X86_FEATURE_PKU is referred to as "PKU" in the hardware documentation:
CPUID.7.0.ECX[3]:PKU. X86_FEATURE_OSPKE is software support for pkeys,
enumerated with CPUID.7.0.ECX[4]:OSPKE, and it reflects the setting of
CR4.PKE(bit 22).

This patch disables CPUID:PKU without ept, because pkeys is not yet
implemented for shadow paging.
Signed-off-by: Huaitong Han <huaitong.han@intel.com>
Reviewed-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Protection keys define a new 4-bit protection key field (PKEY) in bits
62:59 of leaf entries of the page tables, the PKEY is an index to PKRU
register(16 domains), every domain has 2 bits(write disable bit, access
disable bit).

Static logic has been produced in update_pkru_bitmask, dynamic logic need
read pkey from page table entries, get pkru value, and deduce the correct
result.

[ Huaitong: Xiao helps to modify many sections. ]
Signed-off-by: Huaitong Han <huaitong.han@intel.com>
Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

PKEYS defines a new status bit in the PFEC. PFEC.PK (bit 5), if some
conditions is true, the fault is considered as a PKU violation.
pkru_mask indicates if we need to check PKRU.ADi and PKRU.WDi, and
does cache some conditions for permission_fault.

[ Huaitong: Xiao helps to modify many sections. ]
Signed-off-by: Huaitong Han <huaitong.han@intel.com>
Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Currently XSAVE state of host is not restored after VM-exit and PKRU
is managed by XSAVE so the PKRU from guest is still controlling the
memory access even if the CPU is running the code of host. This is
not safe as KVM needs to access the memory of userspace (e,g QEMU) to
do some emulation.

So we save/restore PKRU when guest/host switches.
Signed-off-by: Huaitong Han <huaitong.han@intel.com>
Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

KVM will use it to switch pkru between guest and host.

CC: Ingo Molnar <mingo@redhat.com>
CC: Dave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Signed-off-by: Huaitong Han <huaitong.han@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

This patch adds pkeys support for xsave state.
Signed-off-by: Huaitong Han <huaitong.han@intel.com>
Reviewed-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Pkeys is disabled if CPU is in non-paging mode in hardware. However KVM
always uses paging mode to emulate guest non-paging, mode with TDP. To
emulate this behavior, pkeys needs to be manually disabled when guest
switches to non-paging mode.
Signed-off-by: Huaitong Han <huaitong.han@intel.com>
Reviewed-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Signed-off-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

This patch removes magic number with enum cpuid_leafs.
Signed-off-by: Huaitong Han <huaitong.han@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

This will help in the implementation of PKRU, where the PK bit of the page
fault error code cannot be computed in advance (unlike I/D, R/W and U/S).
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Moving the initialization earlier is needed in 4.6 because
kvm_arch_init_vm is now using mmu_lock, causing lockdep to
complain:

[  284.440294] INFO: trying to register non-static key.
[  284.445259] the code is fine but needs lockdep annotation.
[  284.450736] turning off the locking correctness validator.
...
[  284.528318]  [<ffffffff810aecc3>] lock_acquire+0xd3/0x240
[  284.533733]  [<ffffffffa0305aa0>] ? kvm_page_track_register_notifier+0x20/0x60 [kvm]
[  284.541467]  [<ffffffff81715581>] _raw_spin_lock+0x41/0x80
[  284.546960]  [<ffffffffa0305aa0>] ? kvm_page_track_register_notifier+0x20/0x60 [kvm]
[  284.554707]  [<ffffffffa0305aa0>] kvm_page_track_register_notifier+0x20/0x60 [kvm]
[  284.562281]  [<ffffffffa02ece70>] kvm_mmu_init_vm+0x20/0x30 [kvm]
[  284.568381]  [<ffffffffa02dbf7a>] kvm_arch_init_vm+0x1ea/0x200 [kvm]
[  284.574740]  [<ffffffffa02bff3f>] kvm_dev_ioctl+0xbf/0x4d0 [kvm]

However, it also helps fixing a preexisting problem, which is why this
patch is also good for stable kernels: kvm_create_vm was incrementing
current->mm->mm_count but not decrementing it at the out_err label (in
case kvm_init_mmu_notifier failed).  The new initialization order makes
it possible to add the required mmdrop without adding a new error label.

Cc: stable@vger.kernel.org
Reported-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Upcoming in-kernel VFIO acceleration needs different handling in real
and virtual modes which makes it hard to support both modes in
the same handler.

This creates a copy of kvmppc_rm_h_stuff_tce and kvmppc_rm_h_put_tce
in addition to the existing kvmppc_rm_h_put_tce_indirect.

This also fixes linker breakage when only PR KVM was selected (leaving
HV KVM off): the kvmppc_h_put_tce/kvmppc_h_stuff_tce functions
would not compile at all and the linked would fail.
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Old KVM guests invoke single-context invvpid without actually checking
whether it is supported.  This was fixed by commit 518c8aee ("KVM: VMX:
Make sure single type invvpid is supported before issuing invvpid
instruction", 2010-08-01) and the patch after, but pre-2.6.36
kernels lack it including RHEL 6.

Reported-by: jmontleo@redhat.com
Tested-by: jmontleo@redhat.com
Cc: stable@vger.kernel.org
Fixes: 99b83ac8Reviewed-by: David Matlack <dmatlack@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

A guest executing an invalid invvpid instruction would hang
because the instruction pointer was not updated.

Reported-by: jmontleo@redhat.com
Tested-by: jmontleo@redhat.com
Cc: stable@vger.kernel.org
Fixes: 99b83ac8Reviewed-by: David Matlack <dmatlack@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

A guest executing an invalid invept instruction would hang
because the instruction pointer was not updated.

Cc: stable@vger.kernel.org
Fixes: bfd0a56bReviewed-by: David Matlack <dmatlack@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Merge tag 'kvm-arm-for-4.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

KVM/ARM Changes for v4.6-rc1

Second round of patches for v4.6-rc1, fixing a small handful of issue:
 - disable preemption when calling smp_call_function_many
 - Make kvm_ksym_ref work on VHE systems again after KASRL breakage
 - Disable compiler instrumentation for hypervisor code that could make
   KVM/arm64 blow up.

