Compare commits

...

438 Commits

Author SHA1 Message Date
Phil Elwell
dc8ffff0c1 Pi3 DT: Add dtparams for the SD interface
Add new base dtparams sd_overclock, sd_force_pio, sd_pio_limit
and sd_debug. These were missed out of the initial Pi3 DTB.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
2016-03-07 14:14:27 +00:00
Phil Elwell
85bd50c562 BCM270X_DT: Add pi3-miniuart-bt DT overlay
Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore
UART0/ttyAMA0 over GPIOs 14 & 15. Note that this may reduce the maximum
usable baudrate.

It is also necessary to edit /lib/systemd/system/hciuart.server and
replace ttyAMA0 with ttyS0.

If cmdline.txt uses the alias serial0 to refer to the user-accessable port
then the firmware will replace with the appropriate port whether or not
this overlay is used.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
2016-03-07 10:00:05 +00:00
Phil Elwell
9be1a32098 BCM270X_DT: Add pi3-disable-bt overlay
Disable Bluetooth and restore UART0/ttyAMA0 over GPIOs 14 & 15. To disable
the systemd service that initialises the modem so it doesn't use the UART:

       sudo systemctl disable hciuart

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
2016-03-07 10:00:00 +00:00
Dave Stevenson
abfd67452c DT: Add overlays to configure I2C pins
Lifted from
https://www.raspberrypi.org/forums/viewtopic.php?f=107&t=120938&p=825883
so not claiming this to be my own work.
Adds overlays i2c0-bcm2708 and i2c1-bcm2708 that allow the pin
allocations for i2c-0 and i2c-1 to be changed.
2016-03-06 12:36:37 +00:00
Phil Elwell
02ffe2f70f BCM270X_DT: Add Pi3 support 2016-02-29 10:30:34 +00:00
popcornmix
592b72370d bcm2835-virtgpio: Virtual GPIO driver
Add a virtual GPIO driver that uses the firmware mailbox interface to
request that the VPU toggles LEDs.
2016-02-29 10:29:08 +00:00
Matthias Reichl
f730fce332 ASoC: bcm: add missing .owner fields in sound card drivers
If snd_soc_card.owner is not set the kernel won't do usage refcounting
and one can remove the card driver module while it's in use (eg playback
active) - which leads to a kernel crash.

The missing owner field also prevents ALSA slot ordering
(options snd slots=module-name1,module-name-2,...) from working with
the I2S cards as it has no module name to match against.

Fix these issues by setting the .owner field in the snd_soc_card structs.

Signed-off-by: Matthias Reichl <hias@horus.com>
2016-02-25 09:02:48 +00:00
Phil Elwell
c484e8cc68 amba_pl011: Don't use DT aliases for numbering
The pl011 driver looks for DT aliases of the form "serial<n>",
and if found uses <n> as the device ID. This can cause
/dev/ttyAMA0 to become /dev/ttyAMA1, which is confusing if the
other serial port is provided by the 8250 driver which doesn't
use the same logic.
2016-02-23 17:38:17 +00:00
Phil Elwell
388e9f64fc hci_h5: Don't send conf_req when ACTIVE
Without this patch, a modem and kernel can continuously bombard each
other with conf_req and conf_rsp messages, in a demented game of tag.
2016-02-23 12:57:35 +00:00
Phil Elwell
9b234220ac config: Enable HCI over UARTs 2016-02-23 12:57:33 +00:00
Phil Elwell
58257aa4ff bcm2835-sdhost: Downgrade log message status 2016-02-19 12:06:12 +00:00
Phil Elwell
0a5be76823 BCM270X_DT: at86rf233 overlay - drop to 3MHz
The consensus is that 6MHz is too fast, but that 3MHz is OK.

See: https://github.com/raspberrypi/linux/issues/1294
     https://github.com/raspberrypi/linux/issues/1151
2016-02-18 16:25:40 +00:00
Phil Elwell
04606f393c Revert "Add blk_pos parameter to mmc multi_io_quirk callback"
This reverts commit aab95f9b10.

The bcm2835-sdhost driver no longer needs this patch.
2016-02-16 09:04:57 +00:00
Phil Elwell
d48e8083b4 bcm2835-sdhost: Restore ATOMIC flag to PIO sg mapping
Allocation problems have been seen in a wireless driver, and
this is the only change which might have been responsible.
2016-02-15 11:05:49 +00:00
Phil Elwell
84c35198c7 BCM270X_DT: Use bcm2835-sdhost as standard
Also add new base dtparams sd_overclock, sd_force_pio,
sd_pio_limit and sd_debug.
2016-02-12 17:11:06 +00:00
Phil Elwell
53adab778b bcm2835-sdhost: Major revision
This is a significant revision of the bcm2835-sdhost driver. It
improves on the original in a number of ways:

1) Through the use of CMD23 for reads it appears to avoid problems
   reading some sectors on certain high speed cards.
2) Better atomicity to prevent crashes.
3) Higher performance.
4) Activity logging included, for easier diagnosis in the event
   of a problem.
2016-02-12 17:11:02 +00:00
Digital Dreamtime
7ae9d311c1 Limit PCM512x "Digital" gain to 0dB by default with HiFiBerry DAC+
24db_digital_gain DT param can be used to specify that PCM512x
codec "Digital" volume control should not be limited to 0dB gain,
and if specified will allow the full 24dB gain.
2016-02-09 11:32:03 +00:00
Digital Dreamtime
8b834ff975 Allow up to 24dB digital gain to be applied when using IQAudIO DAC+
24db_digital_gain DT param can be used to specify that PCM512x
codec "Digital" volume control should not be limited to 0dB gain,
and if specified will allow the full 24dB gain.
2016-02-09 11:31:57 +00:00
Phil Elwell
32952c6001 pinctrl-bcm2835: Fix cut-and-paste error in "pull" parsing
The DT bindings for pinctrl-bcm2835 allow both the function and pull
to contain either one entry or one per pin. However, an error in the
DT parsing can cause failures if the number of pulls differs from the
number of functions.
2016-02-09 10:09:04 +00:00
Phil Elwell
e75e6d5633 FIXUP: Overlay README - Restore spaces deleted in error 2016-02-08 12:56:34 +00:00
Phil Elwell
cddbc206ce BCM270X_DT: Adjust overlay README formatting 2016-02-08 09:49:41 +00:00
Phil Elwell
af168f2cd8 FIXUP i2c_bcm2708: Don't change module baudrate parameter
Overwriting the baudrate module parameter creates an apparent
forced baudrate for i2c busses after the first. Not only does this
override the baudrate from DT it also prevents the bus ID from
being initialised.

Also fix whitespace errors.
2016-02-05 11:43:16 +00:00
Phil Elwell
748a6076b9 BCM270X_DT: Add sdio_overclock parameter to sdio overlay
The sdio_overclock parameter is like the overclock_50 parameter, i.e.
it sets an alternate frequency (in MHz) to use when the MMC framework
requests 50MHz, except that it applies to the SDIO bus.

Be aware that the actual frequencies achievable are limited to even integer
divisions of 250MHz, and that the driver will round up to include fractions
(e.g. 62 will include 62.5) but then round down to the nearest frequency.
In other words, the chosen frequency is the highest possible that is less than
the parameter value + 1. In practise this means that 62 is the only sensible
value.

Examples:
  250MHz/4 = 62.5MHz (sdio_overclock=62)
  250MHz/2 = 125MHz (sdio_overclock=125) # Too fast
2016-01-25 10:02:16 +00:00
Andrew Litt
4dee9412d7 SDIO-overlay: add bus_width parameter
Allow setting of the SDIO bus width capability of the bcm2835-mmc
host.  This is helpful when only a 1 bit wide bus is connected
between host and device but both host and device advertise 4 bit
mode.
2016-01-18 12:43:38 +00:00
Andrew Litt
d7a8a4987e bcm2835-mmc: Don't override bus width capabilities from devicetree
Take out the force setting of the MMC_CAP_4_BIT_DATA host capability
so that the result read from devicetree via mmc_of_parse() is
preserved.
2016-01-18 12:43:38 +00:00
popcornmix
7a5ee58c2c rpisense: Make globals static to allow non-module build 2016-01-18 12:43:38 +00:00
Devon Fyson
27510ac7c6 Extend clock timeout, fix modprobe baudrate parameter.
Set the BSC_CLKT clock streching timeout to 35ms as per SMBus specs.\n- Increase priority of baudrate parameter passed to modprobe (in /etc/modprobe.d/*.conf or command line). Currently custom baudrates don't work because they are overridden by clock-frequency in the platform_device passed to the function.
2016-01-18 12:43:38 +00:00
Eric Anholt
ab6247b64e drm: Use the driver's gem_object_free function from CMA helpers.
VC4 wraps the CMA objects in its own structures, so it needs to do its
own teardown (waiting for GPU to finish, updating bo_stats tracking).
The other CMA drivers are using drm_gem_cma_free_object as their
gem_free_object, so this should be a no-op for them.

Signed-off-by: Eric Anholt <eric@anholt.net>
2016-01-18 12:43:38 +00:00
Eric Anholt
420504c5dc drm/vc4: A few more non-functional changes to sync to upstream.
At this point all that's left is the force-enable of HDMI connector,
and using direct firmware calls to turn on V3D instead of the generic
power domain support.

Signed-off-by: Eric Anholt <eric@anholt.net>
2016-01-18 12:43:37 +00:00
Eric Anholt
7244d86699 drm/vc4: Add support for MSAA rendering.
For MSAA, you set a bit in the binner that halves the size of tiles in
each direction, so you can pack 4 samples per pixel in the tile
buffer.  During rendering, you can load and store raw tile buffer
contents (to save the per-sample MSAA contents), or you can load/store
resolved tile buffer contents (loads spam the pixel value to all 4
samples, and stores either average the 4 color samples, or store the
first sample for Z/S).

Signed-off-by: Eric Anholt <eric@anholt.net>
2016-01-18 12:43:37 +00:00
Eric Anholt
0da172fb5d drm/vc4: Synchronize validation code for v2 submission upstream.
Signed-off-by: Eric Anholt <eric@anholt.net>
2016-01-18 12:43:37 +00:00
Eric Anholt
8bfcd19008 drm/vc4: Use "hpd-gpios" for HDMI GPIO, like what landed upstream.
Signed-off-by: Eric Anholt <eric@anholt.net>
2016-01-18 12:43:37 +00:00
Eric Anholt
23bef00ba0 drm/vc4: Update a bunch of code to match upstream submission.
This gets almost everything matching, except for the MSAA support and
using generic PM domains.

Signed-off-by: Eric Anholt <eric@anholt.net>
2016-01-18 12:43:37 +00:00
Eric Anholt
81d88a145f drm/vc4: Add an interface for capturing the GPU state after a hang.
This can be parsed with vc4-gpu-tools tools for trying to figure out
what was going on.

Signed-off-by: Eric Anholt <eric@anholt.net>
2016-01-18 12:43:37 +00:00
Phil Elwell
547120c6be BCM270X_DT: Enable the HW RNG by default 2016-01-08 13:47:49 +00:00
popcornmix
d43824e0a8 Merge pull request #1240 from JanLuca/rpi-4.3.y
MMC: Do not use mmc_debug if CONFIG_MMC_BCM2835 is not set
2015-12-29 12:48:44 +00:00
janluca
9c42ec793b MMC: Do not use mmc_debug if CONFIG_MMC_BCM2835 is not set
If CONFIG_MMC_BCM2835 was not set the compiling of the kernel failed
since mmc_debug was not defined but used in drivers/mmc/core/quirks.c.

This patch add a ifdef-check for CONFIG_MMC_BCM2835 to the change of
commit 64d395457f
2015-12-27 14:34:04 +01:00
Phil Elwell
1865e8c899 bcm2835-sdhost: Don't log timeout errors unless debug=1
The MMC card-discovery process generates timeouts. This is
expected behaviour, so reporting it to the user serves no purpose.
Suppress the reporting of timeout errors unless the debug flag
is on.
2015-12-15 11:48:39 +00:00
Phil Elwell
a89bcc786f bcm270x_dt: Use the sdhost MMC controller by default
The "mmc" overlay reverts to using the other controller.
2015-12-15 11:48:39 +00:00
Phil Elwell
2ceb9820bf Revert "bcm2708: Allow option card devices to be configured via DT"
This reverts commit 8a1799b053.
2015-12-15 11:48:38 +00:00
Phil Elwell
5560285f02 FIXUP BCM270X_DT: Use clk_core for I2C interfaces
Renumber clk_osc to close the gap
2015-12-15 11:48:37 +00:00
Phil Elwell
702c85e0ca lirc-rpi: FIXUP correct error code (should be negative) 2015-12-15 11:48:36 +00:00
Phil Elwell
a9783c1ba9 BCM270X_DT: Use clk_core for I2C interfaces 2015-12-15 11:48:36 +00:00
Patrick Boettcher
eba41c6f33 SDIO-overlay: add poll_once-boolean parameter
Add paramter to toggle sdio-device-polling
done every second or once at boot-time.

Signed-off-by: Patrick Boettcher <patrick.boettcher@posteo.de>
2015-12-15 11:48:35 +00:00
Phil Elwell
c44aa51170 BCM270X_DT: Fix overlay README anomalies 2015-12-15 11:48:34 +00:00
Holger Steinhaus
db238dd8f6 dts: Added overlay for gpio_ir_recv driver 2015-12-15 11:48:34 +00:00
wuyuehang
b8146d865a bcm2709_fb: refine appropriate behaviors to unsupported fb ioctls
since fbturbo introduces and use FBUNSUPPORTED ioctl on copyarea
operations for unsupported dummy ioctl which is expected to return
failure. in such scenario, bcm2709 always prompts error log.

in order not to bother users in kernel log, we change the dev_err to
dev_dbg and return a ENOTTY other than EINVAL to let userspace handles
the return value.

Signed-off-by: wuyuehang <yuehan9.wu@gmail.com>
Reviewed-by: popcornmix <popcornmix@gmail.com>
Reviewed-by: Phil Elwell <pelwell@users.noreply.github.com>
Reviewed-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:48:33 +00:00
popcornmix
61afb7c7c8 config: ADD CONFIG_FB_UDL module (USB displaylink) 2015-12-15 11:48:32 +00:00
popcornmix
1d79e6e708 rpi-ft5406: Use interruptible sleep to avoid high load reported 2015-12-15 11:48:31 +00:00
Ondrej Wisniewski
5e51d7c4c5 dts: Added overlay for Adafruit PiTFT 2.8" capacitive touch screen 2015-12-15 11:48:31 +00:00
Phil Elwell
b46b10abf0 config: Add MCP320X
See: https://github.com/raspberrypi/linux/issues/1189
2015-12-15 11:48:30 +00:00
Alistair Buxton
f2a7bccda5 Build i2c_gpio module and add a device tree overlay to configure it. 2015-12-15 11:48:29 +00:00
Noralf Trønnes
433e030d45 config: Add TOUCHSCREEN_FT6236 2015-12-15 11:48:29 +00:00
Dmitry Torokhov
749bfc5b76 Input: ft6236 - change module license string to match copyright notice
The copyright/license notice says that the code is licensed under GPL v2
only (not GPL v2+), so let's use proper string in MODULE_LICENSE().

Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2015-12-15 11:48:28 +00:00
Fengguang Wu
ce6ed11a89 Input: ft6236 - do not explicitly set driver's owner
There is no need to explicitly set .owner for the driver, the core will do
it for us.

Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2015-12-15 11:48:27 +00:00
Noralf Trønnes
e7cca6c8ea Input: add support for FocalTech FT6236 touchscreen controller
This adds support for the FT6x06 and the FT6x36 family of capacitive touch
panel controllers, in particular the FT6236.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2015-12-15 11:48:26 +00:00
mwilliams03
682bb992d5 New overlay for PiScreen2r 2015-12-15 11:48:26 +00:00
Eric Anholt
fa23089aaa drm/vc4: Fix a typo in a V3D debug register.
Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:25 +00:00
Eric Anholt
c679cc761b drm/vc4: Remove extra barrier()s aroudn CTnCA/CTnEA setup.
The writel() that these expand to already does barriers.

Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:24 +00:00
Eric Anholt
1645f1e5c5 drm/vc4: No need to stop the stopped threads.
This was leftover debug code from the hackdriver.  We never submit
unless the thread is already idle.

Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:24 +00:00
Eric Anholt
46dab46061 drm/vc4: Add support for more display plane formats.
Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:23 +00:00
Eric Anholt
755a684f88 drm/vc4: Drop struct_mutex around CL validation.
We were using it so that we could make sure that shader validation
state didn't change while we were validating, but now shader
validation state is immutable.  The bcl/rcl generation doesn't do any
other BO dereferencing, and seems to have no other global state
dependency not covered by job_lock / bo_lock.  We only need to hold
struct_mutex for object unreferencing.

Fixes a lock order reversal between mmap_sem and struct_mutex.

Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:22 +00:00
popcornmix
7043b17193 config: Add FB_TFT_ILI9163 module 2015-12-15 11:48:22 +00:00
Phil Elwell
3f9affa84b drm/vc4: Increase CMA size to 256M aligned to 256M boundary 2015-12-15 11:48:21 +00:00
Phil Elwell
912bc20b27 drm/vc4: Enable VC4 modules, and increase CMA size with overlay
If using the overlay, be careful not to boot to GUI or run startx,
or the Pi will almost hang, reporting stalls in kernel threads.
2015-12-15 11:48:20 +00:00
Phil Elwell
962bfa7d45 Add vc4-kms-v3d overlay 2015-12-15 11:48:20 +00:00
Eric Anholt
5ddcbf290d drm/vc4: Drop struct_mutex around CL validation.
We were using it so that we could make sure that shader validation
state didn't change while we were validating, but now shader
validation state is immutable.  The bcl/rcl generation doesn't do any
other BO dereferencing, and seems to have no other global state
dependency not covered by job_lock / bo_lock.

Fixes a lock order reversal between mmap_sem and struct_mutex.

Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:19 +00:00
Eric Anholt
5edd010770 drm/vc4: Use job_lock to protect seqno_cb_list.
We're (mostly) not supposed to be using struct_mutex in drivers these
days.

Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:18 +00:00
Eric Anholt
5309f32ab7 drm/vc4: bo cache locking cleanup.
Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:18 +00:00
Eric Anholt
1622e2549b drm/vc4: bo cache locking fixes.
Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:17 +00:00
Eric Anholt
4f7ca2ce9f drm/vc4: Force HDMI to connected.
For some reason on the downstream tree, the HPD GPIO isn't working.

Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:16 +00:00
Eric Anholt
0f60df775a drm/vc4: Add suport for 3D rendering using the V3D engine.
This is a squash of the out-of-tree development series.  Since that
series contained code from the first "get a demo triangle rendered
using a hacked up driver using binary shader code" to "plug the last
known security hole", it's hard to reconstruct a different series of
incremental development that's mergeable without security holes
throughout it.

Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:16 +00:00
Eric Anholt
03bb2a1547 drm: Put an optional field in the driver struct for GEM obj struct size.
This allows a driver to derive from the CMA object without copying all
of the code.

Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:15 +00:00
Eric Anholt
bc819ee465 mm: Remove the PFN busy warning
See commit dae803e165 -- the warning is
expected sometimes when using CMA.  However, that commit still spams
my kernel log with these warnings.

Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:14 +00:00
Derek Foreman
00ccdffc68 drm/vc4: Allow vblank to be disabled
Signed-off-by: Derek Foreman <derekf@osg.samsung.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:13 +00:00
Derek Foreman
d986cd8bc9 drm/vc4: Use the fbdev_cma helpers
Keep the fbdev_cma pointer around so we can use it on hotplog and close
to ensure the frame buffer console is in a useful state.

Signed-off-by: Derek Foreman <derekf@osg.samsung.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:13 +00:00
Eric Anholt
618c7203c8 drm/vc4: Add KMS support for Raspberry Pi.
This is enough for fbcon and bringing up X using
xf86-video-modesetting.  It doesn't support the 3D accelerator or
power management yet.

v2: Drop FB_HELPER select thanks to Archit's patches.  Do manual init
    ordering instead of using the .load hook.  Structure registration
    more like tegra's, but still using the typical "component" code.
    Drop no-op hooks for atomic_begin and mode_fixup() now that
    they're optional.  Drop sentinel in Makefile.  Fix minor style
    nits I noticed on another reread.

v3: Use the new bcm2835 clk driver to manage pixel/HSM clocks instead
    of having a fixed video mode.  Use exynos-style component driver
    matching instead of devicetree nodes to list the component driver
    instances.  Rename compatibility strings to say bcm2835, and
    distinguish pv0/1/2.  Clean up some h/vsync code, and add in
    interlaced mode setup.  Fix up probe/bind error paths.  Use
    bitops.h macros for vc4_regs.h
v4: Include i2c.h, allow building under COMPILE_TEST, drop msleep now
    that other bugs have been fixed, add timeouts to cpu_relax() loops.

Signed-off-by: Eric Anholt <eric@anholt.net>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
2015-12-15 11:48:12 +00:00
Eric Anholt
b38ce57362 drm/vc4: Add devicetree bindings for VC4.
VC4 is the GPU (display and 3D) subsystem present on the 2835 and some
other Broadcom SoCs.

This binding follows the model of msm, imx, sti, and others, where
there is a subsystem node for the whole GPU, with nodes for the
individual HW components within it.

v2: Extend the commit message, fix several nits from Stephen Warren.
v3: Rename the compatibility strings, clean up node names, drop the
    unnecessary lists of components.  Use compatibility strings for
    choosing CRTC HVS channel numbers.  Document the HDMI clock usage.
v4: Whitespace fix, expand acronyms, move to display/ instead of gpu/.

Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:11 +00:00
Eric Anholt
bd9d586b2a bcm2835: Add (disabled) devicetree for the audio clock manager.
Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:10 +00:00
Eric Anholt
678444e5a3 clk: bcm2835: Also build the driver for downstream kernels.
Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:10 +00:00
Eric Anholt
b9d57da8ff clk: bcm2835: Add support for programming the audio domain clocks
This adds support for enabling, disabling, and setting the rate of the
audio domain clocks.  It will be necessary for setting the pixel clock
for HDMI in the VC4 driver and let us write a cpufreq driver.  It will
also improve compatibility with user changes to the firmware's
config.txt, since our previous fixed clocks are unaware of it.

The firmware also has support for configuring the clocks through the
mailbox channel, but the pixel clock setup by the firmware doesn't
work, and it's Raspberry Pi specific anyway.  The only conflicts we
should have with the firmware would be if we made firmware calls that
result in clock management (like opening firmware V3D or ISP access,
which we don't support in upstream), or on hardware over-thermal or
under-voltage (when the firmware would rewrite PLLB to take the ARM
out of overclock).  If that happens, our cached .recalc_rate() results
would be incorrect, but that's no worse than our current state where
we used fixed clocks.

The existing fixed clocks in the code are left in place to provide
backwards compatibility with old device tree files.

v2: Fix onecell->clks[] allocation size.
v3: '/*' on otherwise-empty line for multiline comments, fix top
    comment, use more named initializers, do fewer separate
    allocations on probe, unwind allocations on failure in probe (from
    review by Stephen Warren).  Use new clk_hw_get_name().  Switch
    fb_prediv_bit to be fb_prediv_mask to avoid typing BIT() so many
    times.
v4: Incorporate feedback from Stephen Boyd, and use devm_kasprintf instead
    of bare kasprintf in driver init.
v5: Fix nitpicks from Stefan Wahren, drop a debugging get_rate() call,
    clean up 2 more checkpatch --strict complaints.
v6: More feedback from Stephen Boyd, make #defines for the ANA bits,
    fix non-PLLH KA value.
v7: More nitpicks from Stephen Boyd.

Signed-off-by: Eric Anholt <eric@anholt.net>
Tested-by: Martin Sperl <kernel@martin.sperl.org>
2015-12-15 11:48:09 +00:00
Eric Anholt
6dffff076e clk: bcm2835: Add binding docs for the new platform clock driver.
Previously we've only supported a few fixed clocks based on
assumptions about how the firmware sets up the clocks, but this
binding will let us control the actual (audio power domain) clock
manager.

Signed-off-by: Eric Anholt <eric@anholt.net>
Acked-by: Stephen Warren <swarren@wwwdotorg.org>
Acked-by: Lee Jones <lee@kernel.org>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
2015-12-15 11:48:08 +00:00
Eric Anholt
ec0a31646e clk: bcm2835: Move under bcm/ with other Broadcom SoC clk drivers.
clk-bcm2835.c predates the drivers under bcm/, but all the new BCM
drivers are going in there so let's follow them.

Signed-off-by: Eric Anholt <eric@anholt.net>
Acked-by: Stephen Warren <swarren@wwwdotorg.org>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
2015-12-15 11:48:08 +00:00
Eric Anholt
1d5c05bc28 bcm2708: Use #include in dtsi files.
This will let us include dt-bindings headers and use symbolic names in
various cases.

Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:48:07 +00:00
Phil Elwell
55e4e7e338 BCM270X_DT: Make mmc overlay compatible with current firmware
The original DT overlay logic followed a merge-then-patch procedure,
i.e. parameters are applied to the loaded overlay before the overlay
is merged into the base DTB. This sequence has been changed to
patch-then-merge, in order to support parameterised node names, and
to protect against bad overlays. As a result, overrides (parameters)
must only target labels in the overlay, but the overlay can obviously target nodes in the base DTB.

mmc-overlay.dts (that switches back to the original mmc sdcard
driver) is the only overlay violating that rule, and this patch
fixes it.
2015-12-15 11:48:06 +00:00
Phil Elwell
28f74264fa BCM270X_DT: Add at86rf233 overlay
Add an overlay to support the Atmel AT86RF233 WPAN transceiver on spi0.0.

See: https://github.com/raspberrypi/linux/issues/1151
2015-12-15 11:48:05 +00:00
popcornmix
3ce16dde56 config: Add options for supporting openlabs 802.15.4 radio 2015-12-15 11:48:05 +00:00
popcornmix
fa675ea65e config: Add CONFIG_CRYPTO_USER_API_SKCIPHER 2015-12-15 11:48:04 +00:00
Stuart MacLean
328818c0a6 Add support for the HiFiBerry DAC+ Pro.
The HiFiBerry DAC+ and DAC+ Pro products both use the existing bcm sound driver with the DAC+ Pro having a special clock device driver representing the two high precision oscillators.

An addition bug fix is included for the PCM512x codec where by the physical size of the sample frame is used in the calculation of the LRCK divisor as it was found to be wrong when using 24-bit depth sample contained in a little endian 4-byte sample frame.
2015-12-15 11:48:03 +00:00
popcornmix
dd9e7fca65 config: Add CONFIG_UHID 2015-12-15 11:48:03 +00:00
Noralf Trønnes
70fefd1811 serial/amba-pl011: Remove fifo size hack
This is not necessary since the revision is overridden in the Device Tree:
arm,primecell-periphid = <0x00241011>;

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:48:02 +00:00
Noralf Trønnes
1e1b6d846a clocksource: arm_arch_timer: Remove dc4_arch_timer_init()
It's not needed now that we don't support ATAGS.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:48:01 +00:00
Noralf Trønnes
7ba9b36b1e bcm2709: Disable ATAGS
Disable ATAGS now that we only support booting with Device Tree.
This means we don't need to hardcode devices anymore.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:48:01 +00:00
Noralf Trønnes
4c404d75fe bcm2709: Remove bcm2708_gpio
Not needed now that we only support Device Tree booting.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:48:00 +00:00
Noralf Trønnes
e3ebc3f911 bcm2709: Remove unnecessary files
Remove headers which content is not used.
Remove unused vc_support (would not work because the legacy
mailbox API has been removed).
Remove delay.S which is not used.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:59 +00:00
Noralf Trønnes
e28ee4dfda bcm2709: Make early printk possible on uart0
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:58 +00:00
Noralf Trønnes
9b4b8da51a bcm2708: Remove armctrl irq driver
Not needed now that we only support Device Tree booting.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:58 +00:00
Noralf Trønnes
728f827456 dwc_otg: Simplify FIQ irq number code
Dropping ATAGS means we can simplify the FIQ irq number code.
Also add error checking on the returned irq number.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:57 +00:00
Noralf Trønnes
132ee142f2 bcm2708: Disable ATAGS
Disable ATAGS now that we only support booting with Device Tree.
This means we don't need to hardcode devices anymore.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:56 +00:00
Noralf Trønnes
b6dada0769 bcm2708: Remove bcm2708_gpio
Not needed now that we only support Device Tree booting.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:55 +00:00
Noralf Trønnes
0389f2e11d bcm2708: Remove unused headers
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:54 +00:00
Noralf Trønnes
30b366d9ee vc-sm: Move headers out of arch directory
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:53 +00:00
Noralf Trønnes
f8203f3c78 vc_cma: Provide empty functions when module is not built
Providing empty functions saves the users from guarding the
function call with an #if clause.
Move __init markings from prototypes to functions.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:52 +00:00
Noralf Trønnes
ef300725d5 lirc_rpi: Remove non-DT support
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:52 +00:00
Noralf Trønnes
c79794b5ee i2c-bcm2708: Remove non-DT support
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:51 +00:00
Noralf Trønnes
538cd5b425 BCM270X_DT: Remove spi controller overlays
No need for spi-bcm2708 and spi-bcm2835 DT overlays now that the spi-bcm2708
driver is removed and spi-bcm2835 with DMA enabled is default.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:50 +00:00
Noralf Trønnes
bdfc9880e7 spi-bcm2708: Remove driver
We have switched to spi-bcm2835 and dropping non-DT support means that
we can remove this driver.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:49 +00:00
Noralf Trønnes
82cb6a64df bcm2708-rng: Remove driver
Dropping non-DT support means we don't need this driver.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:49 +00:00
Noralf Trønnes
b6a2f2200a bcm2708_wdog: Remove driver
Dropping non-DT support means we don't need this driver.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:48 +00:00
Phil Elwell
6a43ed383b bcm2835-gpiomem: Fix for ARCH_BCM2835 builds
Build on ARCH_BCM2835, and fail to probe if no IO resource.

See: https://github.com/raspberrypi/linux/issues/1154
2015-12-15 11:47:47 +00:00
Phil Elwell
25f4fcb1d5 scripts: Multi-platform support for mkknlimg and knlinfo
The firmware uses tags in the kernel trailer to choose which dtb file
to load. Current firmware loads bcm2835-*.dtb if the '283x' tag is true,
otherwise it loads bcm270*.dtb. This scheme breaks if an image supports
multiple platforms.

This patch adds '270X' and '283X' tags to indicate support for RPi and
upstream platforms, respectively. '283x' (note lower case 'x') is left
for old firmware, and is only set if the image only supports upstream
builds.
2015-12-15 11:47:46 +00:00
Phil Elwell
63f33f181b BCM270X_DT: Enable the watchdog
Although enabled, the watchdog remains idle until started with a
privileged access to /dev/watchdog, e.g. 'sudo touch /dev/watchdog.'
Once activated, the watchdog must be restarted before the timeout
expires.  The default timeout is 16 seconds.
2015-12-15 11:47:45 +00:00
Dave Stevenson
9739037ee3 BCM2835-V4L2: Return buffers to videobuf2 on shutdown
https://github.com/raspberrypi/linux/issues/817
Fixes the kernel warning from videobuf2 as buffers
are now returned as they are being flushed on
stop_streaming.
2015-12-15 11:47:45 +00:00
Matthias Reichl
b66e1b4056 bcm2835-dma: Limit cyclic transfers on lite channels to 32k
Transfers larger than 32k cause repeated clicking with I2S soundcards.
The exact reason is yet unknown, so limit to 32k as bcm2708-dmaengine
did as an intermediate fix.
2015-12-15 11:47:44 +00:00
Matthias Reichl
b4b64a202b bcm2835-dma: Fix dreq not set for slave transfers
Set dreq to slave_id if it is not set like in bcm2708-dmaengine.
2015-12-15 11:47:43 +00:00
Noralf Trønnes
850c78c5f4 dmaengine: bcm2708: Remove driver but keep legacy API
Dropping non-DT support means we don't need this driver,
but we still need the legacy DMA API.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:43 +00:00
Noralf Trønnes
62fb0b3d9d dmaengine: bcm2708: Change DT compatible string
Both bcm2835-dma and bcm2708-dmaengine have the same compatible string.
So change compatible to "brcm,bcm2708-dma".

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:42 +00:00
Noralf Trønnes
c4b931e540 configs: Enable DMA_BCM2835
Start to use bcm2835-dma when booting with Device Tree.
bcm2708-dmaengine will be used with non-DT boot.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:41 +00:00
Noralf Trønnes
853710bc8d dmaengine: bcm2835: Add debug option for setting wait states
[by popcornmix, taken from bcm2708-dmaengine]
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:40 +00:00
Noralf Trønnes
28a2c5d8df dmaengine: bcm2835: Load driver early and support legacy API
Load driver early since at least bcm2708_fb doesn't support deferred
probing and even if it did, we don't want the video driver deferred.
Support the legacy DMA API which is needed by bcm2708_fb.
Don't mask out channel 2.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:40 +00:00
Noralf Trønnes
7cd3a91a05 dmaengine: bcm2835: set residue_granularity field
bcm2835-dma supports residue reporting at burst level but didn't report
this via the residue_granularity field.

Without this field set properly we get playback issues with I2S cards.

[by HiassofT, taken from bcm2708-dmaengine]
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:39 +00:00
Noralf Trønnes
d89aaa5001 dmaengine: bcm2835: Add slave dma support
Add slave transfer capability to BCM2835 dmaengine driver.
This patch is pulled from the bcm2708-dmaengine driver in the
Raspberry Pi repo. The work was done by Gellert Weisz.

Tested using the bcm2835-mmc driver from the same repo.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:38 +00:00
Noralf Trønnes
98a508ac1a dmaengine: bcm2708: Make legacy API available for bcm2835-dma
bcm2708_fb uses the legacy DMA API, so in order to start using
bcm2835-dma, bcm2835-dma has to support the legacy API. Make this
possible by exporting bcm_dmaman_probe() and bcm_dmaman_remove().

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:38 +00:00
Noralf Trønnes
cb7b685892 bcm2708-i2s: Remove driver
We have switched to bcm2835-i2s and dropping non-DT support means that
we can remove this driver.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:37 +00:00
Matthias Reichl
31f3dfa409 config: fix RaspiDAC Rev.3x dependencies
Change depends to SND_BCM2708_SOC_I2S || SND_BCM2835_SOC_I2S
like the other I2S soundcard drivers.

Signed-off-by: Matthias Reichl <hias@horus.com>
2015-12-15 11:47:36 +00:00
Matthias Reichl
ebabbdd13a BCM270X_DT: switch to bcm2835-i2s
I2S soundcard drivers with proper devicetree support (i.e. not linking
to the cpu_dai/platform via name but to cpu/platform via of_node)
will work out of the box without any modifications.

When the kernel is compiled without devicetree support the platform
code will instantiate the bcm2708-i2s driver and I2S soundcard drivers
will link to it via name, as before.

Signed-off-by: Matthias Reichl <hias@horus.com>
2015-12-15 11:47:35 +00:00
Matthias Reichl
713957a4c1 bcm2835-i2s: Enable MMAP support via a DT property
Code ported from bcm2708-i2s driver in Raspberry Pi tree.

RPi commit 7ee829fd77 ("bcm2708-i2s:
Enable MMAP support via a DT property and overlay")

The i2s driver used to claim to support MMAP, but that feature was disabled
when some problems were found. Add the ability to enable this feature
through Device Tree, using the i2s-mmap overlay.

See: #1004

Signed-off-by: Matthias Reichl <hias@horus.com>
2015-12-15 11:47:34 +00:00
Matthias Reichl
7d9be74a7a bcm2835-i2s: Register PCM device
Code ported from bcm2708-i2s driver in Raspberry Pi tree.

RPi commit ba46b4935a ("ASoC: Add
support for BCM2708")

This driver adds support for digital audio (I2S)
for the BCM2708 SoC that is used by the
Raspberry Pi. External audio codecs can be
connected to the Raspberry Pi via P5 header.

It relies on cyclic DMA engine support for BCM2708.

Signed-off-by: Florian Meier <florian.meier@koalo.de>

Signed-off-by: Matthias Reichl <hias@horus.com>
2015-12-15 11:47:34 +00:00
Matthias Reichl
80633d51b6 bcm2835-i2s: Eliminate debugfs directory error
Code ported from bcm2708-i2s driver in Raspberry Pi tree.

RPi commit fd7d7a3dbe ("bcm2708:
Eliminate i2s debugfs directory error")

Qualify the two regmap ranges uses by bcm2708-i2s ('-i2s' and '-clk')
to avoid the name clash when registering debugfs entries.

Signed-off-by: Matthias Reichl <hias@horus.com>
2015-12-15 11:47:33 +00:00
Matthias Reichl
c8490d3c13 bcm2835-i2s: setup clock only if CPU is clock master
Code ported from bcm2708-i2s driver in Raspberry Pi tree.

RPi commit c14827ecda ("bcm2708: Allow
option card devices to be configured via DT")

Original work by Zoltan Szenczi, committed to RPi tree by
Phil Elwell.

Signed-off-by: Matthias Reichl <hias@horus.com>
2015-12-15 11:47:32 +00:00
Matthias Reichl
5447c6277a bcm2835-i2s: add 24bit support, update bclk_ratio to more correct values
Code ported from bcm2708-i2s driver in Raspberry Pi tree.

RPi commit 62c05a0b53 ("ASoC: BCM2708:
Add 24 bit support")

This adds 24 bit support to the I2S driver of the BCM2708.
Besides enabling the 24 bit flags, it includes two bug fixes:

MMAP is not supported. Claiming this leads to strange issues
when the format of driver and file do not match.

The datasheet states that the width extension bit should be set
for widths greater than 24, but greater or equal would be correct.
This follows from the definition of the width field.

Signed-off-by: Florian Meier <florian.meier@koalo.de>

RPi commit 3e8c672bc4 ("bcm2708-i2s:
Update bclk_ratio to more correct values")

Discussion about blck_ratio affecting sound quality:
https://github.com/raspberrypi/linux/issues/681

Signed-off-by: Matthias Reichl <hias@horus.com>
2015-12-15 11:47:32 +00:00
Matthias Reichl
1917c6a60c configs: enable SND_BCM2835_SOC_I2S
Allow bcm2835-i2s compilation on BCM270x and enable in bcm2709_defconfig
and bcmrpi_defconfig

Signed-off-by: Matthias Reichl <hias@horus.com>
2015-12-15 11:47:31 +00:00
Matthias Reichl
7587afed8a bcm2835-i2s: get base address for DMA from devicetree
Code copied from spi-bcm2835. Get physical address from devicetree
instead of using hardcoded constant.

Signed-off-by: Matthias Reichl <hias@horus.com>
2015-12-15 11:47:30 +00:00
Matthias Reichl
bac7f122ce BCM270X_DT: configure I2S DMA channels
Signed-off-by: Matthias Reichl <hias@horus.com>
2015-12-15 11:47:30 +00:00
Marc Kleine-Budde
17f84a60f1 rtl8192c_rf6052: PHY_RFShadowRefresh(): fix off-by-one
Signed-off-by: Marc Kleine-Budde <mkl@blackshift.org>
2015-12-15 11:47:29 +00:00
P33M
045babfece rpi_display: add backlight driver and overlay
Add a mailbox-driven backlight controller for the Raspberry Pi DSI
touchscreen display. Requires updated GPU firmware to recognise the
mailbox request.

Signed-off-by: Gordon Hollingworth <gordon@raspberrypi.org>
2015-12-15 11:47:28 +00:00
popcornmix
6c417d640e config: remove CONFIG_CPU_SW_DOMAIN_PAN it causes panics 2015-12-15 11:47:28 +00:00
popcornmix
184fd590e2 dwc_otg: Remove duplicate gadget probe/unregister function 2015-12-15 11:47:27 +00:00
popcornmix
b9e7f4ed54 irq-bcm2835: Fix building with 2708 2015-12-15 11:47:26 +00:00
popcornmix
5d078f4c41 bcm2709: Remove custom barrier implementation it is no different to default 2015-12-15 11:47:26 +00:00
popcornmix
2dea8bdd0c vchiq: hack: Add include depecated dma include file 2015-12-15 11:47:25 +00:00
Jan Grulich
a3143dff5d tpa6130a2: Add headphone switch control
Signed-off-by: Jan Grulich <jan@grulich.eu>
2015-12-15 11:47:24 +00:00
Jan Grulich
585eb40c3e RaspiDAC3 support
Signed-off-by: Jan Grulich <jan@grulich.eu>
2015-12-15 11:47:23 +00:00
Noralf Trønnes
beec16368f bcm2835: Add support for uart1
This is a hack until a proper solution is agreed upon.
Martin Sperl is doing some work in this area.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:23 +00:00
Noralf Trønnes
cd0e2a7790 bcm2708-i2s: Make buildable on bcm2835
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:22 +00:00
Noralf Trønnes
3b8644901e i2c-bcm2708: Make buildable on bcm2835
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:21 +00:00
Noralf Trønnes
6d4744ffc0 lirc-rpi: Make buildable on bcm2835
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:20 +00:00
Phil Elwell
ee1d940a20 BCM270X_DT: Add pwm and pwm-2chan overlays
From the README entries:
  Legal pin,function combinations for each channel:
    PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0)            52,5(Alt1)
    PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
  N.B.:
    1) Pin 18 is the only one available on all platforms, and
       it is the one used by the I2S audio interface.
       Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
    2) The onboard analogue audio output uses both PWM channels.
    3) So be careful mixing audio and PWM.
    4) Currently the clock must have been enabled and configured
       by other means.

See: https://github.com/raspberrypi/linux/issues/756
2015-12-15 11:47:20 +00:00
Phil Elwell
f6694cd2b3 Merge pull request #1043 from XECDesign/sense-4.0
mfd: Add Raspberry Pi Sense HAT core driver
2015-12-15 11:47:19 +00:00
Phil Elwell
33869a3df2 scripts/dtc: Add overlay support 2015-12-15 11:47:18 +00:00
Phil Elwell
cbe16a2f34 spidev: Add "spidev" compatible string to silence warning
See: https://github.com/raspberrypi/linux/issues/1054
2015-12-15 11:47:17 +00:00
Phil Elwell
ee99b5d693 spi-bcm2835: Support pin groups other than 7-11
The spi-bcm2835 driver automatically uses GPIO chip-selects due to
some unreliability of the native ones. In doing so it chooses the
same pins as the native chip-selects would use, but the existing
code always uses pins 7 and 8, wherever the SPI function is mapped.

Search the pinctrl group assigned to the driver for pins that
correspond to native chip-selects, and use those for GPIO chip-
selects.

Signed-off-by: Phil Elwell <phil@raspberrypi.org>
2015-12-15 11:47:17 +00:00
Phil Elwell
8dd5a856ae serial: 8250: Don't crash when nr_uarts is 0 2015-12-15 11:47:16 +00:00
Phil Elwell
e658385da5 gpio-poweroff: Allow it to work on Raspberry Pi
The Raspberry Pi firmware manages the power-down and reboot
process. To do this it installs a pm_power_off handler, causing
the gpio-poweroff module to abort the probe function.

This patch introduces a "force" DT property that overrides that
behaviour, and also adds a DT overlay to enable and control it.

Note that running in an active-low configuration (DT parameter
"active_low") requires a custom dt-blob.bin and probably won't
allow a reboot without switching off, so an external inversion
of the trigger signal may be preferable.
2015-12-15 11:47:15 +00:00
Phil Elwell
3ee3b65a85 mach-bcm270x: Enable the building of pinctrl-bcm2835 2015-12-15 11:47:15 +00:00
popcornmix
8d9d6b8dd2 platform: Add force_core command line setting to boot from a different core number 2015-12-15 11:47:14 +00:00
Noralf Trønnes
8bfe01aa5d ARM: bcm2835: Set Serial number and Revision
The VideoCore bootloader passes in Serial number and
Revision number through Device Tree. Make these available to
userspace through /proc/cpuinfo.

Mainline status:

There is a commit in linux-next that standardize passing the serial
number through Device Tree (string: /serial-number):
ARM: 8355/1: arch: Show the serial number from devicetree in cpuinfo

There was an attempt to do the same with the revision number, but it
didn't get in:
[PATCH v2 1/2] arm: devtree: Set system_rev from DT revision

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:13 +00:00
Phil Elwell
539f016d7f Improve __copy_to_user and __copy_from_user performance
Provide a __copy_from_user that uses memcpy. On BCM2708, use
optimised memcpy/memmove/memcmp/memset implementations.

arch/arm: Add mmiocpy/set aliases for memcpy/set

See: https://github.com/raspberrypi/linux/issues/1082
2015-12-15 11:47:13 +00:00
Gordon Hollingworth
f06e24ea56 rpi-ft5406: Add touchscreen driver for pi LCD display
Fix driver detection failure Check that the buffer response is non-zero meaning the touchscreen was detected

rpi-ft5406: Use firmware API
2015-12-15 11:47:12 +00:00
Noralf Trønnes
0db5b43819 bcm2835: bcm2835_defconfig
Some options in bcm2835_defconfig are now the default and
some have changed. Update to keep functionality.

No longer available: SCSI_MULTI_LUN and RESOURCE_COUNTERS.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

bcm2835: bcm2835_defconfig enable MMC_BCM2835

Enable the downstream bcm2835-mmc driver and DMA support.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

bcm2835: bcm2835_defconfig enable BCM2708_MBOX

Enable the mailbox driver.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

bcm2835: bcm2835_defconfig use FB_BCM2708

Enable the bcm2708 framebuffer driver.
Disable the simple framebuffer driver, which matches the
device handed over by u-boot.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

bcm2835: Merge bcm2835_defconfig with bcmrpi_defconfig

These commands where used to make this commit:

./scripts/diffconfig -m arch/arm/configs/bcm2835_defconfig arch/arm/configs/bcmrpi_defconfig > merge.cfg

cat << EOF > filter
CONFIG_ARCH_BCM2708
CONFIG_BCM2708_DT
CONFIG_ARM_PATCH_PHYS_VIRT
CONFIG_PHYS_OFFSET
CONFIG_CMDLINE
CONFIG_BCM2708_WDT
CONFIG_HW_RANDOM_BCM2708
CONFIG_I2C_BCM2708
CONFIG_SPI_BCM2708
CONFIG_SND_BCM2708_SOC_I2S
CONFIG_USB_DWCOTG
CONFIG_LIRC_RPI
EOF

grep -F -v -f filter merge.cfg > filtered.cfg

cat << EOF > added.cfg
CONFIG_WATCHDOG=y
CONFIG_BCM2835_WDT=y
CONFIG_MISC_FILESYSTEMS=y
CONFIG_SND_BCM2835_SOC_I2S=m
EOF

ARCH=arm scripts/kconfig/merge_config.sh arch/arm/configs/bcm2835_defconfig filtered.cfg added.cfg
ARCH=arm make oldconfig

ARCH=arm make savedefconfig
cp defconfig arch/arm/configs/bcm2835_defconfig

rm merge.cfg filter filtered.cfg added.cfg defconfig

ARCH=arm make bcm2835_defconfig
ARCH=arm make oldconfig

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

configs: Incorporate v4.1 dependency changes

Commit 78e9b7de78 added a
dependency on TI_ST instead of selecting it, disabling:
CONFIG_BT_WILINK=m
CONFIG_RADIO_WL128X=m

Commit 652ccae5cc added a
depency on ARM_CRYPTO, disabling:
CONFIG_CRYPTO_SHA*_ARM*=m
CONFIG_CRYPTO_AES_ARM*=m

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

Conflicts:
	arch/arm/configs/bcm2709_defconfig

bcm2835: Sync bcm2835_defconfig with bcmrpi_defconfig

These commands where used to make this commit:

: Get changed and new config values from a merge
./scripts/diffconfig -m arch/arm/configs/bcm2835_defconfig arch/arm/configs/bcmrpi_defconfig > merge.cfg

: Remove these options
cat << EOF > filter
CONFIG_ARCH_BCM2708
CONFIG_BCM2708_DT
CONFIG_ARM_PATCH_PHYS_VIRT
CONFIG_PHYS_OFFSET
CONFIG_CMDLINE
CONFIG_BCM2708_WDT
CONFIG_HW_RANDOM_BCM2708
CONFIG_SPI_BCM2708
EOF

: Apply filter
grep -F -v -f filter merge.cfg > filtered.cfg

: Add these options
: watchdog contains the restart/poweroff code.
cat << EOF > added.cfg
CONFIG_WATCHDOG=y
CONFIG_BCM2835_WDT=y
CONFIG_MISC_FILESYSTEMS=y
CONFIG_I2C_BCM2835=m
CONFIG_SND_BCM2835_SOC_I2S=m
EOF

: Create new config
ARCH=arm scripts/kconfig/merge_config.sh arch/arm/configs/bcm2835_defconfig filtered.cfg added.cfg
: Verify
ARCH=arm make oldconfig

: Update bcm2835_defconfig
ARCH=arm make savedefconfig
cp defconfig arch/arm/configs/bcm2835_defconfig

: Clean up
rm merge.cfg filter filtered.cfg added.cfg defconfig

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:47:11 +00:00
popcornmix
a86a7b659f config: Add default configs 2015-12-15 11:47:10 +00:00
Clive Messer
3a8b897bc9 Add Device Tree support for RPi-DAC. 2015-12-15 11:47:10 +00:00
Waldemar Brodkorb
a294a331f8 Add driver for rpi-proto
Forward port of 3.10.x driver from https://github.com/koalo
We are using a custom board and would like to use rpi 3.18.x
kernel. Patch works fine for our embedded system.

URL to the audio chip:
http://www.mikroe.com/add-on-boards/audio-voice/audio-codec-proto/

Playback tested with devicetree enabled.

Signed-off-by: Waldemar Brodkorb <wbrodkorb@conet.de>
2015-12-15 11:47:09 +00:00
Phil Elwell
b5fe9624a1 enc28j60: Add device tree compatible string and an overlay 2015-12-15 11:47:08 +00:00
Phil Elwell
40924dd47e pinctrl-bcm2835: Only request the interrupts listed in the DTB
Although the GPIO controller can generate three interrupts (four counting
the common one), the device tree files currently only specify two. In the
absence of the third, simply don't register that interrupt (as opposed to
registering 0), which has the effect of making it impossible to generate
interrupts for GPIOs 46-53 which, since they share pins with the SD card
interface, is unlikely to be a problem.
2015-12-15 11:47:08 +00:00
Phil Elwell
cf039d7eee pinctrl-bcm2835: Fix interrupt handling for GPIOs 28-31 and 46-53
Contrary to the documentation, the BCM2835 GPIO controller actually has
four interrupt lines - one each for the three IRQ groups and one common. Rather
confusingly, the GPIO interrupt groups don't correspond directly with the GPIO
control banks. Instead, GPIOs 0-27 generate IRQ GPIO0, 28-45 GPIO1 and
46-53 GPIO2.

Awkwardly, the GPIOS for IRQ GPIO1 straddle two 32-entry GPIO banks, so it is
cleaner to split out a function to process the interrupts for a single GPIO
bank.

This bug has only just been observed because GPIOs above 27 can only be
accessed on an old Raspberry Pi with the optional P5 header fitted, where
the pins are often used for I2S instead.
2015-12-15 11:47:07 +00:00
Phil Elwell
ad3110e583 pinctrl-bcm2835: bcm2835_gpio_direction_output must set the value 2015-12-15 11:47:06 +00:00
notro
c4206fa313 pinctrl-bcm2835: Set base to 0 give expected gpio numbering
Signed-off-by: Noralf Tronnes <notro@tronnes.org>
2015-12-15 11:47:06 +00:00
popcornmix
13dde46d61 bcm2709: Simplify and strip down IRQ handler 2015-12-15 11:47:05 +00:00
Phil Elwell
f4a7c4722c BCM270x_DT: Add pwr_led, and the required "input" trigger
The "input" trigger makes the associated GPIO an input.  This is to support
the Raspberry Pi PWR LED, which is driven by external hardware in normal use.

N.B. pwr_led is not available on Model A or B boards.

leds-gpio: Implement the brightness_get method

The power LED uses some clever logic that means it is driven
by a voltage measuring circuit when configured as input, otherwise
it is driven by the GPIO output value. This patch wires up the
brightness_get method for leds-gpio so that user-space can monitor
the LED value via /sys/class/gpio/led1/brightness. Using the input
trigger this returns an indication of the system power health,
otherwise it is just whatever value the trigger has written most
recently.

See: https://github.com/raspberrypi/linux/issues/1064
2015-12-15 11:47:04 +00:00
Ryan Coe
4e1d7c5efe Update ds1307 driver for device-tree support
Signed-off-by: Ryan Coe <bluemrp9@gmail.com>
2015-12-15 11:47:04 +00:00
Timo Kokkonen
bd25989141 Added support to reserve/enable a GPIO pin to be used from pps-gpio module (LinuxPPS). Enable PPS modules in default config for RPi. 2015-12-15 11:47:03 +00:00
popcornmix
bda8884882 Adding Device Tree support for some RPi audio cards 2015-12-15 11:47:02 +00:00
Phil Elwell
dbb987b08c bcm2708: Allow option card devices to be configured via DT
If the kernel is built with Device Tree support, and if a DT blob
is provided for the kernel at boot time, then the platform devices
for option cards are not created. This avoids both the need to
blacklist unwanted devices, and the need to update the board
support code with each new device.
2015-12-15 11:47:02 +00:00
Daniel Matuschek
afc589f039 Added driver for HiFiBerry Amp amplifier add-on board
The driver contains a low-level hardware driver for the TAS5713 and the
drivers for the Raspberry Pi I2S subsystem.

TAS5713: return error if initialisation fails

Existing TAS5713 driver logs errors during initialisation, but does not return
an error code. Therefore even if initialisation fails, the driver will still be
loaded, but won't work. This patch fixes this. I2C communication error will now
reported correctly by a non-zero return code.

HiFiBerry Amp: fix device-tree problems

Some code to load the driver based on device-tree-overlays was missing. This is added by this patch.
2015-12-15 11:47:01 +00:00
Daniel Matuschek
508230f32d Added support for HiFiBerry DAC+
The driver is based on the HiFiBerry DAC driver. However HiFiBerry DAC+ uses
a different codec chip (PCM5122), therefore a new driver is necessary.
2015-12-15 11:47:00 +00:00
popcornmix
0632846dee hid: Reduce default mouse polling interval to 60Hz
Reduces overhead when using X
2015-12-15 11:47:00 +00:00
Gordon Garrity
8f52ab19bd Add IQaudIO Sound Card support for Raspberry Pi
Set a limit of 0dB on Digital Volume Control

The main volume control in the PCM512x DAC has a range up to
+24dB. This is dangerously loud and can potentially cause massive
clipping in the output stages. Therefore this sets a sensible
limit of 0dB for this control.
2015-12-15 11:46:59 +00:00
Daniel Matuschek
0048bb03fa ASoC: wm8804: Set idle_bias_off to false Idle bias has been change to remove warning on driver startup
Signed-off-by: Daniel Matuschek <daniel@matuschek.net>
2015-12-15 11:46:58 +00:00
Daniel Matuschek
01f6d571eb BCM2708: Added support for HiFiBerry Digi board Board initalization by I2C
Signed-off-by: Daniel Matuschek <daniel@matuschek.net>
2015-12-15 11:46:58 +00:00
Daniel Matuschek
c15ebcea53 ASoC: BCM:Add support for HiFiBerry Digi. Driver is based on the patched WM8804 driver.
Signed-off-by: Daniel Matuschek <daniel@matuschek.net>

Add a parameter to turn off SPDIF output if no audio is playing

This patch adds the paramater auto_shutdown_output to the kernel module.
Default behaviour of the module is the same, but when auto_shutdown_output
is set to 1, the SPDIF oputput will shutdown if no stream is playing.

bugfix for 32kHz sample rate, was missing

HiFiBerry Digi: set SPDIF status bits for sample rate

The HiFiBerry Digi driver did not signal the sample rate in the SPDIF status bits.
While this is optional, some DACs and receivers do not accept this signal. This patch
adds the sample rate bits in the SPDIF status block.
2015-12-15 11:46:57 +00:00
Daniel Matuschek
2ab0abe243 ASoC: wm8804: Implement MCLK configuration options, add 32bit support WM8804 can run with PLL frequencies of 256xfs and 128xfs for most sample rates. At 192kHz only 128xfs is supported. The existing driver selects 128xfs automatically for some lower samples rates. By using an additional mclk_div divider, it is now possible to control the behaviour. This allows using 256xfs PLL frequency on all sample rates up to 96kHz. It should allow lower jitter and better signal quality. The behavior has to be controlled by the sound card driver, because some sample frequency share the same setting. e.g. 192kHz and 96kHz use 24.576MHz master clock. The only difference is the MCLK divider.
This also added support for 32bit data.

Signed-off-by: Daniel Matuschek <daniel@matuschek.net>
2015-12-15 11:46:56 +00:00
Florian Meier
fa0ec93bc0 BCM2708: Add HifiBerry DAC to board file
This adds the initalization of the HifiBerry DAC
to the mach-bcm2708 board file.

Signed-off-by: Florian Meier <florian.meier@koalo.de>
2015-12-15 11:46:56 +00:00
Florian Meier
5bbe7743bd ASoC: Add support for HifiBerry DAC
This adds a machine driver for the HifiBerry DAC.
It is a sound card that can
be stacked onto the Raspberry Pi.

Signed-off-by: Florian Meier <florian.meier@koalo.de>
2015-12-15 11:46:55 +00:00
Florian Meier
036d78e2b3 BCM2708: Add I2S support to board file
Adds the required initializations for I2S
to the board file of mach-bcm2708.

Signed-off-by: Florian Meier <florian.meier@koalo.de>

bcm2708-i2s: Enable MMAP support via a DT property and overlay

The i2s driver used to claim to support MMAP, but that feature was disabled
when some problems were found. Add the ability to enable this feature
through Device Tree, using the i2s-mmap overlay.

See: #1004

bcm2708-i2s: Don't use static pin configuration with DT
2015-12-15 11:46:54 +00:00
Florian Meier
adcc83aae0 ASoC: Add support for PCM5102A codec
Some definitions to support the PCM5102A codec
by Texas Instruments.

Signed-off-by: Florian Meier <florian.meier@koalo.de>
2015-12-15 11:46:54 +00:00
Florian Meier
3690bc292e ASoC: Add support for BCM2708
This driver adds support for digital audio (I2S)
for the BCM2708 SoC that is used by the
Raspberry Pi. External audio codecs can be
connected to the Raspberry Pi via P5 header.

It relies on cyclic DMA engine support for BCM2708.

Signed-off-by: Florian Meier <florian.meier@koalo.de>

ASoC: BCM2708: Add 24 bit support

This adds 24 bit support to the I2S driver of the BCM2708.
Besides enabling the 24 bit flags, it includes two bug fixes:

MMAP is not supported. Claiming this leads to strange issues
when the format of driver and file do not match.

The datasheet states that the width extension bit should be set
for widths greater than 24, but greater or equal would be correct.
This follows from the definition of the width field.

Signed-off-by: Florian Meier <florian.meier@koalo.de>

bcm2708-i2s: Update bclk_ratio to more correct values

Move GPIO setup to hw_params.

This is used to stop the I2S driver from breaking
the GPIO setup for other uses of the PCM interface

Configure GPIOs for I2S based on revision/card settings

With RPi model B+, assignment of the I2S GPIO pins has changed.
This patch uses the board revision to auto-detect the GPIOs used
for I2S. It also allows sound card drivers to set the GPIOs that
should be used. This is especially important with the Compute
Module.

bcm2708-i2s: Avoid leak from iomap when accessing gpio

bcm2708: Eliminate i2s debugfs directory error

Qualify the two regmap ranges uses by bcm2708-i2s ('-i2s' and '-clk')
to avoid the name clash when registering debugfs entries.
2015-12-15 11:46:53 +00:00
popcornmix
a291e31187 config: Enable CONFIG_MEMCG, but leave it disabled (due to memory cost). Enable with cgroup_enable=memory. 2015-12-15 11:46:52 +00:00
popcornmix
1c20c5ff48 Added Device IDs for August DVB-T 205 2015-12-15 11:46:51 +00:00
popcornmix
3a00e92033 enabling the realtime clock 1-wire chip DS1307 and 1-wire on GPIO4 (as a module)
1-wire: Add support for configuring pin for w1-gpio kernel module
See: https://github.com/raspberrypi/linux/pull/457

Add bitbanging pullups, use them for w1-gpio

Allows parasite power to work, uses module option pullup=1

bcm2708: Ensure 1-wire pullup is disabled by default, and expose as module parameter

Signed-off-by: Alex J Lennon <ajlennon@dynamicdevices.co.uk>

w1-gpio: Add gpiopin module parameter and correctly free up gpio pull-up pin, if set

Signed-off-by: Alex J Lennon <ajlennon@dynamicdevices.co.uk>

w1-gpio: Sort out the pullup/parasitic power tangle
2015-12-15 11:46:51 +00:00
popcornmix
bf7238df84 Allow mac address to be set in smsc95xx
Signed-off-by: popcornmix <popcornmix@gmail.com>
2015-12-15 11:46:50 +00:00
Harm Hanemaaijer
0ea73bba1d Speed up console framebuffer imageblit function
Especially on platforms with a slower CPU but a relatively high
framebuffer fill bandwidth, like current ARM devices, the existing
console monochrome imageblit function used to draw console text is
suboptimal for common pixel depths such as 16bpp and 32bpp. The existing
code is quite general and can deal with several pixel depths. By creating
special case functions for 16bpp and 32bpp, by far the most common pixel
formats used on modern systems, a significant speed-up is attained
which can be readily felt on ARM-based devices like the Raspberry Pi
and the Allwinner platform, but should help any platform using the
fb layer.

The special case functions allow constant folding, eliminating a number
of instructions including divide operations, and allow the use of an
unrolled loop, eliminating instructions with a variable shift size,
reducing source memory access instructions, and eliminating excessive
branching. These unrolled loops also allow much better code optimization
by the C compiler. The code that selects which optimized variant is used
is also simplified, eliminating integer divide instructions.

The speed-up, measured by timing 'cat file.txt' in the console, varies
between 40% and 70%, when testing on the Raspberry Pi and Allwinner
ARM-based platforms, depending on font size and the pixel depth, with
the greater benefit for 32bpp.

Signed-off-by: Harm Hanemaaijer <fgenfb@yahoo.com>
2015-12-15 11:46:49 +00:00
popcornmix
e6c86674c4 rtl8192cu: Add PID for D-Link DWA 131 2015-12-15 11:46:48 +00:00
popcornmix
8289217d6c Add non-mainline source for rtl8192cu wireless driver version v4.0.2_9000 as this is widely used. Disabled older rtlwifi driver
8192cu needs old wireless extensions

The obsolete WIRELESS_EXT configuration is used
by the old Realtek code and is needed for AP support.

8192cu: CONFIG_AP_MODE hardcoded in autoconf.h
2015-12-15 11:46:48 +00:00
Siarhei Siamashka
3c29d28d9f fbdev: add FBIOCOPYAREA ioctl
Based on the patch authored by Ali Gholami Rudi at
    https://lkml.org/lkml/2009/7/13/153

Provide an ioctl for userspace applications, but only if this operation
is hardware accelerated (otherwide it does not make any sense).

