kernel: update kernel 4.4 to 4.4.69

Bump the 17.01 tree kernel to 4.4.69. Trunk 4.4 and 17.01 4.4 have diverged, talked this
through with jow, he was okay with a clean diff against 17.01 and not a backported trunk
patch.

The following patches were applied upstream:

* 062-[1-6]-MIPS-* series
* 042-0004-mtd-bcm47xxpart-fix-parsing-first-block

Reintroduced lantiq/patches-4.4/0050-MIPS-Lantiq-Fix-cascaded-IRQ-setup, as
it was incorrectly included upstream thus dropped from LEDE, but subsequently
reverted upstream. Thanks to Kevin Darbyshire-Bryant for pointing me to it.

  Compile-tested on: ar71xx, ramips/mt7621, x86/64.

  Run-tested on: ar71xx, ramips/mt7621, x86/64.

Signed-off-by: Stijn Segers <francesco.borromini@inventati.org>

28 files changed, 143 insertions, 474 deletions

diff --git a/include/kernel-version.mk b/include/kernel-version.mk
index b56bb23..9660969 100644
--- a/include/kernel-version.mk
+++ b/include/kernel-version.mk
@@ -3,10 +3,10 @@
 LINUX_RELEASE?=1
 
 LINUX_VERSION-3.18 = .43
-LINUX_VERSION-4.4 = .61
+LINUX_VERSION-4.4 = .69
 
 LINUX_KERNEL_HASH-3.18.43 = 1236e8123a6ce537d5029232560966feed054ae31776fe8481dd7d18cdd5492c
-LINUX_KERNEL_HASH-4.4.61 = 30dee7164615ad8184eba4ea6f4906b3ceb2fe462a8a4a929c8e9aab8d4a31da
+LINUX_KERNEL_HASH-4.4.69 = 207bbc50aaf827d667a2762312bd6127887cc669ff7a7270b876e7102b8f84fa
 
 ifdef KERNEL_PATCHVER
   LINUX_VERSION:=$(KERNEL_PATCHVER)$(strip $(LINUX_VERSION-$(KERNEL_PATCHVER)))
diff --git a/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch b/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch
index e7df08b..7e3ba4c 100644
--- a/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch
+++ b/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch
@@ -310,7 +310,7 @@
  	if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
 --- a/net/ipv6/ip6_tunnel.c
 +++ b/net/ipv6/ip6_tunnel.c
-@@ -1407,7 +1407,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
+@@ -1409,7 +1409,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
  
  	dsfield = ipv6_get_dsfield(ipv6h);
  	if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
@@ -621,7 +621,7 @@
  		 * XXX skbs on the gro_list have all been parsed and pulled
 --- a/include/net/addrconf.h
 +++ b/include/net/addrconf.h
-@@ -43,7 +43,7 @@ struct prefix_info {
+@@ -45,7 +45,7 @@ struct prefix_info {
  	__be32			reserved2;
  
  	struct in6_addr		prefix;
diff --git a/target/linux/brcm2708/patches-4.4/0029-Add-dwc_otg-driver.patch b/target/linux/brcm2708/patches-4.4/0029-Add-dwc_otg-driver.patch
index 69711f6..1efdf8e 100644
--- a/target/linux/brcm2708/patches-4.4/0029-Add-dwc_otg-driver.patch
+++ b/target/linux/brcm2708/patches-4.4/0029-Add-dwc_otg-driver.patch
@@ -659,7 +659,7 @@ dwc_otg: Remove duplicate gadget probe/unregister function
  }
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
-@@ -4942,7 +4942,7 @@ static void port_event(struct usb_hub *h
+@@ -4958,7 +4958,7 @@ static void port_event(struct usb_hub *h
  	if (portchange & USB_PORT_STAT_C_OVERCURRENT) {
  		u16 status = 0, unused;
  
diff --git a/target/linux/brcm2708/patches-4.4/0061-config-Enable-CONFIG_MEMCG-but-leave-it-disabled-due.patch b/target/linux/brcm2708/patches-4.4/0061-config-Enable-CONFIG_MEMCG-but-leave-it-disabled-due.patch
index 81a8a62..f3f685a 100644
--- a/target/linux/brcm2708/patches-4.4/0061-config-Enable-CONFIG_MEMCG-but-leave-it-disabled-due.patch
+++ b/target/linux/brcm2708/patches-4.4/0061-config-Enable-CONFIG_MEMCG-but-leave-it-disabled-due.patch
@@ -10,7 +10,7 @@ Subject: [PATCH] config: Enable CONFIG_MEMCG, but leave it disabled (due to
 
 --- a/kernel/cgroup.c
 +++ b/kernel/cgroup.c
-@@ -5310,7 +5310,7 @@ int __init cgroup_init_early(void)
+@@ -5311,7 +5311,7 @@ int __init cgroup_init_early(void)
  	return 0;
  }
  
@@ -19,7 +19,7 @@ Subject: [PATCH] config: Enable CONFIG_MEMCG, but leave it disabled (due to
  
  /**
   * cgroup_init - cgroup initialization
-@@ -5806,6 +5806,27 @@ static int __init cgroup_disable(char *s
+@@ -5807,6 +5807,27 @@ static int __init cgroup_disable(char *s
  }
  __setup("cgroup_disable=", cgroup_disable);
  
diff --git a/target/linux/brcm2708/patches-4.4/0577-x86-ioapic-Restore-IO-APIC-irq_chip-retrigger-callba.patch b/target/linux/brcm2708/patches-4.4/0577-x86-ioapic-Restore-IO-APIC-irq_chip-retrigger-callba.patch
deleted file mode 100644
index 48aeac9..0000000
--- a/target/linux/brcm2708/patches-4.4/0577-x86-ioapic-Restore-IO-APIC-irq_chip-retrigger-callba.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 1dab2d7f80fa955ff493785033008b2c17f7cc53 Mon Sep 17 00:00:00 2001
-From: Ruslan Ruslichenko <rruslich@cisco.com>
-Date: Tue, 17 Jan 2017 16:13:52 +0200
-Subject: [PATCH] x86/ioapic: Restore IO-APIC irq_chip retrigger callback
-
-commit 020eb3daaba2857b32c4cf4c82f503d6a00a67de upstream.
-
-commit d32932d02e18 removed the irq_retrigger callback from the IO-APIC
-chip and did not add it to the new IO-APIC-IR irq chip.
-
-Unfortunately the software resend fallback is not enabled on X86, so edge
-interrupts which are received during the lazy disabled state of the
-interrupt line are not retriggered and therefor lost.
-
-Restore the callbacks.
-
-[ tglx: Massaged changelog ]
-
-Fixes: d32932d02e18  ("x86/irq: Convert IOAPIC to use hierarchical irqdomain interfaces")
-Signed-off-by: Ruslan Ruslichenko <rruslich@cisco.com>
-Cc: xe-linux-external@cisco.com
-Link: http://lkml.kernel.org/r/1484662432-13580-1-git-send-email-rruslich@cisco.com
-Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- arch/x86/kernel/apic/io_apic.c | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/arch/x86/kernel/apic/io_apic.c
-+++ b/arch/x86/kernel/apic/io_apic.c
-@@ -1875,6 +1875,7 @@ static struct irq_chip ioapic_chip __rea
- 	.irq_ack		= irq_chip_ack_parent,
- 	.irq_eoi		= ioapic_ack_level,
- 	.irq_set_affinity	= ioapic_set_affinity,
-+	.irq_retrigger		= irq_chip_retrigger_hierarchy,
- 	.flags			= IRQCHIP_SKIP_SET_WAKE,
- };
- 
-@@ -1886,6 +1887,7 @@ static struct irq_chip ioapic_ir_chip __
- 	.irq_ack		= irq_chip_ack_parent,
- 	.irq_eoi		= ioapic_ir_ack_level,
- 	.irq_set_affinity	= ioapic_set_affinity,
-+	.irq_retrigger		= irq_chip_retrigger_hierarchy,
- 	.flags			= IRQCHIP_SKIP_SET_WAKE,
- };
- 
diff --git a/target/linux/brcm63xx/patches-4.4/577-board_VH4032N.patch b/target/linux/brcm63xx/patches-4.4/577-board_VH4032N.patch
index 2e5c13e..4e1e7b6 100644
--- a/target/linux/brcm63xx/patches-4.4/577-board_VH4032N.patch
+++ b/target/linux/brcm63xx/patches-4.4/577-board_VH4032N.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -2356,6 +2356,45 @@ static struct board_info __initdata boar
+@@ -2310,6 +2310,45 @@ static struct board_info __initdata boar
  	},
  };
  
