Merge remote-tracking branch 'origin/f26' into f26-user-thl-vanilla-fedorakernel-4.12.4-300.vanilla.knurd.1.fc26

14 files changed, 674 insertions, 123 deletions

diff --git a/AllWinner-net-emac.patch b/AllWinner-net-emac.patch
index 0e0a319d0..591b2350f 100644
--- a/AllWinner-net-emac.patch
+++ b/AllWinner-net-emac.patch
@@ -2515,3 +2515,40 @@ index 8d2cc6e9a03f..78f6c24952dd 100644
 +	allwinner,leds-active-low;
 +	status = "okay";
 +};
+From 051516f1c20c7d7c274c91b4c2fa73bc8d7fc372 Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Sat, 22 Jul 2017 15:08:12 +0100
+Subject: [PATCH] fix mac assignment so we get static not dynamic MACs
+
+---
+ arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts | 1 +
+ arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts       | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+index 0d1f026d831a..ba2fde2909f9 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+@@ -51,6 +51,7 @@
+ 	compatible = "sinovoip,bananapi-m64", "allwinner,sun50i-a64";
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 		serial1 = &uart1;
+ 	};
+diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
+index 3b491c0e3b0d..8442eb6c9244 100644
+--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64.dts
+@@ -51,6 +51,7 @@
+ 	compatible = "pine64,pine64", "allwinner,sun50i-a64";
+ 
+ 	aliases {
++		ethernet0 = &emac;
+ 		serial0 = &uart0;
+ 	};
+ 
+-- 
+2.13.3
+
diff --git a/CVE-2017-11473.patch b/CVE-2017-11473.patch
deleted file mode 100644
index e3e0658a4..000000000
--- a/CVE-2017-11473.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 70ac67826602edf8c0ccb413e5ba7eacf597a60c Mon Sep 17 00:00:00 2001
-From: Seunghun Han <kkamagui@gmail.com>
-Date: Tue, 18 Jul 2017 20:03:51 +0900
-Subject: x86/acpi: Prevent out of bound access caused by broken ACPI tables
-
-The bus_irq argument of mp_override_legacy_irq() is used as the index into
-the isa_irq_to_gsi[] array. The bus_irq argument originates from
-ACPI_MADT_TYPE_IO_APIC and ACPI_MADT_TYPE_INTERRUPT items in the ACPI
-tables, but is nowhere sanity checked.
-
-That allows broken or malicious ACPI tables to overwrite memory, which
-might cause malfunction, panic or arbitrary code execution.
-
-Add a sanity check and emit a warning when that triggers.
-
-[ tglx: Added warning and rewrote changelog ]
-
-Signed-off-by: Seunghun Han <kkamagui@gmail.com>
-Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
-Cc: security@kernel.org
-Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
-Cc: stable@vger.kernel.org
----
- arch/x86/kernel/acpi/boot.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
-index 6bb6806..7491e73 100644
---- a/arch/x86/kernel/acpi/boot.c
-+++ b/arch/x86/kernel/acpi/boot.c
-@@ -347,6 +347,14 @@ static void __init mp_override_legacy_irq(u8 bus_irq, u8 polarity, u8 trigger,
- 	struct mpc_intsrc mp_irq;
- 
- 	/*
-+	 * Check bus_irq boundary.
-+	 */
-+	if (bus_irq >= NR_IRQS_LEGACY) {
-+		pr_warn("Invalid bus_irq %u for legacy override\n", bus_irq);
-+		return;
-+	}
-+
-+	/*
- 	 * Convert 'gsi' to 'ioapic.pin'.
- 	 */
- 	ioapic = mp_find_ioapic(gsi);
--- 
-cgit v1.1
-
diff --git a/bcm2835-pinctrl-Avoid-warning-from-__irq_do_set_handler.patch b/bcm2835-pinctrl-Avoid-warning-from-__irq_do_set_handler.patch
new file mode 100644
index 000000000..258d3b210
--- /dev/null
+++ b/bcm2835-pinctrl-Avoid-warning-from-__irq_do_set_handler.patch
@@ -0,0 +1,70 @@
+From patchwork Wed Jun 21 18:20:04 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: pinctrl: bcm2835: Avoid warning from __irq_do_set_handler
+From: Stefan Wahren <stefan.wahren@i2se.com>
+X-Patchwork-Id: 9802555
+Message-Id: <1498069204-28154-1-git-send-email-stefan.wahren@i2se.com>
+To: Linus Walleij <linus.walleij@linaro.org>, Eric Anholt <eric@anholt.net>
+Cc: Stefan Wahren <stefan.wahren@i2se.com>, linux-gpio@vger.kernel.org,
+ Phil Elwell <phil@raspberrypi.org>, linux-rpi-kernel@lists.infradead.org, 
+ linux-arm-kernel@lists.infradead.org
+Date: Wed, 21 Jun 2017 20:20:04 +0200
+
+We get a warning during boot with enabled EARLY_PRINTK that
