPORT_BASE_LEN,
+     };
+
+     return 0;
+}
+
+int osf_protocol_decode_capability_entry(const struct osf_capability_report
+                                      *report, u16 index,
+                                      struct osf_capability_entry *entry)
+{
+     const u8 *payload;
+
+     if (!report || !report->entries || !entry)
+             return -EINVAL;
+
+     if (index >= report->capability_count)
+             return -ERANGE;

drivers/iio/opensensorfusion/osf_protocol.c line 211

Quoted 10 lines

drivers/iio/opensensorfusion/osf_protocol.c new file +10 -0

+
+     payload = report->entries + index * OSF_CAP_SENSOR_ENTRY_LEN;
+     *entry = (struct osf_capability_entry) {
+             .sensor_type = get_unaligned_le16(payload),
+             .sensor_index = get_unaligned_le16(payload + 2),
+             .channel_count = get_unaligned_le16(payload + 4),
+             .sample_format = get_unaligned_le16(payload + 6),
+             .scale_nano = get_unaligned_le32(payload + 8),
+             .flags = get_unaligned_le32(payload + 12),
+             .reserved = get_unaligned_le32(payload + 16),

Entirely correctly I think you don't do any checks or reads of reserved values. As such why copy them around? I'd just drop that field from your decoded structures. Not a huge saving but why carry irrelevant data around!

Jonathan

Quoted 4 lines

drivers/iio/opensensorfusion/osf_protocol.c new file +4 -0

+     };
+
+     return 0;
+}

Add a UART byte-stream parser for Open Sensor Fusion frames.

The parser searches for the OSF0 wire magic, keeps partial frames buffered, checks header length and payload bounds, and passes complete candidate frames to a registered frame callback.

Candidates rejected before validation drop only the current head byte before resynchronizing, so a corrupted unvalidated payload length cannot make the parser skip later valid frames. CRC-valid validated frames are consumed in full and classified as handled, ignored, or rejected.

Use a direct callback member with an opaque context and keep explicit statistics for validated outcomes and framing failures.

Assisted-by LLM

Signed-off-by Jinseob Kim <[email protected]>

drivers/iio/opensensorfusion/osf_stream.c new file +12 -0

new file mode 100644
index 000000000000..e262415e69b7
 
 
+void osf_stream_init(struct osf_stream *stream,
+		     int (*receive_frame)(void *context, const u8 *buf,
+					  size_t len),
+		     void *frame_context)
+{
+	if (!stream)
+		return;
+
+	stream->receive_frame = receive_frame;
+	stream->frame_context = frame_context;
+	stream->len = 0;
+	memset(&stream->stats, 0, sizeof(stream->stats));

You could reorder these two functions and call stream_reset from stream_init. Would make it clear what getting to a 'clean' state means.

Quoted 12 lines · On Sat, 19 Sep 2026 03:24:42 +0900 Jinseob Kim <[email protected]> wrote:

Add a UART byte-stream parser for Open Sensor Fusion frames.

The parser searches for the OSF0 wire magic, keeps partial frames buffered, checks header length and payload bounds, and passes complete candidate frames to a registered frame callback.

Candidates rejected before validation drop only the current head byte before resynchronizing, so a corrupted unvalidated payload length cannot make the parser skip later valid frames. CRC-valid validated frames are consumed in full and classified as handled, ignored, or rejected.

Quoted 5 lines

Use a direct callback member with an opaque context and keep explicit statistics for validated outcomes and framing failures.

Assisted-by LLM

Signed-off-by Jinseob Kim <[email protected]>

Just one trivial thing.

Thanks,

Jonathan

Quoted 19 lines

drivers/iio/opensensorfusion/osf_stream.c new file +12 -0

new file mode 100644
index 000000000000..e262415e69b7
 
 
+void osf_stream_init(struct osf_stream *stream,
+                  int (*receive_frame)(void *context, const u8 *buf,
+                                       size_t len),
+                  void *frame_context)
+{
+     if (!stream)
+             return;
+
+     stream->receive_frame = receive_frame;
+     stream->frame_context = frame_context;
+     stream->len = 0;
+     memset(&stream->stats, 0, sizeof(stream->stats));

drivers/iio/opensensorfusion/osf_stream.c line 186

Quoted 10 lines

drivers/iio/opensensorfusion/osf_stream.c new file +10 -0

+}
+
+void osf_stream_reset(struct osf_stream *stream)
+{
+     if (!stream)
+             return;
+
+     stream->len = 0;
+     memset(&stream->stats, 0, sizeof(stream->stats));
+}

You could reorder these two functions and call stream_reset from stream_init. Would make it clear what getting to a 'clean' state means.

Quoted 3 lines

You could reorder these two functions and call stream_reset from stream_init. Would make it clear what getting to a 'clean' state means.

Agreed. I'll move osf_stream_reset() before osf_stream_init() and use it from the init path in the next revision.

Thanks,

Jinseob

2026년 9월 20일 (일) 오전 10:31, Jonathan Cameron <[email protected]>님이 작성:

Quoted 64 lines

Quoted 12 lines · On Sat, 19 Sep 2026 03:24:42 +0900 Jinseob Kim <[email protected]> wrote:

Add a UART byte-stream parser for Open Sensor Fusion frames.

The parser searches for the OSF0 wire magic, keeps partial frames buffered, checks header length and payload bounds, and passes complete candidate frames to a registered frame callback.

Candidates rejected before validation drop only the current head byte before resynchronizing, so a corrupted unvalidated payload length cannot make the parser skip later valid frames. CRC-valid validated frames are consumed in full and classified as handled, ignored, or rejected.

Quoted 5 lines

Use a direct callback member with an opaque context and keep explicit statistics for validated outcomes and framing failures.

Assisted-by LLM

Signed-off-by Jinseob Kim <[email protected]>

Just one trivial thing.

Thanks,

Jonathan

Quoted 19 lines

drivers/iio/opensensorfusion/osf_stream.c new file +12 -0

new file mode 100644
index 000000000000..e262415e69b7
 
 
+void osf_stream_init(struct osf_stream *stream,
+                  int (*receive_frame)(void *context, const u8 *buf,
+                                       size_t len),
+                  void *frame_context)
+{
+     if (!stream)
+             return;
+
+     stream->receive_frame = receive_frame;
+     stream->frame_context = frame_context;
+     stream->len = 0;
+     memset(&stream->stats, 0, sizeof(stream->stats));

drivers/iio/opensensorfusion/osf_stream.c line 186

Quoted 10 lines

drivers/iio/opensensorfusion/osf_stream.c new file +10 -0

+}
+
+void osf_stream_reset(struct osf_stream *stream)
+{
+     if (!stream)
+             return;
+
+     stream->len = 0;
+     memset(&stream->stats, 0, sizeof(stream->stats));
+}  

You could reorder these two functions and call stream_reset from stream_init. Would make it clear what getting to a 'clean' state means.

Connect the stream parser to a serdev receiver and add core frame dispatch with an owned device-status cache. Preserve the distinction between unvalidated candidates and validated application rejections, so malformed status payloads do not cause byte-wise resynchronization.

Open and configure the UART before enabling the supply. A managed release action closes and drains the receive producer before resetting the parser and disabling a successfully enabled supply.

This transport base processes device-status frames and ignores message types without an application handler. It does not register IIO sensor devices. The following patch adds capability discovery and sample publication to IIO, including the publication gate and IIO teardown.

Assisted-by LLM

Signed-off-by Jinseob Kim <[email protected]>

---
 MAINTAINERS                               |   3 +-
 drivers/iio/Kconfig                       |   1 +
 drivers/iio/Makefile                      |   1 +
 drivers/iio/opensensorfusion/Kconfig      |  12 ++
 drivers/iio/opensensorfusion/Makefile     |   5 +
 drivers/iio/opensensorfusion/osf_core.c   | 101 +++++++++++++++
 drivers/iio/opensensorfusion/osf_core.h   |  29 +++++
 drivers/iio/opensensorfusion/osf_serdev.c | 143 ++++++++++++++++++++++
 8 files changed, 293 insertions(+), 2 deletions(-)
 create mode 100644 drivers/iio/opensensorfusion/Kconfig
 create mode 100644 drivers/iio/opensensorfusion/Makefile
 create mode 100644 drivers/iio/opensensorfusion/osf_core.c
 create mode 100644 drivers/iio/opensensorfusion/osf_core.h
 create mode 100644 drivers/iio/opensensorfusion/osf_serdev.c

MAINTAINERS +0 -0

index bad05db854cf..fbbf5f06f1a5 100644

MAINTAINERS +0 -0

 K:	opensensorfusion
 

drivers/iio/opensensorfusion/osf_core.c new file +9 -0

new file mode 100644
index 000000000000..e6812cef4d8c
@@ -0,0 +1,101 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <linux/device.h>
+#include <linux/errno.h>
+#include <linux/types.h>
+
+#include "osf_core.h"
+#include "osf_stream.h"
+

drivers/iio/opensensorfusion/osf_core.c new file +41 -0

+int osf_core_receive_frame(struct osf_device *osf, const u8 *buf, size_t len)
+{
+	struct osf_frame frame;
+	size_t frame_len;
+	int ret;
+
+	ret = osf_protocol_decode_frame(buf, len, &frame, &frame_len);
+	if (ret)
+		return ret;
+
+	if (frame_len != len)
+		return -EMSGSIZE;
+
+	if (frame.protocol_major != OSF_PROTOCOL_MAJOR) {
+		dev_dbg_ratelimited(osf->dev,
+				    "ignoring unsupported protocol major %u\n",
+				    frame.protocol_major);
+		return OSF_STREAM_FRAME_IGNORED;
+	}
+
+	switch (frame.message_type) {
+	case OSF_MSG_DEVICE_STATUS:
+		ret = osf_core_handle_device_status(osf, &frame);
+		break;
+	default:
+		if (frame.message_type >= OSF_RESERVED_MSG_FIRST &&
+		    frame.message_type <= OSF_RESERVED_MSG_LAST) {
+			dev_dbg_ratelimited(osf->dev,
+					    "ignoring reserved message type %#x\n",
+					    frame.message_type);
+			return OSF_STREAM_FRAME_IGNORED;
+		}
+		if (frame.message_type >= OSF_VENDOR_PRIVATE_FIRST) {
+			dev_dbg_ratelimited(osf->dev,
+					    "ignoring vendor message type %#x\n",
+					    frame.message_type);
+			return OSF_STREAM_FRAME_IGNORED;
+		}
+
+		dev_dbg_ratelimited(osf->dev,
+				    "ignoring unsupported message type %#x\n",

drivers/iio/opensensorfusion/osf_core.c new file +3 -0

+
+	return ret;
+}

drivers/iio/opensensorfusion/osf_serdev.c new file +0 -0

new file mode 100644
index 000000000000..8a747c01ff9d

drivers/iio/opensensorfusion/osf_serdev.c new file +16 -0

+#include <linux/device.h>
+#include <linux/err.h>
+#include <linux/errno.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/regulator/consumer.h>
+#include <linux/serdev.h>
+#include <linux/slab.h>
+#include <linux/types.h>
 