@@ -46,7 +46,7 @@
  static struct b53_platform_data WAP5813n_b53_pdata = {
  	.alias = "eth0",
  };
-@@ -2662,6 +2701,7 @@ static const struct board_info __initcon
+@@ -2615,6 +2654,7 @@ static const struct board_info __initcon
  	&board_HG622,
  	&board_HG655b,
  	&board_P870HW51A_V2,
@@ -54,7 +54,7 @@
  	&board_VR3025u,
  	&board_VR3025un,
  	&board_VR3026e,
-@@ -2773,6 +2813,7 @@ static struct of_device_id const bcm963x
+@@ -2725,6 +2765,7 @@ static struct of_device_id const bcm963x
  	{ .compatible = "huawei,hg655b", .data = &board_HG655b, },
  	{ .compatible = "netgear,dgnd3700v1", .data = &board_DGND3700v1_3800B, },
  	{ .compatible = "netgear,evg2000", .data = &board_EVG2000, },
diff --git a/target/linux/generic/patches-4.4/040-0002-mtd-bcm47xxpart-don-t-fail-because-of-bit-flips.patch b/target/linux/generic/patches-4.4/040-0002-mtd-bcm47xxpart-don-t-fail-because-of-bit-flips.patch
index 8a04852..4155a2a 100644
--- a/target/linux/generic/patches-4.4/040-0002-mtd-bcm47xxpart-don-t-fail-because-of-bit-flips.patch
+++ b/target/linux/generic/patches-4.4/040-0002-mtd-bcm47xxpart-don-t-fail-because-of-bit-flips.patch
@@ -59,7 +59,7 @@ Signed-off-by: Brian Norris <computersforpeace@gmail.com>
  			continue;
  		}
  
-@@ -254,10 +258,11 @@ static int bcm47xxpart_parse(struct mtd_
+@@ -252,10 +256,11 @@ static int bcm47xxpart_parse(struct mtd_
  		}
  
  		/* Read middle of the block */
@@ -75,7 +75,7 @@ Signed-off-by: Brian Norris <computersforpeace@gmail.com>
  			continue;
  		}
  
-@@ -277,10 +282,11 @@ static int bcm47xxpart_parse(struct mtd_
+@@ -275,10 +280,11 @@ static int bcm47xxpart_parse(struct mtd_
  		}
  
