kernel: update 17.01 kernel to 4.4.116

This bumps the 4.4. kernel in LEDE 17.01 to 4.4.116.
More Meltdown & Spectre mitigation.

* Refresh patches.
* Refresh x86/config for RETPOLINE.
* Deleted 8049-PCI-layerscape-Add-fsl-ls2085a-pcie-compatible-ID.patch (accepted upstream)
* Deleted 8050-PCI-layerscape-Fix-MSG-TLP-drop-setting.patch (accepted upstream)
* 650-pppoe_header_pad.patch does not apply anymore (code was replaced).

Bumps from 4.4.113 to 4.4.115 were handled by Kevin Darbyshire-Bryant.

Compile-tested on: ar71xx, ramips/mt7621, x86/64
Run-tested on: ar71xx, ramips/mt7621, x86/64

Signed-off-by: Stijn Segers <foss@volatilesystems.org>

29 files changed, 124 insertions, 239 deletions

diff --git a/target/linux/apm821xx/patches-4.4/040-backport_leds-convert-IDE-trigger-to-common-disk-trigger.patch b/target/linux/apm821xx/patches-4.4/040-backport_leds-convert-IDE-trigger-to-common-disk-trigger.patch
index 48714aa466..7cce9bc77f 100644
--- a/target/linux/apm821xx/patches-4.4/040-backport_leds-convert-IDE-trigger-to-common-disk-trigger.patch
+++ b/target/linux/apm821xx/patches-4.4/040-backport_leds-convert-IDE-trigger-to-common-disk-trigger.patch
@@ -47,7 +47,7 @@ Signed-off-by: Jacek Anaszewski <j.anaszewski@samsung.com>
  #include <linux/pm_runtime.h>
  #include <linux/platform_device.h>
  
-@@ -4914,6 +4915,9 @@ void ata_qc_complete(struct ata_queued_c
+@@ -4915,6 +4916,9 @@ void ata_qc_complete(struct ata_queued_c
  {
  	struct ata_port *ap = qc->ap;
  
diff --git a/target/linux/ar71xx/patches-4.4/004-register_gpio_driver_earlier.patch b/target/linux/ar71xx/patches-4.4/004-register_gpio_driver_earlier.patch
index 0c07cb18c7..639e82c245 100644
--- a/target/linux/ar71xx/patches-4.4/004-register_gpio_driver_earlier.patch
+++ b/target/linux/ar71xx/patches-4.4/004-register_gpio_driver_earlier.patch
@@ -3,7 +3,7 @@ from mach files succeed.
 
 --- a/drivers/gpio/gpio-ath79.c
 +++ b/drivers/gpio/gpio-ath79.c
-@@ -202,4 +202,8 @@ static struct platform_driver ath79_gpio
+@@ -202,7 +202,11 @@ static struct platform_driver ath79_gpio
  	.probe = ath79_gpio_probe,
  };
  
@@ -13,3 +13,6 @@ from mach files succeed.
 +	return platform_driver_register(&ath79_gpio_driver);
 +}
 +postcore_initcall(ath79_gpio_init);
+ 
+ MODULE_DESCRIPTION("Atheros AR71XX/AR724X/AR913X GPIO API support");
+ MODULE_LICENSE("GPL v2");
diff --git a/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch b/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch
index a8d8c15c3b..9a440b4505 100644
--- a/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch
+++ b/target/linux/ar71xx/patches-4.4/910-unaligned_access_hacks.patch
@@ -491,7 +491,7 @@
  		memcpy(p, foc->val, foc->len);
 --- a/net/ipv4/igmp.c
 +++ b/net/ipv4/igmp.c
-@@ -529,7 +529,7 @@ static struct sk_buff *add_grec(struct s
+@@ -533,7 +533,7 @@ static struct sk_buff *add_grec(struct s
  		if (!skb)
  			return NULL;
  		psrc = (__be32 *)skb_put(skb, sizeof(__be32));
@@ -664,7 +664,7 @@
  
  #define	IP6_MF		0x0001
  #define	IP6_OFFSET	0xFFF8
-@@ -417,8 +417,8 @@ static inline void __ipv6_addr_set_half(
+@@ -418,8 +418,8 @@ static inline void __ipv6_addr_set_half(
  	}
  #endif
  #endif
@@ -675,7 +675,7 @@
  }
  
  static inline void ipv6_addr_set(struct in6_addr *addr, 
-@@ -477,6 +477,8 @@ static inline bool ipv6_prefix_equal(con
+@@ -478,6 +478,8 @@ static inline bool ipv6_prefix_equal(con
  	const __be32 *a1 = addr1->s6_addr32;
  	const __be32 *a2 = addr2->s6_addr32;
  	unsigned int pdw, pbi;
@@ -684,7 +684,7 @@
  
  	/* check complete u32 in prefix */
  	pdw = prefixlen >> 5;
-@@ -485,7 +487,9 @@ static inline bool ipv6_prefix_equal(con
+@@ -486,7 +488,9 @@ static inline bool ipv6_prefix_equal(con
  
  	/* check incomplete u32 in prefix */
  	pbi = prefixlen & 0x1f;
@@ -695,7 +695,7 @@
  		return false;
  
  	return true;
-@@ -629,13 +633,13 @@ static inline void ipv6_addr_set_v4mappe
+@@ -630,13 +634,13 @@ static inline void ipv6_addr_set_v4mappe
   */
  static inline int __ipv6_addr_diff32(const void *token1, const void *token2, int addrlen)
  {
@@ -711,7 +711,7 @@
  		if (xb)
  			return i * 32 + 31 - __fls(ntohl(xb));
  	}
-@@ -804,17 +808,18 @@ static inline int ip6_default_np_autolab
+@@ -805,17 +809,18 @@ static inline int ip6_default_np_autolab
  static inline void ip6_flow_hdr(struct ipv6hdr *hdr, unsigned int tclass,
  				__be32 flowlabel)
  {
diff --git a/target/linux/bcm53xx/patches-4.4/140-mtd-brcmnand-set-initial-ECC-params-based-on-info-fr.patch b/target/linux/bcm53xx/patches-4.4/140-mtd-brcmnand-set-initial-ECC-params-based-on-info-fr.patch
index ea59938aa1..4eba839d91 100644
--- a/target/linux/bcm53xx/patches-4.4/140-mtd-brcmnand-set-initial-ECC-params-based-on-info-fr.patch
+++ b/target/linux/bcm53xx/patches-4.4/140-mtd-brcmnand-set-initial-ECC-params-based-on-info-fr.patch
@@ -41,7 +41,7 @@ This should be very helpful for ppl adding new devices support.
  static void brcmnand_set_ecc_enabled(struct brcmnand_host *host, int en)
  {
  	struct brcmnand_controller *ctrl = host->ctrl;
-@@ -1997,6 +2008,9 @@ static int brcmnand_init_cs(struct brcmn
+@@ -1990,6 +2001,9 @@ static int brcmnand_init_cs(struct brcmn
  	nand_writereg(ctrl, cfg_offs,
  		      nand_readreg(ctrl, cfg_offs) & ~CFG_BUS_WIDTH);
  
diff --git a/target/linux/brcm2708/patches-4.4/0588-drm-vc4-Verify-at-boot-that-CMA-doesn-t-cross-a-256M.patch b/target/linux/brcm2708/patches-4.4/0588-drm-vc4-Verify-at-boot-that-CMA-doesn-t-cross-a-256M.patch
index cce4b111e7..3fef007b64 100644
--- a/target/linux/brcm2708/patches-4.4/0588-drm-vc4-Verify-at-boot-that-CMA-doesn-t-cross-a-256M.patch
+++ b/target/linux/brcm2708/patches-4.4/0588-drm-vc4-Verify-at-boot-that-CMA-doesn-t-cross-a-256M.patch
@@ -76,4 +76,4 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
 +EXPORT_SYMBOL(cma_get_size);
  
  static unsigned long cma_bitmap_aligned_mask(const struct cma *cma,
- 					     int align_order)
+ 					     unsigned int align_order)
diff --git a/target/linux/generic/patches-4.4/051-0005-ovl-proper-cleanup-of-workdir.patch b/target/linux/generic/patches-4.4/051-0005-ovl-proper-cleanup-of-workdir.patch
index eb095b7a2e..7225fc8cd9 100644
--- a/target/linux/generic/patches-4.4/051-0005-ovl-proper-cleanup-of-workdir.patch
+++ b/target/linux/generic/patches-4.4/051-0005-ovl-proper-cleanup-of-workdir.patch
@@ -53,7 +53,7 @@ Cc: <stable@vger.kernel.org>
  		err = ovl_check_whiteouts(realpath->dentry, rdd);
  
