diff --git a/include/kernel-version.mk b/include/kernel-version.mk
index e90a3c70ab..976d500fb4 100644
--- a/include/kernel-version.mk
+++ b/include/kernel-version.mk
@@ -3,10 +3,10 @@
 LINUX_RELEASE?=1
 
 LINUX_VERSION-3.18 = .43
-LINUX_VERSION-4.4 = .103
+LINUX_VERSION-4.4 = .105
 
 LINUX_KERNEL_HASH-3.18.43 = 1236e8123a6ce537d5029232560966feed054ae31776fe8481dd7d18cdd5492c
-LINUX_KERNEL_HASH-4.4.103 = 1d01d0785fdf52b3f3b9f7ad05b6cff6be034869935962478e19f265b022f904
+LINUX_KERNEL_HASH-4.4.105 = d6e912d578bb76cd8495c631488d7f12a4b35fb410404a93147a547278db1140
 
 ifdef KERNEL_PATCHVER
   LINUX_VERSION:=$(KERNEL_PATCHVER)$(strip $(LINUX_VERSION-$(KERNEL_PATCHVER)))
diff --git a/target/linux/brcm2708/patches-4.4/0029-Add-dwc_otg-driver.patch b/target/linux/brcm2708/patches-4.4/0029-Add-dwc_otg-driver.patch
index 8e9657abcf..1f652dc998 100644
--- a/target/linux/brcm2708/patches-4.4/0029-Add-dwc_otg-driver.patch
+++ b/target/linux/brcm2708/patches-4.4/0029-Add-dwc_otg-driver.patch
@@ -659,7 +659,7 @@ dwc_otg: Remove duplicate gadget probe/unregister function
  }
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
-@@ -4978,7 +4978,7 @@ static void port_event(struct usb_hub *h
+@@ -4987,7 +4987,7 @@ static void port_event(struct usb_hub *h
  	if (portchange & USB_PORT_STAT_C_OVERCURRENT) {
  		u16 status = 0, unused;
  
diff --git a/target/linux/brcm2708/patches-4.4/0337-drm-panel-simple-Add-the-7-DPI-panel-from-Adafruit.patch b/target/linux/brcm2708/patches-4.4/0337-drm-panel-simple-Add-the-7-DPI-panel-from-Adafruit.patch
index d5218b661c..2c9d3b16ff 100644
--- a/target/linux/brcm2708/patches-4.4/0337-drm-panel-simple-Add-the-7-DPI-panel-from-Adafruit.patch
+++ b/target/linux/brcm2708/patches-4.4/0337-drm-panel-simple-Add-the-7-DPI-panel-from-Adafruit.patch
@@ -33,7 +33,7 @@ Signed-off-by: Thierry Reding <treding@nvidia.com>
 +in simple-panel.txt in this directory.
 --- a/drivers/gpu/drm/panel/panel-simple.c
 +++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -1003,6 +1003,40 @@ static const struct panel_desc okaya_rs8
+@@ -1005,6 +1005,40 @@ static const struct panel_desc okaya_rs8
  	.bus_format = MEDIA_BUS_FMT_RGB666_1X18,
  };
  
@@ -74,7 +74,7 @@ Signed-off-by: Thierry Reding <treding@nvidia.com>
  static const struct drm_display_mode ortustech_com43h4m85ulc_mode  = {
  	.clock = 25000,
  	.hdisplay = 480,
-@@ -1179,6 +1213,9 @@ static const struct of_device_id platfor
+@@ -1181,6 +1215,9 @@ static const struct of_device_id platfor
  		.compatible = "okaya,rs800480t-7x0gp",
  		.data = &okaya_rs800480t_7x0gp,
  	}, {
diff --git a/target/linux/ixp4xx/patches-4.4/160-delayed_uart_io.patch b/target/linux/ixp4xx/patches-4.4/160-delayed_uart_io.patch
index 2bcc801b14..937a65e43a 100644
--- a/target/linux/ixp4xx/patches-4.4/160-delayed_uart_io.patch
+++ b/target/linux/ixp4xx/patches-4.4/160-delayed_uart_io.patch
@@ -115,7 +115,7 @@
  	case UPIO_AU:
  		p->serial_out(p, offset, value);
  		p->serial_in(p, UART_LCR);	/* safe, no side-effects */
