mac80211: brcmfmac: fix PCIe reset crash and WARNING

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit cde8c2f2fb)

feeds.conf.default

@@ -1,4 +1,4 @@
-src-git packages https://git.lede-project.org/feed/packages.git^40da7ecf21ffe1f3523ffa430c406e1db58ce3d4
-src-git luci https://git.lede-project.org/project/luci.git^7bf036750081787e01339c82865ad45fca6520ef
-src-git routing https://git.lede-project.org/feed/routing.git^d09478290f72c6e58833b65baf14d9173eaf98e1
-src-git telephony https://git.lede-project.org/feed/telephony.git^95498e75db5c6741cd53f8746ffc1473c72b6e5d
+src-git packages https://git.lede-project.org/feed/packages.git;lede-17.01
+src-git luci https://git.lede-project.org/project/luci.git;lede-17.01
+src-git routing https://git.lede-project.org/feed/routing.git;lede-17.01
+src-git telephony https://git.lede-project.org/feed/telephony.git;lede-17.01

include/kernel-version.mk

@@ -3,10 +3,10 @@
 LINUX_RELEASE?=1
 
 LINUX_VERSION-3.18 = .43
-LINUX_VERSION-4.4 = .153
+LINUX_VERSION-4.4 = .194
 
 LINUX_KERNEL_HASH-3.18.43 = 1236e8123a6ce537d5029232560966feed054ae31776fe8481dd7d18cdd5492c
-LINUX_KERNEL_HASH-4.4.153 = 0f2355515c22ca705600043bedc75218c68dcb8ab528f57f67851fbcb8545402
+LINUX_KERNEL_HASH-4.4.194 = 7f63e893f1a178c25646a302ae7425423a3f1b72fc5d6895a2716e4bb6b8744f
 
 ifdef KERNEL_PATCHVER
   LINUX_VERSION:=$(KERNEL_PATCHVER)$(strip $(LINUX_VERSION-$(KERNEL_PATCHVER)))

include/version.mk

@@ -31,16 +31,16 @@ qstrip_escape=$(subst ','\'',$(call qstrip,$(1)))
 sanitize = $(call tolower,$(subst _,-,$(subst $(space),-,$(1))))
 
 VERSION_NUMBER:=$(call qstrip_escape,$(CONFIG_VERSION_NUMBER))
-VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),17.01.6)
+VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),17.01-SNAPSHOT)
 
 VERSION_CODE:=$(call qstrip_escape,$(CONFIG_VERSION_CODE))
-VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),r3979-2252731af4)
+VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),$(REVISION))
 
 VERSION_NICK:=$(call qstrip_escape,$(CONFIG_VERSION_NICK))
 VERSION_NICK:=$(if $(VERSION_NICK),$(VERSION_NICK),$(RELEASE))
 
 VERSION_REPO:=$(call qstrip_escape,$(CONFIG_VERSION_REPO))
-VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),http://downloads.lede-project.org/releases/17.01.6)
+VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),http://downloads.lede-project.org/releases/17.01-SNAPSHOT)
 
 VERSION_DIST:=$(call qstrip_escape,$(CONFIG_VERSION_DIST))
 VERSION_DIST:=$(if $(VERSION_DIST),$(VERSION_DIST),LEDE)

package/Makefile

@@ -80,8 +80,12 @@ $(curdir)/index: FORCE
 		mkdir -p $$d; \
 		cd $$d || continue; \
 		$(SCRIPT_DIR)/ipkg-make-index.sh . 2>&1 > Packages.manifest; \
-		grep -vE '^(Maintainer|LicenseFiles|Source|Require)' Packages.manifest > Packages && \
-			gzip -9nc Packages > Packages.gz; \
+		grep -vE '^(Maintainer|LicenseFiles|Source|Require)' Packages.manifest > Packages; \
+		case "$$(((64 + $$(stat -L -c%s Packages)) % 128))" in 110|111) \
+			$(call ERROR_MESSAGE,WARNING: Applying padding in $$d/Packages to workaround usign SHA-512 bug!); \
+			{ echo ""; echo ""; } >> Packages;; \
+		esac; \
+		gzip -9nc Packages > Packages.gz; \
 	); done
 ifdef CONFIG_SIGNED_PACKAGES
 	@echo Signing package index...

package/base-files/files/etc/iproute2/ematch_map

@@ -0,0 +1,8 @@
+# lookup table for ematch kinds
+1	cmp
+2	nbyte
+3	u32
+4	meta
+7	canid
+8	ipset
+9	ipt

package/base-files/files/etc/rc.common

@@ -23,6 +23,7 @@ reload() {
 restart() {
 	trap '' TERM
 	stop "$@"
+	trap - TERM
 	start "$@"
 }
 

package/base-files/files/lib/functions.sh

@@ -165,22 +165,27 @@ insert_modules() {
 
 default_prerm() {
 	local root="${IPKG_INSTROOT}"
-	local name
+	local pkgname="$(basename ${1%.*})"
+	local ret=0
 