  	fput(realfile);
-@@ -569,3 +569,64 @@ void ovl_cleanup_whiteouts(struct dentry
+@@ -573,3 +573,64 @@ void ovl_cleanup_whiteouts(struct dentry
  	}
  	mutex_unlock(&upper->d_inode->i_mutex);
  }
diff --git a/target/linux/generic/patches-4.4/204-module_strip.patch b/target/linux/generic/patches-4.4/204-module_strip.patch
index d4c8039f75..106b0a5aed 100644
--- a/target/linux/generic/patches-4.4/204-module_strip.patch
+++ b/target/linux/generic/patches-4.4/204-module_strip.patch
@@ -89,7 +89,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/init/Kconfig
 +++ b/init/Kconfig
-@@ -2026,6 +2026,13 @@ config MODULE_COMPRESS_XZ
+@@ -2033,6 +2033,13 @@ config MODULE_COMPRESS_XZ
  
  endchoice
  
@@ -123,7 +123,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	set_license(mod, get_modinfo(info, "license"));
 --- a/scripts/mod/modpost.c
 +++ b/scripts/mod/modpost.c
-@@ -1963,7 +1963,9 @@ static void read_symbols(char *modname)
+@@ -1964,7 +1964,9 @@ static void read_symbols(char *modname)
  		symname = remove_dot(info.strtab + sym->st_name);
  
  		handle_modversions(mod, &info, sym, symname);
@@ -133,7 +133,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	}
  	if (!is_vmlinux(modname) ||
  	     (is_vmlinux(modname) && vmlinux_section_warnings))
-@@ -2107,7 +2109,9 @@ static void add_header(struct buffer *b,
+@@ -2108,7 +2110,9 @@ static void add_header(struct buffer *b,
  	buf_printf(b, "#include <linux/vermagic.h>\n");
  	buf_printf(b, "#include <linux/compiler.h>\n");
  	buf_printf(b, "\n");
@@ -143,7 +143,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	buf_printf(b, "\n");
  	buf_printf(b, "__visible struct module __this_module\n");
  	buf_printf(b, "__attribute__((section(\".gnu.linkonce.this_module\"))) = {\n");
-@@ -2124,16 +2128,20 @@ static void add_header(struct buffer *b,
+@@ -2125,16 +2129,20 @@ static void add_header(struct buffer *b,
  
  static void add_intree_flag(struct buffer *b, int is_intree)
  {
@@ -164,7 +164,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  /* In kernel, this size is defined in linux/module.h;
-@@ -2237,11 +2245,13 @@ static void add_depends(struct buffer *b
+@@ -2238,11 +2246,13 @@ static void add_depends(struct buffer *b
  
  static void add_srcversion(struct buffer *b, struct module *mod)
  {
@@ -178,7 +178,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  static void write_if_changed(struct buffer *b, const char *fname)
-@@ -2475,7 +2485,9 @@ int main(int argc, char **argv)
+@@ -2476,7 +2486,9 @@ int main(int argc, char **argv)
  		add_staging_flag(&buf, mod->name);
  		err |= add_versions(&buf, mod);
  		add_depends(&buf, mod, modules);
diff --git a/target/linux/generic/patches-4.4/221-module_exports.patch b/target/linux/generic/patches-4.4/221-module_exports.patch
index 510a86c468..44c0a6dec6 100644
--- a/target/linux/generic/patches-4.4/221-module_exports.patch
+++ b/target/linux/generic/patches-4.4/221-module_exports.patch
@@ -54,7 +54,7 @@
  	}
 --- a/scripts/Makefile.build
 +++ b/scripts/Makefile.build
-@@ -299,7 +299,7 @@ targets += $(extra-y) $(MAKECMDGOALS) $(
+@@ -372,7 +372,7 @@ targets += $(extra-y) $(MAKECMDGOALS) $(
  # Linker scripts preprocessor (.lds.S -> .lds)
  # ---------------------------------------------------------------------------
  quiet_cmd_cpp_lds_S = LDS     $@
diff --git a/target/linux/generic/patches-4.4/491-ubi-auto-create-ubiblock-device-for-rootfs.patch b/target/linux/generic/patches-4.4/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
index da3111266a..462f7f42cb 100644
--- a/target/linux/generic/patches-4.4/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
+++ b/target/linux/generic/patches-4.4/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
@@ -11,7 +11,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 
 --- a/drivers/mtd/ubi/block.c
 +++ b/drivers/mtd/ubi/block.c
-@@ -628,6 +628,44 @@ static void __init ubiblock_create_from_
+@@ -636,6 +636,44 @@ static void __init ubiblock_create_from_
  	}
  }
  
@@ -56,7 +56,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  static void ubiblock_remove_all(void)
  {
  	struct ubiblock *next;
-@@ -658,6 +696,10 @@ int __init ubiblock_init(void)
+@@ -668,6 +706,10 @@ int __init ubiblock_init(void)
  	 */
  	ubiblock_create_from_param();
  
diff --git a/target/linux/generic/patches-4.4/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch b/target/linux/generic/patches-4.4/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch
index f55e8e3a4d..9fbfc79927 100644
--- a/target/linux/generic/patches-4.4/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch
+++ b/target/linux/generic/patches-4.4/493-ubi-set-ROOT_DEV-to-ubiblock-rootfs-if-unset.patch
@@ -19,7 +19,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  #include "ubi-media.h"
  #include "ubi.h"
-@@ -448,6 +449,15 @@ int ubiblock_create(struct ubi_volume_in
+@@ -447,6 +448,15 @@ int ubiblock_create(struct ubi_volume_in
  	add_disk(dev->gd);
  	dev_info(disk_to_dev(dev->gd), "created from ubi%d:%d(%s)",
  		 dev->ubi_num, dev->vol_id, vi->name);
@@ -32,6 +32,6 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 +		ROOT_DEV = MKDEV(gd->major, gd->first_minor);
 +	}
 +
+ 	mutex_unlock(&devices_mutex);
  	return 0;
  
- out_free_queue:
diff --git a/target/linux/generic/patches-4.4/610-netfilter_match_bypass_default_checks.patch b/target/linux/generic/patches-4.4/610-netfilter_match_bypass_default_checks.patch
index ea9558fccf..257bcf79ee 100644
--- a/target/linux/generic/patches-4.4/610-netfilter_match_bypass_default_checks.patch
+++ b/target/linux/generic/patches-4.4/610-netfilter_match_bypass_default_checks.patch
@@ -50,16 +50,16 @@
  static bool
  ip_checkentry(const struct ipt_ip *ip)
  {
-@@ -664,6 +690,8 @@ find_check_entry(struct ipt_entry *e, st
- 	struct xt_mtchk_param mtpar;
+@@ -655,6 +681,8 @@ find_check_entry(struct ipt_entry *e, st
  	struct xt_entry_match *ematch;
+ 	unsigned long pcnt;
  
 +	ip_checkdefault(&e->ip);
 +
- 	e->counters.pcnt = xt_percpu_counter_alloc();
- 	if (IS_ERR_VALUE(e->counters.pcnt))
+ 	pcnt = xt_percpu_counter_alloc();
+ 	if (IS_ERR_VALUE(pcnt))
  		return -ENOMEM;
-@@ -948,6 +976,7 @@ copy_entries_to_user(unsigned int total_
+@@ -953,6 +981,7 @@ copy_entries_to_user(unsigned int total_
  	const struct xt_table_info *private = table->private;
  	int ret = 0;
  	const void *loc_cpu_entry;
@@ -67,7 +67,7 @@
  
  	counters = alloc_counters(table);
  	if (IS_ERR(counters))
-@@ -974,6 +1003,14 @@ copy_entries_to_user(unsigned int total_
+@@ -979,6 +1008,14 @@ copy_entries_to_user(unsigned int total_
  			ret = -EFAULT;
  			goto free_counters;
  		}
diff --git a/target/linux/generic/patches-4.4/650-pppoe_header_pad.patch b/target/linux/generic/patches-4.4/650-pppoe_header_pad.patch
deleted file mode 100644
index 409de58c28..0000000000
--- a/target/linux/generic/patches-4.4/650-pppoe_header_pad.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- a/drivers/net/ppp/pppoe.c
-+++ b/drivers/net/ppp/pppoe.c
-@@ -879,7 +879,7 @@ static int pppoe_sendmsg(struct socket *
- 		goto end;
- 
- 
--	skb = sock_wmalloc(sk, total_len + dev->hard_header_len + 32,
-+	skb = sock_wmalloc(sk, total_len + dev->hard_header_len + 32 + NET_SKB_PAD,
- 			   0, GFP_KERNEL);
- 	if (!skb) {
- 		error = -ENOMEM;
-@@ -887,7 +887,7 @@ static int pppoe_sendmsg(struct socket *
- 	}
- 
- 	/* Reserve space for headers. */
--	skb_reserve(skb, dev->hard_header_len);
-+	skb_reserve(skb, dev->hard_header_len + NET_SKB_PAD);
- 	skb_reset_network_header(skb);
- 
- 	skb->dev = dev;
diff --git a/target/linux/generic/patches-4.4/680-NET-skip-GRO-for-foreign-MAC-addresses.patch b/target/linux/generic/patches-4.4/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
index d91db1fe73..7c96f4f171 100644
--- a/target/linux/generic/patches-4.4/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
+++ b/target/linux/generic/patches-4.4/680-NET-skip-GRO-for-foreign-MAC-addresses.patch
@@ -17,7 +17,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -4260,6 +4260,9 @@ static enum gro_result dev_gro_receive(s
+@@ -4271,6 +4271,9 @@ static enum gro_result dev_gro_receive(s
  	enum gro_result ret;
  	int grow;
  
