trunk-47048

133 files changed, 10979 insertions, 0 deletions

diff --git a/target/linux/brcm47xx/Makefile b/target/linux/brcm47xx/Makefile
new file mode 100644
index 0000000..e0c44c8
--- /dev/null
+++ b/target/linux/brcm47xx/Makefile
@@ -0,0 +1,29 @@
+#
+# Copyright (C) 2006-2008 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+include $(TOPDIR)/rules.mk
+
+ARCH:=mipsel
+BOARD:=brcm47xx
+BOARDNAME:=Broadcom BCM47xx/53xx (MIPS)
+FEATURES:=squashfs usb
+SUBTARGETS:=generic mips74k legacy
+MAINTAINER:=Hauke Mehrtens <hauke@hauke-m.de>
+
+KERNEL_PATCHVER:=4.1
+
+include $(INCLUDE_DIR)/target.mk
+
+
+define Target/Description
+	Build firmware images for Broadcom based BCM47xx/53xx routers with MIPS CPU, *not* ARM.
+endef
+
+DEFAULT_PACKAGES += swconfig wpad-mini nvram otrx \
+	kmod-leds-gpio kmod-gpio-button-hotplug \
+	kmod-ledtrig-default-on kmod-ledtrig-timer kmod-ledtrig-netdev
+
+$(eval $(call BuildTarget))
diff --git a/target/linux/brcm47xx/base-files.mk b/target/linux/brcm47xx/base-files.mk
new file mode 100644
index 0000000..d6682bd
--- /dev/null
+++ b/target/linux/brcm47xx/base-files.mk
@@ -0,0 +1,5 @@
+define Package/base-files/install-target
+	rm -f $(1)/etc/config/network
+endef
+
+
diff --git a/target/linux/brcm47xx/base-files/etc/diag.sh b/target/linux/brcm47xx/base-files/etc/diag.sh
new file mode 100644
index 0000000..67453e6
--- /dev/null
+++ b/target/linux/brcm47xx/base-files/etc/diag.sh
@@ -0,0 +1,41 @@
+#!/bin/sh
+# Copyright (C) 2006 OpenWrt.org
+
+. /lib/functions/leds.sh
+
+get_status_led() {
+	status_led_file=$(find /sys/class/leds/ -name "*power*" |head -n1)
+	if [ ! -f $status_led_file ]; then
+		status_led=$(basename $status_led_file)
+		return
+	fi;
+	status_led_file=$(find /sys/class/leds/ -name "*diag*" |head -n1)
+	if [ ! -f $status_led_file ]; then
+		status_led=$(basename $status_led_file)
+		return
+	fi;
+	status_led_file=$(find /sys/class/leds/ -name "*wps*" |head -n1)
+	if [ ! -f $status_led_file ]; then
+		status_led=$(basename $status_led_file)
+		return
+	fi;
+}
+
+set_state() {
+	get_status_led
+
+	case "$1" in
+	preinit)
+		status_led_blink_preinit
+		;;
+	failsafe)
+		status_led_blink_failsafe
+		;;
+	preinit_regular)
+		status_led_blink_preinit_regular
+		;;
+	done)
+		status_led_on
+		;;
+	esac
+}
diff --git a/target/linux/brcm47xx/base-files/etc/init.d/netconfig b/target/linux/brcm47xx/base-files/etc/init.d/netconfig
new file mode 100755
index 0000000..1890cd0
--- /dev/null
+++ b/target/linux/brcm47xx/base-files/etc/init.d/netconfig
@@ -0,0 +1,238 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2006 OpenWrt.org
+
+START=05
+
+start() {
+	[ -e /etc/config/network ] && {
+		local batch
+
+		config_cb() {
+			case "$1" in
+			switch)
+				option_cb() {
+					case "$1" in
+					vlan[0-9]|vlan1[0-5])
+						local id="${1#vlan}"
+						local ports="${2%\*}"
+						append batch "delete network.eth0.${1}${N}"
+						append batch "set network.eth0_${id}=switch_vlan${N}"
+						append batch "set network.eth0_${id}.device=eth0${N}"
+						append batch "set network.eth0_${id}.vlan=${id}${N}"
+						append batch "set network.eth0_${id}.ports='${ports}'${N}"
+					;;
+					esac
+				}
+			;;
+			switch_vlan)
+				option_cb() { :; }
+				batch=""
+			;;
+			esac
+		}
+
+		config_load network
+
+		[ -n "$batch" ] && {
+			logger -t netconfig "migrating switch config to new format ..."
+			echo "$batch${N}commit network" | uci batch
+		}
+
+		exit 0
+	}
+
+	mkdir -p /etc/config
+
+	local cpuport=5
+	[ -e /sbin/swconfig ] && cpuport=$(swconfig dev switch0 help 2>/dev/null | sed -ne "s|.*cpu @ \([0-9]*\).*|\1|p")
+	local switchname=eth0
+	[ -e /sbin/swconfig ] && switchname=$(swconfig dev switch0 help 2>/dev/null | sed -ne "s|switch0: \([^\\\\(]*\).*|\1|p")
+	local model=$(awk 'BEGIN{FS="[ \t]+:[ \t]"} /machine/ {print $2}' /proc/cpuinfo)
+
+	local network_defs=`(
+		if grep -E 'mtd0: 000(6|a)0000' /proc/mtd 2>&- >&-; then
+			# WGT634u
+			echo boardtype=wgt634u
+		else
+			strings "$(find_mtd_part nvram)"
+		fi
+	) | awk -v cpuport="$cpuport" -v model="$model" '
+	function macinc(mac, maca, i, result) {
+		split(mac, maca, ":")
+		for (i = 1; i <= 6; i++) maca[i] = "0x" maca[i]
+		if (++maca[6] > 0xff) {
+			maca[5]++
+			maca[6] = 0
+		}
+		for (i = 1; i <= 6; i++) {
+			if (i != 1) result = result ":"
+			result = result sprintf("%02x", maca[i])
+		}
+		return result
+	}
+
+	BEGIN {
+		FS="="
+		c["lan_ifname"]="eth0.1"
+		c["wan_ifname"]="eth0.2"
+		c["vlan1ports"]="1 2 3 4 5t"
+		c["vlan2ports"]="0 5t"
+		for (i = 0; i < 6; i++) {
+			if (mac_check != "") mac_check = mac_check ":"
+			mac_check = mac_check "[0-9a-fA-F][0-9a-fA-F]"
+		}
+		if (cpuport == "8") {
+			c["vlan1ports"]="1 2 3 4 8t"
+			c["vlan2ports"]="0 8t"
+		}
+	}
+
+	($1 == "boardnum") || ($1 == "boardtype") || ($1 == "boardflags") || ($1 ~ /macaddr/) || \
+	 ($1 ~ /^vlan[0-9]{1,2}ports$/) {
+		nvram[$1] = $2
+	}
+
+	END {
+		if (((nvram["vlan0ports"] ~ /^0 1 2 3 8/ ) && (nvram["vlan1ports"] ~ /^4 8/ && (cpuport == "8"))) || \
+		    ((nvram["vlan1ports"] ~ /^0 1 2 3 8/ ) && (nvram["vlan2ports"] ~ /^4 8/ && (cpuport == "8"))) || \
+		    ((nvram["vlan2ports"] ~ /^0 1 2 3 8/ ) && (nvram["vlan1ports"] ~ /^4 8/ && (cpuport == "8")))) {
+			c["vlan1ports"] = "0 1 2 3 8t"
+			c["vlan2ports"] = "4 8t"
+		}
+		if (((nvram["vlan0ports"] ~ /^0 1 2 3 5/ ) && (nvram["vlan1ports"] ~ /^4 5/ && (cpuport == "5"))) || \
+		    ((nvram["vlan1ports"] ~ /^0 1 2 3 5/ ) && (nvram["vlan2ports"] ~ /^4 5/ && (cpuport == "5"))) || \
+		    ((nvram["vlan2ports"] ~ /^0 1 2 3 5/ ) && (nvram["vlan1ports"] ~ /^4 5/ && (cpuport == "5")))) {
+			c["vlan1ports"] = "0 1 2 3 5t"
+			c["vlan2ports"] = "4 5t"
+		}
+		if ((model == "Asus WLHDD") || (model == "Asus WL300G")) {
+			c["wan_ifname"] = ""
+			c["lan_ifname"] = "eth1"
+		}
+		if (model == "Asus WL330GE") {
+			c["wan_ifname"] = ""
+			c["lan_ifname"] = "eth0.1"
+			c["vlan1ports"] = "4 5t"
+			c["vlan2ports"] = ""
+		}
+		if ((model == "Asus WL500G") || (model == "Microsoft MN-700")) {
+			c["wan_ifname"] = "eth1"
+			c["lan_ifname"] = "eth0"
+		}
+		if ((model == "Asus WL500GP V2") || (model == "Buffalo WHR-G125")) {
+			c["vlan1ports"] = "0 1 2 3 5t"
+			c["vlan2ports"] = "4 5t"
+		}
+		if (model == "Dell TrueMobile 2300") {
+			c["lan_ifname"] = "eth0"
+			c["wan_ifname"] = "eth1"
+			c["vlan1ports"] = "0 1 2 3 4 5"
+			c["vlan2ports"] = ""
+		}
+		if (nvram["boardtype"] == "bcm94710r4") {
+			# Toshiba WRC-1000
+			c["lan_ifname"] = "eth0"
+			c["wan_ifname"] = "eth1"
+		}
+		if ((nvram["boardtype"] == "wgt634u") || (nvram["boardtype"] == "0x0467")) {
+			c["vlan1ports"] = "0 1 2 3 5t"
+			c["vlan2ports"] = "4 5t"
+		}
+		if ((nvram["boardtype"] == "0x042f") || (nvram["boardtype"] == "0x0472")) {
+			if (nvram["boardnum"] == "45") {
+				# WL-500gP
+				c["vlan1ports"] = "1 2 3 4 5t"
+				c["vlan2ports"] = "0 5t"
+			} else {
+				# Generic BCM94704
+				c["vlan1ports"] = "0 1 2 3 4 5"
+				c["vlan2ports"] = ""
+				c["lan_ifname"] = "eth0"
+				c["wan_ifname"] = "eth1"
+
+				# MAC addresses on 4704 tend to be screwed up. Add a workaround here
+				if (nvram["et0macaddr"] ~ mac_check) {
+					c["lan_macaddr"] = nvram["et0macaddr"]
+					c["wan_macaddr"] = macinc(c["lan_macaddr"])
+				}
+			}
+		}
+		# Buffalo WBR-B11 and Buffalo WBR-G54
+		if (nvram["boardtype"] == "bcm94710ap") {
+			c["vlan1ports"] = "0 1 2 3 4 5"
+			c["vlan2ports"] = ""
+			c["lan_ifname"] = "eth0"
+			c["wan_ifname"] = "eth1"
+		}
+
+		# WAP54G
+		if ((nvram["boardnum"] == "2") || \
+			(nvram["boardnum"] == "1024")) {
+			c["lan_ifname"]="eth0"
+			c["wan_ifname"]=""
+		}
+
+		# Sitecom WL-105b
+		if ((nvram["boardum"] == "2") && \
+			(nvram["GemtekPmonVer"] == "1")) {
+			c["lan_ifname"]="eth0"
+			c["wan_ifname"]=""
+		}
+
+		# ASUS WL-700gE
+		# These are actually same as defaults above. For some reason this script applies
+		# Generic BCM94704 settings instead so we revert to proper settings here.
+		# Hopefully someone will fix this properly soon.
+		if (model == "Asus WL700") {
+			c["lan_ifname"]="eth0.1"
+			c["wan_ifname"]="eth0.2"
+			c["vlan1ports"]="1 2 3 4 5t"
+			c["vlan2ports"]="0 5t"
+		}
+		if ((model == "Motorola WR850G") || (model == "Siemens SE505 V2")) {
+			c["vlan1ports"]="0 1 2 3 5t"
+			c["vlan2ports"]="4 5t"
+		}
+		if (model == "Asus WL500W") {
+			c["lan_ifname"] = "eth0"
+			c["wan_ifname"] = "eth1"
+			c["vlan1ports"] = "0 1 2 3 4 5"
+			c["vlan2ports"] = ""
+		}
+		print "local vlan1ports=\"" c["vlan1ports"] "\";"
+		print "local vlan2ports=\"" c["vlan2ports"] "\";"
+		print "local lan_ifname=\"" c["lan_ifname"] "\";"
+		print "local lan_macaddr=\"" c["lan_macaddr"] "\";"
+		print "local wan_ifname=\"" c["wan_ifname"] "\";"
+		print "local wan_macaddr=\"" c["wan_macaddr"] "\";"
+	}'`
+
+	. /lib/functions/uci-defaults.sh
+
+	touch /etc/config/network
+
+	eval "$network_defs"
+
+	[ -n "$vlan1ports" -o -n "$vlan2ports" ] && {
+		local cfg=`ucidef_add_switch "$switchname" 1 1`
+		[ -n "$cfg" ] && uci rename network.$cfg=eth0
+		[ -n "$vlan1ports" ] && {
+			cfg=`ucidef_add_switch_vlan "$switchname" 1 "$vlan1ports"`
+		}
+		[ -n "$vlan2ports" ] && {
+			cfg=`ucidef_add_switch_vlan "$switchname" 2 "$vlan2ports"`
+		}
+	}
+
+	ucidef_set_interface_loopback
+
+	ucidef_set_interface_lan "$lan_ifname"
+	[ -n "$lan_macaddr" ] && ucidef_set_interface_macaddr lan "$lan_macaddr"
+
+	[ -n "$wan_ifname" ] && {
+		ucidef_set_interface_wan "$wan_ifname"
+		[ -n "$wan_macaddr" ] && ucidef_set_interface_macaddr wan "$wan_macaddr"
+	}
+
+	uci commit network
+}
diff --git a/target/linux/brcm47xx/base-files/etc/init.d/wmacfixup b/target/linux/brcm47xx/base-files/etc/init.d/wmacfixup
new file mode 100755
index 0000000..ee1b752
--- /dev/null
+++ b/target/linux/brcm47xx/base-files/etc/init.d/wmacfixup
@@ -0,0 +1,33 @@
+#!/bin/sh /etc/rc.common
+# Copyright (C) 2010 OpenWrt.org
+
+START=41
+
+boot() {
+	[ -d /sys/class/ieee80211 ] || exit
+
+	commit=0
+
+	fixup_wmac() {
+		local cfg="$1"
+		local cfmac
+
+		config_get cfmac "$cfg" macaddr
+
+		[ "$cfmac" != "00:90:4c:5f:00:2a" ] || {
+			local nvmac="$(nvram get il0macaddr 2>/dev/null)"
+			[ -n "$nvmac" ] && [ "$nvmac != "$cfmac ] && {
+				uci set wireless.$cfg.macaddr="$nvmac"
+				commit=1
+			}
+		}
+	}
+
+	config_load wireless
+	config_foreach fixup_wmac wifi-device
+
+	[ "$commit" = 1 ] && uci commit wireless
+}
+
+start() { :; }
+stop()  { :; }
diff --git a/target/linux/brcm47xx/base-files/etc/uci-defaults/03_network_migration b/target/linux/brcm47xx/base-files/etc/uci-defaults/03_network_migration
new file mode 100644
index 0000000..cef5add
--- /dev/null
+++ b/target/linux/brcm47xx/base-files/etc/uci-defaults/03_network_migration
@@ -0,0 +1,29 @@
+#!/bin/sh
+#
+# Copyright (C) 2014 OpenWrt.org
+#
+
+uci show network | grep "\.vlan=0"
+[ $? -ne 0 ] && exit 0
+
+logger -t network "network config is invalid, creating new one"
+
+local lan_proto="$(uci -q get network.lan.proto)"
+local lan_ipaddr="$(uci -q get network.lan.ipaddr)"
+local lan_netmask="$(uci -q get network.lan.netmask)"
+local wan_proto="$(uci -q get network.wan.proto)"
+local wan_ipaddr="$(uci -q get network.wan.ipaddr)"
+local wan_netmask="$(uci -q get network.wan.netmask)"
+
+rm /etc/config/network
+/etc/init.d/netconfig start
+
+uci set network.lan.proto=$lan_proto
+uci set network.lan.ipaddr=$lan_ipaddr
+uci set network.lan.netmask=$lan_netmask
+uci set network.wan.proto=$wan_proto
+uci set network.wan.ipaddr=$wan_ipaddr
+uci set network.wan.netmask=$wan_netmask
+uci commit network
+
+exit 0
diff --git a/target/linux/brcm47xx/base-files/etc/uci-defaults/09_fix_crc b/target/linux/brcm47xx/base-files/etc/uci-defaults/09_fix_crc
new file mode 100644
index 0000000..346a532
--- /dev/null
+++ b/target/linux/brcm47xx/base-files/etc/uci-defaults/09_fix_crc
@@ -0,0 +1,7 @@
+#!/bin/sh
+#
+# Copyright (C) 2007 OpenWrt.org
+#
+#
+
+mtd fixtrx firmware
diff --git a/target/linux/brcm47xx/base-files/lib/preinit/05_init_interfaces_brcm b/target/linux/brcm47xx/base-files/lib/preinit/05_init_interfaces_brcm
new file mode 100644
index 0000000..4b0d0eb
--- /dev/null
+++ b/target/linux/brcm47xx/base-files/lib/preinit/05_init_interfaces_brcm
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+preinit_iface() {
+	ifname=eth0
+
+	# hardware specific overrides
+	case "$(awk 'BEGIN{FS="[ \t]+:[ \t]"} /machine/ {print $2}' /proc/cpuinfo)" in
+		"Asus WLHDD") ifname=eth1;;
+		"Asus WL300G") ifname=eth1;;
+	esac
+
+	local try=0;
+	while [ $((try++)) -le 5 ] && [ ! -f /sys/class/net/$ifname/operstate ]; do sleep 1; done
+}
+
+boot_hook_add preinit_main preinit_iface
diff --git a/target/linux/brcm47xx/base-files/lib/preinit/15_set_preinit_interface_brcm b/target/linux/brcm47xx/base-files/lib/preinit/15_set_preinit_interface_brcm
new file mode 100644
index 0000000..f40e160
--- /dev/null
+++ b/target/linux/brcm47xx/base-files/lib/preinit/15_set_preinit_interface_brcm
@@ -0,0 +1,16 @@
+#!/bin/sh
+
+preinit_ip() {
+	# if the preinit interface isn't specified and ifname is set in
+	# preinit.arch use that interface
+	if [ -z "$pi_ifname" ]; then
+		pi_ifname=$ifname
+	fi
+
+	[ -n "$pi_ifname" ] && grep -q "$pi_ifname" /proc/net/dev && {
+		ifconfig $pi_ifname $pi_ip netmask $pi_netmask broadcast $pi_broadcast up
+
+		local try=0;
+		while [ $((try++)) -le 5 ] && [ ! "$(cat /sys/class/net/$pi_ifname/operstate)" = "up" ]; do sleep 1; done
+	}
+}
diff --git a/target/linux/brcm47xx/base-files/lib/upgrade/platform.sh b/target/linux/brcm47xx/base-files/lib/upgrade/platform.sh
new file mode 100644
index 0000000..cbadefb
--- /dev/null
+++ b/target/linux/brcm47xx/base-files/lib/upgrade/platform.sh
@@ -0,0 +1,157 @@
+PART_NAME=firmware
+
+# $(1): file to read magic from
+# $(2): offset in bytes
+get_magic_long_at() {
+	dd if="$1" skip=$2 bs=1 count=4 2>/dev/null | hexdump -v -n 4 -e '1/1 "%02x"'
+}
+
+platform_machine() {
+	grep "machine" /proc/cpuinfo | sed "s/.*:[ \t]*//"
+}
+
+platform_expected_image() {
+	local machine=$(platform_machine)
+
+	case "$machine" in
+		"Netgear WGR614 V8")	echo "chk U12H072T00_NETGEAR"; return;;
+		"Netgear WGR614 V9")	echo "chk U12H094T00_NETGEAR"; return;;
+		"Netgear WGR614 V10")	echo "chk U12H139T01_NETGEAR"; return;;
+		"Netgear WNDR3300")	echo "chk U12H093T00_NETGEAR"; return;;
+		"Netgear WNDR3400 V1")	echo "chk U12H155T00_NETGEAR"; return;;
+		"Netgear WNDR3400 V2")	echo "chk U12H187T00_NETGEAR"; return;;
+		"Netgear WNDR3400 V3")	echo "chk U12H208T00_NETGEAR"; return;;
+		"Netgear WNDR3400 Vcna")	echo "chk U12H155T01_NETGEAR"; return;;
+		"Netgear WNDR3700 V3")	echo "chk U12H194T00_NETGEAR"; return;;
+		"Netgear WNDR4000")	echo "chk U12H181T00_NETGEAR"; return;;
+		"Netgear WNDR4500 V1")	echo "chk U12H189T00_NETGEAR"; return;;
+		"Netgear WNDR4500 V2")	echo "chk U12H224T00_NETGEAR"; return;;
+		"Netgear WNR2000 V2")	echo "chk U12H114T00_NETGEAR"; return;;
+		"Netgear WNR3500L")	echo "chk U12H136T99_NETGEAR"; return;;
+		"Netgear WNR3500U")	echo "chk U12H136T00_NETGEAR"; return;;
+		"Netgear WNR3500 V2")	echo "chk U12H127T00_NETGEAR"; return;;
+		"Netgear WNR3500 V2vc")	echo "chk U12H127T70_NETGEAR"; return;;
+		"Netgear WNR834B V2")	echo "chk U12H081T00_NETGEAR"; return;;
+		"Linksys E900 V1")	echo "cybertan E900"; return;;
+		"Linksys E1000 V1")	echo "cybertan E100"; return;;
+		"Linksys E1000 V2")	echo "cybertan E100"; return;;
+		"Linksys E1000 V2.1")	echo "cybertan E100"; return;;
+		"Linksys E1200 V2")	echo "cybertan E122"; return;;
+		"Linksys E2000 V1")	echo "cybertan 32XN"; return;;
+		"Linksys E3000 V1")	echo "cybertan 61XN"; return;;
+		"Linksys E3200 V1")	echo "cybertan 3200"; return;;
+		"Linksys E4200 V1")	echo "cybertan 4200"; return;;
+		"Linksys WRT150N V1.1")	echo "cybertan N150"; return;;
+		"Linksys WRT150N V1")	echo "cybertan N150"; return;;
+		"Linksys WRT160N V1")	echo "cybertan N150"; return;;
+		"Linksys WRT160N V3")	echo "cybertan N150"; return;;
+		"Linksys WRT300N V1")	echo "cybertan EWCB"; return;;
+		"Linksys WRT300N V1.1")	echo "cybertan EWC2"; return;;
+		"Linksys WRT310N V1")	echo "cybertan 310N"; return;;
+		"Linksys WRT310N V2")	echo "cybertan 310N"; return;;
+		"Linksys WRT610N V1")	echo "cybertan 610N"; return;;
+		"Linksys WRT610N V2")	echo "cybertan 610N"; return;;
+	esac
+}
+
+brcm47xx_identify() {
+	local magic
+
+	magic=$(get_magic_long "$1")
+	case "$magic" in
+		"48445230")
+			echo "trx"
+			return
+			;;
+		"2a23245e")
+			echo "chk"
+			return
+			;;
+	esac
+
+	magic=$(get_magic_long_at "$1" 14)
+	[ "$magic" = "55324e44" ] && {
+		echo "cybertan"
+		return
+	}
+
+	echo "unknown"
+}
+
+platform_check_image() {
+	[ "$#" -gt 1 ] && return 1
+
+	local file_type=$(brcm47xx_identify "$1")
+	local magic
+	local error=0
+
+	case "$file_type" in
+		"chk")
+			local header_len=$((0x$(get_magic_long_at "$1" 4)))
+			local board_id_len=$(($header_len - 40))
+			local board_id=$(dd if="$1" skip=40 bs=1 count=$board_id_len 2>/dev/null | hexdump -v -e '1/1 "%c"')
+			local dev_board_id=$(platform_expected_image)
+			echo "Found CHK image with device board_id $board_id"
+
+			[ -n "$dev_board_id" -a "chk $board_id" != "$dev_board_id" ] && {
+				echo "Firmware board_id doesn't match device board_id ($dev_board_id)"
+				error=1
+			}
+
+			if ! otrx check "$1" -o "$header_len"; then
+				echo "No valid TRX firmware in the CHK image"
+				error=1
+			fi
+		;;
+		"cybertan")
+			local pattern=$(dd if="$1" bs=1 count=4 2>/dev/null | hexdump -v -e '1/1 "%c"')
+			local dev_pattern=$(platform_expected_image)
+			echo "Found CyberTAN image with device pattern: $pattern"
+
+			[ -n "$dev_pattern" -a "cybertan $pattern" != "$dev_pattern" ] && {
+				echo "Firmware pattern doesn't match device pattern ($dev_pattern)"
+				error=1
+			}
+
+			if ! otrx check "$1" -o 32; then
+				echo "No valid TRX firmware in the CyberTAN image"
+				error=1
+			fi
+		;;
+		"trx")
+			if ! otrx check "$1"; then
+				echo "Invalid (corrupted?) TRX firmware"
+				error=1
+			fi
+		;;
+		*)
+			echo "Invalid image type. Please use only .trx files"
+			error=1
+		;;
+	esac
+
+	return $error
+}
+
+platform_trx_from_chk_cmd() {
+	local header_len=$((0x$(get_magic_long_at "$1" 4)))
+
+	echo -n dd bs=$header_len skip=1
+}
+
+platform_trx_from_cybertan_cmd() {
+	echo -n dd bs=32 skip=1
+}
+
+platform_do_upgrade() {
+	local file_type=$(brcm47xx_identify "$1")
+	local trx="$1"
+	local cmd=""
+
+	case "$file_type" in
+		"chk")		cmd=$(platform_trx_from_chk_cmd "$trx");;
+		"cybertan")	cmd=$(platform_trx_from_cybertan_cmd "$trx");;
+	esac
+
+	default_do_upgrade "$trx" "$cmd"
+}
diff --git a/target/linux/brcm47xx/config-3.18 b/target/linux/brcm47xx/config-3.18
new file mode 100644
index 0000000..642f9ab
--- /dev/null
+++ b/target/linux/brcm47xx/config-3.18
@@ -0,0 +1,173 @@
+CONFIG_ADM6996_PHY=y
+CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE=y
+CONFIG_ARCH_DISCARD_MEMBLOCK=y
+CONFIG_ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE=y
+# CONFIG_ARCH_HAS_SG_CHAIN is not set
+CONFIG_ARCH_HAVE_CUSTOM_GPIO_H=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MIGHT_HAVE_PC_SERIO=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_WANT_IPC_PARSE_VERSION=y
+CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
+CONFIG_B53=y
+# CONFIG_B53_MMAP_DRIVER is not set
+CONFIG_B53_PHY_DRIVER=y
+CONFIG_B53_PHY_FIXUP=y
+# CONFIG_B53_SRAB_DRIVER is not set
+CONFIG_BCM47XX=y
+CONFIG_BCM47XX_BCMA=y
+CONFIG_BCM47XX_SSB=y
+CONFIG_BCM47XX_WDT=y
+CONFIG_BCMA=y
+CONFIG_BCMA_BLOCKIO=y
+CONFIG_BCMA_DEBUG=y
+CONFIG_BCMA_DRIVER_GMAC_CMN=y
+CONFIG_BCMA_DRIVER_GPIO=y
+CONFIG_BCMA_DRIVER_MIPS=y
+CONFIG_BCMA_DRIVER_PCI=y
+CONFIG_BCMA_DRIVER_PCI_HOSTMODE=y
+CONFIG_BCMA_HOST_PCI=y
+CONFIG_BCMA_HOST_PCI_POSSIBLE=y
+CONFIG_BCMA_HOST_SOC=y
+CONFIG_BCMA_NFLASH=y
+CONFIG_BCMA_SFLASH=y
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+CONFIG_CEVT_R4K=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMDLINE="noinitrd console=ttyS0,115200"
+CONFIG_CMDLINE_BOOL=y
+# CONFIG_CMDLINE_OVERRIDE is not set
+# CONFIG_CPU_BMIPS is not set
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_MIPS32_R1=y
+# CONFIG_CPU_MIPS32_R2 is not set
+CONFIG_CPU_MIPSR1=y
+CONFIG_CPU_MIPSR2_IRQ_VI=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_R4K_FPU=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CSRC_R4K=y
+CONFIG_DMA_NONCOHERENT=y
+# CONFIG_EARLY_PRINTK is not set
+CONFIG_FIXED_PHY=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_IO=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GPIOLIB=y
+CONFIG_GPIO_DEVRES=y
+CONFIG_GPIO_SYSFS=y
+CONFIG_GPIO_WDT=y
+CONFIG_HARDWARE_WATCHPOINTS=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+# CONFIG_HAVE_64BIT_ALIGNED_ACCESS is not set
+CONFIG_HAVE_ARCH_JUMP_LABEL=y
+CONFIG_HAVE_ARCH_KGDB=y
+CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
+CONFIG_HAVE_ARCH_TRACEHOOK=y
+# CONFIG_HAVE_BOOTMEM_INFO_NODE is not set
+CONFIG_HAVE_BPF_JIT=y
+CONFIG_HAVE_CC_STACKPROTECTOR=y
+CONFIG_HAVE_CONTEXT_TRACKING=y
+CONFIG_HAVE_C_RECORDMCOUNT=y
+CONFIG_HAVE_DEBUG_KMEMLEAK=y
+CONFIG_HAVE_DEBUG_STACKOVERFLOW=y
+CONFIG_HAVE_DMA_API_DEBUG=y
+CONFIG_HAVE_DMA_ATTRS=y
+CONFIG_HAVE_DMA_CONTIGUOUS=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_GENERIC_DMA_COHERENT=y
+CONFIG_HAVE_IDE=y
+CONFIG_HAVE_MEMBLOCK=y
+CONFIG_HAVE_MEMBLOCK_NODE_MAP=y
+CONFIG_HAVE_MOD_ARCH_SPECIFIC=y
+CONFIG_HAVE_NET_DSA=y
+CONFIG_HAVE_OPROFILE=y
+CONFIG_HAVE_PERF_EVENTS=y
+CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
+CONFIG_HW_HAS_PCI=y
+CONFIG_HW_RANDOM=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQ_CPU=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_LEDS_GPIO_REGISTER=y
+CONFIG_MDIO_BOARDINFO=y
+CONFIG_MIPS=y
+# CONFIG_MIPS_HUGE_TLB_SUPPORT is not set
+CONFIG_MIPS_L1_CACHE_SHIFT=5
+# CONFIG_MIPS_MACHINE is not set
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MTD_BCM47XXSFLASH=y
+CONFIG_MTD_BCM47XX_PARTS=y
+CONFIG_MTD_NAND=y
+CONFIG_MTD_NAND_BCM47XXNFLASH=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_PHYSMAP=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_PER_CPU_KM=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+# CONFIG_NO_IOPORT_MAP is not set
+CONFIG_PAGEFLAGS_EXTENDED=y
+CONFIG_PCI=y
+CONFIG_PCI_DISABLE_COMMON_QUIRKS=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PHYLIB=y
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_RCU_STALL_COMMON is not set
+# CONFIG_SCSI_DMA is not set
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SSB=y
+CONFIG_SSB_B43_PCI_BRIDGE=y
+CONFIG_SSB_BLOCKIO=y
+CONFIG_SSB_DEBUG=y
+CONFIG_SSB_DRIVER_EXTIF=y
+CONFIG_SSB_DRIVER_GIGE=y
+CONFIG_SSB_DRIVER_GPIO=y
+CONFIG_SSB_DRIVER_MIPS=y
+CONFIG_SSB_DRIVER_PCICORE=y
+CONFIG_SSB_DRIVER_PCICORE_POSSIBLE=y
+CONFIG_SSB_EMBEDDED=y
+CONFIG_SSB_PCICORE_HOSTMODE=y
+CONFIG_SSB_PCIHOST=y
+CONFIG_SSB_PCIHOST_POSSIBLE=y
+CONFIG_SSB_SERIAL=y
+CONFIG_SSB_SFLASH=y
+CONFIG_SSB_SPROM=y
+CONFIG_SWCONFIG=y
+CONFIG_SYS_HAS_CPU_BMIPS=y
+CONFIG_SYS_HAS_CPU_BMIPS32_3300=y
+CONFIG_SYS_HAS_CPU_MIPS32_R1=y
+CONFIG_SYS_HAS_CPU_MIPS32_R2=y
+CONFIG_SYS_HAS_EARLY_PRINTK=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_HIGHMEM=y
+CONFIG_SYS_SUPPORTS_LITTLE_ENDIAN=y
+CONFIG_SYS_SUPPORTS_MIPS16=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_GENERIC_EARLY_PRINTK_8250=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_ZONE_DMA_FLAG=0
diff --git a/target/linux/brcm47xx/config-4.1 b/target/linux/brcm47xx/config-4.1
new file mode 100644
index 0000000..bae7013
--- /dev/null
+++ b/target/linux/brcm47xx/config-4.1
@@ -0,0 +1,184 @@
+CONFIG_ADM6996_PHY=y
+CONFIG_ARCH_BINFMT_ELF_STATE=y
+CONFIG_ARCH_DISCARD_MEMBLOCK=y
+CONFIG_ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE=y
+CONFIG_ARCH_HAS_ELF_RANDOMIZE=y
+# CONFIG_ARCH_HAS_GCOV_PROFILE_ALL is not set
+# CONFIG_ARCH_HAS_SG_CHAIN is not set
+CONFIG_ARCH_HAVE_CUSTOM_GPIO_H=y
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MIGHT_HAVE_PC_SERIO=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARCH_WANT_IPC_PARSE_VERSION=y
+CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
+CONFIG_B53=y
+# CONFIG_B53_MMAP_DRIVER is not set
+CONFIG_B53_PHY_DRIVER=y
+CONFIG_B53_PHY_FIXUP=y
+# CONFIG_B53_SRAB_DRIVER is not set
+CONFIG_BCM47XX=y
+CONFIG_BCM47XX_BCMA=y
+CONFIG_BCM47XX_SSB=y
+CONFIG_BCM47XX_WDT=y
+CONFIG_BCMA=y
+CONFIG_BCMA_BLOCKIO=y
+CONFIG_BCMA_DEBUG=y
+CONFIG_BCMA_DRIVER_GMAC_CMN=y
+CONFIG_BCMA_DRIVER_GPIO=y
+CONFIG_BCMA_DRIVER_MIPS=y
+CONFIG_BCMA_DRIVER_PCI=y
+CONFIG_BCMA_DRIVER_PCI_HOSTMODE=y
+CONFIG_BCMA_HOST_PCI=y
+CONFIG_BCMA_HOST_PCI_POSSIBLE=y
+CONFIG_BCMA_HOST_SOC=y
+CONFIG_BCMA_NFLASH=y
+CONFIG_BCMA_SFLASH=y
+CONFIG_CC_OPTIMIZE_FOR_SIZE=y
+CONFIG_CEVT_R4K=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMDLINE="noinitrd console=ttyS0,115200"
+CONFIG_CMDLINE_BOOL=y
+# CONFIG_CMDLINE_OVERRIDE is not set
+# CONFIG_CPU_BMIPS is not set
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_PREFETCH=y
+CONFIG_CPU_HAS_SYNC=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_MIPS32=y
+CONFIG_CPU_MIPS32_R1=y
+# CONFIG_CPU_MIPS32_R2 is not set
+CONFIG_CPU_MIPSR1=y
+CONFIG_CPU_MIPSR2_IRQ_VI=y
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+CONFIG_CPU_R4K_CACHE_TLB=y
+CONFIG_CPU_R4K_FPU=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CSRC_R4K=y
+CONFIG_DMA_NONCOHERENT=y
+# CONFIG_EARLY_PRINTK is not set
+CONFIG_FIXED_PHY=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_IO=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GPIOLIB=y
+CONFIG_GPIO_DEVRES=y
+CONFIG_GPIO_SYSFS=y
+CONFIG_GPIO_WDT=y
+CONFIG_HARDWARE_WATCHPOINTS=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+# CONFIG_HAVE_64BIT_ALIGNED_ACCESS is not set
+# CONFIG_HAVE_ARCH_BITREVERSE is not set
+CONFIG_HAVE_ARCH_JUMP_LABEL=y
+CONFIG_HAVE_ARCH_KGDB=y
+CONFIG_HAVE_ARCH_SECCOMP_FILTER=y
+CONFIG_HAVE_ARCH_TRACEHOOK=y
+# CONFIG_HAVE_BOOTMEM_INFO_NODE is not set
+CONFIG_HAVE_BPF_JIT=y
+CONFIG_HAVE_CC_STACKPROTECTOR=y
+CONFIG_HAVE_CONTEXT_TRACKING=y
+CONFIG_HAVE_C_RECORDMCOUNT=y
+CONFIG_HAVE_DEBUG_KMEMLEAK=y
+CONFIG_HAVE_DEBUG_STACKOVERFLOW=y
+CONFIG_HAVE_DMA_API_DEBUG=y
+CONFIG_HAVE_DMA_ATTRS=y
+CONFIG_HAVE_DMA_CONTIGUOUS=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_GENERIC_DMA_COHERENT=y
+CONFIG_HAVE_IDE=y
+CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y
+CONFIG_HAVE_MEMBLOCK=y
+CONFIG_HAVE_MEMBLOCK_NODE_MAP=y
+CONFIG_HAVE_MOD_ARCH_SPECIFIC=y
+CONFIG_HAVE_NET_DSA=y
+CONFIG_HAVE_OPROFILE=y
+CONFIG_HAVE_PERF_EVENTS=y
+CONFIG_HAVE_SYSCALL_TRACEPOINTS=y
+CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y
+CONFIG_HW_HAS_PCI=y
+CONFIG_HW_RANDOM=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_INITRAMFS_SOURCE=""
+CONFIG_IRQ_CPU=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_LEDS_GPIO_REGISTER=y
+# CONFIG_LZ4_COMPRESS is not set
+# CONFIG_LZ4_DECOMPRESS is not set
+CONFIG_MDIO_BOARDINFO=y
+CONFIG_MIPS=y
+# CONFIG_MIPS_HUGE_TLB_SUPPORT is not set
+CONFIG_MIPS_L1_CACHE_SHIFT=5
+# CONFIG_MIPS_MACHINE is not set
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MTD_BCM47XXSFLASH=y
+CONFIG_MTD_BCM47XX_PARTS=y
+CONFIG_MTD_NAND=y
+CONFIG_MTD_NAND_BCM47XXNFLASH=y
+CONFIG_MTD_NAND_ECC=y
+CONFIG_MTD_PHYSMAP=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_PER_CPU_KM=y
+CONFIG_NO_EXCEPT_FILL=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+# CONFIG_NO_IOPORT_MAP is not set
+CONFIG_PAGEFLAGS_EXTENDED=y
+CONFIG_PCI=y
+CONFIG_PCI_DISABLE_COMMON_QUIRKS=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+# CONFIG_RCU_EXPEDITE_BOOT is not set
+# CONFIG_RCU_STALL_COMMON is not set
+CONFIG_SCHED_HRTICK=y
+# CONFIG_SCSI_DMA is not set
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SRCU=y
+CONFIG_SSB=y
+CONFIG_SSB_B43_PCI_BRIDGE=y
+CONFIG_SSB_BLOCKIO=y
+CONFIG_SSB_DEBUG=y
+CONFIG_SSB_DRIVER_EXTIF=y
+CONFIG_SSB_DRIVER_GIGE=y
+CONFIG_SSB_DRIVER_GPIO=y
+CONFIG_SSB_DRIVER_MIPS=y
+CONFIG_SSB_DRIVER_PCICORE=y
+CONFIG_SSB_DRIVER_PCICORE_POSSIBLE=y
+CONFIG_SSB_EMBEDDED=y
+CONFIG_SSB_PCICORE_HOSTMODE=y
+CONFIG_SSB_PCIHOST=y
+CONFIG_SSB_PCIHOST_POSSIBLE=y
+CONFIG_SSB_SERIAL=y
+CONFIG_SSB_SFLASH=y
+CONFIG_SSB_SPROM=y
+CONFIG_SWCONFIG=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYS_HAS_CPU_BMIPS=y
+CONFIG_SYS_HAS_CPU_BMIPS32_3300=y
+CONFIG_SYS_HAS_CPU_MIPS32_R1=y
+CONFIG_SYS_HAS_CPU_MIPS32_R2=y
+CONFIG_SYS_HAS_EARLY_PRINTK=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_HIGHMEM=y
+CONFIG_SYS_SUPPORTS_LITTLE_ENDIAN=y
+CONFIG_SYS_SUPPORTS_MIPS16=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USE_GENERIC_EARLY_PRINTK_8250=y
+CONFIG_WATCHDOG_CORE=y
+CONFIG_ZONE_DMA_FLAG=0
diff --git a/target/linux/brcm47xx/generic/profiles/100-Broadcom-b43.mk b/target/linux/brcm47xx/generic/profiles/100-Broadcom-b43.mk
new file mode 100644
index 0000000..4c420fb
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/100-Broadcom-b43.mk
@@ -0,0 +1,20 @@
+#
+# Copyright (C) 2007-2013 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-b43
+  NAME:=Broadcom SoC, all Ethernet, BCM43xx WiFi (b43, default)
+  PACKAGES:=kmod-b44 kmod-tg3 kmod-bgmac kmod-b43 kmod-b43legacy
+endef
+
+define Profile/Broadcom-b43/Description
+	Package set compatible with hardware any Broadcom BCM47xx or BCM535x
+	SoC with Broadcom BCM43xx Wifi cards using the mac80211, b43 and
+	b43legacy drivers and b44, tg3 or bgmac Ethernet driver.
+endef
+
+$(eval $(call Profile,Broadcom-b43))
+
diff --git a/target/linux/brcm47xx/generic/profiles/101-Broadcom-wl.mk b/target/linux/brcm47xx/generic/profiles/101-Broadcom-wl.mk
new file mode 100644
index 0000000..21265da
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/101-Broadcom-wl.mk
@@ -0,0 +1,20 @@
+#
+# Copyright (C) 2010-2013 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-wl
+  NAME:=Broadcom SoC, all Ethernet, BCM43xx WiFi (wl, proprietary)
+  PACKAGES:=-wpad-mini kmod-b44 kmod-tg3 kmod-bgmac kmod-brcm-wl wlc nas
+endef
+
+define Profile/Broadcom-wl/Description
+	Package set compatible with hardware any Broadcom BCM47xx or BCM535x
+	SoC with Broadcom BCM43xx Wifi cards using the proprietary Broadcom
+	wireless "wl" driver and b44, tg3 or bgmac Ethernet driver.
+endef
+
+$(eval $(call Profile,Broadcom-wl))
+
diff --git a/target/linux/brcm47xx/generic/profiles/104-Broadcom-ath5k.mk b/target/linux/brcm47xx/generic/profiles/104-Broadcom-ath5k.mk
new file mode 100644
index 0000000..ca5295f
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/104-Broadcom-ath5k.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2006-2013 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-ath5k
+  NAME:=Broadcom SoC, all Ethernet, Atheros WiFi (ath5k)
+  PACKAGES:=kmod-b44 kmod-tg3 kmod-bgmac kmod-ath5k
+endef
+
+define Profile/Broadcom-ath5k/Description
+	Package set compatible with hardware any Broadcom BCM47xx or BCM535x
+	SoC with Atheros Wifi cards using the mac80211 and ath5k drivers and
+	b44, tg3 or bgmac Ethernet driver.
+endef
+$(eval $(call Profile,Broadcom-ath5k))
+
diff --git a/target/linux/brcm47xx/generic/profiles/105-Broadcom-none.mk b/target/linux/brcm47xx/generic/profiles/105-Broadcom-none.mk
new file mode 100644
index 0000000..301d02a
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/105-Broadcom-none.mk
@@ -0,0 +1,18 @@
+#
+# Copyright (C) 2006-2013 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-none
+  NAME:=Broadcom SoC, all Ethernet, No WiFi
+  PACKAGES:=-wpad-mini kmod-b44 kmod-tg3 kmod-bgmac
+endef
+
+define Profile/Broadcom-none/Description
+	Package set compatible with hardware any Broadcom BCM47xx or BCM535x
+	SoC without any Wifi cards and b44, tg3 or bgmac Ethernet driver.
+endef
+$(eval $(call Profile,Broadcom-none))
+
diff --git a/target/linux/brcm47xx/generic/profiles/200-Broadcom-b44-b43.mk b/target/linux/brcm47xx/generic/profiles/200-Broadcom-b44-b43.mk
new file mode 100644
index 0000000..662a7c8
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/200-Broadcom-b44-b43.mk
@@ -0,0 +1,20 @@
+#
+# Copyright (C) 2007-2013 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-b44-b43
+  NAME:=Broadcom SoC, b44 Ethernet, BCM43xx WiFi (b43, default)
+  PACKAGES:=kmod-b44 kmod-b43 kmod-b43legacy
+endef
+
+define Profile/Broadcom-b44-b43/Description
+	Package set compatible with hardware older Broadcom BCM47xx or BCM535x
+	SoC with Broadcom BCM43xx Wifi cards using the mac80211, b43 and
+	b43legacy drivers and b44 Ethernet driver.
+endef
+
+$(eval $(call Profile,Broadcom-b44-b43))
+
diff --git a/target/linux/brcm47xx/generic/profiles/201-Broadcom-b44-wl.mk b/target/linux/brcm47xx/generic/profiles/201-Broadcom-b44-wl.mk
new file mode 100644
index 0000000..f974c00
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/201-Broadcom-b44-wl.mk
@@ -0,0 +1,20 @@
+#
+# Copyright (C) 2010-2013 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-b44-wl
+  NAME:=Broadcom SoC, b44 Ethernet, BCM43xx WiFi (wl, proprietary)
+  PACKAGES:=-wpad-mini kmod-b44 kmod-brcm-wl wlc nas
+endef
+
+define Profile/Broadcom-b44-wl/Description
+	Package set compatible with hardware older Broadcom BCM47xx or BCM535x
+	SoC with Broadcom BCM43xx Wifi cards using the proprietary Broadcom
+	wireless "wl" driver and b44 Ethernet driver.
+endef
+
+$(eval $(call Profile,Broadcom-b44-wl))
+
diff --git a/target/linux/brcm47xx/generic/profiles/204-Broadcom-b44-ath5k.mk b/target/linux/brcm47xx/generic/profiles/204-Broadcom-b44-ath5k.mk
new file mode 100644
index 0000000..e9dda49
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/204-Broadcom-b44-ath5k.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2006-2013 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-b44-ath5k
+  NAME:=Broadcom SoC, b44 Ethernet, Atheros WiFi (ath5k)
+  PACKAGES:=kmod-b44 kmod-ath5k
+endef
+
+define Profile/Broadcom-b44-ath5k/Description
+	Package set compatible with hardware older Broadcom BCM47xx or BCM535x
+	SoC with Atheros Wifi cards using the mac80211 and ath5k drivers and
+	b44 Ethernet driver.
+endef
+$(eval $(call Profile,Broadcom-b44-ath5k))
+
diff --git a/target/linux/brcm47xx/generic/profiles/205-Broadcom-b44-none.mk b/target/linux/brcm47xx/generic/profiles/205-Broadcom-b44-none.mk
new file mode 100644
index 0000000..a936bba
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/205-Broadcom-b44-none.mk
@@ -0,0 +1,18 @@
+#
+# Copyright (C) 2006-2013 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-b44-none
+  NAME:=Broadcom SoC, b44 Ethernet, No WiFi
+  PACKAGES:=-wpad-mini kmod-b44
+endef
+
+define Profile/Broadcom-b44-none/Description
+	Package set compatible with hardware older Broadcom BCM47xx or BCM535x
+	SoC without any Wifi cards and b44 Ethernet driver.
+endef
+$(eval $(call Profile,Broadcom-b44-none))
+
diff --git a/target/linux/brcm47xx/generic/profiles/210-Broadcom-tg3-b43.mk b/target/linux/brcm47xx/generic/profiles/210-Broadcom-tg3-b43.mk
new file mode 100644
index 0000000..a0bece9
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/210-Broadcom-tg3-b43.mk
@@ -0,0 +1,20 @@
+#
+# Copyright (C) 2007-2013 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-tg3-b43
+  NAME:=Broadcom SoC, tg3 Ethernet, BCM43xx WiFi (b43)
+  PACKAGES:=kmod-b43 kmod-tg3
+endef
+
+define Profile/Broadcom-tg3-b43/Description
+	Package set compatible with hardware Broadcom BCM4705/BCM4785
+	SoCs with Broadcom BCM43xx Wifi cards using the mac80211 and b43
+	driver and tg3 Ethernet driver.
+endef
+
+$(eval $(call Profile,Broadcom-tg3-b43))
+
diff --git a/target/linux/brcm47xx/generic/profiles/211-Broadcom-tg3-wl.mk b/target/linux/brcm47xx/generic/profiles/211-Broadcom-tg3-wl.mk
new file mode 100644
index 0000000..24ac234
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/211-Broadcom-tg3-wl.mk
@@ -0,0 +1,20 @@
+#
+# Copyright (C) 2010-2013 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-tg3-wl
+  NAME:=Broadcom SoC, tg3 Ethernet, BCM43xx WiFi (wl, proprietary)
+  PACKAGES:=-wpad-mini kmod-brcm-wl wlc nas kmod-tg3
+endef
+
+define Profile/Broadcom-tg3-wl/Description
+	Package set compatible with hardware Broadcom BCM4705/BCM4785
+	SoC with Broadcom BCM43xx Wifi cards using the proprietary Broadcom
+	wireless "wl" driver and tg3 Ethernet driver.
+endef
+
+$(eval $(call Profile,Broadcom-tg3-wl))
+
diff --git a/target/linux/brcm47xx/generic/profiles/215-Broadcom-tg3-none.mk b/target/linux/brcm47xx/generic/profiles/215-Broadcom-tg3-none.mk
new file mode 100644
index 0000000..2d13ca8
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/215-Broadcom-tg3-none.mk
@@ -0,0 +1,18 @@
+#
+# Copyright (C) 2006-2013 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-tg3-none
+  NAME:=Broadcom SoC, tg3 Ethernet, no WiFi
+  PACKAGES:=-wpad-mini kmod-tg3
+endef
+
+define Profile/Broadcom-tg3-none/Description
+	Package set compatible with hardware Broadcom BCM4705/BCM4785
+	SoC without any Wifi cards and tg3 Ethernet driver.
+endef
+$(eval $(call Profile,Broadcom-tg3-none))
+
diff --git a/target/linux/brcm47xx/generic/profiles/220-Broadcom-bgmac-b43.mk b/target/linux/brcm47xx/generic/profiles/220-Broadcom-bgmac-b43.mk
new file mode 100644
index 0000000..6ef0691
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/220-Broadcom-bgmac-b43.mk
@@ -0,0 +1,20 @@
+#
+# Copyright (C) 2007-2013 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-bgmac-b43
+  NAME:=Broadcom SoC, bgmac Ethernet, BCM43xx WiFi (b43)
+  PACKAGES:=kmod-bgmac kmod-b43
+endef
+
+define Profile/Broadcom-bgmac-b43/Description
+	Package set compatible with hardware newer Broadcom BCM47xx or BCM535x
+	SoC with Broadcom BCM43xx Wifi cards using the mac80211 and b43
+	drivers and bgmac Ethernet driver.
+endef
+
+$(eval $(call Profile,Broadcom-bgmac-b43))
+
diff --git a/target/linux/brcm47xx/generic/profiles/221-Broadcom-bgmac-wl.mk b/target/linux/brcm47xx/generic/profiles/221-Broadcom-bgmac-wl.mk
new file mode 100644
index 0000000..f671cd9
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/221-Broadcom-bgmac-wl.mk
@@ -0,0 +1,20 @@
+#
+# Copyright (C) 2010-2013 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-bgmac-wl
+  NAME:=Broadcom SoC, bgmac Ethernet, BCM43xx WiFi (wl, proprietary)
+  PACKAGES:=-wpad-mini kmod-bgmac kmod-brcm-wl wlc nas
+endef
+
+define Profile/Broadcom-bgmac-wl/Description
+	Package set compatible with hardware newer Broadcom BCM47xx or BCM535x
+	SoC with Broadcom BCM43xx Wifi cards using the proprietary Broadcom
+	wireless "wl" driver and bgmac Ethernet driver.
+endef
+
+$(eval $(call Profile,Broadcom-bgmac-wl))
+
diff --git a/target/linux/brcm47xx/generic/profiles/225-Broadcom-bgmac-none.mk b/target/linux/brcm47xx/generic/profiles/225-Broadcom-bgmac-none.mk
new file mode 100644
index 0000000..0512119
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/225-Broadcom-bgmac-none.mk
@@ -0,0 +1,18 @@
+#
+# Copyright (C) 2006-2013 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-bgmac-none
+  NAME:=Broadcom SoC, bgmac Ethernet, No WiFi
+  PACKAGES:=-wpad-mini kmod-bgmac
+endef
+
+define Profile/Broadcom-bgmac-none/Description
+	Package set compatible with hardware newer Broadcom BCM47xx or BCM535x
+	SoC without any Wifi cards and bgmac Ethernet driver.
+endef
+$(eval $(call Profile,Broadcom-bgmac-none))
+
diff --git a/target/linux/brcm47xx/generic/profiles/226-Broadcom-bgmac-brcsmac.mk b/target/linux/brcm47xx/generic/profiles/226-Broadcom-bgmac-brcsmac.mk
new file mode 100644
index 0000000..d9dc9e7
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/226-Broadcom-bgmac-brcsmac.mk
@@ -0,0 +1,20 @@
+#
+# Copyright (C) 2007-2013 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-bgmac-brcmsmac
+  NAME:=Broadcom SoC, bgmac Ethernet, BCM43xx WiFi (brcmsmac)
+  PACKAGES:=kmod-bgmac kmod-brcmsmac
+endef
+
+define Profile/Broadcom-bgmac-brcmsmac/Description
+	Package set compatable with newer gigabit + N based bcm47xx SoCs with
+	Broadcom BCM43xx Wifi cards using the mac80211 brcmsmac driver and
+	bgmac Ethernet driver.
+endef
+
+$(eval $(call Profile,Broadcom-bgmac-brcmsmac))
+
diff --git a/target/linux/brcm47xx/generic/profiles/PS-1208MFG.mk b/target/linux/brcm47xx/generic/profiles/PS-1208MFG.mk
new file mode 100644
index 0000000..e68c9a2
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/PS-1208MFG.mk
@@ -0,0 +1,18 @@
+#
+# Copyright (C) 2007-2010 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Ps1208mfg
+  NAME:=Edimax PS-1208MFG
+  PACKAGES:=-firewall -dropbear -dnsmasq -mtd -ppp -wpad-mini kmod-b44 block-mount kmod-usb-storage kmod-usb2 kmod-usb-ohci -iptables -swconfig kmod-fs-ext4
+endef
+
+define Profile/Ps1208mfg/Description
+	Package set optimize for edimax PS-1208MFG printserver
+endef
+
+$(eval $(call Profile,Ps1208mfg))
+
diff --git a/target/linux/brcm47xx/generic/profiles/WGT634U.mk b/target/linux/brcm47xx/generic/profiles/WGT634U.mk
new file mode 100644
index 0000000..16c8d9d
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/WGT634U.mk
@@ -0,0 +1,17 @@
+#
+# Copyright (C) 2006 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/WGT634U
+  NAME:=Netgear WGT634U
+  PACKAGES:=kmod-b44 kmod-ath5k kmod-usb-core kmod-usb2 kmod-ocf-ubsec-ssb
+endef
+
+define Profile/WGT634U/Description
+	Package set compatible with the Netgear WGT634U. Contains USB support
+endef
+$(eval $(call Profile,WGT634U))
+
diff --git a/target/linux/brcm47xx/generic/profiles/WL500GPv1-ATH.mk b/target/linux/brcm47xx/generic/profiles/WL500GPv1-ATH.mk
new file mode 100644
index 0000000..3cdd8a0
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/WL500GPv1-ATH.mk
@@ -0,0 +1,16 @@
+#
+# Copyright (C) 2008 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/WL500GPv1
+  NAME:=ASUS WL-500g Premium v1 (Atheros WiFi using ath5k)
+  PACKAGES:=kmod-b44 kmod-ath5k kmod-usb-core kmod-usb-uhci kmod-usb2
+endef
+
+define Profile/WL500GPv1/Description
+	Package set optimized for the WL-500g Premium v1 with USB and Atheros WiFi card support
+endef
+$(eval $(call Profile,WL500GPv1))
diff --git a/target/linux/brcm47xx/generic/profiles/WRT350Nv1.mk b/target/linux/brcm47xx/generic/profiles/WRT350Nv1.mk
new file mode 100644
index 0000000..c861615
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/WRT350Nv1.mk
@@ -0,0 +1,16 @@
+#
+# Copyright (C) 2009 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/WRT350Nv1
+  NAME:=Linksys WRT350Nv1
+  PACKAGES:=kmod-usb-core kmod-usb-ohci kmod-usb2 kmod-tg3 kmod-ocf-ubsec-ssb
+endef
+
+define Profile/WRT350Nv1/Description
+	Package set compatible with the Linksys WRT350Nv1. Contains USB support
+endef
+$(eval $(call Profile,WRT350Nv1))
diff --git a/target/linux/brcm47xx/generic/profiles/WRTSL54GS.mk b/target/linux/brcm47xx/generic/profiles/WRTSL54GS.mk
new file mode 100644
index 0000000..e5bb908
--- /dev/null
+++ b/target/linux/brcm47xx/generic/profiles/WRTSL54GS.mk
@@ -0,0 +1,17 @@
+#
+# Copyright (C) 2006 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/WRTSL54GS
+  NAME:=Linksys WRTSL54GS
+  PACKAGES:=kmod-b44 kmod-usb-core kmod-usb-ohci kmod-usb2 kmod-usb-storage kmod-scsi-core kmod-fs-ext4 e2fsprogs kmod-b43
+endef
+
+define Profile/WRTSL54GS/Description
+	Package set compatible with the Linksys WRTSL54GS. Contains USB support
+endef
+$(eval $(call Profile,WRTSL54GS))
+
diff --git a/target/linux/brcm47xx/generic/target.mk b/target/linux/brcm47xx/generic/target.mk
new file mode 100644
index 0000000..71fde52
--- /dev/null
+++ b/target/linux/brcm47xx/generic/target.mk
@@ -0,0 +1,7 @@
+BOARDNAME:=Generic
+FEATURES+=pcmcia
+
+define Target/Description
+	Build generic firmware for all Broadcom BCM47xx and BCM53xx MIPS
+	devices. It runs on both architectures BMIPS3300 and MIPS 74K.
+endef
diff --git a/target/linux/brcm47xx/image/Makefile b/target/linux/brcm47xx/image/Makefile
new file mode 100644
index 0000000..8063de0
--- /dev/null
+++ b/target/linux/brcm47xx/image/Makefile
@@ -0,0 +1,383 @@
+#
+# Copyright (C) 2006-2012 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/image.mk
+
+define Build/Clean
+	$(MAKE) -C lzma-loader clean
+endef
+
+define Image/Prepare
+	# Optimized LZMA compression (with dictionary), handled by lzma-loader.
+	cat $(KDIR)/vmlinux | $(STAGING_DIR_HOST)/bin/lzma e -si -so -eos -lc1 -lp2 -pb2 > $(KDIR)/vmlinux.lzma
+
+	# Less optimal LZMA compression (no dictionary), handled by CFE.
+	$(STAGING_DIR_HOST)/bin/lzma e -so -d16 $(KDIR)/vmlinux > $(KDIR)/vmlinux-nodictionary.lzma
+
+	gzip -nc9 $(KDIR)/vmlinux > $(KDIR)/vmlinux.gz
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+	cat $(KDIR)/vmlinux-initramfs | $(STAGING_DIR_HOST)/bin/lzma e -si -so -eos -lc1 -lp2 -pb2 > $(KDIR)/vmlinux-initramfs.lzma
+	$(STAGING_DIR_HOST)/bin/lzma e -so -d16 $(KDIR)/vmlinux-initramfs > $(KDIR)/vmlinux-initramfs-nodictionary.lzma
+endif
+	rm -f $(KDIR)/loader.gz
+	$(MAKE) -C lzma-loader \
+		BUILD_DIR="$(KDIR)" \
+		TARGET="$(KDIR)" \
+		clean install
+	echo -ne "\\x00" >> $(KDIR)/loader.gz
+	rm -f $(KDIR)/fs_mark
+	echo -ne '\xde\xad\xc0\xde' > $(KDIR)/fs_mark
+	$(call prepare_generic_squashfs,$(KDIR)/fs_mark)
+endef
+
+define Image/Build/wgt634u
+	dd if=$(KDIR)/loader.elf of=$(BIN_DIR)/$(IMG_PREFIX)-wgt634u-$(2).bin bs=131072 conv=sync
+	cat $(BIN_DIR)/$(IMG_PREFIX)-$(1).trx >> $(BIN_DIR)/$(IMG_PREFIX)-wgt634u-$(2).bin
+endef
+
+define Image/Build/dwl3150
+	cp $(BIN_DIR)/$(IMG_PREFIX)-$(1).trx $(BIN_DIR)/$(IMG_PREFIX)-dwl3150-$(2).bin
+	echo "BCM-5352-2050-0000000-01" >> $(BIN_DIR)/$(IMG_PREFIX)-dwl3150-$(2).bin
+endef
+
+# $(1): filesystem type.
+# $(2): device model (used for output file).
+# $(3): pattern (device specific magic).
+# $(4): version.
+# $(5): simplified filesystem type (without block size).