-	name=$(basename ${1%.*})
-	[ -f "$root/usr/lib/opkg/info/${name}.prerm-pkg" ] && . "$root/usr/lib/opkg/info/${name}.prerm-pkg"
+	if [ -f "$root/usr/lib/opkg/info/${pkgname}.prerm-pkg" ]; then
+		( . "$root/usr/lib/opkg/info/${pkgname}.prerm-pkg" )
+		ret=$?
+	fi
 
 	local shell="$(which bash)"
-	for i in `cat "$root/usr/lib/opkg/info/${name}.list" | grep "^/etc/init.d/"`; do
+	for i in $(grep -s "^/etc/init.d/" "$root/usr/lib/opkg/info/${pkgname}.list"); do
 		if [ -n "$root" ]; then
 			${shell:-/bin/sh} "$root/etc/rc.common" "$root$i" disable
 		else
 			if [ "$PKG_UPGRADE" != "1" ]; then
 				"$i" disable
 			fi
-			"$i" stop || /bin/true
+			"$i" stop
 		fi
 	done
+
+	return $ret
 }
 
 add_group_and_user() {
@@ -238,10 +243,9 @@ default_postinst() {
 	if [ -z "$root" ] && grep -q -s "^/etc/uci-defaults/" "/usr/lib/opkg/info/${pkgname}.list"; then
 		. /lib/functions/system.sh
 		[ -d /tmp/.uci ] || mkdir -p /tmp/.uci
-		for i in $(sed -ne 's!^/etc/uci-defaults/!!p' "/usr/lib/opkg/info/${pkgname}.list"); do (
-			cd /etc/uci-defaults
-			[ -f "$i" ] && . ./"$i" && rm -f "$i"
-		) done
+		for i in $(grep -s "^/etc/uci-defaults/" "/usr/lib/opkg/info/${pkgname}.list"); do
+			( [ -f "$i" ] && cd "$(dirname $i)" && . "$i" ) && rm -f "$i"
+		done
 		uci commit
 	fi
 

package/base-files/image-config.in

@@ -190,7 +190,7 @@ if VERSIONOPT
 	config VERSION_REPO
 		string
 		prompt "Release repository"
-		default "http://downloads.lede-project.org/releases/17.01.6"
+		default "http://downloads.lede-project.org/releases/17.01-SNAPSHOT"
 		help
 			This is the repository address embedded in the image, it defaults
 			to the trunk snapshot repo; the url may contain the following placeholders:
@@ -262,7 +262,7 @@ if VERSIONOPT
 	config VERSION_CODE_FILENAMES
 		bool
 		prompt "Revision code in filenames"
-		default n
+		default y
 		help
 			Enable this to include the revision identifier or the configured
 			version code into the firmware image, SDK- and Image Builder archive

package/devel/perf/Makefile

@@ -26,7 +26,7 @@ include $(INCLUDE_DIR)/package.mk
 define Package/perf
   SECTION:=devel
   CATEGORY:=Development
-  DEPENDS:= +libelf1 +libdw +(mips||mipsel||powerpc||i386||x86_64||arm):libunwind +libpthread +librt +objdump @!LINUX_3_18 @!IN_SDK
+  DEPENDS:= +libelf1 +libdw +(mips||mipsel||powerpc||i386||x86_64||arm||aarch64):libunwind +libpthread +librt +objdump @!LINUX_3_18 @!IN_SDK
   TITLE:=Linux performance monitoring tool
   VERSION:=$(LINUX_VERSION)-$(PKG_RELEASE)
   URL:=http://www.kernel.org

package/kernel/mac80211/Makefile

@@ -11,7 +11,7 @@ include $(INCLUDE_DIR)/kernel.mk
 PKG_NAME:=mac80211
 
 PKG_VERSION:=2017-01-31
-PKG_RELEASE:=14
+PKG_RELEASE:=15
 PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources
 PKG_BACKPORT_VERSION:=
 PKG_HASH:=75e6d39e34cf156212a2509172a4a62b673b69eb4a1d9aaa565f7fa719fa2317

package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh

@@ -14,6 +14,10 @@ MP_CONFIG_INT="mesh_retry_timeout mesh_confirm_timeout mesh_holding_timeout mesh
 MP_CONFIG_BOOL="mesh_auto_open_plinks mesh_fwding"
 MP_CONFIG_STRING="mesh_power_mode"
 
+iw() {
+	command iw $@ || logger -t mac80211 "Failed command: iw $@"
+}
+
 drv_mac80211_init_device_config() {
 	hostapd_common_add_device_config
 

package/kernel/mac80211/patches/013-mm-backport-get_user_pages.patch

@@ -0,0 +1,65 @@
+--- a/backport-include/linux/mm.h
++++ b/backport-include/linux/mm.h
+@@ -39,8 +39,20 @@ static inline
+ long backport_get_user_pages_locked(unsigned long start, unsigned long nr_pages,
+ 		    int write, int force, struct page **pages, int *locked)
+ {
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,4,168))
+ 	return get_user_pages_locked(current, current->mm, start, nr_pages,
+ 		    write, force, pages, locked);
++#else
++	int flags = 0;
++
++	if (write)
++		flags |= FOLL_WRITE;
++	if (force)
++		flags |= FOLL_FORCE;
++
++	return get_user_pages_locked(current, current->mm, start, nr_pages,
++		    flags, pages, locked);
++#endif
+ }
+ #define get_user_pages_locked LINUX_BACKPORT(get_user_pages_locked)
+ 
+@@ -48,8 +60,20 @@ static inline
+ long backport_get_user_pages_unlocked(unsigned long start, unsigned long nr_pages,
+ 				      int write, int force, struct page **pages)
+ {
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,4,168))
+ 	return get_user_pages_unlocked(current, current->mm, start,  nr_pages,
+ 		    write, force, pages);
++#else
++	int flags = 0;
++
++	if (write)
++		flags |= FOLL_WRITE;
++	if (force)
++		flags |= FOLL_FORCE;
++
++	return get_user_pages_unlocked(current, current->mm, start,  nr_pages,
++		    pages, flags);
++#endif
+ }
+ #define get_user_pages_unlocked LINUX_BACKPORT(get_user_pages_unlocked)
+ #endif
+@@ -60,8 +84,20 @@ long backport_get_user_pages(unsigned lo
+ 			    int write, int force, struct page **pages,
+ 			    struct vm_area_struct **vmas)
+ {
++#if (LINUX_VERSION_CODE < KERNEL_VERSION(4,4,168))
+ 	return get_user_pages(current, current->mm, start,  nr_pages,
+ 		    write, force, pages, vmas);
++#else
++	int flags = 0;
++
++	if (write)
++		flags |= FOLL_WRITE;
++	if (force)
++		flags |= FOLL_FORCE;
++
++	return get_user_pages(current, current->mm, start,  nr_pages,
++		    flags, pages, vmas);
++#endif
+ }
+ #define get_user_pages LINUX_BACKPORT(get_user_pages)
+ #endif

package/kernel/mac80211/patches/319-v4.12-0010-brcmfmac-move-brcmf_txflowblock-to-bcdc-layer.patch

