mac80211: brcmfmac: backport remaining changes from 4.16

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>

5 files changed, 1297 insertions, 0 deletions

diff --git a/package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch b/package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch
new file mode 100644
index 0000000000..d010d23f01
--- /dev/null
+++ b/package/kernel/mac80211/patches/315-v4.16-0001-brcmfmac-Support-43455-save-restore-SR-feature-if-FW.patch
@@ -0,0 +1,27 @@
+From e3720dad99859251a8b0fe2807275a8afcfb560d Mon Sep 17 00:00:00 2001
+From: Double Lo <double.lo@cypress.com>
+Date: Tue, 19 Dec 2017 14:56:44 +0800
+Subject: [PATCH] brcmfmac: Support 43455 save-restore (SR) feature if FW
+ include -sr
+
+This patch will add 43455 into the save-restore(SR) capable chip list, so
+the SR engine will be enabled with 43455 FW which built-in the -sr
+function.
+
+Signed-off-by: Double Lo <double.lo@cypress.com>
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+@@ -1338,6 +1338,7 @@ bool brcmf_chip_sr_capable(struct brcmf_
+ 	switch (pub->chip) {
+ 	case BRCM_CC_4354_CHIP_ID:
+ 	case BRCM_CC_4356_CHIP_ID:
++	case BRCM_CC_4345_CHIP_ID:
+ 		/* explicitly check SR engine enable bit */
+ 		pmu_cc3_mask = BIT(2);
+ 		/* fall-through */
diff --git a/package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch b/package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch
new file mode 100644
index 0000000000..bd9de13d7a
--- /dev/null
+++ b/package/kernel/mac80211/patches/316-v4.16-0001-brcmfmac-Remove-array-of-functions.patch
@@ -0,0 +1,1043 @@
+From c9aa7a91de740c537dc8c2f9f3d36fc651371b13 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 9 Jan 2018 13:22:52 +0100
+Subject: [PATCH] brcmfmac: Remove array of functions
+
+Replace the array of functions with a pair of pointers to the
+relevant functions.
+
+Signed-off-by: Ian Molton <ian@mnementh.co.uk>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 115 +++++++-------
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.c    | 168 ++++++++++-----------
+ .../wireless/broadcom/brcm80211/brcmfmac/sdio.h    |  15 +-
+ 3 files changed, 146 insertions(+), 152 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -118,7 +118,7 @@ int brcmf_sdiod_intr_register(struct brc
+ 
+ 		ret = request_irq(pdata->oob_irq_nr, brcmf_sdiod_oob_irqhandler,
+ 				  pdata->oob_irq_flags, "brcmf_oob_intr",
+-				  &sdiodev->func[1]->dev);
++				  &sdiodev->func1->dev);
+ 		if (ret != 0) {
+ 			brcmf_err("request_irq failed %d\n", ret);
+ 			return ret;
+@@ -132,7 +132,7 @@ int brcmf_sdiod_intr_register(struct brc
+ 		}
+ 		sdiodev->irq_wake = true;
+ 
+-		sdio_claim_host(sdiodev->func[1]);
++		sdio_claim_host(sdiodev->func1);
+ 
+ 		if (sdiodev->bus_if->chip == BRCM_CC_43362_CHIP_ID) {
+ 			/* assign GPIO to SDIO core */
+@@ -159,13 +159,13 @@ int brcmf_sdiod_intr_register(struct brc
+ 			data |= SDIO_CCCR_BRCM_SEPINT_ACT_HI;
+ 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT,
+ 				     data, &ret);
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_release_host(sdiodev->func1);
+ 	} else {
+ 		brcmf_dbg(SDIO, "Entering\n");
+-		sdio_claim_host(sdiodev->func[1]);
+-		sdio_claim_irq(sdiodev->func[1], brcmf_sdiod_ib_irqhandler);
+-		sdio_claim_irq(sdiodev->func[2], brcmf_sdiod_dummy_irqhandler);
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_claim_host(sdiodev->func1);
++		sdio_claim_irq(sdiodev->func1, brcmf_sdiod_ib_irqhandler);
++		sdio_claim_irq(sdiodev->func2, brcmf_sdiod_dummy_irqhandler);
++		sdio_release_host(sdiodev->func1);
+ 		sdiodev->sd_irq_requested = true;
+ 	}
+ 
+@@ -183,26 +183,26 @@ void brcmf_sdiod_intr_unregister(struct
+ 		struct brcmfmac_sdio_pd *pdata;
+ 
+ 		pdata = &sdiodev->settings->bus.sdio;
+-		sdio_claim_host(sdiodev->func[1]);
++		sdio_claim_host(sdiodev->func1);
+ 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
+ 		brcmf_sdiod_func0_wb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_release_host(sdiodev->func1);
+ 
+ 		sdiodev->oob_irq_requested = false;
+ 		if (sdiodev->irq_wake) {
+ 			disable_irq_wake(pdata->oob_irq_nr);
+ 			sdiodev->irq_wake = false;
+ 		}
+-		free_irq(pdata->oob_irq_nr, &sdiodev->func[1]->dev);
++		free_irq(pdata->oob_irq_nr, &sdiodev->func1->dev);
+ 		sdiodev->irq_en = false;
+ 		sdiodev->oob_irq_requested = false;
+ 	}
+ 
+ 	if (sdiodev->sd_irq_requested) {
+-		sdio_claim_host(sdiodev->func[1]);
+-		sdio_release_irq(sdiodev->func[2]);
+-		sdio_release_irq(sdiodev->func[1]);
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_claim_host(sdiodev->func1);
++		sdio_release_irq(sdiodev->func2);
++		sdio_release_irq(sdiodev->func1);
++		sdio_release_host(sdiodev->func1);
+ 		sdiodev->sd_irq_requested = false;
+ 	}
+ }
+@@ -264,7 +264,7 @@ u32 brcmf_sdiod_readl(struct brcmf_sdio_
+ 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	data = sdio_readl(sdiodev->func[1], addr, &retval);
++	data = sdio_readl(sdiodev->func1, addr, &retval);
+ 
+ out:
+ 	if (ret)
+@@ -285,7 +285,7 @@ void brcmf_sdiod_writel(struct brcmf_sdi
+ 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	sdio_writel(sdiodev->func[1], data, addr, &retval);
++	sdio_writel(sdiodev->func1, data, addr, &retval);
+ 
+ out:
+ 	if (ret)
+@@ -550,7 +550,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
+ 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr, pkt);
++	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr, pkt);
+ 
+ done:
+ 	return err;
+@@ -575,13 +575,13 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	if (pktq->qlen == 1)
+-		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr,
++		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
+ 					    pktq->next);
