brcm2708: update patches to latest version

As usual these patches were extracted from the raspberry repo:
https://github.com/raspberrypi/linux/commits/rpi-4.4.y

- Disable unused MFD RPISENSE driver.
- Disable ethernet HW checksums in order to avoid kernel exceptions.

Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>

SVN-Revision: 48985

13 files changed, 763 insertions, 6 deletions

diff --git a/target/linux/brcm2708/modules.mk b/target/linux/brcm2708/modules.mk
index 2802c1d758..04e6aa9233 100644
--- a/target/linux/brcm2708/modules.mk
+++ b/target/linux/brcm2708/modules.mk
@@ -274,7 +274,6 @@ define KernelPackage/spi-bcm2835
   SUBMENU:=$(SPI_MENU)
   TITLE:=BCM2835 SPI controller driver
   KCONFIG:=\
-    CONFIG_BCM2708_SPIDEV=n \
     CONFIG_SPI=y \
     CONFIG_SPI_BCM2835 \
     CONFIG_SPI_MASTER=y
@@ -293,7 +292,6 @@ define KernelPackage/spi-bcm2835-aux
   SUBMENU:=$(SPI_MENU)
   TITLE:=BCM2835 Aux SPI controller driver
   KCONFIG:=\
-    CONFIG_BCM2708_SPIDEV=n \
     CONFIG_SPI=y \
     CONFIG_SPI_BCM2835AUX \
     CONFIG_SPI_MASTER=y
@@ -331,8 +329,7 @@ define KernelPackage/i2c-bcm2708
   $(call i2c_defaults,$(I2C_BCM2708_MODULES),59)
   TITLE:=Broadcom BCM2708 I2C master controller driver
   KCONFIG+= \
-	CONFIG_I2C_BCM2708_BAUDRATE=100000 \
-	CONFIG_MFD_RPISENSE_CORE=n
+	CONFIG_I2C_BCM2708_BAUDRATE=100000
   DEPENDS:=@TARGET_brcm2708 +kmod-i2c-core
 endef
 
@@ -348,8 +345,6 @@ I2C_BCM2835_MODULES:=\
 define KernelPackage/i2c-bcm2835
   $(call i2c_defaults,$(I2C_BCM2835_MODULES),59)
   TITLE:=Broadcom BCM2835 I2C master controller driver
-  KCONFIG+= \
-	CONFIG_MFD_RPISENSE_CORE=n
   DEPENDS:=@TARGET_brcm2708 +kmod-i2c-core
 endef
 
diff --git a/target/linux/brcm2708/patches-4.4/0051-fdt-Add-support-for-the-CONFIG_CMDLINE_EXTEND-option.patch b/target/linux/brcm2708/patches-4.4/0051-fdt-Add-support-for-the-CONFIG_CMDLINE_EXTEND-option.patch
index 6103352b51..6103352b51 100755..100644
--- a/target/linux/brcm2708/patches-4.4/0051-fdt-Add-support-for-the-CONFIG_CMDLINE_EXTEND-option.patch
+++ b/target/linux/brcm2708/patches-4.4/0051-fdt-Add-support-for-the-CONFIG_CMDLINE_EXTEND-option.patch
diff --git a/target/linux/brcm2708/patches-4.4/0171-BCM270X_DT-Add-pi3-disable-bt-overlay.patch b/target/linux/brcm2708/patches-4.4/0171-BCM270X_DT-Add-pi3-disable-bt-overlay.patch
new file mode 100644
index 0000000000..d00439eaa5
--- /dev/null
+++ b/target/linux/brcm2708/patches-4.4/0171-BCM270X_DT-Add-pi3-disable-bt-overlay.patch
@@ -0,0 +1,96 @@
+From 42a9bb566fe376a1add4b3780c1b830f64500faa Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Wed, 2 Mar 2016 10:59:05 +0000
+Subject: [PATCH 171/180] BCM270X_DT: Add pi3-disable-bt overlay
+
+Disable Bluetooth and restore UART0/ttyAMA0 over GPIOs 14 & 15. To disable
+the systemd service that initialises the modem so it doesn't use the UART:
+
+       sudo systemctl disable hciuart
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm/boot/dts/overlays/Makefile                |  1 +
+ arch/arm/boot/dts/overlays/README                  |  8 ++++
+ .../boot/dts/overlays/pi3-disable-bt-overlay.dts   | 48 ++++++++++++++++++++++
+ 3 files changed, 57 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -39,6 +39,7 @@ dtb-$(RPI_DT_OVERLAYS) += mcp2515-can0-o
+ dtb-$(RPI_DT_OVERLAYS) += mcp2515-can1-overlay.dtb
+ dtb-$(RPI_DT_OVERLAYS) += mmc-overlay.dtb
+ dtb-$(RPI_DT_OVERLAYS) += mz61581-overlay.dtb
++dtb-$(RPI_DT_OVERLAYS) += pi3-disable-bt-overlay.dtb
+ dtb-$(RPI_DT_OVERLAYS) += piscreen-overlay.dtb
+ dtb-$(RPI_DT_OVERLAYS) += piscreen2r-overlay.dtb
+ dtb-$(RPI_DT_OVERLAYS) += pitft28-capacitive-overlay.dtb
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -496,6 +496,14 @@ Params: speed                   Display
+ [ The pcf8563-rtc overlay has been deleted. See i2c-rtc. ]
+ 
+ 
++Name:   pi3-disable-bt
++Info:   Disable Pi3 Bluetooth and restore UART0/ttyAMA0 over GPIOs 14 & 15
++        N.B. To disable the systemd service that initialises the modem so it
++        doesn't use the UART, use 'sudo systemctl disable hciuart'.