@@ -0,0 +1,137 @@
+From 20ec4f57498f8770c7a1a3e2a316fa752a424178 Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Fri, 10 Mar 2017 21:17:02 +0000
+Subject: [PATCH] brcmfmac: move brcmf_txflowblock to bcdc layer
+
+brcmf_txflowblock is invoked by sdio and usb bus module which are using
+bcdc protocol. This patch makes it a bcdc API instead of a core module
+function.
+
+Reviewed-by: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c    | 10 ++++++++++
+ .../net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h    |  1 +
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h |  2 --
+ .../net/wireless/broadcom/brcm80211/brcmfmac/core.c    | 10 ----------
+ .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.c    |  5 +++--
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c |  5 +++--
+ 6 files changed, 17 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -345,6 +345,16 @@ brcmf_proto_bcdc_txdata(struct brcmf_pub
+ 	return brcmf_bus_txdata(drvr->bus_if, pktbuf);
+ }
+ 
++void brcmf_proto_bcdc_txflowblock(struct device *dev, bool state)
++{
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_pub *drvr = bus_if->drvr;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	brcmf_fws_bus_blocked(drvr, state);
++}
++
+ static void
+ brcmf_proto_bcdc_configure_addr_mode(struct brcmf_pub *drvr, int ifidx,
+ 				     enum proto_addr_mode addr_mode)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
+@@ -19,6 +19,7 @@
+ #ifdef CPTCFG_BRCMFMAC_PROTO_BCDC
+ int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr);
+ void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr);
++void brcmf_proto_bcdc_txflowblock(struct device *dev, bool state);
+ #else
+ static inline int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr) { return 0; }
+ static inline void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr) {}
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -229,8 +229,6 @@ int brcmf_attach(struct device *dev, str
+ void brcmf_detach(struct device *dev);
+ /* Indication from bus module that dongle should be reset */
+ void brcmf_dev_reset(struct device *dev);
+-/* Indication from bus module to change flow-control state */
+-void brcmf_txflowblock(struct device *dev, bool state);
+ 
+ /* Notify the bus has transferred the tx packet to firmware */
+ void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -283,16 +283,6 @@ void brcmf_txflowblock_if(struct brcmf_i
+ 	spin_unlock_irqrestore(&ifp->netif_stop_lock, flags);
+ }
+ 
+-void brcmf_txflowblock(struct device *dev, bool state)
+-{
+-	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+-	struct brcmf_pub *drvr = bus_if->drvr;
+-
+-	brcmf_dbg(TRACE, "Enter\n");
+-
+-	brcmf_fws_bus_blocked(drvr, state);
+-}
+-
+ void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb)
+ {
+ 	if (skb->pkt_type == PACKET_MULTICAST)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -44,6 +44,7 @@
+ #include "firmware.h"
+ #include "core.h"
+ #include "common.h"
++#include "bcdc.h"
+ 
+ #define DCMD_RESP_TIMEOUT	msecs_to_jiffies(2500)
+ #define CTL_DONE_TIMEOUT	msecs_to_jiffies(2500)
+@@ -2328,7 +2329,7 @@ static uint brcmf_sdio_sendfromq(struct
+ 	if ((bus->sdiodev->state == BRCMF_SDIOD_DATA) &&
+ 	    bus->txoff && (pktq_len(&bus->txq) < TXLOW)) {
+ 		bus->txoff = false;
+-		brcmf_txflowblock(bus->sdiodev->dev, false);
++		brcmf_proto_bcdc_txflowblock(bus->sdiodev->dev, false);
+ 	}
+ 
+ 	return cnt;
+@@ -2753,7 +2754,7 @@ static int brcmf_sdio_bus_txdata(struct
+ 
+ 	if (pktq_len(&bus->txq) >= TXHI) {
+ 		bus->txoff = true;
+-		brcmf_txflowblock(dev, true);
++		brcmf_proto_bcdc_txflowblock(dev, true);
+ 	}
+ 	spin_unlock_bh(&bus->txq_lock);
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -29,6 +29,7 @@
+ #include "usb.h"
+ #include "core.h"
+ #include "common.h"
++#include "bcdc.h"
+ 
+ 
+ #define IOCTL_RESP_TIMEOUT		msecs_to_jiffies(2000)
+@@ -488,7 +489,7 @@ static void brcmf_usb_tx_complete(struct
+ 	spin_lock_irqsave(&devinfo->tx_flowblock_lock, flags);
+ 	if (devinfo->tx_freecount > devinfo->tx_high_watermark &&
+ 		devinfo->tx_flowblock) {
+-		brcmf_txflowblock(devinfo->dev, false);
++		brcmf_proto_bcdc_txflowblock(devinfo->dev, false);
+ 		devinfo->tx_flowblock = false;
+ 	}
+ 	spin_unlock_irqrestore(&devinfo->tx_flowblock_lock, flags);
+@@ -635,7 +636,7 @@ static int brcmf_usb_tx(struct device *d
+ 	spin_lock_irqsave(&devinfo->tx_flowblock_lock, flags);
+ 	if (devinfo->tx_freecount < devinfo->tx_low_watermark &&
+ 	    !devinfo->tx_flowblock) {
+-		brcmf_txflowblock(dev, true);
++		brcmf_proto_bcdc_txflowblock(dev, true);
+ 		devinfo->tx_flowblock = true;
+ 	}
+ 	spin_unlock_irqrestore(&devinfo->tx_flowblock_lock, flags);

package/kernel/mac80211/patches/319-v4.12-0011-brcmfmac-move-brcmf_txcomplete-to-bcdc-layer.patch

