kernel: update 4.9 to 4.9.50

Refresh patches.
Compile-tested on ipq8065/nbg6817 and x86/64.
Runtime-tested on ipq8065/nbg6817 and x86/64.

Fixes CVE-2017-1000251.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
[adapt qcom_nandc.c patches to match upstream changes, test ipq8065/nbg6817]
Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>

3 files changed, 65 insertions, 73 deletions

diff --git a/target/linux/ipq806x/patches-4.9/860-qcom-mtd-nand-Add-bam_dma-support-in-qcom_nand-drive.patch b/target/linux/ipq806x/patches-4.9/860-qcom-mtd-nand-Add-bam_dma-support-in-qcom_nand-drive.patch
index 20940514eb..5a3c02c700 100644
--- a/target/linux/ipq806x/patches-4.9/860-qcom-mtd-nand-Add-bam_dma-support-in-qcom_nand-drive.patch
+++ b/target/linux/ipq806x/patches-4.9/860-qcom-mtd-nand-Add-bam_dma-support-in-qcom_nand-drive.patch
@@ -116,7 +116,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  		compatible = "qcom,nandcs";
 --- a/drivers/mtd/nand/qcom_nandc.c
 +++ b/drivers/mtd/nand/qcom_nandc.c
-@@ -226,6 +226,7 @@ struct nandc_regs {
+@@ -234,6 +234,7 @@ struct nandc_regs {
   *				by upper layers directly
   * @buf_size/count/start:	markers for chip->read_buf/write_buf functions
   * @reg_read_buf:		local buffer for reading back registers via DMA
@@ -124,7 +124,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
   * @reg_read_pos:		marker for data read in reg_read_buf
   *
   * @regs:			a contiguous chunk of memory for DMA register
-@@ -234,7 +235,10 @@ struct nandc_regs {
+@@ -242,7 +243,10 @@ struct nandc_regs {
   * @cmd1/vld:			some fixed controller register values
   * @ecc_modes:			supported ECC modes by the current controller,
   *				initialized via DT match data
@@ -136,7 +136,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  struct qcom_nand_controller {
  	struct nand_hw_control controller;
  	struct list_head host_list;
-@@ -247,17 +251,28 @@ struct qcom_nand_controller {
+@@ -255,17 +259,28 @@ struct qcom_nand_controller {
  	struct clk *core_clk;
  	struct clk *aon_clk;
  
@@ -168,7 +168,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	int reg_read_pos;
  
  	struct nandc_regs *regs;
-@@ -316,6 +331,17 @@ struct qcom_nand_host {
+@@ -324,6 +339,17 @@ struct qcom_nand_host {
  	u32 clrreadstatus;
  };
  
@@ -186,16 +186,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  static inline struct qcom_nand_host *to_qcom_nand_host(struct nand_chip *chip)
  {
  	return container_of(chip, struct qcom_nand_host, chip);
-@@ -1893,7 +1919,7 @@ static int qcom_nand_host_setup(struct q
- 				| wide_bus << WIDE_FLASH
- 				| 1 << DEV0_CFG1_ECC_DISABLE;
- 
--	host->ecc_bch_cfg = host->bch_enabled << ECC_CFG_ECC_DISABLE
-+	host->ecc_bch_cfg = !host->bch_enabled << ECC_CFG_ECC_DISABLE
- 				| 0 << ECC_SW_RESET
- 				| host->cw_data << ECC_NUM_DATA_BYTES
- 				| 1 << ECC_FORCE_CLK_OPEN
-@@ -1942,16 +1968,46 @@ static int qcom_nandc_alloc(struct qcom_
+@@ -1949,16 +1975,46 @@ static int qcom_nandc_alloc(struct qcom_
  	if (!nandc->regs)
  		return -ENOMEM;
  
