kernel: bump 4.9 to 4.9.82

Refresh patches.
Remove upstreamed patches:
- ar7/002-MIPS-AR7-ensure-the-port-type-s-FCR-value-is-used.patch
- backport/040-crypto-fix-typo-in-KPP-dependency-of-CRYPTO_ECDH.patch
Remove layerscape/819-Revert-dmaengine-dmatest-move-callback-wait-queue-to.patch,
it is superseded by upstream commit 297c7cc4b5651b174a62925b6c961085f04979fd.
Remove pending/650-pppoe_header_pad.patch, it is superseded by
upstream commit 1bd21b158e07e0b8c5a2ce832305a0ebfe42c480.
Update patches that no longer apply:
- ar71xx/004-register_gpio_driver_earlier.patch
- hack/204-module_strip.patch
- pending/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch

Fixes CVE-2017-8824.

Compile-tested: ar71xx.
Runtime-tested: ar71xx.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>

26 files changed, 84 insertions, 324 deletions

diff --git a/target/linux/ar7/patches-4.9/002-MIPS-AR7-ensure-the-port-type-s-FCR-value-is-used.patch b/target/linux/ar7/patches-4.9/002-MIPS-AR7-ensure-the-port-type-s-FCR-value-is-used.patch
deleted file mode 100644
index cc1a541a3e..0000000000
--- a/target/linux/ar7/patches-4.9/002-MIPS-AR7-ensure-the-port-type-s-FCR-value-is-used.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From ee6c9d41de084b2cefd90e5e0c9f30a35f6d3967 Mon Sep 17 00:00:00 2001
-From: Jonas Gorski <jonas.gorski@gmail.com>
-Date: Sun, 29 Oct 2017 15:50:42 +0100
-Subject: [PATCH RFC 3/3] MIPS: AR7: ensure the port type's FCR value is used
-
-Since commit aef9a7bd9b67 ("serial/uart/8250: Add tunable RX interrupt
-trigger I/F of FIFO buffers"), the port's default FCR value isn't used
-in serial8250_do_set_termios anymore, but copied over once in
-serial8250_config_port and then modified as needed.
-
-Unfortunately, serial8250_config_port will never be called if the port
-is shared between kernel and userspace, and the port's flag doesn't have
-UPF_BOOT_AUTOCONF, which would trigger a serial8250_config_port as well.
-
-This causes garbled output from userspace:
-
-[    5.220000] random: procd urandom read with 49 bits of entropy available
-ers
-   [kee
-
-Fix this by forcing it to be configured on boot, resulting in the
-expected output:
-
-[    5.250000] random: procd urandom read with 50 bits of entropy available
-Press the [f] key and hit [enter] to enter failsafe mode
-Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
-
-Fixes: aef9a7bd9b67 ("serial/uart/8250: Add tunable RX interrupt trigger I/F of FIFO buffers")
-Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
----
-I'm not sure if this is just AR7's issue, or if this points to a general
-issue for UARTs used as kernel console and login console with the "fixed"
-commit.
-
- arch/mips/ar7/platform.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/arch/mips/ar7/platform.c
-+++ b/arch/mips/ar7/platform.c
-@@ -576,7 +576,7 @@ static int __init ar7_register_uarts(voi
- 	uart_port.type		= PORT_AR7;
- 	uart_port.uartclk	= clk_get_rate(bus_clk) / 2;
- 	uart_port.iotype	= UPIO_MEM32;
--	uart_port.flags		= UPF_FIXED_TYPE;
-+	uart_port.flags		= UPF_FIXED_TYPE | UPF_BOOT_AUTOCONF;
- 	uart_port.regshift	= 2;
- 
- 	uart_port.line		= 0;
diff --git a/target/linux/ar71xx/patches-4.9/004-register_gpio_driver_earlier.patch b/target/linux/ar71xx/patches-4.9/004-register_gpio_driver_earlier.patch
index e6e972b7ef..cc30e2d91e 100644
--- a/target/linux/ar71xx/patches-4.9/004-register_gpio_driver_earlier.patch
+++ b/target/linux/ar71xx/patches-4.9/004-register_gpio_driver_earlier.patch
@@ -3,7 +3,7 @@ from mach files succeed.
 
 --- a/drivers/gpio/gpio-ath79.c
 +++ b/drivers/gpio/gpio-ath79.c
-@@ -322,4 +322,8 @@ static struct platform_driver ath79_gpio
+@@ -322,7 +322,11 @@ static struct platform_driver ath79_gpio
  	.remove = ath79_gpio_remove,
  };
  
@@ -13,3 +13,6 @@ from mach files succeed.
 +	return platform_driver_register(&ath79_gpio_driver);
 +}
 +postcore_initcall(ath79_gpio_init);
+ 
+ MODULE_DESCRIPTION("Atheros AR71XX/AR724X/AR913X GPIO API support");
+ MODULE_LICENSE("GPL v2");
diff --git a/target/linux/ar71xx/patches-4.9/910-unaligned_access_hacks.patch b/target/linux/ar71xx/patches-4.9/910-unaligned_access_hacks.patch
index f26af24d14..a453752900 100644
--- a/target/linux/ar71xx/patches-4.9/910-unaligned_access_hacks.patch
+++ b/target/linux/ar71xx/patches-4.9/910-unaligned_access_hacks.patch
@@ -267,7 +267,7 @@
  		case IPV6_2292HOPOPTS:
 --- a/net/ipv6/ip6_gre.c
 +++ b/net/ipv6/ip6_gre.c
-@@ -394,7 +394,7 @@ static void ip6gre_err(struct sk_buff *s
+@@ -395,7 +395,7 @@ static void ip6gre_err(struct sk_buff *s
  		return;
  	ipv6h = (const struct ipv6hdr *)skb->data;
  	greh = (const struct gre_base_hdr *)(skb->data + offset);
@@ -448,7 +448,7 @@
  		memcpy(p, foc->val, foc->len);
 --- a/net/ipv4/igmp.c
 +++ b/net/ipv4/igmp.c
-@@ -533,7 +533,7 @@ static struct sk_buff *add_grec(struct s
+@@ -537,7 +537,7 @@ static struct sk_buff *add_grec(struct s
  		if (!skb)
  			return NULL;
  		psrc = (__be32 *)skb_put(skb, sizeof(__be32));
@@ -621,7 +621,7 @@
  
  #define	IP6_MF		0x0001
  #define	IP6_OFFSET	0xFFF8
-@@ -449,8 +449,8 @@ static inline void __ipv6_addr_set_half(
+@@ -450,8 +450,8 @@ static inline void __ipv6_addr_set_half(
  	}
  #endif
  #endif
@@ -632,7 +632,7 @@
  }
  
  static inline void ipv6_addr_set(struct in6_addr *addr, 
-@@ -509,6 +509,8 @@ static inline bool ipv6_prefix_equal(con
+@@ -510,6 +510,8 @@ static inline bool ipv6_prefix_equal(con
  	const __be32 *a1 = addr1->s6_addr32;
  	const __be32 *a2 = addr2->s6_addr32;
  	unsigned int pdw, pbi;
@@ -641,7 +641,7 @@
  
