brcm47xx: backport MIPS BCM47XX changes queued for 4.2

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

SVN-Revision: 45906

24 files changed, 1407 insertions, 23 deletions

diff --git a/target/linux/brcm47xx/patches-3.18/032-01-MIPS-BCM47XX-Make-sure-NVRAM-buffer-ends-with-0.patch b/target/linux/brcm47xx/patches-3.18/032-01-MIPS-BCM47XX-Make-sure-NVRAM-buffer-ends-with-0.patch
new file mode 100644
index 0000000000..05b6d2d42e
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-01-MIPS-BCM47XX-Make-sure-NVRAM-buffer-ends-with-0.patch
@@ -0,0 +1,59 @@
+From 4ddb225376a2802a4e20e16f71c6d37b679e3169 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 18:46:11 +0200
+Subject: [PATCH] MIPS: BCM47XX: Make sure NVRAM buffer ends with \0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This will simplify reading its contents.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Hante Meuleman <meuleman@broadcom.com>
+Cc: Ian Kent <raven@themaw.net>
+Patchwork: https://patchwork.linux-mips.org/patch/10031/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c
+index ba632ff..dee1c32 100644
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -98,7 +98,7 @@ found:
+ 		pr_err("The nvram size accoridng to the header seems to be bigger than the partition on flash\n");
+ 	if (header->len > NVRAM_SPACE)
+ 		pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+-		       header->len, NVRAM_SPACE);
++		       header->len, NVRAM_SPACE - 1);
+ 
+ 	src = (u32 *)header;
+ 	dst = (u32 *)nvram_buf;
+@@ -106,6 +106,7 @@ found:
+ 		*dst++ = __raw_readl(src++);
+ 	for (; i < header->len && i < NVRAM_SPACE && i < size; i += 4)
+ 		*dst++ = readl(src++);
++	nvram_buf[NVRAM_SPACE - 1] = '\0';
+ 
+ 	return 0;
+ }
+@@ -150,10 +151,10 @@ static int nvram_init(void)
+ 		u8 *dst = (uint8_t *)nvram_buf;
+ 		size_t len = header.len;
+ 
+-		if (header.len > NVRAM_SPACE) {
++		if (len >= NVRAM_SPACE) {
++			len = NVRAM_SPACE - 1;
+ 			pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+-				header.len, NVRAM_SPACE);
+-			len = NVRAM_SPACE;
++				header.len, len);
+ 		}
+ 
+ 		err = mtd_read(mtd, 0, len, &bytes_read, dst);
+-- 
+1.8.4.5
+
diff --git a/target/linux/brcm47xx/patches-3.18/032-02-MIPS-BCM47XX-Simplify-function-looking-for-NVRAM-ent.patch b/target/linux/brcm47xx/patches-3.18/032-02-MIPS-BCM47XX-Simplify-function-looking-for-NVRAM-ent.patch
new file mode 100644
index 0000000000..c74bd06495
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-02-MIPS-BCM47XX-Simplify-function-looking-for-NVRAM-ent.patch
@@ -0,0 +1,64 @@
+From f6f895644230b13618f14f7108f9b23a21a87bfa Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 18:46:12 +0200
+Subject: [PATCH] MIPS: BCM47XX: Simplify function looking for NVRAM entry
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+First of all it shouldn't modify copied NVRAM just to make sure it can
+loop over all entries. It's enough to just compare current position
+pointer with the end of buffer address.
+Secondly buffer is guaranteed to be \0 ended, so we don't need strnchr.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Hante Meuleman <meuleman@broadcom.com>
+Cc: Ian Kent <raven@themaw.net>
+Patchwork: https://patchwork.linux-mips.org/patch/10032/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c
+index dee1c32..95d028c 100644
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -171,7 +171,7 @@ static int nvram_init(void)
+ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len)
+ {
+ 	char *var, *value, *end, *eq;
+-	int data_left, err;
++	int err;
+ 
+ 	if (!name)
+ 		return -EINVAL;
+@@ -184,19 +184,16 @@ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len)
+ 
+ 	/* Look for name=value and return value */
+ 	var = &nvram_buf[sizeof(struct nvram_header)];
+-	end = nvram_buf + sizeof(nvram_buf) - 2;
+-	end[0] = '\0';
+-	end[1] = '\0';
+-	for (; *var; var = value + strlen(value) + 1) {
+-		data_left = end - var;
+-
+-		eq = strnchr(var, data_left, '=');
++	end = nvram_buf + sizeof(nvram_buf);
++	while (var < end && *var) {
++		eq = strchr(var, '=');
+ 		if (!eq)
+ 			break;
+ 		value = eq + 1;
+ 		if (eq - var == strlen(name) &&
+ 		    strncmp(var, name, eq - var) == 0)
+ 			return snprintf(val, val_len, "%s", value);
++		var = value + strlen(value) + 1;
+ 	}
+ 	return -ENOENT;
+ }
+-- 
+1.8.4.5
+
diff --git a/target/linux/brcm47xx/patches-3.18/032-03-MIPS-BCM47xx-Extract-all-boardflags-to-new-u32-field.patch b/target/linux/brcm47xx/patches-3.18/032-03-MIPS-BCM47xx-Extract-all-boardflags-to-new-u32-field.patch
new file mode 100644
index 0000000000..6c09264b48
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-03-MIPS-BCM47xx-Extract-all-boardflags-to-new-u32-field.patch
@@ -0,0 +1,37 @@
+From ecd06daee04bae00f3dfd0a3cd46f28142f18191 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 11:31:02 +0200
+Subject: [PATCH] MIPS: BCM47xx: Extract all boardflags to new u32 fields
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+For years we planned to get rid of old u16 fields, let's start doing it
+with MIPS code. This process will take some time, it requires doing the
+same in ssb/bcma and then switching all drivers to new fields. This will
+be handled in separated patches submitted to appropriate trees.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/10026/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/sprom.c | 3 +++
+ include/linux/ssb/ssb.h   | 5 ++++-
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/arch/mips/bcm47xx/sprom.c b/arch/mips/bcm47xx/sprom.c
+index 68ebf23..4048083 100644
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -201,6 +201,9 @@ static void bcm47xx_sprom_fill_auto(struct ssb_sprom *sprom,
+ 	bool fb = fallback;
+ 
+ 	ENTRY(0xfffffffe, u16, pre, "boardrev", board_rev, 0, true);
++	ENTRY(0xfffffffe, u32, pre, "boardflags", boardflags, 0, fb);
++	ENTRY(0xfffffff0, u32, pre, "boardflags2", boardflags2, 0, fb);
++	ENTRY(0xfffff800, u32, pre, "boardflags3", boardflags3, 0, fb);
+ 	ENTRY(0x00000002, u16, pre, "boardflags", boardflags_lo, 0, fb);
+ 	ENTRY(0xfffffffc, u16, pre, "boardtype", board_type, 0, true);
+ 	ENTRY(0xfffffffe, u16, pre, "boardnum", board_num, 0, fb);
diff --git a/target/linux/brcm47xx/patches-3.18/032-04-MIPS-BCM47xx-Extract-info-about-et2-interface.patch b/target/linux/brcm47xx/patches-3.18/032-04-MIPS-BCM47xx-Extract-info-about-et2-interface.patch
new file mode 100644
index 0000000000..e3c8e1352d
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-04-MIPS-BCM47xx-Extract-info-about-et2-interface.patch
@@ -0,0 +1,47 @@
+From c58ec43eaca5f970911770c17cb3a29ac102656d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 11:54:48 +0200
+Subject: [PATCH] MIPS: BCM47xx: Extract info about et2 interface
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+New devices may have more than 1 Ethernet core (device). We should
+extract info about them to make it available to Ethernet drivers.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Hante Meuleman <meuleman@broadcom.com>
+Cc: Ian Kent <raven@themaw.net>
+Patchwork: https://patchwork.linux-mips.org/patch/10027/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/sprom.c | 6 ++++++
+ include/linux/ssb/ssb.h   | 3 +++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/arch/mips/bcm47xx/sprom.c b/arch/mips/bcm47xx/sprom.c
+index 4048083..92a6c9d 100644
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -531,6 +531,8 @@ static int mac_addr_used = 2;
+ static void bcm47xx_fill_sprom_ethernet(struct ssb_sprom *sprom,
+ 					const char *prefix, bool fallback)
+ {
++	bool fb = fallback;
++
+ 	nvram_read_macaddr(prefix, "et0macaddr", sprom->et0mac, fallback);
+ 	nvram_read_u8(prefix, NULL, "et0mdcport", &sprom->et0mdcport, 0,
+ 		      fallback);
+@@ -543,6 +545,10 @@ static void bcm47xx_fill_sprom_ethernet(struct ssb_sprom *sprom,
+ 	nvram_read_u8(prefix, NULL, "et1phyaddr", &sprom->et1phyaddr, 0,
+ 		      fallback);
+ 
++	nvram_read_macaddr(prefix, "et2macaddr", sprom->et2mac, fb);
++	nvram_read_u8(prefix, NULL, "et2mdcport", &sprom->et2mdcport, 0, fb);
++	nvram_read_u8(prefix, NULL, "et2phyaddr", &sprom->et2phyaddr, 0, fb);
++
+ 	nvram_read_macaddr(prefix, "macaddr", sprom->il0mac, fallback);
+ 	nvram_read_macaddr(prefix, "il0macaddr", sprom->il0mac, fallback);
+ 
diff --git a/target/linux/brcm47xx/patches-3.18/032-05-MIPS-BCM47xx-Read-board-info-for-all-bcma-buses.patch b/target/linux/brcm47xx/patches-3.18/032-05-MIPS-BCM47xx-Read-board-info-for-all-bcma-buses.patch
new file mode 100644
index 0000000000..d3873d4ae6
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-05-MIPS-BCM47xx-Read-board-info-for-all-bcma-buses.patch
@@ -0,0 +1,141 @@
+From 12e1ab54dcd414c3579cfd26be9d9c9e1cab92ad Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 13:05:18 +0200
+Subject: [PATCH] MIPS: BCM47xx: Read board info for all bcma buses
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Extra bcma buses may be totally different models, see following dump:
+boardtype=0x0646
+pci/1/1/boardtype=0x0545
+pci/2/1/boardtype=0x62b
+We need to detect them properly to allow drivers apply some board
+specific hacks.
+
+[ralf@linux-mips.org: folded in Rafal's fix.]
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/10028/
+Patchwork: https://patchwork.linux-mips.org/patch/10048/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/setup.c                    |  3 --
+ arch/mips/bcm47xx/sprom.c                    | 44 ++++++++++++++--------------
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx.h |  4 ---
+ 3 files changed, 22 insertions(+), 29 deletions(-)
+
+diff --git a/arch/mips/bcm47xx/setup.c b/arch/mips/bcm47xx/setup.c
+index 82ff9fd..98c075f 100644
+--- a/arch/mips/bcm47xx/setup.c
++++ b/arch/mips/bcm47xx/setup.c
+@@ -206,9 +206,6 @@ void __init bcm47xx_bus_setup(void)
+ 		err = bcma_host_soc_init(&bcm47xx_bus.bcma);
+ 		if (err)
+ 			panic("Failed to initialize BCMA bus (err %d)", err);
+-
+-		bcm47xx_fill_bcma_boardinfo(&bcm47xx_bus.bcma.bus.boardinfo,
+-					    NULL);
+ 	}
+ #endif
+ 
+diff --git a/arch/mips/bcm47xx/sprom.c b/arch/mips/bcm47xx/sprom.c
+index 92a6c9d..b0d62e7 100644
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -640,19 +640,6 @@ void bcm47xx_fill_ssb_boardinfo(struct ssb_boardinfo *boardinfo,
+ }
+ #endif
+ 
+-#ifdef CONFIG_BCM47XX_BCMA
+-void bcm47xx_fill_bcma_boardinfo(struct bcma_boardinfo *boardinfo,
+-				 const char *prefix)
+-{
+-	nvram_read_u16(prefix, NULL, "boardvendor", &boardinfo->vendor, 0,
+-		       true);
+-	if (!boardinfo->vendor)
+-		boardinfo->vendor = SSB_BOARDVENDOR_BCM;
+-
+-	nvram_read_u16(prefix, NULL, "boardtype", &boardinfo->type, 0, true);
+-}
+-#endif
+-
+ #if defined(CONFIG_BCM47XX_SSB)
+ static int bcm47xx_get_sprom_ssb(struct ssb_bus *bus, struct ssb_sprom *out)
+ {
+@@ -707,33 +694,46 @@ static void bcm47xx_sprom_apply_prefix_alias(char *prefix, size_t prefix_size)
+ 
+ static int bcm47xx_get_sprom_bcma(struct bcma_bus *bus, struct ssb_sprom *out)
+ {
+-	char prefix[10];
++	struct bcma_boardinfo *binfo = &bus->boardinfo;
+ 	struct bcma_device *core;
++	char buf[10];
++	char *prefix;
++	bool fallback = false;
+ 
+ 	switch (bus->hosttype) {
+ 	case BCMA_HOSTTYPE_PCI:
+ 		memset(out, 0, sizeof(struct ssb_sprom));
+-		snprintf(prefix, sizeof(prefix), "pci/%u/%u/",
++		snprintf(buf, sizeof(buf), "pci/%u/%u/",
+ 			 bus->host_pci->bus->number + 1,
+ 			 PCI_SLOT(bus->host_pci->devfn));
+-		bcm47xx_sprom_apply_prefix_alias(prefix, sizeof(prefix));
+-		bcm47xx_fill_sprom(out, prefix, false);
+-		return 0;
++		bcm47xx_sprom_apply_prefix_alias(buf, sizeof(buf));
++		prefix = buf;
++		break;
+ 	case BCMA_HOSTTYPE_SOC:
+ 		memset(out, 0, sizeof(struct ssb_sprom));
+ 		core = bcma_find_core(bus, BCMA_CORE_80211);
+ 		if (core) {
+-			snprintf(prefix, sizeof(prefix), "sb/%u/",
++			snprintf(buf, sizeof(buf), "sb/%u/",
+ 				 core->core_index);
+-			bcm47xx_fill_sprom(out, prefix, true);
++			prefix = buf;
++			fallback = true;
+ 		} else {
+-			bcm47xx_fill_sprom(out, NULL, false);
++			prefix = NULL;
+ 		}
+-		return 0;
++		break;
+ 	default:
+ 		pr_warn("Unable to fill SPROM for given bustype.\n");
+ 		return -EINVAL;
+ 	}
++
++	nvram_read_u16(prefix, NULL, "boardvendor", &binfo->vendor, 0, true);
++	if (!binfo->vendor)
++		binfo->vendor = SSB_BOARDVENDOR_BCM;
++	nvram_read_u16(prefix, NULL, "boardtype", &binfo->type, 0, true);
++
++	bcm47xx_fill_sprom(out, prefix, fallback);
++
++	return 0;
+ }
+ #endif
+ 
+diff --git a/arch/mips/include/asm/mach-bcm47xx/bcm47xx.h b/arch/mips/include/asm/mach-bcm47xx/bcm47xx.h
+index 8ed77f6..1461c10 100644
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx.h
+@@ -52,10 +52,6 @@ void bcm47xx_fill_sprom(struct ssb_sprom *sprom, const char *prefix,
+ void bcm47xx_fill_ssb_boardinfo(struct ssb_boardinfo *boardinfo,
+ 				const char *prefix);
+ #endif
+-#ifdef CONFIG_BCM47XX_BCMA
+-void bcm47xx_fill_bcma_boardinfo(struct bcma_boardinfo *boardinfo,
+-				 const char *prefix);
+-#endif
+ 
+ void bcm47xx_set_system_type(u16 chip_id);
+ 
+-- 
+1.8.4.5
