mac80211: brcmfmac: backport remaining patches from the Linux 5.0

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>

14 files changed, 1071 insertions, 3 deletions

diff --git a/package/kernel/mac80211/patches/brcm/328-v5.0-0001-brcmfmac-add-credit-numbers-updating-support.patch b/package/kernel/mac80211/patches/brcm/328-v5.0-0001-brcmfmac-add-credit-numbers-updating-support.patch
new file mode 100644
index 0000000000..dd40ee2b1f
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/328-v5.0-0001-brcmfmac-add-credit-numbers-updating-support.patch
@@ -0,0 +1,95 @@
+From 153e22c0ff1260035cd7fe72c8aeead1f5fac757 Mon Sep 17 00:00:00 2001
+From: Wright Feng <Wright.Feng@cypress.com>
+Date: Mon, 5 Nov 2018 05:51:54 +0000
+Subject: [PATCH] brcmfmac: add credit numbers updating support
+
+The credit numbers are static and tunable per chip in firmware side.
+However the credit number may be changed that is based on packet pool
+length and will send BRCMF_E_FIFO_CREDIT_MAP event to notify host driver
+updates the credit numbers during interface up.
+The purpose of this patch is making host driver has ability of updating
+the credit numbers when receiving the BRCMF_E_FIFO_CREDIT_MAP event.
+
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/fwsignal.c    | 23 ++++++++++++-------
+ 1 file changed, 15 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -511,6 +511,7 @@ struct brcmf_fws_info {
+ 	struct work_struct fws_dequeue_work;
+ 	u32 fifo_enqpkt[BRCMF_FWS_FIFO_COUNT];
+ 	int fifo_credit[BRCMF_FWS_FIFO_COUNT];
++	int init_fifo_credit[BRCMF_FWS_FIFO_COUNT];
+ 	int credits_borrowed[BRCMF_FWS_FIFO_AC_VO + 1];
+ 	int deq_node_pos[BRCMF_FWS_FIFO_COUNT];
+ 	u32 fifo_credit_map;
+@@ -1237,6 +1238,9 @@ static void brcmf_fws_return_credits(str
+ 	}
+ 
+ 	fws->fifo_credit[fifo] += credits;
++	if (fws->fifo_credit[fifo] > fws->init_fifo_credit[fifo])
++		fws->fifo_credit[fifo] = fws->init_fifo_credit[fifo];
++
+ }
+ 
+ static void brcmf_fws_schedule_deq(struct brcmf_fws_info *fws)
+@@ -1595,19 +1599,21 @@ static int brcmf_fws_notify_credit_map(s
+ 		brcmf_err("event payload too small (%d)\n", e->datalen);
+ 		return -EINVAL;
+ 	}
+-	if (fws->creditmap_received)
+-		return 0;
+ 
+ 	fws->creditmap_received = true;
+ 
+ 	brcmf_dbg(TRACE, "enter: credits %pM\n", credits);
+ 	brcmf_fws_lock(fws);
+ 	for (i = 0; i < ARRAY_SIZE(fws->fifo_credit); i++) {
+-		if (*credits)
++		fws->fifo_credit[i] += credits[i] - fws->init_fifo_credit[i];
++		fws->init_fifo_credit[i] = credits[i];
++		if (fws->fifo_credit[i] > 0)
+ 			fws->fifo_credit_map |= 1 << i;
+ 		else
+ 			fws->fifo_credit_map &= ~(1 << i);
+-		fws->fifo_credit[i] = *credits++;
++		WARN_ONCE(fws->fifo_credit[i] < 0,
++			  "fifo_credit[%d] is negative(%d)\n", i,
++			  fws->fifo_credit[i]);
+ 	}
+ 	brcmf_fws_schedule_deq(fws);
+ 	brcmf_fws_unlock(fws);
+@@ -2013,7 +2019,7 @@ static int brcmf_fws_borrow_credit(struc
+ 	}
+ 
+ 	for (lender_ac = 0; lender_ac <= BRCMF_FWS_FIFO_AC_VO; lender_ac++) {
+-		if (fws->fifo_credit[lender_ac]) {
++		if (fws->fifo_credit[lender_ac] > 0) {
+ 			fws->credits_borrowed[lender_ac]++;
+ 			fws->fifo_credit[lender_ac]--;
+ 			if (fws->fifo_credit[lender_ac] == 0)
+@@ -2210,8 +2216,9 @@ static void brcmf_fws_dequeue_worker(str
+ 			}
+ 			continue;
+ 		}
+-		while ((fws->fifo_credit[fifo]) || ((!fws->bcmc_credit_check) &&
+-		       (fifo == BRCMF_FWS_FIFO_BCMC))) {
++		while ((fws->fifo_credit[fifo] > 0) ||
++		       ((!fws->bcmc_credit_check) &&
++			(fifo == BRCMF_FWS_FIFO_BCMC))) {
+ 			skb = brcmf_fws_deq(fws, fifo);
+ 			if (!skb)
+ 				break;
+@@ -2222,7 +2229,7 @@ static void brcmf_fws_dequeue_worker(str
+ 				break;
+ 		}
+ 		if ((fifo == BRCMF_FWS_FIFO_AC_BE) &&
+-		    (fws->fifo_credit[fifo] == 0) &&
++		    (fws->fifo_credit[fifo] <= 0) &&
+ 		    (!fws->bus_flow_blocked)) {
+ 			while (brcmf_fws_borrow_credit(fws) == 0) {
+ 				skb = brcmf_fws_deq(fws, fifo);
diff --git a/package/kernel/mac80211/patches/brcm/328-v5.0-0002-brcmfmac-enable-frameburst-mode-in-default-firmware-.patch b/package/kernel/mac80211/patches/brcm/328-v5.0-0002-brcmfmac-enable-frameburst-mode-in-default-firmware-.patch
new file mode 100644
index 0000000000..c73ee93a8d
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/328-v5.0-0002-brcmfmac-enable-frameburst-mode-in-default-firmware-.patch
@@ -0,0 +1,42 @@
+From a3bdc6deb60bf6be4405058ca49a686c4db08c39 Mon Sep 17 00:00:00 2001
+From: Wright Feng <Wright.Feng@cypress.com>
+Date: Mon, 5 Nov 2018 05:51:59 +0000
+Subject: [PATCH] brcmfmac: enable frameburst mode in default firmware setting
+
+The frameburst feature can enable per-packet framebursting in firmware
+side and get higher TX throughput in High Throughput(HT) mode. To enhance
+TX throughput, we enable frameburst mode in default firmware setting.