Signed-off-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>
2015-12-15 11:46:47 +00:00
Noralf Trønnes
02fe8791a4 bcm2835: Match with BCM2708 Device Trees
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:46:46 +00:00
notro
8094370f64 BCM2708: Add core Device Tree support
Add the bare minimum needed to boot BCM2708 from a Device Tree.

Signed-off-by: Noralf Tronnes <notro@tronnes.org>

BCM2708: DT: change 'axi' nodename to 'soc'

Change DT node named 'axi' to 'soc' so it matches ARCH_BCM2835.
The VC4 bootloader fills in certain properties in the 'axi' subtree,
but since this is part of an upstreaming effort, the name is changed.

Signed-off-by: Noralf Tronnes notro@tronnes.org

BCM2708_DT: Correct length of the peripheral space

Use dts-dirs feature for overlays.

The kernel makefiles have a dts-dirs target that is for vendor subdirectories.

Using this fixes the install_dtbs target, which previously did not install the overlays.
2015-12-15 11:46:46 +00:00
Phil Elwell
b763550859 fdt: Add support for the CONFIG_CMDLINE_EXTEND option 2015-12-15 11:46:45 +00:00
Phil Elwell
4823bfdc68 scripts: Add mkknlimg and knlinfo scripts from tools repo
The Raspberry Pi firmware looks for a trailer on the kernel image to
determine whether it was compiled with Device Tree support enabled.
If the firmware finds a kernel without this trailer, or which has a
trailer indicating that it isn't DT-capable, it disables DT support
and reverts to using ATAGs.

The mkknlimg utility adds that trailer, having first analysed the
image to look for signs of DT support and the kernel version string.

knlinfo displays the contents of the trailer in the given kernel image.

scripts/mkknlimg: Add support for ARCH_BCM2835

Add a new trailer field indicating whether this is an ARCH_BCM2835
build, as opposed to MACH_BCM2708/9. If the loader finds this flag
is set it changes the default base dtb file name from bcm270x...
to bcm283y...

Also update knlinfo to show the status of the field.
2015-12-15 11:46:44 +00:00
Vincent Sanders
a5e7bb089f bcm2835: add v4l2 camera device
- Supports raw YUV capture, preview, JPEG and H264.
- Uses videobuf2 for data transfer, using dma_buf.
- Uses 3.6.10 timestamping
- Camera power based on use
- Uses immutable input mode on video encoder

Signed-off-by: Daniel Stone <daniels@collabora.com>
Signed-off-by: Luke Diamand <luked@broadcom.com>

V4L2: Fixes from 6by9

V4L2: Fix EV values. Add manual shutter speed control

V4L2 EV values should be in units of 1/1000. Corrected.
Add support for V4L2_CID_EXPOSURE_ABSOLUTE which should
give manual shutter control. Requires manual exposure mode
to be selected first.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Correct JPEG Q-factor range

Should be 1-100, not 0-100

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Fix issue of driver jamming if STREAMON failed.

Fix issue where the driver was left in a partially enabled
state if STREAMON failed, and would then reject many IOCTLs
as it thought it was streaming.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Fix ISO controls.

Driver was passing the index to the GPU, and not the desired
ISO value.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Add flicker avoidance controls

Add support for V4L2_CID_POWER_LINE_FREQUENCY to set flicker
avoidance frequencies.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Add support for frame rate control.

Add support for frame rate (or time per frame as V4L2
inverts it) control via s_parm.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Improve G_FBUF handling so we pass conformance

Return some sane numbers for get framebuffer so that
we pass conformance.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Fix information advertised through g_vidfmt

Width and height were being stored based on incorrect
values.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Add support for inline H264 headers

Add support for V4L2_CID_MPEG_VIDEO_REPEAT_SEQ_HEADER
to control H264 inline headers.
Requires firmware fix to work correctly, otherwise format
has to be set to H264 before this parameter is set.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Fix JPEG timestamp issue

JPEG images were coming through from the GPU with timestamp
of 0. Detect this and give current system time instead
of some invalid value.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Fix issue when switching down JPEG resolution.

JPEG buffer size calculation is based on input resolution.
Input resolution was being configured after output port
format. Caused failures if switching from one JPEG resolution
to a smaller one.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Enable MJPEG encoding

Requires GPU firmware update to support MJPEG encoder.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Correct flag settings for compressed formats

Set flags field correctly on enum_fmt_vid_cap for compressed
image formats.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: H264 profile & level ctrls, FPS control and auto exp pri

Several control handling updates.
H264 profile and level controls.
Timeperframe/FPS reworked to add V4L2_CID_EXPOSURE_AUTO_PRIORITY to
select whether AE is allowed to override the framerate specified.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Correct BGR24 to RGB24 in format table

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Add additional pixel formats. Correct colourspace

Adds the other flavours of YUYV, and NV12.
Corrects the overlay advertised colourspace.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Drop logging msg from info to debug

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Initial pass at scene modes.

Only supports exposure mode and metering modes.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Add manual white balance control.

Adds support for V4L2_CID_RED_BALANCE and
V4L2_CID_BLUE_BALANCE. Only has an effect if
V4L2_CID_AUTO_N_PRESET_WHITE_BALANCE has
V4L2_WHITE_BALANCE_MANUAL selected.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

config: Enable V4L / MMAL driver

V4L2: Increase the MMAL timeout to 3sec

MJPEG codec flush is now taking longer and results
in a kernel panic if the driver has stopped waiting for
the result when it finally completes.
Increase the timeout value from 1 to 3secs.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Add support for setting H264_I_PERIOD

Adds support for the parameter V4L2_CID_MPEG_VIDEO_H264_I_PERIOD
to set the frequency with which I frames are produced.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Enable GPU function for removing padding from images.

GPU can now support arbitrary strides, although may require
additional processing to achieve it. Enable this feature
so that the images delivered are the size requested.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Add support for V4L2_PIX_FMT_BGR32

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Set the colourspace to avoid odd YUV-RGB conversions

Removes the amiguity from the conversion routines and stops
them dropping back to the SD vs HD choice of coeffs.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Make video/still threshold a run-time param

Move the define for at what resolution the driver
switches from a video mode capture to a stills mode
capture to module parameters.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Fix incorrect pool sizing

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Add option to disable enum_framesizes.

Gstreamer's handling of a driver that advertises
V4L2_FRMSIZE_TYPE_STEPWISE to define the supported
resolutions is broken. See bug
https://bugzilla.gnome.org/show_bug.cgi?id=726521

Optional parameter of gst_v4l2src_is_broken added.
If non-zero, the driver claims not to support that
ioctl, and gstreamer should be happy again (it
guesses a set of defaults for itself).

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Add support for more image formats

Adds YVU420 (YV12), YVU420SP (NV21), and BGR888.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

V4L2: Extend range for V4L2_CID_MPEG_VIDEO_H264_I_PERIOD

Request to extend the range from the fairly arbitrary
1000 frames (33 seconds at 30fps). Extend out to the
max range supported (int32 value).
Also allow 0, which is handled by the codec as only
send an I-frame on the first frame and never again.
There may be an exception if it detects a significant
scene change, but there's no easy way around that.

Signed-off-by: Dave Stevenson <dsteve@broadcom.com>

bcm2835-camera: stop_streaming now has a void return

BCM2835-V4L2: Fix compliance test failures

VIDIOC_TRY_FMT and VIDIOC_S_FMT tests were faling due
to reporting V4L2_COLORSPACE_JPEG when the colour
format wasn't V4L2_PIX_FMT_JPEG.
Now reports V4L2_COLORSPACE_SMPTE170M for YUV formats.

bcm2835 camera planar/packed stride length

Added a field to the mmal_fmt struct used to compute the bytes per line
when using a particular format. This results in the correct stride being
calculated even when the format is planar.

Signed-off-by: Garrett Wilson <g@floft.net>

bcm2835: camera: check for scene not being found

static analysis by cppcheck detected some potential NULL pointer
dereference issues:

[drivers/media/platform/bcm2835/controls.c:854]: (error) Possible null
  pointer dereference: scene
  (and lines 858, 859 too)

it is possible that scene is not found because of an invalue ctrl->val
and is therefore NULL and hence causing a null pointer dereference.

Signed-off-by: Colin Ian King <colin.king@canonical.com>

bcm2835: memcpy port data to m rather than rmsg

static analysis by cppcheck detected a memcpy to rmsg which is
not actually initialized at that point.  The memcpy should be copying
to variable m instead.

Signed-off-by: Colin Ian King <colin.king@canonical.com>
2015-12-15 11:46:44 +00:00
Noralf Trønnes
e54752143a firmware: bcm2835: Support ARCH_BCM270x
Support booting without Device Tree.
Turn on USB power.
Load driver early because of lacking support for deferred probing
in many drivers.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:46:43 +00:00
Noralf Trønnes
8557b192d8 firmware: bcm2835: Add missing property tags
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:46:42 +00:00
Noralf Trønnes
0a1a197a5c char: broadcom: Add vcio module
Add module for accessing the mailbox property channel through
/dev/vcio. Was previously in bcm2708-vcio.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:46:42 +00:00
popcornmix
c005b5c085 Add Chris Boot's i2c driver
i2c-bcm2708: fixed baudrate

Fixed issue where the wrong CDIV value was set for baudrates below 3815 Hz (for 250MHz bus clock).
In that case the computed CDIV value was more than 0xffff. However the CDIV register width is only 16 bits.
This resulted in incorrect setting of CDIV and higher baudrate than intended.
Example: 3500Hz -> CDIV=0x11704 -> CDIV(16bit)=0x1704 -> 42430Hz
After correction: 3500Hz -> CDIV=0x11704 -> CDIV(16bit)=0xffff -> 3815Hz
The correct baudrate is shown in the log after the cdiv > 0xffff correction.

Perform I2C combined transactions when possible

Perform I2C combined transactions whenever possible, within the
restrictions of the Broadcomm Serial Controller.

Disable DONE interrupt during TA poll

Prevent interrupt from being triggered if poll is missed and transfer
starts and finishes.

i2c: Make combined transactions optional and disabled by default

i2c: bcm2708: add device tree support

Add DT support to driver and add to .dtsi file.
Setup pins in .dts file.
i2c is disabled by default.

Signed-off-by: Noralf Tronnes <notro@tronnes.org>

bcm2708: don't register i2c controllers when using DT

The devices for the i2c controllers are in the Device Tree.
Only register devices when not using DT.

Signed-off-by: Noralf Tronnes <notro@tronnes.org>

I2C: Only register the I2C device for the current board revision

i2c_bcm2708: Fix clock reference counting

Fix grabbing lock from atomic context in i2c driver

2 main changes:
- check for timeouts in the bcm2708_bsc_setup function as indicated by this comment:
      /* poll for transfer start bit (should only take 1-20 polls) */
  This implies that the setup function can now fail so account for this everywhere it's called
- Removed the clk_get_rate call from inside the setup function as it locks a mutex and that's not ok since we call it from under a spin lock.

i2c-bcm2708: When using DT, leave the GPIO setup to pinctrl

i2c-bcm2708: Increase timeouts to allow larger transfers

Use the timeout value provided by the I2C_TIMEOUT ioctl when waiting
for completion. The default timeout is 1 second.

See: https://github.com/raspberrypi/linux/issues/260

i2c-bcm2708/BCM270X_DT: Add support for I2C2

The third I2C bus (I2C2) is normally reserved for HDMI use. Careless
use of this bus can break an attached display - use with caution.

It is recommended to disable accesses by VideoCore by setting
hdmi_ignore_edid=1 or hdmi_edid_file=1 in config.txt.

The interface is disabled by default - enable using the
i2c2_iknowwhatimdoing DT parameter.

bcm2708-spi: Don't use static pin configuration with DT

Also remove superfluous error checking - the SPI framework ensures the
validity of the chip_select value.
2015-12-15 11:46:41 +00:00
popcornmix
cc84ad91f4 Add Chris Boot's spi driver.
spi: bcm2708: add device tree support

Add DT support to driver and add to .dtsi file.
Setup pins and spidev in .dts file.
SPI is disabled by default.

Signed-off-by: Noralf Tronnes <notro@tronnes.org>

BCM2708: don't register SPI controller when using DT

The device for the SPI controller is in the Device Tree.
Only register the device when not using DT.

Signed-off-by: Noralf Tronnes <notro@tronnes.org>

spi: bcm2835: make driver available on ARCH_BCM2708

Make this driver available on ARCH_BCM2708

Signed-off-by: Noralf Tronnes <notro@tronnes.org>

bcm2708: Remove the prohibition on mixing SPIDEV and DT

spi-bcm2708: Prepare for Common Clock Framework migration

As part of migrating to use the Common Clock Framework, replace clk_enable()
with clk_prepare_enable() and clk_disable() with clk_disable_unprepare().
This does not affect behaviour under the current clock implementation.

Also add a missing clk_disable_unprepare() in the probe error path.

Signed-off-by: Noralf Tronnes <notro@tronnes.org>

spi-bcm2708: Increase timeout from 150ms to 1s

See: https://github.com/raspberrypi/linux/issues/260
2015-12-15 11:46:40 +00:00
popcornmix
901c04d671 Added hwmon/thermal driver for reporting core temperature. Thanks Dorian
BCM270x: Move thermal sensor to Device Tree

Add Device Tree support to bcm2835-thermal driver.
Add thermal sensor device to Device Tree.
Don't add platform device when booting in DT mode.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:46:39 +00:00
popcornmix
807051051c Add cpufreq driver
Signed-off-by: popcornmix <popcornmix@gmail.com>
2015-12-15 11:46:39 +00:00
Aron Szabo
21814f481b lirc: added support for RaspberryPi GPIO
lirc_rpi: Use read_current_timer to determine transmitter delay. Thanks to jjmz and others
See: https://github.com/raspberrypi/linux/issues/525

lirc: Remove restriction on gpio pins that can be used with lirc

Compute Module, for example could use different pins

lirc_rpi: Add parameter to specify input pin pull

Depending on the connected IR circuitry it might be desirable to change the
gpios internal pull from it pull-down default behaviour. Add a module
parameter to allow the user to set it explicitly.

Signed-off-by: Julian Scheel <julian@jusst.de>

lirc-rpi: Use the higher-level irq control functions

This module used to access the irq_chip methods of the
gpio controller directly, rather than going through the
standard enable_irq/irq_set_irq_type functions. This
caused problems on pinctrl-bcm2835 which only implements
the irq_enable/disable methods and not irq_unmask/mask.

lirc-rpi: Correct the interrupt usage

1) Correct the use of enable_irq (i.e. don't call it so often)
2) Correct the shutdown sequence.
3) Avoid a bcm2708_gpio driver quirk by setting the irq flags earlier

lirc-rpi: use getnstimeofday instead of read_current_timer

read_current_timer isn't guaranteed to return values in
microseconds, and indeed it doesn't on a Pi2.

Issue: linux#827

lirc-rpi: Add device tree support, and a suitable overlay

The overlay supports DT parameters that match the old module
parameters, except that gpio_in_pull should be set using the
strings "up", "down" or "off".

lirc-rpi: Also support pinctrl-bcm2835 in non-DT mode
2015-12-15 11:46:38 +00:00
popcornmix
140bd5f197 Add hwrng (hardware random number generator) driver 2015-12-15 11:46:37 +00:00
Luke Wren
8db383e81a Add SMI NAND driver
Signed-off-by: Luke Wren <wren6991@gmail.com>
2015-12-15 11:46:37 +00:00
Luke Wren
b82f697ea0 Add SMI driver
Signed-off-by: Luke Wren <wren6991@gmail.com>
2015-12-15 11:46:36 +00:00
Luke Wren
97085c5583 Add /dev/gpiomem device for rootless user GPIO access
Signed-off-by: Luke Wren <luke@raspberrypi.org>
2015-12-15 11:46:35 +00:00
Tim Gover
245e5f1c09 vcsm: VideoCore shared memory service for BCM2835
Add experimental support for the VideoCore shared memory service.
This allows user processes to allocate memory from VideoCore's
GPU relocatable heap and mmap the buffers. Additionally, the memory
handles can passed to other VideoCore services such as MMAL, OpenMax
and DispmanX

TODO
* This driver was originally released for BCM28155 which has a different
  cache architecture to BCM2835. Consequently, in this release only
  uncached mappings are supported. However, there's no fundamental
  reason which cached mappings cannot be support or BCM2835
* More refactoring is required to remove the typedefs.
* Re-enable the some of the commented out debug-fs statistics which were
  disabled when migrating code from proc-fs.
* There's a lot of code to support sharing of VCSM in order to support
  Android. This could probably done more cleanly or perhaps just
  removed.

Signed-off-by: Tim Gover <timgover@gmail.com>

config: Disable VC_SM for now to fix hang with cutdown kernel

vcsm: Use boolean as it cannot be built as module

On building the bcm_vc_sm as a module we get the following error:

v7_dma_flush_range and do_munmap are undefined in vc-sm.ko.

Fix by making it not an option to build as module

vcsm: Add ioctl for custom cache flushing
2015-12-15 11:46:34 +00:00
popcornmix
fe300f7765 vc_mem: Add vc_mem driver
Signed-off-by: popcornmix <popcornmix@gmail.com>

BCM270x: Move vc_mem

Make the vc_mem module available for ARCH_BCM2835 by moving it.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:46:33 +00:00
popcornmix
d24e891d35 bcm2708 vchiq driver
Signed-off-by: popcornmix <popcornmix@gmail.com>

vchiq: create_pagelist copes with vmalloc memory

Signed-off-by: Daniel Stone <daniels@collabora.com>

vchiq: fix the shim message release

Signed-off-by: Daniel Stone <daniels@collabora.com>

vchiq: export additional symbols

Signed-off-by: Daniel Stone <daniels@collabora.com>

VCHIQ: Make service closure fully synchronous (drv)

This is one half of a two-part patch, the other half of which is to
the vchiq_lib user library. With these patches, calls to
vchiq_close_service and vchiq_remove_service won't return until any
associated callbacks have been delivered to the callback thread.

VCHIQ: Add per-service tracing

The new service option VCHIQ_SERVICE_OPTION_TRACE is a boolean that
toggles tracing for the specified service.

This commit also introduces vchi_service_set_option and the associated
option VCHI_SERVICE_OPTION_TRACE.

vchiq: Make the synchronous-CLOSE logic more tolerant

vchiq: Move logging control into debugfs

vchiq: Take care of a corner case tickled by VCSM

Closing a connection that isn't fully open requires care, since one
side does not know the other side's port number. Code was present to
handle the case where a CLOSE is sent immediately after an OPEN, i.e.
before the OPENACK has been received, but this was incorrectly being
used when an OPEN from a client using port 0 was rejected.

(In the observed failure, the host was attempting to use the VCSM
service, which isn't present in the 'cutdown' firmware. The failure
was intermittent because sometimes the keepalive service would
grab port 0.)

This case can be distinguished because the client's remoteport will
still be VCHIQ_PORT_FREE, and the srvstate will be OPENING. Either
condition is sufficient to differentiate it from the special case
described above.

vchiq: Avoid high load when blocked and unkillable

vchiq: Include SIGSTOP and SIGCONT in list of signals not-masked by vchiq to allow gdb to work

vchiq_arm: Complete support for SYNCHRONOUS mode

vchiq: Remove inline from suspend/resume

vchiq: Allocation does not need to be atomic

vchiq: Fix wrong condition check

The log level is checked from within the log call. Remove the check in the call.

Signed-off-by: Pranith Kumar <bobby.prani@gmail.com>

BCM270x: Add vchiq device to platform file and Device Tree

Prepare to turn the vchiq module into a driver.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

bcm2708: vchiq: Add Device Tree support

Turn vchiq into a driver and stop hardcoding resources.
Use devm_* functions in probe path to simplify cleanup.
A global variable is used to hold the register address. This is done
to keep this patch as small as possible.
Also make available on ARCH_BCM2835.
Based on work by Lubomir Rintel.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

vchiq: Change logging level for inbound data

vchiq_arm: Two cacheing fixes

1) Make fragment size vary with cache line size
Without this patch, non-cache-line-aligned transfers may corrupt
(or be corrupted by) adjacent data structures.

Both ARM and VC need to be updated to enable this feature. This is
ensured by having the loader apply a new DT parameter -
cache-line-size. The existence of this parameter guarantees that the
kernel is capable, and the parameter will only be modified from the
safe default if the loader is capable.

2) Flush/invalidate vmalloc'd memory, and invalidate after reads

vchiq: fix NULL pointer dereference when closing driver

The following code run as root will cause a null pointer dereference oops:

        int fd = open("/dev/vc-cma", O_RDONLY);
        if (fd < 0)
                err(1, "open failed");
        (void)close(fd);

[ 1704.877721] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[ 1704.877725] pgd = b899c000
[ 1704.877736] [00000000] *pgd=37fab831, *pte=00000000, *ppte=00000000
[ 1704.877748] Internal error: Oops: 817 [#1] PREEMPT SMP ARM
[ 1704.877765] Modules linked in: evdev i2c_bcm2708 uio_pdrv_genirq uio
[ 1704.877774] CPU: 2 PID: 3656 Comm: stress-ng-fstat Not tainted 3.19.1-12-generic-bcm2709 #12-Ubuntu
[ 1704.877777] Hardware name: BCM2709
[ 1704.877783] task: b8ab9b00 ti: b7e68000 task.ti: b7e68000
[ 1704.877798] PC is at __down_interruptible+0x50/0xec
[ 1704.877806] LR is at down_interruptible+0x5c/0x68
[ 1704.877813] pc : [<80630ee8>]    lr : [<800704b0>]    psr: 60080093
sp : b7e69e50  ip : b7e69e88  fp : b7e69e84
[ 1704.877817] r10: b88123c8  r9 : 00000010  r8 : 00000001
[ 1704.877822] r7 : b8ab9b00  r6 : 7fffffff  r5 : 80a1cc34  r4 : 80a1cc34
[ 1704.877826] r3 : b7e69e50  r2 : 00000000  r1 : 00000000  r0 : 80a1cc34
[ 1704.877833] Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
[ 1704.877838] Control: 10c5387d  Table: 3899c06a  DAC: 00000015
[ 1704.877843] Process do-oops (pid: 3656, stack limit = 0xb7e68238)
[ 1704.877848] Stack: (0xb7e69e50 to 0xb7e6a000)
[ 1704.877856] 9e40:                                     80a1cc3c 00000000 00000010 b88123c8
[ 1704.877865] 9e60: b7e69e84 80a1cc34 fff9fee9 ffffffff b7e68000 00000009 b7e69ea4 b7e69e88
[ 1704.877874] 9e80: 800704b0 80630ea4 fff9fee9 60080013 80a1cc28 fff9fee9 b7e69edc b7e69ea8
[ 1704.877884] 9ea0: 8040f558 80070460 fff9fee9 ffffffff 00000000 00000000 00000009 80a1cb7c
[ 1704.877893] 9ec0: 00000000 80a1cb7c 00000000 00000010 b7e69ef4 b7e69ee0 803e1ba4 8040f514
[ 1704.877902] 9ee0: 00000e48 80a1cb7c b7e69f14 b7e69ef8 803e1c9c 803e1b74 b88123c0 b92acb18
[ 1704.877911] 9f00: b8812790 b8d815d8 b7e69f24 b7e69f18 803e2250 803e1bc8 b7e69f5c b7e69f28
[ 1704.877921] 9f20: 80167bac 803e222c 00000000 00000000 b7e69f54 b8ab9ffc 00000000 8098c794
[ 1704.877930] 9f40: b8ab9b00 8000efc4 b7e68000 00000000 b7e69f6c b7e69f60 80167d6c 80167b28
[ 1704.877939] 9f60: b7e69f8c b7e69f70 80047d38 80167d60 b7e68000 b7e68010 8000efc4 b7e69fb0
[ 1704.877949] 9f80: b7e69fac b7e69f90 80012820 80047c84 01155490 011549a8 00000001 00000006
[ 1704.877957] 9fa0: 00000000 b7e69fb0 8000ee5c 80012790 00000000 353d8c0f 7efc4308 00000000
[ 1704.877966] 9fc0: 01155490 011549a8 00000001 00000006 00000000 00000000 76cf3ba0 00000003
[ 1704.877975] 9fe0: 00000000 7efc42e4 0002272f 76e2ed66 60080030 00000003 00000000 00000000
[ 1704.877998] [<80630ee8>] (__down_interruptible) from [<800704b0>] (down_interruptible+0x5c/0x68)
[ 1704.878015] [<800704b0>] (down_interruptible) from [<8040f558>] (vchiu_queue_push+0x50/0xd8)
[ 1704.878032] [<8040f558>] (vchiu_queue_push) from [<803e1ba4>] (send_worker_msg+0x3c/0x54)
[ 1704.878045] [<803e1ba4>] (send_worker_msg) from [<803e1c9c>] (vc_cma_set_reserve+0xe0/0x1c4)
[ 1704.878057] [<803e1c9c>] (vc_cma_set_reserve) from [<803e2250>] (vc_cma_release+0x30/0x38)
[ 1704.878069] [<803e2250>] (vc_cma_release) from [<80167bac>] (__fput+0x90/0x1e0)
[ 1704.878082] [<80167bac>] (__fput) from [<80167d6c>] (____fput+0x18/0x1c)
[ 1704.878094] [<80167d6c>] (____fput) from [<80047d38>] (task_work_run+0xc0/0xf8)
[ 1704.878109] [<80047d38>] (task_work_run) from [<80012820>] (do_work_pending+0x9c/0xc4)
[ 1704.878123] [<80012820>] (do_work_pending) from [<8000ee5c>] (work_pending+0xc/0x20)
[ 1704.878133] Code: e50b1034 e3a01000 e50b2030 e580300c (e5823000)

..the fix is to ensure that we have actually initialized the queue before we attempt
to push any items onto it.  This occurs if we do an open() followed by a close() without
any activity in between.

Signed-off-by: Colin Ian King <colin.king@canonical.com>

vchiq_arm: Sort out the vmalloc case

See: https://github.com/raspberrypi/linux/issues/1055
2015-12-15 11:46:33 +00:00
Phil Elwell
7fe7f5889b bcm2835-audio: Create the platform device if the DT node is disabled
For backwards compatibility, allow the built-in ALSA driver to be enabled
either by loading the module from /etc/modules or by enabling the "/audio"
node in DT.
2015-12-15 11:46:32 +00:00
popcornmix
6f861866d2 bcm2708: alsa sound driver
Signed-off-by: popcornmix <popcornmix@gmail.com>

alsa: add mmap support and some cleanups to bcm2835 ALSA driver

snd-bcm2835: Add support for spdif/hdmi passthrough

This adds a dedicated subdevice which can be used for passthrough of non-audio
formats (ie encoded a52) through the hdmi audio link. In addition to this
driver extension an appropriate card config is required to make alsa-lib
support the AES parameters for this device.

snd-bcm2708: Add mutex, improve logging

Fix for ALSA driver crash

Avoids an issue when closing and opening vchiq where a message can arrive before service handle has been written

alsa: reduce severity of expected warning message

snd-bcm2708: Fix dmesg spam for non-error case

alsa: Ensure mutexes are released through error paths

alsa: Make interrupted close paths quieter

BCM270x: Add onboard sound device to Device Tree

Add Device Tree support to alsa driver.
Add device to Device Tree.
Don't add platform devices when booting in DT mode.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:46:31 +00:00
popcornmix
062c0ea100 cma: Add vc_cma driver to enable use of CMA
Signed-off-by: popcornmix <popcornmix@gmail.com>

vc_cma: Make the vc_cma area the default contiguous DMA area
2015-12-15 11:46:31 +00:00
Phil Elwell
956a367612 Adding bcm2835-sdhost driver, and an overlay to enable it
BCM2835 has two SD card interfaces. This driver uses the other one.

bcm2835-sdhost: Error handling fix, and code clarification

bcm2835-sdhost: Adding overclocking option

Allow a different clock speed to be substitued for a requested 50MHz.
This option is exposed using the "overclock_50" DT parameter.
Note that the sdhost interface is restricted to integer divisions of
core_freq, and the highest sensible option for a core_freq of 250MHz
is 84 (250/3 = 83.3MHz), the next being 125 (250/2) which is much too
high.

Use at your own risk.

bcm2835-sdhost: Round up the overclock, so 62 works for 62.5Mhz

Also only warn once for each overclock setting.

bcm2835-sdhost: Improve error handling and recovery

1) Expose the hw_reset method to the MMC framework, removing many
   internal calls by the driver.

2) Reduce overclock setting on error.

3) Increase timeout to cope with high capacity cards.

4) Add properties and parameters to control pio_limit and debug.

5) Reduce messages at probe time.

bcm2835-sdhost: Further improve overclock back-off

bcm2835-sdhost: Clear HBLC for PIO mode

Also update pio_limit default in overlay README.

bcm2835-sdhost: Add the ERASE capability

See: https://github.com/raspberrypi/linux/issues/1076

bcm2835-sdhost: Ignore CRC7 for MMC CMD1

It seems that the sdhost interface returns CRC7 errors for CMD1,
which is the MMC-specific SEND_OP_COND. Returning these errors to
the MMC layer causes a downward spiral, but ignoring them seems
to be harmless.

bcm2835-mmc/sdhost: Remove ARCH_BCM2835 differences

The bcm2835-mmc driver (and -sdhost driver that copied from it)
contains code to handle SDIO interrupts in a threaded interrupt
handler rather than waking the MMC framework thread. The change
follows a patch from Russell King that adds the facility as the
preferred way of working.

However, the new code path is only present in ARCH_BCM2835
builds, which I have taken to be a way of testing the waters
rather than making the change across the board; I can't see
any technical reason why it wouldn't be enabled for MACH_BCM270X
builds. So this patch standardises on the ARCH_BCM2835 code,
removing the old code paths.
2015-12-15 11:46:30 +00:00
gellert
64d395457f MMC: added alternative MMC driver
mmc: Disable CMD23 transfers on all cards

Pending wire-level investigation of these types of transfers
and associated errors on bcm2835-mmc, disable for now. Fallback of
CMD18/CMD25 transfers will be used automatically by the MMC layer.

Reported/Tested-by: Gellert Weisz <gellert@raspberrypi.org>

mmc: bcm2835-mmc: enable DT support for all architectures

Both ARCH_BCM2835 and ARCH_BCM270x are built with OF now.
Enable Device Tree support for all architectures.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

mmc: bcm2835-mmc: fix probe error handling

Probe error handling is broken in several places.
Simplify error handling by using device managed functions.
Replace pr_{err,info} with dev_{err,info}.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

bcm2835-mmc: Add locks when accessing sdhost registers

bcm2835-mmc: Add range of debug options for slowing things down

bcm2835-mmc: Add option to disable some delays

bcm2835-mmc: Add option to disable MMC_QUIRK_BLK_NO_CMD23

bcm2835-mmc: Default to disabling MMC_QUIRK_BLK_NO_CMD23

bcm2835-mmc: Adding overclocking option

Allow a different clock speed to be substitued for a requested 50MHz.
This option is exposed using the "overclock_50" DT parameter.
Note that the mmc interface is restricted to EVEN integer divisions of
250MHz, and the highest sensible option is 63 (250/4 = 62.5), the
next being 125 (250/2) which is much too high.

Use at your own risk.

bcm2835-mmc: Round up the overclock, so 62 works for 62.5Mhz

Also only warn once for each overclock setting.

mmc: bcm2835-mmc: Make available on ARCH_BCM2835

Make the bcm2835-mmc driver available for use on ARCH_BCM2835.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

BCM270x_DT: add bcm2835-mmc entry

Add Device Tree entry for bcm2835-mmc.
In non-DT mode, don't add the device in the board file.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

bcm2835-mmc: Don't overwrite MMC capabilities from DT
2015-12-15 11:46:29 +00:00
Phil Elwell
5826647fd6 Add blk_pos parameter to mmc multi_io_quirk callback 2015-12-15 11:46:29 +00:00
Florian Meier
8ffce0334e dmaengine: Add support for BCM2708
Add support for DMA controller of BCM2708 as used in the Raspberry Pi.
Currently it only supports cyclic DMA.

Signed-off-by: Florian Meier <florian.meier@koalo.de>

dmaengine: expand functionality by supporting scatter/gather transfers sdhci-bcm2708 and dma.c: fix for LITE channels

DMA: fix cyclic LITE length overflow bug

dmaengine: bcm2708: Remove chancnt affectations

Mirror bcm2835-dma.c commit 9eba5536a7:
chancnt is already filled by dma_async_device_register, which uses the channel
list to know how much channels there is.

Since it's already filled, we can safely remove it from the drivers' probe
function.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

dmaengine: bcm2708: overwrite dreq only if it is not set

dreq is set when the DMA channel is fetched from Device Tree.
slave_id is set using dmaengine_slave_config().
Only overwrite dreq with slave_id if it is not set.

dreq/slave_id in the cyclic DMA case is not touched, because I don't
have hardware to test with.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

dmaengine: bcm2708: do device registration in the board file

Don't register the device in the driver. Do it in the board file.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

dmaengine: bcm2708: don't restrict DT support to ARCH_BCM2835

Both ARCH_BCM2835 and ARCH_BCM270x are built with OF now.
Add Device Tree support to the non ARCH_BCM2835 case.
Use the same driver name regardless of architecture.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

BCM270x_DT: add bcm2835-dma entry

Add Device Tree entry for bcm2835-dma.
The entry doesn't contain any resources since they are handled
by the arch/arm/mach-bcm270x/dma.c driver.
In non-DT mode, don't add the device in the board file.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

bcm2708-dmaengine: Add debug options

BCM270x: Add memory and irq resources to dmaengine device and DT

Prepare for merging of the legacy DMA API arch driver dma.c
with bcm2708-dmaengine by adding memory and irq resources both
to platform file device and Device Tree node.
Don't use BCM_DMAMAN_DRIVER_NAME so we don't have to include mach/dma.h

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

dmaengine: bcm2708: Merge with arch dma.c driver and disable dma.c

Merge the legacy DMA API driver with bcm2708-dmaengine.
This is done so we can use bcm2708_fb on ARCH_BCM2835 (mailbox
driver is also needed).

Changes to the dma.c code:
- Use BIT() macro.
- Cutdown some comments to one line.
- Add mutex to vc_dmaman and use this, since the dev lock is locked
  during probing of the engine part.
- Add global g_dmaman variable since drvdata is used by the engine part.
- Restructure for readability:
  vc_dmaman_chan_alloc()
  vc_dmaman_chan_free()
  bcm_dma_chan_free()
- Restructure bcm_dma_chan_alloc() to simplify error handling.
- Use device irq resources instead of hardcoded bcm_dma_irqs table.
- Remove dev_dmaman_register() and code it directly.
- Remove dev_dmaman_deregister() and code it directly.
- Simplify bcm_dmaman_probe() using devm_* functions.
- Get dmachans from DT if available.
- Keep 'dma.dmachans' module argument name for backwards compatibility.

Make it available on ARCH_BCM2835 as well.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

dmaengine: bcm2708: set residue_granularity field

bcm2708-dmaengine supports residue reporting at burst level
but didn't report this via the residue_granularity field.

Without this field set properly we get playback issues with I2S cards.

dmaengine: bcm2708-dmaengine: Fix memory leak when stopping a running transfer

bcm2708-dmaengine: Use more DMA channels (but not 12)

1) Only the bcm2708_fb drivers uses the legacy DMA API, and
it requires a BULK-capable channel, so all other types
(FAST, NORMAL and LITE) can be made available to the regular
DMA API.

2) DMA channels 11-14 share an interrupt. The driver can't
handle this, so don't use channels 12-14 (12 was used, probably
because it appears to have an interrupt, but in reality that
interrupt is for activity on ANY channel). This may explain
a lockup encountered when running out of DMA channels.

The combined effect of this patch is to leave 7 DMA channels
available + channel 0 for bcm2708_fb via the legacy API.

See: https://github.com/raspberrypi/linux/issues/1110
     https://github.com/raspberrypi/linux/issues/1108
2015-12-15 11:46:28 +00:00
popcornmix
f5ac927aa0 bcm2708 framebuffer driver
Signed-off-by: popcornmix <popcornmix@gmail.com>

bcm2708_fb : Implement blanking support using the mailbox property interface

bcm2708_fb: Add pan and vsync controls

bcm2708_fb: DMA acceleration for fb_copyarea

Based on http://www.raspberrypi.org/phpBB3/viewtopic.php?p=62425#p62425
Also used Simon's dmaer_master module as a reference for tweaking DMA
settings for better performance.

For now busylooping only. IRQ support might be added later.
With non-overclocked Raspberry Pi, the performance is ~360 MB/s
for simple copy or ~260 MB/s for two-pass copy (used when dragging
windows to the right).

In the case of using DMA channel 0, the performance improves
to ~440 MB/s.

For comparison, VFP optimized CPU copy can only do ~114 MB/s in
the same conditions (hindered by reading uncached source buffer).

Signed-off-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>

bcm2708_fb: report number of dma copies

Add a counter (exported via debugfs) reporting the
number of dma copies that the framebuffer driver
has done, in order to help evaluate different
optimization strategies.

Signed-off-by: Luke Diamand <luked@broadcom.com>

bcm2708_fb: use IRQ for DMA copies

The copyarea ioctl() uses DMA to speed things along. This
was busy-waiting for completion. This change supports using
an interrupt instead for larger transfers. For small
transfers, busy-waiting is still likely to be faster.

Signed-off-by: Luke Diamand <luke@diamand.org>

bcm2708: Make ioctl logging quieter

video: fbdev: bcm2708_fb: Don't panic on error

No need to panic the kernel if the video driver fails.
Just print a message and return an error.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

fbdev: bcm2708_fb: Add ARCH_BCM2835 support

Add Device Tree support.
Pass the device to dma_alloc_coherent() in order to get the
correct bus address on ARCH_BCM2835.
Use the new DMA legacy API header file.
Including <mach/platform.h> is not necessary.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

BCM270x_DT: Add bcm2708-fb device

Add bcm2708-fb to Device Tree and don't add the
platform device when booting in DT mode.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:46:27 +00:00
popcornmix
e9da8f9f22 bcm2708 watchdog driver
Signed-off-by: popcornmix <popcornmix@gmail.com>
2015-12-15 11:46:27 +00:00
popcornmix
6fa61e3154 Add dwc_otg driver
Signed-off-by: popcornmix <popcornmix@gmail.com>

usb: dwc: fix lockdep false positive

Signed-off-by: Kari Suvanto <karis79@gmail.com>

usb: dwc: fix inconsistent lock state

Signed-off-by: Kari Suvanto <karis79@gmail.com>

Add FIQ patch to dwc_otg driver. Enable with dwc_otg.fiq_fix_enable=1. Should give about 10% more ARM performance.
Thanks to Gordon and Costas

Avoid dynamic memory allocation for channel lock in USB driver. Thanks ddv2005.

Add NAK holdoff scheme. Enabled by default, disable with dwc_otg.nak_holdoff_enable=0. Thanks gsh

Make sure we wait for the reset to finish

dwc_otg: fix bug in dwc_otg_hcd.c resulting in silent kernel
	 memory corruption, escalating to OOPS under high USB load.

dwc_otg: Fix unsafe access of QTD during URB enqueue

In dwc_otg_hcd_urb_enqueue during qtd creation, it was possible that the
transaction could complete almost immediately after the qtd was assigned
to a host channel during URB enqueue, which meant the qtd pointer was no
longer valid having been completed and removed. Usually, this resulted in
an OOPS during URB submission. By predetermining whether transactions
need to be queued or not, this unsafe pointer access is avoided.

This bug was only evident on the Pi model A where a device was attached
that had no periodic endpoints (e.g. USB pendrive or some wlan devices).

dwc_otg: Fix incorrect URB allocation error handling

If the memory allocation for a dwc_otg_urb failed, the kernel would OOPS
because for some reason a member of the *unallocated* struct was set to
zero. Error handling changed to fail correctly.

dwc_otg: fix potential use-after-free case in interrupt handler

If a transaction had previously aborted, certain interrupts are
enabled to track error counts and reset where necessary. On IN
endpoints the host generates an ACK interrupt near-simultaneously
with completion of transfer. In the case where this transfer had
previously had an error, this results in a use-after-free on
the QTD memory space with a 1-byte length being overwritten to
0x00.

dwc_otg: add handling of SPLIT transaction data toggle errors

Previously a data toggle error on packets from a USB1.1 device behind
a TT would result in the Pi locking up as the driver never handled
the associated interrupt. Patch adds basic retry mechanism and
interrupt acknowledgement to cater for either a chance toggle error or
for devices that have a broken initial toggle state (FT8U232/FT232BM).

dwc_otg: implement tasklet for returning URBs to usbcore hcd layer

The dwc_otg driver interrupt handler for transfer completion will spend
a very long time with interrupts disabled when a URB is completed -
this is because usb_hcd_giveback_urb is called from within the handler
which for a USB device driver with complicated processing (e.g. webcam)
will take an exorbitant amount of time to complete. This results in
missed completion interrupts for other USB packets which lead to them
being dropped due to microframe overruns.

This patch splits returning the URB to the usb hcd layer into a
high-priority tasklet. This will have most benefit for isochronous IN
transfers but will also have incidental benefit where multiple periodic
devices are active at once.

dwc_otg: fix NAK holdoff and allow on split transactions only

This corrects a bug where if a single active non-periodic endpoint
had at least one transaction in its qh, on frnum == MAX_FRNUM the qh
would get skipped and never get queued again. This would result in
a silent device until error detection (automatic or otherwise) would
either reset the device or flush and requeue the URBs.

Additionally the NAK holdoff was enabled for all transactions - this
would potentially stall a HS endpoint for 1ms if a previous error state
enabled this interrupt and the next response was a NAK. Fix so that
only split transactions get held off.

dwc_otg: Call usb_hcd_unlink_urb_from_ep with lock held in completion handler

usb_hcd_unlink_urb_from_ep must be called with the HCD lock held.  Calling it
asynchronously in the tasklet was not safe (regression in
c4564d4a1a).

This change unlinks it from the endpoint prior to queueing it for handling in
the tasklet, and also adds a check to ensure the urb is OK to be unlinked
before doing so.

NULL pointer dereference kernel oopses had been observed in usb_hcd_giveback_urb
when a USB device was unplugged/replugged during data transfer.  This effect
was reproduced using automated USB port power control, hundreds of replug
events were performed during active transfers to confirm that the problem was
eliminated.

USB fix using a FIQ to implement split transactions

This commit adds a FIQ implementaion that schedules
the split transactions using a FIQ so we don't get
held off by the interrupt latency of Linux

dwc_otg: fix device attributes and avoid kernel warnings on boot

dcw_otg: avoid logging function that can cause panics

See: https://github.com/raspberrypi/firmware/issues/21
Thanks to cleverca22 for fix

dwc_otg: mask correct interrupts after transaction error recovery

The dwc_otg driver will unmask certain interrupts on a transaction
that previously halted in the error state in order to reset the
QTD error count. The various fine-grained interrupt handlers do not
consider that other interrupts besides themselves were unmasked.

By disabling the two other interrupts only ever enabled in DMA mode
for this purpose, we can avoid unnecessary function calls in the
IRQ handler. This will also prevent an unneccesary FIQ interrupt
from being generated if the FIQ is enabled.

dwc_otg: fiq: prevent FIQ thrash and incorrect state passing to IRQ

In the case of a transaction to a device that had previously aborted
due to an error, several interrupts are enabled to reset the error
count when a device responds. This has the side-effect of making the
FIQ thrash because the hardware will generate multiple instances of
a NAK on an IN bulk/interrupt endpoint and multiple instances of ACK
on an OUT bulk/interrupt endpoint. Make the FIQ mask and clear the
associated interrupts.

Additionally, on non-split transactions make sure that only unmasked
interrupts are cleared. This caused a hard-to-trigger but serious
race condition when you had the combination of an endpoint awaiting
error recovery and a transaction completed on an endpoint - due to
the sequencing and timing of interrupts generated by the dwc_otg core,
it was possible to confuse the IRQ handler.

Fix function tracing

dwc_otg: whitespace cleanup in dwc_otg_urb_enqueue

dwc_otg: prevent OOPSes during device disconnects

The dwc_otg_urb_enqueue function is thread-unsafe. In particular the
access of urb->hcpriv, usb_hcd_link_urb_to_ep, dwc_otg_urb->qtd and
friends does not occur within a critical section and so if a device
was unplugged during activity there was a high chance that the
usbcore hub_thread would try to disable the endpoint with partially-
formed entries in the URB queue. This would result in BUG() or null
pointer dereferences.

Fix so that access of urb->hcpriv, enqueuing to the hardware and
adding to usbcore endpoint URB lists is contained within a single
critical section.

dwc_otg: prevent BUG() in TT allocation if hub address is > 16

A fixed-size array is used to track TT allocation. This was
previously set to 16 which caused a crash because
dwc_otg_hcd_allocate_port would read past the end of the array.

This was hit if a hub was plugged in which enumerated as addr > 16,
due to previous device resets or unplugs.

Also add #ifdef FIQ_DEBUG around hcd->hub_port_alloc[], which grows
to a large size if 128 hub addresses are supported. This field is
for debug only for tracking which frame an allocate happened in.

dwc_otg: make channel halts with unknown state less damaging

If the IRQ received a channel halt interrupt through the FIQ
with no other bits set, the IRQ would not release the host
channel and never complete the URB.

Add catchall handling to treat as a transaction error and retry.

dwc_otg: fiq_split: use TTs with more granularity

This fixes certain issues with split transaction scheduling.

- Isochronous multi-packet OUT transactions now hog the TT until
  they are completed - this prevents hubs aborting transactions
  if they get a periodic start-split out-of-order
- Don't perform TT allocation on non-periodic endpoints - this
  allows simultaneous use of the TT's bulk/control and periodic
  transaction buffers

This commit will mainly affect USB audio playback.

dwc_otg: fix potential sleep while atomic during urb enqueue

Fixes a regression introduced with eb1b482a. Kmalloc called from
dwc_otg_hcd_qtd_add / dwc_otg_hcd_qtd_create did not always have
the GPF_ATOMIC flag set. Force this flag when inside the larger
critical section.

dwc_otg: make fiq_split_enable imply fiq_fix_enable

Failing to set up the FIQ correctly would result in
"IRQ 32: nobody cared" errors in dmesg.

dwc_otg: prevent crashes on host port disconnects

Fix several issues resulting in crashes or inconsistent state
if a Model A root port was disconnected.

- Clean up queue heads properly in kill_urbs_in_qh_list by
  removing the empty QHs from the schedule lists
- Set the halt status properly to prevent IRQ handlers from
  using freed memory
- Add fiq_split related cleanup for saved registers
- Make microframe scheduling reclaim host channels if
  active during a disconnect
- Abort URBs with -ESHUTDOWN status response, informing
  device drivers so they respond in a more correct fashion
  and don't try to resubmit URBs
- Prevent IRQ handlers from attempting to handle channel
  interrupts if the associated URB was dequeued (and the
  driver state was cleared)

dwc_otg: prevent leaking URBs during enqueue

A dwc_otg_urb would get leaked if the HCD enqueue function
failed for any reason. Free the URB at the appropriate points.

dwc_otg: Enable NAK holdoff for control split transactions

Certain low-speed devices take a very long time to complete a
data or status stage of a control transaction, producing NAK
responses until they complete internal processing - the USB2.0
spec limit is up to 500mS. This causes the same type of interrupt
storm as seen with USB-serial dongles prior to c8edb238.

In certain circumstances, usually while booting, this interrupt
storm could cause SD card timeouts.

dwc_otg: Fix for occasional lockup on boot when doing a USB reset

dwc_otg: Don't issue traffic to LS devices in FS mode

Issuing low-speed packets when the root port is in full-speed mode
causes the root port to stop responding. Explicitly fail when
enqueuing URBs to a LS endpoint on a FS bus.

Fix ARM architecture issue with local_irq_restore()

If local_fiq_enable() is called before a local_irq_restore(flags) where
the flags variable has the F bit set, the FIQ will be erroneously disabled.

Fixup arch_local_irq_restore to avoid trampling the F bit in CPSR.

Also fix some of the hacks previously implemented for previous dwc_otg
incarnations.

dwc_otg: fiq_fsm: Base commit for driver rewrite

This commit removes the previous FIQ fixes entirely and adds fiq_fsm.

This rewrite features much more complete support for split transactions
and takes into account several OTG hardware bugs. High-speed
isochronous transactions are also capable of being performed by fiq_fsm.

All driver options have been removed and replaced with:
  - dwc_otg.fiq_enable (bool)
  - dwc_otg.fiq_fsm_enable (bool)
  - dwc_otg.fiq_fsm_mask (bitmask)
  - dwc_otg.nak_holdoff (unsigned int)

Defaults are specified such that fiq_fsm behaves similarly to the
previously implemented FIQ fixes.

fiq_fsm: Push error recovery into the FIQ when fiq_fsm is used

If the transfer associated with a QTD failed due to a bus error, the HCD
would retry the transfer up to 3 times (implementing the USB2.0
three-strikes retry in software).

Due to the masking mechanism used by fiq_fsm, it is only possible to pass
a single interrupt through to the HCD per-transfer.

In this instance host channels would fall off the radar because the error
reset would function, but the subsequent channel halt would be lost.

Push the error count reset into the FIQ handler.

fiq_fsm: Implement timeout mechanism

For full-speed endpoints with a large packet size, interrupt latency
runs the risk of the FIQ starting a transaction too late in a full-speed
frame. If the device is still transmitting data when EOF2 for the
downstream frame occurs, the hub will disable the port. This change is
not reflected in the hub status endpoint and the device becomes
unresponsive.

Prevent high-bandwidth transactions from being started too late in a
frame. The mechanism is not guaranteed: a combination of bit stuffing
and hub latency may still result in a device overrunning.

fiq_fsm: fix bounce buffer utilisation for Isochronous OUT

Multi-packet isochronous OUT transactions were subject to a few bounday
bugs. Fix them.

Audio playback is now much more robust: however, an issue stands with
devices that have adaptive sinks - ALSA plays samples too fast.

dwc_otg: Return full-speed frame numbers in HS mode

The frame counter increments on every *microframe* in high-speed mode.
Most device drivers expect this number to be in full-speed frames - this
caused considerable confusion to e.g. snd_usb_audio which uses the
frame counter to estimate the number of samples played.

fiq_fsm: save PID on completion of interrupt OUT transfers

Also add edge case handling for interrupt transports.

Note that for periodic split IN, data toggles are unimplemented in the
OTG host hardware - it unconditionally accepts any PID.

fiq_fsm: add missing case for fiq_fsm_tt_in_use()

Certain combinations of bitrate and endpoint activity could
result in a periodic transaction erroneously getting started
while the previous Isochronous OUT was still active.

fiq_fsm: clear hcintmsk for aborted transactions

Prevents the FIQ from erroneously handling interrupts
on a timed out channel.

fiq_fsm: enable by default

fiq_fsm: fix dequeues for non-periodic split transactions

If a dequeue happened between the SSPLIT and CSPLIT phases of the
transaction, the HCD would never receive an interrupt.

fiq_fsm: Disable by default

fiq_fsm: Handle HC babble errors

The HCTSIZ transfer size field raises a babble interrupt if
the counter wraps. Handle the resulting interrupt in this case.

dwc_otg: fix interrupt registration for fiq_enable=0

Additionally make the module parameter conditional for wherever
hcd->fiq_state is touched.

fiq_fsm: Enable by default

dwc_otg: Fix various issues with root port and transaction errors

Process the host port interrupts correctly (and don't trample them).
Root port hotplug now functional again.

Fix a few thinkos with the transaction error passthrough for fiq_fsm.

fiq_fsm: Implement hack for Split Interrupt transactions

Hubs aren't too picky about which endpoint we send Control type split
transactions to. By treating Interrupt transfers as Control, it is
possible to use the non-periodic queue in the OTG core as well as the
non-periodic FIFOs in the hub itself. This massively reduces the
microframe exclusivity/contention that periodic split transactions
otherwise have to enforce.

It goes without saying that this is a fairly egregious USB specification
violation, but it works.

Original idea by Hans Petter Selasky @ FreeBSD.org.

dwc_otg: FIQ support on SMP. Set up FIQ stack and handler on Core 0 only.

dwc_otg: introduce fiq_fsm_spin(un|)lock()

SMP safety for the FIQ relies on register read-modify write cycles being
completed in the correct order. Several places in the DWC code modify
registers also touched by the FIQ. Protect these by a bare-bones lock
mechanism.

This also makes it possible to run the FIQ and IRQ handlers on different
cores.

fiq_fsm: fix build on bcm2708 and bcm2709 platforms

dwc_otg: put some barriers back where they should be for UP

bcm2709/dwc_otg: Setup FIQ on core 1 if >1 core active

dwc_otg: fixup read-modify-write in critical paths

Be more careful about read-modify-write on registers that the FIQ
also touches.

Guard fiq_fsm_spin_lock with fiq_enable check

fiq_fsm: Falling out of the state machine isn't fatal

This edge case can be hit if the port is disabled while the FIQ is
in the middle of a transaction. Make the effects less severe.

Also get rid of the useless return value.

squash: dwc_otg: Allow to build without SMP

usb: core: make overcurrent messages more prominent

Hub overcurrent messages are more serious than "debug". Increase loglevel.

usb: dwc_otg: Don't use dma_to_virt()

Commit 6ce0d20 changes dma_to_virt() which breaks this driver.
Open code the old dma_to_virt() implementation to work around this.

Limit the use of __bus_to_virt() to cases where transfer_buffer_length
is set and transfer_buffer is not set. This is done to increase the
chance that this driver will also work on ARCH_BCM2835.

transfer_buffer should not be NULL if the length is set, but the
comment in the code indicates that there are situations where this
might happen. drivers/usb/isp1760/isp1760-hcd.c also has a similar
comment pointing to a possible: 'usb storage / SCSI bug'.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>

dwc_otg: Fix crash when fiq_enable=0

dwc_otg: fiq_fsm: Make high-speed isochronous strided transfers work properly

Certain low-bandwidth high-speed USB devices (specialist audio devices,
compressed-frame webcams) have packet intervals > 1 microframe.

Stride these transfers in the FIQ by using the start-of-frame interrupt
to restart the channel at the right time.

dwc_otg: Force host mode to fix incorrect compute module boards

dwc_otg: Add ARCH_BCM2835 support

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:46:26 +00:00
popcornmix
89bad1e39c Add bcm2708_gpio driver
Signed-off-by: popcornmix <popcornmix@gmail.com>

bcm2708: Add extension to configure internal pulls

The bcm2708 gpio controller supports internal pulls to be used as pull-up,
pull-down or being entirely disabled. As it can be useful for a driver to
change the pull configuration from it's default pull-down state, add an
extension which allows configuring the pull per gpio.

Signed-off-by: Julian Scheel <julian@jusst.de>

bcm2708-gpio: Revert the use of pinctrl_request_gpio

In non-DT systems, pinctrl_request_gpio always fails causing
"requests probe deferral" messages. In DT systems, it isn't useful
because the reference counting is independent of the normal pinctrl
pin reservations.

gpio: Only clear the currently occurring interrupt. Avoids losing interrupts

See: linux #760

bcm2708_gpio: Avoid calling irq_unmask for all interrupts

When setting up the interrupts, specify that the handle_simple_irq
handler should be used. This leaves interrupt acknowledgement to
the caller, and prevents irq_unmask from being called for all
interrupts.

Issue: linux #760
2015-12-15 11:46:25 +00:00
Noralf Trønnes
aa7ea4b435 mailbox: bcm2835: Support ARCH_BCM270x
Make it possible to use bcm2835-mailbox without Device Tree.
Load driver early because of lacking support for deferred probing
in many drivers.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:46:25 +00:00
Noralf Trønnes
9d1976c6c7 BCM2708: Use brcm,bcm2835-system-timer
When booting with Device Tree use drivers/clocksource/bcm2835_timer.c

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:46:24 +00:00
Noralf Trønnes
517d136f05 BCM270x: Switch to firmware driver
defconfig: enable BCM2835_MBOX, RASPBERRYPI_FIRMWARE and BCM_VCIO.
Add firmware node and change mailbox node in Device Tree.
Add/update platform file for firmware and mailbox.
Strip bcm2708-vcio of everything except the legacy API and hook it
up with the firmware driver.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:46:23 +00:00
Phil Elwell
24d03071a6 BCM2708: Use upstream interrupt driver on all Pi1's
Although the aim is to delete the old armctrl driver, that can't happen
while non-DT configurations are still supported. This commit enables
use of the new FIQ-enabled upstream irqchip driver when DT is enabled
on all BCM2835-based RPi platforms (Models A, B, A+, B+ & CM).

BCM2836-based platforms (Pi 2) will get the same treatment at a later
date, unless non-DT support has already been withdrawn.
2015-12-15 11:46:23 +00:00
popcornmix
a051577f3c Main bcm2708/bcm2709 linux port
Signed-off-by: popcornmix <popcornmix@gmail.com>
Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
2015-12-15 11:46:22 +00:00
Noralf Trønnes
b0b75d8a7b irqchip: bcm2835: Add FIQ support
Add a duplicate irq range with an offset on the hwirq's so the
driver can detect that enable_fiq() is used.
Tested with downstream dwc_otg USB controller driver.

Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
Reviewed-by: Eric Anholt <eric@anholt.net>
Acked-by: Stephen Warren <swarren@wwwdotorg.org>
2015-12-15 11:46:21 +00:00
Eric Anholt
476ef7d882 ARM: bcm2835: Add the Raspberry Pi firmware driver
This gives us a function for making mailbox property channel requests
of the firmware, which is most notable in that it will let us get and
set clock rates.

Signed-off-by: Eric Anholt <eric@anholt.net>
2015-12-15 11:46:21 +00:00
Robert Tiemann
1e5d9105a7 BCM2835_DT: Fix I2S register map 2015-12-15 11:46:20 +00:00
popcornmix
6b28671d30 vmstat: Workaround for issue where dirty page count goes negative
See:
https://github.com/raspberrypi/linux/issues/617
http://www.spinics.net/lists/linux-mm/msg72236.html
2015-12-15 11:46:19 +00:00
popcornmix
9735747568 smsc95xx: Disable turbo mode by default 2015-12-15 11:46:19 +00:00
Steve Glendinning
e5f275c27c smsx95xx: fix crimes against truesize
smsc95xx is adjusting truesize when it shouldn't, and following a recent patch from Eric this is now triggering warnings.

This patch stops smsc95xx from changing truesize.

Signed-off-by: Steve Glendinning <steve.glendinning@smsc.com>
2015-12-15 11:46:18 +00:00
Greg Kroah-Hartman
3548341891 Linux 4.3.3 2015-12-14 21:41:43 -08:00
Filipe Manana
e0aa614dc9 Btrfs: fix regression running delayed references when using qgroups
commit b06c4bf5c8 upstream.

In the kernel 4.2 merge window we had a big changes to the implementation
of delayed references and qgroups which made the no_quota field of delayed
references not used anymore. More specifically the no_quota field is not
used anymore as of:

  commit 0ed4792af0 ("btrfs: qgroup: Switch to new extent-oriented qgroup mechanism.")

Leaving the no_quota field actually prevents delayed references from
getting merged, which in turn cause the following BUG_ON(), at
fs/btrfs/extent-tree.c, to be hit when qgroups are enabled:

  static int run_delayed_tree_ref(...)
  {
     (...)
     BUG_ON(node->ref_mod != 1);
     (...)
  }

This happens on a scenario like the following:

  1) Ref1 bytenr X, action = BTRFS_ADD_DELAYED_REF, no_quota = 1, added.

  2) Ref2 bytenr X, action = BTRFS_DROP_DELAYED_REF, no_quota = 0, added.
     It's not merged with Ref1 because Ref1->no_quota != Ref2->no_quota.

  3) Ref3 bytenr X, action = BTRFS_ADD_DELAYED_REF, no_quota = 1, added.
     It's not merged with the reference at the tail of the list of refs
     for bytenr X because the reference at the tail, Ref2 is incompatible
     due to Ref2->no_quota != Ref3->no_quota.

  4) Ref4 bytenr X, action = BTRFS_DROP_DELAYED_REF, no_quota = 0, added.
     It's not merged with the reference at the tail of the list of refs
     for bytenr X because the reference at the tail, Ref3 is incompatible
     due to Ref3->no_quota != Ref4->no_quota.

  5) We run delayed references, trigger merging of delayed references,
     through __btrfs_run_delayed_refs() -> btrfs_merge_delayed_refs().

  6) Ref1 and Ref3 are merged as Ref1->no_quota = Ref3->no_quota and
     all other conditions are satisfied too. So Ref1 gets a ref_mod
     value of 2.

  7) Ref2 and Ref4 are merged as Ref2->no_quota = Ref4->no_quota and
     all other conditions are satisfied too. So Ref2 gets a ref_mod
     value of 2.

  8) Ref1 and Ref2 aren't merged, because they have different values
     for their no_quota field.

  9) Delayed reference Ref1 is picked for running (select_delayed_ref()
     always prefers references with an action == BTRFS_ADD_DELAYED_REF).
     So run_delayed_tree_ref() is called for Ref1 which triggers the
     BUG_ON because Ref1->red_mod != 1 (equals 2).

So fix this by removing the no_quota field, as it's not used anymore as
of commit 0ed4792af0 ("btrfs: qgroup: Switch to new extent-oriented
qgroup mechanism.").

The use of no_quota was also buggy in at least two places:

1) At delayed-refs.c:btrfs_add_delayed_tree_ref() - we were setting
   no_quota to 0 instead of 1 when the following condition was true:
   is_fstree(ref_root) || !fs_info->quota_enabled

2) At extent-tree.c:__btrfs_inc_extent_ref() - we were attempting to
   reset a node's no_quota when the condition "!is_fstree(root_objectid)
   || !root->fs_info->quota_enabled" was true but we did it only in
   an unused local stack variable, that is, we never reset the no_quota
   value in the node itself.

This fixes the remainder of problems several people have been having when
running delayed references, mostly while a balance is running in parallel,
on a 4.2+ kernel.

Very special thanks to Stéphane Lesimple for helping debugging this issue
and testing this fix on his multi terabyte filesystem (which took more
than one day to balance alone, plus fsck, etc).