+ 	else if (!sdiodev->sg_support) {
+ 		glom_skb = brcmu_pkt_buf_get_skb(totlen);
+ 		if (!glom_skb)
+ 			return -ENOMEM;
+-		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[2], addr,
++		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
+ 					    glom_skb);
+ 		if (err)
+ 			goto done;
+@@ -591,7 +591,7 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 			skb_pull(glom_skb, skb->len);
+ 		}
+ 	} else
+-		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func[2], false,
++		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func2, false,
+ 					    addr, pktq);
+ 
+ done:
+@@ -623,7 +623,7 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	if (!err)
+-		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[2], addr,
++		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2, addr,
+ 					     mypkt);
+ 
+ 	brcmu_pkt_buf_free_skb(mypkt);
+@@ -649,13 +649,13 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
+ 
+ 	if (pktq->qlen == 1 || !sdiodev->sg_support) {
+ 		skb_queue_walk(pktq, skb) {
+-			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[2],
++			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2,
+ 						     addr, skb);
+ 			if (err)
+ 				break;
+ 		}
+ 	} else {
+-		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func[2], true,
++		err = brcmf_sdiod_sglist_rw(sdiodev, sdiodev->func2, true,
+ 					    addr, pktq);
+ 	}
+ 
+@@ -686,7 +686,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 	else
+ 		dsize = size;
+ 
+-	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
+ 
+ 	/* Do the transfer(s) */
+ 	while (size) {
+@@ -706,10 +706,10 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 
+ 		if (write) {
+ 			memcpy(pkt->data, data, dsize);
+-			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func[1],
++			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func1,
+ 						     sdaddr, pkt);
+ 		} else {
+-			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func[1],
++			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func1,
+ 						    sdaddr, pkt);
+ 		}
+ 
+@@ -733,7 +733,7 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 
+ 	dev_kfree_skb(pkt);
+ 
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 
+ 	return err;
+ }
+@@ -757,7 +757,7 @@ void brcmf_sdiod_sgtable_alloc(struct br
+ 	uint nents;
+ 	int err;
+ 
+-	func = sdiodev->func[2];
++	func = sdiodev->func2;
+ 	host = func->card->host;
+ 	sdiodev->sg_support = host->max_segs > 1;
+ 	max_blocks = min_t(uint, host->max_blk_count, 511u);
+@@ -818,17 +818,17 @@ static int brcmf_sdiod_freezer_on(struct
+ 	brcmf_sdio_trigger_dpc(sdiodev->bus);
+ 	wait_event(sdiodev->freezer->thread_freeze,
+ 		   atomic_read(expect) == sdiodev->freezer->frozen_count);
+-	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
+ 	res = brcmf_sdio_sleep(sdiodev->bus, true);
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 	return res;
+ }
+ 
+ static void brcmf_sdiod_freezer_off(struct brcmf_sdio_dev *sdiodev)
+ {
+-	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
+ 	brcmf_sdio_sleep(sdiodev->bus, false);
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 	atomic_set(&sdiodev->freezer->freezing, 0);
+ 	complete_all(&sdiodev->freezer->resumed);
+ }
+@@ -878,19 +878,19 @@ static int brcmf_sdiod_remove(struct brc
+ 	brcmf_sdiod_freezer_detach(sdiodev);
+ 
+ 	/* Disable Function 2 */
+-	sdio_claim_host(sdiodev->func[2]);
+-	sdio_disable_func(sdiodev->func[2]);
+-	sdio_release_host(sdiodev->func[2]);
++	sdio_claim_host(sdiodev->func2);
++	sdio_disable_func(sdiodev->func2);
++	sdio_release_host(sdiodev->func2);
+ 
+ 	/* Disable Function 1 */
+-	sdio_claim_host(sdiodev->func[1]);
+-	sdio_disable_func(sdiodev->func[1]);
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
++	sdio_disable_func(sdiodev->func1);
++	sdio_release_host(sdiodev->func1);
+ 
+ 	sg_free_table(&sdiodev->sgtable);
+ 	sdiodev->sbwad = 0;
+ 
+-	pm_runtime_allow(sdiodev->func[1]->card->host->parent);
++	pm_runtime_allow(sdiodev->func1->card->host->parent);
+ 	return 0;
+ }
+ 
+@@ -906,29 +906,27 @@ static int brcmf_sdiod_probe(struct brcm
+ {
+ 	int ret = 0;
+ 
+-	sdiodev->num_funcs = 2;
++	sdio_claim_host(sdiodev->func1);
+ 
+-	sdio_claim_host(sdiodev->func[1]);
+-
+-	ret = sdio_set_block_size(sdiodev->func[1], SDIO_FUNC1_BLOCKSIZE);
++	ret = sdio_set_block_size(sdiodev->func1, SDIO_FUNC1_BLOCKSIZE);
+ 	if (ret) {
+ 		brcmf_err("Failed to set F1 blocksize\n");
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_release_host(sdiodev->func1);
+ 		goto out;
+ 	}
+-	ret = sdio_set_block_size(sdiodev->func[2], SDIO_FUNC2_BLOCKSIZE);
++	ret = sdio_set_block_size(sdiodev->func2, SDIO_FUNC2_BLOCKSIZE);
+ 	if (ret) {
+ 		brcmf_err("Failed to set F2 blocksize\n");
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_release_host(sdiodev->func1);
+ 		goto out;
+ 	}
+ 
+ 	/* increase F2 timeout */
+-	sdiodev->func[2]->enable_timeout = SDIO_WAIT_F2RDY;
++	sdiodev->func2->enable_timeout = SDIO_WAIT_F2RDY;
+ 
+ 	/* Enable Function 1 */
+-	ret = sdio_enable_func(sdiodev->func[1]);
+-	sdio_release_host(sdiodev->func[1]);
++	ret = sdio_enable_func(sdiodev->func1);
++	sdio_release_host(sdiodev->func1);
+ 	if (ret) {
+ 		brcmf_err("Failed to enable F1: err=%d\n", ret);
+ 		goto out;
+@@ -944,7 +942,7 @@ static int brcmf_sdiod_probe(struct brcm
+ 		ret = -ENODEV;
+ 		goto out;
+ 	}
+-	brcmf_sdiod_host_fixup(sdiodev->func[2]->card->host);
++	brcmf_sdiod_host_fixup(sdiodev->func2->card->host);
+ out:
+ 	if (ret)
+ 		brcmf_sdiod_remove(sdiodev);
+@@ -1032,16 +1030,15 @@ static int brcmf_ops_sdio_probe(struct s
+ 	/* store refs to functions used. mmc_card does
+ 	 * not hold the F0 function pointer.
