diff --git a/include/kernel-version.mk b/include/kernel-version.mk
index 3e923037298a..6c220f3f2a1f 100644
--- a/include/kernel-version.mk
+++ b/include/kernel-version.mk
@@ -4,12 +4,12 @@ LINUX_RELEASE?=1
 
 LINUX_VERSION-3.18 = .71
 LINUX_VERSION-4.4 = .121
-LINUX_VERSION-4.9 = .105
+LINUX_VERSION-4.9 = .106
 LINUX_VERSION-4.14 = .48
 
 LINUX_KERNEL_HASH-3.18.71 = 5abc9778ad44ce02ed6c8ab52ece8a21c6d20d21f6ed8a19287b4a38a50c1240
 LINUX_KERNEL_HASH-4.4.121 = 44a88268b5088dc326b30c9b9133ac35a9a200b636b7268d08f32abeae6ca729
-LINUX_KERNEL_HASH-4.9.105 = d085d228e3ac1fdbdf5a31bb8154e4e8a0943a9085f0384842601db8e9d96dc4
+LINUX_KERNEL_HASH-4.9.106 = 2d409bb29588ea9a61bae006255ee97a675ded364c87a9ff43f687c5271bbe3c
 LINUX_KERNEL_HASH-4.14.48 = 80a0608f611fe7a5c54556402cdc2880a21301e1c4e1b19d4c1db82ad2bf22b9
 
 remove_uri_prefix=$(subst git://,,$(subst http://,,$(subst https://,,$(1))))
diff --git a/target/linux/generic/pending-4.9/890-uart_optional_sysrq.patch b/target/linux/generic/pending-4.9/890-uart_optional_sysrq.patch
index b317070e527f..6cb745ee3329 100644
--- a/target/linux/generic/pending-4.9/890-uart_optional_sysrq.patch
+++ b/target/linux/generic/pending-4.9/890-uart_optional_sysrq.patch
@@ -26,7 +26,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  {
 --- a/lib/Kconfig.debug
 +++ b/lib/Kconfig.debug
-@@ -410,6 +410,11 @@ config MAGIC_SYSRQ_DEFAULT_ENABLE
+@@ -396,6 +396,11 @@ config MAGIC_SYSRQ_DEFAULT_ENABLE
  	  This may be set to 1 or 0 to enable or disable them all, or
  	  to a bitmask as described in Documentation/sysrq.txt.
  
diff --git a/target/linux/sunxi/patches-4.9/0052-stmmac-form-4-12.patch b/target/linux/sunxi/patches-4.9/0052-stmmac-form-4-12.patch
index a1b018186f55..1ed12946946d 100644
--- a/target/linux/sunxi/patches-4.9/0052-stmmac-form-4-12.patch
+++ b/target/linux/sunxi/patches-4.9/0052-stmmac-form-4-12.patch
@@ -3095,7 +3095,7 @@
  
  	if (priv->hw->mode->set_16kib_bfsize)
  		bfsize = priv->hw->mode->set_16kib_bfsize(dev->mtu);
-@@ -1033,235 +1234,409 @@ static int init_dma_desc_rings(struct ne
+@@ -1033,257 +1234,516 @@ static int init_dma_desc_rings(struct ne
  
  	priv->dma_buf_sz = bfsize;
  
@@ -3351,17 +3351,10 @@
 -						 priv->tx_skbuff_dma[i].buf,
 -						 priv->tx_skbuff_dma[i].len,
 -						 DMA_TO_DEVICE);
--		}
 +	for (i = 0; i < DMA_TX_SIZE; i++)
 +		stmmac_free_tx_buffer(priv, queue, i);
 +}
- 
--		if (priv->tx_skbuff[i]) {
--			dev_kfree_skb_any(priv->tx_skbuff[i]);
--			priv->tx_skbuff[i] = NULL;
--			priv->tx_skbuff_dma[i].buf = 0;
--			priv->tx_skbuff_dma[i].map_as_page = false;
--		}
++
 +/**
 + * free_dma_rx_desc_resources - free RX dma desc resources
 + * @priv: private structure
@@ -3390,11 +3383,10 @@
 +
 +		kfree(rx_q->rx_skbuff_dma);
 +		kfree(rx_q->rx_skbuff);
- 	}
- }
- 
- /**
-- * alloc_dma_desc_resources - alloc TX/RX resources.
