kernel: bump 4.9 to 4.9.117 for 18.06

* Refreshed patches.
* Removed patches:
  - target/linux/ar71xx/patches-4.9/103-MIPS-ath79-fix-register-address-in-ath79_ddr_wb_flus.patch superseded by upstream
  - target/linux/ar71xx/patches-4.9/403-mtd_fix_cfi_cmdset_0002_status_check.patch superseded by upstream
  - target/linux/brcm63xx/patches-4.9/001-4.11-01-mtd-m25p80-consider-max-message-size-in-m25p80_read.patch accepted upstream
  - target/linux/brcm63xx/patches-4.9/001-4.15-08-bcm63xx_enet-correct-clock-usage.patch accepted upstream
  - target/linux/brcm63xx/patches-4.9/001-4.15-09-bcm63xx_enet-do-not-write-to-random-DMA-channel-on-B.patch accepted upstream
  - target/linux/generic/pending-4.9/900-gen_stats-fix-netlink-stats-padding.patch

* New backported patch to address ext4 breakage, introduced in 4.9.112:
  - backport-4.9/500-ext4-fix-check-to-prevent-initializing-reserved-inod.patch

Also add ARM64_SSBD symbol to ARM64 targets still running kernel 4.9

Thanks to Koen Vandeputte for pointing out the need to add the ARM64_SSBD symbol, and the ext4 patch.

Compile-tested on: ar71xx
Run-tested on: ar71xx

Signed-off-by: Stijn Segers <foss@volatilesystems.org>

26 files changed, 118 insertions, 102 deletions

diff --git a/target/linux/generic/backport-4.9/024-1-tcp-tsq-add-tsq_flags-tsq_enum.patch b/target/linux/generic/backport-4.9/024-1-tcp-tsq-add-tsq_flags-tsq_enum.patch
index 7bf4fd47d2..172e714c5d 100644
--- a/target/linux/generic/backport-4.9/024-1-tcp-tsq-add-tsq_flags-tsq_enum.patch
+++ b/target/linux/generic/backport-4.9/024-1-tcp-tsq-add-tsq_flags-tsq_enum.patch
@@ -45,7 +45,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	return (struct tcp_sock *)sk;
 --- a/net/ipv4/tcp_output.c
 +++ b/net/ipv4/tcp_output.c
-@@ -784,10 +784,10 @@ static void tcp_tasklet_func(unsigned lo
+@@ -789,10 +789,10 @@ static void tcp_tasklet_func(unsigned lo
  	}
  }
  
@@ -60,7 +60,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  /**
   * tcp_release_cb - tcp release_sock() callback
   * @sk: socket
-@@ -808,7 +808,7 @@ void tcp_release_cb(struct sock *sk)
+@@ -813,7 +813,7 @@ void tcp_release_cb(struct sock *sk)
  		nflags = flags & ~TCP_DEFERRED_ALL;
  	} while (cmpxchg(&tp->tsq_flags, flags, nflags) != flags);
  
@@ -69,7 +69,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		tcp_tsq_handler(sk);
  
  	/* Here begins the tricky part :
-@@ -822,15 +822,15 @@ void tcp_release_cb(struct sock *sk)
+@@ -827,15 +827,15 @@ void tcp_release_cb(struct sock *sk)
  	 */
  	sock_release_ownership(sk);
  
diff --git a/target/linux/generic/backport-4.9/024-2-tcp-tsq-remove-one-locked-operation-in-tcp_wfree.patch b/target/linux/generic/backport-4.9/024-2-tcp-tsq-remove-one-locked-operation-in-tcp_wfree.patch
index 914be607e7..af194b2bed 100644
--- a/target/linux/generic/backport-4.9/024-2-tcp-tsq-remove-one-locked-operation-in-tcp_wfree.patch
+++ b/target/linux/generic/backport-4.9/024-2-tcp-tsq-remove-one-locked-operation-in-tcp_wfree.patch
@@ -17,7 +17,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/net/ipv4/tcp_output.c
 +++ b/net/ipv4/tcp_output.c
-@@ -860,6 +860,7 @@ void tcp_wfree(struct sk_buff *skb)
+@@ -865,6 +865,7 @@ void tcp_wfree(struct sk_buff *skb)
  {
  	struct sock *sk = skb->sk;
  	struct tcp_sock *tp = tcp_sk(sk);
@@ -25,7 +25,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	int wmem;
  