  		offset = master->size - possible_nvram_sizes[i];
diff --git a/target/linux/generic/patches-4.4/042-0004-mtd-bcm47xxpart-fix-parsing-first-block-after-aligne.patch b/target/linux/generic/patches-4.4/042-0004-mtd-bcm47xxpart-fix-parsing-first-block-after-aligne.patch
deleted file mode 100644
index 7eed777..0000000
--- a/target/linux/generic/patches-4.4/042-0004-mtd-bcm47xxpart-fix-parsing-first-block-after-aligne.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From bd5d21310133921021d78995ad6346f908483124 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Sun, 20 Nov 2016 16:09:30 +0100
-Subject: [PATCH] mtd: bcm47xxpart: fix parsing first block after aligned TRX
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-After parsing TRX we should skip to the first block placed behind it.
-Our code was working only with TRX with length not aligned to the
-blocksize. In other cases (length aligned) it was missing the block
-places right after TRX.
-
-This fixes calculation and simplifies the comment.
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
-Signed-off-by: Brian Norris <computersforpeace@gmail.com>
----
- drivers/mtd/bcm47xxpart.c | 10 ++++------
- 1 file changed, 4 insertions(+), 6 deletions(-)
-
---- a/drivers/mtd/bcm47xxpart.c
-+++ b/drivers/mtd/bcm47xxpart.c
-@@ -229,12 +229,10 @@ static int bcm47xxpart_parse(struct mtd_
- 
- 			last_trx_part = curr_part - 1;
- 
--			/*
--			 * We have whole TRX scanned, skip to the next part. Use
--			 * roundown (not roundup), as the loop will increase
--			 * offset in next step.
--			 */
--			offset = rounddown(offset + trx->length, blocksize);
-+			/* Jump to the end of TRX */
-+			offset = roundup(offset + trx->length, blocksize);
-+			/* Next loop iteration will increase the offset */
-+			offset -= blocksize;
- 			continue;
- 		}
- 
diff --git a/target/linux/generic/patches-4.4/062-01-MIPS-Introduce-irq_stack.patch b/target/linux/generic/patches-4.4/062-01-MIPS-Introduce-irq_stack.patch
deleted file mode 100644
index 2a929aa..0000000
--- a/target/linux/generic/patches-4.4/062-01-MIPS-Introduce-irq_stack.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From: Matt Redfearn <matt.redfearn@imgtec.com>
-Date: Mon, 19 Dec 2016 14:20:56 +0000
-Subject: [PATCH] MIPS: Introduce irq_stack
-
-Allocate a per-cpu irq stack for use within interrupt handlers.
-
-Also add a utility function on_irq_stack to determine if a given stack
-pointer is within the irq stack for that cpu.
-
-Signed-off-by: Matt Redfearn <matt.redfearn@imgtec.com>
----
-
---- a/arch/mips/include/asm/irq.h
-+++ b/arch/mips/include/asm/irq.h
-@@ -17,6 +17,18 @@
- 
- #include <irq.h>
- 
-+#define IRQ_STACK_SIZE			THREAD_SIZE
-+
-+extern void *irq_stack[NR_CPUS];
-+
-+static inline bool on_irq_stack(int cpu, unsigned long sp)
-+{
-+	unsigned long low = (unsigned long)irq_stack[cpu];
-+	unsigned long high = low + IRQ_STACK_SIZE;
-+
-+	return (low <= sp && sp <= high);
-+}
-+
- #ifdef CONFIG_I8259
- static inline int irq_canonicalize(int irq)
- {
---- a/arch/mips/kernel/asm-offsets.c
-+++ b/arch/mips/kernel/asm-offsets.c
-@@ -101,6 +101,7 @@ void output_thread_info_defines(void)
- 	OFFSET(TI_REGS, thread_info, regs);
- 	DEFINE(_THREAD_SIZE, THREAD_SIZE);
- 	DEFINE(_THREAD_MASK, THREAD_MASK);
-+	DEFINE(_IRQ_STACK_SIZE, IRQ_STACK_SIZE);
- 	BLANK();
- }
- 
---- a/arch/mips/kernel/irq.c
-+++ b/arch/mips/kernel/irq.c
-@@ -25,6 +25,8 @@
- #include <linux/atomic.h>
- #include <asm/uaccess.h>
- 
-+void *irq_stack[NR_CPUS];
-+
- /*
-  * 'what should we do if we get a hw irq event on an illegal vector'.
-  * each architecture has to answer this themselves.
-@@ -55,6 +57,15 @@ void __init init_IRQ(void)
- 		irq_set_noprobe(i);
- 
- 	arch_init_irq();
-+
-+	for_each_possible_cpu(i) {
-+		int irq_pages = IRQ_STACK_SIZE / PAGE_SIZE;
-+		void *s = (void *)__get_free_pages(GFP_KERNEL, irq_pages);
-+
-+		irq_stack[i] = s;
-+		pr_debug("CPU%d IRQ stack at 0x%p - 0x%p\n", i,
-+			irq_stack[i], irq_stack[i] + IRQ_STACK_SIZE);
-+	}
- }
- 
- #ifdef CONFIG_DEBUG_STACKOVERFLOW
diff --git a/target/linux/generic/patches-4.4/062-02-MIPS-Stack-unwinding-while-on-IRQ-stack.patch b/target/linux/generic/patches-4.4/062-02-MIPS-Stack-unwinding-while-on-IRQ-stack.patch
deleted file mode 100644
index fc559ee..0000000
--- a/target/linux/generic/patches-4.4/062-02-MIPS-Stack-unwinding-while-on-IRQ-stack.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From: Matt Redfearn <matt.redfearn@imgtec.com>
-Date: Mon, 19 Dec 2016 14:20:57 +0000
-Subject: [PATCH] MIPS: Stack unwinding while on IRQ stack
-
-Within unwind stack, check if the stack pointer being unwound is within
-the CPU's irq_stack and if so use that page rather than the task's stack
-page.
-
-Signed-off-by: Matt Redfearn <matt.redfearn@imgtec.com>
----
-
---- a/arch/mips/kernel/process.c
-+++ b/arch/mips/kernel/process.c
-@@ -32,6 +32,7 @@
- #include <asm/cpu.h>
- #include <asm/dsp.h>
- #include <asm/fpu.h>
-+#include <asm/irq.h>
- #include <asm/msa.h>
- #include <asm/pgtable.h>
- #include <asm/mipsregs.h>
-@@ -552,7 +553,19 @@ EXPORT_SYMBOL(unwind_stack_by_address);
- unsigned long unwind_stack(struct task_struct *task, unsigned long *sp,
- 			   unsigned long pc, unsigned long *ra)
- {
--	unsigned long stack_page = (unsigned long)task_stack_page(task);
-+	unsigned long stack_page = 0;
-+	int cpu;
-+
-+	for_each_possible_cpu(cpu) {
-+		if (on_irq_stack(cpu, *sp)) {
-+			stack_page = (unsigned long)irq_stack[cpu];
-+			break;
-+		}
-+	}
-+
-+	if (!stack_page)
-+		stack_page = (unsigned long)task_stack_page(task);
-+
- 	return unwind_stack_by_address(stack_page, sp, pc, ra);
- }
- #endif
diff --git a/target/linux/generic/patches-4.4/062-03-MIPS-Only-change-28-to-thread_info-if-coming-from-us.patch b/target/linux/generic/patches-4.4/062-03-MIPS-Only-change-28-to-thread_info-if-coming-from-us.patch
deleted file mode 100644
index e13c67b..0000000
--- a/target/linux/generic/patches-4.4/062-03-MIPS-Only-change-28-to-thread_info-if-coming-from-us.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From: Matt Redfearn <matt.redfearn@imgtec.com>
-Date: Mon, 19 Dec 2016 14:20:58 +0000
-Subject: [PATCH] MIPS: Only change $28 to thread_info if coming from user
- mode
-
-The SAVE_SOME macro is used to save the execution context on all
-exceptions.
-If an exception occurs while executing user code, the stack is switched
-to the kernel's stack for the current task, and register $28 is switched
-to point to the current_thread_info, which is at the bottom of the stack
-region.
-If the exception occurs while executing kernel code, the stack is left,
-and this change ensures that register $28 is not updated. This is the
-correct behaviour when the kernel can be executing on the separate irq
-stack, because the thread_info will not be at the base of it.
-
-With this change, register $28 is only switched to it's kernel
-conventional usage of the currrent thread info pointer at the point at
-which execution enters kernel space. Doing it on every exception was
-redundant, but OK without an IRQ stack, but will be erroneous once that
-is introduced.
-
-Signed-off-by: Matt Redfearn <matt.redfearn@imgtec.com>
-Reviewed-by: Maciej W. Rozycki <macro@imgtec.com>
----
-
---- a/arch/mips/include/asm/stackframe.h
-+++ b/arch/mips/include/asm/stackframe.h
-@@ -216,12 +216,19 @@
- 		LONG_S	$25, PT_R25(sp)
- 		LONG_S	$28, PT_R28(sp)
- 		LONG_S	$31, PT_R31(sp)
-+
-+		/* Set thread_info if we're coming from user mode */
-+		mfc0	k0, CP0_STATUS
-+		sll	k0, 3		/* extract cu0 bit */
-+		bltz	k0, 9f
-+
- 		ori	$28, sp, _THREAD_MASK
- 		xori	$28, _THREAD_MASK
- #ifdef CONFIG_CPU_CAVIUM_OCTEON
- 		.set    mips64
- 		pref    0, 0($28)       /* Prefetch the current pointer */