+static int osf_serdev_probe(struct serdev_device *serdev)
+{
+	struct device *dev = &serdev->dev;
+	struct osf_serdev *osf_uart;
+	unsigned int baudrate;
+	int ret;
+

drivers/iio/opensensorfusion/osf_serdev.c new file +31 -0

+	osf_uart->serdev = serdev;
+	osf_core_init(&osf_uart->osf, dev);
+	osf_stream_init(&osf_uart->stream, osf_serdev_receive_frame,
+			&osf_uart->osf);
+
+	serdev_device_set_drvdata(serdev, osf_uart);
+	serdev_device_set_client_ops(serdev, &osf_serdev_ops);
+
+	ret = serdev_device_open(serdev);
+	if (ret)
+		return ret;
+
+	ret = devm_add_action_or_reset(dev, osf_serdev_release, osf_uart);
+	if (ret)
+		return ret;
+
+	baudrate = serdev_device_set_baudrate(serdev, OSF_SERDEV_BAUD);
+	if (baudrate != OSF_SERDEV_BAUD)
+		/* Keep accepting controller rounding after reporting the mismatch. */
+		dev_warn_probe(dev, -EINVAL, "requested %u baud, controller set %u\n",
+			       OSF_SERDEV_BAUD, baudrate);
+
+	serdev_device_set_flow_control(serdev, false);
+
+	ret = regulator_enable(osf_uart->vcc);
+	if (ret)
+		return dev_err_probe(dev, ret, "failed to enable vcc regulator\n");
+	osf_uart->vcc_enabled = true;
+
+	return 0;
+}

Register IIO devices from supported capability descriptors and expose signed raw samples, descriptor scales and software buffers. Keep early capabilities owned by the core until UART and supply setup is complete, and unregister children after the receive producer has stopped.

Validate nonzero descriptor scales and sample/descriptor equality, leave discovery open after empty or unsupported inventories, and compare repeated descriptors independently of order. Fault a bound session if a descriptor changes meaning, gating cache and buffer publication together.

Add initialized active-scan packing and buffer producer quiescence. The production implementation is now complete; subsequent patches only add the existing core and IIO KUnit suites and their build wiring.

Assisted-by LLM

Signed-off-by Jinseob Kim <[email protected]>

drivers/iio/opensensorfusion/osf_iio.c new file +0 -0

new file mode 100644
index 000000000000..f4011b8fae14

drivers/iio/opensensorfusion/osf_iio.c new file +8 -0

+
+#define OSF_MOD_CHAN(_type, _mod, _idx)				\
+	{								\
+		.type = (_type),					\
+		.modified = 1,						\
+		.channel2 = (_mod),					\
+		.info_mask_separate = BIT(IIO_CHAN_INFO_RAW),		\
+		.info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),	\

drivers/iio/opensensorfusion/osf_iio.c new file +78 -0

+	{								\
+		.type = (_type),					\
+		.info_mask_separate = BIT(IIO_CHAN_INFO_RAW),		\
+		.info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),	\
+		.scan_index = (_idx),					\
+		.scan_type = {						\
+			.sign = 's',					\
+			.realbits = 32,					\
+			.storagebits = 32,				\
+			.endianness = IIO_CPU,				\
+		},							\
+	}
+
+static const struct iio_chan_spec osf_accel_channels[] = {
+	OSF_MOD_CHAN(IIO_ACCEL, IIO_MOD_X, 0),
+	OSF_MOD_CHAN(IIO_ACCEL, IIO_MOD_Y, 1),
+	OSF_MOD_CHAN(IIO_ACCEL, IIO_MOD_Z, 2),
+	IIO_CHAN_SOFT_TIMESTAMP(3),
+};
+
+static const struct iio_chan_spec osf_gyro_channels[] = {
+	OSF_MOD_CHAN(IIO_ANGL_VEL, IIO_MOD_X, 0),
+	OSF_MOD_CHAN(IIO_ANGL_VEL, IIO_MOD_Y, 1),
+	OSF_MOD_CHAN(IIO_ANGL_VEL, IIO_MOD_Z, 2),
+	IIO_CHAN_SOFT_TIMESTAMP(3),
+};
+
+static const struct iio_chan_spec osf_mag_channels[] = {
+	OSF_MOD_CHAN(IIO_MAGN, IIO_MOD_X, 0),
+	OSF_MOD_CHAN(IIO_MAGN, IIO_MOD_Y, 1),
+	OSF_MOD_CHAN(IIO_MAGN, IIO_MOD_Z, 2),
+	IIO_CHAN_SOFT_TIMESTAMP(3),
+};
+
+static const struct iio_chan_spec osf_temp_channels[] = {
+	OSF_CHAN(IIO_TEMP, 0),
+	IIO_CHAN_SOFT_TIMESTAMP(1),
+};
+
+static const struct osf_iio_sensor_spec osf_iio_sensor_specs[] = {
+	{
+		.sensor_type = OSF_SENSOR_ACCELEROMETER,
+		.channel_count = 3,
+		.name = "osf-accel",
+		.channels = osf_accel_channels,
+		.num_channels = ARRAY_SIZE(osf_accel_channels),
+	},
+	{
+		.sensor_type = OSF_SENSOR_GYROSCOPE,
+		.channel_count = 3,
+		.name = "osf-gyro",
+		.channels = osf_gyro_channels,
+		.num_channels = ARRAY_SIZE(osf_gyro_channels),
+	},
+	{
+		.sensor_type = OSF_SENSOR_MAGNETOMETER,
+		.channel_count = 3,
+		.name = "osf-magn",
+		.channels = osf_mag_channels,
+		.num_channels = ARRAY_SIZE(osf_mag_channels),
+	},
+	{
+		.sensor_type = OSF_SENSOR_TEMPERATURE,
+		.channel_count = 1,
+		.name = "osf-temp",
+		.channels = osf_temp_channels,
+		.num_channels = ARRAY_SIZE(osf_temp_channels),
+	},
+};
+
+static const struct osf_iio_sensor_spec *
+osf_iio_find_sensor_spec(u16 sensor_type, u16 channel_count)
+{
+	for (unsigned int i = 0; i < ARRAY_SIZE(osf_iio_sensor_specs); i++) {
+		if (osf_iio_sensor_specs[i].sensor_type == sensor_type &&
+		    osf_iio_sensor_specs[i].channel_count == channel_count)
+			return &osf_iio_sensor_specs[i];
+	}

drivers/iio/opensensorfusion/osf_iio.c new file +16 -0

+	state->buffer_active = true;
+
+	return 0;
+}
+
+static int osf_iio_buffer_predisable(struct iio_dev *indio_dev)
+{
+	struct osf_iio_state *state = iio_priv(indio_dev);
+
+	/* Wait for the current push before the IIO core changes its buffers. */
+	guard(mutex)(&state->buffer_lock);
+	state->buffer_active = false;
+
+	return 0;
+}
 
 
+

drivers/iio/opensensorfusion/osf_iio.c new file +12 -0

+
+		/* Pack the active channels; unused storage remains initialized. */
+		for_each_set_bit(channel, indio_dev->active_scan_mask, channel_count)
+			scan.values[index++] = values[channel];
+
+		return iio_push_to_buffers_with_ts(indio_dev, &scan,
+						   sizeof(scan), timestamp);
+	}
+	default:
+		return -EPROTO;
+	}
+}

drivers/iio/opensensorfusion/osf_serdev.c +0 -0

index 8a747c01ff9d..3d5e90d83967 100644

drivers/iio/opensensorfusion/osf_serdev.c +0 -0

 MODULE_LICENSE("GPL");

Using an extra lock is one solution I suppose to the risk of this racing with the buffer tear down and the problems around active_scan_mask being freed. Could you use

if (iio_device_try_claim_buffer_mode(indio_dev))

and later a release on that to achieve the same result?

Only the ade9000 is doing similar at the moment so would need some testing to make sure no lock inversions occur in general but given you don't take any other locks in here it should be fine.

Quoted 5 lines · On Sat, 19 Sep 2026 03:24:44 +0900 Jinseob Kim <[email protected]> wrote:

Register IIO devices from supported capability descriptors and expose signed raw samples, descriptor scales and software buffers. Keep early capabilities owned by the core until UART and supply setup is complete, and unregister children after the receive producer has stopped.

Quoted 8 lines

Validate nonzero descriptor scales and sample/descriptor equality, leave discovery open after empty or unsupported inventories, and compare repeated descriptors independently of order. Fault a bound session if a descriptor changes meaning, gating cache and buffer publication together.

Add initialized active-scan packing and buffer producer quiescence. The production implementation is now complete; subsequent patches only add the existing core and IIO KUnit suites and their build wiring.

No need to talk about what other patches do and that a series is functionally complete in a patch. If you want to do it, under the --- so it doesn't end up in the git log.

Quoted 3 lines

Assisted-by LLM

Signed-off-by Jinseob Kim <[email protected]>

A few things inline. Biggest one is a question (I'm not sure) on whether you can use a claim on buffered mode (which will hold it in that if it succeeds until released) is sufficient to replace the extra lock you have to block that transition.

Thanks,

Jonathan

Quoted 5 lines

drivers/iio/opensensorfusion/osf_iio.c new file +0 -0

new file mode 100644
index 000000000000..f4011b8fae14

...

drivers/iio/opensensorfusion/osf_iio.c line 39

Quoted 4 lines

drivers/iio/opensensorfusion/osf_iio.c new file +4 -0

+
+struct osf_iio_scan_3axis {
+     s32 values[3];
+     u32 padding;

No needed unless you explicitly write into padding for some reason. C rules add it anyway and then we don't need to make sure it remains correct if this structure changes in future.

drivers/iio/opensensorfusion/osf_iio.c line 45

Quoted 6 lines

drivers/iio/opensensorfusion/osf_iio.c new file +6 -0

+     aligned_s64 timestamp;
+};
+
+struct osf_iio_scan_1axis {
+     s32 value;
+     u32 padding;

As above, unneeded.

drivers/iio/opensensorfusion/osf_iio.c

Quoted 2 lines

drivers/iio/opensensorfusion/osf_iio.c new file +2 -0

+     aligned_s64 timestamp;
+};

Given I think these are only used in one place, moving them to there would avoid need for named structure types.