+define Image/Build/CyberTAN
+	$(STAGING_DIR_HOST)/bin/addpattern -4 -p $(3) -v v$(4) -i $(BIN_DIR)/$(IMG_PREFIX)-$(1).trx -o $(BIN_DIR)/$(IMG_PREFIX)-$(2)-$(5).bin $(if $(6),-s $(6))
+endef
+define Image/Build/CyberTAN2
+	$(STAGING_DIR_HOST)/bin/addpattern -4 -p $(3) -v v$(4) -i $(BIN_DIR)/$(IMG_PREFIX)-$(2)-$(5).noheader.bin -o $(BIN_DIR)/$(IMG_PREFIX)-$(2)-$(5).bin $(if $(6),-s $(6))
+endef
+define Image/Build/CyberTANHead
+	$(STAGING_DIR_HOST)/bin/addpattern -5 -p $(3) -v v$(4) -i /dev/null -o $(KDIR)/$(IMG_PREFIX)-$(2)-header.bin $(if $(6),-s $(6))
+endef
+
+define Image/Build/Motorola
+	$(STAGING_DIR_HOST)/bin/motorola-bin -$(3) $(BIN_DIR)/$(IMG_PREFIX)-$(1).trx $(BIN_DIR)/$(IMG_PREFIX)-$(2)-$(4).bin
+endef
+
+define Image/Build/USR
+	$(STAGING_DIR_HOST)/bin/trx2usr $(BIN_DIR)/$(IMG_PREFIX)-$(1).trx $(BIN_DIR)/$(IMG_PREFIX)-$(2)-$(3).bin
+endef
+
+define Image/Build/Edi
+	$(STAGING_DIR_HOST)/bin/trx2edips $(BIN_DIR)/$(IMG_PREFIX)-$(1).trx $(BIN_DIR)/$(IMG_PREFIX)-$(2)-$(3).bin
+endef
+
+define Image/Build/Huawei
+	dd if=/dev/zero of=$(BIN_DIR)/$(IMG_PREFIX)-$(2)-$(3)-gz.bin bs=92 count=1
+	echo -ne 'HDR0\x08\x00\x00\x00' >> $(BIN_DIR)/$(IMG_PREFIX)-$(2)-$(3)-gz.bin
+	cat $(BIN_DIR)/$(IMG_PREFIX)-$(1)-gz.trx >> $(BIN_DIR)/$(IMG_PREFIX)-$(2)-$(3)-gz.bin
+endef
+
+# $(1): filesystem type.
+# $(2): device model (used for output file).
+# $(3): board_id (device specific magic).
+# $(4): region.
+# $(5): simplified filesystem type (without block size).
+define Image/Build/Chk
+	$(STAGING_DIR_HOST)/bin/mkchkimg -o $(BIN_DIR)/$(IMG_PREFIX)-$(2)-$(5).chk -k $(BIN_DIR)/$(IMG_PREFIX)-$(1).trx -b $(3) -r $(4)
+endef
+
+define trxalign/jffs2-128k
+-a 0x20000 -f $(KDIR)/root.$(1)
+endef
+define trxalign/jffs2-64k
+-a 0x10000 -f $(KDIR)/root.$(1)
+endef
+define trxalign/squashfs
+-a 1024 -f $(KDIR)/root.$(1) $(if $(2),-f $(2)) -a 0x10000 -A $(KDIR)/fs_mark
+endef
+
+define Image/Build/trxV2
+	$(call Image/Build/CyberTANHead,$(1),$(2),$(3),$(4),$(5),$(if $(6),$(6)))
+	$(STAGING_DIR_HOST)/bin/trx \
+		-m 33554432 \
+		-2 \
+		-o $(BIN_DIR)/$(IMG_PREFIX)-$(2)-$(5).noheader.bin \
+		-f $(KDIR)/loader.gz \
+		-f $(KDIR)/vmlinux.lzma \
+		$(call trxalign/$(1),$(1),$(KDIR)/$(IMG_PREFIX)-$(2)-header.bin)
+	$(call Image/Build/CyberTAN2,$(1),$(2),$(3),$(4),$(5),$(if $(6),$(6)))
+endef
+
+#################################################
+# Images
+#################################################
+
+define Build/trx-with-loader
+	$(STAGING_DIR_HOST)/bin/trx \
+		-m 33554432 \
+		-o $@ \
+		-f $(KDIR)/loader.gz \
+		-f $(word 1,$^) \
+		$(call trxalign/$(FILESYSTEM),$(FILESYSTEM))
+endef
+
+define Build/asus-trx
+	$(STAGING_DIR_HOST)/bin/asustrx -p "$(PRODUCTID)" -i $@ -o $@.new
+	mv $@.new $@
+endef
+
+define Build/linksys-bin
+	$(STAGING_DIR_HOST)/bin/addpattern -4 -p $(DEVICE_ID) -v v$(VERSION) -i $@ -o $@.new
+	mv $@.new $@
+endef
+
+#################################################
+# Devices
+#################################################
+
+DEVICE_VARS += PRODUCTID
+DEVICE_VARS += DEVICE_ID VERSION
+DEVICE_VARS += NETGEAR_BOARD_ID NETGEAR_REGION
+
+define Device/Default
+	KERNEL := kernel-bin
+	IMAGE_NAME = $$(IMAGE_PREFIX)-$$(1).$$(2)
+	KERNEL_NAME = vmlinux.lzma
+	FILESYSTEMS := $(FS_64K)
+	IMAGES := trx
+	IMAGE/trx := trx-with-loader
+endef
+
+define Device/asus
+	IMAGES := trx
+	IMAGE/trx := trx-with-loader | asus-trx
+endef
+
+define AsusDevice
+  define Device/asus-$(1)
+	$$(Device/asus)
+	PRODUCTID := $(2)
+  endef
+  TARGET_DEVICES += asus-$(1)
+endef
+
+define Device/linksys
+	IMAGES := bin
+	IMAGE/bin := trx-with-loader | linksys-bin
+endef
+
+define LinksysDevice
+  define Device/linksys-$(1)
+	$$(Device/linksys)
+	DEVICE_ID := $(2)
+	VERSION := $(3)
+  endef
+  TARGET_DEVICES += linksys-$(1)
+endef
+
+define Device/netgear
+	IMAGES := chk
+	IMAGE/chk := trx-with-loader | netgear-chk
+endef
+
+define NetgearDevice
+  define Device/netgear-$(1)
+	$$(Device/netgear)
+	NETGEAR_BOARD_ID := $(2)
+	NETGEAR_REGION := $(3)
+  endef
+  TARGET_DEVICES += netgear-$(1)
+endef
+
+#################################################
+# Subtarget generic
+#################################################
+
+ifeq ($(SUBTARGET),generic)
+  # BCM4705 with tg3
+  $(eval $(call LinksysDevice,wrt300n-v1.1,EWC2,1.51.2))
+  $(eval $(call LinksysDevice,wrt310n-v1,310N,1.0.10))
+  $(eval $(call LinksysDevice,wrt350n-v1,EWCG,1.04.1))
+  $(eval $(call LinksysDevice,wrt610n-v1,610N,1.0.1))
+
+  # BCMA SoC with SSB WiFi
+  $(eval $(call LinksysDevice,wrt610n-v2,610N,2.0.0))
+  $(eval $(call LinksysDevice,e3000-v1,61XN,1.0.3))
+endif
+
+#################################################
+# Subtarget legacy
+#################################################
+
+# $(1): filesystem type.
+define Image/Build/legacy/devices-with-128k-blocks
+	$(call Image/Build/trxV2,$(1),wrt54g3gv2-vf,3G2V,3.00.24,$(patsubst jffs2-%,jffs2,$(1)),6)
+	$(call Image/Build/wgt634u,$(1),$(patsubst jffs2-%,jffs2,$(1)))
+endef
+
+# $(1): filesystem type.
+define Image/Build/legacy/devices-with-64k-blocks
+	$(call Image/Build/dwl3150,$(1),$(patsubst jffs2-%,jffs2,$(1)))
+	$(call Image/Build/Edi,$(1),ps1208mfg,$(patsubst jffs2-%,jffs2,$(1)))
+	$(call Image/Build/Huawei,$(1),e970,$(1))
+	$(call Image/Build/Motorola,$(1),wa840g,2,$(patsubst jffs2-%,jffs2,$(1)))
+	$(call Image/Build/Motorola,$(1),we800g,3,$(patsubst jffs2-%,jffs2,$(1)))
+	$(call Image/Build/Motorola,$(1),wr850g,1,$(1))
+	$(call Image/Build/USR,$(1),usr5461,$(1))
+endef
+
+# $(1): filesystem type.
+define Image/Build/legacy/jffs2-64k
+	$(call Image/Build/legacy/devices-with-64k-blocks,$(1))
+endef
+
+# $(1): filesystem type.
+define Image/Build/legacy/jffs2-128k
+	$(call Image/Build/legacy/devices-with-128k-blocks,$(1))
+endef
+
+# $(1): filesystem type.
+define Image/Build/legacy/squashfs
+	$(call Image/Build/legacy/devices-with-64k-blocks,$(1))
+	$(call Image/Build/legacy/devices-with-128k-blocks,$(1))
+endef
+
+define Device/linksys-wrt54gs
+	$(Device/linksys)
+	FILESYSTEMS := $(FS_128K)
+	DEVICE_ID := W54S
+	VERSION := 4.80.1
+endef
+
+define Device/linksys-wrtsl54gs
+	$(Device/linksys)
+	FILESYSTEMS := $(FS_128K)
+	DEVICE_ID := W54U
+	VERSION := 2.08.1
+endef
+
+ifeq ($(SUBTARGET),legacy)
+  TARGET_DEVICES += \
+	linksys-wrt54gs \
+	linksys-wrtsl54gs
+
+  $(eval $(call AsusDevice,wl-300g,WL300g      ))
+  $(eval $(call AsusDevice,wl-320gp,WL320gP     ))
+  $(eval $(call AsusDevice,wl-330ge,WL-330gE    ))
+  $(eval $(call AsusDevice,wl-500gp-v1,WL500gp     ))
+  $(eval $(call AsusDevice,wl-500gp-v2,WL500gpv2   ))
+  $(eval $(call AsusDevice,wl-500w,WL500W      ))
+  $(eval $(call AsusDevice,wl-520gu,WL520gu     ))
+  $(eval $(call AsusDevice,wl-550ge,WL550gE     ))
+  $(eval $(call AsusDevice,wl-hdd25,WLHDD       ))
+  $(eval $(call LinksysDevice,wrt54g3g,W54F,2.20.1))
+  $(eval $(call LinksysDevice,wrt54g3g-em,W3GN,2.20.1))
+  $(eval $(call LinksysDevice,wrt54g,W54G,4.71.1))
+  $(eval $(call LinksysDevice,wrt54gs-v4,W54s,1.09.1))
+  $(eval $(call LinksysDevice,wrt150n,N150,1.51.3))
+  $(eval $(call LinksysDevice,wrt160n-v1,N150,1.50.1))
+  $(eval $(call LinksysDevice,wrt300n-v1,EWCB,1.03.6))
+  $(eval $(call NetgearDevice,wgr614-v8,U12H072T00_NETGEAR,2))
+  $(eval $(call NetgearDevice,wndr3300-v1,U12H093T00_NETGEAR,2))
+  $(eval $(call NetgearDevice,wnr834b-v2,U12H081T00_NETGEAR,2))
+endif
+
+#################################################
+# Subtarget mips74k
+#################################################
+
+ifeq ($(SUBTARGET),mips74k)
+  $(eval $(call AsusDevice,rt-ac53u,RT-AC53U))
+# $(eval $(call AsusDevice,rt-ac66u,RT-AC66U))
+  $(eval $(call AsusDevice,rt-n10,RT-N10      ))
+  $(eval $(call AsusDevice,rt-n10p,RT-N10P))
+  $(eval $(call AsusDevice,rt-n10p-v2,RT-N10PV2))
+  $(eval $(call AsusDevice,rt-n10u,RT-N10U))
+  $(eval $(call AsusDevice,rt-n10u-b,RT-N10U))
+  $(eval $(call AsusDevice,rt-n12,RT-N12      ))
+  $(eval $(call AsusDevice,rt-n12-b1,RT-N12B1))
+  $(eval $(call AsusDevice,rt-n12-c1,RT-N12C1))
+  $(eval $(call AsusDevice,rt-n12-d1,RT-N12D1))
+  $(eval $(call AsusDevice,rt-n12hp,RT-N12HP))
+  $(eval $(call AsusDevice,rt-n14uhp,RT-N14UHP))
+  $(eval $(call AsusDevice,rt-n15u,RT-N15U))
+  $(eval $(call AsusDevice,rt-n16,RT-N16))
+  $(eval $(call AsusDevice,rt-n53,RT-N53))
+  $(eval $(call AsusDevice,rt-n66u,RT-N66U))
+  $(eval $(call AsusDevice,rt-n66w,RT-N66U))
+  $(eval $(call LinksysDevice,wrt160n-v3,N150,3.0.3))
+  $(eval $(call LinksysDevice,wrt310n-v2,310N,2.0.1))
+  $(eval $(call LinksysDevice,wrt320n-v1,320N,1.0.5))
+  $(eval $(call LinksysDevice,e900-v1,E900,1.0.4))
+  $(eval $(call LinksysDevice,e1000-v1-v2-v2.1,E100,1.1.3))
+  $(eval $(call LinksysDevice,e1200-v1,E120,1.0.3))
+  $(eval $(call LinksysDevice,e1200-v2,E122,1.0.4))
+  $(eval $(call LinksysDevice,e1500-v1,E150,1.0.5))
+  $(eval $(call LinksysDevice,e1550-v1,1550,1.0.3))
+  $(eval $(call LinksysDevice,e2000-v1,32XN,1.0.4))
+  $(eval $(call LinksysDevice,e2500-v1,E25X,1.0.7))
+  $(eval $(call LinksysDevice,e2500-v2,E25X,2.0.0))
+  $(eval $(call LinksysDevice,e2500-v2.1,25RU,2.1.0))
+  $(eval $(call LinksysDevice,e2500-v3,25V3,3.0.0))
+  $(eval $(call LinksysDevice,e3200-v1,3200,1.0.1))
+  $(eval $(call LinksysDevice,e4200-v1,4200,1.0.5))
+  $(eval $(call NetgearDevice,wgr614-v10_north-america,U12H139T01_NETGEAR,2))
+  $(eval $(call NetgearDevice,wgr614-v10_other-regions,U12H139T01_NETGEAR,1))
+  $(eval $(call NetgearDevice,wndr3400-v1,U12H155T00_NETGEAR,2))
+  $(eval $(call NetgearDevice,wndr3400-v2,U12H187T00_NETGEAR,2))
+  $(eval $(call NetgearDevice,wndr3400-v3,U12H208T00_NETGEAR,1))
+  $(eval $(call NetgearDevice,wndr3700-v3,U12H194T00_NETGEAR,2))
+  $(eval $(call NetgearDevice,wndr4000,U12H181T00_NETGEAR,2))
+  $(eval $(call NetgearDevice,wnr1000-v3,U12H139T00_NETGEAR,2))
+  $(eval $(call NetgearDevice,wnr2000v2,U12H114T00_NETGEAR,2))
+  $(eval $(call NetgearDevice,wnr3000rp,U12H163T01_NETGEAR,1))
+  $(eval $(call NetgearDevice,wnr3500l-v1-north-america,U12H136T99_NETGEAR,2))
+  $(eval $(call NetgearDevice,wnr3500l-v1-other-regions,U12H136T99_NETGEAR,1))
+  $(eval $(call NetgearDevice,wnr3500l-v2,U12H172T00_NETGEAR,1))
+  $(eval $(call NetgearDevice,wnr3500-v2,U12H127T00_NETGEAR,2))
+endif
+
+#################################################
+# Shared BuildImage defines
+#################################################
+
+define Image/Build/Initramfs
+	$(STAGING_DIR_HOST)/bin/trx \
+		-m 33554432 \
+		-o $(BIN_DIR)/$(IMG_PREFIX)-initramfs.trx \
+		-f $(KDIR)/loader.gz \
+		-f $(KDIR)/vmlinux-initramfs.lzma
+	$(STAGING_DIR_HOST)/bin/trx \
+		-m 33554432 \
+		-o $(BIN_DIR)/$(IMG_PREFIX)-initramfs-noloader-nodictionary.trx \
+		-f $(KDIR)/vmlinux-initramfs-nodictionary.lzma
+endef
+
+# $(1): filesystem type.
+define Image/Build
+	$(STAGING_DIR_HOST)/bin/trx \
+		-m 33554432 \
+		-o $(BIN_DIR)/$(IMG_PREFIX)-$(1).trx \
+		-f $(KDIR)/loader.gz -f $(KDIR)/vmlinux.lzma \
+		$(call trxalign/$(1),$(1))
+	$(STAGING_DIR_HOST)/bin/trx \
+		-m 33554432 \
+		-o $(BIN_DIR)/$(IMG_PREFIX)-$(1)-noloader-nodictionary.trx \
+		-f $(KDIR)/vmlinux-nodictionary.lzma \
+		$(call trxalign/$(1),$(1))
+	$(STAGING_DIR_HOST)/bin/trx \
+		-m 33554432 \
+		-o $(BIN_DIR)/$(IMG_PREFIX)-$(1)-gz.trx \
+		-f $(KDIR)/vmlinux.gz \
+		$(call trxalign/$(1),$(1))
+	$(call Image/Build/$(SUBTARGET)/$(1),$(1))
+#	$(call Image/Build/Chk,$(1),wgr614_v9,U12H094T00_NETGEAR,2,$(patsubst jffs2-%,jffs2,$(1)))
+#	$(call Image/Build/Chk,$(1),wndr3400_vcna,U12H155T01_NETGEAR,2,$(patsubst jffs2-%,jffs2,$(1)))
+#	$(call Image/Build/Chk,$(1),wnr3500U,U12H136T00_NETGEAR,2,$(patsubst jffs2-%,jffs2,$(1)))
+#	$(call Image/Build/Chk,$(1),wnr3500v2_VC,U12H127T70_NETGEAR,2,$(patsubst jffs2-%,jffs2,$(1)))
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+	$(call Image/Build/Initramfs)
+endif
+endef
+
+$(eval $(call BuildImage))
diff --git a/target/linux/brcm47xx/image/lzma-loader/Makefile b/target/linux/brcm47xx/image/lzma-loader/Makefile
new file mode 100644
index 0000000..5dd6f50
--- /dev/null
+++ b/target/linux/brcm47xx/image/lzma-loader/Makefile
@@ -0,0 +1,33 @@
+# 
+# Copyright (C) 2006 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME := lzma-loader
+PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
+
+$(PKG_BUILD_DIR)/.prepared:
+	mkdir $(PKG_BUILD_DIR)
+	$(CP) ./src/* $(PKG_BUILD_DIR)/
+	touch $@
+
+$(PKG_BUILD_DIR)/loader.gz: $(PKG_BUILD_DIR)/.prepared
+	$(MAKE) -C $(PKG_BUILD_DIR) CC="$(TARGET_CC)" \
+		LD="$(TARGET_CROSS)ld" CROSS_COMPILE="$(TARGET_CROSS)"
+
+download: 
+prepare: $(PKG_BUILD_DIR)/.prepared
+compile: $(PKG_BUILD_DIR)/loader.gz
+install:
+
+ifneq ($(TARGET),)
+install: compile
+	$(CP) $(PKG_BUILD_DIR)/loader.gz $(PKG_BUILD_DIR)/loader.elf $(TARGET)/
+endif
+
+clean:
+	rm -rf $(PKG_BUILD_DIR)
diff --git a/target/linux/brcm47xx/image/lzma-loader/src/LzmaDecode.c b/target/linux/brcm47xx/image/lzma-loader/src/LzmaDecode.c
new file mode 100644
index 0000000..951700b
--- /dev/null
+++ b/target/linux/brcm47xx/image/lzma-loader/src/LzmaDecode.c
@@ -0,0 +1,663 @@
+/*
+  LzmaDecode.c
+  LZMA Decoder
+  
+  LZMA SDK 4.05 Copyright (c) 1999-2004 Igor Pavlov (2004-08-25)
+  http://www.7-zip.org/
+
+  LZMA SDK is licensed under two licenses:
+  1) GNU Lesser General Public License (GNU LGPL)
+  2) Common Public License (CPL)
+  It means that you can select one of these two licenses and 
+  follow rules of that license.
+
+  SPECIAL EXCEPTION:
+  Igor Pavlov, as the author of this code, expressly permits you to 
+  statically or dynamically link your code (or bind by name) to the 
+  interfaces of this file without subjecting your linked code to the 
+  terms of the CPL or GNU LGPL. Any modifications or additions 
+  to this file, however, are subject to the LGPL or CPL terms.
+*/
+
+#include "LzmaDecode.h"
+
+#ifndef Byte
+#define Byte unsigned char
+#endif
+
+#define kNumTopBits 24
+#define kTopValue ((UInt32)1 << kNumTopBits)
+
+#define kNumBitModelTotalBits 11
+#define kBitModelTotal (1 << kNumBitModelTotalBits)
+#define kNumMoveBits 5
+
+typedef struct _CRangeDecoder
+{
+  Byte *Buffer;
+  Byte *BufferLim;
+  UInt32 Range;
+  UInt32 Code;
+  #ifdef _LZMA_IN_CB
+  ILzmaInCallback *InCallback;
+  int Result;
+  #endif
+  int ExtraBytes;
+} CRangeDecoder;
+
+Byte RangeDecoderReadByte(CRangeDecoder *rd)
+{
+  if (rd->Buffer == rd->BufferLim)
+  {
+    #ifdef _LZMA_IN_CB
+    UInt32 size;
+    rd->Result = rd->InCallback->Read(rd->InCallback, &rd->Buffer, &size);
+    rd->BufferLim = rd->Buffer + size;
+    if (size == 0)
+    #endif
+    {
+      rd->ExtraBytes = 1;
+      return 0xFF;
+    }
+  }
+  return (*rd->Buffer++);
+}
+
+/* #define ReadByte (*rd->Buffer++) */
+#define ReadByte (RangeDecoderReadByte(rd))
+
+void RangeDecoderInit(CRangeDecoder *rd,
+  #ifdef _LZMA_IN_CB
+    ILzmaInCallback *inCallback
+  #else
+    Byte *stream, UInt32 bufferSize
+  #endif
+    )
+{
+  int i;
+  #ifdef _LZMA_IN_CB
+  rd->InCallback = inCallback;
+  rd->Buffer = rd->BufferLim = 0;
+  #else
+  rd->Buffer = stream;
+  rd->BufferLim = stream + bufferSize;
+  #endif
+  rd->ExtraBytes = 0;
+  rd->Code = 0;
+  rd->Range = (0xFFFFFFFF);
+  for(i = 0; i < 5; i++)
+    rd->Code = (rd->Code << 8) | ReadByte;
+}
+
+#define RC_INIT_VAR UInt32 range = rd->Range; UInt32 code = rd->Code;        
+#define RC_FLUSH_VAR rd->Range = range; rd->Code = code;
+#define RC_NORMALIZE if (range < kTopValue) { range <<= 8; code = (code << 8) | ReadByte; }
+
+UInt32 RangeDecoderDecodeDirectBits(CRangeDecoder *rd, int numTotalBits)
+{
+  RC_INIT_VAR
+  UInt32 result = 0;
+  int i;
+  for (i = numTotalBits; i > 0; i--)
+  {
+    /* UInt32 t; */
+    range >>= 1;
+
+    result <<= 1;
+    if (code >= range)
+    {
+      code -= range;
+      result |= 1;
+    }
+    /*
+    t = (code - range) >> 31;
+    t &= 1;
+    code -= range & (t - 1);
+    result = (result + result) | (1 - t);
+    */
+    RC_NORMALIZE
+  }
+  RC_FLUSH_VAR
+  return result;
+}
+
+int RangeDecoderBitDecode(CProb *prob, CRangeDecoder *rd)
+{
+  UInt32 bound = (rd->Range >> kNumBitModelTotalBits) * *prob;
+  if (rd->Code < bound)
+  {
+    rd->Range = bound;
+    *prob += (kBitModelTotal - *prob) >> kNumMoveBits;
+    if (rd->Range < kTopValue)
+    {
+      rd->Code = (rd->Code << 8) | ReadByte;
+      rd->Range <<= 8;
+    }
+    return 0;
+  }
+  else
+  {
+    rd->Range -= bound;
+    rd->Code -= bound;
+    *prob -= (*prob) >> kNumMoveBits;
+    if (rd->Range < kTopValue)
+    {
+      rd->Code = (rd->Code << 8) | ReadByte;
+      rd->Range <<= 8;
+    }
+    return 1;
+  }
+}
+
+#define RC_GET_BIT2(prob, mi, A0, A1) \
+  UInt32 bound = (range >> kNumBitModelTotalBits) * *prob; \
+  if (code < bound) \
+    { A0; range = bound; *prob += (kBitModelTotal - *prob) >> kNumMoveBits; mi <<= 1; } \
+  else \
+    { A1; range -= bound; code -= bound; *prob -= (*prob) >> kNumMoveBits; mi = (mi + mi) + 1; } \
+  RC_NORMALIZE
+
+#define RC_GET_BIT(prob, mi) RC_GET_BIT2(prob, mi, ; , ;)               
+
+int RangeDecoderBitTreeDecode(CProb *probs, int numLevels, CRangeDecoder *rd)
+{
+  int mi = 1;
+  int i;
+  #ifdef _LZMA_LOC_OPT
+  RC_INIT_VAR
+  #endif
+  for(i = numLevels; i > 0; i--)
+  {
+    #ifdef _LZMA_LOC_OPT
+    CProb *prob = probs + mi;
+    RC_GET_BIT(prob, mi)
+    #else
+    mi = (mi + mi) + RangeDecoderBitDecode(probs + mi, rd);
+    #endif
+  }
+  #ifdef _LZMA_LOC_OPT
+  RC_FLUSH_VAR
+  #endif
+  return mi - (1 << numLevels);
+}
+
+int RangeDecoderReverseBitTreeDecode(CProb *probs, int numLevels, CRangeDecoder *rd)
+{
+  int mi = 1;
+  int i;
+  int symbol = 0;
+  #ifdef _LZMA_LOC_OPT
+  RC_INIT_VAR
+  #endif
+  for(i = 0; i < numLevels; i++)
+  {
+    #ifdef _LZMA_LOC_OPT
+    CProb *prob = probs + mi;
+    RC_GET_BIT2(prob, mi, ; , symbol |= (1 << i))
+    #else
+    int bit = RangeDecoderBitDecode(probs + mi, rd);
+    mi = mi + mi + bit;
+    symbol |= (bit << i);
+    #endif
+  }
+  #ifdef _LZMA_LOC_OPT
+  RC_FLUSH_VAR
+  #endif
+  return symbol;
+}
+
+Byte LzmaLiteralDecode(CProb *probs, CRangeDecoder *rd)
+{ 
+  int symbol = 1;
+  #ifdef _LZMA_LOC_OPT
+  RC_INIT_VAR
+  #endif
+  do
+  {
+    #ifdef _LZMA_LOC_OPT
+    CProb *prob = probs + symbol;
+    RC_GET_BIT(prob, symbol)
+    #else
+    symbol = (symbol + symbol) | RangeDecoderBitDecode(probs + symbol, rd);
+    #endif
+  }
+  while (symbol < 0x100);
+  #ifdef _LZMA_LOC_OPT
+  RC_FLUSH_VAR
+  #endif
+  return symbol;
+}
+
+Byte LzmaLiteralDecodeMatch(CProb *probs, CRangeDecoder *rd, Byte matchByte)
+{ 
+  int symbol = 1;
+  #ifdef _LZMA_LOC_OPT
+  RC_INIT_VAR
+  #endif
+  do
+  {
+    int bit;
+    int matchBit = (matchByte >> 7) & 1;
+    matchByte <<= 1;
+    #ifdef _LZMA_LOC_OPT
+    {
+      CProb *prob = probs + ((1 + matchBit) << 8) + symbol;
+      RC_GET_BIT2(prob, symbol, bit = 0, bit = 1)
+    }
+    #else
+    bit = RangeDecoderBitDecode(probs + ((1 + matchBit) << 8) + symbol, rd);
+    symbol = (symbol << 1) | bit;
+    #endif
+    if (matchBit != bit)
+    {
+      while (symbol < 0x100)
+      {
+        #ifdef _LZMA_LOC_OPT
+        CProb *prob = probs + symbol;
+        RC_GET_BIT(prob, symbol)
+        #else
+        symbol = (symbol + symbol) | RangeDecoderBitDecode(probs + symbol, rd);
+        #endif
+      }
+      break;
+    }
+  }
+  while (symbol < 0x100);
+  #ifdef _LZMA_LOC_OPT
+  RC_FLUSH_VAR
+  #endif
+  return symbol;
+}
+
+#define kNumPosBitsMax 4
+#define kNumPosStatesMax (1 << kNumPosBitsMax)
+
+#define kLenNumLowBits 3
+#define kLenNumLowSymbols (1 << kLenNumLowBits)
+#define kLenNumMidBits 3
+#define kLenNumMidSymbols (1 << kLenNumMidBits)
+#define kLenNumHighBits 8
+#define kLenNumHighSymbols (1 << kLenNumHighBits)
+
+#define LenChoice 0
+#define LenChoice2 (LenChoice + 1)
+#define LenLow (LenChoice2 + 1)
+#define LenMid (LenLow + (kNumPosStatesMax << kLenNumLowBits))
+#define LenHigh (LenMid + (kNumPosStatesMax << kLenNumMidBits))
+#define kNumLenProbs (LenHigh + kLenNumHighSymbols) 
+
+int LzmaLenDecode(CProb *p, CRangeDecoder *rd, int posState)
+{
+  if(RangeDecoderBitDecode(p + LenChoice, rd) == 0)
+    return RangeDecoderBitTreeDecode(p + LenLow +
+        (posState << kLenNumLowBits), kLenNumLowBits, rd);
+  if(RangeDecoderBitDecode(p + LenChoice2, rd) == 0)
+    return kLenNumLowSymbols + RangeDecoderBitTreeDecode(p + LenMid +
+        (posState << kLenNumMidBits), kLenNumMidBits, rd);
+  return kLenNumLowSymbols + kLenNumMidSymbols + 
+      RangeDecoderBitTreeDecode(p + LenHigh, kLenNumHighBits, rd);
+}
+
+#define kNumStates 12
+
+#define kStartPosModelIndex 4
+#define kEndPosModelIndex 14
+#define kNumFullDistances (1 << (kEndPosModelIndex >> 1))
+
+#define kNumPosSlotBits 6
+#define kNumLenToPosStates 4
+
+#define kNumAlignBits 4
+#define kAlignTableSize (1 << kNumAlignBits)
+
+#define kMatchMinLen 2
+
+#define IsMatch 0
+#define IsRep (IsMatch + (kNumStates << kNumPosBitsMax))
+#define IsRepG0 (IsRep + kNumStates)
+#define IsRepG1 (IsRepG0 + kNumStates)
+#define IsRepG2 (IsRepG1 + kNumStates)
+#define IsRep0Long (IsRepG2 + kNumStates)
+#define PosSlot (IsRep0Long + (kNumStates << kNumPosBitsMax))
+#define SpecPos (PosSlot + (kNumLenToPosStates << kNumPosSlotBits))
+#define Align (SpecPos + kNumFullDistances - kEndPosModelIndex)
+#define LenCoder (Align + kAlignTableSize)
+#define RepLenCoder (LenCoder + kNumLenProbs)
+#define Literal (RepLenCoder + kNumLenProbs)
+
+#if Literal != LZMA_BASE_SIZE
+StopCompilingDueBUG
+#endif
+
+#ifdef _LZMA_OUT_READ
+
+typedef struct _LzmaVarState
+{
+  CRangeDecoder RangeDecoder;
+  Byte *Dictionary;
+  UInt32 DictionarySize;
+  UInt32 DictionaryPos;
+  UInt32 GlobalPos;
+  UInt32 Reps[4];
+  int lc;
+  int lp;
+  int pb;
+  int State;
+  int PreviousIsMatch;
+  int RemainLen;
+} LzmaVarState;
+
+int LzmaDecoderInit(
+    unsigned char *buffer, UInt32 bufferSize,
+    int lc, int lp, int pb,
+    unsigned char *dictionary, UInt32 dictionarySize,
+    #ifdef _LZMA_IN_CB
+    ILzmaInCallback *inCallback
+    #else
+    unsigned char *inStream, UInt32 inSize
+    #endif
+    )
+{
+  LzmaVarState *vs = (LzmaVarState *)buffer;
+  CProb *p = (CProb *)(buffer + sizeof(LzmaVarState));
+  UInt32 numProbs = Literal + ((UInt32)LZMA_LIT_SIZE << (lc + lp));
+  UInt32 i;
+  if (bufferSize < numProbs * sizeof(CProb) + sizeof(LzmaVarState))
+    return LZMA_RESULT_NOT_ENOUGH_MEM;
+  vs->Dictionary = dictionary;
+  vs->DictionarySize = dictionarySize;
+  vs->DictionaryPos = 0;
+  vs->GlobalPos = 0;
+  vs->Reps[0] = vs->Reps[1] = vs->Reps[2] = vs->Reps[3] = 1;
+  vs->lc = lc;
+  vs->lp = lp;
+  vs->pb = pb;
+  vs->State = 0;
+  vs->PreviousIsMatch = 0;
+  vs->RemainLen = 0;
+  dictionary[dictionarySize - 1] = 0;
+  for (i = 0; i < numProbs; i++)
+    p[i] = kBitModelTotal >> 1; 
+  RangeDecoderInit(&vs->RangeDecoder, 
+      #ifdef _LZMA_IN_CB
+      inCallback
+      #else
+      inStream, inSize
+      #endif
+  );
+  return LZMA_RESULT_OK;
+}
+
+int LzmaDecode(unsigned char *buffer, 
+    unsigned char *outStream, UInt32 outSize,
+    UInt32 *outSizeProcessed)
+{
+  LzmaVarState *vs = (LzmaVarState *)buffer;
+  CProb *p = (CProb *)(buffer + sizeof(LzmaVarState));
+  CRangeDecoder rd = vs->RangeDecoder;
+  int state = vs->State;
+  int previousIsMatch = vs->PreviousIsMatch;
+  Byte previousByte;
+  UInt32 rep0 = vs->Reps[0], rep1 = vs->Reps[1], rep2 = vs->Reps[2], rep3 = vs->Reps[3];
+  UInt32 nowPos = 0;
+  UInt32 posStateMask = (1 << (vs->pb)) - 1;
+  UInt32 literalPosMask = (1 << (vs->lp)) - 1;
+  int lc = vs->lc;
+  int len = vs->RemainLen;
+  UInt32 globalPos = vs->GlobalPos;
+
+  Byte *dictionary = vs->Dictionary;
+  UInt32 dictionarySize = vs->DictionarySize;
+  UInt32 dictionaryPos = vs->DictionaryPos;
+
+  if (len == -1)
+  {
+    *outSizeProcessed = 0;
+    return LZMA_RESULT_OK;
+  }
+
+  while(len > 0 && nowPos < outSize)
+  {
+    UInt32 pos = dictionaryPos - rep0;
+    if (pos >= dictionarySize)
+      pos += dictionarySize;
+    outStream[nowPos++] = dictionary[dictionaryPos] = dictionary[pos];
+    if (++dictionaryPos == dictionarySize)
+      dictionaryPos = 0;
+    len--;
+  }
+  if (dictionaryPos == 0)
+    previousByte = dictionary[dictionarySize - 1];
+  else
+    previousByte = dictionary[dictionaryPos - 1];
+#else
+
+int LzmaDecode(
+    Byte *buffer, UInt32 bufferSize,
+    int lc, int lp, int pb,
+    #ifdef _LZMA_IN_CB
+    ILzmaInCallback *inCallback,
+    #else
+    unsigned char *inStream, UInt32 inSize,
+    #endif
+    unsigned char *outStream, UInt32 outSize,
+    UInt32 *outSizeProcessed)
+{
+  UInt32 numProbs = Literal + ((UInt32)LZMA_LIT_SIZE << (lc + lp));
+  CProb *p = (CProb *)buffer;
+  CRangeDecoder rd;
+  UInt32 i;
+  int state = 0;
+  int previousIsMatch = 0;
+  Byte previousByte = 0;
+  UInt32 rep0 = 1, rep1 = 1, rep2 = 1, rep3 = 1;
+  UInt32 nowPos = 0;
+  UInt32 posStateMask = (1 << pb) - 1;
+  UInt32 literalPosMask = (1 << lp) - 1;
+  int len = 0;
+  if (bufferSize < numProbs * sizeof(CProb))
+    return LZMA_RESULT_NOT_ENOUGH_MEM;
+  for (i = 0; i < numProbs; i++)
+    p[i] = kBitModelTotal >> 1; 
+  RangeDecoderInit(&rd, 
+      #ifdef _LZMA_IN_CB
+      inCallback
+      #else
+      inStream, inSize
+      #endif
+      );
+#endif
+
+  *outSizeProcessed = 0;
+  while(nowPos < outSize)
+  {
+    int posState = (int)(
+        (nowPos 
+        #ifdef _LZMA_OUT_READ
+        + globalPos
+        #endif
+        )
+        & posStateMask);
+    #ifdef _LZMA_IN_CB
+    if (rd.Result != LZMA_RESULT_OK)
+      return rd.Result;
+    #endif
+    if (rd.ExtraBytes != 0)
+      return LZMA_RESULT_DATA_ERROR;
+    if (RangeDecoderBitDecode(p + IsMatch + (state << kNumPosBitsMax) + posState, &rd) == 0)
+    {
+      CProb *probs = p + Literal + (LZMA_LIT_SIZE * 
+        (((
+        (nowPos 
+        #ifdef _LZMA_OUT_READ
+        + globalPos
+        #endif
+        )
+        & literalPosMask) << lc) + (previousByte >> (8 - lc))));
+
+      if (state < 4) state = 0;
+      else if (state < 10) state -= 3;
+      else state -= 6;
+      if (previousIsMatch)
+      {
+        Byte matchByte;
+        #ifdef _LZMA_OUT_READ
+        UInt32 pos = dictionaryPos - rep0;
+        if (pos >= dictionarySize)
+          pos += dictionarySize;
+        matchByte = dictionary[pos];
+        #else
+        matchByte = outStream[nowPos - rep0];
+        #endif
+        previousByte = LzmaLiteralDecodeMatch(probs, &rd, matchByte);
+        previousIsMatch = 0;
+      }
+      else
+        previousByte = LzmaLiteralDecode(probs, &rd);
+      outStream[nowPos++] = previousByte;
+      #ifdef _LZMA_OUT_READ
+      dictionary[dictionaryPos] = previousByte;
+      if (++dictionaryPos == dictionarySize)
+        dictionaryPos = 0;
+      #endif
+    }
+    else             
+    {
+      previousIsMatch = 1;
+      if (RangeDecoderBitDecode(p + IsRep + state, &rd) == 1)
+      {
+        if (RangeDecoderBitDecode(p + IsRepG0 + state, &rd) == 0)
+        {
+          if (RangeDecoderBitDecode(p + IsRep0Long + (state << kNumPosBitsMax) + posState, &rd) == 0)
+          {
+            #ifdef _LZMA_OUT_READ
+            UInt32 pos;
+            #endif
+            if (
+               (nowPos 
+                #ifdef _LZMA_OUT_READ
+                + globalPos
+                #endif
+               )
+               == 0)
+              return LZMA_RESULT_DATA_ERROR;
+            state = state < 7 ? 9 : 11;
+            #ifdef _LZMA_OUT_READ
+            pos = dictionaryPos - rep0;
+            if (pos >= dictionarySize)
+              pos += dictionarySize;
+            previousByte = dictionary[pos];
+            dictionary[dictionaryPos] = previousByte;
+            if (++dictionaryPos == dictionarySize)
+              dictionaryPos = 0;
+            #else
+            previousByte = outStream[nowPos - rep0];
+            #endif
+            outStream[nowPos++] = previousByte;
+            continue;
+          }
+        }
+        else
+        {
+          UInt32 distance;
+          if(RangeDecoderBitDecode(p + IsRepG1 + state, &rd) == 0)
+            distance = rep1;
+          else 
+          {
+            if(RangeDecoderBitDecode(p + IsRepG2 + state, &rd) == 0)
+              distance = rep2;
+            else
+            {
+              distance = rep3;
+              rep3 = rep2;
+            }
+            rep2 = rep1;
+          }
+          rep1 = rep0;
+          rep0 = distance;
+        }
+        len = LzmaLenDecode(p + RepLenCoder, &rd, posState);
+        state = state < 7 ? 8 : 11;
+      }
+      else
+      {
+        int posSlot;
+        rep3 = rep2;
+        rep2 = rep1;
+        rep1 = rep0;
+        state = state < 7 ? 7 : 10;
+        len = LzmaLenDecode(p + LenCoder, &rd, posState);
+        posSlot = RangeDecoderBitTreeDecode(p + PosSlot +
+            ((len < kNumLenToPosStates ? len : kNumLenToPosStates - 1) << 
+            kNumPosSlotBits), kNumPosSlotBits, &rd);
+        if (posSlot >= kStartPosModelIndex)
+        {
+          int numDirectBits = ((posSlot >> 1) - 1);
+          rep0 = ((2 | ((UInt32)posSlot & 1)) << numDirectBits);
+          if (posSlot < kEndPosModelIndex)
+          {
+            rep0 += RangeDecoderReverseBitTreeDecode(
+                p + SpecPos + rep0 - posSlot - 1, numDirectBits, &rd);
+          }
+          else
+          {
+            rep0 += RangeDecoderDecodeDirectBits(&rd, 
+                numDirectBits - kNumAlignBits) << kNumAlignBits;
+            rep0 += RangeDecoderReverseBitTreeDecode(p + Align, kNumAlignBits, &rd);
+          }
+        }
+        else
+          rep0 = posSlot;
+        rep0++;
+      }
+      if (rep0 == (UInt32)(0))
+      {
+        /* it's for stream version */
+        len = -1;
+        break;
+      }
+      if (rep0 > nowPos 
+        #ifdef _LZMA_OUT_READ
+        + globalPos
+        #endif
+        )
+      {
+        return LZMA_RESULT_DATA_ERROR;
+      }
+      len += kMatchMinLen;
+      do
+      {
+        #ifdef _LZMA_OUT_READ
+        UInt32 pos = dictionaryPos - rep0;
+        if (pos >= dictionarySize)
+          pos += dictionarySize;
+        previousByte = dictionary[pos];
+        dictionary[dictionaryPos] = previousByte;
+        if (++dictionaryPos == dictionarySize)
+          dictionaryPos = 0;
+        #else
+        previousByte = outStream[nowPos - rep0];
+        #endif
+        outStream[nowPos++] = previousByte;
+        len--;
+      }
+      while(len > 0 && nowPos < outSize);
+    }
+  }
+
+  #ifdef _LZMA_OUT_READ
+  vs->RangeDecoder = rd;
+  vs->DictionaryPos = dictionaryPos;
+  vs->GlobalPos = globalPos + nowPos;
+  vs->Reps[0] = rep0;
+  vs->Reps[1] = rep1;
+  vs->Reps[2] = rep2;
+  vs->Reps[3] = rep3;
+  vs->State = state;
+  vs->PreviousIsMatch = previousIsMatch;
+  vs->RemainLen = len;
+  #endif
+
+  *outSizeProcessed = nowPos;
+  return LZMA_RESULT_OK;
+}
diff --git a/target/linux/brcm47xx/image/lzma-loader/src/LzmaDecode.h b/target/linux/brcm47xx/image/lzma-loader/src/LzmaDecode.h
new file mode 100644
index 0000000..f58944e
--- /dev/null
+++ b/target/linux/brcm47xx/image/lzma-loader/src/LzmaDecode.h
@@ -0,0 +1,100 @@
+/* 
+  LzmaDecode.h
+  LZMA Decoder interface
+
+  LZMA SDK 4.05 Copyright (c) 1999-2004 Igor Pavlov (2004-08-25)
+  http://www.7-zip.org/
+
+  LZMA SDK is licensed under two licenses:
+  1) GNU Lesser General Public License (GNU LGPL)
+  2) Common Public License (CPL)
+  It means that you can select one of these two licenses and 
+  follow rules of that license.
+
+  SPECIAL EXCEPTION:
+  Igor Pavlov, as the author of this code, expressly permits you to 
+  statically or dynamically link your code (or bind by name) to the 
+  interfaces of this file without subjecting your linked code to the 
+  terms of the CPL or GNU LGPL. Any modifications or additions 
+  to this file, however, are subject to the LGPL or CPL terms.
+*/
+
+#ifndef __LZMADECODE_H
+#define __LZMADECODE_H
+
+/* #define _LZMA_IN_CB */
+/* Use callback for input data */
+
+/* #define _LZMA_OUT_READ */
+/* Use read function for output data */
+
+/* #define _LZMA_PROB32 */
+/* It can increase speed on some 32-bit CPUs, 
+   but memory usage will be doubled in that case */
+
+/* #define _LZMA_LOC_OPT */
+/* Enable local speed optimizations inside code */
+
+#ifndef UInt32
+#ifdef _LZMA_UINT32_IS_ULONG
+#define UInt32 unsigned long
+#else
+#define UInt32 unsigned int
+#endif
+#endif
+
+#ifdef _LZMA_PROB32
+#define CProb UInt32
+#else
+#define CProb unsigned short
+#endif
+
+#define LZMA_RESULT_OK 0
+#define LZMA_RESULT_DATA_ERROR 1
+#define LZMA_RESULT_NOT_ENOUGH_MEM 2
+
+#ifdef _LZMA_IN_CB
+typedef struct _ILzmaInCallback
+{
+  int (*Read)(void *object, unsigned char **buffer, UInt32 *bufferSize);
+} ILzmaInCallback;
+#endif
+
+#define LZMA_BASE_SIZE 1846
+#define LZMA_LIT_SIZE 768
+
+/* 
+bufferSize = (LZMA_BASE_SIZE + (LZMA_LIT_SIZE << (lc + lp)))* sizeof(CProb)
+bufferSize += 100 in case of _LZMA_OUT_READ
+by default CProb is unsigned short, 
+but if specify _LZMA_PROB_32, CProb will be UInt32(unsigned int)
+*/
+
+#ifdef _LZMA_OUT_READ
+int LzmaDecoderInit(
+    unsigned char *buffer, UInt32 bufferSize,
+    int lc, int lp, int pb,
+    unsigned char *dictionary, UInt32 dictionarySize,
+  #ifdef _LZMA_IN_CB
+    ILzmaInCallback *inCallback
+  #else
+    unsigned char *inStream, UInt32 inSize
+  #endif
+);
+#endif
+
+int LzmaDecode(
+    unsigned char *buffer, 
+  #ifndef _LZMA_OUT_READ
+    UInt32 bufferSize,
+    int lc, int lp, int pb,
+  #ifdef _LZMA_IN_CB
+    ILzmaInCallback *inCallback,
+  #else
+    unsigned char *inStream, UInt32 inSize,
+  #endif
+  #endif
+    unsigned char *outStream, UInt32 outSize,
+    UInt32 *outSizeProcessed);
+
+#endif
diff --git a/target/linux/brcm47xx/image/lzma-loader/src/Makefile b/target/linux/brcm47xx/image/lzma-loader/src/Makefile
new file mode 100644
index 0000000..3320e56
--- /dev/null
+++ b/target/linux/brcm47xx/image/lzma-loader/src/Makefile
@@ -0,0 +1,77 @@
+#
+# Makefile for Broadcom BCM947XX boards
+#
+# Copyright 2001-2003, Broadcom Corporation
+# All Rights Reserved.
+# 
+# THIS SOFTWARE IS OFFERED "AS IS", AND BROADCOM GRANTS NO WARRANTIES OF ANY
+# KIND, EXPRESS OR IMPLIED, BY STATUTE, COMMUNICATION OR OTHERWISE. BROADCOM
+# SPECIFICALLY DISCLAIMS ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS
+# FOR A SPECIFIC PURPOSE OR NONINFRINGEMENT CONCERNING THIS SOFTWARE.
+#
+# Copyright 2004  Manuel Novoa III <mjn3@codepoet.org>
+#   Modified to support bzip'd kernels.
+#   Of course, it would be better to integrate bunzip capability into CFE.
+#
+# Copyright 2005  Oleg I. Vdovikin <oleg@cs.msu.su>
+#   Cleaned up, modified for lzma support, removed from kernel
+#
+
+TEXT_START	:= 0x80001000
+BZ_TEXT_START	:= 0x80400000
+
+OBJCOPY		:= $(CROSS_COMPILE)objcopy -O binary -R .reginfo -R .note -R .comment -R .mdebug -S
+
+CFLAGS		= -D__KERNEL__ -Wall -Wstrict-prototypes -Wno-trigraphs -Os \
+		  -fno-strict-aliasing -fno-common -fomit-frame-pointer -G 0 -mno-abicalls -fno-pic \
+		  -ffunction-sections -pipe -mlong-calls -fno-common \
+		  -mabi=32 -march=mips32 -Wa,-32 -Wa,-march=mips32 -Wa,-mips32 -Wa,--trap
+CFLAGS		+= -DLOADADDR=$(TEXT_START) -D_LZMA_IN_CB
+
+ASFLAGS		= $(CFLAGS) -D__ASSEMBLY__ -DBZ_TEXT_START=$(BZ_TEXT_START)
+
+SEDFLAGS	:= s/BZ_TEXT_START/$(BZ_TEXT_START)/;s/TEXT_START/$(TEXT_START)/
+
+OBJECTS		:= head.o data.o
+
+all: loader.gz loader.elf
+
+# Don't build dependencies, this may die if $(CC) isn't gcc
+dep:
+
+install:
+
+loader.gz: loader
+	gzip -nc9 $< > $@
+
+loader.elf: loader.o
+	cp $< $@
+
+loader: loader.o
+	$(OBJCOPY) $< $@
+
+loader.o: loader.lds $(OBJECTS)
+	$(LD) -static --gc-sections -no-warn-mismatch -T loader.lds -o $@ $(OBJECTS)
+
+loader.lds: loader.lds.in Makefile
+	@sed "$(SEDFLAGS)" < $< > $@
+
+data.o: data.lds decompress.image
+	$(LD) -no-warn-mismatch -T data.lds -r -o $@ -b binary decompress.image -b elf32-tradlittlemips
+
+data.lds:
+	@echo "SECTIONS { .data : { code_start = .; *(.data) code_stop = .; }}" > $@
+
+decompress.image: decompress
+	$(OBJCOPY) $< $@
+
+decompress: decompress.lds decompress.o LzmaDecode.o
+	$(LD) -static --gc-sections -no-warn-mismatch -T decompress.lds -o $@ decompress.o LzmaDecode.o
+
+decompress.lds: decompress.lds.in Makefile
+	@sed "$(SEDFLAGS)" < $< > $@
+
+mrproper: clean
+
+clean:
+	rm -f loader.gz loader decompress *.lds *.o *.image
diff --git a/target/linux/brcm47xx/image/lzma-loader/src/README b/target/linux/brcm47xx/image/lzma-loader/src/README
new file mode 100644
index 0000000..16649e9
--- /dev/null
+++ b/target/linux/brcm47xx/image/lzma-loader/src/README
@@ -0,0 +1,55 @@
+/*
+ * LZMA compressed kernel decompressor for bcm947xx boards
+ *
+ * Copyright (C) 2005 by Oleg I. Vdovikin <oleg@cs.msu.su>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ */
+
+The code is intended to decompress kernel, being compressed using lzma utility
+build using 7zip LZMA SDK. This utility is located in the LZMA_Alone directory
+
+decompressor code expects that your .trx file consist of three partitions: 
+
+1) decompressor itself (this is gziped code which pmon/cfe will extract and run
+on boot-up instead of real kernel)
+2) LZMA compressed kernel (both streamed and regular modes are supported now)
+3) Root filesystem
+
+Please be sure to apply the following patch for use this new trx layout (it will
+allow using both new and old trx files for root filesystem lookup code)
+
+--- linuz/arch/mips/brcm-boards/bcm947xx/setup.c        2005-01-23 19:24:27.503322896 +0300
++++ linux/arch/mips/brcm-boards/bcm947xx/setup.c        2005-01-23 19:29:05.237100944 +0300
+@@ -221,7 +221,9 @@
+                /* Try looking at TRX header for rootfs offset */
+                if (le32_to_cpu(trx->magic) == TRX_MAGIC) {
+                        bcm947xx_parts[1].offset = off;
+-                       if (le32_to_cpu(trx->offsets[1]) > off)
++                       if (le32_to_cpu(trx->offsets[2]) > off)
++                               off = le32_to_cpu(trx->offsets[2]);
++                       else if (le32_to_cpu(trx->offsets[1]) > off)
+                                off = le32_to_cpu(trx->offsets[1]);
+                        continue;
+                }
+
+
+Revision history:
+	0.02	Initial release
+	0.03	Added Mineharu Takahara <mtakahar@yahoo.com> patch to pass actual
+		output size to decoder (stream mode compressed input is not 
+		a requirement anymore)
+	0.04	Reordered functions using lds script
diff --git a/target/linux/brcm47xx/image/lzma-loader/src/decompress.c b/target/linux/brcm47xx/image/lzma-loader/src/decompress.c
new file mode 100644
index 0000000..05681b1
--- /dev/null
+++ b/target/linux/brcm47xx/image/lzma-loader/src/decompress.c
@@ -0,0 +1,186 @@
+/*
+ * LZMA compressed kernel decompressor for bcm947xx boards
+ *
+ * Copyright (C) 2005 by Oleg I. Vdovikin <oleg@cs.msu.su>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ *
+ * Please note, this was code based on the bunzip2 decompressor code
+ * by Manuel Novoa III  (mjn3@codepoet.org), although the only thing left
+ * is an idea and part of original vendor code
+ *
+ *
+ * 12-Mar-2005  Mineharu Takahara <mtakahar@yahoo.com>
+ *   pass actual output size to decoder (stream mode
+ *   compressed input is not a requirement anymore)
+ *
+ * 24-Apr-2005 Oleg I. Vdovikin
+ *   reordered functions using lds script, removed forward decl
+ *
+ */
+
+#include "LzmaDecode.h"
+
+#define BCM4710_FLASH		0x1fc00000	/* Flash */
+
+#define KSEG0			0x80000000
+#define KSEG1			0xa0000000
+
+#define KSEG1ADDR(a)		((((unsigned)(a)) & 0x1fffffffU) | KSEG1)
+
+#define Index_Invalidate_I	0x00
+#define Index_Writeback_Inv_D   0x01
+
+#define cache_unroll(base,op)	\
+	__asm__ __volatile__(		\
+		".set noreorder;\n"		\
+		".set mips3;\n"			\
+		"cache %1, (%0);\n"		\
+		".set mips0;\n"			\
+		".set reorder\n"		\
+		:						\
+		: "r" (base),			\
+		  "i" (op));
+
+static __inline__ void blast_icache(unsigned long size, unsigned long lsize)
+{
+	unsigned long start = KSEG0;
+	unsigned long end = (start + size);
+
+	while(start < end) {
+		cache_unroll(start,Index_Invalidate_I);
+		start += lsize;
+	}
+}
+
+static __inline__ void blast_dcache(unsigned long size, unsigned long lsize)
+{
+	unsigned long start = KSEG0;
+	unsigned long end = (start + size);
+
+	while(start < end) {
+		cache_unroll(start,Index_Writeback_Inv_D);
+		start += lsize;
+	}
+}
+
+#define TRX_MAGIC       0x30524448      /* "HDR0" */
+
+struct trx_header {
+	unsigned int magic;		/* "HDR0" */
+	unsigned int len;		/* Length of file including header */
+	unsigned int crc32;		/* 32-bit CRC from flag_version to end of file */
+	unsigned int flag_version;	/* 0:15 flags, 16:31 version */
+	unsigned int offsets[3];	/* Offsets of partitions from start of header */
+};
+
+#define EDIMAX_PS_HEADER_MAGIC	0x36315350 /*  "PS16"  */
+#define EDIMAX_PS_HEADER_LEN	0xc /* 12 bytes long for edimax header */
+
+/* beyound the image end, size not known in advance */
+extern unsigned char workspace[];
+
+unsigned int offset;
+unsigned char *data;
+
+/* flash access should be aligned, so wrapper is used */
+/* read byte from the flash, all accesses are 32-bit aligned */
+static int read_byte(void *object, unsigned char **buffer, UInt32 *bufferSize)
+{
+	static unsigned int val;
+
+	if (((unsigned int)offset % 4) == 0) {
+		val = *(unsigned int *)data;
+		data += 4;
+	}
+	
+	*bufferSize = 1;
+	*buffer = ((unsigned char *)&val) + (offset++ & 3);
+	
+	return LZMA_RESULT_OK;
+}
+
+static __inline__ unsigned char get_byte(void)
+{
+	unsigned char *buffer;
+	UInt32 fake;
+	
+	return read_byte(0, &buffer, &fake), *buffer;
+}
+
+/* should be the first function */
+void entry(unsigned long icache_size, unsigned long icache_lsize, 
+	unsigned long dcache_size, unsigned long dcache_lsize,
+	unsigned long fw_arg0, unsigned long fw_arg1,
+	unsigned long fw_arg2, unsigned long fw_arg3)
+{
+	unsigned int i;  /* temp value */
+	unsigned int lc; /* literal context bits */
+	unsigned int lp; /* literal pos state bits */
+	unsigned int pb; /* pos state bits */
+	unsigned int osize; /* uncompressed size */
+
+	ILzmaInCallback callback;
+	callback.Read = read_byte;
+
+	/* look for trx header, 32-bit data access */
+	for (data = ((unsigned char *) KSEG1ADDR(BCM4710_FLASH));
+		((struct trx_header *)data)->magic != TRX_MAGIC &&
+		((struct trx_header *)data)->magic != EDIMAX_PS_HEADER_MAGIC;
+		 data += 65536);
+
+	if (((struct trx_header *)data)->magic == EDIMAX_PS_HEADER_MAGIC)
+		data += EDIMAX_PS_HEADER_LEN;
+	/* compressed kernel is in the partition 0 or 1 */
+	if (((struct trx_header *)data)->offsets[1] > 65536) 
+		data += ((struct trx_header *)data)->offsets[0];
+	else
+		data += ((struct trx_header *)data)->offsets[1];
+
+	offset = 0;
+
+	/* lzma args */
+	i = get_byte();
+	lc = i % 9, i = i / 9;
+	lp = i % 5, pb = i / 5;
+
+	/* skip rest of the LZMA coder property */
+	for (i = 0; i < 4; i++)
+		get_byte();
+
+	/* read the lower half of uncompressed size in the header */
+	osize = ((unsigned int)get_byte()) +
+		((unsigned int)get_byte() << 8) +
+		((unsigned int)get_byte() << 16) +
+		((unsigned int)get_byte() << 24);
+
+	/* skip rest of the header (upper half of uncompressed size) */
+	for (i = 0; i < 4; i++) 
+		get_byte();
+
+	/* decompress kernel */
+	if (LzmaDecode(workspace, ~0, lc, lp, pb, &callback,
+		(unsigned char*)LOADADDR, osize, &i) == LZMA_RESULT_OK)
+	{
+		blast_dcache(dcache_size, dcache_lsize);
+		blast_icache(icache_size, icache_lsize);
+
+		/* Jump to load address */
+		((void (*)(unsigned long, unsigned long, unsigned long,
+			unsigned long)) LOADADDR)(fw_arg0, fw_arg1, fw_arg2,
+				fw_arg3);
+	}
+}
diff --git a/target/linux/brcm47xx/image/lzma-loader/src/decompress.lds.in b/target/linux/brcm47xx/image/lzma-loader/src/decompress.lds.in
new file mode 100644
index 0000000..33f56f8
--- /dev/null
+++ b/target/linux/brcm47xx/image/lzma-loader/src/decompress.lds.in
@@ -0,0 +1,20 @@
+OUTPUT_ARCH(mips)
+ENTRY(entry)
+SECTIONS {
+	. = BZ_TEXT_START;
+	.text : {
+		*(.text.entry)
+		*(.text)
+		*(.rodata)
+	}
+
+	.data : {
+		*(.data)
+	}
+
+	.bss : {
+		*(.bss)
+	}
+
+	workspace = .;
+}
diff --git a/target/linux/brcm47xx/image/lzma-loader/src/head.S b/target/linux/brcm47xx/image/lzma-loader/src/head.S
new file mode 100644
index 0000000..3a33e40
--- /dev/null
+++ b/target/linux/brcm47xx/image/lzma-loader/src/head.S
@@ -0,0 +1,160 @@
+/* Copyright 2005 Oleg I. Vdovikin (oleg@cs.msu.su)	*/
+/* cache manipulation adapted from Broadcom code 	*/
+/* idea taken from original bunzip2 decompressor code	*/
+/* Copyright 2004 Manuel Novoa III (mjn3@codepoet.org)	*/
+/* Licensed under the linux kernel's version of the GPL.*/
+
+#include <asm/asm.h>
+#include <asm/regdef.h>
+
+#define KSEG0		0x80000000
+
+#define C0_CONFIG	$16
+#define C0_TAGLO	$28
+#define C0_TAGHI	$29
+
+#define	CONF1_DA_SHIFT	7			/* D$ associativity */
+#define CONF1_DA_MASK	0x00000380
+#define CONF1_DA_BASE	1
+#define CONF1_DL_SHIFT	10			/* D$ line size */
+#define CONF1_DL_MASK	0x00001c00
+#define CONF1_DL_BASE	2
+#define CONF1_DS_SHIFT	13			/* D$ sets/way */
+#define CONF1_DS_MASK	0x0000e000
+#define CONF1_DS_BASE	64
+#define CONF1_IA_SHIFT	16			/* I$ associativity */
+#define CONF1_IA_MASK	0x00070000
+#define CONF1_IA_BASE	1
+#define CONF1_IL_SHIFT	19			/* I$ line size */
+#define CONF1_IL_MASK	0x00380000
+#define CONF1_IL_BASE	2
+#define CONF1_IS_SHIFT	22			/* Instruction cache sets/way */
+#define CONF1_IS_MASK	0x01c00000
+#define CONF1_IS_BASE	64
+
+#define Index_Invalidate_I	0x00
+#define Index_Writeback_Inv_D   0x01
+
+	.text
+	LEAF(startup)
+	.set noreorder
+	addi    sp, -48 
+	sw      a0, 16(sp) 
+	sw      a1, 20(sp) 
+	sw      a2, 24(sp) 
+	sw      a3, 28(sp)
+	
+	/* Copy decompressor code to the right place */
+	li	t2, BZ_TEXT_START
+	add	a0, t2, 0
+	la      a1, code_start
+	la	a2, code_stop
+$L1:
+	lw	t0, 0(a1)
+	sw	t0, 0(a0)
+	add	a1, 4
+	add	a0, 4
+	blt	a1, a2, $L1
+	nop
+	
+	/* At this point we need to invalidate dcache and */
+	/* icache before jumping to new code */
+
+1:	/* Get cache sizes */
+	.set	mips32
+	mfc0	s0,C0_CONFIG,1
+	.set	mips0
+
+	li	s1,CONF1_DL_MASK
+	and	s1,s0
+	beq	s1,zero,nodc
+	nop
+
+	srl	s1,CONF1_DL_SHIFT
+	li	t0,CONF1_DL_BASE
+	sll	s1,t0,s1		/* s1 has D$ cache line size */
+
+	li	s2,CONF1_DA_MASK
+	and	s2,s0
+	srl	s2,CONF1_DA_SHIFT
+	addiu	s2,CONF1_DA_BASE	/* s2 now has D$ associativity */
+
+	li	t0,CONF1_DS_MASK
+	and	t0,s0
+	srl	t0,CONF1_DS_SHIFT
+	li	s3,CONF1_DS_BASE
+	sll	s3,s3,t0		/* s3 has D$ sets per way */
+
+	multu	s2,s3			/* sets/way * associativity */
+	mflo	t0			/* total cache lines */
+
+	multu	s1,t0			/* D$ linesize * lines */
+	mflo	s2			/* s2 is now D$ size in bytes */
+
+	/* Initilize the D$: */
+	mtc0	zero,C0_TAGLO
+	mtc0	zero,C0_TAGHI
+
+	li	t0,KSEG0		/* Just an address for the first $ line */
+	addu	t1,t0,s2		/*  + size of cache == end */
+
+	.set	mips3
+1:	cache	Index_Writeback_Inv_D,0(t0)
+	.set	mips0
+	bne	t0,t1,1b
+	addu	t0,s1
+	
+nodc:
+	/* Now we get to do it all again for the I$ */
+	
+	move	s3,zero			/* just in case there is no icache */
+	move	s4,zero
+
+	li	t0,CONF1_IL_MASK
+	and	t0,s0
+	beq	t0,zero,noic
+	nop
+
+	srl	t0,CONF1_IL_SHIFT
+	li	s3,CONF1_IL_BASE
+	sll	s3,t0			/* s3 has I$ cache line size */
+
+	li	t0,CONF1_IA_MASK
+	and	t0,s0
+	srl	t0,CONF1_IA_SHIFT
+	addiu	s4,t0,CONF1_IA_BASE	/* s4 now has I$ associativity */
+
+	li	t0,CONF1_IS_MASK
+	and	t0,s0
+	srl	t0,CONF1_IS_SHIFT
+	li	s5,CONF1_IS_BASE
+	sll	s5,t0			/* s5 has I$ sets per way */
+
+	multu	s4,s5			/* sets/way * associativity */
+	mflo	t0			/* s4 is now total cache lines */
+
+	multu	s3,t0			/* I$ linesize * lines */
+	mflo	s4			/* s4 is cache size in bytes */
+
+	/* Initilize the I$: */
+	mtc0	zero,C0_TAGLO
+	mtc0	zero,C0_TAGHI
+
+	li	t0,KSEG0		/* Just an address for the first $ line */
+	addu	t1,t0,s4		/*  + size of cache == end */
+
+	.set	mips3
+1:	cache	Index_Invalidate_I,0(t0)
+	.set	mips0
+	bne	t0,t1,1b
+	addu	t0,s3
+
+noic:
+	move	a0,s3			/* icache line size */
+	move	a1,s4			/* icache size */
+	move	a2,s1			/* dcache line size */
+	jal	t2
+	move	a3,s2			/* dcache size */
+	
+	.set reorder
+	END(startup)
diff --git a/target/linux/brcm47xx/image/lzma-loader/src/loader.lds.in b/target/linux/brcm47xx/image/lzma-loader/src/loader.lds.in
new file mode 100644
index 0000000..20f2ea9
--- /dev/null
+++ b/target/linux/brcm47xx/image/lzma-loader/src/loader.lds.in
@@ -0,0 +1,17 @@
+OUTPUT_ARCH(mips)
+ENTRY(startup)
+SECTIONS {
+	. = TEXT_START;
+	.text : {
+		*(.text)
+		*(.rodata)
+	}
+
+	.data : {
+		*(.data)
+	}
+
+	.bss : {
+		*(.bss)
+	}
+}
diff --git a/target/linux/brcm47xx/legacy/config-default b/target/linux/brcm47xx/legacy/config-default
new file mode 100644
index 0000000..8a52e47
--- /dev/null
+++ b/target/linux/brcm47xx/legacy/config-default
@@ -0,0 +1,8 @@
+CONFIG_B44=y
+CONFIG_B44_PCI=y
+CONFIG_B44_PCICORE_AUTOSELECT=y
+CONFIG_B44_PCI_AUTOSELECT=y
+# CONFIG_BCM47XX_BCMA is not set
+# CONFIG_BCMA is not set
+# CONFIG_MTD_NAND is not set
+# CONFIG_SSB_DRIVER_GIGE is not set
diff --git a/target/linux/brcm47xx/legacy/profiles/100-Broadcom-b43.mk b/target/linux/brcm47xx/legacy/profiles/100-Broadcom-b43.mk
new file mode 100644
index 0000000..50d7770
--- /dev/null
+++ b/target/linux/brcm47xx/legacy/profiles/100-Broadcom-b43.mk
@@ -0,0 +1,20 @@
+#
+# Copyright (C) 2007-2013 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-b43
+  NAME:=Broadcom SoC, all Ethernet, BCM43xx WiFi (b43, default)
+  PACKAGES:=kmod-b43 kmod-b43legacy
+endef
+
+define Profile/Broadcom-b43/Description
+	Package set compatible with hardware any Broadcom BCM47xx or BCM535x
+	SoC with Broadcom BCM43xx Wifi cards using the mac80211, b43 and
+	b43legacy drivers and b44, tg3 or bgmac Ethernet driver.