- #endif
-+9:
- 		.set	pop
- 		.endm
- 
diff --git a/target/linux/generic/patches-4.4/062-04-MIPS-Switch-to-the-irq_stack-in-interrupts.patch b/target/linux/generic/patches-4.4/062-04-MIPS-Switch-to-the-irq_stack-in-interrupts.patch
deleted file mode 100644
index 9bd2336..0000000
--- a/target/linux/generic/patches-4.4/062-04-MIPS-Switch-to-the-irq_stack-in-interrupts.patch
+++ /dev/null
@@ -1,116 +0,0 @@
-From: Matt Redfearn <matt.redfearn@imgtec.com>
-Date: Mon, 19 Dec 2016 14:20:59 +0000
-Subject: [PATCH] MIPS: Switch to the irq_stack in interrupts
-
-When enterring interrupt context via handle_int or except_vec_vi, switch
-to the irq_stack of the current CPU if it is not already in use.
-
-The current stack pointer is masked with the thread size and compared to
-the base or the irq stack. If it does not match then the stack pointer
-is set to the top of that stack, otherwise this is a nested irq being
-handled on the irq stack so the stack pointer should be left as it was.
-
-The in-use stack pointer is placed in the callee saved register s1. It
-will be saved to the stack when plat_irq_dispatch is invoked and can be
-restored once control returns here.
-
-Signed-off-by: Matt Redfearn <matt.redfearn@imgtec.com>
----
-
---- a/arch/mips/kernel/genex.S
-+++ b/arch/mips/kernel/genex.S
-@@ -188,9 +188,44 @@ NESTED(handle_int, PT_SIZE, sp)
- 
- 	LONG_L	s0, TI_REGS($28)
- 	LONG_S	sp, TI_REGS($28)
--	PTR_LA	ra, ret_from_irq
--	PTR_LA  v0, plat_irq_dispatch
--	jr	v0
-+
-+	/*
-+	 * SAVE_ALL ensures we are using a valid kernel stack for the thread.
-+	 * Check if we are already using the IRQ stack.
-+	 */
-+	move	s1, sp # Preserve the sp
-+
-+	/* Get IRQ stack for this CPU */
-+	ASM_CPUID_MFC0	k0, ASM_SMP_CPUID_REG
-+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32)
-+	lui	k1, %hi(irq_stack)
-+#else
-+	lui	k1, %highest(irq_stack)
-+	daddiu	k1, %higher(irq_stack)
-+	dsll	k1, 16
-+	daddiu	k1, %hi(irq_stack)
-+	dsll	k1, 16
-+#endif
-+	LONG_SRL	k0, SMP_CPUID_PTRSHIFT
-+	LONG_ADDU	k1, k0
-+	LONG_L	t0, %lo(irq_stack)(k1)
-+
-+	# Check if already on IRQ stack
-+	PTR_LI	t1, ~(_THREAD_SIZE-1)
-+	and	t1, t1, sp
-+	beq	t0, t1, 2f
-+
-+	/* Switch to IRQ stack */
-+	li	t1, _IRQ_STACK_SIZE
-+	PTR_ADD sp, t0, t1
-+
-+2:
-+	jal	plat_irq_dispatch
-+
-+	/* Restore sp */
-+	move	sp, s1
-+
-+	j	ret_from_irq
- #ifdef CONFIG_CPU_MICROMIPS
- 	nop
- #endif
-@@ -263,8 +298,44 @@ NESTED(except_vec_vi_handler, 0, sp)
- 
- 	LONG_L	s0, TI_REGS($28)
- 	LONG_S	sp, TI_REGS($28)
--	PTR_LA	ra, ret_from_irq
--	jr	v0
-+
-+	/*
-+	 * SAVE_ALL ensures we are using a valid kernel stack for the thread.
-+	 * Check if we are already using the IRQ stack.
-+	 */
-+	move	s1, sp # Preserve the sp
-+
-+	/* Get IRQ stack for this CPU */
-+	ASM_CPUID_MFC0	k0, ASM_SMP_CPUID_REG
-+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32)
-+	lui	k1, %hi(irq_stack)
-+#else
-+	lui	k1, %highest(irq_stack)
-+	daddiu	k1, %higher(irq_stack)
-+	dsll	k1, 16
-+	daddiu	k1, %hi(irq_stack)
-+	dsll	k1, 16
-+#endif
-+	LONG_SRL	k0, SMP_CPUID_PTRSHIFT
-+	LONG_ADDU	k1, k0
-+	LONG_L	t0, %lo(irq_stack)(k1)
-+
-+	# Check if already on IRQ stack
-+	PTR_LI	t1, ~(_THREAD_SIZE-1)
-+	and	t1, t1, sp
-+	beq	t0, t1, 2f
-+
-+	/* Switch to IRQ stack */
-+	li	t1, _IRQ_STACK_SIZE
-+	PTR_ADD sp, t0, t1
-+
-+2:
-+	jal	plat_irq_dispatch
-+
-+	/* Restore sp */
-+	move	sp, s1
-+
-+	j	ret_from_irq
- 	END(except_vec_vi_handler)
- 
- /*
diff --git a/target/linux/generic/patches-4.4/062-05-MIPS-Select-HAVE_IRQ_EXIT_ON_IRQ_STACK.patch b/target/linux/generic/patches-4.4/062-05-MIPS-Select-HAVE_IRQ_EXIT_ON_IRQ_STACK.patch
deleted file mode 100644
index a4942b8..0000000
--- a/target/linux/generic/patches-4.4/062-05-MIPS-Select-HAVE_IRQ_EXIT_ON_IRQ_STACK.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From: Matt Redfearn <matt.redfearn@imgtec.com>
-Date: Mon, 19 Dec 2016 14:21:00 +0000
-Subject: [PATCH] MIPS: Select HAVE_IRQ_EXIT_ON_IRQ_STACK
-
-Since do_IRQ is now invoked on a separate IRQ stack, we select
-HAVE_IRQ_EXIT_ON_IRQ_STACK so that softirq's may be invoked directly
-from irq_exit(), rather than requiring do_softirq_own_stack.
-
-Signed-off-by: Matt Redfearn <matt.redfearn@imgtec.com>
----
-
---- a/arch/mips/Kconfig
-+++ b/arch/mips/Kconfig
-@@ -9,6 +9,7 @@ config MIPS
- 	select HAVE_CONTEXT_TRACKING
- 	select HAVE_GENERIC_DMA_COHERENT
- 	select HAVE_IDE
-+	select HAVE_IRQ_EXIT_ON_IRQ_STACK
- 	select HAVE_OPROFILE
- 	select HAVE_PERF_EVENTS
- 	select PERF_USE_VMALLOC
diff --git a/target/linux/generic/patches-4.4/062-06-MIPS-IRQ-Stack-Fix-erroneous-jal-to-plat_irq_dispatc.patch b/target/linux/generic/patches-4.4/062-06-MIPS-IRQ-Stack-Fix-erroneous-jal-to-plat_irq_dispatc.patch
deleted file mode 100644
index 26cf5c4..0000000
--- a/target/linux/generic/patches-4.4/062-06-MIPS-IRQ-Stack-Fix-erroneous-jal-to-plat_irq_dispatc.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-From de856416e7143e32afc4849625616554aa060f7a Mon Sep 17 00:00:00 2001
-From: Matt Redfearn <matt.redfearn@imgtec.com>
-Date: Wed, 25 Jan 2017 17:00:25 +0000
-Subject: [PATCH] MIPS: IRQ Stack: Fix erroneous jal to plat_irq_dispatch
-
-Commit dda45f701c9d ("MIPS: Switch to the irq_stack in interrupts")
-changed both the normal and vectored interrupt handlers. Unfortunately
-the vectored version, "except_vec_vi_handler", was incorrectly modified
-to unconditionally jal to plat_irq_dispatch, rather than doing a jalr to
-the vectored handler that has been set up. This is ok for many platforms
-which set the vectored handler to plat_irq_dispatch anyway, but will
-cause problems with platforms that use other handlers.
-
-Fixes: dda45f701c9d ("MIPS: Switch to the irq_stack in interrupts")
-Signed-off-by: Matt Redfearn <matt.redfearn@imgtec.com>
-Cc: Ralf Baechle <ralf@linux-mips.org>
-Cc: Paul Burton <paul.burton@imgtec.com>
-Cc: linux-mips@linux-mips.org
-Patchwork: https://patchwork.linux-mips.org/patch/15110/
-Signed-off-by: James Hogan <james.hogan@imgtec.com>
----
- arch/mips/kernel/genex.S | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/arch/mips/kernel/genex.S
-+++ b/arch/mips/kernel/genex.S
-@@ -330,7 +330,7 @@ NESTED(except_vec_vi_handler, 0, sp)
- 	PTR_ADD sp, t0, t1
- 
- 2:
--	jal	plat_irq_dispatch
-+	jalr	v0
- 
- 	/* Restore sp */
- 	move	sp, s1
diff --git a/target/linux/generic/patches-4.4/630-packet_socket_type.patch b/target/linux/generic/patches-4.4/630-packet_socket_type.patch
index c334418..d308786 100644
--- a/target/linux/generic/patches-4.4/630-packet_socket_type.patch
+++ b/target/linux/generic/patches-4.4/630-packet_socket_type.patch
@@ -91,7 +91,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	if (sock->type == SOCK_PACKET)
  		po->prot_hook.func = packet_rcv_spkt;
-@@ -3737,6 +3740,16 @@ packet_setsockopt(struct socket *sock, i
+@@ -3739,6 +3742,16 @@ packet_setsockopt(struct socket *sock, i
  		po->xmit = val ? packet_direct_xmit : dev_queue_xmit;
  		return 0;
  	}
@@ -108,7 +108,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	default:
  		return -ENOPROTOOPT;
  	}
-@@ -3789,6 +3802,13 @@ static int packet_getsockopt(struct sock
+@@ -3791,6 +3804,13 @@ static int packet_getsockopt(struct sock
  	case PACKET_VNET_HDR:
  		val = po->has_vnet_hdr;
  		break;
diff --git a/target/linux/generic/patches-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch b/target/linux/generic/patches-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
index da8e8a6..c402e04 100644
--- a/target/linux/generic/patches-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
+++ b/target/linux/generic/patches-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
@@ -296,7 +296,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  
  		__skb_tunnel_rx(skb, t->dev, t->net);
  