++Load:   dtoverlay=pi3-disable-bt
++Params: <None>
++
++
+ Name:   piscreen
+ Info:   PiScreen display by OzzMaker.com
+ Load:   dtoverlay=piscreen,<param>=<val>
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pi3-disable-bt-overlay.dts
+@@ -0,0 +1,48 @@
++/dts-v1/;
++/plugin/;
++
++/* Disable Bluetooth and restore UART0/ttyAMA0 over GPIOs 14 & 15.
++   To disable the systemd service that initialises the modem so it doesn't use
++   the UART:
++
++       sudo systemctl disable hciuart
++*/
++
++/{
++	compatible = "brcm,bcm2708";
++
++	fragment@0 {
++		target = <&uart1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@1 {
++		target = <&uart0>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart0_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			uart0_pins: uart0_pins {
++				brcm,pins = <14 15>;
++				brcm,function = <4>; /* alt0 */
++				brcm,pull = <0 2>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target-path = "/aliases";
++		__overlay__ {
++			serial0 = "/soc/uart@7e201000";
++			serial1 = "/soc/uart@7e215040";
++		};
++	};
++};
diff --git a/target/linux/brcm2708/patches-4.4/0172-BCM270X_DT-Add-pi3-miniuart-bt-DT-overlay.patch b/target/linux/brcm2708/patches-4.4/0172-BCM270X_DT-Add-pi3-miniuart-bt-DT-overlay.patch
new file mode 100644
index 0000000000..3e1031c109
--- /dev/null
+++ b/target/linux/brcm2708/patches-4.4/0172-BCM270X_DT-Add-pi3-miniuart-bt-DT-overlay.patch
@@ -0,0 +1,117 @@
+From 3b93a5e60a2272bea6b50561c6e871dde5295dfb Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 7 Mar 2016 09:53:03 +0000
+Subject: [PATCH 172/180] BCM270X_DT: Add pi3-miniuart-bt DT overlay
+
+Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore
+UART0/ttyAMA0 over GPIOs 14 & 15. Note that this may reduce the maximum
+usable baudrate.
+
+It is also necessary to edit /lib/systemd/system/hciuart.server and
+replace ttyAMA0 with ttyS0.
+
+If cmdline.txt uses the alias serial0 to refer to the user-accessable port
+then the firmware will replace with the appropriate port whether or not
+this overlay is used.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm/boot/dts/overlays/Makefile                |  1 +
+ arch/arm/boot/dts/overlays/README                  | 10 ++++
+ .../boot/dts/overlays/pi3-miniuart-bt-overlay.dts  | 61 ++++++++++++++++++++++
+ 3 files changed, 72 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -40,6 +40,7 @@ dtb-$(RPI_DT_OVERLAYS) += mcp2515-can1-o
+ dtb-$(RPI_DT_OVERLAYS) += mmc-overlay.dtb
+ dtb-$(RPI_DT_OVERLAYS) += mz61581-overlay.dtb
+ dtb-$(RPI_DT_OVERLAYS) += pi3-disable-bt-overlay.dtb
++dtb-$(RPI_DT_OVERLAYS) += pi3-miniuart-bt-overlay.dtb
+ dtb-$(RPI_DT_OVERLAYS) += piscreen-overlay.dtb
+ dtb-$(RPI_DT_OVERLAYS) += piscreen2r-overlay.dtb
+ dtb-$(RPI_DT_OVERLAYS) += pitft28-capacitive-overlay.dtb
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -504,6 +504,16 @@ Load:   dtoverlay=pi3-disable-bt
+ Params: <None>
+ 
+ 
++Name:   pi3-miniuart-bt
++Info:   Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore
++        UART0/ttyAMA0 over GPIOs 14 & 15. Note that this may reduce the maximum
++        usable baudrate.
++        N.B. It is also necessary to edit /lib/systemd/system/hciuart.server
++        and replace ttyAMA0 with ttyS0.
++Load:   dtoverlay=pi3-miniuart-bt
++Params: <None>
++
++
+ Name:   piscreen
+ Info:   PiScreen display by OzzMaker.com
+ Load:   dtoverlay=piscreen,<param>=<val>
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts
+@@ -0,0 +1,61 @@
++/dts-v1/;
++/plugin/;
++
++/* Switch Pi3 Bluetooth function to use the mini-UART (ttyS0) and restore
++   UART0/ttyAMA0 over GPIOs 14 & 15. Note that this may reduce the maximum
++   usable baudrate.