@@ -27,7 +27,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!(skb->dev->features & NETIF_F_GRO))
  		goto normal;
  
-@@ -5426,6 +5429,48 @@ static void __netdev_adjacent_dev_unlink
+@@ -5437,6 +5440,48 @@ static void __netdev_adjacent_dev_unlink
  					   &upper_dev->adj_list.lower);
  }
  
@@ -76,7 +76,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static int __netdev_upper_dev_link(struct net_device *dev,
  				   struct net_device *upper_dev, bool master,
  				   void *private)
-@@ -5497,6 +5542,7 @@ static int __netdev_upper_dev_link(struc
+@@ -5508,6 +5553,7 @@ static int __netdev_upper_dev_link(struc
  			goto rollback_lower_mesh;
  	}
  
@@ -84,7 +84,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	call_netdevice_notifiers_info(NETDEV_CHANGEUPPER, dev,
  				      &changeupper_info.info);
  	return 0;
-@@ -5623,6 +5669,7 @@ void netdev_upper_dev_unlink(struct net_
+@@ -5634,6 +5680,7 @@ void netdev_upper_dev_unlink(struct net_
  	list_for_each_entry(i, &upper_dev->all_adj_list.upper, list)
  		__netdev_adjacent_dev_unlink(dev, i->dev, i->ref_nr);
  
@@ -92,7 +92,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	call_netdevice_notifiers_info(NETDEV_CHANGEUPPER, dev,
  				      &changeupper_info.info);
  }
-@@ -6163,6 +6210,7 @@ int dev_set_mac_address(struct net_devic
+@@ -6174,6 +6221,7 @@ int dev_set_mac_address(struct net_devic
  	if (err)
  		return err;
  	dev->addr_assign_type = NET_ADDR_SET;
diff --git a/target/linux/generic/patches-4.4/834-ledtrig-libata.patch b/target/linux/generic/patches-4.4/834-ledtrig-libata.patch
index c3d187a098..ad63634479 100644
--- a/target/linux/generic/patches-4.4/834-ledtrig-libata.patch
+++ b/target/linux/generic/patches-4.4/834-ledtrig-libata.patch
@@ -69,7 +69,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  /**
   *	ata_build_rw_tf - Build ATA taskfile for given read/write request
   *	@tf: Target ATA taskfile
-@@ -4780,6 +4793,9 @@ struct ata_queued_cmd *ata_qc_new_init(s
+@@ -4781,6 +4794,9 @@ struct ata_queued_cmd *ata_qc_new_init(s
  		if (tag < 0)
  			return NULL;
  	}
@@ -79,7 +79,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  	qc = __ata_qc_from_tag(ap, tag);
  	qc->tag = tag;
-@@ -5677,6 +5693,9 @@ struct ata_port *ata_port_alloc(struct a
+@@ -5678,6 +5694,9 @@ struct ata_port *ata_port_alloc(struct a
  	ap->stats.unhandled_irq = 1;
  	ap->stats.idle_irq = 1;
  #endif
@@ -89,7 +89,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	ata_sff_port_init(ap);
  
  	return ap;
-@@ -5698,6 +5717,12 @@ static void ata_host_release(struct devi
+@@ -5699,6 +5718,12 @@ static void ata_host_release(struct devi
  
  		kfree(ap->pmp_link);
  		kfree(ap->slave_link);
@@ -102,7 +102,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		kfree(ap);
  		host->ports[i] = NULL;
  	}
-@@ -6144,7 +6169,23 @@ int ata_host_register(struct ata_host *h
+@@ -6145,7 +6170,23 @@ int ata_host_register(struct ata_host *h
  		host->ports[i]->print_id = atomic_inc_return(&ata_print_id);
  		host->ports[i]->local_port_no = i + 1;
  	}
diff --git a/target/linux/generic/patches-4.4/902-debloat_proc.patch b/target/linux/generic/patches-4.4/902-debloat_proc.patch
index 4f874e5986..931f43fce4 100644
--- a/target/linux/generic/patches-4.4/902-debloat_proc.patch
+++ b/target/linux/generic/patches-4.4/902-debloat_proc.patch
@@ -251,7 +251,7 @@
  
 --- a/ipc/msg.c
 +++ b/ipc/msg.c
-@@ -1068,6 +1068,9 @@ void __init msg_init(void)
+@@ -1071,6 +1071,9 @@ void __init msg_init(void)
  {
  	msg_init_ns(&init_ipc_ns);
  
diff --git a/target/linux/generic/patches-4.4/995-mangle_bootargs.patch b/target/linux/generic/patches-4.4/995-mangle_bootargs.patch
index e008dd9098..821370350e 100644
--- a/target/linux/generic/patches-4.4/995-mangle_bootargs.patch
+++ b/target/linux/generic/patches-4.4/995-mangle_bootargs.patch
@@ -40,7 +40,7 @@
  	setup_per_cpu_areas();
 --- a/init/Kconfig
 +++ b/init/Kconfig
-@@ -1648,6 +1648,15 @@ config EMBEDDED
+@@ -1655,6 +1655,15 @@ config EMBEDDED
  	  an embedded system so certain expert options are available
  	  for configuration.
  
diff --git a/target/linux/layerscape/patches-4.4/7017-fsl_qbman-add-qbman-driver.patch b/target/linux/layerscape/patches-4.4/7017-fsl_qbman-add-qbman-driver.patch
index e7e5d311c8..ef9c104b36 100644
--- a/target/linux/layerscape/patches-4.4/7017-fsl_qbman-add-qbman-driver.patch
+++ b/target/linux/layerscape/patches-4.4/7017-fsl_qbman-add-qbman-driver.patch
@@ -109,7 +109,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  	help
 --- a/arch/powerpc/Kconfig
 +++ b/arch/powerpc/Kconfig
-@@ -786,6 +786,11 @@ config FSL_GTM
+@@ -787,6 +787,11 @@ config FSL_GTM
  	help
  	  Freescale General-purpose Timers support
  
@@ -121,7 +121,7 @@ Signed-off-by: Zhao Qiang <qiang.zhao@nxp.com>
  # Yes MCA RS/6000s exist but Linux-PPC does not currently support any
  config MCA
  	bool
-@@ -918,14 +923,14 @@ config DYNAMIC_MEMSTART
+@@ -919,14 +924,14 @@ config DYNAMIC_MEMSTART
  	select NONSTATIC_KERNEL
  	help
  	  This option enables the kernel to be loaded at any page aligned
diff --git a/target/linux/layerscape/patches-4.4/7031-fsl_qbman-Enable-DPAA1-QBMan-for-ARM64-platforms.patch b/target/linux/layerscape/patches-4.4/7031-fsl_qbman-Enable-DPAA1-QBMan-for-ARM64-platforms.patch
index 24f79895da..faa0d7ab0b 100644
--- a/target/linux/layerscape/patches-4.4/7031-fsl_qbman-Enable-DPAA1-QBMan-for-ARM64-platforms.patch
+++ b/target/linux/layerscape/patches-4.4/7031-fsl_qbman-Enable-DPAA1-QBMan-for-ARM64-platforms.patch
@@ -17,7 +17,7 @@ Integrated-by: Zhao Qiang <qiang.zhao@nxp.com>
 