  	/* Keep one reference on sk_wmem_alloc.
-@@ -877,11 +878,17 @@ void tcp_wfree(struct sk_buff *skb)
+@@ -882,11 +883,17 @@ void tcp_wfree(struct sk_buff *skb)
  	if (wmem >= SKB_TRUESIZE(1) && this_cpu_ksoftirqd() == current)
  		goto out;
  
diff --git a/target/linux/generic/backport-4.9/024-3-tcp-tsq-add-shortcut-in-tcp_tasklet_func.patch b/target/linux/generic/backport-4.9/024-3-tcp-tsq-add-shortcut-in-tcp_tasklet_func.patch
index f5004d3ffc..b9b3c55076 100644
--- a/target/linux/generic/backport-4.9/024-3-tcp-tsq-add-shortcut-in-tcp_tasklet_func.patch
+++ b/target/linux/generic/backport-4.9/024-3-tcp-tsq-add-shortcut-in-tcp_tasklet_func.patch
@@ -22,7 +22,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/net/ipv4/tcp_output.c
 +++ b/net/ipv4/tcp_output.c
-@@ -767,19 +767,19 @@ static void tcp_tasklet_func(unsigned lo
+@@ -772,19 +772,19 @@ static void tcp_tasklet_func(unsigned lo
  	list_for_each_safe(q, n, &list) {
  		tp = list_entry(q, struct tcp_sock, tsq_node);
  		list_del(&tp->tsq_node);
@@ -51,7 +51,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		sk_free(sk);
  	}
  }
-@@ -884,7 +884,7 @@ void tcp_wfree(struct sk_buff *skb)
+@@ -889,7 +889,7 @@ void tcp_wfree(struct sk_buff *skb)
  		if (!(oval & TSQF_THROTTLED) || (oval & TSQF_QUEUED))
  			goto out;
  
@@ -60,7 +60,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		nval = cmpxchg(&tp->tsq_flags, oval, nval);
  		if (nval != oval)
  			continue;
-@@ -2210,6 +2210,8 @@ static bool tcp_write_xmit(struct sock *
+@@ -2222,6 +2222,8 @@ static bool tcp_write_xmit(struct sock *
  		    unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))
  			break;
  
diff --git a/target/linux/generic/backport-4.9/024-4-tcp-tsq-avoid-one-atomic-in-tcp_wfree.patch b/target/linux/generic/backport-4.9/024-4-tcp-tsq-avoid-one-atomic-in-tcp_wfree.patch
index a25cdb5717..87452ac853 100644
--- a/target/linux/generic/backport-4.9/024-4-tcp-tsq-avoid-one-atomic-in-tcp_wfree.patch
+++ b/target/linux/generic/backport-4.9/024-4-tcp-tsq-avoid-one-atomic-in-tcp_wfree.patch
@@ -16,7 +16,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/net/ipv4/tcp_output.c
 +++ b/net/ipv4/tcp_output.c
-@@ -880,6 +880,7 @@ void tcp_wfree(struct sk_buff *skb)
+@@ -885,6 +885,7 @@ void tcp_wfree(struct sk_buff *skb)
  
  	for (oval = READ_ONCE(tp->tsq_flags);; oval = nval) {
  		struct tsq_tasklet *tsq;
@@ -24,7 +24,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  		if (!(oval & TSQF_THROTTLED) || (oval & TSQF_QUEUED))
  			goto out;
-@@ -892,8 +893,10 @@ void tcp_wfree(struct sk_buff *skb)
+@@ -897,8 +898,10 @@ void tcp_wfree(struct sk_buff *skb)
  		/* queue this socket to tasklet queue */
  		local_irq_save(flags);
  		tsq = this_cpu_ptr(&tsq_tasklet);
diff --git a/target/linux/generic/backport-4.9/024-5-tcp-tsq-add-a-shortcut-in-tcp_small_queue_check.patch b/target/linux/generic/backport-4.9/024-5-tcp-tsq-add-a-shortcut-in-tcp_small_queue_check.patch
index 65013b6aa7..d04e365f98 100644
--- a/target/linux/generic/backport-4.9/024-5-tcp-tsq-add-a-shortcut-in-tcp_small_queue_check.patch
+++ b/target/linux/generic/backport-4.9/024-5-tcp-tsq-add-a-shortcut-in-tcp_small_queue_check.patch
@@ -19,7 +19,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/net/ipv4/tcp_output.c
 +++ b/net/ipv4/tcp_output.c
-@@ -2115,6 +2115,15 @@ static bool tcp_small_queue_check(struct
+@@ -2127,6 +2127,15 @@ static bool tcp_small_queue_check(struct
  	limit <<= factor;
  