  	/* check complete u32 in prefix */
  	pdw = prefixlen >> 5;
-@@ -517,7 +519,9 @@ static inline bool ipv6_prefix_equal(con
+@@ -518,7 +520,9 @@ static inline bool ipv6_prefix_equal(con
  
  	/* check incomplete u32 in prefix */
  	pbi = prefixlen & 0x1f;
@@ -652,7 +652,7 @@
  		return false;
  
  	return true;
-@@ -661,13 +665,13 @@ static inline void ipv6_addr_set_v4mappe
+@@ -662,13 +666,13 @@ static inline void ipv6_addr_set_v4mappe
   */
  static inline int __ipv6_addr_diff32(const void *token1, const void *token2, int addrlen)
  {
@@ -668,7 +668,7 @@
  		if (xb)
  			return i * 32 + 31 - __fls(ntohl(xb));
  	}
-@@ -836,17 +840,18 @@ static inline int ip6_default_np_autolab
+@@ -837,17 +841,18 @@ static inline int ip6_default_np_autolab
  static inline void ip6_flow_hdr(struct ipv6hdr *hdr, unsigned int tclass,
  				__be32 flowlabel)
  {
@@ -888,7 +888,7 @@
  		*sum = csum_fold(csum_partial(diff, sizeof(diff),
 --- a/drivers/net/vxlan.c
 +++ b/drivers/net/vxlan.c
-@@ -1811,15 +1811,15 @@ static int vxlan_build_skb(struct sk_buf
+@@ -1789,15 +1789,15 @@ static int vxlan_build_skb(struct sk_buf
  		goto out_free;
  
  	vxh = (struct vxlanhdr *) __skb_push(skb, sizeof(*vxh));
@@ -938,7 +938,7 @@
  
 --- a/net/ipv4/tcp_offload.c
 +++ b/net/ipv4/tcp_offload.c
-@@ -215,7 +215,7 @@ struct sk_buff **tcp_gro_receive(struct
+@@ -218,7 +218,7 @@ struct sk_buff **tcp_gro_receive(struct
  
  		th2 = tcp_hdr(p);
  
@@ -947,7 +947,7 @@
  			NAPI_GRO_CB(p)->same_flow = 0;
  			continue;
  		}
-@@ -233,8 +233,8 @@ found:
+@@ -236,8 +236,8 @@ found:
  		  ~(TCP_FLAG_CWR | TCP_FLAG_FIN | TCP_FLAG_PSH));
  	flush |= (__force int)(th->ack_seq ^ th2->ack_seq);
  	for (i = sizeof(*th); i < thlen; i += 4)
diff --git a/target/linux/brcm2708/patches-4.9/950-0121-ARM64-Make-it-work-again-on-4.9-1790.patch b/target/linux/brcm2708/patches-4.9/950-0121-ARM64-Make-it-work-again-on-4.9-1790.patch
index 96b298dd1b..8fea94d44a 100644
--- a/target/linux/brcm2708/patches-4.9/950-0121-ARM64-Make-it-work-again-on-4.9-1790.patch
+++ b/target/linux/brcm2708/patches-4.9/950-0121-ARM64-Make-it-work-again-on-4.9-1790.patch
@@ -16,8 +16,6 @@ Signed-off-by: Michael Zoran <mzoran@crowfest.net>
  4 files changed, 48 insertions(+), 111 deletions(-)
  create mode 120000 arch/arm64/boot/dts/overlays
 
-diff --git a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms
-index 7d213c2c..101794f 100644
 --- a/arch/arm64/Kconfig.platforms
 +++ b/arch/arm64/Kconfig.platforms
 @@ -1,27 +1,5 @@
@@ -48,8 +46,6 @@ index 7d213c2c..101794f 100644
  config ARCH_SUNXI
  	bool "Allwinner sunxi 64-bit SoC Family"
  	select GENERIC_IRQ_CHIP
-diff --git a/arch/arm64/boot/dts/broadcom/Makefile b/arch/arm64/boot/dts/broadcom/Makefile
-index 2152448..7aa03be 100644
 --- a/arch/arm64/boot/dts/broadcom/Makefile
 +++ b/arch/arm64/boot/dts/broadcom/Makefile
 @@ -1,7 +1,15 @@
@@ -69,16 +65,6 @@ index 2152448..7aa03be 100644
  
  always		:= $(dtb-y)
  subdir-y	:= $(dts-dirs)
-diff --git a/arch/arm64/boot/dts/overlays b/arch/arm64/boot/dts/overlays
-new file mode 120000
-index 0000000..ded0864
---- /dev/null
-+++ b/arch/arm64/boot/dts/overlays
-@@ -0,0 +1 @@
-+../../../arm/boot/dts/overlays
-\ No newline at end of file
-diff --git a/arch/arm64/configs/bcmrpi3_defconfig b/arch/arm64/configs/bcmrpi3_defconfig
-index 53da5c7..c7e891d 100644
 --- a/arch/arm64/configs/bcmrpi3_defconfig
 +++ b/arch/arm64/configs/bcmrpi3_defconfig
 @@ -1,52 +1,9 @@
@@ -405,6 +391,3 @@ index 53da5c7..c7e891d 100644
  CONFIG_LIBCRC32C=y
 -CONFIG_BCM2708_VCHIQ=n
 -CONFIG_ARCH_BCM2835=y
--- 
-2.1.4
-
diff --git a/target/linux/brcm2708/patches-4.9/950-0182-drm-vc4-Verify-at-boot-that-CMA-doesn-t-cross-a-256M.patch b/target/linux/brcm2708/patches-4.9/950-0182-drm-vc4-Verify-at-boot-that-CMA-doesn-t-cross-a-256M.patch
index 453d027ae9..f17293ce71 100644
--- a/target/linux/brcm2708/patches-4.9/950-0182-drm-vc4-Verify-at-boot-that-CMA-doesn-t-cross-a-256M.patch
+++ b/target/linux/brcm2708/patches-4.9/950-0182-drm-vc4-Verify-at-boot-that-CMA-doesn-t-cross-a-256M.patch
@@ -37,7 +37,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
  #include "linux/pm_runtime.h"
  #include "vc4_drv.h"
  #include "vc4_regs.h"
-@@ -185,8 +188,23 @@ static int vc4_v3d_bind(struct device *d
+@@ -188,8 +191,23 @@ static int vc4_v3d_bind(struct device *d
  	struct drm_device *drm = dev_get_drvdata(master);
  	struct vc4_dev *vc4 = to_vc4_dev(drm);
  	struct vc4_v3d *v3d = NULL;
@@ -76,4 +76,4 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
 +EXPORT_SYMBOL(cma_get_size);
  
