diff --git a/include/kernel-version.mk b/include/kernel-version.mk
index e90a3c70ab..e35827dfb3 100644
--- a/include/kernel-version.mk
+++ b/include/kernel-version.mk
@@ -3,10 +3,10 @@
 LINUX_RELEASE?=1
 
 LINUX_VERSION-3.18 = .43
-LINUX_VERSION-4.4 = .103
+LINUX_VERSION-4.4 = .106
 
 LINUX_KERNEL_HASH-3.18.43 = 1236e8123a6ce537d5029232560966feed054ae31776fe8481dd7d18cdd5492c
-LINUX_KERNEL_HASH-4.4.103 = 1d01d0785fdf52b3f3b9f7ad05b6cff6be034869935962478e19f265b022f904
+LINUX_KERNEL_HASH-4.4.106 = fe90300fe95756a19bcddd148b4359b6dd549d3bbe03587b179d4220781deb40
 
 ifdef KERNEL_PATCHVER
   LINUX_VERSION:=$(KERNEL_PATCHVER)$(strip $(LINUX_VERSION-$(KERNEL_PATCHVER)))
diff --git a/target/linux/ar71xx/patches-4.4/432-spi-rb4xx-spi-driver.patch b/target/linux/ar71xx/patches-4.4/432-spi-rb4xx-spi-driver.patch
index d6b71be46a..7d99c43b95 100644
--- a/target/linux/ar71xx/patches-4.4/432-spi-rb4xx-spi-driver.patch
+++ b/target/linux/ar71xx/patches-4.4/432-spi-rb4xx-spi-driver.patch
@@ -1,6 +1,6 @@
 --- a/drivers/spi/Kconfig
 +++ b/drivers/spi/Kconfig
-@@ -478,6 +478,12 @@ config SPI_QUP
+@@ -477,6 +477,12 @@ config SPI_QUP
  	  This driver can also be built as a module.  If so, the module
  	  will be called spi_qup.
  
diff --git a/target/linux/ar71xx/patches-4.4/433-spi-rb4xx-cpld-driver.patch b/target/linux/ar71xx/patches-4.4/433-spi-rb4xx-cpld-driver.patch
index 61c186ce9e..0932c729f9 100644
--- a/target/linux/ar71xx/patches-4.4/433-spi-rb4xx-cpld-driver.patch
+++ b/target/linux/ar71xx/patches-4.4/433-spi-rb4xx-cpld-driver.patch
@@ -1,6 +1,6 @@
 --- a/drivers/spi/Kconfig
 +++ b/drivers/spi/Kconfig
-@@ -714,6 +714,13 @@ config SPI_TLE62X0
+@@ -713,6 +713,13 @@ config SPI_TLE62X0
  	  sysfs interface, with each line presented as a kind of GPIO
  	  exposing both switch control and diagnostic feedback.
  
diff --git a/target/linux/ar71xx/patches-4.4/435-spi-vsc7385_driver.patch b/target/linux/ar71xx/patches-4.4/435-spi-vsc7385_driver.patch
index 94dd1d4508..880c088c56 100644
--- a/target/linux/ar71xx/patches-4.4/435-spi-vsc7385_driver.patch
+++ b/target/linux/ar71xx/patches-4.4/435-spi-vsc7385_driver.patch
@@ -1,6 +1,6 @@
 --- a/drivers/spi/Kconfig
 +++ b/drivers/spi/Kconfig
-@@ -721,6 +721,11 @@ config SPI_RB4XX_CPLD
+@@ -720,6 +720,11 @@ config SPI_RB4XX_CPLD
  	  SPI driver for the Xilinx CPLD chip present on the
  	  MikroTik RB4xx boards.
  
diff --git a/target/linux/brcm2708/patches-4.4/0029-Add-dwc_otg-driver.patch b/target/linux/brcm2708/patches-4.4/0029-Add-dwc_otg-driver.patch
index 8e9657abcf..1f652dc998 100644
--- a/target/linux/brcm2708/patches-4.4/0029-Add-dwc_otg-driver.patch
+++ b/target/linux/brcm2708/patches-4.4/0029-Add-dwc_otg-driver.patch
@@ -659,7 +659,7 @@ dwc_otg: Remove duplicate gadget probe/unregister function
  }
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
-@@ -4978,7 +4978,7 @@ static void port_event(struct usb_hub *h
+@@ -4987,7 +4987,7 @@ static void port_event(struct usb_hub *h
  	if (portchange & USB_PORT_STAT_C_OVERCURRENT) {
  		u16 status = 0, unused;
  
diff --git a/target/linux/brcm2708/patches-4.4/0112-drm-Put-an-optional-field-in-the-driver-struct-for-G.patch b/target/linux/brcm2708/patches-4.4/0112-drm-Put-an-optional-field-in-the-driver-struct-for-G.patch
index 7fbaa27ca2..10c5e43fdf 100644
--- a/target/linux/brcm2708/patches-4.4/0112-drm-Put-an-optional-field-in-the-driver-struct-for-G.patch
+++ b/target/linux/brcm2708/patches-4.4/0112-drm-Put-an-optional-field-in-the-driver-struct-for-G.patch
@@ -30,7 +30,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
  