+ 	 */
+-	sdiodev->func[0] = NULL;
+-	sdiodev->func[1] = func->card->sdio_func[0];
+-	sdiodev->func[2] = func;
++	sdiodev->func1 = func->card->sdio_func[0];
++	sdiodev->func2 = func;
+ 
+ 	sdiodev->bus_if = bus_if;
+ 	bus_if->bus_priv.sdio = sdiodev;
+ 	bus_if->proto_type = BRCMF_PROTO_BCDC;
+ 	dev_set_drvdata(&func->dev, bus_if);
+-	dev_set_drvdata(&sdiodev->func[1]->dev, bus_if);
+-	sdiodev->dev = &sdiodev->func[1]->dev;
++	dev_set_drvdata(&sdiodev->func1->dev, bus_if);
++	sdiodev->dev = &sdiodev->func1->dev;
+ 
+ 	brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_DOWN);
+ 
+@@ -1057,7 +1054,7 @@ static int brcmf_ops_sdio_probe(struct s
+ 
+ fail:
+ 	dev_set_drvdata(&func->dev, NULL);
+-	dev_set_drvdata(&sdiodev->func[1]->dev, NULL);
++	dev_set_drvdata(&sdiodev->func1->dev, NULL);
+ 	kfree(sdiodev);
+ 	kfree(bus_if);
+ 	return err;
+@@ -1086,8 +1083,8 @@ static void brcmf_ops_sdio_remove(struct
+ 		/* only proceed with rest of cleanup if func 1 */
+ 		brcmf_sdiod_remove(sdiodev);
+ 
+-		dev_set_drvdata(&sdiodev->func[1]->dev, NULL);
+-		dev_set_drvdata(&sdiodev->func[2]->dev, NULL);
++		dev_set_drvdata(&sdiodev->func1->dev, NULL);
++		dev_set_drvdata(&sdiodev->func2->dev, NULL);
+ 
+ 		kfree(bus_if);
+ 		kfree(sdiodev);
+@@ -1132,7 +1129,7 @@ static int brcmf_ops_sdio_suspend(struct
+ 		else
+ 			sdio_flags |= MMC_PM_WAKE_SDIO_IRQ;
+ 	}
+-	if (sdio_set_host_pm_flags(sdiodev->func[1], sdio_flags))
++	if (sdio_set_host_pm_flags(sdiodev->func1, sdio_flags))
+ 		brcmf_err("Failed to set pm_flags %x\n", sdio_flags);
+ 	return 0;
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -979,7 +979,7 @@ static int brcmf_sdio_readshared(struct
+ 	struct sdpcm_shared_le sh_le;
+ 	__le32 addr_le;
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 	brcmf_sdio_bus_sleep(bus, false, false);
+ 
+ 	/*
+@@ -1013,7 +1013,7 @@ static int brcmf_sdio_readshared(struct
+ 	if (rv < 0)
+ 		goto fail;
+ 
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 
+ 	/* Endianness */
+ 	sh->flags = le32_to_cpu(sh_le.flags);
+@@ -1035,7 +1035,7 @@ static int brcmf_sdio_readshared(struct
+ fail:
+ 	brcmf_err("unable to obtain sdpcm_shared info: rv=%d (addr=0x%x)\n",
+ 		  rv, addr);
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 	return rv;
+ }
+ 
+@@ -1157,7 +1157,7 @@ static void brcmf_sdio_rxfail(struct brc
+ 		  rtx ? ", send NAK" : "");
+ 
+ 	if (abort)
+-		brcmf_sdiod_abort(bus->sdiodev, bus->sdiodev->func[2]);
++		brcmf_sdiod_abort(bus->sdiodev, bus->sdiodev->func2);
+ 
+ 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_RF_TERM,
+ 			   &err);
+@@ -1209,7 +1209,7 @@ static void brcmf_sdio_txfail(struct brc
+ 	brcmf_err("sdio error, abort command and terminate frame\n");
+ 	bus->sdcnt.tx_sderrs++;
+ 
+-	brcmf_sdiod_abort(sdiodev, sdiodev->func[2]);
++	brcmf_sdiod_abort(sdiodev, sdiodev->func2);
+ 	brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_FRAMECTRL, SFC_WF_TERM, NULL);
+ 	bus->sdcnt.f1regdata++;
+ 
+@@ -1565,10 +1565,10 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+ 		 * read directly into the chained packet, or allocate a large
+ 		 * packet and and copy into the chain.
+ 		 */
+-		sdio_claim_host(bus->sdiodev->func[1]);
++		sdio_claim_host(bus->sdiodev->func1);
+ 		errcode = brcmf_sdiod_recv_chain(bus->sdiodev,
+ 						 &bus->glom, dlen);
+-		sdio_release_host(bus->sdiodev->func[1]);
++		sdio_release_host(bus->sdiodev->func1);
+ 		bus->sdcnt.f2rxdata++;
+ 
+ 		/* On failure, kill the superframe */
+@@ -1576,11 +1576,11 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+ 			brcmf_err("glom read of %d bytes failed: %d\n",
+ 				  dlen, errcode);
+ 
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			brcmf_sdio_rxfail(bus, true, false);
+ 			bus->sdcnt.rxglomfail++;
+ 			brcmf_sdio_free_glom(bus);
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 			return 0;
+ 		}
+ 
+@@ -1590,10 +1590,10 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+ 
+ 		rd_new.seq_num = rxseq;
+ 		rd_new.len = dlen;
+-		sdio_claim_host(bus->sdiodev->func[1]);
++		sdio_claim_host(bus->sdiodev->func1);
+ 		errcode = brcmf_sdio_hdparse(bus, pfirst->data, &rd_new,
+ 					     BRCMF_SDIO_FT_SUPER);
+-		sdio_release_host(bus->sdiodev->func[1]);
++		sdio_release_host(bus->sdiodev->func1);
+ 		bus->cur_read.len = rd_new.len_nxtfrm << 4;
+ 
+ 		/* Remove superframe header, remember offset */
+@@ -1609,10 +1609,10 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+ 
+ 			rd_new.len = pnext->len;
+ 			rd_new.seq_num = rxseq++;
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			errcode = brcmf_sdio_hdparse(bus, pnext->data, &rd_new,
+ 						     BRCMF_SDIO_FT_SUB);
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 			brcmf_dbg_hex_dump(BRCMF_GLOM_ON(),
+ 					   pnext->data, 32, "subframe:\n");
+ 
+@@ -1621,11 +1621,11 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+ 
+ 		if (errcode) {
+ 			/* Terminate frame on error */
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			brcmf_sdio_rxfail(bus, true, false);
+ 			bus->sdcnt.rxglomfail++;
+ 			brcmf_sdio_free_glom(bus);
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 			bus->cur_read.len = 0;
+ 			return 0;
+ 		}
+@@ -1833,7 +1833,7 @@ static uint brcmf_sdio_readframes(struct
+ 
+ 		rd->len_left = rd->len;
+ 		/* read header first for unknow frame length */
+-		sdio_claim_host(bus->sdiodev->func[1]);
++		sdio_claim_host(bus->sdiodev->func1);
+ 		if (!rd->len) {
+ 			ret = brcmf_sdiod_recv_buf(bus->sdiodev,
+ 						   bus->rxhdr, BRCMF_FIRSTREAD);
+@@ -1843,7 +1843,7 @@ static uint brcmf_sdio_readframes(struct
+ 					  ret);
+ 				bus->sdcnt.rx_hdrfail++;
+ 				brcmf_sdio_rxfail(bus, true, true);
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 				continue;
+ 			}
+ 
+@@ -1853,7 +1853,7 @@ static uint brcmf_sdio_readframes(struct
+ 
+ 			if (brcmf_sdio_hdparse(bus, bus->rxhdr, rd,
+ 					       BRCMF_SDIO_FT_NORMAL)) {
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 				if (!bus->rxpending)
+ 					break;
+ 				else
+@@ -1869,7 +1869,7 @@ static uint brcmf_sdio_readframes(struct
+ 				rd->len_nxtfrm = 0;
+ 				/* treat all packet as event if we don't know */
+ 				rd->channel = SDPCM_EVENT_CHANNEL;
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 				continue;
+ 			}
+ 			rd->len_left = rd->len > BRCMF_FIRSTREAD ?
