kernel: bump 4.14 to 4.14.93

Refresh patches.
Remove upstreamed patches:
- backport/096-mips-math-emu-Write-protect-delay-slot-emulation-pages.patch
- pending/510-f2fs-fix-sanity_check_raw_super-on-big-endian-machines.patch
- brcm2708/950-0415-qmi_wwan-apply-SET_DTR-quirk-to-the-SIMCOM-shared-de.patch

Compile-tested: ar71xx, ath79, brcm2708/bcm27{08,10}, octeon, x86/64
Runtime-tested: ar71xx, ath79, brcm2708/bcm27{08,10}, octeon, x86/64

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>

14 files changed, 31 insertions, 206 deletions

diff --git a/target/linux/generic/backport-4.14/025-tcp-allow-drivers-to-tweak-TSQ-logic.patch b/target/linux/generic/backport-4.14/025-tcp-allow-drivers-to-tweak-TSQ-logic.patch
index 067481ba94..5639497926 100644
--- a/target/linux/generic/backport-4.14/025-tcp-allow-drivers-to-tweak-TSQ-logic.patch
+++ b/target/linux/generic/backport-4.14/025-tcp-allow-drivers-to-tweak-TSQ-logic.patch
@@ -44,7 +44,7 @@ Cc: Kir Kolyshkin <kir@openvz.org>
    *	@sk_lingertime: %SO_LINGER l_linger setting
    *	@sk_backlog: always used with the per-socket spinlock held
    *	@sk_callback_lock: used with the callbacks in the end of this struct
-@@ -445,6 +446,8 @@ struct sock {
+@@ -446,6 +447,8 @@ struct sock {
  				sk_type      : 16;
  #define SK_PROTOCOL_MAX U8_MAX
  	u16			sk_gso_max_segs;
@@ -55,7 +55,7 @@ Cc: Kir Kolyshkin <kir@openvz.org>
  	rwlock_t		sk_callback_lock;
 --- a/net/core/sock.c
 +++ b/net/core/sock.c
-@@ -2739,6 +2739,7 @@ void sock_init_data(struct socket *sock,
+@@ -2742,6 +2742,7 @@ void sock_init_data(struct socket *sock,
  