+endef
+
+$(eval $(call Profile,Broadcom-b43))
+
diff --git a/target/linux/brcm47xx/legacy/profiles/101-Broadcom-wl.mk b/target/linux/brcm47xx/legacy/profiles/101-Broadcom-wl.mk
new file mode 100644
index 0000000..6a4c5b0
--- /dev/null
+++ b/target/linux/brcm47xx/legacy/profiles/101-Broadcom-wl.mk
@@ -0,0 +1,20 @@
+#
+# Copyright (C) 2010-2013 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-wl
+  NAME:=Broadcom SoC, all Ethernet, BCM43xx WiFi (wl, proprietary)
+  PACKAGES:=-wpad-mini kmod-brcm-wl-mini wlc nas
+endef
+
+define Profile/Broadcom-wl/Description
+	Package set compatible with hardware any Broadcom BCM47xx or BCM535x
+	SoC with Broadcom BCM43xx Wifi cards using the proprietary Broadcom
+	wireless "wl" driver and b44, tg3 or bgmac Ethernet driver.
+endef
+
+$(eval $(call Profile,Broadcom-wl))
+
diff --git a/target/linux/brcm47xx/legacy/profiles/WGT634U.mk b/target/linux/brcm47xx/legacy/profiles/WGT634U.mk
new file mode 100644
index 0000000..ebe5e23
--- /dev/null
+++ b/target/linux/brcm47xx/legacy/profiles/WGT634U.mk
@@ -0,0 +1,17 @@
+#
+# Copyright (C) 2006 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/WGT634U
+  NAME:=Netgear WGT634U
+  PACKAGES:=kmod-ath5k kmod-usb-core kmod-usb2 kmod-ocf-ubsec-ssb
+endef
+
+define Profile/WGT634U/Description
+	Package set compatible with the Netgear WGT634U. Contains USB support
+endef
+$(eval $(call Profile,WGT634U))
+
diff --git a/target/linux/brcm47xx/legacy/profiles/WRTSL54GS.mk b/target/linux/brcm47xx/legacy/profiles/WRTSL54GS.mk
new file mode 100644
index 0000000..8c48483
--- /dev/null
+++ b/target/linux/brcm47xx/legacy/profiles/WRTSL54GS.mk
@@ -0,0 +1,17 @@
+#
+# Copyright (C) 2006 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/WRTSL54GS
+  NAME:=Linksys WRTSL54GS
+  PACKAGES:=kmod-usb-core kmod-usb-ohci kmod-usb2 kmod-usb-storage kmod-scsi-core kmod-fs-ext4 e2fsprogs kmod-b43
+endef
+
+define Profile/WRTSL54GS/Description
+	Package set compatible with the Linksys WRTSL54GS. Contains USB support
+endef
+$(eval $(call Profile,WRTSL54GS))
+
diff --git a/target/linux/brcm47xx/legacy/target.mk b/target/linux/brcm47xx/legacy/target.mk
new file mode 100644
index 0000000..7310896
--- /dev/null
+++ b/target/linux/brcm47xx/legacy/target.mk
@@ -0,0 +1,8 @@
+FEATURES += low_mem pcmcia
+BOARDNAME:=Legacy (BMIPS3300)
+
+define Target/Description
+	Build firmware for Broadcom BCM47xx and BCM53xx devices with
+	BMIPS3300 CPU except for BCM4705 SoC.
+	Supported SoCs: BCM5352E, BCM5354, BCM5365?, BCM4712, BCM4704.
+endef
diff --git a/target/linux/brcm47xx/mips74k/config-default b/target/linux/brcm47xx/mips74k/config-default
new file mode 100644
index 0000000..09ff5a9
--- /dev/null
+++ b/target/linux/brcm47xx/mips74k/config-default
@@ -0,0 +1,19 @@
+# CONFIG_ADM6996_PHY is not set
+# CONFIG_BCM47XX_SSB is not set
+CONFIG_BGMAC=y
+CONFIG_BOUNCE=y
+# CONFIG_CPU_MIPS32_R1 is not set
+# CONFIG_CPU_MIPSR1 is not set
+CONFIG_CPU_MIPS32_R2=y
+CONFIG_CPU_MIPSR2=y
+# CONFIG_FIXED_PHY is not set
+# CONFIG_GPIO_WDT is not set
+CONFIG_HIGHMEM=y
+# CONFIG_SSB is not set
+# CONFIG_SSB_DRIVER_EXTIF is not set
+# CONFIG_SSB_DRIVER_GIGE is not set
+# CONFIG_SSB_DRIVER_MIPS is not set
+# CONFIG_SSB_EMBEDDED is not set
+# CONFIG_SSB_PCICORE_HOSTMODE is not set
+# CONFIG_SSB_SERIAL is not set
+# CONFIG_SSB_SFLASH is not set
diff --git a/target/linux/brcm47xx/mips74k/profiles/100-Broadcom-b43.mk b/target/linux/brcm47xx/mips74k/profiles/100-Broadcom-b43.mk
new file mode 100644
index 0000000..bd3b010
--- /dev/null
+++ b/target/linux/brcm47xx/mips74k/profiles/100-Broadcom-b43.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2014 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-mips74k-b43
+  NAME:=Broadcom SoC, BCM43xx WiFi (b43)
+  PACKAGES:=kmod-b43
+endef
+
+define Profile/Broadcom-mips74k-b43/Description
+	Package set for devices with BCM43xx WiFi including mac80211 and b43
+	driver.
+endef
+
+$(eval $(call Profile,Broadcom-mips74k-b43))
+
diff --git a/target/linux/brcm47xx/mips74k/profiles/101-Broadcom-brcsmac.mk b/target/linux/brcm47xx/mips74k/profiles/101-Broadcom-brcsmac.mk
new file mode 100644
index 0000000..a138ef9
--- /dev/null
+++ b/target/linux/brcm47xx/mips74k/profiles/101-Broadcom-brcsmac.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2014 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-mips74k-brcmsmac
+  NAME:=Broadcom SoC, BCM43xx WiFi (brcmsmac)
+  PACKAGES:=kmod-brcmsmac
+endef
+
+define Profile/Broadcom-mips74k-brcmsmac/Description
+	Package set for devices with BCM43xx WiFi including mac80211 and
+	brcmsmac driver.
+endef
+
+$(eval $(call Profile,Broadcom-mips74k-brcmsmac))
+
diff --git a/target/linux/brcm47xx/mips74k/profiles/102-Broadcom-wl.mk b/target/linux/brcm47xx/mips74k/profiles/102-Broadcom-wl.mk
new file mode 100644
index 0000000..502fff4
--- /dev/null
+++ b/target/linux/brcm47xx/mips74k/profiles/102-Broadcom-wl.mk
@@ -0,0 +1,19 @@
+#
+# Copyright (C) 2014 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-mips74k-wl
+  NAME:=Broadcom SoC, BCM43xx WiFi (proprietary wl)
+  PACKAGES:=-wpad-mini kmod-brcm-wl wlc nas
+endef
+
+define Profile/Broadcom-mips74k-wl/Description
+	Package set for devices with BCM43xx WiFi including proprietary (and
+	closed source) driver "wl".
+endef
+
+$(eval $(call Profile,Broadcom-mips74k-wl))
+
diff --git a/target/linux/brcm47xx/mips74k/profiles/103-Broadcom-none.mk b/target/linux/brcm47xx/mips74k/profiles/103-Broadcom-none.mk
new file mode 100644
index 0000000..5790527
--- /dev/null
+++ b/target/linux/brcm47xx/mips74k/profiles/103-Broadcom-none.mk
@@ -0,0 +1,18 @@
+#
+# Copyright (C) 2014 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define Profile/Broadcom-mips74k-none
+  NAME:=Broadcom SoC, No WiFi
+  PACKAGES:=-wpad-mini
+endef
+
+define Profile/Broadcom-mips74k-none/Description
+	Package set for devices without a WiFi.
+endef
+
+$(eval $(call Profile,Broadcom-mips74k-none))
+
diff --git a/target/linux/brcm47xx/mips74k/target.mk b/target/linux/brcm47xx/mips74k/target.mk
new file mode 100644
index 0000000..ccefa21
--- /dev/null
+++ b/target/linux/brcm47xx/mips74k/target.mk
@@ -0,0 +1,9 @@
+BOARDNAME:=MIPS 74K
+CPU_TYPE:=74kc
+CPU_SUBTYPE:=dsp2
+FEATURES+=mips16
+
+define Target/Description
+	Build firmware for Broadcom BCM47xx and BCM53xx devices with
+	MIPS 74K CPU.
+endef
diff --git a/target/linux/brcm47xx/modules.mk b/target/linux/brcm47xx/modules.mk
new file mode 100644
index 0000000..305643f
--- /dev/null
+++ b/target/linux/brcm47xx/modules.mk
@@ -0,0 +1,36 @@
+#
+# Copyright (C) 2006-2012 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+define KernelPackage/ocf-ubsec-ssb
+  TITLE:=BCM5365P IPSec Core driver
+  DEPENDS:=@TARGET_brcm47xx @!TARGET_brcm47xx_mips74k +kmod-crypto-ocf
+  KCONFIG:=CONFIG_OCF_UBSEC_SSB
+  FILES:=$(LINUX_DIR)/crypto/ocf/ubsec_ssb/ubsec_ssb.ko
+  AUTOLOAD:=$(call AutoLoad,10,ubsec_ssb)
+  $(call AddDepends/crypto)
+endef
+
+define KernelPackage/ocf-ubsec-ssb/description
+  This package contains the OCF driver for the BCM5365p IPSec Core
+endef
+
+$(eval $(call KernelPackage,ocf-ubsec-ssb))
+
+define KernelPackage/bgmac
+  TITLE:=Broadcom bgmac driver
+  KCONFIG:=CONFIG_BGMAC
+  DEPENDS:=@TARGET_brcm47xx @!TARGET_brcm47xx_legacy
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  FILES:=$(LINUX_DIR)/drivers/net/ethernet/broadcom/bgmac.ko
+  AUTOLOAD:=$(call AutoLoad,19,bgmac,1)
+endef
+
+define KernelPackage/bgmac/description
+ Kernel modules for Broadcom bgmac Ethernet adapters.
+endef
+
+$(eval $(call KernelPackage,bgmac))
diff --git a/target/linux/brcm47xx/patches-3.18/030-01-MIPS-BCM47XX-Get-rid-of-calls-to-KSEG1ADDR.patch b/target/linux/brcm47xx/patches-3.18/030-01-MIPS-BCM47XX-Get-rid-of-calls-to-KSEG1ADDR.patch
new file mode 100644
index 0000000..6f33548
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/030-01-MIPS-BCM47XX-Get-rid-of-calls-to-KSEG1ADDR.patch
@@ -0,0 +1,127 @@
+From 8d602dd0f984e8488ab891344ebdb6e1f3128c4a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Wed, 3 Sep 2014 22:51:06 +0200
+Subject: [PATCH 154/158] MIPS: BCM47XX: Get rid of calls to KSEG1ADDR
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We should be using ioremap_nocache helper which handles remaps in a
+smarter way.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: http://patchwork.linux-mips.org/patch/7611/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 44 ++++++++++++++++++++++++++++++++------------
+ 1 file changed, 32 insertions(+), 12 deletions(-)
+
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -23,13 +23,13 @@
+ static char nvram_buf[NVRAM_SPACE];
+ static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
+ 
+-static u32 find_nvram_size(u32 end)
++static u32 find_nvram_size(void __iomem *end)
+ {
+-	struct nvram_header *header;
++	struct nvram_header __iomem *header;
+ 	int i;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(nvram_sizes); i++) {
+-		header = (struct nvram_header *)KSEG1ADDR(end - nvram_sizes[i]);
++		header = (struct nvram_header *)(end - nvram_sizes[i]);
+ 		if (header->magic == NVRAM_HEADER)
+ 			return nvram_sizes[i];
+ 	}
+@@ -38,35 +38,39 @@ static u32 find_nvram_size(u32 end)
+ }
+ 
+ /* Probe for NVRAM header */
+-static int nvram_find_and_copy(u32 base, u32 lim)
++static int nvram_find_and_copy(void __iomem *iobase, u32 lim)
+ {
+-	struct nvram_header *header;
++	struct nvram_header __iomem *header;
+ 	int i;
+ 	u32 off;
+ 	u32 *src, *dst;
+ 	u32 size;
+ 
++	if (nvram_buf[0]) {
++		pr_warn("nvram already initialized\n");
++		return -EEXIST;
++	}
++
+ 	/* TODO: when nvram is on nand flash check for bad blocks first. */
+ 	off = FLASH_MIN;
+ 	while (off <= lim) {
+ 		/* Windowed flash access */
+-		size = find_nvram_size(base + off);
++		size = find_nvram_size(iobase + off);
+ 		if (size) {
+-			header = (struct nvram_header *)KSEG1ADDR(base + off -
+-								  size);
++			header = (struct nvram_header *)(iobase + off - size);
+ 			goto found;
+ 		}
+ 		off <<= 1;
+ 	}
+ 
+ 	/* Try embedded NVRAM at 4 KB and 1 KB as last resorts */
+-	header = (struct nvram_header *) KSEG1ADDR(base + 4096);
++	header = (struct nvram_header *)(iobase + 4096);
+ 	if (header->magic == NVRAM_HEADER) {
+ 		size = NVRAM_SPACE;
+ 		goto found;
+ 	}
+ 
+-	header = (struct nvram_header *) KSEG1ADDR(base + 1024);
++	header = (struct nvram_header *)(iobase + 1024);
+ 	if (header->magic == NVRAM_HEADER) {
+ 		size = NVRAM_SPACE;
+ 		goto found;
+@@ -94,6 +98,22 @@ found:
+ 	return 0;
+ }
+ 
++static int bcm47xx_nvram_init_from_mem(u32 base, u32 lim)
++{
++	void __iomem *iobase;
++	int err;
++
++	iobase = ioremap_nocache(base, lim);
++	if (!iobase)
++		return -ENOMEM;
++
++	err = nvram_find_and_copy(iobase, lim);
++
++	iounmap(iobase);
++
++	return err;
++}
++
+ #ifdef CONFIG_BCM47XX_SSB
+ static int nvram_init_ssb(void)
+ {
+@@ -109,7 +129,7 @@ static int nvram_init_ssb(void)
+ 		return -ENXIO;
+ 	}
+ 
+-	return nvram_find_and_copy(base, lim);
++	return bcm47xx_nvram_init_from_mem(base, lim);
+ }
+ #endif
+ 
+@@ -139,7 +159,7 @@ static int nvram_init_bcma(void)
+ 		return -ENXIO;
+ 	}
+ 
+-	return nvram_find_and_copy(base, lim);
++	return bcm47xx_nvram_init_from_mem(base, lim);
+ }
+ #endif
+ 
diff --git a/target/linux/brcm47xx/patches-3.18/030-02-MIPS-BCM47XX-Make-ssb-init-NVRAM-instead-of-bcm47xx-.patch b/target/linux/brcm47xx/patches-3.18/030-02-MIPS-BCM47XX-Make-ssb-init-NVRAM-instead-of-bcm47xx-.patch
new file mode 100644
index 0000000..ce924d9
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/030-02-MIPS-BCM47XX-Make-ssb-init-NVRAM-instead-of-bcm47xx-.patch
@@ -0,0 +1,124 @@
+From 21400f252a97755579b43a4dc95dd02cd7f0ca75 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Wed, 3 Sep 2014 22:59:45 +0200
+Subject: [PATCH 155/158] MIPS: BCM47XX: Make ssb init NVRAM instead of bcm47xx
+ polling it
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This makes NVRAM code less bcm47xx/ssb specific allowing it to become a
+standalone driver in the future. A similar patch for bcma will follow
+when it's ready.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/7612/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c                          | 30 +++++++---------------
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h |  1 +
+ drivers/ssb/driver_mipscore.c                      | 14 +++++++++-
+ 3 files changed, 23 insertions(+), 22 deletions(-)
+
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -98,7 +98,14 @@ found:
+ 	return 0;
+ }
+ 
+-static int bcm47xx_nvram_init_from_mem(u32 base, u32 lim)
++/*
++ * On bcm47xx we need access to the NVRAM very early, so we can't use mtd
++ * subsystem to access flash. We can't even use platform device / driver to
++ * store memory offset.
++ * To handle this we provide following symbol. It's supposed to be called as
++ * soon as we get info about flash device, before any NVRAM entry is needed.
++ */
++int bcm47xx_nvram_init_from_mem(u32 base, u32 lim)
+ {
+ 	void __iomem *iobase;
+ 	int err;
+@@ -114,25 +121,6 @@ static int bcm47xx_nvram_init_from_mem(u
+ 	return err;
+ }
+ 
+-#ifdef CONFIG_BCM47XX_SSB
+-static int nvram_init_ssb(void)
+-{
+-	struct ssb_mipscore *mcore = &bcm47xx_bus.ssb.mipscore;
+-	u32 base;
+-	u32 lim;
+-
+-	if (mcore->pflash.present) {
+-		base = mcore->pflash.window;
+-		lim = mcore->pflash.window_size;
+-	} else {
+-		pr_err("Couldn't find supported flash memory\n");
+-		return -ENXIO;
+-	}
+-
+-	return bcm47xx_nvram_init_from_mem(base, lim);
+-}
+-#endif
+-
+ #ifdef CONFIG_BCM47XX_BCMA
+ static int nvram_init_bcma(void)
+ {
+@@ -168,7 +156,7 @@ static int nvram_init(void)
+ 	switch (bcm47xx_bus_type) {
+ #ifdef CONFIG_BCM47XX_SSB
+ 	case BCM47XX_BUS_TYPE_SSB:
+-		return nvram_init_ssb();
++		break;
+ #endif
+ #ifdef CONFIG_BCM47XX_BCMA
+ 	case BCM47XX_BUS_TYPE_BCMA:
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h
+@@ -32,6 +32,7 @@ struct nvram_header {
+ #define NVRAM_MAX_VALUE_LEN 255
+ #define NVRAM_MAX_PARAM_LEN 64
+ 
++int bcm47xx_nvram_init_from_mem(u32 base, u32 lim);
+ extern int bcm47xx_nvram_getenv(char *name, char *val, size_t val_len);
+ 
+ static inline void bcm47xx_nvram_parse_macaddr(char *buf, u8 macaddr[6])
+--- a/drivers/ssb/driver_mipscore.c
++++ b/drivers/ssb/driver_mipscore.c
+@@ -15,6 +15,9 @@
+ #include <linux/serial_core.h>
+ #include <linux/serial_reg.h>
+ #include <linux/time.h>
++#ifdef CONFIG_BCM47XX
++#include <bcm47xx_nvram.h>
++#endif
+ 
+ #include "ssb_private.h"
+ 
+@@ -210,6 +213,7 @@ static void ssb_mips_serial_init(struct
+ static void ssb_mips_flash_detect(struct ssb_mipscore *mcore)
+ {
+ 	struct ssb_bus *bus = mcore->dev->bus;
++	struct ssb_sflash *sflash = &mcore->sflash;
+ 	struct ssb_pflash *pflash = &mcore->pflash;
+ 
+ 	/* When there is no chipcommon on the bus there is 4MB flash */
+@@ -242,7 +246,15 @@ static void ssb_mips_flash_detect(struct
+ 	}
+ 
+ ssb_pflash:
+-	if (pflash->present) {
++	if (sflash->present) {
++#ifdef CONFIG_BCM47XX
++		bcm47xx_nvram_init_from_mem(sflash->window, sflash->size);
++#endif
++	} else if (pflash->present) {
++#ifdef CONFIG_BCM47XX
++		bcm47xx_nvram_init_from_mem(pflash->window, pflash->window_size);
++#endif
++
+ 		ssb_pflash_data.width = pflash->buswidth;
+ 		ssb_pflash_resource.start = pflash->window;
+ 		ssb_pflash_resource.end = pflash->window + pflash->window_size;
diff --git a/target/linux/brcm47xx/patches-3.18/030-03-MIPS-BCM47XX-Make-bcma-init-NVRAM-instead-of-bcm47xx.patch b/target/linux/brcm47xx/patches-3.18/030-03-MIPS-BCM47XX-Make-bcma-init-NVRAM-instead-of-bcm47xx.patch
new file mode 100644
index 0000000..000e4b5
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/030-03-MIPS-BCM47XX-Make-bcma-init-NVRAM-instead-of-bcm47xx.patch
@@ -0,0 +1,106 @@
+From 7177efc5b030012c54c2e217c9d6decc0bcc1c53 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 28 Oct 2014 13:30:23 +0100
+Subject: [PATCH 156/158] MIPS: BCM47XX: Make bcma init NVRAM instead of
+ bcm47xx polling it
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This drops ssb/bcma dependency and will allow us to make it a standalone
+driver.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/8233/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c  | 42 ++----------------------------------------
+ drivers/bcma/driver_mips.c | 13 +++++++++++--
+ 2 files changed, 13 insertions(+), 42 deletions(-)
+
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -121,48 +121,10 @@ int bcm47xx_nvram_init_from_mem(u32 base
+ 	return err;
+ }
+ 
+-#ifdef CONFIG_BCM47XX_BCMA
+-static int nvram_init_bcma(void)
+-{
+-	struct bcma_drv_cc *cc = &bcm47xx_bus.bcma.bus.drv_cc;
+-	u32 base;
+-	u32 lim;
+-
+-#ifdef CONFIG_BCMA_NFLASH
+-	if (cc->nflash.boot) {
+-		base = BCMA_SOC_FLASH1;
+-		lim = BCMA_SOC_FLASH1_SZ;
+-	} else
+-#endif
+-	if (cc->pflash.present) {
+-		base = cc->pflash.window;
+-		lim = cc->pflash.window_size;
+-#ifdef CONFIG_BCMA_SFLASH
+-	} else if (cc->sflash.present) {
+-		base = cc->sflash.window;
+-		lim = cc->sflash.size;
+-#endif
+-	} else {
+-		pr_err("Couldn't find supported flash memory\n");
+-		return -ENXIO;
+-	}
+-
+-	return bcm47xx_nvram_init_from_mem(base, lim);
+-}
+-#endif
+-
+ static int nvram_init(void)
+ {
+-	switch (bcm47xx_bus_type) {
+-#ifdef CONFIG_BCM47XX_SSB
+-	case BCM47XX_BUS_TYPE_SSB:
+-		break;
+-#endif
+-#ifdef CONFIG_BCM47XX_BCMA
+-	case BCM47XX_BUS_TYPE_BCMA:
+-		return nvram_init_bcma();
+-#endif
+-	}
++	/* TODO: Look for MTD "nvram" partition */
++
+ 	return -ENXIO;
+ }
+ 
+--- a/drivers/bcma/driver_mips.c
++++ b/drivers/bcma/driver_mips.c
+@@ -20,6 +20,9 @@
+ #include <linux/serial_core.h>
+ #include <linux/serial_reg.h>
+ #include <linux/time.h>
++#ifdef CONFIG_BCM47XX
++#include <bcm47xx_nvram.h>
++#endif
+ 
+ enum bcma_boot_dev {
+ 	BCMA_BOOT_DEV_UNK = 0,
+@@ -316,10 +319,16 @@ static void bcma_core_mips_flash_detect(
+ 	switch (boot_dev) {
+ 	case BCMA_BOOT_DEV_PARALLEL:
+ 	case BCMA_BOOT_DEV_SERIAL:
+-		/* TODO: Init NVRAM using BCMA_SOC_FLASH2 window */
++#ifdef CONFIG_BCM47XX
++		bcm47xx_nvram_init_from_mem(BCMA_SOC_FLASH2,
++					    BCMA_SOC_FLASH2_SZ);
++#endif
+ 		break;
+ 	case BCMA_BOOT_DEV_NAND:
+-		/* TODO: Init NVRAM using BCMA_SOC_FLASH1 window */
++#ifdef CONFIG_BCM47XX
++		bcm47xx_nvram_init_from_mem(BCMA_SOC_FLASH1,
++					    BCMA_SOC_FLASH1_SZ);
++#endif
+ 		break;
+ 	default:
+ 		break;
diff --git a/target/linux/brcm47xx/patches-3.18/030-04-MIPS-BCM47XX-Move-SPROM-fallback-code-into-sprom.c.patch b/target/linux/brcm47xx/patches-3.18/030-04-MIPS-BCM47XX-Move-SPROM-fallback-code-into-sprom.c.patch
new file mode 100644
index 0000000..e38fde4
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/030-04-MIPS-BCM47XX-Move-SPROM-fallback-code-into-sprom.c.patch
@@ -0,0 +1,207 @@
+From a59da8fb3b2a1f2df5f871464e43cd5b6ca6ceb1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 28 Oct 2014 12:52:02 +0100
+Subject: [PATCH 157/158] MIPS: BCM47XX: Move SPROM fallback code into sprom.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This is some general cleanup as well as preparing sprom.c to become a
+standalone driver. We will need this for bcm53xx ARM arch support.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/8232/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/bcm47xx_private.h |  3 ++
+ arch/mips/bcm47xx/setup.c           | 58 ++-----------------------------
+ arch/mips/bcm47xx/sprom.c           | 68 +++++++++++++++++++++++++++++++++++++
+ 3 files changed, 73 insertions(+), 56 deletions(-)
+
+--- a/arch/mips/bcm47xx/bcm47xx_private.h
++++ b/arch/mips/bcm47xx/bcm47xx_private.h
+@@ -6,6 +6,9 @@
+ /* prom.c */
+ void __init bcm47xx_prom_highmem_init(void);
+ 
++/* sprom.c */
++void bcm47xx_sprom_register_fallbacks(void);
++
+ /* buttons.c */
+ int __init bcm47xx_buttons_register(void);
+ 
+--- a/arch/mips/bcm47xx/setup.c
++++ b/arch/mips/bcm47xx/setup.c
+@@ -102,23 +102,6 @@ static void bcm47xx_machine_halt(void)
+ }
+ 
+ #ifdef CONFIG_BCM47XX_SSB
+-static int bcm47xx_get_sprom_ssb(struct ssb_bus *bus, struct ssb_sprom *out)
+-{
+-	char prefix[10];
+-
+-	if (bus->bustype == SSB_BUSTYPE_PCI) {
+-		memset(out, 0, sizeof(struct ssb_sprom));
+-		snprintf(prefix, sizeof(prefix), "pci/%u/%u/",
+-			 bus->host_pci->bus->number + 1,
+-			 PCI_SLOT(bus->host_pci->devfn));
+-		bcm47xx_fill_sprom(out, prefix, false);
+-		return 0;
+-	} else {
+-		printk(KERN_WARNING "bcm47xx: unable to fill SPROM for given bustype.\n");
+-		return -EINVAL;
+-	}
+-}
+-
+ static int bcm47xx_get_invariants(struct ssb_bus *bus,
+ 				  struct ssb_init_invariants *iv)
+ {
+@@ -144,11 +127,6 @@ static void __init bcm47xx_register_ssb(
+ 	char buf[100];
+ 	struct ssb_mipscore *mcore;
+ 
+-	err = ssb_arch_register_fallback_sprom(&bcm47xx_get_sprom_ssb);
+-	if (err)
+-		printk(KERN_WARNING "bcm47xx: someone else already registered"
+-			" a ssb SPROM callback handler (err %d)\n", err);
+-
+ 	err = ssb_bus_ssbbus_register(&(bcm47xx_bus.ssb), SSB_ENUM_BASE,
+ 				      bcm47xx_get_invariants);
+ 	if (err)
+@@ -171,44 +149,10 @@ static void __init bcm47xx_register_ssb(
+ #endif
+ 
+ #ifdef CONFIG_BCM47XX_BCMA
+-static int bcm47xx_get_sprom_bcma(struct bcma_bus *bus, struct ssb_sprom *out)
+-{
+-	char prefix[10];
+-	struct bcma_device *core;
+-
+-	switch (bus->hosttype) {
+-	case BCMA_HOSTTYPE_PCI:
+-		memset(out, 0, sizeof(struct ssb_sprom));
+-		snprintf(prefix, sizeof(prefix), "pci/%u/%u/",
+-			 bus->host_pci->bus->number + 1,
+-			 PCI_SLOT(bus->host_pci->devfn));
+-		bcm47xx_fill_sprom(out, prefix, false);
+-		return 0;
+-	case BCMA_HOSTTYPE_SOC:
+-		memset(out, 0, sizeof(struct ssb_sprom));
+-		core = bcma_find_core(bus, BCMA_CORE_80211);
+-		if (core) {
+-			snprintf(prefix, sizeof(prefix), "sb/%u/",
+-				 core->core_index);
+-			bcm47xx_fill_sprom(out, prefix, true);
+-		} else {
+-			bcm47xx_fill_sprom(out, NULL, false);
+-		}
+-		return 0;
+-	default:
+-		pr_warn("bcm47xx: unable to fill SPROM for given bustype.\n");
+-		return -EINVAL;
+-	}
+-}
+-
+ static void __init bcm47xx_register_bcma(void)
+ {
+ 	int err;
+ 
+-	err = bcma_arch_register_fallback_sprom(&bcm47xx_get_sprom_bcma);
+-	if (err)
+-		pr_warn("bcm47xx: someone else already registered a bcma SPROM callback handler (err %d)\n", err);
+-
+ 	err = bcma_host_soc_register(&bcm47xx_bus.bcma);
+ 	if (err)
+ 		panic("Failed to register BCMA bus (err %d)", err);
+@@ -229,6 +173,7 @@ void __init plat_mem_setup(void)
+ 		printk(KERN_INFO "bcm47xx: using bcma bus\n");
+ #ifdef CONFIG_BCM47XX_BCMA
+ 		bcm47xx_bus_type = BCM47XX_BUS_TYPE_BCMA;
++		bcm47xx_sprom_register_fallbacks();
+ 		bcm47xx_register_bcma();
+ 		bcm47xx_set_system_type(bcm47xx_bus.bcma.bus.chipinfo.id);
+ #ifdef CONFIG_HIGHMEM
+@@ -239,6 +184,7 @@ void __init plat_mem_setup(void)
+ 		printk(KERN_INFO "bcm47xx: using ssb bus\n");
+ #ifdef CONFIG_BCM47XX_SSB
+ 		bcm47xx_bus_type = BCM47XX_BUS_TYPE_SSB;
++		bcm47xx_sprom_register_fallbacks();
+ 		bcm47xx_register_ssb();
+ 		bcm47xx_set_system_type(bcm47xx_bus.ssb.chip_id);
+ #endif
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -801,3 +801,71 @@ void bcm47xx_fill_bcma_boardinfo(struct
+ 	nvram_read_u16(prefix, NULL, "boardtype", &boardinfo->type, 0, true);
+ }
+ #endif
++
++#if defined(CONFIG_BCM47XX_SSB)
++static int bcm47xx_get_sprom_ssb(struct ssb_bus *bus, struct ssb_sprom *out)
++{
++	char prefix[10];
++
++	if (bus->bustype == SSB_BUSTYPE_PCI) {
++		memset(out, 0, sizeof(struct ssb_sprom));
++		snprintf(prefix, sizeof(prefix), "pci/%u/%u/",
++			 bus->host_pci->bus->number + 1,
++			 PCI_SLOT(bus->host_pci->devfn));
++		bcm47xx_fill_sprom(out, prefix, false);
++		return 0;
++	} else {
++		pr_warn("bcm47xx: unable to fill SPROM for given bustype.\n");
++		return -EINVAL;
++	}
++}
++#endif
++
++#if defined(CONFIG_BCM47XX_BCMA)
++static int bcm47xx_get_sprom_bcma(struct bcma_bus *bus, struct ssb_sprom *out)
++{
++	char prefix[10];
++	struct bcma_device *core;
++
++	switch (bus->hosttype) {
++	case BCMA_HOSTTYPE_PCI:
++		memset(out, 0, sizeof(struct ssb_sprom));
++		snprintf(prefix, sizeof(prefix), "pci/%u/%u/",
++			 bus->host_pci->bus->number + 1,
++			 PCI_SLOT(bus->host_pci->devfn));
++		bcm47xx_fill_sprom(out, prefix, false);
++		return 0;
++	case BCMA_HOSTTYPE_SOC:
++		memset(out, 0, sizeof(struct ssb_sprom));
++		core = bcma_find_core(bus, BCMA_CORE_80211);
++		if (core) {
++			snprintf(prefix, sizeof(prefix), "sb/%u/",
++				 core->core_index);
++			bcm47xx_fill_sprom(out, prefix, true);
++		} else {
++			bcm47xx_fill_sprom(out, NULL, false);
++		}
++		return 0;
++	default:
++		pr_warn("bcm47xx: unable to fill SPROM for given bustype.\n");
++		return -EINVAL;
++	}
++}
++#endif
++
++/*
++ * On bcm47xx we need to register SPROM fallback handler very early, so we can't
++ * use anything like platform device / driver for this.
++ */
++void bcm47xx_sprom_register_fallbacks(void)
++{
++#if defined(CONFIG_BCM47XX_SSB)
++	if (ssb_arch_register_fallback_sprom(&bcm47xx_get_sprom_ssb))
++		pr_warn("Failed to registered ssb SPROM handler\n");
++#endif
++
++#if defined(CONFIG_BCM47XX_BCMA)
++	if (bcma_arch_register_fallback_sprom(&bcm47xx_get_sprom_bcma))
++		pr_warn("Failed to registered bcma SPROM handler\n");
++#endif
++}
diff --git a/target/linux/brcm47xx/patches-3.18/030-05-MIPS-BCM47XX-Initialize-bcma-bus-later-with-mm-avail.patch b/target/linux/brcm47xx/patches-3.18/030-05-MIPS-BCM47XX-Initialize-bcma-bus-later-with-mm-avail.patch
new file mode 100644
index 0000000..1e77063
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/030-05-MIPS-BCM47XX-Initialize-bcma-bus-later-with-mm-avail.patch
@@ -0,0 +1,111 @@
+From e5810fa0c1bed16fdfb408862a2e17e962ec5cf6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 28 Oct 2014 14:40:38 +0100
+Subject: [PATCH 158/158] MIPS: BCM47XX: Initialize bcma bus later (with mm
+ available)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Initializaion with memory allocator available will be much simpler, this
+will allow cleanup in the bcma code.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/8234/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/bcm47xx_private.h |  3 +++
+ arch/mips/bcm47xx/irq.c             |  8 ++++++++
+ arch/mips/bcm47xx/setup.c           | 33 +++++++++++++++++++++++++++------
+ 3 files changed, 38 insertions(+), 6 deletions(-)
+
+--- a/arch/mips/bcm47xx/bcm47xx_private.h
++++ b/arch/mips/bcm47xx/bcm47xx_private.h
+@@ -15,6 +15,9 @@ int __init bcm47xx_buttons_register(void
+ /* leds.c */
+ void __init bcm47xx_leds_register(void);
+ 
++/* setup.c */
++void __init bcm47xx_bus_setup(void);
++
+ /* workarounds.c */
+ void __init bcm47xx_workarounds(void);
+ 
+--- a/arch/mips/bcm47xx/irq.c
++++ b/arch/mips/bcm47xx/irq.c
+@@ -22,6 +22,8 @@
+  *  675 Mass Ave, Cambridge, MA 02139, USA.
+  */
+ 
++#include "bcm47xx_private.h"
++
+ #include <linux/types.h>
+ #include <linux/interrupt.h>
+ #include <linux/irq.h>
+@@ -65,6 +67,12 @@ DEFINE_HWx_IRQDISPATCH(7)
+ 
+ void __init arch_init_irq(void)
+ {
++	/*
++	 * This is the first arch callback after mm_init (we can use kmalloc),
++	 * so let's finish bus initialization now.
++	 */
++	bcm47xx_bus_setup();
++
+ #ifdef CONFIG_BCM47XX_BCMA
+ 	if (bcm47xx_bus_type == BCM47XX_BUS_TYPE_BCMA) {
+ 		bcma_write32(bcm47xx_bus.bcma.bus.drv_mips.core,
+--- a/arch/mips/bcm47xx/setup.c
++++ b/arch/mips/bcm47xx/setup.c
+@@ -156,15 +156,14 @@ static void __init bcm47xx_register_bcma
+ 	err = bcma_host_soc_register(&bcm47xx_bus.bcma);
+ 	if (err)
+ 		panic("Failed to register BCMA bus (err %d)", err);
+-
+-	err = bcma_host_soc_init(&bcm47xx_bus.bcma);
+-	if (err)
+-		panic("Failed to initialize BCMA bus (err %d)", err);
+-
+-	bcm47xx_fill_bcma_boardinfo(&bcm47xx_bus.bcma.bus.boardinfo, NULL);
+ }
+ #endif
+ 
++/*
++ * Memory setup is done in the early part of MIPS's arch_mem_init. It's supposed
++ * to detect memory and record it with add_memory_region.
++ * Any extra initializaion performed here must not use kmalloc or bootmem.
++ */
+ void __init plat_mem_setup(void)
+ {
+ 	struct cpuinfo_mips *c = &current_cpu_data;
+@@ -193,6 +192,28 @@ void __init plat_mem_setup(void)
+ 	_machine_restart = bcm47xx_machine_restart;
+ 	_machine_halt = bcm47xx_machine_halt;
+ 	pm_power_off = bcm47xx_machine_halt;
++}
++
++/*
++ * This finishes bus initialization doing things that were not possible without
++ * kmalloc. Make sure to call it late enough (after mm_init).
++ */
++void __init bcm47xx_bus_setup(void)
++{
++#ifdef CONFIG_BCM47XX_BCMA
++	if (bcm47xx_bus_type == BCM47XX_BUS_TYPE_BCMA) {
++		int err;
++
++		err = bcma_host_soc_init(&bcm47xx_bus.bcma);
++		if (err)
++			panic("Failed to initialize BCMA bus (err %d)", err);
++
++		bcm47xx_fill_bcma_boardinfo(&bcm47xx_bus.bcma.bus.boardinfo,
++					    NULL);
++	}
++#endif
++
++	/* With bus initialized we can access NVRAM and detect the board */
+ 	bcm47xx_board_detect();
+ 	mips_set_machine_name(bcm47xx_board_get_name());
+ }
diff --git a/target/linux/brcm47xx/patches-3.18/030-06-MIPS-BCM47XX-Use-mtd-as-an-alternative-way-API-to-ge.patch b/target/linux/brcm47xx/patches-3.18/030-06-MIPS-BCM47XX-Use-mtd-as-an-alternative-way-API-to-ge.patch
new file mode 100644
index 0000000..1e6bc2f
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/030-06-MIPS-BCM47XX-Use-mtd-as-an-alternative-way-API-to-ge.patch
@@ -0,0 +1,83 @@
+From 9d1d08646af4491aec41d40341930b9bfd62ffa9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Wed, 29 Oct 2014 10:05:06 +0100
+Subject: [PATCH] MIPS: BCM47XX: Use mtd as an alternative way/API to get NVRAM
+ content
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+NVRAM can be read using magic memory offset, but after all it's just a
+flash partition. On platforms where NVRAM isn't needed early we can get
+it using mtd subsystem.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/8266/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 42 ++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 38 insertions(+), 4 deletions(-)
+
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -13,12 +13,10 @@
+ 
+ #include <linux/types.h>
+ #include <linux/module.h>
+-#include <linux/ssb/ssb.h>
+ #include <linux/kernel.h>
+ #include <linux/string.h>
+-#include <asm/addrspace.h>
++#include <linux/mtd/mtd.h>
+ #include <bcm47xx_nvram.h>
+-#include <asm/mach-bcm47xx/bcm47xx.h>
+ 
+ static char nvram_buf[NVRAM_SPACE];
+ static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
+@@ -123,7 +121,43 @@ int bcm47xx_nvram_init_from_mem(u32 base
+ 
+ static int nvram_init(void)
+ {
+-	/* TODO: Look for MTD "nvram" partition */
++#ifdef CONFIG_MTD
++	struct mtd_info *mtd;
++	struct nvram_header header;
++	size_t bytes_read;
++	int err, i;
++
++	mtd = get_mtd_device_nm("nvram");
++	if (IS_ERR(mtd))
++		return -ENODEV;
++
++	for (i = 0; i < ARRAY_SIZE(nvram_sizes); i++) {
++		loff_t from = mtd->size - nvram_sizes[i];
++
++		if (from < 0)
++			continue;
++
++		err = mtd_read(mtd, from, sizeof(header), &bytes_read,
++			       (uint8_t *)&header);
++		if (!err && header.magic == NVRAM_HEADER) {
++			u8 *dst = (uint8_t *)nvram_buf;
++			size_t len = header.len;
++
++			if (header.len > NVRAM_SPACE) {
++				pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
++				       header.len, NVRAM_SPACE);
++				len = NVRAM_SPACE;
++			}
++
++			err = mtd_read(mtd, from, len, &bytes_read, dst);
++			if (err)
++				return err;
++			memset(dst + bytes_read, 0x0, NVRAM_SPACE - bytes_read);
++
++			return 0;
++		}
++	}
++#endif
+ 
+ 	return -ENXIO;
+ }
diff --git a/target/linux/brcm47xx/patches-3.18/030-07-MIPS-BCM47XX-Clean-up-nvram-header.patch b/target/linux/brcm47xx/patches-3.18/030-07-MIPS-BCM47XX-Clean-up-nvram-header.patch
new file mode 100644
index 0000000..31d14a9
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/030-07-MIPS-BCM47XX-Clean-up-nvram-header.patch
@@ -0,0 +1,158 @@
+From 341097f17c76b3dd39539526a2af9e7fff43705e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Thu, 30 Oct 2014 12:50:03 +0100
+Subject: [PATCH] MIPS: BCM47XX: Clean up nvram header
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+1) Move private defines to the .c file
+2) Move SPROM helper to the sprom.c
+3) Drop unused code
+4) Rename magic to the NVRAM_MAGIC
+5) Add const to the char pointer we never modify
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/8289/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c                          | 23 ++++++++++----
+ arch/mips/bcm47xx/sprom.c                          | 14 +++++++++
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h | 35 +---------------------
+ 3 files changed, 33 insertions(+), 39 deletions(-)
+
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -18,6 +18,19 @@
+ #include <linux/mtd/mtd.h>
+ #include <bcm47xx_nvram.h>
+ 
++#define NVRAM_MAGIC		0x48534C46	/* 'FLSH' */
++#define NVRAM_SPACE		0x8000
++
++#define FLASH_MIN		0x00020000	/* Minimum flash size */
++
++struct nvram_header {
++	u32 magic;
++	u32 len;
++	u32 crc_ver_init;	/* 0:7 crc, 8:15 ver, 16:31 sdram_init */
++	u32 config_refresh;	/* 0:15 sdram_config, 16:31 sdram_refresh */
++	u32 config_ncdl;	/* ncdl values for memc */
++};
++
+ static char nvram_buf[NVRAM_SPACE];
+ static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
+ 
+@@ -28,7 +41,7 @@ static u32 find_nvram_size(void __iomem
+ 
+ 	for (i = 0; i < ARRAY_SIZE(nvram_sizes); i++) {
+ 		header = (struct nvram_header *)(end - nvram_sizes[i]);
+-		if (header->magic == NVRAM_HEADER)
++		if (header->magic == NVRAM_MAGIC)
+ 			return nvram_sizes[i];
+ 	}
+ 
+@@ -63,13 +76,13 @@ static int nvram_find_and_copy(void __io
+ 
+ 	/* Try embedded NVRAM at 4 KB and 1 KB as last resorts */
+ 	header = (struct nvram_header *)(iobase + 4096);
+-	if (header->magic == NVRAM_HEADER) {
++	if (header->magic == NVRAM_MAGIC) {
+ 		size = NVRAM_SPACE;
+ 		goto found;
+ 	}
+ 
+ 	header = (struct nvram_header *)(iobase + 1024);
+-	if (header->magic == NVRAM_HEADER) {
++	if (header->magic == NVRAM_MAGIC) {
+ 		size = NVRAM_SPACE;
+ 		goto found;
+ 	}
+@@ -139,7 +152,7 @@ static int nvram_init(void)
+ 
+ 		err = mtd_read(mtd, from, sizeof(header), &bytes_read,
+ 			       (uint8_t *)&header);
+-		if (!err && header.magic == NVRAM_HEADER) {
++		if (!err && header.magic == NVRAM_MAGIC) {
+ 			u8 *dst = (uint8_t *)nvram_buf;
+ 			size_t len = header.len;
+ 
+@@ -162,7 +175,7 @@ static int nvram_init(void)
+ 	return -ENXIO;
+ }
+ 
+-int bcm47xx_nvram_getenv(char *name, char *val, size_t val_len)
++int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len)
+ {
+ 	char *var, *value, *end, *eq;
+ 	int err;
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -136,6 +136,20 @@ static void nvram_read_leddc(const char
+ 	*leddc_off_time = (val >> 16) & 0xff;
+ }
+ 
++static void bcm47xx_nvram_parse_macaddr(char *buf, u8 macaddr[6])
++{
++	if (strchr(buf, ':'))
++		sscanf(buf, "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx", &macaddr[0],
++			&macaddr[1], &macaddr[2], &macaddr[3], &macaddr[4],
++			&macaddr[5]);
++	else if (strchr(buf, '-'))
++		sscanf(buf, "%hhx-%hhx-%hhx-%hhx-%hhx-%hhx", &macaddr[0],
++			&macaddr[1], &macaddr[2], &macaddr[3], &macaddr[4],
++			&macaddr[5]);
++	else
++		pr_warn("Can not parse mac address: %s\n", buf);
++}
++
+ static void nvram_read_macaddr(const char *prefix, const char *name,
+ 			       u8 val[6], bool fallback)
+ {
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h
+@@ -14,41 +14,8 @@
+ #include <linux/types.h>
+ #include <linux/kernel.h>
+ 
+-struct nvram_header {
+-	u32 magic;
+-	u32 len;
+-	u32 crc_ver_init;	/* 0:7 crc, 8:15 ver, 16:31 sdram_init */
+-	u32 config_refresh;	/* 0:15 sdram_config, 16:31 sdram_refresh */
+-	u32 config_ncdl;	/* ncdl values for memc */
+-};
+-
+-#define NVRAM_HEADER		0x48534C46	/* 'FLSH' */
+-#define NVRAM_VERSION		1
+-#define NVRAM_HEADER_SIZE	20
+-#define NVRAM_SPACE		0x8000
+-
+-#define FLASH_MIN		0x00020000	/* Minimum flash size */
+-
+-#define NVRAM_MAX_VALUE_LEN 255
+-#define NVRAM_MAX_PARAM_LEN 64
+-
+ int bcm47xx_nvram_init_from_mem(u32 base, u32 lim);
+-extern int bcm47xx_nvram_getenv(char *name, char *val, size_t val_len);
+-
+-static inline void bcm47xx_nvram_parse_macaddr(char *buf, u8 macaddr[6])
+-{
+-	if (strchr(buf, ':'))
+-		sscanf(buf, "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx", &macaddr[0],
+-			&macaddr[1], &macaddr[2], &macaddr[3], &macaddr[4],
+-			&macaddr[5]);
+-	else if (strchr(buf, '-'))
+-		sscanf(buf, "%hhx-%hhx-%hhx-%hhx-%hhx-%hhx", &macaddr[0],
+-			&macaddr[1], &macaddr[2], &macaddr[3], &macaddr[4],
+-			&macaddr[5]);
+-	else
+-		printk(KERN_WARNING "Can not parse mac address: %s\n", buf);
+-}
+-
++int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len);
+ int bcm47xx_nvram_gpio_pin(const char *name);
+ 
+ #endif /* __BCM47XX_NVRAM_H */
diff --git a/target/linux/brcm47xx/patches-3.18/031-01-MIPS-BCM47XX-Support-SPROM-prefixes-for-PCI-devices.patch b/target/linux/brcm47xx/patches-3.18/031-01-MIPS-BCM47XX-Support-SPROM-prefixes-for-PCI-devices.patch
new file mode 100644
index 0000000..e78b159
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/031-01-MIPS-BCM47XX-Support-SPROM-prefixes-for-PCI-devices.patch
@@ -0,0 +1,68 @@
+From 9a6a2b96dfd8b01336f8519a5be7fb353cfa62fb Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Sat, 14 Mar 2015 17:55:54 +0100
+Subject: [PATCH] MIPS: BCM47XX: Support SPROM prefixes for PCI devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Support parsing SPROMs with prefixes defined like devpath1=pci/1/1
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/9552/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/sprom.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -836,6 +836,38 @@ static int bcm47xx_get_sprom_ssb(struct
+ #endif
+ 
+ #if defined(CONFIG_BCM47XX_BCMA)
++/*
++ * Having many NVRAM entries for PCI devices led to repeating prefixes like
++ * pci/1/1/ all the time and wasting flash space. So at some point Broadcom
++ * decided to introduce prefixes like 0: 1: 2: etc.
++ * If we find e.g. devpath0=pci/2/1 or devpath0=pci/2/1/ we should use 0:
++ * instead of pci/2/1/.
++ */
++static void bcm47xx_sprom_apply_prefix_alias(char *prefix, size_t prefix_size)
++{
++	size_t prefix_len = strlen(prefix);
++	size_t short_len = prefix_len - 1;
++	char nvram_var[10];
++	char buf[20];
++	int i;
++
++	/* Passed prefix has to end with a slash */
++	if (prefix_len <= 0 || prefix[prefix_len - 1] != '/')
++		return;
++
++	for (i = 0; i < 3; i++) {
++		if (snprintf(nvram_var, sizeof(nvram_var), "devpath%d", i) <= 0)
++			continue;
++		if (bcm47xx_nvram_getenv(nvram_var, buf, sizeof(buf)) < 0)
++			continue;
++		if (!strcmp(buf, prefix) ||
++		    (short_len && strlen(buf) == short_len && !strncmp(buf, prefix, short_len))) {
++			snprintf(prefix, prefix_size, "%d:", i);
++			return;
++		}
++	}
++}
++
+ static int bcm47xx_get_sprom_bcma(struct bcma_bus *bus, struct ssb_sprom *out)
+ {
+ 	char prefix[10];
+@@ -847,6 +879,7 @@ static int bcm47xx_get_sprom_bcma(struct
+ 		snprintf(prefix, sizeof(prefix), "pci/%u/%u/",
+ 			 bus->host_pci->bus->number + 1,
+ 			 PCI_SLOT(bus->host_pci->devfn));
++		bcm47xx_sprom_apply_prefix_alias(prefix, sizeof(prefix));
+ 		bcm47xx_fill_sprom(out, prefix, false);
+ 		return 0;
+ 	case BCMA_HOSTTYPE_SOC:
diff --git a/target/linux/brcm47xx/patches-3.18/031-03-MIPS-BCM47XX-Use-helpers-for-reading-NVRAM-content.patch b/target/linux/brcm47xx/patches-3.18/031-03-MIPS-BCM47XX-Use-helpers-for-reading-NVRAM-content.patch
new file mode 100644
index 0000000..9c9865f
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/031-03-MIPS-BCM47XX-Use-helpers-for-reading-NVRAM-content.patch
@@ -0,0 +1,51 @@
+From 23d2bc42aceb829eaf90c694941e4523c22865e8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Wed, 10 Dec 2014 11:49:53 +0100
+Subject: [PATCH] MIPS: BCM47XX: Use helpers for reading NVRAM content
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Also drop some unneeded memset-s.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Paul Walmsley <paul@pwsan.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/8661/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -91,7 +91,6 @@ static int nvram_find_and_copy(void __io
+ 	return -ENXIO;
+ 
+ found:
+-
+ 	if (header->len > size)
+ 		pr_err("The nvram size accoridng to the header seems to be bigger than the partition on flash\n");
+ 	if (header->len > NVRAM_SPACE)
+@@ -101,10 +100,9 @@ found:
+ 	src = (u32 *) header;
+ 	dst = (u32 *) nvram_buf;
+ 	for (i = 0; i < sizeof(struct nvram_header); i += 4)
+-		*dst++ = *src++;
++		*dst++ = __raw_readl(src++);
+ 	for (; i < header->len && i < NVRAM_SPACE && i < size; i += 4)
+-		*dst++ = le32_to_cpu(*src++);
+-	memset(dst, 0x0, NVRAM_SPACE - i);
++		*dst++ = readl(src++);
+ 
+ 	return 0;
+ }
+@@ -165,7 +163,6 @@ static int nvram_init(void)
+ 			err = mtd_read(mtd, from, len, &bytes_read, dst);
+ 			if (err)
+ 				return err;
+-			memset(dst + bytes_read, 0x0, NVRAM_SPACE - bytes_read);
+ 
+ 			return 0;
+ 		}
diff --git a/target/linux/brcm47xx/patches-3.18/031-04-MIPS-BCM47XX-Use-strnchr-to-avoid-reading-out-of-the.patch b/target/linux/brcm47xx/patches-3.18/031-04-MIPS-BCM47XX-Use-strnchr-to-avoid-reading-out-of-the.patch
new file mode 100644
index 0000000..ee2e273
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/031-04-MIPS-BCM47XX-Use-strnchr-to-avoid-reading-out-of-the.patch
@@ -0,0 +1,40 @@
+From 80aaaa8b93d860f828e2cf883f307894640765f0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Wed, 10 Dec 2014 11:49:54 +0100
+Subject: [PATCH] MIPS: BCM47XX: Use strnchr to avoid reading out of the buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Paul Walmsley <paul@pwsan.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/8662/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -175,7 +175,7 @@ static int nvram_init(void)
+ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len)
+ {
+ 	char *var, *value, *end, *eq;
+-	int err;
++	int data_left, err;
+ 
+ 	if (!name)
+ 		return -EINVAL;
+@@ -191,7 +191,9 @@ int bcm47xx_nvram_getenv(const char *nam
+ 	end = nvram_buf + sizeof(nvram_buf) - 2;
+ 	end[0] = end[1] = '\0';
+ 	for (; *var; var = value + strlen(value) + 1) {
+-		eq = strchr(var, '=');
++		data_left = end - var;
++
++		eq = strnchr(var, data_left, '=');
+ 		if (!eq)
+ 			break;
+ 		value = eq + 1;
diff --git a/target/linux/brcm47xx/patches-3.18/031-05-MIPS-BCM47xx-Move-NVRAM-header-to-the-include-linux.patch b/target/linux/brcm47xx/patches-3.18/031-05-MIPS-BCM47xx-Move-NVRAM-header-to-the-include-linux.patch
new file mode 100644
index 0000000..c1c0927
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/031-05-MIPS-BCM47xx-Move-NVRAM-header-to-the-include-linux.patch
@@ -0,0 +1,221 @@
+From 138173d4e826587da66c7d321da1a91283222536 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Mon, 1 Dec 2014 07:58:18 +0100
+Subject: [PATCH] MIPS: BCM47xx: Move NVRAM header to the include/linux/.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+There are two reasons for having this header in the common place:
+1) Simplifying drivers that read NVRAM entries. We will be able to
+   safely call bcm47xx_nvram_* functions without #ifdef-s.