+@@ -1886,7 +1886,7 @@ static uint brcmf_sdio_readframes(struct
+ 			brcmf_err("brcmu_pkt_buf_get_skb failed\n");
+ 			brcmf_sdio_rxfail(bus, false,
+ 					    RETRYCHAN(rd->channel));
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 			continue;
+ 		}
+ 		skb_pull(pkt, head_read);
+@@ -1894,16 +1894,16 @@ static uint brcmf_sdio_readframes(struct
+ 
+ 		ret = brcmf_sdiod_recv_pkt(bus->sdiodev, pkt);
+ 		bus->sdcnt.f2rxdata++;
+-		sdio_release_host(bus->sdiodev->func[1]);
++		sdio_release_host(bus->sdiodev->func1);
+ 
+ 		if (ret < 0) {
+ 			brcmf_err("read %d bytes from channel %d failed: %d\n",
+ 				  rd->len, rd->channel, ret);
+ 			brcmu_pkt_buf_free_skb(pkt);
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			brcmf_sdio_rxfail(bus, true,
+ 					    RETRYCHAN(rd->channel));
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 			continue;
+ 		}
+ 
+@@ -1914,7 +1914,7 @@ static uint brcmf_sdio_readframes(struct
+ 		} else {
+ 			memcpy(bus->rxhdr, pkt->data, SDPCM_HDRLEN);
+ 			rd_new.seq_num = rd->seq_num;
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			if (brcmf_sdio_hdparse(bus, bus->rxhdr, &rd_new,
+ 					       BRCMF_SDIO_FT_NORMAL)) {
+ 				rd->len = 0;
+@@ -1927,11 +1927,11 @@ static uint brcmf_sdio_readframes(struct
+ 					  roundup(rd_new.len, 16) >> 4);
+ 				rd->len = 0;
+ 				brcmf_sdio_rxfail(bus, true, true);
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 				brcmu_pkt_buf_free_skb(pkt);
+ 				continue;
+ 			}
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 			rd->len_nxtfrm = rd_new.len_nxtfrm;
+ 			rd->channel = rd_new.channel;
+ 			rd->dat_offset = rd_new.dat_offset;
+@@ -1947,9 +1947,9 @@ static uint brcmf_sdio_readframes(struct
+ 					  rd_new.seq_num);
+ 				/* Force retry w/normal header read */
+ 				rd->len = 0;
+-				sdio_claim_host(bus->sdiodev->func[1]);
++				sdio_claim_host(bus->sdiodev->func1);
+ 				brcmf_sdio_rxfail(bus, false, true);
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 				brcmu_pkt_buf_free_skb(pkt);
+ 				continue;
+ 			}
+@@ -1972,9 +1972,9 @@ static uint brcmf_sdio_readframes(struct
+ 			} else {
+ 				brcmf_err("%s: glom superframe w/o "
+ 					  "descriptor!\n", __func__);
+-				sdio_claim_host(bus->sdiodev->func[1]);
++				sdio_claim_host(bus->sdiodev->func1);
+ 				brcmf_sdio_rxfail(bus, false, false);
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 			}
+ 			/* prepare the descriptor for the next read */
+ 			rd->len = rd->len_nxtfrm << 4;
+@@ -2072,7 +2072,7 @@ static int brcmf_sdio_txpkt_prep_sg(stru
+ 	int ntail, ret;
+ 
+ 	sdiodev = bus->sdiodev;
+-	blksize = sdiodev->func[2]->cur_blksize;
++	blksize = sdiodev->func2->cur_blksize;
+ 	/* sg entry alignment should be a divisor of block size */
+ 	WARN_ON(blksize % bus->sgentry_align);
+ 
+@@ -2251,14 +2251,14 @@ static int brcmf_sdio_txpkt(struct brcmf
+ 	if (ret)
+ 		goto done;
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 	ret = brcmf_sdiod_send_pkt(bus->sdiodev, pktq);
+ 	bus->sdcnt.f2txdata++;
+ 
+ 	if (ret < 0)
+ 		brcmf_sdio_txfail(bus);
+ 
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 
+ done:
+ 	brcmf_sdio_txpkt_postp(bus, pktq);
+@@ -2314,10 +2314,11 @@ static uint brcmf_sdio_sendfromq(struct
+ 		/* In poll mode, need to check for other events */
+ 		if (!bus->intr) {
+ 			/* Check device status, signal pending interrupt */
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			intstatus = brcmf_sdiod_readl(bus->sdiodev,
+ 						      intstat_addr, &ret);
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
++
+ 			bus->sdcnt.f2txdata++;
+ 			if (ret != 0)
+ 				break;
+@@ -2417,7 +2418,7 @@ static void brcmf_sdio_bus_stop(struct d
+ 	}
+ 
+ 	if (sdiodev->state != BRCMF_SDIOD_NOMEDIUM) {
+-		sdio_claim_host(sdiodev->func[1]);
++		sdio_claim_host(sdiodev->func1);
+ 
+ 		/* Enable clock for device interrupts */
+ 		brcmf_sdio_bus_sleep(bus, false, false);
+@@ -2441,13 +2442,13 @@ static void brcmf_sdio_bus_stop(struct d
+ 
+ 		/* Turn off the bus (F2), free any pending packets */
+ 		brcmf_dbg(INTR, "disable SDIO interrupts\n");
+-		sdio_disable_func(sdiodev->func[2]);
++		sdio_disable_func(sdiodev->func2);
+ 
+ 		/* Clear any pending interrupts now that F2 is disabled */
+ 		brcmf_sdiod_writel(sdiodev, core->base + SD_REG(intstatus),
+ 				   local_hostintmask, NULL);
+ 
+-		sdio_release_host(sdiodev->func[1]);
++		sdio_release_host(sdiodev->func1);
+ 	}
+ 	/* Clear the data packet queues */
+ 	brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
+@@ -2522,7 +2523,7 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 
+ 	/* If waiting for HTAVAIL, check status */
+ 	if (!bus->sr_enabled && bus->clkstate == CLK_PENDING) {
+@@ -2585,7 +2586,7 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 		intstatus |= brcmf_sdio_hostmail(bus);
+ 	}
+ 
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 
+ 	/* Generally don't ask for these, can get CRC errors... */
+ 	if (intstatus & I_WR_OOSYNC) {
+@@ -2628,7 +2629,7 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 
+ 	if (bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL) &&
+ 	    data_ok(bus)) {
+-		sdio_claim_host(bus->sdiodev->func[1]);
++		sdio_claim_host(bus->sdiodev->func1);
+ 		if (bus->ctrl_frame_stat) {
+ 			err = brcmf_sdio_tx_ctrlframe(bus,  bus->ctrl_frame_buf,
+ 						      bus->ctrl_frame_len);
+@@ -2636,7 +2637,7 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 			wmb();
+ 			bus->ctrl_frame_stat = false;
+ 		}
+-		sdio_release_host(bus->sdiodev->func[1]);
++		sdio_release_host(bus->sdiodev->func1);
+ 		brcmf_sdio_wait_event_wakeup(bus);
+ 	}