+
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 6 ++++++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h     | 1 +
+ 2 files changed, 7 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6631,6 +6631,12 @@ static s32 brcmf_config_dongle(struct br
+ 
+ 	brcmf_configure_arp_nd_offload(ifp, true);
+ 
++	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_FAKEFRAG, 1);
++	if (err) {
++		brcmf_err("failed to set frameburst mode\n");
++		goto default_conf_out;
++	}
++
+ 	cfg->dongle_up = true;
+ default_conf_out:
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h
+@@ -80,6 +80,7 @@
+ #define BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON	201
+ #define BRCMF_C_SET_ASSOC_PREFER		205
+ #define BRCMF_C_GET_VALID_CHANNELS		217
++#define BRCMF_C_SET_FAKEFRAG			219
+ #define BRCMF_C_GET_KEY_PRIMARY			235
+ #define BRCMF_C_SET_KEY_PRIMARY			236
+ #define BRCMF_C_SET_SCAN_PASSIVE_TIME		258
diff --git a/package/kernel/mac80211/patches/brcm/328-v5.0-0003-brcmfmac-handle-compressed-tx-status-signal.patch b/package/kernel/mac80211/patches/brcm/328-v5.0-0003-brcmfmac-handle-compressed-tx-status-signal.patch
new file mode 100644
index 0000000000..f7e09ecaab
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/328-v5.0-0003-brcmfmac-handle-compressed-tx-status-signal.patch
@@ -0,0 +1,227 @@
+From e4af3ffb43d50f070134aa1b40d5c3573f57deb1 Mon Sep 17 00:00:00 2001
+From: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+Date: Mon, 5 Nov 2018 05:52:05 +0000
+Subject: [PATCH] brcmfmac: handle compressed tx status signal
+
+Firmware inform the driver about tx status by normal tx status signal
+or compressed tx status signal. This patch adds support to handle the
+compressed tx status signal.
+
+Signed-off-by: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/fwsignal.c    | 121 ++++++++++--------
+ 1 file changed, 71 insertions(+), 50 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -1455,9 +1455,10 @@ static int brcmf_fws_txstatus_suppressed
+ 
+ static int
+ brcmf_fws_txs_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
+-		      u32 genbit, u16 seq)
++		      u32 genbit, u16 seq, u8 compcnt)
+ {
+ 	u32 fifo;
++	u8 cnt = 0;
+ 	int ret;
+ 	bool remove_from_hanger = true;
+ 	struct sk_buff *skb;
+@@ -1468,60 +1469,71 @@ brcmf_fws_txs_process(struct brcmf_fws_i
+ 	brcmf_dbg(DATA, "flags %d\n", flags);
+ 
+ 	if (flags == BRCMF_FWS_TXSTATUS_DISCARD)
+-		fws->stats.txs_discard++;
++		fws->stats.txs_discard += compcnt;
+ 	else if (flags == BRCMF_FWS_TXSTATUS_CORE_SUPPRESS) {
+-		fws->stats.txs_supp_core++;
++		fws->stats.txs_supp_core += compcnt;
+ 		remove_from_hanger = false;
+ 	} else if (flags == BRCMF_FWS_TXSTATUS_FW_PS_SUPPRESS) {
+-		fws->stats.txs_supp_ps++;
++		fws->stats.txs_supp_ps += compcnt;
+ 		remove_from_hanger = false;
+ 	} else if (flags == BRCMF_FWS_TXSTATUS_FW_TOSSED)
+-		fws->stats.txs_tossed++;
++		fws->stats.txs_tossed += compcnt;
+ 	else if (flags == BRCMF_FWS_TXSTATUS_HOST_TOSSED)
+-		fws->stats.txs_host_tossed++;
++		fws->stats.txs_host_tossed += compcnt;
+ 	else
+ 		brcmf_err("unexpected txstatus\n");
+ 
+-	ret = brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
+-				      remove_from_hanger);
+-	if (ret != 0) {
+-		brcmf_err("no packet in hanger slot: hslot=%d\n", hslot);
+-		return ret;
+-	}
++	while (cnt < compcnt) {
++		ret = brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
++					      remove_from_hanger);
++		if (ret != 0) {
++			brcmf_err("no packet in hanger slot: hslot=%d\n",
++				  hslot);
++			goto cont;
++		}
+ 
+-	skcb = brcmf_skbcb(skb);
+-	entry = skcb->mac;
+-	if (WARN_ON(!entry)) {
+-		brcmu_pkt_buf_free_skb(skb);
+-		return -EINVAL;
+-	}
+-	entry->transit_count--;
+-	if (entry->suppressed && entry->suppr_transit_count)
+-		entry->suppr_transit_count--;
++		skcb = brcmf_skbcb(skb);
++		entry = skcb->mac;
++		if (WARN_ON(!entry)) {
++			brcmu_pkt_buf_free_skb(skb);
++			goto cont;
++		}
++		entry->transit_count--;
++		if (entry->suppressed && entry->suppr_transit_count)
++			entry->suppr_transit_count--;
+ 
+-	brcmf_dbg(DATA, "%s flags %d htod %X seq %X\n", entry->name, flags,
+-		  skcb->htod, seq);
++		brcmf_dbg(DATA, "%s flags %d htod %X seq %X\n", entry->name,
++			  flags, skcb->htod, seq);
+ 
+-	/* pick up the implicit credit from this packet */
+-	fifo = brcmf_skb_htod_tag_get_field(skb, FIFO);
+-	if ((fws->fcmode == BRCMF_FWS_FCMODE_IMPLIED_CREDIT) ||
+-	    (brcmf_skb_if_flags_get_field(skb, REQ_CREDIT)) ||
+-	    (flags == BRCMF_FWS_TXSTATUS_HOST_TOSSED)) {
+-		brcmf_fws_return_credits(fws, fifo, 1);
+-		brcmf_fws_schedule_deq(fws);
+-	}
+-	brcmf_fws_macdesc_return_req_credit(skb);
++		/* pick up the implicit credit from this packet */
++		fifo = brcmf_skb_htod_tag_get_field(skb, FIFO);