-@@ -1245,6 +1382,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
+@@ -1247,6 +1384,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
  	__u32 mtu;
  	u8 tproto;
  	int err;
@@ -304,7 +304,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  
  	tproto = ACCESS_ONCE(t->parms.proto);
  	if ((tproto != IPPROTO_IPV6 && tproto != 0) ||
-@@ -1275,6 +1413,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
+@@ -1277,6 +1415,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
  	if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
  		fl6.flowi6_mark = skb->mark;
  
@@ -323,7 +323,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
  	if (err != 0) {
  		if (err == -EMSGSIZE)
-@@ -1389,6 +1539,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
+@@ -1391,6 +1541,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
  	t->parms.flowinfo = p->flowinfo;
  	t->parms.link = p->link;
  	t->parms.proto = p->proto;
@@ -338,7 +338,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	ip6_tnl_dst_reset(t);
  	ip6_tnl_link_config(t);
  	return 0;
-@@ -1427,6 +1585,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
+@@ -1429,6 +1587,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
  	p->flowinfo = u->flowinfo;
  	p->link = u->link;
  	p->proto = u->proto;
@@ -346,7 +346,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	memcpy(p->name, u->name, sizeof(u->name));
  }
  
-@@ -1722,6 +1881,15 @@ static int ip6_tnl_validate(struct nlatt
+@@ -1724,6 +1883,15 @@ static int ip6_tnl_validate(struct nlatt
  	return 0;
  }
  
@@ -362,7 +362,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  static void ip6_tnl_netlink_parms(struct nlattr *data[],
  				  struct __ip6_tnl_parm *parms)
  {
-@@ -1753,6 +1921,46 @@ static void ip6_tnl_netlink_parms(struct
+@@ -1755,6 +1923,46 @@ static void ip6_tnl_netlink_parms(struct
  
  	if (data[IFLA_IPTUN_PROTO])
  		parms->proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
@@ -409,7 +409,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  }
  
  static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
-@@ -1805,6 +2013,12 @@ static void ip6_tnl_dellink(struct net_d
+@@ -1807,6 +2015,12 @@ static void ip6_tnl_dellink(struct net_d
  
  static size_t ip6_tnl_get_size(const struct net_device *dev)
  {
@@ -422,7 +422,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	return
  		/* IFLA_IPTUN_LINK */
  		nla_total_size(4) +
-@@ -1822,6 +2036,24 @@ static size_t ip6_tnl_get_size(const str
+@@ -1824,6 +2038,24 @@ static size_t ip6_tnl_get_size(const str
  		nla_total_size(4) +
  		/* IFLA_IPTUN_PROTO */
  		nla_total_size(1) +
@@ -447,7 +447,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  		0;
  }
  
-@@ -1829,6 +2061,9 @@ static int ip6_tnl_fill_info(struct sk_b
+@@ -1831,6 +2063,9 @@ static int ip6_tnl_fill_info(struct sk_b
  {
  	struct ip6_tnl *tunnel = netdev_priv(dev);
  	struct __ip6_tnl_parm *parm = &tunnel->parms;
@@ -457,7 +457,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  
  	if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
  	    nla_put_in6_addr(skb, IFLA_IPTUN_LOCAL, &parm->laddr) ||
-@@ -1837,8 +2072,27 @@ static int ip6_tnl_fill_info(struct sk_b
+@@ -1839,8 +2074,27 @@ static int ip6_tnl_fill_info(struct sk_b
  	    nla_put_u8(skb, IFLA_IPTUN_ENCAP_LIMIT, parm->encap_limit) ||
  	    nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
  	    nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) ||
@@ -486,7 +486,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	return 0;
  
  nla_put_failure:
-@@ -1862,6 +2116,7 @@ static const struct nla_policy ip6_tnl_p
+@@ -1864,6 +2118,7 @@ static const struct nla_policy ip6_tnl_p
  	[IFLA_IPTUN_FLOWINFO]		= { .type = NLA_U32 },
  	[IFLA_IPTUN_FLAGS]		= { .type = NLA_U32 },
  	[IFLA_IPTUN_PROTO]		= { .type = NLA_U8 },
diff --git a/target/linux/generic/patches-4.4/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch b/target/linux/generic/patches-4.4/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
index a82073b..e3f60e2 100644
--- a/target/linux/generic/patches-4.4/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
+++ b/target/linux/generic/patches-4.4/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
@@ -143,7 +143,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  static const struct rt6_info ip6_blk_hole_entry_template = {
  	.dst = {
  		.__refcnt	= ATOMIC_INIT(1),
-@@ -1885,6 +1902,11 @@ static struct rt6_info *ip6_route_info_c
+@@ -1889,6 +1906,11 @@ static struct rt6_info *ip6_route_info_c
  			rt->dst.output = ip6_pkt_prohibit_out;
  			rt->dst.input = ip6_pkt_prohibit;
  			break;
@@ -155,7 +155,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		case RTN_THROW:
  		case RTN_UNREACHABLE:
  		default:
-@@ -2486,6 +2508,17 @@ static int ip6_pkt_prohibit_out(struct n
+@@ -2492,6 +2514,17 @@ static int ip6_pkt_prohibit_out(struct n
  	return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
  }
  