-@@ -2457,6 +2477,7 @@ static int serial8250_request_std_resour
+@@ -2460,6 +2480,7 @@ static int serial8250_request_std_resour
  	case UPIO_MEM32:
  	case UPIO_MEM32BE:
  	case UPIO_MEM:
@@ -123,7 +123,7 @@
  		if (!port->mapbase)
  			break;
  
-@@ -2494,6 +2515,7 @@ static void serial8250_release_std_resou
+@@ -2497,6 +2518,7 @@ static void serial8250_release_std_resou
  	case UPIO_MEM32:
  	case UPIO_MEM32BE:
  	case UPIO_MEM:
diff --git a/target/linux/mediatek/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch b/target/linux/mediatek/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
index 48fda9b020..cde0c9c48e 100644
--- a/target/linux/mediatek/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
+++ b/target/linux/mediatek/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
@@ -2512,285 +2512,9 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  {
 -	struct nand_chip *chip = mtd->priv;
 +	struct nand_chip *chip = mtd_to_nand(mtd);
+ 	int chipnr = (int)(to >> chip->chip_shift);
  	struct mtd_oob_ops ops;
  	int ret;
- 
-@@ -2722,15 +2757,12 @@ static int nand_do_write_oob(struct mtd_
- 			     struct mtd_oob_ops *ops)
- {
- 	int chipnr, page, status, len;
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 
- 	pr_debug("%s: to = 0x%08x, len = %i\n",
- 			 __func__, (unsigned int)to, (int)ops->ooblen);
- 
--	if (ops->mode == MTD_OPS_AUTO_OOB)
--		len = chip->ecc.layout->oobavail;
--	else
--		len = mtd->oobsize;
-+	len = mtd_oobavail(mtd, ops);
- 
- 	/* Do not allow write past end of page */
- 	if ((ops->ooboffs + ops->ooblen) > len) {
-@@ -2847,7 +2879,7 @@ out:
-  */
- static int single_erase(struct mtd_info *mtd, int page)
- {
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 	/* Send commands to erase a block */
- 	chip->cmdfunc(mtd, NAND_CMD_ERASE1, -1, page);
- 	chip->cmdfunc(mtd, NAND_CMD_ERASE2, -1, -1);
-@@ -2879,7 +2911,7 @@ int nand_erase_nand(struct mtd_info *mtd
- 		    int allowbbt)
- {
- 	int page, status, pages_per_block, ret, chipnr;
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 	loff_t len;
- 
- 	pr_debug("%s: start = 0x%012llx, len = %llu\n",
-@@ -2918,7 +2950,7 @@ int nand_erase_nand(struct mtd_info *mtd
- 	while (len) {
- 		/* Check if we have a bad block, we do not erase bad blocks! */
- 		if (nand_block_checkbad(mtd, ((loff_t) page) <<
--					chip->page_shift, 0, allowbbt)) {
-+					chip->page_shift, allowbbt)) {
- 			pr_warn("%s: attempt to erase a bad block at page 0x%08x\n",
- 				    __func__, page);
- 			instr->state = MTD_ERASE_FAILED;
-@@ -3005,7 +3037,20 @@ static void nand_sync(struct mtd_info *m
-  */
- static int nand_block_isbad(struct mtd_info *mtd, loff_t offs)
- {
--	return nand_block_checkbad(mtd, offs, 1, 0);
-+	struct nand_chip *chip = mtd_to_nand(mtd);
-+	int chipnr = (int)(offs >> chip->chip_shift);
-+	int ret;
-+
-+	/* Select the NAND device */
-+	nand_get_device(mtd, FL_READING);
-+	chip->select_chip(mtd, chipnr);
-+
-+	ret = nand_block_checkbad(mtd, offs, 0);
-+
-+	chip->select_chip(mtd, -1);