+
diff --git a/target/linux/brcm47xx/patches-3.18/032-06-MIPS-BCM77xx-Remove-legacy-__cpuinit-data-sections-t.patch b/target/linux/brcm47xx/patches-3.18/032-06-MIPS-BCM77xx-Remove-legacy-__cpuinit-data-sections-t.patch
new file mode 100644
index 0000000000..329fe812cc
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-06-MIPS-BCM77xx-Remove-legacy-__cpuinit-data-sections-t.patch
@@ -0,0 +1,69 @@
+From 50d68dfef385127a1da2957813272c610c691157 Mon Sep 17 00:00:00 2001
+From: Paul Gortmaker <paul.gortmaker@windriver.com>
+Date: Mon, 27 Apr 2015 18:47:56 -0400
+Subject: [PATCH] MIPS: BCM77xx: Remove legacy __cpuinit{,data} sections that
+ crept in
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We removed __cpuinit support (leaving no-op stubs) quite some time ago.
+However a few more crept in as of commit 6ee1d93455384cef8a0426effe85da2
+("MIPS: BCM47XX: Detect more then 128 MiB of RAM (HIGHMEM)")
+
+Since we want to clobber the stubs soon, get this removed now.
+
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+Cc: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Patchwork: https://patchwork.linux-mips.org/patch/9892/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/prom.c           | 2 +-
+ arch/mips/include/asm/pgtable-32.h | 2 +-
+ arch/mips/mm/tlb-r4k.c             | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/mips/bcm47xx/prom.c b/arch/mips/bcm47xx/prom.c
+index ab698ba..135a540 100644
+--- a/arch/mips/bcm47xx/prom.c
++++ b/arch/mips/bcm47xx/prom.c
+@@ -126,7 +126,7 @@ void __init prom_free_prom_memory(void)
+ /* Stripped version of tlb_init, with the call to build_tlb_refill_handler
+  * dropped. Calling it at this stage causes a hang.
+  */
+-void __cpuinit early_tlb_init(void)
++void early_tlb_init(void)
+ {
+ 	write_c0_pagemask(PM_DEFAULT_MASK);
+ 	write_c0_wired(0);
+diff --git a/arch/mips/include/asm/pgtable-32.h b/arch/mips/include/asm/pgtable-32.h
+index 7d56686..832e216 100644
+--- a/arch/mips/include/asm/pgtable-32.h
++++ b/arch/mips/include/asm/pgtable-32.h
+@@ -18,7 +18,7 @@
+ 
+ #include <asm-generic/pgtable-nopmd.h>
+ 
+-extern int temp_tlb_entry __cpuinitdata;
++extern int temp_tlb_entry;
+ 
+ /*
+  * - add_temporary_entry() add a temporary TLB entry. We use TLB entries
+diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
+index 08318ec..5037d58 100644
+--- a/arch/mips/mm/tlb-r4k.c
++++ b/arch/mips/mm/tlb-r4k.c
+@@ -411,7 +411,7 @@ int __init has_transparent_hugepage(void)
+  * lifetime of the system
+  */
+ 
+-int temp_tlb_entry __cpuinitdata;
++int temp_tlb_entry;
+ 
+ __init int add_temporary_entry(unsigned long entrylo0, unsigned long entrylo1,
+ 			       unsigned long entryhi, unsigned long pagemask)
+-- 
+1.8.4.5
+
diff --git a/target/linux/brcm47xx/patches-3.18/032-07-MIPS-BCM47XX-Support-Luxul-XWR-1750-board.patch b/target/linux/brcm47xx/patches-3.18/032-07-MIPS-BCM47XX-Support-Luxul-XWR-1750-board.patch
new file mode 100644
index 0000000000..430edc4531
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-07-MIPS-BCM47XX-Support-Luxul-XWR-1750-board.patch
@@ -0,0 +1,111 @@
+From 981de3c2f27af27fa4c5c952d122b35ee573ab7a Mon Sep 17 00:00:00 2001
+From: Dan Haab <dhaab@luxul.com>
+Date: Wed, 22 Apr 2015 13:58:33 -0600
+Subject: [PATCH] MIPS: BCM47XX: Support Luxul XWR-1750 board
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Dan Haab <dhaab@luxul.com>
+Acked-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Dan Haab <dhaab@luxul.com>
+Patchwork: https://patchwork.linux-mips.org/patch/9831/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/board.c                          |  1 +
+ arch/mips/bcm47xx/buttons.c                        | 11 +++++++++++
+ arch/mips/bcm47xx/leds.c                           | 14 ++++++++++++++
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h |  2 ++
+ 4 files changed, 28 insertions(+)
+
+diff --git a/arch/mips/bcm47xx/board.c b/arch/mips/bcm47xx/board.c
+index bd56415..a88975a 100644
+--- a/arch/mips/bcm47xx/board.c
++++ b/arch/mips/bcm47xx/board.c
+@@ -149,6 +149,7 @@ struct bcm47xx_board_type_list2 bcm47xx_board_list_boot_hw[] __initconst = {
+ /* board_id */
+ static const
+ struct bcm47xx_board_type_list1 bcm47xx_board_list_board_id[] __initconst = {
++	{{BCM47XX_BOARD_LUXUL_XWR_1750_V1, "Luxul XWR-1750 V1"}, "luxul_xwr1750_v1"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614V8, "Netgear WGR614 V8"}, "U12H072T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614V9, "Netgear WGR614 V9"}, "U12H094T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614_V10, "Netgear WGR614 V10"}, "U12H139T01_NETGEAR"},
+diff --git a/arch/mips/bcm47xx/buttons.c b/arch/mips/bcm47xx/buttons.c
+index 276276a..08a4abf 100644
+--- a/arch/mips/bcm47xx/buttons.c
++++ b/arch/mips/bcm47xx/buttons.c
+@@ -299,6 +299,13 @@ bcm47xx_buttons_linksys_wrtsl54gs[] __initconst = {
+ 	BCM47XX_GPIO_KEY(6, KEY_RESTART),
+ };
+ 
++/* Luxul */
++
++static const struct gpio_keys_button
++bcm47xx_buttons_luxul_xwr_1750_v1[] = {
++	BCM47XX_GPIO_KEY(14, BTN_TASK),
++};
++
+ /* Microsoft */
+ 
+ static const struct gpio_keys_button
+@@ -555,6 +562,10 @@ int __init bcm47xx_buttons_register(void)
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrtsl54gs);
+ 		break;
+ 
++	case BCM47XX_BOARD_LUXUL_XWR_1750_V1:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_luxul_xwr_1750_v1);
++		break;
++
+ 	case BCM47XX_BOARD_MICROSOFT_MN700:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_microsoft_nm700);
+ 		break;
+diff --git a/arch/mips/bcm47xx/leds.c b/arch/mips/bcm47xx/leds.c
+index 0e4ade3..d20ae63 100644
+--- a/arch/mips/bcm47xx/leds.c
++++ b/arch/mips/bcm47xx/leds.c
+@@ -370,6 +370,16 @@ bcm47xx_leds_linksys_wrtsl54gs[] __initconst = {
+ 	BCM47XX_GPIO_LED(7, "orange", "wps", 1, LEDS_GPIO_DEFSTATE_OFF),
+ };
+ 
++/* Luxul */
++
++static const struct gpio_led
++bcm47xx_leds_luxul_xwr_1750_v1[] __initconst = {
++	BCM47XX_GPIO_LED(5, "green", "5ghz", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(12, "green", "usb", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED_TRIGGER(13, "green", "status", 0, "timer"),
++	BCM47XX_GPIO_LED(15, "green", "wps", 0, LEDS_GPIO_DEFSTATE_OFF),
++};
++
+ /* Microsoft */
+ 
+ static const struct gpio_led
+@@ -623,6 +633,10 @@ void __init bcm47xx_leds_register(void)
+ 		bcm47xx_set_pdata(bcm47xx_leds_linksys_wrtsl54gs);
+ 		break;
+ 
++	case BCM47XX_BOARD_LUXUL_XWR_1750_V1:
++		bcm47xx_set_pdata(bcm47xx_leds_luxul_xwr_1750_v1);
++		break;
++
+ 	case BCM47XX_BOARD_MICROSOFT_MN700:
+ 		bcm47xx_set_pdata(bcm47xx_leds_microsoft_nm700);
+ 		break;
+diff --git a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
+index c41d1dc..2afb840 100644
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
+@@ -80,6 +80,8 @@ enum bcm47xx_board {
+ 	BCM47XX_BOARD_LINKSYS_WRT610NV2,
+ 	BCM47XX_BOARD_LINKSYS_WRTSL54GS,
+ 
++	BCM47XX_BOARD_LUXUL_XWR_1750_V1,
++
+ 	BCM47XX_BOARD_MICROSOFT_MN700,
+ 
+ 	BCM47XX_BOARD_MOTOROLA_WE800G,
+-- 
+1.8.4.5
+
diff --git a/target/linux/brcm47xx/patches-3.18/032-08-mips-bcm47xx-allow-retrieval-of-complete-nvram-conte.patch b/target/linux/brcm47xx/patches-3.18/032-08-mips-bcm47xx-allow-retrieval-of-complete-nvram-conte.patch
new file mode 100644
index 0000000000..bfa93af41c
--- /dev/null
+++ b/target/linux/brcm47xx/patches-3.18/032-08-mips-bcm47xx-allow-retrieval-of-complete-nvram-conte.patch
@@ -0,0 +1,164 @@
+From 2536295c2aeafc769215a6b2883126fa94c90b9a Mon Sep 17 00:00:00 2001
+From: Hante Meuleman <meuleman@broadcom.com>
+Date: Thu, 21 May 2015 15:27:23 +0200
+Subject: [PATCH] mips: bcm47xx: allow retrieval of complete nvram contents
+
+Host platforms such as routers supported by OpenWrt can
+support NVRAM reading directly from internal NVRAM store.
+The brcmfmac for one requires the complete nvram contents
+to select what needs to be sent to wireless device.
+
+Signed-off-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
+Reviewed-by: Arend Van Spriel <arend@broadcom.com>
+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
+Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/10093/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c     | 60 ++++++++++++++++++++++++++++++++-----------
+ include/linux/bcm47xx_nvram.h | 15 +++++++++++
+ 2 files changed, 60 insertions(+), 15 deletions(-)
+
+diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c
+index 95d028c..2ed762e 100644
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -94,17 +94,22 @@ static int nvram_find_and_copy(void __iomem *iobase, u32 lim)
+ 	return -ENXIO;
+ 
+ found:
+-	if (header->len > size)
+-		pr_err("The nvram size accoridng to the header seems to be bigger than the partition on flash\n");
+-	if (header->len > NVRAM_SPACE)
+-		pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+-		       header->len, NVRAM_SPACE - 1);
+-
+ 	src = (u32 *)header;
+ 	dst = (u32 *)nvram_buf;
+ 	for (i = 0; i < sizeof(struct nvram_header); i += 4)
+ 		*dst++ = __raw_readl(src++);
+-	for (; i < header->len && i < NVRAM_SPACE && i < size; i += 4)
++	header = (struct nvram_header *)nvram_buf;
++	if (header->len > size) {
++		pr_err("The nvram size according to the header seems to be bigger than the partition on flash\n");
++		header->len = size;
++	}
++	if (header->len >= NVRAM_SPACE) {
++		pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
++		       header->len, NVRAM_SPACE - 1);
++		header->len = NVRAM_SPACE - 1;
++	}
++	/* proceed reading data after header */
++	for (; i < header->len; i += 4)
+ 		*dst++ = readl(src++);
+ 	nvram_buf[NVRAM_SPACE - 1] = '\0';
+ 
+@@ -139,6 +144,7 @@ static int nvram_init(void)
+ #ifdef CONFIG_MTD
+ 	struct mtd_info *mtd;
+ 	struct nvram_header header;
++	struct nvram_header *pheader;
+ 	size_t bytes_read;
+ 	int err;
+ 
+@@ -147,20 +153,21 @@ static int nvram_init(void)
+ 		return -ENODEV;
+ 
+ 	err = mtd_read(mtd, 0, sizeof(header), &bytes_read, (uint8_t *)&header);
+-	if (!err && header.magic == NVRAM_MAGIC) {
+-		u8 *dst = (uint8_t *)nvram_buf;
+-		size_t len = header.len;
+-
+-		if (len >= NVRAM_SPACE) {
+-			len = NVRAM_SPACE - 1;
++	if (!err && header.magic == NVRAM_MAGIC &&
++	    header.len > sizeof(header)) {
++		if (header.len >= NVRAM_SPACE) {
+ 			pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+-				header.len, len);
++				header.len, NVRAM_SPACE);
++			header.len = NVRAM_SPACE - 1;
+ 		}
+ 
+-		err = mtd_read(mtd, 0, len, &bytes_read, dst);
++		err = mtd_read(mtd, 0, header.len, &bytes_read,
++			       (u8 *)nvram_buf);
+ 		if (err)
+ 			return err;
+ 
++		pheader = (struct nvram_header *)nvram_buf;
++		pheader->len = header.len;
+ 		return 0;
+ 	}
+ #endif
+@@ -219,3 +226,26 @@ int bcm47xx_nvram_gpio_pin(const char *name)
+ 	return -ENOENT;
+ }
+ EXPORT_SYMBOL(bcm47xx_nvram_gpio_pin);
++
++char *bcm47xx_nvram_get_contents(size_t *nvram_size)
++{
++	int err;
++	char *nvram;
++	struct nvram_header *header;
++
++	if (!nvram_buf[0]) {
++		err = nvram_init();
++		if (err)
++			return NULL;
++	}
++
++	header = (struct nvram_header *)nvram_buf;
++	*nvram_size = header->len - sizeof(struct nvram_header);
++	nvram = vmalloc(*nvram_size);
++	if (!nvram)
++		return NULL;
++	memcpy(nvram, &nvram_buf[sizeof(struct nvram_header)], *nvram_size);
++
++	return nvram;
++}
++EXPORT_SYMBOL(bcm47xx_nvram_get_contents);
+diff --git a/include/linux/bcm47xx_nvram.h b/include/linux/bcm47xx_nvram.h
+index b12b07e..c73927c 100644
+--- a/include/linux/bcm47xx_nvram.h
++++ b/include/linux/bcm47xx_nvram.h
+@@ -10,11 +10,17 @@
+ 
+ #include <linux/types.h>
+ #include <linux/kernel.h>
++#include <linux/vmalloc.h>
+ 
+ #ifdef CONFIG_BCM47XX
+ int bcm47xx_nvram_init_from_mem(u32 base, u32 lim);
+ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len);
+ int bcm47xx_nvram_gpio_pin(const char *name);
++char *bcm47xx_nvram_get_contents(size_t *val_len);
++static inline void bcm47xx_nvram_release_contents(char *nvram)
++{
++	vfree(nvram);
++};
+ #else
+ static inline int bcm47xx_nvram_init_from_mem(u32 base, u32 lim)
+ {
+@@ -29,6 +35,15 @@ static inline int bcm47xx_nvram_gpio_pin(const char *name)
+ {
+ 	return -ENOTSUPP;
+ };
++
++static inline char *bcm47xx_nvram_get_contents(size_t *val_len)
++{
++	return NULL;
++};
++
++static inline void bcm47xx_nvram_release_contents(char *nvram)
++{
++};
+ #endif
+ 
+ #endif /* __BCM47XX_NVRAM_H */
+-- 
+1.8.4.5
+
diff --git a/target/linux/brcm47xx/patches-3.18/320-MIPS-BCM47XX-Devices-database-update-for-4.x.patch b/target/linux/brcm47xx/patches-3.18/320-MIPS-BCM47XX-Devices-database-update-for-4.x.patch
index 2f005b52b3..aa4e947762 100644
--- a/target/linux/brcm47xx/patches-3.18/320-MIPS-BCM47XX-Devices-database-update-for-4.x.patch
+++ b/target/linux/brcm47xx/patches-3.18/320-MIPS-BCM47XX-Devices-database-update-for-4.x.patch
@@ -42,7 +42,7 @@
  bcm47xx_buttons_linksys_wrt54g3gv2[] __initconst = {
  	BCM47XX_GPIO_KEY(5, KEY_WIMAX),
  	BCM47XX_GPIO_KEY(6, KEY_RESTART),
-@@ -407,6 +425,9 @@ int __init bcm47xx_buttons_register(void
+@@ -414,6 +432,9 @@ int __init bcm47xx_buttons_register(void
  	int err;
  
