4.5.0-302.fc24.gnu

18 files changed, 896 insertions, 46 deletions

diff --git a/freed-ora/current/f24/0001-ARM-mvebu-Correct-unit-address-for-linksys.patch b/freed-ora/current/f24/0001-ARM-mvebu-Correct-unit-address-for-linksys.patch
new file mode 100644
index 000000000..ba0320c8e
--- /dev/null
+++ b/freed-ora/current/f24/0001-ARM-mvebu-Correct-unit-address-for-linksys.patch
@@ -0,0 +1,32 @@
+From 0eebfe3b5ae99d3a825be8e45395cea478fd83d8 Mon Sep 17 00:00:00 2001
+From: Patrick Uiterwijk <patrick@puiterwijk.org>
+Date: Mon, 28 Mar 2016 21:30:41 +0000
+Subject: [PATCH] ARM: mvebu: Correct unit address for linksys
+
+The USB2 port for Armada 38x is defined to be at 58000, not at
+50000.
+
+Acked-by: Imre Kaloz <kaloz@openwrt.org>
+Cc: <stable@vger.kernel.org>
+Fixes: 2d0a7addbd10 ("ARM: Kirkwood: Add support for many Synology NAS devices")
+Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
+---
+ arch/arm/boot/dts/armada-385-linksys.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/armada-385-linksys.dtsi b/arch/arm/boot/dts/armada-385-linksys.dtsi
+index 3710755..85d2c37 100644
+--- a/arch/arm/boot/dts/armada-385-linksys.dtsi
++++ b/arch/arm/boot/dts/armada-385-linksys.dtsi
+@@ -117,7 +117,7 @@
+ 			};
+ 
+ 			/* USB part of the eSATA/USB 2.0 port */
+-			usb@50000 {
++			usb@58000 {
+ 				status = "okay";
+ 			};
+ 
+-- 
+2.5.0
+
diff --git a/freed-ora/current/f24/0001-Input-synaptics-handle-spurious-release-of-trackstic.patch b/freed-ora/current/f24/0001-Input-synaptics-handle-spurious-release-of-trackstic.patch
new file mode 100644
index 000000000..52b082b36
--- /dev/null
+++ b/freed-ora/current/f24/0001-Input-synaptics-handle-spurious-release-of-trackstic.patch
@@ -0,0 +1,31 @@
+From cb6fcfe5a7e9197ceb7e9eec56e9c526e4e76354 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Date: Mon, 14 Mar 2016 19:37:12 +0100
+Subject: [PATCH] Input: synaptics - handle spurious release of trackstick
+ buttons, again
+
+Looks like the fimware 8.2 stall has the extra buttons spurious release
+bug.
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+---
+ drivers/input/mouse/synaptics.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 6025eb4..4ef8d7a 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -863,7 +863,8 @@ static void synaptics_report_ext_buttons(struct psmouse *psmouse,
+ 		return;
+ 
+ 	/* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */
+-	if (SYN_ID_FULL(priv->identity) == 0x801 &&
++	if ((SYN_ID_FULL(priv->identity) == 0x801 ||
++	     SYN_ID_FULL(priv->identity) == 0x802) &&
+ 	    !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02))
+ 		return;
+ 
+-- 
+2.5.0
+
diff --git a/freed-ora/current/f24/0001-net-dsa-mv88e6xxx-Introduce-_mv88e6xxx_phy_page_-rea.patch b/freed-ora/current/f24/0001-net-dsa-mv88e6xxx-Introduce-_mv88e6xxx_phy_page_-rea.patch
new file mode 100644
index 000000000..1e2d4db59
--- /dev/null
+++ b/freed-ora/current/f24/0001-net-dsa-mv88e6xxx-Introduce-_mv88e6xxx_phy_page_-rea.patch
@@ -0,0 +1,95 @@
+From 4d1b08a69350d40e0aa14baba4797ef175295718 Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Wed, 30 Mar 2016 12:40:54 +0100
+Subject: [PATCH 1/2] net: dsa: mv88e6xxx: Introduce
+ _mv88e6xxx_phy_page_{read,write}
+
+Add versions of the phy_page_read and _write functions to
+be used in a context where the SMI mutex is held.
+
+Tested-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+Reviewed-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
+---
+ drivers/net/dsa/mv88e6xxx.c | 49 +++++++++++++++++++++++++++++++++------------
+ 1 file changed, 36 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6xxx.c b/drivers/net/dsa/mv88e6xxx.c
+index 512c8c0..3dcfe13 100644
+--- a/drivers/net/dsa/mv88e6xxx.c
++++ b/drivers/net/dsa/mv88e6xxx.c
+@@ -1929,6 +1929,38 @@ static void mv88e6xxx_bridge_work(struct work_struct *work)
+ 	}
+ }
+ 
++static int _mv88e6xxx_phy_page_write(struct dsa_switch *ds, int port, int page,
++				     int reg, int val)
++{
++	int ret;
++
++	ret = _mv88e6xxx_phy_write_indirect(ds, port, 0x16, page);
++	if (ret < 0)
++		goto restore_page_0;
++
++	ret = _mv88e6xxx_phy_write_indirect(ds, port, reg, val);
++restore_page_0:
++	_mv88e6xxx_phy_write_indirect(ds, port, 0x16, 0x0);
++
++	return ret;
++}
++
++static int _mv88e6xxx_phy_page_read(struct dsa_switch *ds, int port, int page,
++				    int reg)
++{
++	int ret;
++
++	ret = _mv88e6xxx_phy_write_indirect(ds, port, 0x16, page);
++	if (ret < 0)
++		goto restore_page_0;
++
++	ret = _mv88e6xxx_phy_read_indirect(ds, port, reg);
++restore_page_0:
++	_mv88e6xxx_phy_write_indirect(ds, port, 0x16, 0x0);
++
++	return ret;
++}
++
+ static int mv88e6xxx_setup_port(struct dsa_switch *ds, int port)
+ {
+ 	struct mv88e6xxx_priv_state *ps = ds_to_priv(ds);
+@@ -2383,13 +2415,9 @@ int mv88e6xxx_phy_page_read(struct dsa_switch *ds, int port, int page, int reg)
+ 	int ret;
+ 
+ 	mutex_lock(&ps->smi_mutex);
+-	ret = _mv88e6xxx_phy_write_indirect(ds, port, 0x16, page);
+-	if (ret < 0)
+-		goto error;
+-	ret = _mv88e6xxx_phy_read_indirect(ds, port, reg);
+-error:
+-	_mv88e6xxx_phy_write_indirect(ds, port, 0x16, 0x0);
++	ret = _mv88e6xxx_phy_page_read(ds, port, page, reg);
+ 	mutex_unlock(&ps->smi_mutex);
++
+ 	return ret;
+ }
+ 
+@@ -2400,14 +2428,9 @@ int mv88e6xxx_phy_page_write(struct dsa_switch *ds, int port, int page,
+ 	int ret;
+ 
+ 	mutex_lock(&ps->smi_mutex);
+-	ret = _mv88e6xxx_phy_write_indirect(ds, port, 0x16, page);
+-	if (ret < 0)
+-		goto error;
+-
+-	ret = _mv88e6xxx_phy_write_indirect(ds, port, reg, val);
+-error:
+-	_mv88e6xxx_phy_write_indirect(ds, port, 0x16, 0x0);
++	ret = _mv88e6xxx_phy_page_write(ds, port, page, reg, val);
+ 	mutex_unlock(&ps->smi_mutex);
++
+ 	return ret;
+ }
+ 
+-- 
+2.7.3
+
diff --git a/freed-ora/current/f24/0001-uas-Limit-qdepth-at-the-scsi-host-level.patch b/freed-ora/current/f24/0001-uas-Limit-qdepth-at-the-scsi-host-level.patch
new file mode 100644
index 000000000..b6c446829
--- /dev/null
+++ b/freed-ora/current/f24/0001-uas-Limit-qdepth-at-the-scsi-host-level.patch
@@ -0,0 +1,45 @@
+From 79abe2bd501d628b165f323098d6972d69bd13d7 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Wed, 16 Mar 2016 13:20:51 +0100
+Subject: [PATCH] uas: Limit qdepth at the scsi-host level
+
+Commit 64d513ac31bd ("scsi: use host wide tags by default") causes
+the scsi-core to queue more cmnds then we can handle on devices with
+multiple LUNs, limit the qdepth at the scsi-host level instead of
+per slave to fix this.
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1315013
+Cc: stable@vger.kernel.org # 4.4.x and 4.5.x
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/usb/storage/uas.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
+index c90a7e4..b5cb7ab 100644
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -800,7 +800,6 @@ static int uas_slave_configure(struct scsi_device *sdev)
+ 	if (devinfo->flags & US_FL_BROKEN_FUA)
+ 		sdev->broken_fua = 1;
+ 
+-	scsi_change_queue_depth(sdev, devinfo->qdepth - 2);
+ 	return 0;
+ }
+ 
+@@ -932,6 +931,12 @@ static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ 	if (result)
+ 		goto set_alt0;
+ 
++	/*
++	 * 1 tag is reserved for untagged commands +
++	 * 1 tag to avoid of by one errors in some bridge firmwares
++	 */
++	shost->can_queue = devinfo->qdepth - 2;
++
+ 	usb_set_intfdata(intf, shost);
+ 	result = scsi_add_host(shost, &intf->dev);
+ 	if (result)
+-- 
+2.7.3
+
diff --git a/freed-ora/current/f24/0002-net-dsa-mv88e6xxx-Clear-the-PDOWN-bit-on-setup.patch b/freed-ora/current/f24/0002-net-dsa-mv88e6xxx-Clear-the-PDOWN-bit-on-setup.patch
new file mode 100644
index 000000000..35b369312
--- /dev/null
+++ b/freed-ora/current/f24/0002-net-dsa-mv88e6xxx-Clear-the-PDOWN-bit-on-setup.patch
@@ -0,0 +1,104 @@