Quoted 8 lines

drivers/iio/opensensorfusion/osf_iio.c new file +8 -0

+
+#define OSF_MOD_CHAN(_type, _mod, _idx)                              \
+     {                                                               \
+             .type = (_type),                                        \
+             .modified = 1,                                          \
+             .channel2 = (_mod),                                     \
+             .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),           \
+             .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),   \

drivers/iio/opensensorfusion/osf_iio.c line 65

Quoted 10 lines

drivers/iio/opensensorfusion/osf_iio.c new file +10 -0

+             .scan_index = (_idx),                                   \
+             .scan_type = {                                          \
+                     .sign = 's',                                    \
+                     .realbits = 32,                                 \
+                     .storagebits = 32,                              \
+                     .endianness = IIO_CPU,                          \
+             },                                                      \
+     }
+
+#define OSF_CHAN(_type, _idx)                                        \

Given this is not much used, you could use the IIO_NO_MOD modifier as a gate on setting .modified = (_mod != IIO_NO_MOD) ? 1 : 0,
and have just one macro.

Quoted 78 lines

drivers/iio/opensensorfusion/osf_iio.c new file +78 -0

+     {                                                               \
+             .type = (_type),                                        \
+             .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),           \
+             .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),   \
+             .scan_index = (_idx),                                   \
+             .scan_type = {                                          \
+                     .sign = 's',                                    \
+                     .realbits = 32,                                 \
+                     .storagebits = 32,                              \
+                     .endianness = IIO_CPU,                          \
+             },                                                      \
+     }
+
+static const struct iio_chan_spec osf_accel_channels[] = {
+     OSF_MOD_CHAN(IIO_ACCEL, IIO_MOD_X, 0),
+     OSF_MOD_CHAN(IIO_ACCEL, IIO_MOD_Y, 1),
+     OSF_MOD_CHAN(IIO_ACCEL, IIO_MOD_Z, 2),
+     IIO_CHAN_SOFT_TIMESTAMP(3),
+};
+
+static const struct iio_chan_spec osf_gyro_channels[] = {
+     OSF_MOD_CHAN(IIO_ANGL_VEL, IIO_MOD_X, 0),
+     OSF_MOD_CHAN(IIO_ANGL_VEL, IIO_MOD_Y, 1),
+     OSF_MOD_CHAN(IIO_ANGL_VEL, IIO_MOD_Z, 2),
+     IIO_CHAN_SOFT_TIMESTAMP(3),
+};
+
+static const struct iio_chan_spec osf_mag_channels[] = {
+     OSF_MOD_CHAN(IIO_MAGN, IIO_MOD_X, 0),
+     OSF_MOD_CHAN(IIO_MAGN, IIO_MOD_Y, 1),
+     OSF_MOD_CHAN(IIO_MAGN, IIO_MOD_Z, 2),
+     IIO_CHAN_SOFT_TIMESTAMP(3),
+};
+
+static const struct iio_chan_spec osf_temp_channels[] = {
+     OSF_CHAN(IIO_TEMP, 0),
+     IIO_CHAN_SOFT_TIMESTAMP(1),
+};
+
+static const struct osf_iio_sensor_spec osf_iio_sensor_specs[] = {
+     {
+             .sensor_type = OSF_SENSOR_ACCELEROMETER,
+             .channel_count = 3,
+             .name = "osf-accel",
+             .channels = osf_accel_channels,
+             .num_channels = ARRAY_SIZE(osf_accel_channels),
+     },
+     {
+             .sensor_type = OSF_SENSOR_GYROSCOPE,
+             .channel_count = 3,
+             .name = "osf-gyro",
+             .channels = osf_gyro_channels,
+             .num_channels = ARRAY_SIZE(osf_gyro_channels),
+     },
+     {
+             .sensor_type = OSF_SENSOR_MAGNETOMETER,
+             .channel_count = 3,
+             .name = "osf-magn",
+             .channels = osf_mag_channels,
+             .num_channels = ARRAY_SIZE(osf_mag_channels),
+     },
+     {
+             .sensor_type = OSF_SENSOR_TEMPERATURE,
+             .channel_count = 1,
+             .name = "osf-temp",
+             .channels = osf_temp_channels,
+             .num_channels = ARRAY_SIZE(osf_temp_channels),
+     },
+};
+
+static const struct osf_iio_sensor_spec *
+osf_iio_find_sensor_spec(u16 sensor_type, u16 channel_count)
+{
+     for (unsigned int i = 0; i < ARRAY_SIZE(osf_iio_sensor_specs); i++) {
+             if (osf_iio_sensor_specs[i].sensor_type == sensor_type &&
+                 osf_iio_sensor_specs[i].channel_count == channel_count)
+                     return &osf_iio_sensor_specs[i];
+     }

drivers/iio/opensensorfusion/osf_iio.c

Quoted 10 lines

drivers/iio/opensensorfusion/osf_iio.c new file +10 -0

+
+     return NULL;
+}
+
+bool osf_iio_sensor_supported(u16 sensor_type, u16 channel_count)
+{
+     if (osf_iio_find_sensor_spec(sensor_type, channel_count))
+             return true;
+
+     return false

        return osf_iio_find_sensor_spec(sensor_type, channel_count) != NULL;

drivers/iio/opensensorfusion/osf_iio.c line 202

Quoted 8 lines

drivers/iio/opensensorfusion/osf_iio.c new file +7 -0

+}
 
+
+static int osf_iio_buffer_postenable(struct iio_dev *indio_dev)
+{
+     struct osf_iio_state *state = iio_priv(indio_dev);
+
+     guard(mutex)(&state->buffer_lock);

These transistions are already guarded by the core, so see the question later on whether you can just claim buffered mode in the data handler to avoid the need for this. That might not work but the way you did this got me thinking about a more general solution to the problem.

Quoted 18 lines

drivers/iio/opensensorfusion/osf_iio.c new file +16 -0

+     state->buffer_active = true;
+
+     return 0;
+}
+
+static int osf_iio_buffer_predisable(struct iio_dev *indio_dev)
+{
+     struct osf_iio_state *state = iio_priv(indio_dev);
+
+     /* Wait for the current push before the IIO core changes its buffers. */
+     guard(mutex)(&state->buffer_lock);
+     state->buffer_active = false;
+
+     return 0;
+}
 
 
+

drivers/iio/opensensorfusion/osf_iio.c line 307

Quoted 10 lines

drivers/iio/opensensorfusion/osf_iio.c new file +10 -0

+int osf_iio_push_sample(struct iio_dev *indio_dev, const s32 *values,
+                     u16 channel_count)
+{
+     struct osf_iio_state *state = iio_priv(indio_dev);
+     s64 timestamp;
+
+     if (channel_count != state->spec->channel_count)
+             return -EPROTO;
+
+     guard(mutex)(&state->buffer_lock);

Using an extra lock is one solution I suppose to the risk of this racing with the buffer tear down and the problems around active_scan_mask being freed. Could you use

if (iio_device_try_claim_buffer_mode(indio_dev))
and later a release on that to achieve the same result?

Only the ade9000 is doing similar at the moment so would need some testing to make sure no lock inversions occur in general but given you don't take any other locks in here it should be fine.

drivers/iio/opensensorfusion/osf_iio.c line 317

Quoted 10 lines

drivers/iio/opensensorfusion/osf_iio.c new file +10 -0

+     if (!state->buffer_active || !iio_buffer_enabled(indio_dev))
+             return 0;
+
+     timestamp = iio_get_time_ns(indio_dev);
+
+     switch (channel_count) {
+     case 1: {
+             struct osf_iio_scan_1axis scan = {
+                     .value = values[0],
+             };

As suggested above, this structure type is only used locally here. So make the definition local as well.

                struct {
                        s32 value;
                        aligned_s64 timestamp;
                } scan = { };

drivers/iio/opensensorfusion/osf_iio.c line 324

Quoted 7 lines

drivers/iio/opensensorfusion/osf_iio.c new file +7 -0

+
+             return iio_push_to_buffers_with_ts(indio_dev, &scan,
+                                                sizeof(scan), timestamp);
+     }
+     case 3: {
+             struct osf_iio_scan_3axis scan = {
+                     .values = { },

Setting values doesn't add anything useful as = { } zeros the whole structure (including any holes - they kernel is built with specific compiler options to ensure that last bit as it wasn't required in older c specs).

drivers/iio/opensensorfusion/osf_iio.c

Quoted 2 lines

drivers/iio/opensensorfusion/osf_iio.c new file +2 -0

+             };
+             unsigned int channel, index = 0;

Please split declarations that assign and ones that don't on to separate lines. Ends up a little more readable.

                unsigned int index = 0;
                unsigned int channel;

Quoted 18 lines

drivers/iio/opensensorfusion/osf_iio.c new file +12 -0

+
+             /* Pack the active channels; unused storage remains initialized. */
+             for_each_set_bit(channel, indio_dev->active_scan_mask, channel_count)
+                     scan.values[index++] = values[channel];
+
+             return iio_push_to_buffers_with_ts(indio_dev, &scan,
+                                                sizeof(scan), timestamp);
+     }
+     default:
+             return -EPROTO;
+     }
+}

drivers/iio/opensensorfusion/osf_serdev.c +0 -0

index 8a747c01ff9d..3d5e90d83967 100644

drivers/iio/opensensorfusion/osf_serdev.c struct osf_serdev { · line 27

Quoted 6 lines

drivers/iio/opensensorfusion/osf_serdev.c +1 -1

@@ -23,7 +23,7 @@ struct osf_serdev {
      bool vcc_enabled;
      struct osf_device osf;
      struct osf_stream stream;
-     /* Protects the parser and all RX counters. */
+     /* Protects the parser, all RX counters, and the registration gate. */
      struct mutex rx_lock;

Just name it 'lock' given it has scope beyond rx. Do that in earlier patch though rather than changing it here.

drivers/iio/opensensorfusion/osf_serdev.c static struct serdev_device_driver osf_serdev_driver = { · line 147

Quoted 9 lines

drivers/iio/opensensorfusion/osf_serdev.c +1 -1

 };
 

@@ -139,5 +144,5 @@ static struct serdev_device_driver osf_serdev_driver = {
 };
 module_serdev_device_driver(osf_serdev_driver);
 
-MODULE_DESCRIPTION("Open Sensor Fusion UART receiver");
+MODULE_DESCRIPTION("Open Sensor Fusion IIO driver");

Just have that being slightly missleading in earlier patch to reduce churn here.

Quoted 1 line

drivers/iio/opensensorfusion/osf_serdev.c +0 -0

 MODULE_LICENSE("GPL");

Using an extra lock is one solution I suppose to the risk of this racing with the buffer tear down and the problems around active_scan_mask being freed. Could you use

if (iio_device_try_claim_buffer_mode(indio_dev))

and later a release on that to achieve the same result?

