kernel: bump 4.4 to 4.4.119

This bumps the 4.4. kernel in master to 4.4.119.
Includes more Meltdown & Spectre mitigation.

* Refresh patches.
* Refresh x86/config for RETPOLINE.
* Deleted 8049-PCI-layerscape-Add-fsl-ls2085a-pcie-compatible-ID.patch (accepted upstream)
* Deleted 8050-PCI-layerscape-Fix-MSG-TLP-drop-setting.patch (accepted upstream)
* Deleted 650-pppoe_header_pad.patch (does not apply anymore (code was replaced)).

Bumps from 4.4.112 to 4.4.115 were handled by Kevin Darbyshire-Bryant.

Compile-tested on: ar71xx & oxnas.

Signed-off-by: Stijn Segers <foss@volatilesystems.org>
Tested-by: Rosen Penev <rosenp@gmail.com>

27 files changed, 126 insertions, 145 deletions

diff --git a/target/linux/ar71xx/patches-4.4/004-register_gpio_driver_earlier.patch b/target/linux/ar71xx/patches-4.4/004-register_gpio_driver_earlier.patch
index 0c07cb18c7..639e82c245 100644
--- a/target/linux/ar71xx/patches-4.4/004-register_gpio_driver_earlier.patch
+++ b/target/linux/ar71xx/patches-4.4/004-register_gpio_driver_earlier.patch
@@ -3,7 +3,7 @@ from mach files succeed.
 
 --- a/drivers/gpio/gpio-ath79.c
 +++ b/drivers/gpio/gpio-ath79.c
-@@ -202,4 +202,8 @@ static struct platform_driver ath79_gpio
+@@ -202,7 +202,11 @@ static struct platform_driver ath79_gpio
  	.probe = ath79_gpio_probe,
  };
  
@@ -13,3 +13,6 @@ from mach files succeed.
 +	return platform_driver_register(&ath79_gpio_driver);
 +}
 +postcore_initcall(ath79_gpio_init);
+ 
+ MODULE_DESCRIPTION("Atheros AR71XX/AR724X/AR913X GPIO API support");
+ MODULE_LICENSE("GPL v2");
diff --git a/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch b/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch
index a8d8c15c3b..72d964df63 100644
--- a/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch
+++ b/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch
@@ -310,7 +310,7 @@
  	if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
 --- a/net/ipv6/ip6_tunnel.c
 +++ b/net/ipv6/ip6_tunnel.c
-@@ -1410,7 +1410,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
+@@ -1307,7 +1307,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
  
  	dsfield = ipv6_get_dsfield(ipv6h);
  	if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
@@ -491,7 +491,7 @@
  		memcpy(p, foc->val, foc->len);
 --- a/net/ipv4/igmp.c
 +++ b/net/ipv4/igmp.c
-@@ -529,7 +529,7 @@ static struct sk_buff *add_grec(struct s
+@@ -533,7 +533,7 @@ static struct sk_buff *add_grec(struct s
  		if (!skb)
  			return NULL;
  		psrc = (__be32 *)skb_put(skb, sizeof(__be32));
@@ -664,7 +664,7 @@
  
  #define	IP6_MF		0x0001
  #define	IP6_OFFSET	0xFFF8
-@@ -417,8 +417,8 @@ static inline void __ipv6_addr_set_half(
+@@ -418,8 +418,8 @@ static inline void __ipv6_addr_set_half(
  	}
  #endif
  #endif
@@ -675,7 +675,7 @@
  }
  
  static inline void ipv6_addr_set(struct in6_addr *addr, 
-@@ -477,6 +477,8 @@ static inline bool ipv6_prefix_equal(con
+@@ -478,6 +478,8 @@ static inline bool ipv6_prefix_equal(con
  	const __be32 *a1 = addr1->s6_addr32;
  	const __be32 *a2 = addr2->s6_addr32;
  	unsigned int pdw, pbi;
@@ -684,7 +684,7 @@
  
  	/* check complete u32 in prefix */
  	pdw = prefixlen >> 5;
-@@ -485,7 +487,9 @@ static inline bool ipv6_prefix_equal(con
+@@ -486,7 +488,9 @@ static inline bool ipv6_prefix_equal(con
  
  	/* check incomplete u32 in prefix */
  	pbi = prefixlen & 0x1f;
@@ -695,7 +695,7 @@
  		return false;
  
  	return true;
-@@ -629,13 +633,13 @@ static inline void ipv6_addr_set_v4mappe
+@@ -630,13 +634,13 @@ static inline void ipv6_addr_set_v4mappe
   */
  static inline int __ipv6_addr_diff32(const void *token1, const void *token2, int addrlen)
  {
@@ -711,7 +711,7 @@
  		if (xb)
  			return i * 32 + 31 - __fls(ntohl(xb));
  	}
-@@ -804,17 +808,18 @@ static inline int ip6_default_np_autolab
+@@ -805,17 +809,18 @@ static inline int ip6_default_np_autolab
  static inline void ip6_flow_hdr(struct ipv6hdr *hdr, unsigned int tclass,
  				__be32 flowlabel)
  {
diff --git a/target/linux/bcm53xx/patches-4.4/140-mtd-brcmnand-set-initial-ECC-params-based-on-info-fr.patch b/target/linux/bcm53xx/patches-4.4/140-mtd-brcmnand-set-initial-ECC-params-based-on-info-fr.patch
index ea59938aa1..4eba839d91 100644
--- a/target/linux/bcm53xx/patches-4.4/140-mtd-brcmnand-set-initial-ECC-params-based-on-info-fr.patch
+++ b/target/linux/bcm53xx/patches-4.4/140-mtd-brcmnand-set-initial-ECC-params-based-on-info-fr.patch
@@ -41,7 +41,7 @@ This should be very helpful for ppl adding new devices support.
  static void brcmnand_set_ecc_enabled(struct brcmnand_host *host, int en)
  {
  	struct brcmnand_controller *ctrl = host->ctrl;
-@@ -1997,6 +2008,9 @@ static int brcmnand_init_cs(struct brcmn
+@@ -1990,6 +2001,9 @@ static int brcmnand_init_cs(struct brcmn
  	nand_writereg(ctrl, cfg_offs,
  		      nand_readreg(ctrl, cfg_offs) & ~CFG_BUS_WIDTH);
  
diff --git a/target/linux/brcm63xx/patches-4.4/000-4.5-03-mtd-nand-spi-nor-assign-MTD-of_node.patch b/target/linux/brcm63xx/patches-4.4/000-4.5-03-mtd-nand-spi-nor-assign-MTD-of_node.patch
index 6b0a12132e..e29aecda21 100644
--- a/target/linux/brcm63xx/patches-4.4/000-4.5-03-mtd-nand-spi-nor-assign-MTD-of_node.patch
+++ b/target/linux/brcm63xx/patches-4.4/000-4.5-03-mtd-nand-spi-nor-assign-MTD-of_node.patch
@@ -15,7 +15,7 @@ Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
 
 --- a/drivers/mtd/nand/nand_base.c
 +++ b/drivers/mtd/nand/nand_base.c
-@@ -3992,6 +3992,9 @@ int nand_scan_ident(struct mtd_info *mtd
+@@ -3995,6 +3995,9 @@ int nand_scan_ident(struct mtd_info *mtd
  	int ret;
  
  	if (chip->flash_node) {
diff --git a/target/linux/brcm63xx/patches-4.4/000-4.5-04-mtd-nand-convert-to-nand_set_flash_node.patch b/target/linux/brcm63xx/patches-4.4/000-4.5-04-mtd-nand-convert-to-nand_set_flash_node.patch
index ecfd8c44f5..15a1ec37d4 100644
--- a/target/linux/brcm63xx/patches-4.4/000-4.5-04-mtd-nand-convert-to-nand_set_flash_node.patch
+++ b/target/linux/brcm63xx/patches-4.4/000-4.5-04-mtd-nand-convert-to-nand_set_flash_node.patch
@@ -28,7 +28,7 @@ Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
 