@@ -173,7 +173,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  /*
   *	Allocate a dst for local (unicast / anycast) address.
   */
-@@ -2728,7 +2761,8 @@ static int rtm_to_fib6_config(struct sk_
+@@ -2734,7 +2767,8 @@ static int rtm_to_fib6_config(struct sk_
  	if (rtm->rtm_type == RTN_UNREACHABLE ||
  	    rtm->rtm_type == RTN_BLACKHOLE ||
  	    rtm->rtm_type == RTN_PROHIBIT ||
@@ -183,7 +183,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		cfg->fc_flags |= RTF_REJECT;
  
  	if (rtm->rtm_type == RTN_LOCAL)
-@@ -3087,6 +3121,9 @@ static int rt6_fill_node(struct net *net
+@@ -3093,6 +3127,9 @@ static int rt6_fill_node(struct net *net
  		case -EACCES:
  			rtm->rtm_type = RTN_PROHIBIT;
  			break;
@@ -193,7 +193,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		case -EAGAIN:
  			rtm->rtm_type = RTN_THROW;
  			break;
-@@ -3363,6 +3400,8 @@ static int ip6_route_dev_notify(struct n
+@@ -3372,6 +3409,8 @@ static int ip6_route_dev_notify(struct n
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  		net->ipv6.ip6_prohibit_entry->dst.dev = dev;
  		net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
@@ -202,7 +202,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
  		net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
  #endif
-@@ -3579,6 +3618,17 @@ static int __net_init ip6_route_net_init
+@@ -3594,6 +3633,17 @@ static int __net_init ip6_route_net_init
  	net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
  	dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
  			 ip6_template_metrics, true);
@@ -220,7 +220,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  #endif
  
  	net->ipv6.sysctl.flush_delay = 0;
-@@ -3597,6 +3647,8 @@ out:
+@@ -3612,6 +3662,8 @@ out:
  	return ret;
  
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
@@ -229,7 +229,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  out_ip6_prohibit_entry:
  	kfree(net->ipv6.ip6_prohibit_entry);
  out_ip6_null_entry:
-@@ -3614,6 +3666,7 @@ static void __net_exit ip6_route_net_exi
+@@ -3629,6 +3681,7 @@ static void __net_exit ip6_route_net_exi
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  	kfree(net->ipv6.ip6_prohibit_entry);
  	kfree(net->ipv6.ip6_blk_hole_entry);
@@ -237,7 +237,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  #endif
  	dst_entries_destroy(&net->ipv6.ip6_dst_ops);
  }
-@@ -3711,6 +3764,9 @@ int __init ip6_route_init(void)
+@@ -3702,6 +3755,9 @@ void __init ip6_route_init_special_entri
  	init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
  	init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
  	init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
@@ -245,5 +245,5 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 +	init_net.ipv6.ip6_policy_failed_entry->rt6i_idev =
 +		in6_dev_get(init_net.loopback_dev);
    #endif
- 	ret = fib6_init();
- 	if (ret)
+ }
+ 
diff --git a/target/linux/ipq806x/patches-4.4/096-03-usb-dwc3-Validate-the-maximum_speed-parameter.patch b/target/linux/ipq806x/patches-4.4/096-03-usb-dwc3-Validate-the-maximum_speed-parameter.patch
index 0f17918..784ba06 100644
--- a/target/linux/ipq806x/patches-4.4/096-03-usb-dwc3-Validate-the-maximum_speed-parameter.patch
+++ b/target/linux/ipq806x/patches-4.4/096-03-usb-dwc3-Validate-the-maximum_speed-parameter.patch
@@ -49,7 +49,7 @@ Signed-off-by: Felipe Balbi <balbi@kernel.org>
  	/* Adjust Frame Length */
 --- a/drivers/usb/dwc3/gadget.c
 +++ b/drivers/usb/dwc3/gadget.c
-@@ -1634,10 +1634,13 @@ static int dwc3_gadget_start(struct usb_
+@@ -1647,10 +1647,13 @@ static int dwc3_gadget_start(struct usb_
  		case USB_SPEED_HIGH:
  			reg |= DWC3_DSTS_HIGHSPEED;
  			break;
diff --git a/target/linux/ipq806x/patches-4.4/096-08-usb-dwc3-remove-num_event_buffers.patch b/target/linux/ipq806x/patches-4.4/096-08-usb-dwc3-remove-num_event_buffers.patch
index 5067548..4fb4064 100644
--- a/target/linux/ipq806x/patches-4.4/096-08-usb-dwc3-remove-num_event_buffers.patch
+++ b/target/linux/ipq806x/patches-4.4/096-08-usb-dwc3-remove-num_event_buffers.patch
@@ -161,7 +161,7 @@ Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
  
 --- a/drivers/usb/dwc3/gadget.c
 +++ b/drivers/usb/dwc3/gadget.c
-@@ -2556,14 +2556,14 @@ static void dwc3_process_event_entry(str
+@@ -2569,14 +2569,14 @@ static void dwc3_process_event_entry(str
  	}
  }
  
@@ -178,7 +178,7 @@ Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
  	left = evt->count;
  
  	if (!(evt->flags & DWC3_EVENT_PENDING))
-@@ -2588,7 +2588,7 @@ static irqreturn_t dwc3_process_event_bu
+@@ -2601,7 +2601,7 @@ static irqreturn_t dwc3_process_event_bu
  		evt->lpos = (evt->lpos + 4) % DWC3_EVENT_BUFFERS_SIZE;
  		left -= 4;
  
@@ -187,7 +187,7 @@ Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
  	}
  
  	evt->count = 0;
-@@ -2596,9 +2596,9 @@ static irqreturn_t dwc3_process_event_bu
+@@ -2609,9 +2609,9 @@ static irqreturn_t dwc3_process_event_bu
  	ret = IRQ_HANDLED;
  