+we try to set a irq_chip without data. This is caused by ignoring
+the return value of irq_of_parse_and_map(). So avoid calling
+gpiochip_set_chained_irqchip() in error case.
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Fixes: 85ae9e512f43 ("pinctrl: bcm2835: switch to GPIOLIB_IRQCHIP")
+---
+ drivers/pinctrl/bcm/pinctrl-bcm2835.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+index 1eb7a1a..2308831 100644
+--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+@@ -1048,6 +1048,10 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev)
+ 	for (i = 0; i < BCM2835_NUM_IRQS; i++) {
+ 		pc->irq[i] = irq_of_parse_and_map(np, i);
+ 		pc->irq_group[i] = i;
++
++		if (pc->irq[i] == 0)
++			continue;
++
+ 		/*
+ 		 * Use the same handler for all groups: this is necessary
+ 		 * since we use one gpiochip to cover all lines - the
+From 8aa99fe688734f249b07314cdd7c5e25651c9c6d Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Thu, 27 Oct 2016 16:21:19 +0100
+Subject: irq-bcm2836: Prevent spurious interrupts, and trap them early
+
+The old arch-specific IRQ macros included a dsb to ensure the
+write to clear the mailbox interrupt completed before returning
+from the interrupt. The BCM2836 irqchip driver needs the same
+precaution to avoid spurious interrupts.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/irqchip/irq-bcm2836.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/irqchip/irq-bcm2836.c b/drivers/irqchip/irq-bcm2836.c
+index e7463e3..a8db33b 100644
+--- a/drivers/irqchip/irq-bcm2836.c
++++ b/drivers/irqchip/irq-bcm2836.c
+@@ -175,6 +175,7 @@ __exception_irq_entry bcm2836_arm_irqchip_handle_irq(struct pt_regs *regs)
+ 		u32 ipi = ffs(mbox_val) - 1;
+ 
+ 		writel(1 << ipi, mailbox0);
++		dsb(sy);
+ 		handle_IPI(ipi, regs);
+ #endif
+ 	} else if (stat) {
+-- 
+cgit v0.12
+
diff --git a/bcm2837-arm32-support.patch b/bcm2837-arm32-support.patch
new file mode 100644
index 000000000..021ae1069
--- /dev/null
+++ b/bcm2837-arm32-support.patch
@@ -0,0 +1,48 @@
+From patchwork Tue Apr 25 16:45:08 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: ARM: dts: Add devicetree for the Raspberry Pi 3, for arm32 (v6)
+From: Eric Anholt <eric@anholt.net>
+X-Patchwork-Id: 9698781
+Message-Id: <20170425164508.32242-1-eric@anholt.net>
+To: Lee Jones <lee@kernel.org>, Florian Fainelli <f.fainelli@gmail.com>,
+ Olof Johansson <olof@lixom.net>, Rob Herring <robh+dt@kernel.org>,
+ Mark Rutland <mark.rutland@arm.com>, devicetree@vger.kernel.org
+Cc: Stefan Wahren <stefan.wahren@i2se.com>, linux-kernel@vger.kernel.org,
+ Eric Anholt <eric@anholt.net>, bcm-kernel-feedback-list@broadcom.com, 
+ Gerd Hoffmann <kraxel@redhat.com>, linux-arm-kernel@lists.infradead.org, 
+ linux-rpi-kernel@lists.infradead.org
+Date: Tue, 25 Apr 2017 09:45:08 -0700
+
+Raspbian and Fedora have decided to support the Pi3 in 32-bit mode for
+now, so it's useful to be able to test that mode on an upstream
+kernel.  It's also been useful for me to use the same board for 32-bit
+and 64-bit development.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+---
+ arch/arm/boot/dts/Makefile            | 1 +
+ arch/arm/boot/dts/bcm2837-rpi-3-b.dts | 1 +
+ 2 files changed, 2 insertions(+)
+ create mode 100644 arch/arm/boot/dts/bcm2837-rpi-3-b.dts
+
+diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
+index 011808490fed..eded842d9978 100644
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -72,6 +72,7 @@ dtb-$(CONFIG_ARCH_BCM2835) += \
+ 	bcm2835-rpi-b-plus.dtb \
+ 	bcm2835-rpi-a-plus.dtb \
+ 	bcm2836-rpi-2-b.dtb \
++	bcm2837-rpi-3-b.dtb \
+ 	bcm2835-rpi-zero.dtb
+ dtb-$(CONFIG_ARCH_BCM_5301X) += \
+ 	bcm4708-asus-rt-ac56u.dtb \
+diff --git a/arch/arm/boot/dts/bcm2837-rpi-3-b.dts b/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
+new file mode 100644
+index 000000000000..c72a27d908b6
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm2837-rpi-3-b.dts
+@@ -0,0 +1 @@
++#include "../../../arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts"
diff --git a/bcm2837-sdhost-fixes.patch b/bcm2837-sdhost-fixes.patch
new file mode 100644