-+	nand_release_device(mtd);
-+
-+	return ret;
- }
- 
- /**
-@@ -3094,7 +3139,7 @@ static int nand_suspend(struct mtd_info
-  */
- static void nand_resume(struct mtd_info *mtd)
- {
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 
- 	if (chip->state == FL_PM_SUSPENDED)
- 		nand_release_device(mtd);
-@@ -3266,7 +3311,7 @@ ext_out:
- 
- static int nand_setup_read_retry_micron(struct mtd_info *mtd, int retry_mode)
- {
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 	uint8_t feature[ONFI_SUBFEATURE_PARAM_LEN] = {retry_mode};
- 
- 	return chip->onfi_set_features(mtd, chip, ONFI_FEATURE_ADDR_READ_RETRY,
-@@ -3937,10 +3982,13 @@ ident_done:
- 	return type;
- }
- 
--static int nand_dt_init(struct mtd_info *mtd, struct nand_chip *chip,
--			struct device_node *dn)
-+static int nand_dt_init(struct nand_chip *chip)
- {
--	int ecc_mode, ecc_strength, ecc_step;
-+	struct device_node *dn = nand_get_flash_node(chip);
-+	int ecc_mode, ecc_algo, ecc_strength, ecc_step;
-+
-+	if (!dn)
-+		return 0;
- 
- 	if (of_get_nand_bus_width(dn) == 16)
- 		chip->options |= NAND_BUSWIDTH_16;
-@@ -3949,6 +3997,7 @@ static int nand_dt_init(struct mtd_info
- 		chip->bbt_options |= NAND_BBT_USE_FLASH;
- 
- 	ecc_mode = of_get_nand_ecc_mode(dn);
-+	ecc_algo = of_get_nand_ecc_algo(dn);
- 	ecc_strength = of_get_nand_ecc_strength(dn);
- 	ecc_step = of_get_nand_ecc_step_size(dn);
- 
-@@ -3961,6 +4010,9 @@ static int nand_dt_init(struct mtd_info
- 	if (ecc_mode >= 0)
- 		chip->ecc.mode = ecc_mode;
- 
-+	if (ecc_algo >= 0)
-+		chip->ecc.algo = ecc_algo;
-+
- 	if (ecc_strength >= 0)
- 		chip->ecc.strength = ecc_strength;
- 
-@@ -3984,15 +4036,16 @@ int nand_scan_ident(struct mtd_info *mtd
- 		    struct nand_flash_dev *table)
- {
- 	int i, nand_maf_id, nand_dev_id;
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 	struct nand_flash_dev *type;
- 	int ret;
- 
--	if (chip->flash_node) {
--		ret = nand_dt_init(mtd, chip, chip->flash_node);
--		if (ret)
--			return ret;
--	}
-+	ret = nand_dt_init(chip);
-+	if (ret)
-+		return ret;
-+
-+	if (!mtd->name && mtd->dev.parent)
-+		mtd->name = dev_name(mtd->dev.parent);
- 
- 	if (!mtd->name && mtd->dev.parent)
- 		mtd->name = dev_name(mtd->dev.parent);
-@@ -4055,7 +4108,7 @@ EXPORT_SYMBOL(nand_scan_ident);
-  */
- static bool nand_ecc_strength_good(struct mtd_info *mtd)
- {
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 	struct nand_ecc_ctrl *ecc = &chip->ecc;
- 	int corr, ds_corr;
- 
-@@ -4083,10 +4136,10 @@ static bool nand_ecc_strength_good(struc
-  */
- int nand_scan_tail(struct mtd_info *mtd)
- {
--	int i;
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 	struct nand_ecc_ctrl *ecc = &chip->ecc;
- 	struct nand_buffers *nbuf;
-+	int ret;
- 
- 	/* New bad blocks should be marked in OOB, flash-based BBT, or both */
- 	BUG_ON((chip->bbt_options & NAND_BBT_NO_OOB_BBM) &&
-@@ -4113,19 +4166,15 @@ int nand_scan_tail(struct mtd_info *mtd)
- 	/*
- 	 * If no default placement scheme is given, select an appropriate one.
