kernel: bump 4.9 to 4.9.219

Refreshed all patches.

Altered patches:
- 0026-NET-multi-phy-support.patch

Fixes:
- CVE-2020-8647
- CVE-2020-8648 (Potentially)
- CVE-2020-8649

Compile-tested on: ar71xx
Runtime-tested on: ar71xx

Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>

19 files changed, 72 insertions, 72 deletions

diff --git a/include/kernel-version.mk b/include/kernel-version.mk
index b20573dd00..65553b3444 100644
--- a/include/kernel-version.mk
+++ b/include/kernel-version.mk
@@ -2,10 +2,10 @@
 
 LINUX_RELEASE?=1
 
-LINUX_VERSION-4.9 = .215
+LINUX_VERSION-4.9 = .219
 LINUX_VERSION-4.14 = .172
 
-LINUX_KERNEL_HASH-4.9.215 = 236f2f47853700f22b9925cb17917d97ff7120fcc8110ec827c5a030a8129f48
+LINUX_KERNEL_HASH-4.9.219 = 6b17238cced3e1c2753d6d5b4f662bd347d4651f07c35506b849eb10aea7bc44
 LINUX_KERNEL_HASH-4.14.172 = 2318a1ab937580a079351ed20557c336a3d95b664f667b14e3ba49e3271b217a
 
 remove_uri_prefix=$(subst git://,,$(subst http://,,$(subst https://,,$(1))))
diff --git a/target/linux/brcm2708/patches-4.9/950-0010-serial-8250-Don-t-crash-when-nr_uarts-is-0.patch b/target/linux/brcm2708/patches-4.9/950-0010-serial-8250-Don-t-crash-when-nr_uarts-is-0.patch
index 447f1ce085..64ad299820 100644
--- a/target/linux/brcm2708/patches-4.9/950-0010-serial-8250-Don-t-crash-when-nr_uarts-is-0.patch
+++ b/target/linux/brcm2708/patches-4.9/950-0010-serial-8250-Don-t-crash-when-nr_uarts-is-0.patch
@@ -9,7 +9,7 @@ Subject: [PATCH] serial: 8250: Don't crash when nr_uarts is 0
 
 --- a/drivers/tty/serial/8250/8250_core.c
 +++ b/drivers/tty/serial/8250/8250_core.c
-@@ -509,6 +509,8 @@ static void __init serial8250_isa_init_p
+@@ -508,6 +508,8 @@ static void __init serial8250_isa_init_p
  
  	if (nr_uarts > UART_NR)
  		nr_uarts = UART_NR;
diff --git a/target/linux/brcm2708/patches-4.9/950-0031-Add-dwc_otg-driver.patch b/target/linux/brcm2708/patches-4.9/950-0031-Add-dwc_otg-driver.patch
index f909e88a10..b125e6a60e 100644
--- a/target/linux/brcm2708/patches-4.9/950-0031-Add-dwc_otg-driver.patch
+++ b/target/linux/brcm2708/patches-4.9/950-0031-Add-dwc_otg-driver.patch
@@ -696,7 +696,7 @@ Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
  }
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
-@@ -5091,7 +5091,7 @@ static void port_event(struct usb_hub *h
+@@ -5095,7 +5095,7 @@ static void port_event(struct usb_hub *h
  	if (portchange & USB_PORT_STAT_C_OVERCURRENT) {
  		u16 status = 0, unused;
  
diff --git a/target/linux/brcm2708/patches-4.9/950-0053-scripts-dtc-Update-to-upstream-version-1.4.1.patch b/target/linux/brcm2708/patches-4.9/950-0053-scripts-dtc-Update-to-upstream-version-1.4.1.patch
index ed4b27092b..bc7bfa1e77 100644
--- a/target/linux/brcm2708/patches-4.9/950-0053-scripts-dtc-Update-to-upstream-version-1.4.1.patch
+++ b/target/linux/brcm2708/patches-4.9/950-0053-scripts-dtc-Update-to-upstream-version-1.4.1.patch
@@ -174,7 +174,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
 --- a/scripts/dtc/dtc-lexer.l
 +++ b/scripts/dtc/dtc-lexer.l
-@@ -121,6 +121,11 @@ static void lexical_error(const char *fm
+@@ -120,6 +120,11 @@ static void lexical_error(const char *fm
  			return DT_V1;
  		}
  