  static unsigned long cma_bitmap_aligned_mask(const struct cma *cma,
- 					     int align_order)
+ 					     unsigned int align_order)
diff --git a/target/linux/generic/backport-4.9/024-8-tcp-tsq-move-tsq_flags-close-to-sk_wmem_alloc.patch b/target/linux/generic/backport-4.9/024-8-tcp-tsq-move-tsq_flags-close-to-sk_wmem_alloc.patch
index 0acd00817e..87b5253abb 100644
--- a/target/linux/generic/backport-4.9/024-8-tcp-tsq-move-tsq_flags-close-to-sk_wmem_alloc.patch
+++ b/target/linux/generic/backport-4.9/024-8-tcp-tsq-move-tsq_flags-close-to-sk_wmem_alloc.patch
@@ -145,7 +145,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
 --- a/net/ipv4/tcp_timer.c
 +++ b/net/ipv4/tcp_timer.c
-@@ -311,7 +311,7 @@ static void tcp_delack_timer(unsigned lo
+@@ -326,7 +326,7 @@ static void tcp_delack_timer(unsigned lo
  		inet_csk(sk)->icsk_ack.blocked = 1;
  		__NET_INC_STATS(sock_net(sk), LINUX_MIB_DELAYEDACKLOCKED);
  		/* deleguate our work to tcp_release_cb() */
@@ -154,7 +154,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  			sock_hold(sk);
  	}
  	bh_unlock_sock(sk);
-@@ -594,7 +594,7 @@ static void tcp_write_timer(unsigned lon
+@@ -609,7 +609,7 @@ static void tcp_write_timer(unsigned lon
  		tcp_write_timer_handler(sk);
  	} else {
  		/* delegate our work to tcp_release_cb() */
diff --git a/target/linux/generic/backport-4.9/040-crypto-fix-typo-in-KPP-dependency-of-CRYPTO_ECDH.patch b/target/linux/generic/backport-4.9/040-crypto-fix-typo-in-KPP-dependency-of-CRYPTO_ECDH.patch
deleted file mode 100644
index eaef5ca0e5..0000000000
--- a/target/linux/generic/backport-4.9/040-crypto-fix-typo-in-KPP-dependency-of-CRYPTO_ECDH.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 4b05f09db650d215632da97f2c25ceba8235102a Mon Sep 17 00:00:00 2001
-From: Hauke Mehrtens <hauke@hauke-m.de>
-Date: Sun, 26 Nov 2017 00:09:45 +0100
-Subject: [PATCH] crypto: fix typo in KPP dependency of CRYPTO_ECDH
-
-This fixes a typo in the CRYPTO_KPP dependency of CRYPTO_ECDH.
-
-Fixes: 3c4b23901a0c ("crypto: ecdh - Add ECDH software support")
-Cc: <stable@vger.kernel.org> # v4.8+
-Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
----
- crypto/Kconfig | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/crypto/Kconfig
-+++ b/crypto/Kconfig
-@@ -120,7 +120,7 @@ config CRYPTO_DH
- 
- config CRYPTO_ECDH
- 	tristate "ECDH algorithm"
--	select CRYTPO_KPP
-+	select CRYPTO_KPP
- 	help
- 	  Generic implementation of the ECDH algorithm
- 
diff --git a/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch b/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch
index 5c6e334b19..d68670e219 100644
--- a/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch
+++ b/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch
@@ -1040,7 +1040,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		writel(irq->mask, adpt->base + EMAC_INT_MASK);
 --- a/drivers/net/ethernet/realtek/r8169.c
 +++ b/drivers/net/ethernet/realtek/r8169.c
-@@ -7579,7 +7579,7 @@ static int rtl8169_poll(struct napi_stru
+@@ -7574,7 +7574,7 @@ static int rtl8169_poll(struct napi_stru
  	}
  
  	if (work_done < budget) {
@@ -1379,7 +1379,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		 */
 --- a/drivers/net/xen-netfront.c
 +++ b/drivers/net/xen-netfront.c
-@@ -1059,7 +1059,7 @@ err:
+@@ -1061,7 +1061,7 @@ err:
  	if (work_done < budget) {
  		int more_to_do = 0;
  
diff --git a/target/linux/generic/hack-4.9/204-module_strip.patch b/target/linux/generic/hack-4.9/204-module_strip.patch
index e36846adb8..3dc0c88db1 100644
--- a/target/linux/generic/hack-4.9/204-module_strip.patch
+++ b/target/linux/generic/hack-4.9/204-module_strip.patch
@@ -98,7 +98,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/init/Kconfig
 +++ b/init/Kconfig
-@@ -2115,6 +2115,13 @@ config TRIM_UNUSED_KSYMS
+@@ -2122,6 +2122,13 @@ config TRIM_UNUSED_KSYMS
  
  	  If unsure, or if you need to build out-of-tree modules, say N.
  
@@ -114,7 +114,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  config MODULES_TREE_LOOKUP
 --- a/kernel/module.c
 +++ b/kernel/module.c
-@@ -2945,9 +2945,11 @@ static struct module *setup_load_info(st
+@@ -2954,9 +2954,11 @@ static struct module *setup_load_info(st
  
  static int check_modinfo(struct module *mod, struct load_info *info, int flags)
  {
@@ -127,14 +127,14 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (flags & MODULE_INIT_IGNORE_VERMAGIC)
  		modmagic = NULL;
  
-@@ -2968,6 +2970,7 @@ static int check_modinfo(struct module *
+@@ -2977,6 +2979,7 @@ static int check_modinfo(struct module *
  				mod->name);
  		add_taint_module(mod, TAINT_OOT_MODULE, LOCKDEP_STILL_OK);
  	}
 +#endif
  
- 	if (get_modinfo(info, "staging")) {
- 		add_taint_module(mod, TAINT_CRAP, LOCKDEP_STILL_OK);
+ 	check_modinfo_retpoline(mod, info);
+ 
 --- a/scripts/mod/modpost.c
 +++ b/scripts/mod/modpost.c
 @@ -1965,7 +1965,9 @@ static void read_symbols(char *modname)
@@ -157,7 +157,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	buf_printf(b, "\n");
  	buf_printf(b, "__visible struct module __this_module\n");
  	buf_printf(b, "__attribute__((section(\".gnu.linkonce.this_module\"))) = {\n");
-@@ -2126,16 +2130,20 @@ static void add_header(struct buffer *b,
+@@ -2126,24 +2130,30 @@ static void add_header(struct buffer *b,
  
  static void add_intree_flag(struct buffer *b, int is_intree)
  {
@@ -167,6 +167,16 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +#endif
  }
  