- 	 */
--	if (!ecc->layout && (ecc->mode != NAND_ECC_SOFT_BCH)) {
-+	if (!mtd->ooblayout && (ecc->mode != NAND_ECC_SOFT_BCH)) {
- 		switch (mtd->oobsize) {
- 		case 8:
--			ecc->layout = &nand_oob_8;
--			break;
- 		case 16:
--			ecc->layout = &nand_oob_16;
-+			mtd_set_ooblayout(mtd, &nand_ooblayout_sp_ops);
- 			break;
- 		case 64:
--			ecc->layout = &nand_oob_64;
--			break;
- 		case 128:
--			ecc->layout = &nand_oob_128;
-+			mtd_set_ooblayout(mtd, &nand_ooblayout_lp_ops);
- 			break;
- 		default:
- 			pr_warn("No oob scheme defined for oobsize %d\n",
-@@ -4168,7 +4217,7 @@ int nand_scan_tail(struct mtd_info *mtd)
- 			ecc->write_oob = nand_write_oob_std;
- 		if (!ecc->read_subpage)
- 			ecc->read_subpage = nand_read_subpage;
--		if (!ecc->write_subpage)
-+		if (!ecc->write_subpage && ecc->hwctl && ecc->calculate)
- 			ecc->write_subpage = nand_write_subpage_hwecc;
- 
- 	case NAND_ECC_HW_SYNDROME:
-@@ -4246,10 +4295,8 @@ int nand_scan_tail(struct mtd_info *mtd)
- 		}
- 
- 		/* See nand_bch_init() for details. */
--		ecc->bytes = DIV_ROUND_UP(
--				ecc->strength * fls(8 * ecc->size), 8);
--		ecc->priv = nand_bch_init(mtd, ecc->size, ecc->bytes,
--					       &ecc->layout);
-+		ecc->bytes = 0;
-+		ecc->priv = nand_bch_init(mtd);
- 		if (!ecc->priv) {
- 			pr_warn("BCH ECC initialization failed!\n");
- 			BUG();
-@@ -4280,20 +4327,9 @@ int nand_scan_tail(struct mtd_info *mtd)
- 	if (!ecc->write_oob_raw)
- 		ecc->write_oob_raw = ecc->write_oob;
- 
--	/*
--	 * The number of bytes available for a client to place data into
--	 * the out of band area.
--	 */
--	ecc->layout->oobavail = 0;
--	for (i = 0; ecc->layout->oobfree[i].length
--			&& i < ARRAY_SIZE(ecc->layout->oobfree); i++)
--		ecc->layout->oobavail += ecc->layout->oobfree[i].length;
--	mtd->oobavail = ecc->layout->oobavail;
--
--	/* ECC sanity check: warn if it's too weak */
--	if (!nand_ecc_strength_good(mtd))
--		pr_warn("WARNING: %s: the ECC used on your system is too weak compared to the one required by the NAND chip\n",
--			mtd->name);
-+	/* propagate ecc info to mtd_info */
-+	mtd->ecc_strength = ecc->strength;
-+	mtd->ecc_step_size = ecc->size;
- 
- 	/*
- 	 * Set the number of read / write steps for one page depending on ECC
-@@ -4306,6 +4342,21 @@ int nand_scan_tail(struct mtd_info *mtd)
- 	}
- 	ecc->total = ecc->steps * ecc->bytes;
- 
-+	/*
-+	 * The number of bytes available for a client to place data into
-+	 * the out of band area.
-+	 */
-+	ret = mtd_ooblayout_count_freebytes(mtd);
-+	if (ret < 0)
-+		ret = 0;
-+
-+	mtd->oobavail = ret;
-+
-+	/* ECC sanity check: warn if it's too weak */
-+	if (!nand_ecc_strength_good(mtd))
-+		pr_warn("WARNING: %s: the ECC used on your system is too weak compared to the one required by the NAND chip\n",
-+			mtd->name);
-+
- 	/* Allow subpage writes up to ecc.steps. Not possible for MLC flash */
- 	if (!(chip->options & NAND_NO_SUBPAGE_WRITE) && nand_is_slc(chip)) {
- 		switch (ecc->steps) {
-@@ -4362,10 +4413,6 @@ int nand_scan_tail(struct mtd_info *mtd)
- 	mtd->_block_markbad = nand_block_markbad;
- 	mtd->writebufsize = mtd->writesize;
- 
--	/* propagate ecc info to mtd_info */
--	mtd->ecclayout = ecc->layout;
--	mtd->ecc_strength = ecc->strength;
--	mtd->ecc_step_size = ecc->size;
- 	/*
- 	 * Initialize bitflip_threshold to its default prior scan_bbt() call.