+2) Getting NVRAM driver out of MIPS arch code. This is needed to support
+   BCM5301X arch which also requires this NVRAM driver. Patch for that
+   will follow once we get is reviewed.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: linux-mips@linux-mips.org
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Paul Walmsley <paul@pwsan.com>
+Cc: linux-soc@vger.kernel.org
+Patchwork: https://patchwork.linux-mips.org/patch/8619/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/board.c                          |  2 +-
+ arch/mips/bcm47xx/nvram.c                          |  2 +-
+ arch/mips/bcm47xx/setup.c                          |  1 -
+ arch/mips/bcm47xx/sprom.c                          |  1 -
+ arch/mips/bcm47xx/time.c                           |  1 -
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx.h       |  1 +
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h | 21 -------------
+ drivers/bcma/driver_mips.c                         |  2 +-
+ drivers/net/ethernet/broadcom/b44.c                |  2 +-
+ drivers/net/ethernet/broadcom/bgmac.c              |  2 +-
+ drivers/ssb/driver_chipcommon_pmu.c                |  2 +-
+ drivers/ssb/driver_mipscore.c                      |  2 +-
+ include/linux/bcm47xx_nvram.h                      | 34 ++++++++++++++++++++++
+ 13 files changed, 42 insertions(+), 31 deletions(-)
+ delete mode 100644 arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h
+ create mode 100644 include/linux/bcm47xx_nvram.h
+
+--- a/arch/mips/bcm47xx/board.c
++++ b/arch/mips/bcm47xx/board.c
+@@ -1,8 +1,8 @@
+ #include <linux/errno.h>
+ #include <linux/export.h>
+ #include <linux/string.h>
++#include <bcm47xx.h>
+ #include <bcm47xx_board.h>
+-#include <bcm47xx_nvram.h>
+ 
+ struct bcm47xx_board_type {
+ 	const enum bcm47xx_board board;
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -16,7 +16,7 @@
+ #include <linux/kernel.h>
+ #include <linux/string.h>
+ #include <linux/mtd/mtd.h>
+-#include <bcm47xx_nvram.h>
++#include <linux/bcm47xx_nvram.h>
+ 
+ #define NVRAM_MAGIC		0x48534C46	/* 'FLSH' */
+ #define NVRAM_SPACE		0x8000
+--- a/arch/mips/bcm47xx/setup.c
++++ b/arch/mips/bcm47xx/setup.c
+@@ -42,7 +42,6 @@
+ #include <asm/reboot.h>
+ #include <asm/time.h>
+ #include <bcm47xx.h>
+-#include <bcm47xx_nvram.h>
+ #include <bcm47xx_board.h>
+ 
+ union bcm47xx_bus bcm47xx_bus;
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -27,7 +27,6 @@
+  */
+ 
+ #include <bcm47xx.h>
+-#include <bcm47xx_nvram.h>
+ #include <linux/if_ether.h>
+ #include <linux/etherdevice.h>
+ 
+--- a/arch/mips/bcm47xx/time.c
++++ b/arch/mips/bcm47xx/time.c
+@@ -27,7 +27,6 @@
+ #include <linux/ssb/ssb.h>
+ #include <asm/time.h>
+ #include <bcm47xx.h>
+-#include <bcm47xx_nvram.h>
+ #include <bcm47xx_board.h>
+ 
+ void __init plat_time_init(void)
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx.h
+@@ -22,6 +22,7 @@
+ #include <linux/ssb/ssb.h>
+ #include <linux/bcma/bcma.h>
+ #include <linux/bcma/bcma_soc.h>
++#include <linux/bcm47xx_nvram.h>
+ 
+ enum bcm47xx_bus_type {
+ #ifdef CONFIG_BCM47XX_SSB
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_nvram.h
+@@ -1,21 +1 @@
+-/*
+- *  Copyright (C) 2005, Broadcom Corporation
+- *  Copyright (C) 2006, Felix Fietkau <nbd@openwrt.org>
+- *
+- *  This program is free software; you can redistribute  it and/or modify it
+- *  under  the terms of  the GNU General  Public License as published by the
+- *  Free Software Foundation;  either version 2 of the  License, or (at your
+- *  option) any later version.
+- */
+-
+-#ifndef __BCM47XX_NVRAM_H
+-#define __BCM47XX_NVRAM_H
+-
+-#include <linux/types.h>
+-#include <linux/kernel.h>
+-
+-int bcm47xx_nvram_init_from_mem(u32 base, u32 lim);
+-int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len);
+-int bcm47xx_nvram_gpio_pin(const char *name);
+-
+-#endif /* __BCM47XX_NVRAM_H */
++#include <linux/bcm47xx_nvram.h>
+--- a/drivers/bcma/driver_mips.c
++++ b/drivers/bcma/driver_mips.c
+@@ -21,7 +21,7 @@
+ #include <linux/serial_reg.h>
+ #include <linux/time.h>
+ #ifdef CONFIG_BCM47XX
+-#include <bcm47xx_nvram.h>
++#include <linux/bcm47xx_nvram.h>
+ #endif
+ 
+ enum bcma_boot_dev {
+--- a/drivers/net/ethernet/broadcom/b44.c
++++ b/drivers/net/ethernet/broadcom/b44.c
+@@ -400,7 +400,7 @@ static void b44_set_flow_ctrl(struct b44
+ }
+ 
+ #ifdef CONFIG_BCM47XX
+-#include <bcm47xx_nvram.h>
++#include <linux/bcm47xx_nvram.h>
+ static void b44_wap54g10_workaround(struct b44 *bp)
+ {
+ 	char buf[20];
+--- a/drivers/net/ethernet/broadcom/bgmac.c
++++ b/drivers/net/ethernet/broadcom/bgmac.c
+@@ -18,7 +18,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/platform_data/b53.h>
+-#include <bcm47xx_nvram.h>
++#include <linux/bcm47xx_nvram.h>
+ 
+ static const struct bcma_device_id bgmac_bcma_tbl[] = {
+ 	BCMA_CORE(BCMA_MANUF_BCM, BCMA_CORE_4706_MAC_GBIT, BCMA_ANY_REV, BCMA_ANY_CLASS),
+--- a/drivers/ssb/driver_chipcommon_pmu.c
++++ b/drivers/ssb/driver_chipcommon_pmu.c
+@@ -14,7 +14,7 @@
+ #include <linux/delay.h>
+ #include <linux/export.h>
+ #ifdef CONFIG_BCM47XX
+-#include <bcm47xx_nvram.h>
++#include <linux/bcm47xx_nvram.h>
+ #endif
+ 
+ #include "ssb_private.h"
+--- a/drivers/ssb/driver_mipscore.c
++++ b/drivers/ssb/driver_mipscore.c
+@@ -16,7 +16,7 @@
+ #include <linux/serial_reg.h>
+ #include <linux/time.h>
+ #ifdef CONFIG_BCM47XX
+-#include <bcm47xx_nvram.h>
++#include <linux/bcm47xx_nvram.h>
+ #endif
+ 
+ #include "ssb_private.h"
+--- /dev/null
++++ b/include/linux/bcm47xx_nvram.h
+@@ -0,0 +1,34 @@
++/*
++ *  This program is free software; you can redistribute  it and/or modify it
++ *  under  the terms of  the GNU General  Public License as published by the
++ *  Free Software Foundation;  either version 2 of the  License, or (at your
++ *  option) any later version.
++ */
++
++#ifndef __BCM47XX_NVRAM_H
++#define __BCM47XX_NVRAM_H
++
++#include <linux/types.h>
++#include <linux/kernel.h>
++
++#ifdef CONFIG_BCM47XX
++int bcm47xx_nvram_init_from_mem(u32 base, u32 lim);
++int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len);
++int bcm47xx_nvram_gpio_pin(const char *name);
++#else
++static inline int bcm47xx_nvram_init_from_mem(u32 base, u32 lim)
++{
++	return -ENOTSUPP;
++};
++static inline int bcm47xx_nvram_getenv(const char *name, char *val,
++				       size_t val_len)
++{
++	return -ENOTSUPP;
++};
++static inline int bcm47xx_nvram_gpio_pin(const char *name)
++{
++	return -ENOTSUPP;
++};
++#endif
++
++#endif /* __BCM47XX_NVRAM_H */
diff --git a/target/linux/brcm47xx/patches-3.18/031-06-MIPS-BCM47XX-Fix-coding-style-to-match-kernel-standa.patch b/target/linux/brcm47xx/patches-3.18/031-06-MIPS-BCM47XX-Fix-coding-style-to-match-kernel-standa.patch
new file mode 100644
index 0000000..826307b
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/031-06-MIPS-BCM47XX-Fix-coding-style-to-match-kernel-standa.patch
@@ -0,0 +1,258 @@
+From d548ca6b0784a99f0fcae397f115823ccd0361a5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Wed, 10 Dec 2014 17:38:26 +0100
+Subject: [PATCH] MIPS: BCM47XX: Fix coding style to match kernel standards
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+[ralf@linux-mips.org: Fixed conflicts.]
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: linux-mips@linux-mips.org
+Cc: Paul Walmsley <paul@pwsan.com>
+Patchwork: https://patchwork.linux-mips.org/patch/8665/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/bcm47xx_private.h |  4 ++++
+ arch/mips/bcm47xx/board.c           |  3 +--
+ arch/mips/bcm47xx/nvram.c           | 25 ++++++++++++++-----------
+ arch/mips/bcm47xx/prom.c            |  3 +--
+ arch/mips/bcm47xx/serial.c          |  8 ++++----
+ arch/mips/bcm47xx/setup.c           | 12 ++++++------
+ arch/mips/bcm47xx/sprom.c           |  8 ++++----
+ arch/mips/bcm47xx/time.c            |  1 -
+ 8 files changed, 34 insertions(+), 30 deletions(-)
+
+--- a/arch/mips/bcm47xx/bcm47xx_private.h
++++ b/arch/mips/bcm47xx/bcm47xx_private.h
+@@ -1,6 +1,10 @@
+ #ifndef LINUX_BCM47XX_PRIVATE_H_
+ #define LINUX_BCM47XX_PRIVATE_H_
+ 
++#ifndef pr_fmt
++#define pr_fmt(fmt)		"bcm47xx: " fmt
++#endif
++
+ #include <linux/kernel.h>
+ 
+ /* prom.c */
+--- a/arch/mips/bcm47xx/board.c
++++ b/arch/mips/bcm47xx/board.c
+@@ -330,9 +330,8 @@ void __init bcm47xx_board_detect(void)
+ 	err = bcm47xx_nvram_getenv("boardtype", buf, sizeof(buf));
+ 
+ 	/* init of nvram failed, probably too early now */
+-	if (err == -ENXIO) {
++	if (err == -ENXIO)
+ 		return;
+-	}
+ 
+ 	board_detected = bcm47xx_board_get_nvram();
+ 	bcm47xx_board.board = board_detected->board;
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -18,8 +18,10 @@
+ #include <linux/mtd/mtd.h>
+ #include <linux/bcm47xx_nvram.h>
+ 
+-#define NVRAM_MAGIC		0x48534C46	/* 'FLSH' */
+-#define NVRAM_SPACE		0x8000
++#define NVRAM_MAGIC			0x48534C46	/* 'FLSH' */
++#define NVRAM_SPACE			0x8000
++#define NVRAM_MAX_GPIO_ENTRIES		32
++#define NVRAM_MAX_GPIO_VALUE_LEN	30
+ 
+ #define FLASH_MIN		0x00020000	/* Minimum flash size */
+ 
+@@ -97,8 +99,8 @@ found:
+ 		pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+ 		       header->len, NVRAM_SPACE);
+ 
+-	src = (u32 *) header;
+-	dst = (u32 *) nvram_buf;
++	src = (u32 *)header;
++	dst = (u32 *)nvram_buf;
+ 	for (i = 0; i < sizeof(struct nvram_header); i += 4)
+ 		*dst++ = __raw_readl(src++);
+ 	for (; i < header->len && i < NVRAM_SPACE && i < size; i += 4)
+@@ -189,7 +191,8 @@ int bcm47xx_nvram_getenv(const char *nam
+ 	/* Look for name=value and return value */
+ 	var = &nvram_buf[sizeof(struct nvram_header)];
+ 	end = nvram_buf + sizeof(nvram_buf) - 2;
+-	end[0] = end[1] = '\0';
++	end[0] = '\0';
++	end[1] = '\0';
+ 	for (; *var; var = value + strlen(value) + 1) {
+ 		data_left = end - var;
+ 
+@@ -197,11 +200,10 @@ int bcm47xx_nvram_getenv(const char *nam
+ 		if (!eq)
+ 			break;
+ 		value = eq + 1;
+-		if ((eq - var) == strlen(name) &&
+-			strncmp(var, name, (eq - var)) == 0) {
++		if (eq - var == strlen(name) &&
++		    strncmp(var, name, eq - var) == 0)
+ 			return snprintf(val, val_len, "%s", value);
+ 		}
+-	}
+ 	return -ENOENT;
+ }
+ EXPORT_SYMBOL(bcm47xx_nvram_getenv);
+@@ -209,10 +211,11 @@ EXPORT_SYMBOL(bcm47xx_nvram_getenv);
+ int bcm47xx_nvram_gpio_pin(const char *name)
+ {
+ 	int i, err;
+-	char nvram_var[10];
+-	char buf[30];
++	char nvram_var[] = "gpioXX";
++	char buf[NVRAM_MAX_GPIO_VALUE_LEN];
+ 
+-	for (i = 0; i < 32; i++) {
++	/* TODO: Optimize it to don't call getenv so many times */
++	for (i = 0; i < NVRAM_MAX_GPIO_ENTRIES; i++) {
+ 		err = snprintf(nvram_var, sizeof(nvram_var), "gpio%i", i);
+ 		if (err <= 0)
+ 			continue;
+--- a/arch/mips/bcm47xx/prom.c
++++ b/arch/mips/bcm47xx/prom.c
+@@ -35,7 +35,6 @@
+ #include <bcm47xx.h>
+ #include <bcm47xx_board.h>
+ 
+-
+ static char bcm47xx_system_type[20] = "Broadcom BCM47XX";
+ 
+ const char *get_system_type(void)
+@@ -83,7 +82,7 @@ static __init void prom_init_mem(void)
+ 		/* Loop condition may be not enough, off may be over 1 MiB */
+ 		if (off + mem >= max) {
+ 			mem = max;
+-			printk(KERN_DEBUG "assume 128MB RAM\n");
++			pr_debug("Assume 128MB RAM\n");
+ 			break;
+ 		}
+ 		if (!memcmp(prom_init, prom_init + mem, 32))
+--- a/arch/mips/bcm47xx/serial.c
++++ b/arch/mips/bcm47xx/serial.c
+@@ -36,8 +36,8 @@ static int __init uart8250_init_ssb(void
+ 		struct plat_serial8250_port *p = &(uart8250_data[i]);
+ 		struct ssb_serial_port *ssb_port = &(mcore->serial_ports[i]);
+ 
+-		p->mapbase = (unsigned int) ssb_port->regs;
+-		p->membase = (void *) ssb_port->regs;
++		p->mapbase = (unsigned int)ssb_port->regs;
++		p->membase = (void *)ssb_port->regs;
+ 		p->irq = ssb_port->irq + 2;
+ 		p->uartclk = ssb_port->baud_base;
+ 		p->regshift = ssb_port->reg_shift;
+@@ -62,8 +62,8 @@ static int __init uart8250_init_bcma(voi
+ 		struct bcma_serial_port *bcma_port;
+ 		bcma_port = &(cc->serial_ports[i]);
+ 
+-		p->mapbase = (unsigned int) bcma_port->regs;
+-		p->membase = (void *) bcma_port->regs;
++		p->mapbase = (unsigned int)bcma_port->regs;
++		p->membase = (void *)bcma_port->regs;
+ 		p->irq = bcma_port->irq;
+ 		p->uartclk = bcma_port->baud_base;
+ 		p->regshift = bcma_port->reg_shift;
+--- a/arch/mips/bcm47xx/setup.c
++++ b/arch/mips/bcm47xx/setup.c
+@@ -52,7 +52,7 @@ EXPORT_SYMBOL(bcm47xx_bus_type);
+ 
+ static void bcm47xx_machine_restart(char *command)
+ {
+-	printk(KERN_ALERT "Please stand by while rebooting the system...\n");
++	pr_alert("Please stand by while rebooting the system...\n");
+ 	local_irq_disable();
+ 	/* Set the watchdog timer to reset immediately */
+ 	switch (bcm47xx_bus_type) {
+@@ -107,7 +107,7 @@ static int bcm47xx_get_invariants(struct
+ 	char buf[20];
+ 
+ 	/* Fill boardinfo structure */
+-	memset(&(iv->boardinfo), 0 , sizeof(struct ssb_boardinfo));
++	memset(&iv->boardinfo, 0 , sizeof(struct ssb_boardinfo));
+ 
+ 	bcm47xx_fill_ssb_boardinfo(&iv->boardinfo, NULL);
+ 
+@@ -126,7 +126,7 @@ static void __init bcm47xx_register_ssb(
+ 	char buf[100];
+ 	struct ssb_mipscore *mcore;
+ 
+-	err = ssb_bus_ssbbus_register(&(bcm47xx_bus.ssb), SSB_ENUM_BASE,
++	err = ssb_bus_ssbbus_register(&bcm47xx_bus.ssb, SSB_ENUM_BASE,
+ 				      bcm47xx_get_invariants);
+ 	if (err)
+ 		panic("Failed to initialize SSB bus (err %d)", err);
+@@ -136,7 +136,7 @@ static void __init bcm47xx_register_ssb(
+ 		if (strstr(buf, "console=ttyS1")) {
+ 			struct ssb_serial_port port;
+ 
+-			printk(KERN_DEBUG "Swapping serial ports!\n");
++			pr_debug("Swapping serial ports!\n");
+ 			/* swap serial ports */
+ 			memcpy(&port, &mcore->serial_ports[0], sizeof(port));
+ 			memcpy(&mcore->serial_ports[0], &mcore->serial_ports[1],
+@@ -168,7 +168,7 @@ void __init plat_mem_setup(void)
+ 	struct cpuinfo_mips *c = &current_cpu_data;
+ 
+ 	if ((c->cputype == CPU_74K) || (c->cputype == CPU_1074K)) {
+-		printk(KERN_INFO "bcm47xx: using bcma bus\n");
++		pr_info("Using bcma bus\n");
+ #ifdef CONFIG_BCM47XX_BCMA
+ 		bcm47xx_bus_type = BCM47XX_BUS_TYPE_BCMA;
+ 		bcm47xx_sprom_register_fallbacks();
+@@ -179,7 +179,7 @@ void __init plat_mem_setup(void)
+ #endif
+ #endif
+ 	} else {
+-		printk(KERN_INFO "bcm47xx: using ssb bus\n");
++		pr_info("Using ssb bus\n");
+ #ifdef CONFIG_BCM47XX_SSB
+ 		bcm47xx_bus_type = BCM47XX_BUS_TYPE_SSB;
+ 		bcm47xx_sprom_register_fallbacks();
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -780,8 +780,8 @@ void bcm47xx_fill_sprom(struct ssb_sprom
+ 		bcm47xx_fill_sprom_path_r4589(sprom, prefix, fallback);
+ 		break;
+ 	default:
+-		pr_warn("Unsupported SPROM revision %d detected. Will extract"
+-			" v1\n", sprom->revision);
++		pr_warn("Unsupported SPROM revision %d detected. Will extract v1\n",
++			sprom->revision);
+ 		sprom->revision = 1;
+ 		bcm47xx_fill_sprom_r1234589(sprom, prefix, fallback);
+ 		bcm47xx_fill_sprom_r12389(sprom, prefix, fallback);
+@@ -828,7 +828,7 @@ static int bcm47xx_get_sprom_ssb(struct
+ 		bcm47xx_fill_sprom(out, prefix, false);
+ 		return 0;
+ 	} else {
+-		pr_warn("bcm47xx: unable to fill SPROM for given bustype.\n");
++		pr_warn("Unable to fill SPROM for given bustype.\n");
+ 		return -EINVAL;
+ 	}
+ }
+@@ -893,7 +893,7 @@ static int bcm47xx_get_sprom_bcma(struct
+ 		}
+ 		return 0;
+ 	default:
+-		pr_warn("bcm47xx: unable to fill SPROM for given bustype.\n");
++		pr_warn("Unable to fill SPROM for given bustype.\n");
+ 		return -EINVAL;
+ 	}
+ }
+--- a/arch/mips/bcm47xx/time.c
++++ b/arch/mips/bcm47xx/time.c
+@@ -22,7 +22,6 @@
+  *  675 Mass Ave, Cambridge, MA 02139, USA.
+  */
+ 
+-
+ #include <linux/init.h>
+ #include <linux/ssb/ssb.h>
+ #include <asm/time.h>
diff --git a/target/linux/brcm47xx/patches-3.18/031-07-MIPS-BCM47XX-Include-io.h-directly-and-fix-brace-ind.patch b/target/linux/brcm47xx/patches-3.18/031-07-MIPS-BCM47XX-Include-io.h-directly-and-fix-brace-ind.patch
new file mode 100644
index 0000000..6f96ee0
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/031-07-MIPS-BCM47XX-Include-io.h-directly-and-fix-brace-ind.patch
@@ -0,0 +1,38 @@
+From 50c979109c484c07358a1ac75b99df36d563c132 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Wed, 1 Apr 2015 08:23:03 +0200
+Subject: [PATCH] MIPS: BCM47XX: Include io.h directly and fix brace indent
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We use IO functions like readl & ioremap_nocache, so include linux/io.h
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/9650/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -11,6 +11,7 @@
+  * option) any later version.
+  */
+ 
++#include <linux/io.h>
+ #include <linux/types.h>
+ #include <linux/module.h>
+ #include <linux/kernel.h>
+@@ -203,7 +204,7 @@ int bcm47xx_nvram_getenv(const char *nam
+ 		if (eq - var == strlen(name) &&
+ 		    strncmp(var, name, eq - var) == 0)
+ 			return snprintf(val, val_len, "%s", value);
+-		}
++	}
+ 	return -ENOENT;
+ }
+ EXPORT_SYMBOL(bcm47xx_nvram_getenv);
diff --git a/target/linux/brcm47xx/patches-3.18/031-08-MIPS-BCM47XX-Increase-NVRAM-buffer-size-to-64-KiB.patch b/target/linux/brcm47xx/patches-3.18/031-08-MIPS-BCM47XX-Increase-NVRAM-buffer-size-to-64-KiB.patch
new file mode 100644
index 0000000..a7cc110
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/031-08-MIPS-BCM47XX-Increase-NVRAM-buffer-size-to-64-KiB.patch
@@ -0,0 +1,32 @@
+From 6ab7c29099390b3d23c97f14498fd26a5ef6b22b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Wed, 1 Apr 2015 08:23:04 +0200
+Subject: [PATCH] MIPS: BCM47XX: Increase NVRAM buffer size to 64 KiB
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+For years Broadcom devices use 64 KiB NVRAM partition size and some of
+them indeed have it filled in more than 50%. This change allows reading
+whole NVRAM e.g. on Netgear WNDR4500 and Netgear R8000.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/9651/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -20,7 +20,7 @@
+ #include <linux/bcm47xx_nvram.h>
+ 
+ #define NVRAM_MAGIC			0x48534C46	/* 'FLSH' */
+-#define NVRAM_SPACE			0x8000
++#define NVRAM_SPACE			0x10000
+ #define NVRAM_MAX_GPIO_ENTRIES		32
+ #define NVRAM_MAX_GPIO_VALUE_LEN	30
+ 
diff --git a/target/linux/brcm47xx/patches-3.18/031-09-MIPS-BCM47XX-Don-t-try-guessing-NVRAM-size-on-MTD-pa.patch b/target/linux/brcm47xx/patches-3.18/031-09-MIPS-BCM47XX-Don-t-try-guessing-NVRAM-size-on-MTD-pa.patch
new file mode 100644
index 0000000..c40c8b7
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/031-09-MIPS-BCM47XX-Don-t-try-guessing-NVRAM-size-on-MTD-pa.patch
@@ -0,0 +1,75 @@
+From 40d12172c8a5c2f3fc39642fc564b053575cd000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Wed, 1 Apr 2015 08:23:05 +0200
+Subject: [PATCH] MIPS: BCM47XX: Don't try guessing NVRAM size on MTD partition
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When dealing with whole flash content (bcm47xx_nvram_init_from_mem) we
+need to find NVRAM start trying various partition sizes (nvram_sizes).
+This is not needed when using MTD as we have direct partition access.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/9652/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 36 ++++++++++++++----------------------
+ 1 file changed, 14 insertions(+), 22 deletions(-)
+
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -139,36 +139,28 @@ static int nvram_init(void)
+ 	struct mtd_info *mtd;
+ 	struct nvram_header header;
+ 	size_t bytes_read;
+-	int err, i;
++	int err;
+ 
+ 	mtd = get_mtd_device_nm("nvram");
+ 	if (IS_ERR(mtd))
+ 		return -ENODEV;
+ 
+-	for (i = 0; i < ARRAY_SIZE(nvram_sizes); i++) {
+-		loff_t from = mtd->size - nvram_sizes[i];
+-
+-		if (from < 0)
+-			continue;
++	err = mtd_read(mtd, 0, sizeof(header), &bytes_read, (uint8_t *)&header);
++	if (!err && header.magic == NVRAM_MAGIC) {
++		u8 *dst = (uint8_t *)nvram_buf;
++		size_t len = header.len;
++
++		if (header.len > NVRAM_SPACE) {
++			pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
++				header.len, NVRAM_SPACE);
++			len = NVRAM_SPACE;
++		}
+ 
+-		err = mtd_read(mtd, from, sizeof(header), &bytes_read,
+-			       (uint8_t *)&header);
+-		if (!err && header.magic == NVRAM_MAGIC) {
+-			u8 *dst = (uint8_t *)nvram_buf;
+-			size_t len = header.len;
+-
+-			if (header.len > NVRAM_SPACE) {
+-				pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+-				       header.len, NVRAM_SPACE);
+-				len = NVRAM_SPACE;
+-			}
+-
+-			err = mtd_read(mtd, from, len, &bytes_read, dst);
+-			if (err)
+-				return err;
++		err = mtd_read(mtd, 0, len, &bytes_read, dst);
++		if (err)
++			return err;
+ 
+-			return 0;
+-		}
++		return 0;
+ 	}
+ #endif
+ 
diff --git a/target/linux/brcm47xx/patches-3.18/031-10-MIPS-BCM47xx-Keep-ID-entries-for-non-standard-device.patch b/target/linux/brcm47xx/patches-3.18/031-10-MIPS-BCM47xx-Keep-ID-entries-for-non-standard-device.patch
new file mode 100644
index 0000000..8918811
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/031-10-MIPS-BCM47xx-Keep-ID-entries-for-non-standard-device.patch
@@ -0,0 +1,96 @@
+From 7515c6f1da334184c3ece06e6f61461086d8e2b1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Wed, 1 Apr 2015 18:18:01 +0200
+Subject: [PATCH] MIPS: BCM47xx: Keep ID entries for non-standard devices
+ together
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/9655/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/board.c | 48 ++++++++++++++++++++---------------------------
+ 1 file changed, 20 insertions(+), 28 deletions(-)
+
+--- a/arch/mips/bcm47xx/board.c
++++ b/arch/mips/bcm47xx/board.c
+@@ -40,20 +40,6 @@ struct bcm47xx_board_type_list1 bcm47xx_
+ 	{ {0}, NULL},
+ };
+ 
+-/* model_no */
+-static const
+-struct bcm47xx_board_type_list1 bcm47xx_board_list_model_no[] __initconst = {
+-	{{BCM47XX_BOARD_ASUS_WL700GE, "Asus WL700"}, "WL700"},
+-	{ {0}, NULL},
+-};
+-
+-/* machine_name */
+-static const
+-struct bcm47xx_board_type_list1 bcm47xx_board_list_machine_name[] __initconst = {
+-	{{BCM47XX_BOARD_LINKSYS_WRTSL54GS, "Linksys WRTSL54GS"}, "WRTSL54GS"},
+-	{ {0}, NULL},
+-};
+-
+ /* hardware_version */
+ static const
+ struct bcm47xx_board_type_list1 bcm47xx_board_list_hardware_version[] __initconst = {
+@@ -202,6 +188,18 @@ struct bcm47xx_board_type_list2 bcm47xx_
+ 	{ {0}, NULL},
+ };
+ 
++/*
++ * Some devices don't use any common NVRAM entry for identification and they
++ * have only one model specific variable.
++ * They don't deserve own arrays, let's group them there using key-value array.
++ */
++static const
++struct bcm47xx_board_type_list2 bcm47xx_board_list_key_value[] __initconst = {
++	{{BCM47XX_BOARD_ASUS_WL700GE, "Asus WL700"}, "model_no", "WL700"},
++	{{BCM47XX_BOARD_LINKSYS_WRTSL54GS, "Linksys WRTSL54GS"}, "machine_name", "WRTSL54GS"},
++	{ {0}, NULL},
++};
++
+ static const
+ struct bcm47xx_board_type bcm47xx_board_unknown[] __initconst = {
+ 	{BCM47XX_BOARD_UNKNOWN, "Unknown Board"},
+@@ -225,20 +223,6 @@ static __init const struct bcm47xx_board
+ 		}
+ 	}
+ 
+-	if (bcm47xx_nvram_getenv("model_no", buf1, sizeof(buf1)) >= 0) {
+-		for (e1 = bcm47xx_board_list_model_no; e1->value1; e1++) {
+-			if (strstarts(buf1, e1->value1))
+-				return &e1->board;
+-		}
+-	}
+-
+-	if (bcm47xx_nvram_getenv("machine_name", buf1, sizeof(buf1)) >= 0) {
+-		for (e1 = bcm47xx_board_list_machine_name; e1->value1; e1++) {
+-			if (strstarts(buf1, e1->value1))
+-				return &e1->board;
+-		}
+-	}
+-
+ 	if (bcm47xx_nvram_getenv("hardware_version", buf1, sizeof(buf1)) >= 0) {
+ 		for (e1 = bcm47xx_board_list_hardware_version; e1->value1; e1++) {
+ 			if (strstarts(buf1, e1->value1))
+@@ -314,6 +298,14 @@ static __init const struct bcm47xx_board
+ 				return &e2->board;
+ 		}
+ 	}
++
++	for (e2 = bcm47xx_board_list_key_value; e2->value1; e2++) {
++		if (bcm47xx_nvram_getenv(e2->value1, buf1, sizeof(buf1)) >= 0) {
++			if (!strcmp(buf1, e2->value2))
++				return &e2->board;
++		}
++	}
++
+ 	return bcm47xx_board_unknown;
+ }
+ 
diff --git a/target/linux/brcm47xx/patches-3.18/031-11-MIPS-BCM47xx-Devices-database-update-for-4.1-or-4.2.patch b/target/linux/brcm47xx/patches-3.18/031-11-MIPS-BCM47xx-Devices-database-update-for-4.1-or-4.2.patch
new file mode 100644
index 0000000..6e6166c
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/031-11-MIPS-BCM47xx-Devices-database-update-for-4.1-or-4.2.patch
@@ -0,0 +1,147 @@
+From 160f14312b0b7d35759535b1f60be79247b263c4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Wed, 1 Apr 2015 18:18:02 +0200
+Subject: [PATCH] MIPS: BCM47xx: Devices database update for 4.1 (or 4.2?)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/9656/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/board.c                          |  4 ++++
+ arch/mips/bcm47xx/buttons.c                        | 18 ++++++++++++++++++
+ arch/mips/bcm47xx/leds.c                           | 10 ++++++++++
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h |  4 ++++
+ 4 files changed, 36 insertions(+)
+
+--- a/arch/mips/bcm47xx/board.c
++++ b/arch/mips/bcm47xx/board.c
+@@ -151,9 +151,11 @@ static const
+ struct bcm47xx_board_type_list1 bcm47xx_board_list_board_id[] __initconst = {
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614V8, "Netgear WGR614 V8"}, "U12H072T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614V9, "Netgear WGR614 V9"}, "U12H094T00_NETGEAR"},
++	{{BCM47XX_BOARD_NETGEAR_WGR614_V10, "Netgear WGR614 V10"}, "U12H139T01_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNDR3300, "Netgear WNDR3300"}, "U12H093T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNDR3400V1, "Netgear WNDR3400 V1"}, "U12H155T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNDR3400V2, "Netgear WNDR3400 V2"}, "U12H187T00_NETGEAR"},
++	{{BCM47XX_BOARD_NETGEAR_WNDR3400_V3, "Netgear WNDR3400 V3"}, "U12H208T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNDR3400VCNA, "Netgear WNDR3400 Vcna"}, "U12H155T01_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNDR3700V3, "Netgear WNDR3700 V3"}, "U12H194T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNDR4000, "Netgear WNDR4000"}, "U12H181T00_NETGEAR"},
+@@ -196,6 +198,8 @@ struct bcm47xx_board_type_list2 bcm47xx_
+ static const
+ struct bcm47xx_board_type_list2 bcm47xx_board_list_key_value[] __initconst = {
+ 	{{BCM47XX_BOARD_ASUS_WL700GE, "Asus WL700"}, "model_no", "WL700"},
++	{{BCM47XX_BOARD_LINKSYS_WRT300N_V1, "Linksys WRT300N V1"}, "router_name", "WRT300N"},
++	{{BCM47XX_BOARD_LINKSYS_WRT600N_V11, "Linksys WRT600N V1.1"}, "Model_Name", "WRT600N"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRTSL54GS, "Linksys WRTSL54GS"}, "machine_name", "WRTSL54GS"},
+ 	{ {0}, NULL},
+ };
+--- a/arch/mips/bcm47xx/buttons.c
++++ b/arch/mips/bcm47xx/buttons.c
+@@ -252,6 +252,12 @@ bcm47xx_buttons_linksys_wrt160nv3[] __in
+ };
+ 
+ static const struct gpio_keys_button
++bcm47xx_buttons_linksys_wrt300n_v1[] __initconst = {
++	BCM47XX_GPIO_KEY(4, KEY_WPS_BUTTON),
++	BCM47XX_GPIO_KEY(6, KEY_RESTART),
++};
++
++static const struct gpio_keys_button
+ bcm47xx_buttons_linksys_wrt300nv11[] __initconst = {
+ 	BCM47XX_GPIO_KEY(4, KEY_UNKNOWN),
+ 	BCM47XX_GPIO_KEY(6, KEY_RESTART),
+@@ -327,6 +333,12 @@ bcm47xx_buttons_netgear_wndr3400v1[] __i
+ };
+ 
+ static const struct gpio_keys_button
++bcm47xx_buttons_netgear_wndr3400_v3[] __initconst = {
++	BCM47XX_GPIO_KEY(12, KEY_RESTART),
++	BCM47XX_GPIO_KEY(23, KEY_WPS_BUTTON),
++};
++
++static const struct gpio_keys_button
+ bcm47xx_buttons_netgear_wndr3700v3[] __initconst = {
+ 	BCM47XX_GPIO_KEY(2, KEY_RFKILL),
+ 	BCM47XX_GPIO_KEY(3, KEY_RESTART),
+@@ -516,6 +528,9 @@ int __init bcm47xx_buttons_register(void
+ 	case BCM47XX_BOARD_LINKSYS_WRT160NV3:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt160nv3);
+ 		break;
++	case BCM47XX_BOARD_LINKSYS_WRT300N_V1:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt300n_v1);
++		break;
+ 	case BCM47XX_BOARD_LINKSYS_WRT300NV11:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt300nv11);
+ 		break;
+@@ -557,6 +572,9 @@ int __init bcm47xx_buttons_register(void
+ 	case BCM47XX_BOARD_NETGEAR_WNDR3400V1:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wndr3400v1);
+ 		break;
++	case BCM47XX_BOARD_NETGEAR_WNDR3400_V3:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wndr3400_v3);
++		break;
+ 	case BCM47XX_BOARD_NETGEAR_WNDR3700V3:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wndr3700v3);
+ 		break;
+--- a/arch/mips/bcm47xx/leds.c
++++ b/arch/mips/bcm47xx/leds.c
+@@ -292,6 +292,13 @@ bcm47xx_leds_linksys_wrt160nv3[] __initc
+ };
+ 
+ static const struct gpio_led
++bcm47xx_leds_linksys_wrt300n_v1[] __initconst = {
++	BCM47XX_GPIO_LED(1, "green", "power", 0, LEDS_GPIO_DEFSTATE_ON),
++	BCM47XX_GPIO_LED(3, "amber", "wps", 1, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(5, "green", "wps", 1, LEDS_GPIO_DEFSTATE_OFF),
++};
++
++static const struct gpio_led
+ bcm47xx_leds_linksys_wrt300nv11[] __initconst = {
+ 	BCM47XX_GPIO_LED(1, "unk", "power", 0, LEDS_GPIO_DEFSTATE_ON),
+ 	BCM47XX_GPIO_LED(3, "amber", "wps", 1, LEDS_GPIO_DEFSTATE_OFF),
+@@ -585,6 +592,9 @@ void __init bcm47xx_leds_register(void)
+ 	case BCM47XX_BOARD_LINKSYS_WRT160NV3:
+ 		bcm47xx_set_pdata(bcm47xx_leds_linksys_wrt160nv3);
+ 		break;
++	case BCM47XX_BOARD_LINKSYS_WRT300N_V1:
++		bcm47xx_set_pdata(bcm47xx_leds_linksys_wrt300n_v1);
++		break;
+ 	case BCM47XX_BOARD_LINKSYS_WRT300NV11:
+ 		bcm47xx_set_pdata(bcm47xx_leds_linksys_wrt300nv11);
+ 		break;
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
+@@ -67,6 +67,7 @@ enum bcm47xx_board {
+ 	BCM47XX_BOARD_LINKSYS_WRT150NV11,
+ 	BCM47XX_BOARD_LINKSYS_WRT160NV1,
+ 	BCM47XX_BOARD_LINKSYS_WRT160NV3,
++	BCM47XX_BOARD_LINKSYS_WRT300N_V1,
+ 	BCM47XX_BOARD_LINKSYS_WRT300NV11,
+ 	BCM47XX_BOARD_LINKSYS_WRT310NV1,
+ 	BCM47XX_BOARD_LINKSYS_WRT310NV2,
+@@ -74,6 +75,7 @@ enum bcm47xx_board {
+ 	BCM47XX_BOARD_LINKSYS_WRT54G_TYPE_0101,
+ 	BCM47XX_BOARD_LINKSYS_WRT54G_TYPE_0467,
+ 	BCM47XX_BOARD_LINKSYS_WRT54G_TYPE_0708,
++	BCM47XX_BOARD_LINKSYS_WRT600N_V11,
+ 	BCM47XX_BOARD_LINKSYS_WRT610NV1,
+ 	BCM47XX_BOARD_LINKSYS_WRT610NV2,
+ 	BCM47XX_BOARD_LINKSYS_WRTSL54GS,
+@@ -86,9 +88,11 @@ enum bcm47xx_board {
+ 
+ 	BCM47XX_BOARD_NETGEAR_WGR614V8,
+ 	BCM47XX_BOARD_NETGEAR_WGR614V9,
++	BCM47XX_BOARD_NETGEAR_WGR614_V10,
+ 	BCM47XX_BOARD_NETGEAR_WNDR3300,
+ 	BCM47XX_BOARD_NETGEAR_WNDR3400V1,
+ 	BCM47XX_BOARD_NETGEAR_WNDR3400V2,
++	BCM47XX_BOARD_NETGEAR_WNDR3400_V3,
+ 	BCM47XX_BOARD_NETGEAR_WNDR3400VCNA,
+ 	BCM47XX_BOARD_NETGEAR_WNDR3700V3,
+ 	BCM47XX_BOARD_NETGEAR_WNDR4000,
diff --git a/target/linux/brcm47xx/patches-3.18/031-12-MIPS-BCM47xx-Add-generic-function-filling-SPROM-entr.patch b/target/linux/brcm47xx/patches-3.18/031-12-MIPS-BCM47xx-Add-generic-function-filling-SPROM-entr.patch
new file mode 100644
index 0000000..482aa49
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/031-12-MIPS-BCM47xx-Add-generic-function-filling-SPROM-entr.patch
@@ -0,0 +1,80 @@
+From d55a52ccf8f80cdf51af2c5c6e56c825f98c4f85 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Thu, 2 Apr 2015 09:13:49 +0200
+Subject: [PATCH] MIPS: BCM47xx: Add generic function filling SPROM entries
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Handling many SPROM revisions became messy, we have tons of functions
+specific to various revision groups which are quite hard to track.
+For years there is yet another revision 11 asking for support, but
+adding it in current the form would make things even worse.
+To resolve this problem let's add new function with table-like entries
+that will contain revision bitmask for every SPROM variable.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Jonas Gorski <jonas.gorski@gmail.com>
+Patchwork: https://patchwork.linux-mips.org/patch/9659/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/sprom.c | 32 +++++++++++++++++++++++++++++---
+ 1 file changed, 29 insertions(+), 3 deletions(-)
+
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -180,6 +180,33 @@ static void nvram_read_alpha2(const char
+ 	memcpy(val, buf, 2);
+ }
+ 
++/* This is one-function-only macro, it uses local "sprom" variable! */
++#define ENTRY(_revmask, _type, _prefix, _name, _val, _allset, _fallback) \
++	if (_revmask & BIT(sprom->revision)) \
++		nvram_read_ ## _type(_prefix, NULL, _name, &sprom->_val, \
++				     _allset, _fallback)
++/*
++ * Special version of filling function that can be safely called for any SPROM
++ * revision. For every NVRAM to SPROM mapping it contains bitmask of revisions
++ * for which the mapping is valid.
++ * It obviously requires some hexadecimal/bitmasks knowledge, but allows
++ * writing cleaner code (easy revisions handling).
++ * Note that while SPROM revision 0 was never used, we still keep BIT(0)
++ * reserved for it, just to keep numbering sane.
++ */
++static void bcm47xx_sprom_fill_auto(struct ssb_sprom *sprom,
++				    const char *prefix, bool fallback)
++{
++	const char *pre = prefix;
++	bool fb = fallback;
++
++	ENTRY(0xfffffffe, u16, pre, "boardrev", board_rev, 0, true);
++	ENTRY(0xfffffffe, u16, pre, "boardnum", board_num, 0, fb);
++
++	/* TODO: Move more mappings here */
++}
++#undef ENTRY /* It's specififc, uses local variable, don't use it (again). */
++
+ static void bcm47xx_fill_sprom_r1234589(struct ssb_sprom *sprom,
+ 					const char *prefix, bool fallback)
+ {
+@@ -714,9 +741,6 @@ static void bcm47xx_fill_sprom_ethernet(
+ static void bcm47xx_fill_board_data(struct ssb_sprom *sprom, const char *prefix,
+ 				    bool fallback)
+ {
+-	nvram_read_u16(prefix, NULL, "boardrev", &sprom->board_rev, 0, true);
+-	nvram_read_u16(prefix, NULL, "boardnum", &sprom->board_num, 0,
+-		       fallback);
+ 	nvram_read_u16(prefix, NULL, "boardtype", &sprom->board_type, 0, true);
+ 	nvram_read_u32_2(prefix, "boardflags", &sprom->boardflags_lo,
+ 			 &sprom->boardflags_hi, fallback);
+@@ -787,6 +811,8 @@ void bcm47xx_fill_sprom(struct ssb_sprom
+ 		bcm47xx_fill_sprom_r12389(sprom, prefix, fallback);
+ 		bcm47xx_fill_sprom_r1(sprom, prefix, fallback);
+ 	}
++
++	bcm47xx_sprom_fill_auto(sprom, prefix, fallback);
+ }
+ 
+ #ifdef CONFIG_BCM47XX_SSB
diff --git a/target/linux/brcm47xx/patches-3.18/031-13-MIPS-BCM47xx-Move-filling-most-of-SPROM-to-the-gener.patch b/target/linux/brcm47xx/patches-3.18/031-13-MIPS-BCM47xx-Move-filling-most-of-SPROM-to-the-gener.patch
new file mode 100644
index 0000000..6a2d64f
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/031-13-MIPS-BCM47xx-Move-filling-most-of-SPROM-to-the-gener.patch
@@ -0,0 +1,711 @@
+From e754dfcfe37f49c9249152e2e98e58887a4d87c8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Thu, 2 Apr 2015 12:30:24 +0200
+Subject: [PATCH] MIPS: BCM47xx: Move filling most of SPROM to the generic
+ function
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This simplifies code a lot by dropping many per-revision-group
+functions. There are still some paths left that use uncommon NVRAM read
+helpers or fill arrays. They will need to be handled in separated patch.