Also, this fixes deadlock issue when using the clone ioctl with qgroups
enabled, as reported by Elias Probst in the mailing list. The deadlock
happens because after calling btrfs_insert_empty_item we have our path
holding a write lock on a leaf of the fs/subvol tree and then before
releasing the path we called check_ref() which did backref walking, when
qgroups are enabled, and tried to read lock the same leaf. The trace for
this case is the following:

  INFO: task systemd-nspawn:6095 blocked for more than 120 seconds.
  (...)
  Call Trace:
    [<ffffffff86999201>] schedule+0x74/0x83
    [<ffffffff863ef64c>] btrfs_tree_read_lock+0xc0/0xea
    [<ffffffff86137ed7>] ? wait_woken+0x74/0x74
    [<ffffffff8639f0a7>] btrfs_search_old_slot+0x51a/0x810
    [<ffffffff863a129b>] btrfs_next_old_leaf+0xdf/0x3ce
    [<ffffffff86413a00>] ? ulist_add_merge+0x1b/0x127
    [<ffffffff86411688>] __resolve_indirect_refs+0x62a/0x667
    [<ffffffff863ef546>] ? btrfs_clear_lock_blocking_rw+0x78/0xbe
    [<ffffffff864122d3>] find_parent_nodes+0xaf3/0xfc6
    [<ffffffff86412838>] __btrfs_find_all_roots+0x92/0xf0
    [<ffffffff864128f2>] btrfs_find_all_roots+0x45/0x65
    [<ffffffff8639a75b>] ? btrfs_get_tree_mod_seq+0x2b/0x88
    [<ffffffff863e852e>] check_ref+0x64/0xc4
    [<ffffffff863e9e01>] btrfs_clone+0x66e/0xb5d
    [<ffffffff863ea77f>] btrfs_ioctl_clone+0x48f/0x5bb
    [<ffffffff86048a68>] ? native_sched_clock+0x28/0x77
    [<ffffffff863ed9b0>] btrfs_ioctl+0xabc/0x25cb
  (...)

The problem goes away by eleminating check_ref(), which no longer is
needed as its purpose was to get a value for the no_quota field of
a delayed reference (this patch removes the no_quota field as mentioned
earlier).

Reported-by: Stéphane Lesimple <stephane_btrfs@lesimple.fr>
Tested-by: Stéphane Lesimple <stephane_btrfs@lesimple.fr>
Reported-by: Elias Probst <mail@eliasprobst.eu>
Reported-by: Peter Becker <floyd.net@gmail.com>
Reported-by: Malte Schröder <malte@tnxip.de>
Reported-by: Derek Dongray <derek@valedon.co.uk>
Reported-by: Erkki Seppala <flux-btrfs@inside.org>
Cc: stable@vger.kernel.org  # 4.2+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Qu Wenruo <quwenruo@cn.fujitsu.com>
2015-12-14 21:41:09 -08:00
Hans Verkuil
4f2347e648 cobalt: fix Kconfig dependency
commit fc88dd16a0 upstream.

The cobalt driver should depend on VIDEO_V4L2_SUBDEV_API.

This fixes this kbuild error:

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   99bc7215bc
commit: 85756a069c [media] cobalt: add new driver
config: x86_64-randconfig-s0-09201514 (attached as .config)
reproduce:
  git checkout 85756a069c
  # save the attached .config to linux build tree
  make ARCH=x86_64

All error/warnings (new ones prefixed by >>):

   drivers/media/i2c/adv7604.c: In function 'adv76xx_get_format':
>> drivers/media/i2c/adv7604.c:1853:9: error: implicit declaration of function 'v4l2_subdev_get_try_format' [-Werror=implicit-function-declaration]
      fmt = v4l2_subdev_get_try_format(sd, cfg, format->pad);
            ^
   drivers/media/i2c/adv7604.c:1853:7: warning: assignment makes pointer from integer without a cast [-Wint-conversion]
      fmt = v4l2_subdev_get_try_format(sd, cfg, format->pad);
          ^
   drivers/media/i2c/adv7604.c: In function 'adv76xx_set_format':
   drivers/media/i2c/adv7604.c:1882:7: warning: assignment makes pointer from integer without a cast [-Wint-conversion]
      fmt = v4l2_subdev_get_try_format(sd, cfg, format->pad);
          ^
   cc1: some warnings being treated as errors

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:09 -08:00
Lu, Han
de48652f0e ALSA: hda/hdmi - apply Skylake fix-ups to Broxton display codec
commit e2656412f2 upstream.

Broxton and Skylake have the same behavior on display audio. So this patch
applys Skylake fix-ups to Broxton.

Signed-off-by: Lu, Han <han.lu@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:09 -08:00
Dan Williams
4ba2bd2c47 ALSA: pci: depend on ZONE_DMA
commit 2db1a57986 upstream.

There are several sound drivers that 'select ZONE_DMA'.  This is
backwards as ZONE_DMA is an architecture capability exported to drivers.
Switch the polarity of the dependency to disable these drivers when the
architecture does not support ZONE_DMA.  This was discovered in the
context of testing/enabling devm_memremap_pages() which depends on
ZONE_DEVICE.  ZONE_DEVICE in turn depends on !ZONE_DMA.

Reported-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:09 -08:00
Arnd Bergmann
4bf8855ea9 ceph: fix message length computation
commit 777d738a5e upstream.

create_request_message() computes the maximum length of a message,
but uses the wrong type for the time stamp: sizeof(struct timespec)
may be 8 or 16 depending on the architecture, while sizeof(struct
ceph_timespec) is always 8, and that is what gets put into the
message.

Found while auditing the uses of timespec for y2038 problems.

Fixes: b8e69066d8 ("ceph: include time stamp in every MDS request")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Yan, Zheng <zyan@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:09 -08:00
Ming Lei
278b54df14 block: fix segment split
commit 578270bfbd upstream.

Inside blk_bio_segment_split(), previous bvec pointer(bvprvp)
always points to the iterator local variable, which is obviously
wrong, so fix it by pointing to the local variable of 'bvprv'.

Fixes: 5014c311baa2b(block: fix bogus compiler warnings in blk-merge.c)
Reported-by: Michael Ellerman <mpe@ellerman.id.au>
Reported-by: Mark Salter <msalter@redhat.com>
Tested-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>
Tested-by: Mark Salter <msalter@redhat.com>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:09 -08:00
Junxiao Bi
eeec50cb58 ocfs2: fix umask ignored issue
commit 8f1eb48758 upstream.

New created file's mode is not masked with umask, and this makes umask not
work for ocfs2 volume.

Fixes: 702e5bc ("ocfs2: use generic posix ACL infrastructure")
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Gang He <ghe@suse.com>
Cc: Mark Fasheh <mfasheh@suse.de>
Cc: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:09 -08:00
Jeff Layton
3994c2dee3 nfs: if we have no valid attrs, then don't declare the attribute cache valid
commit c812012f9c upstream.

If we pass in an empty nfs_fattr struct to nfs_update_inode, it will
(correctly) not update any of the attributes, but it then clears the
NFS_INO_INVALID_ATTR flag, which indicates that the attributes are
up to date. Don't clear the flag if the fattr struct has no valid
attrs to apply.

Reviewed-by: Steve French <steve.french@primarydata.com>
Signed-off-by: Jeff Layton <jeff.layton@primarydata.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:08 -08:00
Jeff Layton
4ffcc6f992 nfs4: resend LAYOUTGET when there is a race that changes the seqid
commit 4f2e9dce0c upstream.

pnfs_layout_process will check the returned layout stateid against what
the kernel has in-core. If it turns out that the stateid we received is
older, then we should resend the LAYOUTGET instead of falling back to
MDS I/O.

Signed-off-by: Jeff Layton <jeff.layton@primarydata.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:08 -08:00
Benjamin Coddington
9a08c6f60b nfs4: start callback_ident at idr 1
commit c68a027c05 upstream.

If clp->cl_cb_ident is zero, then nfs_cb_idr_remove_locked() skips removing
it when the nfs_client is freed.  A decoding or server bug can then find
and try to put that first nfs_client which would lead to a crash.

Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Fixes: d687031265 ("nfs4client: convert to idr_alloc()")
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:08 -08:00
Daniel Borkmann
8489733094 debugfs: fix refcount imbalance in start_creating
commit 0ee9608c89 upstream.

In debugfs' start_creating(), we pin the file system to safely access
its root. When we failed to create a file, we unpin the file system via
failed_creating() to release the mount count and eventually the reference
of the vfsmount.

However, when we run into an error during lookup_one_len() when still
in start_creating(), we only release the parent's mutex but not so the
reference on the mount. Looks like it was done in the past, but after
splitting portions of __create_file() into start_creating() and
end_creating() via 190afd81e4 ("debugfs: split the beginning and the
end of __create_file() off"), this seemed missed. Noticed during code
review.

Fixes: 190afd81e4 ("debugfs: split the beginning and the end of __create_file() off")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:08 -08:00
Andrew Elble
4e9f452926 nfsd: eliminate sending duplicate and repeated delegations
commit 34ed9872e7 upstream.

We've observed the nfsd server in a state where there are
multiple delegations on the same nfs4_file for the same client.
The nfs client does attempt to DELEGRETURN these when they are presented to
it - but apparently under some (unknown) circumstances the client does not
manage to return all of them. This leads to the eventual
attempt to CB_RECALL more than one delegation with the same nfs
filehandle to the same client. The first recall will succeed, but the
next recall will fail with NFS4ERR_BADHANDLE. This leads to the server
having delegations on cl_revoked that the client has no way to FREE
or DELEGRETURN, with resulting inability to recover. The state manager
on the server will continually assert SEQ4_STATUS_RECALLABLE_STATE_REVOKED,
and the state manager on the client will be looping unable to satisfy
the server.

List discussion also reports a race between OPEN and DELEGRETURN that
will be avoided by only sending the delegation once to the
client. This is also logically in accordance with RFC5561 9.1.1 and 10.2.

So, let's:

1.) Not hand out duplicate delegations.
2.) Only send them to the client once.

RFC 5561:

9.1.1:
"Delegations and layouts, on the other hand, are not associated with a
specific owner but are associated with the client as a whole
(identified by a client ID)."

10.2:
"...the stateid for a delegation is associated with a client ID and may be
used on behalf of all the open-owners for the given client.  A
delegation is made to the client as a whole and not to any specific
process or thread of control within it."

Reported-by: Eric Meddaugh <etmsys@rit.edu>
Cc: Trond Myklebust <trond.myklebust@primarydata.com>
Cc: Olga Kornievskaia <aglo@umich.edu>
Signed-off-by: Andrew Elble <aweits@rit.edu>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:08 -08:00
Jeff Layton
9a4a727861 nfsd: serialize state seqid morphing operations
commit 35a92fe877 upstream.

Andrew was seeing a race occur when an OPEN and OPEN_DOWNGRADE were
running in parallel. The server would receive the OPEN_DOWNGRADE first
and check its seqid, but then an OPEN would race in and bump it. The
OPEN_DOWNGRADE would then complete and bump the seqid again.  The result
was that the OPEN_DOWNGRADE would be applied after the OPEN, even though
it should have been rejected since the seqid changed.

The only recourse we have here I think is to serialize operations that
bump the seqid in a stateid, particularly when we're given a seqid in
the call. To address this, we add a new rw_semaphore to the
nfs4_ol_stateid struct. We do a down_write prior to checking the seqid
after looking up the stateid to ensure that nothing else is going to
bump it while we're operating on it.

In the case of OPEN, we do a down_read, as the call doesn't contain a
seqid. Those can run in parallel -- we just need to serialize them when
there is a concurrent OPEN_DOWNGRADE or CLOSE.

LOCK and LOCKU however always take the write lock as there is no
opportunity for parallelizing those.

Reported-and-Tested-by: Andrew W Elble <aweits@rit.edu>
Signed-off-by: Jeff Layton <jeff.layton@primarydata.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:07 -08:00
Stefan Richter
eee26fbfd7 firewire: ohci: fix JMicron JMB38x IT context discovery
commit 100ceb66d5 upstream.

Reported by Clifford and Craig for JMicron OHCI-1394 + SDHCI combo
controllers:  Often or even most of the time, the controller is
initialized with the message "added OHCI v1.10 device as card 0, 4 IR +
0 IT contexts, quirks 0x10".  With 0 isochronous transmit DMA contexts
(IT contexts), applications like audio output are impossible.

However, OHCI-1394 demands that at least 4 IT contexts are implemented
by the link layer controller, and indeed JMicron JMB38x do implement
four of them.  Only their IsoXmitIntMask register is unreliable at early
access.

With my own JMB381 single function controller I found:
  - I can reproduce the problem with a lower probability than Craig's.
  - If I put a loop around the section which clears and reads
    IsoXmitIntMask, then either the first or the second attempt will
    return the correct initial mask of 0x0000000f.  I never encountered
    a case of needing more than a second attempt.
  - Consequently, if I put a dummy reg_read(...IsoXmitIntMaskSet)
    before the first write, the subsequent read will return the correct
    result.
  - If I merely ignore a wrong read result and force the known real
    result, later isochronous transmit DMA usage works just fine.

So let's just fix this chip bug up by the latter method.  Tested with
JMB381 on kernel 3.13 and 4.3.

Since OHCI-1394 generally requires 4 IT contexts at a minium, this
workaround is simply applied whenever the initial read of IsoXmitIntMask
returns 0, regardless whether it's a JMicron chip or not.  I never heard
of this issue together with any other chip though.

I am not 100% sure that this fix works on the OHCI-1394 part of JMB380
and JMB388 combo controllers exactly the same as on the JMB381 single-
function controller, but so far I haven't had a chance to let an owner
of a combo chip run a patched kernel.

Strangely enough, IsoRecvIntMask is always reported correctly, even
though it is probed right before IsoXmitIntMask.

Reported-by: Clifford Dunn
Reported-by: Craig Moore <craig.moore@qenos.com>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:07 -08:00
Daeho Jeong
5cbe4871e7 ext4, jbd2: ensure entering into panic after recording an error in superblock
commit 4327ba52af upstream.

If a EXT4 filesystem utilizes JBD2 journaling and an error occurs, the
journaling will be aborted first and the error number will be recorded
into JBD2 superblock and, finally, the system will enter into the
panic state in "errors=panic" option.  But, in the rare case, this
sequence is little twisted like the below figure and it will happen
that the system enters into panic state, which means the system reset
in mobile environment, before completion of recording an error in the
journal superblock. In this case, e2fsck cannot recognize that the
filesystem failure occurred in the previous run and the corruption
wouldn't be fixed.

Task A                        Task B
ext4_handle_error()
-> jbd2_journal_abort()
  -> __journal_abort_soft()
    -> __jbd2_journal_abort_hard()
    | -> journal->j_flags |= JBD2_ABORT;
    |
    |                         __ext4_abort()
    |                         -> jbd2_journal_abort()
    |                         | -> __journal_abort_soft()
    |                         |   -> if (journal->j_flags & JBD2_ABORT)
    |                         |           return;
    |                         -> panic()
    |
    -> jbd2_journal_update_sb_errno()

Tested-by: Hobin Woo <hobin.woo@samsung.com>
Signed-off-by: Daeho Jeong <daeho.jeong@samsung.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:07 -08:00
Lukas Czerner
5a4ead78e6 ext4: fix potential use after free in __ext4_journal_stop
commit 6934da9238 upstream.

There is a use-after-free possibility in __ext4_journal_stop() in the
case that we free the handle in the first jbd2_journal_stop() because
we're referencing handle->h_err afterwards. This was introduced in
9705acd63b and it is wrong. Fix it by
storing the handle->h_err value beforehand and avoid referencing
potentially freed handle.

Fixes: 9705acd63b
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Reviewed-by: Andreas Dilger <adilger@dilger.ca>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:07 -08:00
Theodore Ts'o
bcdde051c4 ext4 crypto: fix bugs in ext4_encrypted_zeroout()
commit 36086d43f6 upstream.

Fix multiple bugs in ext4_encrypted_zeroout(), including one that
could cause us to write an encrypted zero page to the wrong location
on disk, potentially causing data and file system corruption.
Fortunately, this tends to only show up in stress tests, but even with
these fixes, we are seeing some test failures with generic/127 --- but
these are now caused by data failures instead of metadata corruption.

Since ext4_encrypted_zeroout() is only used for some optimizations to
keep the extent tree from being too fragmented, and
ext4_encrypted_zeroout() itself isn't all that optimized from a time
or IOPS perspective, disable the extent tree optimization for
encrypted inodes for now.  This prevents the data corruption issues
reported by generic/127 until we can figure out what's going wrong.

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:07 -08:00
Theodore Ts'o
99d17a1f12 ext4 crypto: fix memory leak in ext4_bio_write_page()
commit 937d7b84dc upstream.

There are times when ext4_bio_write_page() is called even though we
don't actually need to do any I/O.  This happens when ext4_writepage()
gets called by the jbd2 commit path when an inode needs to force its
pages written out in order to provide data=ordered guarantees --- and
a page is backed by an unwritten (e.g., uninitialized) block on disk,
or if delayed allocation means the page's backing store hasn't been
allocated yet.  In that case, we need to skip the call to
ext4_encrypt_page(), since in addition to wasting CPU, it leads to a
bounce page and an ext4 crypto context getting leaked.

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:07 -08:00
Ilya Dryomov
4d8dce2c10 rbd: don't put snap_context twice in rbd_queue_workfn()
commit 70b16db86f upstream.

Commit 4e752f0ab0 ("rbd: access snapshot context and mapping size
safely") moved ceph_get_snap_context() out of rbd_img_request_create()
and into rbd_queue_workfn(), adding a ceph_put_snap_context() to the
error path in rbd_queue_workfn().  However, rbd_img_request_create()
consumes a ref on snapc, so calling ceph_put_snap_context() after
a successful rbd_img_request_create() leads to an extra put.  Fix it.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Josh Durgin <jdurgin@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:06 -08:00
David Sterba
f0009492b5 btrfs: fix signed overflows in btrfs_sync_file
commit 9dcbeed4d7 upstream.

The calculation of range length in btrfs_sync_file leads to signed
overflow. This was caught by PaX gcc SIZE_OVERFLOW plugin.

https://forums.grsecurity.net/viewtopic.php?f=1&t=4284

The fsync call passes 0 and LLONG_MAX, the range length does not fit to
loff_t and overflows, but the value is converted to u64 so it silently
works as expected.

The minimal fix is a typecast to u64, switching functions to take
(start, end) instead of (start, len) would be more intrusive.

Coccinelle script found that there's one more opencoded calculation of
the length.

<smpl>
@@
loff_t start, end;
@@
* end - start
</smpl>

Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:06 -08:00
Filipe Manana
82c82fadbd Btrfs: fix race when listing an inode's xattrs
commit f1cd1f0b7d upstream.

When listing a inode's xattrs we have a time window where we race against
a concurrent operation for adding a new hard link for our inode that makes
us not return any xattr to user space. In order for this to happen, the
first xattr of our inode needs to be at slot 0 of a leaf and the previous
leaf must still have room for an inode ref (or extref) item, and this can
happen because an inode's listxattrs callback does not lock the inode's
i_mutex (nor does the VFS does it for us), but adding a hard link to an
inode makes the VFS lock the inode's i_mutex before calling the inode's
link callback.

If we have the following leafs:

               Leaf X (has N items)                    Leaf Y

 [ ... (257 INODE_ITEM 0) (257 INODE_REF 256) ]  [ (257 XATTR_ITEM 12345), ... ]
           slot N - 2         slot N - 1              slot 0

The race illustrated by the following sequence diagram is possible:

       CPU 1                                               CPU 2

  btrfs_listxattr()

    searches for key (257 XATTR_ITEM 0)

    gets path with path->nodes[0] == leaf X
    and path->slots[0] == N

    because path->slots[0] is >=
    btrfs_header_nritems(leaf X), it calls
    btrfs_next_leaf()

    btrfs_next_leaf()
      releases the path

                                                   adds key (257 INODE_REF 666)
                                                   to the end of leaf X (slot N),
                                                   and leaf X now has N + 1 items

      searches for the key (257 INODE_REF 256),
      with path->keep_locks == 1, because that
      is the last key it saw in leaf X before
      releasing the path

      ends up at leaf X again and it verifies
      that the key (257 INODE_REF 256) is no
      longer the last key in leaf X, so it
      returns with path->nodes[0] == leaf X
      and path->slots[0] == N, pointing to
      the new item with key (257 INODE_REF 666)

    btrfs_listxattr's loop iteration sees that
    the type of the key pointed by the path is
    different from the type BTRFS_XATTR_ITEM_KEY
    and so it breaks the loop and stops looking
    for more xattr items
      --> the application doesn't get any xattr
          listed for our inode

So fix this by breaking the loop only if the key's type is greater than
BTRFS_XATTR_ITEM_KEY and skip the current key if its type is smaller.

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:06 -08:00
Filipe Manana
42c6cb15b9 Btrfs: fix race leading to BUG_ON when running delalloc for nodatacow
commit 1d512cb77b upstream.

If we are using the NO_HOLES feature, we have a tiny time window when
running delalloc for a nodatacow inode where we can race with a concurrent
link or xattr add operation leading to a BUG_ON.

This happens because at run_delalloc_nocow() we end up casting a leaf item
of type BTRFS_INODE_[REF|EXTREF]_KEY or of type BTRFS_XATTR_ITEM_KEY to a
file extent item (struct btrfs_file_extent_item) and then analyse its
extent type field, which won't match any of the expected extent types
(values BTRFS_FILE_EXTENT_[REG|PREALLOC|INLINE]) and therefore trigger an
explicit BUG_ON(1).

The following sequence diagram shows how the race happens when running a
no-cow dellaloc range [4K, 8K[ for inode 257 and we have the following
neighbour leafs:

             Leaf X (has N items)                    Leaf Y

 [ ... (257 INODE_ITEM 0) (257 INODE_REF 256) ]  [ (257 EXTENT_DATA 8192), ... ]
              slot N - 2         slot N - 1              slot 0

 (Note the implicit hole for inode 257 regarding the [0, 8K[ range)

       CPU 1                                         CPU 2

 run_dealloc_nocow()
   btrfs_lookup_file_extent()
     --> searches for a key with value
         (257 EXTENT_DATA 4096) in the
         fs/subvol tree
     --> returns us a path with
         path->nodes[0] == leaf X and
         path->slots[0] == N

   because path->slots[0] is >=
   btrfs_header_nritems(leaf X), it
   calls btrfs_next_leaf()

   btrfs_next_leaf()
     --> releases the path

                                              hard link added to our inode,
                                              with key (257 INODE_REF 500)
                                              added to the end of leaf X,
                                              so leaf X now has N + 1 keys

     --> searches for the key
         (257 INODE_REF 256), because
         it was the last key in leaf X
         before it released the path,
         with path->keep_locks set to 1

     --> ends up at leaf X again and
         it verifies that the key
         (257 INODE_REF 256) is no longer
         the last key in the leaf, so it
         returns with path->nodes[0] ==
         leaf X and path->slots[0] == N,
         pointing to the new item with
         key (257 INODE_REF 500)

   the loop iteration of run_dealloc_nocow()
   does not break out the loop and continues
   because the key referenced in the path
   at path->nodes[0] and path->slots[0] is
   for inode 257, its type is < BTRFS_EXTENT_DATA_KEY
   and its offset (500) is less then our delalloc
   range's end (8192)

   the item pointed by the path, an inode reference item,
   is (incorrectly) interpreted as a file extent item and
   we get an invalid extent type, leading to the BUG_ON(1):

   if (extent_type == BTRFS_FILE_EXTENT_REG ||
      extent_type == BTRFS_FILE_EXTENT_PREALLOC) {
       (...)
   } else if (extent_type == BTRFS_FILE_EXTENT_INLINE) {
       (...)
   } else {
       BUG_ON(1)
   }

The same can happen if a xattr is added concurrently and ends up having
a key with an offset smaller then the delalloc's range end.

So fix this by skipping keys with a type smaller than
BTRFS_EXTENT_DATA_KEY.

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:06 -08:00
Filipe Manana
280bd68e66 Btrfs: fix race leading to incorrect item deletion when dropping extents
commit aeafbf8486 upstream.

While running a stress test I got the following warning triggered:

  [191627.672810] ------------[ cut here ]------------
  [191627.673949] WARNING: CPU: 8 PID: 8447 at fs/btrfs/file.c:779 __btrfs_drop_extents+0x391/0xa50 [btrfs]()
  (...)
  [191627.701485] Call Trace:
  [191627.702037]  [<ffffffff8145f077>] dump_stack+0x4f/0x7b
  [191627.702992]  [<ffffffff81095de5>] ? console_unlock+0x356/0x3a2
  [191627.704091]  [<ffffffff8104b3b0>] warn_slowpath_common+0xa1/0xbb
  [191627.705380]  [<ffffffffa0664499>] ? __btrfs_drop_extents+0x391/0xa50 [btrfs]
  [191627.706637]  [<ffffffff8104b46d>] warn_slowpath_null+0x1a/0x1c
  [191627.707789]  [<ffffffffa0664499>] __btrfs_drop_extents+0x391/0xa50 [btrfs]
  [191627.709155]  [<ffffffff8115663c>] ? cache_alloc_debugcheck_after.isra.32+0x171/0x1d0
  [191627.712444]  [<ffffffff81155007>] ? kmemleak_alloc_recursive.constprop.40+0x16/0x18
  [191627.714162]  [<ffffffffa06570c9>] insert_reserved_file_extent.constprop.40+0x83/0x24e [btrfs]
  [191627.715887]  [<ffffffffa065422b>] ? start_transaction+0x3bb/0x610 [btrfs]
  [191627.717287]  [<ffffffffa065b604>] btrfs_finish_ordered_io+0x273/0x4e2 [btrfs]
  [191627.728865]  [<ffffffffa065b888>] finish_ordered_fn+0x15/0x17 [btrfs]
  [191627.730045]  [<ffffffffa067d688>] normal_work_helper+0x14c/0x32c [btrfs]
  [191627.731256]  [<ffffffffa067d96a>] btrfs_endio_write_helper+0x12/0x14 [btrfs]
  [191627.732661]  [<ffffffff81061119>] process_one_work+0x24c/0x4ae
  [191627.733822]  [<ffffffff810615b0>] worker_thread+0x206/0x2c2
  [191627.734857]  [<ffffffff810613aa>] ? process_scheduled_works+0x2f/0x2f
  [191627.736052]  [<ffffffff810613aa>] ? process_scheduled_works+0x2f/0x2f
  [191627.737349]  [<ffffffff810669a6>] kthread+0xef/0xf7
  [191627.738267]  [<ffffffff810f3b3a>] ? time_hardirqs_on+0x15/0x28
  [191627.739330]  [<ffffffff810668b7>] ? __kthread_parkme+0xad/0xad
  [191627.741976]  [<ffffffff81465592>] ret_from_fork+0x42/0x70
  [191627.743080]  [<ffffffff810668b7>] ? __kthread_parkme+0xad/0xad
  [191627.744206] ---[ end trace bbfddacb7aaada8d ]---

  $ cat -n fs/btrfs/file.c
  691  int __btrfs_drop_extents(struct btrfs_trans_handle *trans,
  (...)
  758                  btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
  759                  if (key.objectid > ino ||
  760                      key.type > BTRFS_EXTENT_DATA_KEY || key.offset >= end)
  761                          break;
  762
  763                  fi = btrfs_item_ptr(leaf, path->slots[0],
  764                                      struct btrfs_file_extent_item);
  765                  extent_type = btrfs_file_extent_type(leaf, fi);
  766
  767                  if (extent_type == BTRFS_FILE_EXTENT_REG ||
  768                      extent_type == BTRFS_FILE_EXTENT_PREALLOC) {
  (...)
  774                  } else if (extent_type == BTRFS_FILE_EXTENT_INLINE) {
  (...)
  778                  } else {
  779                          WARN_ON(1);
  780                          extent_end = search_start;
  781                  }
  (...)

This happened because the item we were processing did not match a file
extent item (its key type != BTRFS_EXTENT_DATA_KEY), and even on this
case we cast the item to a struct btrfs_file_extent_item pointer and
then find a type field value that does not match any of the expected
values (BTRFS_FILE_EXTENT_[REG|PREALLOC|INLINE]). This scenario happens
due to a tiny time window where a race can happen as exemplified below.
For example, consider the following scenario where we're using the
NO_HOLES feature and we have the following two neighbour leafs:

               Leaf X (has N items)                    Leaf Y

[ ... (257 INODE_ITEM 0) (257 INODE_REF 256) ]  [ (257 EXTENT_DATA 8192), ... ]
          slot N - 2         slot N - 1              slot 0

Our inode 257 has an implicit hole in the range [0, 8K[ (implicit rather
than explicit because NO_HOLES is enabled). Now if our inode has an
ordered extent for the range [4K, 8K[ that is finishing, the following
can happen:

          CPU 1                                       CPU 2

  btrfs_finish_ordered_io()
    insert_reserved_file_extent()
      __btrfs_drop_extents()
         Searches for the key
          (257 EXTENT_DATA 4096) through
          btrfs_lookup_file_extent()

         Key not found and we get a path where
         path->nodes[0] == leaf X and
         path->slots[0] == N

         Because path->slots[0] is >=
         btrfs_header_nritems(leaf X), we call
         btrfs_next_leaf()

         btrfs_next_leaf() releases the path

                                                  inserts key
                                                  (257 INODE_REF 4096)
                                                  at the end of leaf X,
                                                  leaf X now has N + 1 keys,
                                                  and the new key is at
                                                  slot N

         btrfs_next_leaf() searches for
         key (257 INODE_REF 256), with
         path->keep_locks set to 1,
         because it was the last key it
         saw in leaf X

           finds it in leaf X again and
           notices it's no longer the last
           key of the leaf, so it returns 0
           with path->nodes[0] == leaf X and
           path->slots[0] == N (which is now
           < btrfs_header_nritems(leaf X)),
           pointing to the new key
           (257 INODE_REF 4096)

         __btrfs_drop_extents() casts the
         item at path->nodes[0], slot
         path->slots[0], to a struct
         btrfs_file_extent_item - it does
         not skip keys for the target
         inode with a type less than
         BTRFS_EXTENT_DATA_KEY
         (BTRFS_INODE_REF_KEY < BTRFS_EXTENT_DATA_KEY)

         sees a bogus value for the type
         field triggering the WARN_ON in
         the trace shown above, and sets
         extent_end = search_start (4096)

         does the if-then-else logic to
         fixup 0 length extent items created
         by a past bug from hole punching:

           if (extent_end == key.offset &&
               extent_end >= search_start)
               goto delete_extent_item;

         that evaluates to true and it ends
         up deleting the key pointed to by
         path->slots[0], (257 INODE_REF 4096),
         from leaf X

The same could happen for example for a xattr that ends up having a key
with an offset value that matches search_start (very unlikely but not
impossible).

So fix this by ensuring that keys smaller than BTRFS_EXTENT_DATA_KEY are
skipped, never casted to struct btrfs_file_extent_item and never deleted
by accident. Also protect against the unexpected case of getting a key
for a lower inode number by skipping that key and issuing a warning.

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:06 -08:00
Filipe Manana
fcb184a168 Btrfs: fix regression when running delayed references
commit 2c3cf7d5f6 upstream.

In the kernel 4.2 merge window we had a refactoring/rework of the delayed
references implementation in order to fix certain problems with qgroups.
However that rework introduced one more regression that leads to the
following trace when running delayed references for metadata:

[35908.064664] kernel BUG at fs/btrfs/extent-tree.c:1832!
[35908.065201] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
[35908.065201] Modules linked in: dm_flakey dm_mod btrfs crc32c_generic xor raid6_pq nfsd auth_rpcgss oid_registry nfs_acl nfs lockd grace fscache sunrpc loop fuse parport_pc psmouse i2
[35908.065201] CPU: 14 PID: 15014 Comm: kworker/u32:9 Tainted: G        W       4.3.0-rc5-btrfs-next-17+ #1
[35908.065201] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.1-0-g4adadbd-20150316_085822-nilsson.home.kraxel.org 04/01/2014
[35908.065201] Workqueue: btrfs-extent-refs btrfs_extent_refs_helper [btrfs]
[35908.065201] task: ffff880114b7d780 ti: ffff88010c4c8000 task.ti: ffff88010c4c8000
[35908.065201] RIP: 0010:[<ffffffffa04928b5>]  [<ffffffffa04928b5>] insert_inline_extent_backref+0x52/0xb1 [btrfs]
[35908.065201] RSP: 0018:ffff88010c4cbb08  EFLAGS: 00010293
[35908.065201] RAX: 0000000000000000 RBX: ffff88008a661000 RCX: 0000000000000000
[35908.065201] RDX: ffffffffa04dd58f RSI: 0000000000000001 RDI: 0000000000000000
[35908.065201] RBP: ffff88010c4cbb40 R08: 0000000000001000 R09: ffff88010c4cb9f8
[35908.065201] R10: 0000000000000000 R11: 000000000000002c R12: 0000000000000000
[35908.065201] R13: ffff88020a74c578 R14: 0000000000000000 R15: 0000000000000000
[35908.065201] FS:  0000000000000000(0000) GS:ffff88023edc0000(0000) knlGS:0000000000000000
[35908.065201] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[35908.065201] CR2: 00000000015e8708 CR3: 0000000102185000 CR4: 00000000000006e0
[35908.065201] Stack:
[35908.065201]  ffff88010c4cbb18 0000000000000f37 ffff88020a74c578 ffff88015a408000
[35908.065201]  ffff880154a44000 0000000000000000 0000000000000005 ffff88010c4cbbd8
[35908.065201]  ffffffffa0492b9a 0000000000000005 0000000000000000 0000000000000000
[35908.065201] Call Trace:
[35908.065201]  [<ffffffffa0492b9a>] __btrfs_inc_extent_ref+0x8b/0x208 [btrfs]
[35908.065201]  [<ffffffffa0497117>] ? __btrfs_run_delayed_refs+0x4d4/0xd33 [btrfs]
[35908.065201]  [<ffffffffa049773d>] __btrfs_run_delayed_refs+0xafa/0xd33 [btrfs]
[35908.065201]  [<ffffffffa04a976a>] ? join_transaction.isra.10+0x25/0x41f [btrfs]
[35908.065201]  [<ffffffffa04a97ed>] ? join_transaction.isra.10+0xa8/0x41f [btrfs]
[35908.065201]  [<ffffffffa049914d>] btrfs_run_delayed_refs+0x75/0x1dd [btrfs]
[35908.065201]  [<ffffffffa04992f1>] delayed_ref_async_start+0x3c/0x7b [btrfs]
[35908.065201]  [<ffffffffa04d4b4f>] normal_work_helper+0x14c/0x32a [btrfs]
[35908.065201]  [<ffffffffa04d4e93>] btrfs_extent_refs_helper+0x12/0x14 [btrfs]
[35908.065201]  [<ffffffff81063b23>] process_one_work+0x24a/0x4ac
[35908.065201]  [<ffffffff81064285>] worker_thread+0x206/0x2c2
[35908.065201]  [<ffffffff8106407f>] ? rescuer_thread+0x2cb/0x2cb
[35908.065201]  [<ffffffff8106407f>] ? rescuer_thread+0x2cb/0x2cb
[35908.065201]  [<ffffffff8106904d>] kthread+0xef/0xf7
[35908.065201]  [<ffffffff81068f5e>] ? kthread_parkme+0x24/0x24
[35908.065201]  [<ffffffff8147d10f>] ret_from_fork+0x3f/0x70
[35908.065201]  [<ffffffff81068f5e>] ? kthread_parkme+0x24/0x24
[35908.065201] Code: 6a 01 41 56 41 54 ff 75 10 41 51 4d 89 c1 49 89 c8 48 8d 4d d0 e8 f6 f1 ff ff 48 83 c4 28 85 c0 75 2c 49 81 fc ff 00 00 00 77 02 <0f> 0b 4c 8b 45 30 8b 4d 28 45 31
[35908.065201] RIP  [<ffffffffa04928b5>] insert_inline_extent_backref+0x52/0xb1 [btrfs]
[35908.065201]  RSP <ffff88010c4cbb08>
[35908.310885] ---[ end trace fe4299baf0666457 ]---

This happens because the new delayed references code no longer merges
delayed references that have different sequence values. The following
steps are an example sequence leading to this issue:

1) Transaction N starts, fs_info->tree_mod_seq has value 0;

2) Extent buffer (btree node) A is allocated, delayed reference Ref1 for
   bytenr A is created, with a value of 1 and a seq value of 0;

3) fs_info->tree_mod_seq is incremented to 1;

4) Extent buffer A is deleted through btrfs_del_items(), which calls
   btrfs_del_leaf(), which in turn calls btrfs_free_tree_block(). The
   later returns the metadata extent associated to extent buffer A to
   the free space cache (the range is not pinned), because the extent
   buffer was created in the current transaction (N) and writeback never
   happened for the extent buffer (flag BTRFS_HEADER_FLAG_WRITTEN not set
   in the extent buffer).
   This creates the delayed reference Ref2 for bytenr A, with a value
   of -1 and a seq value of 1;

5) Delayed reference Ref2 is not merged with Ref1 when we create it,
   because they have different sequence numbers (decided at
   add_delayed_ref_tail_merge());

6) fs_info->tree_mod_seq is incremented to 2;

7) Some task attempts to allocate a new extent buffer (done at
   extent-tree.c:find_free_extent()), but due to heavy fragmentation
   and running low on metadata space the clustered allocation fails
   and we fall back to unclustered allocation, which finds the
   extent at offset A, so a new extent buffer at offset A is allocated.
   This creates delayed reference Ref3 for bytenr A, with a value of 1
   and a seq value of 2;

8) Ref3 is not merged neither with Ref2 nor Ref1, again because they
   all have different seq values;

9) We start running the delayed references (__btrfs_run_delayed_refs());

10) The delayed Ref1 is the first one being applied, which ends up
    creating an inline extent backref in the extent tree;

10) Next the delayed reference Ref3 is selected for execution, and not
    Ref2, because select_delayed_ref() always gives a preference for
    positive references (that have an action of BTRFS_ADD_DELAYED_REF);

11) When running Ref3 we encounter alreay the inline extent backref
    in the extent tree at insert_inline_extent_backref(), which makes
    us hit the following BUG_ON:

        BUG_ON(owner < BTRFS_FIRST_FREE_OBJECTID);

    This is always true because owner corresponds to the level of the
    extent buffer/btree node in the btree.

For the scenario described above we hit the BUG_ON because we never merge
references that have different seq values.

We used to do the merging before the 4.2 kernel, more specifically, before
the commmits:

  c6fc245499 ("btrfs: delayed-ref: Use list to replace the ref_root in ref_head.")
  c43d160fcd ("btrfs: delayed-ref: Cleanup the unneeded functions.")

This issue became more exposed after the following change that was added
to 4.2 as well:

  cffc3374e5 ("Btrfs: fix order by which delayed references are run")

Which in turn fixed another regression by the two commits previously
mentioned.

So fix this by bringing back the delayed reference merge code, with the
proper adaptations so that it operates against the new data structure
(linked list vs old red black tree implementation).

This issue was hit running fstest btrfs/063 in a loop. Several people have
reported this issue in the mailing list when running on kernels 4.2+.

Very special thanks to Stéphane Lesimple for helping debugging this issue
and testing this fix on his multi terabyte filesystem (which took more
than one day to balance alone, plus fsck, etc).

Fixes: c6fc245499 ("btrfs: delayed-ref: Use list to replace the ref_root in ref_head.")
Reported-by: Peter Becker <floyd.net@gmail.com>
Reported-by: Stéphane Lesimple <stephane_btrfs@lesimple.fr>
Tested-by: Stéphane Lesimple <stephane_btrfs@lesimple.fr>
Reported-by: Malte Schröder <malte@tnxip.de>
Reported-by: Derek Dongray <derek@valedon.co.uk>
Reported-by: Erkki Seppala <flux-btrfs@inside.org>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Liu Bo <bo.li.liu@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:05 -08:00
Filipe Manana
90291b48b1 Btrfs: fix truncation of compressed and inlined extents
commit 0305cd5f7f upstream.

When truncating a file to a smaller size which consists of an inline
extent that is compressed, we did not discard (or made unusable) the
data between the new file size and the old file size, wasting metadata
space and allowing for the truncated data to be leaked and the data
corruption/loss mentioned below.
We were also not correctly decrementing the number of bytes used by the
inode, we were setting it to zero, giving a wrong report for callers of
the stat(2) syscall. The fsck tool also reported an error about a mismatch
between the nbytes of the file versus the real space used by the file.

Now because we weren't discarding the truncated region of the file, it
was possible for a caller of the clone ioctl to actually read the data
that was truncated, allowing for a security breach without requiring root
access to the system, using only standard filesystem operations. The
scenario is the following:

   1) User A creates a file which consists of an inline and compressed
      extent with a size of 2000 bytes - the file is not accessible to
      any other users (no read, write or execution permission for anyone
      else);

   2) The user truncates the file to a size of 1000 bytes;

   3) User A makes the file world readable;

   4) User B creates a file consisting of an inline extent of 2000 bytes;

   5) User B issues a clone operation from user A's file into its own
      file (using a length argument of 0, clone the whole range);

   6) User B now gets to see the 1000 bytes that user A truncated from
      its file before it made its file world readbale. User B also lost
      the bytes in the range [1000, 2000[ bytes from its own file, but
      that might be ok if his/her intention was reading stale data from
      user A that was never supposed to be public.

Note that this contrasts with the case where we truncate a file from 2000
bytes to 1000 bytes and then truncate it back from 1000 to 2000 bytes. In
this case reading any byte from the range [1000, 2000[ will return a value
of 0x00, instead of the original data.

This problem exists since the clone ioctl was added and happens both with
and without my recent data loss and file corruption fixes for the clone
ioctl (patch "Btrfs: fix file corruption and data loss after cloning
inline extents").

So fix this by truncating the compressed inline extents as we do for the
non-compressed case, which involves decompressing, if the data isn't already
in the page cache, compressing the truncated version of the extent, writing
the compressed content into the inline extent and then truncate it.

The following test case for fstests reproduces the problem. In order for
the test to pass both this fix and my previous fix for the clone ioctl
that forbids cloning a smaller inline extent into a larger one,
which is titled "Btrfs: fix file corruption and data loss after cloning
inline extents", are needed. Without that other fix the test fails in a
different way that does not leak the truncated data, instead part of
destination file gets replaced with zeroes (because the destination file
has a larger inline extent than the source).

  seq=`basename $0`
  seqres=$RESULT_DIR/$seq
  echo "QA output created by $seq"
  tmp=/tmp/$$
  status=1	# failure is the default!
  trap "_cleanup; exit \$status" 0 1 2 3 15

  _cleanup()
  {
      rm -f $tmp.*
  }

  # get standard environment, filters and checks
  . ./common/rc
  . ./common/filter

  # real QA test starts here
  _need_to_be_root
  _supported_fs btrfs
  _supported_os Linux
  _require_scratch
  _require_cloner

  rm -f $seqres.full

  _scratch_mkfs >>$seqres.full 2>&1
  _scratch_mount "-o compress"

  # Create our test files. File foo is going to be the source of a clone operation
  # and consists of a single inline extent with an uncompressed size of 512 bytes,
  # while file bar consists of a single inline extent with an uncompressed size of
  # 256 bytes. For our test's purpose, it's important that file bar has an inline
  # extent with a size smaller than foo's inline extent.
  $XFS_IO_PROG -f -c "pwrite -S 0xa1 0 128"   \
          -c "pwrite -S 0x2a 128 384" \
          $SCRATCH_MNT/foo | _filter_xfs_io
  $XFS_IO_PROG -f -c "pwrite -S 0xbb 0 256" $SCRATCH_MNT/bar | _filter_xfs_io

  # Now durably persist all metadata and data. We do this to make sure that we get
  # on disk an inline extent with a size of 512 bytes for file foo.
  sync

  # Now truncate our file foo to a smaller size. Because it consists of a
  # compressed and inline extent, btrfs did not shrink the inline extent to the
  # new size (if the extent was not compressed, btrfs would shrink it to 128
  # bytes), it only updates the inode's i_size to 128 bytes.
  $XFS_IO_PROG -c "truncate 128" $SCRATCH_MNT/foo

  # Now clone foo's inline extent into bar.
  # This clone operation should fail with errno EOPNOTSUPP because the source
  # file consists only of an inline extent and the file's size is smaller than
  # the inline extent of the destination (128 bytes < 256 bytes). However the
  # clone ioctl was not prepared to deal with a file that has a size smaller
  # than the size of its inline extent (something that happens only for compressed
  # inline extents), resulting in copying the full inline extent from the source
  # file into the destination file.
  #
  # Note that btrfs' clone operation for inline extents consists of removing the
  # inline extent from the destination inode and copy the inline extent from the
  # source inode into the destination inode, meaning that if the destination
  # inode's inline extent is larger (N bytes) than the source inode's inline
  # extent (M bytes), some bytes (N - M bytes) will be lost from the destination
  # file. Btrfs could copy the source inline extent's data into the destination's
  # inline extent so that we would not lose any data, but that's currently not
  # done due to the complexity that would be needed to deal with such cases
  # (specially when one or both extents are compressed), returning EOPNOTSUPP, as
  # it's normally not a very common case to clone very small files (only case
  # where we get inline extents) and copying inline extents does not save any
  # space (unlike for normal, non-inlined extents).
  $CLONER_PROG -s 0 -d 0 -l 0 $SCRATCH_MNT/foo $SCRATCH_MNT/bar

  # Now because the above clone operation used to succeed, and due to foo's inline
  # extent not being shinked by the truncate operation, our file bar got the whole
  # inline extent copied from foo, making us lose the last 128 bytes from bar
  # which got replaced by the bytes in range [128, 256[ from foo before foo was
  # truncated - in other words, data loss from bar and being able to read old and
  # stale data from foo that should not be possible to read anymore through normal
  # filesystem operations. Contrast with the case where we truncate a file from a
  # size N to a smaller size M, truncate it back to size N and then read the range
  # [M, N[, we should always get the value 0x00 for all the bytes in that range.

  # We expected the clone operation to fail with errno EOPNOTSUPP and therefore
  # not modify our file's bar data/metadata. So its content should be 256 bytes
  # long with all bytes having the value 0xbb.
  #
  # Without the btrfs bug fix, the clone operation succeeded and resulted in
  # leaking truncated data from foo, the bytes that belonged to its range
  # [128, 256[, and losing data from bar in that same range. So reading the
  # file gave us the following content:
  #
  # 0000000 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1 a1
  # *
  # 0000200 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a
  # *
  # 0000400
  echo "File bar's content after the clone operation:"
  od -t x1 $SCRATCH_MNT/bar

  # Also because the foo's inline extent was not shrunk by the truncate
  # operation, btrfs' fsck, which is run by the fstests framework everytime a
  # test completes, failed reporting the following error:
  #
  #  root 5 inode 257 errors 400, nbytes wrong

  status=0
  exit

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:05 -08:00
Filipe Manana
8b15aa67a2 Btrfs: fix file corruption and data loss after cloning inline extents
commit 8039d87d9e upstream.

Currently the clone ioctl allows to clone an inline extent from one file
to another that already has other (non-inlined) extents. This is a problem
because btrfs is not designed to deal with files having inline and regular
extents, if a file has an inline extent then it must be the only extent
in the file and must start at file offset 0. Having a file with an inline
extent followed by regular extents results in EIO errors when doing reads
or writes against the first 4K of the file.

Also, the clone ioctl allows one to lose data if the source file consists
of a single inline extent, with a size of N bytes, and the destination
file consists of a single inline extent with a size of M bytes, where we
have M > N. In this case the clone operation removes the inline extent
from the destination file and then copies the inline extent from the
source file into the destination file - we lose the M - N bytes from the
destination file, a read operation will get the value 0x00 for any bytes
in the the range [N, M] (the destination inode's i_size remained as M,
that's why we can read past N bytes).

So fix this by not allowing such destructive operations to happen and
return errno EOPNOTSUPP to user space.

Currently the fstest btrfs/035 tests the data loss case but it totally
ignores this - i.e. expects the operation to succeed and does not check
the we got data loss.

The following test case for fstests exercises all these cases that result
in file corruption and data loss:

  seq=`basename $0`
  seqres=$RESULT_DIR/$seq
  echo "QA output created by $seq"
  tmp=/tmp/$$
  status=1	# failure is the default!
  trap "_cleanup; exit \$status" 0 1 2 3 15

  _cleanup()
  {
      rm -f $tmp.*
  }

  # get standard environment, filters and checks
  . ./common/rc
  . ./common/filter

  # real QA test starts here
  _need_to_be_root
  _supported_fs btrfs
  _supported_os Linux
  _require_scratch
  _require_cloner
  _require_btrfs_fs_feature "no_holes"
  _require_btrfs_mkfs_feature "no-holes"

  rm -f $seqres.full

  test_cloning_inline_extents()
  {
      local mkfs_opts=$1
      local mount_opts=$2

      _scratch_mkfs $mkfs_opts >>$seqres.full 2>&1
      _scratch_mount $mount_opts

      # File bar, the source for all the following clone operations, consists
      # of a single inline extent (50 bytes).
      $XFS_IO_PROG -f -c "pwrite -S 0xbb 0 50" $SCRATCH_MNT/bar \
          | _filter_xfs_io

      # Test cloning into a file with an extent (non-inlined) where the
      # destination offset overlaps that extent. It should not be possible to
      # clone the inline extent from file bar into this file.
      $XFS_IO_PROG -f -c "pwrite -S 0xaa 0K 16K" $SCRATCH_MNT/foo \
          | _filter_xfs_io
      $CLONER_PROG -s 0 -d 0 -l 0 $SCRATCH_MNT/bar $SCRATCH_MNT/foo

      # Doing IO against any range in the first 4K of the file should work.
      # Due to a past clone ioctl bug which allowed cloning the inline extent,
      # these operations resulted in EIO errors.
      echo "File foo data after clone operation:"
      # All bytes should have the value 0xaa (clone operation failed and did
      # not modify our file).
      od -t x1 $SCRATCH_MNT/foo
      $XFS_IO_PROG -c "pwrite -S 0xcc 0 100" $SCRATCH_MNT/foo | _filter_xfs_io

      # Test cloning the inline extent against a file which has a hole in its
      # first 4K followed by a non-inlined extent. It should not be possible
      # as well to clone the inline extent from file bar into this file.
      $XFS_IO_PROG -f -c "pwrite -S 0xdd 4K 12K" $SCRATCH_MNT/foo2 \
          | _filter_xfs_io
      $CLONER_PROG -s 0 -d 0 -l 0 $SCRATCH_MNT/bar $SCRATCH_MNT/foo2

      # Doing IO against any range in the first 4K of the file should work.
      # Due to a past clone ioctl bug which allowed cloning the inline extent,
      # these operations resulted in EIO errors.
      echo "File foo2 data after clone operation:"
      # All bytes should have the value 0x00 (clone operation failed and did
      # not modify our file).
      od -t x1 $SCRATCH_MNT/foo2
      $XFS_IO_PROG -c "pwrite -S 0xee 0 90" $SCRATCH_MNT/foo2 | _filter_xfs_io

      # Test cloning the inline extent against a file which has a size of zero
      # but has a prealloc extent. It should not be possible as well to clone
      # the inline extent from file bar into this file.
      $XFS_IO_PROG -f -c "falloc -k 0 1M" $SCRATCH_MNT/foo3 | _filter_xfs_io
      $CLONER_PROG -s 0 -d 0 -l 0 $SCRATCH_MNT/bar $SCRATCH_MNT/foo3

      # Doing IO against any range in the first 4K of the file should work.
      # Due to a past clone ioctl bug which allowed cloning the inline extent,
      # these operations resulted in EIO errors.
      echo "First 50 bytes of foo3 after clone operation:"
      # Should not be able to read any bytes, file has 0 bytes i_size (the
      # clone operation failed and did not modify our file).
      od -t x1 $SCRATCH_MNT/foo3
      $XFS_IO_PROG -c "pwrite -S 0xff 0 90" $SCRATCH_MNT/foo3 | _filter_xfs_io

      # Test cloning the inline extent against a file which consists of a
      # single inline extent that has a size not greater than the size of
      # bar's inline extent (40 < 50).
      # It should be possible to do the extent cloning from bar to this file.
      $XFS_IO_PROG -f -c "pwrite -S 0x01 0 40" $SCRATCH_MNT/foo4 \
          | _filter_xfs_io
      $CLONER_PROG -s 0 -d 0 -l 0 $SCRATCH_MNT/bar $SCRATCH_MNT/foo4

      # Doing IO against any range in the first 4K of the file should work.
      echo "File foo4 data after clone operation:"
      # Must match file bar's content.
      od -t x1 $SCRATCH_MNT/foo4
      $XFS_IO_PROG -c "pwrite -S 0x02 0 90" $SCRATCH_MNT/foo4 | _filter_xfs_io

      # Test cloning the inline extent against a file which consists of a
      # single inline extent that has a size greater than the size of bar's
      # inline extent (60 > 50).
      # It should not be possible to clone the inline extent from file bar
      # into this file.
      $XFS_IO_PROG -f -c "pwrite -S 0x03 0 60" $SCRATCH_MNT/foo5 \
          | _filter_xfs_io
      $CLONER_PROG -s 0 -d 0 -l 0 $SCRATCH_MNT/bar $SCRATCH_MNT/foo5

      # Reading the file should not fail.
      echo "File foo5 data after clone operation:"
      # Must have a size of 60 bytes, with all bytes having a value of 0x03
      # (the clone operation failed and did not modify our file).
      od -t x1 $SCRATCH_MNT/foo5

      # Test cloning the inline extent against a file which has no extents but
      # has a size greater than bar's inline extent (16K > 50).
      # It should not be possible to clone the inline extent from file bar
      # into this file.
      $XFS_IO_PROG -f -c "truncate 16K" $SCRATCH_MNT/foo6 | _filter_xfs_io
      $CLONER_PROG -s 0 -d 0 -l 0 $SCRATCH_MNT/bar $SCRATCH_MNT/foo6

      # Reading the file should not fail.
      echo "File foo6 data after clone operation:"
      # Must have a size of 16K, with all bytes having a value of 0x00 (the
      # clone operation failed and did not modify our file).
      od -t x1 $SCRATCH_MNT/foo6

      # Test cloning the inline extent against a file which has no extents but
      # has a size not greater than bar's inline extent (30 < 50).
      # It should be possible to clone the inline extent from file bar into
      # this file.
      $XFS_IO_PROG -f -c "truncate 30" $SCRATCH_MNT/foo7 | _filter_xfs_io
      $CLONER_PROG -s 0 -d 0 -l 0 $SCRATCH_MNT/bar $SCRATCH_MNT/foo7

      # Reading the file should not fail.
      echo "File foo7 data after clone operation:"
      # Must have a size of 50 bytes, with all bytes having a value of 0xbb.
      od -t x1 $SCRATCH_MNT/foo7

      # Test cloning the inline extent against a file which has a size not
      # greater than the size of bar's inline extent (20 < 50) but has
      # a prealloc extent that goes beyond the file's size. It should not be
      # possible to clone the inline extent from bar into this file.
      $XFS_IO_PROG -f -c "falloc -k 0 1M" \
                      -c "pwrite -S 0x88 0 20" \
                      $SCRATCH_MNT/foo8 | _filter_xfs_io
      $CLONER_PROG -s 0 -d 0 -l 0 $SCRATCH_MNT/bar $SCRATCH_MNT/foo8

      echo "File foo8 data after clone operation:"
      # Must have a size of 20 bytes, with all bytes having a value of 0x88
      # (the clone operation did not modify our file).
      od -t x1 $SCRATCH_MNT/foo8

      _scratch_unmount
  }

  echo -e "\nTesting without compression and without the no-holes feature...\n"
  test_cloning_inline_extents

  echo -e "\nTesting with compression and without the no-holes feature...\n"
  test_cloning_inline_extents "" "-o compress"

  echo -e "\nTesting without compression and with the no-holes feature...\n"
  test_cloning_inline_extents "-O no-holes" ""

  echo -e "\nTesting with compression and with the no-holes feature...\n"
  test_cloning_inline_extents "-O no-holes" "-o compress"

  status=0
  exit

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:05 -08:00
Robin Ruede
b855aa43eb btrfs: fix resending received snapshot with parent
commit b96b1db039 upstream.

This fixes a regression introduced by 37b8d27d between v4.1 and v4.2.

When a snapshot is received, its received_uuid is set to the original
uuid of the subvolume. When that snapshot is then resent to a third
filesystem, it's received_uuid is set to the second uuid
instead of the original one. The same was true for the parent_uuid.
This behaviour was partially changed in 37b8d27d, but in that patch
only the parent_uuid was taken from the real original,
not the uuid itself, causing the search for the parent to fail in
the case below.

This happens for example when trying to send a series of linked
snapshots (e.g. created by snapper) from the backup file system back
to the original one.

The following commands reproduce the issue in v4.2.1
(no error in 4.1.6)

    # setup three test file systems
    for i in 1 2 3; do
	    truncate -s 50M fs$i
	    mkfs.btrfs fs$i
	    mkdir $i
	    mount fs$i $i
    done
    echo "content" > 1/testfile
    btrfs su snapshot -r 1/ 1/snap1
    echo "changed content" > 1/testfile
    btrfs su snapshot -r 1/ 1/snap2

    # works fine:
    btrfs send 1/snap1 | btrfs receive 2/
    btrfs send -p 1/snap1 1/snap2 | btrfs receive 2/

    # ERROR: could not find parent subvolume
    btrfs send 2/snap1 | btrfs receive 3/
    btrfs send -p 2/snap1 2/snap2 | btrfs receive 3/

Signed-off-by: Robin Ruede <rruede+git@gmail.com>
Fixes: 37b8d27de5 ("Btrfs: use received_uuid of parent during send")
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Tested-by: Ed Tomlinson <edt@aei.ca>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:05 -08:00
Eric Dumazet
36204ef3c3 net_sched: fix qdisc_tree_decrease_qlen() races
[ Upstream commit 4eaf3b84f2 ]

qdisc_tree_decrease_qlen() suffers from two problems on multiqueue
devices.

One problem is that it updates sch->q.qlen and sch->qstats.drops
on the mq/mqprio root qdisc, while it should not : Daniele
reported underflows errors :
[  681.774821] PAX: sch->q.qlen: 0 n: 1
[  681.774825] PAX: size overflow detected in function qdisc_tree_decrease_qlen net/sched/sch_api.c:769 cicus.693_49 min, count: 72, decl: qlen; num: 0; context: sk_buff_head;
[  681.774954] CPU: 2 PID: 19 Comm: ksoftirqd/2 Tainted: G           O    4.2.6.201511282239-1-grsec #1
[  681.774955] Hardware name: ASUSTeK COMPUTER INC. X302LJ/X302LJ, BIOS X302LJ.202 03/05/2015
[  681.774956]  ffffffffa9a04863 0000000000000000 0000000000000000 ffffffffa990ff7c
[  681.774959]  ffffc90000d3bc38 ffffffffa95d2810 0000000000000007 ffffffffa991002b
[  681.774960]  ffffc90000d3bc68 ffffffffa91a44f4 0000000000000001 0000000000000001
[  681.774962] Call Trace:
[  681.774967]  [<ffffffffa95d2810>] dump_stack+0x4c/0x7f
[  681.774970]  [<ffffffffa91a44f4>] report_size_overflow+0x34/0x50
[  681.774972]  [<ffffffffa94d17e2>] qdisc_tree_decrease_qlen+0x152/0x160
[  681.774976]  [<ffffffffc02694b1>] fq_codel_dequeue+0x7b1/0x820 [sch_fq_codel]
[  681.774978]  [<ffffffffc02680a0>] ? qdisc_peek_dequeued+0xa0/0xa0 [sch_fq_codel]
[  681.774980]  [<ffffffffa94cd92d>] __qdisc_run+0x4d/0x1d0
[  681.774983]  [<ffffffffa949b2b2>] net_tx_action+0xc2/0x160
[  681.774985]  [<ffffffffa90664c1>] __do_softirq+0xf1/0x200
[  681.774987]  [<ffffffffa90665ee>] run_ksoftirqd+0x1e/0x30
[  681.774989]  [<ffffffffa90896b0>] smpboot_thread_fn+0x150/0x260
[  681.774991]  [<ffffffffa9089560>] ? sort_range+0x40/0x40
[  681.774992]  [<ffffffffa9085fe4>] kthread+0xe4/0x100
[  681.774994]  [<ffffffffa9085f00>] ? kthread_worker_fn+0x170/0x170
[  681.774995]  [<ffffffffa95d8d1e>] ret_from_fork+0x3e/0x70

mq/mqprio have their own ways to report qlen/drops by folding stats on
all their queues, with appropriate locking.

A second problem is that qdisc_tree_decrease_qlen() calls qdisc_lookup()
without proper locking : concurrent qdisc updates could corrupt the list
that qdisc_match_from_root() parses to find a qdisc given its handle.

Fix first problem adding a TCQ_F_NOPARENT qdisc flag that
qdisc_tree_decrease_qlen() can use to abort its tree traversal,
as soon as it meets a mq/mqprio qdisc children.

Second problem can be fixed by RCU protection.
Qdisc are already freed after RCU grace period, so qdisc_list_add() and
qdisc_list_del() simply have to use appropriate rcu list variants.

A future patch will add a per struct netdev_queue list anchor, so that
qdisc_tree_decrease_qlen() can have more efficient lookups.

Reported-by: Daniele Fucini <dfucini@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Cong Wang <cwang@twopensource.com>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:04 -08:00
Paolo Abeni
bae56d7e3f openvswitch: fix hangup on vxlan/gre/geneve device deletion
[ Upstream commit 1317530302 ]

Each openvswitch tunnel vport (vxlan,gre,geneve) holds a reference
to the underlying tunnel device, but never released it when such
device is deleted.
Deleting the underlying device via the ip tool cause the kernel to
hangup in the netdev_wait_allrefs() loop.
This commit ensure that on device unregistration dp_detach_port_notify()
is called for all vports that hold the device reference, properly
releasing it.

Fixes: 614732eaa1 ("openvswitch: Use regular VXLAN net_device device")
Fixes: b2acd1dc39 ("openvswitch: Use regular GRE net_device instead of vport")
Fixes: 6b001e682e ("openvswitch: Use Geneve device.")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Flavio Leitner <fbl@sysclose.org>
Acked-by: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:04 -08:00
Eric Dumazet
7a439c4a67 ipv6: sctp: implement sctp_v6_destroy_sock()
[ Upstream commit 602dd62dfb ]

Dmitry Vyukov reported a memory leak using IPV6 SCTP sockets.

We need to call inet6_destroy_sock() to properly release
inet6 specific fields.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:04 -08:00
Konstantin Khlebnikov
a9c680b654 net/neighbour: fix crash at dumping device-agnostic proxy entries
[ Upstream commit 6adc5fd6a1 ]

Proxy entries could have null pointer to net-device.

Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com>
Fixes: 84920c1420 ("net: Allow ipv6 proxies and arp proxies be shown with iproute2")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:04 -08:00
Eric Dumazet
645e3f33c7 ipv6: add complete rcu protection around np->opt
[ Upstream commit 45f6fad84c ]

This patch addresses multiple problems :

UDP/RAW sendmsg() need to get a stable struct ipv6_txoptions
while socket is not locked : Other threads can change np->opt
concurrently. Dmitry posted a syzkaller
(http://github.com/google/syzkaller) program desmonstrating
use-after-free.

Starting with TCP/DCCP lockless listeners, tcp_v6_syn_recv_sock()
and dccp_v6_request_recv_sock() also need to use RCU protection
to dereference np->opt once (before calling ipv6_dup_options())

This patch adds full RCU protection to np->opt

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:04 -08:00
Daniel Borkmann
90d19ad685 bpf, array: fix heap out-of-bounds access when updating elements
[ Upstream commit fbca9d2d35 ]

During own review but also reported by Dmitry's syzkaller [1] it has been
noticed that we trigger a heap out-of-bounds access on eBPF array maps
when updating elements. This happens with each map whose map->value_size
(specified during map creation time) is not multiple of 8 bytes.