  	if (atomic_read(&sk->sk_wmem_alloc) > limit) {
diff --git a/target/linux/generic/backport-4.9/024-6-tcp-tcp_mtu_probe-is-likely-to-exit-early.patch b/target/linux/generic/backport-4.9/024-6-tcp-tcp_mtu_probe-is-likely-to-exit-early.patch
index 6f2d196687..2a6cd40c8a 100644
--- a/target/linux/generic/backport-4.9/024-6-tcp-tcp_mtu_probe-is-likely-to-exit-early.patch
+++ b/target/linux/generic/backport-4.9/024-6-tcp-tcp_mtu_probe-is-likely-to-exit-early.patch
@@ -17,7 +17,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/net/ipv4/tcp_output.c
 +++ b/net/ipv4/tcp_output.c
-@@ -1948,26 +1948,26 @@ static bool tcp_can_coalesce_send_queue_
+@@ -1960,26 +1960,26 @@ static bool tcp_can_coalesce_send_queue_
   */
  static int tcp_mtu_probe(struct sock *sk)
  {
diff --git a/target/linux/generic/backport-4.9/024-8-tcp-tsq-move-tsq_flags-close-to-sk_wmem_alloc.patch b/target/linux/generic/backport-4.9/024-8-tcp-tsq-move-tsq_flags-close-to-sk_wmem_alloc.patch
index 292b381f8d..0a5b9ead9d 100644
--- a/target/linux/generic/backport-4.9/024-8-tcp-tsq-move-tsq_flags-close-to-sk_wmem_alloc.patch
+++ b/target/linux/generic/backport-4.9/024-8-tcp-tsq-move-tsq_flags-close-to-sk_wmem_alloc.patch
@@ -58,7 +58,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			goto out;
 --- a/net/ipv4/tcp_output.c
 +++ b/net/ipv4/tcp_output.c
-@@ -767,14 +767,15 @@ static void tcp_tasklet_func(unsigned lo
+@@ -772,14 +772,15 @@ static void tcp_tasklet_func(unsigned lo
  	list_for_each_safe(q, n, &list) {
  		tp = list_entry(q, struct tcp_sock, tsq_node);
  		list_del(&tp->tsq_node);
@@ -77,7 +77,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  				tcp_tsq_handler(sk);
  			}
  			bh_unlock_sock(sk);
-@@ -797,16 +798,15 @@ static void tcp_tasklet_func(unsigned lo
+@@ -802,16 +803,15 @@ static void tcp_tasklet_func(unsigned lo
   */
  void tcp_release_cb(struct sock *sk)
  {
@@ -96,7 +96,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	if (flags & TCPF_TSQ_DEFERRED)
  		tcp_tsq_handler(sk);
-@@ -878,7 +878,7 @@ void tcp_wfree(struct sk_buff *skb)
+@@ -883,7 +883,7 @@ void tcp_wfree(struct sk_buff *skb)
  	if (wmem >= SKB_TRUESIZE(1) && this_cpu_ksoftirqd() == current)
  		goto out;
  
@@ -105,7 +105,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		struct tsq_tasklet *tsq;
  		bool empty;
  
-@@ -886,7 +886,7 @@ void tcp_wfree(struct sk_buff *skb)
+@@ -891,7 +891,7 @@ void tcp_wfree(struct sk_buff *skb)
  			goto out;
  
  		nval = (oval & ~TSQF_THROTTLED) | TSQF_QUEUED | TCPF_TSQ_DEFERRED;
@@ -114,7 +114,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		if (nval != oval)
  			continue;
  
-@@ -2124,7 +2124,7 @@ static bool tcp_small_queue_check(struct
+@@ -2136,7 +2136,7 @@ static bool tcp_small_queue_check(struct
  		    skb->prev == sk->sk_write_queue.next)
  			return false;
  
@@ -123,7 +123,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		/* It is possible TX completion already happened
  		 * before we set TSQ_THROTTLED, so we must
  		 * test again the condition.
-@@ -2222,8 +2222,8 @@ static bool tcp_write_xmit(struct sock *
+@@ -2234,8 +2234,8 @@ static bool tcp_write_xmit(struct sock *
  		    unlikely(tso_fragment(sk, skb, limit, mss_now, gfp)))
  			break;
  
@@ -134,7 +134,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		if (tcp_small_queue_check(sk, skb, 0))
  			break;
  
-@@ -3534,8 +3534,6 @@ void tcp_send_ack(struct sock *sk)
+@@ -3546,8 +3546,6 @@ void __tcp_send_ack(struct sock *sk, u32
  	/* We do not want pure acks influencing TCP Small Queues or fq/pacing
  	 * too much.
  	 * SKB_TRUESIZE(max(1 .. 66, MAX_TCP_HEADER)) is unfortunately ~784
diff --git a/target/linux/generic/backport-4.9/024-9-tcp-add-a-missing-barrier-in-tcp_tasklet_func.patch b/target/linux/generic/backport-4.9/024-9-tcp-add-a-missing-barrier-in-tcp_tasklet_func.patch
index d2b8de6a04..bd74303266 100644
--- a/target/linux/generic/backport-4.9/024-9-tcp-add-a-missing-barrier-in-tcp_tasklet_func.patch
+++ b/target/linux/generic/backport-4.9/024-9-tcp-add-a-missing-barrier-in-tcp_tasklet_func.patch
@@ -30,7 +30,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/net/ipv4/tcp_output.c
 +++ b/net/ipv4/tcp_output.c
-@@ -769,6 +769,7 @@ static void tcp_tasklet_func(unsigned lo
+@@ -774,6 +774,7 @@ static void tcp_tasklet_func(unsigned lo
  		list_del(&tp->tsq_node);
  