With the recent rewrite of the arm64 KVM hypervisor code in C, enabling
certain options like KASAN would allow the compiler to generate memory
accesses or function calls to addresses not mapped at EL2. This patch
disables the compiler instrumentation on the arm64 hypervisor code for
gcov-based profiling (GCOV_KERNEL), undefined behaviour sanity checker
(UBSAN) and kernel address sanitizer (KASAN).
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Christoffer Dall <christoffer.dall@linaro.org>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: <stable@vger.kernel.org> # 4.5+
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>

When running with VHE, there is no need to translate kernel pointers
to the EL2 memory space, since we're already there (and we have a much
saner memory map to start with).

Unfortunately, kvm_ksym_ref is getting in the way, and the first
call into the "hypervisor" section is going to end up in fireworks,
since we're now branching into nowhereland. Meh.

A potential solution is to test if VHE is engaged or not, and only
perform the translation in the negative case. With this in place,
VHE is able to run again.
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>

Preemption must be disabled when calling smp_call_function_many

Reported-by: bartosz.wawrzyniak@tieto.com
Signed-off-by: Eric Auger <eric.auger@linaro.org>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>

Pull x86 protection key support from Ingo Molnar:
 "This tree adds support for a new memory protection hardware feature
  that is available in upcoming Intel CPUs: 'protection keys' (pkeys).

  There's a background article at LWN.net:

      https://lwn.net/Articles/643797/

  The gist is that protection keys allow the encoding of
  user-controllable permission masks in the pte.  So instead of having a
  fixed protection mask in the pte (which needs a system call to change
  and works on a per page basis), the user can map a (handful of)
  protection mask variants and can change the masks runtime relatively
  cheaply, without having to change every single page in the affected
  virtual memory range.

  This allows the dynamic switching of the protection bits of large
  amounts of virtual memory, via user-space instructions.  It also
  allows more precise control of MMU permission bits: for example the
  executable bit is separate from the read bit (see more about that
  below).

  This tree adds the MM infrastructure and low level x86 glue needed for
  that, plus it adds a high level API to make use of protection keys -
  if a user-space application calls:

        mmap(..., PROT_EXEC);

  or

        mprotect(ptr, sz, PROT_EXEC);

  (note PROT_EXEC-only, without PROT_READ/WRITE), the kernel will notice
  this special case, and will set a special protection key on this
  memory range.  It also sets the appropriate bits in the Protection
  Keys User Rights (PKRU) register so that the memory becomes unreadable
  and unwritable.

  So using protection keys the kernel is able to implement 'true'
  PROT_EXEC on x86 CPUs: without protection keys PROT_EXEC implies
  PROT_READ as well.  Unreadable executable mappings have security
  advantages: they cannot be read via information leaks to figure out
  ASLR details, nor can they be scanned for ROP gadgets - and they
  cannot be used by exploits for data purposes either.

  We know about no user-space code that relies on pure PROT_EXEC
  mappings today, but binary loaders could start making use of this new
  feature to map binaries and libraries in a more secure fashion.

  There is other pending pkeys work that offers more high level system
  call APIs to manage protection keys - but those are not part of this
  pull request.

  Right now there's a Kconfig that controls this feature
  (CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS) that is default enabled
  (like most x86 CPU feature enablement code that has no runtime
  overhead), but it's not user-configurable at the moment.  If there's
  any serious problem with this then we can make it configurable and/or
  flip the default"

* 'mm-pkeys-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (38 commits)
  x86/mm/pkeys: Fix mismerge of protection keys CPUID bits
  mm/pkeys: Fix siginfo ABI breakage caused by new u64 field
  x86/mm/pkeys: Fix access_error() denial of writes to write-only VMA
  mm/core, x86/mm/pkeys: Add execute-only protection keys support
  x86/mm/pkeys: Create an x86 arch_calc_vm_prot_bits() for VMA flags
  x86/mm/pkeys: Allow kernel to modify user pkey rights register
  x86/fpu: Allow setting of XSAVE state
  x86/mm: Factor out LDT init from context init
  mm/core, x86/mm/pkeys: Add arch_validate_pkey()
  mm/core, arch, powerpc: Pass a protection key in to calc_vm_flag_bits()
  x86/mm/pkeys: Actually enable Memory Protection Keys in the CPU
  x86/mm/pkeys: Add Kconfig prompt to existing config option
  x86/mm/pkeys: Dump pkey from VMA in /proc/pid/smaps
  x86/mm/pkeys: Dump PKRU with other kernel registers
  mm/core, x86/mm/pkeys: Differentiate instruction fetches
  x86/mm/pkeys: Optimize fault handling in access_error()
  mm/core: Do not enforce PKEY permissions on remote mm access
  um, pkeys: Add UML arch_*_access_permitted() methods
  mm/gup, x86/mm/pkeys: Check VMAs and PTEs for protection keys
  x86/mm/gup: Simplify get_user_pages() PTE bit handling
  ...

Pull EFI updates from Ingo Molnar:
 "The main changes are:

   - Use separate EFI page tables when executing EFI firmware code.
     This isolates the EFI context from the rest of the kernel, which
     has security and general robustness advantages.  (Matt Fleming)

   - Run regular UEFI firmware with interrupts enabled.  This is already
     the status quo under other OSs.  (Ard Biesheuvel)

   - Various x86 EFI enhancements, such as the use of non-executable
     attributes for EFI memory mappings.  (Sai Praneeth Prakhya)

   - Various arm64 UEFI enhancements.  (Ard Biesheuvel)

   - ... various fixes and cleanups.

  The separate EFI page tables feature got delayed twice already,
  because it's an intrusive change and we didn't feel confident about
  it - third time's the charm we hope!"

* 'efi-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (37 commits)
  x86/mm/pat: Fix boot crash when 1GB pages are not supported by the CPU
  x86/efi: Only map kernel text for EFI mixed mode
  x86/efi: Map EFI_MEMORY_{XP,RO} memory region bits to EFI page tables
  x86/mm/pat: Don't implicitly allow _PAGE_RW in kernel_map_pages_in_pgd()
  efi/arm*: Perform hardware compatibility check
  efi/arm64: Check for h/w support before booting a >4 KB granular kernel
  efi/arm: Check for LPAE support before booting a LPAE kernel
  efi/arm-init: Use read-only early mappings
  efi/efistub: Prevent __init annotations from being used
  arm64/vmlinux.lds.S: Handle .init.rodata.xxx and .init.bss sections
  efi/arm64: Drop __init annotation from handle_kernel_image()
  x86/mm/pat: Use _PAGE_GLOBAL bit for EFI page table mappings
  efi/runtime-wrappers: Run UEFI Runtime Services with interrupts enabled
  efi: Reformat GUID tables to follow the format in UEFI spec
  efi: Add Persistent Memory type name
  efi: Add NV memory attribute
  x86/efi: Show actual ending addresses in efi_print_memmap
  x86/efi/bgrt: Don't ignore the BGRT if the 'valid' bit is 0
  efivars: Use to_efivar_entry
  efi: Runtime-wrapper: Get rid of the rtc_lock spinlock
  ...