+From a878e3fa9657646ff85468075823870fbbd5745f Mon Sep 17 00:00:00 2001
+From: Peter Robinson <pbrobinson@gmail.com>
+Date: Wed, 30 Mar 2016 12:41:22 +0100
+Subject: [PATCH 2/2] net: dsa: mv88e6xxx: Clear the PDOWN bit on setup
+
+Some of the vendor-specific bootloaders set up this part
+of the initialization for us, so this was never added.
+However, since upstream bootloaders don't initialize the
+chip specifically, they leave the fiber MII's PDOWN flag
+set, which means that the CPU port doesn't connect.
+
+This patch checks whether this flag has been clear prior
+by something else, and if not make us clear it.
+
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
+---
+ drivers/net/dsa/mv88e6xxx.c | 36 ++++++++++++++++++++++++++++++++++++
+ drivers/net/dsa/mv88e6xxx.h |  8 ++++++++
+ 2 files changed, 44 insertions(+)
+
+diff --git a/drivers/net/dsa/mv88e6xxx.c b/drivers/net/dsa/mv88e6xxx.c
+index 3dcfe13..a4e3750 100644
+--- a/drivers/net/dsa/mv88e6xxx.c
++++ b/drivers/net/dsa/mv88e6xxx.c
+@@ -1961,6 +1961,25 @@ restore_page_0:
+ 	return ret;
+ }
+ 
++static int mv88e6xxx_power_on_serdes(struct dsa_switch *ds)
++{
++	int ret;
++
++	ret = _mv88e6xxx_phy_page_read(ds, REG_FIBER_SERDES, PAGE_FIBER_SERDES,
++				       MII_BMCR);
++	if (ret < 0)
++		return ret;
++
++	if (ret & BMCR_PDOWN) {
++		ret &= ~BMCR_PDOWN;
++		ret = _mv88e6xxx_phy_page_write(ds, REG_FIBER_SERDES,
++						PAGE_FIBER_SERDES, MII_BMCR,
++						ret);
++	}
++
++	return ret;
++}
++
+ static int mv88e6xxx_setup_port(struct dsa_switch *ds, int port)
+ {
+ 	struct mv88e6xxx_priv_state *ps = ds_to_priv(ds);
+@@ -2064,6 +2083,23 @@ static int mv88e6xxx_setup_port(struct dsa_switch *ds, int port)
+ 			goto abort;
+ 	}
+ 
++	/* If this port is connected to a SerDes, make sure the SerDes is not
++	 * powered down.
++	 */
++	if (mv88e6xxx_6352_family(ds)) {
++		ret = _mv88e6xxx_reg_read(ds, REG_PORT(port), PORT_STATUS);
++		if (ret < 0)
++			goto abort;
++		ret &= PORT_STATUS_CMODE_MASK;
++		if ((ret == PORT_STATUS_CMODE_100BASE_X) ||
++		    (ret == PORT_STATUS_CMODE_1000BASE_X) ||
++		    (ret == PORT_STATUS_CMODE_SGMII)) {
++			ret = mv88e6xxx_power_on_serdes(ds);
++			if (ret < 0)
++				goto abort;
++		}
++	}
++
+ 	/* Port Control 2: don't force a good FCS, set the maximum frame size to
+ 	 * 10240 bytes, enable secure 802.1q tags, don't discard tagged or
+ 	 * untagged frames on this port, do a destination address lookup on all
+diff --git a/drivers/net/dsa/mv88e6xxx.h b/drivers/net/dsa/mv88e6xxx.h
+index ca08f91..adc7f0d 100644
+--- a/drivers/net/dsa/mv88e6xxx.h
++++ b/drivers/net/dsa/mv88e6xxx.h
+@@ -28,6 +28,10 @@
+ #define SMI_CMD_OP_45_READ_DATA_INC	((3 << 10) | SMI_CMD_BUSY)
+ #define SMI_DATA		0x01
+ 
++/* Fiber/SERDES Registers are located at SMI address F, page 1 */
++#define REG_FIBER_SERDES	0x0f
++#define PAGE_FIBER_SERDES	0x01
++
+ #define REG_PORT(p)		(0x10 + (p))
+ #define PORT_STATUS		0x00
+ #define PORT_STATUS_PAUSE_EN	BIT(15)
+@@ -45,6 +49,10 @@
+ #define PORT_STATUS_MGMII	BIT(6) /* 6185 */
+ #define PORT_STATUS_TX_PAUSED	BIT(5)
+ #define PORT_STATUS_FLOW_CTRL	BIT(4)
++#define PORT_STATUS_CMODE_MASK	0x0f
++#define PORT_STATUS_CMODE_100BASE_X	0x8
++#define PORT_STATUS_CMODE_1000BASE_X	0x9
++#define PORT_STATUS_CMODE_SGMII		0xa
+ #define PORT_PCS_CTRL		0x01
+ #define PORT_PCS_CTRL_RGMII_DELAY_RXCLK	BIT(15)
+ #define PORT_PCS_CTRL_RGMII_DELAY_TXCLK	BIT(14)
+-- 
+2.7.3
+
diff --git a/freed-ora/current/f24/Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch b/freed-ora/current/f24/Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch
new file mode 100644
index 000000000..c7a461de8
--- /dev/null
+++ b/freed-ora/current/f24/Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch
@@ -0,0 +1,107 @@
+From 0f8536022831faaba3a952fa633902d9686f535f Mon Sep 17 00:00:00 2001
+From: Vladis Dronov <vdronov@redhat.com>
+Date: Wed, 23 Mar 2016 15:53:07 -0400
+Subject: [PATCH] Input: ati_remote2: fix crashes on detecting device with
+ invalid descriptor
+
+The ati_remote2 driver expects at least two interfaces with one
+endpoint each. If given malicious descriptor that specify one
+interface or no endpoints, it will crash in the probe function.
+Ensure there is at least two interfaces and one endpoint for each
+interface before using it.
+
+The full disclosure: http://seclists.org/bugtraq/2016/Mar/90
+
+Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
+Signed-off-by: Vladis Dronov <vdronov@redhat.com>
+---
+ drivers/input/misc/ati_remote2.c | 36 ++++++++++++++++++++++++++++++------
+ 1 file changed, 30 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/input/misc/ati_remote2.c b/drivers/input/misc/ati_remote2.c
+index cfd58e87da26..cf5d1e8d92c7 100644
+--- a/drivers/input/misc/ati_remote2.c
++++ b/drivers/input/misc/ati_remote2.c
+@@ -817,26 +817,49 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
+ 
+ 	ar2->udev = udev;
+ 
++	/* Sanity check, first interface must have an endpoint */
++	if ((alt->desc.bNumEndpoints < 1) || !alt->endpoint) {
++		dev_err(&interface->dev,
++			"%s(): interface 0 must have an endpoint\n", __func__);
++		r = -ENODEV;
++		goto fail1;
++	}
+ 	ar2->intf[0] = interface;
+ 	ar2->ep[0] = &alt->endpoint[0].desc;
+ 
++	/* Sanity check, the device must have two interfaces */
+ 	ar2->intf[1] = usb_ifnum_to_if(udev, 1);
++	if ((udev->actconfig->desc.bNumInterfaces < 2) || !ar2->intf[1]) {
++		dev_err(&interface->dev, "%s(): need 2 interfaces, found %d\n",
++			__func__, udev->actconfig->desc.bNumInterfaces);
++		r = -ENODEV;
++		goto fail1;
++	}
++
+ 	r = usb_driver_claim_interface(&ati_remote2_driver, ar2->intf[1], ar2);
+ 	if (r)
+ 		goto fail1;
++
++	/* Sanity check, second interface must have an endpoint */
+ 	alt = ar2->intf[1]->cur_altsetting;
++	if ((alt->desc.bNumEndpoints < 1) || !alt->endpoint) {
++		dev_err(&interface->dev,
++			"%s(): interface 1 must have an endpoint\n", __func__);
++		r = -ENODEV;
++		goto fail2;
++	}
+ 	ar2->ep[1] = &alt->endpoint[0].desc;
+ 
+ 	r = ati_remote2_urb_init(ar2);
+ 	if (r)
+-		goto fail2;
++		goto fail3;
+ 
+ 	ar2->channel_mask = channel_mask;
+ 	ar2->mode_mask = mode_mask;
+ 
+ 	r = ati_remote2_setup(ar2, ar2->channel_mask);
+ 	if (r)
+-		goto fail2;
++		goto fail3;
+ 
+ 	usb_make_path(udev, ar2->phys, sizeof(ar2->phys));
+ 	strlcat(ar2->phys, "/input0", sizeof(ar2->phys));
+@@ -845,11 +868,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
+ 
+ 	r = sysfs_create_group(&udev->dev.kobj, &ati_remote2_attr_group);
+ 	if (r)
+-		goto fail2;
++		goto fail3;
+ 
+ 	r = ati_remote2_input_init(ar2);
+ 	if (r)
+-		goto fail3;
++		goto fail4;
+ 
+ 	usb_set_intfdata(interface, ar2);
+ 
+@@ -857,10 +880,11 @@ static int ati_remote2_probe(struct usb_interface *interface, const struct usb_d
+ 
+ 	return 0;
+ 
+- fail3:
++ fail4:
+ 	sysfs_remove_group(&udev->dev.kobj, &ati_remote2_attr_group);
+- fail2:
++ fail3:
+ 	ati_remote2_urb_cleanup(ar2);
++ fail2:
+ 	usb_driver_release_interface(&ati_remote2_driver, ar2->intf[1]);
+  fail1:
+ 	kfree(ar2);
+-- 
+2.5.0
+
diff --git a/freed-ora/current/f24/bcm283x-add-aux-uart-support-extra-DT-bits-initial-r.patch b/freed-ora/current/f24/bcm283x-Pull-upstream-fixes.patch
index beaa6bd0f..4d639ef89 100644
--- a/freed-ora/current/f24/bcm283x-add-aux-uart-support-extra-DT-bits-initial-r.patch
+++ b/freed-ora/current/f24/bcm283x-Pull-upstream-fixes.patch
@@ -1,8 +1,7 @@
-From 59fb5b800868d984e836ab4a38d8ba1598dc675a Mon Sep 17 00:00:00 2001
+From 1039ba1b91421a9018312f5901855fe03fbb0d1f Mon Sep 17 00:00:00 2001
 From: Peter Robinson <pbrobinson@gmail.com>
-Date: Fri, 18 Mar 2016 19:18:51 +0000
-Subject: [PATCH] bcm283x: add aux uart support, extra DT bits, initial rpi3,
- VC4 fixes and VC4 DT bindings
+Date: Wed, 30 Mar 2016 10:32:41 +0100
+Subject: [PATCH] bcm283x: Pull upstream fixes
 