  		sk = (struct sock *)tp;
diff --git a/target/linux/generic/backport-4.9/025-tcp-allow-drivers-to-tweak-TSQ-logic.patch b/target/linux/generic/backport-4.9/025-tcp-allow-drivers-to-tweak-TSQ-logic.patch
index 33593194d5..be3140bb9c 100644
--- a/target/linux/generic/backport-4.9/025-tcp-allow-drivers-to-tweak-TSQ-logic.patch
+++ b/target/linux/generic/backport-4.9/025-tcp-allow-drivers-to-tweak-TSQ-logic.patch
@@ -65,7 +65,7 @@ Cc: Kir Kolyshkin <kir@openvz.org>
  	 * Before updating sk_refcnt, we must commit prior changes to memory
 --- a/net/ipv4/tcp_output.c
 +++ b/net/ipv4/tcp_output.c
-@@ -1581,7 +1581,7 @@ u32 tcp_tso_autosize(const struct sock *
+@@ -1593,7 +1593,7 @@ u32 tcp_tso_autosize(const struct sock *
  {
  	u32 bytes, segs;
  
@@ -74,7 +74,7 @@ Cc: Kir Kolyshkin <kir@openvz.org>
  		    sk->sk_gso_max_size - 1 - MAX_TCP_HEADER);
  
  	/* Goal is to send at least one packet per ms,
-@@ -2111,7 +2111,7 @@ static bool tcp_small_queue_check(struct
+@@ -2123,7 +2123,7 @@ static bool tcp_small_queue_check(struct
  {
  	unsigned int limit;
  
diff --git a/target/linux/generic/backport-4.9/040-mm-add-support-for-releasing-multiple-instances-of-a.patch b/target/linux/generic/backport-4.9/040-mm-add-support-for-releasing-multiple-instances-of-a.patch
index 84714ce1e1..7a971169bc 100644
--- a/target/linux/generic/backport-4.9/040-mm-add-support-for-releasing-multiple-instances-of-a.patch
+++ b/target/linux/generic/backport-4.9/040-mm-add-support-for-releasing-multiple-instances-of-a.patch
@@ -52,7 +52,7 @@ Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  extern void __free_page_frag(void *addr);
 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
-@@ -3946,6 +3946,20 @@ static struct page *__page_frag_refill(s
+@@ -3945,6 +3945,20 @@ static struct page *__page_frag_refill(s
  	return page;
  }
  
diff --git a/target/linux/generic/backport-4.9/041-mm-rename-__alloc_page_frag-to-page_frag_alloc-and-_.patch b/target/linux/generic/backport-4.9/041-mm-rename-__alloc_page_frag-to-page_frag_alloc-and-_.patch
index 896ba415fe..fbd3316016 100644
--- a/target/linux/generic/backport-4.9/041-mm-rename-__alloc_page_frag-to-page_frag_alloc-and-_.patch
+++ b/target/linux/generic/backport-4.9/041-mm-rename-__alloc_page_frag-to-page_frag_alloc-and-_.patch
@@ -63,7 +63,7 @@ Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  void *napi_alloc_frag(unsigned int fragsz);
 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
-@@ -3960,8 +3960,8 @@ void __page_frag_drain(struct page *page
+@@ -3959,8 +3959,8 @@ void __page_frag_drain(struct page *page
  }
  EXPORT_SYMBOL(__page_frag_drain);
  
@@ -74,7 +74,7 @@ Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  {
  	unsigned int size = PAGE_SIZE;
  	struct page *page;
-@@ -4012,19 +4012,19 @@ refill:
+@@ -4011,19 +4011,19 @@ refill:
  
  	return nc->va + offset;
  }
diff --git a/target/linux/generic/backport-4.9/042-mm-rename-__page_frag-functions-to-__page_frag_cache.patch b/target/linux/generic/backport-4.9/042-mm-rename-__page_frag-functions-to-__page_frag_cache.patch
index 117b01d504..64fdc7606c 100644
--- a/target/linux/generic/backport-4.9/042-mm-rename-__page_frag-functions-to-__page_frag_cache.patch
+++ b/target/linux/generic/backport-4.9/042-mm-rename-__page_frag-functions-to-__page_frag_cache.patch
@@ -33,7 +33,7 @@ Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  extern void page_frag_free(void *addr);
 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
-@@ -3925,8 +3925,8 @@ EXPORT_SYMBOL(free_pages);
+@@ -3924,8 +3924,8 @@ EXPORT_SYMBOL(free_pages);
   * drivers to provide a backing region of memory for use as either an
   * sk_buff->head, or to be used in the "frags" portion of skb_shared_info.
   */
@@ -44,7 +44,7 @@ Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  {
  	struct page *page = NULL;
  	gfp_t gfp = gfp_mask;
-@@ -3946,19 +3946,20 @@ static struct page *__page_frag_refill(s
+@@ -3945,19 +3945,20 @@ static struct page *__page_frag_refill(s
  	return page;
  }
  