++
++   It is also necessary to edit /lib/systemd/system/hciuart.server and
++   replace ttyAMA0 with ttyS0.
++
++   If cmdline.txt uses the alias serial0 to refer to the user-accessable port
++   then the firmware will replace with the appropriate port whether or not
++   this overlay is used.
++*/
++
++/{
++	compatible = "brcm,bcm2708";
++
++	fragment@0 {
++		target = <&uart0>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart0_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@1 {
++		target = <&uart1>;
++		__overlay__ {
++			pinctrl-names = "default";
++			pinctrl-0 = <&uart1_pins>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&gpio>;
++		__overlay__ {
++			uart0_pins: uart0_pins {
++				brcm,pins = <14 15>;
++				brcm,function = <4>; /* alt0 */
++				brcm,pull = <0 2>;
++			};
++
++			uart1_pins: uart1_pins {
++				brcm,pins = <32 33>;
++				brcm,function = <2>; /* alt5=UART1 */
++				brcm,pull = <0 0>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target-path = "/aliases";
++		__overlay__ {
++			serial0 = "/soc/uart@7e201000";
++			serial1 = "/soc/uart@7e215040";
++		};
++	};
++};
diff --git a/target/linux/brcm2708/patches-4.4/0173-Pi3-DT-Add-dtparams-for-the-SD-interface.patch b/target/linux/brcm2708/patches-4.4/0173-Pi3-DT-Add-dtparams-for-the-SD-interface.patch
new file mode 100644
index 0000000000..f9e4767f8a
--- /dev/null
+++ b/target/linux/brcm2708/patches-4.4/0173-Pi3-DT-Add-dtparams-for-the-SD-interface.patch
@@ -0,0 +1,25 @@
+From c8b56d0359160d2aec2ab3168ef9d7c080ae9841 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 7 Mar 2016 13:38:39 +0000
+Subject: [PATCH 173/180] Pi3 DT: Add dtparams for the SD interface
+
+Add new base dtparams sd_overclock, sd_force_pio, sd_pio_limit
+and sd_debug. These were missed out of the initial Pi3 DTB.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm/boot/dts/bcm2710-rpi-3-b.dts | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
++++ b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
+@@ -188,5 +188,9 @@
+ 		audio = <&audio>,"status";
+ 		watchdog = <&watchdog>,"status";
+ 		random = <&random>,"status";
++		sd_overclock = <&sdhost>,"brcm,overclock-50:0";
++		sd_force_pio = <&sdhost>,"brcm,force-pio?";
++		sd_pio_limit = <&sdhost>,"brcm,pio-limit:0";
++		sd_debug     = <&sdhost>,"brcm,debug";
+ 	};
+ };
diff --git a/target/linux/brcm2708/patches-4.4/0174-vchiq_arm-Tweak-the-logging-output.patch b/target/linux/brcm2708/patches-4.4/0174-vchiq_arm-Tweak-the-logging-output.patch
new file mode 100644
index 0000000000..536c6ce2bc
--- /dev/null
+++ b/target/linux/brcm2708/patches-4.4/0174-vchiq_arm-Tweak-the-logging-output.patch
@@ -0,0 +1,75 @@
+From 48f3f7707a43b019e14216cec7376eba21972f9b Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 7 Mar 2016 15:05:11 +0000
+Subject: [PATCH 174/180] vchiq_arm: Tweak the logging output
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ .../vc04_services/interface/vchiq_arm/vchiq_core.c | 31 +++++++++-------------
+ 1 file changed, 13 insertions(+), 18 deletions(-)
+
+--- a/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_core.c
++++ b/drivers/misc/vc04_services/interface/vchiq_arm/vchiq_core.c
+@@ -891,16 +891,14 @@ queue_message(VCHIQ_STATE_T *state, VCHI
+ 						error_count);
+ 					return VCHIQ_ERROR;
+ 				}
+-				if (i == 0) {
+-					if (SRVTRACE_ENABLED(service,
+-							VCHIQ_LOG_INFO))
+-						vchiq_log_dump_mem("Sent", 0,
+-							header->data + pos,
+-							min(64u,
+-							elements[0].size));
+-				}
+ 			}
+ 
++		if (SRVTRACE_ENABLED(service,
++				VCHIQ_LOG_INFO))
++			vchiq_log_dump_mem("Sent", 0,
++				header->data,
++				min(16, pos));
++
+ 		spin_lock(&quota_spinlock);
+ 		service_quota->message_use_count++;
+ 
+@@ -1039,16 +1037,13 @@ queue_message_sync(VCHIQ_STATE_T *state,
+ 						error_count);