  	/* Unmask interrupt */
@@ -199,7 +199,7 @@ Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
  
  	return ret;
  }
-@@ -2608,27 +2608,23 @@ static irqreturn_t dwc3_thread_interrupt
+@@ -2621,27 +2621,23 @@ static irqreturn_t dwc3_thread_interrupt
  	struct dwc3 *dwc = _dwc;
  	unsigned long flags;
  	irqreturn_t ret = IRQ_NONE;
@@ -231,7 +231,7 @@ Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
  	count &= DWC3_GEVNTCOUNT_MASK;
  	if (!count)
  		return IRQ_NONE;
-@@ -2637,9 +2633,9 @@ static irqreturn_t dwc3_check_event_buf(
+@@ -2650,9 +2646,9 @@ static irqreturn_t dwc3_check_event_buf(
  	evt->flags |= DWC3_EVENT_PENDING;
  
  	/* Mask interrupt */
@@ -243,7 +243,7 @@ Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
  
  	return IRQ_WAKE_THREAD;
  }
-@@ -2647,18 +2643,8 @@ static irqreturn_t dwc3_check_event_buf(
+@@ -2660,18 +2656,8 @@ static irqreturn_t dwc3_check_event_buf(
  static irqreturn_t dwc3_interrupt(int irq, void *_dwc)
  {
  	struct dwc3			*dwc = _dwc;
diff --git a/target/linux/ipq806x/patches-4.4/096-09-usb-dwc3-drop-ev_buffs-array.patch b/target/linux/ipq806x/patches-4.4/096-09-usb-dwc3-drop-ev_buffs-array.patch
index 827b621..6592a4e 100644
--- a/target/linux/ipq806x/patches-4.4/096-09-usb-dwc3-drop-ev_buffs-array.patch
+++ b/target/linux/ipq806x/patches-4.4/096-09-usb-dwc3-drop-ev_buffs-array.patch
@@ -76,7 +76,7 @@ Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
  	struct usb_gadget	gadget;
 --- a/drivers/usb/dwc3/gadget.c
 +++ b/drivers/usb/dwc3/gadget.c
-@@ -2563,7 +2563,7 @@ static irqreturn_t dwc3_process_event_bu
+@@ -2576,7 +2576,7 @@ static irqreturn_t dwc3_process_event_bu
  	int left;
  	u32 reg;
  
@@ -85,7 +85,7 @@ Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
  	left = evt->count;
  
  	if (!(evt->flags & DWC3_EVENT_PENDING))
-@@ -2622,7 +2622,7 @@ static irqreturn_t dwc3_check_event_buf(
+@@ -2635,7 +2635,7 @@ static irqreturn_t dwc3_check_event_buf(
  	u32 count;
  	u32 reg;
  
diff --git a/target/linux/ipq806x/patches-4.4/100-usb-phy-Add-Qualcomm-DWC3-HS-SS-PHY-drivers.patch b/target/linux/ipq806x/patches-4.4/100-usb-phy-Add-Qualcomm-DWC3-HS-SS-PHY-drivers.patch
index 0da1927..7d1ab13 100644
--- a/target/linux/ipq806x/patches-4.4/100-usb-phy-Add-Qualcomm-DWC3-HS-SS-PHY-drivers.patch
+++ b/target/linux/ipq806x/patches-4.4/100-usb-phy-Add-Qualcomm-DWC3-HS-SS-PHY-drivers.patch
@@ -1,6 +1,6 @@
 --- a/drivers/phy/Kconfig
 +++ b/drivers/phy/Kconfig
-@@ -390,4 +390,15 @@ config PHY_CYGNUS_PCIE
+@@ -391,4 +391,15 @@ config PHY_CYGNUS_PCIE
  	  Enable this to support the Broadcom Cygnus PCIe PHY.
  	  If unsure, say N.
  
diff --git a/target/linux/lantiq/patches-4.4/0047-irq-fixes.patch b/target/linux/lantiq/patches-4.4/0047-irq-fixes.patch
index f664deb..9efa63d 100644
--- a/target/linux/lantiq/patches-4.4/0047-irq-fixes.patch
+++ b/target/linux/lantiq/patches-4.4/0047-irq-fixes.patch
@@ -45,7 +45,7 @@
  			/* disable */
  			ltq_eiu_w32(ltq_eiu_r32(LTQ_EIU_EXIN_INEN) & ~BIT(i),
  				LTQ_EIU_EXIN_INEN);
-@@ -344,10 +344,10 @@ static int icu_map(struct irq_domain *d,
+@@ -343,10 +343,10 @@ static int icu_map(struct irq_domain *d,
  		return 0;
  
  	for (i = 0; i < exin_avail; i++)
@@ -58,7 +58,7 @@
  
  	return 0;
  }
-@@ -437,14 +437,14 @@ int __init icu_of_init(struct device_nod
+@@ -441,14 +441,14 @@ int __init icu_of_init(struct device_nod
  	eiu_node = of_find_compatible_node(NULL, NULL, "lantiq,eiu-xway");
  	if (eiu_node && !of_address_to_resource(eiu_node, 0, &res)) {
  		/* find out how many external irq sources we have */
diff --git a/target/linux/lantiq/patches-4.4/0050-MIPS-Lantiq-Fix-cascaded-IRQ-setup.patch b/target/linux/lantiq/patches-4.4/0050-MIPS-Lantiq-Fix-cascaded-IRQ-setup.patch
new file mode 100644
index 0000000..c0d7afc
--- /dev/null
+++ b/target/linux/lantiq/patches-4.4/0050-MIPS-Lantiq-Fix-cascaded-IRQ-setup.patch
@@ -0,0 +1,87 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 19 Jan 2017 12:14:44 +0100
+Subject: [PATCH] MIPS: Lantiq: Fix cascaded IRQ setup
+
+With the IRQ stack changes integrated, the XRX200 devices started
+emitting a constant stream of kernel messages like this:
+
+[  565.415310] Spurious IRQ: CAUSE=0x1100c300
+
+This appears to be caused by IP0 firing for some reason without being
+handled. Fix this by setting up IP2-6 as a proper chained IRQ handler and
+calling do_IRQ for all MIPS CPU interrupts.
+
+Cc: john@phrozen.org
+Cc: stable@vger.kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/arch/mips/lantiq/irq.c
++++ b/arch/mips/lantiq/irq.c
+@@ -271,6 +271,11 @@ static void ltq_hw5_irqdispatch(void)
+ DEFINE_HWx_IRQDISPATCH(5)
+ #endif
+ 
++static void ltq_hw_irq_handler(struct irq_desc *desc)
++{
++	ltq_hw_irqdispatch(irq_desc_get_irq(desc) - 2);
++}
++
+ #ifdef CONFIG_MIPS_MT_SMP
+ void __init arch_init_ipiirq(int irq, struct irqaction *action)
+ {
+@@ -315,23 +320,19 @@ static struct irqaction irq_call = {
+ asmlinkage void plat_irq_dispatch(void)
+ {
+ 	unsigned int pending = read_c0_status() & read_c0_cause() & ST0_IM;
+-	unsigned int i;
++	int irq;
+ 
+-	if ((MIPS_CPU_TIMER_IRQ == 7) && (pending & CAUSEF_IP7)) {
+-		do_IRQ(MIPS_CPU_TIMER_IRQ);
+-		goto out;
+-	} else {
+-		for (i = 0; i < MAX_IM; i++) {
+-			if (pending & (CAUSEF_IP2 << i)) {
+-				ltq_hw_irqdispatch(i);
+-				goto out;
+-			}
+-		}
++	if (!pending) {
++		spurious_interrupt();
++		return;
+ 	}
+-	pr_alert("Spurious IRQ: CAUSE=0x%08x\n", read_c0_status());
+ 
+-out:
+-	return;
++	pending >>= CAUSEB_IP;
++	while (pending) {
++		irq = fls(pending) - 1;
++		do_IRQ(MIPS_CPU_IRQ_BASE + irq);
++		pending &= ~BIT(irq);
++	}
+ }
+ 
+ static int icu_map(struct irq_domain *d, unsigned int irq, irq_hw_number_t hw)
+@@ -356,11 +357,6 @@ static const struct irq_domain_ops irq_d
+ 	.map = icu_map,
+ };
+ 
+-static struct irqaction cascade = {
+-	.handler = no_action,
+-	.name = "cascade",
+-};
+-
+ int __init icu_of_init(struct device_node *node, struct device_node *parent)
+ {
+ 	struct device_node *eiu_node;
+@@ -392,7 +388,7 @@ int __init icu_of_init(struct device_nod
+ 	mips_cpu_irq_init();
+ 
+ 	for (i = 0; i < MAX_IM; i++)
+-		setup_irq(i + 2, &cascade);
++		irq_set_chained_handler(i + 2, ltq_hw_irq_handler);
+ 
+ 	if (cpu_has_vint) {
+ 		pr_info("Setting up vectored interrupts\n");
diff --git a/target/linux/mediatek/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch b/target/linux/mediatek/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
index b45d3aa..4b25d18 100644
--- a/target/linux/mediatek/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
+++ b/target/linux/mediatek/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
@@ -4672,7 +4672,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  int INFTL_mount(struct INFTLrecord *s);
 --- a/include/linux/mtd/map.h
 +++ b/include/linux/mtd/map.h
-@@ -142,7 +142,9 @@
+@@ -137,7 +137,9 @@
  #endif
  