 ---
  .../devicetree/bindings/arm/bcm/brcm,bcm2835.txt   |   4 +
@@ -13,7 +12,7 @@ Subject: [PATCH] bcm283x: add aux uart support, extra DT bits, initial rpi3,
  arch/arm/boot/dts/bcm2835-rpi-b-plus.dts           |   4 +
  arch/arm/boot/dts/bcm2835-rpi-b-rev2.dts           |   4 +
  arch/arm/boot/dts/bcm2835-rpi-b.dts                |   4 +
- arch/arm/boot/dts/bcm2835-rpi.dtsi                 |  25 +
+ arch/arm/boot/dts/bcm2835-rpi.dtsi                 |  21 +
  arch/arm/boot/dts/bcm2836-rpi-2-b.dts              |   4 +
  arch/arm/boot/dts/bcm2837-rpi-3-b.dts              |  22 +
  arch/arm/boot/dts/bcm2837.dtsi                     |  68 +++
@@ -31,7 +30,7 @@ Subject: [PATCH] bcm283x: add aux uart support, extra DT bits, initial rpi3,
  drivers/tty/serial/8250/8250_bcm2835aux.c          | 146 +++++
  drivers/tty/serial/8250/Kconfig                    |  24 +
  drivers/tty/serial/8250/Makefile                   |   1 +
- 26 files changed, 1365 insertions(+), 122 deletions(-)
+ 26 files changed, 1361 insertions(+), 122 deletions(-)
  create mode 100644 Documentation/devicetree/bindings/serial/brcm,bcm2835-aux-uart.txt
  create mode 100644 arch/arm/boot/dts/bcm2835-rpi-a.dts
  create mode 100644 arch/arm/boot/dts/bcm2837-rpi-3-b.dts
@@ -178,7 +177,7 @@ index 4859e9d..8b15f9c 100644
 +	hpd-gpios = <&gpio 46 GPIO_ACTIVE_HIGH>;
 +};
 diff --git a/arch/arm/boot/dts/bcm2835-rpi.dtsi b/arch/arm/boot/dts/bcm2835-rpi.dtsi
-index 3afb9fe..40510df 100644
+index 3afb9fe..b1e8145 100644
 --- a/arch/arm/boot/dts/bcm2835-rpi.dtsi
 +++ b/arch/arm/boot/dts/bcm2835-rpi.dtsi
 @@ -1,3 +1,5 @@
@@ -200,15 +199,11 @@ index 3afb9fe..40510df 100644
  	};
  };
  