++	}
++}
++
++/**
 + * free_dma_tx_desc_resources - free TX dma desc resources
 + * @priv: private structure
 + */
@@ -3427,90 +3419,36 @@
 +
 +/**
 + * alloc_dma_rx_desc_resources - alloc RX resources.
-  * @priv: private structure
-  * Description: according to which descriptor can be used (extend or basic)
-  * this function allocates the resources for TX and RX paths. In case of
-  * reception, for example, it pre-allocated the RX socket buffer in order to
-  * allow zero-copy mechanism.
-  */
--static int alloc_dma_desc_resources(struct stmmac_priv *priv)
++ * @priv: private structure
++ * Description: according to which descriptor can be used (extend or basic)
++ * this function allocates the resources for TX and RX paths. In case of
++ * reception, for example, it pre-allocated the RX socket buffer in order to
++ * allow zero-copy mechanism.
++ */
 +static int alloc_dma_rx_desc_resources(struct stmmac_priv *priv)
- {
++{
 +	u32 rx_count = priv->plat->rx_queues_to_use;
- 	int ret = -ENOMEM;
++	int ret = -ENOMEM;
 +	u32 queue;
- 
--	priv->rx_skbuff_dma = kmalloc_array(DMA_RX_SIZE, sizeof(dma_addr_t),
--					    GFP_KERNEL);
--	if (!priv->rx_skbuff_dma)
--		return -ENOMEM;
++
 +	/* RX queues buffers and DMA */
 +	for (queue = 0; queue < rx_count; queue++) {
 +		struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue];
- 
--	priv->rx_skbuff = kmalloc_array(DMA_RX_SIZE, sizeof(struct sk_buff *),
--					GFP_KERNEL);
--	if (!priv->rx_skbuff)
--		goto err_rx_skbuff;
--
--	priv->tx_skbuff_dma = kmalloc_array(DMA_TX_SIZE,
--					    sizeof(*priv->tx_skbuff_dma),
--					    GFP_KERNEL);
--	if (!priv->tx_skbuff_dma)
--		goto err_tx_skbuff_dma;
--
--	priv->tx_skbuff = kmalloc_array(DMA_TX_SIZE, sizeof(struct sk_buff *),
--					GFP_KERNEL);
--	if (!priv->tx_skbuff)
--		goto err_tx_skbuff;
--
--	if (priv->extend_desc) {
--		priv->dma_erx = dma_zalloc_coherent(priv->device, DMA_RX_SIZE *
--						    sizeof(struct
--							   dma_extended_desc),
--						    &priv->dma_rx_phy,
--						    GFP_KERNEL);
--		if (!priv->dma_erx)
--			goto err_dma;
++
 +		rx_q->queue_index = queue;
 +		rx_q->priv_data = priv;
- 
--		priv->dma_etx = dma_zalloc_coherent(priv->device, DMA_TX_SIZE *
--						    sizeof(struct
--							   dma_extended_desc),
--						    &priv->dma_tx_phy,
++
 +		rx_q->rx_skbuff_dma = kmalloc_array(DMA_RX_SIZE,
 +						    sizeof(dma_addr_t),
- 						    GFP_KERNEL);
--		if (!priv->dma_etx) {
--			dma_free_coherent(priv->device, DMA_RX_SIZE *
--					  sizeof(struct dma_extended_desc),
--					  priv->dma_erx, priv->dma_rx_phy);
--			goto err_dma;
--		}
--	} else {
--		priv->dma_rx = dma_zalloc_coherent(priv->device, DMA_RX_SIZE *
