diff --git a/buildroot b/buildroot
index d78ccc1..bc248fa 160000
--- a/buildroot
+++ b/buildroot
@@ -1 +1 @@
-Subproject commit d78ccc1d2872c5ca4449f611f7ddc4f9de262dfe
+Subproject commit bc248fac945aa9c81052386d1f02e837e53fdaff
diff --git a/openpower/linux/linux-0001-xhci-Cleanup-only-when-releasing-primary-hcd.patch b/openpower/linux/linux-0001-xhci-Cleanup-only-when-releasing-primary-hcd.patch
new file mode 100644
index 0000000..5cbb9a2
--- /dev/null
+++ b/openpower/linux/linux-0001-xhci-Cleanup-only-when-releasing-primary-hcd.patch
@@ -0,0 +1,130 @@
+From 296911584cc5dda6763857110862f5267b7f47ee Mon Sep 17 00:00:00 2001
+From: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
+Date: Thu, 5 May 2016 13:24:02 +0930
+Subject: [PATCH 1/5] xhci: Cleanup only when releasing primary hcd
+
+Under stress occasions some TI devices might not return early when
+reading the status register during the quirk invocation of xhci_irq made
+by usb_hcd_pci_remove.  This means that instead of returning, we end up
+handling this interruption in the middle of a shutdown.  Since
+xhci->event_ring has already been freed in xhci_mem_cleanup, we end up
+accessing freed memory, causing the Oops below.
+
+commit 8c24d6d7b09d ("usb: xhci: stop everything on the first call to
+xhci_stop") is the one that changed the instant in which we clean up the
+event queue when stopping a device.  Before, we didn't call
+xhci_mem_cleanup at the first time xhci_stop is executed (for the shared
+HCD), instead, we only did it after the invocation for the primary HCD,
+much later at the removal path.  The code flow for this oops looks like
+this:
+
+xhci_pci_remove()
+	usb_remove_hcd(xhci->shared)
+	        xhci_stop(xhci->shared)
+ 			xhci_halt()
+			xhci_mem_cleanup(xhci);  // Free the event_queue
+	usb_hcd_pci_remove(primary)
+		xhci_irq()  // Access the event_queue if STS_EINT is set. Crash.
+		xhci_stop()
+			xhci_halt()
+			// return early
+
+The fix modifies xhci_stop to only cleanup the xhci data when releasing
+the primary HCD.  This way, we still have the event_queue configured
+when invoking xhci_irq.  We still halt the device on the first call to
+xhci_stop, though.
+
+I could reproduce this issue several times on the mainline kernel by
+doing a bind-unbind stress test with a specific storage gadget attached.
+I also ran the same test over-night with my patch applied and didn't
+observe the issue anymore.
+
+[  113.334124] Unable to handle kernel paging request for data at address 0x00000028
+[  113.335514] Faulting instruction address: 0xd00000000d4f767c
+[  113.336839] Oops: Kernel access of bad area, sig: 11 [#1]
+[  113.338214] SMP NR_CPUS=1024 NUMA PowerNV
+
+[c000000efe47ba90] c000000000720850 usb_hcd_irq+0x50/0x80
+[c000000efe47bac0] c00000000073d328 usb_hcd_pci_remove+0x68/0x1f0
+[c000000efe47bb00] d00000000daf0128 xhci_pci_remove+0x78/0xb0
+[xhci_pci]
+[c000000efe47bb30] c00000000055cf70 pci_device_remove+0x70/0x110