Pull 'objtool' stack frame validation from Ingo Molnar:
 "This tree adds a new kernel build-time object file validation feature
  (ONFIG_STACK_VALIDATION=y): kernel stack frame correctness validation.
  It was written by and is maintained by Josh Poimboeuf.

  The motivation: there's a category of hard to find kernel bugs, most
  of them in assembly code (but also occasionally in C code), that
  degrades the quality of kernel stack dumps/backtraces.  These bugs are
  hard to detect at the source code level.  Such bugs result in
  incorrect/incomplete backtraces most of time - but can also in some
  rare cases result in crashes or other undefined behavior.

  The build time correctness checking is done via the new 'objtool'
  user-space utility that was written for this purpose and which is
  hosted in the kernel repository in tools/objtool/.  The tool's (very
  simple) UI and source code design is shaped after Git and perf and
  shares quite a bit of infrastructure with tools/perf (which tooling
  infrastructure sharing effort got merged via perf and is already
  upstream).  Objtool follows the well-known kernel coding style.

  Objtool does not try to check .c or .S files, it instead analyzes the
  resulting .o generated machine code from first principles: it decodes
  the instruction stream and interprets it.  (Right now objtool supports
  the x86-64 architecture.)

  From tools/objtool/Documentation/stack-validation.txt:

   "The kernel CONFIG_STACK_VALIDATION option enables a host tool named
    objtool which runs at compile time.  It has a "check" subcommand
    which analyzes every .o file and ensures the validity of its stack
    metadata.  It enforces a set of rules on asm code and C inline
    assembly code so that stack traces can be reliable.

    Currently it only checks frame pointer usage, but there are plans to
    add CFI validation for C files and CFI generation for asm files.

    For each function, it recursively follows all possible code paths
    and validates the correct frame pointer state at each instruction.

    It also follows code paths involving special sections, like
    .altinstructions, __jump_table, and __ex_table, which can add
    alternative execution paths to a given instruction (or set of
    instructions).  Similarly, it knows how to follow switch statements,
    for which gcc sometimes uses jump tables."

  When this new kernel option is enabled (it's disabled by default), the
  tool, if it finds any suspicious assembly code pattern, outputs
  warnings in compiler warning format:

    warning: objtool: rtlwifi_rate_mapping()+0x2e7: frame pointer state mismatch
    warning: objtool: cik_tiling_mode_table_init()+0x6ce: call without frame pointer save/setup
    warning: objtool:__schedule()+0x3c0: duplicate frame pointer save
    warning: objtool:__schedule()+0x3fd: sibling call from callable instruction with changed frame pointer

  ... so that scripts that pick up compiler warnings will notice them.
  All known warnings triggered by the tool are fixed by the tree, most
  of the commits in fact prepare the kernel to be warning-free.  Most of
  them are bugfixes or cleanups that stand on their own, but there are
  also some annotations of 'special' stack frames for justified cases
  such entries to JIT-ed code (BPF) or really special boot time code.

  There are two other long-term motivations behind this tool as well:

   - To improve the quality and reliability of kernel stack frames, so
     that they can be used for optimized live patching.

   - To create independent infrastructure to check the correctness of
     CFI stack frames at build time.  CFI debuginfo is notoriously
     unreliable and we cannot use it in the kernel as-is without extra
     checking done both on the kernel side and on the build side.

  The quality of kernel stack frames matters to debuggability as well,
  so IMO we can merge this without having to consider the live patching
  or CFI debuginfo angle"

* 'core-objtool-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (52 commits)
  objtool: Only print one warning per function
  objtool: Add several performance improvements
  tools: Copy hashtable.h into tools directory
  objtool: Fix false positive warnings for functions with multiple switch statements
  objtool: Rename some variables and functions
  objtool: Remove superflous INIT_LIST_HEAD
  objtool: Add helper macros for traversing instructions
  objtool: Fix false positive warnings related to sibling calls
  objtool: Compile with debugging symbols
  objtool: Detect infinite recursion
  objtool: Prevent infinite recursion in noreturn detection
  objtool: Detect and warn if libelf is missing and don't break the build
  tools: Support relative directory path for 'O='
  objtool: Support CROSS_COMPILE
  x86/asm/decoder: Use explicitly signed chars
  objtool: Enable stack metadata validation on 64-bit x86
  objtool: Add CONFIG_STACK_VALIDATION option
  objtool: Add tool to perform compile-time stack metadata validation
  x86/kprobes: Mark kretprobe_trampoline() stack frame as non-standard
  sched: Always inline context_switch()
  ...

Pull ARM SoC driver updates from Arnd Bergmann:
 "Driver updates for ARM SoCs, these contain various things that touch
  the drivers/ directory but got merged through arm-soc for practical
  reasons:

   - Rockchip rk3368 gains power domain support
   - Small updates for the ARM spmi driver
   - The Atmel PMC driver saw a larger rework, touching both
     arch/arm/mach-at91 and drivers/clk/at91
   - All reset controller driver changes alway get merged through
     arm-soc, though this time the largest change is the addition of a
     MIPS pistachio reset driver
   - One bugfix for the NXP (formerly Freescale) i.MX weim bus driver"

* tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (43 commits)
  bus: imx-weim: Take the 'status' property value into account
  clk: at91: remove useless includes
  clk: at91: pmc: remove useless capacities handling
  clk: at91: pmc: drop at91_pmc_base
  usb: gadget: atmel: access the PMC using regmap
  ARM: at91: remove useless includes and function prototypes
  ARM: at91: pm: move idle functions to pm.c
  ARM: at91: pm: find and remap the pmc
  ARM: at91: pm: simply call at91_pm_init
  clk: at91: pmc: move pmc structures to C file
  clk: at91: pmc: merge at91_pmc_init in atmel_pmc_probe
  clk: at91: remove IRQ handling and use polling
  clk: at91: make use of syscon/regmap internally
  clk: at91: make use of syscon to share PMC registers in several drivers
  hwmon: (scpi) add energy meter support
  firmware: arm_scpi: add support for 64-bit sensor values
  firmware: arm_scpi: decrease Tx timeout to 20ms
  firmware: arm_scpi: fix send_message and sensor_get_value for big-endian
  reset: sti: Make reset_control_ops const
  reset: zynq: Make reset_control_ops const
  ...