 --- a/arch/arm64/Kconfig
 +++ b/arch/arm64/Kconfig
-@@ -187,6 +187,11 @@ source "arch/arm64/Kconfig.platforms"
+@@ -188,6 +188,11 @@ source "arch/arm64/Kconfig.platforms"
  
  menu "Bus support"
  
diff --git a/target/linux/layerscape/patches-4.4/8048-mmc-sdhci-of-esdhc-add-remove-some-quirks-according-.patch b/target/linux/layerscape/patches-4.4/8048-mmc-sdhci-of-esdhc-add-remove-some-quirks-according-.patch
index 09afa5e2ac..3391053356 100644
--- a/target/linux/layerscape/patches-4.4/8048-mmc-sdhci-of-esdhc-add-remove-some-quirks-according-.patch
+++ b/target/linux/layerscape/patches-4.4/8048-mmc-sdhci-of-esdhc-add-remove-some-quirks-according-.patch
@@ -34,16 +34,7 @@ Integrated-by: Zhao Qiang <qiang.zhao@nxp.com>
 
 --- a/drivers/mmc/host/sdhci-of-esdhc.c
 +++ b/drivers/mmc/host/sdhci-of-esdhc.c
-@@ -584,6 +584,8 @@ static int sdhci_esdhc_probe(struct plat
- {
- 	struct sdhci_host *host;
- 	struct device_node *np;
-+	struct sdhci_pltfm_host *pltfm_host;
-+	struct sdhci_esdhc *esdhc;
- 	int ret;
- 
- 	np = pdev->dev.of_node;
-@@ -611,6 +613,14 @@ static int sdhci_esdhc_probe(struct plat
+@@ -621,6 +621,14 @@ static int sdhci_esdhc_probe(struct plat
  	if (of_device_is_compatible(np, "fsl,ls1021a-esdhc"))
  		host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL;
  
diff --git a/target/linux/layerscape/patches-4.4/8049-PCI-layerscape-Add-fsl-ls2085a-pcie-compatible-ID.patch b/target/linux/layerscape/patches-4.4/8049-PCI-layerscape-Add-fsl-ls2085a-pcie-compatible-ID.patch
deleted file mode 100644
index 678da2fc17..0000000000
--- a/target/linux/layerscape/patches-4.4/8049-PCI-layerscape-Add-fsl-ls2085a-pcie-compatible-ID.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From f2d357f86d79141969e29ec1dc1669da5120e022 Mon Sep 17 00:00:00 2001
-From: Yang Shi <yang.shi@linaro.org>
-Date: Wed, 27 Jan 2016 09:32:05 -0800
-Subject: [PATCH 49/70] PCI: layerscape: Add "fsl,ls2085a-pcie" compatible ID
-
-The Layerscape PCI host driver must recognize ls2085a compatible when using
-firmware with ls2085a compatible property, otherwise the PCI bus won't be
-detected even though ls2085a compatible is included by the dts.
-
-Signed-off-by: Yang Shi <yang.shi@linaro.org>
-Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
----
- drivers/pci/host/pci-layerscape.c |    1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/pci/host/pci-layerscape.c
-+++ b/drivers/pci/host/pci-layerscape.c
-@@ -203,6 +203,7 @@ static const struct of_device_id ls_pcie
- 	{ .compatible = "fsl,ls1021a-pcie", .data = &ls1021_drvdata },
- 	{ .compatible = "fsl,ls1043a-pcie", .data = &ls1043_drvdata },
- 	{ .compatible = "fsl,ls2080a-pcie", .data = &ls2080_drvdata },
-+	{ .compatible = "fsl,ls2085a-pcie", .data = &ls2080_drvdata },
- 	{ },
- };
- MODULE_DEVICE_TABLE(of, ls_pcie_of_match);
diff --git a/target/linux/layerscape/patches-4.4/8050-PCI-layerscape-Fix-MSG-TLP-drop-setting.patch b/target/linux/layerscape/patches-4.4/8050-PCI-layerscape-Fix-MSG-TLP-drop-setting.patch
deleted file mode 100644
index 1aa23ab074..0000000000
--- a/target/linux/layerscape/patches-4.4/8050-PCI-layerscape-Fix-MSG-TLP-drop-setting.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From 61959c53020fff0584d88e28d6dae9806184f1a8 Mon Sep 17 00:00:00 2001
-From: Minghuan Lian <Minghuan.Lian@nxp.com>
-Date: Mon, 29 Feb 2016 17:24:15 -0600
-Subject: [PATCH 50/70] PCI: layerscape: Fix MSG TLP drop setting
-
-Some kinds of Layerscape PCIe controllers will forward the received message
-TLPs to system application address space, which could corrupt system memory
-or lead to a system hang.  Enable MSG_DROP to fix this issue.
-
-Signed-off-by: Minghuan Lian <Minghuan.Lian@nxp.com>
-Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
----
- drivers/pci/host/pci-layerscape.c |   21 +++++++++++++--------
- 1 file changed, 13 insertions(+), 8 deletions(-)
-
---- a/drivers/pci/host/pci-layerscape.c
-+++ b/drivers/pci/host/pci-layerscape.c
-@@ -77,6 +77,16 @@ static void ls_pcie_fix_class(struct ls_
- 	iowrite16(PCI_CLASS_BRIDGE_PCI, pcie->dbi + PCI_CLASS_DEVICE);
- }
- 
-+/* Drop MSG TLP except for Vendor MSG */
-+static void ls_pcie_drop_msg_tlp(struct ls_pcie *pcie)
-+{
-+	u32 val;
-+
-+	val = ioread32(pcie->dbi + PCIE_STRFMR1);
-+	val &= 0xDFFFFFFF;
-+	iowrite32(val, pcie->dbi + PCIE_STRFMR1);
-+}
-+
- static int ls1021_pcie_link_up(struct pcie_port *pp)
- {
- 	u32 state;
-@@ -97,7 +107,7 @@ static int ls1021_pcie_link_up(struct pc
- static void ls1021_pcie_host_init(struct pcie_port *pp)
- {
- 	struct ls_pcie *pcie = to_ls_pcie(pp);
--	u32 val, index[2];
-+	u32 index[2];
- 
- 	pcie->scfg = syscon_regmap_lookup_by_phandle(pp->dev->of_node,
- 						     "fsl,pcie-scfg");
-@@ -116,13 +126,7 @@ static void ls1021_pcie_host_init(struct
- 
- 	dw_pcie_setup_rc(pp);
- 
--	/*
--	 * LS1021A Workaround for internal TKT228622
--	 * to fix the INTx hang issue
--	 */
--	val = ioread32(pcie->dbi + PCIE_STRFMR1);
--	val &= 0xffff;
--	iowrite32(val, pcie->dbi + PCIE_STRFMR1);
-+	ls_pcie_drop_msg_tlp(pcie);
- }
- 
- static int ls_pcie_link_up(struct pcie_port *pp)
-@@ -147,6 +151,7 @@ static void ls_pcie_host_init(struct pci
- 	iowrite32(1, pcie->dbi + PCIE_DBI_RO_WR_EN);
- 	ls_pcie_fix_class(pcie);
- 	ls_pcie_clear_multifunction(pcie);
-+	ls_pcie_drop_msg_tlp(pcie);
- 	iowrite32(0, pcie->dbi + PCIE_DBI_RO_WR_EN);
- }
- 
diff --git a/target/linux/layerscape/patches-4.4/8142-drivers-mmc-Add-compatible-string-for-LS1046A.patch b/target/linux/layerscape/patches-4.4/8142-drivers-mmc-Add-compatible-string-for-LS1046A.patch
index 34add83db4..d9b4ecb083 100644
--- a/target/linux/layerscape/patches-4.4/8142-drivers-mmc-Add-compatible-string-for-LS1046A.patch
+++ b/target/linux/layerscape/patches-4.4/8142-drivers-mmc-Add-compatible-string-for-LS1046A.patch
@@ -10,7 +10,7 @@ Signed-off-by: Yutang Jiang <yutang.jiang@nxp.com>
 
 --- a/drivers/mmc/host/sdhci-of-esdhc.c
 +++ b/drivers/mmc/host/sdhci-of-esdhc.c
-@@ -607,6 +607,7 @@ static int sdhci_esdhc_probe(struct plat
+@@ -615,6 +615,7 @@ static int sdhci_esdhc_probe(struct plat
  	    of_device_is_compatible(np, "fsl,p4080-esdhc") ||
  	    of_device_is_compatible(np, "fsl,p1020-esdhc") ||
  	    of_device_is_compatible(np, "fsl,t1040-esdhc") ||
diff --git a/target/linux/mediatek/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch b/target/linux/mediatek/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
index 9f4b044473..a5b51d4a90 100644
--- a/target/linux/mediatek/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
+++ b/target/linux/mediatek/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
@@ -2335,16 +2335,16 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  						oob, ops, toread);
  					oobreadlen -= toread;
  				}
-@@ -2024,7 +2078,7 @@ static int nand_do_read_oob(struct mtd_i
- 			    struct mtd_oob_ops *ops)
+@@ -2025,7 +2079,7 @@ static int nand_do_read_oob(struct mtd_i
  {
+ 	unsigned int max_bitflips = 0;
  	int page, realpage, chipnr;
 -	struct nand_chip *chip = mtd->priv;
 +	struct nand_chip *chip = mtd_to_nand(mtd);
  	struct mtd_ecc_stats stats;
  	int readlen = ops->ooblen;
  	int len;
-@@ -2036,10 +2090,7 @@ static int nand_do_read_oob(struct mtd_i
+@@ -2037,10 +2091,7 @@ static int nand_do_read_oob(struct mtd_i
  
  	stats = mtd->ecc_stats;
  