+[c000000efe47bb70] c00000000061c6bc __device_release_driver+0xbc/0x190
+[c000000efe47bba0] c00000000061c7d0 device_release_driver+0x40/0x70
+[c000000efe47bbd0] c000000000619510 unbind_store+0x120/0x150
+[c000000efe47bc20] c0000000006183c4 drv_attr_store+0x64/0xa0
+[c000000efe47bc60] c00000000039f1d0 sysfs_kf_write+0x80/0xb0
+[c000000efe47bca0] c00000000039e14c kernfs_fop_write+0x18c/0x1f0
+[c000000efe47bcf0] c0000000002e962c __vfs_write+0x6c/0x190
+[c000000efe47bd90] c0000000002eab40 vfs_write+0xc0/0x200
+[c000000efe47bde0] c0000000002ec85c SyS_write+0x6c/0x110
+[c000000efe47be30] c000000000009260 system_call+0x38/0x108
+
+Signed-off-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
+Cc: Roger Quadros <rogerq@ti.com>
+Cc: joel@jms.id.au
+Cc: stable@vger.kernel.org
+Reviewed-by: Roger Quadros <rogerq@ti.com>
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+---
+ drivers/usb/host/xhci-ring.c |  3 ++-
+ drivers/usb/host/xhci.c      | 27 +++++++++++++++------------
+ 2 files changed, 17 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 2b63969c2bbf..920296f555dd 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2727,7 +2727,8 @@ hw_died:
+ 		writel(irq_pending, &xhci->ir_set->irq_pending);
+ 	}
+ 
+-	if (xhci->xhc_state & XHCI_STATE_DYING) {
++	if (xhci->xhc_state & XHCI_STATE_DYING ||
++	    xhci->xhc_state & XHCI_STATE_HALTED) {
+ 		xhci_dbg(xhci, "xHCI dying, ignoring interrupt. "
+ 				"Shouldn't IRQs be disabled?\n");
+ 		/* Clear the event handler busy flag (RW1C);
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index ec9e758d5fcd..6fe0174da226 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -680,20 +680,23 @@ void xhci_stop(struct usb_hcd *hcd)
+ 	u32 temp;
+ 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
+ 
+-	if (xhci->xhc_state & XHCI_STATE_HALTED)
+-		return;
+-
+ 	mutex_lock(&xhci->mutex);
+-	spin_lock_irq(&xhci->lock);
+-	xhci->xhc_state |= XHCI_STATE_HALTED;
+-	xhci->cmd_ring_state = CMD_RING_STATE_STOPPED;
+ 
+-	/* Make sure the xHC is halted for a USB3 roothub
+-	 * (xhci_stop() could be called as part of failed init).
+-	 */
+-	xhci_halt(xhci);
+-	xhci_reset(xhci);
+-	spin_unlock_irq(&xhci->lock);
++	if (!(xhci->xhc_state & XHCI_STATE_HALTED)) {
++		spin_lock_irq(&xhci->lock);
++
++		xhci->xhc_state |= XHCI_STATE_HALTED;
++		xhci->cmd_ring_state = CMD_RING_STATE_STOPPED;
++		xhci_halt(xhci);
++		xhci_reset(xhci);
++
++		spin_unlock_irq(&xhci->lock);
++	}
++
++	if (!usb_hcd_is_primary_hcd(hcd)) {
++		mutex_unlock(&xhci->mutex);
++		return;
++	}
+ 
+ 	xhci_cleanup_msix(xhci);
+ 
+-- 
+2.8.1
+
diff --git a/openpower/linux/linux-0001-xhci-Use-xhci_pci_remove-for-xhci-device-shutdown.patch b/openpower/linux/linux-0001-xhci-Use-xhci_pci_remove-for-xhci-device-shutdown.patch
deleted file mode 100644
index c4d9315..0000000
--- a/openpower/linux/linux-0001-xhci-Use-xhci_pci_remove-for-xhci-device-shutdown.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From b9b3f9efd871e228ae14a8adbd7ef4b7d4a46123 Mon Sep 17 00:00:00 2001