index 000000000..9b81005ad
--- /dev/null
+++ b/bcm2837-sdhost-fixes.patch
@@ -0,0 +1,83 @@
+From e199a012a0fb0be11ccd26b4a502ae830eb10db0 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 21 Jun 2016 11:47:56 +0200
+Subject: arm64: dts: bcm2837: add &sdhci and &sdhost
+
+For the raspberry pi 3 we'll need both sdhci (handles sdio wifi) and
+sdhost (handles sdcard).
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Acked-by: Eric Anholt <eric@anholt.net>
+---
+ arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts b/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts
+index c309633..972f14d 100644
+--- a/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts
++++ b/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts
+@@ -22,3 +22,20 @@
+ &uart1 {
+ 	status = "okay";
+ };
++
++/* SDHCI is used to control the SDIO for wireless */
++&sdhci {
++	pinctrl-names = "default";
++	pinctrl-0 = <&emmc_gpio34>;
++	status = "okay";
++	bus-width = <4>;
++	non-removable;
++};
++
++/* SDHOST is used to drive the SD card */
++&sdhost {
++	pinctrl-names = "default";
++	pinctrl-0 = <&sdhost_gpio48>;
++	status = "okay";
++	bus-width = <4>;
++};
+-- 
+cgit v0.12
+
+From 0c1759bc4fc8884d790d4ab99b5276132559b5a1 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 21 Jun 2016 10:00:58 +0200
+Subject: arm: dts: bcm283x: switch from &sdhci to &sdhost
+
+sdcard access with the sdhost controller is faster.
+
+Read access (dd with 64k blocks on rpi2):
+   CONFIG_MMC_SDHCI_IPROC: 11-12 MB/s
+   CONFIG_MMC_BCM2835:     19-20 MB/s
+
+Differences on write access are pretty much in the noise.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Acked-by: Eric Anholt <eric@anholt.net>
+---
+ arch/arm/boot/dts/bcm2835-rpi.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm2835-rpi.dtsi b/arch/arm/boot/dts/bcm2835-rpi.dtsi
+index 8b95832..e36c392 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi.dtsi
++++ b/arch/arm/boot/dts/bcm2835-rpi.dtsi
+@@ -65,13 +65,13 @@
+ &sdhci {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&emmc_gpio48>;
+-	status = "okay";
+ 	bus-width = <4>;
+ };
+ 
+ &sdhost {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&sdhost_gpio48>;
++	status = "okay";
+ 	bus-width = <4>;
+ };
+ 
+-- 
+cgit v0.12
+
diff --git a/bcm283x-Define-UART-pinmuxing-on-board-level.patch b/bcm283x-Define-UART-pinmuxing-on-board-level.patch
new file mode 100644
index 000000000..26efe9007
--- /dev/null
+++ b/bcm283x-Define-UART-pinmuxing-on-board-level.patch
@@ -0,0 +1,171 @@
+From patchwork Thu Jul 20 19:37:07 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [1/3] ARM: bcm283x: Define UART pinmuxing on board level
+From: Stefan Wahren <stefan.wahren@i2se.com>
+X-Patchwork-Id: 9855625
+Message-Id: <1500579429-9101-2-git-send-email-stefan.wahren@i2se.com>
+To: Eric Anholt <eric@anholt.net>, Rob Herring <robh+dt@kernel.org>,
+ Mark Rutland <mark.rutland@arm.com>
+Cc: Stefan Wahren <stefan.wahren@i2se.com>, devicetree@vger.kernel.org,
+ Florian Fainelli <f.fainelli@gmail.com>,
+ Scott Branden <sbranden@broadcom.com>, 
+ linux-rpi-kernel@lists.infradead.org,
+ linux-arm-kernel@lists.infradead.org, Gerd Hoffmann <kraxel@redhat.com>
+Date: Thu, 20 Jul 2017 21:37:07 +0200
+
+Until RPI 3 and Zero W the pl011 (uart0) was always on pin 14/15. So in
+order to take care of them and other boards in the future,
+we need to define UART pinmuxing on board level.
+
+This work based on Eric Anholt's patch "ARM: bcm2385: Don't force pl011
+onto pins 14/15." and Fabian Vogt's patch "ARM64: dts: bcm2837: assign
+uart0 to BT and uart1 to pin headers".
+
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+---
+ arch/arm/boot/dts/bcm2835-rpi-a-plus.dts |  6 ++++++
+ arch/arm/boot/dts/bcm2835-rpi-a.dts      |  6 ++++++
+ arch/arm/boot/dts/bcm2835-rpi-b-plus.dts |  6 ++++++
+ arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts |  6 ++++++
+ arch/arm/boot/dts/bcm2835-rpi-b.dts      |  6 ++++++
+ arch/arm/boot/dts/bcm2835-rpi-zero.dts   |  6 ++++++
+ arch/arm/boot/dts/bcm2835-rpi.dtsi       |  2 +-