 --- a/drivers/mtd/nand/brcmnand/brcmnand.c
 +++ b/drivers/mtd/nand/brcmnand/brcmnand.c
-@@ -1957,7 +1957,7 @@ static int brcmnand_init_cs(struct brcmn
+@@ -1950,7 +1950,7 @@ static int brcmnand_init_cs(struct brcmn
  	mtd = &host->mtd;
  	chip = &host->chip;
  
@@ -50,7 +50,7 @@ Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
  		nand->options |= NAND_BUSWIDTH_16;
 --- a/drivers/mtd/nand/sunxi_nand.c
 +++ b/drivers/mtd/nand/sunxi_nand.c
-@@ -1330,7 +1330,7 @@ static int sunxi_nand_chip_init(struct d
+@@ -1336,7 +1336,7 @@ static int sunxi_nand_chip_init(struct d
  	 * in the DT.
  	 */
  	nand->ecc.mode = NAND_ECC_HW;
diff --git a/target/linux/brcm63xx/patches-4.4/000-4.5-06-mtd-nand-drop-unnecessary-partition-parser-data.patch b/target/linux/brcm63xx/patches-4.4/000-4.5-06-mtd-nand-drop-unnecessary-partition-parser-data.patch
index 8a031301b1..3dc68f01df 100644
--- a/target/linux/brcm63xx/patches-4.4/000-4.5-06-mtd-nand-drop-unnecessary-partition-parser-data.patch
+++ b/target/linux/brcm63xx/patches-4.4/000-4.5-06-mtd-nand-drop-unnecessary-partition-parser-data.patch
@@ -83,7 +83,7 @@ Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
  
 --- a/drivers/mtd/nand/brcmnand/brcmnand.c
 +++ b/drivers/mtd/nand/brcmnand/brcmnand.c
-@@ -1946,7 +1946,6 @@ static int brcmnand_init_cs(struct brcmn
+@@ -1939,7 +1939,6 @@ static int brcmnand_init_cs(struct brcmn
  	struct nand_chip *chip;
  	int ret;
  	u16 cfg_offs;
@@ -91,7 +91,7 @@ Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
  
  	ret = of_property_read_u32(dn, "reg", &host->cs);
  	if (ret) {
-@@ -2025,7 +2024,7 @@ static int brcmnand_init_cs(struct brcmn
+@@ -2018,7 +2017,7 @@ static int brcmnand_init_cs(struct brcmn
  	if (nand_scan_tail(mtd))
  		return -ENXIO;
  
@@ -610,7 +610,7 @@ Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
  
  	flctl = devm_kzalloc(&pdev->dev, sizeof(struct sh_flctl), GFP_KERNEL);
  	if (!flctl)
-@@ -1123,6 +1122,7 @@ static int flctl_probe(struct platform_d
+@@ -1124,6 +1123,7 @@ static int flctl_probe(struct platform_d
  	platform_set_drvdata(pdev, flctl);
  	flctl_mtd = &flctl->mtd;
  	nand = &flctl->chip;
@@ -618,7 +618,7 @@ Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
  	flctl_mtd->priv = nand;
  	flctl_mtd->dev.parent = &pdev->dev;
  	flctl->pdev = pdev;
-@@ -1163,9 +1163,7 @@ static int flctl_probe(struct platform_d
+@@ -1164,9 +1164,7 @@ static int flctl_probe(struct platform_d
  	if (ret)
  		goto err_chip;
  
@@ -662,7 +662,7 @@ Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
  
 --- a/drivers/mtd/nand/sunxi_nand.c
 +++ b/drivers/mtd/nand/sunxi_nand.c
-@@ -1232,7 +1232,6 @@ static int sunxi_nand_chip_init(struct d
+@@ -1238,7 +1238,6 @@ static int sunxi_nand_chip_init(struct d
  {
  	const struct nand_sdr_timings *timings;
  	struct sunxi_nand_chip *chip;
@@ -670,7 +670,7 @@ Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
  	struct mtd_info *mtd;
  	struct nand_chip *nand;
  	int nsels;
-@@ -1366,8 +1365,7 @@ static int sunxi_nand_chip_init(struct d
+@@ -1372,8 +1371,7 @@ static int sunxi_nand_chip_init(struct d
  		return ret;
  	}
  
diff --git a/target/linux/generic/pending-4.4/001-mtdsplit_backport.patch b/target/linux/generic/pending-4.4/001-mtdsplit_backport.patch
index f0839b6b90..b5c485fe13 100644
--- a/target/linux/generic/pending-4.4/001-mtdsplit_backport.patch
+++ b/target/linux/generic/pending-4.4/001-mtdsplit_backport.patch
@@ -129,7 +129,7 @@
  	return __mtdsplit_parse_uimage(master, pparts, data,
 --- a/drivers/mtd/mtdsplit/mtdsplit_wrgg.c
 +++ b/drivers/mtd/mtdsplit/mtdsplit_wrgg.c
-@@ -40,8 +40,8 @@ struct wrgg03_header {
+@@ -51,8 +51,8 @@ struct wrg_header {
  
  
  static int mtdsplit_parse_wrgg(struct mtd_info *master,
diff --git a/target/linux/generic/pending-4.4/051-0005-ovl-proper-cleanup-of-workdir.patch b/target/linux/generic/pending-4.4/051-0005-ovl-proper-cleanup-of-workdir.patch
index eb095b7a2e..7225fc8cd9 100644
--- a/target/linux/generic/pending-4.4/051-0005-ovl-proper-cleanup-of-workdir.patch
+++ b/target/linux/generic/pending-4.4/051-0005-ovl-proper-cleanup-of-workdir.patch
@@ -53,7 +53,7 @@ Cc: <stable@vger.kernel.org>
  		err = ovl_check_whiteouts(realpath->dentry, rdd);
  
  	fput(realfile);
-@@ -569,3 +569,64 @@ void ovl_cleanup_whiteouts(struct dentry
+@@ -573,3 +573,64 @@ void ovl_cleanup_whiteouts(struct dentry
  	}
  	mutex_unlock(&upper->d_inode->i_mutex);
  }
diff --git a/target/linux/generic/pending-4.4/201-extra_optimization.patch b/target/linux/generic/pending-4.4/201-extra_optimization.patch
index 2f834422cb..b4235a11d4 100644
--- a/target/linux/generic/pending-4.4/201-extra_optimization.patch
+++ b/target/linux/generic/pending-4.4/201-extra_optimization.patch
@@ -1,6 +1,6 @@
 --- a/Makefile
 +++ b/Makefile
-@@ -624,12 +624,12 @@ KBUILD_CFLAGS	+= $(call cc-disable-warni
+@@ -626,12 +626,12 @@ KBUILD_CFLAGS	+= $(call cc-disable-warni
  KBUILD_CFLAGS	+= $(call cc-disable-warning, int-in-bool-context)
  
  ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
diff --git a/target/linux/generic/pending-4.4/202-reduce_module_size.patch b/target/linux/generic/pending-4.4/202-reduce_module_size.patch
index d68c463648..1aabf3e722 100644
--- a/target/linux/generic/pending-4.4/202-reduce_module_size.patch
+++ b/target/linux/generic/pending-4.4/202-reduce_module_size.patch
@@ -1,6 +1,6 @@
 --- a/Makefile
 +++ b/Makefile
-@@ -403,7 +403,7 @@ KBUILD_CFLAGS_KERNEL :=
+@@ -405,7 +405,7 @@ KBUILD_CFLAGS_KERNEL :=
  KBUILD_AFLAGS   := -D__ASSEMBLY__ $(call cc-option,-fno-PIE)
  KBUILD_AFLAGS_MODULE  := -DMODULE
  KBUILD_CFLAGS_MODULE  := -DMODULE
diff --git a/target/linux/generic/pending-4.4/204-module_strip.patch b/target/linux/generic/pending-4.4/204-module_strip.patch
index d4c8039f75..a661f98c65 100644
--- a/target/linux/generic/pending-4.4/204-module_strip.patch
+++ b/target/linux/generic/pending-4.4/204-module_strip.patch
@@ -89,7 +89,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/init/Kconfig
 +++ b/init/Kconfig
-@@ -2026,6 +2026,13 @@ config MODULE_COMPRESS_XZ
+@@ -2033,6 +2033,13 @@ config MODULE_COMPRESS_XZ
  
  endchoice
  
@@ -105,7 +105,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  config MODULES_TREE_LOOKUP
 --- a/kernel/module.c
 +++ b/kernel/module.c
-@@ -2871,6 +2871,7 @@ static struct module *setup_load_info(st
+@@ -2880,6 +2880,7 @@ static void check_modinfo_retpoline(stru
  
  static int check_modinfo(struct module *mod, struct load_info *info, int flags)
  {
@@ -113,7 +113,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	const char *modmagic = get_modinfo(info, "vermagic");
  	int err;
  
-@@ -2900,6 +2901,7 @@ static int check_modinfo(struct module *
+@@ -2911,6 +2912,7 @@ static int check_modinfo(struct module *
  		pr_warn("%s: module is from the staging directory, the quality "
  			"is unknown, you have been warned.\n", mod->name);
  	}
@@ -123,7 +123,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	set_license(mod, get_modinfo(info, "license"));
 --- a/scripts/mod/modpost.c
 +++ b/scripts/mod/modpost.c
-@@ -1963,7 +1963,9 @@ static void read_symbols(char *modname)
+@@ -1964,7 +1964,9 @@ static void read_symbols(char *modname)
  		symname = remove_dot(info.strtab + sym->st_name);
  
  		handle_modversions(mod, &info, sym, symname);
@@ -133,7 +133,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	}
  	if (!is_vmlinux(modname) ||
  	     (is_vmlinux(modname) && vmlinux_section_warnings))
-@@ -2107,7 +2109,9 @@ static void add_header(struct buffer *b,
+@@ -2108,7 +2110,9 @@ static void add_header(struct buffer *b,
  	buf_printf(b, "#include <linux/vermagic.h>\n");
  	buf_printf(b, "#include <linux/compiler.h>\n");
  	buf_printf(b, "\n");
@@ -143,7 +143,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	buf_printf(b, "\n");
  	buf_printf(b, "__visible struct module __this_module\n");
  	buf_printf(b, "__attribute__((section(\".gnu.linkonce.this_module\"))) = {\n");
-@@ -2124,16 +2128,20 @@ static void add_header(struct buffer *b,
+@@ -2125,8 +2129,10 @@ static void add_header(struct buffer *b,
  
  static void add_intree_flag(struct buffer *b, int is_intree)
  {
@@ -153,6 +153,9 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +#endif
  }
  
+ /* Cannot check for assembler */
+@@ -2139,10 +2145,12 @@ static void add_retpoline(struct buffer
+ 
  static void add_staging_flag(struct buffer *b, const char *name)
  {
 +#ifndef CONFIG_MODULE_STRIPPED
@@ -164,7 +167,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  /* In kernel, this size is defined in linux/module.h;
-@@ -2237,11 +2245,13 @@ static void add_depends(struct buffer *b
+@@ -2246,11 +2254,13 @@ static void add_depends(struct buffer *b
  
  static void add_srcversion(struct buffer *b, struct module *mod)
  {
@@ -178,7 +181,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  static void write_if_changed(struct buffer *b, const char *fname)
-@@ -2475,7 +2485,9 @@ int main(int argc, char **argv)
+@@ -2485,7 +2495,9 @@ int main(int argc, char **argv)
  		add_staging_flag(&buf, mod->name);
  		err |= add_versions(&buf, mod);
  		add_depends(&buf, mod, modules);
diff --git a/target/linux/generic/pending-4.4/208-disable-modorder.patch b/target/linux/generic/pending-4.4/208-disable-modorder.patch
index 00d6e41952..1707d520be 100644
--- a/target/linux/generic/pending-4.4/208-disable-modorder.patch
+++ b/target/linux/generic/pending-4.4/208-disable-modorder.patch
@@ -5,7 +5,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 ---
 --- a/Makefile
 +++ b/Makefile
-@@ -1121,7 +1121,6 @@ all: modules
+@@ -1123,7 +1123,6 @@ all: modules
  
  PHONY += modules
  modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
@@ -13,7 +13,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	@$(kecho) '  Building modules, stage 2.';
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.fwinst obj=firmware __fw_modbuild
-@@ -1151,7 +1150,6 @@ _modinst_:
+@@ -1153,7 +1152,6 @@ _modinst_:
  		rm -f $(MODLIB)/build ; \
  		ln -s $(CURDIR) $(MODLIB)/build ; \
  	fi
diff --git a/target/linux/generic/pending-4.4/221-module_exports.patch b/target/linux/generic/pending-4.4/221-module_exports.patch
index 510a86c468..44c0a6dec6 100644
--- a/target/linux/generic/pending-4.4/221-module_exports.patch
+++ b/target/linux/generic/pending-4.4/221-module_exports.patch
@@ -54,7 +54,7 @@
  	}
 --- a/scripts/Makefile.build
 +++ b/scripts/Makefile.build
-@@ -299,7 +299,7 @@ targets += $(extra-y) $(MAKECMDGOALS) $(
+@@ -372,7 +372,7 @@ targets += $(extra-y) $(MAKECMDGOALS) $(
  # Linker scripts preprocessor (.lds.S -> .lds)
  # ---------------------------------------------------------------------------
  quiet_cmd_cpp_lds_S = LDS     $@
diff --git a/target/linux/generic/pending-4.4/491-ubi-auto-create-ubiblock-device-for-rootfs.patch b/target/linux/generic/pending-4.4/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
index da3111266a..462f7f42cb 100644
--- a/target/linux/generic/pending-4.4/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
+++ b/target/linux/generic/pending-4.4/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
@@ -11,7 +11,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 
 --- a/drivers/mtd/ubi/block.c
 +++ b/drivers/mtd/ubi/block.c
-@@ -628,6 +628,44 @@ static void __init ubiblock_create_from_
+@@ -636,6 +636,44 @@ static void __init ubiblock_create_from_
  	}
  }
  
@@ -56,7 +56,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  static void ubiblock_remove_all(void)
  {
  	struct ubiblock *next;
-@@ -658,6 +696,10 @@ int __init ubiblock_init(void)
+@@ -668,6 +706,10 @@ int __init ubiblock_init(void)
  	 */
  	ubiblock_create_from_param();
  
diff --git a/target/linux/generic/pending-4.4/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch b/target/linux/generic/pending-4.4/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch
index f55e8e3a4d..9fbfc79927 100644
--- a/target/linux/generic/pending-4.4/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch
+++ b/target/linux/generic/pending-4.4/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch
@@ -19,7 +19,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  #include "ubi-media.h"
  #include "ubi.h"
-@@ -448,6 +449,15 @@ int ubiblock_create(struct ubi_volume_in
+@@ -447,6 +448,15 @@ int ubiblock_create(struct ubi_volume_in
  	add_disk(dev->gd);
  	dev_info(disk_to_dev(dev->gd), "created from ubi%d:%d(%s)",
  		 dev->ubi_num, dev->vol_id, vi->name);
@@ -32,6 +32,6 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 +		ROOT_DEV = MKDEV(gd->major, gd->first_minor);
 +	}
 +
+ 	mutex_unlock(&devices_mutex);
  	return 0;
  