  	switch (board) {
@@ -52,7 +52,7 @@
  	case BCM47XX_BOARD_ASUS_RTN12:
  		err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_rtn12);
  		break;
-@@ -537,6 +558,12 @@ int __init bcm47xx_buttons_register(void
+@@ -544,6 +565,12 @@ int __init bcm47xx_buttons_register(void
  	case BCM47XX_BOARD_LINKSYS_WRT310NV1:
  		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt310nv1);
  		break;
@@ -106,7 +106,7 @@
  bcm47xx_leds_linksys_wrt54g_generic[] __initconst = {
  	BCM47XX_GPIO_LED(0, "unk", "dmz", 1, LEDS_GPIO_DEFSTATE_OFF),
  	BCM47XX_GPIO_LED(1, "unk", "power", 0, LEDS_GPIO_DEFSTATE_ON),
-@@ -468,6 +483,9 @@ void __init bcm47xx_leds_register(void)
+@@ -478,6 +493,9 @@ void __init bcm47xx_leds_register(void)
  	enum bcm47xx_board board = bcm47xx_board_get();
  
  	switch (board) {
@@ -116,7 +116,7 @@
  	case BCM47XX_BOARD_ASUS_RTN12:
  		bcm47xx_set_pdata(bcm47xx_leds_asus_rtn12);
  		break;
-@@ -601,6 +619,9 @@ void __init bcm47xx_leds_register(void)
+@@ -611,6 +629,9 @@ void __init bcm47xx_leds_register(void)
  	case BCM47XX_BOARD_LINKSYS_WRT310NV1:
  		bcm47xx_set_pdata(bcm47xx_leds_linksys_wrt310nv1);
  		break;
diff --git a/target/linux/brcm47xx/patches-3.18/820-wgt634u-nvram-fix.patch b/target/linux/brcm47xx/patches-3.18/820-wgt634u-nvram-fix.patch
index 51ff74301a..c543e8e2e9 100644
--- a/target/linux/brcm47xx/patches-3.18/820-wgt634u-nvram-fix.patch
+++ b/target/linux/brcm47xx/patches-3.18/820-wgt634u-nvram-fix.patch
@@ -279,7 +279,7 @@ out the configuration than the in kernel cfe config reader.
  	/* TODO: when nvram is on nand flash check for bad blocks first. */
  	off = FLASH_MIN;
  	while (off <= lim) {
-@@ -181,6 +203,13 @@ int bcm47xx_nvram_getenv(const char *nam
+@@ -189,6 +211,13 @@ int bcm47xx_nvram_getenv(const char *nam
  			return err;
  	}
  
@@ -292,4 +292,4 @@ out the configuration than the in kernel cfe config reader.
 +
  	/* Look for name=value and return value */
  	var = &nvram_buf[sizeof(struct nvram_header)];
- 	end = nvram_buf + sizeof(nvram_buf) - 2;
+ 	end = nvram_buf + sizeof(nvram_buf);
diff --git a/target/linux/brcm47xx/patches-3.18/830-huawei_e970_support.patch b/target/linux/brcm47xx/patches-3.18/830-huawei_e970_support.patch
index e475532d42..fdb6c19cd2 100644
--- a/target/linux/brcm47xx/patches-3.18/830-huawei_e970_support.patch
+++ b/target/linux/brcm47xx/patches-3.18/830-huawei_e970_support.patch
@@ -8,7 +8,7 @@
  #include <asm/bootinfo.h>
  #include <asm/idle.h>
  #include <asm/prom.h>
-@@ -248,6 +249,33 @@ static struct fixed_phy_status bcm47xx_f
+@@ -245,6 +246,33 @@ static struct fixed_phy_status bcm47xx_f
  	.duplex	= DUPLEX_FULL,
  };
  
@@ -42,7 +42,7 @@
  static int __init bcm47xx_register_bus_complete(void)
  {
  	switch (bcm47xx_bus_type) {
-@@ -267,6 +295,7 @@ static int __init bcm47xx_register_bus_c
+@@ -264,6 +292,7 @@ static int __init bcm47xx_register_bus_c
  	bcm47xx_workarounds();
  