In array_map_alloc(), elem_size is round_up(attr->value_size, 8) and
used to align array map slots for faster access. However, in function
array_map_update_elem(), we update the element as ...

memcpy(array->value + array->elem_size * index, value, array->elem_size);

... where we access 'value' out-of-bounds, since it was allocated from
map_update_elem() from syscall side as kmalloc(map->value_size, GFP_USER)
and later on copied through copy_from_user(value, uvalue, map->value_size).
Thus, up to 7 bytes, we can access out-of-bounds.

Same could happen from within an eBPF program, where in worst case we
access beyond an eBPF program's designated stack.

Since 1be7f75d16 ("bpf: enable non-root eBPF programs") didn't hit an
official release yet, it only affects priviledged users.

In case of array_map_lookup_elem(), the verifier prevents eBPF programs
from accessing beyond map->value_size through check_map_access(). Also
from syscall side map_lookup_elem() only copies map->value_size back to
user, so nothing could leak.

  [1] http://github.com/google/syzkaller

Fixes: 28fbcfa08d ("bpf: add array type of eBPF maps")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:03 -08:00
Quentin Casasnovas
0eaa7b64f7 RDS: fix race condition when sending a message on unbound socket
[ Upstream commit 8c7188b234 ]

Sasha's found a NULL pointer dereference in the RDS connection code when
sending a message to an apparently unbound socket.  The problem is caused
by the code checking if the socket is bound in rds_sendmsg(), which checks
the rs_bound_addr field without taking a lock on the socket.  This opens a
race where rs_bound_addr is temporarily set but where the transport is not
in rds_bind(), leading to a NULL pointer dereference when trying to
dereference 'trans' in __rds_conn_create().

Vegard wrote a reproducer for this issue, so kindly ask him to share if
you're interested.

I cannot reproduce the NULL pointer dereference using Vegard's reproducer
with this patch, whereas I could without.

Complete earlier incomplete fix to CVE-2015-6937:

  74e98eb085 ("RDS: verify the underlying transport exists before creating a connection")

Cc: David S. Miller <davem@davemloft.net>
Cc: stable@vger.kernel.org

Reviewed-by: Vegard Nossum <vegard.nossum@oracle.com>
Reviewed-by: Sasha Levin <sasha.levin@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:03 -08:00
Michal Kubeček
edd6db9dee ipv6: distinguish frag queues by device for multicast and link-local packets
[ Upstream commit 264640fc2c ]

If a fragmented multicast packet is received on an ethernet device which
has an active macvlan on top of it, each fragment is duplicated and
received both on the underlying device and the macvlan. If some
fragments for macvlan are processed before the whole packet for the
underlying device is reassembled, the "overlapping fragments" test in
ip6_frag_queue() discards the whole fragment queue.

To resolve this, add device ifindex to the search key and require it to
match reassembling multicast packets and packets to link-local
addresses.

Note: similar patch has been already submitted by Yoshifuji Hideaki in

  http://patchwork.ozlabs.org/patch/220979/

but got lost and forgotten for some reason.

Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:03 -08:00
Ying Xue
126bb49963 tipc: fix error handling of expanding buffer headroom
[ Upstream commit 7098356bac ]

Coverity says:
*** CID 1338065:  Error handling issues  (CHECKED_RETURN)
/net/tipc/udp_media.c: 162 in tipc_udp_send_msg()
156             struct udp_media_addr *dst = (struct udp_media_addr *)&dest->value;
157             struct udp_media_addr *src = (struct udp_media_addr *)&b->addr.value;
158             struct sk_buff *clone;
159             struct rtable *rt;
160
161             if (skb_headroom(skb) < UDP_MIN_HEADROOM)
>>>     CID 1338065:  Error handling issues  (CHECKED_RETURN)
>>>     Calling "pskb_expand_head" without checking return value (as is done elsewhere 51 out of 56
+times).
162                     pskb_expand_head(skb, UDP_MIN_HEADROOM, 0, GFP_ATOMIC);
163
164             clone = skb_clone(skb, GFP_ATOMIC);
165             skb_set_inner_protocol(clone, htons(ETH_P_TIPC));
166             ub = rcu_dereference_rtnl(b->media_ptr);
167             if (!ub) {

When expanding buffer headroom over udp tunnel with pskb_expand_head(),
it's unfortunate that we don't check its return value. As a result, if
the function returns an error code due to the lack of memory, it may
cause unpredictable consequence as we unconditionally consider that
it's always successful.

Fixes: e53567948f ("tipc: conditionally expand buffer headroom over udp tunnel")
Reported-by: <scan-admin@coverity.com>
Cc: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:03 -08:00
Aaro Koskinen
309ef6d135 broadcom: fix PHY_ID_BCM5481 entry in the id table
[ Upstream commit 3c25a860d1 ]

Commit fcb26ec5b1 ("broadcom: move all PHY_ID's to header")
updated broadcom_tbl to use PHY_IDs, but incorrectly replaced 0x0143bca0
with PHY_ID_BCM5482 (making a duplicate entry, and completely omitting
the original). Fix that.

Fixes: fcb26ec5b1 ("broadcom: move all PHY_ID's to header")
Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:03 -08:00
Nikolay Aleksandrov
b3abad339f vrf: fix double free and memory corruption on register_netdevice failure
[ Upstream commit 7f109f7cc3 ]

When vrf's ->newlink is called, if register_netdevice() fails then it
does free_netdev(), but that's also done by rtnl_newlink() so a second
free happens and memory gets corrupted, to reproduce execute the
following line a couple of times (1 - 5 usually is enough):
$ for i in `seq 1 5`; do ip link add vrf: type vrf table 1; done;
This works because we fail in register_netdevice() because of the wrong
name "vrf:".

And here's a trace of one crash:
[   28.792157] ------------[ cut here ]------------
[   28.792407] kernel BUG at fs/namei.c:246!
[   28.792608] invalid opcode: 0000 [#1] SMP
[   28.793240] Modules linked in: vrf nfsd auth_rpcgss oid_registry
nfs_acl nfs lockd grace sunrpc crct10dif_pclmul crc32_pclmul
crc32c_intel qxl drm_kms_helper ttm drm aesni_intel aes_x86_64 psmouse
glue_helper lrw evdev gf128mul i2c_piix4 ablk_helper cryptd ppdev
parport_pc parport serio_raw pcspkr virtio_balloon virtio_console
i2c_core acpi_cpufreq button 9pnet_virtio 9p 9pnet fscache ipv6 autofs4
ext4 crc16 mbcache jbd2 virtio_blk virtio_net sg sr_mod cdrom
ata_generic ehci_pci uhci_hcd ehci_hcd e1000 usbcore usb_common ata_piix
libata virtio_pci virtio_ring virtio scsi_mod floppy
[   28.796016] CPU: 0 PID: 1148 Comm: ld-linux-x86-64 Not tainted
4.4.0-rc1+ #24
[   28.796016] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.8.1-20150318_183358- 04/01/2014
[   28.796016] task: ffff8800352561c0 ti: ffff88003592c000 task.ti:
ffff88003592c000
[   28.796016] RIP: 0010:[<ffffffff812187b3>]  [<ffffffff812187b3>]
putname+0x43/0x60
[   28.796016] RSP: 0018:ffff88003592fe88  EFLAGS: 00010246
[   28.796016] RAX: 0000000000000000 RBX: ffff8800352561c0 RCX:
0000000000000001
[   28.796016] RDX: 0000000000000000 RSI: 0000000000000000 RDI:
ffff88003784f000
[   28.796016] RBP: ffff88003592ff08 R08: 0000000000000001 R09:
0000000000000000
[   28.796016] R10: 0000000000000000 R11: 0000000000000001 R12:
0000000000000000
[   28.796016] R13: 000000000000047c R14: ffff88003784f000 R15:
ffff8800358c4a00
[   28.796016] FS:  0000000000000000(0000) GS:ffff88003fc00000(0000)
knlGS:0000000000000000
[   28.796016] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   28.796016] CR2: 00007ffd583bc2d9 CR3: 0000000035a99000 CR4:
00000000000406f0
[   28.796016] Stack:
[   28.796016]  ffffffff8121045d ffffffff812102d3 ffff8800352561c0
ffff880035a91660
[   28.796016]  ffff8800008a9880 0000000000000000 ffffffff81a49940
00ffffff81218684
[   28.796016]  ffff8800352561c0 000000000000047c 0000000000000000
ffff880035b36d80
[   28.796016] Call Trace:
[   28.796016]  [<ffffffff8121045d>] ?
do_execveat_common.isra.34+0x74d/0x930
[   28.796016]  [<ffffffff812102d3>] ?
do_execveat_common.isra.34+0x5c3/0x930
[   28.796016]  [<ffffffff8121066c>] do_execve+0x2c/0x30
[   28.796016]  [<ffffffff810939a0>]
call_usermodehelper_exec_async+0xf0/0x140
[   28.796016]  [<ffffffff810938b0>] ? umh_complete+0x40/0x40
[   28.796016]  [<ffffffff815cb1af>] ret_from_fork+0x3f/0x70
[   28.796016] Code: 48 8d 47 1c 48 89 e5 53 48 8b 37 48 89 fb 48 39 c6
74 1a 48 8b 3d 7e e9 8f 00 e8 49 fa fc ff 48 89 df e8 f1 01 fd ff 5b 5d
f3 c3 <0f> 0b 48 89 fe 48 8b 3d 61 e9 8f 00 e8 2c fa fc ff 5b 5d eb e9
[   28.796016] RIP  [<ffffffff812187b3>] putname+0x43/0x60
[   28.796016]  RSP <ffff88003592fe88>

Fixes: 193125dbd8 ("net: Introduce VRF device driver")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Acked-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:02 -08:00
Nikolay Aleksandrov
4eb5e5c531 net: ip6mr: fix static mfc/dev leaks on table destruction
[ Upstream commit 4c6980462f ]

Similar to ipv4, when destroying an mrt table the static mfc entries and
the static devices are kept, which leads to devices that can never be
destroyed (because of refcnt taken) and leaked memory. Make sure that
everything is cleaned up on netns destruction.

Fixes: 8229efdaef ("netns: ip6mr: enable namespace support in ipv6 multicast forwarding code")
CC: Benjamin Thery <benjamin.thery@bull.net>
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Reviewed-by: Cong Wang <cwang@twopensource.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:02 -08:00
Nikolay Aleksandrov
47f706657d net: ipmr: fix static mfc/dev leaks on table destruction
[ Upstream commit 0e615e9601 ]

When destroying an mrt table the static mfc entries and the static
devices are kept, which leads to devices that can never be destroyed
(because of refcnt taken) and leaked memory, for example:
unreferenced object 0xffff880034c144c0 (size 192):
  comm "mfc-broken", pid 4777, jiffies 4320349055 (age 46001.964s)
  hex dump (first 32 bytes):
    98 53 f0 34 00 88 ff ff 98 53 f0 34 00 88 ff ff  .S.4.....S.4....
    ef 0a 0a 14 01 02 03 04 00 00 00 00 01 00 00 00  ................
  backtrace:
    [<ffffffff815c1b9e>] kmemleak_alloc+0x4e/0xb0
    [<ffffffff811ea6e0>] kmem_cache_alloc+0x190/0x300
    [<ffffffff815931cb>] ip_mroute_setsockopt+0x5cb/0x910
    [<ffffffff8153d575>] do_ip_setsockopt.isra.11+0x105/0xff0
    [<ffffffff8153e490>] ip_setsockopt+0x30/0xa0
    [<ffffffff81564e13>] raw_setsockopt+0x33/0x90
    [<ffffffff814d1e14>] sock_common_setsockopt+0x14/0x20
    [<ffffffff814d0b51>] SyS_setsockopt+0x71/0xc0
    [<ffffffff815cdbf6>] entry_SYSCALL_64_fastpath+0x16/0x7a
    [<ffffffffffffffff>] 0xffffffffffffffff

Make sure that everything is cleaned on netns destruction.

Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Reviewed-by: Cong Wang <cwang@twopensource.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:02 -08:00
Daniel Borkmann
609d60122e net, scm: fix PaX detected msg_controllen overflow in scm_detach_fds
[ Upstream commit 6900317f5e ]

David and HacKurx reported a following/similar size overflow triggered
in a grsecurity kernel, thanks to PaX's gcc size overflow plugin:

(Already fixed in later grsecurity versions by Brad and PaX Team.)

[ 1002.296137] PAX: size overflow detected in function scm_detach_fds net/core/scm.c:314
               cicus.202_127 min, count: 4, decl: msg_controllen; num: 0; context: msghdr;
[ 1002.296145] CPU: 0 PID: 3685 Comm: scm_rights_recv Not tainted 4.2.3-grsec+ #7
[ 1002.296149] Hardware name: Apple Inc. MacBookAir5,1/Mac-66F35F19FE2A0D05, [...]
[ 1002.296153]  ffffffff81c27366 0000000000000000 ffffffff81c27375 ffffc90007843aa8
[ 1002.296162]  ffffffff818129ba 0000000000000000 ffffffff81c27366 ffffc90007843ad8
[ 1002.296169]  ffffffff8121f838 fffffffffffffffc fffffffffffffffc ffffc90007843e60
[ 1002.296176] Call Trace:
[ 1002.296190]  [<ffffffff818129ba>] dump_stack+0x45/0x57
[ 1002.296200]  [<ffffffff8121f838>] report_size_overflow+0x38/0x60
[ 1002.296209]  [<ffffffff816a979e>] scm_detach_fds+0x2ce/0x300
[ 1002.296220]  [<ffffffff81791899>] unix_stream_read_generic+0x609/0x930
[ 1002.296228]  [<ffffffff81791c9f>] unix_stream_recvmsg+0x4f/0x60
[ 1002.296236]  [<ffffffff8178dc00>] ? unix_set_peek_off+0x50/0x50
[ 1002.296243]  [<ffffffff8168fac7>] sock_recvmsg+0x47/0x60
[ 1002.296248]  [<ffffffff81691522>] ___sys_recvmsg+0xe2/0x1e0
[ 1002.296257]  [<ffffffff81693496>] __sys_recvmsg+0x46/0x80
[ 1002.296263]  [<ffffffff816934fc>] SyS_recvmsg+0x2c/0x40
[ 1002.296271]  [<ffffffff8181a3ab>] entry_SYSCALL_64_fastpath+0x12/0x85

Further investigation showed that this can happen when an *odd* number of
fds are being passed over AF_UNIX sockets.

In these cases CMSG_LEN(i * sizeof(int)) and CMSG_SPACE(i * sizeof(int)),
where i is the number of successfully passed fds, differ by 4 bytes due
to the extra CMSG_ALIGN() padding in CMSG_SPACE() to an 8 byte boundary
on 64 bit. The padding is used to align subsequent cmsg headers in the
control buffer.

When the control buffer passed in from the receiver side *lacks* these 4
bytes (e.g. due to buggy/wrong API usage), then msg->msg_controllen will
overflow in scm_detach_fds():

  int cmlen = CMSG_LEN(i * sizeof(int));  <--- cmlen w/o tail-padding
  err = put_user(SOL_SOCKET, &cm->cmsg_level);
  if (!err)
    err = put_user(SCM_RIGHTS, &cm->cmsg_type);
  if (!err)
    err = put_user(cmlen, &cm->cmsg_len);
  if (!err) {
    cmlen = CMSG_SPACE(i * sizeof(int));  <--- cmlen w/ 4 byte extra tail-padding
    msg->msg_control += cmlen;
    msg->msg_controllen -= cmlen;         <--- iff no tail-padding space here ...
  }                                            ... wrap-around

F.e. it will wrap to a length of 18446744073709551612 bytes in case the
receiver passed in msg->msg_controllen of 20 bytes, and the sender
properly transferred 1 fd to the receiver, so that its CMSG_LEN results
in 20 bytes and CMSG_SPACE in 24 bytes.

In case of MSG_CMSG_COMPAT (scm_detach_fds_compat()), I haven't seen an
issue in my tests as alignment seems always on 4 byte boundary. Same
should be in case of native 32 bit, where we end up with 4 byte boundaries
as well.

In practice, passing msg->msg_controllen of 20 to recvmsg() while receiving
a single fd would mean that on successful return, msg->msg_controllen is
being set by the kernel to 24 bytes instead, thus more than the input
buffer advertised. It could f.e. become an issue if such application later
on zeroes or copies the control buffer based on the returned msg->msg_controllen
elsewhere.

Maximum number of fds we can send is a hard upper limit SCM_MAX_FD (253).

Going over the code, it seems like msg->msg_controllen is not being read
after scm_detach_fds() in scm_recv() anymore by the kernel, good!

Relevant recvmsg() handler are unix_dgram_recvmsg() (unix_seqpacket_recvmsg())
and unix_stream_recvmsg(). Both return back to their recvmsg() caller,
and ___sys_recvmsg() places the updated length, that is, new msg_control -
old msg_control pointer into msg->msg_controllen (hence the 24 bytes seen
in the example).

Long time ago, Wei Yongjun fixed something related in commit 1ac70e7ad2
("[NET]: Fix function put_cmsg() which may cause usr application memory
overflow").

RFC3542, section 20.2. says:

  The fields shown as "XX" are possible padding, between the cmsghdr
  structure and the data, and between the data and the next cmsghdr
  structure, if required by the implementation. While sending an
  application may or may not include padding at the end of last
  ancillary data in msg_controllen and implementations must accept both
  as valid. On receiving a portable application must provide space for
  padding at the end of the last ancillary data as implementations may
  copy out the padding at the end of the control message buffer and
  include it in the received msg_controllen. When recvmsg() is called
  if msg_controllen is too small for all the ancillary data items
  including any trailing padding after the last item an implementation
  may set MSG_CTRUNC.

Since we didn't place MSG_CTRUNC for already quite a long time, just do
the same as in 1ac70e7ad2 to avoid an overflow.

Btw, even man-page author got this wrong :/ See db939c9b26e9 ("cmsg.3: Fix
error in SCM_RIGHTS code sample"). Some people must have copied this (?),
thus it got triggered in the wild (reported several times during boot by
David and HacKurx).

No Fixes tag this time as pre 2002 (that is, pre history tree).

Reported-by: David Sterba <dave@jikos.cz>
Reported-by: HacKurx <hackurx@gmail.com>
Cc: PaX Team <pageexec@freemail.hu>
Cc: Emese Revfy <re.emese@gmail.com>
Cc: Brad Spengler <spender@grsecurity.net>
Cc: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Cc: Eric Dumazet <edumazet@google.com>
Reviewed-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:02 -08:00
Eric Dumazet
b2d8d14ba2 tcp: initialize tp->copied_seq in case of cross SYN connection
[ Upstream commit 142a2e7ece ]

Dmitry provided a syzkaller (http://github.com/google/syzkaller)
generated program that triggers the WARNING at
net/ipv4/tcp.c:1729 in tcp_recvmsg() :

WARN_ON(tp->copied_seq != tp->rcv_nxt &&
        !(flags & (MSG_PEEK | MSG_TRUNC)));

His program is specifically attempting a Cross SYN TCP exchange,
that we support (for the pleasure of hackers ?), but it looks we
lack proper tcp->copied_seq initialization.

Thanks again Dmitry for your report and testings.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:01 -08:00
Eric Dumazet
11617ee108 tcp: fix potential huge kmalloc() calls in TCP_REPAIR
[ Upstream commit 5d4c9bfbab ]

tcp_send_rcvq() is used for re-injecting data into tcp receive queue.

Problems :

- No check against size is performed, allowed user to fool kernel in
  attempting very large memory allocations, eventually triggering
  OOM when memory is fragmented.

- In case of fault during the copy we do not return correct errno.

Lets use alloc_skb_with_frags() to cook optimal skbs.

Fixes: 292e8d8c85 ("tcp: Move rcvq sending to tcp_input.c")
Fixes: c0e88ff0f2 ("tcp: Repair socket queues")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Pavel Emelyanov <xemul@parallels.com>
Acked-by: Pavel Emelyanov <xemul@parallels.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:01 -08:00
Yuchung Cheng
6f5aa0f4aa tcp: disable Fast Open on timeouts after handshake
[ Upstream commit 0e45f4da59 ]

Some middle-boxes black-hole the data after the Fast Open handshake
(https://www.ietf.org/proceedings/94/slides/slides-94-tcpm-13.pdf).
The exact reason is unknown. The work-around is to disable Fast Open
temporarily after multiple recurring timeouts with few or no data
delivered in the established state.

Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Christoph Paasch <cpaasch@apple.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:01 -08:00
Eric Dumazet
4ef5bc914b tcp: md5: fix lockdep annotation
[ Upstream commit 1b8e6a01e1 ]

When a passive TCP is created, we eventually call tcp_md5_do_add()
with sk pointing to the child. It is not owner by the user yet (we
will add this socket into listener accept queue a bit later anyway)

But we do own the spinlock, so amend the lockdep annotation to avoid
following splat :

[ 8451.090932] net/ipv4/tcp_ipv4.c:923 suspicious rcu_dereference_protected() usage!
[ 8451.090932]
[ 8451.090932] other info that might help us debug this:
[ 8451.090932]
[ 8451.090934]
[ 8451.090934] rcu_scheduler_active = 1, debug_locks = 1
[ 8451.090936] 3 locks held by socket_sockopt_/214795:
[ 8451.090936]  #0:  (rcu_read_lock){.+.+..}, at: [<ffffffff855c6ac1>] __netif_receive_skb_core+0x151/0xe90
[ 8451.090947]  #1:  (rcu_read_lock){.+.+..}, at: [<ffffffff85618143>] ip_local_deliver_finish+0x43/0x2b0
[ 8451.090952]  #2:  (slock-AF_INET){+.-...}, at: [<ffffffff855acda5>] sk_clone_lock+0x1c5/0x500
[ 8451.090958]
[ 8451.090958] stack backtrace:
[ 8451.090960] CPU: 7 PID: 214795 Comm: socket_sockopt_

[ 8451.091215] Call Trace:
[ 8451.091216]  <IRQ>  [<ffffffff856fb29c>] dump_stack+0x55/0x76
[ 8451.091229]  [<ffffffff85123b5b>] lockdep_rcu_suspicious+0xeb/0x110
[ 8451.091235]  [<ffffffff8564544f>] tcp_md5_do_add+0x1bf/0x1e0
[ 8451.091239]  [<ffffffff85645751>] tcp_v4_syn_recv_sock+0x1f1/0x4c0
[ 8451.091242]  [<ffffffff85642b27>] ? tcp_v4_md5_hash_skb+0x167/0x190
[ 8451.091246]  [<ffffffff85647c78>] tcp_check_req+0x3c8/0x500
[ 8451.091249]  [<ffffffff856451ae>] ? tcp_v4_inbound_md5_hash+0x11e/0x190
[ 8451.091253]  [<ffffffff85647170>] tcp_v4_rcv+0x3c0/0x9f0
[ 8451.091256]  [<ffffffff85618143>] ? ip_local_deliver_finish+0x43/0x2b0
[ 8451.091260]  [<ffffffff856181b6>] ip_local_deliver_finish+0xb6/0x2b0
[ 8451.091263]  [<ffffffff85618143>] ? ip_local_deliver_finish+0x43/0x2b0
[ 8451.091267]  [<ffffffff85618d38>] ip_local_deliver+0x48/0x80
[ 8451.091270]  [<ffffffff85618510>] ip_rcv_finish+0x160/0x700
[ 8451.091273]  [<ffffffff8561900e>] ip_rcv+0x29e/0x3d0
[ 8451.091277]  [<ffffffff855c74b7>] __netif_receive_skb_core+0xb47/0xe90

Fixes: a8afca0329 ("tcp: md5: protects md5sig_info with RCU")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:00 -08:00
Bjørn Mork
e8afa3cd3e net: qmi_wwan: add XS Stick W100-2 from 4G Systems
[ Upstream commit 68242a5a1e ]

Thomas reports
"
4gsystems sells two total different LTE-surfsticks under the same name.
..
The newer version of XS Stick W100 is from "omega"
..
Under windows the driver switches to the same ID, and uses MI03\6 for
network and MI01\6 for modem.
..
echo "1c9e 9b01" > /sys/bus/usb/drivers/qmi_wwan/new_id
echo "1c9e 9b01" > /sys/bus/usb-serial/drivers/option1/new_id

T:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  4 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1c9e ProdID=9b01 Rev=02.32
S:  Manufacturer=USB Modem
S:  Product=USB Modem
S:  SerialNumber=
C:  #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
I:  If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage

Now all important things are there:

wwp0s29f7u2i3 (net), ttyUSB2 (at), cdc-wdm0 (qmi), ttyUSB1 (at)

There is also ttyUSB0, but it is not usable, at least not for at.

The device works well with qmi and ModemManager-NetworkManager.
"

Reported-by: Thomas Schäfer <tschaefer@t-online.de>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:00 -08:00
Paolo Abeni
d603fa768b net/ip6_tunnel: fix dst leak
[ Upstream commit 206b49500d ]

the commit cdf3464e6c ("ipv6: Fix dst_entry refcnt bugs in ip6_tunnel")
introduced percpu storage for ip6_tunnel dst cache, but while clearing
such cache it used raw_cpu_ptr to walk the per cpu entries, so cached
dst on non current cpu are not actually reset.

This patch replaces raw_cpu_ptr with per_cpu_ptr, properly cleaning
such storage.

Fixes: cdf3464e6c ("ipv6: Fix dst_entry refcnt bugs in ip6_tunnel")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:41:00 -08:00
Neil Horman
3f7a8d274e snmp: Remove duplicate OUTMCAST stat increment
[ Upstream commit 41033f029e ]

the OUTMCAST stat is double incremented, getting bumped once in the mcast code
itself, and again in the common ip output path.  Remove the mcast bump, as its
not needed

Validated by the reporter, with good results

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Reported-by: Claus Jensen <claus.jensen@microsemi.com>
CC: Claus Jensen <claus.jensen@microsemi.com>
CC: David Miller <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:59 -08:00
Pavel Fedin
ce2ceca37c net: thunder: Check for driver data in nicvf_remove()
[ Upstream commit 7750130d93 ]

In some cases the crash is caused by nicvf_remove() being called from
outside. For example, if we try to feed the device to vfio after the
probe has failed for some reason. So, move the check to better place.

Signed-off-by: Pavel Fedin <p.fedin@samsung.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:59 -08:00
Dragos Tatulea
5eceaad848 net: switchdev: fix return code of fdb_dump stub
[ Upstream commit 24cb7055a3 ]

rtnl_fdb_dump always expects an index to be returned by the ndo_fdb_dump op,
but when CONFIG_NET_SWITCHDEV is off, it returns an error.

Fix that by returning the given unmodified idx.

A similar fix was 0890cf6cb6 ("switchdev: fix return value of
switchdev_port_fdb_dump in case of error") but for the CONFIG_NET_SWITCHDEV=y
case.

Fixes: 45d4122ca7 ("switchdev: add support for fdb add/del/dump via switchdev_port_obj ops.")
Signed-off-by: Dragos Tatulea <dragos@endocode.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:59 -08:00
Jason A. Donenfeld
5c81f50e7f ip_tunnel: disable preemption when updating per-cpu tstats
[ Upstream commit b4fe85f9c9 ]

Drivers like vxlan use the recently introduced
udp_tunnel_xmit_skb/udp_tunnel6_xmit_skb APIs. udp_tunnel6_xmit_skb
makes use of ip6tunnel_xmit, and ip6tunnel_xmit, after sending the
packet, updates the struct stats using the usual
u64_stats_update_begin/end calls on this_cpu_ptr(dev->tstats).
udp_tunnel_xmit_skb makes use of iptunnel_xmit, which doesn't touch
tstats, so drivers like vxlan, immediately after, call
iptunnel_xmit_stats, which does the same thing - calls
u64_stats_update_begin/end on this_cpu_ptr(dev->tstats).

While vxlan is probably fine (I don't know?), calling a similar function
from, say, an unbound workqueue, on a fully preemptable kernel causes
real issues:

[  188.434537] BUG: using smp_processor_id() in preemptible [00000000] code: kworker/u8:0/6
[  188.435579] caller is debug_smp_processor_id+0x17/0x20
[  188.435583] CPU: 0 PID: 6 Comm: kworker/u8:0 Not tainted 4.2.6 #2
[  188.435607] Call Trace:
[  188.435611]  [<ffffffff8234e936>] dump_stack+0x4f/0x7b
[  188.435615]  [<ffffffff81915f3d>] check_preemption_disabled+0x19d/0x1c0
[  188.435619]  [<ffffffff81915f77>] debug_smp_processor_id+0x17/0x20

The solution would be to protect the whole
this_cpu_ptr(dev->tstats)/u64_stats_update_begin/end blocks with
disabling preemption and then reenabling it.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:59 -08:00
Eran Ben Elisha
289defb1e0 net/mlx4_core: Fix sleeping while holding spinlock at rem_slave_counters
[ Upstream commit f5adbfee72 ]

When cleaning slave's counter resources, we hold a spinlock that
protects the slave's counters list. As part of the clean, we call
__mlx4_clear_if_stat which calls mlx4_alloc_cmd_mailbox which is a
sleepable function.

In order to fix this issue, hold the spinlock, and copy all counter
indices into a temporary array, and release the spinlock. Afterwards,
iterate over this array and free every counter. Repeat this scenario
until the original list is empty (a new counter might have been added
while releasing the counters from the temporary array).

Fixes: b72ca7e96a ("net/mlx4_core: Reset counters data when freed")
Reported-by: Moni Shoua <monis@mellanox.com>
Tested-by: Moni Shoua <monis@mellanox.com>
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:58 -08:00
Tariq Toukan
713a813ed2 net/mlx5e: Added self loopback prevention
[ Upstream commit 66189961e9 ]

Prevent outgoing multicast frames from looping back to the RX queue.

By introducing new HW capability self_lb_en_modifiable, which indicates
the support to modify self_lb_en bit in modify_tir command.

When this capability is set we can prevent TIRs from sending back
loopback multicast traffic to their own RQs, by "refreshing TIRs" with
modify_tir command, on every time new channels (SQs/RQs) are created at
device open.
This is needed since TIRs are static and only allocated once on driver
load, and the loopback decision is under their responsibility.

Fixes issues of the kind:
"IPv6: eth2: IPv6 duplicate address fe80::e61d:2dff:fe5c:f2e9 detected!"
The issue is seen since the IPv6 solicitations multicast messages are
loopedback and the network stack thinks they are coming from another host.

Fixes: 5c50368f38 ("net/mlx5e: Light-weight netdev open/stop")
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:58 -08:00
lucien
176cec7823 sctp: translate host order to network order when setting a hmacid
[ Upstream commit ed5a377d87 ]

now sctp auth cannot work well when setting a hmacid manually, which
is caused by that we didn't use the network order for hmacid, so fix
it by adding the transformation in sctp_auth_ep_set_hmacs.

even we set hmacid with the network order in userspace, it still
can't work, because of this condition in sctp_auth_ep_set_hmacs():

		if (id > SCTP_AUTH_HMAC_ID_MAX)
			return -EOPNOTSUPP;

so this wasn't working before and thus it won't break compatibility.

Fixes: 65b07e5d0d ("[SCTP]: API updates to suport SCTP-AUTH extensions.")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:58 -08:00
Daniel Borkmann
377204f209 packet: fix tpacket_snd max frame len
[ Upstream commit 5cfb4c8d05 ]

Since it's introduction in commit 69e3c75f4d ("net: TX_RING and
packet mmap"), TX_RING could be used from SOCK_DGRAM and SOCK_RAW
side. When used with SOCK_DGRAM only, the size_max > dev->mtu +
reserve check should have reserve as 0, but currently, this is
unconditionally set (in it's original form as dev->hard_header_len).

I think this is not correct since tpacket_fill_skb() would then
take dev->mtu and dev->hard_header_len into account for SOCK_DGRAM,
the extra VLAN_HLEN could be possible in both cases. Presumably, the
reserve code was copied from packet_snd(), but later on missed the
check. Make it similar as we have it in packet_snd().

Fixes: 69e3c75f4d ("net: TX_RING and packet mmap")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:58 -08:00
Daniel Borkmann
263c8f423a packet: infer protocol from ethernet header if unset
[ Upstream commit c72219b75f ]

In case no struct sockaddr_ll has been passed to packet
socket's sendmsg() when doing a TX_RING flush run, then
skb->protocol is set to po->num instead, which is the protocol
passed via socket(2)/bind(2).

Applications only xmitting can go the path of allocating the
socket as socket(PF_PACKET, <mode>, 0) and do a bind(2) on the
TX_RING with sll_protocol of 0. That way, register_prot_hook()
is neither called on creation nor on bind time, which saves
cycles when there's no interest in capturing anyway.

That leaves us however with po->num 0 instead and therefore
the TX_RING flush run sets skb->protocol to 0 as well. Eric
reported that this leads to problems when using tools like
trafgen over bonding device. I.e. the bonding's hash function
could invoke the kernel's flow dissector, which depends on
skb->protocol being properly set. In the current situation, all
the traffic is then directed to a single slave.

Fix it up by inferring skb->protocol from the Ethernet header
when not set and we have ARPHRD_ETHER device type. This is only
done in case of SOCK_RAW and where we have a dev->hard_header_len
length. In case of ARPHRD_ETHER devices, this is guaranteed to
cover ETH_HLEN, and therefore being accessed on the skb after
the skb_store_bits().

Reported-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:58 -08:00
Daniel Borkmann
bbf14f8bb1 packet: only allow extra vlan len on ethernet devices
[ Upstream commit 3c70c13248 ]

Packet sockets can be used by various net devices and are not
really restricted to ARPHRD_ETHER device types. However, when
currently checking for the extra 4 bytes that can be transmitted
in VLAN case, our assumption is that we generally probe on
ARPHRD_ETHER devices. Therefore, before looking into Ethernet
header, check the device type first.

This also fixes the issue where non-ARPHRD_ETHER devices could
have no dev->hard_header_len in TX_RING SOCK_RAW case, and thus
the check would test unfilled linear part of the skb (instead
of non-linear).

Fixes: 57f89bfa21 ("network: Allow af_packet to transmit +4 bytes for VLAN packets.")
Fixes: 52f1454f62 ("packet: allow to transmit +4 byte in TX_RING slot for VLAN case")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:58 -08:00
Daniel Borkmann
6b4a14f426 packet: always probe for transport header
[ Upstream commit 8fd6c80d9d ]

We concluded that the skb_probe_transport_header() should better be
called unconditionally. Avoiding the call into the flow dissector has
also not really much to do with the direct xmit mode.

While it seems that only virtio_net code makes use of GSO from non
RX/TX ring packet socket paths, we should probe for a transport header
nevertheless before they hit devices.

Reference: http://thread.gmane.org/gmane.linux.network/386173/
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:57 -08:00
Daniel Borkmann
1a43c23578 packet: do skb_probe_transport_header when we actually have data
[ Upstream commit efdfa2f784 ]

In tpacket_fill_skb() commit c1aad275b0 ("packet: set transport
header before doing xmit") and later on 40893fd0fd ("net: switch
to use skb_probe_transport_header()") was probing for a transport
header on the skb from a ring buffer slot, but at a time, where
the skb has _not even_ been filled with data yet. So that call into
the flow dissector is pretty useless. Lets do it after we've set
up the skb frags.

Fixes: c1aad275b0 ("packet: set transport header before doing xmit")
Reported-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:57 -08:00
Kamal Mostafa
55eabd378b tools/net: Use include/uapi with __EXPORTED_HEADERS__
[ Upstream commit d7475de585 ]

Use the local uapi headers to keep in sync with "recently" added #define's
(e.g. SKF_AD_VLAN_TPID).  Refactored CFLAGS, and bpf_asm doesn't need -I.

Fixes: 3f356385e8 ("filter: bpf_asm: add minimal bpf asm tool")
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:56 -08:00
Nicolas Dichtel
ea9b07516f Revert "ipv6: ndisc: inherit metadata dst when creating ndisc requests"
[ Upstream commit 304d888b29 ]

This reverts commit ab450605b3.

In IPv6, we cannot inherit the dst of the original dst. ndisc packets
are IPv6 packets and may take another route than the original packet.

This patch breaks the following scenario: a packet comes from eth0 and
is forwarded through vxlan1. The encapsulated packet triggers an NS
which cannot be sent because of the wrong route.

CC: Jiri Benc <jbenc@redhat.com>
CC: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:56 -08:00
Martin KaFai Lau
4ab43ae83f ipv6: Check rt->dst.from for the DST_NOCACHE route
[ Upstrem commit 02bcf4e082 ]

All DST_NOCACHE rt6_info used to have rt->dst.from set to
its parent.

After commit 8e3d5be736 ("ipv6: Avoid double dst_free"),
DST_NOCACHE is also set to rt6_info which does not have
a parent (i.e. rt->dst.from is NULL).

This patch catches the rt->dst.from == NULL case.

Fixes: 8e3d5be736 ("ipv6: Avoid double dst_free")
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:56 -08:00
Martin KaFai Lau
dd91a7e65f ipv6: Check expire on DST_NOCACHE route
[ Upstream commit 5973fb1e24 ]

Since the expires of the DST_NOCACHE rt can be set during
the ip6_rt_update_pmtu(), we also need to consider the expires
value when doing ip6_dst_check().

This patches creates __rt6_check_expired() to only
check the expire value (if one exists) of the current rt.

In rt6_dst_from_check(), it adds __rt6_check_expired() as
one of the condition check.

Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:55 -08:00
Martin KaFai Lau
fdaac6a927 ipv6: Avoid creating RTF_CACHE from a rt that is not managed by fib6 tree
[ Upstream commit 0d3f6d297b ]

The original bug report:
https://bugzilla.redhat.com/show_bug.cgi?id=1272571

The setup has a IPv4 GRE tunnel running in a IPSec.  The bug
happens when ndisc starts sending router solicitation at the gre
interface.  The simplified oops stack is like:

__lock_acquire+0x1b2/0x1c30
lock_acquire+0xb9/0x140
_raw_write_lock_bh+0x3f/0x50
__ip6_ins_rt+0x2e/0x60
ip6_ins_rt+0x49/0x50
~~~~~~~~
__ip6_rt_update_pmtu.part.54+0x145/0x250
ip6_rt_update_pmtu+0x2e/0x40
~~~~~~~~
ip_tunnel_xmit+0x1f1/0xf40
__gre_xmit+0x7a/0x90
ipgre_xmit+0x15a/0x220
dev_hard_start_xmit+0x2bd/0x480
__dev_queue_xmit+0x696/0x730
dev_queue_xmit+0x10/0x20
neigh_direct_output+0x11/0x20
ip6_finish_output2+0x21f/0x770
ip6_finish_output+0xa7/0x1d0
ip6_output+0x56/0x190
~~~~~~~~
ndisc_send_skb+0x1d9/0x400
ndisc_send_rs+0x88/0xc0
~~~~~~~~

The rt passed to ip6_rt_update_pmtu() is created by
icmp6_dst_alloc() and it is not managed by the fib6 tree,
so its rt6i_table == NULL.  When __ip6_rt_update_pmtu() creates
a RTF_CACHE clone, the newly created clone also has rt6i_table == NULL
and it causes the ip6_ins_rt() oops.

During pmtu update, we only want to create a RTF_CACHE clone
from a rt which is currently managed (or owned) by the
fib6 tree.  It means either rt->rt6i_node != NULL or
rt is a RTF_PCPU clone.

It is worth to note that rt6i_table may not be NULL even it is
not (yet) managed by the fib6 tree (e.g. addrconf_dst_alloc()).
Hence, rt6i_node is a better check instead of rt6i_table.

Fixes: 45e4fd2668 ("ipv6: Only create RTF_CACHE routes after encountering pmtu")
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Reported-by: Chris Siebenmann <cks-rhbugzilla@cs.toronto.edu>
Cc: Chris Siebenmann <cks-rhbugzilla@cs.toronto.edu>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:55 -08:00
Hannes Frederic Sowa
343f4f8c01 af-unix: passcred support for sendpage
[ Upstream commit 9490f886b1 ]

sendpage did not care about credentials at all. This could lead to
situations in which because of fd passing between processes we could
append data to skbs with different scm data. It is illegal to splice those
skbs together. Instead we have to allocate a new skb and if requested
fill out the scm details.

Fixes: 869e7c6248 ("net: af_unix: implement stream sendpage support")
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:55 -08:00
Rainer Weikusat
58a6a46a03 unix: avoid use-after-free in ep_remove_wait_queue
[ Upstream commit 7d267278a9 ]

Rainer Weikusat <rweikusat@mobileactivedefense.com> writes:
An AF_UNIX datagram socket being the client in an n:1 association with
some server socket is only allowed to send messages to the server if the
receive queue of this socket contains at most sk_max_ack_backlog
datagrams. This implies that prospective writers might be forced to go
to sleep despite none of the message presently enqueued on the server
receive queue were sent by them. In order to ensure that these will be
woken up once space becomes again available, the present unix_dgram_poll
routine does a second sock_poll_wait call with the peer_wait wait queue
of the server socket as queue argument (unix_dgram_recvmsg does a wake
up on this queue after a datagram was received). This is inherently
problematic because the server socket is only guaranteed to remain alive
for as long as the client still holds a reference to it. In case the
connection is dissolved via connect or by the dead peer detection logic
in unix_dgram_sendmsg, the server socket may be freed despite "the
polling mechanism" (in particular, epoll) still has a pointer to the
corresponding peer_wait queue. There's no way to forcibly deregister a
wait queue with epoll.

Based on an idea by Jason Baron, the patch below changes the code such
that a wait_queue_t belonging to the client socket is enqueued on the
peer_wait queue of the server whenever the peer receive queue full
condition is detected by either a sendmsg or a poll. A wake up on the
peer queue is then relayed to the ordinary wait queue of the client
socket via wake function. The connection to the peer wait queue is again
dissolved if either a wake up is about to be relayed or the client
socket reconnects or a dead peer is detected or the client socket is
itself closed. This enables removing the second sock_poll_wait from
unix_dgram_poll, thus avoiding the use-after-free, while still ensuring
that no blocked writer sleeps forever.

Signed-off-by: Rainer Weikusat <rweikusat@mobileactivedefense.com>
Fixes: ec0d215f94 ("af_unix: fix 'poll for write'/connected DGRAM sockets")
Reviewed-by: Jason Baron <jbaron@akamai.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:55 -08:00
Hannes Frederic Sowa
26c04dfb4c af_unix: take receive queue lock while appending new skb
[ Upstream commit a3a116e04c ]

While possibly in future we don't necessarily need to use
sk_buff_head.lock this is a rather larger change, as it affects the
af_unix fd garbage collector, diag and socket cleanups. This is too much
for a stable patch.

For the time being grab sk_buff_head.lock without disabling bh and irqs,
so don't use locked skb_queue_tail.

Fixes: 869e7c6248 ("net: af_unix: implement stream sendpage support")
Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Reported-by: Eric Dumazet <edumazet@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:55 -08:00
Hannes Frederic Sowa
a78f42950a af_unix: don't append consumed skbs to sk_receive_queue
[ Upstream commit 8844f97238 ]

In case multiple writes to a unix stream socket race we could end up in a
situation where we pre-allocate a new skb for use in unix_stream_sendpage
but have to free it again in the locked section because another skb
has been appended meanwhile, which we must use. Accidentally we didn't
clear the pointer after consuming it and so we touched freed memory
while appending it to the sk_receive_queue. So, clear the pointer after
consuming the skb.

This bug has been found with syzkaller
(http://github.com/google/syzkaller) by Dmitry Vyukov.

Fixes: 869e7c6248 ("net: af_unix: implement stream sendpage support")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:55 -08:00
Hannes Frederic Sowa
382c8e80e4 af-unix: fix use-after-free with concurrent readers while splicing
[ Upstream commit 73ed5d25dc ]

During splicing an af-unix socket to a pipe we have to drop all
af-unix socket locks. While doing so we allow another reader to enter
unix_stream_read_generic which can read, copy and finally free another
skb. If exactly this skb is just in process of being spliced we get a
use-after-free report by kasan.

First, we must make sure to not have a free while the skb is used during
the splice operation. We simply increment its use counter before unlocking
the reader lock.

Stream sockets have the nice characteristic that we don't care about
zero length writes and they never reach the peer socket's queue. That
said, we can take the UNIXCB.consumed field as the indicator if the
skb was already freed from the socket's receive queue. If the skb was
fully consumed after we locked the reader side again we know it has been
dropped by a second reader. We indicate a short read to user space and
abort the current splice operation.

This bug has been found with syzkaller
(http://github.com/google/syzkaller) by Dmitry Vyukov.

Fixes: 2b514574f7 ("net: af_unix: implement splice for stream af_unix sockets")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:55 -08:00
françois romieu
808e146b0a r8169: fix kasan reported skb use-after-free.
[ Upstream commit 39174291d8 ]

Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Reported-by: Dave Jones <davej@codemonkey.org.uk>
Fixes: d7d2d89d4b ("r8169: Add software counter for multicast packages")
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Corinna Vinschen <vinschen@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:55 -08:00
Paul Gortmaker
bfa97da914 certs: add .gitignore to stop git nagging about x509_certificate_list
commit 48dbc164b4 upstream.

Currently we see this in "git status" if we build in the source dir:

Untracked files:
  (use "git add <file>..." to include in what will be committed)

        certs/x509_certificate_list

It looks like it used to live in kernel/ so we squash that .gitignore
entry at the same time.  I didn't bother to dig through git history to
see when it moved, since it is just a minor annoyance at most.

Cc: David Woodhouse <dwmw2@infradead.org>
Cc: keyrings@linux-nfs.org
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-14 21:40:54 -08:00
Greg Kroah-Hartman
14fd7c710c Linux 4.3.2 2015-12-10 18:11:40 -05:00
David Howells
14a837d297 X.509: Fix the time validation [ver #2]
commit cc25b994ac upstream.

This fixes CVE-2015-5327.  It affects kernels from 4.3-rc1 onwards.

Fix the X.509 time validation to use month number-1 when looking up the
number of days in that month.  Also put the month number validation before
doing the lookup so as not to risk overrunning the array.

This can be tested by doing the following:

cat <<EOF | openssl x509 -outform DER | keyctl padd asymmetric "" @s
-----BEGIN CERTIFICATE-----
MIIDbjCCAlagAwIBAgIJAN/lUld+VR4hMA0GCSqGSIb3DQEBCwUAMCkxETAPBgNV
BAoMCGxvY2FsLWNhMRQwEgYDVQQDDAtzaWduaW5nIGtleTAeFw0xNTA5MDEyMTMw
MThaFw0xNjA4MzEyMTMwMThaMCkxETAPBgNVBAoMCGxvY2FsLWNhMRQwEgYDVQQD
DAtzaWduaW5nIGtleTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANrn
crcMfMeG67nagX4+m02Xk9rkmsMKI5XTUxbikROe7GSUVJ27sPVPZp4mgzoWlvhh
jfK8CC/qhEhwep8Pgg4EJZyWOjhZb7R97ckGvLIoUC6IO3FC2ZnR7WtmWDgo2Jcj
VlXwJdHhKU1VZwulh81O61N8IBKqz2r/kDhIWiicUCUkI/Do/RMRfKAoDBcSh86m
gOeIAGfq62vbiZhVsX5dOE8Oo2TK5weAvwUIOR7OuGBl5AqwFlPnXQolewiHzKry
THg9e44HfzG4Mi6wUvcJxVaQT1h5SrKD779Z5+8+wf1JLaooetcEUArvWyuxCU59
qxA4lsTjBwl4cmEki+cCAwEAAaOBmDCBlTAMBgNVHRMEBTADAQH/MAsGA1UdDwQE
AwIHgDAdBgNVHQ4EFgQUyND/eKUis7ep/hXMJ8iZMdUhI+IwWQYDVR0jBFIwUIAU
yND/eKUis7ep/hXMJ8iZMdUhI+KhLaQrMCkxETAPBgNVBAoMCGxvY2FsLWNhMRQw
EgYDVQQDDAtzaWduaW5nIGtleYIJAN/lUld+VR4hMA0GCSqGSIb3DQEBCwUAA4IB
AQAMqm1N1yD5pimUELLhT5eO2lRdGUfTozljRxc7e2QT3RLk2TtGhg65JFFN6eml
XS58AEPVcAsSLDlR6WpOpOLB2giM0+fV/eYFHHmh22yqTJl4YgkdUwyzPdCHNOZL
hmSKeY9xliHb6PNrNWWtZwhYYvRaO2DX4GXOMR0Oa2O4vaYu6/qGlZOZv3U6qZLY
wwHEJSrqeBDyMuwN+eANHpoSpiBzD77S4e+7hUDJnql4j6xzJ65+nWJ89fCrQypR
4sN5R3aGeIh3QAQUIKpHilwek0CtEaYERgc5m+jGyKSc1rezJW62hWRTaitOc+d5
G5hh+9YpnYcxQHEKnZ7rFNKJ
-----END CERTIFICATE-----
EOF

If it works, it emit a key ID; if it fails, it should give a bad message
error.

Reported-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Acked-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-10 18:11:25 -05:00
sudip
6b8b7d4fb9 crypto: asymmetric_keys - remove always false comparison
commit 4dd17c9c8a upstream.

hour, min and sec are unsigned int and they can never be less than zero.

Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-10 18:11:25 -05:00
Greg Kroah-Hartman
5f8b2364ca Linux 4.3.1 2015-12-09 14:40:26 -05:00
Boris Ostrovsky
a8adab1a51 xen/events: Always allocate legacy interrupts on PV guests
commit b4ff8389ed upstream.

After commit 8c058b0b9c ("x86/irq: Probe for PIC presence before
allocating descs for legacy IRQs") early_irq_init() will no longer
preallocate descriptors for legacy interrupts if PIC does not
exist, which is the case for Xen PV guests.

Therefore we may need to allocate those descriptors ourselves.

Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:43 -05:00
Arnd Bergmann
b2cb7afbb1 staging/lustre: use jiffies for lp_last_query times
commit 9f088dba3c upstream.

The recently introduced lnet_peer_set_alive() function uses
get_seconds() to read the current time into a shared variable,
but all other uses of that variable compare it to jiffies values.

This changes the current use to jiffies as well for consistency.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: af3fa7c71b ("staging/lustre/lnet: peer aliveness status and NI status")
Cc: Liang Zhen <liang.zhen@intel.com>
Cc: James Simmons <uja.ornl@gmail.com>
Cc: Isaac Huang <he.huang@intel.com>
Signed-off-by: Oleg Drokin <oleg.drokin@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:43 -05:00
Rajmohan Mani
7588e627c8 xhci: Workaround to get Intel xHCI reset working more reliably
commit a596439619 upstream.

Existing Intel xHCI controllers require a delay of 1 mS,
after setting the CMD_RESET bit in command register, before
accessing any HC registers. This allows the HC to complete
the reset operation and be ready for HC register access.
Without this delay, the subsequent HC register access,
may result in a system hang, very rarely.

Verified CherryView / Braswell platforms go through over
5000 warm reboot cycles (which was not possible without
this patch), without any xHCI reset hang.

Signed-off-by: Rajmohan Mani <rajmohan.mani@intel.com>
Tested-by: Joe Lawrence <joe.lawrence@stratus.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:43 -05:00
Peter Hurley
2be56f43e4 tty: Fix tty_send_xchar() lock order inversion
commit ee0c1a65cf upstream.

The correct lock order is atomic_write_lock => termios_rwsem, as
established by tty_write() => n_tty_write().

Fixes: c274f6ef1c ("tty: Hold termios_rwsem for tcflow(TCIxxx)")
Reported-and-Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:42 -05:00
Peter Hurley
45de0e37d2 tty: audit: Fix audit source
commit 6b2a3d628a upstream.

The data to audit/record is in the 'from' buffer (ie., the input
read buffer).

Fixes: 72586c6061 ("n_tty: Fix auditing support for cannonical mode")
Cc: Miloslav Trmač <mitr@redhat.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Acked-by: Laura Abbott <labbott@fedoraproject.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:42 -05:00
James Hogan
9f3de4e4d2 ttyFDC: Fix build problems due to use of module_{init,exit}
commit 3e8137a185 upstream.

Commit 0fd972a7d9 (module: relocate module_init from init.h to
module.h) broke the build of ttyFDC driver due to that driver's (mis)use
of module_mips_cdmm_driver() without first including module.h, for
example:

In file included from ./arch/mips/include/asm/cdmm.h +11 :0,
                 from drivers/tty/mips_ejtag_fdc.c +34 :
include/linux/device.h +1295 :1: warning: data definition has no type or storage class
./arch/mips/include/asm/cdmm.h +84 :2: note: in expansion of macro ‘module_driver’
drivers/tty/mips_ejtag_fdc.c +1157 :1: note: in expansion of macro ‘module_mips_cdmm_driver’
include/linux/device.h +1295 :1: error: type defaults to ‘int’ in declaration of ‘module_init’ [-Werror=implicit-int]
./arch/mips/include/asm/cdmm.h +84 :2: note: in expansion of macro ‘module_driver’
drivers/tty/mips_ejtag_fdc.c +1157 :1: note: in expansion of macro ‘module_mips_cdmm_driver’
drivers/tty/mips_ejtag_fdc.c +1157 :1: warning: parameter names (without types) in function declaration

Instead of just adding the module.h include, switch to using the new
builtin_mips_cdmm_driver() helper macro and drop the remove callback,
since it isn't needed. If module support is added later, the code can
always be resurrected.

Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jiri Slaby <jslaby@suse.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: linux-mips@linux-mips.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:42 -05:00
Clemens Ladisch
7327b7fff4 ALSA: usb-audio: work around CH345 input SysEx corruption
commit a91e627e3f upstream.

One of the many faults of the QinHeng CH345 USB MIDI interface chip is
that it does not handle received SysEx messages correctly -- every second
event packet has a wrong code index number, which is the one from the last
seen message, instead of 4.  For example, the two messages "FE F0 01 02 03
04 05 06 07 08 09 0A 0B 0C 0D 0E F7" result in the following event
packets:

correct:       CH345:
0F FE 00 00    0F FE 00 00
04 F0 01 02    04 F0 01 02
04 03 04 05    0F 03 04 05
04 06 07 08    04 06 07 08
04 09 0A 0B    0F 09 0A 0B
04 0C 0D 0E    04 0C 0D 0E
05 F7 00 00    05 F7 00 00

A class-compliant driver must interpret an event packet with CIN 15 as
having a single data byte, so the other two bytes would be ignored.  The
message received by the host would then be missing two bytes out of six;
in this example, "F0 01 02 03 06 07 08 09 0C 0D 0E F7".

These corrupted SysEx event packages contain only data bytes, while the
CH345 uses event packets with a correct CIN value only for messages with
a status byte, so it is possible to distinguish between these two cases by
checking for the presence of this status byte.

(Other bugs in the CH345's input handling, such as the corruption resulting
from running status, cannot be worked around.)

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:42 -05:00
Clemens Ladisch
a90b6640f8 ALSA: usb-audio: prevent CH345 multiport output SysEx corruption
commit 1ca8b20130 upstream.

The CH345 USB MIDI chip has two output ports.  However, they are
multiplexed through one pin, and the number of ports cannot be reduced
even for hardware that implements only one connector, so for those
devices, data sent to either port ends up on the same hardware output.
This becomes a problem when both ports are used at the same time, as
longer MIDI commands (such as SysEx messages) are likely to be
interrupted by messages from the other port, and thus to get lost.

It would not be possible for the driver to detect how many ports the
device actually has, except that in practice, _all_ devices built with
the CH345 have only one port.  So we can just ignore the device's
descriptors, and hardcode one output port.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:42 -05:00
Clemens Ladisch
da3e8b3f94 ALSA: usb-audio: add packet size quirk for the Medeli DD305
commit 98d362becb upstream.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:41 -05:00
Lu Baolu
72655363eb usb: xhci: fix checking ep busy for CFC
commit 42df7215fa upstream.

Function ep_ring_is_processing() checks the dequeue pointer
in endpoint context to know whether an endpoint is busy with
processing TRBs. This is not correct since dequeue pointer
field in an endpoint context is only valid when the endpoint
is in Halted or Stopped states. This buggy code causes audio
noise when playing sound with USB headset connected to host
controllers which support CFC (one of xhci 1.1 features).

This patch should exist in stable kernel since v4.3.

Reported-and-tested-by: YD Tseng <yd_tseng@asmedia.com.tw>
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:41 -05:00
Bjørn Mork
c88860cd6e USB: option: add XS Stick W100-2 from 4G Systems
commit 638148e20c upstream.

Thomas reports
"
4gsystems sells two total different LTE-surfsticks under the same name.
..
The newer version of XS Stick W100 is from "omega"
..
Under windows the driver switches to the same ID, and uses MI03\6 for
network and MI01\6 for modem.
..
echo "1c9e 9b01" > /sys/bus/usb/drivers/qmi_wwan/new_id
echo "1c9e 9b01" > /sys/bus/usb-serial/drivers/option1/new_id

T:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  4 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1c9e ProdID=9b01 Rev=02.32
S:  Manufacturer=USB Modem
S:  Product=USB Modem
S:  SerialNumber=
C:  #Ifs= 5 Cfg#= 1 Atr=80 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
I:  If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage

Now all important things are there:

wwp0s29f7u2i3 (net), ttyUSB2 (at), cdc-wdm0 (qmi), ttyUSB1 (at)

There is also ttyUSB0, but it is not usable, at least not for at.

The device works well with qmi and ModemManager-NetworkManager.
"

Reported-by: Thomas Schäfer <tschaefer@t-online.de>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:41 -05:00
Aleksander Morgado
0399c7ca98 USB: serial: option: add support for Novatel MiFi USB620L
commit e07af133c3 upstream.

Also known as Verizon U620L.

The device is modeswitched from 1410:9020 to 1410:9022 by selecting the
4th USB configuration:

 $ sudo usb_modeswitch –v 0x1410 –p 0x9020 –u 4

This configuration provides a ECM interface as well as TTYs ('Enterprise
Mode' according to the U620 Linux integration guide).

Signed-off-by: Aleksander Morgado <aleksander@aleksander.es>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:41 -05:00
David Woodhouse
b56df84074 USB: ti_usb_3410_5052: Add Honeywell HGI80 ID
commit 1bcb49e663 upstream.

The Honeywell HGI80 is a wireless interface to the evohome connected
thermostat. It uses a TI 3410 USB-serial port.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:40 -05:00
Uwe Kleine-König
b56ffb4c07 usb: musb: core: fix order of arguments to ulpi write callback
commit 705e63d2b2 upstream.

There is a bit of a mess in the order of arguments to the ulpi write
callback. There is

	int ulpi_write(struct ulpi *ulpi, u8 addr, u8 val)

in drivers/usb/common/ulpi.c;

	struct usb_phy_io_ops {
		...
		int (*write)(struct usb_phy *x, u32 val, u32 reg);
	}

in include/linux/usb/phy.h.

The callback registered by the musb driver has to comply to the latter,
but up to now had "offset" first which effectively made the function
broken for correct users. So flip the order and while at it also
switch to the parameter names of struct usb_phy_io_ops's write.

Fixes: ffb865b1e4 ("usb: musb: add ulpi access operations")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:40 -05:00
Bjørn Mork
7413ab071f USB: qcserial: Fix support for HP lt4112 LTE/HSPA+ Gobi 4G Modem
commit 59536da345 upstream.

The DEVICE_HWI type was added under the faulty assumption that Huawei
devices based on Qualcomm chipsets and firmware use the static USB
interface numbering known from Gobi devices.  But this model does
not apply to Huawei devices like the HP branded lt4112 (Huawei me906e).
Huawei firmwares will dynamically assign interface numbers. Functions
are renumbered when the firmware is reconfigured.

Fix by changing the DEVICE_HWI type to use a simplified version
of Huawei's subclass + protocol scheme: Blacklisting known network
interface combinations and assuming the rest are serial.

Reported-and-tested-by: Muri Nicanor <muri+libqmi@immerda.ch>
Tested-by: Martin Hauke <mardnh@gmx.de>
Fixes: e7181d005e ("USB: qcserial: Add support for HP lt4112 LTE/HSPA+ Gobi 4G Modem")
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:40 -05:00
Petr Štetiar
6763f60ff3 USB: qcserial: Add support for Quectel EC20 Mini PCIe module
commit 9d5b5ed796 upstream.

It seems like this device has same vendor and product IDs as G2K
devices, but it has different number of interfaces(4 vs 5) and also
different interface layout which makes it currently unusable:

	usbcore: registered new interface driver qcserial
	usbserial: USB Serial support registered for Qualcomm USB modem
	usb 2-1.2: unknown number of interfaces: 5

lsusb output:

	Bus 002 Device 003: ID 05c6:9215 Qualcomm, Inc. Acer Gobi 2000 Wireless
	Device Descriptor:
	  bLength                18
	  bDescriptorType         1
	  bcdUSB               2.00
	  bDeviceClass            0 (Defined at Interface level)
	  bDeviceSubClass         0
	  bDeviceProtocol         0
	  bMaxPacketSize0        64
	  idVendor           0x05c6 Qualcomm, Inc.
	  idProduct          0x9215 Acer Gobi 2000 Wireless Modem
	  bcdDevice            2.32
	  iManufacturer           1 Quectel
	  iProduct                2 Quectel LTE Module
	  iSerial                 0
	  bNumConfigurations      1
	  Configuration Descriptor:
	    bLength                 9
	    bDescriptorType         2
	    wTotalLength          209
	    bNumInterfaces          5
	    bConfigurationValue     1
	    iConfiguration          0
	    bmAttributes         0xa0
	      (Bus Powered)
	      Remote Wakeup
	    MaxPower              500mA

Signed-off-by: Petr Štetiar <ynezz@true.cz>
[johan: rename define and add comment ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:39 -05:00
Aaro Koskinen
dbfee9e419 usb: phy: omap-otg: fix uninitialized pointer
commit 2c2025b41a upstream.

otg_dev->extcon was referenced before otg_dev was initialized. Fix.

Fixes: a2fd242324 ("usb: phy: omap-otg: Replace deprecated API of extcon")
Reviewed-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:39 -05:00
Jiri Slaby
a0046cfd74 usblp: do not set TASK_INTERRUPTIBLE before lock
commit 19cd80a214 upstream.

It is not permitted to set task state before lock. usblp_wwait sets
the state to TASK_INTERRUPTIBLE and calls mutex_lock_interruptible.
Upon return from that function, the state will be TASK_RUNNING again.