Quoted 5 lines

Using an extra lock is one solution I suppose to the risk of this racing with the buffer tear down and the problems around active_scan_mask being freed. Could you use

Quoted 7 lines

if (iio_device_try_claim_buffer_mode(indio_dev))

and later a release on that to achieve the same result?

Only the ade9000 is doing similar at the moment so would need some testing to make sure no lock inversions occur in general but given you don't take any other locks in here it should be fine.

I think that should be a better fit here. I'll test replacing the private buffer lock and active flag with iio_device_try_claim_buffer_mode() , iio_device_release_buffer_mode(), including the existing buffer disable/unregister race coverage and lockdep checks.

If that confirms the expected serialization against buffer reconfiguration, I'll use that approach in the next revision.

Thanks,

Jinseob

2026년 9월 20일 (일) 오전 11:03, Jonathan Cameron <[email protected]>님이 작성:

Quoted 313 lines

Quoted 5 lines · On Sat, 19 Sep 2026 03:24:44 +0900 Jinseob Kim <[email protected]> wrote:

Register IIO devices from supported capability descriptors and expose signed raw samples, descriptor scales and software buffers. Keep early capabilities owned by the core until UART and supply setup is complete, and unregister children after the receive producer has stopped.

Quoted 8 lines

Validate nonzero descriptor scales and sample/descriptor equality, leave discovery open after empty or unsupported inventories, and compare repeated descriptors independently of order. Fault a bound session if a descriptor changes meaning, gating cache and buffer publication together.

Add initialized active-scan packing and buffer producer quiescence. The production implementation is now complete; subsequent patches only add the existing core and IIO KUnit suites and their build wiring.

No need to talk about what other patches do and that a series is functionally complete in a patch. If you want to do it, under the --- so it doesn't end up in the git log.

Quoted 3 lines

Assisted-by LLM

Signed-off-by Jinseob Kim <[email protected]>

A few things inline. Biggest one is a question (I'm not sure) on whether you can use a claim on buffered mode (which will hold it in that if it succeeds until released) is sufficient to replace the extra lock you have to block that transition.

Thanks,

Jonathan

Quoted 5 lines

drivers/iio/opensensorfusion/osf_iio.c new file +0 -0

new file mode 100644
index 000000000000..f4011b8fae14

...

drivers/iio/opensensorfusion/osf_iio.c line 39

Quoted 4 lines

drivers/iio/opensensorfusion/osf_iio.c new file +4 -0

+
+struct osf_iio_scan_3axis {
+     s32 values[3];
+     u32 padding;

No needed unless you explicitly write into padding for some reason. C rules add it anyway and then we don't need to make sure it remains correct if this structure changes in future.

drivers/iio/opensensorfusion/osf_iio.c line 45

Quoted 6 lines

drivers/iio/opensensorfusion/osf_iio.c new file +6 -0

+     aligned_s64 timestamp;
+};
+
+struct osf_iio_scan_1axis {
+     s32 value;
+     u32 padding;

As above, unneeded.

drivers/iio/opensensorfusion/osf_iio.c

Quoted 2 lines

drivers/iio/opensensorfusion/osf_iio.c new file +2 -0

+     aligned_s64 timestamp;
+};

Given I think these are only used in one place, moving them to there would avoid need for named structure types.

Quoted 8 lines

drivers/iio/opensensorfusion/osf_iio.c new file +8 -0

+
+#define OSF_MOD_CHAN(_type, _mod, _idx)                              \
+     {                                                               \
+             .type = (_type),                                        \
+             .modified = 1,                                          \
+             .channel2 = (_mod),                                     \
+             .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),           \
+             .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),   \

drivers/iio/opensensorfusion/osf_iio.c line 65

Quoted 10 lines

drivers/iio/opensensorfusion/osf_iio.c new file +10 -0

+             .scan_index = (_idx),                                   \
+             .scan_type = {                                          \
+                     .sign = 's',                                    \
+                     .realbits = 32,                                 \
+                     .storagebits = 32,                              \
+                     .endianness = IIO_CPU,                          \
+             },                                                      \
+     }
+
+#define OSF_CHAN(_type, _idx)                                        \

Given this is not much used, you could use the IIO_NO_MOD modifier as a gate on setting .modified = (_mod != IIO_NO_MOD) ? 1 : 0,
and have just one macro.

Quoted 78 lines

drivers/iio/opensensorfusion/osf_iio.c new file +78 -0

+     {                                                               \
+             .type = (_type),                                        \
+             .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),           \
+             .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),   \
+             .scan_index = (_idx),                                   \
+             .scan_type = {                                          \
+                     .sign = 's',                                    \
+                     .realbits = 32,                                 \
+                     .storagebits = 32,                              \
+                     .endianness = IIO_CPU,                          \
+             },                                                      \
+     }
+
+static const struct iio_chan_spec osf_accel_channels[] = {
+     OSF_MOD_CHAN(IIO_ACCEL, IIO_MOD_X, 0),
+     OSF_MOD_CHAN(IIO_ACCEL, IIO_MOD_Y, 1),
+     OSF_MOD_CHAN(IIO_ACCEL, IIO_MOD_Z, 2),
+     IIO_CHAN_SOFT_TIMESTAMP(3),
+};
+
+static const struct iio_chan_spec osf_gyro_channels[] = {
+     OSF_MOD_CHAN(IIO_ANGL_VEL, IIO_MOD_X, 0),
+     OSF_MOD_CHAN(IIO_ANGL_VEL, IIO_MOD_Y, 1),
+     OSF_MOD_CHAN(IIO_ANGL_VEL, IIO_MOD_Z, 2),
+     IIO_CHAN_SOFT_TIMESTAMP(3),
+};
+
+static const struct iio_chan_spec osf_mag_channels[] = {
+     OSF_MOD_CHAN(IIO_MAGN, IIO_MOD_X, 0),
+     OSF_MOD_CHAN(IIO_MAGN, IIO_MOD_Y, 1),
+     OSF_MOD_CHAN(IIO_MAGN, IIO_MOD_Z, 2),
+     IIO_CHAN_SOFT_TIMESTAMP(3),
+};
+
+static const struct iio_chan_spec osf_temp_channels[] = {
+     OSF_CHAN(IIO_TEMP, 0),
+     IIO_CHAN_SOFT_TIMESTAMP(1),
+};
+
+static const struct osf_iio_sensor_spec osf_iio_sensor_specs[] = {
+     {
+             .sensor_type = OSF_SENSOR_ACCELEROMETER,
+             .channel_count = 3,
+             .name = "osf-accel",
+             .channels = osf_accel_channels,
+             .num_channels = ARRAY_SIZE(osf_accel_channels),
+     },
+     {
+             .sensor_type = OSF_SENSOR_GYROSCOPE,
+             .channel_count = 3,
+             .name = "osf-gyro",
+             .channels = osf_gyro_channels,
+             .num_channels = ARRAY_SIZE(osf_gyro_channels),
+     },
+     {
+             .sensor_type = OSF_SENSOR_MAGNETOMETER,
+             .channel_count = 3,
+             .name = "osf-magn",
+             .channels = osf_mag_channels,
+             .num_channels = ARRAY_SIZE(osf_mag_channels),
+     },
+     {
+             .sensor_type = OSF_SENSOR_TEMPERATURE,
+             .channel_count = 1,
+             .name = "osf-temp",
+             .channels = osf_temp_channels,
+             .num_channels = ARRAY_SIZE(osf_temp_channels),
+     },
+};
+
+static const struct osf_iio_sensor_spec *
+osf_iio_find_sensor_spec(u16 sensor_type, u16 channel_count)
+{
+     for (unsigned int i = 0; i < ARRAY_SIZE(osf_iio_sensor_specs); i++) {
+             if (osf_iio_sensor_specs[i].sensor_type == sensor_type &&
+                 osf_iio_sensor_specs[i].channel_count == channel_count)
+                     return &osf_iio_sensor_specs[i];
+     }

drivers/iio/opensensorfusion/osf_iio.c

Quoted 10 lines

drivers/iio/opensensorfusion/osf_iio.c new file +10 -0

+
+     return NULL;
+}
+
+bool osf_iio_sensor_supported(u16 sensor_type, u16 channel_count)
+{
+     if (osf_iio_find_sensor_spec(sensor_type, channel_count))
+             return true;
+
+     return false

        return osf_iio_find_sensor_spec(sensor_type, channel_count) != NULL;

drivers/iio/opensensorfusion/osf_iio.c line 202

Quoted 8 lines

drivers/iio/opensensorfusion/osf_iio.c new file +7 -0

+}
 
+
+static int osf_iio_buffer_postenable(struct iio_dev *indio_dev)
+{
+     struct osf_iio_state *state = iio_priv(indio_dev);
+
+     guard(mutex)(&state->buffer_lock);

These transistions are already guarded by the core, so see the question later on whether you can just claim buffered mode in the data handler to avoid the need for this. That might not work but the way you did this got me thinking about a more general solution to the problem.

Quoted 18 lines

drivers/iio/opensensorfusion/osf_iio.c new file +16 -0

+     state->buffer_active = true;
+
+     return 0;
+}
+
+static int osf_iio_buffer_predisable(struct iio_dev *indio_dev)
+{
+     struct osf_iio_state *state = iio_priv(indio_dev);
+
+     /* Wait for the current push before the IIO core changes its buffers. */
+     guard(mutex)(&state->buffer_lock);
+     state->buffer_active = false;
+
+     return 0;
+}
 
 
+

drivers/iio/opensensorfusion/osf_iio.c line 307

Quoted 10 lines

drivers/iio/opensensorfusion/osf_iio.c new file +10 -0

+int osf_iio_push_sample(struct iio_dev *indio_dev, const s32 *values,
+                     u16 channel_count)
+{
+     struct osf_iio_state *state = iio_priv(indio_dev);
+     s64 timestamp;
+
+     if (channel_count != state->spec->channel_count)
+             return -EPROTO;
+
+     guard(mutex)(&state->buffer_lock);

Using an extra lock is one solution I suppose to the risk of this racing with the buffer tear down and the problems around active_scan_mask being freed. Could you use

if (iio_device_try_claim_buffer_mode(indio_dev))
and later a release on that to achieve the same result?