@@ -0,0 +1,122 @@
+From 7b584396b7a760bc77bbde4625f83ef173159d3e Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Fri, 10 Mar 2017 21:17:03 +0000
+Subject: [PATCH] brcmfmac: move brcmf_txcomplete to bcdc layer
+
+brcmf_txcomplete is invoked by sdio and usb bus module which are using
+bcdc protocol. So move it from core module into bcdc layer.
+
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/bcdc.c        | 20 +++++++++++++++++++
+ .../broadcom/brcm80211/brcmfmac/bcdc.h        |  2 ++
+ .../broadcom/brcm80211/brcmfmac/bus.h         |  3 ---
+ .../broadcom/brcm80211/brcmfmac/core.c        | 18 -----------------
+ .../broadcom/brcm80211/brcmfmac/sdio.c        |  3 ++-
+ .../broadcom/brcm80211/brcmfmac/usb.c         |  2 +-
+ 6 files changed, 25 insertions(+), 23 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -355,6 +355,26 @@ void brcmf_proto_bcdc_txflowblock(struct
+ 	brcmf_fws_bus_blocked(drvr, state);
+ }
+ 
++void
++brcmf_proto_bcdc_txcomplete(struct device *dev, struct sk_buff *txp,
++			    bool success)
++{
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_pub *drvr = bus_if->drvr;
++	struct brcmf_if *ifp;
++
++	/* await txstatus signal for firmware if active */
++	if (brcmf_fws_fc_active(drvr->fws)) {
++		if (!success)
++			brcmf_fws_bustxfail(drvr->fws, txp);
++	} else {
++		if (brcmf_proto_bcdc_hdrpull(drvr, false, txp, &ifp))
++			brcmu_pkt_buf_free_skb(txp);
++		else
++			brcmf_txfinalize(ifp, txp, success);
++	}
++}
++
+ static void
+ brcmf_proto_bcdc_configure_addr_mode(struct brcmf_pub *drvr, int ifidx,
+ 				     enum proto_addr_mode addr_mode)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
+@@ -20,6 +20,8 @@
+ int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr);
+ void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr);
+ void brcmf_proto_bcdc_txflowblock(struct device *dev, bool state);
++void brcmf_proto_bcdc_txcomplete(struct device *dev, struct sk_buff *txp,
++				 bool success);
+ #else
+ static inline int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr) { return 0; }
+ static inline void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr) {}
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -230,9 +230,6 @@ void brcmf_detach(struct device *dev);
+ /* Indication from bus module that dongle should be reset */
+ void brcmf_dev_reset(struct device *dev);
+ 
+-/* Notify the bus has transferred the tx packet to firmware */
+-void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success);
+-
+ /* Configure the "global" bus state used by upper layers */
+ void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state);
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -383,24 +383,6 @@ void brcmf_txfinalize(struct brcmf_if *i
+ 	brcmu_pkt_buf_free_skb(txp);
+ }
+ 
+-void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success)
+-{
+-	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+-	struct brcmf_pub *drvr = bus_if->drvr;
+-	struct brcmf_if *ifp;
+-
+-	/* await txstatus signal for firmware if active */
+-	if (brcmf_fws_fc_active(drvr->fws)) {
+-		if (!success)
+-			brcmf_fws_bustxfail(drvr->fws, txp);
+-	} else {
+-		if (brcmf_proto_hdrpull(drvr, false, txp, &ifp))
+-			brcmu_pkt_buf_free_skb(txp);
+-		else
+-			brcmf_txfinalize(ifp, txp, success);
+-	}
+-}
+-
+ static struct net_device_stats *brcmf_netdev_get_stats(struct net_device *ndev)
+ {
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -2266,7 +2266,8 @@ done:
+ 		bus->tx_seq = (bus->tx_seq + pktq->qlen) % SDPCM_SEQ_WRAP;
+ 	skb_queue_walk_safe(pktq, pkt_next, tmp) {
+ 		__skb_unlink(pkt_next, pktq);
+-		brcmf_txcomplete(bus->sdiodev->dev, pkt_next, ret == 0);
++		brcmf_proto_bcdc_txcomplete(bus->sdiodev->dev, pkt_next,
++					    ret == 0);
+ 	}
+ 	return ret;
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -483,7 +483,7 @@ static void brcmf_usb_tx_complete(struct
+ 		  req->skb);
+ 	brcmf_usb_del_fromq(devinfo, req);
+ 
+-	brcmf_txcomplete(devinfo->dev, req->skb, urb->status == 0);
++	brcmf_proto_bcdc_txcomplete(devinfo->dev, req->skb, urb->status == 0);
+ 	req->skb = NULL;
+ 	brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req, &devinfo->tx_freecount);
+ 	spin_lock_irqsave(&devinfo->tx_flowblock_lock, flags);

package/kernel/mac80211/patches/319-v4.12-0012-brcmfmac-wrap-brcmf_fws_add_interface-into-bcdc-laye.patch