@@ -251,7 +242,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	}
  
  	INIT_LIST_HEAD(&nandc->desc_list);
-@@ -1964,8 +2020,35 @@ static int qcom_nandc_alloc(struct qcom_
+@@ -1971,8 +2027,35 @@ static int qcom_nandc_alloc(struct qcom_
  
  static void qcom_nandc_unalloc(struct qcom_nand_controller *nandc)
  {
@@ -289,7 +280,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  /* one time setup of a few nand controller registers */
  static int qcom_nandc_setup(struct qcom_nand_controller *nandc)
-@@ -2002,6 +2085,8 @@ static int qcom_nand_host_init(struct qc
+@@ -2010,6 +2093,8 @@ static int qcom_nand_host_init(struct qc
  	mtd->name = devm_kasprintf(dev, GFP_KERNEL, "qcom_nand.%d", host->cs);
  	mtd->owner = THIS_MODULE;
  	mtd->dev.parent = dev;
@@ -298,7 +289,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  	chip->cmdfunc		= qcom_nandc_command;
  	chip->select_chip	= qcom_nandc_select_chip;
-@@ -2049,16 +2134,20 @@ static int qcom_nandc_parse_dt(struct pl
+@@ -2057,16 +2142,20 @@ static int qcom_nandc_parse_dt(struct pl
  	struct device_node *np = nandc->dev->of_node;
  	int ret;
  
@@ -328,7 +319,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	}
  
  	return 0;
-@@ -2073,6 +2162,7 @@ static int qcom_nandc_probe(struct platf
+@@ -2081,6 +2170,7 @@ static int qcom_nandc_probe(struct platf
  	struct device_node *dn = dev->of_node, *child;
  	struct resource *res;
  	int ret;
@@ -336,7 +327,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  	nandc = devm_kzalloc(&pdev->dev, sizeof(*nandc), GFP_KERNEL);
  	if (!nandc)
-@@ -2087,7 +2177,10 @@ static int qcom_nandc_probe(struct platf
+@@ -2095,7 +2185,10 @@ static int qcom_nandc_probe(struct platf
  		return -ENODEV;
  	}
  
@@ -348,7 +339,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
  	nandc->base = devm_ioremap_resource(dev, res);
-@@ -2179,7 +2272,15 @@ static int qcom_nandc_remove(struct plat
+@@ -2187,7 +2280,15 @@ static int qcom_nandc_remove(struct plat
  	return 0;
  }
  
@@ -365,7 +356,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  /*
   * data will hold a struct pointer containing more differences once we support
-@@ -2187,7 +2288,10 @@ static int qcom_nandc_remove(struct plat
+@@ -2195,7 +2296,10 @@ static int qcom_nandc_remove(struct plat
   */
  static const struct of_device_id qcom_nandc_of_match[] = {
  	{	.compatible = "qcom,ipq806x-nand",
diff --git a/target/linux/ipq806x/patches-4.9/861-qcom-mtd-nand-Added-bam-transaction-and-support-addi.patch b/target/linux/ipq806x/patches-4.9/861-qcom-mtd-nand-Added-bam-transaction-and-support-addi.patch
index 84f90b48d6..4b9f672205 100644
--- a/target/linux/ipq806x/patches-4.9/861-qcom-mtd-nand-Added-bam-transaction-and-support-addi.patch
+++ b/target/linux/ipq806x/patches-4.9/861-qcom-mtd-nand-Added-bam-transaction-and-support-addi.patch
@@ -45,7 +45,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  /* dummy register offsets, used by write_reg_dma */
  #define	NAND_DEV_CMD1_RESTORE		0xdead
-@@ -131,6 +134,11 @@
+@@ -135,6 +138,11 @@
  #define	ERASED_PAGE			(PAGE_ALL_ERASED | PAGE_ERASED)
  #define	ERASED_CW			(CODEWORD_ALL_ERASED | CODEWORD_ERASED)
  
@@ -57,9 +57,9 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  /* Version Mask */
  #define	NAND_VERSION_MAJOR_MASK		0xf0000000
  #define	NAND_VERSION_MAJOR_SHIFT	28
-@@ -148,6 +156,9 @@
- #define	FETCH_ID			0xb
- #define	RESET_DEVICE			0xd
+@@ -156,6 +164,9 @@
+ #define NAND_DEV_CMD_VLD_VAL		(READ_START_VLD | WRITE_START_VLD | \
+ 					 ERASE_START_VLD | SEQ_READ_START_VLD)
  