+ arch/arm/boot/dts/bcm2836-rpi-2-b.dts    |  6 ++++++
+ arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts    | 10 ++++++++++
+ 9 files changed, 53 insertions(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm2835-rpi-a-plus.dts b/arch/arm/boot/dts/bcm2835-rpi-a-plus.dts
+index d070454..9f86649 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi-a-plus.dts
++++ b/arch/arm/boot/dts/bcm2835-rpi-a-plus.dts
+@@ -99,3 +99,9 @@
+ &hdmi {
+ 	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+ };
++
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_gpio14>;
++	status = "okay";
++};
+diff --git a/arch/arm/boot/dts/bcm2835-rpi-a.dts b/arch/arm/boot/dts/bcm2835-rpi-a.dts
+index 46d078e..4b1af06 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi-a.dts
++++ b/arch/arm/boot/dts/bcm2835-rpi-a.dts
+@@ -94,3 +94,9 @@
+ &hdmi {
+ 	hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>;
+ };
++
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_gpio14>;
++	status = "okay";
++};
+diff --git a/arch/arm/boot/dts/bcm2835-rpi-b-plus.dts b/arch/arm/boot/dts/bcm2835-rpi-b-plus.dts
+index 432088e..a846f1e 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi-b-plus.dts
++++ b/arch/arm/boot/dts/bcm2835-rpi-b-plus.dts
+@@ -101,3 +101,9 @@
+ &hdmi {
+ 	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+ };
++
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_gpio14>;
++	status = "okay";
++};
+diff --git a/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts b/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts
+index 4133bc2..e860964 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts
++++ b/arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts
+@@ -94,3 +94,9 @@
+ &hdmi {
+ 	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+ };
++
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_gpio14>;
++	status = "okay";
++};
+diff --git a/arch/arm/boot/dts/bcm2835-rpi-b.dts b/arch/arm/boot/dts/bcm2835-rpi-b.dts
+index 4d56fe3..5d77f3f 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi-b.dts
++++ b/arch/arm/boot/dts/bcm2835-rpi-b.dts
+@@ -89,3 +89,9 @@
+ &hdmi {
+ 	hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>;
+ };
++
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_gpio14>;
++	status = "okay";
++};
+diff --git a/arch/arm/boot/dts/bcm2835-rpi-zero.dts b/arch/arm/boot/dts/bcm2835-rpi-zero.dts
+index 79a20d5..7036240 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi-zero.dts
++++ b/arch/arm/boot/dts/bcm2835-rpi-zero.dts
+@@ -103,3 +103,9 @@
+ &hdmi {
+ 	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+ };
++
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_gpio14>;
++	status = "okay";
++};
+diff --git a/arch/arm/boot/dts/bcm2835-rpi.dtsi b/arch/arm/boot/dts/bcm2835-rpi.dtsi
+index e55b362..e36c392 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi.dtsi
++++ b/arch/arm/boot/dts/bcm2835-rpi.dtsi
+@@ -39,7 +39,7 @@
+ 	};
+ 
+ 	alt0: alt0 {
+-		brcm,pins = <4 5 7 8 9 10 11 14 15>;
++		brcm,pins = <4 5 7 8 9 10 11>;
+ 		brcm,function = <BCM2835_FSEL_ALT0>;
+ 	};
+ };
+diff --git a/arch/arm/boot/dts/bcm2836-rpi-2-b.dts b/arch/arm/boot/dts/bcm2836-rpi-2-b.dts
+index bf19e8c..e8de414 100644
+--- a/arch/arm/boot/dts/bcm2836-rpi-2-b.dts
++++ b/arch/arm/boot/dts/bcm2836-rpi-2-b.dts
+@@ -39,3 +39,9 @@
+ &hdmi {
+ 	hpd-gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+ };
++
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_gpio14>;
++	status = "okay";
++};
+diff --git a/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts b/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts
+index 972f14d..20725ca 100644
+--- a/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts
++++ b/arch/arm64/boot/dts/broadcom/bcm2837-rpi-3-b.dts
+@@ -19,7 +19,17 @@
+ 	};
+ };
+ 
++/* uart0 communicates with the BT module */
++&uart0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart0_ctsrts_gpio30 &gpclk2_gpio43>;
++	status = "okay";
++};
++
++/* uart1 is mapped to the pin header */
+ &uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart1_gpio14>;
+ 	status = "okay";
+ };
+ 