++		if (fws->fcmode == BRCMF_FWS_FCMODE_IMPLIED_CREDIT ||
++		    (brcmf_skb_if_flags_get_field(skb, REQ_CREDIT)) ||
++		    flags == BRCMF_FWS_TXSTATUS_HOST_TOSSED) {
++			brcmf_fws_return_credits(fws, fifo, 1);
++			brcmf_fws_schedule_deq(fws);
++		}
++		brcmf_fws_macdesc_return_req_credit(skb);
+ 
+-	ret = brcmf_proto_hdrpull(fws->drvr, false, skb, &ifp);
+-	if (ret) {
+-		brcmu_pkt_buf_free_skb(skb);
+-		return -EINVAL;
++		ret = brcmf_proto_hdrpull(fws->drvr, false, skb, &ifp);
++		if (ret) {
++			brcmu_pkt_buf_free_skb(skb);
++			goto cont;
++		}
++		if (!remove_from_hanger)
++			ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb,
++							    genbit, seq);
++		if (remove_from_hanger || ret)
++			brcmf_txfinalize(ifp, skb, true);
++
++cont:
++		hslot = (hslot + 1) & (BRCMF_FWS_TXSTAT_HSLOT_MASK >>
++				       BRCMF_FWS_TXSTAT_HSLOT_SHIFT);
++		if (BRCMF_FWS_MODE_GET_REUSESEQ(fws->mode))
++			seq = (seq + 1) & BRCMF_SKB_HTOD_SEQ_NR_MASK;
++
++		cnt++;
+ 	}
+-	if (!remove_from_hanger)
+-		ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb,
+-						    genbit, seq);
+-	if (remove_from_hanger || ret)
+-		brcmf_txfinalize(ifp, skb, true);
+ 
+ 	return 0;
+ }
+@@ -1547,7 +1559,8 @@ static int brcmf_fws_fifocreditback_indi
+ 	return BRCMF_FWS_RET_OK_SCHEDULE;
+ }
+ 
+-static int brcmf_fws_txstatus_indicate(struct brcmf_fws_info *fws, u8 *data)
++static int brcmf_fws_txstatus_indicate(struct brcmf_fws_info *fws, u8 type,
++				       u8 *data)
+ {
+ 	__le32 status_le;
+ 	__le16 seq_le;
+@@ -1556,23 +1569,31 @@ static int brcmf_fws_txstatus_indicate(s
+ 	u32 genbit;
+ 	u8 flags;
+ 	u16 seq;
++	u8 compcnt;
++	u8 compcnt_offset = BRCMF_FWS_TYPE_TXSTATUS_LEN;
+ 
+-	fws->stats.txs_indicate++;
+ 	memcpy(&status_le, data, sizeof(status_le));
+ 	status = le32_to_cpu(status_le);
+ 	flags = brcmf_txstatus_get_field(status, FLAGS);
+ 	hslot = brcmf_txstatus_get_field(status, HSLOT);
+ 	genbit = brcmf_txstatus_get_field(status, GENERATION);
+ 	if (BRCMF_FWS_MODE_GET_REUSESEQ(fws->mode)) {
+-		memcpy(&seq_le, &data[BRCMF_FWS_TYPE_PKTTAG_LEN],
++		memcpy(&seq_le, &data[BRCMF_FWS_TYPE_TXSTATUS_LEN],
+ 		       sizeof(seq_le));
+ 		seq = le16_to_cpu(seq_le);
++		compcnt_offset += BRCMF_FWS_TYPE_SEQ_LEN;
+ 	} else {
+ 		seq = 0;
+ 	}
+ 
++	if (type == BRCMF_FWS_TYPE_COMP_TXSTATUS)
++		compcnt = data[compcnt_offset];
++	else
++		compcnt = 1;
++	fws->stats.txs_indicate += compcnt;
++
+ 	brcmf_fws_lock(fws);
+-	brcmf_fws_txs_process(fws, flags, hslot, genbit, seq);
++	brcmf_fws_txs_process(fws, flags, hslot, genbit, seq, compcnt);
+ 	brcmf_fws_unlock(fws);
+ 	return BRCMF_FWS_RET_OK_NOSCHEDULE;
+ }
+@@ -1888,8 +1909,6 @@ void brcmf_fws_hdrpull(struct brcmf_if *
+ 
+ 		err = BRCMF_FWS_RET_OK_NOSCHEDULE;
+ 		switch (type) {
+-		case BRCMF_FWS_TYPE_COMP_TXSTATUS:
+-			break;
+ 		case BRCMF_FWS_TYPE_HOST_REORDER_RXPKTS:
+ 			rd = (struct brcmf_skb_reorder_data *)skb->cb;
+ 			rd->reorder = data;
+@@ -1912,7 +1931,8 @@ void brcmf_fws_hdrpull(struct brcmf_if *
+ 			err = brcmf_fws_request_indicate(fws, type, data);
+ 			break;
+ 		case BRCMF_FWS_TYPE_TXSTATUS:
+-			brcmf_fws_txstatus_indicate(fws, data);
++		case BRCMF_FWS_TYPE_COMP_TXSTATUS:
++			brcmf_fws_txstatus_indicate(fws, type, data);
+ 			break;
+ 		case BRCMF_FWS_TYPE_FIFO_CREDITBACK:
+ 			err = brcmf_fws_fifocreditback_indicate(fws, data);
+@@ -2001,7 +2021,7 @@ static void brcmf_fws_rollback_toq(struc
+ 		fws->stats.rollback_failed++;
+ 		hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
+ 		brcmf_fws_txs_process(fws, BRCMF_FWS_TXSTATUS_HOST_TOSSED,
+-				      hslot, 0, 0);
++				      hslot, 0, 0, 1);
+ 	} else {
+ 		fws->stats.rollback_success++;
+ 		brcmf_fws_return_credits(fws, fifo, 1);
+@@ -2462,7 +2482,8 @@ void brcmf_fws_bustxfail(struct brcmf_fw
+ 	}
+ 	brcmf_fws_lock(fws);
+ 	hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
+-	brcmf_fws_txs_process(fws, BRCMF_FWS_TXSTATUS_HOST_TOSSED, hslot, 0, 0);
++	brcmf_fws_txs_process(fws, BRCMF_FWS_TXSTATUS_HOST_TOSSED, hslot, 0, 0,
++			      1);
+ 	brcmf_fws_unlock(fws);
+ }
+ 
diff --git a/package/kernel/mac80211/patches/brcm/329-v5.0-0001-brcmfmac-add-4354-raw-pcie-device-id.patch b/package/kernel/mac80211/patches/brcm/329-v5.0-0001-brcmfmac-add-4354-raw-pcie-device-id.patch
new file mode 100644
index 0000000000..ead33db0d5
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/329-v5.0-0001-brcmfmac-add-4354-raw-pcie-device-id.patch
@@ -0,0 +1,36 @@
+From eb6b33bfb8f56859df7264dccc2ca8ab7c57342a Mon Sep 17 00:00:00 2001
+From: Winnie Chang <winnie.chang@cypress.com>
+Date: Wed, 21 Nov 2018 07:53:42 +0000
+Subject: [PATCH] brcmfmac: add 4354 raw pcie device id
+
+Add the raw 4354 PCIe device ID for unprogrammed Cypress boards.