- 	 * scan_bbt() might invoke mtd_read(), thus bitflip_threshold must be
-@@ -4421,7 +4468,7 @@ EXPORT_SYMBOL(nand_scan);
-  */
- void nand_release(struct mtd_info *mtd)
- {
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 
- 	if (chip->ecc.mode == NAND_ECC_SOFT_BCH)
- 		nand_bch_free((struct nand_bch_control *)chip->ecc.priv);
 --- a/drivers/mtd/nand/nand_bbt.c
 +++ b/drivers/mtd/nand/nand_bbt.c
 @@ -172,7 +172,7 @@ static int read_bbt(struct mtd_info *mtd
diff --git a/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch b/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
index 48fda9b020..cde0c9c48e 100644
--- a/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
+++ b/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
@@ -2512,285 +2512,9 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  {
 -	struct nand_chip *chip = mtd->priv;
 +	struct nand_chip *chip = mtd_to_nand(mtd);
+ 	int chipnr = (int)(to >> chip->chip_shift);
  	struct mtd_oob_ops ops;
  	int ret;
- 
-@@ -2722,15 +2757,12 @@ static int nand_do_write_oob(struct mtd_
- 			     struct mtd_oob_ops *ops)
- {
- 	int chipnr, page, status, len;
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 
- 	pr_debug("%s: to = 0x%08x, len = %i\n",
- 			 __func__, (unsigned int)to, (int)ops->ooblen);
- 
--	if (ops->mode == MTD_OPS_AUTO_OOB)
--		len = chip->ecc.layout->oobavail;
--	else
--		len = mtd->oobsize;
-+	len = mtd_oobavail(mtd, ops);
- 
- 	/* Do not allow write past end of page */
- 	if ((ops->ooboffs + ops->ooblen) > len) {
-@@ -2847,7 +2879,7 @@ out:
-  */
- static int single_erase(struct mtd_info *mtd, int page)
- {
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 	/* Send commands to erase a block */
- 	chip->cmdfunc(mtd, NAND_CMD_ERASE1, -1, page);
- 	chip->cmdfunc(mtd, NAND_CMD_ERASE2, -1, -1);
-@@ -2879,7 +2911,7 @@ int nand_erase_nand(struct mtd_info *mtd
- 		    int allowbbt)
- {
- 	int page, status, pages_per_block, ret, chipnr;
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 	loff_t len;
- 
- 	pr_debug("%s: start = 0x%012llx, len = %llu\n",
-@@ -2918,7 +2950,7 @@ int nand_erase_nand(struct mtd_info *mtd
- 	while (len) {
- 		/* Check if we have a bad block, we do not erase bad blocks! */
- 		if (nand_block_checkbad(mtd, ((loff_t) page) <<
--					chip->page_shift, 0, allowbbt)) {
-+					chip->page_shift, allowbbt)) {
- 			pr_warn("%s: attempt to erase a bad block at page 0x%08x\n",
- 				    __func__, page);
- 			instr->state = MTD_ERASE_FAILED;
-@@ -3005,7 +3037,20 @@ static void nand_sync(struct mtd_info *m
-  */
- static int nand_block_isbad(struct mtd_info *mtd, loff_t offs)
- {
--	return nand_block_checkbad(mtd, offs, 1, 0);
-+	struct nand_chip *chip = mtd_to_nand(mtd);
-+	int chipnr = (int)(offs >> chip->chip_shift);
-+	int ret;
-+
-+	/* Select the NAND device */
-+	nand_get_device(mtd, FL_READING);
-+	chip->select_chip(mtd, chipnr);
-+
-+	ret = nand_block_checkbad(mtd, offs, 0);
-+
-+	chip->select_chip(mtd, -1);