+ 					return VCHIQ_ERROR;
+ 				}
+-				if (i == 0) {
+-					if (vchiq_sync_log_level >=
+-						VCHIQ_LOG_TRACE)
+-						vchiq_log_dump_mem("Sent Sync",
+-							0, header->data + pos,
+-							min(64u,
+-							elements[0].size));
+-				}
+ 			}
+ 
++		if (vchiq_sync_log_level >= VCHIQ_LOG_TRACE)
++			vchiq_log_dump_mem("Sent Sync",
++				0, header->data,
++				min(16, pos));
++
+ 		VCHIQ_SERVICE_STATS_INC(service, ctrl_tx_count);
+ 		VCHIQ_SERVICE_STATS_ADD(service, ctrl_tx_bytes, size);
+ 	} else {
+@@ -1720,7 +1715,7 @@ parse_rx_slots(VCHIQ_STATE_T *state)
+ 				remoteport, localport, size);
+ 			if (size > 0)
+ 				vchiq_log_dump_mem("Rcvd", 0, header->data,
+-					min(64, size));
++					min(16, size));
+ 		}
+ 
+ 		if (((unsigned int)header & VCHIQ_SLOT_MASK) + calc_stride(size)
+@@ -2187,7 +2182,7 @@ sync_func(void *v)
+ 				remoteport, localport, size);
+ 			if (size > 0)
+ 				vchiq_log_dump_mem("Rcvd", 0, header->data,
+-					min(64, size));
++					min(16, size));
+ 		}
+ 
+ 		switch (type) {
diff --git a/target/linux/brcm2708/patches-4.4/0175-bcm2835-sdhost-Only-claim-one-DMA-channel.patch b/target/linux/brcm2708/patches-4.4/0175-bcm2835-sdhost-Only-claim-one-DMA-channel.patch
new file mode 100644
index 0000000000..fb68bcb5f8
--- /dev/null
+++ b/target/linux/brcm2708/patches-4.4/0175-bcm2835-sdhost-Only-claim-one-DMA-channel.patch
@@ -0,0 +1,160 @@
+From 06c169985c0884ce67377c79d27383e23f41e2cd Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Mon, 7 Mar 2016 16:46:39 +0000
+Subject: [PATCH 175/180] bcm2835-sdhost: Only claim one DMA channel
+
+With both MMC controllers enabled there are few DMA channels left. The
+bcm2835-sdhost driver only uses DMA in one direction at a time, so it
+doesn't need to claim two channels.
+
+See: https://github.com/raspberrypi/linux/issues/1327
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm/boot/dts/bcm2708_common.dtsi |  5 +--
+ drivers/mmc/host/bcm2835-sdhost.c     | 70 ++++++++++++++++++++++++-----------
+ 2 files changed, 50 insertions(+), 25 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2708_common.dtsi
++++ b/arch/arm/boot/dts/bcm2708_common.dtsi
+@@ -136,9 +136,8 @@
+ 			reg = <0x7e202000 0x100>;
+ 			interrupts = <2 24>;
+ 			clocks = <&clk_core>;
+-			dmas = <&dma 13>,
+-			       <&dma 13>;
+-			dma-names = "tx", "rx";
++			dmas = <&dma 13>;
++			dma-names = "rx-tx";
+ 			brcm,overclock-50 = <0>;
+ 			brcm,pio-limit = <1>;
+ 			status = "disabled";
+--- a/drivers/mmc/host/bcm2835-sdhost.c
++++ b/drivers/mmc/host/bcm2835-sdhost.c
+@@ -185,9 +185,10 @@ struct bcm2835_host {
+ 	unsigned int			debug:1;		/* Enable debug output */
+ 
+ 	/*DMA part*/
+-	struct dma_chan			*dma_chan_rx;		/* DMA channel for reads */
+-	struct dma_chan			*dma_chan_tx;		/* DMA channel for writes */
+-	struct dma_chan			*dma_chan;		/* Channel in used */
++	struct dma_chan			*dma_chan_rxtx;		/* DMA channel for reads and writes */
++	struct dma_chan			*dma_chan;		/* Channel in use */
++	struct dma_slave_config		dma_cfg_rx;
++	struct dma_slave_config		dma_cfg_tx;
+ 	struct dma_async_tx_descriptor	*dma_desc;
+ 	u32				dma_dir;
+ 	u32				drain_words;
+@@ -771,12 +772,11 @@ static void bcm2835_sdhost_prepare_dma(s
+ 	log_event("PRD<", (u32)data, 0);
+ 	pr_debug("bcm2835_sdhost_prepare_dma()\n");
+ 
++	dma_chan = host->dma_chan_rxtx;
+ 	if (data->flags & MMC_DATA_READ) {
+-		dma_chan = host->dma_chan_rx;
+ 		dir_data = DMA_FROM_DEVICE;
+ 		dir_slave = DMA_DEV_TO_MEM;
+ 	} else {
+-		dma_chan = host->dma_chan_tx;
+ 		dir_data = DMA_TO_DEVICE;
+ 		dir_slave = DMA_MEM_TO_DEV;
+ 	}
+@@ -813,6 +813,12 @@ static void bcm2835_sdhost_prepare_dma(s
+ 		host->drain_words = len/4;
+ 	}
+ 
++	/* The parameters have already been validated, so this will not fail */
++	(void)dmaengine_slave_config(dma_chan,
++				     (dir_data == DMA_FROM_DEVICE) ?