+ /* Cannot check for assembler */
+ static void add_retpoline(struct buffer *b)
+ {
++#ifndef CONFIG_MODULE_STRIPPED
+ 	buf_printf(b, "\n#ifdef RETPOLINE\n");
+ 	buf_printf(b, "MODULE_INFO(retpoline, \"Y\");\n");
+ 	buf_printf(b, "#endif\n");
++#endif
+ }
+ 
  static void add_staging_flag(struct buffer *b, const char *name)
  {
 +#ifndef CONFIG_MODULE_STRIPPED
@@ -178,7 +188,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  /* In kernel, this size is defined in linux/module.h;
-@@ -2239,11 +2247,13 @@ static void add_depends(struct buffer *b
+@@ -2247,11 +2257,13 @@ static void add_depends(struct buffer *b
  
  static void add_srcversion(struct buffer *b, struct module *mod)
  {
@@ -192,7 +202,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  static void write_if_changed(struct buffer *b, const char *fname)
-@@ -2477,7 +2487,9 @@ int main(int argc, char **argv)
+@@ -2486,7 +2498,9 @@ int main(int argc, char **argv)
  		add_staging_flag(&buf, mod->name);
  		err |= add_versions(&buf, mod);
  		add_depends(&buf, mod, modules);
diff --git a/target/linux/generic/hack-4.9/902-debloat_proc.patch b/target/linux/generic/hack-4.9/902-debloat_proc.patch
index 6216c2d4fb..f2b326fe34 100644
--- a/target/linux/generic/hack-4.9/902-debloat_proc.patch
+++ b/target/linux/generic/hack-4.9/902-debloat_proc.patch
@@ -132,7 +132,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	do {								\
 --- a/ipc/msg.c
 +++ b/ipc/msg.c
-@@ -1058,6 +1058,9 @@ void __init msg_init(void)
+@@ -1061,6 +1061,9 @@ void __init msg_init(void)
  {
  	msg_init_ns(&init_ipc_ns);
  
diff --git a/target/linux/generic/pending-4.9/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch b/target/linux/generic/pending-4.9/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch
index 794280eec9..adae2e049c 100644
--- a/target/linux/generic/pending-4.9/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch
+++ b/target/linux/generic/pending-4.9/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch
@@ -71,7 +71,7 @@ Signed-off-by: Tobias Wolf <dev-NTEO@vplace.de>
 
 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
-@@ -5923,7 +5923,7 @@ static void __ref alloc_node_mem_map(str
+@@ -5918,7 +5918,7 @@ static void __ref alloc_node_mem_map(str
  		mem_map = NODE_DATA(0)->node_mem_map;
  #if defined(CONFIG_HAVE_MEMBLOCK_NODE_MAP) || defined(CONFIG_FLATMEM)
  		if (page_to_pfn(mem_map) != pgdat->node_start_pfn)
diff --git a/target/linux/generic/pending-4.9/491-ubi-auto-create-ubiblock-device-for-rootfs.patch b/target/linux/generic/pending-4.9/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
index 2e7933ba2b..adc653ddcd 100644
--- a/target/linux/generic/pending-4.9/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
+++ b/target/linux/generic/pending-4.9/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
@@ -8,7 +8,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 
 --- a/drivers/mtd/ubi/block.c
 +++ b/drivers/mtd/ubi/block.c
-@@ -627,6 +627,44 @@ static void __init ubiblock_create_from_
+@@ -635,6 +635,44 @@ static void __init ubiblock_create_from_
  	}
  }
  
@@ -53,7 +53,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  static void ubiblock_remove_all(void)
  {
  	struct ubiblock *next;
-@@ -657,6 +695,10 @@ int __init ubiblock_init(void)
+@@ -667,6 +705,10 @@ int __init ubiblock_init(void)
  	 */
  	ubiblock_create_from_param();
  
diff --git a/target/linux/generic/pending-4.9/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch b/target/linux/generic/pending-4.9/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch
index e41dca6c93..8b8bef2641 100644
--- a/target/linux/generic/pending-4.9/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch
+++ b/target/linux/generic/pending-4.9/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch
@@ -17,9 +17,9 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  #include "ubi-media.h"
  #include "ubi.h"
 @@ -447,6 +448,15 @@ int ubiblock_create(struct ubi_volume_in
- 	add_disk(dev->gd);
  	dev_info(disk_to_dev(dev->gd), "created from ubi%d:%d(%s)",
  		 dev->ubi_num, dev->vol_id, vi->name);
+ 	mutex_unlock(&devices_mutex);
 +
 +	if (!strcmp(vi->name, "rootfs") &&
 +	    IS_ENABLED(CONFIG_MTD_ROOTFS_ROOT_DEV) &&
diff --git a/target/linux/generic/pending-4.9/650-pppoe_header_pad.patch b/target/linux/generic/pending-4.9/650-pppoe_header_pad.patch
deleted file mode 100644
index 3115073b50..0000000000
--- a/target/linux/generic/pending-4.9/650-pppoe_header_pad.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Subject: pppoe: add extra padding for the header (useful for drivers that need headroom)
-
-lede-commit 6517a757ec711fc3354b857e273e2621042f3c7a
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
- drivers/net/ppp/pppoe.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/net/ppp/pppoe.c
-+++ b/drivers/net/ppp/pppoe.c
-@@ -861,7 +861,7 @@ static int pppoe_sendmsg(struct socket *
- 		goto end;
- 
- 
--	skb = sock_wmalloc(sk, total_len + dev->hard_header_len + 32,
-+	skb = sock_wmalloc(sk, total_len + dev->hard_header_len + 32 + NET_SKB_PAD,
- 			   0, GFP_KERNEL);
- 	if (!skb) {
- 		error = -ENOMEM;
-@@ -869,7 +869,7 @@ static int pppoe_sendmsg(struct socket *
- 	}
- 
- 	/* Reserve space for headers. */
--	skb_reserve(skb, dev->hard_header_len);
-+	skb_reserve(skb, dev->hard_header_len + NET_SKB_PAD);
- 	skb_reset_network_header(skb);
- 
- 	skb->dev = dev;
diff --git a/target/linux/generic/pending-4.9/680-NET-skip-GRO-for-foreign-MAC-addresses.patch b/target/linux/generic/pending-4.9/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
index bd2ffe34ef..ce13e719e3 100644
--- a/target/linux/generic/pending-4.9/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
+++ b/target/linux/generic/pending-4.9/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
@@ -34,7 +34,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	__u16			tc_index;	/* traffic control index */
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -4524,6 +4524,9 @@ static enum gro_result dev_gro_receive(s
+@@ -4535,6 +4535,9 @@ static enum gro_result dev_gro_receive(s
  	enum gro_result ret;
  	int grow;
  
@@ -44,7 +44,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!(skb->dev->features & NETIF_F_GRO))
  		goto normal;
  