Only the ade9000 is doing similar at the moment so would need some testing to make sure no lock inversions occur in general but given you don't take any other locks in here it should be fine.

drivers/iio/opensensorfusion/osf_iio.c line 317

Quoted 10 lines

drivers/iio/opensensorfusion/osf_iio.c new file +10 -0

+     if (!state->buffer_active || !iio_buffer_enabled(indio_dev))
+             return 0;
+
+     timestamp = iio_get_time_ns(indio_dev);
+
+     switch (channel_count) {
+     case 1: {
+             struct osf_iio_scan_1axis scan = {
+                     .value = values[0],
+             };

As suggested above, this structure type is only used locally here. So make the definition local as well.

                struct {
                        s32 value;
                        aligned_s64 timestamp;
                } scan = { };

drivers/iio/opensensorfusion/osf_iio.c line 324

Quoted 7 lines

drivers/iio/opensensorfusion/osf_iio.c new file +7 -0

+
+             return iio_push_to_buffers_with_ts(indio_dev, &scan,
+                                                sizeof(scan), timestamp);
+     }
+     case 3: {
+             struct osf_iio_scan_3axis scan = {
+                     .values = { },

Setting values doesn't add anything useful as = { } zeros the whole structure (including any holes - they kernel is built with specific compiler options to ensure that last bit as it wasn't required in older c specs).

drivers/iio/opensensorfusion/osf_iio.c

Quoted 2 lines

drivers/iio/opensensorfusion/osf_iio.c new file +2 -0

+             };
+             unsigned int channel, index = 0;

Please split declarations that assign and ones that don't on to separate lines. Ends up a little more readable.

                unsigned int index = 0;
                unsigned int channel;

Quoted 18 lines

drivers/iio/opensensorfusion/osf_iio.c new file +12 -0

+
+             /* Pack the active channels; unused storage remains initialized. */
+             for_each_set_bit(channel, indio_dev->active_scan_mask, channel_count)
+                     scan.values[index++] = values[channel];
+
+             return iio_push_to_buffers_with_ts(indio_dev, &scan,
+                                                sizeof(scan), timestamp);
+     }
+     default:
+             return -EPROTO;
+     }
+}

drivers/iio/opensensorfusion/osf_serdev.c +0 -0

index 8a747c01ff9d..3d5e90d83967 100644

drivers/iio/opensensorfusion/osf_serdev.c struct osf_serdev { · line 27

Quoted 6 lines

drivers/iio/opensensorfusion/osf_serdev.c +1 -1

@@ -23,7 +23,7 @@ struct osf_serdev {
      bool vcc_enabled;
      struct osf_device osf;
      struct osf_stream stream;
-     /* Protects the parser and all RX counters. */
+     /* Protects the parser, all RX counters, and the registration gate. */
      struct mutex rx_lock;

Just name it 'lock' given it has scope beyond rx. Do that in earlier patch though rather than changing it here.

drivers/iio/opensensorfusion/osf_serdev.c static struct serdev_device_driver osf_serdev_driver = { · line 147

Quoted 9 lines

drivers/iio/opensensorfusion/osf_serdev.c +1 -1

 };
 

@@ -139,5 +144,5 @@ static struct serdev_device_driver osf_serdev_driver = {
 };
 module_serdev_device_driver(osf_serdev_driver);
 
-MODULE_DESCRIPTION("Open Sensor Fusion UART receiver");
+MODULE_DESCRIPTION("Open Sensor Fusion IIO driver");

Just have that being slightly missleading in earlier patch to reduce churn here.

Quoted 1 line

drivers/iio/opensensorfusion/osf_serdev.c +0 -0

 MODULE_LICENSE("GPL");

Quoted 7 lines

Using an extra lock is one solution I suppose to the risk of this racing with the buffer tear down and the problems around active_scan_mask being freed. Could you use

if (iio_device_try_claim_buffer_mode(indio_dev))

and later a release on that to achieve the same result?

I looked into this against the current IIO core and tested the relevant paths.

iio_device_try_claim_buffer_mode() does hold the IIO mode lock, and iio_update_buffers() takes the same lock, so it would serialize normal buffer reconfiguration.

However, the unregister path does not hold that mode lock while disabling/deactivating the buffers, and that path can free active_scan_mask.

Because the OSF receive path can still have an
admitted buffer push at that point, the mode claim alone does not appear to provide the same lifetime guarantee as the existing private lock.

I therefore kept the private lock for now. I also reran the disable/unregister race coverage with KASAN and lockdep enabled; those tests pass without diagnostics.

Thanks,

Jinseob

2026년 9월 20일 (일) 오후 1:20, Kim Jinseob <[email protected]>님이 작성:

Quoted 340 lines

Quoted 5 lines

Using an extra lock is one solution I suppose to the risk of this racing with the buffer tear down and the problems around active_scan_mask being freed. Could you use

Quoted 7 lines

if (iio_device_try_claim_buffer_mode(indio_dev))

and later a release on that to achieve the same result?

Only the ade9000 is doing similar at the moment so would need some testing to make sure no lock inversions occur in general but given you don't take any other locks in here it should be fine.

I think that should be a better fit here. I'll test replacing the private buffer lock and active flag with iio_device_try_claim_buffer_mode() , iio_device_release_buffer_mode(), including the existing buffer disable/unregister race coverage and lockdep checks.

If that confirms the expected serialization against buffer reconfiguration, I'll use that approach in the next revision.

Thanks,

Jinseob

2026년 9월 20일 (일) 오전 11:03, Jonathan Cameron <[email protected]>님이 작성:

Quoted 313 lines

Quoted 5 lines · On Sat, 19 Sep 2026 03:24:44 +0900 Jinseob Kim <[email protected]> wrote:

Register IIO devices from supported capability descriptors and expose signed raw samples, descriptor scales and software buffers. Keep early capabilities owned by the core until UART and supply setup is complete, and unregister children after the receive producer has stopped.

Quoted 8 lines

Validate nonzero descriptor scales and sample/descriptor equality, leave discovery open after empty or unsupported inventories, and compare repeated descriptors independently of order. Fault a bound session if a descriptor changes meaning, gating cache and buffer publication together.

Add initialized active-scan packing and buffer producer quiescence. The production implementation is now complete; subsequent patches only add the existing core and IIO KUnit suites and their build wiring.

No need to talk about what other patches do and that a series is functionally complete in a patch. If you want to do it, under the --- so it doesn't end up in the git log.

Quoted 3 lines

Assisted-by LLM

Signed-off-by Jinseob Kim <[email protected]>

A few things inline. Biggest one is a question (I'm not sure) on whether you can use a claim on buffered mode (which will hold it in that if it succeeds until released) is sufficient to replace the extra lock you have to block that transition.

Thanks,

Jonathan

Quoted 5 lines

drivers/iio/opensensorfusion/osf_iio.c new file +0 -0

new file mode 100644
index 000000000000..f4011b8fae14

...

drivers/iio/opensensorfusion/osf_iio.c line 39

Quoted 4 lines

drivers/iio/opensensorfusion/osf_iio.c new file +4 -0

+
+struct osf_iio_scan_3axis {
+     s32 values[3];
+     u32 padding;  

No needed unless you explicitly write into padding for some reason. C rules add it anyway and then we don't need to make sure it remains correct if this structure changes in future.

drivers/iio/opensensorfusion/osf_iio.c line 45

Quoted 6 lines

drivers/iio/opensensorfusion/osf_iio.c new file +6 -0

+     aligned_s64 timestamp;
+};
+
+struct osf_iio_scan_1axis {
+     s32 value;
+     u32 padding;  

As above, unneeded.

drivers/iio/opensensorfusion/osf_iio.c

Quoted 2 lines

drivers/iio/opensensorfusion/osf_iio.c new file +2 -0

+     aligned_s64 timestamp;
+};  

Given I think these are only used in one place, moving them to there would avoid need for named structure types.

Quoted 8 lines

drivers/iio/opensensorfusion/osf_iio.c new file +8 -0

+
+#define OSF_MOD_CHAN(_type, _mod, _idx)                              \
+     {                                                               \
+             .type = (_type),                                        \
+             .modified = 1,                                          \
+             .channel2 = (_mod),                                     \
+             .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),           \
+             .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),   \

drivers/iio/opensensorfusion/osf_iio.c line 65

Quoted 10 lines

drivers/iio/opensensorfusion/osf_iio.c new file +10 -0

+             .scan_index = (_idx),                                   \
+             .scan_type = {                                          \
+                     .sign = 's',                                    \
+                     .realbits = 32,                                 \
+                     .storagebits = 32,                              \
+                     .endianness = IIO_CPU,                          \
+             },                                                      \
+     }
+
+#define OSF_CHAN(_type, _idx)                                        \  

Given this is not much used, you could use the IIO_NO_MOD modifier as a gate on setting .modified = (_mod != IIO_NO_MOD) ? 1 : 0,
and have just one macro.

Quoted 78 lines

drivers/iio/opensensorfusion/osf_iio.c new file +78 -0

+     {                                                               \
+             .type = (_type),                                        \
+             .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),           \
+             .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),   \
+             .scan_index = (_idx),                                   \
+             .scan_type = {                                          \
+                     .sign = 's',                                    \
+                     .realbits = 32,                                 \
+                     .storagebits = 32,                              \
+                     .endianness = IIO_CPU,                          \
+             },                                                      \
+     }
+
+static const struct iio_chan_spec osf_accel_channels[] = {
+     OSF_MOD_CHAN(IIO_ACCEL, IIO_MOD_X, 0),
+     OSF_MOD_CHAN(IIO_ACCEL, IIO_MOD_Y, 1),
+     OSF_MOD_CHAN(IIO_ACCEL, IIO_MOD_Z, 2),
+     IIO_CHAN_SOFT_TIMESTAMP(3),
+};
+
+static const struct iio_chan_spec osf_gyro_channels[] = {
+     OSF_MOD_CHAN(IIO_ANGL_VEL, IIO_MOD_X, 0),
+     OSF_MOD_CHAN(IIO_ANGL_VEL, IIO_MOD_Y, 1),
+     OSF_MOD_CHAN(IIO_ANGL_VEL, IIO_MOD_Z, 2),
+     IIO_CHAN_SOFT_TIMESTAMP(3),
+};
+
+static const struct iio_chan_spec osf_mag_channels[] = {
+     OSF_MOD_CHAN(IIO_MAGN, IIO_MOD_X, 0),
+     OSF_MOD_CHAN(IIO_MAGN, IIO_MOD_Y, 1),
+     OSF_MOD_CHAN(IIO_MAGN, IIO_MOD_Z, 2),
+     IIO_CHAN_SOFT_TIMESTAMP(3),
+};
+
+static const struct iio_chan_spec osf_temp_channels[] = {
+     OSF_CHAN(IIO_TEMP, 0),
+     IIO_CHAN_SOFT_TIMESTAMP(1),
+};
+
+static const struct osf_iio_sensor_spec osf_iio_sensor_specs[] = {
+     {
+             .sensor_type = OSF_SENSOR_ACCELEROMETER,
+             .channel_count = 3,
+             .name = "osf-accel",
+             .channels = osf_accel_channels,
+             .num_channels = ARRAY_SIZE(osf_accel_channels),
+     },
+     {
+             .sensor_type = OSF_SENSOR_GYROSCOPE,
+             .channel_count = 3,
+             .name = "osf-gyro",
+             .channels = osf_gyro_channels,
+             .num_channels = ARRAY_SIZE(osf_gyro_channels),
+     },
+     {
+             .sensor_type = OSF_SENSOR_MAGNETOMETER,
+             .channel_count = 3,
+             .name = "osf-magn",
+             .channels = osf_mag_channels,
+             .num_channels = ARRAY_SIZE(osf_mag_channels),
+     },
+     {
+             .sensor_type = OSF_SENSOR_TEMPERATURE,
+             .channel_count = 1,
+             .name = "osf-temp",
+             .channels = osf_temp_channels,
+             .num_channels = ARRAY_SIZE(osf_temp_channels),
+     },
+};
+
+static const struct osf_iio_sensor_spec *
+osf_iio_find_sensor_spec(u16 sensor_type, u16 channel_count)
+{
+     for (unsigned int i = 0; i < ARRAY_SIZE(osf_iio_sensor_specs); i++) {
+             if (osf_iio_sensor_specs[i].sensor_type == sensor_type &&
+                 osf_iio_sensor_specs[i].channel_count == channel_count)
+                     return &osf_iio_sensor_specs[i];
+     }