  	sk->sk_max_pacing_rate = ~0U;
  	sk->sk_pacing_rate = ~0U;
diff --git a/target/linux/generic/backport-4.14/096-mips-math-emu-Write-protect-delay-slot-emulation-pages.patch b/target/linux/generic/backport-4.14/096-mips-math-emu-Write-protect-delay-slot-emulation-pages.patch
deleted file mode 100644
index f428285a64..0000000000
--- a/target/linux/generic/backport-4.14/096-mips-math-emu-Write-protect-delay-slot-emulation-pages.patch
+++ /dev/null
@@ -1,119 +0,0 @@
-From adcc81f148d733b7e8e641300c5590a2cdc13bf3 Mon Sep 17 00:00:00 2001
-From: Paul Burton <paul.burton@mips.com>
-Date: Thu, 20 Dec 2018 17:45:43 +0000
-Subject: MIPS: math-emu: Write-protect delay slot emulation pages
-
-Mapping the delay slot emulation page as both writeable & executable
-presents a security risk, in that if an exploit can write to & jump into
-the page then it can be used as an easy way to execute arbitrary code.
-
-Prevent this by mapping the page read-only for userland, and using
-access_process_vm() with the FOLL_FORCE flag to write to it from
-mips_dsemul().
-
-This will likely be less efficient due to copy_to_user_page() performing
-cache maintenance on a whole page, rather than a single line as in the
-previous use of flush_cache_sigtramp(). However this delay slot
-emulation code ought not to be running in any performance critical paths
-anyway so this isn't really a problem, and we can probably do better in
-copy_to_user_page() anyway in future.
-
-A major advantage of this approach is that the fix is small & simple to
-backport to stable kernels.
-
-Reported-by: Andy Lutomirski <luto@kernel.org>
-Signed-off-by: Paul Burton <paul.burton@mips.com>
-Fixes: 432c6bacbd0c ("MIPS: Use per-mm page to execute branch delay slot instructions")
-Cc: stable@vger.kernel.org # v4.8+
-Cc: linux-mips@vger.kernel.org
-Cc: linux-kernel@vger.kernel.org
-Cc: Rich Felker <dalias@libc.org>
-Cc: David Daney <david.daney@cavium.com>
----
- arch/mips/kernel/vdso.c     |  4 ++--
- arch/mips/math-emu/dsemul.c | 38 ++++++++++++++++++++------------------
- 2 files changed, 22 insertions(+), 20 deletions(-)
-
---- a/arch/mips/kernel/vdso.c
-+++ b/arch/mips/kernel/vdso.c
-@@ -126,8 +126,8 @@ int arch_setup_additional_pages(struct l
- 
- 	/* Map delay slot emulation page */
- 	base = mmap_region(NULL, STACK_TOP, PAGE_SIZE,
--			   VM_READ|VM_WRITE|VM_EXEC|
--			   VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC,
-+			   VM_READ | VM_EXEC |
-+			   VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC,
- 			   0, NULL);
- 	if (IS_ERR_VALUE(base)) {
- 		ret = base;
---- a/arch/mips/math-emu/dsemul.c
-+++ b/arch/mips/math-emu/dsemul.c
-@@ -214,8 +214,9 @@ int mips_dsemul(struct pt_regs *regs, mi
- {
- 	int isa16 = get_isa16_mode(regs->cp0_epc);
- 	mips_instruction break_math;
--	struct emuframe __user *fr;
--	int err, fr_idx;
-+	unsigned long fr_uaddr;
-+	struct emuframe fr;
-+	int fr_idx, ret;
- 
- 	/* NOP is easy */
- 	if (ir == 0)
-@@ -250,27 +251,31 @@ int mips_dsemul(struct pt_regs *regs, mi
- 		fr_idx = alloc_emuframe();
- 	if (fr_idx == BD_EMUFRAME_NONE)
- 		return SIGBUS;
--	fr = &dsemul_page()[fr_idx];
- 
- 	/* Retrieve the appropriately encoded break instruction */
- 	break_math = BREAK_MATH(isa16);
- 
- 	/* Write the instructions to the frame */
- 	if (isa16) {
--		err = __put_user(ir >> 16,
--				 (u16 __user *)(&fr->emul));
--		err |= __put_user(ir & 0xffff,
--				  (u16 __user *)((long)(&fr->emul) + 2));
--		err |= __put_user(break_math >> 16,
--				  (u16 __user *)(&fr->badinst));
--		err |= __put_user(break_math & 0xffff,
--				  (u16 __user *)((long)(&fr->badinst) + 2));
-+		union mips_instruction _emul = {
-+			.halfword = { ir >> 16, ir }
-+		};
-+		union mips_instruction _badinst = {
-+			.halfword = { break_math >> 16, break_math }
-+		};
-+
-+		fr.emul = _emul.word;
-+		fr.badinst = _badinst.word;
- 	} else {
--		err = __put_user(ir, &fr->emul);
--		err |= __put_user(break_math, &fr->badinst);
-+		fr.emul = ir;
-+		fr.badinst = break_math;
- 	}
- 
--	if (unlikely(err)) {
-+	/* Write the frame to user memory */
-+	fr_uaddr = (unsigned long)&dsemul_page()[fr_idx];
-+	ret = access_process_vm(current, fr_uaddr, &fr, sizeof(fr),
-+				FOLL_FORCE | FOLL_WRITE);
-+	if (unlikely(ret != sizeof(fr))) {
- 		MIPS_FPU_EMU_INC_STATS(errors);
- 		free_emuframe(fr_idx, current->mm);
- 		return SIGBUS;
-@@ -282,10 +287,7 @@ int mips_dsemul(struct pt_regs *regs, mi
- 	atomic_set(&current->thread.bd_emu_frame, fr_idx);
- 
- 	/* Change user register context to execute the frame */
--	regs->cp0_epc = (unsigned long)&fr->emul | isa16;
--
--	/* Ensure the icache observes our newly written frame */
--	flush_cache_sigtramp((unsigned long)&fr->emul);
-+	regs->cp0_epc = fr_uaddr | isa16;
- 
- 	return 0;
- }
diff --git a/target/linux/generic/backport-4.14/101-arm-cns3xxx-use-actual-size-reads-for-PCIe.patch b/target/linux/generic/backport-4.14/101-arm-cns3xxx-use-actual-size-reads-for-PCIe.patch
index 44ca833705..2b3384391a 100644
--- a/target/linux/generic/backport-4.14/101-arm-cns3xxx-use-actual-size-reads-for-PCIe.patch
+++ b/target/linux/generic/backport-4.14/101-arm-cns3xxx-use-actual-size-reads-for-PCIe.patch
@@ -33,11 +33,9 @@ CC: stable@vger.kernel.org # v4.0+
  arch/arm/mach-cns3xxx/pcie.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
-diff --git a/arch/arm/mach-cns3xxx/pcie.c b/arch/arm/mach-cns3xxx/pcie.c
-index 5e11ad3164e0..95a11d5b3587 100644
 --- a/arch/arm/mach-cns3xxx/pcie.c
 +++ b/arch/arm/mach-cns3xxx/pcie.c
-@@ -93,7 +93,7 @@ static int cns3xxx_pci_read_config(struct pci_bus *bus, unsigned int devfn,
+@@ -93,7 +93,7 @@ static int cns3xxx_pci_read_config(struc
  	u32 mask = (0x1ull << (size * 8)) - 1;
  	int shift = (where % 4) * 8;
  