@@ -0,0 +1,95 @@
+From 9fdc64bbdbe7bd546e0fbcedd2f1c03448c6df42 Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Fri, 10 Mar 2017 21:17:04 +0000
+Subject: [PATCH] brcmfmac: wrap brcmf_fws_add_interface into bcdc layer
+
+fwsignal is only used by bcdc. Create a new protocol interface function
+brcmf_proto_add_if for core module to notify protocol layer upon a new
+interface is created.
+
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c  | 7 +++++++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c  | 2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c  | 3 ++-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h | 9 +++++++++
+ 4 files changed, 19 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -399,6 +399,12 @@ static void brcmf_proto_bcdc_rxreorder(s
+ 	brcmf_fws_rxreorder(ifp, skb);
+ }
+ 
++static void
++brcmf_proto_bcdc_add_if(struct brcmf_if *ifp)
++{
++	brcmf_fws_add_interface(ifp);
++}
++
+ int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr)
+ {
+ 	struct brcmf_bcdc *bcdc;
+@@ -422,6 +428,7 @@ int brcmf_proto_bcdc_attach(struct brcmf
+ 	drvr->proto->delete_peer = brcmf_proto_bcdc_delete_peer;
+ 	drvr->proto->add_tdls_peer = brcmf_proto_bcdc_add_tdls_peer;
+ 	drvr->proto->rxreorder = brcmf_proto_bcdc_rxreorder;
++	drvr->proto->add_if = brcmf_proto_bcdc_add_if;
+ 	drvr->proto->pd = bcdc;
+ 
+ 	drvr->hdrlen += BCDC_HEADER_LEN + BRCMF_PROT_FW_SIGNAL_MAX_TXBYTES;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1000,7 +1000,7 @@ int brcmf_bus_started(struct device *dev
+ 	if (ret < 0)
+ 		goto fail;
+ 
+-	brcmf_fws_add_interface(ifp);
++	brcmf_proto_add_if(drvr, ifp);
+ 
+ 	drvr->config = brcmf_cfg80211_attach(drvr, bus_if->dev,
+ 					     drvr->settings->p2p_enable);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
+@@ -25,6 +25,7 @@
+ #include "fwsignal.h"
+ #include "fweh.h"
+ #include "fwil.h"
++#include "proto.h"
+ 
+ /**
+  * struct brcmf_fweh_queue_item - event item on event queue.
+@@ -172,7 +173,7 @@ static void brcmf_fweh_handle_if_event(s
+ 		if (IS_ERR(ifp))
+ 			return;
+ 		if (!is_p2pdev)
+-			brcmf_fws_add_interface(ifp);
++			brcmf_proto_add_if(drvr, ifp);
+ 		if (!drvr->fweh.evt_handler[BRCMF_E_IF])
+ 			if (brcmf_net_attach(ifp, false) < 0)
+ 				return;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
+@@ -44,6 +44,7 @@ struct brcmf_proto {
+ 	void (*add_tdls_peer)(struct brcmf_pub *drvr, int ifidx,
+ 			      u8 peer[ETH_ALEN]);
+ 	void (*rxreorder)(struct brcmf_if *ifp, struct sk_buff *skb);
++	void (*add_if)(struct brcmf_if *ifp);
+ 	void *pd;
+ };
+ 
+@@ -118,4 +119,12 @@ brcmf_proto_rxreorder(struct brcmf_if *i
+ 	ifp->drvr->proto->rxreorder(ifp, skb);
+ }
+ 
++static inline void
++brcmf_proto_add_if(struct brcmf_pub *drvr, struct brcmf_if *ifp)
++{
++	if (!drvr->proto->add_if)
++		return;
++	drvr->proto->add_if(ifp);
++}
++
+ #endif /* BRCMFMAC_PROTO_H */

package/kernel/mac80211/patches/319-v4.12-0013-brcmfmac-wrap-brcmf_fws_del_interface-into-bcdc-laye.patch

@@ -0,0 +1,83 @@
+From c02a5eb82056f75615cb48aa540bfd245f489b99 Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Fri, 10 Mar 2017 21:17:05 +0000
+Subject: [PATCH] brcmfmac: wrap brcmf_fws_del_interface into bcdc layer
+
+Create a new protocol interface function brcmf_proto_del_if for core
+module to notify protocol layer upon interface deletion.
+
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c  | 7 +++++++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c  | 4 ++--
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h | 9 +++++++++
+ 3 files changed, 18 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -405,6 +405,12 @@ brcmf_proto_bcdc_add_if(struct brcmf_if
+ 	brcmf_fws_add_interface(ifp);
+ }
+ 
++static void
++brcmf_proto_bcdc_del_if(struct brcmf_if *ifp)
++{
++	brcmf_fws_del_interface(ifp);
++}
++
+ int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr)
+ {
+ 	struct brcmf_bcdc *bcdc;
+@@ -429,6 +435,7 @@ int brcmf_proto_bcdc_attach(struct brcmf
+ 	drvr->proto->add_tdls_peer = brcmf_proto_bcdc_add_tdls_peer;
+ 	drvr->proto->rxreorder = brcmf_proto_bcdc_rxreorder;
+ 	drvr->proto->add_if = brcmf_proto_bcdc_add_if;
++	drvr->proto->del_if = brcmf_proto_bcdc_del_if;
+ 	drvr->proto->pd = bcdc;
+ 
+ 	drvr->hdrlen += BCDC_HEADER_LEN + BRCMF_PROT_FW_SIGNAL_MAX_TXBYTES;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -716,7 +716,7 @@ void brcmf_remove_interface(struct brcmf
+ 		return;
+ 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, ifidx=%d\n", ifp->bsscfgidx,
+ 		  ifp->ifidx);
+-	brcmf_fws_del_interface(ifp);
++	brcmf_proto_del_if(ifp->drvr, ifp);
+ 	brcmf_del_if(ifp->drvr, ifp->bsscfgidx, rtnl_locked);
+ }
+ 
+@@ -1045,7 +1045,7 @@ fail:
+ 		drvr->config = NULL;
+ 	}
+ 	if (drvr->fws) {
+-		brcmf_fws_del_interface(ifp);
++		brcmf_proto_del_if(ifp->drvr, ifp);
+ 		brcmf_fws_deinit(drvr);
+ 	}
+ 	brcmf_net_detach(ifp->ndev, false);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
+@@ -45,6 +45,7 @@ struct brcmf_proto {
+ 			      u8 peer[ETH_ALEN]);
+ 	void (*rxreorder)(struct brcmf_if *ifp, struct sk_buff *skb);
+ 	void (*add_if)(struct brcmf_if *ifp);
++	void (*del_if)(struct brcmf_if *ifp);
+ 	void *pd;
+ };
+ 
+@@ -127,4 +128,12 @@ brcmf_proto_add_if(struct brcmf_pub *drv
+ 	drvr->proto->add_if(ifp);
+ }
+ 
++static inline void
++brcmf_proto_del_if(struct brcmf_pub *drvr, struct brcmf_if *ifp)
++{
++	if (!drvr->proto->del_if)
++		return;
++	drvr->proto->del_if(ifp);
++}
++
+ #endif /* BRCMFMAC_PROTO_H */