+ 	/* Send queued frames (limit 1 if rx may still be pending) */
+@@ -2652,14 +2653,14 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 		brcmf_err("failed backplane access over SDIO, halting operation\n");
+ 		atomic_set(&bus->intstatus, 0);
+ 		if (bus->ctrl_frame_stat) {
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			if (bus->ctrl_frame_stat) {
+ 				bus->ctrl_frame_err = -ENODEV;
+ 				wmb();
+ 				bus->ctrl_frame_stat = false;
+ 				brcmf_sdio_wait_event_wakeup(bus);
+ 			}
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 		}
+ 	} else if (atomic_read(&bus->intstatus) ||
+ 		   atomic_read(&bus->ipend) > 0 ||
+@@ -2874,13 +2875,13 @@ brcmf_sdio_bus_txctl(struct device *dev,
+ 					 CTL_DONE_TIMEOUT);
+ 	ret = 0;
+ 	if (bus->ctrl_frame_stat) {
+-		sdio_claim_host(bus->sdiodev->func[1]);
++		sdio_claim_host(bus->sdiodev->func1);
+ 		if (bus->ctrl_frame_stat) {
+ 			brcmf_dbg(SDIO, "ctrl_frame timeout\n");
+ 			bus->ctrl_frame_stat = false;
+ 			ret = -ETIMEDOUT;
+ 		}
+-		sdio_release_host(bus->sdiodev->func[1]);
++		sdio_release_host(bus->sdiodev->func1);
+ 	}
+ 	if (!ret) {
+ 		brcmf_dbg(SDIO, "ctrl_frame complete, err=%d\n",
+@@ -3004,7 +3005,7 @@ static int brcmf_sdio_assert_info(struct
+ 		return 0;
+ 	}
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 	if (sh->assert_file_addr != 0) {
+ 		error = brcmf_sdiod_ramrw(bus->sdiodev, false,
+ 					  sh->assert_file_addr, (u8 *)file, 80);
+@@ -3017,7 +3018,7 @@ static int brcmf_sdio_assert_info(struct
+ 		if (error < 0)
+ 			return error;
+ 	}
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 
+ 	seq_printf(seq, "dongle assert: %s:%d: assert(%s)\n",
+ 		   file, sh->assert_line, expr);
+@@ -3291,7 +3292,7 @@ static int brcmf_sdio_download_firmware(
+ 	int bcmerror;
+ 	u32 rstvec;
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 	brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
+ 
+ 	rstvec = get_unaligned_le32(fw->data);
+@@ -3320,7 +3321,7 @@ static int brcmf_sdio_download_firmware(
+ 
+ err:
+ 	brcmf_sdio_clkctl(bus, CLK_SDONLY, false);
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 	return bcmerror;
+ }
+ 
+@@ -3435,7 +3436,7 @@ static int brcmf_sdio_bus_preinit(struct
+ 	if (sdiodev->sg_support) {
+ 		bus->txglom = false;
+ 		value = 1;
+-		pad_size = bus->sdiodev->func[2]->cur_blksize << 1;
++		pad_size = bus->sdiodev->func2->cur_blksize << 1;
+ 		err = brcmf_iovar_data_set(bus->sdiodev->dev, "bus:rxglom",
+ 					   &value, sizeof(u32));
+ 		if (err < 0) {
+@@ -3477,7 +3478,7 @@ static int brcmf_sdio_bus_get_memdump(st
+ 
+ 	address = bus->ci->rambase;
+ 	offset = err = 0;
+-	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
+ 	while (offset < mem_size) {
+ 		len = ((offset + MEMBLOCK) < mem_size) ? MEMBLOCK :
+ 		      mem_size - offset;
+@@ -3493,7 +3494,7 @@ static int brcmf_sdio_bus_get_memdump(st
+ 	}
+ 
+ done:
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 	return err;
+ }
+ 
+@@ -3550,11 +3551,10 @@ static void brcmf_sdio_bus_watchdog(stru
+ 			if (!bus->dpc_triggered) {
+ 				u8 devpend;
+ 
+-				sdio_claim_host(bus->sdiodev->func[1]);
++				sdio_claim_host(bus->sdiodev->func1);
+ 				devpend = brcmf_sdiod_func0_rb(bus->sdiodev,
+-							       SDIO_CCCR_INTx,
+-							       NULL);
+-				sdio_release_host(bus->sdiodev->func[1]);
++						  SDIO_CCCR_INTx, NULL);
++				sdio_release_host(bus->sdiodev->func1);
+ 				intstatus = devpend & (INTR_STATUS_FUNC1 |
+ 						       INTR_STATUS_FUNC2);
+ 			}
+@@ -3580,13 +3580,13 @@ static void brcmf_sdio_bus_watchdog(stru
+ 		bus->console.count += jiffies_to_msecs(BRCMF_WD_POLL);
+ 		if (bus->console.count >= bus->console_interval) {
+ 			bus->console.count -= bus->console_interval;
+-			sdio_claim_host(bus->sdiodev->func[1]);
++			sdio_claim_host(bus->sdiodev->func1);
+ 			/* Make sure backplane clock is on */
+ 			brcmf_sdio_bus_sleep(bus, false, false);
+ 			if (brcmf_sdio_readconsole(bus) < 0)
+ 				/* stop on error */
+ 				bus->console_interval = 0;
+-			sdio_release_host(bus->sdiodev->func[1]);
++			sdio_release_host(bus->sdiodev->func1);
+ 		}
+ 	}
+ #endif				/* DEBUG */
+@@ -3599,11 +3599,11 @@ static void brcmf_sdio_bus_watchdog(stru
+ 			bus->idlecount++;
+ 			if (bus->idlecount > bus->idletime) {
+ 				brcmf_dbg(SDIO, "idle\n");
+-				sdio_claim_host(bus->sdiodev->func[1]);
++				sdio_claim_host(bus->sdiodev->func1);
+ 				brcmf_sdio_wd_timer(bus, false);
+ 				bus->idlecount = 0;
+ 				brcmf_sdio_bus_sleep(bus, true, false);
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 			}
+ 		} else {
+ 			bus->idlecount = 0;
+@@ -3773,8 +3773,8 @@ static u32 brcmf_sdio_buscore_read32(voi
+ 	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
+ 
+ 	if (addr == CORE_CC_REG(SI_ENUM_BASE, chipid) &&
+-	    (sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
+-	     sdiodev->func[1]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
++	    (sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
++	     sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
+ 		rev = (val & CID_REV_MASK) >> CID_REV_SHIFT;
+ 		if (rev >= 2) {
+ 			val &= ~CID_ID_MASK;
+@@ -3810,7 +3810,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 	u32 drivestrength;
+ 
+ 	sdiodev = bus->sdiodev;
+-	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
+ 
+ 	pr_debug("F1 signature read @0x18000000=0x%4x\n",
+ 		 brcmf_sdiod_readl(sdiodev, SI_ENUM_BASE, NULL));
+@@ -3877,8 +3877,8 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 	/* wowl can be supported when KEEP_POWER is true and (WAKE_SDIO_IRQ
+ 	 * is true or when platform data OOB irq is true).