  	fixed_phy_add(PHY_POLL, 0, &bcm47xx_fixed_phy_status);
diff --git a/target/linux/brcm47xx/patches-3.18/976-ssb_increase_pci_delay.patch b/target/linux/brcm47xx/patches-3.18/976-ssb_increase_pci_delay.patch
index bf932729e9..90bda515eb 100644
--- a/target/linux/brcm47xx/patches-3.18/976-ssb_increase_pci_delay.patch
+++ b/target/linux/brcm47xx/patches-3.18/976-ssb_increase_pci_delay.patch
@@ -1,6 +1,6 @@
 --- a/drivers/ssb/driver_pcicore.c
 +++ b/drivers/ssb/driver_pcicore.c
-@@ -388,7 +388,7 @@ static void ssb_pcicore_init_hostmode(st
+@@ -389,7 +389,7 @@ static void ssb_pcicore_init_hostmode(st
  	set_io_port_base(ssb_pcicore_controller.io_map_base);
  	/* Give some time to the PCI controller to configure itself with the new
  	 * values. Not waiting at this point causes crashes of the machine. */
diff --git a/target/linux/brcm47xx/patches-4.0/031-01-MIPS-BCM47XX-Make-sure-NVRAM-buffer-ends-with-0.patch b/target/linux/brcm47xx/patches-4.0/031-01-MIPS-BCM47XX-Make-sure-NVRAM-buffer-ends-with-0.patch
new file mode 100644
index 0000000000..05b6d2d42e
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.0/031-01-MIPS-BCM47XX-Make-sure-NVRAM-buffer-ends-with-0.patch
@@ -0,0 +1,59 @@
+From 4ddb225376a2802a4e20e16f71c6d37b679e3169 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 18:46:11 +0200
+Subject: [PATCH] MIPS: BCM47XX: Make sure NVRAM buffer ends with \0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This will simplify reading its contents.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Hante Meuleman <meuleman@broadcom.com>
+Cc: Ian Kent <raven@themaw.net>
+Patchwork: https://patchwork.linux-mips.org/patch/10031/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c
+index ba632ff..dee1c32 100644
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -98,7 +98,7 @@ found:
+ 		pr_err("The nvram size accoridng to the header seems to be bigger than the partition on flash\n");
+ 	if (header->len > NVRAM_SPACE)
+ 		pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+-		       header->len, NVRAM_SPACE);
++		       header->len, NVRAM_SPACE - 1);
+ 
+ 	src = (u32 *)header;
+ 	dst = (u32 *)nvram_buf;
+@@ -106,6 +106,7 @@ found:
+ 		*dst++ = __raw_readl(src++);
+ 	for (; i < header->len && i < NVRAM_SPACE && i < size; i += 4)
+ 		*dst++ = readl(src++);
++	nvram_buf[NVRAM_SPACE - 1] = '\0';
+ 
+ 	return 0;
+ }
+@@ -150,10 +151,10 @@ static int nvram_init(void)
+ 		u8 *dst = (uint8_t *)nvram_buf;
+ 		size_t len = header.len;
+ 
+-		if (header.len > NVRAM_SPACE) {
++		if (len >= NVRAM_SPACE) {
++			len = NVRAM_SPACE - 1;
+ 			pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+-				header.len, NVRAM_SPACE);
+-			len = NVRAM_SPACE;
++				header.len, len);
+ 		}
+ 
+ 		err = mtd_read(mtd, 0, len, &bytes_read, dst);
+-- 
+1.8.4.5
+
diff --git a/target/linux/brcm47xx/patches-4.0/031-02-MIPS-BCM47XX-Simplify-function-looking-for-NVRAM-ent.patch b/target/linux/brcm47xx/patches-4.0/031-02-MIPS-BCM47XX-Simplify-function-looking-for-NVRAM-ent.patch
new file mode 100644
index 0000000000..c74bd06495
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.0/031-02-MIPS-BCM47XX-Simplify-function-looking-for-NVRAM-ent.patch
@@ -0,0 +1,64 @@
+From f6f895644230b13618f14f7108f9b23a21a87bfa Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 18:46:12 +0200
+Subject: [PATCH] MIPS: BCM47XX: Simplify function looking for NVRAM entry
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+First of all it shouldn't modify copied NVRAM just to make sure it can
+loop over all entries. It's enough to just compare current position
+pointer with the end of buffer address.
+Secondly buffer is guaranteed to be \0 ended, so we don't need strnchr.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Hante Meuleman <meuleman@broadcom.com>
+Cc: Ian Kent <raven@themaw.net>
+Patchwork: https://patchwork.linux-mips.org/patch/10032/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c
+index dee1c32..95d028c 100644
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -171,7 +171,7 @@ static int nvram_init(void)
+ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len)
+ {
+ 	char *var, *value, *end, *eq;
+-	int data_left, err;
++	int err;
+ 
+ 	if (!name)
+ 		return -EINVAL;
+@@ -184,19 +184,16 @@ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len)
+ 
+ 	/* Look for name=value and return value */
+ 	var = &nvram_buf[sizeof(struct nvram_header)];
+-	end = nvram_buf + sizeof(nvram_buf) - 2;
+-	end[0] = '\0';
+-	end[1] = '\0';
+-	for (; *var; var = value + strlen(value) + 1) {
+-		data_left = end - var;
+-
+-		eq = strnchr(var, data_left, '=');
++	end = nvram_buf + sizeof(nvram_buf);
++	while (var < end && *var) {
++		eq = strchr(var, '=');
+ 		if (!eq)
+ 			break;
+ 		value = eq + 1;
+ 		if (eq - var == strlen(name) &&
+ 		    strncmp(var, name, eq - var) == 0)
+ 			return snprintf(val, val_len, "%s", value);
++		var = value + strlen(value) + 1;
+ 	}
+ 	return -ENOENT;
+ }
+-- 
+1.8.4.5
+
diff --git a/target/linux/brcm47xx/patches-4.0/031-03-MIPS-BCM47xx-Extract-all-boardflags-to-new-u32-field.patch b/target/linux/brcm47xx/patches-4.0/031-03-MIPS-BCM47xx-Extract-all-boardflags-to-new-u32-field.patch
new file mode 100644
index 0000000000..6c09264b48
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.0/031-03-MIPS-BCM47xx-Extract-all-boardflags-to-new-u32-field.patch
@@ -0,0 +1,37 @@
+From ecd06daee04bae00f3dfd0a3cd46f28142f18191 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 11:31:02 +0200
+Subject: [PATCH] MIPS: BCM47xx: Extract all boardflags to new u32 fields
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+For years we planned to get rid of old u16 fields, let's start doing it
+with MIPS code. This process will take some time, it requires doing the
+same in ssb/bcma and then switching all drivers to new fields. This will
+be handled in separated patches submitted to appropriate trees.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/10026/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/sprom.c | 3 +++
+ include/linux/ssb/ssb.h   | 5 ++++-
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/arch/mips/bcm47xx/sprom.c b/arch/mips/bcm47xx/sprom.c
+index 68ebf23..4048083 100644
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -201,6 +201,9 @@ static void bcm47xx_sprom_fill_auto(struct ssb_sprom *sprom,
+ 	bool fb = fallback;
+ 
+ 	ENTRY(0xfffffffe, u16, pre, "boardrev", board_rev, 0, true);
++	ENTRY(0xfffffffe, u32, pre, "boardflags", boardflags, 0, fb);
++	ENTRY(0xfffffff0, u32, pre, "boardflags2", boardflags2, 0, fb);
++	ENTRY(0xfffff800, u32, pre, "boardflags3", boardflags3, 0, fb);
+ 	ENTRY(0x00000002, u16, pre, "boardflags", boardflags_lo, 0, fb);
+ 	ENTRY(0xfffffffc, u16, pre, "boardtype", board_type, 0, true);
+ 	ENTRY(0xfffffffe, u16, pre, "boardnum", board_num, 0, fb);
diff --git a/target/linux/brcm47xx/patches-4.0/031-04-MIPS-BCM47xx-Extract-info-about-et2-interface.patch b/target/linux/brcm47xx/patches-4.0/031-04-MIPS-BCM47xx-Extract-info-about-et2-interface.patch
new file mode 100644
index 0000000000..e3c8e1352d
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.0/031-04-MIPS-BCM47xx-Extract-info-about-et2-interface.patch
@@ -0,0 +1,47 @@
+From c58ec43eaca5f970911770c17cb3a29ac102656d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 11:54:48 +0200
+Subject: [PATCH] MIPS: BCM47xx: Extract info about et2 interface
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+New devices may have more than 1 Ethernet core (device). We should
+extract info about them to make it available to Ethernet drivers.
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Hante Meuleman <meuleman@broadcom.com>
+Cc: Ian Kent <raven@themaw.net>
+Patchwork: https://patchwork.linux-mips.org/patch/10027/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/sprom.c | 6 ++++++
+ include/linux/ssb/ssb.h   | 3 +++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/arch/mips/bcm47xx/sprom.c b/arch/mips/bcm47xx/sprom.c
+index 4048083..92a6c9d 100644
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -531,6 +531,8 @@ static int mac_addr_used = 2;
+ static void bcm47xx_fill_sprom_ethernet(struct ssb_sprom *sprom,
+ 					const char *prefix, bool fallback)
+ {
++	bool fb = fallback;
++
+ 	nvram_read_macaddr(prefix, "et0macaddr", sprom->et0mac, fallback);
+ 	nvram_read_u8(prefix, NULL, "et0mdcport", &sprom->et0mdcport, 0,
+ 		      fallback);
+@@ -543,6 +545,10 @@ static void bcm47xx_fill_sprom_ethernet(struct ssb_sprom *sprom,
+ 	nvram_read_u8(prefix, NULL, "et1phyaddr", &sprom->et1phyaddr, 0,
+ 		      fallback);
+ 
++	nvram_read_macaddr(prefix, "et2macaddr", sprom->et2mac, fb);
++	nvram_read_u8(prefix, NULL, "et2mdcport", &sprom->et2mdcport, 0, fb);
++	nvram_read_u8(prefix, NULL, "et2phyaddr", &sprom->et2phyaddr, 0, fb);
++
+ 	nvram_read_macaddr(prefix, "macaddr", sprom->il0mac, fallback);
+ 	nvram_read_macaddr(prefix, "il0macaddr", sprom->il0mac, fallback);
+ 
diff --git a/target/linux/brcm47xx/patches-4.0/031-05-MIPS-BCM47xx-Read-board-info-for-all-bcma-buses.patch b/target/linux/brcm47xx/patches-4.0/031-05-MIPS-BCM47xx-Read-board-info-for-all-bcma-buses.patch