-From: Thadeu Lima De Souza Cascardo <thadeul@br.ibm.com>
-Date: Tue, 25 Mar 2014 10:45:16 -0400
-Subject: [PATCH 1/7] xhci: Use xhci_pci_remove for xhci device shutdown
-
-Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
-Signed-off-by: Joel Stanley <joel@jms.id.au>
----
- drivers/usb/host/xhci-pci.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
-index c2d65206ec6c..c2d33e274542 100644
---- a/drivers/usb/host/xhci-pci.c
-+++ b/drivers/usb/host/xhci-pci.c
-@@ -438,7 +438,7 @@ static struct pci_driver xhci_pci_driver = {
- 	.remove =	xhci_pci_remove,
- 	/* suspend and resume implemented later */
- 
--	.shutdown = 	usb_hcd_pci_shutdown,
-+	.shutdown = 	xhci_pci_remove,
- #ifdef CONFIG_PM
- 	.driver = {
- 		.pm = &usb_hcd_pci_pm_ops
--- 
-2.7.4
-
diff --git a/openpower/linux/linux-0002-Revert-usb-xhci-stop-everything-on-the-first-call-to.patch b/openpower/linux/linux-0002-Revert-usb-xhci-stop-everything-on-the-first-call-to.patch
deleted file mode 100644
index 9e0ae87..0000000
--- a/openpower/linux/linux-0002-Revert-usb-xhci-stop-everything-on-the-first-call-to.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From c761f38475875d0840be302ad64904a18353e332 Mon Sep 17 00:00:00 2001
-From: Joel Stanley <joel@jms.id.au>
-Date: Thu, 28 Jan 2016 13:07:06 +1030
-Subject: [PATCH 2/7] Revert "usb: xhci: stop everything on the first call to
- xhci_stop"
-
-This reverts commit 8c24d6d7b09deee3036ddc4f2b81b53b28c8f877.
-
-With this patch, the driver stops everything at the first call to
-xhci_stop, which is always for the secondary HCD when executing the
-.remove handler. We instead want to only stop when the primray HCD is
-shutting down.
-
-Signed-off-by: Joel Stanley <joel@jms.id.au>
----
- drivers/usb/host/xhci.c | 20 +++++++++++++++-----
- 1 file changed, 15 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
-index 776d59c32bc5..cef80e930db9 100644
---- a/drivers/usb/host/xhci.c
-+++ b/drivers/usb/host/xhci.c
-@@ -665,6 +665,15 @@ int xhci_run(struct usb_hcd *hcd)
- }
- EXPORT_SYMBOL_GPL(xhci_run);
- 
-+static void xhci_only_stop_hcd(struct usb_hcd *hcd)
-+{
-+	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
-+
-+	spin_lock_irq(&xhci->lock);
-+	xhci_halt(xhci);
-+	spin_unlock_irq(&xhci->lock);
-+}
-+
- /*
-  * Stop xHCI driver.
-  *
-@@ -679,14 +688,15 @@ void xhci_stop(struct usb_hcd *hcd)
- 	u32 temp;
- 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
- 
--	if (xhci->xhc_state & XHCI_STATE_HALTED)
-+	mutex_lock(&xhci->mutex);
-+
-+	if (!usb_hcd_is_primary_hcd(hcd)) {
-+		xhci_only_stop_hcd(xhci->shared_hcd);
-+		mutex_unlock(&xhci->mutex);
- 		return;
-+	}
- 
--	mutex_lock(&xhci->mutex);
- 	spin_lock_irq(&xhci->lock);
--	xhci->xhc_state |= XHCI_STATE_HALTED;
--	xhci->cmd_ring_state = CMD_RING_STATE_STOPPED;
--
- 	/* Make sure the xHC is halted for a USB3 roothub
- 	 * (xhci_stop() could be called as part of failed init).