drivers/iio/opensensorfusion/osf_iio.c

Quoted 10 lines

drivers/iio/opensensorfusion/osf_iio.c new file +10 -0

+
+     return NULL;
+}
+
+bool osf_iio_sensor_supported(u16 sensor_type, u16 channel_count)
+{
+     if (osf_iio_find_sensor_spec(sensor_type, channel_count))
+             return true;
+
+     return false  

        return osf_iio_find_sensor_spec(sensor_type, channel_count) != NULL;

drivers/iio/opensensorfusion/osf_iio.c line 202

Quoted 8 lines

drivers/iio/opensensorfusion/osf_iio.c new file +7 -0

+}  
 
+
+static int osf_iio_buffer_postenable(struct iio_dev *indio_dev)
+{
+     struct osf_iio_state *state = iio_priv(indio_dev);
+
+     guard(mutex)(&state->buffer_lock);  

These transistions are already guarded by the core, so see the question later on whether you can just claim buffered mode in the data handler to avoid the need for this. That might not work but the way you did this got me thinking about a more general solution to the problem.

Quoted 18 lines

drivers/iio/opensensorfusion/osf_iio.c new file +16 -0

+     state->buffer_active = true;
+
+     return 0;
+}
+
+static int osf_iio_buffer_predisable(struct iio_dev *indio_dev)
+{
+     struct osf_iio_state *state = iio_priv(indio_dev);
+
+     /* Wait for the current push before the IIO core changes its buffers. */
+     guard(mutex)(&state->buffer_lock);
+     state->buffer_active = false;
+
+     return 0;
+}  
 
 
+

drivers/iio/opensensorfusion/osf_iio.c line 307

Quoted 10 lines

drivers/iio/opensensorfusion/osf_iio.c new file +10 -0

+int osf_iio_push_sample(struct iio_dev *indio_dev, const s32 *values,
+                     u16 channel_count)
+{
+     struct osf_iio_state *state = iio_priv(indio_dev);
+     s64 timestamp;
+
+     if (channel_count != state->spec->channel_count)
+             return -EPROTO;
+
+     guard(mutex)(&state->buffer_lock);  

Using an extra lock is one solution I suppose to the risk of this racing with the buffer tear down and the problems around active_scan_mask being freed. Could you use

if (iio_device_try_claim_buffer_mode(indio_dev))
and later a release on that to achieve the same result?

Only the ade9000 is doing similar at the moment so would need some testing to make sure no lock inversions occur in general but given you don't take any other locks in here it should be fine.

drivers/iio/opensensorfusion/osf_iio.c line 317

Quoted 10 lines

drivers/iio/opensensorfusion/osf_iio.c new file +10 -0

+     if (!state->buffer_active || !iio_buffer_enabled(indio_dev))
+             return 0;
+
+     timestamp = iio_get_time_ns(indio_dev);
+
+     switch (channel_count) {
+     case 1: {
+             struct osf_iio_scan_1axis scan = {
+                     .value = values[0],
+             };  

As suggested above, this structure type is only used locally here. So make the definition local as well.

                struct {
                        s32 value;
                        aligned_s64 timestamp;
                } scan = { };

drivers/iio/opensensorfusion/osf_iio.c line 324

Quoted 7 lines

drivers/iio/opensensorfusion/osf_iio.c new file +7 -0

+
+             return iio_push_to_buffers_with_ts(indio_dev, &scan,
+                                                sizeof(scan), timestamp);
+     }
+     case 3: {
+             struct osf_iio_scan_3axis scan = {
+                     .values = { },  

Setting values doesn't add anything useful as = { } zeros the whole structure (including any holes - they kernel is built with specific compiler options to ensure that last bit as it wasn't required in older c specs).

drivers/iio/opensensorfusion/osf_iio.c

Quoted 2 lines

drivers/iio/opensensorfusion/osf_iio.c new file +2 -0

+             };
+             unsigned int channel, index = 0;  

Please split declarations that assign and ones that don't on to separate lines. Ends up a little more readable.

                unsigned int index = 0;
                unsigned int channel;

Quoted 18 lines

drivers/iio/opensensorfusion/osf_iio.c new file +12 -0

+
+             /* Pack the active channels; unused storage remains initialized. */
+             for_each_set_bit(channel, indio_dev->active_scan_mask, channel_count)
+                     scan.values[index++] = values[channel];
+
+             return iio_push_to_buffers_with_ts(indio_dev, &scan,
+                                                sizeof(scan), timestamp);
+     }
+     default:
+             return -EPROTO;
+     }
+}  

drivers/iio/opensensorfusion/osf_serdev.c +0 -0

index 8a747c01ff9d..3d5e90d83967 100644

drivers/iio/opensensorfusion/osf_serdev.c struct osf_serdev { · line 27

Quoted 6 lines

drivers/iio/opensensorfusion/osf_serdev.c +1 -1

@@ -23,7 +23,7 @@ struct osf_serdev {
      bool vcc_enabled;
      struct osf_device osf;
      struct osf_stream stream;
-     /* Protects the parser and all RX counters. */
+     /* Protects the parser, all RX counters, and the registration gate. */
      struct mutex rx_lock;  

Just name it 'lock' given it has scope beyond rx. Do that in earlier patch though rather than changing it here.

drivers/iio/opensensorfusion/osf_serdev.c static struct serdev_device_driver osf_serdev_driver = { · line 147

Quoted 9 lines

drivers/iio/opensensorfusion/osf_serdev.c +1 -1

 };  
 

@@ -139,5 +144,5 @@ static struct serdev_device_driver osf_serdev_driver = {
 };
 module_serdev_device_driver(osf_serdev_driver);
 
-MODULE_DESCRIPTION("Open Sensor Fusion UART receiver");
+MODULE_DESCRIPTION("Open Sensor Fusion IIO driver");  

Just have that being slightly missleading in earlier patch to reduce churn here.

Quoted 1 line

drivers/iio/opensensorfusion/osf_serdev.c +0 -0

 MODULE_LICENSE("GPL");  

Add the existing core regression cases for frame handling, sample-cache admission, supported capability discovery, repeated descriptors and session faults. The tests exercise valid, ignored and rejected input without changing the production receive or IIO implementation.

Introduce KUnit configuration and build wiring when the core test source is present. IIO-specific tests are added separately in the next patch.

Assisted-by LLM

Signed-off-by Jinseob Kim <[email protected]>

Add the existing IIO active-scan packing and buffer producer lifetime tests. Extend the test build wiring and help text to cover both suites.

This changes no production source. The complete series retains the production behavior of the combined-driver revision, with CRC terminology clarified.

Assisted-by LLM

Signed-off-by Jinseob Kim <[email protected]>

---
 drivers/iio/opensensorfusion/Kconfig        |   2 +-
 drivers/iio/opensensorfusion/Makefile       |   2 +-
 drivers/iio/opensensorfusion/osf_iio_test.c | 325 ++++++++++++++++++++
 3 files changed, 327 insertions(+), 2 deletions(-)
 create mode 100644 drivers/iio/opensensorfusion/osf_iio_test.c

drivers/iio/opensensorfusion/Kconfig +1 -1

index 316f33be1327..b4a2cde9645e 100644
@@ -20,7 +20,7 @@ config OPEN_SENSOR_FUSION_KUNIT_TEST
 	default KUNIT_ALL_TESTS
 	help
 	  Build focused unit tests for the Open Sensor Fusion core sample
-	  acceptance, direct-read cache, and capability/session handling. The tests
+	  acceptance, direct-read cache, and IIO buffer paths. The tests
 	  exercise accepted, ignored, and rejected sample handling without
 	  exposing additional production interfaces.
 

drivers/iio/opensensorfusion/Makefile +1 -1

index c2f5ba065a62..6a28b14cae1f 100644
@@ -4,4 +4,4 @@ obj-$(CONFIG_OPEN_SENSOR_FUSION) += open-sensor-fusion.o
 
 open-sensor-fusion-y := osf_core.o osf_iio.o osf_protocol.o osf_serdev.o \
 			 osf_stream.o
-open-sensor-fusion-$(CONFIG_OPEN_SENSOR_FUSION_KUNIT_TEST) += osf_core_test.o
+open-sensor-fusion-$(CONFIG_OPEN_SENSOR_FUSION_KUNIT_TEST) += osf_core_test.o osf_iio_test.o