++				     &host->dma_cfg_rx :
++				     &host->dma_cfg_tx);
++
+ 	len = dma_map_sg(dma_chan->device->dev, data->sg, data->sg_len,
+ 			 dir_data);
+ 
+@@ -1805,28 +1811,46 @@ int bcm2835_sdhost_add_host(struct bcm28
+ 	spin_lock_init(&host->lock);
+ 
+ 	if (host->allow_dma) {
+-		if (IS_ERR_OR_NULL(host->dma_chan_tx) ||
+-		    IS_ERR_OR_NULL(host->dma_chan_rx)) {
+-			pr_err("%s: unable to initialise DMA channels. "
++		if (IS_ERR_OR_NULL(host->dma_chan_rxtx)) {
++			pr_err("%s: unable to initialise DMA channel. "
+ 			       "Falling back to PIO\n",
+ 			       mmc_hostname(mmc));
+ 			host->use_dma = false;
+ 		} else {
+-			host->use_dma = true;
+-
+ 			cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ 			cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ 			cfg.slave_id = 13;		/* DREQ channel */
+ 
++			/* Validate the slave configurations */
++
+ 			cfg.direction = DMA_MEM_TO_DEV;
+ 			cfg.src_addr = 0;
+ 			cfg.dst_addr = host->bus_addr + SDDATA;
+-			ret = dmaengine_slave_config(host->dma_chan_tx, &cfg);
+ 
+-			cfg.direction = DMA_DEV_TO_MEM;
+-			cfg.src_addr = host->bus_addr + SDDATA;
+-			cfg.dst_addr = 0;
+-			ret = dmaengine_slave_config(host->dma_chan_rx, &cfg);
++			ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
++
++			if (ret == 0) {
++				host->dma_cfg_tx = cfg;
++
++				cfg.direction = DMA_DEV_TO_MEM;
++				cfg.src_addr = host->bus_addr + SDDATA;
++				cfg.dst_addr = 0;
++
++				ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
++			}
++
++			if (ret == 0) {
++				host->dma_cfg_rx = cfg;
++
++				host->use_dma = true;
++			} else {
++				pr_err("%s: unable to configure DMA channel. "
++				       "Falling back to PIO\n",
++				       mmc_hostname(mmc));
++				dma_release_channel(host->dma_chan_rxtx);
++				host->dma_chan_rxtx = NULL;
++				host->use_dma = false;
++			}
+ 		}
+ 	} else {
+ 		host->use_dma = false;
+@@ -1948,19 +1972,21 @@ static int bcm2835_sdhost_probe(struct p
+ 
+ 	if (host->allow_dma) {
+ 		if (node) {
+-			host->dma_chan_tx =
+-				dma_request_slave_channel(dev, "tx");
+-			host->dma_chan_rx =
+-				dma_request_slave_channel(dev, "rx");
++			host->dma_chan_rxtx =
++				dma_request_slave_channel(dev, "rx-tx");
++			if (!host->dma_chan_rxtx)
++				host->dma_chan_rxtx =
++					dma_request_slave_channel(dev, "tx");
++			if (!host->dma_chan_rxtx)
++				host->dma_chan_rxtx =
++					dma_request_slave_channel(dev, "rx");
+ 		} else {
+ 			dma_cap_mask_t mask;
+ 
+ 			dma_cap_zero(mask);
+ 			/* we don't care about the channel, any would work */
+ 			dma_cap_set(DMA_SLAVE, mask);
+-			host->dma_chan_tx =
+-				dma_request_channel(mask, NULL, NULL);
+-			host->dma_chan_rx =
++			host->dma_chan_rxtx =
+ 				dma_request_channel(mask, NULL, NULL);
+ 		}
+ 	}
diff --git a/target/linux/brcm2708/patches-4.4/0176-bcm2835-mmc-Only-claim-one-DMA-channel.patch b/target/linux/brcm2708/patches-4.4/0176-bcm2835-mmc-Only-claim-one-DMA-channel.patch
new file mode 100644
index 0000000000..8f224faf88
--- /dev/null
+++ b/target/linux/brcm2708/patches-4.4/0176-bcm2835-mmc-Only-claim-one-DMA-channel.patch
@@ -0,0 +1,170 @@
+From af80d75abc7604cd9eb1788b0171148d000db09d Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 8 Mar 2016 09:49:16 +0000
+Subject: [PATCH 176/180] bcm2835-mmc: Only claim one DMA channel
+
+With both MMC controllers enabled there are few DMA channels left. The
+bcm2835-mmc driver only uses DMA in one direction at a time, so it
+doesn't need to claim two channels.