- 	 */
--- 
-2.7.4
-
diff --git a/openpower/linux/linux-0004-drivers-drm-ast-Switch-SCU-to-VGA-output-on-POST.patch b/openpower/linux/linux-0002-drivers-drm-ast-Switch-SCU-to-VGA-output-on-POST.patch
similarity index 93%
rename from openpower/linux/linux-0004-drivers-drm-ast-Switch-SCU-to-VGA-output-on-POST.patch
rename to openpower/linux/linux-0002-drivers-drm-ast-Switch-SCU-to-VGA-output-on-POST.patch
index 42b25ea..56b1d41 100644
--- a/openpower/linux/linux-0004-drivers-drm-ast-Switch-SCU-to-VGA-output-on-POST.patch
+++ b/openpower/linux/linux-0002-drivers-drm-ast-Switch-SCU-to-VGA-output-on-POST.patch
@@ -1,7 +1,7 @@
-From 36e277c2d85a35348c651ff18e115c70f310368e Mon Sep 17 00:00:00 2001
+From dc8a683e28d099efb7bc21dce897673afd1d0b58 Mon Sep 17 00:00:00 2001
 From: Jeremy Kerr <jk@ozlabs.org>
 Date: Wed, 2 Mar 2016 11:25:47 +0800
-Subject: [PATCH 4/7] drivers/drm/ast: Switch SCU to VGA output on POST
+Subject: [PATCH 2/5] drivers/drm/ast: Switch SCU to VGA output on POST
 
 On AST BMC platforms, the BMC may be using the VGA device for UART
 mirroring. In this case, we need to switch the DAC output to
@@ -68,5 +68,5 @@
 +	ast_moutdwm(ast, scu_addr | 0x2c, val);
 +}
 -- 
-2.7.4
+2.8.1
 
diff --git a/openpower/linux/linux-0005-scsi-ignore-errors-from-scsi_dh_add_device.patch b/openpower/linux/linux-0003-scsi-ignore-errors-from-scsi_dh_add_device.patch
similarity index 90%
rename from openpower/linux/linux-0005-scsi-ignore-errors-from-scsi_dh_add_device.patch
rename to openpower/linux/linux-0003-scsi-ignore-errors-from-scsi_dh_add_device.patch
index c1812b7..62734df 100644
--- a/openpower/linux/linux-0005-scsi-ignore-errors-from-scsi_dh_add_device.patch
+++ b/openpower/linux/linux-0003-scsi-ignore-errors-from-scsi_dh_add_device.patch
@@ -1,7 +1,7 @@
-From 2e2cc02d46a147b3386ac67b25d6bb4339afb00e Mon Sep 17 00:00:00 2001
+From 0da7781c1a731d0459ba664a08d303672cbd4fb3 Mon Sep 17 00:00:00 2001
 From: Hannes Reinecke <hare@suse.de>
 Date: Tue, 1 Mar 2016 13:57:59 +1100
-Subject: [PATCH 5/7] scsi: ignore errors from scsi_dh_add_device()
+Subject: [PATCH 3/5] scsi: ignore errors from scsi_dh_add_device()
 
 device handler initialisation might fail due to a number of
 reasons. But as device_handlers are optional this shouldn't
@@ -38,5 +38,5 @@
  	device_enable_async_suspend(&sdev->sdev_dev);
  	error = device_add(&sdev->sdev_dev);
 -- 
-2.7.4
+2.8.1
 
diff --git a/openpower/linux/linux-0003-xhci-do-not-halt-the-secondary-HCD.patch b/openpower/linux/linux-0003-xhci-do-not-halt-the-secondary-HCD.patch
deleted file mode 100644
index e3d9efc..0000000
--- a/openpower/linux/linux-0003-xhci-do-not-halt-the-secondary-HCD.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From be0312b5d7ccb3becc42a6f483c68765d4567f4c Mon Sep 17 00:00:00 2001
-From: Thadeu Lima de Souza Cascardo <cascardo@linux.vnet.ibm.com>
-Date: Mon, 10 Mar 2014 13:02:13 -0300
-Subject: [PATCH 3/7] xhci: do not halt the secondary HCD
-
-We can't halt the secondary HCD, because it's also the primary HCD,
-which will cause problems if we have devices attached to the primary
-HCD, like a keyboard.
-
-Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
-Signed-off-by: Joel Stanley <joel@jms.id.au>
----
- drivers/usb/host/xhci.c | 13 ++++++++++++-
- 1 file changed, 12 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
-index cef80e930db9..90f48eb32d93 100644
---- a/drivers/usb/host/xhci.c
-+++ b/drivers/usb/host/xhci.c
-@@ -670,7 +670,18 @@ static void xhci_only_stop_hcd(struct usb_hcd *hcd)
- 	struct xhci_hcd *xhci = hcd_to_xhci(hcd);
- 
- 	spin_lock_irq(&xhci->lock);
--	xhci_halt(xhci);
-+	/*
-+	 * We can't halt the secondary HCD, because it's also the
-+	 * primary HCD, which will cause problems if we have devices
-+	 * attached to the primary HCD, like a keyboard.
