kernel: Backport pending appended DTB handling patches

Backport patches from upstream Linux kernel which are making the
kernel stores the appended dtb not in the same resisters as defined in
the UHI specification, use a separate variable on MIPS.

Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
[some modifications]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

7 files changed, 341 insertions, 37 deletions

diff --git a/target/linux/ar71xx/patches-4.4/509-MIPS-ath79-process-board-kernel-option.patch b/target/linux/ar71xx/patches-4.4/509-MIPS-ath79-process-board-kernel-option.patch
index 4e18a0c81f..40bd8522ab 100644
--- a/target/linux/ar71xx/patches-4.4/509-MIPS-ath79-process-board-kernel-option.patch
+++ b/target/linux/ar71xx/patches-4.4/509-MIPS-ath79-process-board-kernel-option.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/ath79/setup.c
 +++ b/arch/mips/ath79/setup.c
-@@ -251,6 +251,8 @@ void __init plat_time_init(void)
+@@ -253,6 +253,8 @@ void __init plat_time_init(void)
  	mips_hpt_frequency = cpu_clk_rate / 2;
  }
  
diff --git a/target/linux/brcm63xx/patches-4.4/367-MIPS-BCM63XX-add-support-for-loading-DTB.patch b/target/linux/brcm63xx/patches-4.4/367-MIPS-BCM63XX-add-support-for-loading-DTB.patch
index 64c8c33f80..9c93eaa1ba 100644
--- a/target/linux/brcm63xx/patches-4.4/367-MIPS-BCM63XX-add-support-for-loading-DTB.patch
+++ b/target/linux/brcm63xx/patches-4.4/367-MIPS-BCM63XX-add-support-for-loading-DTB.patch
@@ -110,8 +110,8 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	u32 reg, mask;
  