 --- a/include/drm/drmP.h
 +++ b/include/drm/drmP.h
-@@ -639,6 +639,7 @@ struct drm_driver {
+@@ -653,6 +653,7 @@ struct drm_driver {
  
  	u32 driver_features;
  	int dev_priv_size;
diff --git a/target/linux/brcm2708/patches-4.4/0114-drm-vc4-Update-a-bunch-of-code-to-match-upstream-sub.patch b/target/linux/brcm2708/patches-4.4/0114-drm-vc4-Update-a-bunch-of-code-to-match-upstream-sub.patch
index 29321c338e..8d8711d082 100644
--- a/target/linux/brcm2708/patches-4.4/0114-drm-vc4-Update-a-bunch-of-code-to-match-upstream-sub.patch
+++ b/target/linux/brcm2708/patches-4.4/0114-drm-vc4-Update-a-bunch-of-code-to-match-upstream-sub.patch
@@ -1869,7 +1869,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
  	}
 --- a/include/drm/drmP.h
 +++ b/include/drm/drmP.h
-@@ -585,6 +585,13 @@ struct drm_driver {
+@@ -599,6 +599,13 @@ struct drm_driver {
  	int (*gem_open_object) (struct drm_gem_object *, struct drm_file *);
  	void (*gem_close_object) (struct drm_gem_object *, struct drm_file *);
  
@@ -1883,7 +1883,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>
  	/* prime: */
  	/* export handle -> fd (see drm_gem_prime_handle_to_fd() helper) */
  	int (*prime_handle_to_fd)(struct drm_device *dev, struct drm_file *file_priv,
-@@ -639,7 +646,6 @@ struct drm_driver {
+@@ -653,7 +660,6 @@ struct drm_driver {
  
  	u32 driver_features;
  	int dev_priv_size;
diff --git a/target/linux/brcm2708/patches-4.4/0337-drm-panel-simple-Add-the-7-DPI-panel-from-Adafruit.patch b/target/linux/brcm2708/patches-4.4/0337-drm-panel-simple-Add-the-7-DPI-panel-from-Adafruit.patch
index d5218b661c..2c9d3b16ff 100644
--- a/target/linux/brcm2708/patches-4.4/0337-drm-panel-simple-Add-the-7-DPI-panel-from-Adafruit.patch
+++ b/target/linux/brcm2708/patches-4.4/0337-drm-panel-simple-Add-the-7-DPI-panel-from-Adafruit.patch
@@ -33,7 +33,7 @@ Signed-off-by: Thierry Reding <treding@nvidia.com>
 +in simple-panel.txt in this directory.
 --- a/drivers/gpu/drm/panel/panel-simple.c
 +++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -1003,6 +1003,40 @@ static const struct panel_desc okaya_rs8
+@@ -1005,6 +1005,40 @@ static const struct panel_desc okaya_rs8
  	.bus_format = MEDIA_BUS_FMT_RGB666_1X18,
  };
  
@@ -74,7 +74,7 @@ Signed-off-by: Thierry Reding <treding@nvidia.com>
  static const struct drm_display_mode ortustech_com43h4m85ulc_mode  = {
  	.clock = 25000,
  	.hdisplay = 480,
-@@ -1179,6 +1213,9 @@ static const struct of_device_id platfor
+@@ -1181,6 +1215,9 @@ static const struct of_device_id platfor
  		.compatible = "okaya,rs800480t-7x0gp",
  		.data = &okaya_rs800480t_7x0gp,
  	}, {
diff --git a/target/linux/generic/patches-4.4/630-packet_socket_type.patch b/target/linux/generic/patches-4.4/630-packet_socket_type.patch
index a427165f41..0314938ac4 100644
--- a/target/linux/generic/patches-4.4/630-packet_socket_type.patch
+++ b/target/linux/generic/patches-4.4/630-packet_socket_type.patch
@@ -26,7 +26,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #define PACKET_FANOUT_LB		1
 --- a/net/packet/af_packet.c
 +++ b/net/packet/af_packet.c
-@@ -1784,6 +1784,7 @@ static int packet_rcv_spkt(struct sk_buf
+@@ -1777,6 +1777,7 @@ static int packet_rcv_spkt(struct sk_buf
  {
  	struct sock *sk;
  	struct sockaddr_pkt *spkt;
@@ -34,7 +34,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	/*
  	 *	When we registered the protocol we saved the socket in the data
-@@ -1791,6 +1792,7 @@ static int packet_rcv_spkt(struct sk_buf
+@@ -1784,6 +1785,7 @@ static int packet_rcv_spkt(struct sk_buf
  	 */
  
  	sk = pt->af_packet_priv;
@@ -42,7 +42,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	/*
  	 *	Yank back the headers [hope the device set this
-@@ -1803,7 +1805,7 @@ static int packet_rcv_spkt(struct sk_buf
+@@ -1796,7 +1798,7 @@ static int packet_rcv_spkt(struct sk_buf
  	 *	so that this procedure is noop.
  	 */
  