@@ -2356,7 +2356,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	if (unlikely(ops->ooboffs >= len)) {
  		pr_debug("%s: attempt to start read outside oob\n",
-@@ -2073,7 +2124,7 @@ static int nand_do_read_oob(struct mtd_i
+@@ -2074,7 +2125,7 @@ static int nand_do_read_oob(struct mtd_i
  			break;
  
  		len = min(len, readlen);
@@ -2365,7 +2365,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  		if (chip->options & NAND_NEED_READRDY) {
  			/* Apply delay or wait for ready/busy pin */
-@@ -2232,19 +2283,20 @@ static int nand_write_page_swecc(struct
+@@ -2235,19 +2286,20 @@ static int nand_write_page_swecc(struct
  				 const uint8_t *buf, int oob_required,
  				 int page)
  {
@@ -2390,7 +2390,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	return chip->ecc.write_page_raw(mtd, chip, buf, 1, page);
  }
-@@ -2261,12 +2313,11 @@ static int nand_write_page_hwecc(struct
+@@ -2264,12 +2316,11 @@ static int nand_write_page_hwecc(struct
  				  const uint8_t *buf, int oob_required,
  				  int page)
  {
@@ -2404,7 +2404,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	for (i = 0; eccsteps; eccsteps--, i += eccbytes, p += eccsize) {
  		chip->ecc.hwctl(mtd, NAND_ECC_WRITE);
-@@ -2274,8 +2325,10 @@ static int nand_write_page_hwecc(struct
+@@ -2277,8 +2328,10 @@ static int nand_write_page_hwecc(struct
  		chip->ecc.calculate(mtd, p, &ecc_calc[i]);
  	}
  
@@ -2417,7 +2417,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	chip->write_buf(mtd, chip->oob_poi, mtd->oobsize);
  
-@@ -2303,11 +2356,10 @@ static int nand_write_subpage_hwecc(stru
+@@ -2306,11 +2359,10 @@ static int nand_write_subpage_hwecc(stru
  	int ecc_size      = chip->ecc.size;
  	int ecc_bytes     = chip->ecc.bytes;
  	int ecc_steps     = chip->ecc.steps;
@@ -2430,7 +2430,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	for (step = 0; step < ecc_steps; step++) {
  		/* configure controller for WRITE access */
-@@ -2335,8 +2387,10 @@ static int nand_write_subpage_hwecc(stru
+@@ -2338,8 +2390,10 @@ static int nand_write_subpage_hwecc(stru
  	/* copy calculated ECC for whole page to chip->buffer->oob */
  	/* this include masked-value(0xFF) for unwritten subpages */
  	ecc_calc = chip->buffers->ecccalc;
@@ -2443,7 +2443,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/* write OOB buffer to NAND device */
  	chip->write_buf(mtd, chip->oob_poi, mtd->oobsize);
-@@ -2472,7 +2526,8 @@ static int nand_write_page(struct mtd_in
+@@ -2475,7 +2529,8 @@ static int nand_write_page(struct mtd_in
  static uint8_t *nand_fill_oob(struct mtd_info *mtd, uint8_t *oob, size_t len,
  			      struct mtd_oob_ops *ops)
  {
@@ -2453,7 +2453,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/*
  	 * Initialise to all 0xFF, to avoid the possibility of left over OOB
-@@ -2487,31 +2542,12 @@ static uint8_t *nand_fill_oob(struct mtd
+@@ -2490,31 +2545,12 @@ static uint8_t *nand_fill_oob(struct mtd
  		memcpy(chip->oob_poi + ops->ooboffs, oob, len);
  		return oob + len;
  
@@ -2491,7 +2491,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	default:
  		BUG();
  	}
-@@ -2532,12 +2568,11 @@ static int nand_do_write_ops(struct mtd_
+@@ -2535,12 +2571,11 @@ static int nand_do_write_ops(struct mtd_
  			     struct mtd_oob_ops *ops)
  {
  	int chipnr, realpage, page, blockmask, column;
@@ -2506,7 +2506,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	uint8_t *oob = ops->oobbuf;
  	uint8_t *buf = ops->datbuf;
-@@ -2662,7 +2697,7 @@ err_out:
+@@ -2665,7 +2700,7 @@ err_out:
  static int panic_nand_write(struct mtd_info *mtd, loff_t to, size_t len,
  			    size_t *retlen, const uint8_t *buf)
  {
@@ -2515,7 +2515,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	int chipnr = (int)(to >> chip->chip_shift);
  	struct mtd_oob_ops ops;
  	int ret;
-@@ -2725,15 +2760,12 @@ static int nand_do_write_oob(struct mtd_
+@@ -2728,15 +2763,12 @@ static int nand_do_write_oob(struct mtd_
  			     struct mtd_oob_ops *ops)
  {
  	int chipnr, page, status, len;
@@ -2533,7 +2533,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/* Do not allow write past end of page */
  	if ((ops->ooboffs + ops->ooblen) > len) {
-@@ -2850,7 +2882,7 @@ out:
+@@ -2853,7 +2885,7 @@ out:
   */
  static int single_erase(struct mtd_info *mtd, int page)
  {
@@ -2542,7 +2542,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	/* Send commands to erase a block */
  	chip->cmdfunc(mtd, NAND_CMD_ERASE1, -1, page);
  	chip->cmdfunc(mtd, NAND_CMD_ERASE2, -1, -1);
-@@ -2882,7 +2914,7 @@ int nand_erase_nand(struct mtd_info *mtd
+@@ -2885,7 +2917,7 @@ int nand_erase_nand(struct mtd_info *mtd
  		    int allowbbt)
  {
  	int page, status, pages_per_block, ret, chipnr;
@@ -2551,7 +2551,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	loff_t len;
  
  	pr_debug("%s: start = 0x%012llx, len = %llu\n",
-@@ -2921,7 +2953,7 @@ int nand_erase_nand(struct mtd_info *mtd
+@@ -2924,7 +2956,7 @@ int nand_erase_nand(struct mtd_info *mtd
  	while (len) {
  		/* Check if we have a bad block, we do not erase bad blocks! */
  		if (nand_block_checkbad(mtd, ((loff_t) page) <<
@@ -2560,7 +2560,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			pr_warn("%s: attempt to erase a bad block at page 0x%08x\n",
  				    __func__, page);
  			instr->state = MTD_ERASE_FAILED;
-@@ -3008,7 +3040,20 @@ static void nand_sync(struct mtd_info *m
+@@ -3011,7 +3043,20 @@ static void nand_sync(struct mtd_info *m
   */
  static int nand_block_isbad(struct mtd_info *mtd, loff_t offs)
  {
@@ -2582,7 +2582,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  }
  
  /**
-@@ -3097,7 +3142,7 @@ static int nand_suspend(struct mtd_info
+@@ -3100,7 +3145,7 @@ static int nand_suspend(struct mtd_info
   */
  static void nand_resume(struct mtd_info *mtd)
  {
@@ -2591,7 +2591,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	if (chip->state == FL_PM_SUSPENDED)
  		nand_release_device(mtd);
-@@ -3269,7 +3314,7 @@ ext_out:
+@@ -3272,7 +3317,7 @@ ext_out:
  
  static int nand_setup_read_retry_micron(struct mtd_info *mtd, int retry_mode)
  {
@@ -2600,7 +2600,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	uint8_t feature[ONFI_SUBFEATURE_PARAM_LEN] = {retry_mode};
  
  	return chip->onfi_set_features(mtd, chip, ONFI_FEATURE_ADDR_READ_RETRY,
-@@ -3940,10 +3985,13 @@ ident_done:
+@@ -3943,10 +3988,13 @@ ident_done:
  	return type;
  }
  