@@ -629,7 +629,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
      } ;
  
  static yy_state_type yy_last_accepting_state;
-@@ -662,7 +664,7 @@ static int dts_version = 1;
+@@ -661,7 +663,7 @@ static int dts_version = 1;
  static void push_input_file(const char *filename);
  static bool pop_input_file(void);
  static void lexical_error(const char *fmt, ...);
@@ -638,7 +638,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
  #define INITIAL 0
  #define BYTESTRING 1
-@@ -704,7 +706,7 @@ FILE *yyget_out (void );
+@@ -703,7 +705,7 @@ FILE *yyget_out (void );
  
  void yyset_out  (FILE * out_str  );
  
@@ -647,7 +647,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
  char *yyget_text (void );
  
-@@ -853,6 +855,10 @@ YY_DECL
+@@ -852,6 +854,10 @@ YY_DECL
  	register char *yy_cp, *yy_bp;
  	register int yy_act;
      
@@ -658,7 +658,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	if ( !(yy_init) )
  		{
  		(yy_init) = 1;
-@@ -879,11 +885,6 @@ YY_DECL
+@@ -878,11 +884,6 @@ YY_DECL
  		yy_load_buffer_state( );
  		}
  
@@ -670,7 +670,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	while ( 1 )		/* loops until end-of-file is reached */
  		{
  		yy_cp = (yy_c_buf_p);
-@@ -901,7 +902,7 @@ YY_DECL
+@@ -900,7 +901,7 @@ YY_DECL
  yy_match:
  		do
  			{
@@ -679,7 +679,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  			if ( yy_accept[yy_current_state] )
  				{
  				(yy_last_accepting_state) = yy_current_state;
-@@ -910,13 +911,13 @@ yy_match:
+@@ -909,13 +910,13 @@ yy_match:
  			while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
  				{
  				yy_current_state = (int) yy_def[yy_current_state];
@@ -695,7 +695,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  		yy_cp = (yy_last_accepting_cpos);
  		yy_current_state = (yy_last_accepting_state);
  
-@@ -951,39 +952,31 @@ case 2:
+@@ -950,39 +951,31 @@ case 2:
  YY_RULE_SETUP
  #line 75 "dtc-lexer.l"
  {
@@ -749,7 +749,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  {
  			if (!pop_input_file()) {
  				yyterminate();
-@@ -993,7 +986,7 @@ case YY_STATE_EOF(V1):
+@@ -992,7 +985,7 @@ case YY_STATE_EOF(V1):
  case 3:
  /* rule 3 can match eol */
  YY_RULE_SETUP
@@ -758,7 +758,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  {
  			DPRINT("String: %s\n", yytext);
  			yylval.data = data_copy_escape_string(yytext+1,
-@@ -1003,7 +996,7 @@ YY_RULE_SETUP
+@@ -1002,7 +995,7 @@ YY_RULE_SETUP
  	YY_BREAK
  case 4:
  YY_RULE_SETUP
@@ -767,7 +767,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  {
  			DPRINT("Keyword: /dts-v1/\n");
  			dts_version = 1;
-@@ -1013,25 +1006,33 @@ YY_RULE_SETUP
+@@ -1012,25 +1005,33 @@ YY_RULE_SETUP
  	YY_BREAK
  case 5:
  YY_RULE_SETUP
@@ -806,7 +806,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  {
  			DPRINT("Keyword: /delete-property/\n");
  			DPRINT("<PROPNODENAME>\n");
-@@ -1039,9 +1040,9 @@ YY_RULE_SETUP
+@@ -1038,9 +1039,9 @@ YY_RULE_SETUP
  			return DT_DEL_PROP;
  		}
  	YY_BREAK
@@ -818,7 +818,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  {
  			DPRINT("Keyword: /delete-node/\n");
  			DPRINT("<PROPNODENAME>\n");
-@@ -1049,9 +1050,9 @@ YY_RULE_SETUP
+@@ -1048,9 +1049,9 @@ YY_RULE_SETUP
  			return DT_DEL_NODE;
  		}
  	YY_BREAK
@@ -830,7 +830,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  {
  			DPRINT("Label: %s\n", yytext);
  			yylval.labelref = xstrdup(yytext);
-@@ -1059,9 +1060,9 @@ YY_RULE_SETUP
+@@ -1058,9 +1059,9 @@ YY_RULE_SETUP
  			return DT_LABEL;
  		}
  	YY_BREAK
@@ -842,7 +842,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  {
  			char *e;
  			DPRINT("Integer Literal: '%s'\n", yytext);
-@@ -1069,10 +1070,7 @@ YY_RULE_SETUP
+@@ -1068,10 +1069,7 @@ YY_RULE_SETUP
  			errno = 0;
  			yylval.integer = strtoull(yytext, &e, 0);
  
