Merge remote-tracking branch 'origin/master'

9 files changed, 508 insertions, 337 deletions

diff --git a/0001-ARM-mvebu-Correct-unit-address-for-linksys.patch b/0001-ARM-mvebu-Correct-unit-address-for-linksys.patch
new file mode 100644
index 000000000..ba0320c8e
--- /dev/null
+++ b/0001-ARM-mvebu-Correct-unit-address-for-linksys.patch
@@ -0,0 +1,32 @@
+From 0eebfe3b5ae99d3a825be8e45395cea478fd83d8 Mon Sep 17 00:00:00 2001
+From: Patrick Uiterwijk <patrick@puiterwijk.org>
+Date: Mon, 28 Mar 2016 21:30:41 +0000
+Subject: [PATCH] ARM: mvebu: Correct unit address for linksys
+
+The USB2 port for Armada 38x is defined to be at 58000, not at
+50000.
+
+Acked-by: Imre Kaloz <kaloz@openwrt.org>
+Cc: <stable@vger.kernel.org>
+Fixes: 2d0a7addbd10 ("ARM: Kirkwood: Add support for many Synology NAS devices")
+Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
+---
+ arch/arm/boot/dts/armada-385-linksys.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/armada-385-linksys.dtsi b/arch/arm/boot/dts/armada-385-linksys.dtsi
+index 3710755..85d2c37 100644
+--- a/arch/arm/boot/dts/armada-385-linksys.dtsi
++++ b/arch/arm/boot/dts/armada-385-linksys.dtsi
+@@ -117,7 +117,7 @@
+ 			};
+ 
+ 			/* USB part of the eSATA/USB 2.0 port */
+-			usb@50000 {
++			usb@58000 {
+ 				status = "okay";
+ 			};
+ 
+-- 
+2.5.0
+
diff --git a/0001-net-dsa-mv88e6xxx-Introduce-_mv88e6xxx_phy_page_-rea.patch b/0001-net-dsa-mv88e6xxx-Introduce-_mv88e6xxx_phy_page_-rea.patch
new file mode 100644
index 000000000..b2c203f2c
--- /dev/null
+++ b/0001-net-dsa-mv88e6xxx-Introduce-_mv88e6xxx_phy_page_-rea.patch
@@ -0,0 +1,95 @@
+From cc4ee91d46158a4b43a03883ec36b77c03793e85 Mon Sep 17 00:00:00 2001
+From: Patrick Uiterwijk <patrick@puiterwijk.org>
+Date: Fri, 25 Mar 2016 23:05:10 +0000
+Subject: [PATCH 1/2] net: dsa: mv88e6xxx: Introduce
+ _mv88e6xxx_phy_page_{read,write}
+
+Add versions of the phy_page_read and _write functions to
+be used in a context where the SMI mutex is held.
+
+Tested-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+Reviewed-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
+---
+ drivers/net/dsa/mv88e6xxx.c | 49 +++++++++++++++++++++++++++++++++------------
+ 1 file changed, 36 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx.c b/drivers/net/dsa/mv88e6xxx.c
+index fa086e0..86a2029 100644
+--- a/drivers/net/dsa/mv88e6xxx.c
++++ b/drivers/net/dsa/mv88e6xxx.c
+@@ -2264,6 +2264,38 @@ static void mv88e6xxx_bridge_work(struct work_struct *work)
+ 	mutex_unlock(&ps->smi_mutex);
+ }
+ 
++static int _mv88e6xxx_phy_page_write(struct dsa_switch *ds, int port, int page,
++				     int reg, int val)
++{
++	int ret;
++
++	ret = _mv88e6xxx_phy_write_indirect(ds, port, 0x16, page);
++	if (ret < 0)
++		goto restore_page_0;
++
++	ret = _mv88e6xxx_phy_write_indirect(ds, port, reg, val);
++restore_page_0:
++	_mv88e6xxx_phy_write_indirect(ds, port, 0x16, 0x0);
++
++	return ret;
++}
++
++static int _mv88e6xxx_phy_page_read(struct dsa_switch *ds, int port, int page,
++				    int reg)
++{
++	int ret;
++
++	ret = _mv88e6xxx_phy_write_indirect(ds, port, 0x16, page);
++	if (ret < 0)
++		goto restore_page_0;
++
++	ret = _mv88e6xxx_phy_read_indirect(ds, port, reg);
++restore_page_0:
++	_mv88e6xxx_phy_write_indirect(ds, port, 0x16, 0x0);
++
++	return ret;
++}
++
+ static int mv88e6xxx_setup_port(struct dsa_switch *ds, int port)
+ {
+ 	struct mv88e6xxx_priv_state *ps = ds_to_priv(ds);
+@@ -2714,13 +2746,9 @@ int mv88e6xxx_phy_page_read(struct dsa_switch *ds, int port, int page, int reg)
+ 	int ret;
+ 
+ 	mutex_lock(&ps->smi_mutex);
+-	ret = _mv88e6xxx_phy_write_indirect(ds, port, 0x16, page);
+-	if (ret < 0)
+-		goto error;
+-	ret = _mv88e6xxx_phy_read_indirect(ds, port, reg);
+-error:
+-	_mv88e6xxx_phy_write_indirect(ds, port, 0x16, 0x0);
++	ret = _mv88e6xxx_phy_page_read(ds, port, page, reg);
+ 	mutex_unlock(&ps->smi_mutex);
++
+ 	return ret;
+ }
+ 
+@@ -2731,14 +2759,9 @@ int mv88e6xxx_phy_page_write(struct dsa_switch *ds, int port, int page,
+ 	int ret;
+ 
+ 	mutex_lock(&ps->smi_mutex);
+-	ret = _mv88e6xxx_phy_write_indirect(ds, port, 0x16, page);
+-	if (ret < 0)
+-		goto error;
+-
+-	ret = _mv88e6xxx_phy_write_indirect(ds, port, reg, val);
+-error:
+-	_mv88e6xxx_phy_write_indirect(ds, port, 0x16, 0x0);