 +#if CONFIG_OF
-+	if (fw_arg0 == -2)
-+		early_init_dt_verify((void *)fw_arg1);
++	if (fw_passed_dtb)
++		early_init_dt_verify((void *)fw_passed_dtb);
 +#endif
 +
  	bcm63xx_cpu_init();
diff --git a/target/linux/generic/patches-4.4/092-MIPS-ZBOOT-copy-appended-dtb-to-the-end-of-the-kerne.patch b/target/linux/generic/patches-4.4/092-MIPS-ZBOOT-copy-appended-dtb-to-the-end-of-the-kerne.patch
new file mode 100644
index 0000000000..71df42992b
--- /dev/null
+++ b/target/linux/generic/patches-4.4/092-MIPS-ZBOOT-copy-appended-dtb-to-the-end-of-the-kerne.patch
@@ -0,0 +1,132 @@
+From b8f54f2cde788623f41d11327688c75aed34092f Mon Sep 17 00:00:00 2001
+From: Jonas Gorski <jogo@openwrt.org>
+Date: Mon, 20 Jun 2016 11:27:36 +0200
+Subject: [PATCH 1/2] MIPS: ZBOOT: copy appended dtb to the end of the kernel
+
+Instead of rewriting the arguments, just move the appended dtb to where
+the decompressed kernel expects it. This eliminates the need for special
+casing vmlinuz.bin appended dtb files.
+
+Signed-off-by: Jonas Gorski <jogo@openwrt.org>
+Cc: Kevin Cernekee <cernekee@gmail.com>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: John Crispin <john@phrozen.org>
+Cc: Paul Burton <paul.burton@imgtec.com>
+Cc: James Hogan <james.hogan@imgtec.com>
+Cc: Alban Bedel <albeu@free.fr>
+Cc: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
+Cc: Antony Pavlov <antonynpavlov@gmail.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/13698/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/Kconfig                      | 22 ++--------------------
+ arch/mips/boot/compressed/decompress.c | 17 +++++++++++++++++
+ arch/mips/boot/compressed/head.S       | 16 ----------------
+ 3 files changed, 19 insertions(+), 36 deletions(-)
+
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -2752,10 +2752,10 @@ choice
+ 		  the documented boot protocol using a device tree.
+ 
+ 	config MIPS_RAW_APPENDED_DTB
+-		bool "vmlinux.bin"
++		bool "vmlinux.bin or vmlinuz.bin"
+ 		help
+ 		  With this option, the boot code will look for a device tree binary
+-		  DTB) appended to raw vmlinux.bin (without decompressor).
++		  DTB) appended to raw vmlinux.bin or vmlinuz.bin.
+ 		  (e.g. cat vmlinux.bin <filename>.dtb > vmlinux_w_dtb).
+ 
+ 		  This is meant as a backward compatibility convenience for those
+@@ -2767,24 +2767,6 @@ choice
+ 		  look like a DTB header after a reboot if no actual DTB is appended
+ 		  to vmlinux.bin.  Do not leave this option active in a production kernel
+ 		  if you don't intend to always append a DTB.
+-
+-	config MIPS_ZBOOT_APPENDED_DTB
+-		bool "vmlinuz.bin"
+-		depends on SYS_SUPPORTS_ZBOOT
+-		help
+-		  With this option, the boot code will look for a device tree binary
+-		  DTB) appended to raw vmlinuz.bin (with decompressor).
+-		  (e.g. cat vmlinuz.bin <filename>.dtb > vmlinuz_w_dtb).
+-
+-		  This is meant as a backward compatibility convenience for those
+-		  systems with a bootloader that can't be upgraded to accommodate
+-		  the documented boot protocol using a device tree.
+-
+-		  Beware that there is very little in terms of protection against
+-		  this option being confused by leftover garbage in memory that might
+-		  look like a DTB header after a reboot if no actual DTB is appended
+-		  to vmlinuz.bin.  Do not leave this option active in a production kernel