- out_free_queue:
diff --git a/target/linux/generic/pending-4.4/610-netfilter_match_bypass_default_checks.patch b/target/linux/generic/pending-4.4/610-netfilter_match_bypass_default_checks.patch
index 8b96639c7f..dce8020c92 100644
--- a/target/linux/generic/pending-4.4/610-netfilter_match_bypass_default_checks.patch
+++ b/target/linux/generic/pending-4.4/610-netfilter_match_bypass_default_checks.patch
@@ -50,16 +50,16 @@
  static bool
  ip_checkentry(const struct ipt_ip *ip)
  {
-@@ -664,6 +690,8 @@ find_check_entry(struct ipt_entry *e, st
- 	struct xt_mtchk_param mtpar;
+@@ -655,6 +681,8 @@ find_check_entry(struct ipt_entry *e, st
  	struct xt_entry_match *ematch;
+ 	unsigned long pcnt;
  
 +	ip_checkdefault(&e->ip);
 +
- 	e->counters.pcnt = xt_percpu_counter_alloc();
- 	if (IS_ERR_VALUE(e->counters.pcnt))
+ 	pcnt = xt_percpu_counter_alloc();
+ 	if (IS_ERR_VALUE(pcnt))
  		return -ENOMEM;
-@@ -948,6 +976,7 @@ copy_entries_to_user(unsigned int total_
+@@ -953,6 +981,7 @@ copy_entries_to_user(unsigned int total_
  	const struct xt_table_info *private = table->private;
  	int ret = 0;
  	const void *loc_cpu_entry;
@@ -67,7 +67,7 @@
  
  	counters = alloc_counters(table);
  	if (IS_ERR(counters))
-@@ -975,6 +1004,14 @@ copy_entries_to_user(unsigned int total_
+@@ -980,6 +1009,14 @@ copy_entries_to_user(unsigned int total_
  			goto free_counters;
  		}
  
@@ -82,7 +82,7 @@
  		for (i = sizeof(struct ipt_entry);
  		     i < e->target_offset;
  		     i += m->u.match_size) {
-@@ -1380,12 +1417,15 @@ compat_copy_entry_to_user(struct ipt_ent
+@@ -1385,12 +1422,15 @@ compat_copy_entry_to_user(struct ipt_ent
  	compat_uint_t origsize;
  	const struct xt_entry_match *ematch;
  	int ret = 0;
diff --git a/target/linux/generic/pending-4.4/650-pppoe_header_pad.patch b/target/linux/generic/pending-4.4/650-pppoe_header_pad.patch
deleted file mode 100644
index 409de58c28..0000000000
--- a/target/linux/generic/pending-4.4/650-pppoe_header_pad.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- a/drivers/net/ppp/pppoe.c
-+++ b/drivers/net/ppp/pppoe.c
-@@ -879,7 +879,7 @@ static int pppoe_sendmsg(struct socket *
- 		goto end;
- 
- 
--	skb = sock_wmalloc(sk, total_len + dev->hard_header_len + 32,
-+	skb = sock_wmalloc(sk, total_len + dev->hard_header_len + 32 + NET_SKB_PAD,
- 			   0, GFP_KERNEL);
- 	if (!skb) {
- 		error = -ENOMEM;
-@@ -887,7 +887,7 @@ static int pppoe_sendmsg(struct socket *
- 	}
- 
- 	/* Reserve space for headers. */
--	skb_reserve(skb, dev->hard_header_len);
-+	skb_reserve(skb, dev->hard_header_len + NET_SKB_PAD);
- 	skb_reset_network_header(skb);
- 
- 	skb->dev = dev;
diff --git a/target/linux/generic/pending-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch b/target/linux/generic/pending-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
index 303d831214..fe599798ce 100644
--- a/target/linux/generic/pending-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
+++ b/target/linux/generic/pending-4.4/666-Add-support-for-MAP-E-FMRs-mesh-mode.patch
@@ -16,7 +16,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
 
 --- a/include/net/ip6_tunnel.h
 +++ b/include/net/ip6_tunnel.h
-@@ -15,6 +15,18 @@
+@@ -17,6 +17,18 @@
  /* determine capability on a per-packet basis */
  #define IP6_TNL_F_CAP_PER_PACKET 0x40000
  
@@ -35,7 +35,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  struct __ip6_tnl_parm {
  	char name[IFNAMSIZ];	/* name of tunnel device */
  	int link;		/* ifindex of underlying L2 interface */
-@@ -25,6 +37,7 @@ struct __ip6_tnl_parm {
+@@ -27,6 +39,7 @@ struct __ip6_tnl_parm {
  	__u32 flags;		/* tunnel flags */
  	struct in6_addr laddr;	/* local tunnel end-point address */
  	struct in6_addr raddr;	/* remote tunnel end-point address */
@@ -94,7 +94,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  }
  
  static int ip6_tnl_dev_init(struct net_device *dev);
-@@ -230,20 +230,29 @@ EXPORT_SYMBOL_GPL(ip6_tnl_dst_init);
+@@ -139,20 +139,29 @@ static struct net_device_stats *ip6_get_
  static struct ip6_tnl *
  ip6_tnl_lookup(struct net *net, const struct in6_addr *remote, const struct in6_addr *local)
  {
@@ -129,7 +129,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
  		if (ipv6_addr_equal(local, &t->parms.laddr) &&
  		    ipv6_addr_any(&t->parms.raddr) &&
-@@ -251,7 +260,7 @@ ip6_tnl_lookup(struct net *net, const st
+@@ -160,7 +169,7 @@ ip6_tnl_lookup(struct net *net, const st
  			return t;
  	}
  
@@ -138,7 +138,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[hash]) {
  		if (ipv6_addr_equal(remote, &t->parms.raddr) &&
  		    ipv6_addr_any(&t->parms.laddr) &&
-@@ -287,7 +296,7 @@ ip6_tnl_bucket(struct ip6_tnl_net *ip6n,
+@@ -196,7 +205,7 @@ ip6_tnl_bucket(struct ip6_tnl_net *ip6n,
  
  	if (!ipv6_addr_any(remote) || !ipv6_addr_any(local)) {
  		prio = 1;
@@ -147,7 +147,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	}
  	return &ip6n->tnls[prio][h];
  }
-@@ -460,6 +469,12 @@ ip6_tnl_dev_uninit(struct net_device *de
+@@ -369,6 +378,12 @@ ip6_tnl_dev_uninit(struct net_device *de
  	struct net *net = t->net;
  	struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
  
@@ -160,7 +160,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	if (dev == ip6n->fb_tnl_dev)
  		RCU_INIT_POINTER(ip6n->tnls_wc[0], NULL);
  	else
-@@ -856,6 +871,108 @@ int ip6_tnl_rcv_ctl(struct ip6_tnl *t,
+@@ -765,6 +780,108 @@ int ip6_tnl_rcv_ctl(struct ip6_tnl *t,
  }
  EXPORT_SYMBOL_GPL(ip6_tnl_rcv_ctl);
  
@@ -269,7 +269,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  /**
   * ip6_tnl_rcv - decapsulate IPv6 packet and retransmit it locally
   *   @skb: received socket buffer
-@@ -901,6 +1018,26 @@ static int ip6_tnl_rcv(struct sk_buff *s
+@@ -810,6 +927,26 @@ static int ip6_tnl_rcv(struct sk_buff *s
  		skb_reset_network_header(skb);
  		skb->protocol = htons(protocol);
  		memset(skb->cb, 0, sizeof(struct inet6_skb_parm));
@@ -296,7 +296,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  
  		__skb_tunnel_rx(skb, t->dev, t->net);
  