++	ret = _mv88e6xxx_phy_page_write(ds, port, page, reg, val);
+ 	mutex_unlock(&ps->smi_mutex);
++
+ 	return ret;
+ }
+ 
+-- 
+2.5.0
+
diff --git a/0002-net-dsa-mv88e6xxx-Clear-the-PDOWN-bit-on-setup.patch b/0002-net-dsa-mv88e6xxx-Clear-the-PDOWN-bit-on-setup.patch
new file mode 100644
index 000000000..b35298a56
--- /dev/null
+++ b/0002-net-dsa-mv88e6xxx-Clear-the-PDOWN-bit-on-setup.patch
@@ -0,0 +1,104 @@
+From e95d5ac146d9da8a703a726fe70a9f4ac02ab8b2 Mon Sep 17 00:00:00 2001
+From: Patrick Uiterwijk <patrick@puiterwijk.org>
+Date: Fri, 25 Mar 2016 00:38:45 +0000
+Subject: [PATCH 2/2] net: dsa: mv88e6xxx: Clear the PDOWN bit on setup
+
+Some of the vendor-specific bootloaders set up this part
+of the initialization for us, so this was never added.
+However, since upstream bootloaders don't initialize the
+chip specifically, they leave the fiber MII's PDOWN flag
+set, which means that the CPU port doesn't connect.
+
+This patch checks whether this flag has been clear prior
+by something else, and if not make us clear it.
+
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
+---
+ drivers/net/dsa/mv88e6xxx.c | 36 ++++++++++++++++++++++++++++++++++++
+ drivers/net/dsa/mv88e6xxx.h |  8 ++++++++
+ 2 files changed, 44 insertions(+)
+
+diff --git a/drivers/net/dsa/mv88e6xxx.c b/drivers/net/dsa/mv88e6xxx.c
+index 86a2029..50454be 100644
+--- a/drivers/net/dsa/mv88e6xxx.c
++++ b/drivers/net/dsa/mv88e6xxx.c
+@@ -2296,6 +2296,25 @@ restore_page_0:
+ 	return ret;
+ }
+ 
++static int mv88e6xxx_power_on_serdes(struct dsa_switch *ds)
++{
++	int ret;
++
++	ret = _mv88e6xxx_phy_page_read(ds, REG_FIBER_SERDES, PAGE_FIBER_SERDES,
++				       MII_BMCR);
++	if (ret < 0)
++		return ret;
++
++	if (ret & BMCR_PDOWN) {
++		ret &= ~BMCR_PDOWN;
++		ret = _mv88e6xxx_phy_page_write(ds, REG_FIBER_SERDES,
++						PAGE_FIBER_SERDES, MII_BMCR,
++						ret);
++	}
++
++	return ret;
++}
++
+ static int mv88e6xxx_setup_port(struct dsa_switch *ds, int port)
+ {
+ 	struct mv88e6xxx_priv_state *ps = ds_to_priv(ds);
+@@ -2399,6 +2418,23 @@ static int mv88e6xxx_setup_port(struct dsa_switch *ds, int port)
+ 			goto abort;
+ 	}
+ 
++	/* If this port is connected to a SerDes, make sure the SerDes is not
++	 * powered down.
++	 */
++	if (mv88e6xxx_6352_family(ds)) {
++		ret = _mv88e6xxx_reg_read(ds, REG_PORT(port), PORT_STATUS);
++		if (ret < 0)
++			goto abort;
++		ret &= PORT_STATUS_CMODE_MASK;
++		if ((ret == PORT_STATUS_CMODE_100BASE_X) ||
++		    (ret == PORT_STATUS_CMODE_1000BASE_X) ||
++		    (ret == PORT_STATUS_CMODE_SGMII)) {
++			ret = mv88e6xxx_power_on_serdes(ds);
++			if (ret < 0)
++				goto abort;
++		}
++	}
++
+ 	/* Port Control 2: don't force a good FCS, set the maximum frame size to
+ 	 * 10240 bytes, disable 802.1q tags checking, don't discard tagged or
+ 	 * untagged frames on this port, do a destination address lookup on all
+diff --git a/drivers/net/dsa/mv88e6xxx.h b/drivers/net/dsa/mv88e6xxx.h
+index 9a038ab..26a424a 100644
+--- a/drivers/net/dsa/mv88e6xxx.h
++++ b/drivers/net/dsa/mv88e6xxx.h
+@@ -28,6 +28,10 @@
+ #define SMI_CMD_OP_45_READ_DATA_INC	((3 << 10) | SMI_CMD_BUSY)
+ #define SMI_DATA		0x01
+ 
++/* Fiber/SERDES Registers are located at SMI address F, page 1 */
++#define REG_FIBER_SERDES	0x0f
++#define PAGE_FIBER_SERDES	0x01
++
+ #define REG_PORT(p)		(0x10 + (p))
+ #define PORT_STATUS		0x00
+ #define PORT_STATUS_PAUSE_EN	BIT(15)
+@@ -45,6 +49,10 @@
+ #define PORT_STATUS_MGMII	BIT(6) /* 6185 */
+ #define PORT_STATUS_TX_PAUSED	BIT(5)
+ #define PORT_STATUS_FLOW_CTRL	BIT(4)
++#define PORT_STATUS_CMODE_MASK	0x0f
++#define PORT_STATUS_CMODE_100BASE_X	0x8
++#define PORT_STATUS_CMODE_1000BASE_X	0x9
++#define PORT_STATUS_CMODE_SGMII		0xa
+ #define PORT_PCS_CTRL		0x01
+ #define PORT_PCS_CTRL_RGMII_DELAY_RXCLK	BIT(15)
+ #define PORT_PCS_CTRL_RGMII_DELAY_TXCLK	BIT(14)
+-- 
+2.5.0
+
diff --git a/ALSA-usb-audio-Fix-double-free-in-error-paths-after-.patch b/ALSA-usb-audio-Fix-double-free-in-error-paths-after-.patch
new file mode 100644
index 000000000..c1c72f9bf
--- /dev/null
+++ b/ALSA-usb-audio-Fix-double-free-in-error-paths-after-.patch
@@ -0,0 +1,100 @@
+From 1b9e866417f77622b03f5b9c4e2845133054e670 Mon Sep 17 00:00:00 2001
+From: Vladis Dronov <vdronov@redhat.com>