 +/* NAND_CTRL bits */
 +#define        BAM_MODE_EN                     BIT(0)
@@ -67,7 +67,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  /*
   * the NAND controller performs reads/writes with ECC in 516 byte chunks.
   * the driver calls the chunks 'step' or 'codeword' interchangeably
-@@ -169,12 +180,77 @@
+@@ -177,12 +188,77 @@
  #define	ECC_BCH_4BIT	BIT(2)
  #define	ECC_BCH_8BIT	BIT(3)
  
@@ -145,7 +145,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  };
  
  /*
-@@ -202,6 +278,13 @@ struct nandc_regs {
+@@ -210,6 +286,13 @@ struct nandc_regs {
  	__le32 orig_vld;
  
  	__le32 ecc_buf_cfg;
@@ -159,7 +159,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  };
  
  /*
-@@ -217,6 +300,7 @@ struct nandc_regs {
+@@ -225,6 +308,7 @@ struct nandc_regs {
   * @aon_clk:			another controller clock
   *
   * @chan:			dma channel
@@ -167,7 +167,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
   * @cmd_crci:			ADM DMA CRCI for command flow control
   * @data_crci:			ADM DMA CRCI for data flow control
   * @desc_list:			DMA descriptor list (list of desc_infos)
-@@ -242,6 +326,7 @@ struct nandc_regs {
+@@ -250,6 +334,7 @@ struct nandc_regs {
  struct qcom_nand_controller {
  	struct nand_hw_control controller;
  	struct list_head host_list;
@@ -175,7 +175,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  	struct device *dev;
  
-@@ -342,6 +427,45 @@ struct qcom_nand_driver_data {
+@@ -350,6 +435,45 @@ struct qcom_nand_driver_data {
  	bool dma_bam_enabled;
  };
  
@@ -221,7 +221,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  static inline struct qcom_nand_host *to_qcom_nand_host(struct nand_chip *chip)
  {
  	return container_of(chip, struct qcom_nand_host, chip);
-@@ -398,6 +522,16 @@ static __le32 *offset_to_nandc_reg(struc
+@@ -406,6 +530,16 @@ static __le32 *offset_to_nandc_reg(struc
  		return &regs->orig_vld;
  	case NAND_EBI2_ECC_BUF_CFG:
  		return &regs->ecc_buf_cfg;
@@ -238,7 +238,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	default:
  		return NULL;
  	}
-@@ -439,7 +573,7 @@ static void update_rw_regs(struct qcom_n
+@@ -447,7 +581,7 @@ static void update_rw_regs(struct qcom_n
  {
  	struct nand_chip *chip = &host->chip;
  	struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
@@ -247,7 +247,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  	if (read) {
  		if (host->use_ecc)
-@@ -456,12 +590,20 @@ static void update_rw_regs(struct qcom_n
+@@ -464,12 +598,20 @@ static void update_rw_regs(struct qcom_n
  
  		cfg1 = host->cfg1;
  		ecc_bch_cfg = host->ecc_bch_cfg;
@@ -268,7 +268,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	}
  
  	nandc_set_reg(nandc, NAND_FLASH_CMD, cmd);
-@@ -472,8 +614,104 @@ static void update_rw_regs(struct qcom_n
+@@ -480,8 +622,104 @@ static void update_rw_regs(struct qcom_n
  	nandc_set_reg(nandc, NAND_FLASH_STATUS, host->clrflashstatus);
  	nandc_set_reg(nandc, NAND_READ_STATUS, host->clrreadstatus);
  	nandc_set_reg(nandc, NAND_EXEC_CMD, 1);
@@ -373,7 +373,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  static int prep_dma_desc(struct qcom_nand_controller *nandc, bool read,
  			 int reg_off, const void *vaddr, int size,
  			 bool flow_control)
-@@ -552,7 +790,7 @@ err:
+@@ -560,7 +798,7 @@ err:
   * @num_regs:		number of registers to read
   */
  static int read_reg_dma(struct qcom_nand_controller *nandc, int first,
@@ -382,7 +382,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  {
  	bool flow_control = false;
  	void *vaddr;
-@@ -561,10 +799,18 @@ static int read_reg_dma(struct qcom_nand
+@@ -569,10 +807,18 @@ static int read_reg_dma(struct qcom_nand
  	if (first == NAND_READ_ID || first == NAND_FLASH_STATUS)
  		flow_control = true;
  