+
+I've tested this (by printing SPROM content) for regressions on:
+1) BCM4704 (SPROM revision 2)
+2) BCM4706 (SPROM revision 8 plus 11 & 9 on extra WiFi cards)
+The only difference is not reading board_type from SPROM rev 11 which is
+unsupported and treated as rev 1. This change for rev 1 is expected.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Jonas Gorski <jonas.gorski@gmail.com>
+Patchwork: https://patchwork.linux-mips.org/patch/9660/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/sprom.c | 605 ++++++++++++++++------------------------------
+ 1 file changed, 204 insertions(+), 401 deletions(-)
+
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -201,9 +201,211 @@ static void bcm47xx_sprom_fill_auto(stru
+ 	bool fb = fallback;
+ 
+ 	ENTRY(0xfffffffe, u16, pre, "boardrev", board_rev, 0, true);
++	ENTRY(0x00000002, u16, pre, "boardflags", boardflags_lo, 0, fb);
++	ENTRY(0xfffffffc, u16, pre, "boardtype", board_type, 0, true);
+ 	ENTRY(0xfffffffe, u16, pre, "boardnum", board_num, 0, fb);
++	ENTRY(0x00000002, u8, pre, "cc", country_code, 0, fb);
++	ENTRY(0xfffffff8, u8, pre, "regrev", regrev, 0, fb);
+ 
+-	/* TODO: Move more mappings here */
++	ENTRY(0xfffffffe, u8, pre, "ledbh0", gpio0, 0xff, fb);
++	ENTRY(0xfffffffe, u8, pre, "ledbh1", gpio1, 0xff, fb);
++	ENTRY(0xfffffffe, u8, pre, "ledbh2", gpio2, 0xff, fb);
++	ENTRY(0xfffffffe, u8, pre, "ledbh3", gpio3, 0xff, fb);
++
++	ENTRY(0x0000070e, u16, pre, "pa0b0", pa0b0, 0, fb);
++	ENTRY(0x0000070e, u16, pre, "pa0b1", pa0b1, 0, fb);
++	ENTRY(0x0000070e, u16, pre, "pa0b2", pa0b2, 0, fb);
++	ENTRY(0x0000070e, u8, pre, "pa0itssit", itssi_bg, 0, fb);
++	ENTRY(0x0000070e, u8, pre, "pa0maxpwr", maxpwr_bg, 0, fb);
++
++	ENTRY(0x0000070c, u8, pre, "opo", opo, 0, fb);
++	ENTRY(0xfffffffe, u8, pre, "aa2g", ant_available_bg, 0, fb);
++	ENTRY(0xfffffffe, u8, pre, "aa5g", ant_available_a, 0, fb);
++	ENTRY(0x000007fe, s8, pre, "ag0", antenna_gain.a0, 0, fb);
++	ENTRY(0x000007fe, s8, pre, "ag1", antenna_gain.a1, 0, fb);
++	ENTRY(0x000007f0, s8, pre, "ag2", antenna_gain.a2, 0, fb);
++	ENTRY(0x000007f0, s8, pre, "ag3", antenna_gain.a3, 0, fb);
++
++	ENTRY(0x0000070e, u16, pre, "pa1b0", pa1b0, 0, fb);
++	ENTRY(0x0000070e, u16, pre, "pa1b1", pa1b1, 0, fb);
++	ENTRY(0x0000070e, u16, pre, "pa1b2", pa1b2, 0, fb);
++	ENTRY(0x0000070c, u16, pre, "pa1lob0", pa1lob0, 0, fb);
++	ENTRY(0x0000070c, u16, pre, "pa1lob1", pa1lob1, 0, fb);
++	ENTRY(0x0000070c, u16, pre, "pa1lob2", pa1lob2, 0, fb);
++	ENTRY(0x0000070c, u16, pre, "pa1hib0", pa1hib0, 0, fb);
++	ENTRY(0x0000070c, u16, pre, "pa1hib1", pa1hib1, 0, fb);
++	ENTRY(0x0000070c, u16, pre, "pa1hib2", pa1hib2, 0, fb);
++	ENTRY(0x0000070e, u8, pre, "pa1itssit", itssi_a, 0, fb);
++	ENTRY(0x0000070e, u8, pre, "pa1maxpwr", maxpwr_a, 0, fb);
++	ENTRY(0x0000070c, u8, pre, "pa1lomaxpwr", maxpwr_al, 0, fb);
++	ENTRY(0x0000070c, u8, pre, "pa1himaxpwr", maxpwr_ah, 0, fb);
++
++	ENTRY(0x00000708, u8, pre, "bxa2g", bxa2g, 0, fb);
++	ENTRY(0x00000708, u8, pre, "rssisav2g", rssisav2g, 0, fb);
++	ENTRY(0x00000708, u8, pre, "rssismc2g", rssismc2g, 0, fb);
++	ENTRY(0x00000708, u8, pre, "rssismf2g", rssismf2g, 0, fb);
++	ENTRY(0x00000708, u8, pre, "bxa5g", bxa5g, 0, fb);
++	ENTRY(0x00000708, u8, pre, "rssisav5g", rssisav5g, 0, fb);
++	ENTRY(0x00000708, u8, pre, "rssismc5g", rssismc5g, 0, fb);
++	ENTRY(0x00000708, u8, pre, "rssismf5g", rssismf5g, 0, fb);
++	ENTRY(0x00000708, u8, pre, "tri2g", tri2g, 0, fb);
++	ENTRY(0x00000708, u8, pre, "tri5g", tri5g, 0, fb);
++	ENTRY(0x00000708, u8, pre, "tri5gl", tri5gl, 0, fb);
++	ENTRY(0x00000708, u8, pre, "tri5gh", tri5gh, 0, fb);
++	ENTRY(0x00000708, s8, pre, "rxpo2g", rxpo2g, 0, fb);
++	ENTRY(0x00000708, s8, pre, "rxpo5g", rxpo5g, 0, fb);
++	ENTRY(0xfffffff0, u8, pre, "txchain", txchain, 0xf, fb);
++	ENTRY(0xfffffff0, u8, pre, "rxchain", rxchain, 0xf, fb);
++	ENTRY(0xfffffff0, u8, pre, "antswitch", antswitch, 0xff, fb);
++	ENTRY(0x00000700, u8, pre, "tssipos2g", fem.ghz2.tssipos, 0, fb);
++	ENTRY(0x00000700, u8, pre, "extpagain2g", fem.ghz2.extpa_gain, 0, fb);
++	ENTRY(0x00000700, u8, pre, "pdetrange2g", fem.ghz2.pdet_range, 0, fb);
++	ENTRY(0x00000700, u8, pre, "triso2g", fem.ghz2.tr_iso, 0, fb);
++	ENTRY(0x00000700, u8, pre, "antswctl2g", fem.ghz2.antswlut, 0, fb);
++	ENTRY(0x00000700, u8, pre, "tssipos5g", fem.ghz5.tssipos, 0, fb);
++	ENTRY(0x00000700, u8, pre, "extpagain5g", fem.ghz5.extpa_gain, 0, fb);
++	ENTRY(0x00000700, u8, pre, "pdetrange5g", fem.ghz5.pdet_range, 0, fb);
++	ENTRY(0x00000700, u8, pre, "triso5g", fem.ghz5.tr_iso, 0, fb);
++	ENTRY(0x00000700, u8, pre, "antswctl5g", fem.ghz5.antswlut, 0, fb);
++	ENTRY(0x000000f0, u8, pre, "txpid2ga0", txpid2g[0], 0, fb);
++	ENTRY(0x000000f0, u8, pre, "txpid2ga1", txpid2g[1], 0, fb);
++	ENTRY(0x000000f0, u8, pre, "txpid2ga2", txpid2g[2], 0, fb);
++	ENTRY(0x000000f0, u8, pre, "txpid2ga3", txpid2g[3], 0, fb);
++	ENTRY(0x000000f0, u8, pre, "txpid5ga0", txpid5g[0], 0, fb);
++	ENTRY(0x000000f0, u8, pre, "txpid5ga1", txpid5g[1], 0, fb);
++	ENTRY(0x000000f0, u8, pre, "txpid5ga2", txpid5g[2], 0, fb);
++	ENTRY(0x000000f0, u8, pre, "txpid5ga3", txpid5g[3], 0, fb);
++	ENTRY(0x000000f0, u8, pre, "txpid5gla0", txpid5gl[0], 0, fb);
++	ENTRY(0x000000f0, u8, pre, "txpid5gla1", txpid5gl[1], 0, fb);
++	ENTRY(0x000000f0, u8, pre, "txpid5gla2", txpid5gl[2], 0, fb);
++	ENTRY(0x000000f0, u8, pre, "txpid5gla3", txpid5gl[3], 0, fb);
++	ENTRY(0x000000f0, u8, pre, "txpid5gha0", txpid5gh[0], 0, fb);
++	ENTRY(0x000000f0, u8, pre, "txpid5gha1", txpid5gh[1], 0, fb);
++	ENTRY(0x000000f0, u8, pre, "txpid5gha2", txpid5gh[2], 0, fb);
++	ENTRY(0x000000f0, u8, pre, "txpid5gha3", txpid5gh[3], 0, fb);
++
++	ENTRY(0xffffff00, u8, pre, "tempthresh", tempthresh, 0, fb);
++	ENTRY(0xffffff00, u8, pre, "tempoffset", tempoffset, 0, fb);
++	ENTRY(0xffffff00, u16, pre, "rawtempsense", rawtempsense, 0, fb);
++	ENTRY(0xffffff00, u8, pre, "measpower", measpower, 0, fb);
++	ENTRY(0xffffff00, u8, pre, "tempsense_slope", tempsense_slope, 0, fb);
++	ENTRY(0xffffff00, u8, pre, "tempcorrx", tempcorrx, 0, fb);
++	ENTRY(0xffffff00, u8, pre, "tempsense_option", tempsense_option, 0, fb);
++	ENTRY(0x00000700, u8, pre, "freqoffset_corr", freqoffset_corr, 0, fb);
++	ENTRY(0x00000700, u8, pre, "iqcal_swp_dis", iqcal_swp_dis, 0, fb);
++	ENTRY(0x00000700, u8, pre, "hw_iqcal_en", hw_iqcal_en, 0, fb);
++	ENTRY(0x00000700, u8, pre, "elna2g", elna2g, 0, fb);
++	ENTRY(0x00000700, u8, pre, "elna5g", elna5g, 0, fb);
++	ENTRY(0xffffff00, u8, pre, "phycal_tempdelta", phycal_tempdelta, 0, fb);
++	ENTRY(0xffffff00, u8, pre, "temps_period", temps_period, 0, fb);
++	ENTRY(0xffffff00, u8, pre, "temps_hysteresis", temps_hysteresis, 0, fb);
++	ENTRY(0xffffff00, u8, pre, "measpower1", measpower1, 0, fb);
++	ENTRY(0xffffff00, u8, pre, "measpower2", measpower2, 0, fb);
++
++	ENTRY(0x000001f0, u16, pre, "cck2gpo", cck2gpo, 0, fb);
++	ENTRY(0x000001f0, u32, pre, "ofdm2gpo", ofdm2gpo, 0, fb);
++	ENTRY(0x000001f0, u32, pre, "ofdm5gpo", ofdm5gpo, 0, fb);
++	ENTRY(0x000001f0, u32, pre, "ofdm5glpo", ofdm5glpo, 0, fb);
++	ENTRY(0x000001f0, u32, pre, "ofdm5ghpo", ofdm5ghpo, 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs2gpo0", mcs2gpo[0], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs2gpo1", mcs2gpo[1], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs2gpo2", mcs2gpo[2], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs2gpo3", mcs2gpo[3], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs2gpo4", mcs2gpo[4], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs2gpo5", mcs2gpo[5], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs2gpo6", mcs2gpo[6], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs2gpo7", mcs2gpo[7], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5gpo0", mcs5gpo[0], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5gpo1", mcs5gpo[1], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5gpo2", mcs5gpo[2], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5gpo3", mcs5gpo[3], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5gpo4", mcs5gpo[4], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5gpo5", mcs5gpo[5], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5gpo6", mcs5gpo[6], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5gpo7", mcs5gpo[7], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5glpo0", mcs5glpo[0], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5glpo1", mcs5glpo[1], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5glpo2", mcs5glpo[2], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5glpo3", mcs5glpo[3], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5glpo4", mcs5glpo[4], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5glpo5", mcs5glpo[5], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5glpo6", mcs5glpo[6], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5glpo7", mcs5glpo[7], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5ghpo0", mcs5ghpo[0], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5ghpo1", mcs5ghpo[1], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5ghpo2", mcs5ghpo[2], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5ghpo3", mcs5ghpo[3], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5ghpo4", mcs5ghpo[4], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5ghpo5", mcs5ghpo[5], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5ghpo6", mcs5ghpo[6], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "mcs5ghpo7", mcs5ghpo[7], 0, fb);
++	ENTRY(0x000001f0, u16, pre, "cddpo", cddpo, 0, fb);
++	ENTRY(0x000001f0, u16, pre, "stbcpo", stbcpo, 0, fb);
++	ENTRY(0x000001f0, u16, pre, "bw40po", bw40po, 0, fb);
++	ENTRY(0x000001f0, u16, pre, "bwduppo", bwduppo, 0, fb);
++
++	ENTRY(0xfffffe00, u16, pre, "cckbw202gpo", cckbw202gpo, 0, fb);
++	ENTRY(0xfffffe00, u16, pre, "cckbw20ul2gpo", cckbw20ul2gpo, 0, fb);
++	ENTRY(0x00000600, u32, pre, "legofdmbw202gpo", legofdmbw202gpo, 0, fb);
++	ENTRY(0x00000600, u32, pre, "legofdmbw20ul2gpo", legofdmbw20ul2gpo, 0, fb);
++	ENTRY(0x00000600, u32, pre, "legofdmbw205glpo", legofdmbw205glpo, 0, fb);
++	ENTRY(0x00000600, u32, pre, "legofdmbw20ul5glpo", legofdmbw20ul5glpo, 0, fb);
++	ENTRY(0x00000600, u32, pre, "legofdmbw205gmpo", legofdmbw205gmpo, 0, fb);
++	ENTRY(0x00000600, u32, pre, "legofdmbw20ul5gmpo", legofdmbw20ul5gmpo, 0, fb);
++	ENTRY(0x00000600, u32, pre, "legofdmbw205ghpo", legofdmbw205ghpo, 0, fb);
++	ENTRY(0x00000600, u32, pre, "legofdmbw20ul5ghpo", legofdmbw20ul5ghpo, 0, fb);
++	ENTRY(0xfffffe00, u32, pre, "mcsbw202gpo", mcsbw202gpo, 0, fb);
++	ENTRY(0x00000600, u32, pre, "mcsbw20ul2gpo", mcsbw20ul2gpo, 0, fb);
++	ENTRY(0xfffffe00, u32, pre, "mcsbw402gpo", mcsbw402gpo, 0, fb);
++	ENTRY(0xfffffe00, u32, pre, "mcsbw205glpo", mcsbw205glpo, 0, fb);
++	ENTRY(0x00000600, u32, pre, "mcsbw20ul5glpo", mcsbw20ul5glpo, 0, fb);
++	ENTRY(0xfffffe00, u32, pre, "mcsbw405glpo", mcsbw405glpo, 0, fb);
++	ENTRY(0xfffffe00, u32, pre, "mcsbw205gmpo", mcsbw205gmpo, 0, fb);
++	ENTRY(0x00000600, u32, pre, "mcsbw20ul5gmpo", mcsbw20ul5gmpo, 0, fb);
++	ENTRY(0xfffffe00, u32, pre, "mcsbw405gmpo", mcsbw405gmpo, 0, fb);
++	ENTRY(0xfffffe00, u32, pre, "mcsbw205ghpo", mcsbw205ghpo, 0, fb);
++	ENTRY(0x00000600, u32, pre, "mcsbw20ul5ghpo", mcsbw20ul5ghpo, 0, fb);
++	ENTRY(0xfffffe00, u32, pre, "mcsbw405ghpo", mcsbw405ghpo, 0, fb);
++	ENTRY(0x00000600, u16, pre, "mcs32po", mcs32po, 0, fb);
++	ENTRY(0x00000600, u16, pre, "legofdm40duppo", legofdm40duppo, 0, fb);
++	ENTRY(0x00000700, u8, pre, "pcieingress_war", pcieingress_war, 0, fb);
++
++	/* TODO: rev 11 support */
++	ENTRY(0x00000700, u8, pre, "rxgainerr2ga0", rxgainerr2ga[0], 0, fb);
++	ENTRY(0x00000700, u8, pre, "rxgainerr2ga1", rxgainerr2ga[1], 0, fb);
++	ENTRY(0x00000700, u8, pre, "rxgainerr2ga2", rxgainerr2ga[2], 0, fb);
++	ENTRY(0x00000700, u8, pre, "rxgainerr5gla0", rxgainerr5gla[0], 0, fb);
++	ENTRY(0x00000700, u8, pre, "rxgainerr5gla1", rxgainerr5gla[1], 0, fb);
++	ENTRY(0x00000700, u8, pre, "rxgainerr5gla2", rxgainerr5gla[2], 0, fb);
++	ENTRY(0x00000700, u8, pre, "rxgainerr5gma0", rxgainerr5gma[0], 0, fb);
++	ENTRY(0x00000700, u8, pre, "rxgainerr5gma1", rxgainerr5gma[1], 0, fb);
++	ENTRY(0x00000700, u8, pre, "rxgainerr5gma2", rxgainerr5gma[2], 0, fb);
++	ENTRY(0x00000700, u8, pre, "rxgainerr5gha0", rxgainerr5gha[0], 0, fb);
++	ENTRY(0x00000700, u8, pre, "rxgainerr5gha1", rxgainerr5gha[1], 0, fb);
++	ENTRY(0x00000700, u8, pre, "rxgainerr5gha2", rxgainerr5gha[2], 0, fb);
++	ENTRY(0x00000700, u8, pre, "rxgainerr5gua0", rxgainerr5gua[0], 0, fb);
++	ENTRY(0x00000700, u8, pre, "rxgainerr5gua1", rxgainerr5gua[1], 0, fb);
++	ENTRY(0x00000700, u8, pre, "rxgainerr5gua2", rxgainerr5gua[2], 0, fb);
++
++	ENTRY(0xfffffe00, u8, pre, "sar2g", sar2g, 0, fb);
++	ENTRY(0xfffffe00, u8, pre, "sar5g", sar5g, 0, fb);
++
++	/* TODO: rev 11 support */
++	ENTRY(0x00000700, u8, pre, "noiselvl2ga0", noiselvl2ga[0], 0, fb);
++	ENTRY(0x00000700, u8, pre, "noiselvl2ga1", noiselvl2ga[1], 0, fb);
++	ENTRY(0x00000700, u8, pre, "noiselvl2ga2", noiselvl2ga[2], 0, fb);
++	ENTRY(0x00000700, u8, pre, "noiselvl5gla0", noiselvl5gla[0], 0, fb);
++	ENTRY(0x00000700, u8, pre, "noiselvl5gla1", noiselvl5gla[1], 0, fb);
++	ENTRY(0x00000700, u8, pre, "noiselvl5gla2", noiselvl5gla[2], 0, fb);
++	ENTRY(0x00000700, u8, pre, "noiselvl5gma0", noiselvl5gma[0], 0, fb);
++	ENTRY(0x00000700, u8, pre, "noiselvl5gma1", noiselvl5gma[1], 0, fb);
++	ENTRY(0x00000700, u8, pre, "noiselvl5gma2", noiselvl5gma[2], 0, fb);
++	ENTRY(0x00000700, u8, pre, "noiselvl5gha0", noiselvl5gha[0], 0, fb);
++	ENTRY(0x00000700, u8, pre, "noiselvl5gha1", noiselvl5gha[1], 0, fb);
++	ENTRY(0x00000700, u8, pre, "noiselvl5gha2", noiselvl5gha[2], 0, fb);
++	ENTRY(0x00000700, u8, pre, "noiselvl5gua0", noiselvl5gua[0], 0, fb);
++	ENTRY(0x00000700, u8, pre, "noiselvl5gua1", noiselvl5gua[1], 0, fb);
++	ENTRY(0x00000700, u8, pre, "noiselvl5gua2", noiselvl5gua[2], 0, fb);
+ }
+ #undef ENTRY /* It's specififc, uses local variable, don't use it (again). */
+ 
+@@ -211,90 +413,12 @@ static void bcm47xx_fill_sprom_r1234589(
+ 					const char *prefix, bool fallback)
+ {
+ 	nvram_read_u16(prefix, NULL, "devid", &sprom->dev_id, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "ledbh0", &sprom->gpio0, 0xff, fallback);
+-	nvram_read_u8(prefix, NULL, "ledbh1", &sprom->gpio1, 0xff, fallback);
+-	nvram_read_u8(prefix, NULL, "ledbh2", &sprom->gpio2, 0xff, fallback);
+-	nvram_read_u8(prefix, NULL, "ledbh3", &sprom->gpio3, 0xff, fallback);
+-	nvram_read_u8(prefix, NULL, "aa2g", &sprom->ant_available_bg, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "aa5g", &sprom->ant_available_a, 0,
+-		      fallback);
+-	nvram_read_s8(prefix, NULL, "ag0", &sprom->antenna_gain.a0, 0,
+-		      fallback);
+-	nvram_read_s8(prefix, NULL, "ag1", &sprom->antenna_gain.a1, 0,
+-		      fallback);
+ 	nvram_read_alpha2(prefix, "ccode", sprom->alpha2, fallback);
+ }
+ 
+-static void bcm47xx_fill_sprom_r12389(struct ssb_sprom *sprom,
+-				      const char *prefix, bool fallback)
+-{
+-	nvram_read_u16(prefix, NULL, "pa0b0", &sprom->pa0b0, 0, fallback);
+-	nvram_read_u16(prefix, NULL, "pa0b1", &sprom->pa0b1, 0, fallback);
+-	nvram_read_u16(prefix, NULL, "pa0b2", &sprom->pa0b2, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "pa0itssit", &sprom->itssi_bg, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "pa0maxpwr", &sprom->maxpwr_bg, 0,
+-		      fallback);
+-	nvram_read_u16(prefix, NULL, "pa1b0", &sprom->pa1b0, 0, fallback);
+-	nvram_read_u16(prefix, NULL, "pa1b1", &sprom->pa1b1, 0, fallback);
+-	nvram_read_u16(prefix, NULL, "pa1b2", &sprom->pa1b2, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "pa1itssit", &sprom->itssi_a, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "pa1maxpwr", &sprom->maxpwr_a, 0, fallback);
+-}
+-
+-static void bcm47xx_fill_sprom_r1(struct ssb_sprom *sprom, const char *prefix,
+-				  bool fallback)
+-{
+-	nvram_read_u16(prefix, NULL, "boardflags", &sprom->boardflags_lo, 0,
+-		       fallback);
+-	nvram_read_u8(prefix, NULL, "cc", &sprom->country_code, 0, fallback);
+-}
+-
+-static void bcm47xx_fill_sprom_r2389(struct ssb_sprom *sprom,
+-				     const char *prefix, bool fallback)
+-{
+-	nvram_read_u8(prefix, NULL, "opo", &sprom->opo, 0, fallback);
+-	nvram_read_u16(prefix, NULL, "pa1lob0", &sprom->pa1lob0, 0, fallback);
+-	nvram_read_u16(prefix, NULL, "pa1lob1", &sprom->pa1lob1, 0, fallback);
+-	nvram_read_u16(prefix, NULL, "pa1lob2", &sprom->pa1lob2, 0, fallback);
+-	nvram_read_u16(prefix, NULL, "pa1hib0", &sprom->pa1hib0, 0, fallback);
+-	nvram_read_u16(prefix, NULL, "pa1hib1", &sprom->pa1hib1, 0, fallback);
+-	nvram_read_u16(prefix, NULL, "pa1hib2", &sprom->pa1hib2, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "pa1lomaxpwr", &sprom->maxpwr_al, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "pa1himaxpwr", &sprom->maxpwr_ah, 0,
+-		      fallback);
+-}
+-
+-static void bcm47xx_fill_sprom_r389(struct ssb_sprom *sprom, const char *prefix,
+-				    bool fallback)
+-{
+-	nvram_read_u8(prefix, NULL, "bxa2g", &sprom->bxa2g, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "rssisav2g", &sprom->rssisav2g, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "rssismc2g", &sprom->rssismc2g, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "rssismf2g", &sprom->rssismf2g, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "bxa5g", &sprom->bxa5g, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "rssisav5g", &sprom->rssisav5g, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "rssismc5g", &sprom->rssismc5g, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "rssismf5g", &sprom->rssismf5g, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "tri2g", &sprom->tri2g, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "tri5g", &sprom->tri5g, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "tri5gl", &sprom->tri5gl, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "tri5gh", &sprom->tri5gh, 0, fallback);
+-	nvram_read_s8(prefix, NULL, "rxpo2g", &sprom->rxpo2g, 0, fallback);
+-	nvram_read_s8(prefix, NULL, "rxpo5g", &sprom->rxpo5g, 0, fallback);
+-}
+-
+ static void bcm47xx_fill_sprom_r3(struct ssb_sprom *sprom, const char *prefix,
+ 				  bool fallback)
+ {
+-	nvram_read_u8(prefix, NULL, "regrev", &sprom->regrev, 0, fallback);
+ 	nvram_read_leddc(prefix, "leddc", &sprom->leddc_on_time,
+ 			 &sprom->leddc_off_time, fallback);
+ }
+@@ -302,309 +426,10 @@ static void bcm47xx_fill_sprom_r3(struct
+ static void bcm47xx_fill_sprom_r4589(struct ssb_sprom *sprom,
+ 				     const char *prefix, bool fallback)
+ {
+-	nvram_read_u8(prefix, NULL, "regrev", &sprom->regrev, 0, fallback);
+-	nvram_read_s8(prefix, NULL, "ag2", &sprom->antenna_gain.a2, 0,
+-		      fallback);
+-	nvram_read_s8(prefix, NULL, "ag3", &sprom->antenna_gain.a3, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "txchain", &sprom->txchain, 0xf, fallback);
+-	nvram_read_u8(prefix, NULL, "rxchain", &sprom->rxchain, 0xf, fallback);
+-	nvram_read_u8(prefix, NULL, "antswitch", &sprom->antswitch, 0xff,
+-		      fallback);
+ 	nvram_read_leddc(prefix, "leddc", &sprom->leddc_on_time,
+ 			 &sprom->leddc_off_time, fallback);
+ }
+ 
+-static void bcm47xx_fill_sprom_r458(struct ssb_sprom *sprom, const char *prefix,
+-				    bool fallback)
+-{
+-	nvram_read_u16(prefix, NULL, "cck2gpo", &sprom->cck2gpo, 0, fallback);
+-	nvram_read_u32(prefix, NULL, "ofdm2gpo", &sprom->ofdm2gpo, 0, fallback);
+-	nvram_read_u32(prefix, NULL, "ofdm5gpo", &sprom->ofdm5gpo, 0, fallback);
+-	nvram_read_u32(prefix, NULL, "ofdm5glpo", &sprom->ofdm5glpo, 0,
+-		       fallback);
+-	nvram_read_u32(prefix, NULL, "ofdm5ghpo", &sprom->ofdm5ghpo, 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "cddpo", &sprom->cddpo, 0, fallback);
+-	nvram_read_u16(prefix, NULL, "stbcpo", &sprom->stbcpo, 0, fallback);
+-	nvram_read_u16(prefix, NULL, "bw40po", &sprom->bw40po, 0, fallback);
+-	nvram_read_u16(prefix, NULL, "bwduppo", &sprom->bwduppo, 0, fallback);
+-	nvram_read_u16(prefix, NULL, "mcs2gpo0", &sprom->mcs2gpo[0], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs2gpo1", &sprom->mcs2gpo[1], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs2gpo2", &sprom->mcs2gpo[2], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs2gpo3", &sprom->mcs2gpo[3], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs2gpo4", &sprom->mcs2gpo[4], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs2gpo5", &sprom->mcs2gpo[5], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs2gpo6", &sprom->mcs2gpo[6], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs2gpo7", &sprom->mcs2gpo[7], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5gpo0", &sprom->mcs5gpo[0], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5gpo1", &sprom->mcs5gpo[1], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5gpo2", &sprom->mcs5gpo[2], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5gpo3", &sprom->mcs5gpo[3], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5gpo4", &sprom->mcs5gpo[4], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5gpo5", &sprom->mcs5gpo[5], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5gpo6", &sprom->mcs5gpo[6], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5gpo7", &sprom->mcs5gpo[7], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5glpo0", &sprom->mcs5glpo[0], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5glpo1", &sprom->mcs5glpo[1], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5glpo2", &sprom->mcs5glpo[2], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5glpo3", &sprom->mcs5glpo[3], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5glpo4", &sprom->mcs5glpo[4], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5glpo5", &sprom->mcs5glpo[5], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5glpo6", &sprom->mcs5glpo[6], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5glpo7", &sprom->mcs5glpo[7], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5ghpo0", &sprom->mcs5ghpo[0], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5ghpo1", &sprom->mcs5ghpo[1], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5ghpo2", &sprom->mcs5ghpo[2], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5ghpo3", &sprom->mcs5ghpo[3], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5ghpo4", &sprom->mcs5ghpo[4], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5ghpo5", &sprom->mcs5ghpo[5], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5ghpo6", &sprom->mcs5ghpo[6], 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs5ghpo7", &sprom->mcs5ghpo[7], 0,
+-		       fallback);
+-}
+-
+-static void bcm47xx_fill_sprom_r45(struct ssb_sprom *sprom, const char *prefix,
+-				   bool fallback)
+-{
+-	nvram_read_u8(prefix, NULL, "txpid2ga0", &sprom->txpid2g[0], 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "txpid2ga1", &sprom->txpid2g[1], 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "txpid2ga2", &sprom->txpid2g[2], 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "txpid2ga3", &sprom->txpid2g[3], 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "txpid5ga0", &sprom->txpid5g[0], 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "txpid5ga1", &sprom->txpid5g[1], 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "txpid5ga2", &sprom->txpid5g[2], 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "txpid5ga3", &sprom->txpid5g[3], 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "txpid5gla0", &sprom->txpid5gl[0], 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "txpid5gla1", &sprom->txpid5gl[1], 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "txpid5gla2", &sprom->txpid5gl[2], 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "txpid5gla3", &sprom->txpid5gl[3], 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "txpid5gha0", &sprom->txpid5gh[0], 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "txpid5gha1", &sprom->txpid5gh[1], 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "txpid5gha2", &sprom->txpid5gh[2], 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "txpid5gha3", &sprom->txpid5gh[3], 0,
+-		      fallback);
+-}
+-
+-static void bcm47xx_fill_sprom_r89(struct ssb_sprom *sprom, const char *prefix,
+-				   bool fallback)
+-{
+-	nvram_read_u8(prefix, NULL, "tssipos2g", &sprom->fem.ghz2.tssipos, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "extpagain2g",
+-		      &sprom->fem.ghz2.extpa_gain, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "pdetrange2g",
+-		      &sprom->fem.ghz2.pdet_range, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "triso2g", &sprom->fem.ghz2.tr_iso, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "antswctl2g", &sprom->fem.ghz2.antswlut, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "tssipos5g", &sprom->fem.ghz5.tssipos, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "extpagain5g",
+-		      &sprom->fem.ghz5.extpa_gain, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "pdetrange5g",
+-		      &sprom->fem.ghz5.pdet_range, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "triso5g", &sprom->fem.ghz5.tr_iso, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "antswctl5g", &sprom->fem.ghz5.antswlut, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "tempthresh", &sprom->tempthresh, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "tempoffset", &sprom->tempoffset, 0,
+-		      fallback);
+-	nvram_read_u16(prefix, NULL, "rawtempsense", &sprom->rawtempsense, 0,
+-		       fallback);
+-	nvram_read_u8(prefix, NULL, "measpower", &sprom->measpower, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "tempsense_slope",
+-		      &sprom->tempsense_slope, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "tempcorrx", &sprom->tempcorrx, 0,
+-		       fallback);
+-	nvram_read_u8(prefix, NULL, "tempsense_option",
+-		      &sprom->tempsense_option, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "freqoffset_corr",
+-		      &sprom->freqoffset_corr, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "iqcal_swp_dis", &sprom->iqcal_swp_dis, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "hw_iqcal_en", &sprom->hw_iqcal_en, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "elna2g", &sprom->elna2g, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "elna5g", &sprom->elna5g, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "phycal_tempdelta",
+-		      &sprom->phycal_tempdelta, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "temps_period", &sprom->temps_period, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "temps_hysteresis",
+-		      &sprom->temps_hysteresis, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "measpower1", &sprom->measpower1, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "measpower2", &sprom->measpower2, 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "rxgainerr2ga0",
+-		      &sprom->rxgainerr2ga[0], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "rxgainerr2ga1",
+-		      &sprom->rxgainerr2ga[1], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "rxgainerr2ga2",
+-		      &sprom->rxgainerr2ga[2], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "rxgainerr5gla0",
+-		      &sprom->rxgainerr5gla[0], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "rxgainerr5gla1",
+-		      &sprom->rxgainerr5gla[1], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "rxgainerr5gla2",
+-		      &sprom->rxgainerr5gla[2], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "rxgainerr5gma0",
+-		      &sprom->rxgainerr5gma[0], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "rxgainerr5gma1",
+-		      &sprom->rxgainerr5gma[1], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "rxgainerr5gma2",
+-		      &sprom->rxgainerr5gma[2], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "rxgainerr5gha0",
+-		      &sprom->rxgainerr5gha[0], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "rxgainerr5gha1",
+-		      &sprom->rxgainerr5gha[1], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "rxgainerr5gha2",
+-		      &sprom->rxgainerr5gha[2], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "rxgainerr5gua0",
+-		      &sprom->rxgainerr5gua[0], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "rxgainerr5gua1",
+-		      &sprom->rxgainerr5gua[1], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "rxgainerr5gua2",
+-		      &sprom->rxgainerr5gua[2], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "noiselvl2ga0", &sprom->noiselvl2ga[0], 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "noiselvl2ga1", &sprom->noiselvl2ga[1], 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "noiselvl2ga2", &sprom->noiselvl2ga[2], 0,
+-		      fallback);
+-	nvram_read_u8(prefix, NULL, "noiselvl5gla0",
+-		      &sprom->noiselvl5gla[0], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "noiselvl5gla1",
+-		      &sprom->noiselvl5gla[1], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "noiselvl5gla2",
+-		      &sprom->noiselvl5gla[2], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "noiselvl5gma0",
+-		      &sprom->noiselvl5gma[0], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "noiselvl5gma1",
+-		      &sprom->noiselvl5gma[1], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "noiselvl5gma2",
+-		      &sprom->noiselvl5gma[2], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "noiselvl5gha0",
+-		      &sprom->noiselvl5gha[0], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "noiselvl5gha1",
+-		      &sprom->noiselvl5gha[1], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "noiselvl5gha2",
+-		      &sprom->noiselvl5gha[2], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "noiselvl5gua0",
+-		      &sprom->noiselvl5gua[0], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "noiselvl5gua1",
+-		      &sprom->noiselvl5gua[1], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "noiselvl5gua2",
+-		      &sprom->noiselvl5gua[2], 0, fallback);
+-	nvram_read_u8(prefix, NULL, "pcieingress_war",
+-		      &sprom->pcieingress_war, 0, fallback);
+-}
+-
+-static void bcm47xx_fill_sprom_r9(struct ssb_sprom *sprom, const char *prefix,
+-				  bool fallback)
+-{
+-	nvram_read_u16(prefix, NULL, "cckbw202gpo", &sprom->cckbw202gpo, 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "cckbw20ul2gpo", &sprom->cckbw20ul2gpo, 0,
+-		       fallback);
+-	nvram_read_u32(prefix, NULL, "legofdmbw202gpo",
+-		       &sprom->legofdmbw202gpo, 0, fallback);
+-	nvram_read_u32(prefix, NULL, "legofdmbw20ul2gpo",
+-		       &sprom->legofdmbw20ul2gpo, 0, fallback);
+-	nvram_read_u32(prefix, NULL, "legofdmbw205glpo",
+-		       &sprom->legofdmbw205glpo, 0, fallback);
+-	nvram_read_u32(prefix, NULL, "legofdmbw20ul5glpo",
+-		       &sprom->legofdmbw20ul5glpo, 0, fallback);
+-	nvram_read_u32(prefix, NULL, "legofdmbw205gmpo",
+-		       &sprom->legofdmbw205gmpo, 0, fallback);
+-	nvram_read_u32(prefix, NULL, "legofdmbw20ul5gmpo",
+-		       &sprom->legofdmbw20ul5gmpo, 0, fallback);
+-	nvram_read_u32(prefix, NULL, "legofdmbw205ghpo",
+-		       &sprom->legofdmbw205ghpo, 0, fallback);
+-	nvram_read_u32(prefix, NULL, "legofdmbw20ul5ghpo",
+-		       &sprom->legofdmbw20ul5ghpo, 0, fallback);
+-	nvram_read_u32(prefix, NULL, "mcsbw202gpo", &sprom->mcsbw202gpo, 0,
+-		       fallback);
+-	nvram_read_u32(prefix, NULL, "mcsbw20ul2gpo", &sprom->mcsbw20ul2gpo, 0,
+-		       fallback);
+-	nvram_read_u32(prefix, NULL, "mcsbw402gpo", &sprom->mcsbw402gpo, 0,
+-		       fallback);
+-	nvram_read_u32(prefix, NULL, "mcsbw205glpo", &sprom->mcsbw205glpo, 0,
+-		       fallback);
+-	nvram_read_u32(prefix, NULL, "mcsbw20ul5glpo",
+-		       &sprom->mcsbw20ul5glpo, 0, fallback);
+-	nvram_read_u32(prefix, NULL, "mcsbw405glpo", &sprom->mcsbw405glpo, 0,
+-		       fallback);
+-	nvram_read_u32(prefix, NULL, "mcsbw205gmpo", &sprom->mcsbw205gmpo, 0,
+-		       fallback);
+-	nvram_read_u32(prefix, NULL, "mcsbw20ul5gmpo",
+-		       &sprom->mcsbw20ul5gmpo, 0, fallback);
+-	nvram_read_u32(prefix, NULL, "mcsbw405gmpo", &sprom->mcsbw405gmpo, 0,
+-		       fallback);
+-	nvram_read_u32(prefix, NULL, "mcsbw205ghpo", &sprom->mcsbw205ghpo, 0,
+-		       fallback);
+-	nvram_read_u32(prefix, NULL, "mcsbw20ul5ghpo",
+-		       &sprom->mcsbw20ul5ghpo, 0, fallback);
+-	nvram_read_u32(prefix, NULL, "mcsbw405ghpo", &sprom->mcsbw405ghpo, 0,
+-		       fallback);
+-	nvram_read_u16(prefix, NULL, "mcs32po", &sprom->mcs32po, 0, fallback);
+-	nvram_read_u16(prefix, NULL, "legofdm40duppo",
+-		       &sprom->legofdm40duppo, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "sar2g", &sprom->sar2g, 0, fallback);
+-	nvram_read_u8(prefix, NULL, "sar5g", &sprom->sar5g, 0, fallback);
+-}
+-
+ static void bcm47xx_fill_sprom_path_r4589(struct ssb_sprom *sprom,
+ 					  const char *prefix, bool fallback)
+ {
+@@ -741,7 +566,6 @@ static void bcm47xx_fill_sprom_ethernet(
+ static void bcm47xx_fill_board_data(struct ssb_sprom *sprom, const char *prefix,
+ 				    bool fallback)
+ {
+-	nvram_read_u16(prefix, NULL, "boardtype", &sprom->board_type, 0, true);
+ 	nvram_read_u32_2(prefix, "boardflags", &sprom->boardflags_lo,
+ 			 &sprom->boardflags_hi, fallback);
+ 	nvram_read_u32_2(prefix, "boardflags2", &sprom->boardflags2_lo,
+@@ -759,48 +583,29 @@ void bcm47xx_fill_sprom(struct ssb_sprom
+ 	switch (sprom->revision) {
+ 	case 1:
+ 		bcm47xx_fill_sprom_r1234589(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r12389(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r1(sprom, prefix, fallback);
+ 		break;
+ 	case 2:
+ 		bcm47xx_fill_sprom_r1234589(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r12389(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r2389(sprom, prefix, fallback);
+ 		break;
+ 	case 3:
+ 		bcm47xx_fill_sprom_r1234589(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r12389(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r2389(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r389(sprom, prefix, fallback);
+ 		bcm47xx_fill_sprom_r3(sprom, prefix, fallback);
+ 		break;
+ 	case 4:
+ 	case 5:
+ 		bcm47xx_fill_sprom_r1234589(sprom, prefix, fallback);
+ 		bcm47xx_fill_sprom_r4589(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r458(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r45(sprom, prefix, fallback);
+ 		bcm47xx_fill_sprom_path_r4589(sprom, prefix, fallback);
+ 		bcm47xx_fill_sprom_path_r45(sprom, prefix, fallback);
+ 		break;
+ 	case 8:
+ 		bcm47xx_fill_sprom_r1234589(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r12389(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r2389(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r389(sprom, prefix, fallback);
+ 		bcm47xx_fill_sprom_r4589(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r458(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r89(sprom, prefix, fallback);
+ 		bcm47xx_fill_sprom_path_r4589(sprom, prefix, fallback);
+ 		break;
+ 	case 9:
+ 		bcm47xx_fill_sprom_r1234589(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r12389(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r2389(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r389(sprom, prefix, fallback);
+ 		bcm47xx_fill_sprom_r4589(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r89(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r9(sprom, prefix, fallback);
+ 		bcm47xx_fill_sprom_path_r4589(sprom, prefix, fallback);
+ 		break;
+ 	default:
+@@ -808,8 +613,6 @@ void bcm47xx_fill_sprom(struct ssb_sprom
+ 			sprom->revision);
+ 		sprom->revision = 1;
+ 		bcm47xx_fill_sprom_r1234589(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r12389(sprom, prefix, fallback);
+-		bcm47xx_fill_sprom_r1(sprom, prefix, fallback);
+ 	}
+ 
+ 	bcm47xx_sprom_fill_auto(sprom, prefix, fallback);
diff --git a/target/linux/brcm47xx/patches-3.18/032-01-MIPS-BCM47XX-Make-sure-NVRAM-buffer-ends-with-0.patch b/target/linux/brcm47xx/patches-3.18/032-01-MIPS-BCM47XX-Make-sure-NVRAM-buffer-ends-with-0.patch
new file mode 100644
index 0000000..7577da1
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-01-MIPS-BCM47XX-Make-sure-NVRAM-buffer-ends-with-0.patch
@@ -0,0 +1,54 @@
+From 4ddb225376a2802a4e20e16f71c6d37b679e3169 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 18:46:11 +0200
+Subject: [PATCH] MIPS: BCM47XX: Make sure NVRAM buffer ends with \0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This will simplify reading its contents.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Hante Meuleman <meuleman@broadcom.com>
+Cc: Ian Kent <raven@themaw.net>
+Patchwork: https://patchwork.linux-mips.org/patch/10031/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -98,7 +98,7 @@ found:
+ 		pr_err("The nvram size accoridng to the header seems to be bigger than the partition on flash\n");
+ 	if (header->len > NVRAM_SPACE)
+ 		pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+-		       header->len, NVRAM_SPACE);
++		       header->len, NVRAM_SPACE - 1);
+ 
+ 	src = (u32 *)header;
+ 	dst = (u32 *)nvram_buf;
+@@ -106,6 +106,7 @@ found:
+ 		*dst++ = __raw_readl(src++);
+ 	for (; i < header->len && i < NVRAM_SPACE && i < size; i += 4)
+ 		*dst++ = readl(src++);
++	nvram_buf[NVRAM_SPACE - 1] = '\0';
+ 
+ 	return 0;
+ }
+@@ -150,10 +151,10 @@ static int nvram_init(void)
+ 		u8 *dst = (uint8_t *)nvram_buf;
+ 		size_t len = header.len;
+ 
+-		if (header.len > NVRAM_SPACE) {
++		if (len >= NVRAM_SPACE) {
++			len = NVRAM_SPACE - 1;
+ 			pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+-				header.len, NVRAM_SPACE);
+-			len = NVRAM_SPACE;
++				header.len, len);
+ 		}
+ 
+ 		err = mtd_read(mtd, 0, len, &bytes_read, dst);
diff --git a/target/linux/brcm47xx/patches-3.18/032-02-MIPS-BCM47XX-Simplify-function-looking-for-NVRAM-ent.patch b/target/linux/brcm47xx/patches-3.18/032-02-MIPS-BCM47XX-Simplify-function-looking-for-NVRAM-ent.patch
new file mode 100644
index 0000000..7a3ddc3
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-02-MIPS-BCM47XX-Simplify-function-looking-for-NVRAM-ent.patch
@@ -0,0 +1,59 @@
+From f6f895644230b13618f14f7108f9b23a21a87bfa Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 18:46:12 +0200
+Subject: [PATCH] MIPS: BCM47XX: Simplify function looking for NVRAM entry
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+First of all it shouldn't modify copied NVRAM just to make sure it can
+loop over all entries. It's enough to just compare current position
+pointer with the end of buffer address.
+Secondly buffer is guaranteed to be \0 ended, so we don't need strnchr.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Hante Meuleman <meuleman@broadcom.com>
+Cc: Ian Kent <raven@themaw.net>
+Patchwork: https://patchwork.linux-mips.org/patch/10032/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -171,7 +171,7 @@ static int nvram_init(void)
+ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len)
+ {
+ 	char *var, *value, *end, *eq;
+-	int data_left, err;
++	int err;
+ 
+ 	if (!name)
+ 		return -EINVAL;
+@@ -184,19 +184,16 @@ int bcm47xx_nvram_getenv(const char *nam
+ 
+ 	/* Look for name=value and return value */
+ 	var = &nvram_buf[sizeof(struct nvram_header)];
+-	end = nvram_buf + sizeof(nvram_buf) - 2;
+-	end[0] = '\0';
+-	end[1] = '\0';
+-	for (; *var; var = value + strlen(value) + 1) {
+-		data_left = end - var;
+-
+-		eq = strnchr(var, data_left, '=');
++	end = nvram_buf + sizeof(nvram_buf);
++	while (var < end && *var) {
++		eq = strchr(var, '=');
+ 		if (!eq)
+ 			break;
+ 		value = eq + 1;
+ 		if (eq - var == strlen(name) &&
+ 		    strncmp(var, name, eq - var) == 0)
+ 			return snprintf(val, val_len, "%s", value);
++		var = value + strlen(value) + 1;
+ 	}
+ 	return -ENOENT;
+ }
diff --git a/target/linux/brcm47xx/patches-3.18/032-03-MIPS-BCM47xx-Extract-all-boardflags-to-new-u32-field.patch b/target/linux/brcm47xx/patches-3.18/032-03-MIPS-BCM47xx-Extract-all-boardflags-to-new-u32-field.patch
new file mode 100644
index 0000000..7a5babc
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-03-MIPS-BCM47xx-Extract-all-boardflags-to-new-u32-field.patch
@@ -0,0 +1,35 @@
+From ecd06daee04bae00f3dfd0a3cd46f28142f18191 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 11:31:02 +0200
+Subject: [PATCH] MIPS: BCM47xx: Extract all boardflags to new u32 fields
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+For years we planned to get rid of old u16 fields, let's start doing it
+with MIPS code. This process will take some time, it requires doing the
+same in ssb/bcma and then switching all drivers to new fields. This will
+be handled in separated patches submitted to appropriate trees.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/10026/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/sprom.c | 3 +++
+ include/linux/ssb/ssb.h   | 5 ++++-
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -201,6 +201,9 @@ static void bcm47xx_sprom_fill_auto(stru
+ 	bool fb = fallback;
+ 
+ 	ENTRY(0xfffffffe, u16, pre, "boardrev", board_rev, 0, true);
++	ENTRY(0xfffffffe, u32, pre, "boardflags", boardflags, 0, fb);
++	ENTRY(0xfffffff0, u32, pre, "boardflags2", boardflags2, 0, fb);
++	ENTRY(0xfffff800, u32, pre, "boardflags3", boardflags3, 0, fb);
+ 	ENTRY(0x00000002, u16, pre, "boardflags", boardflags_lo, 0, fb);
+ 	ENTRY(0xfffffffc, u16, pre, "boardtype", board_type, 0, true);
+ 	ENTRY(0xfffffffe, u16, pre, "boardnum", board_num, 0, fb);
diff --git a/target/linux/brcm47xx/patches-3.18/032-04-MIPS-BCM47xx-Extract-info-about-et2-interface.patch b/target/linux/brcm47xx/patches-3.18/032-04-MIPS-BCM47xx-Extract-info-about-et2-interface.patch
new file mode 100644
index 0000000..957bb68
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-04-MIPS-BCM47xx-Extract-info-about-et2-interface.patch
@@ -0,0 +1,45 @@
+From c58ec43eaca5f970911770c17cb3a29ac102656d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 11:54:48 +0200
+Subject: [PATCH] MIPS: BCM47xx: Extract info about et2 interface
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+New devices may have more than 1 Ethernet core (device). We should
+extract info about them to make it available to Ethernet drivers.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Hante Meuleman <meuleman@broadcom.com>
+Cc: Ian Kent <raven@themaw.net>
+Patchwork: https://patchwork.linux-mips.org/patch/10027/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/sprom.c | 6 ++++++
+ include/linux/ssb/ssb.h   | 3 +++
+ 2 files changed, 9 insertions(+)
+
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -531,6 +531,8 @@ static int mac_addr_used = 2;
+ static void bcm47xx_fill_sprom_ethernet(struct ssb_sprom *sprom,
+ 					const char *prefix, bool fallback)
+ {
++	bool fb = fallback;
++
+ 	nvram_read_macaddr(prefix, "et0macaddr", sprom->et0mac, fallback);
+ 	nvram_read_u8(prefix, NULL, "et0mdcport", &sprom->et0mdcport, 0,
+ 		      fallback);
+@@ -543,6 +545,10 @@ static void bcm47xx_fill_sprom_ethernet(
+ 	nvram_read_u8(prefix, NULL, "et1phyaddr", &sprom->et1phyaddr, 0,
+ 		      fallback);
+ 
++	nvram_read_macaddr(prefix, "et2macaddr", sprom->et2mac, fb);
++	nvram_read_u8(prefix, NULL, "et2mdcport", &sprom->et2mdcport, 0, fb);
++	nvram_read_u8(prefix, NULL, "et2phyaddr", &sprom->et2phyaddr, 0, fb);
++
+ 	nvram_read_macaddr(prefix, "macaddr", sprom->il0mac, fallback);
+ 	nvram_read_macaddr(prefix, "il0macaddr", sprom->il0mac, fallback);
+ 
diff --git a/target/linux/brcm47xx/patches-3.18/032-05-MIPS-BCM47xx-Read-board-info-for-all-bcma-buses.patch b/target/linux/brcm47xx/patches-3.18/032-05-MIPS-BCM47xx-Read-board-info-for-all-bcma-buses.patch
new file mode 100644
index 0000000..314a6c4
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-05-MIPS-BCM47xx-Read-board-info-for-all-bcma-buses.patch
@@ -0,0 +1,132 @@
+From 12e1ab54dcd414c3579cfd26be9d9c9e1cab92ad Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 13:05:18 +0200
+Subject: [PATCH] MIPS: BCM47xx: Read board info for all bcma buses
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Extra bcma buses may be totally different models, see following dump:
+boardtype=0x0646
+pci/1/1/boardtype=0x0545
+pci/2/1/boardtype=0x62b
+We need to detect them properly to allow drivers apply some board
+specific hacks.
+
+[ralf@linux-mips.org: folded in Rafal's fix.]
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/10028/
+Patchwork: https://patchwork.linux-mips.org/patch/10048/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/setup.c                    |  3 --
+ arch/mips/bcm47xx/sprom.c                    | 44 ++++++++++++++--------------
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx.h |  4 ---
+ 3 files changed, 22 insertions(+), 29 deletions(-)
+
+--- a/arch/mips/bcm47xx/setup.c
++++ b/arch/mips/bcm47xx/setup.c
+@@ -206,9 +206,6 @@ void __init bcm47xx_bus_setup(void)
+ 		err = bcma_host_soc_init(&bcm47xx_bus.bcma);
+ 		if (err)
+ 			panic("Failed to initialize BCMA bus (err %d)", err);
+-
+-		bcm47xx_fill_bcma_boardinfo(&bcm47xx_bus.bcma.bus.boardinfo,
+-					    NULL);
+ 	}
+ #endif
+ 
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -640,19 +640,6 @@ void bcm47xx_fill_ssb_boardinfo(struct s
+ }
+ #endif
+ 
+-#ifdef CONFIG_BCM47XX_BCMA
+-void bcm47xx_fill_bcma_boardinfo(struct bcma_boardinfo *boardinfo,
+-				 const char *prefix)
+-{
+-	nvram_read_u16(prefix, NULL, "boardvendor", &boardinfo->vendor, 0,
+-		       true);
+-	if (!boardinfo->vendor)
+-		boardinfo->vendor = SSB_BOARDVENDOR_BCM;
+-
+-	nvram_read_u16(prefix, NULL, "boardtype", &boardinfo->type, 0, true);
+-}
+-#endif
+-
+ #if defined(CONFIG_BCM47XX_SSB)
+ static int bcm47xx_get_sprom_ssb(struct ssb_bus *bus, struct ssb_sprom *out)
+ {
+@@ -707,33 +694,46 @@ static void bcm47xx_sprom_apply_prefix_a
+ 
+ static int bcm47xx_get_sprom_bcma(struct bcma_bus *bus, struct ssb_sprom *out)
+ {
+-	char prefix[10];
++	struct bcma_boardinfo *binfo = &bus->boardinfo;
+ 	struct bcma_device *core;
++	char buf[10];
++	char *prefix;
++	bool fallback = false;
+ 
+ 	switch (bus->hosttype) {
+ 	case BCMA_HOSTTYPE_PCI:
+ 		memset(out, 0, sizeof(struct ssb_sprom));
+-		snprintf(prefix, sizeof(prefix), "pci/%u/%u/",
++		snprintf(buf, sizeof(buf), "pci/%u/%u/",
+ 			 bus->host_pci->bus->number + 1,
+ 			 PCI_SLOT(bus->host_pci->devfn));
+-		bcm47xx_sprom_apply_prefix_alias(prefix, sizeof(prefix));
+-		bcm47xx_fill_sprom(out, prefix, false);
+-		return 0;
++		bcm47xx_sprom_apply_prefix_alias(buf, sizeof(buf));
++		prefix = buf;
++		break;
+ 	case BCMA_HOSTTYPE_SOC:
+ 		memset(out, 0, sizeof(struct ssb_sprom));
+ 		core = bcma_find_core(bus, BCMA_CORE_80211);
+ 		if (core) {
+-			snprintf(prefix, sizeof(prefix), "sb/%u/",
++			snprintf(buf, sizeof(buf), "sb/%u/",
+ 				 core->core_index);
+-			bcm47xx_fill_sprom(out, prefix, true);
++			prefix = buf;
++			fallback = true;
+ 		} else {
+-			bcm47xx_fill_sprom(out, NULL, false);
++			prefix = NULL;
+ 		}
+-		return 0;
++		break;
+ 	default:
+ 		pr_warn("Unable to fill SPROM for given bustype.\n");
+ 		return -EINVAL;
+ 	}
++
++	nvram_read_u16(prefix, NULL, "boardvendor", &binfo->vendor, 0, true);
++	if (!binfo->vendor)
++		binfo->vendor = SSB_BOARDVENDOR_BCM;
++	nvram_read_u16(prefix, NULL, "boardtype", &binfo->type, 0, true);
++
++	bcm47xx_fill_sprom(out, prefix, fallback);
++
++	return 0;
+ }
+ #endif
+ 
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx.h
+@@ -52,10 +52,6 @@ void bcm47xx_fill_sprom(struct ssb_sprom
+ void bcm47xx_fill_ssb_boardinfo(struct ssb_boardinfo *boardinfo,
+ 				const char *prefix);
+ #endif
+-#ifdef CONFIG_BCM47XX_BCMA
+-void bcm47xx_fill_bcma_boardinfo(struct bcma_boardinfo *boardinfo,
+-				 const char *prefix);
+-#endif
+ 
+ void bcm47xx_set_system_type(u16 chip_id);
+ 
diff --git a/target/linux/brcm47xx/patches-3.18/032-06-MIPS-BCM77xx-Remove-legacy-__cpuinit-data-sections-t.patch b/target/linux/brcm47xx/patches-3.18/032-06-MIPS-BCM77xx-Remove-legacy-__cpuinit-data-sections-t.patch
new file mode 100644
index 0000000..38b95d2
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-06-MIPS-BCM77xx-Remove-legacy-__cpuinit-data-sections-t.patch
@@ -0,0 +1,60 @@
+From 50d68dfef385127a1da2957813272c610c691157 Mon Sep 17 00:00:00 2001
+From: Paul Gortmaker <paul.gortmaker@windriver.com>
+Date: Mon, 27 Apr 2015 18:47:56 -0400
+Subject: [PATCH] MIPS: BCM77xx: Remove legacy __cpuinit{,data} sections that
+ crept in
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We removed __cpuinit support (leaving no-op stubs) quite some time ago.
+However a few more crept in as of commit 6ee1d93455384cef8a0426effe85da2
+("MIPS: BCM47XX: Detect more then 128 MiB of RAM (HIGHMEM)")
+
+Since we want to clobber the stubs soon, get this removed now.
+
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+Cc: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Patchwork: https://patchwork.linux-mips.org/patch/9892/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/prom.c           | 2 +-
+ arch/mips/include/asm/pgtable-32.h | 2 +-
+ arch/mips/mm/tlb-r4k.c             | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/mips/bcm47xx/prom.c
++++ b/arch/mips/bcm47xx/prom.c
+@@ -126,7 +126,7 @@ void __init prom_free_prom_memory(void)
+ /* Stripped version of tlb_init, with the call to build_tlb_refill_handler
+  * dropped. Calling it at this stage causes a hang.
+  */
+-void __cpuinit early_tlb_init(void)
++void early_tlb_init(void)
+ {
+ 	write_c0_pagemask(PM_DEFAULT_MASK);
+ 	write_c0_wired(0);
+--- a/arch/mips/include/asm/pgtable-32.h
++++ b/arch/mips/include/asm/pgtable-32.h
+@@ -18,7 +18,7 @@
+ 
+ #include <asm-generic/pgtable-nopmd.h>
+ 
+-extern int temp_tlb_entry __cpuinitdata;
++extern int temp_tlb_entry;
+ 
+ /*
+  * - add_temporary_entry() add a temporary TLB entry. We use TLB entries
+--- a/arch/mips/mm/tlb-r4k.c
++++ b/arch/mips/mm/tlb-r4k.c
+@@ -411,7 +411,7 @@ int __init has_transparent_hugepage(void
+  * lifetime of the system
+  */
+ 
+-int temp_tlb_entry __cpuinitdata;
++int temp_tlb_entry;
+ 
+ __init int add_temporary_entry(unsigned long entrylo0, unsigned long entrylo1,
+ 			       unsigned long entryhi, unsigned long pagemask)
diff --git a/target/linux/brcm47xx/patches-3.18/032-07-MIPS-BCM47XX-Support-Luxul-XWR-1750-board.patch b/target/linux/brcm47xx/patches-3.18/032-07-MIPS-BCM47XX-Support-Luxul-XWR-1750-board.patch
new file mode 100644
index 0000000..73f0662
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-07-MIPS-BCM47XX-Support-Luxul-XWR-1750-board.patch
@@ -0,0 +1,100 @@
+From 981de3c2f27af27fa4c5c952d122b35ee573ab7a Mon Sep 17 00:00:00 2001
+From: Dan Haab <dhaab@luxul.com>
+Date: Wed, 22 Apr 2015 13:58:33 -0600
+Subject: [PATCH] MIPS: BCM47XX: Support Luxul XWR-1750 board
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Dan Haab <dhaab@luxul.com>
+Acked-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Dan Haab <dhaab@luxul.com>
+Patchwork: https://patchwork.linux-mips.org/patch/9831/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/board.c                          |  1 +
+ arch/mips/bcm47xx/buttons.c                        | 11 +++++++++++
+ arch/mips/bcm47xx/leds.c                           | 14 ++++++++++++++
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h |  2 ++
+ 4 files changed, 28 insertions(+)
+
+--- a/arch/mips/bcm47xx/board.c
++++ b/arch/mips/bcm47xx/board.c
+@@ -149,6 +149,7 @@ struct bcm47xx_board_type_list2 bcm47xx_
+ /* board_id */
+ static const
+ struct bcm47xx_board_type_list1 bcm47xx_board_list_board_id[] __initconst = {
++	{{BCM47XX_BOARD_LUXUL_XWR_1750_V1, "Luxul XWR-1750 V1"}, "luxul_xwr1750_v1"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614V8, "Netgear WGR614 V8"}, "U12H072T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614V9, "Netgear WGR614 V9"}, "U12H094T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614_V10, "Netgear WGR614 V10"}, "U12H139T01_NETGEAR"},
+--- a/arch/mips/bcm47xx/buttons.c
++++ b/arch/mips/bcm47xx/buttons.c
+@@ -299,6 +299,13 @@ bcm47xx_buttons_linksys_wrtsl54gs[] __in
+ 	BCM47XX_GPIO_KEY(6, KEY_RESTART),
+ };
+ 
++/* Luxul */
++
++static const struct gpio_keys_button
++bcm47xx_buttons_luxul_xwr_1750_v1[] = {
++	BCM47XX_GPIO_KEY(14, BTN_TASK),
++};
++
+ /* Microsoft */
+ 
+ static const struct gpio_keys_button
+@@ -555,6 +562,10 @@ int __init bcm47xx_buttons_register(void
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrtsl54gs);
+ 		break;
+ 
++	case BCM47XX_BOARD_LUXUL_XWR_1750_V1:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_luxul_xwr_1750_v1);
++		break;
++
+ 	case BCM47XX_BOARD_MICROSOFT_MN700:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_microsoft_nm700);
+ 		break;
+--- a/arch/mips/bcm47xx/leds.c
++++ b/arch/mips/bcm47xx/leds.c
+@@ -370,6 +370,16 @@ bcm47xx_leds_linksys_wrtsl54gs[] __initc
+ 	BCM47XX_GPIO_LED(7, "orange", "wps", 1, LEDS_GPIO_DEFSTATE_OFF),
+ };
+ 
++/* Luxul */
++
++static const struct gpio_led
++bcm47xx_leds_luxul_xwr_1750_v1[] __initconst = {
++	BCM47XX_GPIO_LED(5, "green", "5ghz", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(12, "green", "usb", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED_TRIGGER(13, "green", "status", 0, "timer"),
++	BCM47XX_GPIO_LED(15, "green", "wps", 0, LEDS_GPIO_DEFSTATE_OFF),
++};
++
+ /* Microsoft */
+ 
+ static const struct gpio_led
+@@ -623,6 +633,10 @@ void __init bcm47xx_leds_register(void)
+ 		bcm47xx_set_pdata(bcm47xx_leds_linksys_wrtsl54gs);
+ 		break;
+ 
++	case BCM47XX_BOARD_LUXUL_XWR_1750_V1:
++		bcm47xx_set_pdata(bcm47xx_leds_luxul_xwr_1750_v1);
++		break;
++
+ 	case BCM47XX_BOARD_MICROSOFT_MN700:
+ 		bcm47xx_set_pdata(bcm47xx_leds_microsoft_nm700);
+ 		break;
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
+@@ -80,6 +80,8 @@ enum bcm47xx_board {
+ 	BCM47XX_BOARD_LINKSYS_WRT610NV2,
+ 	BCM47XX_BOARD_LINKSYS_WRTSL54GS,
+ 
++	BCM47XX_BOARD_LUXUL_XWR_1750_V1,
++
+ 	BCM47XX_BOARD_MICROSOFT_MN700,
+ 
+ 	BCM47XX_BOARD_MOTOROLA_WE800G,
diff --git a/target/linux/brcm47xx/patches-3.18/032-08-mips-bcm47xx-allow-retrieval-of-complete-nvram-conte.patch b/target/linux/brcm47xx/patches-3.18/032-08-mips-bcm47xx-allow-retrieval-of-complete-nvram-conte.patch
new file mode 100644
index 0000000..105c651
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-08-mips-bcm47xx-allow-retrieval-of-complete-nvram-conte.patch
@@ -0,0 +1,157 @@
+From 2536295c2aeafc769215a6b2883126fa94c90b9a Mon Sep 17 00:00:00 2001
+From: Hante Meuleman <meuleman@broadcom.com>
+Date: Thu, 21 May 2015 15:27:23 +0200
+Subject: [PATCH] mips: bcm47xx: allow retrieval of complete nvram contents
+
+Host platforms such as routers supported by OpenWrt can
+support NVRAM reading directly from internal NVRAM store.
+The brcmfmac for one requires the complete nvram contents
+to select what needs to be sent to wireless device.
+
+Signed-off-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
+Reviewed-by: Arend Van Spriel <arend@broadcom.com>
+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
+Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/10093/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c     | 60 ++++++++++++++++++++++++++++++++-----------
+ include/linux/bcm47xx_nvram.h | 15 +++++++++++
+ 2 files changed, 60 insertions(+), 15 deletions(-)
+
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -94,17 +94,22 @@ static int nvram_find_and_copy(void __io
+ 	return -ENXIO;
+ 
+ found:
+-	if (header->len > size)
+-		pr_err("The nvram size accoridng to the header seems to be bigger than the partition on flash\n");
+-	if (header->len > NVRAM_SPACE)
+-		pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+-		       header->len, NVRAM_SPACE - 1);
+-
+ 	src = (u32 *)header;
+ 	dst = (u32 *)nvram_buf;
+ 	for (i = 0; i < sizeof(struct nvram_header); i += 4)
+ 		*dst++ = __raw_readl(src++);
+-	for (; i < header->len && i < NVRAM_SPACE && i < size; i += 4)
++	header = (struct nvram_header *)nvram_buf;
++	if (header->len > size) {
++		pr_err("The nvram size according to the header seems to be bigger than the partition on flash\n");
++		header->len = size;
++	}
++	if (header->len >= NVRAM_SPACE) {
++		pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
++		       header->len, NVRAM_SPACE - 1);
++		header->len = NVRAM_SPACE - 1;
++	}
++	/* proceed reading data after header */
++	for (; i < header->len; i += 4)
+ 		*dst++ = readl(src++);
+ 	nvram_buf[NVRAM_SPACE - 1] = '\0';
+ 
+@@ -139,6 +144,7 @@ static int nvram_init(void)
+ #ifdef CONFIG_MTD
+ 	struct mtd_info *mtd;
+ 	struct nvram_header header;
++	struct nvram_header *pheader;
+ 	size_t bytes_read;
+ 	int err;
+ 
+@@ -147,20 +153,21 @@ static int nvram_init(void)
+ 		return -ENODEV;
+ 
+ 	err = mtd_read(mtd, 0, sizeof(header), &bytes_read, (uint8_t *)&header);
+-	if (!err && header.magic == NVRAM_MAGIC) {
+-		u8 *dst = (uint8_t *)nvram_buf;
+-		size_t len = header.len;
+-
+-		if (len >= NVRAM_SPACE) {
+-			len = NVRAM_SPACE - 1;
++	if (!err && header.magic == NVRAM_MAGIC &&
++	    header.len > sizeof(header)) {
++		if (header.len >= NVRAM_SPACE) {
+ 			pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+-				header.len, len);
++				header.len, NVRAM_SPACE);
++			header.len = NVRAM_SPACE - 1;
+ 		}
+ 
+-		err = mtd_read(mtd, 0, len, &bytes_read, dst);
++		err = mtd_read(mtd, 0, header.len, &bytes_read,
++			       (u8 *)nvram_buf);
+ 		if (err)
+ 			return err;
+ 
++		pheader = (struct nvram_header *)nvram_buf;
++		pheader->len = header.len;
+ 		return 0;
+ 	}
+ #endif
+@@ -219,3 +226,26 @@ int bcm47xx_nvram_gpio_pin(const char *n
+ 	return -ENOENT;
+ }
+ EXPORT_SYMBOL(bcm47xx_nvram_gpio_pin);
++
++char *bcm47xx_nvram_get_contents(size_t *nvram_size)
++{
++	int err;
++	char *nvram;
++	struct nvram_header *header;
++
++	if (!nvram_buf[0]) {
++		err = nvram_init();
++		if (err)
++			return NULL;
++	}
++
++	header = (struct nvram_header *)nvram_buf;
++	*nvram_size = header->len - sizeof(struct nvram_header);
++	nvram = vmalloc(*nvram_size);
++	if (!nvram)
++		return NULL;
++	memcpy(nvram, &nvram_buf[sizeof(struct nvram_header)], *nvram_size);
++
++	return nvram;
++}
++EXPORT_SYMBOL(bcm47xx_nvram_get_contents);
+--- a/include/linux/bcm47xx_nvram.h
++++ b/include/linux/bcm47xx_nvram.h
+@@ -10,11 +10,17 @@
+ 
+ #include <linux/types.h>
+ #include <linux/kernel.h>
++#include <linux/vmalloc.h>
+ 
+ #ifdef CONFIG_BCM47XX
+ int bcm47xx_nvram_init_from_mem(u32 base, u32 lim);
+ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len);
+ int bcm47xx_nvram_gpio_pin(const char *name);
++char *bcm47xx_nvram_get_contents(size_t *val_len);
++static inline void bcm47xx_nvram_release_contents(char *nvram)
++{
++	vfree(nvram);
++};
+ #else
+ static inline int bcm47xx_nvram_init_from_mem(u32 base, u32 lim)
+ {
+@@ -29,6 +35,15 @@ static inline int bcm47xx_nvram_gpio_pin
+ {
+ 	return -ENOTSUPP;
+ };
++
++static inline char *bcm47xx_nvram_get_contents(size_t *val_len)
++{
++	return NULL;
++};
++
++static inline void bcm47xx_nvram_release_contents(char *nvram)
++{
++};
+ #endif
+ 
+ #endif /* __BCM47XX_NVRAM_H */
diff --git a/target/linux/brcm47xx/patches-3.18/032-09-MIPS-BCM47xx-Add-helper-variable-for-storing-NVRAM-l.patch b/target/linux/brcm47xx/patches-3.18/032-09-MIPS-BCM47xx-Add-helper-variable-for-storing-NVRAM-l.patch
new file mode 100644
index 0000000..053144a
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-09-MIPS-BCM47xx-Add-helper-variable-for-storing-NVRAM-l.patch
@@ -0,0 +1,131 @@
+From f229d75f1472c4cd30f464e4a0f94f410046bd80 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Sat, 6 Jun 2015 23:16:23 +0200
+Subject: [PATCH] MIPS: BCM47xx: Add helper variable for storing NVRAM length
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This simplifies code just a bit (also maybe makes it a bit more
+intuitive?) and will allow us to stop storing header. Right now we copy
+whole NVRAM including its header to the internal buffer. It is not
+needed to store a header as we don't access all these details like CRC,
+flags, etc. The next improvement that should follow is copying only the
+real contents.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: linux-mips@linux-mips.org
+Cc: Arend van Spriel <arend@broadcom.com>
+Cc: Hante Meuleman <meuleman@broadcom.com>
+Patchwork: https://patchwork.linux-mips.org/patch/10535/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 37 ++++++++++++++++---------------------
+ 1 file changed, 16 insertions(+), 21 deletions(-)
+
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -35,6 +35,7 @@ struct nvram_header {
+ };
+ 
+ static char nvram_buf[NVRAM_SPACE];
++static size_t nvram_len;
+ static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
+ 
+ static u32 find_nvram_size(void __iomem *end)
+@@ -60,7 +61,7 @@ static int nvram_find_and_copy(void __io
+ 	u32 *src, *dst;
+ 	u32 size;
+ 
+-	if (nvram_buf[0]) {
++	if (nvram_len) {
+ 		pr_warn("nvram already initialized\n");
+ 		return -EEXIST;
+ 	}
+@@ -99,17 +100,18 @@ found:
+ 	for (i = 0; i < sizeof(struct nvram_header); i += 4)
+ 		*dst++ = __raw_readl(src++);
+ 	header = (struct nvram_header *)nvram_buf;
+-	if (header->len > size) {
++	nvram_len = header->len;
++	if (nvram_len > size) {
+ 		pr_err("The nvram size according to the header seems to be bigger than the partition on flash\n");
+-		header->len = size;
++		nvram_len = size;
+ 	}
+-	if (header->len >= NVRAM_SPACE) {
++	if (nvram_len >= NVRAM_SPACE) {
+ 		pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+ 		       header->len, NVRAM_SPACE - 1);
+-		header->len = NVRAM_SPACE - 1;
++		nvram_len = NVRAM_SPACE - 1;
+ 	}
+ 	/* proceed reading data after header */
+-	for (; i < header->len; i += 4)
++	for (; i < nvram_len; i += 4)
+ 		*dst++ = readl(src++);
+ 	nvram_buf[NVRAM_SPACE - 1] = '\0';
+ 
+@@ -144,7 +146,6 @@ static int nvram_init(void)
+ #ifdef CONFIG_MTD
+ 	struct mtd_info *mtd;
+ 	struct nvram_header header;
+-	struct nvram_header *pheader;
+ 	size_t bytes_read;
+ 	int err;
+ 
+@@ -155,20 +156,16 @@ static int nvram_init(void)
+ 	err = mtd_read(mtd, 0, sizeof(header), &bytes_read, (uint8_t *)&header);
+ 	if (!err && header.magic == NVRAM_MAGIC &&
+ 	    header.len > sizeof(header)) {
+-		if (header.len >= NVRAM_SPACE) {
++		nvram_len = header.len;
++		if (nvram_len >= NVRAM_SPACE) {
+ 			pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+ 				header.len, NVRAM_SPACE);
+-			header.len = NVRAM_SPACE - 1;
++			nvram_len = NVRAM_SPACE - 1;
+ 		}
+ 
+-		err = mtd_read(mtd, 0, header.len, &bytes_read,
++		err = mtd_read(mtd, 0, nvram_len, &nvram_len,
+ 			       (u8 *)nvram_buf);
+-		if (err)
+-			return err;
+-
+-		pheader = (struct nvram_header *)nvram_buf;
+-		pheader->len = header.len;
+-		return 0;
++		return err;
+ 	}
+ #endif
+ 
+@@ -183,7 +180,7 @@ int bcm47xx_nvram_getenv(const char *nam
+ 	if (!name)
+ 		return -EINVAL;
+ 
+-	if (!nvram_buf[0]) {
++	if (!nvram_len) {
+ 		err = nvram_init();
+ 		if (err)
+ 			return err;
+@@ -231,16 +228,14 @@ char *bcm47xx_nvram_get_contents(size_t
+ {
+ 	int err;
+ 	char *nvram;
+-	struct nvram_header *header;
+ 
+-	if (!nvram_buf[0]) {
++	if (!nvram_len) {
+ 		err = nvram_init();
+ 		if (err)
+ 			return NULL;
+ 	}
+ 
+-	header = (struct nvram_header *)nvram_buf;
+-	*nvram_size = header->len - sizeof(struct nvram_header);
++	*nvram_size = nvram_len - sizeof(struct nvram_header);
+ 	nvram = vmalloc(*nvram_size);
+ 	if (!nvram)
+ 		return NULL;
diff --git a/target/linux/brcm47xx/patches-3.18/032-10-MIPS-BCM47xx-Don-t-select-BCMA_HOST_PCI.patch b/target/linux/brcm47xx/patches-3.18/032-10-MIPS-BCM47xx-Don-t-select-BCMA_HOST_PCI.patch
new file mode 100644
index 0000000..5bcbaa5
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-10-MIPS-BCM47xx-Don-t-select-BCMA_HOST_PCI.patch
@@ -0,0 +1,30 @@
+From 5521bb0c510ed5c1881636524badfb9bc951f6ac Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Sun, 7 Jun 2015 13:26:44 +0200
+Subject: [PATCH] MIPS: BCM47xx: Don't select BCMA_HOST_PCI
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+SoC may have non-Broadcom PCI device attached or one may want to use
+totally different PCI driver.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/10537/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/mips/bcm47xx/Kconfig
++++ b/arch/mips/bcm47xx/Kconfig
+@@ -25,7 +25,6 @@ config BCM47XX_BCMA
+ 	select BCMA
+ 	select BCMA_HOST_SOC
+ 	select BCMA_DRIVER_MIPS
+-	select BCMA_HOST_PCI if PCI
+ 	select BCMA_DRIVER_PCI_HOSTMODE if PCI
+ 	select BCMA_DRIVER_GPIO
+ 	default y
diff --git a/target/linux/brcm47xx/patches-3.18/159-cpu_fixes.patch b/target/linux/brcm47xx/patches-3.18/159-cpu_fixes.patch
new file mode 100644
index 0000000..48cf095
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/159-cpu_fixes.patch
@@ -0,0 +1,391 @@
+--- a/arch/mips/include/asm/r4kcache.h
++++ b/arch/mips/include/asm/r4kcache.h
+@@ -22,6 +22,20 @@
+ extern void (*r4k_blast_dcache)(void);
+ extern void (*r4k_blast_icache)(void);
+ 
++#ifdef CONFIG_BCM47XX
++#include <asm/paccess.h>
++#include <linux/ssb/ssb.h>
++#define BCM4710_DUMMY_RREG() ((void) *((u8 *) KSEG1ADDR(SSB_ENUM_BASE)))
++
++#define BCM4710_FILL_TLB(addr) (*(volatile unsigned long *)(addr))
++#define BCM4710_PROTECTED_FILL_TLB(addr) ({ unsigned long x; get_dbe(x, (volatile unsigned long *)(addr)); })
++#else
++#define BCM4710_DUMMY_RREG()
++
++#define BCM4710_FILL_TLB(addr)
++#define BCM4710_PROTECTED_FILL_TLB(addr)
++#endif
++
+ /*
+  * This macro return a properly sign-extended address suitable as base address
+  * for indexed cache operations.  Two issues here:
+@@ -154,6 +168,7 @@ static inline void flush_icache_line_ind
+ static inline void flush_dcache_line_indexed(unsigned long addr)
+ {
+ 	__dflush_prologue
++	BCM4710_DUMMY_RREG();
+ 	cache_op(Index_Writeback_Inv_D, addr);
+ 	__dflush_epilogue
+ }
+@@ -181,6 +196,7 @@ static inline void flush_icache_line(uns
+ static inline void flush_dcache_line(unsigned long addr)
+ {
+ 	__dflush_prologue
++	BCM4710_DUMMY_RREG();
+ 	cache_op(Hit_Writeback_Inv_D, addr);
+ 	__dflush_epilogue
+ }
+@@ -188,6 +204,7 @@ static inline void flush_dcache_line(uns
+ static inline void invalidate_dcache_line(unsigned long addr)
+ {
+ 	__dflush_prologue
++	BCM4710_DUMMY_RREG();
+ 	cache_op(Hit_Invalidate_D, addr);
+ 	__dflush_epilogue
+ }
+@@ -243,6 +260,7 @@ static inline void protected_flush_icach
+ #ifdef CONFIG_EVA
+ 		protected_cachee_op(Hit_Invalidate_I, addr);
+ #else
++		BCM4710_DUMMY_RREG();
+ 		protected_cache_op(Hit_Invalidate_I, addr);
+ #endif
+ 		break;
+@@ -257,6 +275,7 @@ static inline void protected_flush_icach
+  */
+ static inline void protected_writeback_dcache_line(unsigned long addr)
+ {
++	BCM4710_DUMMY_RREG();
+ #ifdef CONFIG_EVA
+ 	protected_cachee_op(Hit_Writeback_Inv_D, addr);
+ #else
+@@ -466,8 +485,51 @@ static inline void invalidate_tcache_pag
+ 		: "r" (base),						\
+ 		  "i" (op));
+ 
++static inline void blast_dcache(void)
++{
++	unsigned long start = KSEG0;
++	unsigned long dcache_size = current_cpu_data.dcache.waysize * current_cpu_data.dcache.ways;
++	unsigned long end = (start + dcache_size);
++
++	do {
++		BCM4710_DUMMY_RREG();
++		cache_op(Index_Writeback_Inv_D, start);
++		start += current_cpu_data.dcache.linesz;
++	} while(start < end);
++}
++
++static inline void blast_dcache_page(unsigned long page)
++{
++	unsigned long start = page;
++	unsigned long end = start + PAGE_SIZE;
++
++	BCM4710_FILL_TLB(start);
++	do {
++		BCM4710_DUMMY_RREG();
++		cache_op(Hit_Writeback_Inv_D, start);
++		start += current_cpu_data.dcache.linesz;
++	} while(start < end);
++}
++
++static inline void blast_dcache_page_indexed(unsigned long page)
++{
++	unsigned long start = page;
++	unsigned long end = start + PAGE_SIZE;
++	unsigned long ws_inc = 1UL << current_cpu_data.dcache.waybit;
++	unsigned long ws_end = current_cpu_data.dcache.ways <<
++	                       current_cpu_data.dcache.waybit;
++	unsigned long ws, addr;
++	for (ws = 0; ws < ws_end; ws += ws_inc) {
++		start = page + ws;
++		for (addr = start; addr < end; addr += current_cpu_data.dcache.linesz) {
++			BCM4710_DUMMY_RREG();
++			cache_op(Index_Writeback_Inv_D, addr);
++		}
++	}
++}
++
+ /* build blast_xxx, blast_xxx_page, blast_xxx_page_indexed */
+-#define __BUILD_BLAST_CACHE(pfx, desc, indexop, hitop, lsize, extra)	\
++#define __BUILD_BLAST_CACHE(pfx, desc, indexop, hitop, lsize, extra, war) \
+ static inline void extra##blast_##pfx##cache##lsize(void)		\
+ {									\
+ 	unsigned long start = INDEX_BASE;				\
+@@ -479,6 +541,7 @@ static inline void extra##blast_##pfx##c
+ 									\
+ 	__##pfx##flush_prologue						\
+ 									\
++	war								\
+ 	for (ws = 0; ws < ws_end; ws += ws_inc)				\
+ 		for (addr = start; addr < end; addr += lsize * 32)	\
+ 			cache##lsize##_unroll32(addr|ws, indexop);	\
+@@ -493,6 +556,7 @@ static inline void extra##blast_##pfx##c
+ 									\
+ 	__##pfx##flush_prologue						\
+ 									\
++	war								\
+ 	do {								\
+ 		cache##lsize##_unroll32(start, hitop);			\
+ 		start += lsize * 32;					\
+@@ -511,6 +575,8 @@ static inline void extra##blast_##pfx##c
+ 			       current_cpu_data.desc.waybit;		\
+ 	unsigned long ws, addr;						\
+ 									\
++	war								\
++									\
+ 	__##pfx##flush_prologue						\
+ 									\
+ 	for (ws = 0; ws < ws_end; ws += ws_inc)				\
+@@ -520,26 +586,26 @@ static inline void extra##blast_##pfx##c
+ 	__##pfx##flush_epilogue						\
+ }
+ 
+-__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 16, )
+-__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 16, )
+-__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 16, )
+-__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 32, )
+-__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 32, )
+-__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I_Loongson2, 32, loongson2_)
+-__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 32, )
+-__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 64, )
+-__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 64, )
+-__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 64, )
+-__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 128, )
+-__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 128, )
+-__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 128, )
+-
+-__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 16, )
+-__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 32, )
+-__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 16, )
+-__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 32, )
+-__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 64, )
+-__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 128, )
++__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 16, , )
++__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 16, , BCM4710_FILL_TLB(start);)
++__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 16, , )
++__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 32, , )
++__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 32, , BCM4710_FILL_TLB(start);)
++__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I_Loongson2, 32, loongson2_, BCM4710_FILL_TLB(start);)
++__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 32, , )
++__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 64, , )
++__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 64, , BCM4710_FILL_TLB(start);)
++__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 64, , )
++__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 128, , )
++__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 128, , )
++__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 128, , )
++
++__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 16, , )
++__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 32, , )
++__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 16, , )
++__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 32, , )
++__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 64, , )
++__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 128, , )
+ 
+ #define __BUILD_BLAST_USER_CACHE(pfx, desc, indexop, hitop, lsize) \
+ static inline void blast_##pfx##cache##lsize##_user_page(unsigned long page) \
+@@ -568,17 +634,19 @@ __BUILD_BLAST_USER_CACHE(d, dcache, Inde
+ __BUILD_BLAST_USER_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 64)
+ 
+ /* build blast_xxx_range, protected_blast_xxx_range */
+-#define __BUILD_BLAST_CACHE_RANGE(pfx, desc, hitop, prot, extra)	\
++#define __BUILD_BLAST_CACHE_RANGE(pfx, desc, hitop, prot, extra, war, war2)	\
+ static inline void prot##extra##blast_##pfx##cache##_range(unsigned long start, \
+ 						    unsigned long end)	\
+ {									\
+ 	unsigned long lsize = cpu_##desc##_line_size();			\
+ 	unsigned long addr = start & ~(lsize - 1);			\
+ 	unsigned long aend = (end - 1) & ~(lsize - 1);			\
++	war								\
+ 									\
+ 	__##pfx##flush_prologue						\
+ 									\
+ 	while (1) {							\
++		war2							\
+ 		prot##cache_op(hitop, addr);				\
+ 		if (addr == aend)					\
+ 			break;						\
+@@ -590,8 +658,8 @@ static inline void prot##extra##blast_##
+ 
+ #ifndef CONFIG_EVA
+ 
+-__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, protected_, )
+-__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I, protected_, )
++__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, protected_, , BCM4710_PROTECTED_FILL_TLB(addr); BCM4710_PROTECTED_FILL_TLB(aend);, BCM4710_DUMMY_RREG();)
++__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I, protected_, , , )
+ 
+ #else
+ 
+@@ -628,14 +696,14 @@ __BUILD_PROT_BLAST_CACHE_RANGE(d, dcache
+ __BUILD_PROT_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I)
+ 
+ #endif
+-__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, protected_, )
++__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, protected_, , , )
+ __BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I_Loongson2, \
+-	protected_, loongson2_)
+-__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, , )
+-__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I, , )
+-__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, , )
++	protected_, loongson2_, , )
++__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, , , BCM4710_FILL_TLB(addr); BCM4710_FILL_TLB(aend);, BCM4710_DUMMY_RREG();)
++__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I, , , , )
++__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, , , , )
+ /* blast_inv_dcache_range */
+-__BUILD_BLAST_CACHE_RANGE(inv_d, dcache, Hit_Invalidate_D, , )
+-__BUILD_BLAST_CACHE_RANGE(inv_s, scache, Hit_Invalidate_SD, , )
++__BUILD_BLAST_CACHE_RANGE(inv_d, dcache, Hit_Invalidate_D, , , , BCM4710_DUMMY_RREG();)
++__BUILD_BLAST_CACHE_RANGE(inv_s, scache, Hit_Invalidate_SD, , , , )
+ 
+ #endif /* _ASM_R4KCACHE_H */
+--- a/arch/mips/include/asm/stackframe.h
++++ b/arch/mips/include/asm/stackframe.h
+@@ -358,6 +358,10 @@
+ 		.macro	RESTORE_SP_AND_RET
+ 		LONG_L	sp, PT_R29(sp)
+ 		.set	arch=r4000
++#ifdef CONFIG_BCM47XX
++		nop
++		nop
++#endif
+ 		eret
+ 		.set	mips0
+ 		.endm
+--- a/arch/mips/kernel/genex.S
++++ b/arch/mips/kernel/genex.S
+@@ -32,6 +32,10 @@
+ NESTED(except_vec3_generic, 0, sp)
+ 	.set	push
+ 	.set	noat
++#ifdef CONFIG_BCM47XX
++	nop
++	nop
++#endif
+ #if R5432_CP0_INTERRUPT_WAR
+ 	mfc0	k0, CP0_INDEX
+ #endif
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -38,6 +38,9 @@
+ #include <asm/traps.h>
+ #include <asm/dma-coherence.h>
+ 
++/* For enabling BCM4710 cache workarounds */
++int bcm4710 = 0;
++
+ /*
+  * Special Variant of smp_call_function for use by cache functions:
+  *
+@@ -149,6 +152,9 @@ static void r4k_blast_dcache_user_page_s
+ {
+ 	unsigned long  dc_lsize = cpu_dcache_line_size();
+ 
++	if (bcm4710)
++		r4k_blast_dcache_page = blast_dcache_page;
++	else
+ 	if (dc_lsize == 0)
+ 		r4k_blast_dcache_user_page = (void *)cache_noop;
+ 	else if (dc_lsize == 16)
+@@ -167,6 +173,9 @@ static void r4k_blast_dcache_page_indexe
+ {
+ 	unsigned long dc_lsize = cpu_dcache_line_size();
+ 
++	if (bcm4710)
++		r4k_blast_dcache_page_indexed = blast_dcache_page_indexed;
++	else
+ 	if (dc_lsize == 0)
+ 		r4k_blast_dcache_page_indexed = (void *)cache_noop;
+ 	else if (dc_lsize == 16)
+@@ -186,6 +195,9 @@ static void r4k_blast_dcache_setup(void)
+ {
+ 	unsigned long dc_lsize = cpu_dcache_line_size();
+ 
++	if (bcm4710)
++		r4k_blast_dcache = blast_dcache;
++	else
+ 	if (dc_lsize == 0)
+ 		r4k_blast_dcache = (void *)cache_noop;
+ 	else if (dc_lsize == 16)
+@@ -784,6 +796,8 @@ static void local_r4k_flush_cache_sigtra
+ 	unsigned long addr = (unsigned long) arg;
+ 
+ 	R4600_HIT_CACHEOP_WAR_IMPL;
++	BCM4710_PROTECTED_FILL_TLB(addr);
++	BCM4710_PROTECTED_FILL_TLB(addr + 4);
+ 	if (dc_lsize)
+ 		protected_writeback_dcache_line(addr & ~(dc_lsize - 1));
+ 	if (!cpu_icache_snoops_remote_store && scache_size)
+@@ -1566,6 +1580,17 @@ static void coherency_setup(void)
+ 	 * silly idea of putting something else there ...