@@ -2617,7 +2617,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	if (of_get_nand_bus_width(dn) == 16)
  		chip->options |= NAND_BUSWIDTH_16;
-@@ -3952,6 +4000,7 @@ static int nand_dt_init(struct mtd_info
+@@ -3955,6 +4003,7 @@ static int nand_dt_init(struct mtd_info
  		chip->bbt_options |= NAND_BBT_USE_FLASH;
  
  	ecc_mode = of_get_nand_ecc_mode(dn);
@@ -2625,7 +2625,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	ecc_strength = of_get_nand_ecc_strength(dn);
  	ecc_step = of_get_nand_ecc_step_size(dn);
  
-@@ -3964,6 +4013,9 @@ static int nand_dt_init(struct mtd_info
+@@ -3967,6 +4016,9 @@ static int nand_dt_init(struct mtd_info
  	if (ecc_mode >= 0)
  		chip->ecc.mode = ecc_mode;
  
@@ -2635,7 +2635,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	if (ecc_strength >= 0)
  		chip->ecc.strength = ecc_strength;
  
-@@ -3987,15 +4039,16 @@ int nand_scan_ident(struct mtd_info *mtd
+@@ -3990,15 +4042,16 @@ int nand_scan_ident(struct mtd_info *mtd
  		    struct nand_flash_dev *table)
  {
  	int i, nand_maf_id, nand_dev_id;
@@ -2658,7 +2658,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	if (!mtd->name && mtd->dev.parent)
  		mtd->name = dev_name(mtd->dev.parent);
-@@ -4058,7 +4111,7 @@ EXPORT_SYMBOL(nand_scan_ident);
+@@ -4061,7 +4114,7 @@ EXPORT_SYMBOL(nand_scan_ident);
   */
  static bool nand_ecc_strength_good(struct mtd_info *mtd)
  {
@@ -2667,7 +2667,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	struct nand_ecc_ctrl *ecc = &chip->ecc;
  	int corr, ds_corr;
  
-@@ -4086,10 +4139,10 @@ static bool nand_ecc_strength_good(struc
+@@ -4089,10 +4142,10 @@ static bool nand_ecc_strength_good(struc
   */
  int nand_scan_tail(struct mtd_info *mtd)
  {
@@ -2680,7 +2680,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/* New bad blocks should be marked in OOB, flash-based BBT, or both */
  	BUG_ON((chip->bbt_options & NAND_BBT_NO_OOB_BBM) &&
-@@ -4116,19 +4169,15 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4119,19 +4172,15 @@ int nand_scan_tail(struct mtd_info *mtd)
  	/*
  	 * If no default placement scheme is given, select an appropriate one.
  	 */
@@ -2703,7 +2703,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			break;
  		default:
  			pr_warn("No oob scheme defined for oobsize %d\n",
-@@ -4171,7 +4220,7 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4174,7 +4223,7 @@ int nand_scan_tail(struct mtd_info *mtd)
  			ecc->write_oob = nand_write_oob_std;
  		if (!ecc->read_subpage)
  			ecc->read_subpage = nand_read_subpage;
@@ -2712,7 +2712,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			ecc->write_subpage = nand_write_subpage_hwecc;
  
  	case NAND_ECC_HW_SYNDROME:
-@@ -4249,10 +4298,8 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4252,10 +4301,8 @@ int nand_scan_tail(struct mtd_info *mtd)
  		}
  
  		/* See nand_bch_init() for details. */
@@ -2725,7 +2725,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  		if (!ecc->priv) {
  			pr_warn("BCH ECC initialization failed!\n");
  			BUG();
-@@ -4283,20 +4330,9 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4286,20 +4333,9 @@ int nand_scan_tail(struct mtd_info *mtd)
  	if (!ecc->write_oob_raw)
  		ecc->write_oob_raw = ecc->write_oob;
  
@@ -2749,7 +2749,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/*
  	 * Set the number of read / write steps for one page depending on ECC
-@@ -4309,6 +4345,21 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4312,6 +4348,21 @@ int nand_scan_tail(struct mtd_info *mtd)
  	}
  	ecc->total = ecc->steps * ecc->bytes;
  
@@ -2771,7 +2771,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	/* Allow subpage writes up to ecc.steps. Not possible for MLC flash */
  	if (!(chip->options & NAND_NO_SUBPAGE_WRITE) && nand_is_slc(chip)) {
  		switch (ecc->steps) {
-@@ -4365,10 +4416,6 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4368,10 +4419,6 @@ int nand_scan_tail(struct mtd_info *mtd)
  	mtd->_block_markbad = nand_block_markbad;
  	mtd->writebufsize = mtd->writesize;
  
@@ -2782,7 +2782,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	/*
  	 * Initialize bitflip_threshold to its default prior scan_bbt() call.
  	 * scan_bbt() might invoke mtd_read(), thus bitflip_threshold must be
-@@ -4424,7 +4471,7 @@ EXPORT_SYMBOL(nand_scan);
+@@ -4427,7 +4474,7 @@ EXPORT_SYMBOL(nand_scan);
   */
  void nand_release(struct mtd_info *mtd)
  {
diff --git a/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch b/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
index 9f4b044473..a5b51d4a90 100644
--- a/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
+++ b/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
@@ -2335,16 +2335,16 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  						oob, ops, toread);
  					oobreadlen -= toread;
  				}
-@@ -2024,7 +2078,7 @@ static int nand_do_read_oob(struct mtd_i
- 			    struct mtd_oob_ops *ops)
+@@ -2025,7 +2079,7 @@ static int nand_do_read_oob(struct mtd_i
  {
+ 	unsigned int max_bitflips = 0;
  	int page, realpage, chipnr;
 -	struct nand_chip *chip = mtd->priv;
 +	struct nand_chip *chip = mtd_to_nand(mtd);
  	struct mtd_ecc_stats stats;
  	int readlen = ops->ooblen;
  	int len;
-@@ -2036,10 +2090,7 @@ static int nand_do_read_oob(struct mtd_i
+@@ -2037,10 +2091,7 @@ static int nand_do_read_oob(struct mtd_i
  
  	stats = mtd->ecc_stats;
  
@@ -2356,7 +2356,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	if (unlikely(ops->ooboffs >= len)) {
  		pr_debug("%s: attempt to start read outside oob\n",
-@@ -2073,7 +2124,7 @@ static int nand_do_read_oob(struct mtd_i
+@@ -2074,7 +2125,7 @@ static int nand_do_read_oob(struct mtd_i
  			break;
  
  		len = min(len, readlen);
@@ -2365,7 +2365,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  		if (chip->options & NAND_NEED_READRDY) {
  			/* Apply delay or wait for ready/busy pin */
-@@ -2232,19 +2283,20 @@ static int nand_write_page_swecc(struct
+@@ -2235,19 +2286,20 @@ static int nand_write_page_swecc(struct
  				 const uint8_t *buf, int oob_required,
  				 int page)
  {
@@ -2390,7 +2390,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	return chip->ecc.write_page_raw(mtd, chip, buf, 1, page);
  }
-@@ -2261,12 +2313,11 @@ static int nand_write_page_hwecc(struct
+@@ -2264,12 +2316,11 @@ static int nand_write_page_hwecc(struct
  				  const uint8_t *buf, int oob_required,
  				  int page)
  {
@@ -2404,7 +2404,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	for (i = 0; eccsteps; eccsteps--, i += eccbytes, p += eccsize) {
  		chip->ecc.hwctl(mtd, NAND_ECC_WRITE);
-@@ -2274,8 +2325,10 @@ static int nand_write_page_hwecc(struct
+@@ -2277,8 +2328,10 @@ static int nand_write_page_hwecc(struct
  		chip->ecc.calculate(mtd, p, &ecc_calc[i]);
  	}
  
@@ -2417,7 +2417,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	chip->write_buf(mtd, chip->oob_poi, mtd->oobsize);
  
-@@ -2303,11 +2356,10 @@ static int nand_write_subpage_hwecc(stru
+@@ -2306,11 +2359,10 @@ static int nand_write_subpage_hwecc(stru
  	int ecc_size      = chip->ecc.size;
  	int ecc_bytes     = chip->ecc.bytes;
  	int ecc_steps     = chip->ecc.steps;
@@ -2430,7 +2430,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	for (step = 0; step < ecc_steps; step++) {
  		/* configure controller for WRITE access */
-@@ -2335,8 +2387,10 @@ static int nand_write_subpage_hwecc(stru
+@@ -2338,8 +2390,10 @@ static int nand_write_subpage_hwecc(stru
  	/* copy calculated ECC for whole page to chip->buffer->oob */
  	/* this include masked-value(0xFF) for unwritten subpages */
  	ecc_calc = chip->buffers->ecccalc;
@@ -2443,7 +2443,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/* write OOB buffer to NAND device */
  	chip->write_buf(mtd, chip->oob_poi, mtd->oobsize);
-@@ -2472,7 +2526,8 @@ static int nand_write_page(struct mtd_in
+@@ -2475,7 +2529,8 @@ static int nand_write_page(struct mtd_in
  static uint8_t *nand_fill_oob(struct mtd_info *mtd, uint8_t *oob, size_t len,
  			      struct mtd_oob_ops *ops)
  {
@@ -2453,7 +2453,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/*
  	 * Initialise to all 0xFF, to avoid the possibility of left over OOB
-@@ -2487,31 +2542,12 @@ static uint8_t *nand_fill_oob(struct mtd
+@@ -2490,31 +2545,12 @@ static uint8_t *nand_fill_oob(struct mtd
  		memcpy(chip->oob_poi + ops->ooboffs, oob, len);
  		return oob + len;
  