This is clearly a bug and a warning is generated with LOCKDEP too:
WARNING: CPU: 1 PID: 5109 at kernel/sched/core.c:7404 __might_sleep+0x7d/0x90()
do not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffffffa0c588d0>] usblp_wwait+0xa0/0x310 [usblp]
Modules linked in: ...
CPU: 1 PID: 5109 Comm: captmon Tainted: G        W       4.2.5-0.gef2823b-default #1
Hardware name: LENOVO 23252SG/23252SG, BIOS G2ET33WW (1.13 ) 07/24/2012
 ffffffff81a4edce ffff880236ec7ba8 ffffffff81716651 0000000000000000
 ffff880236ec7bf8 ffff880236ec7be8 ffffffff8106e146 0000000000000282
 ffffffff81a50119 000000000000028b 0000000000000000 ffff8802dab7c508
Call Trace:
...
 [<ffffffff8106e1c6>] warn_slowpath_fmt+0x46/0x50
 [<ffffffff8109a8bd>] __might_sleep+0x7d/0x90
 [<ffffffff8171b20f>] mutex_lock_interruptible_nested+0x2f/0x4b0
 [<ffffffffa0c588fc>] usblp_wwait+0xcc/0x310 [usblp]
 [<ffffffffa0c58bb2>] usblp_write+0x72/0x350 [usblp]
 [<ffffffff8121ed98>] __vfs_write+0x28/0xf0
...

Commit 7f477358e2 (usblp: Implement the
ENOSPC convention) moved the set prior locking. So move it back after
the lock.

Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Fixes: 7f477358e2 ("usblp: Implement the ENOSPC convention")
Acked-By: Pete Zaitcev <zaitcev@yahoo.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:39 -05:00
Jonas Gorski
1207663d5b usb: ehci-orion: fix probe for !GENERIC_PHY
commit db1319e166 upstream.

Commit d445913ce0 ("usb: ehci-orion: add optional PHY support")
added support for optional phys, but devm_phy_optional_get returns
-ENOSYS if GENERIC_PHY is not enabled.

This causes probe failures, even when there are no phys specified:

[    1.443365] orion-ehci f1058000.usb: init f1058000.usb fail, -38
[    1.449403] orion-ehci: probe of f1058000.usb failed with error -38

Similar to dwc3, treat -ENOSYS as no phy.

Fixes: d445913ce0 ("usb: ehci-orion: add optional PHY support")

Signed-off-by: Jonas Gorski <jogo@openwrt.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:39 -05:00
Jurgen Kramer
5a2fb41430 ALSA: usb: Add native DSD support for Aune X1S
commit 16771c7c70 upstream.

This patch adds native DSD support for the Aune X1S 32BIT/384 DSD DAC

Signed-off-by: Jurgen Kramer <gtmkramer@xs4all.nl>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:38 -05:00
Li Jun
0330a1fbe5 usb: chipidea: debug: disable usb irq while role switch
commit 251b3c8b57 upstream.

Since the ci->role will be set after the host role start is complete, there
will be nobody cared irq during start host if usb irq enabled. This error
can be reproduced on i.mx6 sololite EVK board by:
1. disable otg id irq(IDIE) and disable all real otg properties of usbotg1
   in dts.
2. boot up the board with ID cable and usb device connected.
3. echo gadget > /sys/kernel/debug/ci_hdrc.0/role
4. echo host > /sys/kernel/debug/ci_hdrc.0/role
5. irq 212: nobody cared.

Signed-off-by: Li Jun <jun.li@freescale.com>
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:38 -05:00
Peter Chen
a46143c274 usb: chipidea: imx: refine clock operations to adapt for all platforms
commit ae3e57ae26 upstream.

Some i.mx platforms need three clocks to let controller work, but
others only need one, refine clock operation to adapt for all
platforms, it fixes a regression found at i.mx27.

Signed-off-by: Peter Chen <peter.chen@freescale.com>
Tested-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:38 -05:00
John Youn
61d93448a0 usb: dwc3: pci: Set enblslpm quirk for Synopsys platforms
commit 94218ee31b upstream.

Certain Synopsys prototyping PHY boards are not able to meet timings
constraints for LPM. This allows the PHY to meet those timings by
leaving the PHY clock running during suspend.

Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:37 -05:00
John Youn
78e46d1ff1 usb: dwc3: Add dis_enblslpm_quirk
commit ec791d149b upstream.

Add a quirk to clear the GUSB2PHYCFG.ENBLSLPM bit, which controls
whether the PHY receives the suspend signal from the controller.

Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:37 -05:00
John Youn
a78bd89f08 usb: dwc3: pci: Add platform data for Synopsys HAPS
commit bb7f3d6d32 upstream.

Add platform data and set usb3_lpm_capable and has_lpm_erratum.

Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:37 -05:00
John Youn
ab6fc45ff2 usb: dwc3: Support Synopsys USB 3.1 IP
commit 690fb3718a upstream.

This patch allows the dwc3 driver to run on the new Synopsys USB 3.1
IP core, albeit in USB 3.0 mode only.

The Synopsys USB 3.1 IP (DWC_usb31) retains mostly the same register
interface and programming model as the existing USB 3.0 controller IP
(DWC_usb3). However the GSNPSID and version numbers are different.

Add checking for the new ID to pass driver probe.

Also, since the DWC_usb31 version number is lower in value than the
full GSNPSID of the DWC_usb3 IP, we set the high bit to identify
DWC_usb31 and to ensure the values are higher.

Finally, add a documentation note about the revision numbering scheme.
Any future revision checks (for STARS, workarounds, and new features)
should take into consideration how it applies to both the 3.1/3.0 IP.

Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:36 -05:00
John Youn
044668df66 usb: dwc3: pci: Add the PCI Product ID for Synopsys USB 3.1
commit e8095a2536 upstream.

This adds the PCI product ID for the Synopsys USB 3.1 IP core
(DWC_usb31) on a HAPS-based PCI development platform.

Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:36 -05:00
John Youn
6ef8be0f88 usb: dwc3: pci: Add the Synopsys HAPS AXI Product ID
commit 41adc59cae upstream.

This ID is for the Synopsys DWC_usb3 core with AXI interface on PCIe
HAPS platform. This core has the debug registers mapped at a separate
BAR in order to support enhanced hibernation.

Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:36 -05:00
Li Jun
c0cd28e68d usb: chipidea: otg: gadget module load and unload support
commit 85da852df6 upstream.

This patch is to support load and unload gadget driver in full OTG mode.

Signed-off-by: Li Jun <jun.li@freescale.com>
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Tested-by: Jiada Wang <jiada_wang@mentor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:36 -05:00
Ben McCauley
aaa9636572 usb: dwc3: gadget: let us set lower max_speed
commit b9e51b2b1f upstream.

In some SoCs, dwc3 is implemented as a USB2.0 only
core, meaning that it can't ever achieve SuperSpeed.

Currect driver always sets gadget.max_speed to
USB_SPEED_SUPER unconditionally. This can causes
issues to some Host stacks where the host will issue
a GetBOS() request and we will reply with a BOS
containing Superspeed Capability Descriptor.

At least Windows seems to be upset by this fact and
prints a warning that we should connect $this device
to another port.

[ balbi@ti.com : rewrote entire commit, including
source code comment to make a lot clearer what the
problem is ]

Signed-off-by: Ben McCauley <ben.mccauley@garmin.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:35 -05:00
Douglas Gilbert
f95102dd29 usb: gadget: atmel_usba_udc: Expose correct device speed
commit d134c48d88 upstream.

Following changes that appeared in lk 4.0.0, the gadget udc driver for
some ARM based Atmel SoCs (e.g. at91sam9x5 and sama5d3 families)
incorrectly deduced full-speed USB link speed even when the hardware
had negotiated a high-speed link. The fix is to make sure that the
UDPHS Interrupt Enable Register value does not mask the SPEED bit
in the Interrupt Status Register.

For a mass storage gadget this problem lead to failures when the host
had a USB 3 port with the xhci_hcd driver. If the host was a USB 2
port using the ehci_hcd driver then the mass storage gadget worked
(but probably at a lower speed than it should have).

Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>
Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Fixes: 9870d895ad ("usb: atmel_usba_udc: Mask status with enabled irqs")
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:35 -05:00
Mian Yousaf Kaukab
5d8a3e3b16 usb: gadget: net2280: restore ep_cfg after defect7374 workaround
commit 81e9d14a53 upstream.

Defect 7374 workaround enables all GPEP as endpoint 0. Restore
endpoint number when defect 7374 workaround is disabled. Otherwise,
check to match USB endpoint number to hardware endpoint number in
net2280_enable() fails.

Reported-by: Paul Jones <p.jones@teclyn.com>
Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:35 -05:00
Ville Syrjälä
580c9bb064 Revert "usb: dwc3: gadget: drop unnecessary loop when cleaning up TRBs"
commit d115d7050a upstream.

This reverts commit 8f2c9544ab.

As it breaks g_ether on my Baytrail FFRD8 device. Everything starts out
fine, but after a bit of data has been transferred it just stops
flowing.

Note that I do get a bunch of these "NOHZ: local_softirq_pending 08"
when booting the machine, but I'm not really sure if they're related
to this problem.

Cc: Felipe Balbi <balbi@ti.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-usb@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:35 -05:00
David Hildenbrand
5d19d22c7b KVM: s390: enable SIMD only when no VCPUs were created
commit 5967c17b11 upstream.

We should never allow to enable/disable any facilities for the guest
when other VCPUs were already created.

kvm_arch_vcpu_(load|put) relies on SIMD not changing during runtime.
If somebody would create and run VCPUs and then decides to enable
SIMD, undefined behaviour could be possible (e.g. vector save area
not being set up).

Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:35 -05:00
David Hildenbrand
705e4e3c2c KVM: s390: avoid memory overwrites on emergency signal injection
commit b85de33a1a upstream.

Commit 383d0b0501 ("KVM: s390: handle pending local interrupts via
bitmap") introduced a possible memory overwrite from user space.

User space could pass an invalid emergency signal code (sending VCPU)
and therefore exceed the bitmap. Let's take care of this case and
check that the id is in the valid range.

Reviewed-by: Dominik Dingel <dingel@linux.vnet.ibm.com>
Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:34 -05:00
David Hildenbrand
0c1396192a KVM: s390: fix wrong lookup of VCPUs by array index
commit 152e9f65d6 upstream.

For now, VCPUs were always created sequentially with incrementing
VCPU ids. Therefore, the index in the VCPUs array matched the id.

As sequential creation might change with cpu hotplug, let's use
the correct lookup function to find a VCPU by id, not array index.

Let's also use kvm_lookup_vcpu() for validation of the sending VCPU
on external call injection.

Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:34 -05:00
David Hildenbrand
752f0d74a7 KVM: Provide function for VCPU lookup by id
commit db27a7a37a upstream.

Let's provide a function to lookup a VCPU by id.

Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Dominik Dingel <dingel@linux.vnet.ibm.com>
Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
[split patch from refactoring patch]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:34 -05:00
David Hildenbrand
0c590b83b0 KVM: s390: SCA must not cross page boundaries
commit c5c2c39346 upstream.

We seemed to have missed a few corner cases in commit f6c137ff00
("KVM: s390: randomize sca address").

The SCA has a maximum size of 2112 bytes. By setting the sca_offset to
some unlucky numbers, we exceed the page.

0x7c0 (1984) -> Fits exactly
0x7d0 (2000) -> 16 bytes out
0x7e0 (2016) -> 32 bytes out
0x7f0 (2032) -> 48 bytes out

One VCPU entry is 32 bytes long.

For the last two cases, we actually write data to the other page.
1. The address of the VCPU.
2. Injection/delivery/clearing of SIGP externall calls via SIGP IF.

Especially the 2. happens regularly. So this could produce two problems:
1. The guest losing/getting external calls.
2. Random memory overwrites in the host.

So this problem happens on every 127 + 128 created VM with 64 VCPUs.

Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:34 -05:00
Sebastian Ott
46af83a483 s390/pci: reshuffle struct used to write debug data
commit 7cc8944e13 upstream.

zpci_err_insn writes stale stack content to the debugfs.

Ensure that the struct in zpci_err_insn is ordered in a way that
we don't have uninitialized holes in it. In addition to that
add the packed attribute.

Fixes: 3d8258e (s390/pci: move debug messages to debugfs)
Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
Reviewed-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:33 -05:00
Martin Schwidefsky
c2ec9e3a2c s390/kernel: fix ptrace peek/poke for floating point registers
commit 55a423b6f1 upstream.

git commit 155e839a81
"s390/kernel: dynamically allocate FP register save area"
introduced a regression in regard to ptrace.

If the vector register extension is not present or unused the
ptrace peek of a floating pointer register return incorrect data
and the ptrace poke to a floating pointer register overwrites the
task structure starting at task->thread.fpu.fprs.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:33 -05:00
Rajkumar Manoharan
97f367a319 ath10k: fix invalid NSS for 4x4 devices
commit f680f70adb upstream.

The number of spatial streams that are derived from chain mask
for 4x4 devices is using wrong bitmask and conditional check.
This is affecting downlink throughput for QCA99x0 devices. Earlier
cfg_tx_chainmask is not filled by default until user configured it
and so get_nss_from_chainmask never be called. This issue is exposed
by recent commit 166de3f189 ("ath10k: remove supported chain mask").
By default maximum supported chain mask is filled in cfg_tx_chainmask.

Fixes: 5572a95b4b ("ath10k: apply chainmask settings to vdev on creation")
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:33 -05:00
Vivek Natarajan
3a0ff96194 ath10k: use station's current operating mode from assoc request
commit 72f8cef5d1 upstream.

The current number of spatial streams used by the client is advertised
as a separate IE in assoc request. Use this information to set
the NSS operating mode.

Fixes: 45c9abc059 ("ath10k: implement more versatile set_bitrate_mask").
Signed-off-by: Vivek Natarajan <nataraja@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:33 -05:00
Kalle Valo
92f503d0b0 ath10k: add ATH10K_FW_FEATURE_RAW_MODE_SUPPORT to ath10k_core_fw_feature_str[]
commit 5af82fa66a upstream.

This was missed in the original commit adding the flag and ath10k only printed "bit10":

ath10k_pci 0000:02:00.0: qca988x hw2.0 (0x4100016c, 0x043202ff) fw 10.2.4.70.6-2 api 3
htt-ver 2.1 wmi-op 5 htt-op 2 cal otp max-sta 128 raw 0 hwcrypto 1 features no-p2p,bit10

Also add a build test to avoid this happening again.

Fixes: ccec9038c7 ("ath10k: enable raw encap mode and software crypto engine")
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:33 -05:00
Jonas Gorski
0e9637a2b1 pinctrl: qcom: ssbi: fix compilation with DEBUG_FS=n
commit 11091fb0a1 upstream.

The DEBUG_FS=n #defines for the dbg_show functions were missed when
renaming the driver from msm_ to pm8xxx_, causing it to break the build
when DEBUG_FS isn't enabled:

  CC [M]  drivers/pinctrl/qcom/pinctrl-ssbi-gpio.o
drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c:597:14: error: ‘pm8xxx_gpio_dbg_show’ undeclared here (not in a function)
  .dbg_show = pm8xxx_gpio_dbg_show,

Fix this by renaming them correctly.

Fixes: b4c45fe974 ("pinctrl: qcom: ssbi: Family A gpio & mpp drivers")
Signed-off-by: Jonas Gorski <jogo@openwrt.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@sonymobile.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:32 -05:00
Masahiro Yamada
717991ddef pinctrl: uniphier: set input-enable before pin-muxing
commit bac7f4c1bf upstream.

While IECTRL is disabled, input signals are pulled-down internally.
If pin-muxing is set up first, glitch signals (Low to High transition)
might be input to hardware blocks.

Bad case scenario:
[1] The hardware block is already running before pinctrl is handled.
   (the reset is de-asserted by default or by a firmware, for example)
[2] The pin-muxing is set up.  The input signals to hardware block
    are pulled-down by the chip-internal biasing.
[3] The pins are input-enabled.  The signals from the board reach the
    hardware block.

Actually, one invalid character is input to the UART blocks for such
SoCs as PH1-LD4, PH1-sLD8, where UART devices start to run at the
power on reset.

To avoid such problems, pins should be input-enabled before muxing.

Fixes: 6e90889202 ("pinctrl: UniPhier: add UniPhier pinctrl core support")
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Reported-by: Dai Okamura <okamura.dai@socionext.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:32 -05:00
Mark Rutland
ea9130ac69 arm64: page-align sections for DEBUG_RODATA
commit cb083816ab upstream.

A kernel built with DEBUG_RO_DATA && !CONFIG_DEBUG_ALIGN_RODATA doesn't
have .text aligned to a page boundary, though fixup_executable works at
page-granularity thanks to its use of create_mapping. If .text is not
page-aligned, the first page it exists in may be marked non-executable,
leading to failures when an attempt is made to execute code in said
page.

This patch upgrades ALIGN_DEBUG_RO and ALIGN_DEBUG_RO_MIN to force page
alignment for DEBUG_RO_DATA && !CONFIG_DEBUG_ALIGN_RODATA kernels,
ensuring that all sections with specific RWX permission requirements are
mapped with the correct permissions.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reported-by: Jeremy Linton <jeremy.linton@arm.com>
Reviewed-by: Laura Abbott <laura@labbott.name>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Suzuki Poulose <suzuki.poulose@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Fixes: da141706ae ("arm64: add better page protections to arm64")
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:31 -05:00
Robin Murphy
000fb8a2db arm64: Fix compat register mappings
commit 5accd17d0e upstream.

For reasons not entirely apparent, but now enshrined in history, the
architectural mapping of AArch32 banked registers to AArch64 registers
actually orders SP_<mode> and LR_<mode> backwards compared to the
intuitive r13/r14 order, for all modes except FIQ.

Fix the compat_<reg>_<mode> macros accordingly, in the hope of avoiding
subtle bugs with KVM and AArch32 guests.

Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:31 -05:00
Mirza Krak
bf804ca6bc can: sja1000: clear interrupts on start
commit 7cecd9ab80 upstream.

According to SJA1000 data sheet error-warning (EI) interrupt is not
cleared by setting the controller in to reset-mode.

Then if we have the following case:
- system is suspended (echo mem > /sys/power/state) and SJA1000 is left
  in operating state
- A bus error condition occurs which activates EI interrupt, system is
  still suspended which means EI interrupt will be not be handled nor
  cleared.

If the above two events occur, on resume there is no way to return the
SJA1000 to operating state, except to cycle power to it.

By simply reading the IR register on start we will clear any previous
conditions that could be present.

Signed-off-by: Mirza Krak <mirza.krak@hostmobility.com>
Reported-by: Christian Magnusson <Christian.Magnusson@semcon.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:30 -05:00
Marek Vasut
8d66c73710 can: Use correct type in sizeof() in nla_put()
commit 562b103a21 upstream.

The sizeof() is invoked on an incorrect variable, likely due to some
copy-paste error, and this might result in memory corruption. Fix this.

Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Wolfgang Grandegger <wg@grandegger.com>
Cc: netdev@vger.kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:29 -05:00
Johan Hedberg
25f47b043d Bluetooth: Fix missing hdev locking for LE scan cleanup
commit 8ce783dc5e upstream.

The hci_conn objects don't have a dedicated lock themselves but rely
on the caller to hold the hci_dev lock for most types of access. The
hci_conn_timeout() function has so far sent certain HCI commands based
on the hci_conn state which has been possible without holding the
hci_dev lock.

The recent changes to do LE scanning before connect attempts added
even more operations to hci_conn and hci_dev from hci_conn_timeout,
thereby exposing potential race conditions with the hci_dev and
hci_conn states.

As an example of such a race, here there's a timeout but an
l2cap_sock_connect() call manages to race with the cleanup routine:

[Oct21 08:14] l2cap_chan_timeout: chan ee4b12c0 state BT_CONNECT
[  +0.000004] l2cap_chan_close: chan ee4b12c0 state BT_CONNECT
[  +0.000002] l2cap_chan_del: chan ee4b12c0, conn f3141580, err 111, state BT_CONNECT
[  +0.000002] l2cap_sock_teardown_cb: chan ee4b12c0 state BT_CONNECT
[  +0.000005] l2cap_chan_put: chan ee4b12c0 orig refcnt 4
[  +0.000010] hci_conn_drop: hcon f53d56e0 orig refcnt 1
[  +0.000013] l2cap_chan_put: chan ee4b12c0 orig refcnt 3
[  +0.000063] hci_conn_timeout: hcon f53d56e0 state BT_CONNECT
[  +0.000049] hci_conn_params_del: addr ee:0d:30:09:53:1f (type 1)
[  +0.000002] hci_chan_list_flush: hcon f53d56e0
[  +0.000001] hci_chan_del: hci0 hcon f53d56e0 chan f4e7ccc0
[  +0.004528] l2cap_sock_create: sock e708fc00
[  +0.000023] l2cap_chan_create: chan ee4b1770
[  +0.000001] l2cap_chan_hold: chan ee4b1770 orig refcnt 1
[  +0.000002] l2cap_sock_init: sk ee4b3390
[  +0.000029] l2cap_sock_bind: sk ee4b3390
[  +0.000010] l2cap_sock_setsockopt: sk ee4b3390
[  +0.000037] l2cap_sock_connect: sk ee4b3390
[  +0.000002] l2cap_chan_connect: 00:02:72:d9:e5:8b -> ee:0d:30:09:53:1f (type 2) psm 0x00
[  +0.000002] hci_get_route: 00:02:72:d9:e5:8b -> ee:0d:30:09:53:1f
[  +0.000001] hci_dev_hold: hci0 orig refcnt 8
[  +0.000003] hci_conn_hold: hcon f53d56e0 orig refcnt 0

Above the l2cap_chan_connect() shouldn't have been able to reach the
hci_conn f53d56e0 anymore but since hci_conn_timeout didn't do proper
locking that's not the case. The end result is a reference to hci_conn
that's not in the conn_hash list, resulting in list corruption when
trying to remove it later:

[Oct21 08:15] l2cap_chan_timeout: chan ee4b1770 state BT_CONNECT
[  +0.000004] l2cap_chan_close: chan ee4b1770 state BT_CONNECT
[  +0.000003] l2cap_chan_del: chan ee4b1770, conn f3141580, err 111, state BT_CONNECT
[  +0.000001] l2cap_sock_teardown_cb: chan ee4b1770 state BT_CONNECT
[  +0.000005] l2cap_chan_put: chan ee4b1770 orig refcnt 4
[  +0.000002] hci_conn_drop: hcon f53d56e0 orig refcnt 1
[  +0.000015] l2cap_chan_put: chan ee4b1770 orig refcnt 3
[  +0.000038] hci_conn_timeout: hcon f53d56e0 state BT_CONNECT
[  +0.000003] hci_chan_list_flush: hcon f53d56e0
[  +0.000002] hci_conn_hash_del: hci0 hcon f53d56e0
[  +0.000001] ------------[ cut here ]------------
[  +0.000461] WARNING: CPU: 0 PID: 1782 at lib/list_debug.c:56 __list_del_entry+0x3f/0x71()
[  +0.000839] list_del corruption, f53d56e0->prev is LIST_POISON2 (00000200)

The necessary fix is unfortunately more complicated than just adding
hci_dev_lock/unlock calls to the hci_conn_timeout() call path.
Particularly, the hci_conn_del() API, which expects the hci_dev lock to
be held, performs a cancel_delayed_work_sync(&hcon->disc_work) which
would lead to a deadlock if the hci_conn_timeout() call path tries to
acquire the same lock.

This patch solves the problem by deferring the cleanup work to a
separate work callback. To protect against the hci_dev or hci_conn
going away meanwhile temporary references are taken with the help of
hci_dev_hold() and hci_conn_get().

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:28 -05:00
Johan Hedberg
099208a1cb Bluetooth: Fix removing connection parameters when unpairing
commit a6ad2a6b9c upstream.

The commit 89cbb0638e introduced support for deferred connection
parameter removal when unpairing by removing them only once an
existing connection gets disconnected. However, it failed to address
the scenario when we're *not* connected and do an unpair operation.

What makes things worse is that most user space BlueZ versions will
first issue a disconnect request and only then unpair, meaning the
buggy code will be triggered every time. This effectively causes the
kernel to resume scanning and reconnect to a device for which we've
removed all keys and GATT database information.

This patch fixes the issue by adding the missing call to the
hci_conn_params_del() function to a branch which handles the case of
no existing connection.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:28 -05:00
Dmitry Tunin
65fe0308fd Bluetooth: ath3k: Add support of AR3012 0cf3:817b device
commit 18e0afab8c upstream.

T: Bus=04 Lev=02 Prnt=02 Port=04 Cnt=01 Dev#= 3 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0cf3 ProdID=817b Rev=00.02
C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

BugLink: https://bugs.launchpad.net/bugs/1506615

Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:27 -05:00
Dmitry Tunin
f499c55b9e Bluetooth: ath3k: Add new AR3012 0930:021c id
commit cd355ff071 upstream.

This adapter works with the existing linux-firmware.

T:  Bus=01 Lev=01 Prnt=01 Port=03 Cnt=02 Dev#=  3 Spd=12  MxCh= 0
D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0930 ProdID=021c Rev=00.01
C:  #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:  If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
I:  If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb

BugLink: https://bugs.launchpad.net/bugs/1502781

Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:27 -05:00
David Herrmann
de2ebbd167 Bluetooth: hidp: fix device disconnect on idle timeout
commit 660f0fc07d upstream.

The HIDP specs define an idle-timeout which automatically disconnects a
device. This has always been implemented in the HIDP layer and forced a
synchronous shutdown of the hidp-scheduler. This works just fine, but
lacks a forced disconnect on the underlying l2cap channels. This has been
broken since:

    commit 5205185d46
    Author: David Herrmann <dh.herrmann@gmail.com>
    Date:   Sat Apr 6 20:28:47 2013 +0200

        Bluetooth: hidp: remove old session-management

The old session-management always forced an l2cap error on the ctrl/intr
channels when shutting down. The new session-management skips this, as we
don't want to enforce channel policy on the caller. In other words, if
user-space removes an HIDP device, the underlying channels (which are
*owned* and *referenced* by user-space) are still left active. User-space
needs to call shutdown(2) or close(2) to release them.

Unfortunately, this does not work with idle-timeouts. There is no way to
signal user-space that the HIDP layer has been stopped. The API simply
does not support any event-passing except for poll(2). Hence, we restore
old behavior and force EUNATCH on the sockets if the HIDP layer is
disconnected due to idle-timeouts (behavior of explicit disconnects
remains unmodified). User-space can still call

    getsockopt(..., SO_ERROR, ...)

..to retrieve the EUNATCH error and clear sk_err. Hence, the channels can
still be re-used (which nobody does so far, though). Therefore, the API
still supports the new behavior, but with this patch it's also compatible
to the old implicit channel shutdown.

Reported-by: Mark Haun <haunma@keteu.org>
Reported-by: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:26 -05:00
Larry Finger
17b9d97eec staging: rtl8712: Add device ID for Sitecom WLA2100
commit 1e6e632836 upstream.

This adds the USB ID for the Sitecom WLA2100. The Windows 10 inf file
was checked to verify that the addition is correct.

Reported-by: Frans van de Wiel <fvdw@fvdw.eu>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Frans van de Wiel <fvdw@fvdw.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:26 -05:00
Dan Carpenter
c1c2cc1b5f mwifiex: fix mwifiex_rdeeprom_read()
commit 1f9c6e1bc1 upstream.

There were several bugs here.

1)  The done label was in the wrong place so we didn't copy any
    information out when there was no command given.

2)  We were using PAGE_SIZE as the size of the buffer instead of
    "PAGE_SIZE - pos".

3)  snprintf() returns the number of characters that would have been
    printed if there were enough space.  If there was not enough space
    (and we had fixed the memory corruption bug #2) then it would result
    in an information leak when we do simple_read_from_buffer().  I've
    changed it to use scnprintf() instead.

I also removed the initialization at the start of the function, because
I thought it made the code a little more clear.

Fixes: 5e6e3a92b9 ('wireless: mwifiex: initial commit for Marvell mwifiex driver')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:26 -05:00
Amitkumar Karwar
0c7b4e0d36 mwifiex: avoid memsetting PCIe event buffer
commit 14d9c11c91 upstream.

Preallocated PCIe buffer is being reused for all PCIe interface
events. Physical address of the buffer is shared with firmware
so that it can perform DMA on it. As event length is specified
in the header, there should not be a problem if the buffer gets
overwritten.
We will save some cycles by avoiding memset everytime while
submitting the buffer to firmware.

Fixes: 2728cecdc7d6bf3d21(mwifiex: corrections in PCIe event skb)
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:26 -05:00
Aniket Nagarnaik
a251acf26f mwifiex: fix NULL pointer dereference during hidden SSID scan
commit 17e524b1b6 upstream.

This NULL pointer dereference is observed during suspend resume
stress test. All pending commands are cancelled when system goes
into suspend state. There a corner case in which host may receive
response for last scan command after this and try to trigger extra
active scan for hidden SSIDs.

The issue is fixed by adding a NULL check to skip that extra scan.

Fixes: 2375fa2b36 (mwifiex: fix unable to connect hidden SSID..)
Signed-off-by: Aniket Nagarnaik <aniketn@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:25 -05:00
Tony Lindgren
8cb5ad246f mfd: twl6040: Fix deferred probe handling for clk32k
commit 75c08f17ec upstream.

Commit 68bab8662f ("mfd: twl6040: Optional clk32k clock handling")
added clock handling for the 32k clock from palmas-clk. However, that
patch did not consider a typical situation where twl6040 is built-in,
and palmas-clk is a loadable module like we have in omap2plus_defconfig.

If palmas-clk is not loaded before twl6040 probes, we will get a
"clk32k is not handled" warning during booting. This means that any
drivers relying on this clock will mysteriously fail, including
omap5-uevm WLAN and audio.

Note that for WLAN, we probably should also eventually get
the clk32kgaudio for MMC3 directly as that's shared between
audio and WLAN SDIO at least for omap5-uevm. It seems the
WLAN chip cannot get it as otherwise MMC3 won't get properly
probed.

Fixes: 68bab8662f ("mfd: twl6040: Optional clk32k clock handling")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Reviewed-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:25 -05:00
Linus Walleij
b14a661753 clk: versatile-icst: fix memory leak
commit 7bdccef34f upstream.

A static code checker found a memory leak in the Versatile
ICST code. Fix it.

Fixes: a183da637c "clk: versatile: respect parent rate in ICST clock"
Reported-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:25 -05:00
Simran Rai
e6a981502c clk: iproc: Fix PLL output frequency calculation
commit 63243a4da7 upstream.

This patch affects the clocks that use fractional ndivider in their
PLL output frequency calculation. Instead of 2^20 divide factor, the
clock's ndiv integer shift was used. Fixed the bug by replacing ndiv
integer shift with 2^20 factor.

Signed-off-by: Simran Rai <ssimran@broadcom.com>
Signed-off-by: Ray Jui <rjui@broadcom.com>
Reviewed-by: Scott Branden <sbranden@broadcom.com>
Fixes: 5fe225c105 ("clk: iproc: add initial common clock support")
Signed-off-by: Michael Turquette <mturquette@baylibre.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:25 -05:00
Ingo Molnar
40a76e5410 fs/proc, core/debug: Don't expose absolute kernel addresses via wchan
commit b2f73922d1 upstream.

So the /proc/PID/stat 'wchan' field (the 30th field, which contains
the absolute kernel address of the kernel function a task is blocked in)
leaks absolute kernel addresses to unprivileged user-space:

        seq_put_decimal_ull(m, ' ', wchan);

The absolute address might also leak via /proc/PID/wchan as well, if
KALLSYMS is turned off or if the symbol lookup fails for some reason:

static int proc_pid_wchan(struct seq_file *m, struct pid_namespace *ns,
                          struct pid *pid, struct task_struct *task)
{
        unsigned long wchan;
        char symname[KSYM_NAME_LEN];

        wchan = get_wchan(task);

        if (lookup_symbol_name(wchan, symname) < 0) {
                if (!ptrace_may_access(task, PTRACE_MODE_READ))
                        return 0;
                seq_printf(m, "%lu", wchan);
        } else {
                seq_printf(m, "%s", symname);
        }

        return 0;
}

This isn't ideal, because for example it trivially leaks the KASLR offset
to any local attacker:

  fomalhaut:~> printf "%016lx\n" $(cat /proc/$$/stat | cut -d' ' -f35)
  ffffffff8123b380

Most real-life uses of wchan are symbolic:

  ps -eo pid:10,tid:10,wchan:30,comm

and procps uses /proc/PID/wchan, not the absolute address in /proc/PID/stat:

  triton:~/tip> strace -f ps -eo pid:10,tid:10,wchan:30,comm 2>&1 | grep wchan | tail -1
  open("/proc/30833/wchan", O_RDONLY)     = 6

There's one compatibility quirk here: procps relies on whether the
absolute value is non-zero - and we can provide that functionality
by outputing "0" or "1" depending on whether the task is blocked
(whether there's a wchan address).

These days there appears to be very little legitimate reason
user-space would be interested in  the absolute address. The
absolute address is mostly historic: from the days when we
didn't have kallsyms and user-space procps had to do the
decoding itself via the System.map.

So this patch sets all numeric output to "0" or "1" and keeps only
symbolic output, in /proc/PID/wchan.

( The absolute sleep address can generally still be profiled via
  perf, by tasks with sufficient privileges. )

Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Kostya Serebryany <kcc@google.com>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: kasan-dev <kasan-dev@googlegroups.com>
Cc: linux-kernel@vger.kernel.org
Link: http://lkml.kernel.org/r/20150930135917.GA3285@gmail.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:25 -05:00
Marcin Wojtas
ed42098a90 net: mvneta: fix error path for building skb
commit 26c17a179f upstream.

In the actual RX processing, there is same error path for both descriptor
ring refilling and building skb fails. This is not correct, because after
successful refill, the ring is already updated with newly allocated
buffer. Then, in case of build_skb() fail, hitherto code left the original
buffer unmapped.

This patch fixes above situation by swapping error check of skb build with
DMA-unmap of original buffer.

Signed-off-by: Marcin Wojtas <mw@semihalf.com>
Acked-by: Simon Guinot <simon.guinot@sequanux.org>
Fixes a84e328941 ("net: mvneta: fix refilling for Rx DMA buffers")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:24 -05:00
Maxime Ripard
bf14478a37 net: mvneta: Fix CPU_MAP registers initialisation
commit 2502d0ef27 upstream.

The CPU_MAP register is duplicated for each CPUs at different addresses,
each instance being at a different address.

However, the code so far was using CONFIG_NR_CPUS to initialise the CPU_MAP
registers for each registers, while the SoCs embed at most 4 CPUs.

This is especially an issue with multi_v7_defconfig, where CONFIG_NR_CPUS
is currently set to 16, resulting in writes to registers that are not
CPU_MAP.

Fixes: c5aff18204 ("net: mvneta: driver for Marvell Armada 370/XP network unit")
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:24 -05:00
Oren Givon
c592b07ed2 iwlwifi: Add new PCI IDs for the 8260 series
commit 4ab75944c4 upstream.

Add some new PCI IDs for the 8260 series which were missing.
The following sub-system IDs were added:
0x0130, 0x1130, 0x0132, 0x1132, 0x1150, 0x8110, 0x9110, 0x8130,
0x9130, 0x8132, 0x9132, 0x8150, 0x9150, 0x0044, 0x0930

Signed-off-by: Oren Givon <oren.givon@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:24 -05:00
Emmanuel Grumbach
66c4d63673 iwlwifi: pcie: fix (again) prepare card flow
commit 03a19cbb91 upstream.

The hardware bug in the commit mentioned below forces us
not to re-enable the clock gating in the Host Cluster.
The impact on the power consumption is minimal and it allows
the WAKE_ME interrupt to propagate.

Fixes: c9fdec9f39 ("iwlwifi: pcie: fix prepare card flow")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:24 -05:00
Christophe Ricard
7fc3efcbf1 NFC: nci: extract pipe value using NCI_HCP_MSG_GET_PIPE
commit e65917b6d5 upstream.

When receiving data in nci_hci_msg_rx_work, extract pipe
value using NCI_HCP_MSG_GET_PIPE macro.

Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:23 -05:00
Christophe Ricard
37e8081d25 NFC: nci: Fix improper management of HCI return code
commit d8cd37ed2f upstream.

When sending HCI data over NCI, HCI return code is part
of the NCI data. In order to get correctly the HCI return
code, we assume the NCI communication is successful and
extract the return code for the nci_hci functions return code.

This is done because nci_to_errno does not match hci return
code value.

Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:23 -05:00
Christophe Ricard
fa885c63ce NFC: nci: Fix incorrect data chaining when sending data
commit 500c4ef022 upstream.

When sending HCI data over NCI, cmd information should be
present only on the first packet.
Each packet shall be specifically allocated and sent to the
NCI layer.

Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:23 -05:00
Christophe Ricard
306105dcdc NFC: st-nci: Fix incorrect spi buffer size
commit a1269dd116 upstream.

When sending data over SPI, the maximum expected length is the maximum
nci packet payload + data header size + the frame head room (1 for the
ndlc header) + the frame trail room (0).

Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:22 -05:00
Ola Olsson
526b4f4d1e nl80211: Fix potential memory leak from parse_acl_data
commit 4baf6bea37 upstream.

If parse_acl_data succeeds but the subsequent parsing of smps
attributes fails, there will be a memory leak due to early returns.
Fix that by moving the ACL parsing later.

Fixes: 18998c381b ("cfg80211: allow requesting SMPS mode on ap start")
Signed-off-by: Ola Olsson <ola.olsson@sonymobile.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:22 -05:00
Janusz.Dziedzic@tieto.com
901b9f4511 mac80211: fix divide by zero when NOA update
commit 519ee6918b upstream.

In case of one shot NOA the interval can be 0, catch that
instead of potentially (depending on the driver) crashing
like this:

divide error: 0000 [#1] SMP
[...]
Call Trace:
<IRQ>
[<ffffffffc08e891c>] ieee80211_extend_absent_time+0x6c/0xb0 [mac80211]
[<ffffffffc08e8a17>] ieee80211_update_p2p_noa+0xb7/0xe0 [mac80211]
[<ffffffffc069cc30>] ath9k_p2p_ps_timer+0x170/0x190 [ath9k]
[<ffffffffc070adf8>] ath_gen_timer_isr+0xc8/0xf0 [ath9k_hw]
[<ffffffffc0691156>] ath9k_tasklet+0x296/0x2f0 [ath9k]
[<ffffffff8107ad65>] tasklet_action+0xe5/0xf0
[...]

Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:21 -05:00
Arik Nemtsov
db96a3cfca mac80211: allow null chandef in tracing
commit 254d3dfe44 upstream.

In TDLS channel-switch operations the chandef can sometimes be NULL.
Avoid an oops in the trace code for these cases and just print a
chandef full of zeros.

Fixes: a7a6bdd067 ("mac80211: introduce TDLS channel switch ops")
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:21 -05:00
Johannes Berg
85eeb5c5ad mac80211: fix driver RSSI event calculations
commit 8ec6d97871 upstream.

The ifmgd->ave_beacon_signal value cannot be taken as is for
comparisons, it must be divided by since it's represented
like that for better accuracy of the EWMA calculations. This
would lead to invalid driver RSSI events. Fix the used value.

Fixes: 615f7b9bb1 ("mac80211: add driver RSSI threshold events")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:20 -05:00
Andrei Otcheretianski
328a286547 mac80211: Fix local deauth while associating
commit a64cba3c53 upstream.

Local request to deauthenticate wasn't handled while associating, thus
the association could continue even when the user space required to
disconnect.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:20 -05:00
Dave Hansen
7631e903a6 x86/mpx: Fix 32-bit address space calculation
commit f3119b8302 upstream.

I received a bug report that running 32-bit MPX binaries on
64-bit kernels was broken.  I traced it down to this little code
snippet.  We were switching our "number of bounds directory
entries" calculation correctly.  But, we didn't switch the other
side of the calculation: the virtual space size.

This meant that we were calculating an absurd size for
bd_entry_virt_space() on 32-bit because we used the 64-bit
virt_space.

This was _also_ broken for 32-bit kernels running on 64-bit
hardware since boot_cpu_data.x86_virt_bits=48 even when running
in 32-bit mode.

Correct that and properly handle all 3 possible cases:

 1. 32-bit binary on 64-bit kernel
 2. 64-bit binary on 64-bit kernel
 3. 32-bit binary on 32-bit kernel

This manifested in having bounds tables not properly unmapped.
It "leaked" memory but had no functional impact otherwise.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave@sr71.net>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20151111181934.FA7FAC34@viggo.jf.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:20 -05:00
Dave Hansen
10ec42fc4e x86/mpx: Do proper get_user() when running 32-bit binaries on 64-bit kernels
commit 46561c3959 upstream.

When you call get_user(foo, bar), you effectively do a

	copy_from_user(&foo, bar, sizeof(*bar));

Note that the sizeof() is implicit.

When we reach out to userspace to try to zap an entire "bounds
table" we need to go read a "bounds directory entry" in order to
locate the table's address.  The size of a "directory entry"
depends on the binary being run and is always the size of a
pointer.

But, when we have a 64-bit kernel and a 32-bit application, the
directory entry is still only 32-bits long, but we fetch it with
a 64-bit pointer which makes get_user() does a 64-bit fetch.
Reading 4 extra bytes isn't harmful, unless we are at the end of
and run off the table.  It might also cause the zero page to get
faulted in unnecessarily even if you are not at the end.

Fix it up by doing a special 32-bit get_user() via a cast when
we have 32-bit userspace.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave@sr71.net>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20151111181931.3ACF6822@viggo.jf.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:19 -05:00
Dave Hansen
44a06ce07b x86/fpu: Fix 32-bit signal frame handling
commit ab6b529475 upstream.

(This should have gone to LKML originally. Sorry for the extra
 noise, folks on the cc.)

Background:

Signal frames on x86 have two formats:

  1. For 32-bit executables (whether on a real 32-bit kernel or
     under 32-bit emulation on a 64-bit kernel) we have a
    'fpregset_t' that includes the "FSAVE" registers.

  2. For 64-bit executables (on 64-bit kernels obviously), the
     'fpregset_t' is smaller and does not contain the "FSAVE"
     state.

When creating the signal frame, we have to be aware of whether
we are running a 32 or 64-bit executable so we create the
correct format signal frame.

Problem:

save_xstate_epilog() uses 'fx_sw_reserved_ia32' whenever it is
called for a 32-bit executable.  This is for real 32-bit and
ia32 emulation.

But, fpu__init_prepare_fx_sw_frame() only initializes
'fx_sw_reserved_ia32' when emulation is enabled, *NOT* for real
32-bit kernels.

This leads to really wierd situations where 32-bit programs
lose their extended state when returning from a signal handler.
The kernel copies the uninitialized (zero) 'fx_sw_reserved_ia32'
out to userspace in save_xstate_epilog().  But when returning
from the signal, the kernel errors out in check_for_xstate()
when it does not see FP_XSTATE_MAGIC1 present (because it was
zeroed).  This leads to the FPU/XSAVE state being initialized.

For MPX, this leads to the most permissive state and means we
silently lose bounds violations.  I think this would also mean
that we could lose *ANY* FPU/SSE/AVX state.  I'm not sure why
no one has spotted this bug.

I believe this was broken by:

	72a671ced6 ("x86, fpu: Unify signal handling code paths for x86 and x86_64 kernels")

way back in 2012.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: dave@sr71.net
Cc: fenghua.yu@intel.com
Cc: yu-cheng.yu@intel.com
Link: http://lkml.kernel.org/r/20151111002354.A0799571@viggo.jf.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:19 -05:00
Huaitong Han
2062c50207 x86/fpu: Fix get_xsave_addr() behavior under virtualization
commit a05917b6ba upstream.

KVM uses the get_xsave_addr() function in a different fashion from
the native kernel, in that the 'xsave' parameter belongs to guest vcpu,
not the currently running task.

But 'xsave' is replaced with current task's (host) xsave structure, so
get_xsave_addr() will incorrectly return the bad xsave address to KVM.

Fix it so that the passed in 'xsave' address is used - as intended
originally.

Signed-off-by: Huaitong Han <huaitong.han@intel.com>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Fenghua Yu <fenghua.yu@intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Quentin Casasnovas <quentin.casasnovas@oracle.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: dave.hansen@intel.com
Link: http://lkml.kernel.org/r/1446800423-21622-1-git-send-email-huaitong.han@intel.com
[ Tidied up the changelog. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:19 -05:00
Andrew Cooper
905095d791 x86/cpu: Fix SMAP check in PVOPS environments
commit 581b7f158f upstream.

There appears to be no formal statement of what pv_irq_ops.save_fl() is
supposed to return precisely.  Native returns the full flags, while lguest and
Xen only return the Interrupt Flag, and both have comments by the
implementations stating that only the Interrupt Flag is looked at.  This may
have been true when initially implemented, but no longer is.

To make matters worse, the Xen PVOP leaves the upper bits undefined, making
the BUG_ON() undefined behaviour.  Experimentally, this now trips for 32bit PV
guests on Broadwell hardware.  The BUG_ON() is consistent for an individual
build, but not consistent for all builds.  It has also been a sitting timebomb
since SMAP support was introduced.

Use native_save_fl() instead, which will obtain an accurate view of the AC
flag.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: David Vrabel <david.vrabel@citrix.com>
Tested-by: Rusty Russell <rusty@rustcorp.com.au>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: <lguest@lists.ozlabs.org>
Cc: Xen-devel <xen-devel@lists.xen.org>
Link: http://lkml.kernel.org/r/1433323874-6927-1-git-send-email-andrew.cooper3@citrix.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:18 -05:00
Borislav Petkov
58c9f67c37 x86/cpu: Call verify_cpu() after having entered long mode too
commit 04633df0c4 upstream.

When we get loaded by a 64-bit bootloader, kernel entry point is
startup_64 in head_64.S. We don't trust any and all bootloaders because
some will fiddle with CPU configuration so we go ahead and massage each
CPU into sanity again.

For example, some dell BIOSes have this XD disable feature which set
IA32_MISC_ENABLE[34] and disable NX. This might be some dumb workaround
for other OSes but Linux sure doesn't need it.

A similar thing is present in the Surface 3 firmware - see
https://bugzilla.kernel.org/show_bug.cgi?id=106051 - which sets this bit
only on the BSP:

  # rdmsr -a 0x1a0
  400850089
  850089
  850089
  850089

I know, right?!

There's not even an off switch in there.

So fix all those cases by sanitizing the 64-bit entry point too. For
that, make verify_cpu() callable in 64-bit mode also.

Requested-and-debugged-by: "H. Peter Anvin" <hpa@zytor.com>
Reported-and-tested-by: Bastien Nocera <bugzilla@hadess.net>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/1446739076-21303-1-git-send-email-bp@alien8.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:18 -05:00
Vitaly Kuznetsov
abb92fbf97 x86/irq: Probe for PIC presence before allocating descs for legacy IRQs
commit 8c058b0b9c upstream.

Commit d32932d02e ("x86/irq: Convert IOAPIC to use hierarchical irqdomain
interfaces") brought a regression for Hyper-V Gen2 instances. These
instances don't have i8259 legacy PIC but they use legacy IRQs for serial
port, rtc, and acpi. With this commit included we end up with these IRQs
not initialized. Earlier, there was a special workaround for legacy IRQs
in mp_map_pin_to_irq() doing mp_irqdomain_map() without looking at
nr_legacy_irqs() and now we fail in __irq_domain_alloc_irqs() when
irq_domain_alloc_descs() returns -EEXIST.

The essence of the issue seems to be that early_irq_init() calls
arch_probe_nr_irqs() to figure out the number of legacy IRQs before
we probe for i8259 and gets 16. Later when init_8259A() is called we switch
to NULL legacy PIC and nr_legacy_irqs() starts to return 0 but we already
have 16 descs allocated.

Solve the issue by separating i8259 probe from init and calling it in
arch_probe_nr_irqs() before we actually use nr_legacy_irqs() information.

Fixes: d32932d02e ("x86/irq: Convert IOAPIC to use hierarchical irqdomain interfaces")
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Cc: Jiang Liu <jiang.liu@linux.intel.com>
Cc: K. Y. Srinivasan <kys@microsoft.com>
Link: http://lkml.kernel.org/r/1446543614-3621-1-git-send-email-vkuznets@redhat.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:18 -05:00
Krzysztof Mazur
268ad525ea x86/setup: Fix low identity map for >= 2GB kernel range
commit 68accac392 upstream.

The commit f5f3497cad extended the low identity mapping. However, if
the kernel uses more than 2 GB (VMSPLIT_2G_OPT or VMSPLIT_1G memory
split), the normal memory mapping is overwritten by the low identity
mapping causing a crash. To avoid overwritting, limit the low identity
map to cover only memory before kernel range (PAGE_OFFSET).

Fixes: f5f3497cad "x86/setup: Extend low identity map to cover whole kernel range
Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Matt Fleming <matt.fleming@intel.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Link: http://lkml.kernel.org/r/1446815916-22105-1-git-send-email-krzysiek@podlesie.net
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:18 -05:00
Eric Northup
971cdbf756 KVM: x86: work around infinite loop in microcode when #AC is delivered
commit 54a20552e1 upstream.

It was found that a guest can DoS a host by triggering an infinite
stream of "alignment check" (#AC) exceptions.  This causes the
microcode to enter an infinite loop where the core never receives
another interrupt.  The host kernel panics pretty quickly due to the
effects (CVE-2015-5307).

Signed-off-by: Eric Northup <digitaleric@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:17 -05:00
Laszlo Ersek
1e143e741d KVM: x86: obey KVM_X86_QUIRK_CD_NW_CLEARED in kvm_set_cr0()
commit 879ae18804 upstream.

Commit b18d5431ac ("KVM: x86: fix CR0.CD virtualization") was
technically correct, but it broke OVMF guests by slowing down various
parts of the firmware.

Commit fb279950ba ("KVM: vmx: obey KVM_QUIRK_CD_NW_CLEARED") quirked the
first function modified by b18d5431ac, vmx_get_mt_mask(), for OVMF's
sake. This restored the speed of the OVMF code that runs before
PlatformPei (including the memory intensive LZMA decompression in SEC).

This patch extends the quirk to the second function modified by
b18d5431ac, kvm_set_cr0(). It eliminates the intrusive slowdown that
hits the EFI_MP_SERVICES_PROTOCOL implementation of edk2's
UefiCpuPkg/CpuDxe -- which is built into OVMF --, when CpuDxe starts up
all APs at once for initialization, in order to count them.

We also carry over the kvm_arch_has_noncoherent_dma() sub-condition from
the other half of the original commit b18d5431ac.

Fixes: b18d5431ac
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Tested-by: Janusz Mocek <januszmk6@gmail.com>
Signed-off-by: Laszlo Ersek <lersek@redhat.com>#
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:17 -05:00
Paolo Bonzini
15978cabaa KVM: x86: allow RSM from 64-bit mode
commit 89651a3dec upstream.

The SDM says that exiting system management mode from 64-bit mode
is invalid, but that would be too good to be true.  But actually,
most of the code is already there to support exiting from compat
mode (EFER.LME=1, EFER.LMA=0).  Getting all the way from 64-bit
mode to real mode only requires clearing CS.L and CR4.PCIDE.

Fixes: 660a5d517a
Tested-by: Laszlo Ersek <lersek@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:17 -05:00
Radim Krčmář
b6b8b23bd7 KVM: x86: handle SMBASE as physical address in RSM
commit f40606b147 upstream.

GET_SMSTATE depends on real mode to ensure that smbase+offset is treated
as a physical address, which has already caused a bug after shuffling
the code.  Enforce physical addressing.

Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Reported-by: Laszlo Ersek <lersek@redhat.com>
Tested-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:17 -05:00
Radim Krčmář
bead1229f8 KVM: x86: add read_phys to x86_emulate_ops
commit 7a036a6f67 upstream.

We want to read the physical memory when emulating RSM.

X86EMUL_IO_NEEDED is returned on all errors for consistency with other
helpers.

Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Tested-by: Laszlo Ersek <lersek@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:16 -05:00
Paolo Bonzini
ff3a8601b8 kvm: x86: zero EFER on INIT
commit 5690891bce upstream.

Not zeroing EFER means that a 32-bit firmware cannot enter paging mode
without clearing EFER.LME first (which it should not know about).
Yang Zhang from Intel confirmed that the manual is wrong and EFER is
cleared to zero on INIT.

Fixes: d28bc9dd25
Cc: Yang Z Zhang <yang.z.zhang@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:16 -05:00
Radim Krčmář
2bb00c9086 kvm: x86: set KVM_REQ_EVENT when updating IRR
commit c77f3fab44 upstream.

After moving PIR to IRR, the interrupt needs to be delivered manually.

Reported-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:16 -05:00
James Hogan
40b295b30e MIPS: KVM: Uninit VCPU in vcpu_create error path
commit 585bb8f9a5 upstream.

If either of the memory allocations in kvm_arch_vcpu_create() fail, the
vcpu which has been allocated and kvm_vcpu_init'd doesn't get uninit'd
in the error handling path. Add a call to kvm_vcpu_uninit() to fix this.

Fixes: 669e846e6c ("KVM/MIPS32: MIPS arch specific APIs for KVM")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Gleb Natapov <gleb@kernel.org>
Cc: linux-mips@linux-mips.org
Cc: kvm@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:15 -05:00
James Hogan
58e3361f14 MIPS: KVM: Fix CACHE immediate offset sign extension
commit c5c2a3b998 upstream.

The immediate field of the CACHE instruction is signed, so ensure that
it gets sign extended by casting it to an int16_t rather than just
masking the low 16 bits.

Fixes: e685c689f3 ("KVM/MIPS32: Privileged instruction/target branch emulation.")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Gleb Natapov <gleb@kernel.org>
Cc: linux-mips@linux-mips.org
Cc: kvm@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:15 -05:00
James Hogan
d169209a98 MIPS: KVM: Fix ASID restoration logic
commit 002374f371 upstream.

ASID restoration on guest resume should determine the guest execution
mode based on the guest Status register rather than bit 30 of the guest
PC.

Fix the two places in locore.S that do this, loading the guest status
from the cop0 area. Note, this assembly is specific to the trap &
emulate implementation of KVM, so it doesn't need to check the
supervisor bit as that mode is not implemented in the guest.

Fixes: b680f70fc1 ("KVM/MIPS32: Entry point for trampolining to...")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Gleb Natapov <gleb@kernel.org>
Cc: linux-mips@linux-mips.org
Cc: kvm@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:14 -05:00
Alban Bedel
e3301b7ef8 MIPS: ath79: Fix the DDR control initialization on ar71xx and ar934x
commit 5011a7e808 upstream.

The DDR control initialization needs to know the SoC type, however
ath79_detect_sys_type() was called after ath79_ddr_ctrl_init().
Reverse the order to fix the DDR control initialization on ar71xx and
ar934x.

Signed-off-by: Alban Bedel <albeu@free.fr>
Cc: Felix Fietkau <nbd@openwrt.org>
Cc: Qais Yousef <qais.yousef@imgtec.com>
Cc: Andrew Bresticker <abrestic@chromium.org>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/11500/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:14 -05:00
James Hogan
c6f3f16ccc MIPS: CDMM: Add builtin_mips_cdmm_driver() macro
commit 1b4a5ddb12 upstream.

Add helper macro builtin_mips_cdmm_driver() for builtin CDMM drivers
that don't do anything special in init and have no exit. The
module_mips_cdmm_driver() helper isn't really appropriate for drivers
that can't be built as a module.

Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jiri Slaby <jslaby@suse.com>
Cc: linux-mips@linux-mips.org
Patchwork: http://patchwork.linux-mips.org/patch/11264/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:14 -05:00
Hauke Mehrtens
9473e288c3 MIPS: lantiq: add clk_round_rate()
commit 4e7d30dba4 upstream.

This adds a basic implementation of clk_round_rate()
The clk_round_rate() function is called by multiple drivers and
subsystems now and the lantiq clk driver is supposed to export this,
but doesn't do so, this causes linking problems like this one:
ERROR: "clk_round_rate" [drivers/media/v4l2-core/videodev.ko] undefined!

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Acked-by: John Crispin <blogic@openwrt.org>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/11358/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:13 -05:00
Arnd Bergmann
aaa46adc35 ARM: pxa: remove incorrect __init annotation on pxa27x_set_pwrmode
commit 54c09889bf upstream.

The z2 machine calls pxa27x_set_pwrmode() in order to power off
the machine, but this function gets discarded early at boot because
it is marked __init, as pointed out by kbuild:

WARNING: vmlinux.o(.text+0x145c4): Section mismatch in reference from the function z2_power_off() to the function .init.text:pxa27x_set_pwrmode()
The function z2_power_off() references
the function __init pxa27x_set_pwrmode().
This is often because z2_power_off lacks a __init
annotation or the annotation of pxa27x_set_pwrmode is wrong.

This removes the __init section modifier to fix rebooting and the
build error.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: ba4a90a6d8 ("ARM: pxa/z2: fix building error of pxa27x_cpu_suspend() no longer available")
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:13 -05:00
Chen-Yu Tsai
2c45565f18 ARM: dts: sun6i: hummingbird: Fix VDD-CPU and VDD-GPU regulator names
commit 976d84fce6 upstream.

The VDD-CPU and VDD-GPU regulators were incorrectly swapped.

Fixes: bab0356122 ("ARM: dts: sun6i: hummingbird: Add AXP221 regulator
       nodes")

Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:13 -05:00
Tony Lindgren
5a089fcb46 ARM: dts: Fix WLAN regression on omap5-uevm
commit 0efc898a9b upstream.

Commit 99f84cae43 ("ARM: dts: add wl12xx/wl18xx bindings") added
device tree bindings for the TI WLAN SDIO on many omap variants.

I recall wondering how come omap5-uevm did not have the WLAN
added and this issue has been bugging me for a while now, and
I finally tracked it down to a bad pinmux regression, and a missing
deferred probe handling for the 32k clock from palmas that's
requested by twl6040.

Basically 392adaf796 ("ARM: dts: omap5-evm: Add mcspi data")
added pin muxing for mcspi4 that conflicts with the onboard
WLAN. While some omap5-uevm don't have WLAN populated, the
pins are not reused for other devices. And as the SDIO bus
should be probed, let's try to enable WLAN by default.

Let's fix the regression and add the WLAN configuration as
done for the other boards in 99f84cae43 ("ARM: dts: add
wl12xx/wl18xx bindings"). And let's use the new MMC pwrseq for
the 32k clock as suggested by Javier Martinez Canillas
<javier@dowhile0.org>.

Note that without a related deferred probe fix for twl6040,
the 32k clock is not initialized if palmas-clk is a module
and twl6040 is built-in.

Let's also use the generic "non-removable" instead of the
legacy "ti,non-removable" property while at it.

And finally, note that omap5 seems to require WAKEUP_EN for
the WLAN GPIO interrupt.

Fixes: 392adaf796 ("ARM: dts: omap5-evm: Add mcspi data")
Cc: Sourav Poddar <sourav.poddar@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:13 -05:00
Marek Szyprowski
f706ac7622 ARM: dts: Add vbus regulator to USB2 phy nodes on exynos3250, exynos4210 and exynos4412 boards
commit 4ae9a4c66c upstream.

Exynos USB2 PHY driver now supports VBUS regulator, so add it to all
boards which have it available. This also fixes commit
7eec126675 ("ARM: dts: Add Maxim 77693 PMIC to exynos4412-trats2"),
which added new regulators to Trats2 board, but without linking them to
the consumers.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Fixes: 7eec126675 ("ARM: dts: Add Maxim 77693 PMIC to exynos4412-trats2")
Signed-off-by: Kukjin Kim <kgene@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:12 -05:00
Patrick Doyle
48d6d4f8e4 ARM: at91: pm: at91_pm_suspend_in_sram() must be 8-byte aligned
commit 5fcf8d1a0e upstream.

fncpy() requires that the source and the destination are both 8-byte
aligned.

Signed-off-by: Patrick Doyle <pdoyle@irobot.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Fixes: d94e688cae ("ARM: at91/pm: move the copying the sram function to the sram initialization phase")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:12 -05:00
Holger Busse
7fbe6208f7 ARM: at91/dt: corrections to i2c1 declaration to sama5d4
commit d1a9c24ad1 upstream.

Correcting the dma declaration for i2c1 dma.

Signed-off-by: Holger Busse <h.busse@kathrein-sachsen.de>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Fixes: 4cc7cdf35c ("ARM: at91/dt: add i2c1 declaration to sama5d4")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:12 -05:00
Dmitry Osipenko
73982e9667 ARM: tegra: paz00: use con_id's to refer GPIO's in gpiod_lookup table
commit e77b675f87 upstream.

Commit 72daceb9a1 ("net: rfkill: gpio: Add default GPIO driver mappings
for ACPI") removed possibility to request GPIO by table index for non-ACPI
platforms without changing its users. As result "shutdown" GPIO request
will fail if request for "reset" GPIO succeeded or "reset" will be
requested instead of "shutdown" if "reset" wasn't defined. Fix it by
making gpiod_lookup_table use con_id's instead of indexes.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Fixes: 72daceb (net: rfkill: gpio: Add default GPIO driver mappings for ACPI)
Acked-by: Alexandre Courbot <acourbot@nvidia.com>
Reviewed-by: Marc Dietrich <marvin24@gmx.de>
Tested-by: Marc Dietrich <marvin24@gmx.de>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:11 -05:00
Peter Chen
c09ea0445e ARM: dts: imx27.dtsi: change the clock information for usb
commit facf47ee6b upstream.

For imx27, it needs three clocks to let the controller work,
the old code is wrong, and usbmisc has not included clock handling
code any more. Without this patch, it will cause below data
abort when accessing usbmisc registers.

usbcore: registered new interface driver usb-storage
Unhandled fault: external abort on non-linefetch (0x008) at 0xf4424600
pgd = c0004000
[f4424600] *pgd=10000452(bad)
Internal error: : 8 [#1] PREEMPT ARM
Modules linked in:
CPU: 0 PID: 1 Comm: swapper Not tainted 4.1.0-next-20150701-dirty #3089
Hardware name: Freescale i.MX27 (Device Tree Support)
task: c7832b60 ti: c783e000 task.ti: c783e000
PC is at usbmisc_imx27_init+0x4c/0xbc
LR is at usbmisc_imx27_init+0x40/0xbc
pc : [<c03cb5c0>]    lr : [<c03cb5b4>]    psr: 60000093
sp : c783fe08  ip : 00000000  fp : 00000000
r10: c0576434  r9 : 0000009c  r8 : c7a773a0
r7 : 01000000  r6 : 60000013  r5 : c7a776f0  r4 : c7a773f0
r3 : f4424600  r2 : 00000000  r1 : 00000001  r0 : 00000001
Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 0005317f  Table: a0004000  DAC: 00000017
Process swapper (pid: 1, stack limit = 0xc783e190)
Stack: (0xc783fe08 to 0xc7840000)

Signed-off-by: Peter Chen <peter.chen@freescale.com>
Reported-by: Fabio Estevam <fabio.estevam@freescale.com>
Tested-by: Fabio Estevam <fabio.estevam@freescale.com>
Acked-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:11 -05:00
Peter Ujfalusi
6b98f5acaa ARM: common: edma: Fix channel parameter for irq callbacks
commit 696d8b70c0 upstream.

In case when the interrupt happened for the second eDMA the channel
number was incorrectly passed to the client driver.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:11 -05:00
Marek Szyprowski
53c5c97174 ARM: 8427/1: dma-mapping: add support for offset parameter in dma_mmap()
commit 7e31210349 upstream.