Pull ARM SoC defconfig updates from Arnd Bergmann:
 "As usual, a bunch of commits, mostly adding drivers and other options
  to defconfigs.

  The realview_smp_defconfig and realview_defconfig got merged into one,
  so we are now down to 110 files.

  For stm32, we have now added a Kconfig fragment, the first such file
  on arch/arm.  The purpose here is to have a shared defconfig file that
  works for all boards, while the DRAM offset has to be hardwired on
  NOMMU machines at compile time.

  The Exynos defconfig changes depend on changes in the RTC tree, so
  this is pulled in here, but has already been merged into 4.6 now"

* tag 'armsoc-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (45 commits)
  ARM: imx_v4_v5_defconfig: Enable initramfs support
  ARM: imx_v4_v5_defconfig: Cleanup imx_v4_v5_defconfig
  ARM: multi_v7_defconfig: Enable LP872x regulator support
  ARM: omap2plus_defconfig: Enable LP872x regulator support
  ARM: mxs_defconfig: Enable initramfs support
  ARM: mxs_defconfig: Cleanup mxs_defconfig
  ARM: multi_v5_defconfig: Enable initramfs support
  ARM: multi_v5_defconfig: Cleanup multi_v5_defconfig
  ARM: multi_v7_defconfig: enable useful configurations for Vybrid
  ARM: multi_v7_defconfig: add MACH_ARTPEC6
  ARM: omap2plus_defconfig: Enable AT24 eeprom
  ARM: omap2plus_defconfig: Enable TI TVP5150 video decoder support
  ARM: omap2plus_defconfig: Enable ISP support and dependencies
  ARM: omap2plus_defconfig: Enable OMAP IOMMU support
  ARM: socfpga_defconfig: enable support for initramfs/initrd support
  ARM: at91/defconfig: add sama5d2 adc support in sama5_defconfig
  ARM: multi_v7_defconfig: Enable BCM283x
  ARM: bcm2835_defconfig: Enable RPi power domain driver
  ARM: bcm2835_defconfig: Enable RPi firmware driver
  ARM: bcm2835_defconfig: enable ARMv7 support
  ...

Pull ARM 64-bit DT updates from Arnd Bergmann:
 "The arm64 device tree changes make up an increasing portion of the
  overall changes, so they are kept separate from the 32-bit devicetree
  changes and from the other arm64 updates.

  Newly added SoCs and boards are:
   - 96Boards Husky board
   - AMD Overdrive board
   - Amlogic S905 SoC and related Tronsmart boxes
   - Annapurna Labs Alpine family and development board
   - Broadcom Vulcan servers
   - Broadcom Northstar 2 SoC
   - Marvell Armada 3700 family and development board
   - Qualcomm MSM8996 SoC

  Additional devices are enabled for existing platforms from Applied
  Micro, Hisilicon, Mediatek, Qualcomm, and Renesas and there are a
  couple of other updates for Rockchip, Xilinx and NXP/Freescale"

* tag 'armsoc-dt64' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (102 commits)
  ARM64: dts: amlogic: Add Tronsmart Vega S95 configs
  Documentation: devicetree: amlogic: Document Tronsmart Vega S95 boards
  ARM64: dts: Prepare configs for Amlogic Meson GXBaby
  Documentation: devicetree: amlogic: Document Meson GXBaby
  devicetree: bindings: Add vendor prefix for Tronsmart
  arm64: dts: qcom: Fix MPP's function used for LED control
  arm64: dts: alpine: add the MSIX node in the Alpine v2 dtsi
  arm64: dts: add the Alpine v2 EVP
  arm64: dts: marvell: re-order Device Tree nodes for Armada AP806
  arm64: dts: marvell: update Armada AP806 clock description
  arm64: dts: marvell: add Device Tree files for Armada 7K/8K
  arm64: dts: apm: Add DT node for X-Gene v2 SLIMpro Mailbox I2C Driver
  arm64: dts: apm: Mailbox device tree node for APM X-Gene v2 platform.
  arm64: dts: apm: Add DT node for X-Gene v1 SLIMpro Mailbox I2C Driver
  arm64: dts: apm: mailbox device tree node for APM X-Gene platform.
  arm64: dts: apm: Update GPIO to control power-off on X-Gene v2 platforms
  arm64: dts: apm: Update GPIO standby controller DT node for X-Gene v2 platforms
  arm64: dts: apm: Update GPIO to control power-off on X-Gene v1 platforms
  arm64: dts: salvator-x: enable USB 2.0 Host of channel 1 and 2
  arm64: dts: salvator-x: enable usb2_phy of channel 1 and 2
  ...

Pull ARM DT updates from Arnd Bergmann:
 "These are all the updates to device tree files for 32-bit platforms,
  plus a couple of related 64-bit updates:

  New SoC support:
   - Allwinner A83T
   - Axis Artpec-6 SoC
   - Mediatek MT7623 SoC
   - TI Keystone K2G SoC
   - ST Microelectronics stm32f469

  New board or machine support:
   - ARM Juno R2
   - Buffalo Linkstation LS-QVL and LS-GL
   - Cubietruck plus
   - D-Link DIR-885L
   - DT support for ARM RealView PB1176 and PB11MPCore
   - Google Nexus 7
   - Homlet v2
   - Itead Ibox
   - Lamobo R1
   - LG Optimus Black
   - Logicpd dm3730
   - Raspberry Pi Model A

  Other changes include
   - Lots of updates for Qualcomm APQ8064, MSM8974 and others
   - Improved support for Nokia N900 and other OMAP machines
   - Common clk support for lpc32xx
   - HDLCD display on ARM
   - Improved stm32f429 support
   - Improved Renesas device support, r8a779x and others
   - Lots of Rockchip updates
   - Samsung cleanups
   - ADC support for Atmel SAMA5D2
   - BCM2835 (Raspberry Pi) improvements
   - Broadcom Northstar Plus enhancements
   - OMAP GPMC rework
   - Several improvements for Atmel SAMA5D2 / Xplained
   - Global change to remove inofficial "arm,amba-bus" compatible
     string"