@@ -68,7 +68,7 @@ Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  
  void *page_frag_alloc(struct page_frag_cache *nc,
  		      unsigned int fragsz, gfp_t gfp_mask)
-@@ -3969,7 +3970,7 @@ void *page_frag_alloc(struct page_frag_c
+@@ -3968,7 +3969,7 @@ void *page_frag_alloc(struct page_frag_c
  
  	if (unlikely(!nc->va)) {
  refill:
diff --git a/target/linux/generic/backport-4.9/050-usb-dwc2-Remove-unnecessary-kfree.patch b/target/linux/generic/backport-4.9/050-usb-dwc2-Remove-unnecessary-kfree.patch
index 69aaa9f84d..346eba9221 100644
--- a/target/linux/generic/backport-4.9/050-usb-dwc2-Remove-unnecessary-kfree.patch
+++ b/target/linux/generic/backport-4.9/050-usb-dwc2-Remove-unnecessary-kfree.patch
@@ -14,7 +14,7 @@ Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
 
 --- a/drivers/usb/dwc2/hcd.c
 +++ b/drivers/usb/dwc2/hcd.c
-@@ -5200,7 +5200,6 @@ error3:
+@@ -5202,7 +5202,6 @@ error3:
  error2:
  	usb_put_hcd(hcd);
  error1:
diff --git a/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch b/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch
index 5c0388ed0f..00f9339abe 100644
--- a/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch
+++ b/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch
@@ -214,14 +214,14 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  				   RCANFD_RFCC_RFIE);
 --- a/drivers/net/can/xilinx_can.c
 +++ b/drivers/net/can/xilinx_can.c
-@@ -726,7 +726,7 @@ static int xcan_rx_poll(struct napi_stru
- 		can_led_event(ndev, CAN_LED_EVENT_RX);
+@@ -838,7 +838,7 @@ static int xcan_rx_poll(struct napi_stru
+ 	}
  
  	if (work_done < quota) {
 -		napi_complete(napi);
 +		napi_complete_done(napi, work_done);
  		ier = priv->read_reg(priv, XCAN_IER_OFFSET);
- 		ier |= (XCAN_IXR_RXOK_MASK | XCAN_IXR_RXNEMP_MASK);
+ 		ier |= XCAN_IXR_RXNEMP_MASK;
  		priv->write_reg(priv, XCAN_IER_OFFSET, ier);
 --- a/drivers/net/ethernet/3com/typhoon.c
 +++ b/drivers/net/ethernet/3com/typhoon.c
@@ -1117,7 +1117,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	return work_done;
 --- a/drivers/net/ethernet/sun/sungem.c
 +++ b/drivers/net/ethernet/sun/sungem.c
-@@ -922,7 +922,7 @@ static int gem_poll(struct napi_struct *
+@@ -924,7 +924,7 @@ static int gem_poll(struct napi_struct *
  		gp->status = readl(gp->regs + GREG_STAT);
  	} while (gp->status & GREG_STAT_NAPI);
  
diff --git a/target/linux/generic/backport-4.9/500-ext4-fix-check-to-prevent-initializing-reserved-inod.patch b/target/linux/generic/backport-4.9/500-ext4-fix-check-to-prevent-initializing-reserved-inod.patch
new file mode 100644
index 0000000000..914dddf726
--- /dev/null
+++ b/target/linux/generic/backport-4.9/500-ext4-fix-check-to-prevent-initializing-reserved-inod.patch
@@ -0,0 +1,65 @@
+From 5012284700775a4e6e3fbe7eac4c543c4874b559 Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Sat, 28 Jul 2018 08:12:04 -0400
+Subject: [PATCH] ext4: fix check to prevent initializing reserved inodes
+
+Commit 8844618d8aa7: "ext4: only look at the bg_flags field if it is
+valid" will complain if block group zero does not have the
+EXT4_BG_INODE_ZEROED flag set.  Unfortunately, this is not correct,
+since a freshly created file system has this flag cleared.  It gets
+almost immediately after the file system is mounted read-write --- but
+the following somewhat unlikely sequence will end up triggering a
+false positive report of a corrupted file system:
+
+   mkfs.ext4 /dev/vdc
+   mount -o ro /dev/vdc /vdc
+   mount -o remount,rw /dev/vdc
+
+Instead, when initializing the inode table for block group zero, test
+to make sure that itable_unused count is not too large, since that is
+the case that will result in some or all of the reserved inodes
+getting cleared.
+
+This fixes the failures reported by Eric Whiteney when running
+generic/230 and generic/231 in the the nojournal test case.
+
+Fixes: 8844618d8aa7 ("ext4: only look at the bg_flags field if it is valid")
+Reported-by: Eric Whitney <enwlinux@gmail.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+---
+ fs/ext4/ialloc.c | 5 ++++-
+ fs/ext4/super.c  | 8 +-------
+ 2 files changed, 5 insertions(+), 8 deletions(-)
+
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -1316,7 +1316,10 @@ int ext4_init_inode_table(struct super_b
+ 			    ext4_itable_unused_count(sb, gdp)),
+ 			    sbi->s_inodes_per_block);
+ 
+-	if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group)) {
++	if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group) ||
++	    ((group == 0) && ((EXT4_INODES_PER_GROUP(sb) -
++			       ext4_itable_unused_count(sb, gdp)) <
++			      EXT4_FIRST_INO(sb)))) {
+ 		ext4_error(sb, "Something is wrong with group %u: "
+ 			   "used itable blocks: %d; "
+ 			   "itable unused count: %u",
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -3031,14 +3031,8 @@ static ext4_group_t ext4_has_uninit_itab
+ 		if (!gdp)
+ 			continue;
+ 
+-		if (gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED))
+-			continue;
+-		if (group != 0)
++		if (!(gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED)))
+ 			break;
+-		ext4_error(sb, "Inode table for bg 0 marked as "
+-			   "needing zeroing");
+-		if (sb->s_flags & MS_RDONLY)
+-			return ngroups;
+ 	}
+ 
+ 	return group;
diff --git a/target/linux/generic/hack-4.9/207-disable-modorder.patch b/target/linux/generic/hack-4.9/207-disable-modorder.patch
index f9b3ac4dcf..1a72c91be2 100644
--- a/target/linux/generic/hack-4.9/207-disable-modorder.patch
+++ b/target/linux/generic/hack-4.9/207-disable-modorder.patch
@@ -15,7 +15,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/Makefile
 +++ b/Makefile
-@@ -1211,7 +1211,6 @@ all: modules
+@@ -1212,7 +1212,6 @@ all: modules
  