-+	nand_release_device(mtd);
-+
-+	return ret;
- }
- 
- /**
-@@ -3094,7 +3139,7 @@ static int nand_suspend(struct mtd_info
-  */
- static void nand_resume(struct mtd_info *mtd)
- {
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 
- 	if (chip->state == FL_PM_SUSPENDED)
- 		nand_release_device(mtd);
-@@ -3266,7 +3311,7 @@ ext_out:
- 
- static int nand_setup_read_retry_micron(struct mtd_info *mtd, int retry_mode)
- {
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 	uint8_t feature[ONFI_SUBFEATURE_PARAM_LEN] = {retry_mode};
- 
- 	return chip->onfi_set_features(mtd, chip, ONFI_FEATURE_ADDR_READ_RETRY,
-@@ -3937,10 +3982,13 @@ ident_done:
- 	return type;
- }
- 
--static int nand_dt_init(struct mtd_info *mtd, struct nand_chip *chip,
--			struct device_node *dn)
-+static int nand_dt_init(struct nand_chip *chip)
- {
--	int ecc_mode, ecc_strength, ecc_step;
-+	struct device_node *dn = nand_get_flash_node(chip);
-+	int ecc_mode, ecc_algo, ecc_strength, ecc_step;
-+
-+	if (!dn)
-+		return 0;
- 
- 	if (of_get_nand_bus_width(dn) == 16)
- 		chip->options |= NAND_BUSWIDTH_16;
-@@ -3949,6 +3997,7 @@ static int nand_dt_init(struct mtd_info
- 		chip->bbt_options |= NAND_BBT_USE_FLASH;
- 
- 	ecc_mode = of_get_nand_ecc_mode(dn);
-+	ecc_algo = of_get_nand_ecc_algo(dn);
- 	ecc_strength = of_get_nand_ecc_strength(dn);
- 	ecc_step = of_get_nand_ecc_step_size(dn);
- 
-@@ -3961,6 +4010,9 @@ static int nand_dt_init(struct mtd_info
- 	if (ecc_mode >= 0)
- 		chip->ecc.mode = ecc_mode;
- 
-+	if (ecc_algo >= 0)
-+		chip->ecc.algo = ecc_algo;
-+
- 	if (ecc_strength >= 0)
- 		chip->ecc.strength = ecc_strength;
- 
-@@ -3984,15 +4036,16 @@ int nand_scan_ident(struct mtd_info *mtd
- 		    struct nand_flash_dev *table)
- {
- 	int i, nand_maf_id, nand_dev_id;
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 	struct nand_flash_dev *type;
- 	int ret;
- 
--	if (chip->flash_node) {
--		ret = nand_dt_init(mtd, chip, chip->flash_node);
--		if (ret)
--			return ret;
--	}
-+	ret = nand_dt_init(chip);
-+	if (ret)
-+		return ret;
-+
-+	if (!mtd->name && mtd->dev.parent)
-+		mtd->name = dev_name(mtd->dev.parent);
- 
- 	if (!mtd->name && mtd->dev.parent)
- 		mtd->name = dev_name(mtd->dev.parent);
-@@ -4055,7 +4108,7 @@ EXPORT_SYMBOL(nand_scan_ident);
-  */
- static bool nand_ecc_strength_good(struct mtd_info *mtd)
- {
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 	struct nand_ecc_ctrl *ecc = &chip->ecc;
- 	int corr, ds_corr;
- 
-@@ -4083,10 +4136,10 @@ static bool nand_ecc_strength_good(struc
-  */
- int nand_scan_tail(struct mtd_info *mtd)
- {
--	int i;
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 	struct nand_ecc_ctrl *ecc = &chip->ecc;
- 	struct nand_buffers *nbuf;
-+	int ret;
- 
- 	/* New bad blocks should be marked in OOB, flash-based BBT, or both */
- 	BUG_ON((chip->bbt_options & NAND_BBT_NO_OOB_BBM) &&
-@@ -4113,19 +4166,15 @@ int nand_scan_tail(struct mtd_info *mtd)
- 	/*
- 	 * If no default placement scheme is given, select an appropriate one.