-@@ -5812,6 +5815,48 @@ static void __netdev_adjacent_dev_unlink
+@@ -5823,6 +5826,48 @@ static void __netdev_adjacent_dev_unlink
  					   &upper_dev->adj_list.lower);
  }
  
@@ -93,7 +93,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static int __netdev_upper_dev_link(struct net_device *dev,
  				   struct net_device *upper_dev, bool master,
  				   void *upper_priv, void *upper_info)
-@@ -6010,6 +6055,8 @@ void netdev_upper_dev_unlink(struct net_
+@@ -6021,6 +6066,8 @@ void netdev_upper_dev_unlink(struct net_
  	list_for_each_entry(i, &upper_dev->all_adj_list.upper, list)
  		__netdev_adjacent_dev_unlink(dev, i->dev, i->ref_nr);
  
@@ -102,7 +102,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	call_netdevice_notifiers_info(NETDEV_CHANGEUPPER, dev,
  				      &changeupper_info.info);
  }
-@@ -6610,6 +6657,7 @@ int dev_set_mac_address(struct net_devic
+@@ -6621,6 +6668,7 @@ int dev_set_mac_address(struct net_devic
  	if (err)
  		return err;
  	dev->addr_assign_type = NET_ADDR_SET;
diff --git a/target/linux/generic/pending-4.9/834-ledtrig-libata.patch b/target/linux/generic/pending-4.9/834-ledtrig-libata.patch
index 44ee23fb9b..50eaa52e97 100644
--- a/target/linux/generic/pending-4.9/834-ledtrig-libata.patch
+++ b/target/linux/generic/pending-4.9/834-ledtrig-libata.patch
@@ -65,7 +65,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  /**
   *	ata_build_rw_tf - Build ATA taskfile for given read/write request
   *	@tf: Target ATA taskfile
-@@ -4963,6 +4976,9 @@ struct ata_queued_cmd *ata_qc_new_init(s
+@@ -4964,6 +4977,9 @@ struct ata_queued_cmd *ata_qc_new_init(s
  		if (tag < 0)
  			return NULL;
  	}
@@ -75,7 +75,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  	qc = __ata_qc_from_tag(ap, tag);
  	qc->tag = tag;
-@@ -5865,6 +5881,9 @@ struct ata_port *ata_port_alloc(struct a
+@@ -5866,6 +5882,9 @@ struct ata_port *ata_port_alloc(struct a
  	ap->stats.unhandled_irq = 1;
  	ap->stats.idle_irq = 1;
  #endif
@@ -85,7 +85,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	ata_sff_port_init(ap);
  
  	return ap;
-@@ -5886,6 +5905,12 @@ static void ata_host_release(struct devi
+@@ -5887,6 +5906,12 @@ static void ata_host_release(struct devi
  
  		kfree(ap->pmp_link);
  		kfree(ap->slave_link);
@@ -98,7 +98,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		kfree(ap);
  		host->ports[i] = NULL;
  	}
-@@ -6332,7 +6357,23 @@ int ata_host_register(struct ata_host *h
+@@ -6333,7 +6358,23 @@ int ata_host_register(struct ata_host *h
  		host->ports[i]->print_id = atomic_inc_return(&ata_print_id);
  		host->ports[i]->local_port_no = i + 1;
  	}
diff --git a/target/linux/generic/pending-4.9/920-mangle_bootargs.patch b/target/linux/generic/pending-4.9/920-mangle_bootargs.patch
index bdf8c0d383..ec2f340097 100644
--- a/target/linux/generic/pending-4.9/920-mangle_bootargs.patch
+++ b/target/linux/generic/pending-4.9/920-mangle_bootargs.patch
@@ -13,7 +13,7 @@ Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
 
 --- a/init/Kconfig
 +++ b/init/Kconfig
-@@ -1687,6 +1687,15 @@ config EMBEDDED
+@@ -1694,6 +1694,15 @@ config EMBEDDED
  	  an embedded system so certain expert options are available
  	  for configuration.
  
diff --git a/target/linux/ixp4xx/patches-4.9/160-delayed_uart_io.patch b/target/linux/ixp4xx/patches-4.9/160-delayed_uart_io.patch
index 1ac9e5f9fb..3ca1f36379 100644
--- a/target/linux/ixp4xx/patches-4.9/160-delayed_uart_io.patch
+++ b/target/linux/ixp4xx/patches-4.9/160-delayed_uart_io.patch
@@ -18,7 +18,7 @@
  		uart->capabilities	= up->capabilities;
 --- a/drivers/tty/serial/serial_core.c
 +++ b/drivers/tty/serial/serial_core.c
-@@ -2229,6 +2229,7 @@ uart_report_port(struct uart_driver *drv
+@@ -2231,6 +2231,7 @@ uart_report_port(struct uart_driver *drv
  		snprintf(address, sizeof(address),
  			 "I/O 0x%lx offset 0x%x", port->iobase, port->hub6);
  		break;
@@ -26,7 +26,7 @@
  	case UPIO_MEM:
  	case UPIO_MEM16:
  	case UPIO_MEM32:
-@@ -2893,6 +2894,7 @@ int uart_match_port(struct uart_port *po
+@@ -2895,6 +2896,7 @@ int uart_match_port(struct uart_port *po
  	case UPIO_HUB6:
  		return (port1->iobase == port2->iobase) &&
  		       (port1->hub6   == port2->hub6);
diff --git a/target/linux/layerscape/patches-4.9/202-core-linux-support-layerscape.patch b/target/linux/layerscape/patches-4.9/202-core-linux-support-layerscape.patch
index 158ce0cfc9..9dcecb0789 100644
--- a/target/linux/layerscape/patches-4.9/202-core-linux-support-layerscape.patch
+++ b/target/linux/layerscape/patches-4.9/202-core-linux-support-layerscape.patch
@@ -421,7 +421,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
   *	These are the defined Ethernet Protocol ID's.
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -6604,9 +6604,18 @@ int dev_set_mtu(struct net_device *dev,
+@@ -6615,9 +6615,18 @@ int dev_set_mtu(struct net_device *dev,
  	if (new_mtu == dev->mtu)
  		return 0;
  
diff --git a/target/linux/layerscape/patches-4.9/803-cpufreq-support-layerscape.patch b/target/linux/layerscape/patches-4.9/803-cpufreq-support-layerscape.patch
index 2da45b6cf0..465f909a97 100644
--- a/target/linux/layerscape/patches-4.9/803-cpufreq-support-layerscape.patch
+++ b/target/linux/layerscape/patches-4.9/803-cpufreq-support-layerscape.patch
@@ -17,7 +17,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
 