+
+See: https://github.com/raspberrypi/linux/issues/1327
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm/boot/dts/bcm2708_common.dtsi |  5 +--
+ drivers/mmc/host/bcm2835-mmc.c        | 69 +++++++++++++++++++++++++----------
+ 2 files changed, 51 insertions(+), 23 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2708_common.dtsi
++++ b/arch/arm/boot/dts/bcm2708_common.dtsi
+@@ -232,9 +232,8 @@
+ 			reg = <0x7e300000 0x100>;
+ 			interrupts = <2 30>;
+ 			clocks = <&clk_mmc>;
+-			dmas = <&dma 11>,
+-			       <&dma 11>;
+-			dma-names = "tx", "rx";
++			dmas = <&dma 11>;
++			dma-names = "rx-tx";
+ 			brcm,overclock-50 = <0>;
+ 			status = "disabled";
+ 		};
+--- a/drivers/mmc/host/bcm2835-mmc.c
++++ b/drivers/mmc/host/bcm2835-mmc.c
+@@ -108,8 +108,9 @@ struct bcm2835_host {
+ 	u32						shadow;
+ 
+ 	/*DMA part*/
+-	struct dma_chan			*dma_chan_rx;		/* DMA channel for reads */
+-	struct dma_chan			*dma_chan_tx;		/* DMA channel for writes */
++	struct dma_chan			*dma_chan_rxtx;		/* DMA channel for reads and writes */
++	struct dma_slave_config		dma_cfg_rx;
++	struct dma_slave_config		dma_cfg_tx;
+ 	struct dma_async_tx_descriptor	*tx_desc;	/* descriptor */
+ 
+ 	bool					have_dma;
+@@ -342,7 +343,7 @@ static void bcm2835_mmc_dma_complete(voi
+ 
+ 	if (host->data && !(host->data->flags & MMC_DATA_WRITE)) {
+ 		/* otherwise handled in SDHCI IRQ */
+-		dma_chan = host->dma_chan_rx;
++		dma_chan = host->dma_chan_rxtx;
+ 		dir_data = DMA_FROM_DEVICE;
+ 
+ 		dma_unmap_sg(dma_chan->device->dev,
+@@ -493,16 +494,21 @@ static void bcm2835_mmc_transfer_dma(str
+ 	if (host->blocks == 0)
+ 		return;
+ 
++	dma_chan = host->dma_chan_rxtx;
+ 	if (host->data->flags & MMC_DATA_READ) {
+-		dma_chan = host->dma_chan_rx;
+ 		dir_data = DMA_FROM_DEVICE;
+ 		dir_slave = DMA_DEV_TO_MEM;
+ 	} else {
+-		dma_chan = host->dma_chan_tx;
+ 		dir_data = DMA_TO_DEVICE;
+ 		dir_slave = DMA_MEM_TO_DEV;
+ 	}
+ 
++	/* The parameters have already been validated, so this will not fail */
++	(void)dmaengine_slave_config(dma_chan,
++				     (dir_data == DMA_FROM_DEVICE) ?
++				     &host->dma_cfg_rx :
++				     &host->dma_cfg_tx);
++
+ 	BUG_ON(!dma_chan->device);
+ 	BUG_ON(!dma_chan->device->dev);
+ 	BUG_ON(!host->data->sg);
+@@ -936,7 +942,7 @@ static void bcm2835_mmc_data_irq(struct
+ 		if  (host->data->flags & MMC_DATA_WRITE) {
+ 			/* IRQ handled here */
+ 
+-			dma_chan = host->dma_chan_tx;
++			dma_chan = host->dma_chan_rxtx;
+ 			dir_data = DMA_TO_DEVICE;
+ 			dma_unmap_sg(dma_chan->device->dev,
+ 				 host->data->sg, host->data->sg_len,
+@@ -1316,28 +1322,47 @@ static int bcm2835_mmc_add_host(struct b
+ 	dev_info(dev, "Forcing PIO mode\n");
+ 	host->have_dma = false;
+ #else
+-	if (IS_ERR_OR_NULL(host->dma_chan_tx) ||
+-	    IS_ERR_OR_NULL(host->dma_chan_rx)) {
+-		dev_err(dev, "%s: Unable to initialise DMA channels. Falling back to PIO\n",
++	if (IS_ERR_OR_NULL(host->dma_chan_rxtx)) {
++		dev_err(dev, "%s: Unable to initialise DMA channel. Falling back to PIO\n",
+ 			DRIVER_NAME);
+ 		host->have_dma = false;
+ 	} else {
+-		dev_info(dev, "DMA channels allocated");
+-		host->have_dma = true;
++		dev_info(dev, "DMA channel allocated");
+ 
+ 		cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ 		cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ 		cfg.slave_id = 11;		/* DREQ channel */
+ 
++		/* Validate the slave configurations */
++
+ 		cfg.direction = DMA_MEM_TO_DEV;
+ 		cfg.src_addr = 0;
+ 		cfg.dst_addr = host->bus_addr + SDHCI_BUFFER;