drivers/iio/opensensorfusion/osf_iio_test.c new file +325 -0

new file mode 100644
index 000000000000..63d3ca1af329
@@ -0,0 +1,325 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <kunit/device.h>
+#include <kunit/test.h>
+
+#include <linux/bitmap.h>
+#include <linux/completion.h>
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/iio/buffer.h>
+#include <linux/iio/buffer_impl.h>
+#include <linux/iio/iio.h>
+#include <linux/kthread.h>
+#include <linux/string.h>
+
+#include "osf_core.h"
+#include "osf_iio.h"
+
+static noinline void osf_test_poison_stack(void)
+{
+	u8 bytes[1024];
+
+	memset(bytes, 0xa5, sizeof(bytes));
+	barrier_data(bytes);
+}
+
+static void osf_iio_check_scan(struct kunit *test, struct iio_dev *indio_dev,
+			       const s32 *values, unsigned int channels,
+			       unsigned int mask, bool ts)
+{
+	struct iio_buffer *buffer = indio_dev->buffer;
+	unsigned int data_bytes = hweight32(mask) * sizeof(s32);
+	unsigned int ts_offset = ALIGN(data_bytes, 8);
+	unsigned int scan_bytes = ts ? ts_offset + 8 : data_bytes;
+	unsigned int offset = 0;
+	u8 scan[24] __aligned(8);
+	s64 before, after, timestamp;
+	int ret;
+
+	bitmap_zero((unsigned long *)buffer->scan_mask, iio_get_masklength(indio_dev));
+	for (unsigned int i = 0; i < channels; i++)
+		if (mask & BIT(i))
+			set_bit(i, (unsigned long *)buffer->scan_mask);
+	buffer->scan_timestamp = ts;
+	ret = iio_update_buffers(indio_dev, buffer, NULL);
+	KUNIT_ASSERT_EQ(test, ret, 0);
+
+	kunit_info(test, "device=%s mask=%u ts=%u bytes=%u\n",
+		   indio_dev->name, mask, ts, scan_bytes);
+	memset(scan, 0xa5, sizeof(scan));
+	before = iio_get_time_ns(indio_dev);
+	osf_test_poison_stack();
+	ret = osf_iio_push_sample(indio_dev, values, channels);
+	after = iio_get_time_ns(indio_dev);
+	KUNIT_EXPECT_EQ(test, ret, 0);
+	KUNIT_EXPECT_EQ(test, buffer->bytes_per_datum, scan_bytes);
+	ret = iio_pop_from_buffer(buffer, scan);
+	KUNIT_EXPECT_EQ(test, ret, 0);
+	if (ret)
+		goto disable;
+
+	for (unsigned int i = 0; i < channels; i++) {
+		if (!(mask & BIT(i)))
+			continue;
+		KUNIT_EXPECT_MEMEQ(test, scan + offset, &values[i], sizeof(s32));
+		offset += sizeof(s32);
+	}
+	if (ts) {
+		for (unsigned int i = data_bytes; i < ts_offset; i++)
+			KUNIT_EXPECT_EQ(test, scan[i], (u8)0);
+		memcpy(&timestamp, scan + ts_offset, sizeof(timestamp));
+		KUNIT_EXPECT_GE(test, timestamp, before);
+		KUNIT_EXPECT_LE(test, timestamp, after);
+	}
+	/* Neither kfifo nor the producer may write outside the consumer stride. */
+	for (unsigned int i = scan_bytes; i < sizeof(scan); i++)
+		KUNIT_EXPECT_EQ(test, scan[i], (u8)0xa5);
+
+disable:
+	KUNIT_EXPECT_EQ(test, iio_update_buffers(indio_dev, NULL, buffer), 0);
+}
+
+/* Protect timestamp alignment holes and every supported scan layout. */
+static void osf_iio_scan_bytes_test(struct kunit *test)
+{
+	static const u16 types[] = {
+		OSF_SENSOR_ACCELEROMETER, OSF_SENSOR_GYROSCOPE,
+		OSF_SENSOR_MAGNETOMETER, OSF_SENSOR_TEMPERATURE,
+	};
+	const s32 values[] = { 101, -202, 303 };
+	struct osf_capability_entry entry = {
+		.sample_format = OSF_SAMPLE_FORMAT_S32,
+		.scale_nano = 1000000,
+	};
+	struct osf_device *osf;
+	struct device *dev;
+
+	dev = kunit_device_register(test, "osf-iio");
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dev);
+	osf = kunit_kzalloc(test, sizeof(*osf), GFP_KERNEL);
+	KUNIT_ASSERT_NOT_NULL(test, osf);
+	osf_core_init(osf, dev);
+
+	for (unsigned int t = 0; t < ARRAY_SIZE(types); t++) {
+		unsigned int channels = t == 3 ? 1 : 3;
+		struct iio_dev *indio_dev;
+		int ret;
+
+		entry.sensor_type = types[t];
+		entry.channel_count = channels;
+		ret = osf_iio_register_sensor(dev, &entry, osf, &indio_dev);
+		KUNIT_ASSERT_EQ(test, ret, 0);
+		for (unsigned int mask = 1; mask < BIT(channels); mask++)
+			for (unsigned int ts = 0; ts < 2; ts++)
+				osf_iio_check_scan(test, indio_dev, values, channels, mask, ts);
+		osf_iio_unregister_sensor(indio_dev);
+	}
+}
+
+struct osf_iio_race {
+	struct iio_buffer_access_funcs access;
+	const struct iio_buffer_access_funcs *original;
+	struct iio_dev *indio_dev;
+	struct completion entered;
+	struct completion release;
+	struct completion config_started;
+	struct completion config_done;
+	atomic_t block_store;
+	atomic_t stores;
+	atomic_t disabled;
+	atomic_t bad_store;
+	int enable_error;
+	int disable_error;
+	int config_result;
+	bool unregister;
+};
+
+static struct osf_iio_race *osf_iio_race_from_buffer(struct iio_buffer *buffer)
+{
+	return container_of(buffer->access, struct osf_iio_race, access);
+}
+
+static int osf_iio_test_store(struct iio_buffer *buffer, const void *data)
+{
+	struct osf_iio_race *race = osf_iio_race_from_buffer(buffer);
+
+	if (atomic_xchg(&race->block_store, 0)) {
+		complete(&race->entered);
+		if (!wait_for_completion_timeout(&race->release, 5 * HZ))
+			return -ETIMEDOUT;
+	}
+	if (atomic_read(&race->disabled))
+		atomic_inc(&race->bad_store);
+	atomic_inc(&race->stores);
+	return race->original->store_to(buffer, data);
+}
+
+static int osf_iio_test_enable(struct iio_buffer *buffer, struct iio_dev *indio_dev)
+{
+	struct osf_iio_race *race = osf_iio_race_from_buffer(buffer);
+
+	if (race->enable_error)
+		return race->enable_error;
+	atomic_set(&race->disabled, 0);
+	return 0;
+}
+
+static int osf_iio_test_disable(struct iio_buffer *buffer, struct iio_dev *indio_dev)
+{
+	struct osf_iio_race *race = osf_iio_race_from_buffer(buffer);
+
+	atomic_set(&race->disabled, 1);
+	return race->disable_error;
+}
+
+static int osf_iio_test_producer(void *data)
+{
+	struct osf_iio_race *race = data;
+	const s32 values[] = { 101, -202, 303 };
+
+	while (!kthread_should_stop()) {
+		osf_iio_push_sample(race->indio_dev, values, ARRAY_SIZE(values));
+		cond_resched();
+	}
+	return 0;
+}
+
+static int osf_iio_test_configure(void *data)
+{
+	struct osf_iio_race *race = data;
+
+	complete(&race->config_started);
+	if (race->unregister) {
+		osf_iio_unregister_sensor(race->indio_dev);
+		race->config_result = 0;
+	} else {
+		race->config_result = iio_update_buffers(race->indio_dev, NULL,
+							 race->indio_dev->buffer);
+	}
+	complete(&race->config_done);
+	while (!kthread_should_stop())
+		msleep(20);
+	return 0;
+}
+
+static void osf_iio_expect_quiesce(struct kunit *test, struct osf_iio_race *race)
+{
+	struct task_struct *config;
+	unsigned long waited;
+
+	config = kthread_run(osf_iio_test_configure, race, "osf-cfg-test");
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, config);
+	KUNIT_EXPECT_NE(test, wait_for_completion_timeout(&race->config_started, HZ), 0UL);
+	waited = wait_for_completion_timeout(&race->config_done, msecs_to_jiffies(20));
+	KUNIT_EXPECT_EQ(test, waited, 0UL);
+	complete(&race->release);
+	KUNIT_EXPECT_NE(test, wait_for_completion_timeout(&race->config_done, HZ), 0UL);
+	kthread_stop(config);
+	KUNIT_EXPECT_EQ(test, race->config_result, 0);
+}
+
+/* Run real IIO configuration and kfifo code against an independent producer. */
+static void osf_iio_buffer_lifetime_test(struct kunit *test)
+{
+	struct osf_capability_entry entry = {
+		.sensor_type = OSF_SENSOR_ACCELEROMETER,
+		.channel_count = 3,
+		.sample_format = OSF_SAMPLE_FORMAT_S32,
+		.scale_nano = 1000000,
+	};
+	const s32 values[] = { 101, -202, 303 };
+	struct task_struct *producer;
+	struct osf_iio_race *race;
+	struct osf_device *osf;
+	struct iio_dev *indio_dev;
+	struct iio_buffer *buffer;
+	struct device *dev;
+	int stores, ret;
+
+	dev = kunit_device_register(test, "osf-race");
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, dev);
+	osf = kunit_kzalloc(test, sizeof(*osf), GFP_KERNEL);
+	race = kunit_kzalloc(test, sizeof(*race), GFP_KERNEL);
+	KUNIT_ASSERT_NOT_NULL(test, osf);
+	KUNIT_ASSERT_NOT_NULL(test, race);
+	osf_core_init(osf, dev);
+	ret = osf_iio_register_sensor(dev, &entry, osf, &indio_dev);
+	KUNIT_ASSERT_EQ(test, ret, 0);
+	buffer = indio_dev->buffer;
+	race->indio_dev = indio_dev;
+	race->original = buffer->access;
+	race->access = *buffer->access;
+	race->access.store_to = osf_iio_test_store;
+	race->access.enable = osf_iio_test_enable;
+	race->access.disable = osf_iio_test_disable;
+	buffer->access = &race->access;
+	init_completion(&race->entered);
+	init_completion(&race->release);
+	init_completion(&race->config_started);
+	init_completion(&race->config_done);
+	atomic_set(&race->disabled, 1);
+	set_bit(0, (unsigned long *)buffer->scan_mask);
+	KUNIT_EXPECT_EQ(test, iio_update_buffers(indio_dev, buffer, NULL), 0);
+
+	atomic_set(&race->block_store, 1);
+	producer = kthread_run(osf_iio_test_producer, race, "osf-rx-test");
+	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, producer);
+	KUNIT_EXPECT_NE(test, wait_for_completion_timeout(&race->entered, HZ), 0UL);
+	osf_iio_expect_quiesce(test, race);
+
+	for (unsigned int i = 0; i < 100; i++) {
+		bitmap_zero((unsigned long *)buffer->scan_mask, iio_get_masklength(indio_dev));
+		*(unsigned long *)buffer->scan_mask = (i % 7) + 1;
+		buffer->scan_timestamp = i & 1;
+		KUNIT_EXPECT_EQ(test, iio_update_buffers(indio_dev, buffer, NULL), 0);
+		cond_resched();
+		KUNIT_EXPECT_EQ(test, iio_update_buffers(indio_dev, NULL, buffer), 0);
+	}
+
+	race->enable_error = -EIO;
+	KUNIT_EXPECT_EQ(test, iio_update_buffers(indio_dev, buffer, NULL), -EIO);
+	stores = atomic_read(&race->stores);
+	KUNIT_EXPECT_EQ(test, osf_iio_push_sample(indio_dev, values, 3), 0);
+	KUNIT_EXPECT_EQ(test, atomic_read(&race->stores), stores);
+	race->enable_error = 0;
+	KUNIT_EXPECT_EQ(test, iio_update_buffers(indio_dev, buffer, NULL), 0);
+	race->disable_error = -EIO;
+	KUNIT_EXPECT_EQ(test, iio_update_buffers(indio_dev, NULL, buffer), -EIO);
+	stores = atomic_read(&race->stores);
+	KUNIT_EXPECT_EQ(test, osf_iio_push_sample(indio_dev, values, 3), 0);
+	KUNIT_EXPECT_EQ(test, atomic_read(&race->stores), stores);
+	race->disable_error = 0;
+
+	KUNIT_EXPECT_EQ(test, iio_update_buffers(indio_dev, buffer, NULL), 0);
+	/* Retain ownership while testing unregister against an admitted push. */
+	get_device(&indio_dev->dev);
+	reinit_completion(&race->entered);
+	reinit_completion(&race->release);
+	reinit_completion(&race->config_started);
+	reinit_completion(&race->config_done);
+	atomic_set(&race->block_store, 1);
+	KUNIT_EXPECT_NE(test, wait_for_completion_timeout(&race->entered, HZ), 0UL);
+	race->unregister = true;
+	osf_iio_expect_quiesce(test, race);
+	kthread_stop(producer);
+	KUNIT_EXPECT_EQ(test, atomic_read(&race->bad_store), 0);
+	KUNIT_EXPECT_GT(test, atomic_read(&race->stores), 0);
+	buffer->access = race->original;
+	put_device(&indio_dev->dev);
+}
+
+static struct kunit_case osf_iio_test_cases[] = {
+	KUNIT_CASE(osf_iio_scan_bytes_test),
+	KUNIT_CASE(osf_iio_buffer_lifetime_test),
+	{ }
+};
+
+static struct kunit_suite osf_iio_test_suite = {
+	.name = "osf-iio",
+	.test_cases = osf_iio_test_cases,
+};
+
+kunit_test_suite(osf_iio_test_suite);
+
+MODULE_LICENSE("GPL");