- 	 */
--	if (!ecc->layout && (ecc->mode != NAND_ECC_SOFT_BCH)) {
-+	if (!mtd->ooblayout && (ecc->mode != NAND_ECC_SOFT_BCH)) {
- 		switch (mtd->oobsize) {
- 		case 8:
--			ecc->layout = &nand_oob_8;
--			break;
- 		case 16:
--			ecc->layout = &nand_oob_16;
-+			mtd_set_ooblayout(mtd, &nand_ooblayout_sp_ops);
- 			break;
- 		case 64:
--			ecc->layout = &nand_oob_64;
--			break;
- 		case 128:
--			ecc->layout = &nand_oob_128;
-+			mtd_set_ooblayout(mtd, &nand_ooblayout_lp_ops);
- 			break;
- 		default:
- 			pr_warn("No oob scheme defined for oobsize %d\n",
-@@ -4168,7 +4217,7 @@ int nand_scan_tail(struct mtd_info *mtd)
- 			ecc->write_oob = nand_write_oob_std;
- 		if (!ecc->read_subpage)
- 			ecc->read_subpage = nand_read_subpage;
--		if (!ecc->write_subpage)
-+		if (!ecc->write_subpage && ecc->hwctl && ecc->calculate)
- 			ecc->write_subpage = nand_write_subpage_hwecc;
- 
- 	case NAND_ECC_HW_SYNDROME:
-@@ -4246,10 +4295,8 @@ int nand_scan_tail(struct mtd_info *mtd)
- 		}
- 
- 		/* See nand_bch_init() for details. */
--		ecc->bytes = DIV_ROUND_UP(
--				ecc->strength * fls(8 * ecc->size), 8);
--		ecc->priv = nand_bch_init(mtd, ecc->size, ecc->bytes,
--					       &ecc->layout);
-+		ecc->bytes = 0;
-+		ecc->priv = nand_bch_init(mtd);
- 		if (!ecc->priv) {
- 			pr_warn("BCH ECC initialization failed!\n");
- 			BUG();
-@@ -4280,20 +4327,9 @@ int nand_scan_tail(struct mtd_info *mtd)
- 	if (!ecc->write_oob_raw)
- 		ecc->write_oob_raw = ecc->write_oob;
- 
--	/*
--	 * The number of bytes available for a client to place data into
--	 * the out of band area.
--	 */
--	ecc->layout->oobavail = 0;
--	for (i = 0; ecc->layout->oobfree[i].length
--			&& i < ARRAY_SIZE(ecc->layout->oobfree); i++)
--		ecc->layout->oobavail += ecc->layout->oobfree[i].length;
--	mtd->oobavail = ecc->layout->oobavail;
--
--	/* ECC sanity check: warn if it's too weak */
--	if (!nand_ecc_strength_good(mtd))
--		pr_warn("WARNING: %s: the ECC used on your system is too weak compared to the one required by the NAND chip\n",
--			mtd->name);
-+	/* propagate ecc info to mtd_info */
-+	mtd->ecc_strength = ecc->strength;
-+	mtd->ecc_step_size = ecc->size;
- 
- 	/*
- 	 * Set the number of read / write steps for one page depending on ECC
-@@ -4306,6 +4342,21 @@ int nand_scan_tail(struct mtd_info *mtd)
- 	}
- 	ecc->total = ecc->steps * ecc->bytes;
- 
-+	/*
-+	 * The number of bytes available for a client to place data into
-+	 * the out of band area.
-+	 */
-+	ret = mtd_ooblayout_count_freebytes(mtd);
-+	if (ret < 0)
-+		ret = 0;
-+
-+	mtd->oobavail = ret;
-+
-+	/* ECC sanity check: warn if it's too weak */
-+	if (!nand_ecc_strength_good(mtd))
-+		pr_warn("WARNING: %s: the ECC used on your system is too weak compared to the one required by the NAND chip\n",
-+			mtd->name);
-+
- 	/* Allow subpage writes up to ecc.steps. Not possible for MLC flash */
- 	if (!(chip->options & NAND_NO_SUBPAGE_WRITE) && nand_is_slc(chip)) {
- 		switch (ecc->steps) {
-@@ -4362,10 +4413,6 @@ int nand_scan_tail(struct mtd_info *mtd)
- 	mtd->_block_markbad = nand_block_markbad;
- 	mtd->writebufsize = mtd->writesize;
- 
--	/* propagate ecc info to mtd_info */
--	mtd->ecclayout = ecc->layout;
--	mtd->ecc_strength = ecc->strength;
--	mtd->ecc_step_size = ecc->size;
- 	/*
- 	 * Initialize bitflip_threshold to its default prior scan_bbt() call.