@@ -854,7 +854,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
  			if (errno == ERANGE)
  				lexical_error("Integer literal '%s' out of range",
-@@ -1084,10 +1082,10 @@ YY_RULE_SETUP
+@@ -1083,10 +1081,10 @@ YY_RULE_SETUP
  			return DT_LITERAL;
  		}
  	YY_BREAK
@@ -868,7 +868,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  {
  			struct data d;
  			DPRINT("Character literal: %s\n", yytext);
-@@ -1109,18 +1107,18 @@ YY_RULE_SETUP
+@@ -1108,18 +1106,18 @@ YY_RULE_SETUP
  			return DT_CHAR_LITERAL;
  		}
  	YY_BREAK
@@ -891,7 +891,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  {	/* new-style path reference */
  			yytext[yyleng-1] = '\0';
  			DPRINT("Ref: %s\n", yytext+2);
-@@ -1128,27 +1126,27 @@ YY_RULE_SETUP
+@@ -1127,27 +1125,27 @@ YY_RULE_SETUP
  			return DT_REF;
  		}
  	YY_BREAK
@@ -925,7 +925,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  {
  			DPRINT("PropNodeName: %s\n", yytext);
  			yylval.propnodename = xstrdup((yytext[0] == '\\') ?
-@@ -1157,75 +1155,75 @@ YY_RULE_SETUP
+@@ -1156,75 +1154,75 @@ YY_RULE_SETUP
  			return DT_PROPNODENAME;
  		}
  	YY_BREAK
@@ -1030,7 +1030,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  {
  			DPRINT("Char: %c (\\x%02x)\n", yytext[0],
  				(unsigned)yytext[0]);
-@@ -1241,12 +1239,12 @@ YY_RULE_SETUP
+@@ -1240,12 +1238,12 @@ YY_RULE_SETUP
  			return yytext[0];
  		}
  	YY_BREAK
@@ -1046,7 +1046,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
  	case YY_END_OF_BUFFER:
  		{
-@@ -1376,7 +1374,6 @@ ECHO;
+@@ -1375,7 +1373,6 @@ ECHO;
  			"fatal flex scanner internal error--no action found" );
  	} /* end of action switch */
  		} /* end of scanning one token */
@@ -1054,7 +1054,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  } /* end of yylex */
  
  /* yy_get_next_buffer - try to read in a new buffer
-@@ -1432,21 +1429,21 @@ static int yy_get_next_buffer (void)
+@@ -1431,21 +1428,21 @@ static int yy_get_next_buffer (void)
  
  	else
  		{
@@ -1079,7 +1079,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
  				if ( new_size <= 0 )
  					b->yy_buf_size += b->yy_buf_size / 8;
-@@ -1477,7 +1474,7 @@ static int yy_get_next_buffer (void)
+@@ -1476,7 +1473,7 @@ static int yy_get_next_buffer (void)
  
  		/* Read in more data. */
  		YY_INPUT( (&YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move]),
@@ -1088,7 +1088,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
  		YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars);
  		}
-@@ -1539,7 +1536,7 @@ static int yy_get_next_buffer (void)
+@@ -1538,7 +1535,7 @@ static int yy_get_next_buffer (void)
  		while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
  			{
  			yy_current_state = (int) yy_def[yy_current_state];
@@ -1097,7 +1097,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  				yy_c = yy_meta[(unsigned int) yy_c];
  			}
  		yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
-@@ -1567,13 +1564,13 @@ static int yy_get_next_buffer (void)
+@@ -1566,13 +1563,13 @@ static int yy_get_next_buffer (void)
  	while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state )
  		{
  		yy_current_state = (int) yy_def[yy_current_state];
@@ -1114,7 +1114,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  }
  