@@ -46,6 +44,3 @@ index 5e11ad3164e0..95a11d5b3587 100644
  
  	if (ret == PCIBIOS_SUCCESSFUL && !bus->number && !devfn &&
  	    (where & 0xffc) == PCI_CLASS_REVISION)
--- 
-2.17.1
-
diff --git a/target/linux/generic/hack-4.14/207-disable-modorder.patch b/target/linux/generic/hack-4.14/207-disable-modorder.patch
index 0619dcaa7b..b45a8e3bc2 100644
--- a/target/linux/generic/hack-4.14/207-disable-modorder.patch
+++ b/target/linux/generic/hack-4.14/207-disable-modorder.patch
@@ -15,7 +15,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/Makefile
 +++ b/Makefile
-@@ -1237,7 +1237,6 @@ all: modules
+@@ -1240,7 +1240,6 @@ all: modules
  
  PHONY += modules
  modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
@@ -23,7 +23,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	@$(kecho) '  Building modules, stage 2.';
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
  
-@@ -1266,7 +1265,6 @@ _modinst_:
+@@ -1269,7 +1268,6 @@ _modinst_:
  		rm -f $(MODLIB)/build ; \
  		ln -s $(CURDIR) $(MODLIB)/build ; \
  	fi
diff --git a/target/linux/generic/hack-4.14/300-MIPS-r4k_cache-use-more-efficient-cache-blast.patch b/target/linux/generic/hack-4.14/300-MIPS-r4k_cache-use-more-efficient-cache-blast.patch
index 860a7e03c5..c07ccf9474 100644
--- a/target/linux/generic/hack-4.14/300-MIPS-r4k_cache-use-more-efficient-cache-blast.patch
+++ b/target/linux/generic/hack-4.14/300-MIPS-r4k_cache-use-more-efficient-cache-blast.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 ---
 --- a/arch/mips/include/asm/r4kcache.h
 +++ b/arch/mips/include/asm/r4kcache.h
-@@ -682,16 +682,48 @@ static inline void prot##extra##blast_##
+@@ -683,16 +683,48 @@ static inline void prot##extra##blast_##
  						    unsigned long end)	\
  {									\
  	unsigned long lsize = cpu_##desc##_line_size();			\
diff --git a/target/linux/generic/hack-4.14/702-phy_add_aneg_done_function.patch b/target/linux/generic/hack-4.14/702-phy_add_aneg_done_function.patch
index 0453112a1f..24d3cdffa3 100644
--- a/target/linux/generic/hack-4.14/702-phy_add_aneg_done_function.patch
+++ b/target/linux/generic/hack-4.14/702-phy_add_aneg_done_function.patch
@@ -15,7 +15,7 @@
  