@@ -51,7 +51,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		goto out;
  
  	if (!net_eq(dev_net(dev), sock_net(sk)))
-@@ -2006,12 +2008,12 @@ static int packet_rcv(struct sk_buff *sk
+@@ -1999,12 +2001,12 @@ static int packet_rcv(struct sk_buff *sk
  	int skb_len = skb->len;
  	unsigned int snaplen, res;
  
@@ -67,7 +67,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!net_eq(dev_net(dev), sock_net(sk)))
  		goto drop;
  
-@@ -2131,12 +2133,12 @@ static int tpacket_rcv(struct sk_buff *s
+@@ -2124,12 +2126,12 @@ static int tpacket_rcv(struct sk_buff *s
  	BUILD_BUG_ON(TPACKET_ALIGN(sizeof(*h.h2)) != 32);
  	BUILD_BUG_ON(TPACKET_ALIGN(sizeof(*h.h3)) != 48);
  
@@ -83,7 +83,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!net_eq(dev_net(dev), sock_net(sk)))
  		goto drop;
  
-@@ -3127,6 +3129,7 @@ static int packet_create(struct net *net
+@@ -3126,6 +3128,7 @@ static int packet_create(struct net *net
  	mutex_init(&po->pg_vec_lock);
  	po->rollover = NULL;
  	po->prot_hook.func = packet_rcv;
@@ -91,7 +91,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	if (sock->type == SOCK_PACKET)
  		po->prot_hook.func = packet_rcv_spkt;
-@@ -3756,6 +3759,16 @@ packet_setsockopt(struct socket *sock, i
+@@ -3755,6 +3758,16 @@ packet_setsockopt(struct socket *sock, i
  		po->xmit = val ? packet_direct_xmit : dev_queue_xmit;
  		return 0;
  	}
@@ -108,7 +108,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	default:
  		return -ENOPROTOOPT;
  	}
-@@ -3809,6 +3822,13 @@ static int packet_getsockopt(struct sock
+@@ -3807,6 +3820,13 @@ static int packet_getsockopt(struct sock
  	case PACKET_VNET_HDR:
  		val = po->has_vnet_hdr;
  		break;
@@ -124,7 +124,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		break;
 --- a/net/packet/internal.h
 +++ b/net/packet/internal.h
-@@ -129,6 +129,7 @@ struct packet_sock {
+@@ -128,6 +128,7 @@ struct packet_sock {
  	struct net_device __rcu	*cached_dev;
  	int			(*xmit)(struct sk_buff *skb);
  	struct packet_type	prot_hook ____cacheline_aligned_in_smp;
diff --git a/target/linux/ixp4xx/patches-4.4/160-delayed_uart_io.patch b/target/linux/ixp4xx/patches-4.4/160-delayed_uart_io.patch
index 2bcc801b14..937a65e43a 100644
--- a/target/linux/ixp4xx/patches-4.4/160-delayed_uart_io.patch
+++ b/target/linux/ixp4xx/patches-4.4/160-delayed_uart_io.patch
@@ -115,7 +115,7 @@
  	case UPIO_AU:
  		p->serial_out(p, offset, value);
  		p->serial_in(p, UART_LCR);	/* safe, no side-effects */
-@@ -2457,6 +2477,7 @@ static int serial8250_request_std_resour
+@@ -2460,6 +2480,7 @@ static int serial8250_request_std_resour
  	case UPIO_MEM32:
  	case UPIO_MEM32BE:
  	case UPIO_MEM:
@@ -123,7 +123,7 @@
  		if (!port->mapbase)
  			break;
  
-@@ -2494,6 +2515,7 @@ static void serial8250_release_std_resou
+@@ -2497,6 +2518,7 @@ static void serial8250_release_std_resou
  	case UPIO_MEM32:
  	case UPIO_MEM32BE:
  	case UPIO_MEM:
diff --git a/target/linux/lantiq/patches-4.4/0100-spi-add-support-for-Lantiq-SPI-controller.patch b/target/linux/lantiq/patches-4.4/0100-spi-add-support-for-Lantiq-SPI-controller.patch
index daec87c433..3dc60a7032 100644
--- a/target/linux/lantiq/patches-4.4/0100-spi-add-support-for-Lantiq-SPI-controller.patch
+++ b/target/linux/lantiq/patches-4.4/0100-spi-add-support-for-Lantiq-SPI-controller.patch
@@ -13,7 +13,7 @@ Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
 
 --- a/drivers/spi/Kconfig
 +++ b/drivers/spi/Kconfig
-@@ -356,6 +356,13 @@ config SPI_MT65XX
+@@ -355,6 +355,13 @@ config SPI_MT65XX
  	  say Y or M here.If you are not sure, say N.
  	  SPI drivers for Mediatek MT65XX and MT81XX series ARM SoCs.
  