  #ifndef YY_NO_INPUT
-@@ -1600,7 +1597,7 @@ static int yy_get_next_buffer (void)
+@@ -1599,7 +1596,7 @@ static int yy_get_next_buffer (void)
  
  		else
  			{ /* need more input */
@@ -1123,7 +1123,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  			++(yy_c_buf_p);
  
  			switch ( yy_get_next_buffer(  ) )
-@@ -1874,7 +1871,7 @@ void yypop_buffer_state (void)
+@@ -1873,7 +1870,7 @@ void yypop_buffer_state (void)
   */
  static void yyensure_buffer_stack (void)
  {
@@ -1132,7 +1132,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
      
  	if (!(yy_buffer_stack)) {
  
-@@ -1971,12 +1968,12 @@ YY_BUFFER_STATE yy_scan_string (yyconst
+@@ -1970,12 +1967,12 @@ YY_BUFFER_STATE yy_scan_string (yyconst
   * 
   * @return the newly allocated buffer state object.
   */
@@ -1147,7 +1147,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
      
  	/* Get memory for full buffer, including space for trailing EOB's. */
  	n = _yybytes_len + 2;
-@@ -2058,7 +2055,7 @@ FILE *yyget_out  (void)
+@@ -2057,7 +2054,7 @@ FILE *yyget_out  (void)
  /** Get the length of the current token.
   * 
   */
@@ -1156,7 +1156,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  {
          return yyleng;
  }
-@@ -2206,7 +2203,7 @@ void yyfree (void * ptr )
+@@ -2205,7 +2202,7 @@ void yyfree (void * ptr )
  
  #define YYTABLES_NAME "yytables"
  
diff --git a/target/linux/brcm2708/patches-4.9/950-0063-Improve-__copy_to_user-and-__copy_from_user-performa.patch b/target/linux/brcm2708/patches-4.9/950-0063-Improve-__copy_to_user-and-__copy_from_user-performa.patch
index 4d9af00207..f44039ea30 100644
--- a/target/linux/brcm2708/patches-4.9/950-0063-Improve-__copy_to_user-and-__copy_from_user-performa.patch
+++ b/target/linux/brcm2708/patches-4.9/950-0063-Improve-__copy_to_user-and-__copy_from_user-performa.patch
@@ -279,7 +279,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 -ENDPROC(arm_copy_from_user)
 +ENDPROC(__copy_from_user_std)
  
- 	.pushsection .fixup,"ax"
+ 	.pushsection .text.fixup,"ax"
  	.align 0
 --- /dev/null
 +++ b/arch/arm/lib/exports_rpi.c
diff --git a/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch b/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch
index 393cbbabb6..712348c835 100644
--- a/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch
+++ b/target/linux/generic/backport-4.9/090-net-generalize-napi_complete_done.patch
@@ -803,7 +803,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
 --- a/drivers/net/ethernet/marvell/mvneta.c
 +++ b/drivers/net/ethernet/marvell/mvneta.c
-@@ -2702,11 +2702,9 @@ static int mvneta_poll(struct napi_struc
+@@ -2701,11 +2701,9 @@ static int mvneta_poll(struct napi_struc
  			rx_done = mvneta_rx_swbm(pp, budget, &pp->rxqs[rx_queue]);
  	}
  
diff --git a/target/linux/generic/hack-4.9/702-phy_add_aneg_done_function.patch b/target/linux/generic/hack-4.9/702-phy_add_aneg_done_function.patch
index e5b610b4c8..ab8b8647ec 100644
--- a/target/linux/generic/hack-4.9/702-phy_add_aneg_done_function.patch
+++ b/target/linux/generic/hack-4.9/702-phy_add_aneg_done_function.patch
@@ -1,6 +1,6 @@
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -495,6 +495,12 @@ struct phy_driver {
+@@ -497,6 +497,12 @@ struct phy_driver {
  	/* Determines the negotiated speed and duplex */
  	int (*read_status)(struct phy_device *phydev);
  
@@ -15,7 +15,7 @@
  
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -1316,6 +1316,9 @@ int genphy_update_link(struct phy_device
+@@ -1320,6 +1320,9 @@ int genphy_update_link(struct phy_device
  {
  	int status;
  
diff --git a/target/linux/generic/hack-4.9/710-phy-add-mdio_register_board_info.patch b/target/linux/generic/hack-4.9/710-phy-add-mdio_register_board_info.patch
index 844f747859..e25c517ea7 100644
--- a/target/linux/generic/hack-4.9/710-phy-add-mdio_register_board_info.patch
+++ b/target/linux/generic/hack-4.9/710-phy-add-mdio_register_board_info.patch
@@ -50,7 +50,7 @@
  		phy_device_free(phydev);
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -870,6 +870,23 @@ void mdio_bus_exit(void);
+@@ -872,6 +872,23 @@ void mdio_bus_exit(void);
  