Specification status: OSF-D2H 0.0 spec-1 has completed project technical stability review, has been adopted by the project owner, and is published as a fixed specification.

Canonical specification:
https://github.com/opensensorfusion/opensensorfusion-protocol/blob/ca9cdea1ae550c2b4d6f29f87877adae99470744/spec/osf-d2h-0.0.md

Errata process:
https://github.com/opensensorfusion/opensensorfusion-protocol/blob/ca9cdea1ae550c2b4d6f29f87877adae99470744/errata/README.md

Current adoption/publication record:
https://github.com/opensensorfusion/opensensorfusion-protocol/blob/0cabccf63ac01d0eb82dd9882739ff58eed4a76c/reviews/publication-record-20260918.md

The specification was frozen before adoption/publication, so its embedded status snapshot is intentionally historical. The dated publication record above establishes the current adopted/public state. This is project review and adoption, not an external maintainer approval.

This series adds the Open Sensor Fusion UART receive path and IIO devices discovered from capability reports. It exposes accelerometer, gyroscope, magnetometer and temperature data through RAW/SCALE and buffered scans. Device Tree describes the sensor hub; its individual streams are discovered at runtime.

The receiver validates supported descriptors and sample scales, keeps discovery open after empty or unsupported initial inventories, and checks repeated inventories before allowing new data to use registered metadata. A supported descriptor changing meaning faults the session until an explicit teardown and rebind. Existing v9 cache, scan-layout and buffer lifetime fixes are retained.

Based on Jonathan Cameron's IIO testing branch:
69fa76f0af3414cc189c3b0b807cb59e327ecc00

Changes since v9:
- Publish and reference the reviewed/adopted OSF-D2H 0.0 specification, errata process and dated publication evidence.
- Tolerate reserved padding, validate descriptor/sample scales, keep discovery open after empty/unsupported reports, and compare repeated capability reports.
- Fail closed on changed descriptor meaning instead of publishing data with stale metadata.
- Add focused KUnit coverage for these lifecycle and validation cases.
- Use managed UART/IIO/power teardown and dev_warn_probe() for the controller baud-rate warning, addressing Andy's probe-path feedback.
- Split the former combined UART/core/IIO driver patch into transport/core, IIO registration, core KUnit, and IIO KUnit patches following review.
- Use validated/unvalidated terminology for framing/CRC results throughout the stream/core/transport code, tests and diagnostics. CRC detects accidental corruption; it does not provide cryptographic authentication.

Prior validation on the identical source tree:
identical source tree evidence reused; no builds rerun for DCO packaging.
- All eight intermediate apply/config/relevant builds.
- Independent transport/core and IIO module link/MODPOST.
- GCC/Clang W=1 vmlinux and modules.
- GCC and Clang KUnit: core 16 + IIO 2, all 18 pass in each run.
- Core-only intermediate KUnit: all 16 pass.
- ARM64 Image, selected OSF module and Pi4 DTB.
- Targeted DT binding/style and IIO documentation.

The terminology-only diff was verified mechanically. Wire semantics and data-path behavior are unchanged; the receive diagnostic key is validated=. Hardware testing was not repeated for this terminology revision or this post-DCO packaging audit; previous hardware evidence remains historical.

Human DCO is complete. No email has been sent.

Jinseob Kim (8):
dt-bindings: iio: add Open Sensor Fusion device
Documentation: iio: add Open Sensor Fusion driver overview
iio: osf: add protocol decoding
iio: osf: add validated stream parser
iio: osf: add UART transport and core receive path
iio: osf: add IIO devices from capability reports
iio: osf: add core KUnit tests
iio: osf: add IIO KUnit tests

 .../bindings/iio/opensensorfusion,osf.yaml    |   52 +
 .../devicetree/bindings/vendor-prefixes.yaml  |    2 +
 Documentation/iio/index.rst                   |    1 +
 Documentation/iio/open-sensor-fusion.rst      |   77 ++
 MAINTAINERS                                   |    8 +
 drivers/iio/Kconfig                           |    1 +
 drivers/iio/Makefile                          |    1 +
 drivers/iio/opensensorfusion/Kconfig          |   27 +

Any reason not to push it one level deeper and put it under IMUs? I'm not that keen to grow the top level menu for this as all the other entries are about type of sensor, not one specific sensor.

Quoted 78 lines · On Sat, 19 Sep 2026 03:24:38 +0900 Jinseob Kim <[email protected]> wrote:

Specification status: OSF-D2H 0.0 spec-1 has completed project technical stability review, has been adopted by the project owner, and is published as a fixed specification.

Canonical specification:
https://github.com/opensensorfusion/opensensorfusion-protocol/blob/ca9cdea1ae550c2b4d6f29f87877adae99470744/spec/osf-d2h-0.0.md

Errata process:
https://github.com/opensensorfusion/opensensorfusion-protocol/blob/ca9cdea1ae550c2b4d6f29f87877adae99470744/errata/README.md

Current adoption/publication record:
https://github.com/opensensorfusion/opensensorfusion-protocol/blob/0cabccf63ac01d0eb82dd9882739ff58eed4a76c/reviews/publication-record-20260918.md

The specification was frozen before adoption/publication, so its embedded status snapshot is intentionally historical. The dated publication record above establishes the current adopted/public state. This is project review and adoption, not an external maintainer approval.

This series adds the Open Sensor Fusion UART receive path and IIO devices discovered from capability reports. It exposes accelerometer, gyroscope, magnetometer and temperature data through RAW/SCALE and buffered scans. Device Tree describes the sensor hub; its individual streams are discovered at runtime.

The receiver validates supported descriptors and sample scales, keeps discovery open after empty or unsupported initial inventories, and checks repeated inventories before allowing new data to use registered metadata. A supported descriptor changing meaning faults the session until an explicit teardown and rebind. Existing v9 cache, scan-layout and buffer lifetime fixes are retained.

Based on Jonathan Cameron's IIO testing branch:
69fa76f0af3414cc189c3b0b807cb59e327ecc00

Changes since v9:
- Publish and reference the reviewed/adopted OSF-D2H 0.0 specification, errata process and dated publication evidence.
- Tolerate reserved padding, validate descriptor/sample scales, keep discovery open after empty/unsupported reports, and compare repeated capability reports.
- Fail closed on changed descriptor meaning instead of publishing data with stale metadata.
- Add focused KUnit coverage for these lifecycle and validation cases.
- Use managed UART/IIO/power teardown and dev_warn_probe() for the controller baud-rate warning, addressing Andy's probe-path feedback.
- Split the former combined UART/core/IIO driver patch into transport/core, IIO registration, core KUnit, and IIO KUnit patches following review.
- Use validated/unvalidated terminology for framing/CRC results throughout the stream/core/transport code, tests and diagnostics. CRC detects accidental corruption; it does not provide cryptographic authentication.

Prior validation on the identical source tree:
identical source tree evidence reused; no builds rerun for DCO packaging.
- All eight intermediate apply/config/relevant builds.
- Independent transport/core and IIO module link/MODPOST.
- GCC/Clang W=1 vmlinux and modules.
- GCC and Clang KUnit: core 16 + IIO 2, all 18 pass in each run.
- Core-only intermediate KUnit: all 16 pass.
- ARM64 Image, selected OSF module and Pi4 DTB.
- Targeted DT binding/style and IIO documentation.

The terminology-only diff was verified mechanically. Wire semantics and data-path behavior are unchanged; the receive diagnostic key is validated=. Hardware testing was not repeated for this terminology revision or this post-DCO packaging audit; previous hardware evidence remains historical.

Human DCO is complete. No email has been sent.

Jinseob Kim (8):
dt-bindings: iio: add Open Sensor Fusion device
Documentation: iio: add Open Sensor Fusion driver overview
iio: osf: add protocol decoding
iio: osf: add validated stream parser
iio: osf: add UART transport and core receive path
iio: osf: add IIO devices from capability reports
iio: osf: add core KUnit tests
iio: osf: add IIO KUnit tests

Quoted 8 lines

 .../bindings/iio/opensensorfusion,osf.yaml    |   52 +
 .../devicetree/bindings/vendor-prefixes.yaml  |    2 +
 Documentation/iio/index.rst                   |    1 +
 Documentation/iio/open-sensor-fusion.rst      |   77 ++
 MAINTAINERS                                   |    8 +
 drivers/iio/Kconfig                           |    1 +
 drivers/iio/Makefile                          |    1 +
 drivers/iio/opensensorfusion/Kconfig          |   27 +

Any reason not to push it one level deeper and put it under IMUs? I'm not that keen to grow the top level menu for this as all the other entries are about type of sensor, not one specific sensor.