-@@ -1248,6 +1385,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
+@@ -1145,6 +1282,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
  	__u32 mtu;
  	u8 tproto;
  	int err;
@@ -304,7 +304,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  
  	tproto = ACCESS_ONCE(t->parms.proto);
  	if ((tproto != IPPROTO_IPV6 && tproto != 0) ||
-@@ -1278,6 +1416,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
+@@ -1175,6 +1313,18 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str
  	if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
  		fl6.flowi6_mark = skb->mark;
  
@@ -323,7 +323,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
  	if (err != 0) {
  		if (err == -EMSGSIZE)
-@@ -1392,6 +1542,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
+@@ -1289,6 +1439,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
  	t->parms.flowinfo = p->flowinfo;
  	t->parms.link = p->link;
  	t->parms.proto = p->proto;
@@ -335,10 +335,10 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
 +	}
 +	t->parms.fmrs = p->fmrs;
 +
- 	ip6_tnl_dst_reset(t);
+ 	dst_cache_reset(&t->dst_cache);
  	ip6_tnl_link_config(t);
  	return 0;
-@@ -1430,6 +1588,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
+@@ -1327,6 +1485,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
  	p->flowinfo = u->flowinfo;
  	p->link = u->link;
  	p->proto = u->proto;
@@ -346,7 +346,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	memcpy(p->name, u->name, sizeof(u->name));
  }
  
-@@ -1725,6 +1884,15 @@ static int ip6_tnl_validate(struct nlatt
+@@ -1622,6 +1781,15 @@ static int ip6_tnl_validate(struct nlatt
  	return 0;
  }
  
@@ -362,7 +362,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  static void ip6_tnl_netlink_parms(struct nlattr *data[],
  				  struct __ip6_tnl_parm *parms)
  {
-@@ -1756,6 +1924,46 @@ static void ip6_tnl_netlink_parms(struct
+@@ -1653,6 +1821,46 @@ static void ip6_tnl_netlink_parms(struct
  
  	if (data[IFLA_IPTUN_PROTO])
  		parms->proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
@@ -409,7 +409,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  }
  
  static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
-@@ -1808,6 +2016,12 @@ static void ip6_tnl_dellink(struct net_d
+@@ -1705,6 +1913,12 @@ static void ip6_tnl_dellink(struct net_d
  
  static size_t ip6_tnl_get_size(const struct net_device *dev)
  {
@@ -422,7 +422,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	return
  		/* IFLA_IPTUN_LINK */
  		nla_total_size(4) +
-@@ -1825,6 +2039,24 @@ static size_t ip6_tnl_get_size(const str
+@@ -1722,6 +1936,24 @@ static size_t ip6_tnl_get_size(const str
  		nla_total_size(4) +
  		/* IFLA_IPTUN_PROTO */
  		nla_total_size(1) +
@@ -447,7 +447,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  		0;
  }
  
-@@ -1832,6 +2064,9 @@ static int ip6_tnl_fill_info(struct sk_b
+@@ -1729,6 +1961,9 @@ static int ip6_tnl_fill_info(struct sk_b
  {
  	struct ip6_tnl *tunnel = netdev_priv(dev);
  	struct __ip6_tnl_parm *parm = &tunnel->parms;
@@ -457,7 +457,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  
  	if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
  	    nla_put_in6_addr(skb, IFLA_IPTUN_LOCAL, &parm->laddr) ||
-@@ -1840,8 +2075,27 @@ static int ip6_tnl_fill_info(struct sk_b
+@@ -1737,8 +1972,27 @@ static int ip6_tnl_fill_info(struct sk_b
  	    nla_put_u8(skb, IFLA_IPTUN_ENCAP_LIMIT, parm->encap_limit) ||
  	    nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
  	    nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) ||
@@ -486,7 +486,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
  	return 0;
  
  nla_put_failure:
-@@ -1865,6 +2119,7 @@ static const struct nla_policy ip6_tnl_p
+@@ -1762,6 +2016,7 @@ static const struct nla_policy ip6_tnl_p
  	[IFLA_IPTUN_FLOWINFO]		= { .type = NLA_U32 },
  	[IFLA_IPTUN_FLAGS]		= { .type = NLA_U32 },
  	[IFLA_IPTUN_PROTO]		= { .type = NLA_U8 },
diff --git a/target/linux/generic/pending-4.4/680-NET-skip-GRO-for-foreign-MAC-addresses.patch b/target/linux/generic/pending-4.4/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
index d91db1fe73..7c96f4f171 100644
--- a/target/linux/generic/pending-4.4/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
+++ b/target/linux/generic/pending-4.4/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
@@ -17,7 +17,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -4260,6 +4260,9 @@ static enum gro_result dev_gro_receive(s
+@@ -4271,6 +4271,9 @@ static enum gro_result dev_gro_receive(s
  	enum gro_result ret;
  	int grow;
  
@@ -27,7 +27,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!(skb->dev->features & NETIF_F_GRO))
  		goto normal;
  
-@@ -5426,6 +5429,48 @@ static void __netdev_adjacent_dev_unlink
+@@ -5437,6 +5440,48 @@ static void __netdev_adjacent_dev_unlink
  					   &upper_dev->adj_list.lower);
  }
  
@@ -76,7 +76,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static int __netdev_upper_dev_link(struct net_device *dev,
  				   struct net_device *upper_dev, bool master,
  				   void *private)
-@@ -5497,6 +5542,7 @@ static int __netdev_upper_dev_link(struc
+@@ -5508,6 +5553,7 @@ static int __netdev_upper_dev_link(struc
  			goto rollback_lower_mesh;
  	}
  
@@ -84,7 +84,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	call_netdevice_notifiers_info(NETDEV_CHANGEUPPER, dev,
  				      &changeupper_info.info);
  	return 0;
-@@ -5623,6 +5669,7 @@ void netdev_upper_dev_unlink(struct net_
+@@ -5634,6 +5680,7 @@ void netdev_upper_dev_unlink(struct net_
  	list_for_each_entry(i, &upper_dev->all_adj_list.upper, list)
  		__netdev_adjacent_dev_unlink(dev, i->dev, i->ref_nr);
  
@@ -92,7 +92,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	call_netdevice_notifiers_info(NETDEV_CHANGEUPPER, dev,
  				      &changeupper_info.info);
  }
-@@ -6163,6 +6210,7 @@ int dev_set_mac_address(struct net_devic
+@@ -6174,6 +6221,7 @@ int dev_set_mac_address(struct net_devic
  	if (err)
  		return err;
  	dev->addr_assign_type = NET_ADDR_SET;
diff --git a/target/linux/generic/pending-4.4/834-ledtrig-libata.patch b/target/linux/generic/pending-4.4/834-ledtrig-libata.patch
index c3d187a098..ad63634479 100644
--- a/target/linux/generic/pending-4.4/834-ledtrig-libata.patch
+++ b/target/linux/generic/pending-4.4/834-ledtrig-libata.patch
@@ -69,7 +69,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  /**
   *	ata_build_rw_tf - Build ATA taskfile for given read/write request
   *	@tf: Target ATA taskfile
-@@ -4780,6 +4793,9 @@ struct ata_queued_cmd *ata_qc_new_init(s
+@@ -4781,6 +4794,9 @@ struct ata_queued_cmd *ata_qc_new_init(s
  		if (tag < 0)
  			return NULL;
  	}
@@ -79,7 +79,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  	qc = __ata_qc_from_tag(ap, tag);
  	qc->tag = tag;
-@@ -5677,6 +5693,9 @@ struct ata_port *ata_port_alloc(struct a
+@@ -5678,6 +5694,9 @@ struct ata_port *ata_port_alloc(struct a
  	ap->stats.unhandled_irq = 1;
  	ap->stats.idle_irq = 1;
  #endif
@@ -89,7 +89,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	ata_sff_port_init(ap);
  