+-		  if you don't intend to always append a DTB.
+ endchoice
+ 
+ choice
+--- a/arch/mips/boot/compressed/decompress.c
++++ b/arch/mips/boot/compressed/decompress.c
+@@ -14,6 +14,7 @@
+ #include <linux/types.h>
+ #include <linux/kernel.h>
+ #include <linux/string.h>
++#include <linux/libfdt.h>
+ 
+ #include <asm/addrspace.h>
+ 
+@@ -36,6 +37,8 @@ extern void puthex(unsigned long long va
+ #define puthex(val) do {} while (0)
+ #endif
+ 
++extern char __appended_dtb[];
++
+ void error(char *x)
+ {
+ 	puts("\n\n");
+@@ -114,6 +117,20 @@ void decompress_kernel(unsigned long boo
+ 	__decompress((char *)zimage_start, zimage_size, 0, 0,
+ 		   (void *)VMLINUX_LOAD_ADDRESS_ULL, 0, 0, error);
+ 
++	if (IS_ENABLED(CONFIG_MIPS_RAW_APPENDED_DTB) &&
++	    fdt_magic((void *)&__appended_dtb) == FDT_MAGIC) {
++		unsigned int image_size, dtb_size;
++
++		dtb_size = fdt_totalsize((void *)&__appended_dtb);
++
++		/* last four bytes is always image size in little endian */
++		image_size = le32_to_cpup((void *)&__image_end - 4);
++
++		/* copy dtb to where the booted kernel will expect it */
++		memcpy((void *)VMLINUX_LOAD_ADDRESS_ULL + image_size,
++		       __appended_dtb, dtb_size);
++	}
++
+ 	/* FIXME: should we flush cache here? */
+ 	puts("Now, booting the kernel...\n");
+ }
+--- a/arch/mips/boot/compressed/head.S
++++ b/arch/mips/boot/compressed/head.S
+@@ -25,22 +25,6 @@ start:
+ 	move	s2, a2
+ 	move	s3, a3
+ 
+-#ifdef CONFIG_MIPS_ZBOOT_APPENDED_DTB
+-	PTR_LA	t0, __appended_dtb
+-#ifdef CONFIG_CPU_BIG_ENDIAN
+-	li	t1, 0xd00dfeed
+-#else
+-	li	t1, 0xedfe0dd0
+-#endif
+-	lw	t2, (t0)
+-	bne	t1, t2, not_found
+-	 nop
+-
+-	move	s1, t0
+-	PTR_LI	s0, -2
+-not_found:
+-#endif
+-
+ 	/* Clear BSS */
+ 	PTR_LA	a0, _edata
+ 	PTR_LA	a2, _end
diff --git a/target/linux/generic/patches-4.4/093-MIPS-store-the-appended-dtb-address-in-a-variable.patch b/target/linux/generic/patches-4.4/093-MIPS-store-the-appended-dtb-address-in-a-variable.patch
new file mode 100644
index 0000000000..764c1cb830
--- /dev/null
+++ b/target/linux/generic/patches-4.4/093-MIPS-store-the-appended-dtb-address-in-a-variable.patch
@@ -0,0 +1,132 @@
+From 15f37e1588920e010f20b53f04af94e91b8ee714 Mon Sep 17 00:00:00 2001
+From: Jonas Gorski <jogo@openwrt.org>
+Date: Mon, 20 Jun 2016 11:27:37 +0200
+Subject: [PATCH] MIPS: store the appended dtb address in a variable
+
+Instead of rewriting the arguments to match the UHI spec, store the
+address of a appended or UHI supplied dtb in fw_supplied_dtb.
+
+That way the original bootloader arugments are kept intact while still
+making the use of an appended dtb invisible for mach code.
+
+Mach code can still find out if it is an appended dtb by comparing
+fw_arg1 with fw_supplied_dtb.
+
+Signed-off-by: Jonas Gorski <jogo@openwrt.org>
+Cc: Kevin Cernekee <cernekee@gmail.com>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: John Crispin <john@phrozen.org>
+Cc: Paul Burton <paul.burton@imgtec.com>
+Cc: James Hogan <james.hogan@imgtec.com>
+Cc: Alban Bedel <albeu@free.fr>
+Cc: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
+Cc: Antony Pavlov <antonynpavlov@gmail.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/13699/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/ath79/setup.c          |  4 ++--
+ arch/mips/bmips/setup.c          |  4 ++--
+ arch/mips/include/asm/bootinfo.h |  4 ++++