 --- a/drivers/cpufreq/Kconfig
 +++ b/drivers/cpufreq/Kconfig
-@@ -332,7 +332,7 @@ endif
+@@ -334,7 +334,7 @@ endif
  
  config QORIQ_CPUFREQ
  	tristate "CPU frequency scaling driver for Freescale QorIQ SoCs"
diff --git a/target/linux/layerscape/patches-4.9/804-crypto-support-layerscape.patch b/target/linux/layerscape/patches-4.9/804-crypto-support-layerscape.patch
index c456eb862c..2598cdedbb 100644
--- a/target/linux/layerscape/patches-4.9/804-crypto-support-layerscape.patch
+++ b/target/linux/layerscape/patches-4.9/804-crypto-support-layerscape.patch
@@ -781,7 +781,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  };
  
  struct tcrypt_result {
-@@ -1331,6 +1331,10 @@ static int do_test(const char *alg, u32
+@@ -1333,6 +1333,10 @@ static int do_test(const char *alg, u32
  		ret += tcrypt_test("hmac(sha3-512)");
  		break;
  
@@ -792,7 +792,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  	case 150:
  		ret += tcrypt_test("ansi_cprng");
  		break;
-@@ -1392,6 +1396,9 @@ static int do_test(const char *alg, u32
+@@ -1394,6 +1398,9 @@ static int do_test(const char *alg, u32
  	case 190:
  		ret += tcrypt_test("authenc(hmac(sha512),cbc(des3_ede))");
  		break;
@@ -802,7 +802,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  	case 200:
  		test_cipher_speed("ecb(aes)", ENCRYPT, sec, NULL, 0,
  				speed_template_16_24_32);
-@@ -1406,9 +1413,9 @@ static int do_test(const char *alg, u32
+@@ -1408,9 +1415,9 @@ static int do_test(const char *alg, u32
  		test_cipher_speed("lrw(aes)", DECRYPT, sec, NULL, 0,
  				speed_template_32_40_48);
  		test_cipher_speed("xts(aes)", ENCRYPT, sec, NULL, 0,
@@ -814,7 +814,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  		test_cipher_speed("cts(cbc(aes))", ENCRYPT, sec, NULL, 0,
  				speed_template_16_24_32);
  		test_cipher_speed("cts(cbc(aes))", DECRYPT, sec, NULL, 0,
-@@ -1839,9 +1846,9 @@ static int do_test(const char *alg, u32
+@@ -1841,9 +1848,9 @@ static int do_test(const char *alg, u32
  		test_acipher_speed("lrw(aes)", DECRYPT, sec, NULL, 0,
  				   speed_template_32_40_48);
  		test_acipher_speed("xts(aes)", ENCRYPT, sec, NULL, 0,
@@ -23462,7 +23462,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  
  /*
   * Descriptor to instantiate RNG State Handle 0 in normal mode and
-@@ -270,7 +271,7 @@ static int deinstantiate_rng(struct devi
+@@ -274,7 +275,7 @@ static int deinstantiate_rng(struct devi
  		/*
  		 * If the corresponding bit is set, then it means the state
  		 * handle was initialized by us, and thus it needs to be
@@ -23471,7 +23471,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  		 */
  		if ((1 << sh_idx) & state_handle_mask) {
  			/*
-@@ -303,20 +304,24 @@ static int caam_remove(struct platform_d
+@@ -307,20 +308,24 @@ static int caam_remove(struct platform_d
  	struct device *ctrldev;
  	struct caam_drv_private *ctrlpriv;
  	struct caam_ctrl __iomem *ctrl;
@@ -23504,7 +23504,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  		deinstantiate_rng(ctrldev, ctrlpriv->rng4_sh_init);
  
  	/* Shut down debug views */
-@@ -331,8 +336,8 @@ static int caam_remove(struct platform_d
+@@ -335,8 +340,8 @@ static int caam_remove(struct platform_d
  	clk_disable_unprepare(ctrlpriv->caam_ipg);
  	clk_disable_unprepare(ctrlpriv->caam_mem);
  	clk_disable_unprepare(ctrlpriv->caam_aclk);
@@ -23515,7 +23515,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  	return 0;
  }
  
-@@ -366,11 +371,8 @@ static void kick_trng(struct platform_de
+@@ -370,11 +375,8 @@ static void kick_trng(struct platform_de
  	 */
  	val = (rd_reg32(&r4tst->rtsdctl) & RTSDCTL_ENT_DLY_MASK)
  	      >> RTSDCTL_ENT_DLY_SHIFT;
@@ -23529,7 +23529,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  
  	val = rd_reg32(&r4tst->rtsdctl);
  	val = (val & ~RTSDCTL_ENT_DLY_MASK) |
-@@ -382,15 +384,12 @@ static void kick_trng(struct platform_de
+@@ -386,15 +388,12 @@ static void kick_trng(struct platform_de
  	wr_reg32(&r4tst->rtfrqmax, RTFRQMAX_DISABLE);
  	/* read the control register */
  	val = rd_reg32(&r4tst->rtmctl);
@@ -23548,7 +23548,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  }
  
  /**
-@@ -411,28 +410,26 @@ int caam_get_era(void)
+@@ -415,28 +414,26 @@ int caam_get_era(void)
  }
  EXPORT_SYMBOL(caam_get_era);
  
@@ -23592,7 +23592,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  	struct device *dev;
  	struct device_node *nprop, *np;
  	struct caam_ctrl __iomem *ctrl;
-@@ -452,9 +449,10 @@ static int caam_probe(struct platform_de
+@@ -456,9 +453,10 @@ static int caam_probe(struct platform_de
  
  	dev = &pdev->dev;
  	dev_set_drvdata(dev, ctrlpriv);
@@ -23604,7 +23604,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  	/* Enable clocking */
  	clk = caam_drv_identify_clk(&pdev->dev, "ipg");
  	if (IS_ERR(clk)) {
-@@ -483,14 +481,16 @@ static int caam_probe(struct platform_de
+@@ -487,14 +485,16 @@ static int caam_probe(struct platform_de
  	}
  	ctrlpriv->caam_aclk = clk;
  
@@ -23628,7 +23628,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  
  	ret = clk_prepare_enable(ctrlpriv->caam_ipg);
  	if (ret < 0) {
-@@ -511,11 +511,13 @@ static int caam_probe(struct platform_de
+@@ -515,11 +515,13 @@ static int caam_probe(struct platform_de
  		goto disable_caam_mem;
  	}
  
@@ -23647,7 +23647,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  	}
  
  	/* Get configuration properties from device tree */
-@@ -542,13 +544,13 @@ static int caam_probe(struct platform_de
+@@ -546,13 +548,13 @@ static int caam_probe(struct platform_de
  	else
  		BLOCK_OFFSET = PG_SIZE_64K;
  
@@ -23666,7 +23666,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  			 BLOCK_OFFSET * DECO_BLOCK_NUMBER
  			 );
  
-@@ -557,12 +559,17 @@ static int caam_probe(struct platform_de
+@@ -561,12 +563,17 @@ static int caam_probe(struct platform_de
  