* tag 'armsoc-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (350 commits)
  ARM, ARM64: dts: drop "arm,amba-bus" in favor of "simple-bus"
  ARM: dts: artpec: dual-license on artpec6.dtsi
  ARM: dts: ux500: add synaptics RMI4 for Ux500 TVK DT
  arm64: dts: juno/vexpress: fix node name unit-address presence warnings
  arm64: dts: foundation-v8: add SBSA Generic Watchdog device node
  ARM: dts: at91: sama5d2 Xplained: add leds node
  ARM: dts: at91: sama5d2 Xplained: add user push button
  ARM: dts: at91: sama5d2 Xplained: set pin muxing for usb gadget and usb host
  ARM: dts: stm32f429: Enable Ethernet on Eval board
  ARM: dts: omap3-sniper: TWL4030 keypad support
  Revert "ARM: dts: DRA7: Add dt nodes for PWMSS"
  ARM: dts: dm814x: dra62x: Disable wait pin monitoring for NAND
  ARM: dts: dm814x: dra62x: Fix NAND device nodes
  ARM: dts: stm32f429: Add Ethernet support
  ARM: dts: stm32f429: Add system config bank node
  ARM: dts: at91: sama5d2: add nand0 and nfc0 nodes
  ARM: dts: at91: sama5d2: add dma properties to UART nodes
  ARM: dts: at91: sama5d2 Xplained: Correct the macb irq pinctrl node
  ARM: dts: exynos: Don't overheat the Odroid XU3-Lite on high load
  ARM: dts: exynos: Add cooling levels for Exynos5422/5800 CPUs
  ...

Pull ARM SoC 64-bit changes from Arnd Bergmann:
 "Here's our branch of ARM64 contents for this merge window, now
  containing all ARM64 changes other than device tree files.

   - Various new platforms get added:
      * Allwinner A64 SoC
      * Annapurna Labs Alpine SoCs
      * Broadcom Vulcan
      * Marvell Armada 3700 SoCs
      * Amlogic S905

   - Various defconfig changes to enable platform specific drivers

  This branch includes the clk git tree to resolve a build-time
  dependency"

* tag 'armsoc-arm64' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (48 commits)
  arm64: defconfig: Increase MMC_BLOCK_MINORS to 16
  arm64: defconfig: Add Qualcomm sdhci and restart functionality
  ARM64: Enable Amlogic Meson GXBaby platform
  arm64: defconfig: Enable Samsung MFD and related configs
  arm64: alpine: select the Alpine MSI controller driver
  arm64: defconfig: enable the Alpine family
  arm64: add Alpine SoC family
  arm64: defconfig: Enable exynos thermal config
  arm64: add defconfig options for Allwinner SoCs
  arm64: defconfig: Enable DesignWare APB GPIO controller
  arm64: defconfig: Add Renesas R-Car Gen3 USB 2.0 phy driver support
  arm64: EXYNOS: Consolidate ARCH_EXYNOS7 symbol into ARCH_EXYNOS
  clk: samsung: Don't build ARMv8 clock drivers on ARMv7
  MAINTAINERS: Add entry for Broadcom Vulcan SoC
  arm64: cputype info for Broadcom Vulcan
  arm64: Broadcom Vulcan support
  arm64: defconfig: Add Broadcom Vulcan to defconfig
  arm64: update ARCH_MVEBU for Marvell Armada 7K/8K support
  Documentation: arm: add Marvell Armada 7K and 8K families
  Documentation: arm: add link to Armada 38x Functional Spec
  ...

Pull ARM SoC platform updates from Arnd Bergmann:
 "Newly added support for additional SoCs:
   - Axis Artpec-6 SoC family
   - Allwinner A83T SoC
   - Mediatek MT7623
   - NXP i.MX6QP SoC
   - ST Microelectronics stm32f469 microcontroller

  New features:
   - SMP support for Mediatek mt2701
   - Big-endian support for NXP i.MX
   - DaVinci now uses the new DMA engine dma_slave_map
   - OMAP now uses the new DMA engine dma_slave_map
   - earlyprintk support for palmchip uart on mach-tango
   - delay timer support for orion

  Other:
   - Exynos PMU driver moved out to drivers/soc/
   - Various smaller updates for Renesas, Xilinx, PXA, AT91, OMAP,
     uniphier"

* tag 'armsoc-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (83 commits)
  ARM: uniphier: rework SMP code to support new System Bus binding
  ARM: uniphier: add missing of_node_put()
  ARM: at91: avoid defining CONFIG_* symbols in source code
  ARM: DRA7: hwmod: Add data for eDMA tpcc, tptc0, tptc1
  ARM: imx: Make reset_control_ops const
  ARM: imx: Do L2 errata only if the L2 cache isn't enabled
  ARM: imx: select ARM_CPU_SUSPEND only for imx6
  dmaengine: pxa_dma: fix the maximum requestor line
  ARM: alpine: select the Alpine MSI controller driver
  ARM: pxa: add the number of DMA requestor lines
  dmaengine: mmp-pdma: add number of requestors
  dma: mmp_pdma: Add the #dma-requests DT property documentation
  ARM: OMAP2+: Add rtc hwmod configuration for ti81xx
  ARM: s3c24xx: Avoid warning for inb/outb
  ARM: zynq: Move early printk virtual address to vmalloc area
  ARM: DRA7: hwmod: Add custom reset handler for PCIeSS
  ARM: SAMSUNG: Remove unused register offset definition
  ARM: EXYNOS: Cleanup header files inclusion
  drivers: soc: samsung: Enable COMPILE_TEST
  MAINTAINERS: Add maintainers entry for drivers/soc/samsung
  ...

Pull ARM SoC cleanups from Arnd Bergmann:
 "A few simple cleanups across multiple platforms, not much standing
  out:

   - lpc32xx removes its private implementation of the clk API, after
     generic code was merged in 4.5
   - all unused Makefile.boot files get removed
   - a number of simplifications for shmobile
   - asm/clkdev.h gets replaced with the asm-generic version after all
     mach/clkdev.h implementations are gone"

* tag 'armsoc-cleanup' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: shmobile: Kconfig: Get rid of old comment
  ARM: shmobile: Consolidate SCU mapping code
  arm: lpc32xx: remove direct control of GPIOs from shared mach file
  arm: lpc32xx: remove selected HAVE_IDE
  arm: lpc32xx: switch to common clock framework
  ARM: Use generic clkdev.h header
  ARM: plat-versatile: Remove unused clock.c file
  ARM: netx: remove redundant "depends on ARCH_NETX"
  ARM: integrator: remove redundant select in Kconfig
  ARM: drop unused Makefile.boot of Multiplatform SoCs
  ARM: mvebu: add missing of_node_put()
  ARM: shmobile: r8a7779: Remove remainings of removed SCU boot setup code
  ARM: shmobile: Typo s/MIPDR/MPIDR/
  ARM: shmobile: Add includes providing forward declarations
  ARM: shmobile: rcar-gen2: Make rcar_gen2_dma_contiguous static
  ARM: mv78xx0: use "depends on" instead of "if" after prompt

Pull ARM SoC non-urgent fixes from Arnd Bergmann:
 "As usual, we queue up a few fixes that don't seem urgent enough to go
  in through -rc.