+ arch/mips/kernel/head.S          | 21 ++++++++++++++-------
+ arch/mips/kernel/setup.c         |  4 ++++
+ arch/mips/lantiq/prom.c          |  4 ++--
+ arch/mips/pic32/pic32mzda/init.c |  4 ++--
+ 7 files changed, 30 insertions(+), 15 deletions(-)
+
+--- a/arch/mips/ath79/setup.c
++++ b/arch/mips/ath79/setup.c
+@@ -207,6 +207,8 @@ void __init plat_mem_setup(void)
+ 	fdt_start = fw_getenvl("fdt_start");
+ 	if (fdt_start)
+ 		__dt_setup_arch((void *)KSEG0ADDR(fdt_start));
++	else if (fw_passed_dtb)
++		__dt_setup_arch((void *)KSEG0ADDR(fw_passed_dtb));
+ #ifdef CONFIG_BUILTIN_DTB
+ 	else
+ 		__dt_setup_arch(__dtb_start);
+--- a/arch/mips/bmips/setup.c
++++ b/arch/mips/bmips/setup.c
+@@ -149,8 +149,8 @@ void __init plat_mem_setup(void)
+ 	/* intended to somewhat resemble ARM; see Documentation/arm/Booting */
+ 	if (fw_arg0 == 0 && fw_arg1 == 0xffffffff)
+ 		dtb = phys_to_virt(fw_arg2);
+-	else if (fw_arg0 == -2) /* UHI interface */
+-		dtb = (void *)fw_arg1;
++	else if (fw_passed_dtb) /* UHI interface */
++		dtb = (void *)fw_passed_dtb;
+ 	else if (__dtb_start != __dtb_end)
+ 		dtb = (void *)__dtb_start;
+ 	else
+--- a/arch/mips/include/asm/bootinfo.h
++++ b/arch/mips/include/asm/bootinfo.h
+@@ -127,6 +127,10 @@ extern char arcs_cmdline[COMMAND_LINE_SI
+  */
+ extern unsigned long fw_arg0, fw_arg1, fw_arg2, fw_arg3;
+ 
++#ifdef CONFIG_USE_OF
++extern unsigned long fw_passed_dtb;
++#endif
++
+ /*
+  * Platform memory detection hook called by setup_arch
+  */
+--- a/arch/mips/kernel/head.S
++++ b/arch/mips/kernel/head.S
+@@ -94,21 +94,24 @@ NESTED(kernel_entry, 16, sp)			# kernel
+ 	jr	t0
+ 0:
+ 
++#ifdef CONFIG_USE_OF
+ #ifdef CONFIG_MIPS_RAW_APPENDED_DTB
+-	PTR_LA		t0, __appended_dtb
++	PTR_LA		t2, __appended_dtb
+ 
+ #ifdef CONFIG_CPU_BIG_ENDIAN
+ 	li		t1, 0xd00dfeed
+ #else
+ 	li		t1, 0xedfe0dd0
+ #endif
+-	lw		t2, (t0)
+-	bne		t1, t2, not_found
+-	 nop
+-
+-	move		a1, t0
+-	PTR_LI		a0, -2
+-not_found:
++	lw		t0, (t2)
++	beq		t0, t1, dtb_found
++#endif
++	li		t1, -2
++	beq		a0, t1, dtb_found
++	move		t2, a1
++
++	li		t2, 0
++dtb_found:
+ #endif
+ 	PTR_LA		t0, __bss_start		# clear .bss
+ 	LONG_S		zero, (t0)
+@@ -123,6 +126,10 @@ not_found:
+ 	LONG_S		a2, fw_arg2
+ 	LONG_S		a3, fw_arg3
+ 
++#ifdef CONFIG_USE_OF
++	LONG_S		t2, fw_passed_dtb
++#endif
++
+ 	MTC0		zero, CP0_CONTEXT	# clear context register
+ 	PTR_LA		$28, init_thread_union
+ 	/* Set the SP after an empty pt_regs.  */
+--- a/arch/mips/kernel/setup.c
++++ b/arch/mips/kernel/setup.c
+@@ -814,6 +814,10 @@ void __init setup_arch(char **cmdline_p)
+ unsigned long kernelsp[NR_CPUS];
+ unsigned long fw_arg0, fw_arg1, fw_arg2, fw_arg3;
+ 
++#ifdef CONFIG_USE_OF
++unsigned long fw_passed_dtb;
++#endif
++
+ #ifdef CONFIG_DEBUG_FS
+ struct dentry *mips_debugfs_dir;
+ static int __init debugfs_mips(void)
diff --git a/target/linux/generic/patches-4.4/160-usb-gadget-udc-net2280-add-usb2380-support.patch b/target/linux/generic/patches-4.4/160-usb-gadget-udc-net2280-add-usb2380-support.patch
index edb8fcf705..c03280149e 100644
--- a/target/linux/generic/patches-4.4/160-usb-gadget-udc-net2280-add-usb2380-support.patch
+++ b/target/linux/generic/patches-4.4/160-usb-gadget-udc-net2280-add-usb2380-support.patch
@@ -18,11 +18,9 @@ Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
  drivers/usb/gadget/udc/net2280.h |  1 +
  3 files changed, 34 insertions(+), 22 deletions(-)
 
-diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
-index 7c28941..658b8da 100644
 --- a/drivers/usb/gadget/udc/Kconfig
 +++ b/drivers/usb/gadget/udc/Kconfig
-@@ -312,7 +312,7 @@ config USB_NET2272_DMA
+@@ -298,7 +298,7 @@ config USB_NET2272_DMA
  	  If unsure, say "N" here.  The driver works fine in PIO mode.
  
  config USB_NET2280
@@ -31,7 +29,7 @@ index 7c28941..658b8da 100644
  	depends on PCI
  	help
  	   NetChip 2280 / 2282 is a PCI based USB peripheral controller which
-@@ -322,6 +322,8 @@ config USB_NET2280
+@@ -308,6 +308,8 @@ config USB_NET2280
  	   (for control transfers) and several endpoints with dedicated
  	   functions.
  
@@ -40,11 +38,9 @@ index 7c28941..658b8da 100644
  	   PLX 3380 / 3382 is a PCIe based USB peripheral controller which
  	   supports full, high speed USB 2.0 and super speed USB 3.0
  	   data transfers.
-diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c
-index c894b94..614ab951 100644
 --- a/drivers/usb/gadget/udc/net2280.c
 +++ b/drivers/usb/gadget/udc/net2280.c
-@@ -211,7 +211,7 @@ net2280_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
+@@ -211,7 +211,7 @@ net2280_enable(struct usb_ep *_ep, const
  		goto print_err;
  	}
  
@@ -53,7 +49,7 @@ index c894b94..614ab951 100644
  		if ((desc->bEndpointAddress & 0x0f) >= 0x0c) {
  			ret = -EDOM;
  			goto print_err;
-@@ -245,7 +245,7 @@ net2280_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
+@@ -245,7 +245,7 @@ net2280_enable(struct usb_ep *_ep, const
  	/* set type, direction, address; reset fifo counters */
  	writel(BIT(FIFO_FLUSH), &ep->regs->ep_stat);
  
@@ -62,7 +58,7 @@ index c894b94..614ab951 100644
  		tmp = readl(&ep->cfg->ep_cfg);
  		/* If USB ep number doesn't match hardware ep number */
  		if ((tmp & 0xf) != usb_endpoint_num(desc)) {
-@@ -316,7 +316,7 @@ net2280_enable(struct usb_ep *_ep, const struct usb_endpoint_descriptor *desc)
+@@ -316,7 +316,7 @@ net2280_enable(struct usb_ep *_ep, const
  			BIT(CLEAR_NAK_OUT_PACKETS_MODE), &ep->regs->ep_rsp);
  	}
  
@@ -71,7 +67,7 @@ index c894b94..614ab951 100644
  		ep_clear_seqnum(ep);
  	writel(tmp, &ep->cfg->ep_cfg);
  
-@@ -527,7 +527,7 @@ static int net2280_disable(struct usb_ep *_ep)
+@@ -527,7 +527,7 @@ static int net2280_disable(struct usb_ep
  	spin_lock_irqsave(&ep->dev->lock, flags);
  	nuke(ep);
  
@@ -80,7 +76,7 @@ index c894b94..614ab951 100644
  		ep_reset_338x(ep->dev->regs, ep);
  	else
  		ep_reset_228x(ep->dev->regs, ep);
-@@ -862,7 +862,7 @@ static void start_queue(struct net2280_ep *ep, u32 dmactl, u32 td_dma)
+@@ -862,7 +862,7 @@ static void start_queue(struct net2280_e
  	writel(readl(&dma->dmastat), &dma->dmastat);
  
  	writel(td_dma, &dma->dmadesc);
@@ -89,7 +85,7 @@ index c894b94..614ab951 100644
  		dmactl |= BIT(DMA_REQUEST_OUTSTANDING);
  	writel(dmactl, &dma->dmactl);
  
-@@ -1046,7 +1046,7 @@ net2280_queue(struct usb_ep *_ep, struct usb_request *_req, gfp_t gfp_flags)
+@@ -1046,7 +1046,7 @@ net2280_queue(struct usb_ep *_ep, struct
  