new file mode 100644
index 0000000000..d3873d4ae6
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.0/031-05-MIPS-BCM47xx-Read-board-info-for-all-bcma-buses.patch
@@ -0,0 +1,141 @@
+From 12e1ab54dcd414c3579cfd26be9d9c9e1cab92ad Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
+Date: Tue, 12 May 2015 13:05:18 +0200
+Subject: [PATCH] MIPS: BCM47xx: Read board info for all bcma buses
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Extra bcma buses may be totally different models, see following dump:
+boardtype=0x0646
+pci/1/1/boardtype=0x0545
+pci/2/1/boardtype=0x62b
+We need to detect them properly to allow drivers apply some board
+specific hacks.
+
+[ralf@linux-mips.org: folded in Rafal's fix.]
+
+Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Patchwork: https://patchwork.linux-mips.org/patch/10028/
+Patchwork: https://patchwork.linux-mips.org/patch/10048/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/setup.c                    |  3 --
+ arch/mips/bcm47xx/sprom.c                    | 44 ++++++++++++++--------------
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx.h |  4 ---
+ 3 files changed, 22 insertions(+), 29 deletions(-)
+
+diff --git a/arch/mips/bcm47xx/setup.c b/arch/mips/bcm47xx/setup.c
+index 82ff9fd..98c075f 100644
+--- a/arch/mips/bcm47xx/setup.c
++++ b/arch/mips/bcm47xx/setup.c
+@@ -206,9 +206,6 @@ void __init bcm47xx_bus_setup(void)
+ 		err = bcma_host_soc_init(&bcm47xx_bus.bcma);
+ 		if (err)
+ 			panic("Failed to initialize BCMA bus (err %d)", err);
+-
+-		bcm47xx_fill_bcma_boardinfo(&bcm47xx_bus.bcma.bus.boardinfo,
+-					    NULL);
+ 	}
+ #endif
+ 
+diff --git a/arch/mips/bcm47xx/sprom.c b/arch/mips/bcm47xx/sprom.c
+index 92a6c9d..b0d62e7 100644
+--- a/arch/mips/bcm47xx/sprom.c
++++ b/arch/mips/bcm47xx/sprom.c
+@@ -640,19 +640,6 @@ void bcm47xx_fill_ssb_boardinfo(struct ssb_boardinfo *boardinfo,
+ }
+ #endif
+ 
+-#ifdef CONFIG_BCM47XX_BCMA
+-void bcm47xx_fill_bcma_boardinfo(struct bcma_boardinfo *boardinfo,
+-				 const char *prefix)
+-{
+-	nvram_read_u16(prefix, NULL, "boardvendor", &boardinfo->vendor, 0,
+-		       true);
+-	if (!boardinfo->vendor)
+-		boardinfo->vendor = SSB_BOARDVENDOR_BCM;
+-
+-	nvram_read_u16(prefix, NULL, "boardtype", &boardinfo->type, 0, true);
+-}
+-#endif
+-
+ #if defined(CONFIG_BCM47XX_SSB)
+ static int bcm47xx_get_sprom_ssb(struct ssb_bus *bus, struct ssb_sprom *out)
+ {
+@@ -707,33 +694,46 @@ static void bcm47xx_sprom_apply_prefix_alias(char *prefix, size_t prefix_size)
+ 
+ static int bcm47xx_get_sprom_bcma(struct bcma_bus *bus, struct ssb_sprom *out)
+ {
+-	char prefix[10];
++	struct bcma_boardinfo *binfo = &bus->boardinfo;
+ 	struct bcma_device *core;
++	char buf[10];
++	char *prefix;
++	bool fallback = false;
+ 
+ 	switch (bus->hosttype) {
+ 	case BCMA_HOSTTYPE_PCI:
+ 		memset(out, 0, sizeof(struct ssb_sprom));
+-		snprintf(prefix, sizeof(prefix), "pci/%u/%u/",
++		snprintf(buf, sizeof(buf), "pci/%u/%u/",
+ 			 bus->host_pci->bus->number + 1,
+ 			 PCI_SLOT(bus->host_pci->devfn));
+-		bcm47xx_sprom_apply_prefix_alias(prefix, sizeof(prefix));
+-		bcm47xx_fill_sprom(out, prefix, false);
+-		return 0;
++		bcm47xx_sprom_apply_prefix_alias(buf, sizeof(buf));
++		prefix = buf;
++		break;
+ 	case BCMA_HOSTTYPE_SOC:
+ 		memset(out, 0, sizeof(struct ssb_sprom));
+ 		core = bcma_find_core(bus, BCMA_CORE_80211);
+ 		if (core) {
+-			snprintf(prefix, sizeof(prefix), "sb/%u/",
++			snprintf(buf, sizeof(buf), "sb/%u/",
+ 				 core->core_index);
+-			bcm47xx_fill_sprom(out, prefix, true);
++			prefix = buf;
++			fallback = true;
+ 		} else {
+-			bcm47xx_fill_sprom(out, NULL, false);
++			prefix = NULL;
+ 		}
+-		return 0;
++		break;
+ 	default:
+ 		pr_warn("Unable to fill SPROM for given bustype.\n");
+ 		return -EINVAL;
+ 	}
++
++	nvram_read_u16(prefix, NULL, "boardvendor", &binfo->vendor, 0, true);
++	if (!binfo->vendor)
++		binfo->vendor = SSB_BOARDVENDOR_BCM;
++	nvram_read_u16(prefix, NULL, "boardtype", &binfo->type, 0, true);
++
++	bcm47xx_fill_sprom(out, prefix, fallback);
++
++	return 0;
+ }
+ #endif
+ 
+diff --git a/arch/mips/include/asm/mach-bcm47xx/bcm47xx.h b/arch/mips/include/asm/mach-bcm47xx/bcm47xx.h
+index 8ed77f6..1461c10 100644
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx.h
+@@ -52,10 +52,6 @@ void bcm47xx_fill_sprom(struct ssb_sprom *sprom, const char *prefix,
+ void bcm47xx_fill_ssb_boardinfo(struct ssb_boardinfo *boardinfo,
+ 				const char *prefix);
+ #endif
+-#ifdef CONFIG_BCM47XX_BCMA
+-void bcm47xx_fill_bcma_boardinfo(struct bcma_boardinfo *boardinfo,
+-				 const char *prefix);
+-#endif
+ 
+ void bcm47xx_set_system_type(u16 chip_id);
+ 
+-- 
+1.8.4.5
+
diff --git a/target/linux/brcm47xx/patches-4.0/031-06-MIPS-BCM77xx-Remove-legacy-__cpuinit-data-sections-t.patch b/target/linux/brcm47xx/patches-4.0/031-06-MIPS-BCM77xx-Remove-legacy-__cpuinit-data-sections-t.patch
new file mode 100644
index 0000000000..329fe812cc
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.0/031-06-MIPS-BCM77xx-Remove-legacy-__cpuinit-data-sections-t.patch
@@ -0,0 +1,69 @@
+From 50d68dfef385127a1da2957813272c610c691157 Mon Sep 17 00:00:00 2001
+From: Paul Gortmaker <paul.gortmaker@windriver.com>
+Date: Mon, 27 Apr 2015 18:47:56 -0400
+Subject: [PATCH] MIPS: BCM77xx: Remove legacy __cpuinit{,data} sections that
+ crept in
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We removed __cpuinit support (leaving no-op stubs) quite some time ago.
+However a few more crept in as of commit 6ee1d93455384cef8a0426effe85da2
+("MIPS: BCM47XX: Detect more then 128 MiB of RAM (HIGHMEM)")
+
+Since we want to clobber the stubs soon, get this removed now.
+
+Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
+Cc: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: linux-kernel@vger.kernel.org
+Patchwork: https://patchwork.linux-mips.org/patch/9892/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/prom.c           | 2 +-
+ arch/mips/include/asm/pgtable-32.h | 2 +-
+ arch/mips/mm/tlb-r4k.c             | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/mips/bcm47xx/prom.c b/arch/mips/bcm47xx/prom.c
+index ab698ba..135a540 100644
+--- a/arch/mips/bcm47xx/prom.c
++++ b/arch/mips/bcm47xx/prom.c
+@@ -126,7 +126,7 @@ void __init prom_free_prom_memory(void)
+ /* Stripped version of tlb_init, with the call to build_tlb_refill_handler
+  * dropped. Calling it at this stage causes a hang.
+  */
+-void __cpuinit early_tlb_init(void)
++void early_tlb_init(void)
+ {
+ 	write_c0_pagemask(PM_DEFAULT_MASK);
+ 	write_c0_wired(0);
+diff --git a/arch/mips/include/asm/pgtable-32.h b/arch/mips/include/asm/pgtable-32.h
+index 7d56686..832e216 100644
+--- a/arch/mips/include/asm/pgtable-32.h
++++ b/arch/mips/include/asm/pgtable-32.h
+@@ -18,7 +18,7 @@
+ 
+ #include <asm-generic/pgtable-nopmd.h>
+ 
+-extern int temp_tlb_entry __cpuinitdata;
++extern int temp_tlb_entry;
+ 
+ /*
+  * - add_temporary_entry() add a temporary TLB entry. We use TLB entries
+diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
+index 08318ec..5037d58 100644
+--- a/arch/mips/mm/tlb-r4k.c
++++ b/arch/mips/mm/tlb-r4k.c
+@@ -411,7 +411,7 @@ int __init has_transparent_hugepage(void)
+  * lifetime of the system
+  */
+ 
+-int temp_tlb_entry __cpuinitdata;
++int temp_tlb_entry;
+ 
+ __init int add_temporary_entry(unsigned long entrylo0, unsigned long entrylo1,
+ 			       unsigned long entryhi, unsigned long pagemask)
+-- 
+1.8.4.5
+
diff --git a/target/linux/brcm47xx/patches-4.0/031-07-MIPS-BCM47XX-Support-Luxul-XWR-1750-board.patch b/target/linux/brcm47xx/patches-4.0/031-07-MIPS-BCM47XX-Support-Luxul-XWR-1750-board.patch
new file mode 100644
index 0000000000..430edc4531
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.0/031-07-MIPS-BCM47XX-Support-Luxul-XWR-1750-board.patch
@@ -0,0 +1,111 @@
+From 981de3c2f27af27fa4c5c952d122b35ee573ab7a Mon Sep 17 00:00:00 2001
+From: Dan Haab <dhaab@luxul.com>
+Date: Wed, 22 Apr 2015 13:58:33 -0600
+Subject: [PATCH] MIPS: BCM47XX: Support Luxul XWR-1750 board
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Dan Haab <dhaab@luxul.com>
+Acked-by: Rafał Miłecki <zajec5@gmail.com>
+Cc: linux-mips@linux-mips.org
+Cc: Hauke Mehrtens <hauke@hauke-m.de>
+Cc: Dan Haab <dhaab@luxul.com>
+Patchwork: https://patchwork.linux-mips.org/patch/9831/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/board.c                          |  1 +
+ arch/mips/bcm47xx/buttons.c                        | 11 +++++++++++
+ arch/mips/bcm47xx/leds.c                           | 14 ++++++++++++++
+ arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h |  2 ++
+ 4 files changed, 28 insertions(+)
+
+diff --git a/arch/mips/bcm47xx/board.c b/arch/mips/bcm47xx/board.c
+index bd56415..a88975a 100644
+--- a/arch/mips/bcm47xx/board.c
++++ b/arch/mips/bcm47xx/board.c
+@@ -149,6 +149,7 @@ struct bcm47xx_board_type_list2 bcm47xx_board_list_boot_hw[] __initconst = {
+ /* board_id */
+ static const
+ struct bcm47xx_board_type_list1 bcm47xx_board_list_board_id[] __initconst = {