+ 	 */
+ 	switch (current_cpu_type()) {
++	case CPU_BMIPS3300:
++		{
++			u32 cm;
++			cm = read_c0_diag();
++			/* Enable icache */
++			cm |= (1 << 31);
++			/* Enable dcache */
++			cm |= (1 << 30);
++			write_c0_diag(cm);
++		}
++		break;
+ 	case CPU_R4000PC:
+ 	case CPU_R4000SC:
+ 	case CPU_R4000MC:
+@@ -1612,6 +1637,15 @@ void r4k_cache_init(void)
+ 	extern void build_copy_page(void);
+ 	struct cpuinfo_mips *c = &current_cpu_data;
+ 
++	/* Check if special workarounds are required */
++#ifdef CONFIG_BCM47XX
++	if (current_cpu_data.cputype == CPU_BMIPS32 && (current_cpu_data.processor_id & 0xff) == 0) {
++		printk("Enabling BCM4710A0 cache workarounds.\n");
++		bcm4710 = 1;
++	} else
++#endif
++		bcm4710 = 0;
++
+ 	probe_pcache();
+ 	setup_scache();
+ 
+@@ -1681,7 +1715,15 @@ void r4k_cache_init(void)
+ 	 */
+ 	local_r4k___flush_cache_all(NULL);
+ 
++#ifdef CONFIG_BCM47XX
++	{
++		static void (*_coherency_setup)(void);
++		_coherency_setup = (void (*)(void)) KSEG1ADDR(coherency_setup);
++		_coherency_setup();
++	}
++#else
+ 	coherency_setup();
++#endif
+ 	board_cache_error_setup = r4k_cache_error_setup;
+ }
+ 
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -1285,6 +1285,9 @@ static void build_r4000_tlb_refill_handl
+ 			/* No need for uasm_i_nop */
+ 		}
+ 
++#ifdef CONFIG_BCM47XX
++		uasm_i_nop(&p);
++#endif
+ #ifdef CONFIG_64BIT
+ 		build_get_pmde64(&p, &l, &r, K0, K1); /* get pmd in K1 */
+ #else
+@@ -1847,6 +1850,9 @@ build_r4000_tlbchange_handler_head(u32 *
+ {
+ 	struct work_registers wr = build_get_work_registers(p);
+ 
++#ifdef CONFIG_BCM47XX
++	uasm_i_nop(p);
++#endif
+ #ifdef CONFIG_64BIT
+ 	build_get_pmde64(p, l, r, wr.r1, wr.r2); /* get pmd in ptr */
+ #else
diff --git a/target/linux/brcm47xx/patches-3.18/160-kmap_coherent.patch b/target/linux/brcm47xx/patches-3.18/160-kmap_coherent.patch
new file mode 100644
index 0000000..9241386
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/160-kmap_coherent.patch
@@ -0,0 +1,70 @@
+--- a/arch/mips/include/asm/cpu-features.h
++++ b/arch/mips/include/asm/cpu-features.h
+@@ -151,6 +151,9 @@
+ #ifndef cpu_has_local_ebase
+ #define cpu_has_local_ebase	1
+ #endif
++#ifndef cpu_use_kmap_coherent
++#define cpu_use_kmap_coherent 1
++#endif
+ 
+ /*
+  * I-Cache snoops remote store.	 This only matters on SMP.  Some multiprocessors
+--- a/arch/mips/include/asm/mach-bcm47xx/cpu-feature-overrides.h
++++ b/arch/mips/include/asm/mach-bcm47xx/cpu-feature-overrides.h
+@@ -79,4 +79,6 @@
+ #define cpu_scache_line_size()		0
+ #define cpu_has_vz			0
+ 
++#define cpu_use_kmap_coherent		0
++
+ #endif /* __ASM_MACH_BCM47XX_CPU_FEATURE_OVERRIDES_H */
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -591,7 +591,7 @@ static inline void local_r4k_flush_cache
+ 		 */
+ 		map_coherent = (cpu_has_dc_aliases &&
+ 				page_mapped(page) && !Page_dcache_dirty(page));
+-		if (map_coherent)
++		if (map_coherent && cpu_use_kmap_coherent)
+ 			vaddr = kmap_coherent(page, addr);
+ 		else
+ 			vaddr = kmap_atomic(page);
+@@ -616,7 +616,7 @@ static inline void local_r4k_flush_cache
+ 	}
+ 
+ 	if (vaddr) {
+-		if (map_coherent)
++		if (map_coherent && cpu_use_kmap_coherent)
+ 			kunmap_coherent();
+ 		else
+ 			kunmap_atomic(vaddr);
+--- a/arch/mips/mm/init.c
++++ b/arch/mips/mm/init.c
+@@ -155,7 +155,7 @@ void copy_user_highpage(struct page *to,
+ 	void *vfrom, *vto;
+ 
+ 	vto = kmap_atomic(to);
+-	if (cpu_has_dc_aliases &&
++	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
+ 	    page_mapped(from) && !Page_dcache_dirty(from)) {
+ 		vfrom = kmap_coherent(from, vaddr);
+ 		copy_page(vto, vfrom);
+@@ -177,7 +177,7 @@ void copy_to_user_page(struct vm_area_st
+ 	struct page *page, unsigned long vaddr, void *dst, const void *src,
+ 	unsigned long len)
+ {
+-	if (cpu_has_dc_aliases &&
++	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
+ 	    page_mapped(page) && !Page_dcache_dirty(page)) {
+ 		void *vto = kmap_coherent(page, vaddr) + (vaddr & ~PAGE_MASK);
+ 		memcpy(vto, src, len);
+@@ -195,7 +195,7 @@ void copy_from_user_page(struct vm_area_
+ 	struct page *page, unsigned long vaddr, void *dst, const void *src,
+ 	unsigned long len)
+ {
+-	if (cpu_has_dc_aliases &&
++	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
+ 	    page_mapped(page) && !Page_dcache_dirty(page)) {
+ 		void *vfrom = kmap_coherent(page, vaddr) + (vaddr & ~PAGE_MASK);
+ 		memcpy(dst, vfrom, len);
diff --git a/target/linux/brcm47xx/patches-3.18/209-b44-register-adm-switch.patch b/target/linux/brcm47xx/patches-3.18/209-b44-register-adm-switch.patch
new file mode 100644
index 0000000..108d79c
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/209-b44-register-adm-switch.patch
@@ -0,0 +1,122 @@
+From b36f694256f41bc71571f467646d015dda128d14 Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Sat, 9 Nov 2013 17:03:59 +0100
+Subject: [PATCH 210/210] b44: register adm switch
+
+---
+ drivers/net/ethernet/broadcom/b44.c |   57 +++++++++++++++++++++++++++++++++++
+ drivers/net/ethernet/broadcom/b44.h |    3 ++
+ 2 files changed, 60 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/b44.c
++++ b/drivers/net/ethernet/broadcom/b44.c
+@@ -31,6 +31,8 @@
+ #include <linux/ssb/ssb.h>
+ #include <linux/slab.h>
+ #include <linux/phy.h>
++#include <linux/platform_device.h>
++#include <linux/platform_data/adm6996-gpio.h>
+ 
+ #include <asm/uaccess.h>
+ #include <asm/io.h>
+@@ -2239,6 +2241,70 @@ static void b44_adjust_link(struct net_d
+ 	}
+ }
+ 
++#ifdef CONFIG_BCM47XX
++static int b44_register_adm_switch(struct b44 *bp)
++{
++	int gpio;
++	struct platform_device *pdev;
++	struct adm6996_gpio_platform_data adm_data = {0};
++	struct platform_device_info info = {0};
++
++	adm_data.model = ADM6996L;
++	gpio = bcm47xx_nvram_gpio_pin("adm_eecs");
++	if (gpio >= 0)
++		adm_data.eecs = gpio;
++	else
++		adm_data.eecs = 2;
++
++	gpio = bcm47xx_nvram_gpio_pin("adm_eesk");
++	if (gpio >= 0)
++		adm_data.eesk = gpio;
++	else
++		adm_data.eesk = 3;
++
++	gpio = bcm47xx_nvram_gpio_pin("adm_eedi");
++	if (gpio >= 0)
++		adm_data.eedi = gpio;
++	else
++		adm_data.eedi = 4;
++
++	gpio = bcm47xx_nvram_gpio_pin("adm_rc");
++	if (gpio >= 0)
++		adm_data.eerc = gpio;
++	else
++		adm_data.eerc = 5;
++
++	info.parent = bp->sdev->dev;
++	info.name = "adm6996_gpio";
++	info.id = -1;
++	info.data = &adm_data;
++	info.size_data = sizeof(adm_data);
++
++	if (!bp->adm_switch) {
++		pdev = platform_device_register_full(&info);
++		if (IS_ERR(pdev))
++			return PTR_ERR(pdev);
++
++		bp->adm_switch = pdev;
++	}
++	return 0;
++}
++static void b44_unregister_adm_switch(struct b44 *bp)
++{
++	if (bp->adm_switch)
++		platform_device_unregister(bp->adm_switch);
++}
++#else
++static int b44_register_adm_switch(struct b44 *bp)
++{
++	return 0;
++}
++static void b44_unregister_adm_switch(struct b44 *bp)
++{
++
++}
++#endif /* CONFIG_BCM47XX */
++
+ static int b44_register_phy_one(struct b44 *bp)
+ {
+ 	struct mii_bus *mii_bus;
+@@ -2282,6 +2348,9 @@ static int b44_register_phy_one(struct b
+ 	if (!bp->mii_bus->phy_map[bp->phy_addr] &&
+ 	    (sprom->boardflags_lo & (B44_BOARDFLAG_ROBO | B44_BOARDFLAG_ADM))) {
+ 
++		if (sprom->boardflags_lo & B44_BOARDFLAG_ADM)
++			b44_register_adm_switch(bp);
++
+ 		dev_info(sdev->dev,
+ 			 "could not find PHY at %i, use fixed one\n",
+ 			 bp->phy_addr);
+@@ -2476,6 +2545,7 @@ static void b44_remove_one(struct ssb_de
+ 	unregister_netdev(dev);
+ 	if (bp->flags & B44_FLAG_EXTERNAL_PHY)
+ 		b44_unregister_phy_one(bp);
++	b44_unregister_adm_switch(bp);
+ 	ssb_device_disable(sdev, 0);
+ 	ssb_bus_may_powerdown(sdev->bus);
+ 	free_netdev(dev);
+--- a/drivers/net/ethernet/broadcom/b44.h
++++ b/drivers/net/ethernet/broadcom/b44.h
+@@ -404,6 +404,9 @@ struct b44 {
+ 	struct mii_bus		*mii_bus;
+ 	int			old_link;
+ 	struct mii_if_info	mii_if;
++
++	/* platform device for associated switch */
++	struct platform_device *adm_switch;
+ };
+ 
+ #endif /* _B44_H */
diff --git a/target/linux/brcm47xx/patches-3.18/210-b44_phy_fix.patch b/target/linux/brcm47xx/patches-3.18/210-b44_phy_fix.patch
new file mode 100644
index 0000000..86bbfaa
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/210-b44_phy_fix.patch
@@ -0,0 +1,54 @@
+--- a/drivers/net/ethernet/broadcom/b44.c
++++ b/drivers/net/ethernet/broadcom/b44.c
+@@ -431,10 +431,34 @@ static void b44_wap54g10_workaround(stru
+ error:
+ 	pr_warn("PHY: cannot reset MII transceiver isolate bit\n");
+ }
++
++static void b44_bcm47xx_workarounds(struct b44 *bp)
++{
++	char buf[20];
++	struct ssb_device *sdev = bp->sdev;
++
++	/* Toshiba WRC-1000, Siemens SE505 v1, Askey RT-210W, RT-220W */
++	if (sdev->bus->sprom.board_num == 100) {
++		bp->phy_addr = B44_PHY_ADDR_NO_LOCAL_PHY;
++	} else {
++		/* WL-HDD */
++		if (bcm47xx_nvram_getenv("hardware_version", buf, sizeof(buf)) >= 0 &&
++		    !strncmp(buf, "WL300-", strlen("WL300-"))) {
++			if (sdev->bus->sprom.et0phyaddr == 0 &&
++			    sdev->bus->sprom.et1phyaddr == 1)
++				bp->phy_addr = B44_PHY_ADDR_NO_LOCAL_PHY;
++		}
++	}
++	return;
++}
+ #else
+ static inline void b44_wap54g10_workaround(struct b44 *bp)
+ {
+ }
++
++static inline void b44_bcm47xx_workarounds(struct b44 *bp)
++{
++}
+ #endif
+ 
+ static int b44_setup_phy(struct b44 *bp)
+@@ -443,6 +467,7 @@ static int b44_setup_phy(struct b44 *bp)
+ 	int err;
+ 
+ 	b44_wap54g10_workaround(bp);
++	b44_bcm47xx_workarounds(bp);
+ 
+ 	if (bp->flags & B44_FLAG_EXTERNAL_PHY)
+ 		return 0;
+@@ -2169,6 +2194,8 @@ static int b44_get_invariants(struct b44
+ 	 * valid PHY address. */
+ 	bp->phy_addr &= 0x1F;
+ 
++	b44_bcm47xx_workarounds(bp);
++
+ 	memcpy(bp->dev->dev_addr, addr, ETH_ALEN);
+ 
+ 	if (!is_valid_ether_addr(&bp->dev->dev_addr[0])){
diff --git a/target/linux/brcm47xx/patches-3.18/280-activate_ssb_support_in_usb.patch b/target/linux/brcm47xx/patches-3.18/280-activate_ssb_support_in_usb.patch
new file mode 100644
index 0000000..33fefdd
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/280-activate_ssb_support_in_usb.patch
@@ -0,0 +1,25 @@
+This prevents the options from being delete with make kernel_oldconfig.
+---
+ drivers/ssb/Kconfig |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/bcma/Kconfig
++++ b/drivers/bcma/Kconfig
+@@ -33,6 +33,7 @@ config BCMA_HOST_PCI
+ config BCMA_HOST_SOC
+ 	bool "Support for BCMA in a SoC"
+ 	depends on BCMA
++	select USB_HCD_BCMA if USB_EHCI_HCD || USB_OHCI_HCD
+ 	help
+ 	  Host interface for a Broadcom AIX bus directly mapped into
+ 	  the memory. This only works with the Broadcom SoCs from the
+--- a/drivers/ssb/Kconfig
++++ b/drivers/ssb/Kconfig
+@@ -147,6 +147,7 @@ config SSB_SFLASH
+ config SSB_EMBEDDED
+ 	bool
+ 	depends on SSB_DRIVER_MIPS && SSB_PCICORE_HOSTMODE
++	select USB_HCD_SSB if USB_EHCI_HCD || USB_OHCI_HCD
+ 	default y
+ 
+ config SSB_DRIVER_EXTIF
diff --git a/target/linux/brcm47xx/patches-3.18/300-fork_cacheflush.patch b/target/linux/brcm47xx/patches-3.18/300-fork_cacheflush.patch
new file mode 100644
index 0000000..686fb1b
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/300-fork_cacheflush.patch
@@ -0,0 +1,11 @@
+--- a/arch/mips/include/asm/cacheflush.h
++++ b/arch/mips/include/asm/cacheflush.h
+@@ -32,7 +32,7 @@
+ extern void (*flush_cache_all)(void);
+ extern void (*__flush_cache_all)(void);
+ extern void (*flush_cache_mm)(struct mm_struct *mm);
+-#define flush_cache_dup_mm(mm)	do { (void) (mm); } while (0)
++#define flush_cache_dup_mm(mm) flush_cache_mm(mm)
+ extern void (*flush_cache_range)(struct vm_area_struct *vma,
+ 	unsigned long start, unsigned long end);
+ extern void (*flush_cache_page)(struct vm_area_struct *vma, unsigned long page, unsigned long pfn);
diff --git a/target/linux/brcm47xx/patches-3.18/310-no_highpage.patch b/target/linux/brcm47xx/patches-3.18/310-no_highpage.patch
new file mode 100644
index 0000000..41542a0
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/310-no_highpage.patch
@@ -0,0 +1,66 @@
+--- a/arch/mips/include/asm/page.h
++++ b/arch/mips/include/asm/page.h
+@@ -71,6 +71,7 @@ static inline unsigned int page_size_ftl
+ #endif /* CONFIG_MIPS_HUGE_TLB_SUPPORT */
+ 
+ #include <linux/pfn.h>
++#include <asm/cpu-features.h>
+ 
+ extern void build_clear_page(void);
+ extern void build_copy_page(void);
+@@ -105,13 +106,16 @@ static inline void clear_user_page(void
+ 		flush_data_cache_page((unsigned long)addr);
+ }
+ 
+-extern void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
+-	struct page *to);
+-struct vm_area_struct;
+-extern void copy_user_highpage(struct page *to, struct page *from,
+-	unsigned long vaddr, struct vm_area_struct *vma);
++static inline void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
++	struct page *to)
++{
++	extern void (*flush_data_cache_page)(unsigned long addr);
+ 
+-#define __HAVE_ARCH_COPY_USER_HIGHPAGE
++	copy_page(vto, vfrom);
++	if (!cpu_has_ic_fills_f_dc ||
++	    pages_do_alias((unsigned long)vto, vaddr & PAGE_MASK))
++		flush_data_cache_page((unsigned long)vto);
++}
+ 
+ /*
+  * These are used to make use of C type-checking..
+--- a/arch/mips/mm/init.c
++++ b/arch/mips/mm/init.c
+@@ -149,30 +149,6 @@ void kunmap_coherent(void)
+ 	pagefault_enable();
+ }
+ 
+-void copy_user_highpage(struct page *to, struct page *from,
+-	unsigned long vaddr, struct vm_area_struct *vma)
+-{
+-	void *vfrom, *vto;
+-
+-	vto = kmap_atomic(to);
+-	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
+-	    page_mapped(from) && !Page_dcache_dirty(from)) {
+-		vfrom = kmap_coherent(from, vaddr);
+-		copy_page(vto, vfrom);
+-		kunmap_coherent();
+-	} else {
+-		vfrom = kmap_atomic(from);
+-		copy_page(vto, vfrom);
+-		kunmap_atomic(vfrom);
+-	}
+-	if ((!cpu_has_ic_fills_f_dc) ||
+-	    pages_do_alias((unsigned long)vto, vaddr & PAGE_MASK))
+-		flush_data_cache_page((unsigned long)vto);
+-	kunmap_atomic(vto);
+-	/* Make sure this page is cleared on other CPU's too before using it */
+-	smp_wmb();
+-}
+-
+ void copy_to_user_page(struct vm_area_struct *vma,
+ 	struct page *page, unsigned long vaddr, void *dst, const void *src,
+ 	unsigned long len)
diff --git a/target/linux/brcm47xx/patches-3.18/320-MIPS-BCM47XX-Devices-database-update-for-4.x.patch b/target/linux/brcm47xx/patches-3.18/320-MIPS-BCM47XX-Devices-database-update-for-4.x.patch
new file mode 100644
index 0000000..affa569
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/320-MIPS-BCM47XX-Devices-database-update-for-4.x.patch
@@ -0,0 +1,166 @@
+--- a/arch/mips/bcm47xx/board.c
++++ b/arch/mips/bcm47xx/board.c
+@@ -140,6 +140,7 @@ struct bcm47xx_board_type_list2 bcm47xx_
+ 	{{BCM47XX_BOARD_LINKSYS_WRT300NV11, "Linksys WRT300N V1.1"}, "WRT300N", "1.1"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRT310NV1, "Linksys WRT310N V1"}, "WRT310N", "1.0"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRT310NV2, "Linksys WRT310N V2"}, "WRT310N", "2.0"},
++	{{BCM47XX_BOARD_LINKSYS_WRT320N_V1, "Linksys WRT320N V1"}, "WRT320N", "1.0"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRT54G3GV2, "Linksys WRT54G3GV2-VF"}, "WRT54G3GV2-VF", "1.0"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRT610NV1, "Linksys WRT610N V1"}, "WRT610N", "1.0"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRT610NV2, "Linksys WRT610N V2"}, "WRT610N", "2.0"},
+@@ -162,6 +163,7 @@ struct bcm47xx_board_type_list1 bcm47xx_
+ 	{{BCM47XX_BOARD_NETGEAR_WNDR4000, "Netgear WNDR4000"}, "U12H181T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNDR4500V1, "Netgear WNDR4500 V1"}, "U12H189T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNDR4500V2, "Netgear WNDR4500 V2"}, "U12H224T00_NETGEAR"},
++	{{BCM47XX_BOARD_NETGEAR_WNR1000_V3, "Netgear WNR1000 V3"}, "U12H139T50_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNR2000, "Netgear WNR2000"}, "U12H114T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNR3500L, "Netgear WNR3500L"}, "U12H136T99_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNR3500U, "Netgear WNR3500U"}, "U12H136T00_NETGEAR"},
+--- a/arch/mips/bcm47xx/buttons.c
++++ b/arch/mips/bcm47xx/buttons.c
+@@ -20,6 +20,12 @@
+ /* Asus */
+ 
+ static const struct gpio_keys_button
++bcm47xx_buttons_asus_rtn10u[] __initconst = {
++	BCM47XX_GPIO_KEY(20, KEY_WPS_BUTTON),
++	BCM47XX_GPIO_KEY(21, KEY_RESTART),
++};
++
++static const struct gpio_keys_button
+ bcm47xx_buttons_asus_rtn12[] __initconst = {
+ 	BCM47XX_GPIO_KEY(0, KEY_WPS_BUTTON),
+ 	BCM47XX_GPIO_KEY(1, KEY_RESTART),
+@@ -270,6 +276,18 @@ bcm47xx_buttons_linksys_wrt310nv1[] __in
+ };
+ 
+ static const struct gpio_keys_button
++bcm47xx_buttons_linksys_wrt310n_v2[] __initconst = {
++	BCM47XX_GPIO_KEY(5, KEY_WPS_BUTTON),
++	BCM47XX_GPIO_KEY(6, KEY_RESTART),
++};
++
++static const struct gpio_keys_button
++bcm47xx_buttons_linksys_wrt320n_v1[] __initconst = {
++	BCM47XX_GPIO_KEY(5, KEY_WPS_BUTTON),
++	BCM47XX_GPIO_KEY(8, KEY_RESTART),
++};
++
++static const struct gpio_keys_button
+ bcm47xx_buttons_linksys_wrt54g3gv2[] __initconst = {
+ 	BCM47XX_GPIO_KEY(5, KEY_WIMAX),
+ 	BCM47XX_GPIO_KEY(6, KEY_RESTART),
+@@ -360,6 +378,11 @@ bcm47xx_buttons_netgear_wndr4500v1[] __i
+ };
+ 
+ static const struct gpio_keys_button
++bcm47xx_buttons_netgear_wnr1000_v3[] __initconst = {
++	BCM47XX_GPIO_KEY(3, KEY_RESTART),
++};
++
++static const struct gpio_keys_button
+ bcm47xx_buttons_netgear_wnr3500lv1[] __initconst = {
+ 	BCM47XX_GPIO_KEY(4, KEY_RESTART),
+ 	BCM47XX_GPIO_KEY(6, KEY_WPS_BUTTON),
+@@ -414,6 +437,9 @@ int __init bcm47xx_buttons_register(void
+ 	int err;
+ 
+ 	switch (board) {
++	case BCM47XX_BOARD_ASUS_RTN10U:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_rtn10u);
++		break;
+ 	case BCM47XX_BOARD_ASUS_RTN12:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_rtn12);
+ 		break;
+@@ -544,6 +570,12 @@ int __init bcm47xx_buttons_register(void
+ 	case BCM47XX_BOARD_LINKSYS_WRT310NV1:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt310nv1);
+ 		break;
++	case BCM47XX_BOARD_LINKSYS_WRT310NV2:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt310n_v2);
++		break;
++	case BCM47XX_BOARD_LINKSYS_WRT320N_V1:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt320n_v1);
++		break;
+ 	case BCM47XX_BOARD_LINKSYS_WRT54G3GV2:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt54g3gv2);
+ 		break;
+@@ -592,6 +624,9 @@ int __init bcm47xx_buttons_register(void
+ 	case BCM47XX_BOARD_NETGEAR_WNDR4500V1:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wndr4500v1);
+ 		break;
++	case BCM47XX_BOARD_NETGEAR_WNR1000_V3:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wnr1000_v3);
++		break;
+ 	case BCM47XX_BOARD_NETGEAR_WNR3500L:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wnr3500lv1);
+ 		break;
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
+@@ -71,6 +71,7 @@ enum bcm47xx_board {
+ 	BCM47XX_BOARD_LINKSYS_WRT300NV11,
+ 	BCM47XX_BOARD_LINKSYS_WRT310NV1,
+ 	BCM47XX_BOARD_LINKSYS_WRT310NV2,
++	BCM47XX_BOARD_LINKSYS_WRT320N_V1,
+ 	BCM47XX_BOARD_LINKSYS_WRT54G3GV2,
+ 	BCM47XX_BOARD_LINKSYS_WRT54G_TYPE_0101,
+ 	BCM47XX_BOARD_LINKSYS_WRT54G_TYPE_0467,
+@@ -100,6 +101,7 @@ enum bcm47xx_board {
+ 	BCM47XX_BOARD_NETGEAR_WNDR4000,
+ 	BCM47XX_BOARD_NETGEAR_WNDR4500V1,
+ 	BCM47XX_BOARD_NETGEAR_WNDR4500V2,
++	BCM47XX_BOARD_NETGEAR_WNR1000_V3,
+ 	BCM47XX_BOARD_NETGEAR_WNR2000,
+ 	BCM47XX_BOARD_NETGEAR_WNR3500L,
+ 	BCM47XX_BOARD_NETGEAR_WNR3500U,
+--- a/arch/mips/bcm47xx/leds.c
++++ b/arch/mips/bcm47xx/leds.c
+@@ -29,6 +29,14 @@
+ /* Asus */
+ 
+ static const struct gpio_led
++bcm47xx_leds_asus_rtn10u[] __initconst = {
++	BCM47XX_GPIO_LED(5, "green", "wlan", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(6, "green", "power", 1, LEDS_GPIO_DEFSTATE_ON),
++	BCM47XX_GPIO_LED(7, "green", "wps", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(8, "green", "usb", 0, LEDS_GPIO_DEFSTATE_OFF),
++};
++
++static const struct gpio_led
+ bcm47xx_leds_asus_rtn12[] __initconst = {
+ 	BCM47XX_GPIO_LED(2, "unk", "power", 1, LEDS_GPIO_DEFSTATE_ON),
+ 	BCM47XX_GPIO_LED(7, "unk", "wlan", 0, LEDS_GPIO_DEFSTATE_OFF),
+@@ -313,6 +321,13 @@ bcm47xx_leds_linksys_wrt310nv1[] __initc
+ };
+ 
+ static const struct gpio_led
++bcm47xx_leds_linksys_wrt320n_v1[] __initconst = {
++	BCM47XX_GPIO_LED(1, "blue", "wlan", 1, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(2, "blue", "power", 0, LEDS_GPIO_DEFSTATE_ON),
++	BCM47XX_GPIO_LED(4, "amber", "wps", 1, LEDS_GPIO_DEFSTATE_OFF),
++};
++
++static const struct gpio_led
+ bcm47xx_leds_linksys_wrt54g_generic[] __initconst = {
+ 	BCM47XX_GPIO_LED(0, "unk", "dmz", 1, LEDS_GPIO_DEFSTATE_OFF),
+ 	BCM47XX_GPIO_LED(1, "unk", "power", 0, LEDS_GPIO_DEFSTATE_ON),
+@@ -478,6 +493,9 @@ void __init bcm47xx_leds_register(void)
+ 	enum bcm47xx_board board = bcm47xx_board_get();
+ 
+ 	switch (board) {
++	case BCM47XX_BOARD_ASUS_RTN10U:
++		bcm47xx_set_pdata(bcm47xx_leds_asus_rtn10u);
++		break;
+ 	case BCM47XX_BOARD_ASUS_RTN12:
+ 		bcm47xx_set_pdata(bcm47xx_leds_asus_rtn12);
+ 		break;
+@@ -611,6 +629,9 @@ void __init bcm47xx_leds_register(void)
+ 	case BCM47XX_BOARD_LINKSYS_WRT310NV1:
+ 		bcm47xx_set_pdata(bcm47xx_leds_linksys_wrt310nv1);
+ 		break;
++	case BCM47XX_BOARD_LINKSYS_WRT320N_V1:
++		bcm47xx_set_pdata(bcm47xx_leds_linksys_wrt320n_v1);
++		break;
+ 	case BCM47XX_BOARD_LINKSYS_WRT54G3GV2:
+ 		bcm47xx_set_pdata(bcm47xx_leds_linksys_wrt54g3gv2);
+ 		break;
diff --git a/target/linux/brcm47xx/patches-3.18/400-mtd-bcm47xxpart-get-nvram.patch b/target/linux/brcm47xx/patches-3.18/400-mtd-bcm47xxpart-get-nvram.patch
new file mode 100644
index 0000000..df51191
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/400-mtd-bcm47xxpart-get-nvram.patch
@@ -0,0 +1,34 @@
+--- a/drivers/mtd/bcm47xxpart.c
++++ b/drivers/mtd/bcm47xxpart.c
+@@ -97,6 +97,7 @@ static int bcm47xxpart_parse(struct mtd_
+ 	int trx_part = -1;
+ 	int last_trx_part = -1;
+ 	int possible_nvram_sizes[] = { 0x8000, 0xF000, 0x10000, };
++	bool found_nvram = false;
+ 
+ 	/*
+ 	 * Some really old flashes (like AT45DB*) had smaller erasesize-s, but
+@@ -300,12 +301,23 @@ static int bcm47xxpart_parse(struct mtd_
+ 		if (buf[0] == NVRAM_HEADER) {
+ 			bcm47xxpart_add_part(&parts[curr_part++], "nvram",
+ 					     master->size - blocksize, 0);
++			found_nvram = true;
+ 			break;
+ 		}
+ 	}
+ 
+ 	kfree(buf);
+ 
++	if (!found_nvram) {
++		pr_err("can not find a nvram partition reserve last block\n");
++		bcm47xxpart_add_part(&parts[curr_part++], "nvram_guess",
++				     master->size - blocksize * 2, MTD_WRITEABLE);
++		for (i = 0; i < curr_part; i++) {
++			if (parts[i].size + parts[i].offset == master->size)
++				parts[i].offset -= blocksize * 2;
++		}
++	}
++
+ 	/*
+ 	 * Assume that partitions end at the beginning of the one they are
+ 	 * followed by.
diff --git a/target/linux/brcm47xx/patches-3.18/610-pci_ide_fix.patch b/target/linux/brcm47xx/patches-3.18/610-pci_ide_fix.patch
new file mode 100644
index 0000000..76751e8
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/610-pci_ide_fix.patch
@@ -0,0 +1,14 @@
+--- a/include/linux/ide.h
++++ b/include/linux/ide.h
+@@ -191,7 +191,11 @@ static inline void ide_std_init_ports(st
+ 	hw->io_ports.ctl_addr = ctl_addr;
+ }
+ 
++#if defined CONFIG_BCM47XX
++# define MAX_HWIFS	2
++#else
+ #define MAX_HWIFS	10
++#endif
+ 
+ /*
+  * Now for the data we need to maintain per-drive:  ide_drive_t
diff --git a/target/linux/brcm47xx/patches-3.18/791-tg3-no-pci-sleep.patch b/target/linux/brcm47xx/patches-3.18/791-tg3-no-pci-sleep.patch
new file mode 100644
index 0000000..35a816d
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/791-tg3-no-pci-sleep.patch
@@ -0,0 +1,17 @@
+When the Ethernet controller is powered down and someone wants to 
+access the mdio bus like the witch driver (b53) the system crashed if 
+PCI_D3hot was set before. This patch deactivates this power sawing mode 
+when a switch driver is in use.
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -4263,7 +4263,8 @@ static int tg3_power_down_prepare(struct
+ static void tg3_power_down(struct tg3 *tp)
+ {
+ 	pci_wake_from_d3(tp->pdev, tg3_flag(tp, WOL_ENABLE));
+-	pci_set_power_state(tp->pdev, PCI_D3hot);
++	if (!tg3_flag(tp, ROBOSWITCH))
++		pci_set_power_state(tp->pdev, PCI_D3hot);
+ }
+ 
+ static void tg3_aux_stat_to_speed_duplex(struct tg3 *tp, u32 val, u16 *speed, u8 *duplex)
diff --git a/target/linux/brcm47xx/patches-3.18/800-bcma-add-table-of-serial-flashes-with-smaller-blocks.patch b/target/linux/brcm47xx/patches-3.18/800-bcma-add-table-of-serial-flashes-with-smaller-blocks.patch
new file mode 100644
index 0000000..99d909b
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/800-bcma-add-table-of-serial-flashes-with-smaller-blocks.patch
@@ -0,0 +1,73 @@
+From 597715c61ae75a05ab3310a34ff3857a006f0f63 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Thu, 20 Nov 2014 21:32:42 +0100
+Subject: [PATCH] bcma: add table of serial flashes with smaller blocks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+---
+ drivers/bcma/driver_chipcommon_sflash.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+--- a/drivers/bcma/driver_chipcommon_sflash.c
++++ b/drivers/bcma/driver_chipcommon_sflash.c
+@@ -9,6 +9,7 @@
+ 
+ #include <linux/platform_device.h>
+ #include <linux/bcma/bcma.h>
++#include <bcm47xx_board.h>
+ 
+ static struct resource bcma_sflash_resource = {
+ 	.name	= "bcma_sflash",
+@@ -41,6 +42,13 @@ static const struct bcma_sflash_tbl_e bc
+ 	{ NULL },
+ };
+ 
++/* Some devices use smaller blocks (and have more of them) */
++static const struct bcma_sflash_tbl_e bcma_sflash_st_shrink_tbl[] = {
++	{ "M25P16", 0x14, 0x1000, 512, },
++	{ "M25P32", 0x15, 0x1000, 1024, },
++	{ NULL },
++};
++
+ static const struct bcma_sflash_tbl_e bcma_sflash_sst_tbl[] = {
+ 	{ "SST25WF512", 1, 0x1000, 16, },
+ 	{ "SST25VF512", 0x48, 0x1000, 16, },
+@@ -84,6 +92,24 @@ static void bcma_sflash_cmd(struct bcma_
+ 	bcma_err(cc->core->bus, "SFLASH control command failed (timeout)!\n");
+ }
+ 
++const struct bcma_sflash_tbl_e *bcma_sflash_shrink_flash(u32 id)
++{
++	enum bcm47xx_board board = bcm47xx_board_get();
++	const struct bcma_sflash_tbl_e *e;
++
++	switch (board) {
++	case BCM47XX_BOARD_NETGEAR_WGR614_V10:
++	case BCM47XX_BOARD_NETGEAR_WNR1000_V3:
++		for (e = bcma_sflash_st_shrink_tbl; e->name; e++) {
++			if (e->id == id)
++				return e;
++		}
++		return NULL;
++	default:
++		return NULL;
++	}
++}
++
+ /* Initialize serial flash access */
+ int bcma_sflash_init(struct bcma_drv_cc *cc)
+ {
+@@ -114,6 +140,10 @@ int bcma_sflash_init(struct bcma_drv_cc
+ 		case 0x13:
+ 			return -ENOTSUPP;
+ 		default:
++			e = bcma_sflash_shrink_flash(id);
++			if (e)
++				break;
++
+ 			for (e = bcma_sflash_st_tbl; e->name; e++) {
+ 				if (e->id == id)
+ 					break;
diff --git a/target/linux/brcm47xx/patches-3.18/820-wgt634u-nvram-fix.patch b/target/linux/brcm47xx/patches-3.18/820-wgt634u-nvram-fix.patch
new file mode 100644
index 0000000..4738c22
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/820-wgt634u-nvram-fix.patch
@@ -0,0 +1,295 @@
+The Netgear wgt634u uses a different format for storing the 
+configuration. This patch is needed to read out the correct 
+configuration. The cfe_env.c file uses a different method way to read 
+out the configuration than the in kernel cfe config reader.
+
+--- a/arch/mips/bcm47xx/Makefile
++++ b/arch/mips/bcm47xx/Makefile
+@@ -5,3 +5,4 @@
+ 
+ obj-y				+= irq.o nvram.o prom.o serial.o setup.o time.o sprom.o
+ obj-y				+= board.o buttons.o leds.o workarounds.o
++obj-y				+= cfe_env.o
+--- /dev/null
++++ b/arch/mips/bcm47xx/cfe_env.c
+@@ -0,0 +1,228 @@
++/*
++ * CFE environment variable access
++ *
++ * Copyright 2001-2003, Broadcom Corporation
++ * Copyright 2006, Felix Fietkau <nbd@openwrt.org>
++ * 
++ * This program is free software; you can redistribute  it and/or modify it
++ * under  the terms of  the GNU General  Public License as published by the
++ * Free Software Foundation;  either version 2 of the  License, or (at your
++ * option) any later version.
++ */
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/string.h>
++#include <asm/io.h>
++#include <asm/uaccess.h>
++
++#define NVRAM_SIZE       (0x1ff0)
++static char _nvdata[NVRAM_SIZE];
++static char _valuestr[256];
++
++/*
++ * TLV types.  These codes are used in the "type-length-value"
++ * encoding of the items stored in the NVRAM device (flash or EEPROM)
++ *
++ * The layout of the flash/nvram is as follows:
++ *
++ * <type> <length> <data ...> <type> <length> <data ...> <type_end>
++ *
++ * The type code of "ENV_TLV_TYPE_END" marks the end of the list.
++ * The "length" field marks the length of the data section, not
++ * including the type and length fields.
++ *
++ * Environment variables are stored as follows:
++ *
++ * <type_env> <length> <flags> <name> = <value>
++ *
++ * If bit 0 (low bit) is set, the length is an 8-bit value.
++ * If bit 0 (low bit) is clear, the length is a 16-bit value
++ * 
++ * Bit 7 set indicates "user" TLVs.  In this case, bit 0 still
++ * indicates the size of the length field.  
++ *
++ * Flags are from the constants below:
++ *
++ */
++#define ENV_LENGTH_16BITS	0x00	/* for low bit */
++#define ENV_LENGTH_8BITS	0x01
++
++#define ENV_TYPE_USER		0x80
++
++#define ENV_CODE_SYS(n,l) (((n)<<1)|(l))
++#define ENV_CODE_USER(n,l) ((((n)<<1)|(l)) | ENV_TYPE_USER)
++
++/*
++ * The actual TLV types we support
++ */
++
++#define ENV_TLV_TYPE_END	0x00	
++#define ENV_TLV_TYPE_ENV	ENV_CODE_SYS(0,ENV_LENGTH_8BITS)
++
++/*
++ * Environment variable flags 
++ */
++
++#define ENV_FLG_NORMAL		0x00	/* normal read/write */
++#define ENV_FLG_BUILTIN		0x01	/* builtin - not stored in flash */
++#define ENV_FLG_READONLY	0x02	/* read-only - cannot be changed */
++
++#define ENV_FLG_MASK		0xFF	/* mask of attributes we keep */
++#define ENV_FLG_ADMIN		0x100	/* lets us internally override permissions */
++
++
++/*  *********************************************************************
++    *  _nvram_read(buffer,offset,length)
++    *  
++    *  Read data from the NVRAM device
++    *  
++    *  Input parameters: 
++    *  	   buffer - destination buffer
++    *  	   offset - offset of data to read
++    *  	   length - number of bytes to read
++    *  	   
++    *  Return value:
++    *  	   number of bytes read, or <0 if error occured
++    ********************************************************************* */
++static int
++_nvram_read(unsigned char *nv_buf, unsigned char *buffer, int offset, int length)
++{
++    int i;
++    if (offset > NVRAM_SIZE)
++	return -1; 
++
++    for ( i = 0; i < length; i++) {
++	buffer[i] = ((volatile unsigned char*)nv_buf)[offset + i];
++    }
++    return length;
++}
++
++
++static char*
++_strnchr(const char *dest,int c,size_t cnt)
++{
++	while (*dest && (cnt > 0)) {
++	if (*dest == c) return (char *) dest;
++	dest++;
++	cnt--;
++	}
++	return NULL;
++}
++
++
++
++/*
++ * Core support API: Externally visible.
++ */
++
++/*
++ * Get the value of an NVRAM variable
++ * @param	name	name of variable to get
++ * @return	value of variable or NULL if undefined
++ */
++
++char *cfe_env_get(unsigned char *nv_buf, const char *name)
++{
++    int size;
++    unsigned char *buffer;
++    unsigned char *ptr;
++    unsigned char *envval;
++    unsigned int reclen;
++    unsigned int rectype;
++    int offset;
++    int flg;
++    
++	if (!strcmp(name, "nvram_type"))
++		return "cfe";
++	
++    size = NVRAM_SIZE;
++    buffer = &_nvdata[0];
++
++    ptr = buffer;
++    offset = 0;
++
++    /* Read the record type and length */
++    if (_nvram_read(nv_buf, ptr,offset,1) != 1) {
++	goto error;
++    }
++    
++    while ((*ptr != ENV_TLV_TYPE_END)  && (size > 1)) {
++
++	/* Adjust pointer for TLV type */
++	rectype = *(ptr);
++	offset++;
++	size--;
++
++	/* 
++	 * Read the length.  It can be either 1 or 2 bytes
++	 * depending on the code 
++	 */
++	if (rectype & ENV_LENGTH_8BITS) {
++	    /* Read the record type and length - 8 bits */
++	    if (_nvram_read(nv_buf, ptr,offset,1) != 1) {
++		goto error;
++	    }
++	    reclen = *(ptr);
++	    size--;
++	    offset++;
++	}
++	else {
++	    /* Read the record type and length - 16 bits, MSB first */
++	    if (_nvram_read(nv_buf, ptr,offset,2) != 2) {
++		goto error;
++	    }
++	    reclen = (((unsigned int) *(ptr)) << 8) + (unsigned int) *(ptr+1);
++	    size -= 2;
++	    offset += 2;
++	}
++
++	if (reclen > size)
++	    break;	/* should not happen, bad NVRAM */
++
++	switch (rectype) {
++	    case ENV_TLV_TYPE_ENV:
++		/* Read the TLV data */
++		if (_nvram_read(nv_buf, ptr,offset,reclen) != reclen)
++		    goto error;
++		flg = *ptr++;
++		envval = (unsigned char *) _strnchr(ptr,'=',(reclen-1));
++		if (envval) {
++		    *envval++ = '\0';
++		    memcpy(_valuestr,envval,(reclen-1)-(envval-ptr));
++		    _valuestr[(reclen-1)-(envval-ptr)] = '\0';
++#if 0			
++		    printk(KERN_INFO "NVRAM:%s=%s\n", ptr, _valuestr);
++#endif
++		    if(!strcmp(ptr, name)){
++			return _valuestr;
++		    }
++		    if((strlen(ptr) > 1) && !strcmp(&ptr[1], name))
++			return _valuestr;
++		}
++		break;
++		
++	    default: 
++		/* Unknown TLV type, skip it. */
++		break;
++	    }
++
++	/*
++	 * Advance to next TLV 
++	 */
++		
++	size -= (int)reclen;
++	offset += reclen;
++
++	/* Read the next record type */
++	ptr = buffer;
++	if (_nvram_read(nv_buf, ptr,offset,1) != 1)
++	    goto error;
++	}
++
++error:
++    return NULL;
++
++}
++
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -37,6 +37,8 @@ struct nvram_header {
+ static char nvram_buf[NVRAM_SPACE];
+ static size_t nvram_len;
+ static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
++static int cfe_env;
++extern char *cfe_env_get(char *nv_buf, const char *name);
+ 
+ static u32 find_nvram_size(void __iomem *end)
+ {
+@@ -66,6 +68,26 @@ static int nvram_find_and_copy(void __io
+ 		return -EEXIST;
+ 	}
+ 
++	cfe_env = 0;
++
++	/* XXX: hack for supporting the CFE environment stuff on WGT634U */
++	if (lim >= 8 * 1024 * 1024) {
++		src = (u32 *)(iobase + 8 * 1024 * 1024 - 0x2000);
++		dst = (u32 *)nvram_buf;
++
++		if ((*src & 0xff00ff) == 0x000001) {
++			printk("early_nvram_init: WGT634U NVRAM found.\n");
++
++			for (i = 0; i < 0x1ff0; i++) {
++				if (*src == 0xFFFFFFFF)
++					break;
++				*dst++ = *src++;
++			}
++			cfe_env = 1;
++			return 0;
++		}
++	}
++
+ 	/* TODO: when nvram is on nand flash check for bad blocks first. */
+ 	off = FLASH_MIN;
+ 	while (off <= lim) {
+@@ -180,6 +202,13 @@ int bcm47xx_nvram_getenv(const char *nam
+ 	if (!name)
+ 		return -EINVAL;
+ 
++	if (cfe_env) {
++		value = cfe_env_get(nvram_buf, name);
++		if (!value)
++			return -ENOENT;
++		return snprintf(val, val_len, "%s", value);
++	}
++
+ 	if (!nvram_len) {
+ 		err = nvram_init();
+ 		if (err)
diff --git a/target/linux/brcm47xx/patches-3.18/830-huawei_e970_support.patch b/target/linux/brcm47xx/patches-3.18/830-huawei_e970_support.patch
new file mode 100644
index 0000000..fdb6c19
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/830-huawei_e970_support.patch
@@ -0,0 +1,101 @@
+--- a/arch/mips/bcm47xx/setup.c
++++ b/arch/mips/bcm47xx/setup.c
+@@ -36,6 +36,7 @@
+ #include <linux/ssb/ssb.h>
+ #include <linux/ssb/ssb_embedded.h>
+ #include <linux/bcma/bcma_soc.h>
++#include <linux/old_gpio_wdt.h>
+ #include <asm/bootinfo.h>
+ #include <asm/idle.h>
+ #include <asm/prom.h>
+@@ -245,6 +246,33 @@ static struct fixed_phy_status bcm47xx_f
+ 	.duplex	= DUPLEX_FULL,
+ };
+ 
++static struct gpio_wdt_platform_data gpio_wdt_data;
++
++static struct platform_device gpio_wdt_device = {
++	.name			= "gpio-wdt",
++	.id			= 0,
++	.dev			= {
++		.platform_data	= &gpio_wdt_data,
++	},
++};
++
++static int __init bcm47xx_register_gpio_watchdog(void)
++{
++	enum bcm47xx_board board = bcm47xx_board_get();
++
++	switch (board) {
++	case BCM47XX_BOARD_HUAWEI_E970:
++		pr_info("bcm47xx: detected Huawei E970 or similar, starting early gpio_wdt timer\n");
++		gpio_wdt_data.gpio = 7;
++		gpio_wdt_data.interval = HZ;
++		gpio_wdt_data.first_interval = HZ / 5;
++		return platform_device_register(&gpio_wdt_device);
++	default:
++		/* Nothing to do */
++		return 0;
++	}
++}
++
+ static int __init bcm47xx_register_bus_complete(void)
+ {
+ 	switch (bcm47xx_bus_type) {
+@@ -264,6 +292,7 @@ static int __init bcm47xx_register_bus_c
+ 	bcm47xx_workarounds();
+ 
+ 	fixed_phy_add(PHY_POLL, 0, &bcm47xx_fixed_phy_status);
++	bcm47xx_register_gpio_watchdog();
+ 	return 0;
+ }
+ device_initcall(bcm47xx_register_bus_complete);
+--- a/arch/mips/configs/bcm47xx_defconfig
++++ b/arch/mips/configs/bcm47xx_defconfig
+@@ -67,6 +67,7 @@ CONFIG_HW_RANDOM=y
+ CONFIG_GPIO_SYSFS=y
+ CONFIG_WATCHDOG=y
+ CONFIG_BCM47XX_WDT=y
++CONFIG_GPIO_WDT=y
+ CONFIG_SSB_DEBUG=y
+ CONFIG_SSB_DRIVER_GIGE=y
+ CONFIG_BCMA_DRIVER_GMAC_CMN=y
+--- a/drivers/ssb/embedded.c
++++ b/drivers/ssb/embedded.c
+@@ -34,11 +34,36 @@ int ssb_watchdog_timer_set(struct ssb_bu
+ }
+ EXPORT_SYMBOL(ssb_watchdog_timer_set);
+ 
++#ifdef CONFIG_BCM47XX
++#include <bcm47xx_board.h>
++
++static bool ssb_watchdog_supported(void)
++{
++	enum bcm47xx_board board = bcm47xx_board_get();
++
++	/* The Huawei E970 has a hardware watchdog using a GPIO */
++	switch (board) {
++	case BCM47XX_BOARD_HUAWEI_E970:
++		return false;
++	default:
++		return true;
++	}
++}
++#else
++static bool ssb_watchdog_supported(void)
++{
++	return true;
++}
++#endif
++
+ int ssb_watchdog_register(struct ssb_bus *bus)
+ {
+ 	struct bcm47xx_wdt wdt = {};
+ 	struct platform_device *pdev;
+ 
++	if (!ssb_watchdog_supported())
++		return 0;
++
+ 	if (ssb_chipco_available(&bus->chipco)) {
+ 		wdt.driver_data = &bus->chipco;
+ 		wdt.timer_set = ssb_chipco_watchdog_timer_set_wdt;
diff --git a/target/linux/brcm47xx/patches-3.18/900-ssb-reject-PCI-writes-setting-CardBus-bridge-resourc.patch b/target/linux/brcm47xx/patches-3.18/900-ssb-reject-PCI-writes-setting-CardBus-bridge-resourc.patch
new file mode 100644
index 0000000..d7d2d7e
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/900-ssb-reject-PCI-writes-setting-CardBus-bridge-resourc.patch
@@ -0,0 +1,30 @@
+From 5c81397a0147ea59c778d1de14ef54e2268221f6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Wed, 8 Apr 2015 06:58:11 +0200
+Subject: [PATCH] ssb: reject PCI writes setting CardBus bridge resources
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+If SoC has a CardBus we can set resources of device at slot 1 only. It's
+impossigle to set bridge resources as it simply overwrites device 1
+configuration and usually results in Data bus error-s.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+---
+ drivers/ssb/driver_pcicore.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/ssb/driver_pcicore.c
++++ b/drivers/ssb/driver_pcicore.c
+@@ -164,6 +164,10 @@ static int ssb_extpci_write_config(struc
+ 	SSB_WARN_ON(!pc->hostmode);
+ 	if (unlikely(len != 1 && len != 2 && len != 4))
+ 		goto out;
++	/* CardBus SoCs allow configuring dev 1 resources only */
++	if (extpci_core->cardbusmode && dev != 1 &&
++	    off >= PCI_BASE_ADDRESS_0 && off <= PCI_BASE_ADDRESS_5)
++		goto out;
+ 	addr = get_cfgspace_addr(pc, bus, dev, func, off);
+ 	if (unlikely(!addr))
+ 		goto out;
diff --git a/target/linux/brcm47xx/patches-3.18/920-cache-wround.patch b/target/linux/brcm47xx/patches-3.18/920-cache-wround.patch
new file mode 100644
index 0000000..4045d91
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/920-cache-wround.patch
@@ -0,0 +1,138 @@
+--- a/arch/mips/include/asm/r4kcache.h
++++ b/arch/mips/include/asm/r4kcache.h
+@@ -25,10 +25,28 @@ extern void (*r4k_blast_icache)(void);
+ #ifdef CONFIG_BCM47XX
+ #include <asm/paccess.h>
+ #include <linux/ssb/ssb.h>
+-#define BCM4710_DUMMY_RREG() ((void) *((u8 *) KSEG1ADDR(SSB_ENUM_BASE)))
++#define BCM4710_DUMMY_RREG() bcm4710_dummy_rreg()
++
++static inline unsigned long bcm4710_dummy_rreg(void)
++{
++      return *(volatile unsigned long *)(KSEG1ADDR(SSB_ENUM_BASE));
++}
++
++#define BCM4710_FILL_TLB(addr) bcm4710_fill_tlb((void *)(addr))
++
++static inline unsigned long bcm4710_fill_tlb(void *addr)
++{
++      return *(unsigned long *)addr;
++}
++
++#define BCM4710_PROTECTED_FILL_TLB(addr) bcm4710_protected_fill_tlb((void *)(addr))
++
++static inline void bcm4710_protected_fill_tlb(void *addr)
++{
++      unsigned long x;
++      get_dbe(x, (unsigned long *)addr);;
++}
+ 
+-#define BCM4710_FILL_TLB(addr) (*(volatile unsigned long *)(addr))
+-#define BCM4710_PROTECTED_FILL_TLB(addr) ({ unsigned long x; get_dbe(x, (volatile unsigned long *)(addr)); })
+ #else
+ #define BCM4710_DUMMY_RREG()
+ 
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -940,6 +940,9 @@ build_get_pgde32(u32 **p, unsigned int t
+ 		uasm_i_srl(p, ptr, ptr, SMP_CPUID_PTRSHIFT);
+ 		uasm_i_addu(p, ptr, tmp, ptr);
+ #else
++#ifdef CONFIG_BCM47XX
++		uasm_i_nop(p);
++#endif
+ 		UASM_i_LA_mostly(p, ptr, pgdc);
+ #endif
+ 		uasm_i_mfc0(p, tmp, C0_BADVADDR); /* get faulting address */
+@@ -1285,12 +1288,12 @@ static void build_r4000_tlb_refill_handl
+ 			/* No need for uasm_i_nop */
+ 		}
+ 
+-#ifdef CONFIG_BCM47XX
+-		uasm_i_nop(&p);
+-#endif
+ #ifdef CONFIG_64BIT
+ 		build_get_pmde64(&p, &l, &r, K0, K1); /* get pmd in K1 */
+ #else
++# ifdef CONFIG_BCM47XX
++		uasm_i_nop(&p);
++# endif
+ 		build_get_pgde32(&p, K0, K1); /* get pgd in K1 */
+ #endif
+ 
+@@ -1302,6 +1305,9 @@ static void build_r4000_tlb_refill_handl
+ 		build_update_entries(&p, K0, K1);
+ 		build_tlb_write_entry(&p, &l, &r, tlb_random);
+ 		uasm_l_leave(&l, p);
++#ifdef CONFIG_BCM47XX
++		uasm_i_nop(&p);
++#endif
+ 		uasm_i_eret(&p); /* return from trap */
+ 	}
+ #ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT
+@@ -1850,12 +1856,12 @@ build_r4000_tlbchange_handler_head(u32 *
+ {
+ 	struct work_registers wr = build_get_work_registers(p);
+ 
+-#ifdef CONFIG_BCM47XX
+-	uasm_i_nop(p);
+-#endif
+ #ifdef CONFIG_64BIT
+ 	build_get_pmde64(p, l, r, wr.r1, wr.r2); /* get pmd in ptr */
+ #else
++# ifdef CONFIG_BCM47XX
++	uasm_i_nop(p);
++# endif
+ 	build_get_pgde32(p, wr.r1, wr.r2); /* get pgd in ptr */
+ #endif
+ 
+@@ -1902,6 +1908,9 @@ build_r4000_tlbchange_handler_tail(u32 *
+ 	build_tlb_write_entry(p, l, r, tlb_indexed);
+ 	uasm_l_leave(l, *p);
+ 	build_restore_work_registers(p);
++#ifdef CONFIG_BCM47XX
++	uasm_i_nop(p);
++#endif
+ 	uasm_i_eret(p); /* return from trap */
+ 
+ #ifdef CONFIG_64BIT
+--- a/arch/mips/kernel/genex.S
++++ b/arch/mips/kernel/genex.S
+@@ -21,6 +21,19 @@
+ #include <asm/war.h>
+ #include <asm/thread_info.h>
+ 
++#ifdef CONFIG_BCM47XX
++# ifdef eret
++#  undef eret
++# endif
++# define eret 					\
++	.set push;				\
++	.set noreorder;				\
++	 nop; 					\
++	 nop;					\
++	 eret;					\
++	.set pop;
++#endif
++
+ 	__INIT
+ 
+ /*
+@@ -34,7 +47,6 @@ NESTED(except_vec3_generic, 0, sp)
+ 	.set	noat
+ #ifdef CONFIG_BCM47XX
+ 	nop
+-	nop
+ #endif
+ #if R5432_CP0_INTERRUPT_WAR
+ 	mfc0	k0, CP0_INDEX
+@@ -59,6 +71,9 @@ NESTED(except_vec3_r4000, 0, sp)
+ 	.set	push
+ 	.set	arch=r4000
+ 	.set	noat
++#ifdef CONFIG_BCM47XX
++	nop
++#endif
+ 	mfc0	k1, CP0_CAUSE
+ 	li	k0, 31<<2
+ 	andi	k1, k1, 0x7c
diff --git a/target/linux/brcm47xx/patches-3.18/940-bcm47xx-yenta.patch b/target/linux/brcm47xx/patches-3.18/940-bcm47xx-yenta.patch
new file mode 100644
index 0000000..1739ff7
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/940-bcm47xx-yenta.patch
@@ -0,0 +1,46 @@
+--- a/drivers/pcmcia/yenta_socket.c
++++ b/drivers/pcmcia/yenta_socket.c
+@@ -920,6 +920,8 @@ static unsigned int yenta_probe_irq(stru
+ 	 * Probe for usable interrupts using the force
+ 	 * register to generate bogus card status events.