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -1458,6 +1458,9 @@ int genphy_update_link(struct phy_device
+@@ -1455,6 +1455,9 @@ int genphy_update_link(struct phy_device
  {
  	int status;
  
diff --git a/target/linux/generic/hack-4.14/902-debloat_proc.patch b/target/linux/generic/hack-4.14/902-debloat_proc.patch
index 98788cd265..092f0aa81b 100644
--- a/target/linux/generic/hack-4.14/902-debloat_proc.patch
+++ b/target/linux/generic/hack-4.14/902-debloat_proc.patch
@@ -327,7 +327,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/net/core/sock.c
 +++ b/net/core/sock.c
-@@ -3378,6 +3378,8 @@ static __net_initdata struct pernet_oper
+@@ -3381,6 +3381,8 @@ static __net_initdata struct pernet_oper
  
  static int __init proto_init(void)
  {
diff --git a/target/linux/generic/pending-4.14/203-kallsyms_uncompressed.patch b/target/linux/generic/pending-4.14/203-kallsyms_uncompressed.patch
index fa68f307d4..5f66c3d501 100644
--- a/target/linux/generic/pending-4.14/203-kallsyms_uncompressed.patch
+++ b/target/linux/generic/pending-4.14/203-kallsyms_uncompressed.patch
@@ -65,7 +65,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static int absolute_percpu = 0;
  static char symbol_prefix_char = '\0';
  static int base_relative = 0;
-@@ -457,6 +458,9 @@ static void write_src(void)
+@@ -458,6 +459,9 @@ static void write_src(void)
  
  	free(markers);
  
@@ -75,7 +75,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	output_label("kallsyms_token_table");
  	off = 0;
  	for (i = 0; i < 256; i++) {
-@@ -515,6 +519,9 @@ static void *find_token(unsigned char *s
+@@ -516,6 +520,9 @@ static void *find_token(unsigned char *s
  {
  	int i;
  
@@ -85,7 +85,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	for (i = 0; i < len - 1; i++) {
  		if (str[i] == token[0] && str[i+1] == token[1])
  			return &str[i];
-@@ -587,6 +594,9 @@ static void optimize_result(void)
+@@ -588,6 +595,9 @@ static void optimize_result(void)
  {
  	int i, best;
  