- 	 * scan_bbt() might invoke mtd_read(), thus bitflip_threshold must be
-@@ -4421,7 +4468,7 @@ EXPORT_SYMBOL(nand_scan);
-  */
- void nand_release(struct mtd_info *mtd)
- {
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 
- 	if (chip->ecc.mode == NAND_ECC_SOFT_BCH)
- 		nand_bch_free((struct nand_bch_control *)chip->ecc.priv);
 --- a/drivers/mtd/nand/nand_bbt.c
 +++ b/drivers/mtd/nand/nand_bbt.c
 @@ -172,7 +172,7 @@ static int read_bbt(struct mtd_info *mtd
diff --git a/target/linux/oxnas/patches-4.4/0074-mtd-nand-import-nand_hw_control_init.patch b/target/linux/oxnas/patches-4.4/0074-mtd-nand-import-nand_hw_control_init.patch
index 4b3260c41b..cf3bd2815b 100644
--- a/target/linux/oxnas/patches-4.4/0074-mtd-nand-import-nand_hw_control_init.patch
+++ b/target/linux/oxnas/patches-4.4/0074-mtd-nand-import-nand_hw_control_init.patch
@@ -87,7 +87,7 @@ Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
  	}
 --- a/drivers/mtd/nand/nand_base.c
 +++ b/drivers/mtd/nand/nand_base.c
-@@ -3202,8 +3202,7 @@ static void nand_set_defaults(struct nan
+@@ -3195,8 +3195,7 @@ static void nand_set_defaults(struct nan
  
  	if (!chip->controller) {
  		chip->controller = &chip->hwcontrol;
diff --git a/target/linux/ramips/patches-4.4/0040-nand-add-mtk-nand-hack-hook.patch b/target/linux/ramips/patches-4.4/0040-nand-add-mtk-nand-hack-hook.patch
index 254bf5286a..e7f4d893f6 100644
--- a/target/linux/ramips/patches-4.4/0040-nand-add-mtk-nand-hack-hook.patch
+++ b/target/linux/ramips/patches-4.4/0040-nand-add-mtk-nand-hack-hook.patch
@@ -118,7 +118,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			if (ret < 0) {
  				if (use_bufpoi)
  					/* Invalidate page cache */
-@@ -2932,8 +2936,11 @@ int nand_erase_nand(struct mtd_info *mtd
+@@ -2935,8 +2939,11 @@ int nand_erase_nand(struct mtd_info *mtd
  		if (page <= chip->pagebuf && chip->pagebuf <
  		    (page + pages_per_block))
  			chip->pagebuf = -1;
diff --git a/target/linux/ramips/patches-4.4/0901-spansion_nand_id_fix.patch b/target/linux/ramips/patches-4.4/0901-spansion_nand_id_fix.patch
index e4853a8c51..7091085958 100644
--- a/target/linux/ramips/patches-4.4/0901-spansion_nand_id_fix.patch
+++ b/target/linux/ramips/patches-4.4/0901-spansion_nand_id_fix.patch
@@ -13,7 +13,7 @@ Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
 
 --- a/drivers/mtd/nand/nand_base.c
 +++ b/drivers/mtd/nand/nand_base.c
-@@ -3568,6 +3568,7 @@ static void nand_decode_ext_id(struct mt
+@@ -3571,6 +3571,7 @@ static void nand_decode_ext_id(struct mt
  	/*
  	 * Field definitions are in the following datasheets:
  	 * Old style (4,5 byte ID): Samsung K9GAG08U0M (p.32)
@@ -21,7 +21,7 @@ Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
  	 * New Samsung (6 byte ID): Samsung K9GAG08U0F (p.44)
  	 * Hynix MLC   (6 byte ID): Hynix H27UBG8T2B (p.22)
  	 *
-@@ -3665,6 +3666,19 @@ static void nand_decode_ext_id(struct mt
+@@ -3668,6 +3669,19 @@ static void nand_decode_ext_id(struct mt
  		*busw = (extid & 0x01) ? NAND_BUSWIDTH_16 : 0;
  
  		/*