diff --git a/target/linux/mediatek/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch b/target/linux/mediatek/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
index 48fda9b020..e1964123a0 100644
--- a/target/linux/mediatek/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
+++ b/target/linux/mediatek/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
@@ -2506,16 +2506,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	uint8_t *oob = ops->oobbuf;
  	uint8_t *buf = ops->datbuf;
-@@ -2662,7 +2697,7 @@ err_out:
- static int panic_nand_write(struct mtd_info *mtd, loff_t to, size_t len,
- 			    size_t *retlen, const uint8_t *buf)
- {
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 	struct mtd_oob_ops ops;
- 	int ret;
- 
-@@ -2722,15 +2757,12 @@ static int nand_do_write_oob(struct mtd_
+@@ -2725,15 +2760,12 @@ static int nand_do_write_oob(struct mtd_
  			     struct mtd_oob_ops *ops)
  {
  	int chipnr, page, status, len;
@@ -2533,7 +2524,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/* Do not allow write past end of page */
  	if ((ops->ooboffs + ops->ooblen) > len) {
-@@ -2847,7 +2879,7 @@ out:
+@@ -2850,7 +2882,7 @@ out:
   */
  static int single_erase(struct mtd_info *mtd, int page)
  {
@@ -2542,7 +2533,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	/* Send commands to erase a block */
  	chip->cmdfunc(mtd, NAND_CMD_ERASE1, -1, page);
  	chip->cmdfunc(mtd, NAND_CMD_ERASE2, -1, -1);
-@@ -2879,7 +2911,7 @@ int nand_erase_nand(struct mtd_info *mtd
+@@ -2882,7 +2914,7 @@ int nand_erase_nand(struct mtd_info *mtd
  		    int allowbbt)
  {
  	int page, status, pages_per_block, ret, chipnr;
@@ -2551,7 +2542,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	loff_t len;
  
  	pr_debug("%s: start = 0x%012llx, len = %llu\n",
-@@ -2918,7 +2950,7 @@ int nand_erase_nand(struct mtd_info *mtd
+@@ -2921,7 +2953,7 @@ int nand_erase_nand(struct mtd_info *mtd
  	while (len) {
  		/* Check if we have a bad block, we do not erase bad blocks! */
  		if (nand_block_checkbad(mtd, ((loff_t) page) <<
@@ -2560,7 +2551,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			pr_warn("%s: attempt to erase a bad block at page 0x%08x\n",
  				    __func__, page);
  			instr->state = MTD_ERASE_FAILED;
-@@ -3005,7 +3037,20 @@ static void nand_sync(struct mtd_info *m
+@@ -3008,7 +3040,20 @@ static void nand_sync(struct mtd_info *m
   */
  static int nand_block_isbad(struct mtd_info *mtd, loff_t offs)
  {
@@ -2582,7 +2573,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  }
  
  /**
-@@ -3094,7 +3139,7 @@ static int nand_suspend(struct mtd_info
+@@ -3097,7 +3142,7 @@ static int nand_suspend(struct mtd_info
   */
  static void nand_resume(struct mtd_info *mtd)
  {
@@ -2591,7 +2582,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	if (chip->state == FL_PM_SUSPENDED)
  		nand_release_device(mtd);
-@@ -3266,7 +3311,7 @@ ext_out:
+@@ -3269,7 +3314,7 @@ ext_out:
  
  static int nand_setup_read_retry_micron(struct mtd_info *mtd, int retry_mode)
  {
@@ -2600,7 +2591,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	uint8_t feature[ONFI_SUBFEATURE_PARAM_LEN] = {retry_mode};
  
  	return chip->onfi_set_features(mtd, chip, ONFI_FEATURE_ADDR_READ_RETRY,
-@@ -3937,10 +3982,13 @@ ident_done:
+@@ -3940,10 +3985,13 @@ ident_done:
  	return type;
  }
  
@@ -2617,7 +2608,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	if (of_get_nand_bus_width(dn) == 16)
  		chip->options |= NAND_BUSWIDTH_16;
-@@ -3949,6 +3997,7 @@ static int nand_dt_init(struct mtd_info
+@@ -3952,6 +4000,7 @@ static int nand_dt_init(struct mtd_info
  		chip->bbt_options |= NAND_BBT_USE_FLASH;
  
  	ecc_mode = of_get_nand_ecc_mode(dn);
@@ -2625,7 +2616,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	ecc_strength = of_get_nand_ecc_strength(dn);
  	ecc_step = of_get_nand_ecc_step_size(dn);
  
-@@ -3961,6 +4010,9 @@ static int nand_dt_init(struct mtd_info
+@@ -3964,6 +4013,9 @@ static int nand_dt_init(struct mtd_info
  	if (ecc_mode >= 0)
  		chip->ecc.mode = ecc_mode;
  
@@ -2635,7 +2626,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	if (ecc_strength >= 0)
  		chip->ecc.strength = ecc_strength;
  
-@@ -3984,15 +4036,16 @@ int nand_scan_ident(struct mtd_info *mtd
+@@ -3987,15 +4039,16 @@ int nand_scan_ident(struct mtd_info *mtd
  		    struct nand_flash_dev *table)
  {
  	int i, nand_maf_id, nand_dev_id;
@@ -2658,7 +2649,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	if (!mtd->name && mtd->dev.parent)
  		mtd->name = dev_name(mtd->dev.parent);
-@@ -4055,7 +4108,7 @@ EXPORT_SYMBOL(nand_scan_ident);
+@@ -4058,7 +4111,7 @@ EXPORT_SYMBOL(nand_scan_ident);
   */
  static bool nand_ecc_strength_good(struct mtd_info *mtd)
  {
@@ -2667,7 +2658,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	struct nand_ecc_ctrl *ecc = &chip->ecc;
  	int corr, ds_corr;
  