+
+Reviewed-by: Arend Van Spriel <arend@broadcom.com>
+Signed-off-by: Winnie Chang <winnie.chang@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c       | 1 +
+ drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -2019,6 +2019,7 @@ static const struct dev_pm_ops brcmf_pci
+ static const struct pci_device_id brcmf_pcie_devid_table[] = {
+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4350_DEVICE_ID),
+ 	BRCMF_PCIE_DEVICE_SUB(0x4355, BRCM_PCIE_VENDOR_ID_BROADCOM, 0x4355),
++	BRCMF_PCIE_DEVICE(BRCM_PCIE_4354_RAW_DEVICE_ID),
+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4356_DEVICE_ID),
+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43567_DEVICE_ID),
+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43570_DEVICE_ID),
+--- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
+@@ -74,6 +74,7 @@
+ /* PCIE Device IDs */
+ #define BRCM_PCIE_4350_DEVICE_ID	0x43a3
+ #define BRCM_PCIE_4354_DEVICE_ID	0x43df
++#define BRCM_PCIE_4354_RAW_DEVICE_ID	0x4354
+ #define BRCM_PCIE_4356_DEVICE_ID	0x43ec
+ #define BRCM_PCIE_43567_DEVICE_ID	0x43d3
+ #define BRCM_PCIE_43570_DEVICE_ID	0x43d9
diff --git a/package/kernel/mac80211/patches/brcm/329-v5.0-0002-brcmfmac-set-F2-watermark-to-256-for-4373.patch b/package/kernel/mac80211/patches/brcm/329-v5.0-0002-brcmfmac-set-F2-watermark-to-256-for-4373.patch
new file mode 100644
index 0000000000..a915473b8c
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/329-v5.0-0002-brcmfmac-set-F2-watermark-to-256-for-4373.patch
@@ -0,0 +1,73 @@
+From e1a08730eeb0bad4d82c3bc40e74854872de618d Mon Sep 17 00:00:00 2001
+From: Wright Feng <wright.feng@cypress.com>
+Date: Wed, 21 Nov 2018 07:53:44 +0000
+Subject: [PATCH] brcmfmac: set F2 watermark to 256 for 4373
+
+We got SDIO_CRC_ERROR with 4373 on SDR104 when doing bi-directional
+throughput test. Enable watermark to 256 to guarantee the operation
+stability.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/sdio.c        | 26 +++++++++++++++++--
+ 1 file changed, 24 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -49,6 +49,10 @@
+ #define DCMD_RESP_TIMEOUT	msecs_to_jiffies(2500)
+ #define CTL_DONE_TIMEOUT	msecs_to_jiffies(2500)
+ 
++/* watermark expressed in number of words */
++#define DEFAULT_F2_WATERMARK    0x8
++#define CY_4373_F2_WATERMARK    0x40
++
+ #ifdef DEBUG
+ 
+ #define BRCMF_TRAP_INFO_SIZE	80
+@@ -138,6 +142,8 @@ struct rte_console {
+ /* 1: isolate internal sdio signals, put external pads in tri-state; requires
+  * sdio bus power cycle to clear (rev 9) */
+ #define SBSDIO_DEVCTL_PADS_ISO		0x08
++/* 1: enable F2 Watermark */
++#define SBSDIO_DEVCTL_F2WM_ENAB		0x10
+ /* Force SD->SB reset mapping (rev 11) */
+ #define SBSDIO_DEVCTL_SB_RST_CTL	0x30
+ /*   Determined by CoreControl bit */
+@@ -4046,6 +4052,7 @@ static void brcmf_sdio_firmware_callback
+ 	void *nvram;
+ 	u32 nvram_len;
+ 	u8 saveclk;
++	u8 devctl;
+ 
+ 	brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
+ 
+@@ -4101,8 +4108,23 @@ static void brcmf_sdio_firmware_callback
+ 		brcmf_sdiod_writel(sdiod, core->base + SD_REG(hostintmask),
+ 				   bus->hostintmask, NULL);
+ 
+-
+-		brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK, 8, &err);
++		switch (sdiod->func1->device) {
++		case SDIO_DEVICE_ID_CYPRESS_4373:
++			brcmf_dbg(INFO, "set F2 watermark to 0x%x*4 bytes\n",
++				  CY_4373_F2_WATERMARK);
++			brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
++					   CY_4373_F2_WATERMARK, &err);
++			devctl = brcmf_sdiod_readb(sdiod, SBSDIO_DEVICE_CTL,
++						   &err);
++			devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
++			brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl,
++					   &err);
++			break;
++		default:
++			brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
++					   DEFAULT_F2_WATERMARK, &err);
++			break;
++		}
+ 	} else {
+ 		/* Disable F2 again */
+ 		sdio_disable_func(sdiod->func2);
diff --git a/package/kernel/mac80211/patches/brcm/329-v5.0-0003-brcmfmac-set-SDIO-F1-MesBusyCtrl-for-CYW4373.patch b/package/kernel/mac80211/patches/brcm/329-v5.0-0003-brcmfmac-set-SDIO-F1-MesBusyCtrl-for-CYW4373.patch
new file mode 100644
index 0000000000..0e22a1545e
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/329-v5.0-0003-brcmfmac-set-SDIO-F1-MesBusyCtrl-for-CYW4373.patch
@@ -0,0 +1,55 @@
+From 58e4bbea0c1d9b5ace11df968c5dc096ce052a73 Mon Sep 17 00:00:00 2001
+From: Madhan Mohan R <MadhanMohan.R@cypress.com>
+Date: Wed, 21 Nov 2018 07:53:45 +0000
+Subject: [PATCH] brcmfmac: set SDIO F1 MesBusyCtrl for CYW4373
+
+Along with F2 watermark (existing) configuration, F1 MesBusyCtrl
+should be enabled & sdio device RX FIFO watermark should be
+configured to avoid overflow errors.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Madhan Mohan R <madhanmohan.r@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h | 9 ++++++++-
+ 2 files changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4119,6 +4119,9 @@ static void brcmf_sdio_firmware_callback
+ 			devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
+ 			brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl,
+ 					   &err);
++			brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_MESBUSYCTRL,
++					   CY_4373_F2_WATERMARK |
++					   SBSDIO_MESBUSYCTRL_ENAB, &err);
+ 			break;
+ 		default:
+ 			brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -77,7 +77,7 @@
+ #define SBSDIO_GPIO_OUT			0x10006
+ /* gpio enable */
+ #define SBSDIO_GPIO_EN			0x10007
+-/* rev < 7, watermark for sdio device */
++/* rev < 7, watermark for sdio device TX path */
+ #define SBSDIO_WATERMARK		0x10008
+ /* control busy signal generation */
+ #define SBSDIO_DEVICE_CTL		0x10009
+@@ -104,6 +104,13 @@
+ #define SBSDIO_FUNC1_RFRAMEBCHI		0x1001C
+ /* MesBusyCtl (rev 11) */
+ #define SBSDIO_FUNC1_MESBUSYCTRL	0x1001D
++/* Watermark for sdio device RX path */
++#define SBSDIO_MESBUSY_RXFIFO_WM_MASK	0x7F
++#define SBSDIO_MESBUSY_RXFIFO_WM_SHIFT	0