  	return ap;
-@@ -5698,6 +5717,12 @@ static void ata_host_release(struct devi
+@@ -5699,6 +5718,12 @@ static void ata_host_release(struct devi
  
  		kfree(ap->pmp_link);
  		kfree(ap->slave_link);
@@ -102,7 +102,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		kfree(ap);
  		host->ports[i] = NULL;
  	}
-@@ -6144,7 +6169,23 @@ int ata_host_register(struct ata_host *h
+@@ -6145,7 +6170,23 @@ int ata_host_register(struct ata_host *h
  		host->ports[i]->print_id = atomic_inc_return(&ata_print_id);
  		host->ports[i]->local_port_no = i + 1;
  	}
diff --git a/target/linux/generic/pending-4.4/901-debloat_sock_diag.patch b/target/linux/generic/pending-4.4/901-debloat_sock_diag.patch
index fa9f37b716..4733d1b79c 100644
--- a/target/linux/generic/pending-4.4/901-debloat_sock_diag.patch
+++ b/target/linux/generic/pending-4.4/901-debloat_sock_diag.patch
@@ -39,7 +39,7 @@
  
 --- a/net/ipv4/Kconfig
 +++ b/net/ipv4/Kconfig
-@@ -414,6 +414,7 @@ config INET_LRO
+@@ -415,6 +415,7 @@ config INET_LRO
  
  config INET_DIAG
  	tristate "INET: socket monitoring interface"
diff --git a/target/linux/generic/pending-4.4/902-debloat_proc.patch b/target/linux/generic/pending-4.4/902-debloat_proc.patch
index 4f874e5986..931f43fce4 100644
--- a/target/linux/generic/pending-4.4/902-debloat_proc.patch
+++ b/target/linux/generic/pending-4.4/902-debloat_proc.patch
@@ -251,7 +251,7 @@
  
 --- a/ipc/msg.c
 +++ b/ipc/msg.c
-@@ -1068,6 +1068,9 @@ void __init msg_init(void)
+@@ -1071,6 +1071,9 @@ void __init msg_init(void)
  {
  	msg_init_ns(&init_ipc_ns);
  
diff --git a/target/linux/generic/pending-4.4/995-mangle_bootargs.patch b/target/linux/generic/pending-4.4/995-mangle_bootargs.patch
index e008dd9098..821370350e 100644
--- a/target/linux/generic/pending-4.4/995-mangle_bootargs.patch
+++ b/target/linux/generic/pending-4.4/995-mangle_bootargs.patch
@@ -40,7 +40,7 @@
  	setup_per_cpu_areas();
 --- a/init/Kconfig
 +++ b/init/Kconfig
-@@ -1648,6 +1648,15 @@ config EMBEDDED
+@@ -1655,6 +1655,15 @@ config EMBEDDED
  	  an embedded system so certain expert options are available
  	  for configuration.
  
diff --git a/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch b/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
index 9f4b044473..204d6e0bc7 100644
--- a/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
+++ b/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
@@ -2335,16 +2335,16 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  						oob, ops, toread);
  					oobreadlen -= toread;
  				}
-@@ -2024,7 +2078,7 @@ static int nand_do_read_oob(struct mtd_i
- 			    struct mtd_oob_ops *ops)
+@@ -2025,7 +2079,7 @@ static int nand_do_read_oob(struct mtd_i
  {
+ 	unsigned int max_bitflips = 0;
  	int page, realpage, chipnr;
 -	struct nand_chip *chip = mtd->priv;
 +	struct nand_chip *chip = mtd_to_nand(mtd);
  	struct mtd_ecc_stats stats;
  	int readlen = ops->ooblen;
  	int len;
-@@ -2036,10 +2090,7 @@ static int nand_do_read_oob(struct mtd_i
+@@ -2037,10 +2091,7 @@ static int nand_do_read_oob(struct mtd_i
  
  	stats = mtd->ecc_stats;
  
@@ -2356,7 +2356,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	if (unlikely(ops->ooboffs >= len)) {
  		pr_debug("%s: attempt to start read outside oob\n",
-@@ -2073,7 +2124,7 @@ static int nand_do_read_oob(struct mtd_i
+@@ -2074,7 +2125,7 @@ static int nand_do_read_oob(struct mtd_i
  			break;
  
  		len = min(len, readlen);
@@ -2365,7 +2365,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  		if (chip->options & NAND_NEED_READRDY) {
  			/* Apply delay or wait for ready/busy pin */
-@@ -2232,19 +2283,20 @@ static int nand_write_page_swecc(struct
+@@ -2235,19 +2286,20 @@ static int nand_write_page_swecc(struct
  				 const uint8_t *buf, int oob_required,
  				 int page)
  {
@@ -2390,7 +2390,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	return chip->ecc.write_page_raw(mtd, chip, buf, 1, page);
  }
-@@ -2261,12 +2313,11 @@ static int nand_write_page_hwecc(struct
+@@ -2264,12 +2316,11 @@ static int nand_write_page_hwecc(struct
  				  const uint8_t *buf, int oob_required,
  				  int page)
  {
@@ -2404,7 +2404,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	for (i = 0; eccsteps; eccsteps--, i += eccbytes, p += eccsize) {
  		chip->ecc.hwctl(mtd, NAND_ECC_WRITE);
-@@ -2274,8 +2325,10 @@ static int nand_write_page_hwecc(struct
+@@ -2277,8 +2328,10 @@ static int nand_write_page_hwecc(struct
  		chip->ecc.calculate(mtd, p, &ecc_calc[i]);
  	}
  
@@ -2417,7 +2417,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	chip->write_buf(mtd, chip->oob_poi, mtd->oobsize);
  
-@@ -2303,11 +2356,10 @@ static int nand_write_subpage_hwecc(stru
+@@ -2306,11 +2359,10 @@ static int nand_write_subpage_hwecc(stru
  	int ecc_size      = chip->ecc.size;
  	int ecc_bytes     = chip->ecc.bytes;
  	int ecc_steps     = chip->ecc.steps;
@@ -2430,7 +2430,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	for (step = 0; step < ecc_steps; step++) {
  		/* configure controller for WRITE access */
-@@ -2335,8 +2387,10 @@ static int nand_write_subpage_hwecc(stru
+@@ -2338,8 +2390,10 @@ static int nand_write_subpage_hwecc(stru
  	/* copy calculated ECC for whole page to chip->buffer->oob */
  	/* this include masked-value(0xFF) for unwritten subpages */
  	ecc_calc = chip->buffers->ecccalc;
@@ -2443,7 +2443,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/* write OOB buffer to NAND device */
  	chip->write_buf(mtd, chip->oob_poi, mtd->oobsize);
-@@ -2472,7 +2526,8 @@ static int nand_write_page(struct mtd_in
+@@ -2475,7 +2529,8 @@ static int nand_write_page(struct mtd_in
  static uint8_t *nand_fill_oob(struct mtd_info *mtd, uint8_t *oob, size_t len,
  			      struct mtd_oob_ops *ops)
  {
@@ -2453,7 +2453,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/*
  	 * Initialise to all 0xFF, to avoid the possibility of left over OOB
-@@ -2487,31 +2542,12 @@ static uint8_t *nand_fill_oob(struct mtd
+@@ -2490,31 +2545,12 @@ static uint8_t *nand_fill_oob(struct mtd
  		memcpy(chip->oob_poi + ops->ooboffs, oob, len);
  		return oob + len;
  