@@ -95,7 +95,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	/* using the '\0' symbol last allows compress_symbols to use standard
  	 * fast string functions */
  	for (i = 255; i >= 0; i--) {
-@@ -775,6 +785,8 @@ int main(int argc, char **argv)
+@@ -776,6 +786,8 @@ int main(int argc, char **argv)
  				symbol_prefix_char = *p;
  			} else if (strcmp(argv[i], "--base-relative") == 0)
  				base_relative = 1;
diff --git a/target/linux/generic/pending-4.14/470-mtd-spi-nor-support-limiting-4K-sectors-support-base.patch b/target/linux/generic/pending-4.14/470-mtd-spi-nor-support-limiting-4K-sectors-support-base.patch
index 231f9c21a4..0f4ea32688 100644
--- a/target/linux/generic/pending-4.14/470-mtd-spi-nor-support-limiting-4K-sectors-support-base.patch
+++ b/target/linux/generic/pending-4.14/470-mtd-spi-nor-support-limiting-4K-sectors-support-base.patch
@@ -36,7 +36,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +
  config SPI_ATMEL_QUADSPI
  	tristate "Atmel Quad SPI Controller"
- 	depends on ARCH_AT91 || (ARM && COMPILE_TEST)
+ 	depends on ARCH_AT91 || (ARM && COMPILE_TEST && !ARCH_EBSA110)
 --- a/drivers/mtd/spi-nor/spi-nor.c
 +++ b/drivers/mtd/spi-nor/spi-nor.c
 @@ -2561,10 +2561,12 @@ static int spi_nor_select_erase(struct s
diff --git a/target/linux/generic/pending-4.14/510-f2fs-fix-sanity_check_raw_super-on-big-endian-machines.patch b/target/linux/generic/pending-4.14/510-f2fs-fix-sanity_check_raw_super-on-big-endian-machines.patch
deleted file mode 100644
index 6cbaf28e81..0000000000
--- a/target/linux/generic/pending-4.14/510-f2fs-fix-sanity_check_raw_super-on-big-endian-machines.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
-To: linux-f2fs-devel@lists.sourceforge.net, yuchao0@huawei.com,
-        jaegeuk@kernel.org
-Subject: [PATCH v2 1/1] f2fs: fix validation of the block count in
- sanity_check_raw_super
-Date: Sat, 22 Dec 2018 11:22:26 +0100
-Message-Id: <20181222102226.10050-2-martin.blumenstingl@googlemail.com>
-
-Treat "block_count" from struct f2fs_super_block as 64-bit little endian
-value in sanity_check_raw_super() because struct f2fs_super_block
-declares "block_count" as "__le64".
-
-This fixes a bug where the superblock validation fails on big endian
-devices with the following error:
-  F2FS-fs (sda1): Wrong segment_count / block_count (61439 > 0)
-  F2FS-fs (sda1): Can't find valid F2FS filesystem in 1th superblock
-  F2FS-fs (sda1): Wrong segment_count / block_count (61439 > 0)
-  F2FS-fs (sda1): Can't find valid F2FS filesystem in 2th superblock
-As result of this the partition cannot be mounted.
-
-With this patch applied the superblock validation works fine and the
-partition can be mounted again:
-  F2FS-fs (sda1): Mounted with checkpoint version = 7c84
-
-My little endian x86-64 hardware was able to mount the partition without
-this fix.
-To confirm that mounting f2fs filesystems works on big endian machines
-again I tested this on a 32-bit MIPS big endian (lantiq) device.
-
-Fixes: 0cfe75c5b01199 ("f2fs: enhance sanity_check_raw_super() to avoid potential overflows")
-Cc: stable@vger.kernel.org
-Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
-Reviewed-by: Chao Yu <yuchao0@huawei.com>
----
-
---- a/fs/f2fs/super.c
-+++ b/fs/f2fs/super.c
-@@ -1897,10 +1897,10 @@ static int sanity_check_raw_super(struct
- 		return 1;
- 	}
- 
--	if (segment_count > (le32_to_cpu(raw_super->block_count) >> 9)) {
-+	if (segment_count > (le64_to_cpu(raw_super->block_count) >> 9)) {
- 		f2fs_msg(sb, KERN_INFO,
--			"Wrong segment_count / block_count (%u > %u)",
--			segment_count, le32_to_cpu(raw_super->block_count));
-+			"Wrong segment_count / block_count (%u > %llu)",
-+			segment_count, le64_to_cpu(raw_super->block_count));
- 		return 1;
- 	}
- 
diff --git a/target/linux/generic/pending-4.14/630-packet_socket_type.patch b/target/linux/generic/pending-4.14/630-packet_socket_type.patch
index d55d678549..e8eae3b7ff 100644
--- a/target/linux/generic/pending-4.14/630-packet_socket_type.patch
+++ b/target/linux/generic/pending-4.14/630-packet_socket_type.patch
@@ -87,7 +87,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!net_eq(dev_net(dev), sock_net(sk)))
  		goto drop;
  