  extern struct bus_type mdio_bus_type;
  
diff --git a/target/linux/generic/hack-4.9/901-debloat_sock_diag.patch b/target/linux/generic/hack-4.9/901-debloat_sock_diag.patch
index 5e7884130a..a78bb0f8a4 100644
--- a/target/linux/generic/hack-4.9/901-debloat_sock_diag.patch
+++ b/target/linux/generic/hack-4.9/901-debloat_sock_diag.patch
@@ -55,7 +55,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/net/ipv4/Kconfig
 +++ b/net/ipv4/Kconfig
-@@ -408,6 +408,7 @@ config INET_XFRM_MODE_BEET
+@@ -409,6 +409,7 @@ config INET_XFRM_MODE_BEET
  
  config INET_DIAG
  	tristate "INET: socket monitoring interface"
diff --git a/target/linux/generic/hack-4.9/902-debloat_proc.patch b/target/linux/generic/hack-4.9/902-debloat_proc.patch
index cb13f0ff02..43614633dd 100644
--- a/target/linux/generic/hack-4.9/902-debloat_proc.patch
+++ b/target/linux/generic/hack-4.9/902-debloat_proc.patch
@@ -233,7 +233,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		return -ENOMEM;
 --- a/mm/vmalloc.c
 +++ b/mm/vmalloc.c
-@@ -2727,6 +2727,8 @@ static const struct file_operations proc
+@@ -2730,6 +2730,8 @@ static const struct file_operations proc
  
  static int __init proc_vmalloc_init(void)
  {
@@ -339,7 +339,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/net/ipv4/fib_trie.c
 +++ b/net/ipv4/fib_trie.c
-@@ -2677,10 +2677,12 @@ static const struct file_operations fib_
+@@ -2680,10 +2680,12 @@ static const struct file_operations fib_
  
  int __net_init fib_proc_init(struct net *net)
  {
@@ -354,7 +354,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			 &fib_triestat_fops))
  		goto out2;
  
-@@ -2690,17 +2692,21 @@ int __net_init fib_proc_init(struct net
+@@ -2693,17 +2695,21 @@ int __net_init fib_proc_init(struct net
  	return 0;
  
  out3:
diff --git a/target/linux/generic/pending-4.9/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch b/target/linux/generic/pending-4.9/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
index 3f6b406cf2..b9c7aa06c9 100644
--- a/target/linux/generic/pending-4.9/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
+++ b/target/linux/generic/pending-4.9/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
@@ -66,7 +66,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  static void rt_fibinfo_free(struct rtable __rcu **rtp)
 --- a/net/ipv4/fib_trie.c
 +++ b/net/ipv4/fib_trie.c
-@@ -2406,6 +2406,7 @@ static const char *const rtn_type_names[
+@@ -2409,6 +2409,7 @@ static const char *const rtn_type_names[
  	[RTN_THROW] = "THROW",
  	[RTN_NAT] = "NAT",
  	[RTN_XRESOLVE] = "XRESOLVE",
@@ -181,7 +181,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		cfg->fc_flags |= RTF_REJECT;
  
  	if (rtm->rtm_type == RTN_LOCAL)
-@@ -3222,6 +3256,9 @@ static int rt6_fill_node(struct net *net
+@@ -3223,6 +3257,9 @@ static int rt6_fill_node(struct net *net
  		case -EACCES:
  			rtm->rtm_type = RTN_PROHIBIT;
  			break;
@@ -191,7 +191,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		case -EAGAIN:
  			rtm->rtm_type = RTN_THROW;
  			break;
-@@ -3498,6 +3535,8 @@ static int ip6_route_dev_notify(struct n
+@@ -3499,6 +3536,8 @@ static int ip6_route_dev_notify(struct n
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  		net->ipv6.ip6_prohibit_entry->dst.dev = dev;
  		net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
@@ -200,7 +200,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
  		net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
  #endif
-@@ -3509,6 +3548,7 @@ static int ip6_route_dev_notify(struct n
+@@ -3510,6 +3549,7 @@ static int ip6_route_dev_notify(struct n
  		in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  		in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);
@@ -208,7 +208,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		in6_dev_put(net->ipv6.ip6_blk_hole_entry->rt6i_idev);
  #endif
  	}
-@@ -3724,6 +3764,17 @@ static int __net_init ip6_route_net_init
+@@ -3725,6 +3765,17 @@ static int __net_init ip6_route_net_init
  	net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
  	dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
  			 ip6_template_metrics, true);
@@ -226,7 +226,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  #endif
  
  	net->ipv6.sysctl.flush_delay = 0;
-@@ -3742,6 +3793,8 @@ out:
+@@ -3743,6 +3794,8 @@ out:
  	return ret;
  