++/* Enable busy capability for MES access */
++#define SBSDIO_MESBUSYCTRL_ENAB		0x80
++#define SBSDIO_MESBUSYCTRL_ENAB_SHIFT	7
++
+ /* Sdio Core Rev 12 */
+ #define SBSDIO_FUNC1_WAKEUPCTRL		0x1001E
+ #define SBSDIO_FUNC1_WCTRL_ALPWAIT_MASK		0x1
diff --git a/package/kernel/mac80211/patches/brcm/329-v5.0-0004-brcmfmac-add-support-for-CYW43012-SDIO-chipset.patch b/package/kernel/mac80211/patches/brcm/329-v5.0-0004-brcmfmac-add-support-for-CYW43012-SDIO-chipset.patch
new file mode 100644
index 0000000000..e53d4bafa0
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/329-v5.0-0004-brcmfmac-add-support-for-CYW43012-SDIO-chipset.patch
@@ -0,0 +1,253 @@
+From 35cb51b2162a1a7c5cd977f92595e60ab14d3b22 Mon Sep 17 00:00:00 2001
+From: Chi-Hsien Lin <Chi-Hsien.Lin@cypress.com>
+Date: Wed, 21 Nov 2018 07:53:47 +0000
+Subject: [PATCH] brcmfmac: add support for CYW43012 SDIO chipset
+
+CYW43012 is a 1x1 802.11a/b/g/n Dual-Band HT20, 256-QAM/Turbo QAM. It
+is an Ultra Low Power WLAN+BT combo chip.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Praveen Babu C <praveen.chandran@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/bcmsdh.c      |  1 +
+ .../broadcom/brcm80211/brcmfmac/chip.c        | 14 +++-
+ .../broadcom/brcm80211/brcmfmac/sdio.c        | 74 ++++++++++++++++---
+ .../broadcom/brcm80211/include/brcm_hw_ids.h  |  1 +
+ include/linux/mmc/sdio_ids.h                  |  1 +
+ 5 files changed, 78 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -972,6 +972,7 @@ static const struct sdio_device_id brcmf
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4354),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4356),
+ 	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_CYPRESS_4373),
++	BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_CYPRESS_43012),
+ 	{ /* end: all zeroes */ }
+ };
+ MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_ids);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+@@ -165,6 +165,7 @@ struct sbconfig {
+ #define SRCI_LSS_MASK		0x00f00000
+ #define SRCI_LSS_SHIFT		20
+ #define	SRCI_SRNB_MASK		0xf0
++#define	SRCI_SRNB_MASK_EXT	0x100
+ #define	SRCI_SRNB_SHIFT		4
+ #define	SRCI_SRBSZ_MASK		0xf
+ #define	SRCI_SRBSZ_SHIFT	0
+@@ -592,7 +593,13 @@ static void brcmf_chip_socram_ramsize(st
+ 		if (lss != 0)
+ 			*ramsize += (1 << ((lss - 1) + SR_BSZ_BASE));
+ 	} else {
+-		nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
++		/* length of SRAM Banks increased for corerev greater than 23 */
++		if (sr->pub.rev >= 23) {
++			nb = (coreinfo & (SRCI_SRNB_MASK | SRCI_SRNB_MASK_EXT))
++				>> SRCI_SRNB_SHIFT;
++		} else {
++			nb = (coreinfo & SRCI_SRNB_MASK) >> SRCI_SRNB_SHIFT;
++		}
+ 		for (i = 0; i < nb; i++) {
+ 			retent = brcmf_chip_socram_banksize(sr, i, &banksize);
+ 			*ramsize += banksize;
+@@ -1356,6 +1363,11 @@ bool brcmf_chip_sr_capable(struct brcmf_
+ 		addr = CORE_CC_REG(base, sr_control1);
+ 		reg = chip->ops->read32(chip->ctx, addr);
+ 		return reg != 0;
++	case CY_CC_43012_CHIP_ID:
++		addr = CORE_CC_REG(pmu->base, retention_ctl);
++		reg = chip->ops->read32(chip->ctx, addr);
++		return (reg & (PMU_RCTL_MACPHY_DISABLE_MASK |
++			       PMU_RCTL_LOGIC_DISABLE_MASK)) == 0;
+ 	default:
+ 		addr = CORE_CC_REG(pmu->base, pmucapabilities_ext);
+ 		reg = chip->ops->read32(chip->ctx, addr);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -624,6 +624,7 @@ BRCMF_FW_DEF(43455, "brcmfmac43455-sdio"
+ BRCMF_FW_DEF(4354, "brcmfmac4354-sdio");
+ BRCMF_FW_DEF(4356, "brcmfmac4356-sdio");
+ BRCMF_FW_DEF(4373, "brcmfmac4373-sdio");
++BRCMF_FW_DEF(43012, "brcmfmac43012-sdio");
+ 
+ static const struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
+ 	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
+@@ -643,7 +644,8 @@ static const struct brcmf_firmware_mappi
+ 	BRCMF_FW_ENTRY(BRCM_CC_4345_CHIP_ID, 0xFFFFFFC0, 43455),
+ 	BRCMF_FW_ENTRY(BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, 4354),
+ 	BRCMF_FW_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
+-	BRCMF_FW_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373)
++	BRCMF_FW_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373),
++	BRCMF_FW_ENTRY(CY_CC_43012_CHIP_ID, 0xFFFFFFFF, 43012)
+ };
+ 
+ static void pkt_align(struct sk_buff *p, int len, int align)
+@@ -677,6 +679,14 @@ brcmf_sdio_kso_control(struct brcmf_sdio
+ 	/* 1st KSO write goes to AOS wake up core if device is asleep  */
+ 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, wr_val, &err);
+ 
++	/* In case of 43012 chip, the chip could go down immediately after
++	 * KSO bit is cleared. So the further reads of KSO register could
++	 * fail. Thereby just bailing out immediately after clearing KSO
++	 * bit, to avoid polling of KSO bit.
++	 */
++	if (!on && bus->ci->chip == CY_CC_43012_CHIP_ID)
++		return err;
++
+ 	if (on) {
+ 		/* device WAKEUP through KSO:
+ 		 * write bit 0 & read back until
+@@ -2402,6 +2412,14 @@ static int brcmf_sdio_tx_ctrlframe(struc
+ 	return ret;
+ }
+ 
++static bool brcmf_chip_is_ulp(struct brcmf_chip *ci)
++{
++	if (ci->chip == CY_CC_43012_CHIP_ID)
++		return true;
++	else
++		return false;
++}
++
+ static void brcmf_sdio_bus_stop(struct device *dev)
+ {
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+@@ -2409,7 +2427,7 @@ static void brcmf_sdio_bus_stop(struct d
+ 	struct brcmf_sdio *bus = sdiodev->bus;
+ 	struct brcmf_core *core = bus->sdio_core;
+ 	u32 local_hostintmask;
+-	u8 saveclk;
++	u8 saveclk, bpreq;
+ 	int err;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+@@ -2436,9 +2454,14 @@ static void brcmf_sdio_bus_stop(struct d
+ 		/* Force backplane clocks to assure F2 interrupt propagates */
+ 		saveclk = brcmf_sdiod_readb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+ 					    &err);
+-		if (!err)
+-			brcmf_sdiod_writeb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+-					   (saveclk | SBSDIO_FORCE_HT), &err);
++		if (!err) {
++			bpreq = saveclk;
++			bpreq |= brcmf_chip_is_ulp(bus->ci) ?