-@@ -3265,6 +3267,7 @@ static int packet_create(struct net *net
+@@ -3269,6 +3271,7 @@ static int packet_create(struct net *net
  	mutex_init(&po->pg_vec_lock);
  	po->rollover = NULL;
  	po->prot_hook.func = packet_rcv;
@@ -95,7 +95,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	if (sock->type == SOCK_PACKET)
  		po->prot_hook.func = packet_rcv_spkt;
-@@ -3878,6 +3881,16 @@ packet_setsockopt(struct socket *sock, i
+@@ -3882,6 +3885,16 @@ packet_setsockopt(struct socket *sock, i
  		po->xmit = val ? packet_direct_xmit : dev_queue_xmit;
  		return 0;
  	}
@@ -112,7 +112,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	default:
  		return -ENOPROTOOPT;
  	}
-@@ -3930,6 +3943,13 @@ static int packet_getsockopt(struct sock
+@@ -3934,6 +3947,13 @@ static int packet_getsockopt(struct sock
  	case PACKET_VNET_HDR:
  		val = po->has_vnet_hdr;
  		break;
diff --git a/target/linux/generic/pending-4.14/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch b/target/linux/generic/pending-4.14/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
index 7c60d7e799..89e6646c57 100644
--- a/target/linux/generic/pending-4.14/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
+++ b/target/linux/generic/pending-4.14/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
@@ -292,7 +292,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	__skb_tunnel_rx(skb, tunnel->dev, tunnel->net);
  
  	err = dscp_ecn_decapsulate(tunnel, ipv6h, skb);
-@@ -962,6 +1101,7 @@ static void init_tel_txopt(struct ipv6_t
+@@ -963,6 +1102,7 @@ static void init_tel_txopt(struct ipv6_t
  	opt->ops.opt_nflen = 8;
  }
  
@@ -300,7 +300,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  /**
   * ip6_tnl_addr_conflict - compare packet addresses to tunnel's own
   *   @t: the outgoing tunnel device
-@@ -1305,6 +1445,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
+@@ -1306,6 +1446,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
  {
  	struct ip6_tnl *t = netdev_priv(dev);
  	struct ipv6hdr *ipv6h;
@@ -308,7 +308,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	int encap_limit = -1;
  	__u16 offset;
  	struct flowi6 fl6;
-@@ -1371,6 +1512,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
+@@ -1372,6 +1513,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
  
  	fl6.flowi6_uid = sock_net_uid(dev_net(dev), NULL);
  
@@ -327,7 +327,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
  		return -1;
  
-@@ -1499,6 +1652,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
+@@ -1500,6 +1653,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
  	t->parms.link = p->link;
  	t->parms.proto = p->proto;
  	t->parms.fwmark = p->fwmark;
@@ -342,7 +342,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	dst_cache_reset(&t->dst_cache);
  	ip6_tnl_link_config(t);
  	return 0;
-@@ -1537,6 +1698,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
+@@ -1538,6 +1699,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
  	p->flowinfo = u->flowinfo;
  	p->link = u->link;
  	p->proto = u->proto;
@@ -350,7 +350,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	memcpy(p->name, u->name, sizeof(u->name));
  }
  
-@@ -1923,6 +2085,15 @@ static int ip6_tnl_validate(struct nlatt
+@@ -1924,6 +2086,15 @@ static int ip6_tnl_validate(struct nlatt
  	return 0;
  }
  
@@ -366,7 +366,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  static void ip6_tnl_netlink_parms(struct nlattr *data[],
  				  struct __ip6_tnl_parm *parms)
  {
-@@ -1960,6 +2131,46 @@ static void ip6_tnl_netlink_parms(struct
+@@ -1961,6 +2132,46 @@ static void ip6_tnl_netlink_parms(struct
  
  	if (data[IFLA_IPTUN_FWMARK])
  		parms->fwmark = nla_get_u32(data[IFLA_IPTUN_FWMARK]);
@@ -413,7 +413,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  }
  
  static bool ip6_tnl_netlink_encap_parms(struct nlattr *data[],
-@@ -2075,6 +2286,12 @@ static void ip6_tnl_dellink(struct net_d
+@@ -2076,6 +2287,12 @@ static void ip6_tnl_dellink(struct net_d
  
  static size_t ip6_tnl_get_size(const struct net_device *dev)
  {
@@ -426,7 +426,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	return
  		/* IFLA_IPTUN_LINK */
  		nla_total_size(4) +
-@@ -2104,6 +2321,24 @@ static size_t ip6_tnl_get_size(const str
+@@ -2105,6 +2322,24 @@ static size_t ip6_tnl_get_size(const str
  		nla_total_size(0) +
  		/* IFLA_IPTUN_FWMARK */
  		nla_total_size(4) +
@@ -451,7 +451,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  		0;
  }
  