+Date: Thu, 31 Mar 2016 12:05:43 -0400
+Subject: [PATCH 2/2] ALSA: usb-audio: Fix double-free in error paths after
+ snd_usb_add_audio_stream() call
+
+create_fixed_stream_quirk(), snd_usb_parse_audio_interface() and
+create_uaxx_quirk() functions allocate the audioformat object by themselves
+and free it upon error before returning. However, once the object is linked
+to a stream, it's freed again in snd_usb_audio_pcm_free(), thus it'll be
+double-freed, eventually resulting in a memory corruption.
+
+This patch fixes these failures in the error paths by unlinking the audioformat
+object before freeing it.
+
+Based on a patch by Takashi Iwai" <tiwai@suse.de>
+
+[Note for stable backports:
+ this patch requires the commit 902eb7fd1e4a ('ALSA: usb-audio: Minor
+ code cleanup in create_fixed_stream_quirk()')]
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1283358
+Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
+Cc: <stable@vger.kernel.org> # see the note above
+Signed-off-by: Vladis Dronov <vdronov@redhat.com>
+---
+ sound/usb/quirks.c | 4 ++++
+ sound/usb/stream.c | 6 +++++-
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 2f0bbc43f902..6f68ba9bda8a 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -150,6 +150,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
+ 		usb_audio_err(chip, "cannot memdup\n");
+ 		return -ENOMEM;
+ 	}
++	INIT_LIST_HEAD(&fp->list);
+ 	if (fp->nr_rates > MAX_NR_RATES) {
+ 		kfree(fp);
+ 		return -EINVAL;
+@@ -193,6 +194,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
+ 	return 0;
+ 
+  error:
++	list_del(&fp->list); /* unlink for avoiding double-free */
+ 	kfree(fp);
+ 	kfree(rate_table);
+ 	return err;
+@@ -468,6 +470,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip,
+ 	fp->ep_attr = get_endpoint(alts, 0)->bmAttributes;
+ 	fp->datainterval = 0;
+ 	fp->maxpacksize = le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize);
++	INIT_LIST_HEAD(&fp->list);
+ 
+ 	switch (fp->maxpacksize) {
+ 	case 0x120:
+@@ -491,6 +494,7 @@ static int create_uaxx_quirk(struct snd_usb_audio *chip,
+ 		? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
+ 	err = snd_usb_add_audio_stream(chip, stream, fp);
+ 	if (err < 0) {
++		list_del(&fp->list); /* unlink for avoiding double-free */
+ 		kfree(fp);
+ 		return err;
+ 	}
+diff --git a/sound/usb/stream.c b/sound/usb/stream.c
+index 8ee14f2365e7..3b23102230c0 100644
+--- a/sound/usb/stream.c
++++ b/sound/usb/stream.c
+@@ -316,7 +316,9 @@ static struct snd_pcm_chmap_elem *convert_chmap(int channels, unsigned int bits,
+ /*
+  * add this endpoint to the chip instance.
+  * if a stream with the same endpoint already exists, append to it.
+- * if not, create a new pcm stream.
++ * if not, create a new pcm stream. note, fp is added to the substream
++ * fmt_list and will be freed on the chip instance release. do not free
++ * fp or do remove it from the substream fmt_list to avoid double-free.
+  */
+ int snd_usb_add_audio_stream(struct snd_usb_audio *chip,
+ 			     int stream,
+@@ -677,6 +679,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no)
+ 					* (fp->maxpacksize & 0x7ff);
+ 		fp->attributes = parse_uac_endpoint_attributes(chip, alts, protocol, iface_no);
+ 		fp->clock = clock;
++		INIT_LIST_HEAD(&fp->list);
+ 
+ 		/* some quirks for attributes here */
+ 
+@@ -725,6 +728,7 @@ int snd_usb_parse_audio_interface(struct snd_usb_audio *chip, int iface_no)
+ 		dev_dbg(&dev->dev, "%u:%d: add audio endpoint %#x\n", iface_no, altno, fp->endpoint);
+ 		err = snd_usb_add_audio_stream(chip, stream, fp);
+ 		if (err < 0) {
++			list_del(&fp->list); /* unlink for avoiding double-free */
+ 			kfree(fp->rate_table);
+ 			kfree(fp->chmap);
+ 			kfree(fp);
+-- 
+2.5.5
+
diff --git a/efi-arm64-don-t-apply-MEMBLOCK_NOMAP-to-UEFI-memory-map-mapping.patch b/efi-arm64-don-t-apply-MEMBLOCK_NOMAP-to-UEFI-memory-map-mapping.patch
new file mode 100644
index 000000000..2e3ae0c9b
--- /dev/null
+++ b/efi-arm64-don-t-apply-MEMBLOCK_NOMAP-to-UEFI-memory-map-mapping.patch
@@ -0,0 +1,92 @@
+From patchwork Wed Mar 30 07:46:23 2016
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: efi/arm64: don't apply MEMBLOCK_NOMAP to UEFI memory map mapping
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+X-Patchwork-Id: 8693271