-@@ -4083,10 +4136,10 @@ static bool nand_ecc_strength_good(struc
+@@ -4086,10 +4139,10 @@ static bool nand_ecc_strength_good(struc
   */
  int nand_scan_tail(struct mtd_info *mtd)
  {
@@ -2680,7 +2671,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/* New bad blocks should be marked in OOB, flash-based BBT, or both */
  	BUG_ON((chip->bbt_options & NAND_BBT_NO_OOB_BBM) &&
-@@ -4113,19 +4166,15 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4116,19 +4169,15 @@ int nand_scan_tail(struct mtd_info *mtd)
  	/*
  	 * If no default placement scheme is given, select an appropriate one.
  	 */
@@ -2703,7 +2694,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			break;
  		default:
  			pr_warn("No oob scheme defined for oobsize %d\n",
-@@ -4168,7 +4217,7 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4171,7 +4220,7 @@ int nand_scan_tail(struct mtd_info *mtd)
  			ecc->write_oob = nand_write_oob_std;
  		if (!ecc->read_subpage)
  			ecc->read_subpage = nand_read_subpage;
@@ -2712,7 +2703,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			ecc->write_subpage = nand_write_subpage_hwecc;
  
  	case NAND_ECC_HW_SYNDROME:
-@@ -4246,10 +4295,8 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4249,10 +4298,8 @@ int nand_scan_tail(struct mtd_info *mtd)
  		}
  
  		/* See nand_bch_init() for details. */
@@ -2725,7 +2716,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  		if (!ecc->priv) {
  			pr_warn("BCH ECC initialization failed!\n");
  			BUG();
-@@ -4280,20 +4327,9 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4283,20 +4330,9 @@ int nand_scan_tail(struct mtd_info *mtd)
  	if (!ecc->write_oob_raw)
  		ecc->write_oob_raw = ecc->write_oob;
  
@@ -2749,7 +2740,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/*
  	 * Set the number of read / write steps for one page depending on ECC
-@@ -4306,6 +4342,21 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4309,6 +4345,21 @@ int nand_scan_tail(struct mtd_info *mtd)
  	}
  	ecc->total = ecc->steps * ecc->bytes;
  
@@ -2771,7 +2762,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	/* Allow subpage writes up to ecc.steps. Not possible for MLC flash */
  	if (!(chip->options & NAND_NO_SUBPAGE_WRITE) && nand_is_slc(chip)) {
  		switch (ecc->steps) {
-@@ -4362,10 +4413,6 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4365,10 +4416,6 @@ int nand_scan_tail(struct mtd_info *mtd)
  	mtd->_block_markbad = nand_block_markbad;
  	mtd->writebufsize = mtd->writesize;
  
@@ -2782,7 +2773,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	/*
  	 * Initialize bitflip_threshold to its default prior scan_bbt() call.
  	 * scan_bbt() might invoke mtd_read(), thus bitflip_threshold must be
-@@ -4421,7 +4468,7 @@ EXPORT_SYMBOL(nand_scan);
+@@ -4424,7 +4471,7 @@ EXPORT_SYMBOL(nand_scan);
   */
  void nand_release(struct mtd_info *mtd)
  {
diff --git a/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch b/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
index 48fda9b020..e1964123a0 100644
--- a/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
+++ b/target/linux/oxnas/patches-4.4/0072-mtd-backport-v4.7-0day-patches-from-Boris.patch
@@ -2506,16 +2506,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	uint8_t *oob = ops->oobbuf;
  	uint8_t *buf = ops->datbuf;
-@@ -2662,7 +2697,7 @@ err_out:
- static int panic_nand_write(struct mtd_info *mtd, loff_t to, size_t len,
- 			    size_t *retlen, const uint8_t *buf)
- {
--	struct nand_chip *chip = mtd->priv;
-+	struct nand_chip *chip = mtd_to_nand(mtd);
- 	struct mtd_oob_ops ops;
- 	int ret;
- 
-@@ -2722,15 +2757,12 @@ static int nand_do_write_oob(struct mtd_
+@@ -2725,15 +2760,12 @@ static int nand_do_write_oob(struct mtd_
  			     struct mtd_oob_ops *ops)
  {
  	int chipnr, page, status, len;
@@ -2533,7 +2524,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/* Do not allow write past end of page */
  	if ((ops->ooboffs + ops->ooblen) > len) {
-@@ -2847,7 +2879,7 @@ out:
+@@ -2850,7 +2882,7 @@ out:
   */
  static int single_erase(struct mtd_info *mtd, int page)
  {
@@ -2542,7 +2533,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	/* Send commands to erase a block */
  	chip->cmdfunc(mtd, NAND_CMD_ERASE1, -1, page);
  	chip->cmdfunc(mtd, NAND_CMD_ERASE2, -1, -1);
-@@ -2879,7 +2911,7 @@ int nand_erase_nand(struct mtd_info *mtd
+@@ -2882,7 +2914,7 @@ int nand_erase_nand(struct mtd_info *mtd
  		    int allowbbt)
  {
  	int page, status, pages_per_block, ret, chipnr;
@@ -2551,7 +2542,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	loff_t len;
  