++				SBSDIO_HT_AVAIL_REQ : SBSDIO_FORCE_HT;
++			brcmf_sdiod_writeb(sdiodev,
++					   SBSDIO_FUNC1_CHIPCLKCSR,
++					   bpreq, &err);
++		}
+ 		if (err)
+ 			brcmf_err("Failed to force clock for F2: err %d\n",
+ 				  err);
+@@ -3328,20 +3351,45 @@ err:
+ 	return bcmerror;
+ }
+ 
++static bool brcmf_sdio_aos_no_decode(struct brcmf_sdio *bus)
++{
++	if (bus->ci->chip == CY_CC_43012_CHIP_ID)
++		return true;
++	else
++		return false;
++}
++
+ static void brcmf_sdio_sr_init(struct brcmf_sdio *bus)
+ {
+ 	int err = 0;
+ 	u8 val;
++	u8 wakeupctrl;
++	u8 cardcap;
++	u8 chipclkcsr;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
++	if (brcmf_chip_is_ulp(bus->ci)) {
++		wakeupctrl = SBSDIO_FUNC1_WCTRL_ALPWAIT_SHIFT;
++		chipclkcsr = SBSDIO_HT_AVAIL_REQ;
++	} else {
++		wakeupctrl = SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT;
++		chipclkcsr = SBSDIO_FORCE_HT;
++	}
++
++	if (brcmf_sdio_aos_no_decode(bus)) {
++		cardcap = SDIO_CCCR_BRCM_CARDCAP_CMD_NODEC;
++	} else {
++		cardcap = (SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT |
++			   SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT);
++	}
++
+ 	val = brcmf_sdiod_readb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, &err);
+ 	if (err) {
+ 		brcmf_err("error reading SBSDIO_FUNC1_WAKEUPCTRL\n");
+ 		return;
+ 	}
+-
+-	val |= 1 << SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT;
++	val |= 1 << wakeupctrl;
+ 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, val, &err);
+ 	if (err) {
+ 		brcmf_err("error writing SBSDIO_FUNC1_WAKEUPCTRL\n");
+@@ -3350,8 +3398,7 @@ static void brcmf_sdio_sr_init(struct br
+ 
+ 	/* Add CMD14 Support */
+ 	brcmf_sdiod_func0_wb(bus->sdiodev, SDIO_CCCR_BRCM_CARDCAP,
+-			     (SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT |
+-			      SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT),
++			     cardcap,
+ 			     &err);
+ 	if (err) {
+ 		brcmf_err("error writing SDIO_CCCR_BRCM_CARDCAP\n");
+@@ -3359,7 +3406,7 @@ static void brcmf_sdio_sr_init(struct br
+ 	}
+ 
+ 	brcmf_sdiod_writeb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+-			   SBSDIO_FORCE_HT, &err);
++			   chipclkcsr, &err);
+ 	if (err) {
+ 		brcmf_err("error writing SBSDIO_FUNC1_CHIPCLKCSR\n");
+ 		return;
+@@ -4051,7 +4098,7 @@ static void brcmf_sdio_firmware_callback
+ 	const struct firmware *code;
+ 	void *nvram;
+ 	u32 nvram_len;
+-	u8 saveclk;
++	u8 saveclk, bpreq;
+ 	u8 devctl;
+ 
+ 	brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
+@@ -4085,8 +4132,11 @@ static void brcmf_sdio_firmware_callback
+ 	/* Force clocks on backplane to be sure F2 interrupt propagates */
+ 	saveclk = brcmf_sdiod_readb(sdiod, SBSDIO_FUNC1_CHIPCLKCSR, &err);
+ 	if (!err) {
++		bpreq = saveclk;
++		bpreq |= brcmf_chip_is_ulp(bus->ci) ?
++			SBSDIO_HT_AVAIL_REQ : SBSDIO_FORCE_HT;
+ 		brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_CHIPCLKCSR,
+-				   (saveclk | SBSDIO_FORCE_HT), &err);
++				   bpreq, &err);
+ 	}
+ 	if (err) {
+ 		brcmf_err("Failed to force clock for F2: err %d\n", err);
+--- a/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcm_hw_ids.h
+@@ -60,6 +60,7 @@
+ #define BRCM_CC_43664_CHIP_ID		43664
+ #define BRCM_CC_4371_CHIP_ID		0x4371
+ #define CY_CC_4373_CHIP_ID		0x4373
++#define CY_CC_43012_CHIP_ID		43012
+ 
+ /* USB Device IDs */
+ #define BRCM_USB_43143_DEVICE_ID	0xbd1e
+--- a/include/linux/mmc/sdio_ids.h
++++ b/include/linux/mmc/sdio_ids.h
+@@ -42,6 +42,7 @@
+ #define SDIO_DEVICE_ID_BROADCOM_4354		0x4354
+ #define SDIO_DEVICE_ID_BROADCOM_4356		0x4356
+ #define SDIO_DEVICE_ID_CYPRESS_4373		0x4373
++#define SDIO_DEVICE_ID_CYPRESS_43012		43012
+ 
+ #define SDIO_VENDOR_ID_INTEL			0x0089
+ #define SDIO_DEVICE_ID_INTEL_IWMC3200WIMAX	0x1402
diff --git a/package/kernel/mac80211/patches/brcm/329-v5.0-0005-brcmfmac-allow-GCI-core-enumuration.patch b/package/kernel/mac80211/patches/brcm/329-v5.0-0005-brcmfmac-allow-GCI-core-enumuration.patch
new file mode 100644
index 0000000000..809ee9a516
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/329-v5.0-0005-brcmfmac-allow-GCI-core-enumuration.patch
@@ -0,0 +1,60 @@
+From b021a6bc1175442609af0b66d64f850883e155fb Mon Sep 17 00:00:00 2001
+From: Chi-Hsien Lin <Chi-Hsien.Lin@cypress.com>
+Date: Wed, 21 Nov 2018 07:53:48 +0000
+Subject: [PATCH] brcmfmac: allow GCI core enumuration
+
+GCI core is needed for ULP operation. Allow GCI core enumuration with
+below changes:
+ - Allow GCI to be added to core list even when it doesn't have a wrapper.
+ - Allow 8K address space size.