@@ -402,7 +402,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	return prep_dma_desc(nandc, true, first, vaddr, size, flow_control);
  }
  
-@@ -576,7 +822,7 @@ static int read_reg_dma(struct qcom_nand
+@@ -584,7 +830,7 @@ static int read_reg_dma(struct qcom_nand
   * @num_regs:		number of registers to write
   */
  static int write_reg_dma(struct qcom_nand_controller *nandc, int first,
@@ -411,7 +411,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  {
  	bool flow_control = false;
  	struct nandc_regs *regs = nandc->regs;
-@@ -588,12 +834,29 @@ static int write_reg_dma(struct qcom_nan
+@@ -596,12 +842,29 @@ static int write_reg_dma(struct qcom_nan
  	if (first == NAND_FLASH_CMD)
  		flow_control = true;
  
@@ -441,7 +441,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	size = num_regs * sizeof(u32);
  
  	return prep_dma_desc(nandc, false, first, vaddr, size, flow_control);
-@@ -608,8 +871,12 @@ static int write_reg_dma(struct qcom_nan
+@@ -616,8 +879,12 @@ static int write_reg_dma(struct qcom_nan
   * @size:		DMA transaction size in bytes
   */
  static int read_data_dma(struct qcom_nand_controller *nandc, int reg_off,
@@ -455,7 +455,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	return prep_dma_desc(nandc, true, reg_off, vaddr, size, false);
  }
  
-@@ -622,8 +889,12 @@ static int read_data_dma(struct qcom_nan
+@@ -630,8 +897,12 @@ static int read_data_dma(struct qcom_nan
   * @size:		DMA transaction size in bytes
   */
  static int write_data_dma(struct qcom_nand_controller *nandc, int reg_off,
@@ -469,7 +469,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	return prep_dma_desc(nandc, false, reg_off, vaddr, size, false);
  }
  
-@@ -633,14 +904,57 @@ static int write_data_dma(struct qcom_na
+@@ -641,14 +912,57 @@ static int write_data_dma(struct qcom_na
   */
  static void config_cw_read(struct qcom_nand_controller *nandc)
  {
@@ -533,7 +533,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  }
  
  /*
-@@ -649,19 +963,20 @@ static void config_cw_read(struct qcom_n
+@@ -657,19 +971,20 @@ static void config_cw_read(struct qcom_n
   */
  static void config_cw_write_pre(struct qcom_nand_controller *nandc)
  {
@@ -561,7 +561,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  }
  
  /*
-@@ -675,6 +990,8 @@ static int nandc_param(struct qcom_nand_
+@@ -683,6 +998,8 @@ static int nandc_param(struct qcom_nand_
  	struct nand_chip *chip = &host->chip;
  	struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
  
@@ -570,7 +570,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	/*
  	 * NAND_CMD_PARAM is called before we know much about the FLASH chip
  	 * in use. we configure the controller to perform a raw read of 512
-@@ -708,9 +1025,13 @@ static int nandc_param(struct qcom_nand_
+@@ -715,9 +1032,13 @@ static int nandc_param(struct qcom_nand_
  
  	nandc_set_reg(nandc, NAND_DEV_CMD1_RESTORE, nandc->cmd1);
  	nandc_set_reg(nandc, NAND_DEV_CMD_VLD_RESTORE, nandc->vld);
@@ -586,7 +586,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  	nandc->buf_count = 512;
  	memset(nandc->data_buffer, 0xff, nandc->buf_count);
-@@ -718,11 +1039,12 @@ static int nandc_param(struct qcom_nand_
+@@ -725,11 +1046,12 @@ static int nandc_param(struct qcom_nand_
  	config_cw_read(nandc);
  
  	read_data_dma(nandc, FLASH_BUF_ACC, nandc->data_buffer,
@@ -602,7 +602,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  	return 0;
  }
-@@ -733,6 +1055,8 @@ static int erase_block(struct qcom_nand_
+@@ -740,6 +1062,8 @@ static int erase_block(struct qcom_nand_
  	struct nand_chip *chip = &host->chip;
  	struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
  