diff --git a/bcm283x-drm-vc4-Fix-OOPSes-from-trying-to-cache-a-partially-constructed-BO..patch b/bcm283x-drm-vc4-Fix-OOPSes-from-trying-to-cache-a-partially-constructed-BO..patch
new file mode 100644
index 000000000..70a528253
--- /dev/null
+++ b/bcm283x-drm-vc4-Fix-OOPSes-from-trying-to-cache-a-partially-constructed-BO..patch
@@ -0,0 +1,42 @@
+From patchwork Thu Feb  9 18:16:00 2017
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: drm/vc4: Fix OOPSes from trying to cache a partially constructed BO.
+From: Eric Anholt <eric@anholt.net>
+X-Patchwork-Id: 138087
+Message-Id: <20170209181600.24048-1-eric@anholt.net>
+To: dri-devel@lists.freedesktop.org
+Cc: linux-kernel@vger.kernel.org, pbrobinson@gmail.com
+Date: Thu,  9 Feb 2017 10:16:00 -0800
+
+If a CMA allocation failed, the partially constructed BO would be
+unreferenced through the normal path, and we might choose to put it in
+the BO cache.  If we then reused it before it expired from the cache,
+the kernel would OOPS.
+
+Signed-off-by: Eric Anholt <eric@anholt.net>
+Fixes: c826a6e10644 ("drm/vc4: Add a BO cache.")
+---
+ drivers/gpu/drm/vc4/vc4_bo.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c
+index 5ec14f25625d..fd83a2807656 100644
+--- a/drivers/gpu/drm/vc4/vc4_bo.c
++++ b/drivers/gpu/drm/vc4/vc4_bo.c
+@@ -314,6 +314,14 @@ void vc4_free_object(struct drm_gem_object *gem_bo)
+ 		goto out;
+ 	}
+ 
++	/* If this object was partially constructed but CMA allocation
++	 * had failed, just free it.
++	 */
++	if (!bo->base.vaddr) {
++		vc4_bo_destroy(bo);
++		goto out;
++	}
++
+ 	cache_list = vc4_get_cache_list_for_size(dev, gem_bo->size);
+ 	if (!cache_list) {
+ 		vc4_bo_destroy(bo);
diff --git a/bcm283x-flip-sdcontroller.patch b/bcm283x-flip-sdcontroller.patch
new file mode 100644
index 000000000..44b5eb146
--- /dev/null
+++ b/bcm283x-flip-sdcontroller.patch
@@ -0,0 +1,41 @@
+From 0c1759bc4fc8884d790d4ab99b5276132559b5a1 Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Tue, 21 Jun 2016 10:00:58 +0200
+Subject: arm: dts: bcm283x: switch from &sdhci to &sdhost
+
+sdcard access with the sdhost controller is faster.
+
+Read access (dd with 64k blocks on rpi2):
+   CONFIG_MMC_SDHCI_IPROC: 11-12 MB/s
+   CONFIG_MMC_BCM2835:     19-20 MB/s
+
+Differences on write access are pretty much in the noise.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Acked-by: Eric Anholt <eric@anholt.net>
+---
+ arch/arm/boot/dts/bcm2835-rpi.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/bcm2835-rpi.dtsi b/arch/arm/boot/dts/bcm2835-rpi.dtsi
+index 8b95832..e36c392 100644
+--- a/arch/arm/boot/dts/bcm2835-rpi.dtsi
++++ b/arch/arm/boot/dts/bcm2835-rpi.dtsi
+@@ -65,13 +65,13 @@
+ &sdhci {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&emmc_gpio48>;
+-	status = "okay";
+ 	bus-width = <4>;
+ };
+ 
+ &sdhost {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&sdhost_gpio48>;
++	status = "okay";
+ 	bus-width = <4>;
+ };
+ 
+-- 
+cgit v0.12
+
diff --git a/bt-bcm.patch b/bt-bcm.patch
new file mode 100644
index 000000000..aa5334b2b
--- /dev/null
+++ b/bt-bcm.patch
@@ -0,0 +1,32 @@
+From feb16722b5d5f05b7ae1278a43e717c3d35cd512 Mon Sep 17 00:00:00 2001
+From: Ian Molton <ian@mnementh.co.uk>
+Date: Wed, 28 Jun 2017 20:10:55 +0100
+Subject: Bluetooth: btbcm: Add entry for BCM43430 UART bluetooth
+
+This patch adds the device ID for the bluetooth chip used in the
+Broadcom BCM43430 SDIO WiFi / UART BT chip.
+
+Successfully tested using Firmware version 0x0182
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Reported-by: Loic Poulain <loic.poulain@intel.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+---
+ drivers/bluetooth/btbcm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c
+index 24f8c4e..9ab6cfb 100644
+--- a/drivers/bluetooth/btbcm.c
++++ b/drivers/bluetooth/btbcm.c
+@@ -295,6 +295,7 @@ static const struct {
+ 	{ 0x410e, "BCM43341B0"	},	/* 002.001.014 */
+ 	{ 0x4406, "BCM4324B3"	},	/* 002.004.006 */
+ 	{ 0x610c, "BCM4354"	},	/* 003.001.012 */
++	{ 0x2209, "BCM43430A1"  },	/* 001.002.009 */
+ 	{ }
+ };
+ 
+-- 
+cgit v1.1
+