@@ -2491,7 +2491,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	default:
  		BUG();
  	}
-@@ -2532,12 +2568,11 @@ static int nand_do_write_ops(struct mtd_
+@@ -2535,12 +2571,11 @@ static int nand_do_write_ops(struct mtd_
  			     struct mtd_oob_ops *ops)
  {
  	int chipnr, realpage, page, blockmask, column;
@@ -2506,7 +2506,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	uint8_t *oob = ops->oobbuf;
  	uint8_t *buf = ops->datbuf;
-@@ -2662,7 +2697,7 @@ err_out:
+@@ -2665,7 +2700,7 @@ err_out:
  static int panic_nand_write(struct mtd_info *mtd, loff_t to, size_t len,
  			    size_t *retlen, const uint8_t *buf)
  {
@@ -2515,7 +2515,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	int chipnr = (int)(to >> chip->chip_shift);
  	struct mtd_oob_ops ops;
  	int ret;
-@@ -2725,15 +2760,12 @@ static int nand_do_write_oob(struct mtd_
+@@ -2728,15 +2763,12 @@ static int nand_do_write_oob(struct mtd_
  			     struct mtd_oob_ops *ops)
  {
  	int chipnr, page, status, len;
@@ -2533,7 +2533,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/* Do not allow write past end of page */
  	if ((ops->ooboffs + ops->ooblen) > len) {
-@@ -2850,7 +2882,7 @@ out:
+@@ -2853,7 +2885,7 @@ out:
   */
  static int single_erase(struct mtd_info *mtd, int page)
  {
@@ -2542,7 +2542,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	/* Send commands to erase a block */
  	chip->cmdfunc(mtd, NAND_CMD_ERASE1, -1, page);
  	chip->cmdfunc(mtd, NAND_CMD_ERASE2, -1, -1);
-@@ -2882,7 +2914,7 @@ int nand_erase_nand(struct mtd_info *mtd
+@@ -2885,7 +2917,7 @@ int nand_erase_nand(struct mtd_info *mtd
  		    int allowbbt)
  {
  	int page, status, pages_per_block, ret, chipnr;
@@ -2551,7 +2551,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	loff_t len;
  
  	pr_debug("%s: start = 0x%012llx, len = %llu\n",
-@@ -2921,7 +2953,7 @@ int nand_erase_nand(struct mtd_info *mtd
+@@ -2924,7 +2956,7 @@ int nand_erase_nand(struct mtd_info *mtd
  	while (len) {
  		/* Check if we have a bad block, we do not erase bad blocks! */
  		if (nand_block_checkbad(mtd, ((loff_t) page) <<
@@ -2560,7 +2560,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			pr_warn("%s: attempt to erase a bad block at page 0x%08x\n",
  				    __func__, page);
  			instr->state = MTD_ERASE_FAILED;
-@@ -3008,7 +3040,20 @@ static void nand_sync(struct mtd_info *m
+@@ -3011,7 +3043,20 @@ static void nand_sync(struct mtd_info *m
   */
  static int nand_block_isbad(struct mtd_info *mtd, loff_t offs)
  {
@@ -2582,7 +2582,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  }
  
  /**
-@@ -3097,7 +3142,7 @@ static int nand_suspend(struct mtd_info
+@@ -3100,7 +3145,7 @@ static int nand_suspend(struct mtd_info
   */
  static void nand_resume(struct mtd_info *mtd)
  {
@@ -2591,7 +2591,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	if (chip->state == FL_PM_SUSPENDED)
  		nand_release_device(mtd);
-@@ -3269,7 +3314,7 @@ ext_out:
+@@ -3272,7 +3317,7 @@ ext_out:
  
  static int nand_setup_read_retry_micron(struct mtd_info *mtd, int retry_mode)
  {
@@ -2600,7 +2600,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	uint8_t feature[ONFI_SUBFEATURE_PARAM_LEN] = {retry_mode};
  
  	return chip->onfi_set_features(mtd, chip, ONFI_FEATURE_ADDR_READ_RETRY,
-@@ -3940,10 +3985,13 @@ ident_done:
+@@ -3943,10 +3988,13 @@ ident_done:
  	return type;
  }
  
@@ -2617,7 +2617,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	if (of_get_nand_bus_width(dn) == 16)
  		chip->options |= NAND_BUSWIDTH_16;
-@@ -3952,6 +4000,7 @@ static int nand_dt_init(struct mtd_info
+@@ -3955,6 +4003,7 @@ static int nand_dt_init(struct mtd_info
  		chip->bbt_options |= NAND_BBT_USE_FLASH;
  
  	ecc_mode = of_get_nand_ecc_mode(dn);
@@ -2625,7 +2625,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	ecc_strength = of_get_nand_ecc_strength(dn);
  	ecc_step = of_get_nand_ecc_step_size(dn);
  
-@@ -3964,6 +4013,9 @@ static int nand_dt_init(struct mtd_info
+@@ -3967,6 +4016,9 @@ static int nand_dt_init(struct mtd_info
  	if (ecc_mode >= 0)
  		chip->ecc.mode = ecc_mode;
  
@@ -2635,7 +2635,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	if (ecc_strength >= 0)
  		chip->ecc.strength = ecc_strength;
  
-@@ -3987,15 +4039,16 @@ int nand_scan_ident(struct mtd_info *mtd
+@@ -3990,15 +4042,16 @@ int nand_scan_ident(struct mtd_info *mtd
  		    struct nand_flash_dev *table)
  {
  	int i, nand_maf_id, nand_dev_id;
@@ -2658,7 +2658,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	if (!mtd->name && mtd->dev.parent)
  		mtd->name = dev_name(mtd->dev.parent);
-@@ -4058,7 +4111,7 @@ EXPORT_SYMBOL(nand_scan_ident);
+@@ -4061,7 +4114,7 @@ EXPORT_SYMBOL(nand_scan_ident);
   */
  static bool nand_ecc_strength_good(struct mtd_info *mtd)
  {
@@ -2667,7 +2667,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	struct nand_ecc_ctrl *ecc = &chip->ecc;
  	int corr, ds_corr;
  
-@@ -4086,10 +4139,10 @@ static bool nand_ecc_strength_good(struc
+@@ -4089,10 +4142,10 @@ static bool nand_ecc_strength_good(struc
   */
  int nand_scan_tail(struct mtd_info *mtd)
  {
@@ -2680,7 +2680,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/* New bad blocks should be marked in OOB, flash-based BBT, or both */
  	BUG_ON((chip->bbt_options & NAND_BBT_NO_OOB_BBM) &&
-@@ -4116,19 +4169,15 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4119,19 +4172,15 @@ int nand_scan_tail(struct mtd_info *mtd)
  	/*
  	 * If no default placement scheme is given, select an appropriate one.
  	 */
@@ -2703,7 +2703,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			break;
  		default:
  			pr_warn("No oob scheme defined for oobsize %d\n",
-@@ -4171,7 +4220,7 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4174,7 +4223,7 @@ int nand_scan_tail(struct mtd_info *mtd)
  			ecc->write_oob = nand_write_oob_std;
  		if (!ecc->read_subpage)
  			ecc->read_subpage = nand_read_subpage;
@@ -2712,7 +2712,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			ecc->write_subpage = nand_write_subpage_hwecc;
  
  	case NAND_ECC_HW_SYNDROME:
-@@ -4249,10 +4298,8 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4252,10 +4301,8 @@ int nand_scan_tail(struct mtd_info *mtd)
  		}
  
  		/* See nand_bch_init() for details. */
@@ -2725,7 +2725,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  		if (!ecc->priv) {
  			pr_warn("BCH ECC initialization failed!\n");
  			BUG();
-@@ -4283,20 +4330,9 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4286,20 +4333,9 @@ int nand_scan_tail(struct mtd_info *mtd)
  	if (!ecc->write_oob_raw)
  		ecc->write_oob_raw = ecc->write_oob;
  