  	/* kickstart this i/o queue? */
  	if  (list_empty(&ep->queue) && !ep->stopped &&
@@ -98,7 +94,7 @@ index c894b94..614ab951 100644
  		  (readl(&ep->regs->ep_rsp) & BIT(CLEAR_ENDPOINT_HALT)))) {
  
  		/* use DMA if the endpoint supports it, else pio */
-@@ -1169,7 +1169,7 @@ static void scan_dma_completions(struct net2280_ep *ep)
+@@ -1169,7 +1169,7 @@ static void scan_dma_completions(struct
  			break;
  		} else if (!ep->is_in &&
  			   (req->req.length % ep->ep.maxpacket) &&
@@ -107,7 +103,7 @@ index c894b94..614ab951 100644
  
  			tmp = readl(&ep->regs->ep_stat);
  			/* AVOID TROUBLE HERE by not issuing short reads from
-@@ -1367,7 +1367,7 @@ net2280_set_halt_and_wedge(struct usb_ep *_ep, int value, int wedged)
+@@ -1367,7 +1367,7 @@ net2280_set_halt_and_wedge(struct usb_ep
  				ep->wedged = 1;
  		} else {
  			clear_halt(ep);
@@ -116,7 +112,7 @@ index c894b94..614ab951 100644
  				!list_empty(&ep->queue) && ep->td_dma)
  					restart_dma(ep);
  			ep->wedged = 0;
-@@ -2394,7 +2394,7 @@ static int net2280_start(struct usb_gadget *_gadget,
+@@ -2394,7 +2394,7 @@ static int net2280_start(struct usb_gadg
  	 */
  	net2280_led_active(dev, 1);
  
@@ -125,7 +121,7 @@ index c894b94..614ab951 100644
  		defect7374_enable_data_eps_zero(dev);
  
  	ep0_start(dev);
-@@ -3063,7 +3063,7 @@ static void handle_stat0_irqs(struct net2280 *dev, u32 stat)
+@@ -3063,7 +3063,7 @@ static void handle_stat0_irqs(struct net
  		}
  		ep->stopped = 0;
  		dev->protocol_stall = 0;
@@ -134,7 +130,7 @@ index c894b94..614ab951 100644
  			if (ep->dev->quirks & PLX_2280)
  				tmp = BIT(FIFO_OVERFLOW) |
  				    BIT(FIFO_UNDERFLOW);
-@@ -3090,7 +3090,7 @@ static void handle_stat0_irqs(struct net2280 *dev, u32 stat)
+@@ -3090,7 +3090,7 @@ static void handle_stat0_irqs(struct net
  		cpu_to_le32s(&u.raw[0]);
  		cpu_to_le32s(&u.raw[1]);
  
@@ -143,7 +139,7 @@ index c894b94..614ab951 100644
  			defect7374_workaround(dev, u.r);
  
  		tmp = 0;
-@@ -3173,7 +3173,7 @@ static void handle_stat0_irqs(struct net2280 *dev, u32 stat)
+@@ -3173,7 +3173,7 @@ static void handle_stat0_irqs(struct net
  			} else {
  				ep_vdbg(dev, "%s clear halt\n", e->ep.name);
  				clear_halt(e);
@@ -152,7 +148,7 @@ index c894b94..614ab951 100644
  					!list_empty(&e->queue) && e->td_dma)
  						restart_dma(e);
  			}
-@@ -3195,7 +3195,7 @@ static void handle_stat0_irqs(struct net2280 *dev, u32 stat)
+@@ -3195,7 +3195,7 @@ static void handle_stat0_irqs(struct net
  			if (e->ep.name == ep0name)
  				goto do_stall;
  			set_halt(e);
@@ -179,7 +175,7 @@ index c894b94..614ab951 100644
  			u32 r_dmacount = readl(&dma->dmacount);
  			if (!ep->is_in &&  (r_dmacount & 0x00FFFFFF) &&
  			    (tmp & BIT(DMA_TRANSACTION_DONE_INTERRUPT)))
-@@ -3468,7 +3468,7 @@ static irqreturn_t net2280_irq(int irq, void *_dev)
+@@ -3468,7 +3468,7 @@ static irqreturn_t net2280_irq(int irq,
  	/* control requests and PIO */
  	handle_stat0_irqs(dev, readl(&dev->regs->irqstat0));
  