  	/*
  	 * Enable DECO watchdogs and, if this is a PHYS_ADDR_T_64BIT kernel,
@@ -23689,7 +23689,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  
  	/*
  	 *  Read the Compile Time paramters and SCFGR to determine
-@@ -590,64 +597,69 @@ static int caam_probe(struct platform_de
+@@ -594,64 +601,69 @@ static int caam_probe(struct platform_de
  			      JRSTART_JR1_START | JRSTART_JR2_START |
  			      JRSTART_JR3_START);
  
@@ -23797,7 +23797,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  	}
  
  	/* If no QI and no rings specified, quit and go home */
-@@ -662,8 +674,10 @@ static int caam_probe(struct platform_de
+@@ -666,8 +678,10 @@ static int caam_probe(struct platform_de
  	/*
  	 * If SEC has RNG version >= 4 and RNG state handle has not been
  	 * already instantiated, do RNG instantiation
@@ -23809,7 +23809,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  		ctrlpriv->rng4_sh_init =
  			rd_reg32(&ctrl->r4tst[0].rdsta);
  		/*
-@@ -730,78 +744,47 @@ static int caam_probe(struct platform_de
+@@ -734,78 +748,47 @@ static int caam_probe(struct platform_de
  
  	/* Report "alive" for developer to see */
  	dev_info(dev, "device ID = 0x%016llx (Era %d)\n", caam_id,
@@ -23923,7 +23923,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  	ctrlpriv->ctl_kek_wrap.size = KEK_KEY_SIZE * sizeof(u32);
  	ctrlpriv->ctl_kek = debugfs_create_blob("kek",
  						S_IRUSR |
-@@ -809,7 +792,7 @@ static int caam_probe(struct platform_de
+@@ -813,7 +796,7 @@ static int caam_probe(struct platform_de
  						ctrlpriv->ctl,
  						&ctrlpriv->ctl_kek_wrap);
  
@@ -23932,7 +23932,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  	ctrlpriv->ctl_tkek_wrap.size = KEK_KEY_SIZE * sizeof(u32);
  	ctrlpriv->ctl_tkek = debugfs_create_blob("tkek",
  						 S_IRUSR |
-@@ -817,7 +800,7 @@ static int caam_probe(struct platform_de
+@@ -821,7 +804,7 @@ static int caam_probe(struct platform_de
  						 ctrlpriv->ctl,
  						 &ctrlpriv->ctl_tkek_wrap);
  
@@ -23941,7 +23941,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  	ctrlpriv->ctl_tdsk_wrap.size = KEK_KEY_SIZE * sizeof(u32);
  	ctrlpriv->ctl_tdsk = debugfs_create_blob("tdsk",
  						 S_IRUSR |
-@@ -828,13 +811,17 @@ static int caam_probe(struct platform_de
+@@ -832,13 +815,17 @@ static int caam_probe(struct platform_de
  	return 0;
  
  caam_remove:
@@ -23960,7 +23960,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  disable_caam_aclk:
  	clk_disable_unprepare(ctrlpriv->caam_aclk);
  disable_caam_mem:
-@@ -844,17 +831,6 @@ disable_caam_ipg:
+@@ -848,17 +835,6 @@ disable_caam_ipg:
  	return ret;
  }
  
diff --git a/target/linux/layerscape/patches-4.9/819-Revert-dmaengine-dmatest-move-callback-wait-queue-to.patch b/target/linux/layerscape/patches-4.9/819-Revert-dmaengine-dmatest-move-callback-wait-queue-to.patch
deleted file mode 100644
index a8e8ad5c0c..0000000000
--- a/target/linux/layerscape/patches-4.9/819-Revert-dmaengine-dmatest-move-callback-wait-queue-to.patch
+++ /dev/null
@@ -1,134 +0,0 @@
-From 8772422ee95b17d87b5cb6cb4318b7ec73f4cfcf Mon Sep 17 00:00:00 2001
-From: Yangbo Lu <yangbo.lu@nxp.com>
-Date: Mon, 29 Jan 2018 18:04:07 +0800
-Subject: [PATCH] Revert "dmaengine: dmatest: move callback wait queue to
- thread context"
-
-This reverts commit 679dbeac0b6bb551e1f3b95673695b22b2ac953d.
----
- drivers/dma/dmatest.c | 55 ++++++++++++++++++++++-----------------------------
- 1 file changed, 24 insertions(+), 31 deletions(-)
-
---- a/drivers/dma/dmatest.c
-+++ b/drivers/dma/dmatest.c
-@@ -158,12 +158,6 @@ MODULE_PARM_DESC(run, "Run the test (def
- #define PATTERN_OVERWRITE	0x20
- #define PATTERN_COUNT_MASK	0x1f
- 
--/* poor man's completion - we want to use wait_event_freezable() on it */
--struct dmatest_done {
--	bool			done;
--	wait_queue_head_t	*wait;
--};
--
- struct dmatest_thread {
- 	struct list_head	node;
- 	struct dmatest_info	*info;
-@@ -172,8 +166,6 @@ struct dmatest_thread {
- 	u8			**srcs;
- 	u8			**dsts;
- 	enum dma_transaction_type type;
--	wait_queue_head_t done_wait;
--	struct dmatest_done test_done;
- 	bool			done;
- };
- 
-@@ -334,25 +326,18 @@ static unsigned int dmatest_verify(u8 **
- 	return error_count;
- }
- 
-+/* poor man's completion - we want to use wait_event_freezable() on it */
-+struct dmatest_done {
-+	bool			done;
-+	wait_queue_head_t	*wait;
-+};
- 
- static void dmatest_callback(void *arg)
- {
- 	struct dmatest_done *done = arg;
--	struct dmatest_thread *thread =
--		container_of(arg, struct dmatest_thread, done_wait);
--	if (!thread->done) {
--		done->done = true;
--		wake_up_all(done->wait);
--	} else {
--		/*
--		 * If thread->done, it means that this callback occurred
--		 * after the parent thread has cleaned up. This can
--		 * happen in the case that driver doesn't implement
--		 * the terminate_all() functionality and a dma operation
--		 * did not occur within the timeout period
--		 */
--		WARN(1, "dmatest: Kernel memory may be corrupted!!\n");
--	}
-+
-+	done->done = true;
-+	wake_up_all(done->wait);
- }
- 
- static unsigned int min_odd(unsigned int x, unsigned int y)
-@@ -423,8 +408,9 @@ static unsigned long long dmatest_KBs(s6
-  */
- static int dmatest_func(void *data)
- {
-+	DECLARE_WAIT_QUEUE_HEAD_ONSTACK(done_wait);
- 	struct dmatest_thread	*thread = data;
--	struct dmatest_done	*done = &thread->test_done;
-+	struct dmatest_done	done = { .wait = &done_wait };
- 	struct dmatest_info	*info;
- 	struct dmatest_params	*params;
- 	struct dma_chan		*chan;
-@@ -651,9 +637,9 @@ static int dmatest_func(void *data)
- 			continue;
- 		}
- 
--		done->done = false;
-+		done.done = false;
- 		tx->callback = dmatest_callback;
--		tx->callback_param = done;
-+		tx->callback_param = &done;
- 		cookie = tx->tx_submit(tx);
- 
- 		if (dma_submit_error(cookie)) {
-@@ -666,12 +652,21 @@ static int dmatest_func(void *data)
- 		}
- 		dma_async_issue_pending(chan);
- 
--		wait_event_freezable_timeout(thread->done_wait, done->done,
-+		wait_event_freezable_timeout(done_wait, done.done,
- 					     msecs_to_jiffies(params->timeout));
- 
- 		status = dma_async_is_tx_complete(chan, cookie, NULL, NULL);
- 
--		if (!done->done) {
-+		if (!done.done) {
-+			/*
-+			 * We're leaving the timed out dma operation with
-+			 * dangling pointer to done_wait.  To make this
-+			 * correct, we'll need to allocate wait_done for
-+			 * each test iteration and perform "who's gonna
-+			 * free it this time?" dancing.  For now, just
-+			 * leave it dangling.
-+			 */
-+			WARN(1, "dmatest: Kernel stack may be corrupted!!\n");
- 			dmaengine_unmap_put(um);
- 			result("test timed out", total_tests, src_off, dst_off,
- 			       len, 0);
-@@ -752,7 +747,7 @@ err_thread_type:
- 		dmatest_KBs(runtime, total_len), ret);
- 
- 	/* terminate all transfers on specified channels */
--	if (ret || failed_tests)
-+	if (ret)
- 		dmaengine_terminate_all(chan);
- 
- 	thread->done = true;
-@@ -812,8 +807,6 @@ static int dmatest_add_threads(struct dm
- 		thread->info = info;
- 		thread->chan = dtc->chan;
- 		thread->type = type;
--		thread->test_done.wait = &thread->done_wait;
--		init_waitqueue_head(&thread->done_wait);
- 		smp_wmb();
- 		thread->task = kthread_create(dmatest_func, thread, "%s-%s%u",
- 				dma_chan_name(chan), op, i);
diff --git a/target/linux/mpc85xx/patches-4.9/102-powerpc-add-cmdline-override.patch b/target/linux/mpc85xx/patches-4.9/102-powerpc-add-cmdline-override.patch
index 3d59927d1d..c70ac1bb9d 100644
--- a/target/linux/mpc85xx/patches-4.9/102-powerpc-add-cmdline-override.patch
+++ b/target/linux/mpc85xx/patches-4.9/102-powerpc-add-cmdline-override.patch
@@ -1,6 +1,6 @@
 --- a/arch/powerpc/Kconfig
 +++ b/arch/powerpc/Kconfig
-@@ -707,6 +707,14 @@ config CMDLINE_FORCE
+@@ -708,6 +708,14 @@ config CMDLINE_FORCE
  	  This is useful if you cannot or don't want to change the
  	  command-line options your boot loader passes to the kernel.
  