  	pr_debug("%s: start = 0x%012llx, len = %llu\n",
-@@ -2918,7 +2950,7 @@ int nand_erase_nand(struct mtd_info *mtd
+@@ -2921,7 +2953,7 @@ int nand_erase_nand(struct mtd_info *mtd
  	while (len) {
  		/* Check if we have a bad block, we do not erase bad blocks! */
  		if (nand_block_checkbad(mtd, ((loff_t) page) <<
@@ -2560,7 +2551,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			pr_warn("%s: attempt to erase a bad block at page 0x%08x\n",
  				    __func__, page);
  			instr->state = MTD_ERASE_FAILED;
-@@ -3005,7 +3037,20 @@ static void nand_sync(struct mtd_info *m
+@@ -3008,7 +3040,20 @@ static void nand_sync(struct mtd_info *m
   */
  static int nand_block_isbad(struct mtd_info *mtd, loff_t offs)
  {
@@ -2582,7 +2573,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  }
  
  /**
-@@ -3094,7 +3139,7 @@ static int nand_suspend(struct mtd_info
+@@ -3097,7 +3142,7 @@ static int nand_suspend(struct mtd_info
   */
  static void nand_resume(struct mtd_info *mtd)
  {
@@ -2591,7 +2582,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	if (chip->state == FL_PM_SUSPENDED)
  		nand_release_device(mtd);
-@@ -3266,7 +3311,7 @@ ext_out:
+@@ -3269,7 +3314,7 @@ ext_out:
  
  static int nand_setup_read_retry_micron(struct mtd_info *mtd, int retry_mode)
  {
@@ -2600,7 +2591,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	uint8_t feature[ONFI_SUBFEATURE_PARAM_LEN] = {retry_mode};
  
  	return chip->onfi_set_features(mtd, chip, ONFI_FEATURE_ADDR_READ_RETRY,
-@@ -3937,10 +3982,13 @@ ident_done:
+@@ -3940,10 +3985,13 @@ ident_done:
  	return type;
  }
  
@@ -2617,7 +2608,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	if (of_get_nand_bus_width(dn) == 16)
  		chip->options |= NAND_BUSWIDTH_16;
-@@ -3949,6 +3997,7 @@ static int nand_dt_init(struct mtd_info
+@@ -3952,6 +4000,7 @@ static int nand_dt_init(struct mtd_info
  		chip->bbt_options |= NAND_BBT_USE_FLASH;
  
  	ecc_mode = of_get_nand_ecc_mode(dn);
@@ -2625,7 +2616,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	ecc_strength = of_get_nand_ecc_strength(dn);
  	ecc_step = of_get_nand_ecc_step_size(dn);
  
-@@ -3961,6 +4010,9 @@ static int nand_dt_init(struct mtd_info
+@@ -3964,6 +4013,9 @@ static int nand_dt_init(struct mtd_info
  	if (ecc_mode >= 0)
  		chip->ecc.mode = ecc_mode;
  
@@ -2635,7 +2626,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	if (ecc_strength >= 0)
  		chip->ecc.strength = ecc_strength;
  
-@@ -3984,15 +4036,16 @@ int nand_scan_ident(struct mtd_info *mtd
+@@ -3987,15 +4039,16 @@ int nand_scan_ident(struct mtd_info *mtd
  		    struct nand_flash_dev *table)
  {
  	int i, nand_maf_id, nand_dev_id;
@@ -2658,7 +2649,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	if (!mtd->name && mtd->dev.parent)
  		mtd->name = dev_name(mtd->dev.parent);
-@@ -4055,7 +4108,7 @@ EXPORT_SYMBOL(nand_scan_ident);
+@@ -4058,7 +4111,7 @@ EXPORT_SYMBOL(nand_scan_ident);
   */
  static bool nand_ecc_strength_good(struct mtd_info *mtd)
  {
@@ -2667,7 +2658,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	struct nand_ecc_ctrl *ecc = &chip->ecc;
  	int corr, ds_corr;
  