++	{{BCM47XX_BOARD_LUXUL_XWR_1750_V1, "Luxul XWR-1750 V1"}, "luxul_xwr1750_v1"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614V8, "Netgear WGR614 V8"}, "U12H072T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614V9, "Netgear WGR614 V9"}, "U12H094T00_NETGEAR"},
+ 	{{BCM47XX_BOARD_NETGEAR_WGR614_V10, "Netgear WGR614 V10"}, "U12H139T01_NETGEAR"},
+diff --git a/arch/mips/bcm47xx/buttons.c b/arch/mips/bcm47xx/buttons.c
+index 276276a..08a4abf 100644
+--- a/arch/mips/bcm47xx/buttons.c
++++ b/arch/mips/bcm47xx/buttons.c
+@@ -299,6 +299,13 @@ bcm47xx_buttons_linksys_wrtsl54gs[] __initconst = {
+ 	BCM47XX_GPIO_KEY(6, KEY_RESTART),
+ };
+ 
++/* Luxul */
++
++static const struct gpio_keys_button
++bcm47xx_buttons_luxul_xwr_1750_v1[] = {
++	BCM47XX_GPIO_KEY(14, BTN_TASK),
++};
++
+ /* Microsoft */
+ 
+ static const struct gpio_keys_button
+@@ -555,6 +562,10 @@ int __init bcm47xx_buttons_register(void)
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrtsl54gs);
+ 		break;
+ 
++	case BCM47XX_BOARD_LUXUL_XWR_1750_V1:
++		err = bcm47xx_copy_bdata(bcm47xx_buttons_luxul_xwr_1750_v1);
++		break;
++
+ 	case BCM47XX_BOARD_MICROSOFT_MN700:
+ 		err = bcm47xx_copy_bdata(bcm47xx_buttons_microsoft_nm700);
+ 		break;
+diff --git a/arch/mips/bcm47xx/leds.c b/arch/mips/bcm47xx/leds.c
+index 0e4ade3..d20ae63 100644
+--- a/arch/mips/bcm47xx/leds.c
++++ b/arch/mips/bcm47xx/leds.c
+@@ -370,6 +370,16 @@ bcm47xx_leds_linksys_wrtsl54gs[] __initconst = {
+ 	BCM47XX_GPIO_LED(7, "orange", "wps", 1, LEDS_GPIO_DEFSTATE_OFF),
+ };
+ 
++/* Luxul */
++
++static const struct gpio_led
++bcm47xx_leds_luxul_xwr_1750_v1[] __initconst = {
++	BCM47XX_GPIO_LED(5, "green", "5ghz", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED(12, "green", "usb", 0, LEDS_GPIO_DEFSTATE_OFF),
++	BCM47XX_GPIO_LED_TRIGGER(13, "green", "status", 0, "timer"),
++	BCM47XX_GPIO_LED(15, "green", "wps", 0, LEDS_GPIO_DEFSTATE_OFF),
++};
++
+ /* Microsoft */
+ 
+ static const struct gpio_led
+@@ -623,6 +633,10 @@ void __init bcm47xx_leds_register(void)
+ 		bcm47xx_set_pdata(bcm47xx_leds_linksys_wrtsl54gs);
+ 		break;
+ 
++	case BCM47XX_BOARD_LUXUL_XWR_1750_V1:
++		bcm47xx_set_pdata(bcm47xx_leds_luxul_xwr_1750_v1);
++		break;
++
+ 	case BCM47XX_BOARD_MICROSOFT_MN700:
+ 		bcm47xx_set_pdata(bcm47xx_leds_microsoft_nm700);
+ 		break;
+diff --git a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
+index c41d1dc..2afb840 100644
+--- a/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
++++ b/arch/mips/include/asm/mach-bcm47xx/bcm47xx_board.h
+@@ -80,6 +80,8 @@ enum bcm47xx_board {
+ 	BCM47XX_BOARD_LINKSYS_WRT610NV2,
+ 	BCM47XX_BOARD_LINKSYS_WRTSL54GS,
+ 
++	BCM47XX_BOARD_LUXUL_XWR_1750_V1,
++
+ 	BCM47XX_BOARD_MICROSOFT_MN700,
+ 
+ 	BCM47XX_BOARD_MOTOROLA_WE800G,
+-- 
+1.8.4.5
+
diff --git a/target/linux/brcm47xx/patches-4.0/031-08-mips-bcm47xx-allow-retrieval-of-complete-nvram-conte.patch b/target/linux/brcm47xx/patches-4.0/031-08-mips-bcm47xx-allow-retrieval-of-complete-nvram-conte.patch
new file mode 100644
index 0000000000..bfa93af41c
--- /dev/null
+++ b/target/linux/brcm47xx/patches-4.0/031-08-mips-bcm47xx-allow-retrieval-of-complete-nvram-conte.patch
@@ -0,0 +1,164 @@
+From 2536295c2aeafc769215a6b2883126fa94c90b9a Mon Sep 17 00:00:00 2001
+From: Hante Meuleman <meuleman@broadcom.com>
+Date: Thu, 21 May 2015 15:27:23 +0200
+Subject: [PATCH] mips: bcm47xx: allow retrieval of complete nvram contents
+
+Host platforms such as routers supported by OpenWrt can
+support NVRAM reading directly from internal NVRAM store.
+The brcmfmac for one requires the complete nvram contents
+to select what needs to be sent to wireless device.
+
+Signed-off-by: Arend van Spriel <arend@broadcom.com>
+Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
+Reviewed-by: Arend Van Spriel <arend@broadcom.com>
+Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
+Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
+Cc: linux-mips@linux-mips.org
+Patchwork: https://patchwork.linux-mips.org/patch/10093/
+Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
+---
+ arch/mips/bcm47xx/nvram.c     | 60 ++++++++++++++++++++++++++++++++-----------
+ include/linux/bcm47xx_nvram.h | 15 +++++++++++
+ 2 files changed, 60 insertions(+), 15 deletions(-)
+
+diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c
+index 95d028c..2ed762e 100644
+--- a/arch/mips/bcm47xx/nvram.c
++++ b/arch/mips/bcm47xx/nvram.c
+@@ -94,17 +94,22 @@ static int nvram_find_and_copy(void __iomem *iobase, u32 lim)
+ 	return -ENXIO;
+ 
+ found:
+-	if (header->len > size)
+-		pr_err("The nvram size accoridng to the header seems to be bigger than the partition on flash\n");
+-	if (header->len > NVRAM_SPACE)
+-		pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+-		       header->len, NVRAM_SPACE - 1);
+-
+ 	src = (u32 *)header;
+ 	dst = (u32 *)nvram_buf;
+ 	for (i = 0; i < sizeof(struct nvram_header); i += 4)
+ 		*dst++ = __raw_readl(src++);
+-	for (; i < header->len && i < NVRAM_SPACE && i < size; i += 4)
++	header = (struct nvram_header *)nvram_buf;
++	if (header->len > size) {
++		pr_err("The nvram size according to the header seems to be bigger than the partition on flash\n");
++		header->len = size;
++	}
++	if (header->len >= NVRAM_SPACE) {
++		pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
++		       header->len, NVRAM_SPACE - 1);
++		header->len = NVRAM_SPACE - 1;
++	}
++	/* proceed reading data after header */
++	for (; i < header->len; i += 4)
+ 		*dst++ = readl(src++);
+ 	nvram_buf[NVRAM_SPACE - 1] = '\0';
+ 
+@@ -139,6 +144,7 @@ static int nvram_init(void)
+ #ifdef CONFIG_MTD
+ 	struct mtd_info *mtd;
+ 	struct nvram_header header;
++	struct nvram_header *pheader;
+ 	size_t bytes_read;
+ 	int err;
+ 
+@@ -147,20 +153,21 @@ static int nvram_init(void)
+ 		return -ENODEV;
+ 
+ 	err = mtd_read(mtd, 0, sizeof(header), &bytes_read, (uint8_t *)&header);
+-	if (!err && header.magic == NVRAM_MAGIC) {
+-		u8 *dst = (uint8_t *)nvram_buf;
+-		size_t len = header.len;
+-
+-		if (len >= NVRAM_SPACE) {
+-			len = NVRAM_SPACE - 1;
++	if (!err && header.magic == NVRAM_MAGIC &&
++	    header.len > sizeof(header)) {
++		if (header.len >= NVRAM_SPACE) {
+ 			pr_err("nvram on flash (%i bytes) is bigger than the reserved space in memory, will just copy the first %i bytes\n",
+-				header.len, len);
++				header.len, NVRAM_SPACE);
++			header.len = NVRAM_SPACE - 1;
+ 		}
+ 
+-		err = mtd_read(mtd, 0, len, &bytes_read, dst);
++		err = mtd_read(mtd, 0, header.len, &bytes_read,
++			       (u8 *)nvram_buf);
+ 		if (err)
+ 			return err;
+ 
++		pheader = (struct nvram_header *)nvram_buf;
++		pheader->len = header.len;
+ 		return 0;
+ 	}
+ #endif
+@@ -219,3 +226,26 @@ int bcm47xx_nvram_gpio_pin(const char *name)
+ 	return -ENOENT;
+ }
+ EXPORT_SYMBOL(bcm47xx_nvram_gpio_pin);
++
++char *bcm47xx_nvram_get_contents(size_t *nvram_size)
++{
++	int err;
++	char *nvram;
++	struct nvram_header *header;
++
++	if (!nvram_buf[0]) {
++		err = nvram_init();
++		if (err)
++			return NULL;
++	}
++
++	header = (struct nvram_header *)nvram_buf;
++	*nvram_size = header->len - sizeof(struct nvram_header);
++	nvram = vmalloc(*nvram_size);
++	if (!nvram)
++		return NULL;
++	memcpy(nvram, &nvram_buf[sizeof(struct nvram_header)], *nvram_size);
++
++	return nvram;
++}
++EXPORT_SYMBOL(bcm47xx_nvram_get_contents);
+diff --git a/include/linux/bcm47xx_nvram.h b/include/linux/bcm47xx_nvram.h
+index b12b07e..c73927c 100644
+--- a/include/linux/bcm47xx_nvram.h
++++ b/include/linux/bcm47xx_nvram.h
+@@ -10,11 +10,17 @@
+ 
+ #include <linux/types.h>
+ #include <linux/kernel.h>
++#include <linux/vmalloc.h>
+ 
+ #ifdef CONFIG_BCM47XX
+ int bcm47xx_nvram_init_from_mem(u32 base, u32 lim);
+ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len);
+ int bcm47xx_nvram_gpio_pin(const char *name);
++char *bcm47xx_nvram_get_contents(size_t *val_len);
++static inline void bcm47xx_nvram_release_contents(char *nvram)
++{
++	vfree(nvram);
++};
+ #else
+ static inline int bcm47xx_nvram_init_from_mem(u32 base, u32 lim)
+ {
+@@ -29,6 +35,15 @@ static inline int bcm47xx_nvram_gpio_pin(const char *name)
+ {
+ 	return -ENOTSUPP;
+ };
++
++static inline char *bcm47xx_nvram_get_contents(size_t *val_len)
++{
++	return NULL;
++};
++
++static inline void bcm47xx_nvram_release_contents(char *nvram)
++{
++};
+ #endif
+ 
+ #endif /* __BCM47XX_NVRAM_H */
+-- 
+1.8.4.5
+
diff --git a/target/linux/brcm47xx/patches-4.0/320-MIPS-BCM47XX-Devices-database-update-for-4.x.patch b/target/linux/brcm47xx/patches-4.0/320-MIPS-BCM47XX-Devices-database-update-for-4.x.patch
index 2f005b52b3..aa4e947762 100644
--- a/target/linux/brcm47xx/patches-4.0/320-MIPS-BCM47XX-Devices-database-update-for-4.x.patch
+++ b/target/linux/brcm47xx/patches-4.0/320-MIPS-BCM47XX-Devices-database-update-for-4.x.patch
@@ -42,7 +42,7 @@
  bcm47xx_buttons_linksys_wrt54g3gv2[] __initconst = {
  	BCM47XX_GPIO_KEY(5, KEY_WIMAX),
  	BCM47XX_GPIO_KEY(6, KEY_RESTART),
-@@ -407,6 +425,9 @@ int __init bcm47xx_buttons_register(void
+@@ -414,6 +432,9 @@ int __init bcm47xx_buttons_register(void
  	int err;
  