-@@ -58,3 +66,20 @@
+@@ -58,3 +66,16 @@
  	status = "okay";
  	bus-width = <4>;
  };
 +
-+&usb {
-+	power-domains = <&power RPI_POWER_DOMAIN_USB>;
-+};
-+
 +&pwm {
 +	status = "okay";
 +};
@@ -2151,5 +2146,5 @@ index b9b9bca..5c1869f 100644
  obj-$(CONFIG_SERIAL_8250_FOURPORT)	+= 8250_fourport.o
  obj-$(CONFIG_SERIAL_8250_ACCENT)	+= 8250_accent.o
 -- 
-2.5.0
+2.7.3
 
diff --git a/freed-ora/current/f24/config-arm-generic b/freed-ora/current/f24/config-arm-generic
index 8215a36a8..b868cf20d 100644
--- a/freed-ora/current/f24/config-arm-generic
+++ b/freed-ora/current/f24/config-arm-generic
@@ -166,7 +166,6 @@ CONFIG_SND_HDA_TEGRA=m
 
 # CONFIG_ARM_TEGRA20_CPUFREQ is not set
 # CONFIG_MFD_NVEC is not set
-# CONFIG_TEGRA20_APB_DMA is not set
 
 # Virt
 CONFIG_PARAVIRT=y
@@ -436,7 +435,6 @@ CONFIG_VFIO_AMBA=m
 # CONFIG_CADENCE_WATCHDOG is not set
 
 # CONFIG_DRM_ARMADA is not set
-# CONFIG_DRM_TEGRA is not set
 # CONFIG_SHMOBILE_IOMMU is not set
 
 # CONFIG_COMMON_CLK_SI570 is not set
diff --git a/freed-ora/current/f24/config-armv7-generic b/freed-ora/current/f24/config-armv7-generic
index e5d10e198..ba5f41aa1 100644
--- a/freed-ora/current/f24/config-armv7-generic
+++ b/freed-ora/current/f24/config-armv7-generic
@@ -380,6 +380,13 @@ CONFIG_AD525X_DPOT=m
 CONFIG_AD525X_DPOT_I2C=m
 CONFIG_AD525X_DPOT_SPI=m
 
+# Jetson TK1
+CONFIG_PINCTRL_AS3722=y
+CONFIG_POWER_RESET_AS3722=y
+CONFIG_MFD_AS3722=y
+CONFIG_REGULATOR_AS3722=m
+CONFIG_RTC_DRV_AS3722=y
+
 # TI Generic
 CONFIG_TI_SOC_THERMAL=m
 CONFIG_TI_THERMAL=y
diff --git a/freed-ora/current/f24/config-armv7-lpae b/freed-ora/current/f24/config-armv7-lpae
index 828b13a87..4baa10c9b 100644
--- a/freed-ora/current/f24/config-armv7-lpae
+++ b/freed-ora/current/f24/config-armv7-lpae
@@ -71,7 +71,6 @@ CONFIG_GPIO_SYSCON=m
 # CONFIG_SPI_TEGRA20_SFLASH is not set
 # CONFIG_SPI_TEGRA20_SLINK is not set
 # CONFIG_MFD_MAX8907 is not set
-# CONFIG_MFD_NVEC is not set
 # CONFIG_SND_SOC_TEGRA_ALC5632 is not set
 # CONFIG_SND_SOC_TEGRA_TRIMSLICE is not set
 # CONFIG_SND_SOC_TEGRA_WM8753 is not set
@@ -80,5 +79,4 @@ CONFIG_GPIO_SYSCON=m
 # CONFIG_SND_SOC_TEGRA20_AC97 is not set
 # CONFIG_SND_SOC_TEGRA20_DAS is not set
 # CONFIG_SND_SOC_TEGRA20_SPDIF is not set
-# CONFIG_SND_SOC_TEGRA_RT5677 is not set
 # CONFIG_DRM_OMAP is not set
diff --git a/freed-ora/current/f24/config-x86-generic b/freed-ora/current/f24/config-x86-generic
index 10a3a126b..af204bcf1 100644
--- a/freed-ora/current/f24/config-x86-generic
+++ b/freed-ora/current/f24/config-x86-generic
@@ -72,7 +72,7 @@ CONFIG_MMIOTRACE=y
 # CONFIG_MMIOTRACE_TEST is not set
 # CONFIG_DEBUG_PER_CPU_MAPS is not set
 CONFIG_DEBUG_RODATA=y
-CONFIG_DEBUG_WX=y
+# CONFIG_DEBUG_WX is not set
 CONFIG_DEBUG_STACKOVERFLOW=y
 