diff --git a/bz1471302.patch b/bz1471302.patch
new file mode 100644
index 000000000..0a1325e78
--- /dev/null
+++ b/bz1471302.patch
@@ -0,0 +1,81 @@
+From: Johannes Thumshirn <jthumshirn@suse.de>
+Subject: Re: [REGRESSION] 28676d869bbb (scsi: sg: check for valid direction
+ before starting the request) breaks mtx tape library control
+To: Jason L Tibbitts III <tibbs@math.uh.edu>
+Cc: Doug Gilbert <dgilbert@interlog.com>, linux-scsi@vger.kernel.org,
+	linux-kernel@vger.kernel.org, dvyukov@google.com, hare@suse.com,
+	hch@lst.de, martin.petersen@oracle.com
+Date: Wed, 26 Jul 2017 09:39:34 +0200 (6 hours, 57 minutes ago)
+
+On Tue, Jul 25, 2017 at 01:25:07PM -0500, Jason L Tibbitts III wrote:
+> >>>>> "JT" == Johannes Thumshirn <jthumshirn@suse.de> writes:
+> ioctl(3, SG_IO, {interface_id='S', dxfer_direction=SG_DXFER_TO_DEV, cmd_len=12, cmdp="\xa5\x00\x00\x00\x00\x01\x03\xe9\x00\x00\x00\x00", mx_sb_len=20, iovec_count=0, dxfer_len=0, timeout=300000, flags=0, dxferp=NULL, status=0, masked_status=0, msg_status=0, sb_len_wr=0, sbp="", host_status=0, driver_status=0, resid=0, duration=0, info=0}) = -1 EINVAL (Invalid argument)
+
+[...]
+ 	case SG_DXFER_TO_DEV:
+  	case SG_DXFER_TO_FROM_DEV:
+ 		if (!hp->dxferp)
+  			return false;
+  		return true;
+
+So here we go, dxfer_direction is SG_DXFER_TO_DEV, dxfer_len is 0 and dxferp
+is NULL. We bail out because dxferp is NULL here.
+
+I only looked at sg_write() and not sg_new_write() which is called by the
+SG_IO path not the fops->write() path.
+
+It's probably best to just check for dxfer_len <= 2^28 to be valid as Doug
+suggested:
+
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index 4fe606b000b4..d7ff71e0c85c 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -751,29 +751,6 @@ sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
+ 	return count;
+ }
+ 
+-static bool sg_is_valid_dxfer(sg_io_hdr_t *hp)
+-{
+-	switch (hp->dxfer_direction) {
+-	case SG_DXFER_NONE:
+-		if (hp->dxferp || hp->dxfer_len > 0)
+-			return false;
+-		return true;
+-	case SG_DXFER_TO_DEV:
+-	case SG_DXFER_FROM_DEV:
+-	case SG_DXFER_TO_FROM_DEV:
+-		if (!hp->dxferp || hp->dxfer_len == 0)
+-			return false;
+-		return true;
+-	case SG_DXFER_UNKNOWN:
+-		if ((!hp->dxferp && hp->dxfer_len) ||
+-		    (hp->dxferp && hp->dxfer_len == 0))
+-			return false;
+-		return true;
+-	default:
+-		return false;
+-	}
+-}
+-
+ static int
+ sg_common_write(Sg_fd * sfp, Sg_request * srp,
+ 		unsigned char *cmnd, int timeout, int blocking)
+@@ -800,7 +771,7 @@ sg_common_write(Sg_fd * sfp, Sg_request * srp,
+ 			"sg_common_write:  scsi opcode=0x%02x, cmd_size=%d\n",
+ 			(int) cmnd[0], (int) hp->cmd_len));
+ 
+-	if (!sg_is_valid_dxfer(hp))
++	if (hp->dxfer_len >= SZ_256M)
+ 		return -EINVAL;
+ 
+ 	k = sg_start_req(srp, cmnd);
+
+-- 
+Johannes Thumshirn                                          Storage
+jthumshirn@suse.de                                +49 911 74053 689
+SUSE LINUX GmbH, Maxfeldstr. 5, 90409 Nürnberg
+GF: Felix Imendörffer, Jane Smithard, Graham Norton
+HRB 21284 (AG Nürnberg)
+Key fingerprint = EC38 9CAB C2C4 F25D 8600 D0D0 0393 969D 2D76 0850
+
diff --git a/force-python3-in-kvm_stat.patch b/force-python3-in-kvm_stat.patch
new file mode 100644
index 000000000..38fca1b3c
--- /dev/null
+++ b/force-python3-in-kvm_stat.patch
@@ -0,0 +1,22 @@
+From fc6a72140ef515447743c840674b1aa86b1a4812 Mon Sep 17 00:00:00 2001
+From: Fedora Kernel Team <kernel-team@fedoraproject.org>
+Date: Tue, 25 Jul 2017 12:38:46 -0500
+Subject: [PATCH] Force python3 in kvm_stat
+
+---
+ tools/kvm/kvm_stat/kvm_stat | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/kvm/kvm_stat/kvm_stat b/tools/kvm/kvm_stat/kvm_stat
+index 8f74ed8..12a8cbb 100755
+--- a/tools/kvm/kvm_stat/kvm_stat
++++ b/tools/kvm/kvm_stat/kvm_stat
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python3
+ #
+ # top-like utility for displaying kvm statistics
+ #
+-- 
+2.9.4
+
diff --git a/kernel.spec b/kernel.spec
index 68a5fe702..f7e275538 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -58,7 +58,7 @@ Summary: The Linux kernel
 %define stable_rc 0
 