+-		ret = dmaengine_slave_config(host->dma_chan_tx, &cfg);
+ 
+-		cfg.direction = DMA_DEV_TO_MEM;
+-		cfg.src_addr = host->bus_addr + SDHCI_BUFFER;
+-		cfg.dst_addr = 0;
+-		ret = dmaengine_slave_config(host->dma_chan_rx, &cfg);
++		ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
++
++		if (ret == 0) {
++			host->dma_cfg_tx = cfg;
++
++			cfg.direction = DMA_DEV_TO_MEM;
++			cfg.src_addr = host->bus_addr + SDHCI_BUFFER;
++			cfg.dst_addr = 0;
++
++			ret = dmaengine_slave_config(host->dma_chan_rxtx, &cfg);
++		}
++
++		if (ret == 0) {
++			host->dma_cfg_rx = cfg;
++
++			host->use_dma = true;
++		} else {
++			pr_err("%s: unable to configure DMA channel. "
++			       "Faling back to PIO\n",
++			       mmc_hostname(mmc));
++			dma_release_channel(host->dma_chan_rxtx);
++			host->dma_chan_rxtx = NULL;
++			host->use_dma = false;
++		}
+ 	}
+ #endif
+ 	mmc->max_segs = 128;
+@@ -1416,16 +1441,20 @@ static int bcm2835_mmc_probe(struct plat
+ 
+ #ifndef FORCE_PIO
+ 	if (node) {
+-		host->dma_chan_tx = dma_request_slave_channel(dev, "tx");
+-		host->dma_chan_rx = dma_request_slave_channel(dev, "rx");
++		host->dma_chan_rxtx = dma_request_slave_channel(dev, "rx-tx");
++		if (!host->dma_chan_rxtx)
++			host->dma_chan_rxtx =
++				dma_request_slave_channel(dev, "tx");
++		if (!host->dma_chan_rxtx)
++			host->dma_chan_rxtx =
++				dma_request_slave_channel(dev, "rx");
+ 	} else {
+ 		dma_cap_mask_t mask;
+ 
+ 		dma_cap_zero(mask);
+ 		/* we don't care about the channel, any would work */
+ 		dma_cap_set(DMA_SLAVE, mask);
+-		host->dma_chan_tx = dma_request_channel(mask, NULL, NULL);
+-		host->dma_chan_rx = dma_request_channel(mask, NULL, NULL);
++		host->dma_chan_rxtx = dma_request_channel(mask, NULL, NULL);
+ 	}
+ #endif
+ 	clk = devm_clk_get(dev, NULL);
diff --git a/target/linux/brcm2708/patches-4.4/0177-config-rebuild-with-savedefconfig.patch b/target/linux/brcm2708/patches-4.4/0177-config-rebuild-with-savedefconfig.patch
new file mode 100644
index 0000000000..34eedc1076
--- /dev/null
+++ b/target/linux/brcm2708/patches-4.4/0177-config-rebuild-with-savedefconfig.patch
@@ -0,0 +1,28 @@
+From 0b65dbd40ad6b3d7cc979e8b7817f74b823f66ef Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Tue, 8 Mar 2016 17:08:39 +0000
+Subject: [PATCH 177/180] config: rebuild with savedefconfig
+
+---
+ arch/arm/configs/bcm2709_defconfig | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/arm/configs/bcm2709_defconfig
++++ b/arch/arm/configs/bcm2709_defconfig
+@@ -593,7 +593,6 @@ CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+ CONFIG_SERIAL_OF_PLATFORM=y
+ CONFIG_TTY_PRINTK=y
+ CONFIG_HW_RANDOM=y
+-CONFIG_HW_RANDOM_BCM2835=y
+ CONFIG_RAW_DRIVER=y
+ CONFIG_I2C=y
+ CONFIG_I2C_CHARDEV=m
+@@ -1112,7 +1111,7 @@ CONFIG_EXTCON=m
+ CONFIG_EXTCON_ARIZONA=m
+ CONFIG_IIO=m
+ CONFIG_IIO_BUFFER=y
+-CONFIG_IIO_BUFFER_CB=y
++CONFIG_IIO_BUFFER_CB=m
+ CONFIG_IIO_KFIFO_BUF=m
+ CONFIG_MCP320X=m
+ CONFIG_DHT11=m
diff --git a/target/linux/brcm2708/patches-4.4/0178-config-Add-module-for-mcp3422-ADC.patch b/target/linux/brcm2708/patches-4.4/0178-config-Add-module-for-mcp3422-ADC.patch
new file mode 100644
index 0000000000..d6c1a75fa8
--- /dev/null
+++ b/target/linux/brcm2708/patches-4.4/0178-config-Add-module-for-mcp3422-ADC.patch
@@ -0,0 +1,30 @@
+From 1e19acaf4b88ee6dcbe8843a07a04edf177be7c3 Mon Sep 17 00:00:00 2001
+From: popcornmix <popcornmix@gmail.com>
+Date: Tue, 8 Mar 2016 17:06:33 +0000
+Subject: [PATCH 178/180] config: Add module for mcp3422 ADC