 CONFIG_ACPI=y
diff --git a/freed-ora/current/f24/digi_acceleport-do-sanity-checking-for-the-number-of.patch b/freed-ora/current/f24/digi_acceleport-do-sanity-checking-for-the-number-of.patch
index 2bbae94b7..eb060eb08 100644
--- a/freed-ora/current/f24/digi_acceleport-do-sanity-checking-for-the-number-of.patch
+++ b/freed-ora/current/f24/digi_acceleport-do-sanity-checking-for-the-number-of.patch
@@ -1,7 +1,7 @@
 From e9c2a3972496927631a1a98fef43e9538e9fd5d5 Mon Sep 17 00:00:00 2001
 From: Oliver Neukum <oneukum@suse.com>
 Date: Mon, 14 Mar 2016 15:53:38 +0100
-Subject: [PATCH] digi_acceleport: do sanity checking for the number of ports
+Subject: [PATCH v2] digi_acceleport: do sanity checking for the number of ports
 
 The driver can be crashed with devices that expose crafted
 descriptors with too few endpoints.
@@ -9,26 +9,62 @@ See:
 http://seclists.org/bugtraq/2016/Mar/61
 
 Signed-off-by: Oliver Neukum <ONeukum@suse.com>
+
+v1 - added sanity checks
+v2 - moved them to probe() to fix problems Johan pointed out
 ---
- drivers/usb/serial/digi_acceleport.c | 5 +++++
- 1 file changed, 5 insertions(+)
+ drivers/usb/serial/digi_acceleport.c | 24 +++++++++++++++++++-----
+ 1 file changed, 19 insertions(+), 5 deletions(-)
 
 diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
-index 12b0e67473ba..c4d4d4547d40 100644
+index 12b0e67..dab1dcf 100644
 --- a/drivers/usb/serial/digi_acceleport.c
 +++ b/drivers/usb/serial/digi_acceleport.c
-@@ -1260,6 +1260,11 @@ static int digi_startup(struct usb_serial *serial)
+@@ -1252,7 +1252,8 @@ static int digi_port_init(struct usb_serial_port *port, unsigned port_num)
+ static int digi_startup(struct usb_serial *serial)
+ {
+ 	struct digi_serial *serial_priv;
+-	int ret;
++	int ret = -ENODEV;
++	int i;
+ 
+ 	serial_priv = kzalloc(sizeof(*serial_priv), GFP_KERNEL);
+ 	if (!serial_priv)
+@@ -1260,18 +1261,31 @@ static int digi_startup(struct usb_serial *serial)
  
  	spin_lock_init(&serial_priv->ds_serial_lock);
  	serial_priv->ds_oob_port_num = serial->type->num_ports;
-+	if (!(serial_priv->ds_oob_port_num == 2 && serial->type == &digi_acceleport_2_device)
-+		&& !(serial_priv->ds_oob_port_num == 4 && serial->type == &digi_acceleport_4_device)) {
-+		kfree(serial_priv);
-+		return -EINVAL;
++
++	/* Check whether the expected number of ports matches the device */
++	if (serial->num_ports < serial_priv->ds_oob_port_num)
++		goto error;
++	/* all features must be present */
++	for (i = 0; i < serial->type->num_ports + 1 ; i++) {
++		if (!serial->port[i]->read_urb)
++			goto error;
++		if (!serial->port[i]->write_urb)
++			goto error;
 +	}
++
  	serial_priv->ds_oob_port = serial->port[serial_priv->ds_oob_port_num];
  