@@ -188,7 +184,7 @@ index c894b94..614ab951 100644
  		/* re-enable interrupt to trigger any possible new interrupt */
  		u32 pciirqenb1 = readl(&dev->regs->pciirqenb1);
  		writel(pciirqenb1 & 0x7FFFFFFF, &dev->regs->pciirqenb1);
-@@ -3513,7 +3513,7 @@ static void net2280_remove(struct pci_dev *pdev)
+@@ -3513,7 +3513,7 @@ static void net2280_remove(struct pci_de
  	}
  	if (dev->got_irq)
  		free_irq(pdev->irq, dev);
@@ -197,7 +193,7 @@ index c894b94..614ab951 100644
  		pci_disable_msi(pdev);
  	if (dev->regs)
  		iounmap(dev->regs);
-@@ -3593,7 +3593,7 @@ static int net2280_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+@@ -3593,7 +3593,7 @@ static int net2280_probe(struct pci_dev
  	dev->dep = (struct net2280_dep_regs __iomem *) (base + 0x0200);
  	dev->epregs = (struct net2280_ep_regs __iomem *) (base + 0x0300);
  
@@ -206,7 +202,7 @@ index c894b94..614ab951 100644
  		u32 fsmvalue;
  		u32 usbstat;
  		dev->usb_ext = (struct usb338x_usb_ext_regs __iomem *)
-@@ -3637,7 +3637,7 @@ static int net2280_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+@@ -3637,7 +3637,7 @@ static int net2280_probe(struct pci_dev
  		goto done;
  	}
  
@@ -215,8 +211,8 @@ index c894b94..614ab951 100644
  		if (pci_enable_msi(pdev))
  			ep_err(dev, "Failed to enable MSI mode\n");
  
-@@ -3755,10 +3755,19 @@ static const struct pci_device_id pci_ids[] = { {
- 	.class =	PCI_CLASS_SERIAL_USB_DEVICE,
+@@ -3755,10 +3755,19 @@ static const struct pci_device_id pci_id
+ 	.class =	((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
  	.class_mask =	~0,
  	.vendor =	PCI_VENDOR_ID_PLX,
 +	.device =	0x2380,
@@ -235,8 +231,8 @@ index c894b94..614ab951 100644
 +	.driver_data =	PLX_PCIE | PLX_SUPERSPEED,
  	 },
  	{
- 	.class =	PCI_CLASS_SERIAL_USB_DEVICE,
-@@ -3767,7 +3776,7 @@ static const struct pci_device_id pci_ids[] = { {
+ 	.class =	((PCI_CLASS_SERIAL_USB << 8) | 0xfe),
+@@ -3767,7 +3776,7 @@ static const struct pci_device_id pci_id
  	.device =	0x3382,
  	.subvendor =	PCI_ANY_ID,
  	.subdevice =	PCI_ANY_ID,
@@ -245,11 +241,9 @@ index c894b94..614ab951 100644
  	 },
  { /* end: all zeroes */ }
  };
-diff --git a/drivers/usb/gadget/udc/net2280.h b/drivers/usb/gadget/udc/net2280.h
-index 0d32052..2736a95 100644
 --- a/drivers/usb/gadget/udc/net2280.h
 +++ b/drivers/usb/gadget/udc/net2280.h
-@@ -47,6 +47,7 @@ set_idx_reg(struct net2280_regs __iomem *regs, u32 index, u32 value)
+@@ -47,6 +47,7 @@ set_idx_reg(struct net2280_regs __iomem
  #define PLX_LEGACY		BIT(0)
  #define PLX_2280		BIT(1)
  #define PLX_SUPERSPEED		BIT(2)
@@ -257,6 +251,3 @@ index 0d32052..2736a95 100644
  