@@ -611,7 +611,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	nandc_set_reg(nandc, NAND_FLASH_CMD,
  		      BLOCK_ERASE | PAGE_ACC | LAST_PAGE);
  	nandc_set_reg(nandc, NAND_ADDR0, page_addr);
-@@ -744,14 +1068,15 @@ static int erase_block(struct qcom_nand_
+@@ -751,14 +1075,15 @@ static int erase_block(struct qcom_nand_
  	nandc_set_reg(nandc, NAND_FLASH_STATUS, host->clrflashstatus);
  	nandc_set_reg(nandc, NAND_READ_STATUS, host->clrreadstatus);
  
@@ -633,7 +633,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  	return 0;
  }
-@@ -765,16 +1090,19 @@ static int read_id(struct qcom_nand_host
+@@ -772,16 +1097,19 @@ static int read_id(struct qcom_nand_host
  	if (column == -1)
  		return 0;
  
@@ -657,7 +657,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  	return 0;
  }
-@@ -785,28 +1113,108 @@ static int reset(struct qcom_nand_host *
+@@ -792,28 +1120,108 @@ static int reset(struct qcom_nand_host *
  	struct nand_chip *chip = &host->chip;
  	struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
  
@@ -771,7 +771,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  	return 0;
  }
-@@ -817,7 +1225,16 @@ static void free_descs(struct qcom_nand_
+@@ -824,7 +1232,16 @@ static void free_descs(struct qcom_nand_
  
  	list_for_each_entry_safe(desc, n, &nandc->desc_list, node) {
  		list_del(&desc->node);
@@ -789,7 +789,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  		kfree(desc);
  	}
  }
-@@ -1128,6 +1545,9 @@ static int read_page_ecc(struct qcom_nan
+@@ -1135,6 +1552,9 @@ static int read_page_ecc(struct qcom_nan
  	struct nand_ecc_ctrl *ecc = &chip->ecc;
  	int i, ret;
  
@@ -799,7 +799,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	/* queue cmd descs for each codeword */
  	for (i = 0; i < ecc->steps; i++) {
  		int data_size, oob_size;
-@@ -1141,11 +1561,36 @@ static int read_page_ecc(struct qcom_nan
+@@ -1148,11 +1568,36 @@ static int read_page_ecc(struct qcom_nan
  			oob_size = host->ecc_bytes_hw + host->spare_bytes;
  		}
  
@@ -838,7 +838,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  		/*
  		 * when ecc is enabled, the controller doesn't read the real
-@@ -1161,7 +1606,7 @@ static int read_page_ecc(struct qcom_nan
+@@ -1168,7 +1613,7 @@ static int read_page_ecc(struct qcom_nan
  				*oob_buf++ = 0xff;
  
  			read_data_dma(nandc, FLASH_BUF_ACC + data_size,
@@ -847,7 +847,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  		}
  
  		if (data_buf)
-@@ -1200,10 +1645,14 @@ static int copy_last_cw(struct qcom_nand
+@@ -1207,10 +1652,14 @@ static int copy_last_cw(struct qcom_nand
  
  	set_address(host, host->cw_size * (ecc->steps - 1), page);
  	update_rw_regs(host, 1, true);
@@ -863,7 +863,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  	ret = submit_descs(nandc);
  	if (ret)
-@@ -1226,6 +1675,7 @@ static int qcom_nandc_read_page(struct m
+@@ -1233,6 +1682,7 @@ static int qcom_nandc_read_page(struct m
  	data_buf = buf;
  	oob_buf = oob_required ? chip->oob_poi : NULL;
  