  	ret = digi_port_init(serial_priv->ds_oob_port,
+ 						serial_priv->ds_oob_port_num);
+-	if (ret) {
+-		kfree(serial_priv);
+-		return ret;
+-	}
++	if (ret)
++		goto error;
+ 
+ 	usb_set_serial_data(serial, serial_priv);
+ 
+ 	return 0;
++error:
++	kfree(serial_priv);
++	return ret;
+ }
+ 
+ 
 -- 
-2.5.0
-
+2.1.4
diff --git a/freed-ora/current/f24/efi-arm64-don-t-apply-MEMBLOCK_NOMAP-to-UEFI-memory-map-mapping.patch b/freed-ora/current/f24/efi-arm64-don-t-apply-MEMBLOCK_NOMAP-to-UEFI-memory-map-mapping.patch
new file mode 100644
index 000000000..2e3ae0c9b
--- /dev/null
+++ b/freed-ora/current/f24/efi-arm64-don-t-apply-MEMBLOCK_NOMAP-to-UEFI-memory-map-mapping.patch
@@ -0,0 +1,92 @@
+From patchwork Wed Mar 30 07:46:23 2016
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: efi/arm64: don't apply MEMBLOCK_NOMAP to UEFI memory map mapping
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+X-Patchwork-Id: 8693271
+Message-Id: <1459323983-9120-1-git-send-email-ard.biesheuvel@linaro.org>
+To: linux-efi@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
+	matt@codeblueprint.co.uk
+Cc: mark.rutland@arm.com, mlangsdo@redhat.com,
+	Ard Biesheuvel <ard.biesheuvel@linaro.org>, leif.lindholm@linaro.org, 
+	jeremy.linton@arm.com, msalter@redhat.com
+Date: Wed, 30 Mar 2016 09:46:23 +0200
+
+Hi Matt,
+
+Could we queue this as a fix for v4.6 with a cc:stable for v4.5, please?
+(assuming no objections from any of the cc'ees)
+
+Thanks,
+Ard.
+
+----------8<--------------
+Commit 4dffbfc48d65 ("arm64/efi: mark UEFI reserved regions as
+MEMBLOCK_NOMAP") updated the mapping logic of both the RuntimeServices
+regions as well as the kernel's copy of the UEFI memory map to set the
+MEMBLOCK_NOMAP flag, which causes these regions to be omitted from the
+kernel direct mapping, and from being covered by a struct page.
+For the RuntimeServices regions, this is an obvious win, since the contents
+of these regions have significance to the firmware executable code itself,
+and are mapped in the EFI page tables using attributes that are described in
+the UEFI memory map, and which may differ from the attributes we use for
+mapping system RAM. It also prevents the contents from being modified
+inadvertently, since the EFI page tables are only live during runtime
+service invocations.
+
+None of these concerns apply to the allocation that covers the UEFI memory
+map, since it is entirely owned by the kernel. Setting the MEMBLOCK_NOMAP on
+the region did allow us to use ioremap_cache() to map it both on arm64 and
+on ARM, since the latter does not allow ioremap_cache() to be used on
+regions that are covered by a struct page.
+
+The ioremap_cache() on ARM restriction will be lifted in the v4.7 timeframe,
+but in the mean time, it has been reported that commit 4dffbfc48d65 causes
+a regression on 64k granule kernels. This is due to the fact that, given
+the 64 KB page size, the region that we end up removing from the kernel
+direct mapping is rounded up to 64 KB, and this 64 KB page frame may be
+shared with the initrd when booting via GRUB (which does not align its
+EFI_LOADER_DATA allocations to 64 KB like the stub does). This will crash
+the kernel as soon as it tries to access the initrd.
+
+Since the issue is specific to arm64, revert back to memblock_reserve()'ing
+the UEFI memory map when running on arm64. This is a temporary fix for v4.5
+and v4.6, and will be superseded in the v4.7 timeframe when we will be able
+to move back to memblock_reserve() unconditionally.
+
+Fixes: 4dffbfc48d65 ("arm64/efi: mark UEFI reserved regions as MEMBLOCK_NOMAP")
+Reported-by: Mark Salter <msalter@redhat.com>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+
+---
+drivers/firmware/efi/arm-init.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/firmware/efi/arm-init.c b/drivers/firmware/efi/arm-init.c
+index aa1f743152a2..8714f8c271ba 100644
+--- a/drivers/firmware/efi/arm-init.c
++++ b/drivers/firmware/efi/arm-init.c
+@@ -203,7 +203,19 @@ void __init efi_init(void)
+ 
+ 	reserve_regions();
+ 	early_memunmap(memmap.map, params.mmap_size);
+-	memblock_mark_nomap(params.mmap & PAGE_MASK,
+-			    PAGE_ALIGN(params.mmap_size +
+-				       (params.mmap & ~PAGE_MASK)));
++
++	if (IS_ENABLED(CONFIG_ARM)) {
++		/*
++		 * ARM currently does not allow ioremap_cache() to be called on
++		 * memory regions that are covered by struct page. So remove the
++		 * UEFI memory map from the linear mapping.
++		 */
++		memblock_mark_nomap(params.mmap & PAGE_MASK,
++				    PAGE_ALIGN(params.mmap_size +
++					       (params.mmap & ~PAGE_MASK)));
++	} else {
++		memblock_reserve(params.mmap & PAGE_MASK,
++				 PAGE_ALIGN(params.mmap_size +
++					    (params.mmap & ~PAGE_MASK)));
++	}
+ }
diff --git a/freed-ora/current/f24/input-gtco-fix-crash-on-detecting-device-without-end.patch b/freed-ora/current/f24/input-gtco-fix-crash-on-detecting-device-without-end.patch
new file mode 100644
index 000000000..849f607a5
--- /dev/null
+++ b/freed-ora/current/f24/input-gtco-fix-crash-on-detecting-device-without-end.patch
@@ -0,0 +1,49 @@
+Subject:    [PATCH] Input: gtco: fix crash on detecting device without endpoints
+From:       Vladis Dronov <vdronov@redhat.com>
+Date:       2016-03-18 18:35:00
+
+The gtco driver expects at least one valid endpoint. If given
+malicious descriptors that specify 0 for the number of endpoints,
+it will crash in the probe function. Ensure there is at least
+one endpoint on the interface before using it. Fix minor coding
+style issue.
+
+The full report of this issue can be found here:
+http://seclists.org/bugtraq/2016/Mar/86
+
+Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
+Signed-off-by: Vladis Dronov <vdronov@redhat.com>
+---
+ drivers/input/tablet/gtco.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c
+index 3a7f3a4..7c18249 100644
+--- a/drivers/input/tablet/gtco.c
++++ b/drivers/input/tablet/gtco.c
+@@ -858,6 +858,14 @@ static int gtco_probe(struct usb_interface *usbinterface,
+ 		goto err_free_buf;
+ 	}
+ 
++	/* Sanity check that a device has an endpoint */
++	if (usbinterface->altsetting[0].desc.bNumEndpoints < 1) {
++		dev_err(&usbinterface->dev,
++			"Invalid number of endpoints\n");
++		error = -EINVAL;
++		goto err_free_urb;
++	}
++
+ 	/*
+ 	 * The endpoint is always altsetting 0, we know this since we know
+ 	 * this device only has one interrupt endpoint
+@@ -879,7 +887,7 @@ static int gtco_probe(struct usb_interface *usbinterface,
+ 	 * HID report descriptor
+ 	 */
+ 	if (usb_get_extra_descriptor(usbinterface->cur_altsetting,
+-				     HID_DEVICE_TYPE, &hid_desc) != 0){
++				     HID_DEVICE_TYPE, &hid_desc) != 0) {
+ 		dev_err(&usbinterface->dev,
+ 			"Can't retrieve exta USB descriptor to get hid report descriptor length\n");
+ 		error = -EIO;
+-- 
+2.5.0
diff --git a/freed-ora/current/f24/kernel.spec b/freed-ora/current/f24/kernel.spec
index 5a88d1210..9585dde49 100644
--- a/freed-ora/current/f24/kernel.spec
+++ b/freed-ora/current/f24/kernel.spec
@@ -42,7 +42,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be appended after the rcX and
 # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
 #
-%global baserelease 301
+%global baserelease 302
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -545,33 +545,44 @@ Patch07: freedo.patch
 
 # Standalone patches
 
-# http://www.spinics.net/lists/netdev/msg369442.html
-Patch452: revert-stmmac-Fix-eth0-No-PHY-found-regression.patch
-Patch453: stmmac-fix-MDIO-settings.patch
+Patch420: arm64-avoid-needing-console-to-enable-serial-console.patch
+
+Patch421: arm64-acpi-drop-expert-patch.patch
 
-Patch454: bcm283x-add-aux-uart-support-extra-DT-bits-initial-r.patch
+# http://www.spinics.net/lists/arm-kernel/msg490981.html
+Patch422: geekbox-v4-device-tree-support.patch
 
-Patch455: arm64-avoid-needing-console-to-enable-serial-console.patch
+# http://www.spinics.net/lists/arm-kernel/msg483898.html
+Patch423: Initial-AllWinner-A64-and-PINE64-support.patch
 
-Patch456: arm64-acpi-drop-expert-patch.patch
+# http://www.spinics.net/lists/arm-kernel/msg493431.html
+Patch424: efi-arm64-don-t-apply-MEMBLOCK_NOMAP-to-UEFI-memory-map-mapping.patch
 
 # http://patchwork.ozlabs.org/patch/587554/
-Patch457: ARM-tegra-usb-no-reset.patch
+Patch430: ARM-tegra-usb-no-reset.patch
 
-Patch458: ARM-mvebu-change-order-of-ethernet-DT-nodes-on-Armada-38x.patch
+Patch431: arm-i.MX6-Utilite-device-dtb.patch
 
-# http://www.spinics.net/lists/arm-kernel/msg490981.html
-Patch459: geekbox-v4-device-tree-support.patch
+# http://www.spinics.net/lists/linux-tegra/msg25152.html
+Patch432: Fix-tegra-to-use-stdout-path-for-serial-console.patch
 
-# http://www.spinics.net/lists/arm-kernel/msg483898.html
-Patch460: Initial-AllWinner-A64-and-PINE64-support.patch
+Patch433: bcm283x-Pull-upstream-fixes.patch
 