+Message-Id: <1459323983-9120-1-git-send-email-ard.biesheuvel@linaro.org>
+To: linux-efi@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
+	matt@codeblueprint.co.uk
+Cc: mark.rutland@arm.com, mlangsdo@redhat.com,
+	Ard Biesheuvel <ard.biesheuvel@linaro.org>, leif.lindholm@linaro.org, 
+	jeremy.linton@arm.com, msalter@redhat.com
+Date: Wed, 30 Mar 2016 09:46:23 +0200
+
+Hi Matt,
+
+Could we queue this as a fix for v4.6 with a cc:stable for v4.5, please?
+(assuming no objections from any of the cc'ees)
+
+Thanks,
+Ard.
+
+----------8<--------------
+Commit 4dffbfc48d65 ("arm64/efi: mark UEFI reserved regions as
+MEMBLOCK_NOMAP") updated the mapping logic of both the RuntimeServices
+regions as well as the kernel's copy of the UEFI memory map to set the
+MEMBLOCK_NOMAP flag, which causes these regions to be omitted from the
+kernel direct mapping, and from being covered by a struct page.
+For the RuntimeServices regions, this is an obvious win, since the contents
+of these regions have significance to the firmware executable code itself,
+and are mapped in the EFI page tables using attributes that are described in
+the UEFI memory map, and which may differ from the attributes we use for
+mapping system RAM. It also prevents the contents from being modified
+inadvertently, since the EFI page tables are only live during runtime
+service invocations.
+
+None of these concerns apply to the allocation that covers the UEFI memory
+map, since it is entirely owned by the kernel. Setting the MEMBLOCK_NOMAP on
+the region did allow us to use ioremap_cache() to map it both on arm64 and
+on ARM, since the latter does not allow ioremap_cache() to be used on
+regions that are covered by a struct page.
+
+The ioremap_cache() on ARM restriction will be lifted in the v4.7 timeframe,
+but in the mean time, it has been reported that commit 4dffbfc48d65 causes
+a regression on 64k granule kernels. This is due to the fact that, given
+the 64 KB page size, the region that we end up removing from the kernel
+direct mapping is rounded up to 64 KB, and this 64 KB page frame may be
+shared with the initrd when booting via GRUB (which does not align its
+EFI_LOADER_DATA allocations to 64 KB like the stub does). This will crash
+the kernel as soon as it tries to access the initrd.
+
+Since the issue is specific to arm64, revert back to memblock_reserve()'ing
+the UEFI memory map when running on arm64. This is a temporary fix for v4.5
+and v4.6, and will be superseded in the v4.7 timeframe when we will be able
+to move back to memblock_reserve() unconditionally.
+
+Fixes: 4dffbfc48d65 ("arm64/efi: mark UEFI reserved regions as MEMBLOCK_NOMAP")
+Reported-by: Mark Salter <msalter@redhat.com>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+---
+drivers/firmware/efi/arm-init.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/firmware/efi/arm-init.c b/drivers/firmware/efi/arm-init.c
+index aa1f743152a2..8714f8c271ba 100644
+--- a/drivers/firmware/efi/arm-init.c
++++ b/drivers/firmware/efi/arm-init.c
+@@ -203,7 +203,19 @@ void __init efi_init(void)
+ 
+ 	reserve_regions();
+ 	early_memunmap(memmap.map, params.mmap_size);
+-	memblock_mark_nomap(params.mmap & PAGE_MASK,
+-			    PAGE_ALIGN(params.mmap_size +
+-				       (params.mmap & ~PAGE_MASK)));
++
++	if (IS_ENABLED(CONFIG_ARM)) {
++		/*
++		 * ARM currently does not allow ioremap_cache() to be called on
++		 * memory regions that are covered by struct page. So remove the
++		 * UEFI memory map from the linear mapping.
++		 */
++		memblock_mark_nomap(params.mmap & PAGE_MASK,
++				    PAGE_ALIGN(params.mmap_size +
++					       (params.mmap & ~PAGE_MASK)));
++	} else {
++		memblock_reserve(params.mmap & PAGE_MASK,
++				 PAGE_ALIGN(params.mmap_size +
++					    (params.mmap & ~PAGE_MASK)));
++	}
+ }
diff --git a/kernel.spec b/kernel.spec
index d05c8b7da..769ee9d5d 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -44,7 +44,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be appended after the rcX and
 # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
 #
-%global baserelease 1
+%global baserelease 3
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -514,29 +514,36 @@ Source5005: kbuild-AFTER_LINK.patch
 