--						   sizeof(struct dma_desc),
--						   &priv->dma_rx_phy,
--						   GFP_KERNEL);
--		if (!priv->dma_rx)
--			goto err_dma;
++						    GFP_KERNEL);
 +		if (!rx_q->rx_skbuff_dma)
 +			return -ENOMEM;
- 
--		priv->dma_tx = dma_zalloc_coherent(priv->device, DMA_TX_SIZE *
--						   sizeof(struct dma_desc),
--						   &priv->dma_tx_phy,
--						   GFP_KERNEL);
--		if (!priv->dma_tx) {
--			dma_free_coherent(priv->device, DMA_RX_SIZE *
--					  sizeof(struct dma_desc),
--					  priv->dma_rx, priv->dma_rx_phy);
++
 +		rx_q->rx_skbuff = kmalloc_array(DMA_RX_SIZE,
 +						sizeof(struct sk_buff *),
 +						GFP_KERNEL);
 +		if (!rx_q->rx_skbuff)
- 			goto err_dma;
++			goto err_dma;
 +
 +		if (priv->extend_desc) {
 +			rx_q->dma_erx = dma_zalloc_coherent(priv->device,
@@ -3531,19 +3469,12 @@
 +							   GFP_KERNEL);
 +			if (!rx_q->dma_rx)
 +				goto err_dma;
- 		}
- 	}
- 
- 	return 0;
- 
- err_dma:
--	kfree(priv->tx_skbuff);
--err_tx_skbuff:
--	kfree(priv->tx_skbuff_dma);
--err_tx_skbuff_dma:
--	kfree(priv->rx_skbuff);
--err_rx_skbuff:
--	kfree(priv->rx_skbuff_dma);
++		}
++	}
++
++	return 0;
++
++err_dma:
 +	free_dma_rx_desc_resources(priv);
 +
 +	return ret;
@@ -3600,7 +3531,7 @@
 +							   GFP_KERNEL);
 +			if (!tx_q->dma_tx)
 +				goto err_dma_buffers;
-+		}
+ 		}
 +	}
 +
 +	return 0;
@@ -3629,85 +3560,126 @@
 +
 +	ret = alloc_dma_tx_desc_resources(priv);
 +
- 	return ret;
- }
- 
++	return ret;
++}
++
 +/**
 + * free_dma_desc_resources - free dma desc resources
 + * @priv: private structure
 + */
- static void free_dma_desc_resources(struct stmmac_priv *priv)
- {
--	/* Release the DMA TX/RX socket buffers */
--	dma_free_rx_skbufs(priv);
--	dma_free_tx_skbufs(priv);
--
--	/* Free DMA regions of consistent memory previously allocated */
--	if (!priv->extend_desc) {
--		dma_free_coherent(priv->device,
--				  DMA_TX_SIZE * sizeof(struct dma_desc),
--				  priv->dma_tx, priv->dma_tx_phy);
--		dma_free_coherent(priv->device,
--				  DMA_RX_SIZE * sizeof(struct dma_desc),
--				  priv->dma_rx, priv->dma_rx_phy);
--	} else {
--		dma_free_coherent(priv->device, DMA_TX_SIZE *
--				  sizeof(struct dma_extended_desc),
--				  priv->dma_etx, priv->dma_tx_phy);
--		dma_free_coherent(priv->device, DMA_RX_SIZE *
--				  sizeof(struct dma_extended_desc),
--				  priv->dma_erx, priv->dma_rx_phy);
--	}
--	kfree(priv->rx_skbuff_dma);
--	kfree(priv->rx_skbuff);
--	kfree(priv->tx_skbuff_dma);
--	kfree(priv->tx_skbuff);
++static void free_dma_desc_resources(struct stmmac_priv *priv)
++{
 +	/* Release the DMA RX socket buffers */
 +	free_dma_rx_desc_resources(priv);
 +
 +	/* Release the DMA TX socket buffers */
 +	free_dma_tx_desc_resources(priv);
- }
- 
- /**