-# http://www.spinics.net/lists/linux-tegra/msg25152.html
-Patch461: Fix-tegra-to-use-stdout-path-for-serial-console.patch
+# http://www.spinics.net/lists/netdev/msg369442.html
+Patch434: revert-stmmac-Fix-eth0-No-PHY-found-regression.patch
+Patch435: stmmac-fix-MDIO-settings.patch
 
-Patch463: arm-i.MX6-Utilite-device-dtb.patch
+Patch436: ARM-mvebu-change-order-of-ethernet-DT-nodes-on-Armada-38x.patch
 
-Patch465: lib-cpumask-Make-CPUMASK_OFFSTACK-usable-without-deb.patch
+# mvebu usb fixes http://www.spinics.net/lists/arm-kernel/msg493305.html
+Patch437: 0001-ARM-mvebu-Correct-unit-address-for-linksys.patch
+
+# mvebu DSA switch fixes
+# http://www.spinics.net/lists/netdev/msg370841.html http://www.spinics.net/lists/netdev/msg370842.html
+Patch438: 0001-net-dsa-mv88e6xxx-Introduce-_mv88e6xxx_phy_page_-rea.patch
+Patch439: 0002-net-dsa-mv88e6xxx-Clear-the-PDOWN-bit-on-setup.patch
+
+Patch460: lib-cpumask-Make-CPUMASK_OFFSTACK-usable-without-deb.patch
 
 Patch466: input-kill-stupid-messages.patch
 
@@ -694,6 +705,7 @@ Patch674: USB-iowarrior-fix-oops-with-malicious-USB-descriptor.patch
 
 #CVE-2016-2185 rhbz 1317014 1317471
 Patch675: usb_driver_claim_interface-add-sanity-checking.patch
+Patch669: Input-ati_remote2-fix-crashes-on-detecting-device-wi.patch
 
 #CVE-2016-3138 rhbz 1317010 1316204
 Patch676: cdc-acm-more-sanity-checking.patch
@@ -703,6 +715,24 @@ Patch677: digi_acceleport-do-sanity-checking-for-the-number-of.patch
 