  PHONY += modules
  modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
@@ -23,7 +23,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	@$(kecho) '  Building modules, stage 2.';
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.fwinst obj=firmware __fw_modbuild
-@@ -1241,7 +1240,6 @@ _modinst_:
+@@ -1242,7 +1241,6 @@ _modinst_:
  		rm -f $(MODLIB)/build ; \
  		ln -s $(CURDIR) $(MODLIB)/build ; \
  	fi
diff --git a/target/linux/generic/hack-4.9/211-host_tools_portability.patch b/target/linux/generic/hack-4.9/211-host_tools_portability.patch
index e6fd328431..e4d6851418 100644
--- a/target/linux/generic/hack-4.9/211-host_tools_portability.patch
+++ b/target/linux/generic/hack-4.9/211-host_tools_portability.patch
@@ -12,7 +12,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/tools/build/Build.include
 +++ b/tools/build/Build.include
-@@ -95,4 +95,4 @@ cxx_flags = -Wp,-MD,$(depfile),-MT,$@ $(
+@@ -96,4 +96,4 @@ cxx_flags = -Wp,-MD,$(depfile),-MT,$@ $(
  ###
  ## HOSTCC C flags
  
diff --git a/target/linux/generic/hack-4.9/220-gc_sections.patch b/target/linux/generic/hack-4.9/220-gc_sections.patch
index 40e4905db2..a041ff1d03 100644
--- a/target/linux/generic/hack-4.9/220-gc_sections.patch
+++ b/target/linux/generic/hack-4.9/220-gc_sections.patch
@@ -33,9 +33,9 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  # Read KERNELRELEASE from include/config/kernel.release (if it exists)
  KERNELRELEASE = $(shell cat include/config/kernel.release 2> /dev/null)
  KERNELVERSION = $(VERSION)$(if $(PATCHLEVEL),.$(PATCHLEVEL)$(if $(SUBLEVEL),.$(SUBLEVEL)))$(EXTRAVERSION)
-@@ -636,11 +641,6 @@ KBUILD_CFLAGS	+= $(call cc-disable-warni
- KBUILD_CFLAGS	+= $(call cc-disable-warning, format-overflow)
+@@ -637,11 +642,6 @@ KBUILD_CFLAGS	+= $(call cc-disable-warni
  KBUILD_CFLAGS	+= $(call cc-disable-warning, int-in-bool-context)
+ KBUILD_CFLAGS	+= $(call cc-disable-warning, attribute-alias)
  
 -ifdef CONFIG_LD_DEAD_CODE_DATA_ELIMINATION
 -KBUILD_CFLAGS	+= $(call cc-option,-ffunction-sections,)
diff --git a/target/linux/generic/hack-4.9/902-debloat_proc.patch b/target/linux/generic/hack-4.9/902-debloat_proc.patch
index ae2dad61e5..cab7276d29 100644
--- a/target/linux/generic/hack-4.9/902-debloat_proc.patch
+++ b/target/linux/generic/hack-4.9/902-debloat_proc.patch
@@ -232,7 +232,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		return -ENOMEM;
 --- a/mm/vmalloc.c
 +++ b/mm/vmalloc.c
-@@ -2713,6 +2713,8 @@ static const struct file_operations proc
+@@ -2714,6 +2714,8 @@ static const struct file_operations proc
  
  static int __init proc_vmalloc_init(void)
  {
diff --git a/target/linux/generic/pending-4.9/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch b/target/linux/generic/pending-4.9/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch
index adae2e049c..5b886b30fd 100644
--- a/target/linux/generic/pending-4.9/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch
+++ b/target/linux/generic/pending-4.9/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch
@@ -71,7 +71,7 @@ Signed-off-by: Tobias Wolf <dev-NTEO@vplace.de>
 