 # Do we have a -stable update to apply?
-%define stable_update 3
+%define stable_update 4
 # Set rpm version accordingly
 %if 0%{?stable_update}
 %define stablerev %{stable_update}
@@ -565,6 +565,9 @@ Patch122: Input-synaptics-pin-3-touches-when-the-firmware-repo.patch
 
 Patch123: firmware-Drop-WARN-from-usermodehelper_read_trylock-.patch
 
+# Because the python 3 transition is fail
+Patch124: force-python3-in-kvm_stat.patch
+
 # 200 - x86 / secureboot
 
 Patch201: efi-lockdown.patch
@@ -602,23 +605,13 @@ Patch305: ARM-tegra-usb-no-reset.patch
 
 Patch306: AllWinner-net-emac.patch
 
-# http://www.spinics.net/lists/devicetree/msg163238.html
-Patch308: bcm2837-initial-support.patch
-
-# http://www.spinics.net/lists/dri-devel/msg132235.html
-Patch309: drm-vc4-Fix-OOPSes-from-trying-to-cache-a-partially-constructed-BO..patch
-
 # https://www.spinics.net/lists/arm-kernel/msg554183.html
-Patch311: arm-imx6-hummingboard2.patch
-
-Patch312: arm64-Add-option-of-13-for-FORCE_MAX_ZONEORDER.patch
+Patch307: arm-imx6-hummingboard2.patch
 
-Patch313: bcm2835-clk-audio-jitter-issues.patch
-Patch314: bcm2835-fix-potential-null-pointer-dereferences.patch
+Patch308: arm64-Add-option-of-13-for-FORCE_MAX_ZONEORDER.patch
 
-# https://patchwork.freedesktop.org/patch/163300/
-# https://patchwork.freedesktop.org/patch/161978/
-Patch315: bcm283x-vc4-fix-vblank.patch
+# https://www.spinics.net/lists/linux-arm-msm/msg28203.html
+Patch309: qcom-display-iommu.patch
 
 # https://patchwork.kernel.org/patch/9815555/
 # https://patchwork.kernel.org/patch/9815651/
@@ -626,22 +619,37 @@ Patch315: bcm283x-vc4-fix-vblank.patch
 # https://patchwork.kernel.org/patch/9820417/
 # https://patchwork.kernel.org/patch/9821151/
 # https://patchwork.kernel.org/patch/9821157/
-Patch316: qcom-msm89xx-fixes.patch
+Patch310: qcom-msm89xx-fixes.patch
 
-Patch317: arm-thermal-fixes.patch
-# https://patchwork.kernel.org/patch/9802555/
-Patch318: pinctrl-bcm2835-Avoid-warning-from-__irq_do_set_handler.patch
+Patch311: arm-thermal-fixes.patch
 
 # https://patchwork.kernel.org/patch/9831825/
 # https://patchwork.kernel.org/patch/9833721/
-Patch319: arm-tegra-fix-gpu-iommu.patch
+Patch312: arm-tegra-fix-gpu-iommu.patch
 
-# https://www.spinics.net/lists/linux-arm-msm/msg28203.html
-Patch320: qcom-display-iommu.patch
+# https://patchwork.freedesktop.org/patch/163300/
+# https://patchwork.freedesktop.org/patch/161978/
+Patch320: bcm283x-vc4-fix-vblank.patch
+
+# https://patchwork.kernel.org/patch/9802555/
+Patch321: bcm2835-pinctrl-Avoid-warning-from-__irq_do_set_handler.patch
+
+Patch322: bcm2835-clk-audio-jitter-issues.patch
+Patch323: bcm2835-fix-potential-null-pointer-dereferences.patch
+
+# http://www.spinics.net/lists/dri-devel/msg132235.html
+Patch324: bcm283x-drm-vc4-Fix-OOPSes-from-trying-to-cache-a-partially-constructed-BO..patch
+
+Patch325: bcm2837-sdhost-fixes.patch
+Patch326: bcm283x-Define-UART-pinmuxing-on-board-level.patch
+Patch327: bt-bcm.patch
+
+# http://www.spinics.net/lists/devicetree/msg163238.html
+Patch329: bcm2837-arm32-support.patch
 
 # This breaks RPi booting with a LPAE kernel, we don't support the DSI ports currently
 # Revert it while I engage upstream to work out what's going on
-Patch321: Revert-ARM-dts-bcm2835-Add-the-DSI-module-nodes-and-.patch
+Patch330: Revert-ARM-dts-bcm2835-Add-the-DSI-module-nodes-and-.patch
 