   - a number of randconfig warning fixes from Arnd
   - various small fixes for OMAP
   - one somewhat larger patch to restore the OMAP3 cpuidle tuning that
     was lost in a cleanup
   - a small regression fix for cns3xxx PCI"

* tag 'armsoc-fixes-nc' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (26 commits)
  CNS3xxx: Fix PCI cns3xxx_write_config()
  MAINTAINERS: unify email addrs for Kevin Hilman
  CNS3xxx: remove unused *_VIRT definitions
  ARM: OMAP2+: Fix hwmod clock for l4_ls
  soc: TI knav_qmss: fix dma_addr_t printing
  ARM: prima2: always enable reset controller
  ARM: socfpga: hide unused functions
  ARM: ux500: fix ureachable iounmap()
  ARM: ks8695: fix __initdata annotation
  ARM: mvebu: mark mvebu_hwcc_pci_nb as __maybe_unused
  ARM: mv78xx0: avoid unused function warning
  ARM: orion: only select I2C_BOARDINFO when using I2C
  ARM: OMAP2+: Fix out of range register access with syscon_config.max_register
  ARM: OMAP3: Add cpuidle parameters table for omap3430
  ARM: davinci: make I2C support optional
  ARM: davinci: DA8xx+DMx combined kernels need PATCH_PHYS_VIRT
  ARM: davinci: avoid unused mityomapl138_pn_info variable
  ARM: davinci: limit DT support to DA850
  ARM: DRA7: hwmod: Add reset data for PCIe
  ARM: DRA7: hwmod: Fix OCP2SCP sysconfig
  ...

Commit 2213e9a6 ("kallsyms: add support for relative offsets in
kallsyms address table") changed the default kallsyms symbol table
format to use relative references rather than absolute addresses.

This reduces the size of the kallsyms symbol table by 50% on 64-bit
architectures, and further reduces the size of the relocation tables
used by relocatable kernels.  Since the memory footprint of the static
kernel image is always much smaller than 4 GB, these relative references
are assumed to be representable in 32 bits, even when the native word
size is 64 bits.

On 64-bit architectures, this obviously only works if the distance
between each relative reference and the chosen anchor point is
representable in 32 bits, and so the table generation code in
scripts/kallsyms.c scans the table for the lowest value that is covered
by the kernel text, and selects it as the anchor point.

However, when using the GOLD linker rather than the default BFD linker
to build the x86_64 kernel, the symbol phys_offset_64, which is the
result of arithmetic defined in the linker script, is emitted as a 'T'
rather than an 'A' type symbol, resulting in scripts/kallsyms.c to
mistake it for a suitable anchor point, even though it is far away from
the actual kernel image in the virtual address space.  This results in
out-of-range warnings from scripts/kallsyms.c and a broken build.

So let's align with the BFD linker, and emit the phys_offset_[32|64]
symbols as absolute symbols explicitly.  Note that the out of range
issue does not exist on 32-bit x86, but this patch changes both symbols
for symmetry.
Reported-by: Markus Trippelsdorf <markus@trippelsdorf.de>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull virtio/vhost updates from Michael Tsirkin:
 "New features, performance improvements, cleanups:

   - basic polling support for vhost
   - rework virtio to optionally use DMA API, fixing it on Xen
   - balloon stats gained a new entry
   - using the new napi_alloc_skb speeds up virtio net
   - virtio blk stats can now be read while another VCPU is busy
     inflating or deflating the balloon

  plus misc cleanups in various places"

* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
  virtio_net: replace netdev_alloc_skb_ip_align() with napi_alloc_skb()
  vhost_net: basic polling support
  vhost: introduce vhost_vq_avail_empty()
  vhost: introduce vhost_has_work()
  virtio_balloon: Allow to resize and update the balloon stats in parallel
  virtio_balloon: Use a workqueue instead of "vballoon" kthread
  virtio/s390: size of SET_IND payload
  virtio/s390: use dev_to_virtio
  vhost: rename vhost_init_used()
  vhost: rename cross-endian helpers
  virtio_blk: VIRTIO_BLK_F_WCE->VIRTIO_BLK_F_FLUSH
  vring: Use the DMA API on Xen
  virtio_pci: Use the DMA API if enabled
  virtio_mmio: Use the DMA API if enabled
  virtio: Add improved queue allocation API
  virtio_ring: Support DMA APIs
  vring: Introduce vring_use_dma_api()
  s390/dma: Allow per device dma ops
  alpha/dma: use common noop dma ops
  dma: Provide simple noop dma ops

Pull mailbox updates from Jassi Brar:

 - mailbox bindings and drivers for
     * APM X-Gene
     * Hisilicon Hi6220
     * Rockchip RK3368
   platforms

 - minor fixes to the above three drivers.

 - misc cleanups of mailbox-test driver.

* 'mailbox-for-next' of git://git.linaro.org/landing-teams/working/fujitsu/integration:
  mailbox: rockchip: avoid 64-bit division
  mailbox: rockchip: Add Rockchip mailbox driver
  dt-bindings: rockchip-mailbox: Add mailbox controller document on Rockchip SoCs
  mailbox/xgene-slimpro: Checking for IS_ERR instead of NULL
  mailbox: Hi6220: add mailbox driver
  dt-bindings: mailbox: Document Hi6220 mailbox driver
  mailbox: mailbox-test: add support for separate tx/rx buffer with single channel
  mailbox: mailbox-test: use print_hex_dump_bytes to allow dynamic printk
  mailbox: mailbox-test: fix the compatible string
  mailbox: mailbox-test: rename driver as generic test driver
  Documentation: mailbox: Add APM X-Gene SLIMpro mailbox dts documentation
  mailbox: Add support for APM X-Gene platform mailbox driver

Pull Xtensa updates from Chris Zankel:
 "Xtensa improvements for 4.6:

   - control whether perf IRQ is treated as NMI from Kconfig
   - implement ioremap for regions outside KIO segment
   - fix ISS serial port behaviour when EOF is reached
   - fix preemption in {clear,copy}_user_highpage
   - fix endianness issues for XTFPGA devices, big-endian cores are now
     fully functional
   - clean up debug infrastructure and add support for hardware
     breakpoints and watchpoints
   - add processor configurations for Three Core HiFi-2 MX and HiFi3
     cpus"