 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
-@@ -5918,7 +5918,7 @@ static void __ref alloc_node_mem_map(str
+@@ -5932,7 +5932,7 @@ static void __ref alloc_node_mem_map(str
  		mem_map = NODE_DATA(0)->node_mem_map;
  #if defined(CONFIG_HAVE_MEMBLOCK_NODE_MAP) || defined(CONFIG_FLATMEM)
  		if (page_to_pfn(mem_map) != pgdat->node_start_pfn)
diff --git a/target/linux/generic/pending-4.9/201-extra_optimization.patch b/target/linux/generic/pending-4.9/201-extra_optimization.patch
index 2da816e4e0..3e878e96d6 100644
--- a/target/linux/generic/pending-4.9/201-extra_optimization.patch
+++ b/target/linux/generic/pending-4.9/201-extra_optimization.patch
@@ -14,7 +14,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/Makefile
 +++ b/Makefile
-@@ -642,12 +642,12 @@ KBUILD_CFLAGS	+= $(call cc-option,-fdata
+@@ -643,12 +643,12 @@ KBUILD_CFLAGS	+= $(call cc-option,-fdata
  endif
  
  ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
diff --git a/target/linux/generic/pending-4.9/610-netfilter_match_bypass_default_checks.patch b/target/linux/generic/pending-4.9/610-netfilter_match_bypass_default_checks.patch
index 217d20ec5d..d3a6afa804 100644
--- a/target/linux/generic/pending-4.9/610-netfilter_match_bypass_default_checks.patch
+++ b/target/linux/generic/pending-4.9/610-netfilter_match_bypass_default_checks.patch
@@ -68,7 +68,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!xt_percpu_counter_alloc(alloc_state, &e->counters))
  		return -ENOMEM;
  
-@@ -829,6 +857,7 @@ copy_entries_to_user(unsigned int total_
+@@ -830,6 +858,7 @@ copy_entries_to_user(unsigned int total_
  	const struct xt_table_info *private = table->private;
  	int ret = 0;
  	const void *loc_cpu_entry;
@@ -76,7 +76,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	counters = alloc_counters(table);
  	if (IS_ERR(counters))
-@@ -856,6 +885,14 @@ copy_entries_to_user(unsigned int total_
+@@ -857,6 +886,14 @@ copy_entries_to_user(unsigned int total_
  			goto free_counters;
  		}
  
@@ -91,7 +91,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		for (i = sizeof(struct ipt_entry);
  		     i < e->target_offset;
  		     i += m->u.match_size) {
-@@ -1245,12 +1282,15 @@ compat_copy_entry_to_user(struct ipt_ent
+@@ -1246,12 +1283,15 @@ compat_copy_entry_to_user(struct ipt_ent
  	compat_uint_t origsize;
  	const struct xt_entry_match *ematch;
  	int ret = 0;
diff --git a/target/linux/generic/pending-4.9/630-packet_socket_type.patch b/target/linux/generic/pending-4.9/630-packet_socket_type.patch
index 0bf9339d11..08d730ac31 100644
--- a/target/linux/generic/pending-4.9/630-packet_socket_type.patch
+++ b/target/linux/generic/pending-4.9/630-packet_socket_type.patch
@@ -87,7 +87,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!net_eq(dev_net(dev), sock_net(sk)))
  		goto drop;
  
-@@ -3262,6 +3264,7 @@ static int packet_create(struct net *net
+@@ -3260,6 +3262,7 @@ static int packet_create(struct net *net
  	mutex_init(&po->pg_vec_lock);
  	po->rollover = NULL;
  	po->prot_hook.func = packet_rcv;
@@ -95,7 +95,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	if (sock->type == SOCK_PACKET)
  		po->prot_hook.func = packet_rcv_spkt;
-@@ -3875,6 +3878,16 @@ packet_setsockopt(struct socket *sock, i
+@@ -3873,6 +3876,16 @@ packet_setsockopt(struct socket *sock, i
  		po->xmit = val ? packet_direct_xmit : dev_queue_xmit;
  		return 0;
  	}
@@ -112,7 +112,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	default:
  		return -ENOPROTOOPT;
  	}
-@@ -3927,6 +3940,13 @@ static int packet_getsockopt(struct sock
+@@ -3925,6 +3938,13 @@ static int packet_getsockopt(struct sock
  	case PACKET_VNET_HDR:
  		val = po->has_vnet_hdr;
  		break;
diff --git a/target/linux/generic/pending-4.9/834-ledtrig-libata.patch b/target/linux/generic/pending-4.9/834-ledtrig-libata.patch
index 4b319bd399..b2c0b48980 100644
--- a/target/linux/generic/pending-4.9/834-ledtrig-libata.patch
+++ b/target/linux/generic/pending-4.9/834-ledtrig-libata.patch
@@ -65,7 +65,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  /**
   *	ata_build_rw_tf - Build ATA taskfile for given read/write request
   *	@tf: Target ATA taskfile
-@@ -4991,6 +5004,9 @@ struct ata_queued_cmd *ata_qc_new_init(s
+@@ -4994,6 +5007,9 @@ struct ata_queued_cmd *ata_qc_new_init(s
  		if (tag < 0)
  			return NULL;
  	}
@@ -75,7 +75,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  	qc = __ata_qc_from_tag(ap, tag);
  	qc->tag = tag;
-@@ -5892,6 +5908,9 @@ struct ata_port *ata_port_alloc(struct a
+@@ -5895,6 +5911,9 @@ struct ata_port *ata_port_alloc(struct a
  	ap->stats.unhandled_irq = 1;
  	ap->stats.idle_irq = 1;
  #endif
@@ -85,7 +85,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	ata_sff_port_init(ap);
  