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
@@ -235,7 +235,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  out_ip6_prohibit_entry:
  	kfree(net->ipv6.ip6_prohibit_entry);
  out_ip6_null_entry:
-@@ -3759,6 +3812,7 @@ static void __net_exit ip6_route_net_exi
+@@ -3760,6 +3813,7 @@ static void __net_exit ip6_route_net_exi
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  	kfree(net->ipv6.ip6_prohibit_entry);
  	kfree(net->ipv6.ip6_blk_hole_entry);
@@ -243,7 +243,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  #endif
  	dst_entries_destroy(&net->ipv6.ip6_dst_ops);
  }
-@@ -3832,6 +3886,9 @@ void __init ip6_route_init_special_entri
+@@ -3833,6 +3887,9 @@ void __init ip6_route_init_special_entri
  	init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
  	init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
  	init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
diff --git a/target/linux/generic/pending-4.9/701-phy_extension.patch b/target/linux/generic/pending-4.9/701-phy_extension.patch
index 74931c421f..acd5f6836c 100644
--- a/target/linux/generic/pending-4.9/701-phy_extension.patch
+++ b/target/linux/generic/pending-4.9/701-phy_extension.patch
@@ -62,7 +62,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
   * @phydev: the phy_device struct
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -827,6 +827,7 @@ int phy_ethtool_ksettings_get(struct phy
+@@ -829,6 +829,7 @@ int phy_ethtool_ksettings_get(struct phy
  			      struct ethtool_link_ksettings *cmd);
  int phy_ethtool_ksettings_set(struct phy_device *phydev,
  			      const struct ethtool_link_ksettings *cmd);
diff --git a/target/linux/generic/pending-4.9/703-phy-add-detach-callback-to-struct-phy_driver.patch b/target/linux/generic/pending-4.9/703-phy-add-detach-callback-to-struct-phy_driver.patch
index 04b75b0188..9af4b0efcf 100644
--- a/target/linux/generic/pending-4.9/703-phy-add-detach-callback-to-struct-phy_driver.patch
+++ b/target/linux/generic/pending-4.9/703-phy-add-detach-callback-to-struct-phy_driver.patch
@@ -11,7 +11,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -1005,6 +1005,9 @@ void phy_detach(struct phy_device *phyde
+@@ -1009,6 +1009,9 @@ void phy_detach(struct phy_device *phyde
  	struct mii_bus *bus;
  	int i;
  
@@ -23,7 +23,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  	phy_suspend(phydev);
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -507,6 +507,12 @@ struct phy_driver {
+@@ -509,6 +509,12 @@ struct phy_driver {
  	 */
  	int (*did_interrupt)(struct phy_device *phydev);
  
diff --git a/target/linux/ixp4xx/patches-4.9/160-delayed_uart_io.patch b/target/linux/ixp4xx/patches-4.9/160-delayed_uart_io.patch
index a520cb3682..784f23576d 100644
--- a/target/linux/ixp4xx/patches-4.9/160-delayed_uart_io.patch
+++ b/target/linux/ixp4xx/patches-4.9/160-delayed_uart_io.patch
@@ -1,6 +1,6 @@
 --- a/drivers/tty/serial/8250/8250_core.c
 +++ b/drivers/tty/serial/8250/8250_core.c
-@@ -833,6 +833,7 @@ static int serial8250_probe(struct platf
+@@ -832,6 +832,7 @@ static int serial8250_probe(struct platf
  		uart.port.get_mctrl	= p->get_mctrl;
  		uart.port.pm		= p->pm;
  		uart.port.dev		= &dev->dev;
@@ -8,7 +8,7 @@
  		uart.port.irqflags	|= irqflag;
  		ret = serial8250_register_8250_port(&uart);
  		if (ret < 0) {
-@@ -989,6 +990,7 @@ int serial8250_register_8250_port(struct
+@@ -988,6 +989,7 @@ int serial8250_register_8250_port(struct
  		uart->bugs		= up->bugs;
  		uart->port.mapbase      = up->port.mapbase;
  		uart->port.mapsize      = up->port.mapsize;
@@ -105,7 +105,7 @@
  	case UPIO_AU:
  		p->serial_out(p, offset, value);
  		p->serial_in(p, UART_LCR);	/* safe, no side-effects */
-@@ -2759,6 +2779,7 @@ static int serial8250_request_std_resour
+@@ -2763,6 +2783,7 @@ static int serial8250_request_std_resour
  	case UPIO_MEM32BE:
  	case UPIO_MEM16:
  	case UPIO_MEM:
@@ -113,7 +113,7 @@
  		if (!port->mapbase)
  			break;
  