diff --git a/target/linux/pistachio/patches-4.9/411-mtd-nand-Check-length-of-ID-before-reading-bits-per-.patch b/target/linux/pistachio/patches-4.9/411-mtd-nand-Check-length-of-ID-before-reading-bits-per-.patch
index f360613f9f..6ffac4dc05 100644
--- a/target/linux/pistachio/patches-4.9/411-mtd-nand-Check-length-of-ID-before-reading-bits-per-.patch
+++ b/target/linux/pistachio/patches-4.9/411-mtd-nand-Check-length-of-ID-before-reading-bits-per-.patch
@@ -21,7 +21,7 @@ Signed-off-by: Ezequiel Garcia <ezequiel.garcia@imgtec.com>
 
 --- a/drivers/mtd/nand/nand_base.c
 +++ b/drivers/mtd/nand/nand_base.c
-@@ -4043,7 +4043,8 @@ static bool find_full_id_nand(struct mtd
+@@ -4046,7 +4046,8 @@ static bool find_full_id_nand(struct mtd
  		mtd->erasesize = type->erasesize;
  		mtd->oobsize = type->oobsize;
  
diff --git a/target/linux/ramips/patches-4.9/0040-nand-hack.patch b/target/linux/ramips/patches-4.9/0040-nand-hack.patch
index e0bd5f6026..5bc00b16b5 100644
--- a/target/linux/ramips/patches-4.9/0040-nand-hack.patch
+++ b/target/linux/ramips/patches-4.9/0040-nand-hack.patch
@@ -18,7 +18,7 @@
  			if (ret < 0) {
  				if (use_bufpoi)
  					/* Invalidate page cache */
-@@ -3206,8 +3210,11 @@ int nand_erase_nand(struct mtd_info *mtd
+@@ -3209,8 +3213,11 @@ int nand_erase_nand(struct mtd_info *mtd
  		    (page + pages_per_block))
  			chip->pagebuf = -1;
  
@@ -31,7 +31,7 @@
  		/*
  		 * See if operation failed and additional status checks are
  		 * available
-@@ -4401,6 +4408,7 @@ int nand_scan_ident(struct mtd_info *mtd
+@@ -4404,6 +4411,7 @@ int nand_scan_ident(struct mtd_info *mtd
  		 * cmdfunc() both expect cmd_ctrl() to be populated,
  		 * so we need to check that that's the case
  		 */
diff --git a/target/linux/ramips/patches-4.9/0901-spansion_nand_id_fix.patch b/target/linux/ramips/patches-4.9/0901-spansion_nand_id_fix.patch
index daaa0aca65..fa5b1274ef 100644
--- a/target/linux/ramips/patches-4.9/0901-spansion_nand_id_fix.patch
+++ b/target/linux/ramips/patches-4.9/0901-spansion_nand_id_fix.patch
@@ -13,7 +13,7 @@ Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
 
 --- a/drivers/mtd/nand/nand_base.c
 +++ b/drivers/mtd/nand/nand_base.c
-@@ -3853,6 +3853,7 @@ static void nand_decode_ext_id(struct mt
+@@ -3856,6 +3856,7 @@ static void nand_decode_ext_id(struct mt
  	/*
  	 * Field definitions are in the following datasheets:
  	 * Old style (4,5 byte ID): Samsung K9GAG08U0M (p.32)
@@ -21,7 +21,7 @@ Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
  	 * New Samsung (6 byte ID): Samsung K9GAG08U0F (p.44)
  	 * Hynix MLC   (6 byte ID): Hynix H27UBG8T2B (p.22)
  	 *
-@@ -3950,6 +3951,19 @@ static void nand_decode_ext_id(struct mt
+@@ -3953,6 +3954,19 @@ static void nand_decode_ext_id(struct mt
  		*busw = (extid & 0x01) ? NAND_BUSWIDTH_16 : 0;
  
  		/*