  #ifndef map_bankwidth
@@ -4682,7 +4682,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  static inline int map_bankwidth(void *map)
  {
  	BUG();
-@@ -238,8 +240,11 @@ struct map_info {
+@@ -233,8 +235,11 @@ struct map_info {
  	   If there is no cache to care about this can be set to NULL. */
  	void (*inval_cache)(struct map_info *, unsigned long, ssize_t);
  
diff --git a/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch b/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
index b45d3aa..4b25d18 100644
--- a/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
+++ b/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
@@ -4672,7 +4672,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  int INFTL_mount(struct INFTLrecord *s);
 --- a/include/linux/mtd/map.h
 +++ b/include/linux/mtd/map.h
-@@ -142,7 +142,9 @@
+@@ -137,7 +137,9 @@
  #endif
  
  #ifndef map_bankwidth
@@ -4682,7 +4682,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  static inline int map_bankwidth(void *map)
  {
  	BUG();
-@@ -238,8 +240,11 @@ struct map_info {
+@@ -233,8 +235,11 @@ struct map_info {
  	   If there is no cache to care about this can be set to NULL. */
  	void (*inval_cache)(struct map_info *, unsigned long, ssize_t);
  
diff --git a/target/linux/sunxi/patches-4.4/100-clk-sunxi-add-dram-gates-support.patch b/target/linux/sunxi/patches-4.4/100-clk-sunxi-add-dram-gates-support.patch
index 4d353f3..a94e9b8 100644
--- a/target/linux/sunxi/patches-4.4/100-clk-sunxi-add-dram-gates-support.patch
+++ b/target/linux/sunxi/patches-4.4/100-clk-sunxi-add-dram-gates-support.patch
@@ -21,7 +21,7 @@ Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
 
 --- a/drivers/clk/sunxi/clk-simple-gates.c
 +++ b/drivers/clk/sunxi/clk-simple-gates.c
-@@ -158,3 +158,15 @@ CLK_OF_DECLARE(sun5i_a13_ahb, "allwinner
+@@ -160,3 +160,15 @@ CLK_OF_DECLARE(sun5i_a13_ahb, "allwinner
  	       sun4i_a10_ahb_init);
  CLK_OF_DECLARE(sun7i_a20_ahb, "allwinner,sun7i-a20-ahb-gates-clk",
  	       sun4i_a10_ahb_init);
diff --git a/target/linux/sunxi/patches-4.4/107-clk-sunxi-add-h3-usbphy-clocks.patch b/target/linux/sunxi/patches-4.4/107-clk-sunxi-add-h3-usbphy-clocks.patch
index ddd5e97..c845d51 100644
--- a/target/linux/sunxi/patches-4.4/107-clk-sunxi-add-h3-usbphy-clocks.patch
+++ b/target/linux/sunxi/patches-4.4/107-clk-sunxi-add-h3-usbphy-clocks.patch
@@ -19,7 +19,7 @@ Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
 
 --- a/Documentation/devicetree/bindings/clock/sunxi.txt
 +++ b/Documentation/devicetree/bindings/clock/sunxi.txt
-@@ -68,6 +68,7 @@ Required properties:
+@@ -70,6 +70,7 @@ Required properties:
  	"allwinner,sun5i-a13-usb-clk" - for usb gates + resets on A13
  	"allwinner,sun6i-a31-usb-clk" - for usb gates + resets on A31
  	"allwinner,sun8i-a23-usb-clk" - for usb gates + resets on A23
diff --git a/target/linux/sunxi/patches-4.4/110-clk-sunxi-add-ve-for-sun457i.patch b/target/linux/sunxi/patches-4.4/110-clk-sunxi-add-ve-for-sun457i.patch
index 780e034..f929753 100644
--- a/target/linux/sunxi/patches-4.4/110-clk-sunxi-add-ve-for-sun457i.patch
+++ b/target/linux/sunxi/patches-4.4/110-clk-sunxi-add-ve-for-sun457i.patch
@@ -22,7 +22,7 @@ Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
 
 --- a/Documentation/devicetree/bindings/clock/sunxi.txt
 +++ b/Documentation/devicetree/bindings/clock/sunxi.txt
-@@ -71,6 +71,7 @@ Required properties:
+@@ -73,6 +73,7 @@ Required properties:
  	"allwinner,sun8i-h3-usb-clk" - for usb gates + resets on H3
  	"allwinner,sun9i-a80-usb-mod-clk" - for usb gates + resets on A80
  	"allwinner,sun9i-a80-usb-phy-clk" - for usb phy gates + resets on A80
@@ -30,7 +30,7 @@ Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
  
  Required properties for all clocks:
  - reg : shall be the control register address for the clock.
-@@ -90,6 +91,9 @@ Required properties for all clocks:
+@@ -92,6 +93,9 @@ Required properties for all clocks:
  And "allwinner,*-usb-clk" clocks also require:
  - reset-cells : shall be set to 1