@@ -2491,7 +2491,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	default:
  		BUG();
  	}
-@@ -2532,12 +2568,11 @@ static int nand_do_write_ops(struct mtd_
+@@ -2535,12 +2571,11 @@ static int nand_do_write_ops(struct mtd_
  			     struct mtd_oob_ops *ops)
  {
  	int chipnr, realpage, page, blockmask, column;
@@ -2506,7 +2506,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	uint8_t *oob = ops->oobbuf;
  	uint8_t *buf = ops->datbuf;
-@@ -2662,7 +2697,7 @@ err_out:
+@@ -2665,7 +2700,7 @@ err_out:
  static int panic_nand_write(struct mtd_info *mtd, loff_t to, size_t len,
  			    size_t *retlen, const uint8_t *buf)
  {
@@ -2515,7 +2515,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	int chipnr = (int)(to >> chip->chip_shift);
  	struct mtd_oob_ops ops;
  	int ret;
-@@ -2725,15 +2760,12 @@ static int nand_do_write_oob(struct mtd_
+@@ -2728,15 +2763,12 @@ static int nand_do_write_oob(struct mtd_
  			     struct mtd_oob_ops *ops)
  {
  	int chipnr, page, status, len;
@@ -2533,7 +2533,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/* Do not allow write past end of page */
  	if ((ops->ooboffs + ops->ooblen) > len) {
-@@ -2850,7 +2882,7 @@ out:
+@@ -2853,7 +2885,7 @@ out:
   */
  static int single_erase(struct mtd_info *mtd, int page)
  {
@@ -2542,7 +2542,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	/* Send commands to erase a block */
  	chip->cmdfunc(mtd, NAND_CMD_ERASE1, -1, page);
  	chip->cmdfunc(mtd, NAND_CMD_ERASE2, -1, -1);
-@@ -2882,7 +2914,7 @@ int nand_erase_nand(struct mtd_info *mtd
+@@ -2885,7 +2917,7 @@ int nand_erase_nand(struct mtd_info *mtd
  		    int allowbbt)
  {
  	int page, status, pages_per_block, ret, chipnr;
@@ -2551,7 +2551,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	loff_t len;
  
  	pr_debug("%s: start = 0x%012llx, len = %llu\n",
-@@ -2921,7 +2953,7 @@ int nand_erase_nand(struct mtd_info *mtd
+@@ -2924,7 +2956,7 @@ int nand_erase_nand(struct mtd_info *mtd
  	while (len) {
  		/* Check if we have a bad block, we do not erase bad blocks! */
  		if (nand_block_checkbad(mtd, ((loff_t) page) <<
@@ -2560,7 +2560,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			pr_warn("%s: attempt to erase a bad block at page 0x%08x\n",
  				    __func__, page);
  			instr->state = MTD_ERASE_FAILED;
-@@ -3008,7 +3040,20 @@ static void nand_sync(struct mtd_info *m
+@@ -3011,7 +3043,20 @@ static void nand_sync(struct mtd_info *m
   */
  static int nand_block_isbad(struct mtd_info *mtd, loff_t offs)
  {
@@ -2582,7 +2582,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  }
  
  /**
-@@ -3097,7 +3142,7 @@ static int nand_suspend(struct mtd_info
+@@ -3100,7 +3145,7 @@ static int nand_suspend(struct mtd_info
   */
  static void nand_resume(struct mtd_info *mtd)
  {
@@ -2591,7 +2591,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	if (chip->state == FL_PM_SUSPENDED)
  		nand_release_device(mtd);
-@@ -3269,7 +3314,7 @@ ext_out:
+@@ -3272,7 +3317,7 @@ ext_out:
  
  static int nand_setup_read_retry_micron(struct mtd_info *mtd, int retry_mode)
  {
@@ -2600,7 +2600,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	uint8_t feature[ONFI_SUBFEATURE_PARAM_LEN] = {retry_mode};
  
  	return chip->onfi_set_features(mtd, chip, ONFI_FEATURE_ADDR_READ_RETRY,
-@@ -3940,10 +3985,13 @@ ident_done:
+@@ -3943,10 +3988,13 @@ ident_done:
  	return type;
  }
  
@@ -2617,7 +2617,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	if (of_get_nand_bus_width(dn) == 16)
  		chip->options |= NAND_BUSWIDTH_16;
-@@ -3952,6 +4000,7 @@ static int nand_dt_init(struct mtd_info
+@@ -3955,6 +4003,7 @@ static int nand_dt_init(struct mtd_info
  		chip->bbt_options |= NAND_BBT_USE_FLASH;
  
  	ecc_mode = of_get_nand_ecc_mode(dn);
@@ -2625,7 +2625,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	ecc_strength = of_get_nand_ecc_strength(dn);
  	ecc_step = of_get_nand_ecc_step_size(dn);
  
-@@ -3964,6 +4013,9 @@ static int nand_dt_init(struct mtd_info
+@@ -3967,6 +4016,9 @@ static int nand_dt_init(struct mtd_info
  	if (ecc_mode >= 0)
  		chip->ecc.mode = ecc_mode;
  
@@ -2635,7 +2635,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	if (ecc_strength >= 0)
  		chip->ecc.strength = ecc_strength;
  
-@@ -3987,15 +4039,16 @@ int nand_scan_ident(struct mtd_info *mtd
+@@ -3990,15 +4042,16 @@ int nand_scan_ident(struct mtd_info *mtd
  		    struct nand_flash_dev *table)
  {
  	int i, nand_maf_id, nand_dev_id;
@@ -2658,7 +2658,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	if (!mtd->name && mtd->dev.parent)
  		mtd->name = dev_name(mtd->dev.parent);
-@@ -4058,7 +4111,7 @@ EXPORT_SYMBOL(nand_scan_ident);
+@@ -4061,7 +4114,7 @@ EXPORT_SYMBOL(nand_scan_ident);
   */
  static bool nand_ecc_strength_good(struct mtd_info *mtd)
  {
@@ -2667,7 +2667,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	struct nand_ecc_ctrl *ecc = &chip->ecc;
  	int corr, ds_corr;
  
-@@ -4086,10 +4139,10 @@ static bool nand_ecc_strength_good(struc
+@@ -4089,10 +4142,10 @@ static bool nand_ecc_strength_good(struc
   */
  int nand_scan_tail(struct mtd_info *mtd)
  {
@@ -2680,7 +2680,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/* New bad blocks should be marked in OOB, flash-based BBT, or both */
  	BUG_ON((chip->bbt_options & NAND_BBT_NO_OOB_BBM) &&
-@@ -4116,19 +4169,15 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4119,19 +4172,15 @@ int nand_scan_tail(struct mtd_info *mtd)
  	/*
  	 * If no default placement scheme is given, select an appropriate one.
  	 */
@@ -2703,7 +2703,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			break;
  		default:
  			pr_warn("No oob scheme defined for oobsize %d\n",
-@@ -4171,7 +4220,7 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4174,7 +4223,7 @@ int nand_scan_tail(struct mtd_info *mtd)
  			ecc->write_oob = nand_write_oob_std;
  		if (!ecc->read_subpage)
  			ecc->read_subpage = nand_read_subpage;
@@ -2712,7 +2712,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			ecc->write_subpage = nand_write_subpage_hwecc;
  
  	case NAND_ECC_HW_SYNDROME:
-@@ -4249,10 +4298,8 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4252,10 +4301,8 @@ int nand_scan_tail(struct mtd_info *mtd)
  		}
  
  		/* See nand_bch_init() for details. */
@@ -2725,7 +2725,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  		if (!ecc->priv) {
  			pr_warn("BCH ECC initialization failed!\n");
  			BUG();
-@@ -4283,20 +4330,9 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4286,20 +4333,9 @@ int nand_scan_tail(struct mtd_info *mtd)
  	if (!ecc->write_oob_raw)
  		ecc->write_oob_raw = ecc->write_oob;
  