package/kernel/mac80211/patches/319-v4.12-0014-brcmfmac-wrap-brcmf_fws_reset_interface-into-bcdc-la.patch

@@ -0,0 +1,82 @@
+From 66ded1f8b33cdd9d6d3e20f5f8dd23615a110e70 Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Fri, 10 Mar 2017 21:17:06 +0000
+Subject: [PATCH] brcmfmac: wrap brcmf_fws_reset_interface into bcdc layer
+
+Create a new protocol interface function brcmf_proto_reset_if for core
+module to notify protocol layer when interface role changes.
+
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c  | 7 +++++++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c  | 3 +--
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h | 9 +++++++++
+ 3 files changed, 17 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -411,6 +411,12 @@ brcmf_proto_bcdc_del_if(struct brcmf_if
+ 	brcmf_fws_del_interface(ifp);
+ }
+ 
++static void
++brcmf_proto_bcdc_reset_if(struct brcmf_if *ifp)
++{
++	brcmf_fws_reset_interface(ifp);
++}
++
+ int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr)
+ {
+ 	struct brcmf_bcdc *bcdc;
+@@ -436,6 +442,7 @@ int brcmf_proto_bcdc_attach(struct brcmf
+ 	drvr->proto->rxreorder = brcmf_proto_bcdc_rxreorder;
+ 	drvr->proto->add_if = brcmf_proto_bcdc_add_if;
+ 	drvr->proto->del_if = brcmf_proto_bcdc_del_if;
++	drvr->proto->reset_if = brcmf_proto_bcdc_reset_if;
+ 	drvr->proto->pd = bcdc;
+ 
+ 	drvr->hdrlen += BCDC_HEADER_LEN + BRCMF_PROT_FW_SIGNAL_MAX_TXBYTES;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
+@@ -22,7 +22,6 @@
+ #include "core.h"
+ #include "debug.h"
+ #include "tracepoint.h"
+-#include "fwsignal.h"
+ #include "fweh.h"
+ #include "fwil.h"
+ #include "proto.h"
+@@ -180,7 +179,7 @@ static void brcmf_fweh_handle_if_event(s
+ 	}
+ 
+ 	if (ifp && ifevent->action == BRCMF_E_IF_CHANGE)
+-		brcmf_fws_reset_interface(ifp);
++		brcmf_proto_reset_if(drvr, ifp);
+ 
+ 	err = brcmf_fweh_call_event_handler(ifp, emsg->event_code, emsg, data);
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
+@@ -46,6 +46,7 @@ struct brcmf_proto {
+ 	void (*rxreorder)(struct brcmf_if *ifp, struct sk_buff *skb);
+ 	void (*add_if)(struct brcmf_if *ifp);
+ 	void (*del_if)(struct brcmf_if *ifp);
++	void (*reset_if)(struct brcmf_if *ifp);
+ 	void *pd;
+ };
+ 
+@@ -136,4 +137,12 @@ brcmf_proto_del_if(struct brcmf_pub *drv
+ 	drvr->proto->del_if(ifp);
+ }
+ 
++static inline void
++brcmf_proto_reset_if(struct brcmf_pub *drvr, struct brcmf_if *ifp)
++{
++	if (!drvr->proto->reset_if)
++		return;
++	drvr->proto->reset_if(ifp);
++}
++
+ #endif /* BRCMFMAC_PROTO_H */

package/kernel/mac80211/patches/319-v4.12-0020-brcmfmac-wrap-brcmf_fws_init-into-bcdc-layer.patch