-@@ -2797,6 +2818,7 @@ static void serial8250_release_std_resou
+@@ -2801,6 +2822,7 @@ static void serial8250_release_std_resou
  	case UPIO_MEM32BE:
  	case UPIO_MEM16:
  	case UPIO_MEM:
diff --git a/target/linux/lantiq/patches-4.9/0026-NET-multi-phy-support.patch b/target/linux/lantiq/patches-4.9/0026-NET-multi-phy-support.patch
index e5cfc0a7d3..e616cfd6da 100644
--- a/target/linux/lantiq/patches-4.9/0026-NET-multi-phy-support.patch
+++ b/target/linux/lantiq/patches-4.9/0026-NET-multi-phy-support.patch
@@ -43,10 +43,10 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  		}
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -369,6 +369,7 @@ struct phy_device {
- 	bool is_pseudo_fixed_link;
+@@ -371,6 +371,7 @@ struct phy_device {
  	bool has_fixups;
  	bool suspended;
+ 	bool suspended_by_mdio_bus;
 +	bool no_auto_carrier_off;
  
  	enum phy_state state;
diff --git a/target/linux/layerscape/patches-4.9/201-config-support-layerscape.patch b/target/linux/layerscape/patches-4.9/201-config-support-layerscape.patch
index 218421265a..264f6acb3b 100644
--- a/target/linux/layerscape/patches-4.9/201-config-support-layerscape.patch
+++ b/target/linux/layerscape/patches-4.9/201-config-support-layerscape.patch
@@ -140,7 +140,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  	depends on IXP4XX_ETH
 --- a/drivers/rtc/Kconfig
 +++ b/drivers/rtc/Kconfig
-@@ -414,6 +414,14 @@ config RTC_DRV_PCF85063
+@@ -415,6 +415,14 @@ config RTC_DRV_PCF85063
  	  This driver can also be built as a module. If so, the module
  	  will be called rtc-pcf85063.
  
diff --git a/target/linux/layerscape/patches-4.9/703-phy-support-layerscape.patch b/target/linux/layerscape/patches-4.9/703-phy-support-layerscape.patch
index 99ffab1b90..a26b1b526d 100644
--- a/target/linux/layerscape/patches-4.9/703-phy-support-layerscape.patch
+++ b/target/linux/layerscape/patches-4.9/703-phy-support-layerscape.patch
@@ -1695,7 +1695,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  EXPORT_SYMBOL(phy_ethtool_get_wol);
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -1050,7 +1050,7 @@ int phy_suspend(struct phy_device *phyde
+@@ -1054,7 +1054,7 @@ int phy_suspend(struct phy_device *phyde
  	if (wol.wolopts)
  		return -EBUSY;
  
@@ -1704,7 +1704,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  		ret = phydrv->suspend(phydev);
  
  	if (ret)
-@@ -1067,7 +1067,7 @@ int phy_resume(struct phy_device *phydev
+@@ -1071,7 +1071,7 @@ int phy_resume(struct phy_device *phydev
  	struct phy_driver *phydrv = to_phy_driver(phydev->mdio.dev.driver);
  	int ret = 0;
  
@@ -1713,7 +1713,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  		ret = phydrv->resume(phydev);
  
  	if (ret)
-@@ -1724,7 +1724,7 @@ static int phy_remove(struct device *dev
+@@ -1728,7 +1728,7 @@ static int phy_remove(struct device *dev
  	phydev->state = PHY_DOWN;
  	mutex_unlock(&phydev->lock);
  