+ 	 */
+-	if ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_KEEP_POWER) &&
+-	    ((sdio_get_host_pm_caps(sdiodev->func[1]) & MMC_PM_WAKE_SDIO_IRQ) ||
++	if ((sdio_get_host_pm_caps(sdiodev->func1) & MMC_PM_KEEP_POWER) &&
++	    ((sdio_get_host_pm_caps(sdiodev->func1) & MMC_PM_WAKE_SDIO_IRQ) ||
+ 	     (sdiodev->settings->bus.sdio.oob_irq_supported)))
+ 		sdiodev->bus_if->wowl_supported = true;
+ #endif
+@@ -3917,7 +3917,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 	if (err)
+ 		goto fail;
+ 
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 
+ 	brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
+ 
+@@ -3938,7 +3938,7 @@ brcmf_sdio_probe_attach(struct brcmf_sdi
+ 	return true;
+ 
+ fail:
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 	return false;
+ }
+ 
+@@ -4044,7 +4044,7 @@ static void brcmf_sdio_firmware_callback
+ 	bus->sdcnt.tickcnt = 0;
+ 	brcmf_sdio_wd_timer(bus, true);
+ 
+-	sdio_claim_host(sdiodev->func[1]);
++	sdio_claim_host(sdiodev->func1);
+ 
+ 	/* Make sure backplane clock is on, needed to generate F2 interrupt */
+ 	brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
+@@ -4066,7 +4066,7 @@ static void brcmf_sdio_firmware_callback
+ 	brcmf_sdiod_writel(sdiod, core->base + SD_REG(tosbmailboxdata),
+ 			   SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT, NULL);
+ 
+-	err = sdio_enable_func(sdiodev->func[2]);
++	err = sdio_enable_func(sdiodev->func2);
+ 
+ 	brcmf_dbg(INFO, "enable F2: err=%d\n", err);
+ 
+@@ -4081,7 +4081,7 @@ static void brcmf_sdio_firmware_callback
+ 		brcmf_sdiod_writeb(sdiodev, SBSDIO_WATERMARK, 8, &err);
+ 	} else {
+ 		/* Disable F2 again */
+-		sdio_disable_func(sdiodev->func[2]);
++		sdio_disable_func(sdiodev->func2);
+ 		goto release;
+ 	}
+ 
+@@ -4106,7 +4106,7 @@ static void brcmf_sdio_firmware_callback
+ 	if (err != 0)
+ 		brcmf_sdio_clkctl(bus, CLK_NONE, false);
+ 
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ 
+ 	err = brcmf_bus_started(dev);
+ 	if (err != 0) {
+@@ -4116,10 +4116,10 @@ static void brcmf_sdio_firmware_callback
+ 	return;
+ 
+ release:
+-	sdio_release_host(sdiodev->func[1]);
++	sdio_release_host(sdiodev->func1);
+ fail:
+ 	brcmf_dbg(TRACE, "failed: dev=%s, err=%d\n", dev_name(dev), err);
+-	device_release_driver(&sdiodev->func[2]->dev);
++	device_release_driver(&sdiodev->func2->dev);
+ 	device_release_driver(dev);
+ }
+ 
+@@ -4146,7 +4146,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 
+ 	/* single-threaded workqueue */
+ 	wq = alloc_ordered_workqueue("brcmf_wq/%s", WQ_MEM_RECLAIM,
+-				     dev_name(&sdiodev->func[1]->dev));
++				     dev_name(&sdiodev->func1->dev));
+ 	if (!wq) {
+ 		brcmf_err("insufficient memory to create txworkqueue\n");
+ 		goto fail;
+@@ -4173,7 +4173,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 	init_completion(&bus->watchdog_wait);
+ 	bus->watchdog_tsk = kthread_run(brcmf_sdio_watchdog_thread,
+ 					bus, "brcmf_wdog/%s",
+-					dev_name(&sdiodev->func[1]->dev));
++					dev_name(&sdiodev->func1->dev));
+ 	if (IS_ERR(bus->watchdog_tsk)) {
+ 		pr_warn("brcmf_watchdog thread failed to start\n");
+ 		bus->watchdog_tsk = NULL;
+@@ -4199,7 +4199,7 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 	}
+ 
+ 	/* Query the F2 block size, set roundup accordingly */
+-	bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
++	bus->blocksize = bus->sdiodev->func2->cur_blksize;
+ 	bus->roundup = min(max_roundup, bus->blocksize);
+ 
+ 	/* Allocate buffers */
+@@ -4215,17 +4215,17 @@ struct brcmf_sdio *brcmf_sdio_probe(stru
+ 		}
+ 	}
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 
+ 	/* Disable F2 to clear any intermediate frame state on the dongle */
+-	sdio_disable_func(bus->sdiodev->func[2]);
++	sdio_disable_func(bus->sdiodev->func2);
+ 
+ 	bus->rxflow = false;
+ 
+ 	/* Done with backplane-dependent accesses, can drop clock... */
+ 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
+ 
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 
+ 	/* ...and initialize clock/power states */
+ 	bus->clkstate = CLK_SDONLY;
+@@ -4277,7 +4277,7 @@ void brcmf_sdio_remove(struct brcmf_sdio
+ 
+ 		if (bus->ci) {
+ 			if (bus->sdiodev->state != BRCMF_SDIOD_NOMEDIUM) {
+-				sdio_claim_host(bus->sdiodev->func[1]);
++				sdio_claim_host(bus->sdiodev->func1);
+ 				brcmf_sdio_wd_timer(bus, false);
+ 				brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