+ - Don't overwrite the address value when an additional size descriptor
+   is in place.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/chip.c    | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+@@ -786,7 +786,7 @@ static int brcmf_chip_dmp_get_regaddr(st
+ 				      u32 *regbase, u32 *wrapbase)
+ {
+ 	u8 desc;
+-	u32 val;
++	u32 val, szdesc;
+ 	u8 mpnum = 0;
+ 	u8 stype, sztype, wraptype;
+ 
+@@ -832,14 +832,15 @@ static int brcmf_chip_dmp_get_regaddr(st
+ 
+ 		/* next size descriptor can be skipped */
+ 		if (sztype == DMP_SLAVE_SIZE_DESC) {
+-			val = brcmf_chip_dmp_get_desc(ci, eromaddr, NULL);
++			szdesc = brcmf_chip_dmp_get_desc(ci, eromaddr, NULL);
+ 			/* skip upper size descriptor if present */
+-			if (val & DMP_DESC_ADDRSIZE_GT32)
++			if (szdesc & DMP_DESC_ADDRSIZE_GT32)
+ 				brcmf_chip_dmp_get_desc(ci, eromaddr, NULL);
+ 		}
+ 
+-		/* only look for 4K register regions */
+-		if (sztype != DMP_SLAVE_SIZE_4K)
++		/* look for 4K or 8K register regions */
++		if (sztype != DMP_SLAVE_SIZE_4K &&
++		    sztype != DMP_SLAVE_SIZE_8K)
+ 			continue;
+ 
+ 		stype = (val & DMP_SLAVE_TYPE) >> DMP_SLAVE_TYPE_S;
+@@ -896,7 +897,8 @@ int brcmf_chip_dmp_erom_scan(struct brcm
+ 
+ 		/* need core with ports */
+ 		if (nmw + nsw == 0 &&
+-		    id != BCMA_CORE_PMU)
++		    id != BCMA_CORE_PMU &&
++		    id != BCMA_CORE_GCI)
+ 			continue;
+ 
+ 		/* try to obtain register address info */
diff --git a/package/kernel/mac80211/patches/brcm/329-v5.0-0006-brcmfmac-update-43012-F2-watermark-setting-to-fix-DM.patch b/package/kernel/mac80211/patches/brcm/329-v5.0-0006-brcmfmac-update-43012-F2-watermark-setting-to-fix-DM.patch
new file mode 100644
index 0000000000..3b44952af4
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/329-v5.0-0006-brcmfmac-update-43012-F2-watermark-setting-to-fix-DM.patch
@@ -0,0 +1,49 @@
+From f95a8d9c6aca196f1ace5b2e53a3dd3bc491b1b3 Mon Sep 17 00:00:00 2001
+From: Naveen Gupta <naveen.gupta@cypress.com>
+Date: Wed, 21 Nov 2018 07:53:49 +0000
+Subject: [PATCH] brcmfmac: update 43012 F2 watermark setting to fix DMA Error
+ during UDP RX Traffic
+
+The number of words that the read FIFO has to contain except
+the end of frame before sends data back to the host.
+Max watermark = (512B - 2* (BurstLength))/4 =
+(512 - 128)/4 = 384/4 = 0x60
+so if burst length (i.e. BurstLength = 64) is increased,
+watermark has to be reduced. This is the optimal setting for this chip.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Naveen Gupta <naveen.gupta@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.c  | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -52,6 +52,7 @@
+ /* watermark expressed in number of words */
+ #define DEFAULT_F2_WATERMARK    0x8
+ #define CY_4373_F2_WATERMARK    0x40
++#define CY_43012_F2_WATERMARK    0x60
+ 
+ #ifdef DEBUG
+ 
+@@ -4173,6 +4174,17 @@ static void brcmf_sdio_firmware_callback
+ 					   CY_4373_F2_WATERMARK |
+ 					   SBSDIO_MESBUSYCTRL_ENAB, &err);
+ 			break;
++		case SDIO_DEVICE_ID_CYPRESS_43012:
++			brcmf_dbg(INFO, "set F2 watermark to 0x%x*4 bytes\n",
++				  CY_43012_F2_WATERMARK);
++			brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
++					   CY_43012_F2_WATERMARK, &err);
++			devctl = brcmf_sdiod_readb(sdiod, SBSDIO_DEVICE_CTL,
++						   &err);
++			devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
++			brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl,
++					   &err);
++			break;
+ 		default:
+ 			brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
+ 					   DEFAULT_F2_WATERMARK, &err);
diff --git a/package/kernel/mac80211/patches/brcm/329-v5.0-0007-brcmfmac-4373-save-restore-support.patch b/package/kernel/mac80211/patches/brcm/329-v5.0-0007-brcmfmac-4373-save-restore-support.patch
new file mode 100644
index 0000000000..61c65692de
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/329-v5.0-0007-brcmfmac-4373-save-restore-support.patch
@@ -0,0 +1,57 @@
+From 2f2d389efda4caa4c1b69cb4fa2ab217f0fe6d6f Mon Sep 17 00:00:00 2001
+From: Chi-Hsien Lin <Chi-Hsien.Lin@cypress.com>
+Date: Wed, 21 Nov 2018 07:53:50 +0000
+Subject: [PATCH] brcmfmac: 4373 save-restore support
+
+Use chipcommon sr_control0 register to check 4373 sr support.
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/chip.c        |  5 +++++
+ .../broadcom/brcm80211/include/chipcommon.h   | 19 +++++++++++++++++++
+ 2 files changed, 24 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+@@ -1365,6 +1365,11 @@ bool brcmf_chip_sr_capable(struct brcmf_
+ 		addr = CORE_CC_REG(base, sr_control1);
+ 		reg = chip->ops->read32(chip->ctx, addr);
+ 		return reg != 0;
++	case CY_CC_4373_CHIP_ID:
++		/* explicitly check SR engine enable bit */
++		addr = CORE_CC_REG(base, sr_control0);
++		reg = chip->ops->read32(chip->ctx, addr);
++		return (reg & CC_SR_CTL0_ENABLE_MASK) != 0;
+ 	case CY_CC_43012_CHIP_ID:
+ 		addr = CORE_CC_REG(pmu->base, retention_ctl);
+ 		reg = chip->ops->read32(chip->ctx, addr);
+--- a/drivers/net/wireless/broadcom/brcm80211/include/chipcommon.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/chipcommon.h
+@@ -269,6 +269,25 @@ struct chipcregs {
+ /* GSIO (spi/i2c) present, rev >= 37 */
+ #define	CC_CAP2_GSIO		0x00000002
+ 
++/* sr_control0, rev >= 48 */
++#define CC_SR_CTL0_ENABLE_MASK			BIT(0)
++#define CC_SR_CTL0_ENABLE_SHIFT		0
++#define CC_SR_CTL0_EN_SR_ENG_CLK_SHIFT	1 /* sr_clk to sr_memory enable */
++#define CC_SR_CTL0_RSRC_TRIGGER_SHIFT	2 /* Rising edge resource trigger 0 to
++					   * sr_engine
++					   */
++#define CC_SR_CTL0_MIN_DIV_SHIFT	6 /* Min division value for fast clk
++					   * in sr_engine
++					   */
++#define CC_SR_CTL0_EN_SBC_STBY_SHIFT		16
++#define CC_SR_CTL0_EN_SR_ALP_CLK_MASK_SHIFT	18
++#define CC_SR_CTL0_EN_SR_HT_CLK_SHIFT		19
++#define CC_SR_CTL0_ALLOW_PIC_SHIFT	20 /* Allow pic to separate power
++					    * domains
++					    */
++#define CC_SR_CTL0_MAX_SR_LQ_CLK_CNT_SHIFT	25
++#define CC_SR_CTL0_EN_MEM_DISABLE_FOR_SLEEP	30
++
+ /* pmucapabilities */
+ #define PCAP_REV_MASK	0x000000ff
+ #define PCAP_RC_MASK	0x00001f00
diff --git a/package/kernel/mac80211/patches/brcm/329-v5.0-0008-brcmfmac-disable-command-decode-in-sdio_aos.patch b/package/kernel/mac80211/patches/brcm/329-v5.0-0008-brcmfmac-disable-command-decode-in-sdio_aos.patch
new file mode 100644
index 0000000000..a1125e588d
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/329-v5.0-0008-brcmfmac-disable-command-decode-in-sdio_aos.patch
@@ -0,0 +1,45 @@
+From 29f6589140a10ece8c1d73f58043ea5b3473ab3e Mon Sep 17 00:00:00 2001
+From: Wright Feng <wright.feng@cypress.com>
+Date: Wed, 21 Nov 2018 07:53:52 +0000
+Subject: [PATCH] brcmfmac: disable command decode in sdio_aos
+
+AOS is a part of the SDIOD core that becomes active when the rest of
+SDIOD is sleeping to keep SDIO bus alive responding to reduced set of
+commands.