IOMMU-based dma_mmap() implementation lacked proper support for offset
parameter used in mmap call (it always assumed that mapping starts from
offset zero). This patch adds support for offset parameter to IOMMU-based
implementation.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:10 -05:00
Marek Szyprowski
9837c4f9a0 ARM: 8426/1: dma-mapping: add missing range check in dma_mmap()
commit 371f0f085f upstream.

dma_mmap() function in IOMMU-based dma-mapping implementation lacked
a check for valid range of mmap parameters (offset and buffer size), what
might have caused access beyond the allocated buffer. This patch fixes
this issue.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:10 -05:00
Eric Dumazet
d71ab4e1ef net: fix a race in dst_release()
[ Upstream commit d69bbf88c8 ]

Only cpu seeing dst refcount going to 0 can safely
dereference dst->flags.

Otherwise an other cpu might already have freed the dst.

Fixes: 27b75c95f1 ("net: avoid RCU for NOCACHE dst")
Reported-by: Greg Thelen <gthelen@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:10 -05:00
Jay Vosburgh
1c88ba236f bonding: fix panic on non-ARPHRD_ETHER enslave failure
[ Upstream commit 40baec2257 ]

Since commit 7d5cd2ce529b, when bond_enslave fails on devices that
are not ARPHRD_ETHER, if needed, it resets the bonding device back to
ARPHRD_ETHER by calling ether_setup.

	Unfortunately, ether_setup clobbers dev->flags, clearing IFF_UP
if the bond device is up, leaving it in a quasi-down state without
having actually gone through dev_close.  For bonding, if any periodic
work queue items are active (miimon, arp_interval, etc), those will
remain running, as they are stopped by bond_close.  At this point, if
the bonding module is unloaded or the bond is deleted, the system will
panic when the work function is called.

	This panic is resolved by calling dev_close on the bond itself
prior to calling ether_setup.

Cc: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: Jay Vosburgh <jay.vosburgh@canonical.com>
Fixes: 7d5cd2ce52 ("bonding: correctly handle bonding type change on enslave failure")
Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:10 -05:00
Francesco Ruggeri
1e2d4ae735 packet: race condition in packet_bind
[ Upstream commit 30f7ea1c2b ]

There is a race conditions between packet_notifier and packet_bind{_spkt}.

It happens if packet_notifier(NETDEV_UNREGISTER) executes between the
time packet_bind{_spkt} takes a reference on the new netdevice and the
time packet_do_bind sets po->ifindex.
In this case the notification can be missed.
If this happens during a dev_change_net_namespace this can result in the
netdevice to be moved to the new namespace while the packet_sock in the
old namespace still holds a reference on it. When the netdevice is later
deleted in the new namespace the deletion hangs since the packet_sock
is not found in the new namespace' &net->packet.sklist.
It can be reproduced with the script below.

This patch makes packet_do_bind check again for the presence of the
netdevice in the packet_sock's namespace after the synchronize_net
in unregister_prot_hook.
More in general it also uses the rcu lock for the duration of the bind
to stop dev_change_net_namespace/rollback_registered_many from
going past the synchronize_net following unlist_netdevice, so that
no NETDEV_UNREGISTER notifications can happen on the new netdevice
while the bind is executing. In order to do this some code from
packet_bind{_spkt} is consolidated into packet_do_dev.

import socket, os, time, sys
proto=7
realDev='em1'
vlanId=400
if len(sys.argv) > 1:
   vlanId=int(sys.argv[1])
dev='vlan%d' % vlanId

os.system('taskset -p 0x10 %d' % os.getpid())

s = socket.socket(socket.PF_PACKET, socket.SOCK_RAW, proto)
os.system('ip link add link %s name %s type vlan id %d' %
          (realDev, dev, vlanId))
os.system('ip netns add dummy')

pid=os.fork()

if pid == 0:
   # dev should be moved while packet_do_bind is in synchronize net
   os.system('taskset -p 0x20000 %d' % os.getpid())
   os.system('ip link set %s netns dummy' % dev)
   os.system('ip netns exec dummy ip link del %s' % dev)
   s.close()
   sys.exit(0)

time.sleep(.004)
try:
   s.bind(('%s' % dev, proto+1))
except:
   print 'Could not bind socket'
   s.close()
   os.system('ip netns del dummy')
   sys.exit(0)

os.waitpid(pid, 0)
s.close()
os.system('ip netns del dummy')
sys.exit(0)

Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:09 -05:00
Tobias Klauser
46d85c56f0 tun_dst: Fix potential NULL dereference
[ Upstream commit f63ce5b6fa ]

In tun_dst_unclone() the return value of skb_metadata_dst() is checked
for being NULL after it is dereferenced. Fix this by moving the
dereference after the NULL check.

Found by the Coverity scanner (CID 1338068).

Fixes: fc4099f172 ("openvswitch: Fix egress tunnel info.")
Cc: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:09 -05:00
David Ahern
0c04f7b0d0 net: Fix prefsrc lookups
[ Upstream commit e1b8d903c6 ]

A bug report (https://bugzilla.kernel.org/show_bug.cgi?id=107071) noted
that the follwoing ip command is failing with v4.3:

    $ ip route add 10.248.5.0/24 dev bond0.250 table vlan_250 src 10.248.5.154
    RTNETLINK answers: Invalid argument

021dd3b8a1 changed the lookup of the given preferred source address to
use the table id passed in, but this assumes the local entries are in the
given table which is not necessarily true for non-VRF use cases. When
validating the preferred source fallback to the local table on failure.

Fixes: 021dd3b8a1 ("net: Add routes to the table associated with the device")
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:09 -05:00
WANG Cong
10b1965171 ipv4: disable BH when changing ip local port range
[ Upstream commit 4ee3bd4a8c ]

This fixes the following lockdep warning:

 [ INFO: inconsistent lock state ]
 4.3.0-rc7+ #1197 Not tainted
 ---------------------------------
 inconsistent {IN-SOFTIRQ-R} -> {SOFTIRQ-ON-W} usage.
 sysctl/1019 [HC0[0]:SC0[0]:HE1:SE1] takes:
  (&(&net->ipv4.ip_local_ports.lock)->seqcount){+.+-..}, at: [<ffffffff81921de7>] ipv4_local_port_range+0xb4/0x12a
 {IN-SOFTIRQ-R} state was registered at:
   [<ffffffff810bd682>] __lock_acquire+0x2f6/0xdf0
   [<ffffffff810be6d5>] lock_acquire+0x11c/0x1a4
   [<ffffffff818e599c>] inet_get_local_port_range+0x4e/0xae
   [<ffffffff8166e8e3>] udp_flow_src_port.constprop.40+0x23/0x116
   [<ffffffff81671cb9>] vxlan_xmit_one+0x219/0xa6a
   [<ffffffff81672f75>] vxlan_xmit+0xa6b/0xaa5
   [<ffffffff817f2deb>] dev_hard_start_xmit+0x2ae/0x465
   [<ffffffff817f35ed>] __dev_queue_xmit+0x531/0x633
   [<ffffffff817f3702>] dev_queue_xmit_sk+0x13/0x15
   [<ffffffff818004a5>] neigh_resolve_output+0x12f/0x14d
   [<ffffffff81959cfa>] ip6_finish_output2+0x344/0x39f
   [<ffffffff8195bf58>] ip6_finish_output+0x88/0x8e
   [<ffffffff8195bfef>] ip6_output+0x91/0xe5
   [<ffffffff819792ae>] dst_output_sk+0x47/0x4c
   [<ffffffff81979392>] NF_HOOK_THRESH.constprop.30+0x38/0x82
   [<ffffffff8197981e>] mld_sendpack+0x189/0x266
   [<ffffffff8197b28b>] mld_ifc_timer_expire+0x1ef/0x223
   [<ffffffff810de581>] call_timer_fn+0xfb/0x28c
   [<ffffffff810ded1e>] run_timer_softirq+0x1c7/0x1f1

Fixes: b8f1a55639 ("udp: Add function to make source port for UDP tunnels")
Cc: Tom Herbert <tom@herbertland.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:09 -05:00
Sabrina Dubroca
35b2aa1c3c ipv6: clean up dev_snmp6 proc entry when we fail to initialize inet6_dev
[ Upstream commit 2a189f9e57 ]

In ipv6_add_dev, when addrconf_sysctl_register fails, we do not clean up
the dev_snmp6 entry that we have already registered for this device.
Call snmp6_unregister_dev in this case.

Fixes: a317a2f19d ("ipv6: fail early when creating netdev named all or default")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:09 -05:00
Eric Dumazet
2e05a9e795 net: avoid NULL deref in inet_ctl_sock_destroy()
[ Upstream commit 8fa677d270 ]

Under low memory conditions, tcp_sk_init() and icmp_sk_init()
can both iterate on all possible cpus and call inet_ctl_sock_destroy(),
with eventual NULL pointer.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:08 -05:00
Martin Habets
c555478720 sfc: push partner queue for skb->xmit_more
[ Upstream commit b2663a4f30 ]

When the IP stack passes SKBs the sfc driver puts them in 2 different TX
queues (called partners), one for checksummed and one for not checksummed.
If the SKB has xmit_more set the driver will delay pushing the work to the
NIC.

When later it does decide to push the buffers this patch ensures it also
pushes the partner queue, if that also has any delayed work. Before this
fix the work in the partner queue would be left for a long time and cause
a netdev watchdog.

Fixes: 70b33fb ("sfc: add support for skb->xmit_more")
Reported-by: Jianlin Shi <jishi@redhat.com>
Signed-off-by: Martin Habets <mhabets@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:08 -05:00
Eric Dumazet
684d640a5b sit: fix sit0 percpu double allocations
[ Upstream commit 4ece900977 ]

sit0 device allocates its percpu storage twice :
- One time in ipip6_tunnel_init()
- One time in ipip6_fb_tunnel_init()

Thus we leak 48 bytes per possible cpu per network namespace dismantle.

ipip6_fb_tunnel_init() can be much simpler and does not
return an error, and should be called after register_netdev()

Note that ipip6_tunnel_clone_6rd() also needs to be called
after register_netdev() (calling ipip6_tunnel_init())

Fixes: ebe084aafb ("sit: Use ipip6_tunnel_init as the ndo_init function.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:08 -05:00
Ani Sinha
e02e04ff60 ipmr: fix possible race resulting from improper usage of IP_INC_STATS_BH() in preemptible context.
[ Upstream commit 44f49dd8b5 ]

Fixes the following kernel BUG :

BUG: using __this_cpu_add() in preemptible [00000000] code: bash/2758
caller is __this_cpu_preempt_check+0x13/0x15
CPU: 0 PID: 2758 Comm: bash Tainted: P           O   3.18.19 #2
 ffffffff8170eaca ffff880110d1b788 ffffffff81482b2a 0000000000000000
 0000000000000000 ffff880110d1b7b8 ffffffff812010ae ffff880007cab800
 ffff88001a060800 ffff88013a899108 ffff880108b84240 ffff880110d1b7c8
Call Trace:
[<ffffffff81482b2a>] dump_stack+0x52/0x80
[<ffffffff812010ae>] check_preemption_disabled+0xce/0xe1
[<ffffffff812010d4>] __this_cpu_preempt_check+0x13/0x15
[<ffffffff81419d60>] ipmr_queue_xmit+0x647/0x70c
[<ffffffff8141a154>] ip_mr_forward+0x32f/0x34e
[<ffffffff8141af76>] ip_mroute_setsockopt+0xe03/0x108c
[<ffffffff810553fc>] ? get_parent_ip+0x11/0x42
[<ffffffff810e6974>] ? pollwake+0x4d/0x51
[<ffffffff81058ac0>] ? default_wake_function+0x0/0xf
[<ffffffff810553fc>] ? get_parent_ip+0x11/0x42
[<ffffffff810613d9>] ? __wake_up_common+0x45/0x77
[<ffffffff81486ea9>] ? _raw_spin_unlock_irqrestore+0x1d/0x32
[<ffffffff810618bc>] ? __wake_up_sync_key+0x4a/0x53
[<ffffffff8139a519>] ? sock_def_readable+0x71/0x75
[<ffffffff813dd226>] do_ip_setsockopt+0x9d/0xb55
[<ffffffff81429818>] ? unix_seqpacket_sendmsg+0x3f/0x41
[<ffffffff813963fe>] ? sock_sendmsg+0x6d/0x86
[<ffffffff813959d4>] ? sockfd_lookup_light+0x12/0x5d
[<ffffffff8139650a>] ? SyS_sendto+0xf3/0x11b
[<ffffffff810d5738>] ? new_sync_read+0x82/0xaa
[<ffffffff813ddd19>] compat_ip_setsockopt+0x3b/0x99
[<ffffffff813fb24a>] compat_raw_setsockopt+0x11/0x32
[<ffffffff81399052>] compat_sock_common_setsockopt+0x18/0x1f
[<ffffffff813c4d05>] compat_SyS_setsockopt+0x1a9/0x1cf
[<ffffffff813c4149>] compat_SyS_socketcall+0x180/0x1e3
[<ffffffff81488ea1>] cstar_dispatch+0x7/0x1e

Signed-off-by: Ani Sinha <ani@arista.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:08 -05:00
Phil Reid
b8f93a05cb stmmac: Correctly report PTP capabilities.
[ Upstream commit e6dbe1eb2d ]

priv->hwts_*_en indicate if timestamping is enabled/disabled at run
time. But  priv->dma_cap.time_stamp  and priv->dma_cap.atime_stamp
indicates HW is support for PTPv1/PTPv2.

Signed-off-by: Phil Reid <preid@electromag.com.au>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:07 -05:00
Julian Anastasov
7b4d18bbbd ipv4: update RTNH_F_LINKDOWN flag on UP event
[ Upstream commit c9b3292eeb ]

When nexthop is part of multipath route we should clear the
LINKDOWN flag when link goes UP or when first address is added.
This is needed because we always set LINKDOWN flag when DEAD flag
was set but now on UP the nexthop is not dead anymore. Examples when
LINKDOWN bit can be forgotten when no NETDEV_CHANGE is delivered:

- link goes down (LINKDOWN is set), then link goes UP and device
shows carrier OK but LINKDOWN remains set

- last address is deleted (LINKDOWN is set), then address is
added and device shows carrier OK but LINKDOWN remains set

Steps to reproduce:
modprobe dummy
ifconfig dummy0 192.168.168.1 up

here add a multipath route where one nexthop is for dummy0:

ip route add 1.2.3.4 nexthop dummy0 nexthop SOME_OTHER_DEVICE
ifconfig dummy0 down
ifconfig dummy0 up

now ip route shows nexthop that is not dead. Now set the sysctl var:

echo 1 > /proc/sys/net/ipv4/conf/dummy0/ignore_routes_with_linkdown

now ip route will show a dead nexthop because the forgotten
RTNH_F_LINKDOWN is propagated as RTNH_F_DEAD.

Fixes: 8a3d03166f ("net: track link-status of ipv4 nexthops")
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:07 -05:00
Julian Anastasov
795d2a6ddb ipv4: fix to not remove local route on link down
[ Upstream commit 4f823defdd ]

When fib_netdev_event calls fib_disable_ip on NETDEV_DOWN event
we should not delete the local routes if the local address
is still present. The confusion comes from the fact that both
fib_netdev_event and fib_inetaddr_event use the NETDEV_DOWN
constant. Fix it by returning back the variable 'force'.

Steps to reproduce:
modprobe dummy
ifconfig dummy0 192.168.168.1 up
ifconfig dummy0 down
ip route list table local | grep dummy | grep host
local 192.168.168.1 dev dummy0  proto kernel  scope host  src 192.168.168.1

Fixes: 8a3d03166f ("net: track link-status of ipv4 nexthops")
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:07 -05:00
Florian Fainelli
cfb2f132a8 net: bcmgenet: Software reset EPHY after power on
[ Upstream commit 5dbebbb44a ]

The EPHY on GENET v1->v3 is extremely finicky, and will show occasional
failures based on the timing and reset sequence, ranging from duplicate
packets, to extremely high latencies.

Perform an additional software reset, and re-configuration to make sure it is
in a consistent and working state.

Fixes: 6ac3ce8295 ("net: bcmgenet: Remove excessive PHY reset")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:07 -05:00
Jon Paul Maloy
1f9ba7bc8b tipc: linearize arriving NAME_DISTR and LINK_PROTO buffers
[ Upstream commit 5cbb28a4bf ]

Testing of the new UDP bearer has revealed that reception of
NAME_DISTRIBUTOR, LINK_PROTOCOL/RESET and LINK_PROTOCOL/ACTIVATE
message buffers is not prepared for the case that those may be
non-linear.

We now linearize all such buffers before they are delivered up to the
generic reception layer.

In order for the commit to apply cleanly to 'net' and 'stable', we do
the change in the function tipc_udp_recv() for now. Later, we will post
a commit to 'net-next' moving the linearization to generic code, in
tipc_named_rcv() and tipc_link_proto_rcv().

Fixes: commit d0f91938be ("tipc: add ip/udp media type")
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:06 -05:00
Bjørn Mork
0bbb0285d4 USB: qcserial: add Sierra Wireless MC74xx/EM74xx
commit f504ab1888 upstream.

New device IDs shamelessly lifted from the vendor driver.

Signed-off-by: Bjørn Mork <bjorn@mork.no>
Acked-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:06 -05:00
H. Nikolaus Schaller
7585db5b76 ARM: 8449/1: fix bug in vdsomunge swab32 macro
commit 38850d786a upstream.

Commit 8a603f91cc ("ARM: 8445/1: fix vdsomunge not to depend on
glibc specific byteswap.h") unfortunately introduced a bug created but
not found during discussion and patch simplification.

Reported-by: Efraim Yawitz <efraim.yawitz@gmail.com>
Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Fixes: 8a603f91cc ("ARM: 8445/1: fix vdsomunge not to depend on glibc specific byteswap.h")
Signed-off-by: Nathan Lynch <nathan_lynch@mentor.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2015-12-09 14:34:06 -05:00
847 changed files with 303875 additions and 4179 deletions

View File

@@ -0,0 +1,45 @@
Broadcom BCM2835 CPRMAN clocks
This binding uses the common clock binding:
Documentation/devicetree/bindings/clock/clock-bindings.txt
The CPRMAN clock controller generates clocks in the audio power domain
of the BCM2835. There is a level of PLLs deriving from an external
oscillator, a level of PLL dividers that produce channels off of the
few PLLs, and a level of mostly-generic clock generators sourcing from
the PLL channels. Most other hardware components source from the
clock generators, but a few (like the ARM or HDMI) will source from
the PLL dividers directly.
Required properties:
- compatible: Should be "brcm,bcm2835-cprman"
- #clock-cells: Should be <1>. The permitted clock-specifier values can be
found in include/dt-bindings/clock/bcm2835.h
- reg: Specifies base physical address and size of the registers
- clocks: The external oscillator clock phandle
Example:
clk_osc: clock@3 {
compatible = "fixed-clock";
reg = <3>;
#clock-cells = <0>;
clock-output-names = "osc";
clock-frequency = <19200000>;
};
clocks: cprman@7e101000 {
compatible = "brcm,bcm2835-cprman";
#clock-cells = <1>;
reg = <0x7e101000 0x2000>;
clocks = <&clk_osc>;
};
i2c0: i2c@7e205000 {
compatible = "brcm,bcm2835-i2c";
reg = <0x7e205000 0x1000>;
interrupts = <2 21>;
clocks = <&clocks BCM2835_CLOCK_VPU>;
#address-cells = <1>;
#size-cells = <0>;
};

View File

@@ -0,0 +1,65 @@
Broadcom VC4 (VideoCore4) GPU
The VC4 device present on the Raspberry Pi includes a display system
with HDMI output and the HVS (Hardware Video Scaler) for compositing
display planes.
Required properties for VC4:
- compatible: Should be "brcm,bcm2835-vc4"
Required properties for Pixel Valve:
- compatible: Should be one of "brcm,bcm2835-pixelvalve0",
"brcm,bcm2835-pixelvalve1", or "brcm,bcm2835-pixelvalve2"
- reg: Physical base address and length of the PV's registers
- interrupts: The interrupt number
See bindings/interrupt-controller/brcm,bcm2835-armctrl-ic.txt
Required properties for HVS:
- compatible: Should be "brcm,bcm2835-hvs"
- reg: Physical base address and length of the HVS's registers
- interrupts: The interrupt number
See bindings/interrupt-controller/brcm,bcm2835-armctrl-ic.txt
Required properties for HDMI
- compatible: Should be "brcm,bcm2835-hdmi"
- reg: Physical base address and length of the two register ranges
("HDMI" and "HD", in that order)
- interrupts: The interrupt numbers
See bindings/interrupt-controller/brcm,bcm2835-armctrl-ic.txt
- ddc: phandle of the I2C controller used for DDC EDID probing
- clocks: a) hdmi: The HDMI state machine clock
b) pixel: The pixel clock.
Optional properties for HDMI:
- hpd-gpio: The GPIO pin for HDMI hotplug detect (if it doesn't appear
as an interrupt/status bit in the HDMI controller
itself). See bindings/pinctrl/brcm,bcm2835-gpio.txt
Example:
pixelvalve@7e807000 {
compatible = "brcm,bcm2835-pixelvalve2";
reg = <0x7e807000 0x100>;
interrupts = <2 10>; /* pixelvalve */
};
hvs@7e400000 {
compatible = "brcm,bcm2835-hvs";
reg = <0x7e400000 0x6000>;
interrupts = <2 1>;
};
hdmi: hdmi@7e902000 {
compatible = "brcm,bcm2835-hdmi";
reg = <0x7e902000 0x600>,
<0x7e808000 0x100>;
interrupts = <2 8>, <2 9>;
ddc = <&i2c2>;
hpd-gpio = <&gpio 46 GPIO_ACTIVE_HIGH>;
clocks = <&clocks BCM2835_PLLH_PIX>,
<&clocks BCM2835_CLOCK_HSM>;
clock-names = "pixel", "hdmi";
};
vc4: gpu@7e4c0000 {
compatible = "brcm,bcm2835-vc4";
};

View File

@@ -48,8 +48,8 @@ Example:
bcm2835_i2s: i2s@7e203000 { bcm2835_i2s: i2s@7e203000 {
compatible = "brcm,bcm2835-i2s"; compatible = "brcm,bcm2835-i2s";
reg = < 0x7e203000 0x20>, reg = < 0x7e203000 0x24>,
< 0x7e101098 0x02>; < 0x7e101098 0x08>;
dmas = <&dma 2>, dmas = <&dma 2>,
<&dma 3>; <&dma 3>;

View File

@@ -0,0 +1,35 @@
* FocalTech FT6236 I2C touchscreen controller
Required properties:
- compatible : "focaltech,ft6236"
- reg : I2C slave address of the chip (0x38)
- interrupt-parent : a phandle pointing to the interrupt controller
serving the interrupt for this chip
- interrupts : interrupt specification for the touch controller
interrupt
- reset-gpios : GPIO specification for the RSTN input
- touchscreen-size-x : horizontal resolution of touchscreen (in pixels)
- touchscreen-size-y : vertical resolution of touchscreen (in pixels)
Optional properties:
- touchscreen-fuzz-x : horizontal noise value of the absolute input
device (in pixels)
- touchscreen-fuzz-y : vertical noise value of the absolute input
device (in pixels)
- touchscreen-inverted-x : X axis is inverted (boolean)
- touchscreen-inverted-y : Y axis is inverted (boolean)
- touchscreen-swapped-x-y: X and Y axis are swapped (boolean)
Swapping is done after inverting the axis
Example:
ft6x06@38 {
compatible = "focaltech,ft6236";
reg = <0x38>;
interrupt-parent = <&gpio>;
interrupts = <23 2>;
touchscreen-size-x = <320>;
touchscreen-size-y = <480>;
touchscreen-inverted-x;
touchscreen-swapped-x-y;
};

View File

@@ -0,0 +1,17 @@
* Broadcom BCM2835 SMI character device driver.
SMI or secondary memory interface is a peripheral specific to certain Broadcom
SOCs, and is helpful for talking to things like parallel-interface displays
and NAND flashes (in fact, most things with a parallel register interface).
This driver adds a character device which provides a user-space interface to
an instance of the SMI driver.
Required properties:
- compatible: "brcm,bcm2835-smi-dev"
- smi_handle: a phandle to the smi node.
Optional properties:
- None.

View File

@@ -0,0 +1,48 @@
* Broadcom BCM2835 SMI driver.
SMI or secondary memory interface is a peripheral specific to certain Broadcom
SOCs, and is helpful for talking to things like parallel-interface displays
and NAND flashes (in fact, most things with a parallel register interface).
Required properties:
- compatible: "brcm,bcm2835-smi"
- reg: Should contain location and length of SMI registers and SMI clkman regs
- interrupts: *the* SMI interrupt.
- pinctrl-names: should be "default".
- pinctrl-0: the phandle of the gpio pin node.
- brcm,smi-clock-source: the clock source for clkman
- brcm,smi-clock-divisor: the integer clock divisor for clkman
- dmas: the dma controller phandle and the DREQ number (4 on a 2835)
- dma-names: the name used by the driver to request its channel.
Should be "rx-tx".
Optional properties:
- None.
Examples:
8 data pin configuration:
smi: smi@7e600000 {
compatible = "brcm,bcm2835-smi";
reg = <0x7e600000 0x44>, <0x7e1010b0 0x8>;
interrupts = <2 16>;
pinctrl-names = "default";
pinctrl-0 = <&smi_pins>;
brcm,smi-clock-source = <6>;
brcm,smi-clock-divisor = <4>;
dmas = <&dma 4>;
dma-names = "rx-tx";
status = "okay";
};
smi_pins: smi_pins {
brcm,pins = <2 3 4 5 6 7 8 9 10 11 12 13 14 15>;
/* Alt 1: SMI */
brcm,function = <5 5 5 5 5 5 5 5 5 5 5 5 5 5>;
/* /CS, /WE and /OE are pulled high, as they are
generally active low signals */
brcm,pull = <2 2 2 2 2 2 0 0 0 0 0 0 0 0>;
};

View File

@@ -0,0 +1,42 @@
* BCM2835 SMI NAND flash
This driver is a shim between the BCM2835 SMI driver (SMI is a peripheral for
talking to parallel register interfaces) and Linux's MTD layer.
Required properties:
- compatible: "brcm,bcm2835-smi-nand"
- status: "okay"
Optional properties:
- partition@n, where n is an integer from a consecutive sequence starting at 0
- Difficult to store partition table on NAND device - normally put it
in the source code, kernel bootparams, or device tree (the best way!)
- Sub-properties:
- label: the partition name, as shown by mtdinfo /dev/mtd*
- reg: the size and offset of this partition.
- (optional) read-only: an empty property flagging as read only
Example:
nand: flash@0 {
compatible = "brcm,bcm2835-smi-nand";
status = "okay";
partition@0 {
label = "stage2";
// 128k
reg = <0 0x20000>;
read-only;
};
partition@1 {
label = "firmware";
// 16M
reg = <0x20000 0x1000000>;
read-only;
};
partition@2 {
label = "root";
// 2G
reg = <0x1020000 0x80000000>;
};
};

View File

@@ -16,8 +16,8 @@ Example:
bcm2835_i2s: i2s@7e203000 { bcm2835_i2s: i2s@7e203000 {
compatible = "brcm,bcm2835-i2s"; compatible = "brcm,bcm2835-i2s";
reg = <0x7e203000 0x20>, reg = <0x7e203000 0x24>,
<0x7e101098 0x02>; <0x7e101098 0x08>;
dmas = <&dma 2>, dmas = <&dma 2>,
<&dma 3>; <&dma 3>;

View File

@@ -35,6 +35,8 @@ Optional properties:
LTSSM during USB3 Compliance mode. LTSSM during USB3 Compliance mode.
- snps,dis_u3_susphy_quirk: when set core will disable USB3 suspend phy. - snps,dis_u3_susphy_quirk: when set core will disable USB3 suspend phy.
- snps,dis_u2_susphy_quirk: when set core will disable USB2 suspend phy. - snps,dis_u2_susphy_quirk: when set core will disable USB2 suspend phy.
- snps,dis_enblslpm_quirk: when set clears the enblslpm in GUSB2PHYCFG,
disabling the suspend signal to the PHY.
- snps,is-utmi-l1-suspend: true when DWC3 asserts output signal - snps,is-utmi-l1-suspend: true when DWC3 asserts output signal
utmi_l1_suspend_n, false when asserts utmi_sleep_n utmi_l1_suspend_n, false when asserts utmi_sleep_n
- snps,hird-threshold: HIRD threshold - snps,hird-threshold: HIRD threshold

View File

@@ -82,6 +82,7 @@ everspin Everspin Technologies, Inc.
excito Excito excito Excito
fcs Fairchild Semiconductor fcs Fairchild Semiconductor
firefly Firefly firefly Firefly
focaltech FocalTech Systems Co.,Ltd
fsl Freescale Semiconductor fsl Freescale Semiconductor
GEFanuc GE Fanuc Intelligent Platforms Embedded Systems, Inc. GEFanuc GE Fanuc Intelligent Platforms Embedded Systems, Inc.
gef GE Fanuc Intelligent Platforms Embedded Systems, Inc. gef GE Fanuc Intelligent Platforms Embedded Systems, Inc.

View File

@@ -140,7 +140,8 @@ Table 1-1: Process specific entries in /proc
stat Process status stat Process status
statm Process memory status information statm Process memory status information
status Process status in human readable form status Process status in human readable form
wchan If CONFIG_KALLSYMS is set, a pre-decoded wchan wchan Present with CONFIG_KALLSYMS=y: it shows the kernel function
symbol the task is blocked in - or "0" if not blocked.
pagemap Page table pagemap Page table
stack Report full stack trace, enable via CONFIG_STACKTRACE stack Report full stack trace, enable via CONFIG_STACKTRACE
smaps a extension based on maps, showing the memory consumption of smaps a extension based on maps, showing the memory consumption of
@@ -310,7 +311,7 @@ Table 1-4: Contents of the stat files (as of 2.6.30-rc7)
blocked bitmap of blocked signals blocked bitmap of blocked signals
sigign bitmap of ignored signals sigign bitmap of ignored signals
sigcatch bitmap of caught signals sigcatch bitmap of caught signals
wchan address where process went to sleep 0 (place holder, used to be the wchan address, use /proc/PID/wchan instead)
0 (place holder) 0 (place holder)
0 (place holder) 0 (place holder)
exit_signal signal to send to parent thread on exit exit_signal signal to send to parent thread on exit

View File

@@ -0,0 +1,60 @@
BCM2835 (aka Raspberry Pi) V4L2 driver
======================================
1. Copyright
============
Copyright © 2013 Raspberry Pi (Trading) Ltd.
2. License
==========
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
3. Quick Start
==============
You need a version 1.0 or later of v4l2-ctl, available from:
git://git.linuxtv.org/v4l-utils.git
$ sudo modprobe bcm2835-v4l2
Turn on the overlay:
$ v4l2-ctl --overlay=1
Turn off the overlay:
$ v4l2-ctl --overlay=0
Set the capture format for video:
$ v4l2-ctl --set-fmt-video=width=1920,height=1088,pixelformat=4
(Note: 1088 not 1080).
Capture:
$ v4l2-ctl --stream-mmap=3 --stream-count=100 --stream-to=somefile.h264
Stills capture:
$ v4l2-ctl --set-fmt-video=width=2592,height=1944,pixelformat=3
$ v4l2-ctl --stream-mmap=3 --stream-count=1 --stream-to=somefile.jpg
List of available formats:
$ v4l2-ctl --list-formats

View File

@@ -1,6 +1,6 @@
VERSION = 4 VERSION = 4
PATCHLEVEL = 3 PATCHLEVEL = 3
SUBLEVEL = 0 SUBLEVEL = 3
EXTRAVERSION = EXTRAVERSION =
NAME = Blurry Fish Butt NAME = Blurry Fish Butt

View File

@@ -315,6 +315,49 @@ choice
default ARCH_VERSATILE if !MMU default ARCH_VERSATILE if !MMU
default ARCH_MULTIPLATFORM if MMU default ARCH_MULTIPLATFORM if MMU
config ARCH_BCM2708
bool "Broadcom BCM2708 family"
select CPU_V6
select ARM_AMBA
select CLKSRC_MMIO
select CLKSRC_OF if OF
select HAVE_SCHED_CLOCK
select NEED_MACH_GPIO_H
select NEED_MACH_MEMORY_H
select COMMON_CLK
select ARCH_HAS_CPUFREQ
select GENERIC_CLOCKEVENTS
select ARM_ERRATA_411920
select MACH_BCM2708
select MULTI_IRQ_HANDLER
select SPARSE_IRQ
select VC4
select FIQ
help
This enables support for Broadcom BCM2708 boards.
config ARCH_BCM2709
bool "Broadcom BCM2709 family"
select CPU_V7
select HAVE_SMP
select ARM_AMBA
select MIGHT_HAVE_CACHE_L2X0
select HAVE_SCHED_CLOCK
select NEED_MACH_MEMORY_H
select NEED_MACH_IO_H
select COMMON_CLK
select ARCH_HAS_CPUFREQ
select GENERIC_CLOCKEVENTS
select MACH_BCM2709
select VC4
select FIQ
select USE_OF
select ARCH_REQUIRE_GPIOLIB
select PINCTRL
select PINCTRL_BCM2835
help
This enables support for Broadcom BCM2709 boards.
config ARCH_MULTIPLATFORM config ARCH_MULTIPLATFORM
bool "Allow multiple platforms to be selected" bool "Allow multiple platforms to be selected"
depends on MMU depends on MMU
@@ -828,6 +871,9 @@ config ARCH_VIRT
# Kconfigs may be included either alphabetically (according to the # Kconfigs may be included either alphabetically (according to the
# plat- suffix) or along side the corresponding mach-* source. # plat- suffix) or along side the corresponding mach-* source.
# #
source "arch/arm/mach-bcm2708/Kconfig"
source "arch/arm/mach-bcm2709/Kconfig"
source "arch/arm/mach-mvebu/Kconfig" source "arch/arm/mach-mvebu/Kconfig"
source "arch/arm/mach-alpine/Kconfig" source "arch/arm/mach-alpine/Kconfig"

View File

@@ -1247,6 +1247,14 @@ choice
options; the platform specific options are deprecated options; the platform specific options are deprecated
and will be soon removed. and will be soon removed.
config DEBUG_BCM2708_UART0
bool "Broadcom BCM270X UART0 (PL011)"
depends on ARCH_BCM2708 || ARCH_BCM2709
help
Say Y here if you want the debug print routines to direct
their output to UART 0. The port must have been initialised
by the boot-loader before use.
endchoice endchoice
config DEBUG_AT91_UART config DEBUG_AT91_UART

View File

@@ -154,6 +154,8 @@ textofs-$(CONFIG_ARCH_AXXIA) := 0x00308000
# Machine directory name. This list is sorted alphanumerically # Machine directory name. This list is sorted alphanumerically
# by CONFIG_* macro name. # by CONFIG_* macro name.
machine-$(CONFIG_ARCH_BCM2708) += bcm2708
machine-$(CONFIG_ARCH_BCM2709) += bcm2709
machine-$(CONFIG_ARCH_ALPINE) += alpine machine-$(CONFIG_ARCH_ALPINE) += alpine
machine-$(CONFIG_ARCH_AT91) += at91 machine-$(CONFIG_ARCH_AT91) += at91
machine-$(CONFIG_ARCH_AXXIA) += axxia machine-$(CONFIG_ARCH_AXXIA) += axxia

View File

@@ -1,5 +1,26 @@
ifeq ($(CONFIG_OF),y) ifeq ($(CONFIG_OF),y)
dtb-$(CONFIG_ARCH_BCM2708) += bcm2708-rpi-b.dtb
dtb-$(CONFIG_ARCH_BCM2708) += bcm2708-rpi-b-plus.dtb
dtb-$(CONFIG_ARCH_BCM2708) += bcm2708-rpi-cm.dtb
dtb-$(CONFIG_ARCH_BCM2835) += bcm2835-rpi-cm.dtb
dtb-$(CONFIG_ARCH_BCM2709) += bcm2709-rpi-2-b.dtb
dtb-$(CONFIG_ARCH_BCM2709) += bcm2710-rpi-3-b.dtb
# Raspberry Pi
ifeq ($(CONFIG_ARCH_BCM2708),y)
RPI_DT_OVERLAYS=y
endif
ifeq ($(CONFIG_ARCH_BCM2709),y)
RPI_DT_OVERLAYS=y
endif
ifeq ($(CONFIG_ARCH_BCM2835),y)
RPI_DT_OVERLAYS=y
endif
ifeq ($(RPI_DT_OVERLAYS),y)
dts-dirs += overlays
endif
dtb-$(CONFIG_ARCH_ALPINE) += \ dtb-$(CONFIG_ARCH_ALPINE) += \
alpine-db.dtb alpine-db.dtb
dtb-$(CONFIG_MACH_ASM9260) += \ dtb-$(CONFIG_MACH_ASM9260) += \
@@ -738,7 +759,17 @@ dtb-$(CONFIG_ARCH_MEDIATEK) += \
mt8127-moose.dtb \ mt8127-moose.dtb \
mt8135-evbp1.dtb mt8135-evbp1.dtb
dtb-$(CONFIG_ARCH_ZX) += zx296702-ad1.dtb dtb-$(CONFIG_ARCH_ZX) += zx296702-ad1.dtb
targets += dtbs dtbs_install
targets += $(dtb-y)
endif endif
always := $(dtb-y) always := $(dtb-y)
subdir-y := $(dts-dirs)
clean-files := *.dtb clean-files := *.dtb
# Enable fixups to support overlays on BCM2708 platforms
ifeq ($(RPI_DT_OVERLAYS),y)
DTC_FLAGS ?= -@
endif

View File

@@ -0,0 +1,149 @@
/dts-v1/;
#include "bcm2708.dtsi"
/ {
compatible = "brcm,bcm2708";
model = "Raspberry Pi Model B+";
};
&gpio {
sdhost_pins: sdhost_pins {
brcm,pins = <48 49 50 51 52 53>;
brcm,function = <4>; /* alt0 */
};
spi0_pins: spi0_pins {
brcm,pins = <9 10 11>;
brcm,function = <4>; /* alt0 */
};
spi0_cs_pins: spi0_cs_pins {
brcm,pins = <8 7>;
brcm,function = <1>; /* output */
};
i2c0_pins: i2c0 {
brcm,pins = <0 1>;
brcm,function = <4>;
};
i2c1_pins: i2c1 {
brcm,pins = <2 3>;
brcm,function = <4>;
};
i2s_pins: i2s {
brcm,pins = <18 19 20 21>;
brcm,function = <4>; /* alt0 */
};
};
&sdhost {
pinctrl-names = "default";
pinctrl-0 = <&sdhost_pins>;
bus-width = <4>;
status = "okay";
};
&fb {
status = "okay";
};
&uart0 {
status = "okay";
};
&spi0 {
pinctrl-names = "default";
pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
spidev@0{
compatible = "spidev";
reg = <0>; /* CE0 */
#address-cells = <1>;
#size-cells = <0>;
spi-max-frequency = <500000>;
};
spidev@1{
compatible = "spidev";
reg = <1>; /* CE1 */
#address-cells = <1>;
#size-cells = <0>;
spi-max-frequency = <500000>;
};
};
&i2c0 {
pinctrl-names = "default";
pinctrl-0 = <&i2c0_pins>;
clock-frequency = <100000>;
};
&i2c1 {
pinctrl-names = "default";
pinctrl-0 = <&i2c1_pins>;
clock-frequency = <100000>;
};
&i2c2 {
clock-frequency = <100000>;
};
&i2s {
#sound-dai-cells = <0>;
pinctrl-names = "default";
pinctrl-0 = <&i2s_pins>;
};
&random {
status = "okay";
};
&leds {
act_led: act {
label = "led0";
linux,default-trigger = "mmc0";
gpios = <&gpio 47 0>;
};
pwr_led: pwr {
label = "led1";
linux,default-trigger = "input";
gpios = <&gpio 35 0>;
};
};
/ {
__overrides__ {
uart0 = <&uart0>,"status";
uart0_clkrate = <&clk_uart0>,"clock-frequency:0";
i2s = <&i2s>,"status";
spi = <&spi0>,"status";
i2c0 = <&i2c0>,"status";
i2c1 = <&i2c1>,"status";
i2c2_iknowwhatimdoing = <&i2c2>,"status";
i2c0_baudrate = <&i2c0>,"clock-frequency:0";
i2c1_baudrate = <&i2c1>,"clock-frequency:0";
i2c2_baudrate = <&i2c2>,"clock-frequency:0";
core_freq = <&clk_core>,"clock-frequency:0";
act_led_gpio = <&act_led>,"gpios:4";
act_led_activelow = <&act_led>,"gpios:8";
act_led_trigger = <&act_led>,"linux,default-trigger";
pwr_led_gpio = <&pwr_led>,"gpios:4";
pwr_led_activelow = <&pwr_led>,"gpios:8";
pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
audio = <&audio>,"status";
watchdog = <&watchdog>,"status";
random = <&random>,"status";
sd_overclock = <&sdhost>,"brcm,overclock-50:0";
sd_force_pio = <&sdhost>,"brcm,force-pio?";
sd_pio_limit = <&sdhost>,"brcm,pio-limit:0";
sd_debug = <&sdhost>,"brcm,debug";
};
};

View File

@@ -0,0 +1,139 @@
/dts-v1/;
#include "bcm2708.dtsi"
/ {
compatible = "brcm,bcm2708";
model = "Raspberry Pi Model B";
};
&gpio {
sdhost_pins: sdhost_pins {
brcm,pins = <48 49 50 51 52 53>;
brcm,function = <4>; /* alt0 */
};
spi0_pins: spi0_pins {
brcm,pins = <9 10 11>;
brcm,function = <4>; /* alt0 */
};
spi0_cs_pins: spi0_cs_pins {
brcm,pins = <8 7>;
brcm,function = <1>; /* output */
};
i2c0_pins: i2c0 {
brcm,pins = <0 1>;
brcm,function = <4>;
};
i2c1_pins: i2c1 {
brcm,pins = <2 3>;
brcm,function = <4>;
};
i2s_pins: i2s {
brcm,pins = <28 29 30 31>;
brcm,function = <6>; /* alt2 */
};
};
&sdhost {
pinctrl-names = "default";
pinctrl-0 = <&sdhost_pins>;
bus-width = <4>;
status = "okay";
};
&fb {
status = "okay";
};
&uart0 {
status = "okay";
};
&spi0 {
pinctrl-names = "default";
pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
spidev@0{
compatible = "spidev";
reg = <0>; /* CE0 */
#address-cells = <1>;
#size-cells = <0>;
spi-max-frequency = <500000>;
};
spidev@1{
compatible = "spidev";
reg = <1>; /* CE1 */
#address-cells = <1>;
#size-cells = <0>;
spi-max-frequency = <500000>;
};
};
&i2c0 {
pinctrl-names = "default";
pinctrl-0 = <&i2c0_pins>;
clock-frequency = <100000>;
};
&i2c1 {
pinctrl-names = "default";
pinctrl-0 = <&i2c1_pins>;
clock-frequency = <100000>;
};
&i2c2 {
clock-frequency = <100000>;
};
&i2s {
#sound-dai-cells = <0>;
pinctrl-names = "default";
pinctrl-0 = <&i2s_pins>;
};
&random {
status = "okay";
};
&leds {
act_led: act {
label = "led0";
linux,default-trigger = "mmc0";
gpios = <&gpio 16 1>;
};
};
/ {
__overrides__ {
uart0 = <&uart0>,"status";
uart0_clkrate = <&clk_uart0>,"clock-frequency:0";
i2s = <&i2s>,"status";
spi = <&spi0>,"status";
i2c0 = <&i2c0>,"status";
i2c1 = <&i2c1>,"status";
i2c2_iknowwhatimdoing = <&i2c2>,"status";
i2c0_baudrate = <&i2c0>,"clock-frequency:0";
i2c1_baudrate = <&i2c1>,"clock-frequency:0";
i2c2_baudrate = <&i2c2>,"clock-frequency:0";
core_freq = <&clk_core>,"clock-frequency:0";
act_led_gpio = <&act_led>,"gpios:4";
act_led_activelow = <&act_led>,"gpios:8";
act_led_trigger = <&act_led>,"linux,default-trigger";
audio = <&audio>,"status";
watchdog = <&watchdog>,"status";
random = <&random>,"status";
sd_overclock = <&sdhost>,"brcm,overclock-50:0";
sd_force_pio = <&sdhost>,"brcm,force-pio?";
sd_pio_limit = <&sdhost>,"brcm,pio-limit:0";
sd_debug = <&sdhost>,"brcm,debug";
};
};

View File

@@ -0,0 +1,101 @@
/dts-v1/;
#include "bcm2708-rpi-cm.dtsi"
/ {
model = "Raspberry Pi Compute Module";
};
&uart0 {
status = "okay";
};
&gpio {
spi0_pins: spi0_pins {
brcm,pins = <9 10 11>;
brcm,function = <4>; /* alt0 */
};
spi0_cs_pins: spi0_cs_pins {
brcm,pins = <8 7>;
brcm,function = <1>; /* output */
};
i2c0_pins: i2c0 {
brcm,pins = <0 1>;
brcm,function = <4>;
};
i2c1_pins: i2c1 {
brcm,pins = <2 3>;
brcm,function = <4>;
};
i2s_pins: i2s {
brcm,pins = <18 19 20 21>;
brcm,function = <4>; /* alt0 */
};
};
&spi0 {
pinctrl-names = "default";
pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
spidev@0{
compatible = "spidev";
reg = <0>; /* CE0 */
#address-cells = <1>;
#size-cells = <0>;
spi-max-frequency = <500000>;
};
spidev@1{
compatible = "spidev";
reg = <1>; /* CE1 */
#address-cells = <1>;
#size-cells = <0>;
spi-max-frequency = <500000>;
};
};
&i2c0 {
pinctrl-names = "default";
pinctrl-0 = <&i2c0_pins>;
clock-frequency = <100000>;
};
&i2c1 {
pinctrl-names = "default";
pinctrl-0 = <&i2c1_pins>;
clock-frequency = <100000>;
};
&i2c2 {
clock-frequency = <100000>;
};
&i2s {
#sound-dai-cells = <0>;
pinctrl-names = "default";
pinctrl-0 = <&i2s_pins>;
};
&random {
status = "okay";
};
/ {
__overrides__ {
uart0 = <&uart0>,"status";
uart0_clkrate = <&clk_uart0>,"clock-frequency:0";
i2s = <&i2s>,"status";
spi = <&spi0>,"status";
i2c0 = <&i2c0>,"status";
i2c1 = <&i2c1>,"status";
i2c2_iknowwhatimdoing = <&i2c2>,"status";
i2c0_baudrate = <&i2c0>,"clock-frequency:0";
i2c1_baudrate = <&i2c1>,"clock-frequency:0";
i2c2_baudrate = <&i2c2>,"clock-frequency:0";
};
};

View File

@@ -0,0 +1,53 @@
#include "bcm2708.dtsi"
&gpio {
sdhost_pins: sdhost_pins {
brcm,pins = <48 49 50 51 52 53>;
brcm,function = <4>; /* alt0 */
};
};
&gpio {
sdhost_pins: sdhost_pins {
brcm,pins = <48 49 50 51 52 53>;
brcm,function = <4>; /* alt0 */
};
};
&leds {
act_led: act {
label = "led0";
linux,default-trigger = "mmc0";
gpios = <&gpio 47 0>;
};
};
&sdhost {
pinctrl-names = "default";
pinctrl-0 = <&sdhost_pins>;
bus-width = <4>;
non-removable;
status = "okay";
};
&fb {
status = "okay";
};
/ {
__overrides__ {
core_freq = <&clk_core>,"clock-frequency:0";
act_led_gpio = <&act_led>,"gpios:4";
act_led_activelow = <&act_led>,"gpios:8";
act_led_trigger = <&act_led>,"linux,default-trigger";
audio = <&audio>,"status";
watchdog = <&watchdog>,"status";
random = <&random>,"status";
sd_overclock = <&sdhost>,"brcm,overclock-50:0";
sd_force_pio = <&sdhost>,"brcm,force-pio?";
sd_pio_limit = <&sdhost>,"brcm,pio-limit:0";
sd_debug = <&sdhost>,"brcm,debug";
};
};

View File

@@ -0,0 +1,40 @@
#include "bcm2708_common.dtsi"
/ {
compatible = "brcm,bcm2708";
model = "BCM2708";
chosen {
/* No padding required - the boot loader can do that. */
bootargs = "";
};
soc {
ranges = <0x7e000000 0x20000000 0x01000000>;
timer@7e003000 {
compatible = "brcm,bcm2835-system-timer";
reg = <0x7e003000 0x1000>;
interrupts = <1 0>, <1 1>, <1 2>, <1 3>;
clock-frequency = <1000000>;
};
arm-pmu {
compatible = "arm,arm1176-pmu";
};
gpiomem {
compatible = "brcm,bcm2835-gpiomem";
reg = <0x7e200000 0x1000>;
status = "okay";
};
};
};
&intc {
compatible = "brcm,bcm2835-armctrl-ic";
};
&watchdog {
status = "okay";
};

View File

@@ -0,0 +1,349 @@
#include "skeleton.dtsi"
/ {
interrupt-parent = <&intc>;
aliases {
audio = &audio;
sound = &sound;
soc = &soc;
dma = &dma;
intc = &intc;
watchdog = &watchdog;
random = &random;
mailbox = &mailbox;
gpio = &gpio;
uart0 = &uart0;
sdhost = &sdhost;
i2s = &i2s;
spi0 = &spi0;
i2c0 = &i2c0;
uart1 = &uart1;
mmc = &mmc;
i2c1 = &i2c1;
i2c2 = &i2c2;
usb = &usb;
leds = &leds;
fb = &fb;
vchiq = &vchiq;
thermal = &thermal;
clocks = &clocks;
};
/* Onboard audio */
audio: audio {
compatible = "brcm,bcm2835-audio";
brcm,pwm-channels = <8>;
status = "disabled";
};
/* External sound card */
sound: sound {
};
soc: soc {
compatible = "simple-bus";
#address-cells = <1>;
#size-cells = <1>;
dma: dma@7e007000 {
compatible = "brcm,bcm2835-dma";
reg = <0x7e007000 0xf00>;
interrupts = <1 16>,
<1 17>,
<1 18>,
<1 19>,
<1 20>,
<1 21>,
<1 22>,
<1 23>,
<1 24>,
<1 25>,
<1 26>,
<1 27>;
#dma-cells = <1>;
brcm,dma-channel-mask = <0x0f35>;
};
intc: interrupt-controller@7e00b200 {
compatible = "brcm,bcm2708-armctrl-ic";
reg = <0x7e00b200 0x200>;
interrupt-controller;
#interrupt-cells = <2>;
};
mailbox: mailbox@7e00b800 {
compatible = "brcm,bcm2835-mbox";
reg = <0x7e00b880 0x40>;
interrupts = <0 1>;
#mbox-cells = <0>;
};
watchdog: watchdog@7e100000 {
compatible = "brcm,bcm2835-pm-wdt";
reg = <0x7e100000 0x28>;
status = "disabled";
};
cprman: cprman@7e101000 {
compatible = "brcm,bcm2835-cprman";
#clock-cells = <1>;
reg = <0x7e101000 0x2000>;
/* CPRMAN derives everything from the platform's
* oscillator.
*/
clocks = <&clk_osc>;
status = "disabled";
};
random: rng@7e104000 {
compatible = "brcm,bcm2835-rng";
reg = <0x7e104000 0x10>;
status = "disabled";
};
gpio: gpio@7e200000 {
compatible = "brcm,bcm2835-gpio";
reg = <0x7e200000 0xb4>;
interrupts = <2 17>, <2 18>;
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
#interrupt-cells = <2>;
};
uart0: uart@7e201000 {
compatible = "arm,pl011", "arm,primecell";
reg = <0x7e201000 0x1000>;
interrupts = <2 25>;
clocks = <&clk_uart0 &clk_apb_p>;
clock-names = "uartclk","apb_pclk";
arm,primecell-periphid = <0x00241011>; // For an explanation, see
// https://github.com/raspberrypi/linux/commit/13731d862cf5219216533a3b0de052cee4cc5038
status = "disabled";
};
sdhost: sdhost@7e202000 {
compatible = "brcm,bcm2835-sdhost";
reg = <0x7e202000 0x100>;
interrupts = <2 24>;
clocks = <&clk_core>;
dmas = <&dma 13>,
<&dma 13>;
dma-names = "tx", "rx";
brcm,overclock-50 = <0>;
brcm,pio-limit = <1>;
status = "disabled";
};
i2s: i2s@7e203000 {
compatible = "brcm,bcm2835-i2s";
reg = <0x7e203000 0x24>,
<0x7e101098 0x08>;
dmas = <&dma 2>, <&dma 3>;
dma-names = "tx", "rx";
status = "disabled";
};
spi0: spi@7e204000 {
compatible = "brcm,bcm2835-spi";
reg = <0x7e204000 0x1000>;
interrupts = <2 22>;
clocks = <&clk_core>;
#address-cells = <1>;
#size-cells = <0>;
status = "disabled";
/* the dma channels */
dmas = <&dma 6>, <&dma 7>;
dma-names = "tx", "rx";
/* the chipselects used - <0> means native GPIO
* add more gpios if necessary as <&gpio 6 1>
* (but do not forget to make them output!)
*/
cs-gpios = <0>, <0>;
};
i2c0: i2c@7e205000 {
compatible = "brcm,bcm2708-i2c";
reg = <0x7e205000 0x1000>;
interrupts = <2 21>;
clocks = <&clk_core>;
#address-cells = <1>;
#size-cells = <0>;
status = "disabled";
};
pwm: pwm@7e20c000 {
compatible = "brcm,bcm2835-pwm";
reg = <0x7e20c000 0x28>;
clocks = <&clk_pwm>;
#pwm-cells = <2>;
status = "disabled";
};
uart1: uart@7e215040 {
compatible = "brcm,bcm2835-aux-uart", "ns16550";
reg = <0x7e215040 0x40>;
interrupts = <1 29>;
clocks = <&clk_uart1>;
reg-shift = <2>;
no-loopback-test;
status = "disabled";
};
mmc: mmc@7e300000 {
compatible = "brcm,bcm2835-mmc";
reg = <0x7e300000 0x100>;
interrupts = <2 30>;
clocks = <&clk_mmc>;
dmas = <&dma 11>,
<&dma 11>;
dma-names = "tx", "rx";
brcm,overclock-50 = <0>;
status = "disabled";
};
i2c1: i2c@7e804000 {
compatible = "brcm,bcm2708-i2c";
reg = <0x7e804000 0x1000>;
interrupts = <2 21>;
clocks = <&clk_core>;
#address-cells = <1>;
#size-cells = <0>;
status = "disabled";
};
i2c2: i2c@7e805000 {
// Beware - this is shared with the HDMI module.
// Careless use may break (really) your display.
// Caveat emptor.
compatible = "brcm,bcm2708-i2c";
reg = <0x7e805000 0x1000>;
interrupts = <2 21>;
clocks = <&clk_core>;
#address-cells = <1>;
#size-cells = <0>;
status = "disabled";
};
smi: smi@7e600000 {
compatible = "brcm,bcm2835-smi";
reg = <0x7e600000 0x44>, <0x7e1010b0 0x8>;
interrupts = <2 16>;
brcm,smi-clock-source = <6>;
brcm,smi-clock-divisor = <4>;
dmas = <&dma 4>;
dma-names = "rx-tx";
status = "disabled";
};
usb: usb@7e980000 {
compatible = "brcm,bcm2708-usb";
reg = <0x7e980000 0x10000>,
<0x7e006000 0x1000>;
interrupts = <2 0>,
<1 9>;
};
firmware: firmware {
compatible = "raspberrypi,bcm2835-firmware";
mboxes = <&mailbox>;
};
leds: leds {
compatible = "gpio-leds";
};
fb: fb {
compatible = "brcm,bcm2708-fb";
firmware = <&firmware>;
status = "disabled";
};
vchiq: vchiq {
compatible = "brcm,bcm2835-vchiq";
reg = <0x7e00b840 0xf>;
interrupts = <0 2>;
cache-line-size = <32>;
firmware = <&firmware>;
};
thermal: thermal {
compatible = "brcm,bcm2835-thermal";
firmware = <&firmware>;
};
};
clocks: clocks {
compatible = "simple-bus";
#address-cells = <1>;
#size-cells = <0>;
clk_core: clock@0 {
compatible = "fixed-clock";
reg = <0>;
#clock-cells = <0>;
clock-output-names = "core";
clock-frequency = <250000000>;
};
clk_mmc: clock@1 {
compatible = "fixed-clock";
reg = <1>;
#clock-cells = <0>;
clock-output-names = "mmc";
clock-frequency = <250000000>;
};
clk_uart0: clock@2 {
compatible = "fixed-clock";
reg = <2>;
#clock-cells = <0>;
clock-output-names = "uart0_pclk";
clock-frequency = <3000000>;
};
clk_apb_p: clock@3 {
compatible = "fixed-clock";
reg = <3>;
#clock-cells = <0>;
clock-output-names = "apb_pclk";
clock-frequency = <126000000>;
};
clk_pwm: clock@4 {
compatible = "fixed-clock";
reg = <4>;
#clock-cells = <0>;
clock-output-names = "pwm";
clock-frequency = <100000000>;
};
clk_uart1: clock@5 {
compatible = "fixed-factor-clock";
reg = <5>;
clocks = <&clk_core>;
#clock-cells = <0>;
clock-div = <1>;
clock-mult = <2>;
};
/* The oscillator is the root of the clock tree. */
clk_osc: clock@6 {
compatible = "fixed-clock";
reg = <6>;
#clock-cells = <0>;
clock-output-names = "osc";
clock-frequency = <19200000>;
};
};
__overrides__ {
cache_line_size = <&vchiq>, "cache-line-size:0";
};
};

View File

@@ -0,0 +1,149 @@
/dts-v1/;
#include "bcm2709.dtsi"
/ {
compatible = "brcm,bcm2709";
model = "Raspberry Pi 2 Model B";
};
&gpio {
sdhost_pins: sdhost_pins {
brcm,pins = <48 49 50 51 52 53>;
brcm,function = <4>; /* alt0 */
};
spi0_pins: spi0_pins {
brcm,pins = <9 10 11>;
brcm,function = <4>; /* alt0 */
};
spi0_cs_pins: spi0_cs_pins {
brcm,pins = <8 7>;
brcm,function = <1>; /* output */
};
i2c0_pins: i2c0 {
brcm,pins = <0 1>;
brcm,function = <4>;
};
i2c1_pins: i2c1 {
brcm,pins = <2 3>;
brcm,function = <4>;
};
i2s_pins: i2s {
brcm,pins = <18 19 20 21>;
brcm,function = <4>; /* alt0 */
};
};
&sdhost {
pinctrl-names = "default";
pinctrl-0 = <&sdhost_pins>;
bus-width = <4>;
status = "okay";
};
&fb {
status = "okay";
};
&uart0 {
status = "okay";
};
&spi0 {
pinctrl-names = "default";
pinctrl-0 = <&spi0_pins &spi0_cs_pins>;
cs-gpios = <&gpio 8 1>, <&gpio 7 1>;
spidev@0{
compatible = "spidev";
reg = <0>; /* CE0 */
#address-cells = <1>;
#size-cells = <0>;
spi-max-frequency = <500000>;
};
spidev@1{
compatible = "spidev";
reg = <1>; /* CE1 */
#address-cells = <1>;
#size-cells = <0>;
spi-max-frequency = <500000>;
};
};
&i2c0 {
pinctrl-names = "default";
pinctrl-0 = <&i2c0_pins>;
clock-frequency = <100000>;
};
&i2c1 {
pinctrl-names = "default";
pinctrl-0 = <&i2c1_pins>;
clock-frequency = <100000>;
};
&i2c2 {
clock-frequency = <100000>;
};
&i2s {
#sound-dai-cells = <0>;
pinctrl-names = "default";
pinctrl-0 = <&i2s_pins>;
};
&random {
status = "okay";
};
&leds {
act_led: act {
label = "led0";
linux,default-trigger = "mmc0";
gpios = <&gpio 47 0>;
};
pwr_led: pwr {
label = "led1";
linux,default-trigger = "input";
gpios = <&gpio 35 0>;
};
};
/ {
__overrides__ {
uart0 = <&uart0>,"status";
uart0_clkrate = <&clk_uart0>,"clock-frequency:0";
i2s = <&i2s>,"status";
spi = <&spi0>,"status";
i2c0 = <&i2c0>,"status";
i2c1 = <&i2c1>,"status";
i2c2_iknowwhatimdoing = <&i2c2>,"status";
i2c0_baudrate = <&i2c0>,"clock-frequency:0";
i2c1_baudrate = <&i2c1>,"clock-frequency:0";
i2c2_baudrate = <&i2c2>,"clock-frequency:0";
core_freq = <&clk_core>,"clock-frequency:0";
act_led_gpio = <&act_led>,"gpios:4";
act_led_activelow = <&act_led>,"gpios:8";
act_led_trigger = <&act_led>,"linux,default-trigger";
pwr_led_gpio = <&pwr_led>,"gpios:4";
pwr_led_activelow = <&pwr_led>,"gpios:8";
pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
audio = <&audio>,"status";
watchdog = <&watchdog>,"status";
random = <&random>,"status";
sd_overclock = <&sdhost>,"brcm,overclock-50:0";
sd_force_pio = <&sdhost>,"brcm,force-pio?";
sd_pio_limit = <&sdhost>,"brcm,pio-limit:0";
sd_debug = <&sdhost>,"brcm,debug";
};
};

View File

@@ -0,0 +1,80 @@
#include "bcm2708_common.dtsi"
/ {
compatible = "brcm,bcm2709";
model = "BCM2709";
chosen {
/* No padding required - the boot loader can do that. */
bootargs = "";
};
soc {
ranges = <0x7e000000 0x3f000000 0x01000000>;
arm-pmu {
compatible = "arm,cortex-a7-pmu";
interrupts = <3 9>;
};
gpiomem {
compatible = "brcm,bcm2835-gpiomem";
reg = <0x7e200000 0x1000>;
status = "okay";
};
};
timer {
compatible = "arm,armv7-timer";
clock-frequency = <19200000>;
interrupts = <3 0>, // PHYS_SECURE_PPI
<3 1>, // PHYS_NONSECURE_PPI
<3 3>, // VIRT_PPI
<3 2>; // HYP_PPI
always-on;
};
cpus: cpus {
#address-cells = <1>;
#size-cells = <0>;
v7_cpu0: cpu@0 {
device_type = "cpu";
compatible = "arm,cortex-a7";
reg = <0xf00>;
clock-frequency = <800000000>;
};
v7_cpu1: cpu@1 {
device_type = "cpu";
compatible = "arm,cortex-a7";
reg = <0xf01>;
clock-frequency = <800000000>;
};
v7_cpu2: cpu@2 {
device_type = "cpu";
compatible = "arm,cortex-a7";
reg = <0xf02>;
clock-frequency = <800000000>;
};
v7_cpu3: cpu@3 {
device_type = "cpu";
compatible = "arm,cortex-a7";
reg = <0xf03>;
clock-frequency = <800000000>;
};
};
__overrides__ {
arm_freq = <&v7_cpu0>, "clock-frequency:0",
<&v7_cpu1>, "clock-frequency:0",
<&v7_cpu2>, "clock-frequency:0",
<&v7_cpu3>, "clock-frequency:0";
};
};
&watchdog {
status = "okay";
};