@@ -2749,7 +2749,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/*
  	 * Set the number of read / write steps for one page depending on ECC
-@@ -4309,6 +4345,21 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4312,6 +4348,21 @@ int nand_scan_tail(struct mtd_info *mtd)
  	}
  	ecc->total = ecc->steps * ecc->bytes;
  
@@ -2771,7 +2771,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	/* Allow subpage writes up to ecc.steps. Not possible for MLC flash */
  	if (!(chip->options & NAND_NO_SUBPAGE_WRITE) && nand_is_slc(chip)) {
  		switch (ecc->steps) {
-@@ -4365,10 +4416,6 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4368,10 +4419,6 @@ int nand_scan_tail(struct mtd_info *mtd)
  	mtd->_block_markbad = nand_block_markbad;
  	mtd->writebufsize = mtd->writesize;
  
@@ -2782,7 +2782,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	/*
  	 * Initialize bitflip_threshold to its default prior scan_bbt() call.
  	 * scan_bbt() might invoke mtd_read(), thus bitflip_threshold must be
-@@ -4424,7 +4471,7 @@ EXPORT_SYMBOL(nand_scan);
+@@ -4427,7 +4474,7 @@ EXPORT_SYMBOL(nand_scan);
   */
  void nand_release(struct mtd_info *mtd)
  {
diff --git a/target/linux/oxnas/patches-4.4/0074-mtd-nand-import-nand_hw_control_init.patch b/target/linux/oxnas/patches-4.4/0074-mtd-nand-import-nand_hw_control_init.patch
index aefcfd98a7..8ff28b3bc2 100644
--- a/target/linux/oxnas/patches-4.4/0074-mtd-nand-import-nand_hw_control_init.patch
+++ b/target/linux/oxnas/patches-4.4/0074-mtd-nand-import-nand_hw_control_init.patch
@@ -39,7 +39,7 @@ Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
  	info->platform   = plat;
 --- a/drivers/mtd/nand/brcmnand/brcmnand.c
 +++ b/drivers/mtd/nand/brcmnand/brcmnand.c
-@@ -2156,8 +2156,7 @@ int brcmnand_probe(struct platform_devic
+@@ -2149,8 +2149,7 @@ int brcmnand_probe(struct platform_devic
  
  	init_completion(&ctrl->done);
  	init_completion(&ctrl->dma_done);
@@ -87,7 +87,7 @@ Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
  	}
 --- a/drivers/mtd/nand/nand_base.c
 +++ b/drivers/mtd/nand/nand_base.c
-@@ -3205,8 +3205,7 @@ static void nand_set_defaults(struct nan
+@@ -3208,8 +3208,7 @@ static void nand_set_defaults(struct nan
  
  	if (!chip->controller) {
  		chip->controller = &chip->hwcontrol;
@@ -135,7 +135,7 @@ Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
  
 --- a/drivers/mtd/nand/sunxi_nand.c
 +++ b/drivers/mtd/nand/sunxi_nand.c
-@@ -1426,8 +1426,7 @@ static int sunxi_nfc_probe(struct platfo
+@@ -1432,8 +1432,7 @@ static int sunxi_nfc_probe(struct platfo
  		return -ENOMEM;
  
  	nfc->dev = dev;
diff --git a/target/linux/oxnas/patches-4.4/999-libata-hacks.patch b/target/linux/oxnas/patches-4.4/999-libata-hacks.patch
index 1f4799dd88..ac278ab234 100644
--- a/target/linux/oxnas/patches-4.4/999-libata-hacks.patch
+++ b/target/linux/oxnas/patches-4.4/999-libata-hacks.patch
@@ -15,7 +15,7 @@
  	/* initialize internal qc */
  
  	/* XXX: Tag 0 is used for drivers with legacy EH as some
-@@ -4787,6 +4795,9 @@ struct ata_queued_cmd *ata_qc_new_init(s
+@@ -4788,6 +4796,9 @@ struct ata_queued_cmd *ata_qc_new_init(s
  	if (unlikely(ap->pflags & ATA_PFLAG_FROZEN))
  		return NULL;
  
@@ -25,7 +25,7 @@
  	/* libsas case */
  	if (ap->flags & ATA_FLAG_SAS_HOST) {
  		tag = ata_sas_allocate_tag(ap);
-@@ -4832,6 +4843,8 @@ void ata_qc_free(struct ata_queued_cmd *
+@@ -4833,6 +4844,8 @@ void ata_qc_free(struct ata_queued_cmd *
  		qc->tag = ATA_TAG_POISON;
  		if (ap->flags & ATA_FLAG_SAS_HOST)
  			ata_sas_free_tag(tag, ap);
diff --git a/target/linux/ramips/patches-4.4/0040-nand-add-mtk-nand-hack-hook.patch b/target/linux/ramips/patches-4.4/0040-nand-add-mtk-nand-hack-hook.patch
index e7f4d893f6..7c4570486c 100644
--- a/target/linux/ramips/patches-4.4/0040-nand-add-mtk-nand-hack-hook.patch
+++ b/target/linux/ramips/patches-4.4/0040-nand-add-mtk-nand-hack-hook.patch
@@ -118,7 +118,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			if (ret < 0) {
  				if (use_bufpoi)
  					/* Invalidate page cache */
-@@ -2935,8 +2939,11 @@ int nand_erase_nand(struct mtd_info *mtd
+@@ -2938,8 +2942,11 @@ int nand_erase_nand(struct mtd_info *mtd
  		if (page <= chip->pagebuf && chip->pagebuf <
  		    (page + pages_per_block))
  			chip->pagebuf = -1;
diff --git a/target/linux/ramips/patches-4.4/0901-spansion_nand_id_fix.patch b/target/linux/ramips/patches-4.4/0901-spansion_nand_id_fix.patch
index 7091085958..56c8342e99 100644
--- a/target/linux/ramips/patches-4.4/0901-spansion_nand_id_fix.patch
+++ b/target/linux/ramips/patches-4.4/0901-spansion_nand_id_fix.patch
@@ -13,7 +13,7 @@ Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
 
 --- a/drivers/mtd/nand/nand_base.c
 +++ b/drivers/mtd/nand/nand_base.c
-@@ -3571,6 +3571,7 @@ static void nand_decode_ext_id(struct mt
+@@ -3574,6 +3574,7 @@ static void nand_decode_ext_id(struct mt
  	/*
  	 * Field definitions are in the following datasheets:
  	 * Old style (4,5 byte ID): Samsung K9GAG08U0M (p.32)
@@ -21,7 +21,7 @@ Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
  	 * New Samsung (6 byte ID): Samsung K9GAG08U0F (p.44)
  	 * Hynix MLC   (6 byte ID): Hynix H27UBG8T2B (p.22)
  	 *
-@@ -3668,6 +3669,19 @@ static void nand_decode_ext_id(struct mt
+@@ -3671,6 +3672,19 @@ static void nand_decode_ext_id(struct mt
  		*busw = (extid & 0x01) ? NAND_BUSWIDTH_16 : 0;
  
  		/*
diff --git a/target/linux/x86/config-4.4 b/target/linux/x86/config-4.4
index 26bb124b8c..b441679d03 100644
--- a/target/linux/x86/config-4.4
+++ b/target/linux/x86/config-4.4
@@ -40,6 +40,7 @@ CONFIG_ARCH_USE_BUILTIN_BSWAP=y
 CONFIG_ARCH_USE_QUEUED_RWLOCKS=y
 CONFIG_ARCH_USE_QUEUED_SPINLOCKS=y
 CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT=y
+CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH=y
 CONFIG_ARCH_WANT_FRAME_POINTERS=y
 CONFIG_ARCH_WANT_GENERAL_HUGETLB=y
 CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y
@@ -138,6 +139,7 @@ CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
 CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y
 CONFIG_GENERIC_CMOS_UPDATE=y
 CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
 CONFIG_GENERIC_EARLY_IOREMAP=y
 CONFIG_GENERIC_FIND_FIRST_BIT=y
 CONFIG_GENERIC_IO=y
@@ -351,13 +353,13 @@ CONFIG_RATIONAL=y
 CONFIG_RD_BZIP2=y
 CONFIG_RD_GZIP=y
 # CONFIG_RELOCATABLE is not set
+CONFIG_RETPOLINE=y
 CONFIG_RTC_CLASS=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
 # CONFIG_SBC7240_WDT is not set
 # CONFIG_SBC8360_WDT is not set
 # CONFIG_SBC_EPX_C3_WATCHDOG is not set
 # CONFIG_SC1200_WDT is not set
-CONFIG_SCHED_HRTICK=y
 # CONFIG_SCHED_INFO is not set
 CONFIG_SCSI=y
 CONFIG_SCSI_SPI_ATTRS=y