  	switch (board) {
@@ -52,7 +52,7 @@
  	case BCM47XX_BOARD_ASUS_RTN12:
  		err = bcm47xx_copy_bdata(bcm47xx_buttons_asus_rtn12);
  		break;
-@@ -537,6 +558,12 @@ int __init bcm47xx_buttons_register(void
+@@ -544,6 +565,12 @@ int __init bcm47xx_buttons_register(void
  	case BCM47XX_BOARD_LINKSYS_WRT310NV1:
  		err = bcm47xx_copy_bdata(bcm47xx_buttons_linksys_wrt310nv1);
  		break;
@@ -106,7 +106,7 @@
  bcm47xx_leds_linksys_wrt54g_generic[] __initconst = {
  	BCM47XX_GPIO_LED(0, "unk", "dmz", 1, LEDS_GPIO_DEFSTATE_OFF),
  	BCM47XX_GPIO_LED(1, "unk", "power", 0, LEDS_GPIO_DEFSTATE_ON),
-@@ -468,6 +483,9 @@ void __init bcm47xx_leds_register(void)
+@@ -478,6 +493,9 @@ void __init bcm47xx_leds_register(void)
  	enum bcm47xx_board board = bcm47xx_board_get();
  
  	switch (board) {
@@ -116,7 +116,7 @@
  	case BCM47XX_BOARD_ASUS_RTN12:
  		bcm47xx_set_pdata(bcm47xx_leds_asus_rtn12);
  		break;
-@@ -601,6 +619,9 @@ void __init bcm47xx_leds_register(void)
+@@ -611,6 +629,9 @@ void __init bcm47xx_leds_register(void)
  	case BCM47XX_BOARD_LINKSYS_WRT310NV1:
  		bcm47xx_set_pdata(bcm47xx_leds_linksys_wrt310nv1);
  		break;
diff --git a/target/linux/brcm47xx/patches-4.0/820-wgt634u-nvram-fix.patch b/target/linux/brcm47xx/patches-4.0/820-wgt634u-nvram-fix.patch
index 51ff74301a..c543e8e2e9 100644
--- a/target/linux/brcm47xx/patches-4.0/820-wgt634u-nvram-fix.patch
+++ b/target/linux/brcm47xx/patches-4.0/820-wgt634u-nvram-fix.patch
@@ -279,7 +279,7 @@ out the configuration than the in kernel cfe config reader.
  	/* TODO: when nvram is on nand flash check for bad blocks first. */
  	off = FLASH_MIN;
  	while (off <= lim) {
-@@ -181,6 +203,13 @@ int bcm47xx_nvram_getenv(const char *nam
+@@ -189,6 +211,13 @@ int bcm47xx_nvram_getenv(const char *nam
  			return err;
  	}
  