View File

@@ -0,0 +1,190 @@
/dts-v1/;
#include "bcm2710.dtsi"
/ {
model = "Raspberry Pi 3 Model B";
};
&gpio {
sdhost_pins: sdhost_pins {
brcm,pins = <48 49 50 51 52 53>;
brcm,function = <4>; /* alt0 */
};
spi0_pins: spi0_pins {
brcm,pins = <7 8 9 10 11>;
brcm,function = <4>; /* alt0 */
};
i2c0_pins: i2c0 {
brcm,pins = <0 1>;
brcm,function = <4>;
};
i2c1_pins: i2c1 {
brcm,pins = <2 3>;
brcm,function = <4>;
};
i2s_pins: i2s {
brcm,pins = <18 19 20 21>;
brcm,function = <4>; /* alt0 */
};
sdio_pins: sdio_pins {
brcm,pins = <34 35 36 37 38 39>;
brcm,function = <7 7 7 7 7 7>; /* alt3 = SD1 */
brcm,pull = <0 2 2 2 2 2>;
};
bt_pins: bt_pins {
brcm,pins = <28 29 30 31 43>;
brcm,function = <6 6 6 6 4>; /* alt2:PCM alt0:GPCLK2 */
brcm,pull = <0 0 0 0 0>;
};
uart0_pins: uart0_pins {
brcm,pins = <32 33>;
brcm,function = <7>; /* alt3=UART0 */
brcm,pull = <0 0>;
};
uart1_pins: uart1_pins {
brcm,pins = <14 15>;
brcm,function = <2>; /* alt5=UART1 */
brcm,pull = <0 0>;
};
};
&sdhost {
pinctrl-names = "default";
pinctrl-0 = <&sdhost_pins>;
bus-width = <4>;
status = "okay";
};
&mmc {
pinctrl-names = "default";
pinctrl-0 = <&sdio_pins>;
non-removable;
bus-width = <4>;
status = "okay";
brcm,overclock-50 = <0>;
};
&soc {
virtgpio: virtgpio {
compatible = "brcm,bcm2835-virtgpio";
gpio-controller;
#gpio-cells = <2>;
firmware = <&firmware>;
status = "okay";
};
};
&fb {
status = "okay";
};
&uart0 {
pinctrl-names = "default";
pinctrl-0 = <&uart0_pins &bt_pins>;
status = "okay";
};
&uart1 {
pinctrl-names = "default";
pinctrl-0 = <&uart1_pins>;
status = "okay";
};
&spi0 {
pinctrl-names = "default";
pinctrl-0 = <&spi0_pins>;
cs-gpios = <0 0>;
spidev@0{
compatible = "spidev";
reg = <0>; /* CE0 */
#address-cells = <1>;
#size-cells = <0>;
spi-max-frequency = <500000>;
};
spidev@1{
compatible = "spidev";
reg = <1>; /* CE1 */
#address-cells = <1>;
#size-cells = <0>;
spi-max-frequency = <500000>;
};
};
&i2c0 {
pinctrl-names = "default";
pinctrl-0 = <&i2c0_pins>;
clock-frequency = <100000>;
};
&i2c1 {
pinctrl-names = "default";
pinctrl-0 = <&i2c1_pins>;
clock-frequency = <100000>;
};
&i2c2 {
clock-frequency = <100000>;
};
&i2s {
#sound-dai-cells = <0>;
pinctrl-names = "default";
pinctrl-0 = <&i2s_pins>;
};
&random {
status = "okay";
};
&leds {
act_led: act {
label = "led0";
linux,default-trigger = "mmc0";
gpios = <&virtgpio 0 0>;
};
};
/ {
chosen {
bootargs = "8250.nr_uarts=1";
};
};
/ {
__overrides__ {
uart0 = <&uart0>,"status";
uart0_clkrate = <&clk_uart0>,"clock-frequency:0";
i2s = <&i2s>,"status";
spi = <&spi0>,"status";
i2c0 = <&i2c0>,"status";
i2c1 = <&i2c1>,"status";
i2c2_iknowwhatimdoing = <&i2c2>,"status";
i2c0_baudrate = <&i2c0>,"clock-frequency:0";
i2c1_baudrate = <&i2c1>,"clock-frequency:0";
i2c2_baudrate = <&i2c2>,"clock-frequency:0";
core_freq = <&clk_core>,"clock-frequency:0";
act_led_gpio = <&act_led>,"gpios:4";
act_led_activelow = <&act_led>,"gpios:8";
act_led_trigger = <&act_led>,"linux,default-trigger";
audio = <&audio>,"status";
watchdog = <&watchdog>,"status";
random = <&random>,"status";
sd_overclock = <&sdhost>,"brcm,overclock-50:0";
sd_force_pio = <&sdhost>,"brcm,force-pio?";
sd_pio_limit = <&sdhost>,"brcm,pio-limit:0";
sd_debug = <&sdhost>,"brcm,debug";
};
};

View File

@@ -0,0 +1,76 @@
#include "bcm2708_common.dtsi"
/ {
compatible = "brcm,bcm2710","brcm,bcm2709";
model = "BCM2710";
chosen {
/* No padding required - the boot loader can do that. */
bootargs = "";
};
soc {
ranges = <0x7e000000 0x3f000000 0x01000000>;
arm-pmu {
compatible = "arm,cortex-a7-pmu";
interrupts = <3 9>;
};
gpiomem {
compatible = "brcm,bcm2835-gpiomem";
reg = <0x7e200000 0x1000>;
status = "okay";
};
};
timer {
compatible = "arm,armv7-timer";
clock-frequency = <19200000>;
interrupts = <3 0>, // PHYS_SECURE_PPI
<3 1>, // PHYS_NONSECURE_PPI
<3 3>, // VIRT_PPI
<3 2>; // HYP_PPI
always-on;
};
cpus: cpus {
#address-cells = <1>;
#size-cells = <0>;
v7_cpu0: cpu@0 {
device_type = "cpu";
compatible = "arm,cortex-a7";
reg = <0x000>;
clock-frequency = <800000000>;
};
v7_cpu1: cpu@1 {
device_type = "cpu";
compatible = "arm,cortex-a7";
reg = <0x001>;
clock-frequency = <800000000>;
};
v7_cpu2: cpu@2 {
device_type = "cpu";
compatible = "arm,cortex-a7";
reg = <0x002>;
clock-frequency = <800000000>;
};
v7_cpu3: cpu@3 {
device_type = "cpu";
compatible = "arm,cortex-a7";
reg = <0x003>;
clock-frequency = <800000000>;
};
};
__overrides__ {
arm_freq = <&v7_cpu0>, "clock-frequency:0",
<&v7_cpu1>, "clock-frequency:0",
<&v7_cpu2>, "clock-frequency:0",
<&v7_cpu3>, "clock-frequency:0";
};
};

View File

@@ -1,30 +1,128 @@
/dts-v1/; /dts-v1/;
#include "bcm2835-rpi.dtsi" #include "bcm2835.dtsi"
/ { / {
compatible = "raspberrypi,model-b-plus", "brcm,bcm2835"; compatible = "raspberrypi,model-b-plus", "brcm,bcm2835";
model = "Raspberry Pi Model B+"; model = "Raspberry Pi Model B+";
leds {
act {
gpios = <&gpio 47 0>;
};
pwr {
label = "PWR";
gpios = <&gpio 35 0>;
default-state = "keep";
linux,default-trigger = "default-on";
};
};
}; };
&gpio { &gpio {
pinctrl-0 = <&gpioout &alt0 &i2s_alt0 &alt3>; spi0_pins: spi0_pins {
brcm,pins = <7 8 9 10 11>;
brcm,function = <4>; /* alt0 */
};
/* I2S interface */ i2c0_pins: i2c0 {
i2s_alt0: i2s_alt0 { brcm,pins = <0 1>;
brcm,function = <4>;
};
i2c1_pins: i2c1 {
brcm,pins = <2 3>;
brcm,function = <4>;
};
i2s_pins: i2s {
brcm,pins = <18 19 20 21>; brcm,pins = <18 19 20 21>;
brcm,function = <BCM2835_FSEL_ALT0>; brcm,function = <4>; /* alt0 */
};
};
&mmc {
status = "okay";
bus-width = <4>;
};
&fb {
status = "okay";
};
&uart0 {
status = "okay";
};
&spi0 {
pinctrl-names = "default";
pinctrl-0 = <&spi0_pins>;
spidev@0{
compatible = "spidev";
reg = <0>; /* CE0 */
#address-cells = <1>;
#size-cells = <0>;
spi-max-frequency = <500000>;
};
spidev@1{
compatible = "spidev";
reg = <1>; /* CE1 */
#address-cells = <1>;
#size-cells = <0>;
spi-max-frequency = <500000>;
};
};
&i2c0 {
pinctrl-names = "default";
pinctrl-0 = <&i2c0_pins>;
clock-frequency = <100000>;
};
&i2c1 {
pinctrl-names = "default";
pinctrl-0 = <&i2c1_pins>;
clock-frequency = <100000>;
};
&i2c2 {
clock-frequency = <100000>;
};
&i2s {
#sound-dai-cells = <0>;
pinctrl-names = "default";
pinctrl-0 = <&i2s_pins>;
};
&leds {
act_led: act {
label = "led0";
linux,default-trigger = "mmc0";
gpios = <&gpio 47 0>;
};
pwr_led: pwr {
label = "led1";
linux,default-trigger = "input";
gpios = <&gpio 35 0>;
};
};
/ {
__overrides__ {
uart0 = <&uart0>,"status";
uart0_clkrate = <&clk_uart0>,"clock-frequency:0";
uart1_clkrate = <&uart1>,"clock-frequency:0";
i2s = <&i2s>,"status";
spi = <&spi0>,"status";
i2c0 = <&i2c0>,"status";
i2c1 = <&i2c1>,"status";
i2c2_iknowwhatimdoing = <&i2c2>,"status";
i2c0_baudrate = <&i2c0>,"clock-frequency:0";
i2c1_baudrate = <&i2c1>,"clock-frequency:0";
i2c2_baudrate = <&i2c2>,"clock-frequency:0";
core_freq = <&clk_core>,"clock-frequency:0";
act_led_gpio = <&act_led>,"gpios:4";
act_led_activelow = <&act_led>,"gpios:8";
act_led_trigger = <&act_led>,"linux,default-trigger";
pwr_led_gpio = <&pwr_led>,"gpios:4";
pwr_led_activelow = <&pwr_led>,"gpios:8";
pwr_led_trigger = <&pwr_led>,"linux,default-trigger";
audio = <&audio>,"status";
watchdog = <&watchdog>,"status";
random = <&random>,"status";
}; };
}; };

View File

@@ -1,23 +1,118 @@
/dts-v1/; /dts-v1/;
#include "bcm2835-rpi.dtsi" #include "bcm2835.dtsi"
/ { / {
compatible = "raspberrypi,model-b", "brcm,bcm2835"; compatible = "raspberrypi,model-b", "brcm,bcm2835";
model = "Raspberry Pi Model B"; model = "Raspberry Pi Model B";
leds {
act {
gpios = <&gpio 16 1>;
};
};
}; };
&gpio { &gpio {
pinctrl-0 = <&gpioout &alt0 &i2s_alt2 &alt3>; spi0_pins: spi0_pins {
brcm,pins = <7 8 9 10 11>;
brcm,function = <4>; /* alt0 */
};
/* I2S interface */ i2c0_pins: i2c0 {
i2s_alt2: i2s_alt2 { brcm,pins = <0 1>;
brcm,function = <4>;
};
i2c1_pins: i2c1 {
brcm,pins = <2 3>;
brcm,function = <4>;
};
i2s_pins: i2s {
brcm,pins = <28 29 30 31>; brcm,pins = <28 29 30 31>;
brcm,function = <BCM2835_FSEL_ALT2>; brcm,function = <6>; /* alt2 */
};
};
&mmc {
status = "okay";
bus-width = <4>;
};
&fb {
status = "okay";
};
&uart0 {
status = "okay";
};
&spi0 {
pinctrl-names = "default";
pinctrl-0 = <&spi0_pins>;
spidev@0{
compatible = "spidev";
reg = <0>; /* CE0 */
#address-cells = <1>;
#size-cells = <0>;
spi-max-frequency = <500000>;
};
spidev@1{
compatible = "spidev";
reg = <1>; /* CE1 */
#address-cells = <1>;
#size-cells = <0>;
spi-max-frequency = <500000>;
};
};
&i2c0 {
pinctrl-names = "default";
pinctrl-0 = <&i2c0_pins>;
clock-frequency = <100000>;
};
&i2c1 {
pinctrl-names = "default";
pinctrl-0 = <&i2c1_pins>;
clock-frequency = <100000>;
};
&i2c2 {
clock-frequency = <100000>;
};
&i2s {
#sound-dai-cells = <0>;
pinctrl-names = "default";
pinctrl-0 = <&i2s_pins>;
};
&leds {
act_led: act {
label = "led0";
linux,default-trigger = "mmc0";
gpios = <&gpio 16 1>;
};
};
/ {
__overrides__ {
uart0 = <&uart0>,"status";
uart0_clkrate = <&clk_uart0>,"clock-frequency:0";
uart1_clkrate = <&uart1>,"clock-frequency:0";
i2s = <&i2s>,"status";
spi = <&spi0>,"status";
i2c0 = <&i2c0>,"status";
i2c1 = <&i2c1>,"status";
i2c2_iknowwhatimdoing = <&i2c2>,"status";
i2c0_baudrate = <&i2c0>,"clock-frequency:0";
i2c1_baudrate = <&i2c1>,"clock-frequency:0";
i2c2_baudrate = <&i2c2>,"clock-frequency:0";
core_freq = <&clk_core>,"clock-frequency:0";
act_led_gpio = <&act_led>,"gpios:4";
act_led_activelow = <&act_led>,"gpios:8";
act_led_trigger = <&act_led>,"linux,default-trigger";
audio = <&audio>,"status";
watchdog = <&watchdog>,"status";
random = <&random>,"status";
}; };
}; };

View File

@@ -0,0 +1,93 @@
/dts-v1/;
#include "bcm2835-rpi-cm.dtsi"
/ {
model = "Raspberry Pi Compute Module";
};
&uart0 {
status = "okay";
};
&gpio {
spi0_pins: spi0_pins {
brcm,pins = <7 8 9 10 11>;
brcm,function = <4>; /* alt0 */
};
i2c0_pins: i2c0 {
brcm,pins = <0 1>;
brcm,function = <4>;
};
i2c1_pins: i2c1 {
brcm,pins = <2 3>;
brcm,function = <4>;
};
i2s_pins: i2s {
brcm,pins = <18 19 20 21>;
brcm,function = <4>; /* alt0 */
};
};
&spi0 {
pinctrl-names = "default";
pinctrl-0 = <&spi0_pins>;
spidev@0{
compatible = "spidev";
reg = <0>; /* CE0 */
#address-cells = <1>;
#size-cells = <0>;
spi-max-frequency = <500000>;
};
spidev@1{
compatible = "spidev";
reg = <1>; /* CE1 */
#address-cells = <1>;
#size-cells = <0>;
spi-max-frequency = <500000>;
};
};
&i2c0 {
pinctrl-names = "default";
pinctrl-0 = <&i2c0_pins>;
clock-frequency = <100000>;
};
&i2c1 {
pinctrl-names = "default";
pinctrl-0 = <&i2c1_pins>;
clock-frequency = <100000>;
};
&i2c2 {
clock-frequency = <100000>;
};
&i2s {
#sound-dai-cells = <0>;
pinctrl-names = "default";
pinctrl-0 = <&i2s_pins>;
};
/ {
__overrides__ {
uart0 = <&uart0>,"status";
uart0_clkrate = <&clk_uart0>,"clock-frequency:0";
uart1_clkrate = <&uart1>,"clock-frequency:0";
i2s = <&i2s>,"status";
spi = <&spi0>,"status";
i2c0 = <&i2c0>,"status";
i2c1 = <&i2c1>,"status";
i2c2_iknowwhatimdoing = <&i2c2>,"status";
i2c0_baudrate = <&i2c0>,"clock-frequency:0";
i2c1_baudrate = <&i2c1>,"clock-frequency:0";
i2c2_baudrate = <&i2c2>,"clock-frequency:0";
core_freq = <&clk_core>,"clock-frequency:0";
};
};

View File

@@ -0,0 +1,30 @@
#include "bcm2835.dtsi"
&leds {
act_led: act {
label = "led0";
linux,default-trigger = "mmc0";
gpios = <&gpio 47 0>;
};
};
&mmc {
status = "okay";
bus-width = <4>;
};
&fb {
status = "okay";
};
/ {
__overrides__ {
act_led_gpio = <&act_led>,"gpios:4";
act_led_activelow = <&act_led>,"gpios:8";
act_led_trigger = <&act_led>,"linux,default-trigger";
audio = <&audio>,"status";
watchdog = <&watchdog>,"status";
random = <&random>,"status";
};
};

View File

@@ -1,20 +1,15 @@
#include <dt-bindings/pinctrl/bcm2835.h> #include "bcm2708_common.dtsi"
#include "skeleton.dtsi"
/ { / {
compatible = "brcm,bcm2835"; compatible = "brcm,bcm2835";
model = "BCM2835"; model = "BCM2835";
interrupt-parent = <&intc>;
chosen { chosen {
bootargs = "earlyprintk console=ttyAMA0"; bootargs = "";
}; };
soc { soc {
compatible = "simple-bus"; ranges = <0x7e000000 0x20000000 0x01000000>;
#address-cells = <1>;
#size-cells = <1>;
ranges = <0x7e000000 0x20000000 0x02000000>;
dma-ranges = <0x40000000 0x00000000 0x20000000>; dma-ranges = <0x40000000 0x00000000 0x20000000>;
timer@7e003000 { timer@7e003000 {
@@ -24,169 +19,21 @@
clock-frequency = <1000000>; clock-frequency = <1000000>;
}; };
dma: dma@7e007000 {
compatible = "brcm,bcm2835-dma";
reg = <0x7e007000 0xf00>;
interrupts = <1 16>,
<1 17>,
<1 18>,
<1 19>,
<1 20>,
<1 21>,
<1 22>,
<1 23>,
<1 24>,
<1 25>,
<1 26>,
<1 27>,
<1 28>;
#dma-cells = <1>;
brcm,dma-channel-mask = <0x7f35>;
};
intc: interrupt-controller@7e00b200 {
compatible = "brcm,bcm2835-armctrl-ic";
reg = <0x7e00b200 0x200>;
interrupt-controller;
#interrupt-cells = <2>;
};
watchdog@7e100000 {
compatible = "brcm,bcm2835-pm-wdt";
reg = <0x7e100000 0x28>;
};
rng@7e104000 {
compatible = "brcm,bcm2835-rng";
reg = <0x7e104000 0x10>;
};
mailbox: mailbox@7e00b800 {
compatible = "brcm,bcm2835-mbox";
reg = <0x7e00b880 0x40>;
interrupts = <0 1>;
#mbox-cells = <0>;
};
gpio: gpio@7e200000 {
compatible = "brcm,bcm2835-gpio";
reg = <0x7e200000 0xb4>;
/*
* The GPIO IP block is designed for 3 banks of GPIOs.
* Each bank has a GPIO interrupt for itself.
* There is an overall "any bank" interrupt.
* In order, these are GIC interrupts 17, 18, 19, 20.
* Since the BCM2835 only has 2 banks, the 2nd bank
* interrupt output appears to be mirrored onto the
* 3rd bank's interrupt signal.
* So, a bank0 interrupt shows up on 17, 20, and
* a bank1 interrupt shows up on 18, 19, 20!
*/
interrupts = <2 17>, <2 18>, <2 19>, <2 20>;
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
#interrupt-cells = <2>;
};
uart@7e201000 {
compatible = "brcm,bcm2835-pl011", "arm,pl011", "arm,primecell";
reg = <0x7e201000 0x1000>;
interrupts = <2 25>;
clock-frequency = <3000000>;
arm,primecell-periphid = <0x00241011>;
};
i2s: i2s@7e203000 {
compatible = "brcm,bcm2835-i2s";
reg = <0x7e203000 0x20>,
<0x7e101098 0x02>;
dmas = <&dma 2>,
<&dma 3>;
dma-names = "tx", "rx";
status = "disabled";
};
spi: spi@7e204000 {
compatible = "brcm,bcm2835-spi";
reg = <0x7e204000 0x1000>;
interrupts = <2 22>;
clocks = <&clk_spi>;
#address-cells = <1>;
#size-cells = <0>;
status = "disabled";
};
i2c0: i2c@7e205000 {
compatible = "brcm,bcm2835-i2c";
reg = <0x7e205000 0x1000>;
interrupts = <2 21>;
clocks = <&clk_i2c>;
#address-cells = <1>;
#size-cells = <0>;
status = "disabled";
};
sdhci: sdhci@7e300000 {
compatible = "brcm,bcm2835-sdhci";
reg = <0x7e300000 0x100>;
interrupts = <2 30>;
clocks = <&clk_mmc>;
status = "disabled";
};
i2c1: i2c@7e804000 {
compatible = "brcm,bcm2835-i2c";
reg = <0x7e804000 0x1000>;
interrupts = <2 21>;
clocks = <&clk_i2c>;
#address-cells = <1>;
#size-cells = <0>;
status = "disabled";
};
usb@7e980000 {
compatible = "brcm,bcm2835-usb";
reg = <0x7e980000 0x10000>;
interrupts = <1 9>;
};
arm-pmu { arm-pmu {
compatible = "arm,arm1176-pmu"; compatible = "arm,arm1176-pmu";
}; };
aux_enable: aux_enable@0x7e215004 {
compatible = "bcrm,bcm2835-aux-enable";
reg = <0x7e215004 0x04>;
};
};
}; };
clocks { &intc {
compatible = "simple-bus"; compatible = "brcm,bcm2835-armctrl-ic";
#address-cells = <1>;
#size-cells = <0>;
clk_mmc: clock@0 {
compatible = "fixed-clock";
reg = <0>;
#clock-cells = <0>;
clock-output-names = "mmc";
clock-frequency = <100000000>;
}; };
clk_i2c: clock@1 { &watchdog {
compatible = "fixed-clock"; status = "okay";
reg = <1>;
#clock-cells = <0>;
clock-output-names = "i2c";
clock-frequency = <250000000>;
};
clk_spi: clock@2 {
compatible = "fixed-clock";
reg = <2>;
#clock-cells = <0>;
clock-output-names = "spi";
clock-frequency = <250000000>;
};
};
}; };

View File

@@ -161,6 +161,7 @@
}; };
&exynos_usbphy { &exynos_usbphy {
vbus-supply = <&safeout_reg>;
status = "okay"; status = "okay";
}; };

View File

@@ -153,6 +153,7 @@
&exynos_usbphy { &exynos_usbphy {
status = "okay"; status = "okay";
vbus-supply = <&safeout_reg>;
}; };
&hsotg { &hsotg {

View File

@@ -251,6 +251,7 @@
&exynos_usbphy { &exynos_usbphy {
status = "okay"; status = "okay";
vbus-supply = <&safe1_sreg>;
}; };
&fimd { &fimd {
@@ -448,7 +449,6 @@
safe1_sreg: ESAFEOUT1 { safe1_sreg: ESAFEOUT1 {
regulator-name = "SAFEOUT1"; regulator-name = "SAFEOUT1";
regulator-always-on;
}; };
safe2_sreg: ESAFEOUT2 { safe2_sreg: ESAFEOUT2 {

View File

@@ -248,6 +248,7 @@
&exynos_usbphy { &exynos_usbphy {
status = "okay"; status = "okay";
vbus-supply = <&safeout1_reg>;
}; };
&fimd { &fimd {
@@ -486,7 +487,6 @@
safeout1_reg: ESAFEOUT1 { safeout1_reg: ESAFEOUT1 {
regulator-name = "SAFEOUT1"; regulator-name = "SAFEOUT1";
regulator-always-on;
}; };
safeout2_reg: ESAFEOUT2 { safeout2_reg: ESAFEOUT2 {

View File

@@ -391,6 +391,7 @@
}; };
&exynos_usbphy { &exynos_usbphy {
vbus-supply = <&esafeout1_reg>;
status = "okay"; status = "okay";
}; };

View File

@@ -486,7 +486,10 @@
compatible = "fsl,imx27-usb"; compatible = "fsl,imx27-usb";
reg = <0x10024000 0x200>; reg = <0x10024000 0x200>;
interrupts = <56>; interrupts = <56>;
clocks = <&clks IMX27_CLK_USB_IPG_GATE>; clocks = <&clks IMX27_CLK_USB_IPG_GATE>,
<&clks IMX27_CLK_USB_AHB_GATE>,
<&clks IMX27_CLK_USB_DIV>;
clock-names = "ipg", "ahb", "per";
fsl,usbmisc = <&usbmisc 0>; fsl,usbmisc = <&usbmisc 0>;
status = "disabled"; status = "disabled";
}; };
@@ -495,7 +498,10 @@
compatible = "fsl,imx27-usb"; compatible = "fsl,imx27-usb";
reg = <0x10024200 0x200>; reg = <0x10024200 0x200>;
interrupts = <54>; interrupts = <54>;
clocks = <&clks IMX27_CLK_USB_IPG_GATE>; clocks = <&clks IMX27_CLK_USB_IPG_GATE>,
<&clks IMX27_CLK_USB_AHB_GATE>,
<&clks IMX27_CLK_USB_DIV>;
clock-names = "ipg", "ahb", "per";
fsl,usbmisc = <&usbmisc 1>; fsl,usbmisc = <&usbmisc 1>;
dr_mode = "host"; dr_mode = "host";
status = "disabled"; status = "disabled";
@@ -505,7 +511,10 @@
compatible = "fsl,imx27-usb"; compatible = "fsl,imx27-usb";
reg = <0x10024400 0x200>; reg = <0x10024400 0x200>;
interrupts = <55>; interrupts = <55>;
clocks = <&clks IMX27_CLK_USB_IPG_GATE>; clocks = <&clks IMX27_CLK_USB_IPG_GATE>,
<&clks IMX27_CLK_USB_AHB_GATE>,
<&clks IMX27_CLK_USB_DIV>;
clock-names = "ipg", "ahb", "per";
fsl,usbmisc = <&usbmisc 2>; fsl,usbmisc = <&usbmisc 2>;
dr_mode = "host"; dr_mode = "host";
status = "disabled"; status = "disabled";
@@ -515,7 +524,6 @@
#index-cells = <1>; #index-cells = <1>;
compatible = "fsl,imx27-usbmisc"; compatible = "fsl,imx27-usbmisc";
reg = <0x10024600 0x200>; reg = <0x10024600 0x200>;
clocks = <&clks IMX27_CLK_USB_AHB_GATE>;
}; };
sahara2: sahara@10025000 { sahara2: sahara@10025000 {

View File

@@ -31,6 +31,24 @@
regulator-max-microvolt = <3000000>; regulator-max-microvolt = <3000000>;
}; };
mmc3_pwrseq: sdhci0_pwrseq {
compatible = "mmc-pwrseq-simple";
clocks = <&clk32kgaudio>;
clock-names = "ext_clock";
};
vmmcsdio_fixed: fixedregulator-mmcsdio {
compatible = "regulator-fixed";
regulator-name = "vmmcsdio_fixed";
regulator-min-microvolt = <1800000>;
regulator-max-microvolt = <1800000>;
gpio = <&gpio5 12 GPIO_ACTIVE_HIGH>; /* gpio140 WLAN_EN */
enable-active-high;
startup-delay-us = <70000>;
pinctrl-names = "default";
pinctrl-0 = <&wlan_pins>;
};
/* HS USB Host PHY on PORT 2 */ /* HS USB Host PHY on PORT 2 */
hsusb2_phy: hsusb2_phy { hsusb2_phy: hsusb2_phy {
compatible = "usb-nop-xceiv"; compatible = "usb-nop-xceiv";
@@ -197,12 +215,20 @@
>; >;
}; };
mcspi4_pins: pinmux_mcspi4_pins { mmc3_pins: pinmux_mmc3_pins {
pinctrl-single,pins = < pinctrl-single,pins = <
0x164 (PIN_INPUT | MUX_MODE1) /* mcspi4_clk */ OMAP5_IOPAD(0x01a4, PIN_INPUT_PULLUP | MUX_MODE0) /* wlsdio_clk */
0x168 (PIN_INPUT | MUX_MODE1) /* mcspi4_simo */ OMAP5_IOPAD(0x01a6, PIN_INPUT_PULLUP | MUX_MODE0) /* wlsdio_cmd */
0x16a (PIN_INPUT | MUX_MODE1) /* mcspi4_somi */ OMAP5_IOPAD(0x01a8, PIN_INPUT_PULLUP | MUX_MODE0) /* wlsdio_data0 */
0x16c (PIN_INPUT | MUX_MODE1) /* mcspi4_cs0 */ OMAP5_IOPAD(0x01aa, PIN_INPUT_PULLUP | MUX_MODE0) /* wlsdio_data1 */
OMAP5_IOPAD(0x01ac, PIN_INPUT_PULLUP | MUX_MODE0) /* wlsdio_data2 */
OMAP5_IOPAD(0x01ae, PIN_INPUT_PULLUP | MUX_MODE0) /* wlsdio_data3 */
>;
};
wlan_pins: pinmux_wlan_pins {
pinctrl-single,pins = <
OMAP5_IOPAD(0x1bc, PIN_OUTPUT | MUX_MODE6) /* mcspi1_clk.gpio5_140 */
>; >;
}; };
@@ -276,6 +302,12 @@
0x1A (PIN_OUTPUT | MUX_MODE0) /* fref_clk1_out, USB hub clk */ 0x1A (PIN_OUTPUT | MUX_MODE0) /* fref_clk1_out, USB hub clk */
>; >;
}; };
wlcore_irq_pin: pinmux_wlcore_irq_pin {
pinctrl-single,pins = <
OMAP5_IOPAD(0x040, WAKEUP_EN | PIN_INPUT_PULLUP | MUX_MODE6) /* llia_wakereqin.gpio1_wk14 */
>;
};
}; };
&mmc1 { &mmc1 {
@@ -290,8 +322,25 @@
}; };
&mmc3 { &mmc3 {
vmmc-supply = <&vmmcsdio_fixed>;
mmc-pwrseq = <&mmc3_pwrseq>;
bus-width = <4>; bus-width = <4>;
ti,non-removable; non-removable;
cap-power-off-card;
pinctrl-names = "default";
pinctrl-0 = <&mmc3_pins &wlcore_irq_pin>;
interrupts-extended = <&gic GIC_SPI 94 IRQ_TYPE_LEVEL_HIGH
&omap5_pmx_core 0x168>;
#address-cells = <1>;
#size-cells = <0>;
wlcore: wlcore@2 {
compatible = "ti,wl1271";
reg = <2>;
interrupt-parent = <&gpio1>;
interrupts = <14 IRQ_TYPE_LEVEL_HIGH>; /* gpio 14 */
ref-clock-frequency = <26000000>;
};
}; };
&mmc4 { &mmc4 {
@@ -598,11 +647,6 @@
pinctrl-0 = <&mcspi3_pins>; pinctrl-0 = <&mcspi3_pins>;
}; };
&mcspi4 {
pinctrl-names = "default";
pinctrl-0 = <&mcspi4_pins>;
};
&uart1 { &uart1 {
pinctrl-names = "default"; pinctrl-names = "default";
pinctrl-0 = <&uart1_pins>; pinctrl-0 = <&uart1_pins>;

View File

@@ -0,0 +1,80 @@
ifeq ($(CONFIG_OF),y)
# Overlays for the Raspberry Pi platform
ifeq ($(CONFIG_ARCH_BCM2708),y)
RPI_DT_OVERLAYS=y
endif
ifeq ($(CONFIG_ARCH_BCM2709),y)
RPI_DT_OVERLAYS=y
endif
ifeq ($(CONFIG_ARCH_BCM2835),y)
RPI_DT_OVERLAYS=y
endif
dtb-$(RPI_DT_OVERLAYS) += ads7846-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += at86rf233-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += bmp085_i2c-sensor-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += dht11-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += enc28j60-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += gpio-ir-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += gpio-poweroff-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += hifiberry-amp-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += hifiberry-dac-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += hifiberry-dacplus-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += hifiberry-digi-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += hy28a-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += hy28b-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += i2c-rtc-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += i2c-gpio-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += i2c0-bcm2708-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += i2c1-bcm2708-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += i2s-mmap-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += iqaudio-dac-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += iqaudio-dacplus-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += lirc-rpi-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += mcp2515-can0-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += mcp2515-can1-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += mmc-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += mz61581-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += pi3-disable-bt-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += pi3-miniuart-bt-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += piscreen-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += piscreen2r-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += pitft28-capacitive-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += pitft28-resistive-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += pps-gpio-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += pwm-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += pwm-2chan-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += raspidac3-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += rpi-backlight-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += rpi-dac-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += rpi-display-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += rpi-ft5406-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += rpi-proto-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += rpi-sense-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += sdhost-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += sdio-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += smi-dev-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += smi-nand-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += smi-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += spi-gpio35-39-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += tinylcd35-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += uart1-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += vc4-kms-v3d-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += vga666-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += w1-gpio-overlay.dtb
dtb-$(RPI_DT_OVERLAYS) += w1-gpio-pullup-overlay.dtb
targets += dtbs dtbs_install
targets += $(dtb-y)
endif
always := $(dtb-y)
clean-files := *.dtb
# Enable fixups to support overlays on BCM2708 platforms
ifeq ($(RPI_DT_OVERLAYS),y)
DTC_FLAGS ?= -@
endif

View File

@@ -0,0 +1,812 @@
Introduction
============
This directory contains Device Tree overlays. Device Tree makes it possible
to support many hardware configurations with a single kernel and without the
need to explicitly load or blacklist kernel modules. Note that this isn't a
"pure" Device Tree configuration (c.f. MACH_BCM2835) - some on-board devices
are still configured by the board support code, but the intention is to
eventually reach that goal.
On Raspberry Pi, Device Tree usage is controlled from /boot/config.txt. By
default, the Raspberry Pi kernel boots with device tree enabled. You can
completely disable DT usage (for now) by adding:
device_tree=
to your config.txt, which should cause your Pi to revert to the old way of
doing things after a reboot.
In /boot you will find a .dtb for each base platform. This describes the
hardware that is part of the Raspberry Pi board. The loader (start.elf and its
siblings) selects the .dtb file appropriate for the platform by name, and reads
it into memory. At this point, all of the optional interfaces (i2c, i2s, spi)
are disabled, but they can be enabled using Device Tree parameters:
dtparam=i2c=on,i2s=on,spi=on
However, this shouldn't be necessary in many use cases because loading an
overlay that requires one of those interfaces will cause it to be enabled
automatically, and it is advisable to only enable interfaces if they are
needed.
Configuring additional, optional hardware is done using Device Tree overlays
(see below).
raspi-config
============
The Advanced Options section of the raspi-config utility can enable and disable
Device Tree use, as well as toggling the I2C and SPI interfaces. Note that it
is possible to both enable an interface and blacklist the driver, if for some
reason you should want to defer the loading.
Modules
=======
As well as describing the hardware, Device Tree also gives enough information
to allow suitable driver modules to be located and loaded, with the corollary
that unneeded modules are not loaded. As a result it should be possible to
remove lines from /etc/modules, and /etc/modprobe.d/raspi-blacklist.conf can
have its contents deleted (or commented out).
Using Overlays
==============
Overlays are loaded using the "dtoverlay" directive. As an example, consider
the popular lirc-rpi module, the Linux Infrared Remote Control driver. In the
pre-DT world this would be loaded from /etc/modules, with an explicit
"modprobe lirc-rpi" command, or programmatically by lircd. With DT enabled,
this becomes a line in config.txt:
dtoverlay=lirc-rpi
This causes the file /boot/overlays/lirc-rpi-overlay.dtb to be loaded. By
default it will use GPIOs 17 (out) and 18 (in), but this can be modified using
DT parameters:
dtoverlay=lirc-rpi,gpio_out_pin=17,gpio_in_pin=13
Parameters always have default values, although in some cases (e.g. "w1-gpio")
it is necessary to provided multiple overlays in order to get the desired
behaviour. See the list of overlays below for a description of the parameters
and their defaults.
The Overlay and Parameter Reference
===================================
N.B. When editing this file, please preserve the indentation levels to make it
simple to parse programmatically. NO HARD TABS.
Name: <The base DTB>
Info: Configures the base Raspberry Pi hardware
Load: <loaded automatically>
Params:
audio Set to "on" to enable the onboard ALSA audio
interface (default "off")
i2c_arm Set to "on" to enable the ARM's i2c interface
(default "off")
i2c_vc Set to "on" to enable the i2c interface
usually reserved for the VideoCore processor
(default "off")
i2c An alias for i2c_arm
i2c_arm_baudrate Set the baudrate of the ARM's i2c interface
(default "100000")
i2c_vc_baudrate Set the baudrate of the VideoCore i2c interface
(default "100000")
i2c_baudrate An alias for i2c_arm_baudrate
i2s Set to "on" to enable the i2s interface
(default "off")
spi Set to "on" to enable the spi interfaces
(default "off")
random Set to "on" to enable the hardware random
number generator (default "on")
sd_overclock Clock (in MHz) to use when the MMC framework
requests 50MHz
sd_force_pio Disable DMA support for SD driver (default off)
sd_pio_limit Number of blocks above which to use DMA for
SD card (default 1)
sd_debug Enable debug output from SD driver (default off)
uart0 Set to "off" to disable uart0 (default "on")
watchdog Set to "on" to enable the hardware watchdog
(default "off")
act_led_trigger Choose which activity the LED tracks.
Use "heartbeat" for a nice load indicator.
(default "mmc")
act_led_activelow Set to "on" to invert the sense of the LED
(default "off")
act_led_gpio Set which GPIO to use for the activity LED
(in case you want to connect it to an external
device)
(default "16" on a non-Plus board, "47" on a
Plus or Pi 2)
pwr_led_trigger
pwr_led_activelow
pwr_led_gpio
As for act_led_*, but using the PWR LED.
Not available on Model A/B boards.
N.B. It is recommended to only enable those interfaces that are needed.
Leaving all interfaces enabled can lead to unwanted behaviour (i2c_vc
interfering with Pi Camera, I2S and SPI hogging GPIO pins, etc.)
Note also that i2c, i2c_arm and i2c_vc are aliases for the physical
interfaces i2c0 and i2c1. Use of the numeric variants is still possible
but deprecated because the ARM/VC assignments differ between board
revisions. The same board-specific mapping applies to i2c_baudrate,
and the other i2c baudrate parameters.
Name: ads7846
Info: ADS7846 Touch controller
Load: dtoverlay=ads7846,<param>=<val>
Params: cs SPI bus Chip Select (default 1)
speed SPI bus speed (default 2MHz, max 3.25MHz)
penirq GPIO used for PENIRQ. REQUIRED
penirq_pull Set GPIO pull (default 0=none, 2=pullup)
swapxy Swap x and y axis
xmin Minimum value on the X axis (default 0)
ymin Minimum value on the Y axis (default 0)
xmax Maximum value on the X axis (default 4095)
ymax Maximum value on the Y axis (default 4095)
pmin Minimum reported pressure value (default 0)
pmax Maximum reported pressure value (default 65535)
xohms Touchpanel sensitivity (X-plate resistance)
(default 400)
penirq is required and usually xohms (60-100) has to be set as well.
Apart from that, pmax (255) and swapxy are also common.
The rest of the calibration can be done with xinput-calibrator.
See: github.com/notro/fbtft/wiki/FBTFT-on-Raspian
Device Tree binding document:
www.kernel.org/doc/Documentation/devicetree/bindings/input/ads7846.txt
Name: at86rf233
Info: Configures the Atmel AT86RF233 802.15.4 low-power WPAN transceiver,
connected to spi0.0
Load: dtoverlay=at86rf233,<param>=<val>
Params: interrupt GPIO used for INT (default 23)
reset GPIO used for Reset (default 24)
sleep GPIO used for Sleep (default 25)
speed SPI bus speed in Hz (default 3000000)
trim Fine tuning of the internal capacitance
arrays (0=+0pF, 15=+4.5pF, default 15)
Name: bmp085_i2c-sensor
Info: Configures the BMP085/BMP180 digital barometric pressure and temperature
sensors from Bosch Sensortec
Load: dtoverlay=bmp085_i2c-sensor
Params: <None>
Name: dht11
Info: Overlay for the DHT11/DHT21/DHT22 humidity/temperature sensors
Also sometimes found with the part number(s) AM230x.
Load: dtoverlay=dht11,<param>=<val>
Params: gpiopin GPIO connected to the sensor's DATA output.
(default 4)
[ The ds1307-rtc overlay has been deleted. See i2c-rtc. ]
Name: enc28j60
Info: Overlay for the Microchip ENC28J60 Ethernet Controller (SPI)
Load: dtoverlay=enc28j60,<param>=<val>
Params: int_pin GPIO used for INT (default 25)
speed SPI bus speed (default 12000000)
Name: gpio-ir
Info: Use GPIO pin as rc-core style infrared receiver input. The rc-core-
based gpio_ir_recv driver maps received keys directly to a
/dev/input/event* device, all decoding is done by the kernel - LIRC is
not required! The key mapping and other decoding parameters can be
configured by "ir-keytable" tool.
Load: dtoverlay=gpio-ir,<param>=<val>
Params: gpio_pin Input pin number. Default is 18.
gpio_pull Desired pull-up/down state (off, down, up)
Default is "down".
rc-map-name Default rc keymap (can also be changed by
ir-keytable), defaults to "rc-rc6-mce"
Name: gpio-poweroff
Info: Drives a GPIO high or low on reboot
Load: dtoverlay=gpio-poweroff,<param>=<val>
Params: gpiopin GPIO for signalling (default 26)
active_low Set if the power control device requires a
high->low transition to trigger a power-down.
Note that this will require the support of a
custom dt-blob.bin to prevent a power-down
during the boot process, and that a reboot
will also cause the pin to go low.
Name: hifiberry-amp
Info: Configures the HifiBerry Amp and Amp+ audio cards
Load: dtoverlay=hifiberry-amp
Params: <None>
Name: hifiberry-dac
Info: Configures the HifiBerry DAC audio card
Load: dtoverlay=hifiberry-dac
Params: <None>
Name: hifiberry-dacplus
Info: Configures the HifiBerry DAC+ audio card
Load: dtoverlay=hifiberry-dacplus,<param>=<val>
Params: 24db_digital_gain Allow gain to be applied via the PCM512x codec
Digital volume control. Enable with
"dtoverlay=hifiberry-dacplus,24db_digital_gain"
(The default behaviour is that the Digital
volume control is limited to a maximum of
0dB. ie. it can attenuate but not provide
gain. For most users, this will be desired
as it will prevent clipping. By appending
the 24dB_digital_gain parameter, the Digital
volume control will allow up to 24dB of
gain. If this parameter is enabled, it is the
responsibility of the user to ensure that
the Digital volume control is set to a value
that does not result in clipping/distortion!)
Name: hifiberry-digi
Info: Configures the HifiBerry Digi audio card
Load: dtoverlay=hifiberry-digi
Params: <None>
Name: hy28a
Info: HY28A - 2.8" TFT LCD Display Module by HAOYU Electronics
Default values match Texy's display shield
Load: dtoverlay=hy28a,<param>=<val>
Params: speed Display SPI bus speed
rotate Display rotation {0,90,180,270}
fps Delay between frame updates
debug Debug output level {0-7}
xohms Touchpanel sensitivity (X-plate resistance)
resetgpio GPIO used to reset controller
ledgpio GPIO used to control backlight
Name: hy28b
Info: HY28B - 2.8" TFT LCD Display Module by HAOYU Electronics
Default values match Texy's display shield
Load: dtoverlay=hy28b,<param>=<val>
Params: speed Display SPI bus speed
rotate Display rotation {0,90,180,270}
fps Delay between frame updates
debug Debug output level {0-7}
xohms Touchpanel sensitivity (X-plate resistance)
resetgpio GPIO used to reset controller
ledgpio GPIO used to control backlight
Name: i2c-gpio
Info: Adds support for software i2c controller on gpio pins
Load: dtoverlay=i2c-gpio,<param>=<val>
Params: i2c_gpio_sda GPIO used for I2C data (default "23")
i2c_gpio_scl GPIO used for I2C clock (default "24")
i2c_gpio_delay_us Clock delay in microseconds
(default "2" = ~100kHz)
Name: i2c-rtc
Info: Adds support for a number of I2C Real Time Clock devices
Load: dtoverlay=i2c-rtc,<param>=<val>
Params: ds1307 Select the DS1307 device
ds3231 Select the DS3231 device
mcp7941x Select the MCP7941x device
pcf2127 Select the PCF2127 device
pcf8523 Select the PCF8523 device
pcf8563 Select the PCF8563 device
Name: i2c0-bcm2708
Info: Enable the i2c_bcm2708 driver for the i2c0 bus
Load: dtoverlay=i2c0-bcm2708,<param>=<val>
Params: sda0_pin GPIO pin for SDA0 (0, 28 [or 44] - default 0)
scl0_pin GPIO pin for SCL0 (1, 29 [or 45] - default 1)
Name: i2c1-bcm2708
Info: Enable the i2c_bcm2708 driver for the i2c1 bus
Load: dtoverlay=i2c1-bcm2708,<param>=<val>
Params: sda1_pin GPIO pin for SDA1 (2 or 44 - default 2)
scl1_pin GPIO pin for SCL1 (3 or 45 - default 3)
pin_func Alternative pin function (4 (alt0), 6 (alt2) -
default 4)
Name: i2s-mmap
Info: Enables mmap support in the bcm2708-i2s driver
Load: dtoverlay=i2s-mmap
Params: <None>
Name: iqaudio-dac
Info: Configures the IQaudio DAC audio card
Load: dtoverlay=iqaudio-dac
Params: <None>
Name: iqaudio-dacplus
Info: Configures the IQaudio DAC+ audio card
Load: dtoverlay=iqaudio-dacplus,<param>=<val>
Params: 24db_digital_gain Allow gain to be applied via the PCM512x codec
Digital volume control. Enable with
"dtoverlay=iqaudio-dacplus,24db_digital_gain"
(The default behaviour is that the Digital
volume control is limited to a maximum of
0dB. ie. it can attenuate but not provide
gain. For most users, this will be desired
as it will prevent clipping. By appending
the 24db_digital_gain parameter, the Digital
volume control will allow up to 24dB of
gain. If this parameter is enabled, it is the
responsibility of the user to ensure that
the Digital volume control is set to a value
that does not result in clipping/distortion!)
Name: lirc-rpi
Info: Configures lirc-rpi (Linux Infrared Remote Control for Raspberry Pi)
Consult the module documentation for more details.
Load: dtoverlay=lirc-rpi,<param>=<val>
Params: gpio_out_pin GPIO for output (default "17")
gpio_in_pin GPIO for input (default "18")
gpio_in_pull Pull up/down/off on the input pin
(default "down")
sense Override the IR receive auto-detection logic:
"0" = force active-high
"1" = force active-low
"-1" = use auto-detection
(default "-1")
softcarrier Turn the software carrier "on" or "off"
(default "on")
invert "on" = invert the output pin (default "off")
debug "on" = enable additional debug messages
(default "off")
Name: mcp2515-can0
Info: Configures the MCP2515 CAN controller on spi0.0
Load: dtoverlay=mcp2515-can0,<param>=<val>
Params: oscillator Clock frequency for the CAN controller (Hz)
spimaxfrequency Maximum SPI frequence (Hz)
interrupt GPIO for interrupt signal
Name: mcp2515-can1
Info: Configures the MCP2515 CAN controller on spi0.1
Load: dtoverlay=mcp2515-can1,<param>=<val>
Params: oscillator Clock frequency for the CAN controller (Hz)
spimaxfrequency Maximum SPI frequence (Hz)
interrupt GPIO for interrupt signal
Name: mmc
Info: Selects the bcm2835-mmc SD/MMC driver, optionally with overclock
Load: dtoverlay=mmc,<param>=<val>
Params: overclock_50 Clock (in MHz) to use when the MMC framework
requests 50MHz
Name: mz61581
Info: MZ61581 display by Tontec
Load: dtoverlay=mz61581,<param>=<val>
Params: speed Display SPI bus speed
rotate Display rotation {0,90,180,270}
fps Delay between frame updates
txbuflen Transmit buffer length (default 32768)
debug Debug output level {0-7}
xohms Touchpanel sensitivity (X-plate resistance)
[ The pcf2127-rtc overlay has been deleted. See i2c-rtc. ]
[ The pcf8523-rtc overlay has been deleted. See i2c-rtc. ]
[ The pcf8563-rtc overlay has been deleted. See i2c-rtc. ]
Name: pi3-disable-bt
Info: Disable Pi3 Bluetooth and restore UART0/ttyAMA0 over GPIOs 14 & 15
N.B. To disable the systemd service that initialises the modem so it
doesn't use the UART, use 'sudo systemctl disable hciuart'.
Load: dtoverlay=pi3-disable-bt
Params: <None>
Name: pi3-miniuart-bt
Info: Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore
UART0/ttyAMA0 over GPIOs 14 & 15. Note that this may reduce the maximum
usable baudrate.
N.B. It is also necessary to edit /lib/systemd/system/hciuart.server
and replace ttyAMA0 with ttyS0.
Load: dtoverlay=pi3-miniuart-bt
Params: <None>
Name: piscreen
Info: PiScreen display by OzzMaker.com
Load: dtoverlay=piscreen,<param>=<val>
Params: speed Display SPI bus speed
rotate Display rotation {0,90,180,270}
fps Delay between frame updates
debug Debug output level {0-7}
xohms Touchpanel sensitivity (X-plate resistance)
Name: piscreen2r
Info: PiScreen 2 with resistive TP display by OzzMaker.com
Load: dtoverlay=piscreen2r,<param>=<val>
Params: speed Display SPI bus speed
rotate Display rotation {0,90,180,270}
fps Delay between frame updates
debug Debug output level {0-7}
xohms Touchpanel sensitivity (X-plate resistance)
Name: pitft28-capacitive
Info: Adafruit PiTFT 2.8" capacitive touch screen
Load: dtoverlay=pitft28-capacitive,<param>=<val>
Params: speed Display SPI bus speed
rotate Display rotation {0,90,180,270}
fps Delay between frame updates
debug Debug output level {0-7}
touch-sizex Touchscreen size x (default 240)
touch-sizey Touchscreen size y (default 320)
touch-invx Touchscreen inverted x axis
touch-invy Touchscreen inverted y axis
touch-swapxy Touchscreen swapped x y axis
Name: pitft28-resistive
Info: Adafruit PiTFT 2.8" resistive touch screen
Load: dtoverlay=pitft28-resistive,<param>=<val>
Params: speed Display SPI bus speed
rotate Display rotation {0,90,180,270}
fps Delay between frame updates
debug Debug output level {0-7}
Name: pps-gpio
Info: Configures the pps-gpio (pulse-per-second time signal via GPIO).
Load: dtoverlay=pps-gpio,<param>=<val>
Params: gpiopin Input GPIO (default "18")
Name: pwm
Info: Configures a single PWM channel
Legal pin,function combinations for each channel:
PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0) 52,5(Alt1)
PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
N.B.:
1) Pin 18 is the only one available on all platforms, and
it is the one used by the I2S audio interface.
Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
2) The onboard analogue audio output uses both PWM channels.
3) So be careful mixing audio and PWM.
4) Currently the clock must have been enabled and configured
by other means.
Load: dtoverlay=pwm,<param>=<val>
Params: pin Output pin (default 18) - see table
func Pin function (default 2 = Alt5) - see above
clock PWM clock frequency (informational)
Name: pwm-2chan
Info: Configures both PWM channels
Legal pin,function combinations for each channel:
PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0) 52,5(Alt1)
PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
N.B.:
1) Pin 18 is the only one available on all platforms, and
it is the one used by the I2S audio interface.
Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
2) The onboard analogue audio output uses both PWM channels.
3) So be careful mixing audio and PWM.
4) Currently the clock must have been enabled and configured
by other means.
Load: dtoverlay=pwm-2chan,<param>=<val>
Params: pin Output pin (default 18) - see table
pin2 Output pin for other channel (default 19)
func Pin function (default 2 = Alt5) - see above
func2 Function for pin2 (default 2 = Alt5)
clock PWM clock frequency (informational)
Name: raspidac3
Info: Configures the RaspiDAV Rev.3x audio card
Load: dtoverlay=raspidac3
Params: <None>
Name: rpi-backlight
Info: Raspberry Pi official display backlight driver
Load: dtoverlay=rpi-backlight
Params: <None>
Name: rpi-dac
Info: Configures the RPi DAC audio card
Load: dtoverlay=rpi-dac
Params: <None>
Name: rpi-display
Info: RPi-Display - 2.8" Touch Display by Watterott
Load: dtoverlay=rpi-display,<param>=<val>
Params: speed Display SPI bus speed
rotate Display rotation {0,90,180,270}
fps Delay between frame updates
debug Debug output level {0-7}
xohms Touchpanel sensitivity (X-plate resistance)
Name: rpi-ft5406
Info: Official Raspberry Pi display touchscreen
Load: dtoverlay=rpi-ft5406
Params: <None>
Name: rpi-proto
Info: Configures the RPi Proto audio card
Load: dtoverlay=rpi-proto
Params: <None>
Name: rpi-sense
Info: Raspberry Pi Sense HAT
Load: dtoverlay=rpi-sense
Params: <None>
Name: sdhost
Info: Selects the bcm2835-sdhost SD/MMC driver, optionally with overclock
Load: dtoverlay=sdhost,<param>=<val>
Params: overclock_50 Clock (in MHz) to use when the MMC framework
requests 50MHz
force_pio Disable DMA support (default off)
pio_limit Number of blocks above which to use DMA
(default 1)
debug Enable debug output (default off)
Name: sdio
Info: Selects the bcm2835-sdhost SD/MMC driver, optionally with overclock,
and enables SDIO via GPIOs 22-27.
Load: dtoverlay=sdio,<param>=<val>
Params: overclock_50 SD Clock (in MHz) to use when the MMC framework
requests 50MHz
sdio_overclock SDIO Clock (in MHz) to use when the MMC
framework requests 50MHz
force_pio Disable DMA support (default off)
pio_limit Number of blocks above which to use DMA
(default 1)
debug Enable debug output (default off)
poll_once Disable SDIO-device polling every second
(default on: polling once at boot-time)
bus_width Set the SDIO host bus width (default 4 bits)
Name: smi
Info: Enables the Secondary Memory Interface peripheral. Uses GPIOs 2-25!
Load: dtoverlay=smi
Params: <None>
Name: smi-dev
Info: Enables the userspace interface for the SMI driver
Load: dtoverlay=smi-dev
Params: <None>
Name: smi-nand
Info: Enables access to NAND flash via the SMI interface
Load: dtoverlay=smi-nand
Params: <None>
Name: spi-gpio35-39
Info: move SPI function block to GPIO 35 to 39
Load: dtoverlay=spi-gpio35-39
Params: <None>
Name: tinylcd35
Info: 3.5" Color TFT Display by www.tinylcd.com
Options: Touch, RTC, keypad
Load: dtoverlay=tinylcd35,<param>=<val>
Params: speed Display SPI bus speed
rotate Display rotation {0,90,180,270}
fps Delay between frame updates
debug Debug output level {0-7}
touch Enable touch panel
touchgpio Touch controller IRQ GPIO
xohms Touchpanel: Resistance of X-plate in ohms
rtc-pcf PCF8563 Real Time Clock
rtc-ds DS1307 Real Time Clock
keypad Enable keypad
Examples:
Display with touchpanel, PCF8563 RTC and keypad:
dtoverlay=tinylcd35,touch,rtc-pcf,keypad
Old touch display:
dtoverlay=tinylcd35,touch,touchgpio=3
Name: uart1
Info: Enable uart1 in place of uart0
Load: dtoverlay=uart1,<param>=<val>
Params: txd1_pin GPIO pin for TXD1 (14, 32 or 40 - default 14)
rxd1_pin GPIO pin for RXD1 (15, 33 or 41 - default 15)
Name: vc4-kms-v3d
Info: Enable Eric Anholt's DRM VC4 HDMI/HVS/V3D driver. Running startx or
booting to GUI while this overlay is in use will cause interesting
lockups.
Load: dtoverlay=vc4-kms-v3d
Params: <None>
Name: vga666
Info: Overlay for the Fen Logic VGA666 board
This uses GPIOs 2-21 (so no I2C), and activates the output 2-3 seconds
after the kernel has started.
Load: dtoverlay=vga666
Params: <None>
Name: w1-gpio
Info: Configures the w1-gpio Onewire interface module.
Use this overlay if you *don't* need a GPIO to drive an external pullup.
Load: dtoverlay=w1-gpio,<param>=<val>
Params: gpiopin GPIO for I/O (default "4")
pullup Non-zero, "on", or "y" to enable the parasitic
power (2-wire, power-on-data) feature
Name: w1-gpio-pullup
Info: Configures the w1-gpio Onewire interface module.
Use this overlay if you *do* need a GPIO to drive an external pullup.
Load: dtoverlay=w1-gpio-pullup,<param>=<val>
Params: gpiopin GPIO for I/O (default "4")
pullup Non-zero, "on", or "y" to enable the parasitic
power (2-wire, power-on-data) feature
extpullup GPIO for external pullup (default "5")
Troubleshooting
===============
If you are experiencing problems that you think are DT-related, enable DT
diagnostic output by adding this to /boot/config.txt:
dtdebug=on
and rebooting. Then run:
sudo vcdbg log msg
and look for relevant messages.
Further reading
===============
This is only meant to be a quick introduction to the subject of Device Tree on
Raspberry Pi. There is a more complete explanation here:
http://www.raspberrypi.org/documentation/configuration/device-tree.md

View File

@@ -0,0 +1,83 @@
/*
* Generic Device Tree overlay for the ADS7846 touch controller
*
*/
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
fragment@0 {
target = <&spi0>;
__overlay__ {
status = "okay";
spidev@0{
status = "disabled";
};
spidev@1{
status = "disabled";
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
ads7846_pins: ads7846_pins {
brcm,pins = <255>; /* illegal default value */
brcm,function = <0>; /* in */
brcm,pull = <0>; /* none */
};
};
};
fragment@2 {
target = <&spi0>;
__overlay__ {
/* needed to avoid dtc warning */
#address-cells = <1>;
#size-cells = <0>;
ads7846: ads7846@1 {
compatible = "ti,ads7846";
reg = <1>;
pinctrl-names = "default";
pinctrl-0 = <&ads7846_pins>;
spi-max-frequency = <2000000>;
interrupts = <255 2>; /* high-to-low edge triggered */
interrupt-parent = <&gpio>;
pendown-gpio = <&gpio 255 0>;
/* driver defaults */
ti,x-min = /bits/ 16 <0>;
ti,y-min = /bits/ 16 <0>;
ti,x-max = /bits/ 16 <0x0FFF>;
ti,y-max = /bits/ 16 <0x0FFF>;
ti,pressure-min = /bits/ 16 <0>;
ti,pressure-max = /bits/ 16 <0xFFFF>;
ti,x-plate-ohms = /bits/ 16 <400>;
};
};
};
__overrides__ {
cs = <&ads7846>,"reg:0";
speed = <&ads7846>,"spi-max-frequency:0";
penirq = <&ads7846_pins>,"brcm,pins:0", /* REQUIRED */
<&ads7846>,"interrupts:0",
<&ads7846>,"pendown-gpio:4";
penirq_pull = <&ads7846_pins>,"brcm,pull:0";
swapxy = <&ads7846>,"ti,swap-xy?";
xmin = <&ads7846>,"ti,x-min;0";
ymin = <&ads7846>,"ti,y-min;0";
xmax = <&ads7846>,"ti,x-max;0";
ymax = <&ads7846>,"ti,y-max;0";
pmin = <&ads7846>,"ti,pressure-min;0";
pmax = <&ads7846>,"ti,pressure-max;0";
xohms = <&ads7846>,"ti,x-plate-ohms;0";
};
};

View File

@@ -0,0 +1,54 @@
/dts-v1/;
/plugin/;
/* Overlay for Atmel AT86RF233 IEEE 802.15.4 WPAN transceiver on spi0.0 */
/ {
compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
fragment@0 {
target = <&spi0>;
__overlay__ {
#address-cells = <1>;
#size-cells = <0>;
status = "okay";
spidev@0{
status = "disabled";
};
lowpan0: at86rf233@0 {
compatible = "atmel,at86rf233";
reg = <0>;
interrupt-parent = <&gpio>;
interrupts = <23 4>; /* active high */
reset-gpio = <&gpio 24 1>;
sleep-gpio = <&gpio 25 1>;
spi-max-frequency = <3000000>;
xtal-trim = /bits/ 8 <0xf>;
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
lowpan0_pins: lowpan0_pins {
brcm,pins = <23 24 25>;
brcm,function = <0 1 1>; /* in out out */
};
};
};
__overrides__ {
interrupt = <&lowpan0>, "interrupts:0",
<&lowpan0_pins>, "brcm,pins:0";
reset = <&lowpan0>, "reset-gpio:4",
<&lowpan0_pins>, "brcm,pins:4";
sleep = <&lowpan0>, "sleep-gpio:4",
<&lowpan0_pins>, "brcm,pins:8";
speed = <&lowpan0>, "spi-max-frequency:0";
trim = <&lowpan0>, "xtal-trim.0";
};
};

View File

@@ -0,0 +1,23 @@
// Definitions for BMP085/BMP180 digital barometric pressure and temperature sensors from Bosch Sensortec
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target = <&i2c_arm>;
__overlay__ {
#address-cells = <1>;
#size-cells = <0>;
status = "okay";
bmp085@77 {
compatible = "bosch,bmp085";
reg = <0x77>;
default-oversampling = <3>;
status = "okay";
};
};
};
};

View File

@@ -0,0 +1,39 @@
/*
* Overlay for the DHT11/21/22 humidity/temperature sensor modules.
*/
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target-path = "/";
__overlay__ {
dht11: dht11@0 {
compatible = "dht11";
pinctrl-names = "default";
pinctrl-0 = <&dht11_pins>;
gpios = <&gpio 4 0>;
status = "okay";
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
dht11_pins: dht11_pins {
brcm,pins = <4>;
brcm,function = <0>; // in
brcm,pull = <0>; // off
};
};
};
__overrides__ {
gpiopin = <&dht11_pins>,"brcm,pins:0",
<&dht11>,"gpios:4";
};
};