-@@ -1271,19 +1646,104 @@ static void free_dma_desc_resources(stru
-  */
- static void stmmac_mac_enable_rx_queues(struct stmmac_priv *priv)
- {
--	int rx_count = priv->dma_cap.number_rx_queues;
--	int queue = 0;
++}
++
++/**
++ *  stmmac_mac_enable_rx_queues - Enable MAC rx queues
++ *  @priv: driver private structure
++ *  Description: It is used for enabling the rx queues in the MAC
++ */
++static void stmmac_mac_enable_rx_queues(struct stmmac_priv *priv)
++{
 +	u32 rx_queues_count = priv->plat->rx_queues_to_use;
 +	int queue;
 +	u8 mode;
  
--	/* If GMAC does not have multiple queues, then this is not necessary*/
--	if (rx_count == 1)
--		return;
+-		if (priv->tx_skbuff[i]) {
+-			dev_kfree_skb_any(priv->tx_skbuff[i]);
+-			priv->tx_skbuff[i] = NULL;
+-			priv->tx_skbuff_dma[i].buf = 0;
+-			priv->tx_skbuff_dma[i].map_as_page = false;
+-		}
 +	for (queue = 0; queue < rx_queues_count; queue++) {
 +		mode = priv->plat->rx_queues_cfg[queue].mode_to_use;
 +		priv->hw->mac->rx_queue_enable(priv->hw, mode, queue);
-+	}
-+}
+ 	}
+ }
  
--	/**
--	 *  If the core is synthesized with multiple rx queues / multiple
--	 *  dma channels, then rx queues will be disabled by default.
--	 *  For now only rx queue 0 is enabled.
--	 */
--	priv->hw->mac->rx_queue_enable(priv->hw, queue);
-+/**
+ /**
+- * alloc_dma_desc_resources - alloc TX/RX resources.
+- * @priv: private structure
+- * Description: according to which descriptor can be used (extend or basic)
+- * this function allocates the resources for TX and RX paths. In case of
+- * reception, for example, it pre-allocated the RX socket buffer in order to
+- * allow zero-copy mechanism.
 + * stmmac_start_rx_dma - start RX DMA channel
 + * @priv: driver private structure
 + * @chan: RX channel index
 + * Description:
 + * This starts a RX DMA channel
-+ */
+  */
+-static int alloc_dma_desc_resources(struct stmmac_priv *priv)
 +static void stmmac_start_rx_dma(struct stmmac_priv *priv, u32 chan)
-+{
+ {
+-	int ret = -ENOMEM;
+-
+-	priv->rx_skbuff_dma = kmalloc_array(DMA_RX_SIZE, sizeof(dma_addr_t),
+-					    GFP_KERNEL);
+-	if (!priv->rx_skbuff_dma)
+-		return -ENOMEM;
+-
+-	priv->rx_skbuff = kmalloc_array(DMA_RX_SIZE, sizeof(struct sk_buff *),
+-					GFP_KERNEL);
+-	if (!priv->rx_skbuff)
+-		goto err_rx_skbuff;
+-
+-	priv->tx_skbuff_dma = kmalloc_array(DMA_TX_SIZE,
+-					    sizeof(*priv->tx_skbuff_dma),
+-					    GFP_KERNEL);
+-	if (!priv->tx_skbuff_dma)
+-		goto err_tx_skbuff_dma;
+-
+-	priv->tx_skbuff = kmalloc_array(DMA_TX_SIZE, sizeof(struct sk_buff *),
+-					GFP_KERNEL);
+-	if (!priv->tx_skbuff)
+-		goto err_tx_skbuff;
+-
+-	if (priv->extend_desc) {
+-		priv->dma_erx = dma_zalloc_coherent(priv->device, DMA_RX_SIZE *