+
+Transaction between AOS and SDIOD is not protected, and if cmd 52 is
+received in AOS and in the middle of response state changed from AOS to
+SDIOD, response is corrupted and it causes to SDIO Host controller to
+hang.
+
+Command decode for below chips are disabled in this commit:
+ - 4339
+ - 4345
+ - 4354
+ - 4373
+
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Double Lo <double.lo@cypress.com>
+Signed-off-by: Madhan Mohan R <madhanmohan.r@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -3354,7 +3354,11 @@ err:
+ 
+ static bool brcmf_sdio_aos_no_decode(struct brcmf_sdio *bus)
+ {
+-	if (bus->ci->chip == CY_CC_43012_CHIP_ID)
++	if (bus->ci->chip == CY_CC_43012_CHIP_ID ||
++	    bus->ci->chip == CY_CC_4373_CHIP_ID ||
++	    bus->ci->chip == BRCM_CC_4339_CHIP_ID ||
++	    bus->ci->chip == BRCM_CC_4345_CHIP_ID ||
++	    bus->ci->chip == BRCM_CC_4354_CHIP_ID)
+ 		return true;
+ 	else
+ 		return false;
diff --git a/package/kernel/mac80211/patches/brcm/330-v5.0-0001-brcmfmac-fix-false-positive-Wmaybe-unintialized-warn.patch b/package/kernel/mac80211/patches/brcm/330-v5.0-0001-brcmfmac-fix-false-positive-Wmaybe-unintialized-warn.patch
new file mode 100644
index 0000000000..5d454fd3ee
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/330-v5.0-0001-brcmfmac-fix-false-positive-Wmaybe-unintialized-warn.patch
@@ -0,0 +1,34 @@
+From 412dd15c8177d93abe0c8787b83b31c5eb061405 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 10 Dec 2018 21:55:37 +0100
+Subject: [PATCH] brcmfmac: fix false-positive -Wmaybe-unintialized warning
+
+When CONFIG_NO_AUTO_INLINE is set, we get a false-postive warning
+for the brcmf_fw_request_nvram_done() function, after gcc figures
+out that brcmf_fw_nvram_from_efi() might not set the 'data_len'
+variable, but fails to notice that it always returns NULL:
+
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c: In function 'brcmf_fw_request_nvram_done':
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c:560:11: error: 'data_len' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+
+Mark it 'inline' to force gcc to understand this.
+
+Fixes: ce2e6db554fa ("brcmfmac: Add support for getting nvram contents from EFI variables")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -512,7 +512,7 @@ fail:
+ 	return NULL;
+ }
+ #else
+-static u8 *brcmf_fw_nvram_from_efi(size_t *data_len) { return NULL; }
++static inline u8 *brcmf_fw_nvram_from_efi(size_t *data_len) { return NULL; }
+ #endif
+ 
+ static void brcmf_fw_free_request(struct brcmf_fw_request *req)
diff --git a/package/kernel/mac80211/patches/brcm/100-brcmfmac-fix-roamoff-1-modparam.patch b/package/kernel/mac80211/patches/brcm/331-v5.0-0001-brcmfmac-fix-roamoff-1-modparam.patch
index 114a3b3fe4..4ddc903418 100644
--- a/package/kernel/mac80211/patches/brcm/100-brcmfmac-fix-roamoff-1-modparam.patch
+++ b/package/kernel/mac80211/patches/brcm/331-v5.0-0001-brcmfmac-fix-roamoff-1-modparam.patch
@@ -1,7 +1,7 @@
-From 22d319f2665dd3458d59c934fa0c8cf1b1d7227f Mon Sep 17 00:00:00 2001
+From 8c892df41500469729e0d662816300196e4f463d Mon Sep 17 00:00:00 2001
 From: Stijn Tintel <stijn@linux-ipv6.be>
-Date: Sat, 10 Nov 2018 13:25:20 +0200
-Subject: [PATCH wireless-drivers] brcmfmac: fix roamoff=1 modparam
+Date: Tue, 4 Dec 2018 20:29:05 +0200
+Subject: [PATCH] brcmfmac: fix roamoff=1 modparam
 
 When the update_connect_param callback is set, nl80211 expects the flag
 WIPHY_FLAG_SUPPORTS_FW_ROAM to be set as well. However, this flag is
@@ -15,6 +15,7 @@ Fixes: 7f9a3e150ec7 ("nl80211: Update ERP info using NL80211_CMD_UPDATE_CONNECT_
 Cc: Stable <stable@vger.kernel.org> # 4.19+
 Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
 Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 ---
  .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c   | 11 +++++++++--
  .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.h   |  2 +-
diff --git a/package/kernel/mac80211/patches/brcm/332-v5.0-0001-brcmfmac-Fix-access-point-mode.patch b/package/kernel/mac80211/patches/brcm/332-v5.0-0001-brcmfmac-Fix-access-point-mode.patch
new file mode 100644
index 0000000000..acf587676e
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/332-v5.0-0001-brcmfmac-Fix-access-point-mode.patch
@@ -0,0 +1,41 @@
+From 861cb5eb467f5e38dce1aabe4e8db379255bd89b Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Wed, 12 Dec 2018 20:20:06 +0100
+Subject: [PATCH] brcmfmac: Fix access point mode
+
+Since commit 1204aa17f3b4 ("brcmfmac: set WIPHY_FLAG_HAVE_AP_SME flag")
+the Raspberry Pi 3 A+ (BCM43455) isn't able to operate in AP mode with
+hostapd (device_ap_sme=1 use_monitor=0):
+
+brcmfmac: brcmf_cfg80211_stop_ap: setting AP mode failed -52
+
+So add the missing mgmt_stypes for AP mode to fix this.
+
+Fixes: 1204aa17f3b4 ("brcmfmac: set WIPHY_FLAG_HAVE_AP_SME flag")
+Suggested-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c    | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6308,6 +6308,16 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] =
+ 		.tx = 0xffff,
+ 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+ 		      BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
++	},
++	[NL80211_IFTYPE_AP] = {
++		.tx = 0xffff,
++		.rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
++		      BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
++		      BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
++		      BIT(IEEE80211_STYPE_DISASSOC >> 4) |
++		      BIT(IEEE80211_STYPE_AUTH >> 4) |
++		      BIT(IEEE80211_STYPE_DEAUTH >> 4) |
++		      BIT(IEEE80211_STYPE_ACTION >> 4)
+ 	}
+ };
+