View File

@@ -0,0 +1,50 @@
// Overlay for the Microchip ENC28J60 Ethernet Controller
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target = <&spi0>;
__overlay__ {
/* needed to avoid dtc warning */
#address-cells = <1>;
#size-cells = <0>;
status = "okay";
spidev@0{
status = "disabled";
};
eth1: enc28j60@0{
compatible = "microchip,enc28j60";
reg = <0>; /* CE0 */
pinctrl-names = "default";
pinctrl-0 = <&eth1_pins>;
interrupt-parent = <&gpio>;
interrupts = <25 0x2>; /* falling edge */
spi-max-frequency = <12000000>;
status = "okay";
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
eth1_pins: eth1_pins {
brcm,pins = <25>;
brcm,function = <0>; /* in */
brcm,pull = <0>; /* none */
};
};
};
__overrides__ {
int_pin = <&eth1>, "interrupts:0",
<&eth1_pins>, "brcm,pins:0";
speed = <&eth1>, "spi-max-frequency:0";
};
};

View File

@@ -0,0 +1,45 @@
// Definitions for ir-gpio module
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target-path = "/";
__overlay__ {
gpio_ir: ir-receiver {
compatible = "gpio-ir-receiver";
// pin number, high or low
gpios = <&gpio 18 1>;
// parameter for keymap name
linux,rc-map-name = "rc-rc6-mce";
status = "okay";
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
gpio_ir_pins: gpio_ir_pins {
brcm,pins = <18>; // pin 18
brcm,function = <0>; // in
brcm,pull = <1>; // down
};
};
};
__overrides__ {
// parameters
gpio_pin = <&gpio_ir>,"gpios:4",
<&gpio_ir_pins>,"brcm,pins:0",
<&gpio_ir_pins>,"brcm,pull:0"; // pin number
gpio_pull = <&gpio_ir_pins>,"brcm,pull:0"; // pull-up/down state
rc-map-name = <&gpio_ir>,"linux,rc-map-name"; // default rc map
};
};

View File

@@ -0,0 +1,34 @@
// Definitions for gpio-poweroff module
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target-path = "/";
__overlay__ {
power_ctrl: power_ctrl {
compatible = "gpio-poweroff";
gpios = <&gpio 26 0>;
force;
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
power_ctrl_pins: power_ctrl_pins {
brcm,pins = <26>;
brcm,function = <1>; // out
};
};
};
__overrides__ {
gpiopin = <&power_ctrl>,"gpios:4",
<&power_ctrl_pins>,"brcm,pins:0";
active_low = <&power_ctrl>,"gpios:8";
};
};

View File

@@ -0,0 +1,39 @@
// Definitions for HiFiBerry Amp/Amp+
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target = <&sound>;
__overlay__ {
compatible = "hifiberry,hifiberry-amp";
i2s-controller = <&i2s>;
status = "okay";
};
};
fragment@1 {
target = <&i2s>;
__overlay__ {
status = "okay";
};
};
fragment@2 {
target = <&i2c1>;
__overlay__ {
#address-cells = <1>;
#size-cells = <0>;
status = "okay";
tas5713@1b {
#sound-dai-cells = <0>;
compatible = "ti,tas5713";
reg = <0x1b>;
status = "okay";
};
};
};
};

View File

@@ -0,0 +1,34 @@
// Definitions for HiFiBerry DAC
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target = <&sound>;
__overlay__ {
compatible = "hifiberry,hifiberry-dac";
i2s-controller = <&i2s>;
status = "okay";
};
};
fragment@1 {
target = <&i2s>;
__overlay__ {
status = "okay";
};
};
fragment@2 {
target-path = "/";
__overlay__ {
pcm5102a-codec {
#sound-dai-cells = <0>;
compatible = "ti,pcm5102a";
status = "okay";
};
};
};
};

View File

@@ -0,0 +1,54 @@
// Definitions for HiFiBerry DAC+
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target-path = "/clocks";
__overlay__ {
dacpro_osc: dacpro_osc {
compatible = "hifiberry,dacpro-clk";
#clock-cells = <0>;
};
};
};
fragment@1 {
target = <&sound>;
frag1: __overlay__ {
compatible = "hifiberry,hifiberry-dacplus";
i2s-controller = <&i2s>;
status = "okay";
};
};
fragment@2 {
target = <&i2s>;
__overlay__ {
status = "okay";
};
};
fragment@3 {
target = <&i2c1>;
__overlay__ {
#address-cells = <1>;
#size-cells = <0>;
status = "okay";
pcm5122@4d {
#sound-dai-cells = <0>;
compatible = "ti,pcm5122";
reg = <0x4d>;
clocks = <&dacpro_osc>;
status = "okay";
};
};
};
__overrides__ {
24db_digital_gain = <&frag1>,"hifiberry,24db_digital_gain?";
};
};

View File

@@ -0,0 +1,39 @@
// Definitions for HiFiBerry Digi
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target = <&sound>;
__overlay__ {
compatible = "hifiberry,hifiberry-digi";
i2s-controller = <&i2s>;
status = "okay";
};
};
fragment@1 {
target = <&i2s>;
__overlay__ {
status = "okay";
};
};
fragment@2 {
target = <&i2c1>;
__overlay__ {
#address-cells = <1>;
#size-cells = <0>;
status = "okay";
wm8804@3b {
#sound-dai-cells = <0>;
compatible = "wlf,wm8804";
reg = <0x3b>;
status = "okay";
};
};
};
};

View File

@@ -0,0 +1,87 @@
/*
* Device Tree overlay for HY28A display
*
*/
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
fragment@0 {
target = <&spi0>;
__overlay__ {
status = "okay";
spidev@0{
status = "disabled";
};
spidev@1{
status = "disabled";
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
hy28a_pins: hy28a_pins {
brcm,pins = <17 25 18>;
brcm,function = <0 1 1>; /* in out out */
};
};
};
fragment@2 {
target = <&spi0>;
__overlay__ {
/* needed to avoid dtc warning */
#address-cells = <1>;
#size-cells = <0>;
hy28a: hy28a@0{
compatible = "ilitek,ili9320";
reg = <0>;
pinctrl-names = "default";
pinctrl-0 = <&hy28a_pins>;
spi-max-frequency = <32000000>;
spi-cpol;
spi-cpha;
rotate = <270>;
bgr;
fps = <50>;
buswidth = <8>;
startbyte = <0x70>;
reset-gpios = <&gpio 25 0>;
led-gpios = <&gpio 18 1>;
debug = <0>;
};
hy28a_ts: hy28a-ts@1 {
compatible = "ti,ads7846";
reg = <1>;
spi-max-frequency = <2000000>;
interrupts = <17 2>; /* high-to-low edge triggered */
interrupt-parent = <&gpio>;
pendown-gpio = <&gpio 17 0>;
ti,x-plate-ohms = /bits/ 16 <100>;
ti,pressure-max = /bits/ 16 <255>;
};
};
};
__overrides__ {
speed = <&hy28a>,"spi-max-frequency:0";
rotate = <&hy28a>,"rotate:0";
fps = <&hy28a>,"fps:0";
debug = <&hy28a>,"debug:0";
xohms = <&hy28a_ts>,"ti,x-plate-ohms;0";
resetgpio = <&hy28a>,"reset-gpios:4",
<&hy28a_pins>, "brcm,pins:1";
ledgpio = <&hy28a>,"led-gpios:4",
<&hy28a_pins>, "brcm,pins:2";
};
};

View File

@@ -0,0 +1,142 @@
/*
* Device Tree overlay for HY28b display shield by Texy
*
*/
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
fragment@0 {
target = <&spi0>;
__overlay__ {
status = "okay";
spidev@0{
status = "disabled";
};
spidev@1{
status = "disabled";
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
hy28b_pins: hy28b_pins {
brcm,pins = <17 25 18>;
brcm,function = <0 1 1>; /* in out out */
};
};
};
fragment@2 {
target = <&spi0>;
__overlay__ {
/* needed to avoid dtc warning */
#address-cells = <1>;
#size-cells = <0>;
hy28b: hy28b@0{
compatible = "ilitek,ili9325";
reg = <0>;
pinctrl-names = "default";
pinctrl-0 = <&hy28b_pins>;
spi-max-frequency = <48000000>;
spi-cpol;
spi-cpha;
rotate = <270>;
bgr;
fps = <50>;
buswidth = <8>;
startbyte = <0x70>;
reset-gpios = <&gpio 25 0>;
led-gpios = <&gpio 18 1>;
gamma = "04 1F 4 7 7 0 7 7 6 0\n0F 00 1 7 4 0 0 0 6 7";
init = <0x10000e7 0x0010
0x1000000 0x0001
0x1000001 0x0100
0x1000002 0x0700
0x1000003 0x1030
0x1000004 0x0000
0x1000008 0x0207
0x1000009 0x0000
0x100000a 0x0000
0x100000c 0x0001
0x100000d 0x0000
0x100000f 0x0000
0x1000010 0x0000
0x1000011 0x0007
0x1000012 0x0000
0x1000013 0x0000
0x2000032
0x1000010 0x1590
0x1000011 0x0227
0x2000032
0x1000012 0x009c
0x2000032
0x1000013 0x1900
0x1000029 0x0023
0x100002b 0x000e
0x2000032
0x1000020 0x0000
0x1000021 0x0000
0x2000032
0x1000050 0x0000
0x1000051 0x00ef
0x1000052 0x0000
0x1000053 0x013f
0x1000060 0xa700
0x1000061 0x0001
0x100006a 0x0000
0x1000080 0x0000
0x1000081 0x0000
0x1000082 0x0000
0x1000083 0x0000
0x1000084 0x0000
0x1000085 0x0000
0x1000090 0x0010
0x1000092 0x0000
0x1000093 0x0003
0x1000095 0x0110
0x1000097 0x0000
0x1000098 0x0000
0x1000007 0x0133
0x1000020 0x0000
0x1000021 0x0000
0x2000064>;
debug = <0>;
};
hy28b_ts: hy28b-ts@1 {
compatible = "ti,ads7846";
reg = <1>;
spi-max-frequency = <2000000>;
interrupts = <17 2>; /* high-to-low edge triggered */
interrupt-parent = <&gpio>;
pendown-gpio = <&gpio 17 0>;
ti,x-plate-ohms = /bits/ 16 <100>;
ti,pressure-max = /bits/ 16 <255>;
};
};
};
__overrides__ {
speed = <&hy28b>,"spi-max-frequency:0";
rotate = <&hy28b>,"rotate:0";
fps = <&hy28b>,"fps:0";
debug = <&hy28b>,"debug:0";
xohms = <&hy28b_ts>,"ti,x-plate-ohms;0";
resetgpio = <&hy28b>,"reset-gpios:4",
<&hy28b_pins>, "brcm,pins:1";
ledgpio = <&hy28b>,"led-gpios:4",
<&hy28b_pins>, "brcm,pins:2";
};
};

View File

@@ -0,0 +1,28 @@
// Overlay for i2c_gpio bitbanging host bus.
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target-path = "/";
__overlay__ {
i2c_gpio: i2c@0 {
compatible = "i2c-gpio";
gpios = <&gpio 23 0 /* sda */
&gpio 24 0 /* scl */
>;
i2c-gpio,delay-us = <2>; /* ~100 kHz */
#address-cells = <1>;
#size-cells = <0>;
};
};
};
__overrides__ {
i2c_gpio_sda = <&i2c_gpio>,"gpios:4";
i2c_gpio_scl = <&i2c_gpio>,"gpios:16";
i2c_gpio_delay_us = <&i2c_gpio>,"i2c-gpio,delay-us:0";
};
};

View File

@@ -0,0 +1,55 @@
// Definitions for several I2C based Real Time Clocks
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target = <&i2c_arm>;
__overlay__ {
#address-cells = <1>;
#size-cells = <0>;
status = "okay";
ds1307: ds1307@68 {
compatible = "maxim,ds1307";
reg = <0x68>;
status = "disable";
};
mcp7941x: mcp7941x@6f {
compatible = "microchip,mcp7941x";
reg = <0x6f>;
status = "disable";
};
ds3231: ds3231@68 {
compatible = "maxim,ds3231";
reg = <0x68>;
status = "disable";
};
pcf2127: pcf2127@51 {
compatible = "nxp,pcf2127";
reg = <0x51>;
status = "disable";
};
pcf8523: pcf8523@68 {
compatible = "nxp,pcf8523";
reg = <0x68>;
status = "disable";
};
pcf8563: pcf8563@51 {
compatible = "nxp,pcf8563";
reg = <0x51>;
status = "disable";
};
};
};
__overrides__ {
ds1307 = <&ds1307>,"status";
ds3231 = <&ds3231>,"status";
mcp7941x = <&mcp7941x>,"status";
pcf2127 = <&pcf2127>,"status";
pcf8523 = <&pcf8523>,"status";
pcf8563 = <&pcf8563>,"status";
};
};

View File

@@ -0,0 +1,36 @@
/*
* Device tree overlay for i2c_bcm2708, i2c0 bus
*
* Compile:
* dtc -@ -I dts -O dtb -o i2c0-bcm2708-overlay.dtb i2c0-bcm2708-overlay.dts
*/
/dts-v1/;
/plugin/;
/{
compatible = "brcm,bcm2708";
fragment@0 {
target = <&i2c0>;
__overlay__ {
pinctrl-0 = <&i2c0_pins>;
status = "okay";
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
i2c0_pins: i2c0 {
brcm,pins = <0 1>;
brcm,function = <4>; /* alt0 */
};
};
};
__overrides__ {
sda0_pin = <&i2c0_pins>,"brcm,pins:0";
scl0_pin = <&i2c0_pins>,"brcm,pins:4";
};
};

View File

@@ -0,0 +1,37 @@
/*
* Device tree overlay for i2c_bcm2708, i2c1 bus
*
* Compile:
* dtc -@ -I dts -O dtb -o i2c1-bcm2708-overlay.dtb i2c1-bcm2708-overlay.dts
*/
/dts-v1/;
/plugin/;
/{
compatible = "brcm,bcm2708";
fragment@0 {
target = <&i2c1>;
__overlay__ {
pinctrl-0 = <&i2c1_pins>;
status = "okay";
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
i2c1_pins: i2c1 {
brcm,pins = <2 3>;
brcm,function = <4>; /* alt0 */
};
};
};
__overrides__ {
sda1_pin = <&i2c1_pins>,"brcm,pins:0";
scl1_pin = <&i2c1_pins>,"brcm,pins:4";
pin_func = <&i2c1_pins>,"brcm,function:0";
};
};

View File

@@ -0,0 +1,13 @@
/dts-v1/;
/plugin/;
/{
compatible = "brcm,bcm2708";
fragment@0 {
target = <&i2s>;
__overlay__ {
brcm,enable-mmap;
};
};
};

View File

@@ -0,0 +1,39 @@
// Definitions for IQaudIO DAC
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target = <&sound>;
__overlay__ {
compatible = "iqaudio,iqaudio-dac";
i2s-controller = <&i2s>;
status = "okay";
};
};
fragment@1 {
target = <&i2s>;
__overlay__ {
status = "okay";
};
};
fragment@2 {
target = <&i2c1>;
__overlay__ {
#address-cells = <1>;
#size-cells = <0>;
status = "okay";
pcm5122@4c {
#sound-dai-cells = <0>;
compatible = "ti,pcm5122";
reg = <0x4c>;
status = "okay";
};
};
};
};

View File

@@ -0,0 +1,43 @@
// Definitions for IQaudIO DAC+
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target = <&sound>;
frag0: __overlay__ {
compatible = "iqaudio,iqaudio-dac";
i2s-controller = <&i2s>;
status = "okay";
};
};
fragment@1 {
target = <&i2s>;
__overlay__ {
status = "okay";
};
};
fragment@2 {
target = <&i2c1>;
__overlay__ {
#address-cells = <1>;
#size-cells = <0>;
status = "okay";
pcm5122@4c {
#sound-dai-cells = <0>;
compatible = "ti,pcm5122";
reg = <0x4c>;
status = "okay";
};
};
};
__overrides__ {
24db_digital_gain = <&frag0>,"iqaudio,24db_digital_gain?";
};
};

View File

@@ -0,0 +1,57 @@
// Definitions for lirc-rpi module
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target-path = "/";
__overlay__ {
lirc_rpi: lirc_rpi {
compatible = "rpi,lirc-rpi";
pinctrl-names = "default";
pinctrl-0 = <&lirc_pins>;
status = "okay";
// Override autodetection of IR receiver circuit
// (0 = active high, 1 = active low, -1 = no override )
rpi,sense = <0xffffffff>;
// Software carrier
// (0 = off, 1 = on)
rpi,softcarrier = <1>;
// Invert output
// (0 = off, 1 = on)
rpi,invert = <0>;
// Enable debugging messages
// (0 = off, 1 = on)
rpi,debug = <0>;
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
lirc_pins: lirc_pins {
brcm,pins = <17 18>;
brcm,function = <1 0>; // out in
brcm,pull = <0 1>; // off down
};
};
};
__overrides__ {
gpio_out_pin = <&lirc_pins>,"brcm,pins:0";
gpio_in_pin = <&lirc_pins>,"brcm,pins:4";
gpio_in_pull = <&lirc_pins>,"brcm,pull:4";
sense = <&lirc_rpi>,"rpi,sense:0";
softcarrier = <&lirc_rpi>,"rpi,softcarrier:0";
invert = <&lirc_rpi>,"rpi,invert:0";
debug = <&lirc_rpi>,"rpi,debug:0";
};
};

View File

@@ -0,0 +1,69 @@
/*
* Device tree overlay for mcp251x/can0 on spi0.0
*/
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
/* disable spi-dev for spi0.0 */
fragment@0 {
target = <&spi0>;
__overlay__ {
status = "okay";
spidev@0{
status = "disabled";
};
};
};
/* the interrupt pin of the can-controller */
fragment@1 {
target = <&gpio>;
__overlay__ {
can0_pins: can0_pins {
brcm,pins = <25>;
brcm,function = <0>; /* input */
};
};
};
/* the clock/oscillator of the can-controller */
fragment@2 {
target-path = "/clocks";
__overlay__ {
/* external oscillator of mcp2515 on SPI0.0 */
can0_osc: can0_osc {
compatible = "fixed-clock";
#clock-cells = <0>;
clock-frequency = <16000000>;
};
};
};
/* the spi config of the can-controller itself binding everything together */
fragment@3 {
target = <&spi0>;
__overlay__ {
/* needed to avoid dtc warning */
#address-cells = <1>;
#size-cells = <0>;
can0: mcp2515@0 {
reg = <0>;
compatible = "microchip,mcp2515";
pinctrl-names = "default";
pinctrl-0 = <&can0_pins>;
spi-max-frequency = <10000000>;
interrupt-parent = <&gpio>;
interrupts = <25 0x2>;
clocks = <&can0_osc>;
};
};
};
__overrides__ {
oscillator = <&can0_osc>,"clock-frequency:0";
spimaxfrequency = <&can0>,"spi-max-frequency:0";
interrupt = <&can0_pins>,"brcm,pins:0",<&can0>,"interrupts:0";
};
};

View File

@@ -0,0 +1,69 @@
/*
* Device tree overlay for mcp251x/can1 on spi0.1 edited by petit_miner
*/
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
/* disable spi-dev for spi0.1 */
fragment@0 {
target = <&spi0>;
__overlay__ {
status = "okay";
spidev@1{
status = "disabled";
};
};
};
/* the interrupt pin of the can-controller */
fragment@1 {
target = <&gpio>;
__overlay__ {
can1_pins: can1_pins {
brcm,pins = <25>;
brcm,function = <0>; /* input */
};
};
};
/* the clock/oscillator of the can-controller */
fragment@2 {
target-path = "/clocks";
__overlay__ {
/* external oscillator of mcp2515 on spi0.1 */
can1_osc: can1_osc {
compatible = "fixed-clock";
#clock-cells = <0>;
clock-frequency = <16000000>;
};
};
};
/* the spi config of the can-controller itself binding everything together */
fragment@3 {
target = <&spi0>;
__overlay__ {
/* needed to avoid dtc warning */
#address-cells = <1>;
#size-cells = <0>;
can1: mcp2515@1 {
reg = <1>;
compatible = "microchip,mcp2515";
pinctrl-names = "default";
pinctrl-0 = <&can1_pins>;
spi-max-frequency = <10000000>;
interrupt-parent = <&gpio>;
interrupts = <25 0x2>;
clocks = <&can1_osc>;
};
};
};
__overrides__ {
oscillator = <&can1_osc>,"clock-frequency:0";
spimaxfrequency = <&can1>,"spi-max-frequency:0";
interrupt = <&can1_pins>,"brcm,pins:0",<&can1>,"interrupts:0";
};
};

View File

@@ -0,0 +1,38 @@
/dts-v1/;
/plugin/;
/{
compatible = "brcm,bcm2708";
fragment@0 {
target = <&mmc>;
frag0: __overlay__ {
pinctrl-names = "default";
pinctrl-0 = <&mmc_pins>;
bus-width = <4>;
brcm,overclock-50 = <0>;
status = "okay";
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
mmc_pins: mmc_pins {
brcm,pins = <48 49 50 51 52 53>;
brcm,function = <7>; /* alt3 */
};
};
};
fragment@2 {
target = <&sdhost>;
__overlay__ {
status = "disabled";
};
};
__overrides__ {
overclock_50 = <&frag0>,"brcm,overclock-50:0";
};
};

View File

@@ -0,0 +1,111 @@
/*
* Device Tree overlay for MZ61581-PI-EXT 2014.12.28 by Tontec
*
*/
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
fragment@0 {
target = <&spi0>;
__overlay__ {
status = "okay";
spidev@0{
status = "disabled";
};
spidev@1{
status = "disabled";
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
mz61581_pins: mz61581_pins {
brcm,pins = <4 15 18 25>;
brcm,function = <0 1 1 1>; /* in out out out */
};
};
};
fragment@2 {
target = <&spi0>;
__overlay__ {
/* needed to avoid dtc warning */
#address-cells = <1>;
#size-cells = <0>;
mz61581: mz61581@0{
compatible = "samsung,s6d02a1";
reg = <0>;
pinctrl-names = "default";
pinctrl-0 = <&mz61581_pins>;
spi-max-frequency = <128000000>;
spi-cpol;
spi-cpha;
width = <320>;
height = <480>;
rotate = <270>;
bgr;
fps = <30>;
buswidth = <8>;
txbuflen = <32768>;
reset-gpios = <&gpio 15 0>;
dc-gpios = <&gpio 25 0>;
led-gpios = <&gpio 18 0>;
init = <0x10000b0 00
0x1000011
0x20000ff
0x10000b3 0x02 0x00 0x00 0x00
0x10000c0 0x13 0x3b 0x00 0x02 0x00 0x01 0x00 0x43
0x10000c1 0x08 0x16 0x08 0x08
0x10000c4 0x11 0x07 0x03 0x03
0x10000c6 0x00
0x10000c8 0x03 0x03 0x13 0x5c 0x03 0x07 0x14 0x08 0x00 0x21 0x08 0x14 0x07 0x53 0x0c 0x13 0x03 0x03 0x21 0x00
0x1000035 0x00
0x1000036 0xa0
0x100003a 0x55
0x1000044 0x00 0x01
0x10000d0 0x07 0x07 0x1d 0x03
0x10000d1 0x03 0x30 0x10
0x10000d2 0x03 0x14 0x04
0x1000029
0x100002c>;
/* This is a workaround to make sure the init sequence slows down and doesn't fail */
debug = <3>;
};
mz61581_ts: mz61581_ts@1 {
compatible = "ti,ads7846";
reg = <1>;
spi-max-frequency = <2000000>;
interrupts = <4 2>; /* high-to-low edge triggered */
interrupt-parent = <&gpio>;
pendown-gpio = <&gpio 4 0>;
ti,x-plate-ohms = /bits/ 16 <60>;
ti,pressure-max = /bits/ 16 <255>;
};
};
};
__overrides__ {
speed = <&mz61581>, "spi-max-frequency:0";
rotate = <&mz61581>, "rotate:0";
fps = <&mz61581>, "fps:0";
txbuflen = <&mz61581>, "txbuflen:0";
debug = <&mz61581>, "debug:0";
xohms = <&mz61581_ts>,"ti,x-plate-ohms;0";
};
};

View File

@@ -0,0 +1,48 @@
/dts-v1/;
/plugin/;
/* Disable Bluetooth and restore UART0/ttyAMA0 over GPIOs 14 & 15.
To disable the systemd service that initialises the modem so it doesn't use
the UART:
sudo systemctl disable hciuart
*/
/{
compatible = "brcm,bcm2708";
fragment@0 {
target = <&uart1>;
__overlay__ {
status = "disabled";
};
};
fragment@1 {
target = <&uart0>;
__overlay__ {
pinctrl-names = "default";
pinctrl-0 = <&uart0_pins>;
status = "okay";
};
};
fragment@2 {
target = <&gpio>;
__overlay__ {
uart0_pins: uart0_pins {
brcm,pins = <14 15>;
brcm,function = <4>; /* alt0 */
brcm,pull = <0 2>;
};
};
};
fragment@3 {
target-path = "/aliases";
__overlay__ {
serial0 = "/soc/uart@7e201000";
serial1 = "/soc/uart@7e215040";
};
};
};

View File

@@ -0,0 +1,61 @@
/dts-v1/;
/plugin/;
/* Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore
UART0/ttyAMA0 over GPIOs 14 & 15. Note that this may reduce the maximum
usable baudrate.
It is also necessary to edit /lib/systemd/system/hciuart.server and
replace ttyAMA0 with ttyS0.
If cmdline.txt uses the alias serial0 to refer to the user-accessable port
then the firmware will replace with the appropriate port whether or not
this overlay is used.
*/
/{
compatible = "brcm,bcm2708";
fragment@0 {
target = <&uart0>;
__overlay__ {
pinctrl-names = "default";
pinctrl-0 = <&uart0_pins>;
status = "okay";
};
};
fragment@1 {
target = <&uart1>;
__overlay__ {
pinctrl-names = "default";
pinctrl-0 = <&uart1_pins>;
status = "okay";
};
};
fragment@2 {
target = <&gpio>;
__overlay__ {
uart0_pins: uart0_pins {
brcm,pins = <14 15>;
brcm,function = <4>; /* alt0 */
brcm,pull = <0 2>;
};
uart1_pins: uart1_pins {
brcm,pins = <32 33>;
brcm,function = <2>; /* alt5=UART1 */
brcm,pull = <0 0>;
};
};
};
fragment@3 {
target-path = "/aliases";
__overlay__ {
serial0 = "/soc/uart@7e201000";
serial1 = "/soc/uart@7e215040";
};
};
};

View File

@@ -0,0 +1,96 @@
/*
* Device Tree overlay for PiScreen 3.5" display shield by Ozzmaker
*
*/
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
fragment@0 {
target = <&spi0>;
__overlay__ {
status = "okay";
spidev@0{
status = "disabled";
};
spidev@1{
status = "disabled";
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
piscreen_pins: piscreen_pins {
brcm,pins = <17 25 24 22>;
brcm,function = <0 1 1 1>; /* in out out out */
};
};
};
fragment@2 {
target = <&spi0>;
__overlay__ {
/* needed to avoid dtc warning */
#address-cells = <1>;
#size-cells = <0>;
piscreen: piscreen@0{
compatible = "ilitek,ili9486";
reg = <0>;
pinctrl-names = "default";
pinctrl-0 = <&piscreen_pins>;
spi-max-frequency = <24000000>;
rotate = <270>;
bgr;
fps = <30>;
buswidth = <8>;
regwidth = <16>;
reset-gpios = <&gpio 25 0>;
dc-gpios = <&gpio 24 0>;
led-gpios = <&gpio 22 1>;
debug = <0>;
init = <0x10000b0 0x00
0x1000011
0x20000ff
0x100003a 0x55
0x1000036 0x28
0x10000c2 0x44
0x10000c5 0x00 0x00 0x00 0x00
0x10000e0 0x0f 0x1f 0x1c 0x0c 0x0f 0x08 0x48 0x98 0x37 0x0a 0x13 0x04 0x11 0x0d 0x00
0x10000e1 0x0f 0x32 0x2e 0x0b 0x0d 0x05 0x47 0x75 0x37 0x06 0x10 0x03 0x24 0x20 0x00
0x10000e2 0x0f 0x32 0x2e 0x0b 0x0d 0x05 0x47 0x75 0x37 0x06 0x10 0x03 0x24 0x20 0x00
0x1000011
0x1000029>;
};
piscreen_ts: piscreen-ts@1 {
compatible = "ti,ads7846";
reg = <1>;
spi-max-frequency = <2000000>;
interrupts = <17 2>; /* high-to-low edge triggered */
interrupt-parent = <&gpio>;
pendown-gpio = <&gpio 17 0>;
ti,swap-xy;
ti,x-plate-ohms = /bits/ 16 <100>;
ti,pressure-max = /bits/ 16 <255>;
};
};
};
__overrides__ {
speed = <&piscreen>,"spi-max-frequency:0";
rotate = <&piscreen>,"rotate:0";
fps = <&piscreen>,"fps:0";
debug = <&piscreen>,"debug:0";
xohms = <&piscreen_ts>,"ti,x-plate-ohms;0";
};
};

View File

@@ -0,0 +1,100 @@
/*
* Device Tree overlay for PiScreen2 3.5" TFT with resistive touch by Ozzmaker.com
*
*/
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
fragment@0 {
target = <&spi0>;
__overlay__ {
status = "okay";
spidev@0{
status = "disabled";
};
spidev@1{
status = "disabled";
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
piscreen2_pins: piscreen2_pins {
brcm,pins = <17 25 24 22>;
brcm,function = <0 1 1 1>; /* in out out out */
};
};
};
fragment@2 {
target = <&spi0>;
__overlay__ {
/* needed to avoid dtc warning */
#address-cells = <1>;
#size-cells = <0>;
piscreen2: piscreen2@0{
compatible = "ilitek,ili9486";
reg = <0>;
pinctrl-names = "default";
pinctrl-0 = <&piscreen2_pins>;
bgr;
spi-max-frequency = <64000000>;
rotate = <90>;
fps = <30>;
buswidth = <8>;
regwidth = <16>;
txbuflen = <32768>;
reset-gpios = <&gpio 25 0>;
dc-gpios = <&gpio 24 0>;
led-gpios = <&gpio 22 1>;
debug = <0>;
init = <0x10000b0 0x00
0x1000011
0x20000ff
0x100003a 0x55
0x1000036 0x28
0x10000c0 0x11 0x09
0x10000c1 0x41
0x10000c5 0x00 0x00 0x00 0x00
0x10000b6 0x00 0x02
0x10000f7 0xa9 0x51 0x2c 0x2
0x10000be 0x00 0x04
0x10000e9 0x00
0x1000011
0x1000029>;
};
piscreen2_ts: piscreen2-ts@1 {
compatible = "ti,ads7846";
reg = <1>;
spi-max-frequency = <2000000>;
interrupts = <17 2>; /* high-to-low edge triggered */
interrupt-parent = <&gpio>;
pendown-gpio = <&gpio 17 0>;
ti,swap-xy;
ti,x-plate-ohms = /bits/ 16 <100>;
ti,pressure-max = /bits/ 16 <255>;
};
};
};
__overrides__ {
speed = <&piscreen2>,"spi-max-frequency:0";
rotate = <&piscreen2>,"rotate:0";
fps = <&piscreen2>,"fps:0";
debug = <&piscreen2>,"debug:0";
xohms = <&piscreen2_ts>,"ti,x-plate-ohms;0";
};
};

View File

@@ -0,0 +1,88 @@
/*
* Device Tree overlay for Adafruit PiTFT 2.8" capacitive touch screen
*
*/
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
fragment@0 {
target = <&spi0>;
__overlay__ {
status = "okay";
spidev@0{
status = "disabled";
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
pitft_pins: pitft_pins {
brcm,pins = <24 25>;
brcm,function = <0 1>; /* in out */
brcm,pull = <2 0>; /* pullup none */
};
};
};
fragment@2 {
target = <&spi0>;
__overlay__ {
/* needed to avoid dtc warning */
#address-cells = <1>;
#size-cells = <0>;
pitft: pitft@0{
compatible = "ilitek,ili9340";
reg = <0>;
pinctrl-names = "default";
pinctrl-0 = <&pitft_pins>;
spi-max-frequency = <32000000>;
rotate = <90>;
fps = <25>;
bgr;
buswidth = <8>;
dc-gpios = <&gpio 25 0>;
debug = <0>;
};
};
};
fragment@3 {
target = <&i2c1>;
__overlay__ {
/* needed to avoid dtc warning */
#address-cells = <1>;
#size-cells = <0>;
ft6236: ft6236@38 {
compatible = "focaltech,ft6236";
reg = <0x38>;
interrupt-parent = <&gpio>;
interrupts = <24 2>;
touchscreen-size-x = <240>;
touchscreen-size-y = <320>;
};
};
};
__overrides__ {
speed = <&pitft>,"spi-max-frequency:0";
rotate = <&pitft>,"rotate:0";
fps = <&pitft>,"fps:0";
debug = <&pitft>,"debug:0";
touch-sizex = <&ft6236>,"touchscreen-size-x?";
touch-sizey = <&ft6236>,"touchscreen-size-y?";
touch-invx = <&ft6236>,"touchscreen-inverted-x?";
touch-invy = <&ft6236>,"touchscreen-inverted-y?";
touch-swapxy = <&ft6236>,"touchscreen-swapped-x-y?";
};
};

View File

@@ -0,0 +1,115 @@
/*
* Device Tree overlay for Adafruit PiTFT 2.8" resistive touch screen
*
*/
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
fragment@0 {
target = <&spi0>;
__overlay__ {
status = "okay";
spidev@0{
status = "disabled";
};
spidev@1{
status = "disabled";
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
pitft_pins: pitft_pins {
brcm,pins = <24 25>;
brcm,function = <0 1>; /* in out */
brcm,pull = <2 0>; /* pullup none */
};
};
};
fragment@2 {
target = <&spi0>;
__overlay__ {
/* needed to avoid dtc warning */
#address-cells = <1>;
#size-cells = <0>;
pitft: pitft@0{
compatible = "ilitek,ili9340";
reg = <0>;
pinctrl-names = "default";
pinctrl-0 = <&pitft_pins>;
spi-max-frequency = <32000000>;
rotate = <90>;
fps = <25>;
bgr;
buswidth = <8>;
dc-gpios = <&gpio 25 0>;
debug = <0>;
};
pitft_ts@1 {
#address-cells = <1>;
#size-cells = <0>;
compatible = "st,stmpe610";
reg = <1>;
spi-max-frequency = <500000>;
irq-gpio = <&gpio 24 0x2>; /* IRQF_TRIGGER_FALLING */
interrupts = <24 2>; /* high-to-low edge triggered */
interrupt-parent = <&gpio>;
interrupt-controller;
stmpe_touchscreen {
compatible = "st,stmpe-ts";
st,sample-time = <4>;
st,mod-12b = <1>;
st,ref-sel = <0>;
st,adc-freq = <2>;
st,ave-ctrl = <3>;
st,touch-det-delay = <4>;
st,settling = <2>;
st,fraction-z = <7>;
st,i-drive = <0>;
};
stmpe_gpio: stmpe_gpio {
#gpio-cells = <2>;
compatible = "st,stmpe-gpio";
/*
* only GPIO2 is wired/available
* and it is wired to the backlight
*/
st,norequest-mask = <0x7b>;
};
};
};
};
fragment@3 {
target-path = "/soc";
__overlay__ {
backlight {
compatible = "gpio-backlight";
gpios = <&stmpe_gpio 2 0>;
default-on;
};
};
};
__overrides__ {
speed = <&pitft>,"spi-max-frequency:0";
rotate = <&pitft>,"rotate:0";
fps = <&pitft>,"fps:0";
debug = <&pitft>,"debug:0";
};
};

View File

@@ -0,0 +1,34 @@
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target-path = "/";
__overlay__ {
pps: pps {
compatible = "pps-gpio";
pinctrl-names = "default";
pinctrl-0 = <&pps_pins>;
gpios = <&gpio 18 0>;
status = "okay";
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
pps_pins: pps_pins {
brcm,pins = <18>;
brcm,function = <0>; // in
brcm,pull = <0>; // off
};
};
};
__overrides__ {
gpiopin = <&pps>,"gpios:4",
<&pps_pins>,"brcm,pins:0";
};
};

View File

@@ -0,0 +1,46 @@
/dts-v1/;
/plugin/;
/*
This is the 2-channel overlay - only use it if you need both channels.
Legal pin,function combinations for each channel:
PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0) 52,5(Alt1)
PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
N.B.:
1) Pin 18 is the only one available on all platforms, and
it is the one used by the I2S audio interface.
Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
2) The onboard analogue audio output uses both PWM channels.
3) So be careful mixing audio and PWM.
*/
/ {
fragment@0 {
target = <&gpio>;
__overlay__ {
pwm_pins: pwm_pins {
brcm,pins = <18 19>;
brcm,function = <2 2>; /* Alt5 */
};
};
};
fragment@1 {
target = <&pwm>;
__overlay__ {
pinctrl-names = "default";
pinctrl-0 = <&pwm_pins>;
status = "okay";
};
};
__overrides__ {
pin = <&pwm_pins>,"brcm,pins:0";
pin2 = <&pwm_pins>,"brcm,pins:4";
func = <&pwm_pins>,"brcm,function:0";
func2 = <&pwm_pins>,"brcm,function:4";
clock = <&clk_pwm>,"clock-frequency:0";
};
};

View File

@@ -0,0 +1,42 @@
/dts-v1/;
/plugin/;
/*
Legal pin,function combinations for each channel:
PWM0: 12,4(Alt0) 18,2(Alt5) 40,4(Alt0) 52,5(Alt1)
PWM1: 13,4(Alt0) 19,2(Alt5) 41,4(Alt0) 45,4(Alt0) 53,5(Alt1)
N.B.:
1) Pin 18 is the only one available on all platforms, and
it is the one used by the I2S audio interface.
Pins 12 and 13 might be better choices on an A+, B+ or Pi2.
2) The onboard analogue audio output uses both PWM channels.
3) So be careful mixing audio and PWM.
*/
/ {
fragment@0 {
target = <&gpio>;
__overlay__ {
pwm_pins: pwm_pins {
brcm,pins = <18>;
brcm,function = <2>; /* Alt5 */
};
};
};
fragment@1 {
target = <&pwm>;
__overlay__ {
pinctrl-names = "default";
pinctrl-0 = <&pwm_pins>;
status = "okay";
};
};
__overrides__ {
pin = <&pwm_pins>,"brcm,pins:0";
func = <&pwm_pins>,"brcm,function:0";
clock = <&clk_pwm>,"clock-frequency:0";
};
};

View File

@@ -0,0 +1,45 @@
// Definitions for RaspiDACv3
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target = <&sound>;
__overlay__ {
compatible = "jg,raspidacv3";
i2s-controller = <&i2s>;
status = "okay";
};
};
fragment@1 {
target = <&i2s>;
__overlay__ {
status = "okay";
};
};
fragment@2 {
target = <&i2c1>;
__overlay__ {
#address-cells = <1>;
#size-cells = <0>;
status = "okay";
pcm5122@4c {
#sound-dai-cells = <0>;
compatible = "ti,pcm5122";
reg = <0x4c>;
status = "okay";
};
tpa6130a2: tpa6130a2@60 {
compatible = "ti,tpa6130a2";
reg = <0x60>;
status = "okay";
};
};
};
};

View File

@@ -0,0 +1,21 @@
/*
* Devicetree overlay for mailbox-driven Raspberry Pi DSI Display
* backlight controller
*/
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target-path = "/";
__overlay__ {
rpi_backlight: rpi_backlight {
compatible = "raspberrypi,rpi-backlight";
firmware = <&firmware>;
status = "okay";
};
};
};
};

View File

@@ -0,0 +1,34 @@
// Definitions for RPi DAC
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target = <&sound>;
__overlay__ {
compatible = "rpi,rpi-dac";
i2s-controller = <&i2s>;
status = "okay";
};
};
fragment@1 {
target = <&i2s>;
__overlay__ {
status = "okay";
};
};
fragment@2 {
target-path = "/";
__overlay__ {
pcm1794a-codec {
#sound-dai-cells = <0>;
compatible = "ti,pcm1794a";
status = "okay";
};
};
};
};

View File

@@ -0,0 +1,82 @@
/*
* Device Tree overlay for rpi-display by Watterott
*
*/
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
fragment@0 {
target = <&spi0>;
__overlay__ {
status = "okay";
spidev@0{
status = "disabled";
};
spidev@1{
status = "disabled";
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
rpi_display_pins: rpi_display_pins {
brcm,pins = <18 23 24 25>;
brcm,function = <1 1 1 0>; /* out out out in */
brcm,pull = <0 0 0 2>; /* - - - up */
};
};
};
fragment@2 {
target = <&spi0>;
__overlay__ {
/* needed to avoid dtc warning */
#address-cells = <1>;
#size-cells = <0>;
rpidisplay: rpi-display@0{
compatible = "ilitek,ili9341";
reg = <0>;
pinctrl-names = "default";
pinctrl-0 = <&rpi_display_pins>;
spi-max-frequency = <32000000>;
rotate = <270>;
bgr;
fps = <30>;
buswidth = <8>;
reset-gpios = <&gpio 23 0>;
dc-gpios = <&gpio 24 0>;
led-gpios = <&gpio 18 1>;
debug = <0>;
};
rpidisplay_ts: rpi-display-ts@1 {
compatible = "ti,ads7846";
reg = <1>;
spi-max-frequency = <2000000>;
interrupts = <25 2>; /* high-to-low edge triggered */
interrupt-parent = <&gpio>;
pendown-gpio = <&gpio 25 0>;
ti,x-plate-ohms = /bits/ 16 <60>;
ti,pressure-max = /bits/ 16 <255>;
};
};
};
__overrides__ {
speed = <&rpidisplay>,"spi-max-frequency:0";
rotate = <&rpidisplay>,"rotate:0";
fps = <&rpidisplay>,"fps:0";
debug = <&rpidisplay>,"debug:0";
xohms = <&rpidisplay_ts>,"ti,x-plate-ohms;0";
};
};

View File

@@ -0,0 +1,17 @@
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target-path = "/";
__overlay__ {
rpi_ft5406: rpi_ft5406 {
compatible = "rpi,rpi-ft5406";
firmware = <&firmware>;
status = "okay";
};
};
};
};

View File

@@ -0,0 +1,39 @@
// Definitions for Rpi-Proto
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target = <&sound>;
__overlay__ {
compatible = "rpi,rpi-proto";
i2s-controller = <&i2s>;
status = "okay";
};
};
fragment@1 {
target = <&i2s>;
__overlay__ {
status = "okay";
};
};
fragment@2 {
target = <&i2c1>;
__overlay__ {
#address-cells = <1>;
#size-cells = <0>;
status = "okay";
wm8731@1a {
#sound-dai-cells = <0>;
compatible = "wlf,wm8731";
reg = <0x1a>;
status = "okay";
};
};
};
};

View File

@@ -0,0 +1,47 @@
// rpi-sense HAT
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708", "brcm,bcm2709";
fragment@0 {
target = <&i2c1>;
__overlay__ {
#address-cells = <1>;
#size-cells = <0>;
status = "okay";
rpi-sense@46 {
compatible = "rpi,rpi-sense";
reg = <0x46>;
keys-int-gpios = <&gpio 23 1>;
status = "okay";
};
lsm9ds1-magn@1c {
compatible = "st,lsm9ds1-magn";
reg = <0x1c>;
status = "okay";
};
lsm9ds1-accel6a {
compatible = "st,lsm9ds1-accel";
reg = <0x6a>;
status = "okay";
};
lps25h-press@5c {
compatible = "st,lps25h-press";
reg = <0x5c>;
status = "okay";
};
hts221-humid@5f {
compatible = "st,hts221-humid";
reg = <0x5f>;
status = "okay";
};
};
};
};

View File

@@ -0,0 +1,31 @@
/dts-v1/;
/plugin/;
/* Provide backwards compatible aliases for the old sdhost dtparams. */
/{
compatible = "brcm,bcm2708";
fragment@0 {
target = <&sdhost>;
frag0: __overlay__ {
brcm,overclock-50 = <0>;
brcm,pio-limit = <1>;
status = "okay";
};
};
fragment@1 {
target = <&mmc>;
__overlay__ {
status = "disabled";
};
};
__overrides__ {
overclock_50 = <&frag0>,"brcm,overclock-50:0";
force_pio = <&frag0>,"brcm,force-pio?";
pio_limit = <&frag0>,"brcm,pio-limit:0";
debug = <&frag0>,"brcm,debug?";
};
};

View File

@@ -0,0 +1,36 @@
/* Enable SDIO from MMC interface via GPIOs 22-27. Includes sdhost overlay. */
/include/ "sdhost-overlay.dts"
/{
compatible = "brcm,bcm2708";
fragment@3 {
target = <&mmc>;
sdio_mmc: __overlay__ {
pinctrl-names = "default";
pinctrl-0 = <&sdio_pins>;
non-removable;
bus-width = <4>;
brcm,overclock-50 = <0>;
status = "okay";
};
};
fragment@4 {
target = <&gpio>;
__overlay__ {
sdio_pins: sdio_pins {
brcm,pins = <22 23 24 25 26 27>;
brcm,function = <7 7 7 7 7 7>; /* ALT3 = SD1 */
brcm,pull = <0 2 2 2 2 2>;
};
};
};
__overrides__ {
poll_once = <&sdio_mmc>,"non-removable?";
bus_width = <&sdio_mmc>,"bus-width:0";
sdio_overclock = <&sdio_mmc>,"brcm,overclock-50:0";
};
};

View File

@@ -0,0 +1,18 @@
// Description: Overlay to enable character device interface for SMI.
// Author: Luke Wren <luke@raspberrypi.org>
/dts-v1/;
/plugin/;
/{
fragment@0 {
target = <&soc>;
__overlay__ {
smi_dev {
compatible = "brcm,bcm2835-smi-dev";
smi_handle = <&smi>;
status = "okay";
};
};
};
};

View File

@@ -0,0 +1,69 @@
// Description: Overlay to enable NAND flash through
// the secondary memory interface
// Author: Luke Wren
/dts-v1/;
/plugin/;
/{
compatible = "brcm,bcm2708";
fragment@0 {
target = <&smi>;
__overlay__ {
pinctrl-names = "default";
pinctrl-0 = <&smi_pins>;
status = "okay";
};
};
fragment@1 {
target = <&soc>;
__overlay__ {
#address-cells = <1>;
#size-cells = <1>;
nand: flash@0 {
compatible = "brcm,bcm2835-smi-nand";
smi_handle = <&smi>;
#address-cells = <1>;
#size-cells = <1>;
status = "okay";
partition@0 {
label = "stage2";
// 128k
reg = <0 0x20000>;
read-only;
};
partition@1 {
label = "firmware";
// 16M
reg = <0x20000 0x1000000>;
read-only;
};
partition@2 {
label = "root";
// 2G (will need to use 64 bit for >=4G)
reg = <0x1020000 0x80000000>;
};
};
};
};
fragment@2 {
target = <&gpio>;
__overlay__ {
smi_pins: smi_pins {
brcm,pins = <0 1 2 3 4 5 6 7 8 9 10 11
12 13 14 15>;
/* Alt 1: SMI */
brcm,function = <5 5 5 5 5 5 5 5 5 5 5
5 5 5 5 5>;
/* /CS, /WE and /OE are pulled high, as they are
generally active low signals */
brcm,pull = <2 2 2 2 2 2 2 2 0 0 0 0 0 0 0 0>;
};
};
};
};

View File

@@ -0,0 +1,37 @@
// Description: Overlay to enable the secondary memory interface peripheral
// Author: Luke Wren
/dts-v1/;
/plugin/;
/{
compatible = "brcm,bcm2708";
fragment@0 {
target = <&smi>;
__overlay__ {
pinctrl-names = "default";
pinctrl-0 = <&smi_pins>;
status = "okay";
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
smi_pins: smi_pins {
/* Don't configure the top two address bits, as
these are already used as ID_SD and ID_SC */
brcm,pins = <2 3 4 5 6 7 8 9 10 11 12 13 14 15
16 17 18 19 20 21 22 23 24 25>;
/* Alt 0: SMI */
brcm,function = <5 5 5 5 5 5 5 5 5 5 5 5 5 5 5
5 5 5 5 5 5 5 5 5>;
/* /CS, /WE and /OE are pulled high, as they are
generally active low signals */
brcm,pull = <2 2 2 2 2 2 0 0 0 0 0 0 0 0 0 0 0
0 0 0 0 0 0 0>;
};
};
};
};

View File

@@ -0,0 +1,31 @@
/*
* Device tree overlay to move spi0 to gpio 35 to 39 on CM
*/
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2835", "brcm,bcm2836", "brcm,bcm2708", "brcm,bcm2709";
fragment@0 {
target = <&spi0>;
__overlay__ {
cs-gpios = <&gpio 36 1>, <&gpio 35 1>;
};
};
fragment@1 {
target = <&spi0_cs_pins>;
__overlay__ {
bcrm,pins = <36 35>;
};
};
fragment@2 {
target = <&spi0_pins>;
__overlay__ {
bcrm,pins = <37 38 39>;
};
};
};

View File

@@ -0,0 +1,216 @@
/*
* tinylcd35-overlay.dts
*
* -------------------------------------------------
* www.tinlylcd.com
* -------------------------------------------------
* Device---Driver-----BUS GPIO's
* display tinylcd35 spi0.0 25 24 18
* touch ads7846 spi0.1 5
* rtc ds1307 i2c1-0068
* rtc pcf8563 i2c1-0051
* keypad gpio-keys --------- 17 22 27 23 28
*
*
* TinyLCD.com 3.5 inch TFT
*
* Version 001
* 5/3/2015 -- Noralf Trønnes Initial Device tree framework
* 10/3/2015 -- tinylcd@gmail.com added ds1307 support.
*
*/
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
fragment@0 {
target = <&spi0>;
__overlay__ {
status = "okay";
spidev@0{
status = "disabled";
};
spidev@1{
status = "disabled";
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
tinylcd35_pins: tinylcd35_pins {
brcm,pins = <25 24 18>;
brcm,function = <1>; /* out */
};
tinylcd35_ts_pins: tinylcd35_ts_pins {
brcm,pins = <5>;
brcm,function = <0>; /* in */
};
keypad_pins: keypad_pins {
brcm,pins = <4 17 22 23 27>;
brcm,function = <0>; /* in */
brcm,pull = <1>; /* down */
};
};
};
fragment@2 {
target = <&spi0>;
__overlay__ {
/* needed to avoid dtc warning */
#address-cells = <1>;
#size-cells = <0>;
tinylcd35: tinylcd35@0{
compatible = "neosec,tinylcd";
reg = <0>;
pinctrl-names = "default";
pinctrl-0 = <&tinylcd35_pins>,
<&tinylcd35_ts_pins>;
spi-max-frequency = <48000000>;
rotate = <270>;
fps = <20>;
bgr;
buswidth = <8>;
reset-gpios = <&gpio 25 0>;
dc-gpios = <&gpio 24 0>;
led-gpios = <&gpio 18 1>;
debug = <0>;
init = <0x10000B0 0x80
0x10000C0 0x0A 0x0A
0x10000C1 0x01 0x01
0x10000C2 0x33
0x10000C5 0x00 0x42 0x80
0x10000B1 0xD0 0x11
0x10000B4 0x02
0x10000B6 0x00 0x22 0x3B
0x10000B7 0x07
0x1000036 0x58
0x10000F0 0x36 0xA5 0xD3
0x10000E5 0x80
0x10000E5 0x01
0x10000B3 0x00
0x10000E5 0x00
0x10000F0 0x36 0xA5 0x53
0x10000E0 0x00 0x35 0x33 0x00 0x00 0x00 0x00 0x35 0x33 0x00 0x00 0x00
0x100003A 0x55
0x1000011
0x2000001
0x1000029>;
};
tinylcd35_ts: tinylcd35_ts@1 {
compatible = "ti,ads7846";
reg = <1>;
status = "disabled";
spi-max-frequency = <2000000>;
interrupts = <5 2>; /* high-to-low edge triggered */
interrupt-parent = <&gpio>;
pendown-gpio = <&gpio 5 0>;
ti,x-plate-ohms = /bits/ 16 <100>;
ti,pressure-max = /bits/ 16 <255>;
};
};
};
/* RTC */
fragment@3 {
target = <&i2c1>;
__overlay__ {
#address-cells = <1>;
#size-cells = <0>;
pcf8563: pcf8563@51 {
compatible = "nxp,pcf8563";
reg = <0x51>;
status = "disabled";
};
};
};
fragment@4 {
target = <&i2c1>;
__overlay__ {
#address-cells = <1>;
#size-cells = <0>;
ds1307: ds1307@68 {
compatible = "maxim,ds1307";
reg = <0x68>;
status = "disabled";
};
};
};
/*
* Values for input event code is found under the
* 'Keys and buttons' heading in include/uapi/linux/input.h
*/
fragment@5 {
target-path = "/soc";
__overlay__ {
keypad: keypad {
compatible = "gpio-keys";
#address-cells = <1>;
#size-cells = <0>;
pinctrl-names = "default";
pinctrl-0 = <&keypad_pins>;
status = "disabled";
autorepeat;
button@17 {
label = "GPIO KEY_UP";
linux,code = <103>;
gpios = <&gpio 17 0>;
};
button@22 {
label = "GPIO KEY_DOWN";
linux,code = <108>;
gpios = <&gpio 22 0>;
};
button@27 {
label = "GPIO KEY_LEFT";
linux,code = <105>;
gpios = <&gpio 27 0>;
};
button@23 {
label = "GPIO KEY_RIGHT";
linux,code = <106>;
gpios = <&gpio 23 0>;
};
button@4 {
label = "GPIO KEY_ENTER";
linux,code = <28>;
gpios = <&gpio 4 0>;
};
};
};
};
__overrides__ {
speed = <&tinylcd35>,"spi-max-frequency:0";
rotate = <&tinylcd35>,"rotate:0";
fps = <&tinylcd35>,"fps:0";
debug = <&tinylcd35>,"debug:0";
touch = <&tinylcd35_ts>,"status";
touchgpio = <&tinylcd35_ts_pins>,"brcm,pins:0",
<&tinylcd35_ts>,"interrupts:0",
<&tinylcd35_ts>,"pendown-gpio:4";
xohms = <&tinylcd35_ts>,"ti,x-plate-ohms;0";
rtc-pcf = <&i2c1>,"status",
<&pcf8563>,"status";
rtc-ds = <&i2c1>,"status",
<&ds1307>,"status";
keypad = <&keypad>,"status";
};
};

View File

@@ -0,0 +1,38 @@
/dts-v1/;
/plugin/;
/{
compatible = "brcm,bcm2708";
fragment@0 {
target = <&uart1>;
__overlay__ {
pinctrl-names = "default";
pinctrl-0 = <&uart1_pins>;
status = "okay";
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
uart1_pins: uart1_pins {
brcm,pins = <14 15>;
brcm,function = <2>; /* alt5 */
brcm,pull = <0 2>;
};
};
};
fragment@2 {
target-path = "/chosen";
__overlay__ {
bootargs = "8250.nr_uarts=1";
};
};
__overrides__ {
txd1_pin = <&uart1_pins>,"brcm,pins:0";
rxd1_pin = <&uart1_pins>,"brcm,pins:4";
};
};

View File

@@ -0,0 +1,95 @@
/*
* vc4-kms-v3d-overlay.dts
*/
/dts-v1/;
/plugin/;
#include "dt-bindings/clock/bcm2835.h"
#include "dt-bindings/gpio/gpio.h"
/ {
compatible = "brcm,bcm2835", "brcm,bcm2708", "brcm,bcm2709";
fragment@0 {
target = <&i2c2>;
__overlay__ {
status = "okay";
};
};
fragment@1 {
target = <&cprman>;
__overlay__ {
status = "okay";
};
};
fragment@2 {
target = <&fb>;
__overlay__ {
status = "disabled";
};
};
fragment@3 {
target = <&soc>;
__overlay__ {
#address-cells = <1>;
#size-cells = <1>;
pixelvalve@7e206000 {
compatible = "brcm,bcm2835-pixelvalve0";
reg = <0x7e206000 0x100>;
interrupts = <2 13>; /* pwa0 */
};
pixelvalve@7e207000 {
compatible = "brcm,bcm2835-pixelvalve1";
reg = <0x7e207000 0x100>;
interrupts = <2 14>; /* pwa1 */
};
hvs@7e400000 {
compatible = "brcm,bcm2835-hvs";
reg = <0x7e400000 0x6000>;
interrupts = <2 1>;
};
pixelvalve@7e807000 {
compatible = "brcm,bcm2835-pixelvalve2";
reg = <0x7e807000 0x100>;
interrupts = <2 10>; /* pixelvalve */
};
hdmi@7e902000 {
compatible = "brcm,bcm2835-hdmi";
reg = <0x7e902000 0x600>,
<0x7e808000 0x100>;
interrupts = <2 8>, <2 9>;
ddc = <&i2c2>;
hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>;
clocks = <&cprman BCM2835_PLLH_PIX>,
<&cprman BCM2835_CLOCK_HSM>;
clock-names = "pixel", "hdmi";
};
v3d@7ec00000 {
compatible = "brcm,vc4-v3d";
reg = <0x7ec00000 0x1000>;
interrupts = <1 10>;
};
gpu@7e4c0000 {
compatible = "brcm,bcm2835-vc4";
};
};
};
fragment@4 {
target-path = "/chosen";
__overlay__ {
bootargs = "cma=256M@512M";
};
};
};

View File

@@ -0,0 +1,30 @@
/dts-v1/;
/plugin/;
/{
compatible = "brcm,bcm2708";
// There is no VGA driver module, but we need a platform device
// node (that doesn't already use pinctrl) to hang the pinctrl
// reference on - leds will do
fragment@0 {
target = <&leds>;
__overlay__ {
pinctrl-names = "default";
pinctrl-0 = <&vga666_pins>;
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
vga666_pins: vga666_pins {
brcm,pins = <2 3 4 5 6 7 8 9 10 11 12
13 14 15 16 17 18 19 20 21>;
brcm,function = <6>; /* alt2 */
brcm,pull = <0>; /* no pull */
};
};
};
};

View File

@@ -0,0 +1,39 @@
// Definitions for w1-gpio module (without external pullup)
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target-path = "/";
__overlay__ {
w1: onewire@0 {
compatible = "w1-gpio";
pinctrl-names = "default";
pinctrl-0 = <&w1_pins>;
gpios = <&gpio 4 0>;
rpi,parasitic-power = <0>;
status = "okay";
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
w1_pins: w1_pins {
brcm,pins = <4>;
brcm,function = <0>; // in (initially)
brcm,pull = <0>; // off
};
};
};
__overrides__ {
gpiopin = <&w1>,"gpios:4",
<&w1_pins>,"brcm,pins:0";
pullup = <&w1>,"rpi,parasitic-power:0";
};
};

View File

@@ -0,0 +1,41 @@
// Definitions for w1-gpio module (with external pullup)
/dts-v1/;
/plugin/;
/ {
compatible = "brcm,bcm2708";
fragment@0 {
target-path = "/";
__overlay__ {
w1: onewire@0 {
compatible = "w1-gpio";
pinctrl-names = "default";
pinctrl-0 = <&w1_pins>;
gpios = <&gpio 4 0>, <&gpio 5 1>;
rpi,parasitic-power = <0>;
status = "okay";
};
};
};
fragment@1 {
target = <&gpio>;
__overlay__ {
w1_pins: w1_pins {
brcm,pins = <4 5>;
brcm,function = <0 1>; // in out
brcm,pull = <0 0>; // off off
};
};
};
__overrides__ {
gpiopin = <&w1>,"gpios:4",
<&w1_pins>,"brcm,pins:0";
extpullup = <&w1>,"gpios:16",
<&w1_pins>,"brcm,pins:4";
pullup = <&w1>,"rpi,parasitic-power:0";
};
};

View File

@@ -939,11 +939,11 @@
reg = <0xf8018000 0x4000>; reg = <0xf8018000 0x4000>;
interrupts = <33 IRQ_TYPE_LEVEL_HIGH 6>; interrupts = <33 IRQ_TYPE_LEVEL_HIGH 6>;
dmas = <&dma1 dmas = <&dma1
(AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)) (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
AT91_XDMAC_DT_PERID(4)>, | AT91_XDMAC_DT_PERID(4))>,
<&dma1 <&dma1
(AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)) (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
AT91_XDMAC_DT_PERID(5)>; | AT91_XDMAC_DT_PERID(5))>;
dma-names = "tx", "rx"; dma-names = "tx", "rx";
pinctrl-names = "default"; pinctrl-names = "default";
pinctrl-0 = <&pinctrl_i2c1>; pinctrl-0 = <&pinctrl_i2c1>;

View File

@@ -184,20 +184,20 @@
regulator-name = "vcc-3v0"; regulator-name = "vcc-3v0";
}; };
vdd_cpu: dcdc2 { vdd_gpu: dcdc2 {
regulator-always-on;
regulator-min-microvolt = <700000>;
regulator-max-microvolt = <1320000>;
regulator-name = "vdd-cpu";
};
vdd_gpu: dcdc3 {
regulator-always-on; regulator-always-on;
regulator-min-microvolt = <700000>; regulator-min-microvolt = <700000>;
regulator-max-microvolt = <1320000>; regulator-max-microvolt = <1320000>;
regulator-name = "vdd-gpu"; regulator-name = "vdd-gpu";
}; };
vdd_cpu: dcdc3 {
regulator-always-on;
regulator-min-microvolt = <700000>;
regulator-max-microvolt = <1320000>;
regulator-name = "vdd-cpu";
};
vdd_sys_dll: dcdc4 { vdd_sys_dll: dcdc4 {
regulator-always-on; regulator-always-on;
regulator-min-microvolt = <1100000>; regulator-min-microvolt = <1100000>;

View File

@@ -406,7 +406,8 @@ static irqreturn_t dma_irq_handler(int irq, void *data)
BIT(slot)); BIT(slot));
if (edma_cc[ctlr]->intr_data[channel].callback) if (edma_cc[ctlr]->intr_data[channel].callback)
edma_cc[ctlr]->intr_data[channel].callback( edma_cc[ctlr]->intr_data[channel].callback(
channel, EDMA_DMA_COMPLETE, EDMA_CTLR_CHAN(ctlr, channel),
EDMA_DMA_COMPLETE,
edma_cc[ctlr]->intr_data[channel].data); edma_cc[ctlr]->intr_data[channel].data);
} }
} while (sh_ipr); } while (sh_ipr);
@@ -460,7 +461,8 @@ static irqreturn_t dma_ccerr_handler(int irq, void *data)
if (edma_cc[ctlr]->intr_data[k]. if (edma_cc[ctlr]->intr_data[k].
callback) { callback) {
edma_cc[ctlr]->intr_data[k]. edma_cc[ctlr]->intr_data[k].
callback(k, callback(
EDMA_CTLR_CHAN(ctlr, k),
EDMA_DMA_CC_ERROR, EDMA_DMA_CC_ERROR,
edma_cc[ctlr]->intr_data edma_cc[ctlr]->intr_data
[k].data); [k].data);

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

File diff suppressed because it is too large Load Diff

Some files were not shown because too many files have changed in this diff Show More