  	return ap;
-@@ -5913,6 +5932,12 @@ static void ata_host_release(struct devi
+@@ -5916,6 +5935,12 @@ static void ata_host_release(struct devi
  
  		kfree(ap->pmp_link);
  		kfree(ap->slave_link);
@@ -98,7 +98,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		kfree(ap);
  		host->ports[i] = NULL;
  	}
-@@ -6359,7 +6384,23 @@ int ata_host_register(struct ata_host *h
+@@ -6362,7 +6387,23 @@ int ata_host_register(struct ata_host *h
  		host->ports[i]->print_id = atomic_inc_return(&ata_print_id);
  		host->ports[i]->local_port_no = i + 1;
  	}
@@ -134,7 +134,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  /*
   * Define if arch has non-standard setup.  This is a _PCI_ standard
-@@ -883,6 +886,12 @@ struct ata_port {
+@@ -884,6 +887,12 @@ struct ata_port {
  #ifdef CONFIG_ATA_ACPI
  	struct ata_acpi_gtm	__acpi_init_gtm; /* use ata_acpi_init_gtm() */
  #endif
diff --git a/target/linux/generic/pending-4.9/890-uart_optional_sysrq.patch b/target/linux/generic/pending-4.9/890-uart_optional_sysrq.patch
index 6cb745ee33..ff0824d343 100644
--- a/target/linux/generic/pending-4.9/890-uart_optional_sysrq.patch
+++ b/target/linux/generic/pending-4.9/890-uart_optional_sysrq.patch
@@ -15,7 +15,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/include/linux/serial_core.h
 +++ b/include/linux/serial_core.h
-@@ -455,7 +455,7 @@ extern void uart_handle_cts_change(struc
+@@ -456,7 +456,7 @@ extern void uart_handle_cts_change(struc
  extern void uart_insert_char(struct uart_port *port, unsigned int status,
  		 unsigned int overrun, unsigned int ch, unsigned int flag);
  
diff --git a/target/linux/generic/pending-4.9/900-gen_stats-fix-netlink-stats-padding.patch b/target/linux/generic/pending-4.9/900-gen_stats-fix-netlink-stats-padding.patch
deleted file mode 100644
index f5ceecca93..0000000000
--- a/target/linux/generic/pending-4.9/900-gen_stats-fix-netlink-stats-padding.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-The gen_stats facility will add a header for the toplevel nlattr of type
-TCA_STATS2 that contains all stats added by qdisc callbacks. A reference
-to this header is stored in the gnet_dump struct, and when all the
-per-qdisc callbacks have finished adding their stats, the length of the
-containing header will be adjusted to the right value.
-
-However, on architectures that need padding (i.e., that don't set
-CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), the padding nlattr is added
-before the stats, which means that the stored pointer will point to the
-padding, and so when the header is fixed up, the result is just a very
-big padding nlattr. Because most qdiscs also supply the legacy TCA_STATS
-struct, this problem has been mostly invisible, but we exposed it with
-the netlink attribute-based statistics in CAKE.
-
-Fix the issue by fixing up the stored pointer if it points to a padding
-nlattr.
-
-Tested-by: Pete Heist <pete@heistp.net>
-Tested-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
-Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
----
- net/core/gen_stats.c |   16 ++++++++++++++--
- 1 file changed, 14 insertions(+), 2 deletions(-)
-
---- a/net/core/gen_stats.c
-+++ b/net/core/gen_stats.c
-@@ -77,8 +77,20 @@ gnet_stats_start_copy_compat(struct sk_b
- 		d->lock = lock;
- 		spin_lock_bh(lock);
- 	}
--	if (d->tail)
--		return gnet_stats_copy(d, type, NULL, 0, padattr);
-+	if (d->tail) {
-+		int ret = gnet_stats_copy(d, type, NULL, 0, padattr);
-+
-+		/* The initial attribute added in gnet_stats_copy() may be
-+		 * preceded by a padding attribute, in which case d->tail will
-+		 * end up pointing at the padding instead of the real attribute.
-+		 * Fix this so gnet_stats_finish_copy() adjusts the length of
-+		 * the right attribute.
-+		 */
-+		if (ret == 0 && d->tail->nla_type == padattr)
-+			d->tail = (struct nlattr *)((char *)d->tail +
-+						    NLA_ALIGN(d->tail->nla_len));
-+		return ret;
-+	}
- 
- 	return 0;
- }