 Patch678: ims-pcu-sanity-check-against-missing-interfaces.patch
 
+#rhbz 1315013
+Patch679: 0001-uas-Limit-qdepth-at-the-scsi-host-level.patch
+
+#rhbz 1317190
+Patch680: thermal-fix.patch
+
+#rhbz 1318079
+Patch681: 0001-Input-synaptics-handle-spurious-release-of-trackstic.patch
+
+#CVE-2016-2187 rhbz 1317017 1317010
+Patch686: input-gtco-fix-crash-on-detecting-device-without-end.patch
+
+#CVE-2016-3136 rhbz 1317007 1317010
+Patch687: mct_u232-sanity-checking-in-probe.patch
+
+# CVE-2016-3157 rhbz 1315711 1321948
+Patch688: x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -2322,6 +2352,29 @@ fi
 #
 # 
 %changelog
+* Wed Mar 30 2016 Peter Robinson <pbrobinson@fedoraproject.org> - 4.5.0-302
+- Add upstream mvebu/DSA fixes
+- Minor ARMv7 fixes
+- Boot fix for aarch64 devices with 64K page size requirements (Seattle)
+
+* Tue Mar 29 2016 Josh Boyer <jwboyer@fedoraproject.org>
+- CVE-2016-3157 xen: priv escalation on 64bit PV domains with io port access (rhbz 1315711 1321948)
+
+* Tue Mar 29 2016 Justin M. Forbes <jforbes@fedoraproject.org>
+- Turn off DEBUG_WX (rhbz 1318599)
+
+* Wed Mar 23 2016 Peter Robinson <pbrobinson@fedoraproject.org>
+- Fix Tegra Jetson TK1
+
+* Tue Mar 22 2016 Josh Boyer <jwboyer@fedoraproject.org>
+- CVE-2016-3136 mct_u232: oops on invalid USB descriptors (rhbz 1317007 1317010)
+- CVE-2016-2187 gtco: oops on invalid USB descriptors (rhbz 1317017 1317010)
+
+* Mon Mar 21 2016 Laura Abbott <labbott@fedoraproject.org>
+- uas: Limit qdepth at the scsi-host level (rhbz 1315013)
+- Fix for performance regression caused by thermal (rhbz 1317190)
+- Input: synaptics - handle spurious release of trackstick buttons, again (rhbz 1318079)
+
 * Sat Mar 19 2016 Peter Robinson <pbrobinson@fedoraproject.org> 4.5.0-301
 - Upstream fix for stmmac driver regressions (AllWinner Gb NICs)
 - Update various ARM device support patches
diff --git a/freed-ora/current/f24/mct_u232-sanity-checking-in-probe.patch b/freed-ora/current/f24/mct_u232-sanity-checking-in-probe.patch
new file mode 100644
index 000000000..006faf15f
--- /dev/null
+++ b/freed-ora/current/f24/mct_u232-sanity-checking-in-probe.patch
@@ -0,0 +1,35 @@
+Subject:    [PATCH v2] mct_u232: sanity checking in probe
+From:       Oliver Neukum <oneukum@suse.com>
+Date:       2016-03-21 13:14:37
+
+An attack using the lack of sanity checking in probe
+is known. This patch checks for the existance of a
+second port.
+CVE-2016-3136
+
+Signed-off-by: Oliver Neukum <ONeukum@suse.com>
+CC: stable@vger.kernel.org
+
+v1 - add sanity check for presence of a second port
+v2 - add sanity check for an interrupt endpoint
+---
+ drivers/usb/serial/mct_u232.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
+index 4446b8d..3e64538 100644
+--- a/drivers/usb/serial/mct_u232.c
++++ b/drivers/usb/serial/mct_u232.c
+@@ -378,6 +378,10 @@ static int mct_u232_port_probe(struct usb_serial_port *port)
+ {
+ 	struct mct_u232_private *priv;
+ 
++	/* check first to simplify error handling */
++	if (!port->serial->port[1] || !port->serial->port[1]->interrupt_in_urb)
++		return -ENODEV;
++
+ 	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+ 	if (!priv)
+ 		return -ENOMEM;
+-- 
+2.1.4
diff --git a/freed-ora/current/f24/thermal-fix.patch b/freed-ora/current/f24/thermal-fix.patch
new file mode 100644
index 000000000..bca27cfbe
--- /dev/null
+++ b/freed-ora/current/f24/thermal-fix.patch
@@ -0,0 +1,77 @@
+From 81ad4276b505e987dd8ebbdf63605f92cd172b52 Mon Sep 17 00:00:00 2001
+From: Zhang Rui <rui.zhang@intel.com>
+Date: Fri, 18 Mar 2016 10:03:24 +0800
+Subject: [PATCH] Thermal: Ignore invalid trip points
+
+In some cases, platform thermal driver may report invalid trip points,
+thermal core should not take any action for these trip points.
+
+CC: <stable@vger.kernel.org> #3.18+
+Link: https://bugzilla.redhat.com/show_bug.cgi?id=1317190
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=114551
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+---
+ drivers/thermal/thermal_core.c | 13 ++++++++++++-
+ include/linux/thermal.h        |  2 ++
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
+index a0a8fd1..d4b5465 100644
+--- a/drivers/thermal/thermal_core.c
++++ b/drivers/thermal/thermal_core.c
+@@ -454,6 +454,10 @@ static void handle_thermal_trip(struct thermal_zone_device *tz, int trip)
+ {
+ 	enum thermal_trip_type type;
+ 
++	/* Ignore disabled trip points */
++	if (test_bit(trip, &tz->trips_disabled))
++		return;
++
+ 	tz->ops->get_trip_type(tz, trip, &type);
+ 
+ 	if (type == THERMAL_TRIP_CRITICAL || type == THERMAL_TRIP_HOT)
+@@ -1800,6 +1804,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
+ {
+ 	struct thermal_zone_device *tz;
+ 	enum thermal_trip_type trip_type;
++	int trip_temp;
+ 	int result;
+ 	int count;
+ 	int passive = 0;
+@@ -1871,9 +1876,15 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
+ 		goto unregister;
+ 
+ 	for (count = 0; count < trips; count++) {
+-		tz->ops->get_trip_type(tz, count, &trip_type);
++		if (tz->ops->get_trip_type(tz, count, &trip_type))
++			set_bit(count, &tz->trips_disabled);
+ 		if (trip_type == THERMAL_TRIP_PASSIVE)
+ 			passive = 1;
++		if (tz->ops->get_trip_temp(tz, count, &trip_temp))
++			set_bit(count, &tz->trips_disabled);
++		/* Check for bogus trip points */
++		if (trip_temp == 0)
++			set_bit(count, &tz->trips_disabled);
+ 	}
+ 
+ 	if (!passive) {
+diff --git a/include/linux/thermal.h b/include/linux/thermal.h
+index 9c48199..a55d052 100644
+--- a/include/linux/thermal.h
++++ b/include/linux/thermal.h
+@@ -156,6 +156,7 @@ struct thermal_attr {
+  * @trip_hyst_attrs:	attributes for trip points for sysfs: trip hysteresis
+  * @devdata:	private pointer for device private data
+  * @trips:	number of trip points the thermal zone supports
++ * @trips_disabled;	bitmap for disabled trips
+  * @passive_delay:	number of milliseconds to wait between polls when
+  *			performing passive cooling.
+  * @polling_delay:	number of milliseconds to wait between polls when
+@@ -191,6 +192,7 @@ struct thermal_zone_device {
+ 	struct thermal_attr *trip_hyst_attrs;
+ 	void *devdata;
+ 	int trips;
++	unsigned long trips_disabled;	/* bitmap for disabled trips */
+ 	int passive_delay;
+ 	int polling_delay;
+ 	int temperature;
diff --git a/freed-ora/current/f24/x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch b/freed-ora/current/f24/x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch
new file mode 100644
index 000000000..38f7bfbb0
--- /dev/null
+++ b/freed-ora/current/f24/x86-iopl-64-Properly-context-switch-IOPL-on-Xen-PV.patch
@@ -0,0 +1,96 @@
+From b7a584598aea7ca73140cb87b40319944dd3393f Mon Sep 17 00:00:00 2001
+From: Andy Lutomirski <luto@kernel.org>
+Date: Wed, 16 Mar 2016 14:14:21 -0700
+Subject: [PATCH] x86/iopl/64: Properly context-switch IOPL on Xen PV
+
+On Xen PV, regs->flags doesn't reliably reflect IOPL and the
+exit-to-userspace code doesn't change IOPL.  We need to context
+switch it manually.
+
+I'm doing this without going through paravirt because this is
+specific to Xen PV.  After the dust settles, we can merge this with
+the 32-bit code, tidy up the iopl syscall implementation, and remove
+the set_iopl pvop entirely.
+
+Fixes XSA-171.
+
+Reviewewd-by: Jan Beulich <JBeulich@suse.com>
+Signed-off-by: Andy Lutomirski <luto@kernel.org>
+Cc: Andrew Cooper <andrew.cooper3@citrix.com>
+Cc: Andy Lutomirski <luto@amacapital.net>
+Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Brian Gerst <brgerst@gmail.com>
+Cc: David Vrabel <david.vrabel@citrix.com>
+Cc: Denys Vlasenko <dvlasenk@redhat.com>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Jan Beulich <JBeulich@suse.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: stable@vger.kernel.org
+Link: http://lkml.kernel.org/r/693c3bd7aeb4d3c27c92c622b7d0f554a458173c.1458162709.git.luto@kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+---
+ arch/x86/include/asm/xen/hypervisor.h |  2 ++
+ arch/x86/kernel/process_64.c          | 12 ++++++++++++
+ arch/x86/xen/enlighten.c              |  2 +-
+ 3 files changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h
+index 8b2d4bea9962..39171b3646bb 100644
+--- a/arch/x86/include/asm/xen/hypervisor.h
++++ b/arch/x86/include/asm/xen/hypervisor.h
+@@ -62,4 +62,6 @@ void xen_arch_register_cpu(int num);
+ void xen_arch_unregister_cpu(int num);
+ #endif
+ 
++extern void xen_set_iopl_mask(unsigned mask);
++
+ #endif /* _ASM_X86_XEN_HYPERVISOR_H */
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index b9d99e0f82c4..9f751876066f 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -48,6 +48,7 @@
+ #include <asm/syscalls.h>
+ #include <asm/debugreg.h>
+ #include <asm/switch_to.h>
++#include <asm/xen/hypervisor.h>
+ 
+ asmlinkage extern void ret_from_fork(void);
+ 
+@@ -411,6 +412,17 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
+ 		     task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV))
+ 		__switch_to_xtra(prev_p, next_p, tss);
+ 
++#ifdef CONFIG_XEN
++	/*
++	 * On Xen PV, IOPL bits in pt_regs->flags have no effect, and
++	 * current_pt_regs()->flags may not match the current task's
++	 * intended IOPL.  We need to switch it manually.
++	 */
++	if (unlikely(static_cpu_has(X86_FEATURE_XENPV) &&
++		     prev->iopl != next->iopl))
++		xen_set_iopl_mask(next->iopl);
++#endif
++
+ 	if (static_cpu_has_bug(X86_BUG_SYSRET_SS_ATTRS)) {
+ 		/*
+ 		 * AMD CPUs have a misfeature: SYSRET sets the SS selector but
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index 2c261082eadf..8381fb990c7f 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -961,7 +961,7 @@ static void xen_load_sp0(struct tss_struct *tss,
+ 	tss->x86_tss.sp0 = thread->sp0;
+ }
+ 
+-static void xen_set_iopl_mask(unsigned mask)
++void xen_set_iopl_mask(unsigned mask)
+ {
+ 	struct physdev_set_iopl set_iopl;
+ 
+-- 
+2.5.5
+