-+	 */
-+	/*xhci_halt(xhci);*/
-+
-+	/* The shared_hcd is going to be deallocated shortly (the USB core only
-+	 * calls this function when allocation fails in usb_add_hcd(), or
-+	 * usb_remove_hcd() is called).  So we need to unset xHCI's pointer.
-+	 */
-+	xhci->shared_hcd = NULL;
- 	spin_unlock_irq(&xhci->lock);
- }
- 
--- 
-2.7.4
-
diff --git a/openpower/linux/linux-0006-net-mlx4_core-Set-UAR-page-size-to-4KB-regardless-of.patch b/openpower/linux/linux-0004-net-mlx4_core-Set-UAR-page-size-to-4KB-regardless-of.patch
similarity index 98%
rename from openpower/linux/linux-0006-net-mlx4_core-Set-UAR-page-size-to-4KB-regardless-of.patch
rename to openpower/linux/linux-0004-net-mlx4_core-Set-UAR-page-size-to-4KB-regardless-of.patch
index c65784e..63711fe 100644
--- a/openpower/linux/linux-0006-net-mlx4_core-Set-UAR-page-size-to-4KB-regardless-of.patch
+++ b/openpower/linux/linux-0004-net-mlx4_core-Set-UAR-page-size-to-4KB-regardless-of.patch
@@ -1,7 +1,7 @@
-From 822aa6730a539993c3b17e151b49af6f90dc80e3 Mon Sep 17 00:00:00 2001
+From cd938ce413d38e771471275cf75f4714849883e2 Mon Sep 17 00:00:00 2001
 From: Huy Nguyen <huyn@mellanox.com>
 Date: Wed, 17 Feb 2016 17:24:26 +0200
-Subject: [PATCH 6/7] net/mlx4_core: Set UAR page size to 4KB regardless of
+Subject: [PATCH 4/5] net/mlx4_core: Set UAR page size to 4KB regardless of
  system page size
 
 problem description:
@@ -295,5 +295,5 @@
 +}
  #endif /* MLX4_DEVICE_H */
 -- 
-2.7.4
+2.8.1
 
diff --git a/openpower/linux/linux-0007-Release-4.4.8-openpower1.patch b/openpower/linux/linux-0005-Release-4.4.9-openpower1.patch
similarity index 70%
rename from openpower/linux/linux-0007-Release-4.4.8-openpower1.patch
rename to openpower/linux/linux-0005-Release-4.4.9-openpower1.patch
index 8489fdf..5126525 100644
--- a/openpower/linux/linux-0007-Release-4.4.8-openpower1.patch
+++ b/openpower/linux/linux-0005-Release-4.4.9-openpower1.patch
@@ -1,7 +1,7 @@
-From 1a760bf8893312c55a31323ce3d28e316bef2be3 Mon Sep 17 00:00:00 2001
+From 1ef895a037e6db091b3f349081f0af6f09d572c5 Mon Sep 17 00:00:00 2001
 From: Joel Stanley <joel@jms.id.au>
 Date: Thu, 14 Apr 2016 21:40:26 +0930
-Subject: [PATCH 7/7] Release 4.4.8-openpower1
+Subject: [PATCH 5/5] Release 4.4.9-openpower1
 
 Signed-off-by: Joel Stanley <joel@jms.id.au>
 ---
@@ -9,18 +9,18 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/Makefile b/Makefile
-index 1928fcd539cc..48e579df4201 100644
+index 0722cdf52152..adca207f285e 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -1,7 +1,7 @@
  VERSION = 4
  PATCHLEVEL = 4
- SUBLEVEL = 8
+ SUBLEVEL = 9
 -EXTRAVERSION =
 +EXTRAVERSION = -openpower1
  NAME = Blurry Fish Butt
  
  # *DOCUMENTATION*
 -- 
-2.7.4
+2.8.1