 # 400 - IBM (ppc/s390x) patches
 
@@ -677,13 +685,13 @@ Patch616: 0016-Input-silead-Do-not-try-to-directly-access-the-GPIO-.patch
 # CVE-2017-7542 rhbz 1473649 1473650
 Patch701: 0001-ipv6-avoid-overflow-of-offset-in-ip6_find_1stfragopt.patch
 
-# CVE-2017-11473 rhbz 1473209 147310
-Patch702: CVE-2017-11473.patch
-
 # rhbz 1431375
 Patch703: HID-rmi-Make-sure-the-HID-device-is-opened-on-resume.patch
 Patch704: input-rmi4-remove-the-need-for-artifical-IRQ.patch
 
+# rhbz 1471302
+Patch705: bz1471302.patch 
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -2260,6 +2268,18 @@ fi
 #
 #
 %changelog
+* Thu Jul 27 2017 Justin M. Forbes <jforbes@redhat.com> - 4.12.4-300
+- Linux v4.12.4
+
+* Wed Jul 26 2017 Justin M. Forbes <jforbes@fedoraproject.org>
+- Fix mtx (rhbz 1471302)
+
+* Tue Jul 25 2017 Justin M. Forbes <jforbes@fedoraproject.org>
+- Force python3 for kvm_stat because we can't dep (rhbz 1456722)
+
+* Tue Jul 25 2017 Peter Robinson <pbrobinson@fedoraproject.org> 4.12.3-301
+- Bring in ARM patches from stabilization branch
+
 * Mon Jul 24 2017 Justin M. Forbes <jforbes@fedoraproject.org> - 4.12.3-300
 - Linux v4.12.3
 - Fix rhbz 1431375
diff --git a/qcom-msm89xx-fixes.patch b/qcom-msm89xx-fixes.patch
index fc2f16dc3..029876b3f 100644
--- a/qcom-msm89xx-fixes.patch
+++ b/qcom-msm89xx-fixes.patch
@@ -45,54 +45,6 @@ index 600f5f9f7431..62580ad1b1f1 100644
 -- 
 2.13.0
 
-From ccdf75f90484a87ddb29649304156a503bf5a829 Mon Sep 17 00:00:00 2001
-From: Bjorn Andersson <bjorn.andersson@linaro.org>
-Date: Wed, 28 Jun 2017 16:44:58 -0700
-Subject: [PATCH 2/6] spmi: Include OF based modalias in device uevent
-
-Include the OF-based modalias in the uevent sent when registering SPMI
-devices, so that user space has a chance to autoload the kernel module
-for the device.
-
-Reported-by: Rob Clark <robdclark@gmail.com>
-Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
-Tested-by: Rob Clark <robdclark@gmail.com>
-Reviewed-by: Stephen Boyd <sboyd@codeaurora.org>
----
- drivers/spmi/spmi.c | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/drivers/spmi/spmi.c b/drivers/spmi/spmi.c
-index 2b9b0941d9eb..6d23226e5f69 100644
---- a/drivers/spmi/spmi.c
-+++ b/drivers/spmi/spmi.c
-@@ -365,11 +365,23 @@ static int spmi_drv_remove(struct device *dev)
- 	return 0;
- }
- 
-+static int spmi_drv_uevent(struct device *dev, struct kobj_uevent_env *env)
-+{
-+	int ret;
-+
-+	ret = of_device_uevent_modalias(dev, env);
-+	if (ret != -ENODEV)
-+		return ret;
-+
-+	return 0;
-+}
-+
- static struct bus_type spmi_bus_type = {
- 	.name		= "spmi",
- 	.match		= spmi_device_match,
- 	.probe		= spmi_drv_probe,
- 	.remove		= spmi_drv_remove,
-+	.uevent		= spmi_drv_uevent,
- };
- 
- /**
--- 
-2.13.0
-
 From 283d0e00a18b294ec56f1fb904896a546704faaf Mon Sep 17 00:00:00 2001
 From: Rob Clark <robdclark@gmail.com>
 Date: Fri, 30 Jun 2017 11:47:21 -0400
diff --git a/sources b/sources
index 700a46c92..eca2d86c5 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
 SHA512 (perf-man-4.12.tar.gz) = 4d3bbda1f520dba0007c351af46f45085fe4842074eb2e01aee736fd369df595f8f72ed6c1192715f1120bf3353279777f9dca1178fe93bffe5be2de700d409c
 SHA512 (linux-4.12.tar.xz) = 8e81b41b253e63233e92948941f44c6482acb52aa3a3fd172f03a38a86f2c35b2ad4fd407acd1bc3964673eba344fe104d3a03e3ff4bf9cd1f22bd44263bd728
-SHA512 (patch-4.12.3.xz) = a6ace68b6387665a1f77420b415a72032465fae6d99ec409487765ecf7cfb8a8458fe09f844662249f14e5739db3f82b28cdac705b0d54d4c6e268719d350c0d
+SHA512 (patch-4.12.4.xz) = 8a6b72524050733c166524230d85f808275a65c28f06444350ebb8c64dd4cab666f8629ef1d1d2b6c25c1f36820a1fd114510af5a38509df55f9c3071543e647