@@ -2749,7 +2749,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/*
  	 * Set the number of read / write steps for one page depending on ECC
-@@ -4309,6 +4345,21 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4312,6 +4348,21 @@ int nand_scan_tail(struct mtd_info *mtd)
  	}
  	ecc->total = ecc->steps * ecc->bytes;
  
@@ -2771,7 +2771,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	/* Allow subpage writes up to ecc.steps. Not possible for MLC flash */
  	if (!(chip->options & NAND_NO_SUBPAGE_WRITE) && nand_is_slc(chip)) {
  		switch (ecc->steps) {
-@@ -4365,10 +4416,6 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4368,10 +4419,6 @@ int nand_scan_tail(struct mtd_info *mtd)
  	mtd->_block_markbad = nand_block_markbad;
  	mtd->writebufsize = mtd->writesize;
  
@@ -2782,7 +2782,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	/*
  	 * Initialize bitflip_threshold to its default prior scan_bbt() call.
  	 * scan_bbt() might invoke mtd_read(), thus bitflip_threshold must be
-@@ -4424,7 +4471,7 @@ EXPORT_SYMBOL(nand_scan);
+@@ -4427,7 +4474,7 @@ EXPORT_SYMBOL(nand_scan);
   */
  void nand_release(struct mtd_info *mtd)
  {
@@ -4993,7 +4993,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  /*
   * NAND Flash Manufacturer ID Codes
   */
-@@ -850,7 +911,6 @@ extern int nand_do_read(struct mtd_info
+@@ -851,7 +912,6 @@ extern int nand_do_read(struct mtd_info
   * @chip_delay:		R/B delay value in us
   * @options:		Option flags, e.g. 16bit buswidth
   * @bbt_options:	BBT option flags, e.g. NAND_BBT_USE_FLASH
@@ -5001,7 +5001,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
   * @part_probe_types:	NULL-terminated array of probe types
   */
  struct platform_nand_chip {
-@@ -858,7 +918,6 @@ struct platform_nand_chip {
+@@ -859,7 +919,6 @@ struct platform_nand_chip {
  	int chip_offset;
  	int nr_partitions;
  	struct mtd_partition *partitions;
@@ -5009,7 +5009,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	int chip_delay;
  	unsigned int options;
  	unsigned int bbt_options;
-@@ -908,15 +967,6 @@ struct platform_nand_data {
+@@ -909,15 +968,6 @@ struct platform_nand_data {
  	struct platform_nand_ctrl ctrl;
  };
  
@@ -5142,7 +5142,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  		      long long offset, long long length);
 --- a/include/linux/mtd/sh_flctl.h
 +++ b/include/linux/mtd/sh_flctl.h
-@@ -143,11 +143,11 @@ enum flctl_ecc_res_t {
+@@ -143,7 +143,6 @@ enum flctl_ecc_res_t {
  struct dma_chan;
  
  struct sh_flctl {
@@ -5150,12 +5150,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	struct nand_chip	chip;
  	struct platform_device	*pdev;
  	struct dev_pm_qos_request pm_qos;
- 	void __iomem		*reg;
-+	resource_size_t		fifo;
- 
- 	uint8_t	done_buff[2048 + 64];	/* max size 2048 + 64 */
- 	int	read_bytes;
-@@ -186,7 +186,7 @@ struct sh_flctl_platform_data {
+@@ -187,7 +186,7 @@ struct sh_flctl_platform_data {
  
  static inline struct sh_flctl *mtd_to_flctl(struct mtd_info *mtdinfo)
  {
diff --git a/target/linux/oxnas/patches-4.4/0074-mtd-nand-import-nand_hw_control_init.patch b/target/linux/oxnas/patches-4.4/0074-mtd-nand-import-nand_hw_control_init.patch
index aefcfd98a7..8ff28b3bc2 100644
--- a/target/linux/oxnas/patches-4.4/0074-mtd-nand-import-nand_hw_control_init.patch
+++ b/target/linux/oxnas/patches-4.4/0074-mtd-nand-import-nand_hw_control_init.patch
@@ -39,7 +39,7 @@ Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
  	info->platform   = plat;
 --- a/drivers/mtd/nand/brcmnand/brcmnand.c
 +++ b/drivers/mtd/nand/brcmnand/brcmnand.c
-@@ -2156,8 +2156,7 @@ int brcmnand_probe(struct platform_devic
+@@ -2149,8 +2149,7 @@ int brcmnand_probe(struct platform_devic
  
  	init_completion(&ctrl->done);
  	init_completion(&ctrl->dma_done);
@@ -87,7 +87,7 @@ Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
  	}
 --- a/drivers/mtd/nand/nand_base.c
 +++ b/drivers/mtd/nand/nand_base.c
-@@ -3205,8 +3205,7 @@ static void nand_set_defaults(struct nan
+@@ -3208,8 +3208,7 @@ static void nand_set_defaults(struct nan
  
  	if (!chip->controller) {
  		chip->controller = &chip->hwcontrol;
@@ -135,7 +135,7 @@ Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
  
 --- a/drivers/mtd/nand/sunxi_nand.c
 +++ b/drivers/mtd/nand/sunxi_nand.c
-@@ -1426,8 +1426,7 @@ static int sunxi_nfc_probe(struct platfo
+@@ -1432,8 +1432,7 @@ static int sunxi_nfc_probe(struct platfo
  		return -ENOMEM;
  
  	nfc->dev = dev;
diff --git a/target/linux/oxnas/patches-4.4/800-oxnas-ehci.patch b/target/linux/oxnas/patches-4.4/800-oxnas-ehci.patch
index 5b25afc953..7f26de6b14 100644
--- a/target/linux/oxnas/patches-4.4/800-oxnas-ehci.patch
+++ b/target/linux/oxnas/patches-4.4/800-oxnas-ehci.patch
@@ -1,6 +1,6 @@
 --- a/drivers/usb/host/Kconfig
 +++ b/drivers/usb/host/Kconfig
-@@ -313,6 +313,13 @@ config USB_OCTEON_EHCI
+@@ -315,6 +315,13 @@ config USB_OCTEON_EHCI
  	  USB 2.0 device support.  All CN6XXX based chips with USB are
  	  supported.
  
diff --git a/target/linux/oxnas/patches-4.4/999-libata-hacks.patch b/target/linux/oxnas/patches-4.4/999-libata-hacks.patch
index 1f4799dd88..ac278ab234 100644
--- a/target/linux/oxnas/patches-4.4/999-libata-hacks.patch
+++ b/target/linux/oxnas/patches-4.4/999-libata-hacks.patch
@@ -15,7 +15,7 @@
  	/* initialize internal qc */
  
  	/* XXX: Tag 0 is used for drivers with legacy EH as some
-@@ -4787,6 +4795,9 @@ struct ata_queued_cmd *ata_qc_new_init(s
+@@ -4788,6 +4796,9 @@ struct ata_queued_cmd *ata_qc_new_init(s
  	if (unlikely(ap->pflags & ATA_PFLAG_FROZEN))
  		return NULL;
  
@@ -25,7 +25,7 @@
  	/* libsas case */
  	if (ap->flags & ATA_FLAG_SAS_HOST) {
  		tag = ata_sas_allocate_tag(ap);
-@@ -4832,6 +4843,8 @@ void ata_qc_free(struct ata_queued_cmd *
+@@ -4833,6 +4844,8 @@ void ata_qc_free(struct ata_queued_cmd *
  		qc->tag = ATA_TAG_POISON;
  		if (ap->flags & ATA_FLAG_SAS_HOST)
  			ata_sas_free_tag(tag, ap);