+ 				/* Leave the device in state where it is
+@@ -4287,7 +4287,7 @@ void brcmf_sdio_remove(struct brcmf_sdio
+ 				msleep(20);
+ 				brcmf_chip_set_passive(bus->ci);
+ 				brcmf_sdio_clkctl(bus, CLK_NONE, false);
+-				sdio_release_host(bus->sdiodev->func[1]);
++				sdio_release_host(bus->sdiodev->func1);
+ 			}
+ 			brcmf_chip_detach(bus->ci);
+ 		}
+@@ -4334,9 +4334,9 @@ int brcmf_sdio_sleep(struct brcmf_sdio *
+ {
+ 	int ret;
+ 
+-	sdio_claim_host(bus->sdiodev->func[1]);
++	sdio_claim_host(bus->sdiodev->func1);
+ 	ret = brcmf_sdio_bus_sleep(bus, sleep, false);
+-	sdio_release_host(bus->sdiodev->func[1]);
++	sdio_release_host(bus->sdiodev->func1);
+ 
+ 	return ret;
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -21,9 +21,6 @@
+ #include <linux/firmware.h>
+ #include "firmware.h"
+ 
+-/* Maximum number of I/O funcs */
+-#define NUM_SDIO_FUNCS	3
+-
+ #define SDIOD_FBR_SIZE		0x100
+ 
+ /* io_en */
+@@ -173,8 +170,8 @@ struct brcmf_sdio;
+ struct brcmf_sdiod_freezer;
+ 
+ struct brcmf_sdio_dev {
+-	struct sdio_func *func[NUM_SDIO_FUNCS];
+-	u8 num_funcs;			/* Supported funcs on client */
++	struct sdio_func *func1;
++	struct sdio_func *func2;
+ 	u32 sbwad;			/* Save backplane window address */
+ 	struct brcmf_core *cc_core;	/* chipcommon core info struct */
+ 	struct brcmf_sdio *bus;
+@@ -295,17 +292,17 @@ void brcmf_sdiod_intr_unregister(struct
+ /* SDIO device register access interface */
+ /* Accessors for SDIO Function 0 */
+ #define brcmf_sdiod_func0_rb(sdiodev, addr, r) \
+-	sdio_f0_readb((sdiodev)->func[1], (addr), (r))
++	sdio_f0_readb((sdiodev)->func1, (addr), (r))
+ 
+ #define brcmf_sdiod_func0_wb(sdiodev, addr, v, ret) \
+-	sdio_f0_writeb((sdiodev)->func[1], (v), (addr), (ret))
++	sdio_f0_writeb((sdiodev)->func1, (v), (addr), (ret))
+ 
+ /* Accessors for SDIO Function 1 */
+ #define brcmf_sdiod_readb(sdiodev, addr, r) \
+-	sdio_readb((sdiodev)->func[1], (addr), (r))
++	sdio_readb((sdiodev)->func1, (addr), (r))
+ 
+ #define brcmf_sdiod_writeb(sdiodev, addr, v, ret) \
+-	sdio_writeb((sdiodev)->func[1], (v), (addr), (ret))
++	sdio_writeb((sdiodev)->func1, (v), (addr), (ret))
+ 
+ u32 brcmf_sdiod_readl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
+ void brcmf_sdiod_writel(struct brcmf_sdio_dev *sdiodev, u32 addr, u32 data,
diff --git a/package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch b/package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch
new file mode 100644
index 0000000000..dc78000be1
--- /dev/null
+++ b/package/kernel/mac80211/patches/316-v4.16-0002-brcmfmac-add-comment-block-in-brcmf_sdio_buscore_rea.patch
@@ -0,0 +1,31 @@
+From 32adbcaa5df49f1977441f7a4bf180a0bcfe9966 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 9 Jan 2018 13:22:53 +0100
+Subject: [PATCH] brcmfmac: add comment block in brcmf_sdio_buscore_read()
+
+In brcmf_sdio_buscore_read() there is some special handling upon
+register access to chipid register of the chipcommon core. Add
+comment explaining why it is done here.
+
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3772,6 +3772,13 @@ static u32 brcmf_sdio_buscore_read32(voi
+ 
+ 	val = brcmf_sdiod_readl(sdiodev, addr, NULL);
+ 
++	/*
++	 * this is a bit of special handling if reading the chipcommon chipid
++	 * register. The 4339 is a next-gen of the 4335. It uses the same
++	 * SDIO device id as 4335 and the chipid register returns 4335 as well.
++	 * It can be identified as 4339 by looking at the chip revision. It
++	 * is corrected here so the chip.c module has the right info.
++	 */
+ 	if (addr == CORE_CC_REG(SI_ENUM_BASE, chipid) &&
+ 	    (sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4339 ||
+ 	     sdiodev->func1->device == SDIO_DEVICE_ID_BROADCOM_4335_4339)) {
diff --git a/package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch b/package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch
new file mode 100644
index 0000000000..c587f413d5
--- /dev/null
+++ b/package/kernel/mac80211/patches/316-v4.16-0003-brcmfmac-rename-brcmf_sdiod_buff_-read-write-functio.patch
@@ -0,0 +1,137 @@
+From 378f6a16043e5d3346301fc618f503e97aea335b Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 9 Jan 2018 13:22:54 +0100
+Subject: [PATCH] brcmfmac: rename brcmf_sdiod_buff_{read,write}() functions
+
+Rename functions to brcmf_sdio_skbuff_{read,write}() as we pass an
+skbuff to this function.