* tag 'xtensa-next-20160320' of git://github.com/czankel/xtensa-linux:
  xtensa: add test_kc705_hifi variant
  xtensa: add Three Core HiFi-2 MX Variant.
  xtensa: support hardware breakpoints/watchpoints
  xtensa: use context structure for debug exceptions
  xtensa: remove remaining non-functional KGDB bits
  xtensa: clear all DBREAKC registers on start
  xtensa: xtfpga: fix earlycon endianness
  xtensa: xtfpga: fix i2c controller register width and endianness
  xtensa: xtfpga: fix ethernet controller endianness
  xtensa: xtfpga: fix serial port register width and endianness
  xtensa: define CONFIG_CPU_{BIG,LITTLE}_ENDIAN
  xtensa: fix preemption in {clear,copy}_user_highpage
  xtensa: ISS: don't hang if stdin EOF is reached
  xtensa: support ioremap for memory outside KIO region
  xtensa: use XTENSA_INT_LEVEL macro in asm/timex.h
  xtensa: make fake NMI configurable

Pull watchdog updates from Wim Van Sebroeck:

 - new drivers for: NI 903x/913x watchdog driver, WinSystems EBC-C384
   watchdog timer and ARM SBSA watchdog driver

 - Support for NCT6102D devices

 - Improvements of the generic watchdog framework (improve restart
   handler, make set_timeout optional, introduce infrastructure
   triggered keepalives, ...

 - improvements on the pnx4008 watchdog driver

 - several smaller fixes and improvements

* git://www.linux-watchdog.org/linux-watchdog: (28 commits)
  watchdog: Ensure that wdd is not dereferenced if NULL
  watchdog: imx2: Convert to use infrastructure triggered keepalives
  watchdog: dw_wdt: Convert to use watchdog infrastructure
  watchdog: Add support for minimum time between heartbeats
  watchdog: Make stop function optional
  watchdog: Introduce WDOG_HW_RUNNING flag
  watchdog: Introduce hardware maximum heartbeat in watchdog core
  watchdog: Make set_timeout function optional
  arm: lpc32xx: remove restart handler
  arm: lpc32xx: phy3250 remove restart hook
  watchdog: pnx4008: restart: support "cmd" from userspace
  watchdog: pnx4008: add support for soft reset
  watchdog: pnx4008: add restart handler
  watchdog: pnx4008: update logging during power-on
  watchdog: tangox_wdt: test clock rate to avoid division by 0
  watchdog: atlas7_wdt: test clock rate to avoid division by 0
  watchdog: s3c2410_wdt: Add max and min timeout values
  Watchdog: introduce ARM SBSA watchdog driver
  Documentation: add sbsa-gwdt driver documentation
  watchdog: Add watchdog timer support for the WinSystems EBC-C384
  ...

Pull firewire updates from Stefan Richter:
 "IEEE 1394 subsystem patches:

   - move away from outmoded timekeeping API
   - error reporting fix
   - documentation bits"

* tag 'firewire-updates' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
  firewire: ABI documentation: libhinawa uses firewire-cdev
  firewire: ABI documentation: jujuutils were renamed to linux-firewire-utils
  firewire: ohci: propagate return code from soft_reset to probe and resume
  firewire: nosy: Replace timeval with timespec64

Pull vfs updates from Al Viro:

 - Preparations of parallel lookups (the remaining main obstacle is the
   need to move security_d_instantiate(); once that becomes safe, the
   rest will be a matter of rather short series local to fs/*.c

 - preadv2/pwritev2 series from Christoph

 - assorted fixes

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (32 commits)
  splice: handle zero nr_pages in splice_to_pipe()
  vfs: show_vfsstat: do not ignore errors from show_devname method
  dcache.c: new helper: __d_add()
  don't bother with __d_instantiate(dentry, NULL)
  untangle fsnotify_d_instantiate() a bit
  uninline d_add()
  replace d_add_unique() with saner primitive
  quota: use lookup_one_len_unlocked()
  cifs_get_root(): use lookup_one_len_unlocked()
  nfs_lookup: don't bother with d_instantiate(dentry, NULL)
  kill dentry_unhash()
  ceph_fill_trace(): don't bother with d_instantiate(dn, NULL)
  autofs4: don't bother with d_instantiate(dentry, NULL) in ->lookup()
  configfs: move d_rehash() into configfs_create() for regular files
  ceph: don't bother with d_rehash() in splice_dentry()
  namei: teach lookup_slow() to skip revalidate
  namei: massage lookup_slow() to be usable by lookup_one_len_unlocked()
  lookup_one_len_unlocked(): use lookup_dcache()
  namei: simplify invalidation logics in lookup_dcache()
  namei: change calling conventions for lookup_{fast,slow} and follow_managed()
  ...

Pull audit updates from Paul Moore:
 "A small set of patches for audit this time; just three in total and
  one is a spelling fix.

  The two patches with actual content are designed to help prevent new
  instances of auditd from displacing an existing, functioning auditd
  and to generate a log of the attempt.  Not to worry, dead/stuck auditd
  instances can still be replaced by a new instance without problem.

  Nothing controversial, and everything passes our regression suite"

* 'stable-4.6' of git://git.infradead.org/users/pcmoore/audit:
  audit: Fix typo in comment
  audit: log failed attempts to change audit_pid configuration
  audit: stop an old auditd being starved out by a new auditd

Pull ARM updates from Russell King:
 "Another mixture of changes this time around:

   - Split XIP linker file from main linker file to make it more
     maintainable, and various XIP fixes, and clean up a resulting
     macro.

   - Decompressor cleanups from Masahiro Yamada

   - Avoid printing an error for a missing L2 cache

   - Remove some duplicated symbols in System.map, and move
     vectors/stubs back into kernel VMA

   - Various low priority fixes from Arnd

   - Updates to allow bus match functions to return negative errno
     values, touching some drivers and the driver core.  Greg has acked
     these changes.

   - Virtualisation platform udpates form Jean-Philippe Brucker.

   - Security enhancements from Kees Cook

   - Rework some Kconfig dependencies and move PSCI idle management code
     out of arch/arm into drivers/firmware/psci.c

   - ARM DMA mapping updates, touching media, acked by Mauro.

   - Fix places in ARM code which should be using virt_to_idmap() so
     that Keystone2 can work.

   - Fix Marvell Tauros2 to work again with non-DT boots.