-@@ -2111,6 +2346,9 @@ static int ip6_tnl_fill_info(struct sk_b
+@@ -2112,6 +2347,9 @@ static int ip6_tnl_fill_info(struct sk_b
  {
  	struct ip6_tnl *tunnel = netdev_priv(dev);
  	struct __ip6_tnl_parm *parm = &tunnel->parms;
@@ -461,7 +461,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  
  	if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
  	    nla_put_in6_addr(skb, IFLA_IPTUN_LOCAL, &parm->laddr) ||
-@@ -2120,9 +2358,27 @@ static int ip6_tnl_fill_info(struct sk_b
+@@ -2121,9 +2359,27 @@ static int ip6_tnl_fill_info(struct sk_b
  	    nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
  	    nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) ||
  	    nla_put_u8(skb, IFLA_IPTUN_PROTO, parm->proto) ||
@@ -490,7 +490,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	if (nla_put_u16(skb, IFLA_IPTUN_ENCAP_TYPE, tunnel->encap.type) ||
  	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_SPORT, tunnel->encap.sport) ||
  	    nla_put_be16(skb, IFLA_IPTUN_ENCAP_DPORT, tunnel->encap.dport) ||
-@@ -2162,6 +2418,7 @@ static const struct nla_policy ip6_tnl_p
+@@ -2163,6 +2419,7 @@ static const struct nla_policy ip6_tnl_p
  	[IFLA_IPTUN_ENCAP_DPORT]	= { .type = NLA_U16 },
  	[IFLA_IPTUN_COLLECT_METADATA]	= { .type = NLA_FLAG },
  	[IFLA_IPTUN_FWMARK]		= { .type = NLA_U32 },
diff --git a/target/linux/generic/pending-4.14/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch b/target/linux/generic/pending-4.14/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
index 1397580382..36aaccbdb3 100644
--- a/target/linux/generic/pending-4.14/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
+++ b/target/linux/generic/pending-4.14/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
@@ -76,7 +76,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  static inline const char *rtn_type(char *buf, size_t len, unsigned int t)
 --- a/net/ipv4/ipmr.c
 +++ b/net/ipv4/ipmr.c
-@@ -161,6 +161,7 @@ static int ipmr_rule_action(struct fib_r
+@@ -163,6 +163,7 @@ static int ipmr_rule_action(struct fib_r
  	case FR_ACT_UNREACHABLE:
  		return -ENETUNREACH;
  	case FR_ACT_PROHIBIT:
@@ -99,7 +99,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	tb_id = fib_rule_get_table(rule, arg);
 --- a/net/ipv6/ip6mr.c
 +++ b/net/ipv6/ip6mr.c
-@@ -168,6 +168,8 @@ static int ip6mr_rule_action(struct fib_
+@@ -170,6 +170,8 @@ static int ip6mr_rule_action(struct fib_
  		return -ENETUNREACH;
  	case FR_ACT_PROHIBIT:
  		return -EACCES;
diff --git a/target/linux/generic/pending-4.14/703-phy-add-detach-callback-to-struct-phy_driver.patch b/target/linux/generic/pending-4.14/703-phy-add-detach-callback-to-struct-phy_driver.patch
index 11436a2166..119b53c6d7 100644
--- a/target/linux/generic/pending-4.14/703-phy-add-detach-callback-to-struct-phy_driver.patch
+++ b/target/linux/generic/pending-4.14/703-phy-add-detach-callback-to-struct-phy_driver.patch
@@ -11,7 +11,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -1102,6 +1102,9 @@ void phy_detach(struct phy_device *phyde
+@@ -1099,6 +1099,9 @@ void phy_detach(struct phy_device *phyde
  	struct module *ndev_owner = dev->dev.parent->driver->owner;
  	struct mii_bus *bus;