@@ -292,4 +292,4 @@ out the configuration than the in kernel cfe config reader.
 +
  	/* Look for name=value and return value */
  	var = &nvram_buf[sizeof(struct nvram_header)];
- 	end = nvram_buf + sizeof(nvram_buf) - 2;
+ 	end = nvram_buf + sizeof(nvram_buf);
diff --git a/target/linux/brcm47xx/patches-4.0/830-huawei_e970_support.patch b/target/linux/brcm47xx/patches-4.0/830-huawei_e970_support.patch
index e475532d42..fdb6c19cd2 100644
--- a/target/linux/brcm47xx/patches-4.0/830-huawei_e970_support.patch
+++ b/target/linux/brcm47xx/patches-4.0/830-huawei_e970_support.patch
@@ -8,7 +8,7 @@
  #include <asm/bootinfo.h>
  #include <asm/idle.h>
  #include <asm/prom.h>
-@@ -248,6 +249,33 @@ static struct fixed_phy_status bcm47xx_f
+@@ -245,6 +246,33 @@ static struct fixed_phy_status bcm47xx_f
  	.duplex	= DUPLEX_FULL,
  };
  
@@ -42,7 +42,7 @@
  static int __init bcm47xx_register_bus_complete(void)
  {
  	switch (bcm47xx_bus_type) {
-@@ -267,6 +295,7 @@ static int __init bcm47xx_register_bus_c
+@@ -264,6 +292,7 @@ static int __init bcm47xx_register_bus_c
  	bcm47xx_workarounds();
  
  	fixed_phy_add(PHY_POLL, 0, &bcm47xx_fixed_phy_status);
diff --git a/target/linux/brcm47xx/patches-4.0/920-cache-wround.patch b/target/linux/brcm47xx/patches-4.0/920-cache-wround.patch
index 05eff99607..39ed07cc86 100644
--- a/target/linux/brcm47xx/patches-4.0/920-cache-wround.patch
+++ b/target/linux/brcm47xx/patches-4.0/920-cache-wround.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/include/asm/r4kcache.h
 +++ b/arch/mips/include/asm/r4kcache.h
-@@ -26,10 +26,28 @@ extern void (*r4k_blast_icache)(void);
+@@ -28,10 +28,28 @@ extern void (*r4k_blast_icache)(void);
  #ifdef CONFIG_BCM47XX
  #include <asm/paccess.h>
  #include <linux/ssb/ssb.h>
@@ -34,7 +34,7 @@
  
 --- a/arch/mips/mm/tlbex.c
 +++ b/arch/mips/mm/tlbex.c
-@@ -941,6 +941,9 @@ build_get_pgde32(u32 **p, unsigned int t
+@@ -924,6 +924,9 @@ build_get_pgde32(u32 **p, unsigned int t
  		uasm_i_srl(p, ptr, ptr, SMP_CPUID_PTRSHIFT);
  		uasm_i_addu(p, ptr, tmp, ptr);
  #else
@@ -44,7 +44,7 @@
  		UASM_i_LA_mostly(p, ptr, pgdc);
  #endif
  		uasm_i_mfc0(p, tmp, C0_BADVADDR); /* get faulting address */
-@@ -1286,12 +1289,12 @@ static void build_r4000_tlb_refill_handl
+@@ -1269,12 +1272,12 @@ static void build_r4000_tlb_refill_handl
  			/* No need for uasm_i_nop */
  		}
  
@@ -60,7 +60,7 @@
  		build_get_pgde32(&p, K0, K1); /* get pgd in K1 */
  #endif
  
-@@ -1303,6 +1306,9 @@ static void build_r4000_tlb_refill_handl
+@@ -1286,6 +1289,9 @@ static void build_r4000_tlb_refill_handl
  		build_update_entries(&p, K0, K1);
  		build_tlb_write_entry(&p, &l, &r, tlb_random);
  		uasm_l_leave(&l, p);
@@ -70,7 +70,7 @@
  		uasm_i_eret(&p); /* return from trap */
  	}
  #ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT
-@@ -1851,12 +1857,12 @@ build_r4000_tlbchange_handler_head(u32 *
+@@ -1834,12 +1840,12 @@ build_r4000_tlbchange_handler_head(u32 *
  {
  	struct work_registers wr = build_get_work_registers(p);
  
@@ -86,7 +86,7 @@
  	build_get_pgde32(p, wr.r1, wr.r2); /* get pgd in ptr */
  #endif
  
-@@ -1903,6 +1909,9 @@ build_r4000_tlbchange_handler_tail(u32 *
+@@ -1886,6 +1892,9 @@ build_r4000_tlbchange_handler_tail(u32 *
  	build_tlb_write_entry(p, l, r, tlb_indexed);
  	uasm_l_leave(l, *p);
  	build_restore_work_registers(p);