   - Provide a delay timer for ARM Orion platforms"

* 'for-linus' of git://ftp.arm.linux.org.uk/~rmk/linux-arm: (45 commits)
  ARM: 8546/1: dma-mapping: refactor to fix coherent+cma+gfp=0
  ARM: 8547/1: dma-mapping: store buffer information
  ARM: 8543/1: decompressor: rename suffix_y to compress-y
  ARM: 8542/1: decompressor: merge piggy.*.S and simplify Makefile
  ARM: 8541/1: decompressor: drop redundant FORCE in Makefile
  ARM: 8540/1: decompressor: use clean-files instead of extra-y to clean files
  ARM: 8539/1: decompressor: drop more unneeded assignments to "targets"
  ARM: 8538/1: decompressor: drop unneeded assignments to "targets"
  ARM: 8532/1: uncompress: mark putc as inline
  ARM: 8531/1: turn init_new_context into an inline function
  ARM: 8530/1: remove VIRT_TO_BUS
  ARM: 8537/1: drop unused DEBUG_RODATA from XIP_KERNEL
  ARM: 8536/1: mm: hide __start_rodata_section_aligned for non-debug builds
  ARM: 8535/1: mm: DEBUG_RODATA makes no sense with XIP_KERNEL
  ARM: 8534/1: virt: fix hyp-stub build for pre-ARMv7 CPUs
  ARM: make the physical-relative calculation more obvious
  ARM: 8512/1: proc-v7.S: Adjust stack address when XIP_KERNEL
  ARM: 8411/1: Add default SPARSEMEM settings
  ARM: 8503/1: clk_register_clkdev: remove format string interface
  ARM: 8529/1: remove 'i' and 'zi' targets
  ...

Pull arch/sh updates from Rich Felker:
 "This includes minor cleanups, a fix for a crash that likely affects
  all sh models with MMU, and introduction of a framework for boards
  described by device tree, which sets the stage for future J2 support"

* tag 'tag-sh-for-4.6' of git://git.libc.org/linux-sh:
  sched/preempt, sh: kmap_coherent relies on disabled preemption
  sh: add SMP method selection to device tree pseudo-board
  sh: add device tree support and generic board using device tree
  sh: remove arch-specific localtimer and use generic one
  sh: make MMU-specific SMP code conditional on CONFIG_MMU
  sh: provide unified syscall trap compatible with all SH models
  sh: New gcc support
  sh: Disable trace for kernel uncompressing.
  sh: Use generic clkdev.h header

Pull powerpc updates from Michael Ellerman:
 "This was delayed a day or two by some build-breakage on old toolchains
  which we've now fixed.

  There's two PCI commits both acked by Bjorn.

  There's one commit to mm/hugepage.c which is (co)authored by Kirill.

  Highlights:
   - Restructure Linux PTE on Book3S/64 to Radix format from Paul
     Mackerras
   - Book3s 64 MMU cleanup in preparation for Radix MMU from Aneesh
     Kumar K.V
   - Add POWER9 cputable entry from Michael Neuling
   - FPU/Altivec/VSX save/restore optimisations from Cyril Bur
   - Add support for new ftrace ABI on ppc64le from Torsten Duwe

  Various cleanups & minor fixes from:
   - Adam Buchbinder, Andrew Donnellan, Balbir Singh, Christophe Leroy,
     Cyril Bur, Luis Henriques, Madhavan Srinivasan, Pan Xinhui, Russell
     Currey, Sukadev Bhattiprolu, Suraj Jitindar Singh.

  General:
   - atomics: Allow architectures to define their own __atomic_op_*
     helpers from Boqun Feng
   - Implement atomic{, 64}_*_return_* variants and acquire/release/
     relaxed variants for (cmp)xchg from Boqun Feng
   - Add powernv_defconfig from Jeremy Kerr
   - Fix BUG_ON() reporting in real mode from Balbir Singh
   - Add xmon command to dump OPAL msglog from Andrew Donnellan
   - Add xmon command to dump process/task similar to ps(1) from Douglas
     Miller
   - Clean up memory hotplug failure paths from David Gibson

  pci/eeh:
   - Redesign SR-IOV on PowerNV to give absolute isolation between VFs
     from Wei Yang.
   - EEH Support for SRIOV VFs from Wei Yang and Gavin Shan.
   - PCI/IOV: Rename and export virtfn_{add, remove} from Wei Yang
   - PCI: Add pcibios_bus_add_device() weak function from Wei Yang
   - MAINTAINERS: Update EEH details and maintainership from Russell
     Currey

  cxl:
   - Support added to the CXL driver for running on both bare-metal and
     hypervisor systems, from Christophe Lombard and Frederic Barrat.
   - Ignore probes for virtual afu pci devices from Vaibhav Jain

  perf:
   - Export Power8 generic and cache events to sysfs from Sukadev
     Bhattiprolu
   - hv-24x7: Fix usage with chip events, display change in counter
     values, display domain indices in sysfs, eliminate domain suffix in
     event names, from Sukadev Bhattiprolu

  Freescale:
   - Updates from Scott: "Highlights include 8xx optimizations, 32-bit
     checksum optimizations, 86xx consolidation, e5500/e6500 cpu
     hotplug, more fman and other dt bits, and minor fixes/cleanup"

* tag 'powerpc-4.6-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (179 commits)
  powerpc: Fix unrecoverable SLB miss during restore_math()
  powerpc/8xx: Fix do_mtspr_cpu6() build on older compilers
  powerpc/rcpm: Fix build break when SMP=n
  powerpc/book3e-64: Use hardcoded mttmr opcode
  powerpc/fsl/dts: Add "jedec,spi-nor" flash compatible
  powerpc/T104xRDB: add tdm riser card node to device tree
  powerpc32: PAGE_EXEC required for inittext
  powerpc/mpc85xx: Add pcsphy nodes to FManV3 device tree
  powerpc/mpc85xx: Add MDIO bus muxing support to the board device tree(s)
  powerpc/86xx: Introduce and use common dtsi
  powerpc/86xx: Update device tree
  powerpc/86xx: Move dts files to fsl directory
  powerpc/86xx: Switch to kconfig fragments approach
  powerpc/86xx: Update defconfigs
  powerpc/86xx: Consolidate common platform code
  powerpc32: Remove one insn in mulhdu
  powerpc32: small optimisation in flush_icache_range()
  powerpc: Simplify test in __dma_sync()
  powerpc32: move xxxxx_dcache_range() functions inline
  powerpc32: Remove clear_pages() and define clear_page() inline
  ...