+-						    sizeof(struct
+-							   dma_extended_desc),
+-						    &priv->dma_rx_phy,
+-						    GFP_KERNEL);
+-		if (!priv->dma_erx)
+-			goto err_dma;
+-
+-		priv->dma_etx = dma_zalloc_coherent(priv->device, DMA_TX_SIZE *
+-						    sizeof(struct
+-							   dma_extended_desc),
+-						    &priv->dma_tx_phy,
+-						    GFP_KERNEL);
+-		if (!priv->dma_etx) {
+-			dma_free_coherent(priv->device, DMA_RX_SIZE *
+-					  sizeof(struct dma_extended_desc),
+-					  priv->dma_erx, priv->dma_rx_phy);
+-			goto err_dma;
+-		}
+-	} else {
+-		priv->dma_rx = dma_zalloc_coherent(priv->device, DMA_RX_SIZE *
+-						   sizeof(struct dma_desc),
+-						   &priv->dma_rx_phy,
+-						   GFP_KERNEL);
+-		if (!priv->dma_rx)
+-			goto err_dma;
 +	netdev_dbg(priv->dev, "DMA RX processes started in channel %d\n", chan);
 +	priv->hw->dma->start_rx(priv->ioaddr, chan);
 +}
-+
+ 
+-		priv->dma_tx = dma_zalloc_coherent(priv->device, DMA_TX_SIZE *
+-						   sizeof(struct dma_desc),
+-						   &priv->dma_tx_phy,
+-						   GFP_KERNEL);
+-		if (!priv->dma_tx) {
+-			dma_free_coherent(priv->device, DMA_RX_SIZE *
+-					  sizeof(struct dma_desc),
+-					  priv->dma_rx, priv->dma_rx_phy);
+-			goto err_dma;
+-		}
+-	}
 +/**
 + * stmmac_start_tx_dma - start TX DMA channel
 + * @priv: driver private structure
@@ -3720,7 +3692,8 @@
 +	netdev_dbg(priv->dev, "DMA TX processes started in channel %d\n", chan);
 +	priv->hw->dma->start_tx(priv->ioaddr, chan);
 +}
-+
+ 
+-	return 0;
 +/**
 + * stmmac_stop_rx_dma - stop RX DMA channel
 + * @priv: driver private structure
@@ -3733,7 +3706,16 @@
 +	netdev_dbg(priv->dev, "DMA RX processes stopped in channel %d\n", chan);
 +	priv->hw->dma->stop_rx(priv->ioaddr, chan);
 +}
-+
+ 
+-err_dma:
+-	kfree(priv->tx_skbuff);
+-err_tx_skbuff:
+-	kfree(priv->tx_skbuff_dma);
+-err_tx_skbuff_dma:
+-	kfree(priv->rx_skbuff);
+-err_rx_skbuff:
+-	kfree(priv->rx_skbuff_dma);
+-	return ret;
 +/**
 + * stmmac_stop_tx_dma - stop TX DMA channel
 + * @priv: driver private structure
@@ -3745,8 +3727,9 @@
 +{
 +	netdev_dbg(priv->dev, "DMA TX processes stopped in channel %d\n", chan);
 +	priv->hw->dma->stop_tx(priv->ioaddr, chan);
-+}
-+
+ }
+ 
+-static void free_dma_desc_resources(struct stmmac_priv *priv)
 +/**
 + * stmmac_start_all_dma - start all RX and TX DMA channels
 + * @priv: driver private structure
@@ -3754,7 +3737,31 @@
 + * This starts all the RX and TX DMA channels
 + */
 +static void stmmac_start_all_dma(struct stmmac_priv *priv)
-+{
+ {
+-	/* Release the DMA TX/RX socket buffers */
+-	dma_free_rx_skbufs(priv);
+-	dma_free_tx_skbufs(priv);
+-
+-	/* Free DMA regions of consistent memory previously allocated */