 # Standalone patches
 
-Patch451: lib-cpumask-Make-CPUMASK_OFFSTACK-usable-without-deb.patch
+Patch420: arm64-avoid-needing-console-to-enable-serial-console.patch
 
-Patch452: arm64-avoid-needing-console-to-enable-serial-console.patch
+Patch421: arm64-acpi-drop-expert-patch.patch
 
-# http://www.spinics.net/lists/netdev/msg369442.html
-#atch453 revert-stmmac-Fix-eth0-No-PHY-found-regression.patch
-#atch454 stmmac-fix-MDIO-settings.patch
+# http://www.spinics.net/lists/arm-kernel/msg490981.html
+Patch422: geekbox-v4-device-tree-support.patch
+
+# http://www.spinics.net/lists/arm-kernel/msg483898.html
+Patch423: Initial-AllWinner-A64-and-PINE64-support.patch
 
-Patch456: arm64-acpi-drop-expert-patch.patch
+# http://www.spinics.net/lists/arm-kernel/msg493431.html
+Patch424: efi-arm64-don-t-apply-MEMBLOCK_NOMAP-to-UEFI-memory-map-mapping.patch
 
 # http://patchwork.ozlabs.org/patch/587554/
-Patch457: ARM-tegra-usb-no-reset.patch
+Patch430: ARM-tegra-usb-no-reset.patch
 
-# http://www.spinics.net/lists/arm-kernel/msg490981.html
-Patch459: geekbox-v4-device-tree-support.patch
+# http://www.spinics.net/lists/linux-tegra/msg25152.html
+Patch431: Fix-tegra-to-use-stdout-path-for-serial-console.patch
 
-# http://www.spinics.net/lists/arm-kernel/msg483898.html
-Patch460: Initial-AllWinner-A64-and-PINE64-support.patch
+Patch432: arm-i.MX6-Utilite-device-dtb.patch
 
-# http://www.spinics.net/lists/linux-tegra/msg25152.html
-Patch461: Fix-tegra-to-use-stdout-path-for-serial-console.patch
+# mvebu usb fixes http://www.spinics.net/lists/arm-kernel/msg493305.html
+Patch433: 0001-ARM-mvebu-Correct-unit-address-for-linksys.patch
 
-Patch463: arm-i.MX6-Utilite-device-dtb.patch
+# mvebu DSA switch fixes
+# http://www.spinics.net/lists/netdev/msg370841.html http://www.spinics.net/lists/netdev/msg370842.html
+Patch434: 0001-net-dsa-mv88e6xxx-Introduce-_mv88e6xxx_phy_page_-rea.patch
+Patch435: 0002-net-dsa-mv88e6xxx-Clear-the-PDOWN-bit-on-setup.patch
+
+Patch460: lib-cpumask-Make-CPUMASK_OFFSTACK-usable-without-deb.patch
 
 Patch466: input-kill-stupid-messages.patch
 
@@ -629,6 +636,9 @@ Patch663: USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch
 #CVE-2016-3134 rhbz 1317383 1317384
 Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch
 
+#CVE-2016-2184 rhbz 1317012 1317470
+Patch668: ALSA-usb-audio-Fix-double-free-in-error-paths-after-.patch
+
 #CVE-2016-3137 rhbz 1317010 1316996
 Patch672: cypress_m8-add-sanity-checking.patch
 