@@ -871,7 +871,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	ret = read_page_ecc(host, data_buf, oob_buf);
  	if (ret) {
  		dev_err(nandc->dev, "failure to read page\n");
-@@ -1245,13 +1695,19 @@ static int qcom_nandc_read_page_raw(stru
+@@ -1252,13 +1702,19 @@ static int qcom_nandc_read_page_raw(stru
  	u8 *data_buf, *oob_buf;
  	struct nand_ecc_ctrl *ecc = &chip->ecc;
  	int i, ret;
@@ -891,7 +891,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	for (i = 0; i < ecc->steps; i++) {
  		int data_size1, data_size2, oob_size1, oob_size2;
  		int reg_off = FLASH_BUF_ACC;
-@@ -1269,21 +1725,49 @@ static int qcom_nandc_read_page_raw(stru
+@@ -1276,21 +1732,49 @@ static int qcom_nandc_read_page_raw(stru
  			oob_size2 = host->ecc_bytes_hw + host->spare_bytes;
  		}
  
@@ -946,7 +946,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  		oob_buf += oob_size2;
  	}
  
-@@ -1306,6 +1790,7 @@ static int qcom_nandc_read_oob(struct mt
+@@ -1313,6 +1797,7 @@ static int qcom_nandc_read_oob(struct mt
  	int ret;
  
  	clear_read_regs(nandc);
@@ -954,7 +954,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  	host->use_ecc = true;
  	set_address(host, 0, page);
-@@ -1329,6 +1814,7 @@ static int qcom_nandc_write_page(struct
+@@ -1336,6 +1821,7 @@ static int qcom_nandc_write_page(struct
  	int i, ret;
  
  	clear_read_regs(nandc);
@@ -962,7 +962,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  	data_buf = (u8 *)buf;
  	oob_buf = chip->oob_poi;
-@@ -1350,7 +1836,8 @@ static int qcom_nandc_write_page(struct
+@@ -1357,7 +1843,8 @@ static int qcom_nandc_write_page(struct
  
  		config_cw_write_pre(nandc);
  
@@ -972,7 +972,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  		/*
  		 * when ECC is enabled, we don't really need to write anything
-@@ -1363,7 +1850,7 @@ static int qcom_nandc_write_page(struct
+@@ -1370,7 +1857,7 @@ static int qcom_nandc_write_page(struct
  			oob_buf += host->bbm_size;
  
  			write_data_dma(nandc, FLASH_BUF_ACC + data_size,
@@ -981,7 +981,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  		}
  
  		config_cw_write_post(nandc);
-@@ -1393,6 +1880,7 @@ static int qcom_nandc_write_page_raw(str
+@@ -1400,6 +1887,7 @@ static int qcom_nandc_write_page_raw(str
  	int i, ret;
  
  	clear_read_regs(nandc);
@@ -989,7 +989,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  	data_buf = (u8 *)buf;
  	oob_buf = chip->oob_poi;
-@@ -1419,19 +1907,22 @@ static int qcom_nandc_write_page_raw(str
+@@ -1426,19 +1914,22 @@ static int qcom_nandc_write_page_raw(str
  
  		config_cw_write_pre(nandc);
  
@@ -1016,7 +1016,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  		oob_buf += oob_size2;
  
  		config_cw_write_post(nandc);
-@@ -1467,6 +1958,7 @@ static int qcom_nandc_write_oob(struct m
+@@ -1474,6 +1965,7 @@ static int qcom_nandc_write_oob(struct m
  
  	host->use_ecc = true;
  
@@ -1024,7 +1024,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	ret = copy_last_cw(host, page);
  	if (ret)
  		return ret;
-@@ -1486,7 +1978,7 @@ static int qcom_nandc_write_oob(struct m
+@@ -1493,7 +1985,7 @@ static int qcom_nandc_write_oob(struct m
  
  	config_cw_write_pre(nandc);
  	write_data_dma(nandc, FLASH_BUF_ACC, nandc->data_buffer,
@@ -1033,7 +1033,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	config_cw_write_post(nandc);
  
  	ret = submit_descs(nandc);
-@@ -1524,6 +2016,7 @@ static int qcom_nandc_block_bad(struct m
+@@ -1531,6 +2023,7 @@ static int qcom_nandc_block_bad(struct m
  	 */
  	host->use_ecc = false;
  