  #define REG_DIAG		0x0
  #define     RETRY_COUNTER                                       16
--- 
-1.9.1
-
diff --git a/target/linux/generic/patches-4.4/300-mips_expose_boot_raw.patch b/target/linux/generic/patches-4.4/300-mips_expose_boot_raw.patch
index cd7d28a2c9..76c70782a9 100644
--- a/target/linux/generic/patches-4.4/300-mips_expose_boot_raw.patch
+++ b/target/linux/generic/patches-4.4/300-mips_expose_boot_raw.patch
@@ -18,7 +18,7 @@ Acked-by: Rob Landley <rob@landley.net>
  config CEVT_BCM1480
  	bool
  
-@@ -2810,6 +2807,18 @@ choice
+@@ -2792,6 +2789,18 @@ choice
  		bool "Bootloader kernel arguments if available"
  endchoice
  
diff --git a/target/linux/lantiq/patches-4.4/122-MIPS-store-the-appended-dtb-address-in-a-variable.patch b/target/linux/lantiq/patches-4.4/122-MIPS-store-the-appended-dtb-address-in-a-variable.patch
new file mode 100644
index 0000000000..a6641bf723
--- /dev/null
+++ b/target/linux/lantiq/patches-4.4/122-MIPS-store-the-appended-dtb-address-in-a-variable.patch
@@ -0,0 +1,49 @@
+From 15f37e1588920e010f20b53f04af94e91b8ee714 Mon Sep 17 00:00:00 2001
+From: Jonas Gorski <jogo@openwrt.org>
+Date: Mon, 20 Jun 2016 11:27:37 +0200
+Subject: [PATCH] MIPS: store the appended dtb address in a variable
+
+Instead of rewriting the arguments to match the UHI spec, store the
+address of a appended or UHI supplied dtb in fw_supplied_dtb.
+
+That way the original bootloader arugments are kept intact while still
+making the use of an appended dtb invisible for mach code.
+
+Mach code can still find out if it is an appended dtb by comparing
+fw_arg1 with fw_supplied_dtb.
+
+Signed-off-by: Jonas Gorski <jogo@openwrt.org>
+Cc: Kevin Cernekee <cernekee@gmail.com>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: John Crispin <john@phrozen.org>
+Cc: Paul Burton <paul.burton@imgtec.com>
+Cc: James Hogan <james.hogan@imgtec.com>
+Cc: Alban Bedel <albeu@free.fr>
+Cc: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
+Cc: Antony Pavlov <antonynpavlov@gmail.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/13699/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/ath79/setup.c          |  4 ++--
+ arch/mips/bmips/setup.c          |  4 ++--
+ arch/mips/include/asm/bootinfo.h |  4 ++++
+ arch/mips/kernel/head.S          | 21 ++++++++++++++-------
+ arch/mips/kernel/setup.c         |  4 ++++
+ arch/mips/lantiq/prom.c          |  4 ++--
+ arch/mips/pic32/pic32mzda/init.c |  4 ++--
+ 7 files changed, 30 insertions(+), 15 deletions(-)
+
+--- a/arch/mips/lantiq/prom.c
++++ b/arch/mips/lantiq/prom.c
+@@ -74,8 +74,8 @@ void __init plat_mem_setup(void)
+ 
+ 	set_io_port_base((unsigned long) KSEG1);
+ 
+-	if (fw_arg0 == -2) /* UHI interface */
+-		dtb = (void *)fw_arg1;
++	if (fw_passed_dtb) /* UHI interface */
++		dtb = (void *)fw_passed_dtb;
+ 	else if (__dtb_start != __dtb_end)
+ 		dtb = (void *)__dtb_start;
+ 	else