@@ -1751,7 +1751,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  	default:
  		return "unknown";
  	}
-@@ -791,6 +794,9 @@ int phy_stop_interrupts(struct phy_devic
+@@ -793,6 +796,9 @@ int phy_stop_interrupts(struct phy_devic
  
  static inline int phy_read_status(struct phy_device *phydev)
  {
diff --git a/target/linux/layerscape/patches-4.9/810-iommu-support-layerscape.patch b/target/linux/layerscape/patches-4.9/810-iommu-support-layerscape.patch
index 59cf0e7ad2..fdea5450f6 100644
--- a/target/linux/layerscape/patches-4.9/810-iommu-support-layerscape.patch
+++ b/target/linux/layerscape/patches-4.9/810-iommu-support-layerscape.patch
@@ -995,7 +995,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  };
  
  struct dmar_atsr_unit {
-@@ -4271,27 +4272,40 @@ static inline void init_iommu_pm_ops(voi
+@@ -4272,27 +4273,40 @@ static inline void init_iommu_pm_ops(voi
  int __init dmar_parse_one_rmrr(struct acpi_dmar_header *header, void *arg)
  {
  	struct acpi_dmar_reserved_memory *rmrr;
@@ -1041,7 +1041,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  }
  
  static struct dmar_atsr_unit *dmar_find_atsr(struct acpi_dmar_atsr *atsr)
-@@ -4505,6 +4519,7 @@ static void intel_iommu_free_dmars(void)
+@@ -4506,6 +4520,7 @@ static void intel_iommu_free_dmars(void)
  	list_for_each_entry_safe(rmrru, rmrr_n, &dmar_rmrr_units, list) {
  		list_del(&rmrru->list);
  		dmar_free_dev_scope(&rmrru->devices, &rmrru->devices_cnt);
@@ -1049,7 +1049,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  		kfree(rmrru);
  	}
  
-@@ -5243,6 +5258,45 @@ static void intel_iommu_remove_device(st
+@@ -5246,6 +5261,45 @@ static void intel_iommu_remove_device(st
  	iommu_device_unlink(iommu->iommu_dev, dev);
  }
  
@@ -1095,7 +1095,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  #ifdef CONFIG_INTEL_IOMMU_SVM
  #define MAX_NR_PASID_BITS (20)
  static inline unsigned long intel_iommu_get_pts(struct intel_iommu *iommu)
-@@ -5373,19 +5427,21 @@ struct intel_iommu *intel_svm_device_to_
+@@ -5376,19 +5430,21 @@ struct intel_iommu *intel_svm_device_to_
  #endif /* CONFIG_INTEL_IOMMU_SVM */
  
  static const struct iommu_ops intel_iommu_ops = {
diff --git a/target/linux/layerscape/patches-4.9/817-usb-support-layerscape.patch b/target/linux/layerscape/patches-4.9/817-usb-support-layerscape.patch
index 11b759e700..5e67c891c2 100644
--- a/target/linux/layerscape/patches-4.9/817-usb-support-layerscape.patch
+++ b/target/linux/layerscape/patches-4.9/817-usb-support-layerscape.patch
@@ -87,7 +87,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  			pkt_len = le32_to_cpu(rx_desc->opts1) & RX_LEN_MASK;
  			if (pkt_len < ETH_ZLEN)
  				break;
-@@ -4520,6 +4525,7 @@ static struct usb_device_id rtl8152_tabl
+@@ -4526,6 +4531,7 @@ static struct usb_device_id rtl8152_tabl
  	{REALTEK_USB_DEVICE(VENDOR_ID_LENOVO,  0x304f)},
  	{REALTEK_USB_DEVICE(VENDOR_ID_LINKSYS, 0x0041)},
  	{REALTEK_USB_DEVICE(VENDOR_ID_NVIDIA,  0x09ff)},
@@ -156,7 +156,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  	int ret;
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
-@@ -4450,6 +4450,14 @@ hub_port_init(struct usb_hub *hub, struc
+@@ -4454,6 +4454,14 @@ hub_port_init(struct usb_hub *hub, struc
  	else
  		speed = usb_speed_string(udev->speed);
  
@@ -632,7 +632,7 @@ Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
  	struct platform_device *dwc3_pdev = to_platform_device(dwc->dev);
  
  	irq = platform_get_irq_byname(dwc3_pdev, "peripheral");
-@@ -3042,6 +3043,12 @@ int dwc3_gadget_init(struct dwc3 *dwc)
+@@ -3041,6 +3042,12 @@ int dwc3_gadget_init(struct dwc3 *dwc)
  		goto err5;
  	}