+
+---
+ arch/arm/configs/bcm2709_defconfig | 1 +
+ arch/arm/configs/bcmrpi_defconfig  | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/arch/arm/configs/bcm2709_defconfig
++++ b/arch/arm/configs/bcm2709_defconfig
+@@ -1114,6 +1114,7 @@ CONFIG_IIO_BUFFER=y
+ CONFIG_IIO_BUFFER_CB=m
+ CONFIG_IIO_KFIFO_BUF=m
+ CONFIG_MCP320X=m
++CONFIG_MCP3422=m
+ CONFIG_DHT11=m
+ CONFIG_PWM_BCM2835=m
+ CONFIG_RASPBERRYPI_FIRMWARE=y
+--- a/arch/arm/configs/bcmrpi_defconfig
++++ b/arch/arm/configs/bcmrpi_defconfig
+@@ -1121,6 +1121,7 @@ CONFIG_IIO_BUFFER=y
+ CONFIG_IIO_BUFFER_CB=m
+ CONFIG_IIO_KFIFO_BUF=m
+ CONFIG_MCP320X=m
++CONFIG_MCP3422=m
+ CONFIG_DHT11=m
+ CONFIG_PWM_BCM2835=m
+ CONFIG_RASPBERRYPI_FIRMWARE=y
diff --git a/target/linux/brcm2708/patches-4.4/0179-Pi3-DT-Add-pull-ups-on-the-UART-RX-lines.patch b/target/linux/brcm2708/patches-4.4/0179-Pi3-DT-Add-pull-ups-on-the-UART-RX-lines.patch
new file mode 100644
index 0000000000..794a7bb4d5
--- /dev/null
+++ b/target/linux/brcm2708/patches-4.4/0179-Pi3-DT-Add-pull-ups-on-the-UART-RX-lines.patch
@@ -0,0 +1,40 @@
+From e064caf725672cb95cc8327f4dc55d3de257cd74 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.org>
+Date: Tue, 8 Mar 2016 16:18:57 +0000
+Subject: [PATCH 179/180] Pi3 DT: Add pull-ups on the UART RX lines
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ arch/arm/boot/dts/bcm2710-rpi-3-b.dts                  | 4 ++--
+ arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
++++ b/arch/arm/boot/dts/bcm2710-rpi-3-b.dts
+@@ -53,13 +53,13 @@
+ 	uart0_pins: uart0_pins {
+ 		brcm,pins = <32 33>;
+ 		brcm,function = <7>; /* alt3=UART0 */
+-		brcm,pull = <0 0>;
++		brcm,pull = <0 2>;
+ 	};
+ 
+ 	uart1_pins: uart1_pins {
+ 		brcm,pins = <14 15>;
+ 		brcm,function = <2>; /* alt5=UART1 */
+-		brcm,pull = <0 0>;
++		brcm,pull = <0 2>;
+ 	};
+ };
+ 
+--- a/arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts
++++ b/arch/arm/boot/dts/overlays/pi3-miniuart-bt-overlay.dts
+@@ -46,7 +46,7 @@
+ 			uart1_pins: uart1_pins {
+ 				brcm,pins = <32 33>;
+ 				brcm,function = <2>; /* alt5=UART1 */
+-				brcm,pull = <0 0>;
++				brcm,pull = <0 2>;
+ 			};
+ 		};
+ 	};
diff --git a/target/linux/brcm2708/patches-4.4/1000-mfd-rpisense-disable.patch b/target/linux/brcm2708/patches-4.4/1000-mfd-rpisense-disable.patch
new file mode 100644
index 0000000000..164e8447f6
--- /dev/null
+++ b/target/linux/brcm2708/patches-4.4/1000-mfd-rpisense-disable.patch
@@ -0,0 +1,10 @@
+--- a/drivers/mfd/Kconfig
++++ b/drivers/mfd/Kconfig
+@@ -13,6 +13,7 @@ config MFD_CORE
+ config MFD_RPISENSE_CORE
+ 	tristate "Raspberry Pi Sense HAT core functions"
+ 	depends on I2C
++	depends on BROKEN
+ 	select MFD_CORE
+ 	help
+ 	  This is the core driver for the Raspberry Pi Sense HAT. This provides
diff --git a/target/linux/brcm2708/patches-4.4/1001-smsc95xx-disable-hw-csum.patch b/target/linux/brcm2708/patches-4.4/1001-smsc95xx-disable-hw-csum.patch
new file mode 100644
index 0000000000..eff1f0049c
--- /dev/null
+++ b/target/linux/brcm2708/patches-4.4/1001-smsc95xx-disable-hw-csum.patch
@@ -0,0 +1,11 @@
+--- a/drivers/net/usb/smsc95xx.c
++++ b/drivers/net/usb/smsc95xx.c
+@@ -42,7 +42,7 @@
+ #define LAN95XX_EEPROM_MAGIC		(0x9500)
+ #define EEPROM_MAC_OFFSET		(0x01)
+ #define DEFAULT_TX_CSUM_ENABLE		(true)
+-#define DEFAULT_RX_CSUM_ENABLE		(true)
++#define DEFAULT_RX_CSUM_ENABLE		(false)
+ #define SMSC95XX_INTERNAL_PHY_ID	(1)
+ #define SMSC95XX_TX_OVERHEAD		(8)
+ #define SMSC95XX_TX_OVERHEAD_CSUM	(12)