@@ -0,0 +1,76 @@
+From 62c50a34883c6b821d816b6a661e5d47c09d42b2 Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Tue, 28 Mar 2017 11:43:24 +0100
+Subject: [PATCH] brcmfmac: wrap brcmf_fws_init into bcdc layer
+
+Create a new protocol layer interface brcmf_proto_init_cb for protocol
+layer to finish initialzation after core module components(fweh and
+etc.) are initialized.
+
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Reviewed-by: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c  | 7 +++++++
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c  | 2 +-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h | 9 +++++++++
+ 3 files changed, 17 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -417,6 +417,12 @@ brcmf_proto_bcdc_reset_if(struct brcmf_i
+ 	brcmf_fws_reset_interface(ifp);
+ }
+ 
++static int
++brcmf_proto_bcdc_init_done(struct brcmf_pub *drvr)
++{
++	return brcmf_fws_init(drvr);
++}
++
+ int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr)
+ {
+ 	struct brcmf_bcdc *bcdc;
+@@ -443,6 +449,7 @@ int brcmf_proto_bcdc_attach(struct brcmf
+ 	drvr->proto->add_if = brcmf_proto_bcdc_add_if;
+ 	drvr->proto->del_if = brcmf_proto_bcdc_del_if;
+ 	drvr->proto->reset_if = brcmf_proto_bcdc_reset_if;
++	drvr->proto->init_done = brcmf_proto_bcdc_init_done;
+ 	drvr->proto->pd = bcdc;
+ 
+ 	drvr->hdrlen += BCDC_HEADER_LEN + BRCMF_PROT_FW_SIGNAL_MAX_TXBYTES;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -996,7 +996,7 @@ int brcmf_bus_started(struct device *dev
+ 	}
+ 	brcmf_feat_attach(drvr);
+ 
+-	ret = brcmf_fws_init(drvr);
++	ret = brcmf_proto_init_done(drvr);
+ 	if (ret < 0)
+ 		goto fail;
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
+@@ -47,6 +47,7 @@ struct brcmf_proto {
+ 	void (*add_if)(struct brcmf_if *ifp);
+ 	void (*del_if)(struct brcmf_if *ifp);
+ 	void (*reset_if)(struct brcmf_if *ifp);
++	int (*init_done)(struct brcmf_pub *drvr);
+ 	void *pd;
+ };
+ 
+@@ -145,4 +146,12 @@ brcmf_proto_reset_if(struct brcmf_pub *d
+ 	drvr->proto->reset_if(ifp);
+ }
+ 
++static inline int
++brcmf_proto_init_done(struct brcmf_pub *drvr)
++{
++	if (!drvr->proto->init_done)
++		return 0;
++	return drvr->proto->init_done(drvr);
++}
++
+ #endif /* BRCMFMAC_PROTO_H */

package/kernel/mac80211/patches/319-v4.12-0021-brcmfmac-move-brcmf_fws_deinit-to-bcdc-layer.patch

@@ -0,0 +1,57 @@
+From 8f9dd1a974380ebe2d7bf82df4e6ba6bfb89c575 Mon Sep 17 00:00:00 2001
+From: Franky Lin <franky.lin@broadcom.com>
+Date: Tue, 28 Mar 2017 11:43:25 +0100
+Subject: [PATCH] brcmfmac: move brcmf_fws_deinit to bcdc layer
+
+Move brcmf_fws_deinit into brcmf_proto_bcdc_detach since it is a bcdc
+exclusive feature.
+
+Signed-off-by: Franky Lin <franky.lin@broadcom.com>
+Reviewed-by: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c | 1 +
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 7 -------
+ 2 files changed, 1 insertion(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -464,6 +464,7 @@ fail:
+ 
+ void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr)
+ {
++	brcmf_fws_deinit(drvr);
+ 	kfree(drvr->proto->pd);
+ 	drvr->proto->pd = NULL;
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -32,7 +32,6 @@
+ #include "p2p.h"
+ #include "cfg80211.h"
+ #include "fwil.h"
+-#include "fwsignal.h"
+ #include "feature.h"
+ #include "proto.h"
+ #include "pcie.h"
+@@ -1044,10 +1043,6 @@ fail:
+ 		brcmf_cfg80211_detach(drvr->config);
+ 		drvr->config = NULL;
+ 	}
+-	if (drvr->fws) {
+-		brcmf_proto_del_if(ifp->drvr, ifp);
+-		brcmf_fws_deinit(drvr);
+-	}
+ 	brcmf_net_detach(ifp->ndev, false);
+ 	if (p2p_ifp)
+ 		brcmf_net_detach(p2p_ifp->ndev, false);
+@@ -1113,8 +1108,6 @@ void brcmf_detach(struct device *dev)
+ 
+ 	brcmf_cfg80211_detach(drvr->config);
+ 
+-	brcmf_fws_deinit(drvr);
+-
+ 	brcmf_bus_stop(drvr->bus_if);
+ 
+ 	brcmf_proto_detach(drvr);

package/kernel/mac80211/patches/319-v4.12-0022-brcmfmac-add-support-to-move-wiphy-instance-into-net.patch