+ 	 */
++#ifndef CONFIG_BCM47XX
++	/* WRT54G3G does not like this */
+ 	cb_writel(socket, CB_SOCKET_EVENT, -1);
+ 	cb_writel(socket, CB_SOCKET_MASK, CB_CSTSMASK);
+ 	reg = exca_readb(socket, I365_CSCINT);
+@@ -935,6 +937,7 @@ static unsigned int yenta_probe_irq(stru
+ 	}
+ 	cb_writel(socket, CB_SOCKET_MASK, 0);
+ 	exca_writeb(socket, I365_CSCINT, reg);
++#endif
+ 
+ 	mask = probe_irq_mask(val) & 0xffff;
+ 
+@@ -1019,6 +1022,10 @@ static void yenta_get_socket_capabilitie
+ 	else
+ 		socket->socket.irq_mask = 0;
+ 
++	/* irq mask probing is broken for the WRT54G3G */
++	if (socket->socket.irq_mask == 0)
++		socket->socket.irq_mask = 0x6f8;
++
+ 	dev_printk(KERN_INFO, &socket->dev->dev,
+ 		   "ISA IRQ mask 0x%04x, PCI irq %d\n",
+ 		   socket->socket.irq_mask, socket->cb_irq);
+@@ -1257,6 +1264,15 @@ static int yenta_probe(struct pci_dev *d
+ 	dev_printk(KERN_INFO, &dev->dev,
+ 		   "Socket status: %08x\n", cb_readl(socket, CB_SOCKET_STATE));
+ 
++	/* Generate an interrupt on card insert/remove */
++	config_writew(socket, CB_SOCKET_MASK, CB_CSTSMASK | CB_CDMASK);
++
++	/* Set up Multifunction Routing Status Register */
++	config_writew(socket, 0x8C, 0x1000 /* MFUNC3 to GPIO3 */ | 0x2 /* MFUNC0 to INTA */);
++
++	/* Switch interrupts to parallelized */
++	config_writeb(socket, 0x92, 0x64);
++
+ 	yenta_fixup_parent_bridge(dev->subordinate);
+ 
+ 	/* Register it with the pcmcia layer.. */
diff --git a/target/linux/brcm47xx/patches-3.18/976-ssb_increase_pci_delay.patch b/target/linux/brcm47xx/patches-3.18/976-ssb_increase_pci_delay.patch
new file mode 100644
index 0000000..90bda51
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/976-ssb_increase_pci_delay.patch
@@ -0,0 +1,11 @@
+--- a/drivers/ssb/driver_pcicore.c
++++ b/drivers/ssb/driver_pcicore.c
+@@ -389,7 +389,7 @@ static void ssb_pcicore_init_hostmode(st
+ 	set_io_port_base(ssb_pcicore_controller.io_map_base);
+ 	/* Give some time to the PCI controller to configure itself with the new
+ 	 * values. Not waiting at this point causes crashes of the machine. */
+-	mdelay(10);
++	mdelay(300);
+ 	register_pci_controller(&ssb_pcicore_controller);
+ }
+ 
diff --git a/target/linux/brcm47xx/patches-3.18/999-wl_exports.patch b/target/linux/brcm47xx/patches-3.18/999-wl_exports.patch
new file mode 100644
index 0000000..be14a09
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/999-wl_exports.patch
@@ -0,0 +1,22 @@
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -34,7 +34,8 @@ struct nvram_header {
+ 	u32 config_ncdl;	/* ncdl values for memc */
+ };
+ 
+-static char nvram_buf[NVRAM_SPACE];
++char nvram_buf[NVRAM_SPACE];
++EXPORT_SYMBOL(nvram_buf);
+ static size_t nvram_len;
+ static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
+ static int cfe_env;
+--- a/arch/mips/mm/cache.c
++++ b/arch/mips/mm/cache.c
+@@ -59,6 +59,7 @@ void (*_dma_cache_wback)(unsigned long s
+ void (*_dma_cache_inv)(unsigned long start, unsigned long size);
+ 
+ EXPORT_SYMBOL(_dma_cache_wback_inv);
++EXPORT_SYMBOL(_dma_cache_inv);
+ 
+ #endif /* CONFIG_DMA_NONCOHERENT || CONFIG_DMA_MAYBE_COHERENT */
+ 
diff --git a/target/linux/brcm47xx/patches-4.1/031-01-MIPS-BCM47XX-Make-sure-NVRAM-buffer-ends-with-0.patch b/target/linux/brcm47xx/patches-4.1/031-01-MIPS-BCM47XX-Make-sure-NVRAM-buffer-ends-with-0.patch
new file mode 100644
index 0000000..7577da1
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/031-01-MIPS-BCM47XX-Make-sure-NVRAM-buffer-ends-with-0.patch
@@ -0,0 +1,54 @@
+From 4ddb225376a2802a4e20e16f71c6d37b679e3169 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 18:46:11 +0200
+Subject: [PATCH] MIPS: BCM47XX: Make sure NVRAM buffer ends with \0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This will simplify reading its contents.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Hante Meuleman <meuleman@broadcom.com>
+Cc: Ian Kent <raven@themaw.net>
+Patchwork: https://patchwork.linux-mips.org/patch/10031/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -98,7 +98,7 @@ found:
+ 		pr_err("The nvram size accoridng to the header seems to be bigger than the partition on flash\n");
+ 	if (header->len > NVRAM_SPACE)
+ 		pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+-		       header->len, NVRAM_SPACE);
++		       header->len, NVRAM_SPACE - 1);
+ 
+ 	src = (u32 *)header;
+ 	dst = (u32 *)nvram_buf;
+@@ -106,6 +106,7 @@ found:
+ 		*dst++ = __raw_readl(src++);
+ 	for (; i < header->len && i < NVRAM_SPACE && i < size; i += 4)
+ 		*dst++ = readl(src++);
++	nvram_buf[NVRAM_SPACE - 1] = '\0';
+ 
+ 	return 0;
+ }
+@@ -150,10 +151,10 @@ static int nvram_init(void)
+ 		u8 *dst = (uint8_t *)nvram_buf;
+ 		size_t len = header.len;
+ 
+-		if (header.len > NVRAM_SPACE) {
++		if (len >= NVRAM_SPACE) {
++			len = NVRAM_SPACE - 1;
+ 			pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+-				header.len, NVRAM_SPACE);
+-			len = NVRAM_SPACE;
++				header.len, len);
+ 		}
+ 
+ 		err = mtd_read(mtd, 0, len, &bytes_read, dst);
diff --git a/target/linux/brcm47xx/patches-4.1/031-02-MIPS-BCM47XX-Simplify-function-looking-for-NVRAM-ent.patch b/target/linux/brcm47xx/patches-4.1/031-02-MIPS-BCM47XX-Simplify-function-looking-for-NVRAM-ent.patch
new file mode 100644
index 0000000..7a3ddc3
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/031-02-MIPS-BCM47XX-Simplify-function-looking-for-NVRAM-ent.patch
@@ -0,0 +1,59 @@
+From f6f895644230b13618f14f7108f9b23a21a87bfa Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 18:46:12 +0200
+Subject: [PATCH] MIPS: BCM47XX: Simplify function looking for NVRAM entry
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+First of all it shouldn't modify copied NVRAM just to make sure it can
+loop over all entries. It's enough to just compare current position
+pointer with the end of buffer address.
+Secondly buffer is guaranteed to be \0 ended, so we don't need strnchr.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Hante Meuleman <meuleman@broadcom.com>
+Cc: Ian Kent <raven@themaw.net>
+Patchwork: https://patchwork.linux-mips.org/patch/10032/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -171,7 +171,7 @@ static int nvram_init(void)
+ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len)
+ {
+ 	char *var, *value, *end, *eq;
+-	int data_left, err;
++	int err;
+ 
+ 	if (!name)
+ 		return -EINVAL;
+@@ -184,19 +184,16 @@ int bcm47xx_nvram_getenv(const char *nam
+ 
+ 	/* Look for name=value and return value */
+ 	var = &nvram_buf[sizeof(struct nvram_header)];
+-	end = nvram_buf + sizeof(nvram_buf) - 2;
+-	end[0] = '\0';
+-	end[1] = '\0';
+-	for (; *var; var = value + strlen(value) + 1) {
+-		data_left = end - var;
+-
+-		eq = strnchr(var, data_left, '=');
++	end = nvram_buf + sizeof(nvram_buf);
++	while (var < end && *var) {
++		eq = strchr(var, '=');
+ 		if (!eq)
+ 			break;
+ 		value = eq + 1;
+ 		if (eq - var == strlen(name) &&
+ 		    strncmp(var, name, eq - var) == 0)
+ 			return snprintf(val, val_len, "%s", value);
++		var = value + strlen(value) + 1;
+ 	}
+ 	return -ENOENT;
+ }
diff --git a/target/linux/brcm47xx/patches-4.1/031-03-MIPS-BCM47xx-Extract-all-boardflags-to-new-u32-field.patch b/target/linux/brcm47xx/patches-4.1/031-03-MIPS-BCM47xx-Extract-all-boardflags-to-new-u32-field.patch
new file mode 100644
index 0000000..7a5babc
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/031-03-MIPS-BCM47xx-Extract-all-boardflags-to-new-u32-field.patch
@@ -0,0 +1,35 @@
+From ecd06daee04bae00f3dfd0a3cd46f28142f18191 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 11:31:02 +0200
+Subject: [PATCH] MIPS: BCM47xx: Extract all boardflags to new u32 fields
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+For years we planned to get rid of old u16 fields, let's start doing it
+with MIPS code. This process will take some time, it requires doing the
+same in ssb/bcma and then switching all drivers to new fields. This will
+be handled in separated patches submitted to appropriate trees.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/10026/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/sprom.c | 3 +++
+ include/linux/ssb/ssb.h   | 5 ++++-
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -201,6 +201,9 @@ static void bcm47xx_sprom_fill_auto(stru
+ 	bool fb = fallback;
+ 
+ 	ENTRY(0xfffffffe, u16, pre, "boardrev", board_rev, 0, true);
++	ENTRY(0xfffffffe, u32, pre, "boardflags", boardflags, 0, fb);
++	ENTRY(0xfffffff0, u32, pre, "boardflags2", boardflags2, 0, fb);
++	ENTRY(0xfffff800, u32, pre, "boardflags3", boardflags3, 0, fb);
+ 	ENTRY(0x00000002, u16, pre, "boardflags", boardflags_lo, 0, fb);
+ 	ENTRY(0xfffffffc, u16, pre, "boardtype", board_type, 0, true);
+ 	ENTRY(0xfffffffe, u16, pre, "boardnum", board_num, 0, fb);
diff --git a/target/linux/brcm47xx/patches-4.1/031-04-MIPS-BCM47xx-Extract-info-about-et2-interface.patch b/target/linux/brcm47xx/patches-4.1/031-04-MIPS-BCM47xx-Extract-info-about-et2-interface.patch
new file mode 100644
index 0000000..957bb68
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/031-04-MIPS-BCM47xx-Extract-info-about-et2-interface.patch
@@ -0,0 +1,45 @@
+From c58ec43eaca5f970911770c17cb3a29ac102656d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 11:54:48 +0200
+Subject: [PATCH] MIPS: BCM47xx: Extract info about et2 interface
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+New devices may have more than 1 Ethernet core (device). We should
+extract info about them to make it available to Ethernet drivers.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Hante Meuleman <meuleman@broadcom.com>
+Cc: Ian Kent <raven@themaw.net>
+Patchwork: https://patchwork.linux-mips.org/patch/10027/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/sprom.c | 6 ++++++
+ include/linux/ssb/ssb.h   | 3 +++
+ 2 files changed, 9 insertions(+)
+
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -531,6 +531,8 @@ static int mac_addr_used = 2;
+ static void bcm47xx_fill_sprom_ethernet(struct ssb_sprom *sprom,
+ 					const char *prefix, bool fallback)
+ {
++	bool fb = fallback;
++
+ 	nvram_read_macaddr(prefix, "et0macaddr", sprom->et0mac, fallback);
+ 	nvram_read_u8(prefix, NULL, "et0mdcport", &sprom->et0mdcport, 0,
+ 		      fallback);
+@@ -543,6 +545,10 @@ static void bcm47xx_fill_sprom_ethernet(
+ 	nvram_read_u8(prefix, NULL, "et1phyaddr", &sprom->et1phyaddr, 0,
+ 		      fallback);
+ 
++	nvram_read_macaddr(prefix, "et2macaddr", sprom->et2mac, fb);
++	nvram_read_u8(prefix, NULL, "et2mdcport", &sprom->et2mdcport, 0, fb);
++	nvram_read_u8(prefix, NULL, "et2phyaddr", &sprom->et2phyaddr, 0, fb);
++
+ 	nvram_read_macaddr(prefix, "macaddr", sprom->il0mac, fallback);
+ 	nvram_read_macaddr(prefix, "il0macaddr", sprom->il0mac, fallback);
+ 
diff --git a/target/linux/brcm47xx/patches-4.1/031-05-MIPS-BCM47xx-Read-board-info-for-all-bcma-buses.patch b/target/linux/brcm47xx/patches-4.1/031-05-MIPS-BCM47xx-Read-board-info-for-all-bcma-buses.patch
new file mode 100644
index 0000000..314a6c4
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/031-05-MIPS-BCM47xx-Read-board-info-for-all-bcma-buses.patch
@@ -0,0 +1,132 @@
+From 12e1ab54dcd414c3579cfd26be9d9c9e1cab92ad Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 13:05:18 +0200
+Subject: [PATCH] MIPS: BCM47xx: Read board info for all bcma buses
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Extra bcma buses may be totally different models, see following dump:
+boardtype=0x0646
+pci/1/1/boardtype=0x0545
+pci/2/1/boardtype=0x62b
+We need to detect them properly to allow drivers apply some board
+specific hacks.
+
+[ralf@linux-mips.org: folded in Rafal's fix.]
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/10028/
+Patchwork: https://patchwork.linux-mips.org/patch/10048/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/setup.c                    |  3 --
+ arch/mips/bcm47xx/sprom.c                    | 44 ++++++++++++++--------------
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx.h |  4 ---
+ 3 files changed, 22 insertions(+), 29 deletions(-)
+
+--- a/arch/mips/bcm47xx/setup.c
++++ b/arch/mips/bcm47xx/setup.c
+@@ -206,9 +206,6 @@ void __init bcm47xx_bus_setup(void)
+ 		err = bcma_host_soc_init(&bcm47xx_bus.bcma);
+ 		if (err)
+ 			panic("Failed to initialize BCMA bus (err %d)", err);
+-
+-		bcm47xx_fill_bcma_boardinfo(&bcm47xx_bus.bcma.bus.boardinfo,
+-					    NULL);
+ 	}
+ #endif
+ 
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -640,19 +640,6 @@ void bcm47xx_fill_ssb_boardinfo(struct s
+ }
+ #endif
+ 
+-#ifdef CONFIG_BCM47XX_BCMA
+-void bcm47xx_fill_bcma_boardinfo(struct bcma_boardinfo *boardinfo,
+-				 const char *prefix)
+-{
+-	nvram_read_u16(prefix, NULL, "boardvendor", &boardinfo->vendor, 0,
+-		       true);
+-	if (!boardinfo->vendor)
+-		boardinfo->vendor = SSB_BOARDVENDOR_BCM;
+-
+-	nvram_read_u16(prefix, NULL, "boardtype", &boardinfo->type, 0, true);
+-}
+-#endif
+-
+ #if defined(CONFIG_BCM47XX_SSB)
+ static int bcm47xx_get_sprom_ssb(struct ssb_bus *bus, struct ssb_sprom *out)
+ {
+@@ -707,33 +694,46 @@ static void bcm47xx_sprom_apply_prefix_a
+ 
+ static int bcm47xx_get_sprom_bcma(struct bcma_bus *bus, struct ssb_sprom *out)
+ {
+-	char prefix[10];
++	struct bcma_boardinfo *binfo = &bus->boardinfo;
+ 	struct bcma_device *core;
++	char buf[10];
++	char *prefix;
++	bool fallback = false;
+ 
+ 	switch (bus->hosttype) {
+ 	case BCMA_HOSTTYPE_PCI:
+ 		memset(out, 0, sizeof(struct ssb_sprom));
+-		snprintf(prefix, sizeof(prefix), "pci/%u/%u/",
++		snprintf(buf, sizeof(buf), "pci/%u/%u/",
+ 			 bus->host_pci->bus->number + 1,
+ 			 PCI_SLOT(bus->host_pci->devfn));
+-		bcm47xx_sprom_apply_prefix_alias(prefix, sizeof(prefix));
+-		bcm47xx_fill_sprom(out, prefix, false);
+-		return 0;
++		bcm47xx_sprom_apply_prefix_alias(buf, sizeof(buf));
++		prefix = buf;
++		break;
+ 	case BCMA_HOSTTYPE_SOC:
+ 		memset(out, 0, sizeof(struct ssb_sprom));
+ 		core = bcma_find_core(bus, BCMA_CORE_80211);
+ 		if (core) {
+-			snprintf(prefix, sizeof(prefix), "sb/%u/",
++			snprintf(buf, sizeof(buf), "sb/%u/",
+ 				 core->core_index);
+-			bcm47xx_fill_sprom(out, prefix, true);
++			prefix = buf;
++			fallback = true;
+ 		} else {
+-			bcm47xx_fill_sprom(out, NULL, false);
++			prefix = NULL;
+ 		}
+-		return 0;
++		break;
+ 	default:
+ 		pr_warn("Unable to fill SPROM for given bustype.\n");
+ 		return -EINVAL;
+ 	}
++
++	nvram_read_u16(prefix, NULL, "boardvendor", &binfo->vendor, 0, true);
++	if (!binfo->vendor)
++		binfo->vendor = SSB_BOARDVENDOR_BCM;
++	nvram_read_u16(prefix, NULL, "boardtype", &binfo->type, 0, true);
++
++	bcm47xx_fill_sprom(out, prefix, fallback);
++
++	return 0;
+ }
+ #endif
+ 
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx.h
+@@ -52,10 +52,6 @@ void bcm47xx_fill_sprom(struct ssb_sprom
+ void bcm47xx_fill_ssb_boardinfo(struct ssb_boardinfo *boardinfo,
+ 				const char *prefix);
+ #endif
+-#ifdef CONFIG_BCM47XX_BCMA
+-void bcm47xx_fill_bcma_boardinfo(struct bcma_boardinfo *boardinfo,
+-				 const char *prefix);
+-#endif
+ 
+ void bcm47xx_set_system_type(u16 chip_id);
+ 
diff --git a/target/linux/brcm47xx/patches-4.1/031-06-MIPS-BCM77xx-Remove-legacy-__cpuinit-data-sections-t.patch b/target/linux/brcm47xx/patches-4.1/031-06-MIPS-BCM77xx-Remove-legacy-__cpuinit-data-sections-t.patch
new file mode 100644
index 0000000..e81f695
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/031-06-MIPS-BCM77xx-Remove-legacy-__cpuinit-data-sections-t.patch
@@ -0,0 +1,60 @@
+From 50d68dfef385127a1da2957813272c610c691157 Mon Sep 17 00:00:00 2001
+From: Paul Gortmaker <paul.gortmaker@windriver.com>
+Date: Mon, 27 Apr 2015 18:47:56 -0400
+Subject: [PATCH] MIPS: BCM77xx: Remove legacy __cpuinit{,data} sections that
+ crept in
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We removed __cpuinit support (leaving no-op stubs) quite some time ago.
+However a few more crept in as of commit 6ee1d93455384cef8a0426effe85da2
+("MIPS: BCM47XX: Detect more then 128 MiB of RAM (HIGHMEM)")
+
+Since we want to clobber the stubs soon, get this removed now.
+
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+Cc: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Patchwork: https://patchwork.linux-mips.org/patch/9892/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/prom.c           | 2 +-
+ arch/mips/include/asm/pgtable-32.h | 2 +-
+ arch/mips/mm/tlb-r4k.c             | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/mips/bcm47xx/prom.c
++++ b/arch/mips/bcm47xx/prom.c
+@@ -126,7 +126,7 @@ void __init prom_free_prom_memory(void)
+ /* Stripped version of tlb_init, with the call to build_tlb_refill_handler
+  * dropped. Calling it at this stage causes a hang.
+  */
+-void __cpuinit early_tlb_init(void)
++void early_tlb_init(void)
+ {
+ 	write_c0_pagemask(PM_DEFAULT_MASK);
+ 	write_c0_wired(0);
+--- a/arch/mips/include/asm/pgtable-32.h
++++ b/arch/mips/include/asm/pgtable-32.h
+@@ -18,7 +18,7 @@
+ 
+ #include <asm-generic/pgtable-nopmd.h>
+ 
+-extern int temp_tlb_entry __cpuinitdata;
++extern int temp_tlb_entry;
+ 
+ /*
+  * - add_temporary_entry() add a temporary TLB entry. We use TLB entries
+--- a/arch/mips/mm/tlb-r4k.c
++++ b/arch/mips/mm/tlb-r4k.c
+@@ -423,7 +423,7 @@ int __init has_transparent_hugepage(void
+  * lifetime of the system
+  */
+ 
+-int temp_tlb_entry __cpuinitdata;
++int temp_tlb_entry;
+ 
+ __init int add_temporary_entry(unsigned long entrylo0, unsigned long entrylo1,
+ 			       unsigned long entryhi, unsigned long pagemask)
diff --git a/target/linux/brcm47xx/patches-4.1/031-07-MIPS-BCM47XX-Support-Luxul-XWR-1750-board.patch b/target/linux/brcm47xx/patches-4.1/031-07-MIPS-BCM47XX-Support-Luxul-XWR-1750-board.patch
new file mode 100644
index 0000000..73f0662
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/031-07-MIPS-BCM47XX-Support-Luxul-XWR-1750-board.patch
@@ -0,0 +1,100 @@
+From 981de3c2f27af27fa4c5c952d122b35ee573ab7a Mon Sep 17 00:00:00 2001
+From: Dan Haab <dhaab@luxul.com>
+Date: Wed, 22 Apr 2015 13:58:33 -0600
+Subject: [PATCH] MIPS: BCM47XX: Support Luxul XWR-1750 board
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Dan Haab <dhaab@luxul.com>
+Acked-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Dan Haab <dhaab@luxul.com>
+Patchwork: https://patchwork.linux-mips.org/patch/9831/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/board.c                          |  1 +
+ arch/mips/bcm47xx/buttons.c                        | 11 +++++++++++
+ arch/mips/bcm47xx/leds.c                           | 14 ++++++++++++++
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h |  2 ++
+ 4 files changed, 28 insertions(+)
+
+--- a/arch/mips/bcm47xx/board.c
++++ b/arch/mips/bcm47xx/board.c
+@@ -149,6 +149,7 @@ struct bcm47xx_board_type_list2 bcm47xx_
+ /* board_id */
+ static const
+ struct bcm47xx_board_type_list1 bcm47xx_board_list_board_id[] __initconst = {
++	{{BCM47XX_BOARD_LUXUL_XWR_1750_V1, "Luxul XWR-1750 V1"}, "luxul_xwr1750_v1"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614V8, "Netgear WGR614 V8"}, "U12H072T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614V9, "Netgear WGR614 V9"}, "U12H094T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614_V10, "Netgear WGR614 V10"}, "U12H139T01_NETGEAR"},
+--- a/arch/mips/bcm47xx/buttons.c
++++ b/arch/mips/bcm47xx/buttons.c
+@@ -299,6 +299,13 @@ bcm47xx_buttons_linksys_wrtsl54gs[] __in
+ 	BCM47XX_GPIO_KEY(6, KEY_RESTART),
+ };
+ 
++/* Luxul */
++
++static const struct gpio_keys_button
++bcm47xx_buttons_luxul_xwr_1750_v1[] = {
++	BCM47XX_GPIO_KEY(14, BTN_TASK),
++};
++
+ /* Microsoft */
+ 
+ static const struct gpio_keys_button
+@@ -555,6 +562,10 @@ int __init bcm47xx_buttons_register(void
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrtsl54gs);
+ 		break;
+ 
++	case BCM47XX_BOARD_LUXUL_XWR_1750_V1:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_luxul_xwr_1750_v1);
++		break;
++
+ 	case BCM47XX_BOARD_MICROSOFT_MN700:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_microsoft_nm700);
+ 		break;
+--- a/arch/mips/bcm47xx/leds.c
++++ b/arch/mips/bcm47xx/leds.c
+@@ -370,6 +370,16 @@ bcm47xx_leds_linksys_wrtsl54gs[] __initc
+ 	BCM47XX_GPIO_LED(7, "orange", "wps", 1, LEDS_GPIO_DEFSTATE_OFF),
+ };
+ 
++/* Luxul */
++
++static const struct gpio_led
++bcm47xx_leds_luxul_xwr_1750_v1[] __initconst = {
++	BCM47XX_GPIO_LED(5, "green", "5ghz", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(12, "green", "usb", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED_TRIGGER(13, "green", "status", 0, "timer"),
++	BCM47XX_GPIO_LED(15, "green", "wps", 0, LEDS_GPIO_DEFSTATE_OFF),
++};
++
+ /* Microsoft */
+ 
+ static const struct gpio_led
+@@ -623,6 +633,10 @@ void __init bcm47xx_leds_register(void)
+ 		bcm47xx_set_pdata(bcm47xx_leds_linksys_wrtsl54gs);
+ 		break;
+ 
++	case BCM47XX_BOARD_LUXUL_XWR_1750_V1:
++		bcm47xx_set_pdata(bcm47xx_leds_luxul_xwr_1750_v1);
++		break;
++
+ 	case BCM47XX_BOARD_MICROSOFT_MN700:
+ 		bcm47xx_set_pdata(bcm47xx_leds_microsoft_nm700);
+ 		break;
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
+@@ -80,6 +80,8 @@ enum bcm47xx_board {
+ 	BCM47XX_BOARD_LINKSYS_WRT610NV2,
+ 	BCM47XX_BOARD_LINKSYS_WRTSL54GS,
+ 
++	BCM47XX_BOARD_LUXUL_XWR_1750_V1,
++
+ 	BCM47XX_BOARD_MICROSOFT_MN700,
+ 
+ 	BCM47XX_BOARD_MOTOROLA_WE800G,
diff --git a/target/linux/brcm47xx/patches-4.1/031-08-mips-bcm47xx-allow-retrieval-of-complete-nvram-conte.patch b/target/linux/brcm47xx/patches-4.1/031-08-mips-bcm47xx-allow-retrieval-of-complete-nvram-conte.patch
new file mode 100644
index 0000000..105c651
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/031-08-mips-bcm47xx-allow-retrieval-of-complete-nvram-conte.patch
@@ -0,0 +1,157 @@
+From 2536295c2aeafc769215a6b2883126fa94c90b9a Mon Sep 17 00:00:00 2001
+From: Hante Meuleman <meuleman@broadcom.com>
+Date: Thu, 21 May 2015 15:27:23 +0200
+Subject: [PATCH] mips: bcm47xx: allow retrieval of complete nvram contents
+
+Host platforms such as routers supported by OpenWrt can
+support NVRAM reading directly from internal NVRAM store.
+The brcmfmac for one requires the complete nvram contents
+to select what needs to be sent to wireless device.
+
+Signed-off-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
+Reviewed-by: Arend Van Spriel <arend@broadcom.com>
+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
+Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/10093/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c     | 60 ++++++++++++++++++++++++++++++++-----------
+ include/linux/bcm47xx_nvram.h | 15 +++++++++++
+ 2 files changed, 60 insertions(+), 15 deletions(-)
+
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -94,17 +94,22 @@ static int nvram_find_and_copy(void __io
+ 	return -ENXIO;
+ 
+ found:
+-	if (header->len > size)
+-		pr_err("The nvram size accoridng to the header seems to be bigger than the partition on flash\n");
+-	if (header->len > NVRAM_SPACE)
+-		pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+-		       header->len, NVRAM_SPACE - 1);
+-
+ 	src = (u32 *)header;
+ 	dst = (u32 *)nvram_buf;
+ 	for (i = 0; i < sizeof(struct nvram_header); i += 4)
+ 		*dst++ = __raw_readl(src++);
+-	for (; i < header->len && i < NVRAM_SPACE && i < size; i += 4)
++	header = (struct nvram_header *)nvram_buf;
++	if (header->len > size) {
++		pr_err("The nvram size according to the header seems to be bigger than the partition on flash\n");
++		header->len = size;
++	}
++	if (header->len >= NVRAM_SPACE) {
++		pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
++		       header->len, NVRAM_SPACE - 1);
++		header->len = NVRAM_SPACE - 1;
++	}
++	/* proceed reading data after header */
++	for (; i < header->len; i += 4)
+ 		*dst++ = readl(src++);
+ 	nvram_buf[NVRAM_SPACE - 1] = '\0';
+ 
+@@ -139,6 +144,7 @@ static int nvram_init(void)
+ #ifdef CONFIG_MTD
+ 	struct mtd_info *mtd;
+ 	struct nvram_header header;
++	struct nvram_header *pheader;
+ 	size_t bytes_read;
+ 	int err;
+ 
+@@ -147,20 +153,21 @@ static int nvram_init(void)
+ 		return -ENODEV;
+ 
+ 	err = mtd_read(mtd, 0, sizeof(header), &bytes_read, (uint8_t *)&header);
+-	if (!err && header.magic == NVRAM_MAGIC) {
+-		u8 *dst = (uint8_t *)nvram_buf;
+-		size_t len = header.len;
+-
+-		if (len >= NVRAM_SPACE) {
+-			len = NVRAM_SPACE - 1;
++	if (!err && header.magic == NVRAM_MAGIC &&
++	    header.len > sizeof(header)) {
++		if (header.len >= NVRAM_SPACE) {
+ 			pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+-				header.len, len);
++				header.len, NVRAM_SPACE);
++			header.len = NVRAM_SPACE - 1;
+ 		}
+ 
+-		err = mtd_read(mtd, 0, len, &bytes_read, dst);
++		err = mtd_read(mtd, 0, header.len, &bytes_read,
++			       (u8 *)nvram_buf);
+ 		if (err)
+ 			return err;
+ 
++		pheader = (struct nvram_header *)nvram_buf;
++		pheader->len = header.len;
+ 		return 0;
+ 	}
+ #endif
+@@ -219,3 +226,26 @@ int bcm47xx_nvram_gpio_pin(const char *n
+ 	return -ENOENT;
+ }
+ EXPORT_SYMBOL(bcm47xx_nvram_gpio_pin);
++
++char *bcm47xx_nvram_get_contents(size_t *nvram_size)
++{
++	int err;
++	char *nvram;
++	struct nvram_header *header;
++
++	if (!nvram_buf[0]) {
++		err = nvram_init();
++		if (err)
++			return NULL;
++	}
++
++	header = (struct nvram_header *)nvram_buf;
++	*nvram_size = header->len - sizeof(struct nvram_header);
++	nvram = vmalloc(*nvram_size);
++	if (!nvram)
++		return NULL;
++	memcpy(nvram, &nvram_buf[sizeof(struct nvram_header)], *nvram_size);
++
++	return nvram;
++}
++EXPORT_SYMBOL(bcm47xx_nvram_get_contents);
+--- a/include/linux/bcm47xx_nvram.h
++++ b/include/linux/bcm47xx_nvram.h
+@@ -10,11 +10,17 @@
+ 
+ #include <linux/types.h>
+ #include <linux/kernel.h>
++#include <linux/vmalloc.h>
+ 
+ #ifdef CONFIG_BCM47XX
+ int bcm47xx_nvram_init_from_mem(u32 base, u32 lim);
+ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len);
+ int bcm47xx_nvram_gpio_pin(const char *name);
++char *bcm47xx_nvram_get_contents(size_t *val_len);
++static inline void bcm47xx_nvram_release_contents(char *nvram)
++{
++	vfree(nvram);
++};
+ #else
+ static inline int bcm47xx_nvram_init_from_mem(u32 base, u32 lim)
+ {
+@@ -29,6 +35,15 @@ static inline int bcm47xx_nvram_gpio_pin
+ {
+ 	return -ENOTSUPP;
+ };
++
++static inline char *bcm47xx_nvram_get_contents(size_t *val_len)
++{
++	return NULL;
++};
++
++static inline void bcm47xx_nvram_release_contents(char *nvram)
++{
++};
+ #endif
+ 
+ #endif /* __BCM47XX_NVRAM_H */
diff --git a/target/linux/brcm47xx/patches-4.1/031-09-MIPS-BCM47xx-Add-helper-variable-for-storing-NVRAM-l.patch b/target/linux/brcm47xx/patches-4.1/031-09-MIPS-BCM47xx-Add-helper-variable-for-storing-NVRAM-l.patch
new file mode 100644
index 0000000..053144a
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/031-09-MIPS-BCM47xx-Add-helper-variable-for-storing-NVRAM-l.patch
@@ -0,0 +1,131 @@
+From f229d75f1472c4cd30f464e4a0f94f410046bd80 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Sat, 6 Jun 2015 23:16:23 +0200
+Subject: [PATCH] MIPS: BCM47xx: Add helper variable for storing NVRAM length
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This simplifies code just a bit (also maybe makes it a bit more
+intuitive?) and will allow us to stop storing header. Right now we copy
+whole NVRAM including its header to the internal buffer. It is not
+needed to store a header as we don't access all these details like CRC,
+flags, etc. The next improvement that should follow is copying only the
+real contents.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: linux-mips@linux-mips.org
+Cc: Arend van Spriel <arend@broadcom.com>
+Cc: Hante Meuleman <meuleman@broadcom.com>
+Patchwork: https://patchwork.linux-mips.org/patch/10535/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 37 ++++++++++++++++---------------------
+ 1 file changed, 16 insertions(+), 21 deletions(-)
+
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -35,6 +35,7 @@ struct nvram_header {
+ };
+ 
+ static char nvram_buf[NVRAM_SPACE];
++static size_t nvram_len;
+ static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
+ 
+ static u32 find_nvram_size(void __iomem *end)
+@@ -60,7 +61,7 @@ static int nvram_find_and_copy(void __io
+ 	u32 *src, *dst;
+ 	u32 size;
+ 
+-	if (nvram_buf[0]) {
++	if (nvram_len) {
+ 		pr_warn("nvram already initialized\n");
+ 		return -EEXIST;
+ 	}
+@@ -99,17 +100,18 @@ found:
+ 	for (i = 0; i < sizeof(struct nvram_header); i += 4)
+ 		*dst++ = __raw_readl(src++);
+ 	header = (struct nvram_header *)nvram_buf;
+-	if (header->len > size) {
++	nvram_len = header->len;
++	if (nvram_len > size) {
+ 		pr_err("The nvram size according to the header seems to be bigger than the partition on flash\n");
+-		header->len = size;
++		nvram_len = size;
+ 	}
+-	if (header->len >= NVRAM_SPACE) {
++	if (nvram_len >= NVRAM_SPACE) {
+ 		pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+ 		       header->len, NVRAM_SPACE - 1);
+-		header->len = NVRAM_SPACE - 1;
++		nvram_len = NVRAM_SPACE - 1;
+ 	}
+ 	/* proceed reading data after header */
+-	for (; i < header->len; i += 4)
++	for (; i < nvram_len; i += 4)
+ 		*dst++ = readl(src++);
+ 	nvram_buf[NVRAM_SPACE - 1] = '\0';
+ 
+@@ -144,7 +146,6 @@ static int nvram_init(void)
+ #ifdef CONFIG_MTD
+ 	struct mtd_info *mtd;
+ 	struct nvram_header header;
+-	struct nvram_header *pheader;
+ 	size_t bytes_read;
+ 	int err;
+ 
+@@ -155,20 +156,16 @@ static int nvram_init(void)
+ 	err = mtd_read(mtd, 0, sizeof(header), &bytes_read, (uint8_t *)&header);
+ 	if (!err && header.magic == NVRAM_MAGIC &&
+ 	    header.len > sizeof(header)) {
+-		if (header.len >= NVRAM_SPACE) {
++		nvram_len = header.len;
++		if (nvram_len >= NVRAM_SPACE) {
+ 			pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+ 				header.len, NVRAM_SPACE);
+-			header.len = NVRAM_SPACE - 1;
++			nvram_len = NVRAM_SPACE - 1;
+ 		}
+ 
+-		err = mtd_read(mtd, 0, header.len, &bytes_read,
++		err = mtd_read(mtd, 0, nvram_len, &nvram_len,
+ 			       (u8 *)nvram_buf);
+-		if (err)
+-			return err;
+-
+-		pheader = (struct nvram_header *)nvram_buf;
+-		pheader->len = header.len;
+-		return 0;
++		return err;
+ 	}
+ #endif
+ 
+@@ -183,7 +180,7 @@ int bcm47xx_nvram_getenv(const char *nam
+ 	if (!name)
+ 		return -EINVAL;
+ 
+-	if (!nvram_buf[0]) {
++	if (!nvram_len) {
+ 		err = nvram_init();
+ 		if (err)
+ 			return err;
+@@ -231,16 +228,14 @@ char *bcm47xx_nvram_get_contents(size_t
+ {
+ 	int err;
+ 	char *nvram;
+-	struct nvram_header *header;
+ 
+-	if (!nvram_buf[0]) {
++	if (!nvram_len) {
+ 		err = nvram_init();
+ 		if (err)
+ 			return NULL;
+ 	}
+ 
+-	header = (struct nvram_header *)nvram_buf;
+-	*nvram_size = header->len - sizeof(struct nvram_header);
++	*nvram_size = nvram_len - sizeof(struct nvram_header);
+ 	nvram = vmalloc(*nvram_size);
+ 	if (!nvram)
+ 		return NULL;
diff --git a/target/linux/brcm47xx/patches-4.1/031-10-MIPS-BCM47xx-Don-t-select-BCMA_HOST_PCI.patch b/target/linux/brcm47xx/patches-4.1/031-10-MIPS-BCM47xx-Don-t-select-BCMA_HOST_PCI.patch
new file mode 100644
index 0000000..5bcbaa5
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/031-10-MIPS-BCM47xx-Don-t-select-BCMA_HOST_PCI.patch
@@ -0,0 +1,30 @@
+From 5521bb0c510ed5c1881636524badfb9bc951f6ac Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Sun, 7 Jun 2015 13:26:44 +0200
+Subject: [PATCH] MIPS: BCM47xx: Don't select BCMA_HOST_PCI
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+SoC may have non-Broadcom PCI device attached or one may want to use
+totally different PCI driver.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/10537/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/mips/bcm47xx/Kconfig
++++ b/arch/mips/bcm47xx/Kconfig
+@@ -25,7 +25,6 @@ config BCM47XX_BCMA
+ 	select BCMA
+ 	select BCMA_HOST_SOC
+ 	select BCMA_DRIVER_MIPS
+-	select BCMA_HOST_PCI if PCI
+ 	select BCMA_DRIVER_PCI_HOSTMODE if PCI
+ 	select BCMA_DRIVER_GPIO
+ 	default y
diff --git a/target/linux/brcm47xx/patches-4.1/159-cpu_fixes.patch b/target/linux/brcm47xx/patches-4.1/159-cpu_fixes.patch
new file mode 100644
index 0000000..11d90ec
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/159-cpu_fixes.patch
@@ -0,0 +1,391 @@
+--- a/arch/mips/include/asm/r4kcache.h
++++ b/arch/mips/include/asm/r4kcache.h
+@@ -25,6 +25,20 @@
+ extern void (*r4k_blast_dcache)(void);
+ extern void (*r4k_blast_icache)(void);
+ 
++#ifdef CONFIG_BCM47XX
++#include <asm/paccess.h>
++#include <linux/ssb/ssb.h>
++#define BCM4710_DUMMY_RREG() ((void) *((u8 *) KSEG1ADDR(SSB_ENUM_BASE)))
++
++#define BCM4710_FILL_TLB(addr) (*(volatile unsigned long *)(addr))
++#define BCM4710_PROTECTED_FILL_TLB(addr) ({ unsigned long x; get_dbe(x, (volatile unsigned long *)(addr)); })
++#else
++#define BCM4710_DUMMY_RREG()
++
++#define BCM4710_FILL_TLB(addr)
++#define BCM4710_PROTECTED_FILL_TLB(addr)
++#endif
++
+ /*
+  * This macro return a properly sign-extended address suitable as base address
+  * for indexed cache operations.  Two issues here:
+@@ -98,6 +112,7 @@ static inline void flush_icache_line_ind
+ static inline void flush_dcache_line_indexed(unsigned long addr)
+ {
+ 	__dflush_prologue
++	BCM4710_DUMMY_RREG();
+ 	cache_op(Index_Writeback_Inv_D, addr);
+ 	__dflush_epilogue
+ }
+@@ -125,6 +140,7 @@ static inline void flush_icache_line(uns
+ static inline void flush_dcache_line(unsigned long addr)
+ {
+ 	__dflush_prologue
++	BCM4710_DUMMY_RREG();
+ 	cache_op(Hit_Writeback_Inv_D, addr);
+ 	__dflush_epilogue
+ }
+@@ -132,6 +148,7 @@ static inline void flush_dcache_line(uns
+ static inline void invalidate_dcache_line(unsigned long addr)
+ {
+ 	__dflush_prologue
++	BCM4710_DUMMY_RREG();
+ 	cache_op(Hit_Invalidate_D, addr);
+ 	__dflush_epilogue
+ }
+@@ -187,6 +204,7 @@ static inline void protected_flush_icach
+ #ifdef CONFIG_EVA
+ 		protected_cachee_op(Hit_Invalidate_I, addr);
+ #else
++		BCM4710_DUMMY_RREG();
+ 		protected_cache_op(Hit_Invalidate_I, addr);
+ #endif
+ 		break;
+@@ -201,6 +219,7 @@ static inline void protected_flush_icach
+  */
+ static inline void protected_writeback_dcache_line(unsigned long addr)
+ {
++	BCM4710_DUMMY_RREG();
+ #ifdef CONFIG_EVA
+ 	protected_cachee_op(Hit_Writeback_Inv_D, addr);
+ #else
+@@ -554,8 +573,51 @@ static inline void invalidate_tcache_pag
+ 		: "r" (base),						\
+ 		  "i" (op));
+ 
++static inline void blast_dcache(void)
++{
++	unsigned long start = KSEG0;
++	unsigned long dcache_size = current_cpu_data.dcache.waysize * current_cpu_data.dcache.ways;
++	unsigned long end = (start + dcache_size);
++
++	do {
++		BCM4710_DUMMY_RREG();
++		cache_op(Index_Writeback_Inv_D, start);
++		start += current_cpu_data.dcache.linesz;
++	} while(start < end);
++}
++
++static inline void blast_dcache_page(unsigned long page)
++{
++	unsigned long start = page;
++	unsigned long end = start + PAGE_SIZE;
++
++	BCM4710_FILL_TLB(start);
++	do {
++		BCM4710_DUMMY_RREG();
++		cache_op(Hit_Writeback_Inv_D, start);
++		start += current_cpu_data.dcache.linesz;
++	} while(start < end);
++}
++
++static inline void blast_dcache_page_indexed(unsigned long page)
++{
++	unsigned long start = page;
++	unsigned long end = start + PAGE_SIZE;
++	unsigned long ws_inc = 1UL << current_cpu_data.dcache.waybit;
++	unsigned long ws_end = current_cpu_data.dcache.ways <<
++	                       current_cpu_data.dcache.waybit;
++	unsigned long ws, addr;
++	for (ws = 0; ws < ws_end; ws += ws_inc) {
++		start = page + ws;
++		for (addr = start; addr < end; addr += current_cpu_data.dcache.linesz) {
++			BCM4710_DUMMY_RREG();
++			cache_op(Index_Writeback_Inv_D, addr);
++		}
++	}
++}
++
+ /* build blast_xxx, blast_xxx_page, blast_xxx_page_indexed */
+-#define __BUILD_BLAST_CACHE(pfx, desc, indexop, hitop, lsize, extra)	\
++#define __BUILD_BLAST_CACHE(pfx, desc, indexop, hitop, lsize, extra, war) \
+ static inline void extra##blast_##pfx##cache##lsize(void)		\
+ {									\
+ 	unsigned long start = INDEX_BASE;				\
+@@ -567,6 +629,7 @@ static inline void extra##blast_##pfx##c
+ 									\
+ 	__##pfx##flush_prologue						\
+ 									\
++	war								\
+ 	for (ws = 0; ws < ws_end; ws += ws_inc)				\
+ 		for (addr = start; addr < end; addr += lsize * 32)	\
+ 			cache##lsize##_unroll32(addr|ws, indexop);	\
+@@ -581,6 +644,7 @@ static inline void extra##blast_##pfx##c
+ 									\
+ 	__##pfx##flush_prologue						\
+ 									\
++	war								\
+ 	do {								\
+ 		cache##lsize##_unroll32(start, hitop);			\
+ 		start += lsize * 32;					\
+@@ -599,6 +663,8 @@ static inline void extra##blast_##pfx##c
+ 			       current_cpu_data.desc.waybit;		\
+ 	unsigned long ws, addr;						\
+ 									\
++	war								\
++									\
+ 	__##pfx##flush_prologue						\
+ 									\
+ 	for (ws = 0; ws < ws_end; ws += ws_inc)				\
+@@ -608,26 +674,26 @@ static inline void extra##blast_##pfx##c
+ 	__##pfx##flush_epilogue						\
+ }
+ 
+-__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 16, )
+-__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 16, )
+-__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 16, )
+-__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 32, )
+-__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 32, )
+-__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I_Loongson2, 32, loongson2_)
+-__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 32, )
+-__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 64, )
+-__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 64, )
+-__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 64, )
+-__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 128, )
+-__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 128, )
+-__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 128, )
+-
+-__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 16, )
+-__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 32, )
+-__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 16, )
+-__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 32, )
+-__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 64, )
+-__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 128, )
++__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 16, , )
++__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 16, , BCM4710_FILL_TLB(start);)
++__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 16, , )
++__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 32, , )
++__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 32, , BCM4710_FILL_TLB(start);)
++__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I_Loongson2, 32, loongson2_, BCM4710_FILL_TLB(start);)
++__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 32, , )
++__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 64, , )
++__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 64, , BCM4710_FILL_TLB(start);)
++__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 64, , )
++__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 128, , )
++__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 128, , )
++__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 128, , )
++
++__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 16, , )
++__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 32, , )
++__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 16, , )
++__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 32, , )
++__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 64, , )
++__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 128, , )
+ 
+ #define __BUILD_BLAST_USER_CACHE(pfx, desc, indexop, hitop, lsize) \
+ static inline void blast_##pfx##cache##lsize##_user_page(unsigned long page) \
+@@ -656,17 +722,19 @@ __BUILD_BLAST_USER_CACHE(d, dcache, Inde
+ __BUILD_BLAST_USER_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 64)
+ 
+ /* build blast_xxx_range, protected_blast_xxx_range */
+-#define __BUILD_BLAST_CACHE_RANGE(pfx, desc, hitop, prot, extra)	\
++#define __BUILD_BLAST_CACHE_RANGE(pfx, desc, hitop, prot, extra, war, war2)	\
+ static inline void prot##extra##blast_##pfx##cache##_range(unsigned long start, \
+ 						    unsigned long end)	\
+ {									\
+ 	unsigned long lsize = cpu_##desc##_line_size();			\
+ 	unsigned long addr = start & ~(lsize - 1);			\
+ 	unsigned long aend = (end - 1) & ~(lsize - 1);			\
++	war								\
+ 									\
+ 	__##pfx##flush_prologue						\
+ 									\
+ 	while (1) {							\
++		war2							\
+ 		prot##cache_op(hitop, addr);				\
+ 		if (addr == aend)					\
+ 			break;						\
+@@ -678,8 +746,8 @@ static inline void prot##extra##blast_##
+ 
+ #ifndef CONFIG_EVA
+ 
+-__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, protected_, )
+-__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I, protected_, )
++__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, protected_, , BCM4710_PROTECTED_FILL_TLB(addr); BCM4710_PROTECTED_FILL_TLB(aend);, BCM4710_DUMMY_RREG();)
++__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I, protected_, , , )
+ 
+ #else
+ 
+@@ -716,14 +784,14 @@ __BUILD_PROT_BLAST_CACHE_RANGE(d, dcache
+ __BUILD_PROT_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I)
+ 
+ #endif
+-__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, protected_, )
++__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, protected_, , , )
+ __BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I_Loongson2, \
+-	protected_, loongson2_)
+-__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, , )
+-__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I, , )
+-__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, , )
++	protected_, loongson2_, , )
++__BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, , , BCM4710_FILL_TLB(addr); BCM4710_FILL_TLB(aend);, BCM4710_DUMMY_RREG();)
++__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I, , , , )
++__BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, , , , )
+ /* blast_inv_dcache_range */
+-__BUILD_BLAST_CACHE_RANGE(inv_d, dcache, Hit_Invalidate_D, , )
+-__BUILD_BLAST_CACHE_RANGE(inv_s, scache, Hit_Invalidate_SD, , )
++__BUILD_BLAST_CACHE_RANGE(inv_d, dcache, Hit_Invalidate_D, , , , BCM4710_DUMMY_RREG();)
++__BUILD_BLAST_CACHE_RANGE(inv_s, scache, Hit_Invalidate_SD, , , , )
+ 
+ #endif /* _ASM_R4KCACHE_H */
+--- a/arch/mips/include/asm/stackframe.h
++++ b/arch/mips/include/asm/stackframe.h
+@@ -358,6 +358,10 @@
+ 		.macro	RESTORE_SP_AND_RET
+ 		LONG_L	sp, PT_R29(sp)
+ 		.set	arch=r4000
++#ifdef CONFIG_BCM47XX
++		nop
++		nop
++#endif
+ 		eret
+ 		.set	mips0
+ 		.endm
+--- a/arch/mips/kernel/genex.S
++++ b/arch/mips/kernel/genex.S
+@@ -32,6 +32,10 @@
+ NESTED(except_vec3_generic, 0, sp)
+ 	.set	push
+ 	.set	noat
++#ifdef CONFIG_BCM47XX
++	nop
++	nop
++#endif
+ #if R5432_CP0_INTERRUPT_WAR
+ 	mfc0	k0, CP0_INDEX
+ #endif
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -39,6 +39,9 @@
+ #include <asm/dma-coherence.h>
+ #include <asm/mips-cm.h>
+ 
++/* For enabling BCM4710 cache workarounds */
++int bcm4710 = 0;
++
+ /*
+  * Special Variant of smp_call_function for use by cache functions:
+  *
+@@ -157,6 +160,9 @@ static void r4k_blast_dcache_user_page_s
+ {
+ 	unsigned long  dc_lsize = cpu_dcache_line_size();
+ 
++	if (bcm4710)
++		r4k_blast_dcache_page = blast_dcache_page;
++	else
+ 	if (dc_lsize == 0)
+ 		r4k_blast_dcache_user_page = (void *)cache_noop;
+ 	else if (dc_lsize == 16)
+@@ -175,6 +181,9 @@ static void r4k_blast_dcache_page_indexe
+ {
+ 	unsigned long dc_lsize = cpu_dcache_line_size();
+ 
++	if (bcm4710)
++		r4k_blast_dcache_page_indexed = blast_dcache_page_indexed;
++	else
+ 	if (dc_lsize == 0)
+ 		r4k_blast_dcache_page_indexed = (void *)cache_noop;
+ 	else if (dc_lsize == 16)
+@@ -194,6 +203,9 @@ static void r4k_blast_dcache_setup(void)
+ {
+ 	unsigned long dc_lsize = cpu_dcache_line_size();
+ 
++	if (bcm4710)
++		r4k_blast_dcache = blast_dcache;
++	else
+ 	if (dc_lsize == 0)
+ 		r4k_blast_dcache = (void *)cache_noop;
+ 	else if (dc_lsize == 16)
+@@ -793,6 +805,8 @@ static void local_r4k_flush_cache_sigtra
+ 	unsigned long addr = (unsigned long) arg;
+ 
+ 	R4600_HIT_CACHEOP_WAR_IMPL;
++	BCM4710_PROTECTED_FILL_TLB(addr);
++	BCM4710_PROTECTED_FILL_TLB(addr + 4);
+ 	if (dc_lsize)
+ 		protected_writeback_dcache_line(addr & ~(dc_lsize - 1));
+ 	if (!cpu_icache_snoops_remote_store && scache_size)
+@@ -1599,6 +1613,17 @@ static void coherency_setup(void)
+ 	 * silly idea of putting something else there ...