@@ -646,6 +656,9 @@ Patch687: mct_u232-sanity-checking-in-probe.patch
 
 Patch688: sound-usb-fix-NULL-dereference-in-usb_audio_probe.patch
 
+#rhbz 1321749
+Patch689: uapi-linux-stddef.h-Provide-__always_inline-to-users.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1467,6 +1480,9 @@ BuildKernel() {
     rm -rf $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/include
     cp .config $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
     cp -a scripts $RPM_BUILD_ROOT/lib/modules/$KernelVer/build
+    if [ -f tools/objtool/objtool ]; then
+      cp -a tools/objtool/objtool $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/tools/objtool/ || :
+    fi
     if [ -d arch/$Arch/scripts ]; then
       cp -a arch/$Arch/scripts $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/arch/%{_arch} || :
     fi
@@ -2171,6 +2187,18 @@ fi
 #
 # 
 %changelog
+* Thu Mar 31 2016 Josh Boyer <jwboyer@fedoraproject.org>
+- Add another patch for CVE-2016-2184
+
+* Wed Mar 30 2016 Josh Boyer <jwboyer@fedoraproject.org>
+- Fix undefined __always_inline in exported headers (rhbz 1321749)
+- Make sure to install objtool in -devel subpackage if it exists (rhbz 1321628)
+
+* Wed Mar 30 2016 Peter Robinson <pbrobinson@fedoraproject.org>
+- Add ARMv7 mvebu fixes headed upstream
+- Minor ARMv7 cleanups
+- Boot fix for aarch64 devices with 64K page size requirements (Seattle)
+
 * Sun Mar 27 2016 Josh Boyer <jwboyer@fedoraproject.org> - 4.6.0-0.rc1.git0.1
 - Linux v4.6-rc1
 - Disable debugging options.
diff --git a/revert-stmmac-Fix-eth0-No-PHY-found-regression.patch b/revert-stmmac-Fix-eth0-No-PHY-found-regression.patch
deleted file mode 100644
index 68b9cd3ab..000000000
--- a/revert-stmmac-Fix-eth0-No-PHY-found-regression.patch
+++ /dev/null
@@ -1,87 +0,0 @@
-From 44f947bb8ef5f4add9f2d84e1ff53afd8f2f5537 Mon Sep 17 00:00:00 2001
-From: Peter Robinson <pbrobinson@gmail.com>
-Date: Wed, 16 Mar 2016 15:21:44 +0000
-Subject: [PATCH 1/2] Revert "stmmac: Fix 'eth0: No PHY found' regression"
-
-This reverts commit 88f8b1bb41c6208f81b6a480244533ded7b59493.
----
- drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c     | 11 ++++++++++-
- drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c |  9 +--------
- include/linux/stmmac.h                                |  1 -
- 3 files changed, 11 insertions(+), 10 deletions(-)
-
-diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
-index efb54f3..0faf163 100644
---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
-+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
-@@ -199,12 +199,21 @@ int stmmac_mdio_register(struct net_device *ndev)
- 	struct stmmac_priv *priv = netdev_priv(ndev);
- 	struct stmmac_mdio_bus_data *mdio_bus_data = priv->plat->mdio_bus_data;
- 	int addr, found;
--	struct device_node *mdio_node = priv->plat->mdio_node;
-+	struct device_node *mdio_node = NULL;
-+	struct device_node *child_node = NULL;
- 
- 	if (!mdio_bus_data)
- 		return 0;
- 
- 	if (IS_ENABLED(CONFIG_OF)) {
-+		for_each_child_of_node(priv->device->of_node, child_node) {
-+			if (of_device_is_compatible(child_node,
-+						    "snps,dwmac-mdio")) {
-+				mdio_node = child_node;
-+				break;
-+			}
-+		}
-+
- 		if (mdio_node) {
- 			netdev_dbg(ndev, "FOUND MDIO subnode\n");
- 		} else {
-diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
-index 4514ba7..6a52fa1 100644
---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
-+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
-@@ -110,7 +110,6 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
- 	struct device_node *np = pdev->dev.of_node;
- 	struct plat_stmmacenet_data *plat;
- 	struct stmmac_dma_cfg *dma_cfg;
--	struct device_node *child_node = NULL;
- 
- 	plat = devm_kzalloc(&pdev->dev, sizeof(*plat), GFP_KERNEL);
- 	if (!plat)
-@@ -141,19 +140,13 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
- 		plat->phy_node = of_node_get(np);
- 	}
- 
--	for_each_child_of_node(np, child_node)
--		if (of_device_is_compatible(child_node,	"snps,dwmac-mdio")) {
--			plat->mdio_node = child_node;
--			break;
--		}
--
- 	/* "snps,phy-addr" is not a standard property. Mark it as deprecated
- 	 * and warn of its use. Remove this when phy node support is added.
- 	 */
- 	if (of_property_read_u32(np, "snps,phy-addr", &plat->phy_addr) == 0)
- 		dev_warn(&pdev->dev, "snps,phy-addr property is deprecated\n");
- 
--	if ((plat->phy_node && !of_phy_is_fixed_link(np)) || !plat->mdio_node)
-+	if ((plat->phy_node && !of_phy_is_fixed_link(np)) || plat->phy_bus_name)
- 		plat->mdio_bus_data = NULL;
- 	else
- 		plat->mdio_bus_data =
-diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
-index 881a79d..eead8ab 100644
---- a/include/linux/stmmac.h
-+++ b/include/linux/stmmac.h
-@@ -100,7 +100,6 @@ struct plat_stmmacenet_data {
- 	int interface;
- 	struct stmmac_mdio_bus_data *mdio_bus_data;
- 	struct device_node *phy_node;
--	struct device_node *mdio_node;
- 	struct stmmac_dma_cfg *dma_cfg;
- 	int clk_csr;
- 	int has_gmac;
--- 