+-	if (!priv->extend_desc) {
+-		dma_free_coherent(priv->device,
+-				  DMA_TX_SIZE * sizeof(struct dma_desc),
+-				  priv->dma_tx, priv->dma_tx_phy);
+-		dma_free_coherent(priv->device,
+-				  DMA_RX_SIZE * sizeof(struct dma_desc),
+-				  priv->dma_rx, priv->dma_rx_phy);
+-	} else {
+-		dma_free_coherent(priv->device, DMA_TX_SIZE *
+-				  sizeof(struct dma_extended_desc),
+-				  priv->dma_etx, priv->dma_tx_phy);
+-		dma_free_coherent(priv->device, DMA_RX_SIZE *
+-				  sizeof(struct dma_extended_desc),
+-				  priv->dma_erx, priv->dma_rx_phy);
+-	}
+-	kfree(priv->rx_skbuff_dma);
+-	kfree(priv->rx_skbuff);
+-	kfree(priv->tx_skbuff_dma);
+-	kfree(priv->tx_skbuff);
 +	u32 rx_channels_count = priv->plat->rx_queues_to_use;
 +	u32 tx_channels_count = priv->plat->tx_queues_to_use;
 +	u32 chan = 0;
@@ -3764,23 +3771,38 @@
 +
 +	for (chan = 0; chan < tx_channels_count; chan++)
 +		stmmac_start_tx_dma(priv, chan);
-+}
-+
-+/**
+ }
+ 
+ /**
+- *  stmmac_mac_enable_rx_queues - Enable MAC rx queues
+- *  @priv: driver private structure
+- *  Description: It is used for enabling the rx queues in the MAC
 + * stmmac_stop_all_dma - stop all RX and TX DMA channels
 + * @priv: driver private structure
 + * Description:
 + * This stops the RX and TX DMA channels
-+ */
+  */
+-static void stmmac_mac_enable_rx_queues(struct stmmac_priv *priv)
 +static void stmmac_stop_all_dma(struct stmmac_priv *priv)
-+{
+ {
+-	int rx_count = priv->dma_cap.number_rx_queues;
+-	int queue = 0;
 +	u32 rx_channels_count = priv->plat->rx_queues_to_use;
 +	u32 tx_channels_count = priv->plat->tx_queues_to_use;
 +	u32 chan = 0;
-+
+ 
+-	/* If GMAC does not have multiple queues, then this is not necessary*/
+-	if (rx_count == 1)
+-		return;
 +	for (chan = 0; chan < rx_channels_count; chan++)
 +		stmmac_stop_rx_dma(priv, chan);
-+
+ 
+-	/**
+-	 *  If the core is synthesized with multiple rx queues / multiple
+-	 *  dma channels, then rx queues will be disabled by default.
+-	 *  For now only rx queue 0 is enabled.
+-	 */
+-	priv->hw->mac->rx_queue_enable(priv->hw, queue);
 +	for (chan = 0; chan < tx_channels_count; chan++)
 +		stmmac_stop_tx_dma(priv, chan);
  }
diff --git a/target/linux/x86/patches-4.9/200-pcengines-apu2-reboot.patch b/target/linux/x86/patches-4.9/200-pcengines-apu2-reboot.patch
index 21a8eeff92cc..6c2b21d157bc 100644
--- a/target/linux/x86/patches-4.9/200-pcengines-apu2-reboot.patch
+++ b/target/linux/x86/patches-4.9/200-pcengines-apu2-reboot.patch
@@ -1,6 +1,6 @@
 --- a/arch/x86/kernel/reboot.c
 +++ b/arch/x86/kernel/reboot.c
-@@ -447,6 +447,16 @@ static struct dmi_system_id __initdata r
+@@ -449,6 +449,16 @@ static struct dmi_system_id __initdata r
  		},
  	},
  