+ 	 */
+ 	switch (current_cpu_type()) {
++	case CPU_BMIPS3300:
++		{
++			u32 cm;
++			cm = read_c0_diag();
++			/* Enable icache */
++			cm |= (1 << 31);
++			/* Enable dcache */
++			cm |= (1 << 30);
++			write_c0_diag(cm);
++		}
++		break;
+ 	case CPU_R4000PC:
+ 	case CPU_R4000SC:
+ 	case CPU_R4000MC:
+@@ -1645,6 +1670,15 @@ void r4k_cache_init(void)
+ 	extern void build_copy_page(void);
+ 	struct cpuinfo_mips *c = &current_cpu_data;
+ 
++	/* Check if special workarounds are required */
++#ifdef CONFIG_BCM47XX
++	if (current_cpu_data.cputype == CPU_BMIPS32 && (current_cpu_data.processor_id & 0xff) == 0) {
++		printk("Enabling BCM4710A0 cache workarounds.\n");
++		bcm4710 = 1;
++	} else
++#endif
++		bcm4710 = 0;
++
+ 	probe_pcache();
+ 	setup_scache();
+ 
+@@ -1714,7 +1748,15 @@ void r4k_cache_init(void)
+ 	 */
+ 	local_r4k___flush_cache_all(NULL);
+ 
++#ifdef CONFIG_BCM47XX
++	{
++		static void (*_coherency_setup)(void);
++		_coherency_setup = (void (*)(void)) KSEG1ADDR(coherency_setup);
++		_coherency_setup();
++	}
++#else
+ 	coherency_setup();
++#endif
+ 	board_cache_error_setup = r4k_cache_error_setup;
+ 
+ 	/*
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -1296,6 +1296,9 @@ static void build_r4000_tlb_refill_handl
+ 			/* No need for uasm_i_nop */
+ 		}
+ 
++#ifdef CONFIG_BCM47XX
++		uasm_i_nop(&p);
++#endif
+ #ifdef CONFIG_64BIT
+ 		build_get_pmde64(&p, &l, &r, K0, K1); /* get pmd in K1 */
+ #else
+@@ -1868,6 +1871,9 @@ build_r4000_tlbchange_handler_head(u32 *
+ {
+ 	struct work_registers wr = build_get_work_registers(p);
+ 
++#ifdef CONFIG_BCM47XX
++	uasm_i_nop(p);
++#endif
+ #ifdef CONFIG_64BIT
+ 	build_get_pmde64(p, l, r, wr.r1, wr.r2); /* get pmd in ptr */
+ #else
diff --git a/target/linux/brcm47xx/patches-4.1/160-kmap_coherent.patch b/target/linux/brcm47xx/patches-4.1/160-kmap_coherent.patch
new file mode 100644
index 0000000..2df8f04
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/160-kmap_coherent.patch
@@ -0,0 +1,70 @@
+--- a/arch/mips/include/asm/cpu-features.h
++++ b/arch/mips/include/asm/cpu-features.h
+@@ -158,6 +158,9 @@
+ #ifndef cpu_has_local_ebase
+ #define cpu_has_local_ebase	1
+ #endif
++#ifndef cpu_use_kmap_coherent
++#define cpu_use_kmap_coherent 1
++#endif
+ 
+ /*
+  * I-Cache snoops remote store.	 This only matters on SMP.  Some multiprocessors
+--- a/arch/mips/include/asm/mach-bcm47xx/cpu-feature-overrides.h
++++ b/arch/mips/include/asm/mach-bcm47xx/cpu-feature-overrides.h
+@@ -79,4 +79,6 @@
+ #define cpu_scache_line_size()		0
+ #define cpu_has_vz			0
+ 
++#define cpu_use_kmap_coherent		0
++
+ #endif /* __ASM_MACH_BCM47XX_CPU_FEATURE_OVERRIDES_H */
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -600,7 +600,7 @@ static inline void local_r4k_flush_cache
+ 		 */
+ 		map_coherent = (cpu_has_dc_aliases &&
+ 				page_mapped(page) && !Page_dcache_dirty(page));
+-		if (map_coherent)
++		if (map_coherent && cpu_use_kmap_coherent)
+ 			vaddr = kmap_coherent(page, addr);
+ 		else
+ 			vaddr = kmap_atomic(page);
+@@ -625,7 +625,7 @@ static inline void local_r4k_flush_cache
+ 	}
+ 
+ 	if (vaddr) {
+-		if (map_coherent)
++		if (map_coherent && cpu_use_kmap_coherent)
+ 			kunmap_coherent();
+ 		else
+ 			kunmap_atomic(vaddr);
+--- a/arch/mips/mm/init.c
++++ b/arch/mips/mm/init.c
+@@ -160,7 +160,7 @@ void copy_user_highpage(struct page *to,
+ 	void *vfrom, *vto;
+ 
+ 	vto = kmap_atomic(to);
+-	if (cpu_has_dc_aliases &&
++	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
+ 	    page_mapped(from) && !Page_dcache_dirty(from)) {
+ 		vfrom = kmap_coherent(from, vaddr);
+ 		copy_page(vto, vfrom);
+@@ -182,7 +182,7 @@ void copy_to_user_page(struct vm_area_st
+ 	struct page *page, unsigned long vaddr, void *dst, const void *src,
+ 	unsigned long len)
+ {
+-	if (cpu_has_dc_aliases &&
++	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
+ 	    page_mapped(page) && !Page_dcache_dirty(page)) {
+ 		void *vto = kmap_coherent(page, vaddr) + (vaddr & ~PAGE_MASK);
+ 		memcpy(vto, src, len);
+@@ -200,7 +200,7 @@ void copy_from_user_page(struct vm_area_
+ 	struct page *page, unsigned long vaddr, void *dst, const void *src,
+ 	unsigned long len)
+ {
+-	if (cpu_has_dc_aliases &&
++	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
+ 	    page_mapped(page) && !Page_dcache_dirty(page)) {
+ 		void *vfrom = kmap_coherent(page, vaddr) + (vaddr & ~PAGE_MASK);
+ 		memcpy(dst, vfrom, len);
diff --git a/target/linux/brcm47xx/patches-4.1/209-b44-register-adm-switch.patch b/target/linux/brcm47xx/patches-4.1/209-b44-register-adm-switch.patch
new file mode 100644
index 0000000..777744c
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/209-b44-register-adm-switch.patch
@@ -0,0 +1,122 @@
+From b36f694256f41bc71571f467646d015dda128d14 Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Sat, 9 Nov 2013 17:03:59 +0100
+Subject: [PATCH 210/210] b44: register adm switch
+
+---
+ drivers/net/ethernet/broadcom/b44.c |   57 +++++++++++++++++++++++++++++++++++
+ drivers/net/ethernet/broadcom/b44.h |    3 ++
+ 2 files changed, 60 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/b44.c
++++ b/drivers/net/ethernet/broadcom/b44.c
+@@ -31,6 +31,8 @@
+ #include <linux/ssb/ssb.h>
+ #include <linux/slab.h>
+ #include <linux/phy.h>
++#include <linux/platform_device.h>
++#include <linux/platform_data/adm6996-gpio.h>
+ 
+ #include <asm/uaccess.h>
+ #include <asm/io.h>
+@@ -2240,6 +2242,70 @@ static void b44_adjust_link(struct net_d
+ 	}
+ }
+ 
++#ifdef CONFIG_BCM47XX
++static int b44_register_adm_switch(struct b44 *bp)
++{
++	int gpio;
++	struct platform_device *pdev;
++	struct adm6996_gpio_platform_data adm_data = {0};
++	struct platform_device_info info = {0};
++
++	adm_data.model = ADM6996L;
++	gpio = bcm47xx_nvram_gpio_pin("adm_eecs");
++	if (gpio >= 0)
++		adm_data.eecs = gpio;
++	else
++		adm_data.eecs = 2;
++
++	gpio = bcm47xx_nvram_gpio_pin("adm_eesk");
++	if (gpio >= 0)
++		adm_data.eesk = gpio;
++	else
++		adm_data.eesk = 3;
++
++	gpio = bcm47xx_nvram_gpio_pin("adm_eedi");
++	if (gpio >= 0)
++		adm_data.eedi = gpio;
++	else
++		adm_data.eedi = 4;
++
++	gpio = bcm47xx_nvram_gpio_pin("adm_rc");
++	if (gpio >= 0)
++		adm_data.eerc = gpio;
++	else
++		adm_data.eerc = 5;
++
++	info.parent = bp->sdev->dev;
++	info.name = "adm6996_gpio";
++	info.id = -1;
++	info.data = &adm_data;
++	info.size_data = sizeof(adm_data);
++
++	if (!bp->adm_switch) {
++		pdev = platform_device_register_full(&info);
++		if (IS_ERR(pdev))
++			return PTR_ERR(pdev);
++
++		bp->adm_switch = pdev;
++	}
++	return 0;
++}
++static void b44_unregister_adm_switch(struct b44 *bp)
++{
++	if (bp->adm_switch)
++		platform_device_unregister(bp->adm_switch);
++}
++#else
++static int b44_register_adm_switch(struct b44 *bp)
++{
++	return 0;
++}
++static void b44_unregister_adm_switch(struct b44 *bp)
++{
++
++}
++#endif /* CONFIG_BCM47XX */
++
+ static int b44_register_phy_one(struct b44 *bp)
+ {
+ 	struct mii_bus *mii_bus;
+@@ -2283,6 +2349,9 @@ static int b44_register_phy_one(struct b
+ 	if (!bp->mii_bus->phy_map[bp->phy_addr] &&
+ 	    (sprom->boardflags_lo & (B44_BOARDFLAG_ROBO | B44_BOARDFLAG_ADM))) {
+ 
++		if (sprom->boardflags_lo & B44_BOARDFLAG_ADM)
++			b44_register_adm_switch(bp);
++
+ 		dev_info(sdev->dev,
+ 			 "could not find PHY at %i, use fixed one\n",
+ 			 bp->phy_addr);
+@@ -2479,6 +2548,7 @@ static void b44_remove_one(struct ssb_de
+ 	unregister_netdev(dev);
+ 	if (bp->flags & B44_FLAG_EXTERNAL_PHY)
+ 		b44_unregister_phy_one(bp);
++	b44_unregister_adm_switch(bp);
+ 	ssb_device_disable(sdev, 0);
+ 	ssb_bus_may_powerdown(sdev->bus);
+ 	netif_napi_del(&bp->napi);
+--- a/drivers/net/ethernet/broadcom/b44.h
++++ b/drivers/net/ethernet/broadcom/b44.h
+@@ -404,6 +404,9 @@ struct b44 {
+ 	struct mii_bus		*mii_bus;
+ 	int			old_link;
+ 	struct mii_if_info	mii_if;
++
++	/* platform device for associated switch */
++	struct platform_device *adm_switch;
+ };
+ 
+ #endif /* _B44_H */
diff --git a/target/linux/brcm47xx/patches-4.1/210-b44_phy_fix.patch b/target/linux/brcm47xx/patches-4.1/210-b44_phy_fix.patch
new file mode 100644
index 0000000..04f6832
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/210-b44_phy_fix.patch
@@ -0,0 +1,54 @@
+--- a/drivers/net/ethernet/broadcom/b44.c
++++ b/drivers/net/ethernet/broadcom/b44.c
+@@ -431,10 +431,34 @@ static void b44_wap54g10_workaround(stru
+ error:
+ 	pr_warn("PHY: cannot reset MII transceiver isolate bit\n");
+ }
++
++static void b44_bcm47xx_workarounds(struct b44 *bp)
++{
++	char buf[20];
++	struct ssb_device *sdev = bp->sdev;
++
++	/* Toshiba WRC-1000, Siemens SE505 v1, Askey RT-210W, RT-220W */
++	if (sdev->bus->sprom.board_num == 100) {
++		bp->phy_addr = B44_PHY_ADDR_NO_LOCAL_PHY;
++	} else {
++		/* WL-HDD */
++		if (bcm47xx_nvram_getenv("hardware_version", buf, sizeof(buf)) >= 0 &&
++		    !strncmp(buf, "WL300-", strlen("WL300-"))) {
++			if (sdev->bus->sprom.et0phyaddr == 0 &&
++			    sdev->bus->sprom.et1phyaddr == 1)
++				bp->phy_addr = B44_PHY_ADDR_NO_LOCAL_PHY;
++		}
++	}
++	return;
++}
+ #else
+ static inline void b44_wap54g10_workaround(struct b44 *bp)
+ {
+ }
++
++static inline void b44_bcm47xx_workarounds(struct b44 *bp)
++{
++}
+ #endif
+ 
+ static int b44_setup_phy(struct b44 *bp)
+@@ -443,6 +467,7 @@ static int b44_setup_phy(struct b44 *bp)
+ 	int err;
+ 
+ 	b44_wap54g10_workaround(bp);
++	b44_bcm47xx_workarounds(bp);
+ 
+ 	if (bp->flags & B44_FLAG_EXTERNAL_PHY)
+ 		return 0;
+@@ -2170,6 +2195,8 @@ static int b44_get_invariants(struct b44
+ 	 * valid PHY address. */
+ 	bp->phy_addr &= 0x1F;
+ 
++	b44_bcm47xx_workarounds(bp);
++
+ 	memcpy(bp->dev->dev_addr, addr, ETH_ALEN);
+ 
+ 	if (!is_valid_ether_addr(&bp->dev->dev_addr[0])){
diff --git a/target/linux/brcm47xx/patches-4.1/280-activate_ssb_support_in_usb.patch b/target/linux/brcm47xx/patches-4.1/280-activate_ssb_support_in_usb.patch
new file mode 100644
index 0000000..33fefdd
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/280-activate_ssb_support_in_usb.patch
@@ -0,0 +1,25 @@
+This prevents the options from being delete with make kernel_oldconfig.
+---
+ drivers/ssb/Kconfig |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/bcma/Kconfig
++++ b/drivers/bcma/Kconfig
+@@ -33,6 +33,7 @@ config BCMA_HOST_PCI
+ config BCMA_HOST_SOC
+ 	bool "Support for BCMA in a SoC"
+ 	depends on BCMA
++	select USB_HCD_BCMA if USB_EHCI_HCD || USB_OHCI_HCD
+ 	help
+ 	  Host interface for a Broadcom AIX bus directly mapped into
+ 	  the memory. This only works with the Broadcom SoCs from the
+--- a/drivers/ssb/Kconfig
++++ b/drivers/ssb/Kconfig
+@@ -147,6 +147,7 @@ config SSB_SFLASH
+ config SSB_EMBEDDED
+ 	bool
+ 	depends on SSB_DRIVER_MIPS && SSB_PCICORE_HOSTMODE
++	select USB_HCD_SSB if USB_EHCI_HCD || USB_OHCI_HCD
+ 	default y
+ 
+ config SSB_DRIVER_EXTIF
diff --git a/target/linux/brcm47xx/patches-4.1/300-fork_cacheflush.patch b/target/linux/brcm47xx/patches-4.1/300-fork_cacheflush.patch
new file mode 100644
index 0000000..0f79deb
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/300-fork_cacheflush.patch
@@ -0,0 +1,11 @@
+--- a/arch/mips/include/asm/cacheflush.h
++++ b/arch/mips/include/asm/cacheflush.h
+@@ -46,7 +46,7 @@
+ extern void (*flush_cache_all)(void);
+ extern void (*__flush_cache_all)(void);
+ extern void (*flush_cache_mm)(struct mm_struct *mm);
+-#define flush_cache_dup_mm(mm)	do { (void) (mm); } while (0)
++#define flush_cache_dup_mm(mm) flush_cache_mm(mm)
+ extern void (*flush_cache_range)(struct vm_area_struct *vma,
+ 	unsigned long start, unsigned long end);
+ extern void (*flush_cache_page)(struct vm_area_struct *vma, unsigned long page, unsigned long pfn);
diff --git a/target/linux/brcm47xx/patches-4.1/310-no_highpage.patch b/target/linux/brcm47xx/patches-4.1/310-no_highpage.patch
new file mode 100644
index 0000000..5598aae
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/310-no_highpage.patch
@@ -0,0 +1,64 @@
+--- a/arch/mips/include/asm/page.h
++++ b/arch/mips/include/asm/page.h
+@@ -71,6 +71,7 @@ static inline unsigned int page_size_ftl
+ #endif /* CONFIG_MIPS_HUGE_TLB_SUPPORT */
+ 
+ #include <linux/pfn.h>
++#include <asm/cpu-features.h>
+ 
+ extern void build_clear_page(void);
+ extern void build_copy_page(void);
+@@ -105,11 +106,16 @@ static inline void clear_user_page(void
+ 		flush_data_cache_page((unsigned long)addr);
+ }
+ 
+-struct vm_area_struct;
+-extern void copy_user_highpage(struct page *to, struct page *from,
+-	unsigned long vaddr, struct vm_area_struct *vma);
++static inline void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
++	struct page *to)
++{
++	extern void (*flush_data_cache_page)(unsigned long addr);
+ 
+-#define __HAVE_ARCH_COPY_USER_HIGHPAGE
++	copy_page(vto, vfrom);
++	if (!cpu_has_ic_fills_f_dc ||
++	    pages_do_alias((unsigned long)vto, vaddr & PAGE_MASK))
++		flush_data_cache_page((unsigned long)vto);
++}
+ 
+ /*
+  * These are used to make use of C type-checking..
+--- a/arch/mips/mm/init.c
++++ b/arch/mips/mm/init.c
+@@ -154,30 +154,6 @@ void kunmap_coherent(void)
+ 	pagefault_enable();
+ }
+ 
+-void copy_user_highpage(struct page *to, struct page *from,
+-	unsigned long vaddr, struct vm_area_struct *vma)
+-{
+-	void *vfrom, *vto;
+-
+-	vto = kmap_atomic(to);
+-	if (cpu_has_dc_aliases && cpu_use_kmap_coherent &&
+-	    page_mapped(from) && !Page_dcache_dirty(from)) {
+-		vfrom = kmap_coherent(from, vaddr);
+-		copy_page(vto, vfrom);
+-		kunmap_coherent();
+-	} else {
+-		vfrom = kmap_atomic(from);
+-		copy_page(vto, vfrom);
+-		kunmap_atomic(vfrom);
+-	}
+-	if ((!cpu_has_ic_fills_f_dc) ||
+-	    pages_do_alias((unsigned long)vto, vaddr & PAGE_MASK))
+-		flush_data_cache_page((unsigned long)vto);
+-	kunmap_atomic(vto);
+-	/* Make sure this page is cleared on other CPU's too before using it */
+-	smp_wmb();
+-}
+-
+ void copy_to_user_page(struct vm_area_struct *vma,
+ 	struct page *page, unsigned long vaddr, void *dst, const void *src,
+ 	unsigned long len)
diff --git a/target/linux/brcm47xx/patches-4.1/320-MIPS-BCM47XX-Devices-database-update-for-4.x.patch b/target/linux/brcm47xx/patches-4.1/320-MIPS-BCM47XX-Devices-database-update-for-4.x.patch
new file mode 100644
index 0000000..e19a458
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/320-MIPS-BCM47XX-Devices-database-update-for-4.x.patch
@@ -0,0 +1,204 @@
+--- a/arch/mips/bcm47xx/board.c
++++ b/arch/mips/bcm47xx/board.c
+@@ -140,6 +140,7 @@ struct bcm47xx_board_type_list2 bcm47xx_
+ 	{{BCM47XX_BOARD_LINKSYS_WRT300NV11, "Linksys WRT300N V1.1"}, "WRT300N", "1.1"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRT310NV1, "Linksys WRT310N V1"}, "WRT310N", "1.0"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRT310NV2, "Linksys WRT310N V2"}, "WRT310N", "2.0"},
++	{{BCM47XX_BOARD_LINKSYS_WRT320N_V1, "Linksys WRT320N V1"}, "WRT320N", "1.0"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRT54G3GV2, "Linksys WRT54G3GV2-VF"}, "WRT54G3GV2-VF", "1.0"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRT610NV1, "Linksys WRT610N V1"}, "WRT610N", "1.0"},
+ 	{{BCM47XX_BOARD_LINKSYS_WRT610NV2, "Linksys WRT610N V2"}, "WRT610N", "2.0"},
+@@ -150,6 +151,7 @@ struct bcm47xx_board_type_list2 bcm47xx_
+ static const
+ struct bcm47xx_board_type_list1 bcm47xx_board_list_board_id[] __initconst = {
+ 	{{BCM47XX_BOARD_LUXUL_XWR_1750_V1, "Luxul XWR-1750 V1"}, "luxul_xwr1750_v1"},
++	{{BCM47XX_BOARD_NETGEAR_R6300_V1, "Netgear R6300 V1"}, "U12H218T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614V8, "Netgear WGR614 V8"}, "U12H072T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614V9, "Netgear WGR614 V9"}, "U12H094T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614_V10, "Netgear WGR614 V10"}, "U12H139T01_NETGEAR"},
+@@ -162,6 +164,7 @@ struct bcm47xx_board_type_list1 bcm47xx_
+ 	{{BCM47XX_BOARD_NETGEAR_WNDR4000, "Netgear WNDR4000"}, "U12H181T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNDR4500V1, "Netgear WNDR4500 V1"}, "U12H189T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNDR4500V2, "Netgear WNDR4500 V2"}, "U12H224T00_NETGEAR"},
++	{{BCM47XX_BOARD_NETGEAR_WNR1000_V3, "Netgear WNR1000 V3"}, "U12H139T50_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNR2000, "Netgear WNR2000"}, "U12H114T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNR3500L, "Netgear WNR3500L"}, "U12H136T99_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WNR3500U, "Netgear WNR3500U"}, "U12H136T00_NETGEAR"},
+--- a/arch/mips/bcm47xx/buttons.c
++++ b/arch/mips/bcm47xx/buttons.c
+@@ -20,6 +20,12 @@
+ /* Asus */
+ 
+ static const struct gpio_keys_button
++bcm47xx_buttons_asus_rtn10u[] __initconst = {
++	BCM47XX_GPIO_KEY(20, KEY_WPS_BUTTON),
++	BCM47XX_GPIO_KEY(21, KEY_RESTART),
++};
++
++static const struct gpio_keys_button
+ bcm47xx_buttons_asus_rtn12[] __initconst = {
+ 	BCM47XX_GPIO_KEY(0, KEY_WPS_BUTTON),
+ 	BCM47XX_GPIO_KEY(1, KEY_RESTART),
+@@ -270,6 +276,18 @@ bcm47xx_buttons_linksys_wrt310nv1[] __in
+ };
+ 
+ static const struct gpio_keys_button
++bcm47xx_buttons_linksys_wrt310n_v2[] __initconst = {
++	BCM47XX_GPIO_KEY(5, KEY_WPS_BUTTON),
++	BCM47XX_GPIO_KEY(6, KEY_RESTART),
++};
++
++static const struct gpio_keys_button
++bcm47xx_buttons_linksys_wrt320n_v1[] __initconst = {
++	BCM47XX_GPIO_KEY(5, KEY_WPS_BUTTON),
++	BCM47XX_GPIO_KEY(8, KEY_RESTART),
++};
++
++static const struct gpio_keys_button
+ bcm47xx_buttons_linksys_wrt54g3gv2[] __initconst = {
+ 	BCM47XX_GPIO_KEY(5, KEY_WIMAX),
+ 	BCM47XX_GPIO_KEY(6, KEY_RESTART),
+@@ -333,6 +351,11 @@ bcm47xx_buttons_motorola_wr850gv2v3[] __
+ /* Netgear */
+ 
+ static const struct gpio_keys_button
++bcm47xx_buttons_netgear_r6300_v1[] __initconst = {
++	BCM47XX_GPIO_KEY(6, KEY_RESTART),
++};
++
++static const struct gpio_keys_button
+ bcm47xx_buttons_netgear_wndr3400v1[] __initconst = {
+ 	BCM47XX_GPIO_KEY(4, KEY_RESTART),
+ 	BCM47XX_GPIO_KEY(6, KEY_WPS_BUTTON),
+@@ -360,6 +383,11 @@ bcm47xx_buttons_netgear_wndr4500v1[] __i
+ };
+ 
+ static const struct gpio_keys_button
++bcm47xx_buttons_netgear_wnr1000_v3[] __initconst = {
++	BCM47XX_GPIO_KEY(3, KEY_RESTART),
++};
++
++static const struct gpio_keys_button
+ bcm47xx_buttons_netgear_wnr3500lv1[] __initconst = {
+ 	BCM47XX_GPIO_KEY(4, KEY_RESTART),
+ 	BCM47XX_GPIO_KEY(6, KEY_WPS_BUTTON),
+@@ -414,6 +442,9 @@ int __init bcm47xx_buttons_register(void
+ 	int err;
+ 
+ 	switch (board) {
++	case BCM47XX_BOARD_ASUS_RTN10U:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_rtn10u);
++		break;
+ 	case BCM47XX_BOARD_ASUS_RTN12:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_rtn12);
+ 		break;
+@@ -544,6 +575,12 @@ int __init bcm47xx_buttons_register(void
+ 	case BCM47XX_BOARD_LINKSYS_WRT310NV1:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt310nv1);
+ 		break;
++	case BCM47XX_BOARD_LINKSYS_WRT310NV2:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt310n_v2);
++		break;
++	case BCM47XX_BOARD_LINKSYS_WRT320N_V1:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt320n_v1);
++		break;
+ 	case BCM47XX_BOARD_LINKSYS_WRT54G3GV2:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt54g3gv2);
+ 		break;
+@@ -580,6 +617,9 @@ int __init bcm47xx_buttons_register(void
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_motorola_wr850gv2v3);
+ 		break;
+ 
++	case BCM47XX_BOARD_NETGEAR_R6300_V1:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_r6300_v1);
++		break;
+ 	case BCM47XX_BOARD_NETGEAR_WNDR3400V1:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wndr3400v1);
+ 		break;
+@@ -592,6 +632,9 @@ int __init bcm47xx_buttons_register(void
+ 	case BCM47XX_BOARD_NETGEAR_WNDR4500V1:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wndr4500v1);
+ 		break;
++	case BCM47XX_BOARD_NETGEAR_WNR1000_V3:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wnr1000_v3);
++		break;
+ 	case BCM47XX_BOARD_NETGEAR_WNR3500L:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_netgear_wnr3500lv1);
+ 		break;
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
+@@ -71,6 +71,7 @@ enum bcm47xx_board {
+ 	BCM47XX_BOARD_LINKSYS_WRT300NV11,
+ 	BCM47XX_BOARD_LINKSYS_WRT310NV1,
+ 	BCM47XX_BOARD_LINKSYS_WRT310NV2,
++	BCM47XX_BOARD_LINKSYS_WRT320N_V1,
+ 	BCM47XX_BOARD_LINKSYS_WRT54G3GV2,
+ 	BCM47XX_BOARD_LINKSYS_WRT54G_TYPE_0101,
+ 	BCM47XX_BOARD_LINKSYS_WRT54G_TYPE_0467,
+@@ -88,6 +89,7 @@ enum bcm47xx_board {
+ 	BCM47XX_BOARD_MOTOROLA_WR850GP,
+ 	BCM47XX_BOARD_MOTOROLA_WR850GV2V3,
+ 
++	BCM47XX_BOARD_NETGEAR_R6300_V1,
+ 	BCM47XX_BOARD_NETGEAR_WGR614V8,
+ 	BCM47XX_BOARD_NETGEAR_WGR614V9,
+ 	BCM47XX_BOARD_NETGEAR_WGR614_V10,
+@@ -100,6 +102,7 @@ enum bcm47xx_board {
+ 	BCM47XX_BOARD_NETGEAR_WNDR4000,
+ 	BCM47XX_BOARD_NETGEAR_WNDR4500V1,
+ 	BCM47XX_BOARD_NETGEAR_WNDR4500V2,
++	BCM47XX_BOARD_NETGEAR_WNR1000_V3,
+ 	BCM47XX_BOARD_NETGEAR_WNR2000,
+ 	BCM47XX_BOARD_NETGEAR_WNR3500L,
+ 	BCM47XX_BOARD_NETGEAR_WNR3500U,
+--- a/arch/mips/bcm47xx/leds.c
++++ b/arch/mips/bcm47xx/leds.c
+@@ -29,6 +29,14 @@
+ /* Asus */
+ 
+ static const struct gpio_led
++bcm47xx_leds_asus_rtn10u[] __initconst = {
++	BCM47XX_GPIO_LED(5, "green", "wlan", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(6, "green", "power", 1, LEDS_GPIO_DEFSTATE_ON),
++	BCM47XX_GPIO_LED(7, "green", "wps", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(8, "green", "usb", 0, LEDS_GPIO_DEFSTATE_OFF),
++};
++
++static const struct gpio_led
+ bcm47xx_leds_asus_rtn12[] __initconst = {
+ 	BCM47XX_GPIO_LED(2, "unk", "power", 1, LEDS_GPIO_DEFSTATE_ON),
+ 	BCM47XX_GPIO_LED(7, "unk", "wlan", 0, LEDS_GPIO_DEFSTATE_OFF),
+@@ -313,6 +321,13 @@ bcm47xx_leds_linksys_wrt310nv1[] __initc
+ };
+ 
+ static const struct gpio_led
++bcm47xx_leds_linksys_wrt320n_v1[] __initconst = {
++	BCM47XX_GPIO_LED(1, "blue", "wlan", 1, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(2, "blue", "power", 0, LEDS_GPIO_DEFSTATE_ON),
++	BCM47XX_GPIO_LED(4, "amber", "wps", 1, LEDS_GPIO_DEFSTATE_OFF),
++};
++
++static const struct gpio_led
+ bcm47xx_leds_linksys_wrt54g_generic[] __initconst = {
+ 	BCM47XX_GPIO_LED(0, "unk", "dmz", 1, LEDS_GPIO_DEFSTATE_OFF),
+ 	BCM47XX_GPIO_LED(1, "unk", "power", 0, LEDS_GPIO_DEFSTATE_ON),
+@@ -478,6 +493,9 @@ void __init bcm47xx_leds_register(void)
+ 	enum bcm47xx_board board = bcm47xx_board_get();
+ 
+ 	switch (board) {
++	case BCM47XX_BOARD_ASUS_RTN10U:
++		bcm47xx_set_pdata(bcm47xx_leds_asus_rtn10u);
++		break;
+ 	case BCM47XX_BOARD_ASUS_RTN12:
+ 		bcm47xx_set_pdata(bcm47xx_leds_asus_rtn12);
+ 		break;
+@@ -611,6 +629,9 @@ void __init bcm47xx_leds_register(void)
+ 	case BCM47XX_BOARD_LINKSYS_WRT310NV1:
+ 		bcm47xx_set_pdata(bcm47xx_leds_linksys_wrt310nv1);
+ 		break;
++	case BCM47XX_BOARD_LINKSYS_WRT320N_V1:
++		bcm47xx_set_pdata(bcm47xx_leds_linksys_wrt320n_v1);
++		break;
+ 	case BCM47XX_BOARD_LINKSYS_WRT54G3GV2:
+ 		bcm47xx_set_pdata(bcm47xx_leds_linksys_wrt54g3gv2);
+ 		break;
diff --git a/target/linux/brcm47xx/patches-4.1/400-mtd-bcm47xxpart-get-nvram.patch b/target/linux/brcm47xx/patches-4.1/400-mtd-bcm47xxpart-get-nvram.patch
new file mode 100644
index 0000000..df51191
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/400-mtd-bcm47xxpart-get-nvram.patch
@@ -0,0 +1,34 @@
+--- a/drivers/mtd/bcm47xxpart.c
++++ b/drivers/mtd/bcm47xxpart.c
+@@ -97,6 +97,7 @@ static int bcm47xxpart_parse(struct mtd_
+ 	int trx_part = -1;
+ 	int last_trx_part = -1;
+ 	int possible_nvram_sizes[] = { 0x8000, 0xF000, 0x10000, };
++	bool found_nvram = false;
+ 
+ 	/*
+ 	 * Some really old flashes (like AT45DB*) had smaller erasesize-s, but
+@@ -300,12 +301,23 @@ static int bcm47xxpart_parse(struct mtd_
+ 		if (buf[0] == NVRAM_HEADER) {
+ 			bcm47xxpart_add_part(&parts[curr_part++], "nvram",
+ 					     master->size - blocksize, 0);
++			found_nvram = true;
+ 			break;
+ 		}
+ 	}
+ 
+ 	kfree(buf);
+ 
++	if (!found_nvram) {
++		pr_err("can not find a nvram partition reserve last block\n");
++		bcm47xxpart_add_part(&parts[curr_part++], "nvram_guess",
++				     master->size - blocksize * 2, MTD_WRITEABLE);
++		for (i = 0; i < curr_part; i++) {
++			if (parts[i].size + parts[i].offset == master->size)
++				parts[i].offset -= blocksize * 2;
++		}
++	}
++
+ 	/*
+ 	 * Assume that partitions end at the beginning of the one they are
+ 	 * followed by.
diff --git a/target/linux/brcm47xx/patches-4.1/610-pci_ide_fix.patch b/target/linux/brcm47xx/patches-4.1/610-pci_ide_fix.patch
new file mode 100644
index 0000000..76751e8
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/610-pci_ide_fix.patch
@@ -0,0 +1,14 @@
+--- a/include/linux/ide.h
++++ b/include/linux/ide.h
+@@ -191,7 +191,11 @@ static inline void ide_std_init_ports(st
+ 	hw->io_ports.ctl_addr = ctl_addr;
+ }
+ 
++#if defined CONFIG_BCM47XX
++# define MAX_HWIFS	2
++#else
+ #define MAX_HWIFS	10
++#endif
+ 
+ /*
+  * Now for the data we need to maintain per-drive:  ide_drive_t
diff --git a/target/linux/brcm47xx/patches-4.1/791-tg3-no-pci-sleep.patch b/target/linux/brcm47xx/patches-4.1/791-tg3-no-pci-sleep.patch
new file mode 100644
index 0000000..35a816d
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/791-tg3-no-pci-sleep.patch
@@ -0,0 +1,17 @@
+When the Ethernet controller is powered down and someone wants to 
+access the mdio bus like the witch driver (b53) the system crashed if 
+PCI_D3hot was set before. This patch deactivates this power sawing mode 
+when a switch driver is in use.
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -4263,7 +4263,8 @@ static int tg3_power_down_prepare(struct
+ static void tg3_power_down(struct tg3 *tp)
+ {
+ 	pci_wake_from_d3(tp->pdev, tg3_flag(tp, WOL_ENABLE));
+-	pci_set_power_state(tp->pdev, PCI_D3hot);
++	if (!tg3_flag(tp, ROBOSWITCH))
++		pci_set_power_state(tp->pdev, PCI_D3hot);
+ }
+ 
+ static void tg3_aux_stat_to_speed_duplex(struct tg3 *tp, u32 val, u16 *speed, u8 *duplex)
diff --git a/target/linux/brcm47xx/patches-4.1/800-bcma-add-table-of-serial-flashes-with-smaller-blocks.patch b/target/linux/brcm47xx/patches-4.1/800-bcma-add-table-of-serial-flashes-with-smaller-blocks.patch
new file mode 100644
index 0000000..99d909b
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/800-bcma-add-table-of-serial-flashes-with-smaller-blocks.patch
@@ -0,0 +1,73 @@
+From 597715c61ae75a05ab3310a34ff3857a006f0f63 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Thu, 20 Nov 2014 21:32:42 +0100
+Subject: [PATCH] bcma: add table of serial flashes with smaller blocks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+---
+ drivers/bcma/driver_chipcommon_sflash.c | 29 +++++++++++++++++++++++++++++
+ 1 file changed, 29 insertions(+)
+
+--- a/drivers/bcma/driver_chipcommon_sflash.c
++++ b/drivers/bcma/driver_chipcommon_sflash.c
+@@ -9,6 +9,7 @@
+ 
+ #include <linux/platform_device.h>
+ #include <linux/bcma/bcma.h>
++#include <bcm47xx_board.h>
+ 
+ static struct resource bcma_sflash_resource = {
+ 	.name	= "bcma_sflash",
+@@ -41,6 +42,13 @@ static const struct bcma_sflash_tbl_e bc
+ 	{ NULL },
+ };
+ 
++/* Some devices use smaller blocks (and have more of them) */
++static const struct bcma_sflash_tbl_e bcma_sflash_st_shrink_tbl[] = {
++	{ "M25P16", 0x14, 0x1000, 512, },
++	{ "M25P32", 0x15, 0x1000, 1024, },
++	{ NULL },
++};
++
+ static const struct bcma_sflash_tbl_e bcma_sflash_sst_tbl[] = {
+ 	{ "SST25WF512", 1, 0x1000, 16, },
+ 	{ "SST25VF512", 0x48, 0x1000, 16, },
+@@ -84,6 +92,24 @@ static void bcma_sflash_cmd(struct bcma_
+ 	bcma_err(cc->core->bus, "SFLASH control command failed (timeout)!\n");
+ }
+ 
++const struct bcma_sflash_tbl_e *bcma_sflash_shrink_flash(u32 id)
++{
++	enum bcm47xx_board board = bcm47xx_board_get();
++	const struct bcma_sflash_tbl_e *e;
++
++	switch (board) {
++	case BCM47XX_BOARD_NETGEAR_WGR614_V10:
++	case BCM47XX_BOARD_NETGEAR_WNR1000_V3:
++		for (e = bcma_sflash_st_shrink_tbl; e->name; e++) {
++			if (e->id == id)
++				return e;
++		}
++		return NULL;
++	default:
++		return NULL;
++	}
++}
++
+ /* Initialize serial flash access */
+ int bcma_sflash_init(struct bcma_drv_cc *cc)
+ {
+@@ -114,6 +140,10 @@ int bcma_sflash_init(struct bcma_drv_cc
+ 		case 0x13:
+ 			return -ENOTSUPP;
+ 		default:
++			e = bcma_sflash_shrink_flash(id);
++			if (e)
++				break;
++
+ 			for (e = bcma_sflash_st_tbl; e->name; e++) {
+ 				if (e->id == id)
+ 					break;
diff --git a/target/linux/brcm47xx/patches-4.1/820-wgt634u-nvram-fix.patch b/target/linux/brcm47xx/patches-4.1/820-wgt634u-nvram-fix.patch
new file mode 100644
index 0000000..4738c22
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/820-wgt634u-nvram-fix.patch
@@ -0,0 +1,295 @@
+The Netgear wgt634u uses a different format for storing the 
+configuration. This patch is needed to read out the correct 
+configuration. The cfe_env.c file uses a different method way to read 
+out the configuration than the in kernel cfe config reader.
+
+--- a/arch/mips/bcm47xx/Makefile
++++ b/arch/mips/bcm47xx/Makefile
+@@ -5,3 +5,4 @@
+ 
+ obj-y				+= irq.o nvram.o prom.o serial.o setup.o time.o sprom.o
+ obj-y				+= board.o buttons.o leds.o workarounds.o
++obj-y				+= cfe_env.o
+--- /dev/null
++++ b/arch/mips/bcm47xx/cfe_env.c
+@@ -0,0 +1,228 @@
++/*
++ * CFE environment variable access
++ *
++ * Copyright 2001-2003, Broadcom Corporation
++ * Copyright 2006, Felix Fietkau <nbd@openwrt.org>
++ * 
++ * This program is free software; you can redistribute  it and/or modify it
++ * under  the terms of  the GNU General  Public License as published by the
++ * Free Software Foundation;  either version 2 of the  License, or (at your
++ * option) any later version.
++ */
++
++#include <linux/init.h>
++#include <linux/module.h>
++#include <linux/kernel.h>
++#include <linux/string.h>
++#include <asm/io.h>
++#include <asm/uaccess.h>
++
++#define NVRAM_SIZE       (0x1ff0)
++static char _nvdata[NVRAM_SIZE];
++static char _valuestr[256];
++
++/*
++ * TLV types.  These codes are used in the "type-length-value"
++ * encoding of the items stored in the NVRAM device (flash or EEPROM)
++ *
++ * The layout of the flash/nvram is as follows:
++ *
++ * <type> <length> <data ...> <type> <length> <data ...> <type_end>
++ *
++ * The type code of "ENV_TLV_TYPE_END" marks the end of the list.
++ * The "length" field marks the length of the data section, not
++ * including the type and length fields.
++ *
++ * Environment variables are stored as follows:
++ *
++ * <type_env> <length> <flags> <name> = <value>
++ *
++ * If bit 0 (low bit) is set, the length is an 8-bit value.
++ * If bit 0 (low bit) is clear, the length is a 16-bit value
++ * 
++ * Bit 7 set indicates "user" TLVs.  In this case, bit 0 still
++ * indicates the size of the length field.  
++ *
++ * Flags are from the constants below:
++ *
++ */
++#define ENV_LENGTH_16BITS	0x00	/* for low bit */
++#define ENV_LENGTH_8BITS	0x01
++
++#define ENV_TYPE_USER		0x80
++
++#define ENV_CODE_SYS(n,l) (((n)<<1)|(l))
++#define ENV_CODE_USER(n,l) ((((n)<<1)|(l)) | ENV_TYPE_USER)
++
++/*
++ * The actual TLV types we support
++ */
++
++#define ENV_TLV_TYPE_END	0x00	
++#define ENV_TLV_TYPE_ENV	ENV_CODE_SYS(0,ENV_LENGTH_8BITS)
++
++/*
++ * Environment variable flags 
++ */
++
++#define ENV_FLG_NORMAL		0x00	/* normal read/write */
++#define ENV_FLG_BUILTIN		0x01	/* builtin - not stored in flash */
++#define ENV_FLG_READONLY	0x02	/* read-only - cannot be changed */
++
++#define ENV_FLG_MASK		0xFF	/* mask of attributes we keep */
++#define ENV_FLG_ADMIN		0x100	/* lets us internally override permissions */
++
++
++/*  *********************************************************************
++    *  _nvram_read(buffer,offset,length)
++    *  
++    *  Read data from the NVRAM device
++    *  
++    *  Input parameters: 
++    *  	   buffer - destination buffer
++    *  	   offset - offset of data to read
++    *  	   length - number of bytes to read
++    *  	   
++    *  Return value:
++    *  	   number of bytes read, or <0 if error occured
++    ********************************************************************* */
++static int
++_nvram_read(unsigned char *nv_buf, unsigned char *buffer, int offset, int length)
++{
++    int i;
++    if (offset > NVRAM_SIZE)
++	return -1; 
++
++    for ( i = 0; i < length; i++) {
++	buffer[i] = ((volatile unsigned char*)nv_buf)[offset + i];
++    }
++    return length;
++}
++
++
++static char*
++_strnchr(const char *dest,int c,size_t cnt)
++{
++	while (*dest && (cnt > 0)) {
++	if (*dest == c) return (char *) dest;
++	dest++;
++	cnt--;
++	}
++	return NULL;
++}
++
++
++
++/*
++ * Core support API: Externally visible.
++ */
++
++/*
++ * Get the value of an NVRAM variable
++ * @param	name	name of variable to get
++ * @return	value of variable or NULL if undefined
++ */
++
++char *cfe_env_get(unsigned char *nv_buf, const char *name)
++{
++    int size;
++    unsigned char *buffer;
++    unsigned char *ptr;
++    unsigned char *envval;
++    unsigned int reclen;
++    unsigned int rectype;
++    int offset;
++    int flg;
++    
++	if (!strcmp(name, "nvram_type"))
++		return "cfe";
++	
++    size = NVRAM_SIZE;
++    buffer = &_nvdata[0];
++
++    ptr = buffer;
++    offset = 0;
++
++    /* Read the record type and length */
++    if (_nvram_read(nv_buf, ptr,offset,1) != 1) {
++	goto error;
++    }
++    
++    while ((*ptr != ENV_TLV_TYPE_END)  && (size > 1)) {
++
++	/* Adjust pointer for TLV type */
++	rectype = *(ptr);
++	offset++;
++	size--;
++
++	/* 
++	 * Read the length.  It can be either 1 or 2 bytes
++	 * depending on the code 
++	 */
++	if (rectype & ENV_LENGTH_8BITS) {
++	    /* Read the record type and length - 8 bits */
++	    if (_nvram_read(nv_buf, ptr,offset,1) != 1) {
++		goto error;
++	    }
++	    reclen = *(ptr);
++	    size--;
++	    offset++;
++	}
++	else {
++	    /* Read the record type and length - 16 bits, MSB first */
++	    if (_nvram_read(nv_buf, ptr,offset,2) != 2) {
++		goto error;
++	    }
++	    reclen = (((unsigned int) *(ptr)) << 8) + (unsigned int) *(ptr+1);
++	    size -= 2;
++	    offset += 2;
++	}
++
++	if (reclen > size)
++	    break;	/* should not happen, bad NVRAM */
++
++	switch (rectype) {
++	    case ENV_TLV_TYPE_ENV:
++		/* Read the TLV data */
++		if (_nvram_read(nv_buf, ptr,offset,reclen) != reclen)
++		    goto error;
++		flg = *ptr++;
++		envval = (unsigned char *) _strnchr(ptr,'=',(reclen-1));
++		if (envval) {
++		    *envval++ = '\0';
++		    memcpy(_valuestr,envval,(reclen-1)-(envval-ptr));
++		    _valuestr[(reclen-1)-(envval-ptr)] = '\0';
++#if 0			
++		    printk(KERN_INFO "NVRAM:%s=%s\n", ptr, _valuestr);
++#endif
++		    if(!strcmp(ptr, name)){
++			return _valuestr;
++		    }
++		    if((strlen(ptr) > 1) && !strcmp(&ptr[1], name))
++			return _valuestr;
++		}
++		break;
++		
++	    default: 
++		/* Unknown TLV type, skip it. */
++		break;
++	    }
++
++	/*
++	 * Advance to next TLV 
++	 */
++		
++	size -= (int)reclen;
++	offset += reclen;
++
++	/* Read the next record type */
++	ptr = buffer;
++	if (_nvram_read(nv_buf, ptr,offset,1) != 1)
++	    goto error;
++	}
++
++error:
++    return NULL;
++
++}
++
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -37,6 +37,8 @@ struct nvram_header {
+ static char nvram_buf[NVRAM_SPACE];
+ static size_t nvram_len;
+ static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
++static int cfe_env;
++extern char *cfe_env_get(char *nv_buf, const char *name);
+ 
+ static u32 find_nvram_size(void __iomem *end)
+ {
+@@ -66,6 +68,26 @@ static int nvram_find_and_copy(void __io
+ 		return -EEXIST;
+ 	}
+ 
++	cfe_env = 0;
++
++	/* XXX: hack for supporting the CFE environment stuff on WGT634U */
++	if (lim >= 8 * 1024 * 1024) {
++		src = (u32 *)(iobase + 8 * 1024 * 1024 - 0x2000);
++		dst = (u32 *)nvram_buf;
++
++		if ((*src & 0xff00ff) == 0x000001) {
++			printk("early_nvram_init: WGT634U NVRAM found.\n");
++
++			for (i = 0; i < 0x1ff0; i++) {
++				if (*src == 0xFFFFFFFF)
++					break;
++				*dst++ = *src++;
++			}
++			cfe_env = 1;
++			return 0;
++		}
++	}
++
+ 	/* TODO: when nvram is on nand flash check for bad blocks first. */
+ 	off = FLASH_MIN;
+ 	while (off <= lim) {
+@@ -180,6 +202,13 @@ int bcm47xx_nvram_getenv(const char *nam
+ 	if (!name)
+ 		return -EINVAL;
+ 
++	if (cfe_env) {
++		value = cfe_env_get(nvram_buf, name);
++		if (!value)
++			return -ENOENT;
++		return snprintf(val, val_len, "%s", value);
++	}
++
+ 	if (!nvram_len) {
+ 		err = nvram_init();
+ 		if (err)
diff --git a/target/linux/brcm47xx/patches-4.1/830-huawei_e970_support.patch b/target/linux/brcm47xx/patches-4.1/830-huawei_e970_support.patch
new file mode 100644
index 0000000..fdb6c19
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/830-huawei_e970_support.patch
@@ -0,0 +1,101 @@
+--- a/arch/mips/bcm47xx/setup.c
++++ b/arch/mips/bcm47xx/setup.c
+@@ -36,6 +36,7 @@
+ #include <linux/ssb/ssb.h>
+ #include <linux/ssb/ssb_embedded.h>
+ #include <linux/bcma/bcma_soc.h>
++#include <linux/old_gpio_wdt.h>
+ #include <asm/bootinfo.h>
+ #include <asm/idle.h>
+ #include <asm/prom.h>
+@@ -245,6 +246,33 @@ static struct fixed_phy_status bcm47xx_f
+ 	.duplex	= DUPLEX_FULL,
+ };
+ 
++static struct gpio_wdt_platform_data gpio_wdt_data;
++
++static struct platform_device gpio_wdt_device = {
++	.name			= "gpio-wdt",
++	.id			= 0,
++	.dev			= {
++		.platform_data	= &gpio_wdt_data,
++	},
++};
++
++static int __init bcm47xx_register_gpio_watchdog(void)
++{
++	enum bcm47xx_board board = bcm47xx_board_get();
++
++	switch (board) {
++	case BCM47XX_BOARD_HUAWEI_E970:
++		pr_info("bcm47xx: detected Huawei E970 or similar, starting early gpio_wdt timer\n");
++		gpio_wdt_data.gpio = 7;
++		gpio_wdt_data.interval = HZ;
++		gpio_wdt_data.first_interval = HZ / 5;
++		return platform_device_register(&gpio_wdt_device);
++	default:
++		/* Nothing to do */
++		return 0;
++	}
++}
++
+ static int __init bcm47xx_register_bus_complete(void)
+ {
+ 	switch (bcm47xx_bus_type) {
+@@ -264,6 +292,7 @@ static int __init bcm47xx_register_bus_c
+ 	bcm47xx_workarounds();
+ 
+ 	fixed_phy_add(PHY_POLL, 0, &bcm47xx_fixed_phy_status);
++	bcm47xx_register_gpio_watchdog();
+ 	return 0;
+ }
+ device_initcall(bcm47xx_register_bus_complete);
+--- a/arch/mips/configs/bcm47xx_defconfig
++++ b/arch/mips/configs/bcm47xx_defconfig
+@@ -67,6 +67,7 @@ CONFIG_HW_RANDOM=y
+ CONFIG_GPIO_SYSFS=y
+ CONFIG_WATCHDOG=y
+ CONFIG_BCM47XX_WDT=y
++CONFIG_GPIO_WDT=y
+ CONFIG_SSB_DEBUG=y
+ CONFIG_SSB_DRIVER_GIGE=y
+ CONFIG_BCMA_DRIVER_GMAC_CMN=y
+--- a/drivers/ssb/embedded.c
++++ b/drivers/ssb/embedded.c
+@@ -34,11 +34,36 @@ int ssb_watchdog_timer_set(struct ssb_bu
+ }
+ EXPORT_SYMBOL(ssb_watchdog_timer_set);
+ 
++#ifdef CONFIG_BCM47XX
++#include <bcm47xx_board.h>
++
++static bool ssb_watchdog_supported(void)
++{
++	enum bcm47xx_board board = bcm47xx_board_get();
++
++	/* The Huawei E970 has a hardware watchdog using a GPIO */
++	switch (board) {
++	case BCM47XX_BOARD_HUAWEI_E970:
++		return false;
++	default:
++		return true;
++	}
++}
++#else
++static bool ssb_watchdog_supported(void)
++{
++	return true;
++}
++#endif
++
+ int ssb_watchdog_register(struct ssb_bus *bus)
+ {
+ 	struct bcm47xx_wdt wdt = {};
+ 	struct platform_device *pdev;
+ 
++	if (!ssb_watchdog_supported())
++		return 0;
++
+ 	if (ssb_chipco_available(&bus->chipco)) {
+ 		wdt.driver_data = &bus->chipco;
+ 		wdt.timer_set = ssb_chipco_watchdog_timer_set_wdt;
diff --git a/target/linux/brcm47xx/patches-4.1/900-ssb-reject-PCI-writes-setting-CardBus-bridge-resourc.patch b/target/linux/brcm47xx/patches-4.1/900-ssb-reject-PCI-writes-setting-CardBus-bridge-resourc.patch
new file mode 100644
index 0000000..d7d2d7e
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/900-ssb-reject-PCI-writes-setting-CardBus-bridge-resourc.patch
@@ -0,0 +1,30 @@
+From 5c81397a0147ea59c778d1de14ef54e2268221f6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Wed, 8 Apr 2015 06:58:11 +0200
+Subject: [PATCH] ssb: reject PCI writes setting CardBus bridge resources
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+If SoC has a CardBus we can set resources of device at slot 1 only. It's
+impossigle to set bridge resources as it simply overwrites device 1
+configuration and usually results in Data bus error-s.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+---
+ drivers/ssb/driver_pcicore.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/ssb/driver_pcicore.c
++++ b/drivers/ssb/driver_pcicore.c
+@@ -164,6 +164,10 @@ static int ssb_extpci_write_config(struc
+ 	SSB_WARN_ON(!pc->hostmode);
+ 	if (unlikely(len != 1 && len != 2 && len != 4))
+ 		goto out;
++	/* CardBus SoCs allow configuring dev 1 resources only */
++	if (extpci_core->cardbusmode && dev != 1 &&
++	    off >= PCI_BASE_ADDRESS_0 && off <= PCI_BASE_ADDRESS_5)
++		goto out;
+ 	addr = get_cfgspace_addr(pc, bus, dev, func, off);
+ 	if (unlikely(!addr))
+ 		goto out;
diff --git a/target/linux/brcm47xx/patches-4.1/920-cache-wround.patch b/target/linux/brcm47xx/patches-4.1/920-cache-wround.patch
new file mode 100644
index 0000000..e26d98a
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/920-cache-wround.patch
@@ -0,0 +1,138 @@
+--- a/arch/mips/include/asm/r4kcache.h
++++ b/arch/mips/include/asm/r4kcache.h
+@@ -28,10 +28,28 @@ extern void (*r4k_blast_icache)(void);
+ #ifdef CONFIG_BCM47XX
+ #include <asm/paccess.h>
+ #include <linux/ssb/ssb.h>
+-#define BCM4710_DUMMY_RREG() ((void) *((u8 *) KSEG1ADDR(SSB_ENUM_BASE)))
++#define BCM4710_DUMMY_RREG() bcm4710_dummy_rreg()
++
++static inline unsigned long bcm4710_dummy_rreg(void)
++{
++      return *(volatile unsigned long *)(KSEG1ADDR(SSB_ENUM_BASE));
++}
++
++#define BCM4710_FILL_TLB(addr) bcm4710_fill_tlb((void *)(addr))
++
++static inline unsigned long bcm4710_fill_tlb(void *addr)
++{
++      return *(unsigned long *)addr;
++}
++
++#define BCM4710_PROTECTED_FILL_TLB(addr) bcm4710_protected_fill_tlb((void *)(addr))
++
++static inline void bcm4710_protected_fill_tlb(void *addr)
++{
++      unsigned long x;
++      get_dbe(x, (unsigned long *)addr);;
++}
+ 
+-#define BCM4710_FILL_TLB(addr) (*(volatile unsigned long *)(addr))
+-#define BCM4710_PROTECTED_FILL_TLB(addr) ({ unsigned long x; get_dbe(x, (volatile unsigned long *)(addr)); })
+ #else
+ #define BCM4710_DUMMY_RREG()
+ 
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -936,6 +936,9 @@ build_get_pgde32(u32 **p, unsigned int t
+ 		uasm_i_srl(p, ptr, ptr, SMP_CPUID_PTRSHIFT);
+ 		uasm_i_addu(p, ptr, tmp, ptr);
+ #else
++#ifdef CONFIG_BCM47XX
++		uasm_i_nop(p);
++#endif
+ 		UASM_i_LA_mostly(p, ptr, pgdc);
+ #endif
+ 		uasm_i_mfc0(p, tmp, C0_BADVADDR); /* get faulting address */
+@@ -1296,12 +1299,12 @@ static void build_r4000_tlb_refill_handl
+ 			/* No need for uasm_i_nop */
+ 		}
+ 
+-#ifdef CONFIG_BCM47XX
+-		uasm_i_nop(&p);
+-#endif
+ #ifdef CONFIG_64BIT
+ 		build_get_pmde64(&p, &l, &r, K0, K1); /* get pmd in K1 */
+ #else
++# ifdef CONFIG_BCM47XX
++		uasm_i_nop(&p);
++# endif
+ 		build_get_pgde32(&p, K0, K1); /* get pgd in K1 */
+ #endif
+ 
+@@ -1313,6 +1316,9 @@ static void build_r4000_tlb_refill_handl
+ 		build_update_entries(&p, K0, K1);
+ 		build_tlb_write_entry(&p, &l, &r, tlb_random);
+ 		uasm_l_leave(&l, p);
++#ifdef CONFIG_BCM47XX
++		uasm_i_nop(&p);
++#endif
+ 		uasm_i_eret(&p); /* return from trap */
+ 	}
+ #ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT
+@@ -1871,12 +1877,12 @@ build_r4000_tlbchange_handler_head(u32 *
+ {
+ 	struct work_registers wr = build_get_work_registers(p);
+ 
+-#ifdef CONFIG_BCM47XX
+-	uasm_i_nop(p);
+-#endif
+ #ifdef CONFIG_64BIT
+ 	build_get_pmde64(p, l, r, wr.r1, wr.r2); /* get pmd in ptr */
+ #else
++# ifdef CONFIG_BCM47XX
++	uasm_i_nop(p);
++# endif
+ 	build_get_pgde32(p, wr.r1, wr.r2); /* get pgd in ptr */
+ #endif
+ 
+@@ -1923,6 +1929,9 @@ build_r4000_tlbchange_handler_tail(u32 *
+ 	build_tlb_write_entry(p, l, r, tlb_indexed);
+ 	uasm_l_leave(l, *p);
+ 	build_restore_work_registers(p);
++#ifdef CONFIG_BCM47XX
++	uasm_i_nop(p);
++#endif
+ 	uasm_i_eret(p); /* return from trap */
+ 
+ #ifdef CONFIG_64BIT
+--- a/arch/mips/kernel/genex.S
++++ b/arch/mips/kernel/genex.S
+@@ -21,6 +21,19 @@
+ #include <asm/war.h>
+ #include <asm/thread_info.h>
+ 
++#ifdef CONFIG_BCM47XX
++# ifdef eret
++#  undef eret
++# endif
++# define eret 					\
++	.set push;				\
++	.set noreorder;				\
++	 nop; 					\
++	 nop;					\
++	 eret;					\
++	.set pop;
++#endif
++
+ 	__INIT
+ 
+ /*
+@@ -34,7 +47,6 @@ NESTED(except_vec3_generic, 0, sp)
+ 	.set	noat
+ #ifdef CONFIG_BCM47XX
+ 	nop
+-	nop
+ #endif
+ #if R5432_CP0_INTERRUPT_WAR
+ 	mfc0	k0, CP0_INDEX
+@@ -59,6 +71,9 @@ NESTED(except_vec3_r4000, 0, sp)
+ 	.set	push
+ 	.set	arch=r4000
+ 	.set	noat
++#ifdef CONFIG_BCM47XX
++	nop
++#endif
+ 	mfc0	k1, CP0_CAUSE
+ 	li	k0, 31<<2
+ 	andi	k1, k1, 0x7c
diff --git a/target/linux/brcm47xx/patches-4.1/940-bcm47xx-yenta.patch b/target/linux/brcm47xx/patches-4.1/940-bcm47xx-yenta.patch
new file mode 100644
index 0000000..77c10fc
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/940-bcm47xx-yenta.patch
@@ -0,0 +1,46 @@
+--- a/drivers/pcmcia/yenta_socket.c
++++ b/drivers/pcmcia/yenta_socket.c
+@@ -920,6 +920,8 @@ static unsigned int yenta_probe_irq(stru
+ 	 * Probe for usable interrupts using the force
+ 	 * register to generate bogus card status events.
+ 	 */
++#ifndef CONFIG_BCM47XX
++	/* WRT54G3G does not like this */
+ 	cb_writel(socket, CB_SOCKET_EVENT, -1);
+ 	cb_writel(socket, CB_SOCKET_MASK, CB_CSTSMASK);
+ 	reg = exca_readb(socket, I365_CSCINT);
+@@ -935,6 +937,7 @@ static unsigned int yenta_probe_irq(stru
+ 	}
+ 	cb_writel(socket, CB_SOCKET_MASK, 0);
+ 	exca_writeb(socket, I365_CSCINT, reg);
++#endif
+ 
+ 	mask = probe_irq_mask(val) & 0xffff;
+ 
+@@ -1019,6 +1022,10 @@ static void yenta_get_socket_capabilitie
+ 	else
+ 		socket->socket.irq_mask = 0;
+ 
++	/* irq mask probing is broken for the WRT54G3G */
++	if (socket->socket.irq_mask == 0)
++		socket->socket.irq_mask = 0x6f8;
++
+ 	dev_printk(KERN_INFO, &socket->dev->dev,
+ 		   "ISA IRQ mask 0x%04x, PCI irq %d\n",
+ 		   socket->socket.irq_mask, socket->cb_irq);
+@@ -1255,6 +1262,15 @@ static int yenta_probe(struct pci_dev *d
+ 	dev_printk(KERN_INFO, &dev->dev,
+ 		   "Socket status: %08x\n", cb_readl(socket, CB_SOCKET_STATE));
+ 
++	/* Generate an interrupt on card insert/remove */
++	config_writew(socket, CB_SOCKET_MASK, CB_CSTSMASK | CB_CDMASK);
++
++	/* Set up Multifunction Routing Status Register */
++	config_writew(socket, 0x8C, 0x1000 /* MFUNC3 to GPIO3 */ | 0x2 /* MFUNC0 to INTA */);
++
++	/* Switch interrupts to parallelized */
++	config_writeb(socket, 0x92, 0x64);
++
+ 	yenta_fixup_parent_bridge(dev->subordinate);
+ 
+ 	/* Register it with the pcmcia layer.. */
diff --git a/target/linux/brcm47xx/patches-4.1/976-ssb_increase_pci_delay.patch b/target/linux/brcm47xx/patches-4.1/976-ssb_increase_pci_delay.patch
new file mode 100644
index 0000000..90bda51
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/976-ssb_increase_pci_delay.patch
@@ -0,0 +1,11 @@
+--- a/drivers/ssb/driver_pcicore.c
++++ b/drivers/ssb/driver_pcicore.c
+@@ -389,7 +389,7 @@ static void ssb_pcicore_init_hostmode(st
+ 	set_io_port_base(ssb_pcicore_controller.io_map_base);
+ 	/* Give some time to the PCI controller to configure itself with the new
+ 	 * values. Not waiting at this point causes crashes of the machine. */
+-	mdelay(10);
++	mdelay(300);
+ 	register_pci_controller(&ssb_pcicore_controller);
+ }
+ 
diff --git a/target/linux/brcm47xx/patches-4.1/999-wl_exports.patch b/target/linux/brcm47xx/patches-4.1/999-wl_exports.patch
new file mode 100644
index 0000000..be14a09
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.1/999-wl_exports.patch
@@ -0,0 +1,22 @@
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -34,7 +34,8 @@ struct nvram_header {
+ 	u32 config_ncdl;	/* ncdl values for memc */
+ };
+ 
+-static char nvram_buf[NVRAM_SPACE];
++char nvram_buf[NVRAM_SPACE];
++EXPORT_SYMBOL(nvram_buf);
+ static size_t nvram_len;
+ static const u32 nvram_sizes[] = {0x8000, 0xF000, 0x10000};
+ static int cfe_env;
+--- a/arch/mips/mm/cache.c
++++ b/arch/mips/mm/cache.c
+@@ -59,6 +59,7 @@ void (*_dma_cache_wback)(unsigned long s
+ void (*_dma_cache_inv)(unsigned long start, unsigned long size);
+ 
+ EXPORT_SYMBOL(_dma_cache_wback_inv);
++EXPORT_SYMBOL(_dma_cache_inv);
+ 
+ #endif /* CONFIG_DMA_NONCOHERENT || CONFIG_DMA_MAYBE_COHERENT */
+