@@ -1041,7 +1041,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	ret = copy_last_cw(host, page);
  	if (ret)
  		goto err;
-@@ -1554,6 +2047,7 @@ static int qcom_nandc_block_markbad(stru
+@@ -1561,6 +2054,7 @@ static int qcom_nandc_block_markbad(stru
  	int page, ret, status = 0;
  
  	clear_read_regs(nandc);
@@ -1049,7 +1049,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  	/*
  	 * to mark the BBM as bad, we flash the entire last codeword with 0s.
-@@ -1570,7 +2064,8 @@ static int qcom_nandc_block_markbad(stru
+@@ -1577,7 +2071,8 @@ static int qcom_nandc_block_markbad(stru
  	update_rw_regs(host, 1, false);
  
  	config_cw_write_pre(nandc);
@@ -1059,7 +1059,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	config_cw_write_post(nandc);
  
  	ret = submit_descs(nandc);
-@@ -1930,6 +2425,8 @@ static int qcom_nand_host_setup(struct q
+@@ -1937,6 +2432,8 @@ static int qcom_nand_host_setup(struct q
  
  	host->clrflashstatus = FS_READY_BSY_N;
  	host->clrreadstatus = 0xc0;
@@ -1068,7 +1068,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  
  	dev_dbg(nandc->dev,
  		"cfg0 %x cfg1 %x ecc_buf_cfg %x ecc_bch cfg %x cw_size %d cw_data %d strength %d parity_bytes %d steps %d\n",
-@@ -2008,6 +2505,12 @@ static int qcom_nandc_alloc(struct qcom_
+@@ -2015,6 +2512,12 @@ static int qcom_nandc_alloc(struct qcom_
  			dev_err(nandc->dev, "failed to request cmd channel\n");
  			return -ENODEV;
  		}
@@ -1081,7 +1081,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	}
  
  	INIT_LIST_HEAD(&nandc->desc_list);
-@@ -2043,6 +2546,9 @@ static void qcom_nandc_unalloc(struct qc
+@@ -2050,6 +2553,9 @@ static void qcom_nandc_unalloc(struct qc
  			devm_kfree(nandc->dev, nandc->reg_read_buf);
  	}
  
@@ -1091,7 +1091,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
  	if (nandc->regs)
  		devm_kfree(nandc->dev, nandc->regs);
  
-@@ -2053,11 +2559,18 @@ static void qcom_nandc_unalloc(struct qc
+@@ -2060,12 +2566,19 @@ static void qcom_nandc_unalloc(struct qc
  /* one time setup of a few nand controller registers */
  static int qcom_nandc_setup(struct qcom_nand_controller *nandc)
  {
@@ -1099,6 +1099,7 @@ Signed-off-by: Ram Chandra Jangir <rjangir@codeaurora.org>
 +
  	/* kill onenand */
  	nandc_write(nandc, SFLASHC_BURST_CFG, 0);
+ 	nandc_write(nandc, NAND_DEV_CMD_VLD, NAND_DEV_CMD_VLD_VAL);
  
 -	/* enable ADM DMA */
 -	nandc_write(nandc, NAND_FLASH_CHIP_SELECT, DM_EN);
diff --git a/target/linux/mediatek/patches-4.9/0052-net-phy-add-FC.patch b/target/linux/mediatek/patches-4.9/0052-net-phy-add-FC.patch
index 89f730b3a3..32d516ce4d 100644
--- a/target/linux/mediatek/patches-4.9/0052-net-phy-add-FC.patch
+++ b/target/linux/mediatek/patches-4.9/0052-net-phy-add-FC.patch
@@ -10,7 +10,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
 
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -1799,7 +1799,7 @@ static struct phy_driver genphy_driver[]
+@@ -1804,7 +1804,7 @@ static struct phy_driver genphy_driver[]
  	.config_init	= genphy_config_init,
  	.features	= PHY_GBIT_FEATURES | SUPPORTED_MII |
  			  SUPPORTED_AUI | SUPPORTED_FIBRE |