-@@ -4083,10 +4136,10 @@ static bool nand_ecc_strength_good(struc
+@@ -4086,10 +4139,10 @@ static bool nand_ecc_strength_good(struc
   */
  int nand_scan_tail(struct mtd_info *mtd)
  {
@@ -2680,7 +2671,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/* New bad blocks should be marked in OOB, flash-based BBT, or both */
  	BUG_ON((chip->bbt_options & NAND_BBT_NO_OOB_BBM) &&
-@@ -4113,19 +4166,15 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4116,19 +4169,15 @@ int nand_scan_tail(struct mtd_info *mtd)
  	/*
  	 * If no default placement scheme is given, select an appropriate one.
  	 */
@@ -2703,7 +2694,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			break;
  		default:
  			pr_warn("No oob scheme defined for oobsize %d\n",
-@@ -4168,7 +4217,7 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4171,7 +4220,7 @@ int nand_scan_tail(struct mtd_info *mtd)
  			ecc->write_oob = nand_write_oob_std;
  		if (!ecc->read_subpage)
  			ecc->read_subpage = nand_read_subpage;
@@ -2712,7 +2703,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			ecc->write_subpage = nand_write_subpage_hwecc;
  
  	case NAND_ECC_HW_SYNDROME:
-@@ -4246,10 +4295,8 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4249,10 +4298,8 @@ int nand_scan_tail(struct mtd_info *mtd)
  		}
  
  		/* See nand_bch_init() for details. */
@@ -2725,7 +2716,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  		if (!ecc->priv) {
  			pr_warn("BCH ECC initialization failed!\n");
  			BUG();
-@@ -4280,20 +4327,9 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4283,20 +4330,9 @@ int nand_scan_tail(struct mtd_info *mtd)
  	if (!ecc->write_oob_raw)
  		ecc->write_oob_raw = ecc->write_oob;
  
@@ -2749,7 +2740,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	/*
  	 * Set the number of read / write steps for one page depending on ECC
-@@ -4306,6 +4342,21 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4309,6 +4345,21 @@ int nand_scan_tail(struct mtd_info *mtd)
  	}
  	ecc->total = ecc->steps * ecc->bytes;
  
@@ -2771,7 +2762,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	/* Allow subpage writes up to ecc.steps. Not possible for MLC flash */
  	if (!(chip->options & NAND_NO_SUBPAGE_WRITE) && nand_is_slc(chip)) {
  		switch (ecc->steps) {
-@@ -4362,10 +4413,6 @@ int nand_scan_tail(struct mtd_info *mtd)
+@@ -4365,10 +4416,6 @@ int nand_scan_tail(struct mtd_info *mtd)
  	mtd->_block_markbad = nand_block_markbad;
  	mtd->writebufsize = mtd->writesize;
  
@@ -2782,7 +2773,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	/*
  	 * Initialize bitflip_threshold to its default prior scan_bbt() call.
  	 * scan_bbt() might invoke mtd_read(), thus bitflip_threshold must be
-@@ -4421,7 +4468,7 @@ EXPORT_SYMBOL(nand_scan);
+@@ -4424,7 +4471,7 @@ EXPORT_SYMBOL(nand_scan);
   */
  void nand_release(struct mtd_info *mtd)
  {
diff --git a/target/linux/oxnas/patches-4.4/0074-mtd-nand-import-nand_hw_control_init.patch b/target/linux/oxnas/patches-4.4/0074-mtd-nand-import-nand_hw_control_init.patch
index 4b3260c41b..aefcfd98a7 100644
--- a/target/linux/oxnas/patches-4.4/0074-mtd-nand-import-nand_hw_control_init.patch
+++ b/target/linux/oxnas/patches-4.4/0074-mtd-nand-import-nand_hw_control_init.patch
@@ -87,7 +87,7 @@ Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
  	}
 --- a/drivers/mtd/nand/nand_base.c
 +++ b/drivers/mtd/nand/nand_base.c
-@@ -3202,8 +3202,7 @@ static void nand_set_defaults(struct nan
+@@ -3205,8 +3205,7 @@ static void nand_set_defaults(struct nan
  
  	if (!chip->controller) {
  		chip->controller = &chip->hwcontrol;
diff --git a/target/linux/ramips/patches-4.4/0040-nand-add-mtk-nand-hack-hook.patch b/target/linux/ramips/patches-4.4/0040-nand-add-mtk-nand-hack-hook.patch
index 254bf5286a..e7f4d893f6 100644
--- a/target/linux/ramips/patches-4.4/0040-nand-add-mtk-nand-hack-hook.patch
+++ b/target/linux/ramips/patches-4.4/0040-nand-add-mtk-nand-hack-hook.patch
@@ -118,7 +118,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			if (ret < 0) {
  				if (use_bufpoi)
  					/* Invalidate page cache */
-@@ -2932,8 +2936,11 @@ int nand_erase_nand(struct mtd_info *mtd
+@@ -2935,8 +2939,11 @@ int nand_erase_nand(struct mtd_info *mtd
  		if (page <= chip->pagebuf && chip->pagebuf <
  		    (page + pages_per_block))
  			chip->pagebuf = -1;
diff --git a/target/linux/ramips/patches-4.4/0042-SPI-ralink-add-Ralink-SoC-spi-driver.patch b/target/linux/ramips/patches-4.4/0042-SPI-ralink-add-Ralink-SoC-spi-driver.patch
index f79f2cfc5f..642632628b 100644
--- a/target/linux/ramips/patches-4.4/0042-SPI-ralink-add-Ralink-SoC-spi-driver.patch
+++ b/target/linux/ramips/patches-4.4/0042-SPI-ralink-add-Ralink-SoC-spi-driver.patch
@@ -16,7 +16,7 @@ Acked-by: John Crispin <blogic@openwrt.org>
 