+
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 48 +++++++++++-----------
+ 1 file changed, 24 insertions(+), 24 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -292,24 +292,24 @@ out:
+ 		*ret = retval;
+ }
+ 
+-static int brcmf_sdiod_buff_read(struct brcmf_sdio_dev *sdiodev,
+-				 struct sdio_func *func, u32 addr,
+-				 struct sk_buff *pkt)
++static int brcmf_sdiod_skbuff_read(struct brcmf_sdio_dev *sdiodev,
++				   struct sdio_func *func, u32 addr,
++				   struct sk_buff *skb)
+ {
+ 	unsigned int req_sz;
+ 	int err;
+ 
+ 	/* Single skb use the standard mmc interface */
+-	req_sz = pkt->len + 3;
++	req_sz = skb->len + 3;
+ 	req_sz &= (uint)~3;
+ 
+ 	switch (func->num) {
+ 	case 1:
+-		err = sdio_memcpy_fromio(func, ((u8 *)(pkt->data)), addr,
++		err = sdio_memcpy_fromio(func, ((u8 *)(skb->data)), addr,
+ 					 req_sz);
+ 		break;
+ 	case 2:
+-		err = sdio_readsb(func, ((u8 *)(pkt->data)), addr, req_sz);
++		err = sdio_readsb(func, ((u8 *)(skb->data)), addr, req_sz);
+ 		break;
+ 	default:
+ 		/* bail out as things are really fishy here */
+@@ -323,18 +323,18 @@ static int brcmf_sdiod_buff_read(struct
+ 	return err;
+ }
+ 
+-static int brcmf_sdiod_buff_write(struct brcmf_sdio_dev *sdiodev,
+-				  struct sdio_func *func, u32 addr,
+-				  struct sk_buff *pkt)
++static int brcmf_sdiod_skbuff_write(struct brcmf_sdio_dev *sdiodev,
++				    struct sdio_func *func, u32 addr,
++				    struct sk_buff *skb)
+ {
+ 	unsigned int req_sz;
+ 	int err;
+ 
+ 	/* Single skb use the standard mmc interface */
+-	req_sz = pkt->len + 3;
++	req_sz = skb->len + 3;
+ 	req_sz &= (uint)~3;
+ 
+-	err = sdio_memcpy_toio(func, addr, ((u8 *)(pkt->data)), req_sz);
++	err = sdio_memcpy_toio(func, addr, ((u8 *)(skb->data)), req_sz);
+ 
+ 	if (err == -ENOMEDIUM)
+ 		brcmf_sdiod_change_state(sdiodev, BRCMF_SDIOD_NOMEDIUM);
+@@ -550,7 +550,7 @@ int brcmf_sdiod_recv_pkt(struct brcmf_sd
+ 	addr &= SBSDIO_SB_OFT_ADDR_MASK;
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+-	err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr, pkt);
++	err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func2, addr, pkt);
+ 
+ done:
+ 	return err;
+@@ -575,14 +575,14 @@ int brcmf_sdiod_recv_chain(struct brcmf_
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	if (pktq->qlen == 1)
+-		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
+-					    pktq->next);
++		err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func2, addr,
++					      pktq->next);
+ 	else if (!sdiodev->sg_support) {
+ 		glom_skb = brcmu_pkt_buf_get_skb(totlen);
+ 		if (!glom_skb)
+ 			return -ENOMEM;
+-		err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func2, addr,
+-					    glom_skb);
++		err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func2, addr,
++					      glom_skb);
+ 		if (err)
+ 			goto done;
+ 
+@@ -623,8 +623,8 @@ int brcmf_sdiod_send_buf(struct brcmf_sd
+ 	addr |= SBSDIO_SB_ACCESS_2_4B_FLAG;
+ 
+ 	if (!err)
+-		err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2, addr,
+-					     mypkt);
++		err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2, addr,
++					       mypkt);
+ 
+ 	brcmu_pkt_buf_free_skb(mypkt);
+ 
+@@ -649,8 +649,8 @@ int brcmf_sdiod_send_pkt(struct brcmf_sd
+ 
+ 	if (pktq->qlen == 1 || !sdiodev->sg_support) {
+ 		skb_queue_walk(pktq, skb) {
+-			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func2,
+-						     addr, skb);
++			err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func2,
++						       addr, skb);
+ 			if (err)
+ 				break;
+ 		}
+@@ -706,11 +706,11 @@ brcmf_sdiod_ramrw(struct brcmf_sdio_dev
+ 
+ 		if (write) {
+ 			memcpy(pkt->data, data, dsize);
+-			err = brcmf_sdiod_buff_write(sdiodev, sdiodev->func1,
+-						     sdaddr, pkt);
++			err = brcmf_sdiod_skbuff_write(sdiodev, sdiodev->func1,
++						       sdaddr, pkt);
+ 		} else {
+-			err = brcmf_sdiod_buff_read(sdiodev, sdiodev->func1,
+-						    sdaddr, pkt);
++			err = brcmf_sdiod_skbuff_read(sdiodev, sdiodev->func1,
++						      sdaddr, pkt);
+ 		}
+ 
+ 		if (err) {
diff --git a/package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch b/package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch
new file mode 100644
index 0000000000..b60c81a3a2
--- /dev/null
+++ b/package/kernel/mac80211/patches/317-v4.16-0001-brcmfmac-Use-zeroing-memory-allocator-than-allocator.patch
@@ -0,0 +1,59 @@
+From b7acadaf038740c43515dc1548f43d01cc92823a Mon Sep 17 00:00:00 2001
+From: Himanshu Jha <himanshujha199640@gmail.com>
+Date: Tue, 9 Jan 2018 02:15:31 +0530
+Subject: [PATCH] brcmfmac: Use zeroing memory allocator than allocator/memset
+
+Use dma_zalloc_coherent for allocating zeroed
+memory and remove unnecessary memset function.
+
+Generated-by: scripts/coccinelle/api/alloc/kzalloc-simple.cocci
+
+Suggested-by: Luis R. Rodriguez <mcgrof@kernel.org>
+Signed-off-by: Himanshu Jha <himanshujha199640@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/pcie.c  | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -1251,14 +1251,14 @@ static int brcmf_pcie_init_scratchbuffer
+ 	u64 address;
+ 	u32 addr;
+ 
+-	devinfo->shared.scratch = dma_alloc_coherent(&devinfo->pdev->dev,
+-		BRCMF_DMA_D2H_SCRATCH_BUF_LEN,
+-		&devinfo->shared.scratch_dmahandle, GFP_KERNEL);
++	devinfo->shared.scratch =
++		dma_zalloc_coherent(&devinfo->pdev->dev,
++					BRCMF_DMA_D2H_SCRATCH_BUF_LEN,
++					&devinfo->shared.scratch_dmahandle,
++					GFP_KERNEL);
+ 	if (!devinfo->shared.scratch)
+ 		goto fail;
+ 
+-	memset(devinfo->shared.scratch, 0, BRCMF_DMA_D2H_SCRATCH_BUF_LEN);
+-
+ 	addr = devinfo->shared.tcm_base_address +
+ 	       BRCMF_SHARED_DMA_SCRATCH_ADDR_OFFSET;
+ 	address = (u64)devinfo->shared.scratch_dmahandle;
+@@ -1268,14 +1268,14 @@ static int brcmf_pcie_init_scratchbuffer
+ 	       BRCMF_SHARED_DMA_SCRATCH_LEN_OFFSET;
+ 	brcmf_pcie_write_tcm32(devinfo, addr, BRCMF_DMA_D2H_SCRATCH_BUF_LEN);
+ 
+-	devinfo->shared.ringupd = dma_alloc_coherent(&devinfo->pdev->dev,
+-		BRCMF_DMA_D2H_RINGUPD_BUF_LEN,
+-		&devinfo->shared.ringupd_dmahandle, GFP_KERNEL);
++	devinfo->shared.ringupd =
++		dma_zalloc_coherent(&devinfo->pdev->dev,
++					BRCMF_DMA_D2H_RINGUPD_BUF_LEN,
++					&devinfo->shared.ringupd_dmahandle,
++					GFP_KERNEL);
+ 	if (!devinfo->shared.ringupd)
+ 		goto fail;
+ 
+-	memset(devinfo->shared.ringupd, 0, BRCMF_DMA_D2H_RINGUPD_BUF_LEN);
+-
+ 	addr = devinfo->shared.tcm_base_address +
+ 	       BRCMF_SHARED_DMA_RINGUPD_ADDR_OFFSET;
+ 	address = (u64)devinfo->shared.ringupd_dmahandle;