-2.5.0
-
diff --git a/stmmac-fix-MDIO-settings.patch b/stmmac-fix-MDIO-settings.patch
deleted file mode 100644
index 41fa928a4..000000000
--- a/stmmac-fix-MDIO-settings.patch
+++ /dev/null
@@ -1,235 +0,0 @@
-From d55a02f460ffd64a5ba7f331489af87edeebf8da Mon Sep 17 00:00:00 2001
-From: Giuseppe CAVALLARO <peppe.cavallaro@st.com>
-Date: Wed, 16 Mar 2016 10:38:49 +0100
-Subject: [PATCH 2/2] stmmac: fix MDIO settings
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Initially the phy_bus_name was added to manipulate the
-driver name but it was recently just used to manage the
-fixed-link and then to take some decision at run-time.
-So the patch uses the is_pseudo_fixed_link and removes
-the phy_bus_name variable not necessary anymore.
-
-The driver can manage the mdio registration by using phy-handle,
-dwmac-mdio and own parameter e.g. snps,phy-addr.
-This patch takes care about all these possible configurations
-and fixes the mdio registration in case of there is a real
-transceiver or a switch (that needs to be managed by using
-fixed-link).
-
-Signed-off-by: Giuseppe Cavallaro <peppe.cavallaro@st.com>
-Reviewed-by: Andreas Färber <afaerber@suse.de>
-Tested-by: Frank Schäfer <fschaefer.oss@googlemail.com>
-Cc: Gabriel Fernandez <gabriel.fernandez@linaro.org>
-Cc: Dinh Nguyen <dinh.linux@gmail.com>
-Cc: David S. Miller <davem@davemloft.net>
-Cc: Phil Reid <preid@electromag.com.au>
----
- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c  | 11 +--
- drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c  | 19 +----
- .../net/ethernet/stmicro/stmmac/stmmac_platform.c  | 84 +++++++++++++++++-----
- include/linux/stmmac.h                             |  2 +-
- 4 files changed, 71 insertions(+), 45 deletions(-)
-
-diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
-index c21015b..389d7d0 100644
---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
-+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
-@@ -271,7 +271,6 @@ static void stmmac_eee_ctrl_timer(unsigned long arg)
-  */
- bool stmmac_eee_init(struct stmmac_priv *priv)
- {
--	char *phy_bus_name = priv->plat->phy_bus_name;
- 	unsigned long flags;
- 	bool ret = false;
- 
-@@ -283,7 +282,7 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
- 		goto out;
- 
- 	/* Never init EEE in case of a switch is attached */
--	if (phy_bus_name && (!strcmp(phy_bus_name, "fixed")))
-+	if (priv->phydev->is_pseudo_fixed_link)
- 		goto out;
- 
- 	/* MAC core supports the EEE feature. */
-@@ -820,12 +819,8 @@ static int stmmac_init_phy(struct net_device *dev)
- 		phydev = of_phy_connect(dev, priv->plat->phy_node,
- 					&stmmac_adjust_link, 0, interface);
- 	} else {
--		if (priv->plat->phy_bus_name)
--			snprintf(bus_id, MII_BUS_ID_SIZE, "%s-%x",
--				 priv->plat->phy_bus_name, priv->plat->bus_id);
--		else
--			snprintf(bus_id, MII_BUS_ID_SIZE, "stmmac-%x",
--				 priv->plat->bus_id);
-+		snprintf(bus_id, MII_BUS_ID_SIZE, "stmmac-%x",
-+			 priv->plat->bus_id);
- 
- 		snprintf(phy_id_fmt, MII_BUS_ID_SIZE + 3, PHY_ID_FMT, bus_id,
- 			 priv->plat->phy_addr);
-diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
-index 0faf163..3f5512f 100644
---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
-+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
-@@ -198,29 +198,12 @@ int stmmac_mdio_register(struct net_device *ndev)
- 	struct mii_bus *new_bus;
- 	struct stmmac_priv *priv = netdev_priv(ndev);
- 	struct stmmac_mdio_bus_data *mdio_bus_data = priv->plat->mdio_bus_data;
-+	struct device_node *mdio_node = priv->plat->mdio_node;
- 	int addr, found;
--	struct device_node *mdio_node = NULL;
--	struct device_node *child_node = NULL;
- 
- 	if (!mdio_bus_data)
- 		return 0;
- 
--	if (IS_ENABLED(CONFIG_OF)) {
--		for_each_child_of_node(priv->device->of_node, child_node) {
--			if (of_device_is_compatible(child_node,
--						    "snps,dwmac-mdio")) {
--				mdio_node = child_node;
--				break;
--			}
--		}
--
--		if (mdio_node) {
--			netdev_dbg(ndev, "FOUND MDIO subnode\n");
--		} else {
--			netdev_warn(ndev, "No MDIO subnode found\n");
--		}
--	}
--
- 	new_bus = mdiobus_alloc();
- 	if (new_bus == NULL)
- 		return -ENOMEM;
-diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
-index 6a52fa1..190fb6d 100644
---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
-+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
-@@ -96,6 +96,69 @@ static int dwmac1000_validate_ucast_entries(int ucast_entries)
- }
- 
- /**
-+ * stmmac_dt_phy - parse device-tree driver parameters to allocate PHY resources
-+ * @plat: driver data platform structure
-+ * @np: device tree node
-+ * @dev: device pointer
-+ * Description:
-+ * The mdio bus will be allocated in case of a phy transceiver is on board;
-+ * it will be NULL if the fixed-link is configured.
-+ * If there is the "snps,dwmac-mdio" sub-node the mdio will be allocated
-+ * in any case (for DSA, mdio must be registered even if fixed-link).
-+ * The table below sums the supported configurations:
-+ *	-------------------------------
-+ *	snps,phy-addr	|     Y
-+ *	-------------------------------
-+ *	phy-handle	|     Y
-+ *	-------------------------------
-+ *	fixed-link	|     N
-+ *	-------------------------------
-+ *	snps,dwmac-mdio	|
-+ *	  even if	|     Y
-+ *	fixed-link	|
-+ *	-------------------------------
-+ *
-+ * It returns 0 in case of success otherwise -ENODEV.
-+ */
-+static int stmmac_dt_phy(struct plat_stmmacenet_data *plat,
-+			 struct device_node *np, struct device *dev)
-+{
-+	bool mdio = true;
-+
-+	/* If phy-handle property is passed from DT, use it as the PHY */
-+	plat->phy_node = of_parse_phandle(np, "phy-handle", 0);
-+	if (plat->phy_node)
-+		dev_dbg(dev, "Found phy-handle subnode\n");
-+
-+	/* If phy-handle is not specified, check if we have a fixed-phy */
-+	if (!plat->phy_node && of_phy_is_fixed_link(np)) {
-+		if ((of_phy_register_fixed_link(np) < 0))
-+			return -ENODEV;
-+
-+		dev_dbg(dev, "Found fixed-link subnode\n");
-+		plat->phy_node = of_node_get(np);
-+		mdio = false;
-+	}
-+
-+	/* If snps,dwmac-mdio is passed from DT, always register the MDIO */
-+	for_each_child_of_node(np, plat->mdio_node) {
-+		if (of_device_is_compatible(plat->mdio_node, "snps,dwmac-mdio"))
-+			break;
-+	}
-+
-+	if (plat->mdio_node) {
-+		dev_dbg(dev, "Found MDIO subnode\n");
-+		mdio = true;
-+	}
-+
-+	if (mdio)
-+		plat->mdio_bus_data =
-+			devm_kzalloc(dev, sizeof(struct stmmac_mdio_bus_data),
-+				     GFP_KERNEL);
-+	return 0;
-+}
-+
-+/**
-  * stmmac_probe_config_dt - parse device-tree driver parameters
-  * @pdev: platform_device structure
-  * @plat: driver data platform structure
-@@ -129,30 +192,15 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac)
- 	/* Default to phy auto-detection */
- 	plat->phy_addr = -1;
- 
--	/* If we find a phy-handle property, use it as the PHY */
--	plat->phy_node = of_parse_phandle(np, "phy-handle", 0);
--
--	/* If phy-handle is not specified, check if we have a fixed-phy */
--	if (!plat->phy_node && of_phy_is_fixed_link(np)) {
--		if ((of_phy_register_fixed_link(np) < 0))
--			return ERR_PTR(-ENODEV);
--
--		plat->phy_node = of_node_get(np);
--	}
--
- 	/* "snps,phy-addr" is not a standard property. Mark it as deprecated
- 	 * and warn of its use. Remove this when phy node support is added.
- 	 */
- 	if (of_property_read_u32(np, "snps,phy-addr", &plat->phy_addr) == 0)
- 		dev_warn(&pdev->dev, "snps,phy-addr property is deprecated\n");
- 
--	if ((plat->phy_node && !of_phy_is_fixed_link(np)) || plat->phy_bus_name)
--		plat->mdio_bus_data = NULL;
--	else
--		plat->mdio_bus_data =
--			devm_kzalloc(&pdev->dev,
--				     sizeof(struct stmmac_mdio_bus_data),
--				     GFP_KERNEL);
-+	/* To Configure PHY by using all device-tree supported properties */
-+	if (stmmac_dt_phy(plat, np, &pdev->dev))
-+		return ERR_PTR(-ENODEV);
- 
- 	of_property_read_u32(np, "tx-fifo-depth", &plat->tx_fifo_size);
- 
-diff --git a/include/linux/stmmac.h b/include/linux/stmmac.h
-index eead8ab..8b1ff2b 100644
---- a/include/linux/stmmac.h
-+++ b/include/linux/stmmac.h
-@@ -94,12 +94,12 @@ struct stmmac_dma_cfg {
- };
- 
- struct plat_stmmacenet_data {
--	char *phy_bus_name;
- 	int bus_id;
- 	int phy_addr;
- 	int interface;
- 	struct stmmac_mdio_bus_data *mdio_bus_data;
- 	struct device_node *phy_node;
-+	struct device_node *mdio_node;
- 	struct stmmac_dma_cfg *dma_cfg;
- 	int clk_csr;
- 	int has_gmac;
--- 
-2.5.0
-
diff --git a/uapi-linux-stddef.h-Provide-__always_inline-to-users.patch b/uapi-linux-stddef.h-Provide-__always_inline-to-users.patch
new file mode 100644
index 000000000..ba6628efb
--- /dev/null
+++ b/uapi-linux-stddef.h-Provide-__always_inline-to-users.patch
@@ -0,0 +1,42 @@
+From dd39fab52b6b8e86381d0da847a0252384926832 Mon Sep 17 00:00:00 2001
+From: Denys Vlasenko <dvlasenk@redhat.com>
+Date: Wed, 30 Mar 2016 00:14:57 +0200
+Subject: [PATCH] uapi/linux/stddef.h: Provide __always_inline to userspace
+ headers
+
+Recent change to uapi/linux/swab.h needs this.
+
+Unfortunately, UAPI headers don't include compiler.h and fixing it there is not enough.
+
+Tested. Testcase: "make headers_install" and try to compile this:
+
+	#include <linux/swab.h>
+	void main() {}
+
+Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
+CC: Josh Boyer <jwboyer@fedoraproject.org>
+CC: Thomas Graf <tgraf@suug.ch>
+CC: Peter Zijlstra <peterz@infradead.org>
+CC: David Rientjes <rientjes@google.com>
+CC: Arnd Bergmann <arnd@arndb.de>
+CC: Ingo Molnar <mingo@kernel.org>
+CC: Andrew Morton <akpm@linux-foundation.org>
+CC: Linus Torvalds <torvalds@linux-foundation.org>
+CC: linux-kernel@vger.kernel.org
+---
+ include/uapi/linux/stddef.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/include/uapi/linux/stddef.h b/include/uapi/linux/stddef.h
+index aa9f10428743..621fa8ac4425 100644
+--- a/include/uapi/linux/stddef.h
++++ b/include/uapi/linux/stddef.h
+@@ -1 +1,5 @@
+ #include <linux/compiler.h>
++
++#ifndef __always_inline
++#define __always_inline inline
++#endif
+-- 
+2.5.5
+