 --- a/drivers/spi/Kconfig
 +++ b/drivers/spi/Kconfig
-@@ -478,6 +478,12 @@ config SPI_QUP
+@@ -477,6 +477,12 @@ config SPI_QUP
  	  This driver can also be built as a module.  If so, the module
  	  will be called spi_qup.
  
diff --git a/target/linux/ramips/patches-4.4/0043-spi-add-mt7621-support.patch b/target/linux/ramips/patches-4.4/0043-spi-add-mt7621-support.patch
index 13936b2e1f..8a78bda840 100644
--- a/target/linux/ramips/patches-4.4/0043-spi-add-mt7621-support.patch
+++ b/target/linux/ramips/patches-4.4/0043-spi-add-mt7621-support.patch
@@ -13,7 +13,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 
 --- a/drivers/spi/Kconfig
 +++ b/drivers/spi/Kconfig
-@@ -484,6 +484,12 @@ config SPI_RT2880
+@@ -483,6 +483,12 @@ config SPI_RT2880
  	help
  	  This selects a driver for the Ralink RT288x/RT305x SPI Controller.
  
diff --git a/target/linux/ramips/patches-4.4/0511-net-mediatek-add-support-for-the-multiphy-carrier-pa.patch b/target/linux/ramips/patches-4.4/0511-net-mediatek-add-support-for-the-multiphy-carrier-pa.patch
index 4d5c2d8744..643c68731c 100644
--- a/target/linux/ramips/patches-4.4/0511-net-mediatek-add-support-for-the-multiphy-carrier-pa.patch
+++ b/target/linux/ramips/patches-4.4/0511-net-mediatek-add-support-for-the-multiphy-carrier-pa.patch
@@ -25,7 +25,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	return IRQ_HANDLED;
 --- a/drivers/net/ethernet/mediatek/gsw_mt7620.h
 +++ b/drivers/net/ethernet/mediatek/gsw_mt7620.h
-@@ -113,5 +113,6 @@ u32 mt7530_mdio_r32(struct mt7620_gsw *g
+@@ -119,5 +119,6 @@ u32 mt7530_mdio_r32(struct mt7620_gsw *g
  u32 _mt7620_mii_write(struct mt7620_gsw *gsw, u32 phy_addr,
  			     u32 phy_register, u32 write_data);
  u32 _mt7620_mii_read(struct mt7620_gsw *gsw, int phy_addr, int phy_reg);
diff --git a/target/linux/ramips/patches-4.4/0513-net-mediatek-add-swconfig-driver-for-gsw_mt762x.patch b/target/linux/ramips/patches-4.4/0513-net-mediatek-add-swconfig-driver-for-gsw_mt762x.patch
index 10db0765c2..35d1bd0c74 100644
--- a/target/linux/ramips/patches-4.4/0513-net-mediatek-add-swconfig-driver-for-gsw_mt762x.patch
+++ b/target/linux/ramips/patches-4.4/0513-net-mediatek-add-swconfig-driver-for-gsw_mt762x.patch
@@ -51,7 +51,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  #define GSW_REG_PORT_PMCR(x)	(0x3000 + (x * 0x100))
  #define GSW_REG_PORT_STATUS(x)	(0x3008 + (x * 0x100))
  #define GSW_REG_SMACCR0		0x3fE4
-@@ -76,6 +78,7 @@
+@@ -82,6 +84,7 @@
  #define PHY_PRE_EN		BIT(30)
  #define PMY_MDC_CONF(_x)	((_x & 0x3f) << 24)
  
diff --git a/target/linux/ramips/patches-4.4/0901-spansion_nand_id_fix.patch b/target/linux/ramips/patches-4.4/0901-spansion_nand_id_fix.patch
index e4853a8c51..7091085958 100644
--- a/target/linux/ramips/patches-4.4/0901-spansion_nand_id_fix.patch
+++ b/target/linux/ramips/patches-4.4/0901-spansion_nand_id_fix.patch
@@ -13,7 +13,7 @@ Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
 
 --- a/drivers/mtd/nand/nand_base.c
 +++ b/drivers/mtd/nand/nand_base.c
-@@ -3568,6 +3568,7 @@ static void nand_decode_ext_id(struct mt
+@@ -3571,6 +3571,7 @@ static void nand_decode_ext_id(struct mt
  	/*
  	 * Field definitions are in the following datasheets:
  	 * Old style (4,5 byte ID): Samsung K9GAG08U0M (p.32)
@@ -21,7 +21,7 @@ Signed-off-by: Nikolay Martynov <mar.kolya@gmail.com>
  	 * New Samsung (6 byte ID): Samsung K9GAG08U0F (p.44)
  	 * Hynix MLC   (6 byte ID): Hynix H27UBG8T2B (p.22)
  	 *
-@@ -3665,6 +3666,19 @@ static void nand_decode_ext_id(struct mt
+@@ -3668,6 +3669,19 @@ static void nand_decode_ext_id(struct mt
  		*busw = (extid & 0x01) ? NAND_BUSWIDTH_16 : 0;
  
  		/*