@@ -0,0 +1,88 @@
+From 0cc0236cf713a9ecfcf902e35bd098bc179265a8 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 28 Mar 2017 11:43:26 +0100
+Subject: [PATCH] brcmfmac: add support to move wiphy instance into network
+ namespace
+
+To support network namespace the driver must assure all created
+network interfaces are in the same namespace as the wiphy instance
+and flag the support using WIPHY_FLAG_NETNS_OK.
+
+Verified using two terminals:
+
+ Terminal 1			Terminal 2
+ --------------------------	---------------------------------
+ # ip netns add brcm-wifi	# iw dev
+				phy#0
+					Interface wlan3
+						ifindex 11
+						wdev 0x1
+ # ip netns exec brcm-wifi bash
+ # iw dev
+ # echo $$
+ 20337			# iw phy0 set netns 20337
+ # iw dev
+ phy#0
+	Interface wlan3
+		ifindex 11
+		wdev 0x2
+ # iw phy0 interface add wl3.ap type __ap
+ # iw dev
+ phy#0
+	Interface wl3.ap
+		ifindex 2
+		wdev 0x3
+	Interface wlan3
+		ifindex 11
+		wdev 0x2
+				# iw dev
+ # iw phy0 set netns 1
+ # iw dev
+				# iw dev
+				phy#0
+					Interface wl3.ap
+						ifindex 2
+						wdev 0x5
+					Interface wlan3
+						ifindex 11
+						wdev 0x4
+
+Note:
+	increasing wdev identifier above indicates issue in
+	cfg80211 which is addressed separately.
+
+Tested-by: Mark Asselstine <mark.asselstine@windriver.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 ++-
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c     | 3 ++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6453,7 +6453,8 @@ static int brcmf_setup_wiphy(struct wiph
+ 				    BIT(NL80211_BSS_SELECT_ATTR_BAND_PREF) |
+ 				    BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);
+ 
+-	wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT |
++	wiphy->flags |= WIPHY_FLAG_NETNS_OK |
++			WIPHY_FLAG_PS_ON_BY_DEFAULT |
+ 			WIPHY_FLAG_OFFCHAN_TX |
+ 			WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
+ 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_TDLS))
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -485,8 +485,9 @@ int brcmf_net_attach(struct brcmf_if *if
+ 	ndev->needed_headroom += drvr->hdrlen;
+ 	ndev->ethtool_ops = &brcmf_ethtool_ops;
+ 
+-	/* set the mac address */
++	/* set the mac address & netns */
+ 	memcpy(ndev->dev_addr, ifp->mac_addr, ETH_ALEN);
++	dev_net_set(ndev, wiphy_net(cfg_to_wiphy(drvr->config)));
+ 
+ 	INIT_WORK(&ifp->multicast_work, _brcmf_set_multicast_list);
+ 	INIT_WORK(&ifp->ndoffload_work, _brcmf_update_ndtable);

package/kernel/mac80211/patches/319-v4.12-0024-brcmfmac-no-need-for-d11inf-instance-in-brcmf_pno_st.patch

@@ -0,0 +1,37 @@
+From 78b9ccb81377ba908b2c18daf6e1a7beddc281e3 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 28 Mar 2017 11:43:28 +0100
+Subject: [PATCH] brcmfmac: no need for d11inf instance in
+ brcmf_pno_start_sched_scan()
+
+In brcmf_pno_start_sched_scan() a local variable is declared and
+assigned for struct brcmu_d11inf. However, there is no other reference
+to it so it is unnecessary.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pno.c
+@@ -182,7 +182,6 @@ int brcmf_pno_clean(struct brcmf_if *ifp
+ int brcmf_pno_start_sched_scan(struct brcmf_if *ifp,
+ 			       struct cfg80211_sched_scan_request *req)
+ {
+-	struct brcmu_d11inf *d11inf;
+ 	struct brcmf_pno_config_le pno_cfg;
+ 	struct cfg80211_ssid *ssid;
+ 	u16 chan;
+@@ -209,7 +208,6 @@ int brcmf_pno_start_sched_scan(struct br
+ 	}
+ 
+ 	/* configure channels to use */
+-	d11inf = &ifp->drvr->config->d11inf;
+ 	for (i = 0; i < req->n_channels; i++) {
+ 		chan = req->channels[i]->hw_value;
+ 		pno_cfg.channel_list[i] = cpu_to_le16(chan);

package/kernel/mac80211/patches/319-v4.12-0030-brcmfmac-properly-align-buffers-on-certain-platforms.patch

@@ -22,7 +22,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -539,7 +539,11 @@ static int qcount[NUMPRIO];
+@@ -540,7 +540,11 @@ static int qcount[NUMPRIO];
  /* Limit on rounding up frames */
  static const uint max_roundup = 512;
  

package/kernel/mac80211/patches/319-v4.12-0040-brcmfmac-rename-brcmf_fws_-de-init-to-brcmf_fws-at-d.patch

@@ -0,0 +1,77 @@
+From ffb9f18ad8f0e5e1d88c56478bf24e6464c96eee Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 6 Apr 2017 13:14:37 +0100
+Subject: [PATCH] brcmfmac: rename brcmf_fws_{de,}init to brcmf_fws{at,de}tach
+
+This is a non-functional change to align the fwsignal module to
+the naming pattern used throughout the driver.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c     | 4 ++--
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c | 6 +++---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h | 4 ++--
+ 3 files changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -420,7 +420,7 @@ brcmf_proto_bcdc_reset_if(struct brcmf_i
+ static int
+ brcmf_proto_bcdc_init_done(struct brcmf_pub *drvr)
+ {
+-	return brcmf_fws_init(drvr);
++	return brcmf_fws_attach(drvr);
+ }
+ 
+ int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr)
+@@ -464,7 +464,7 @@ fail:
+ 
+ void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr)
+ {
+-	brcmf_fws_deinit(drvr);
++	brcmf_fws_detach(drvr);
+ 	kfree(drvr->proto->pd);
+ 	drvr->proto->pd = NULL;
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -2308,7 +2308,7 @@ static int brcmf_debugfs_fws_stats_read(
+ }
+ #endif
+ 
+-int brcmf_fws_init(struct brcmf_pub *drvr)
++int brcmf_fws_attach(struct brcmf_pub *drvr)
+ {
+ 	struct brcmf_fws_info *fws;
+ 	struct brcmf_if *ifp;
+@@ -2408,11 +2408,11 @@ int brcmf_fws_init(struct brcmf_pub *drv
+ 	return 0;
+ 
+ fail:
+-	brcmf_fws_deinit(drvr);
++	brcmf_fws_detach(drvr);
+ 	return rc;
+ }
+ 
+-void brcmf_fws_deinit(struct brcmf_pub *drvr)
++void brcmf_fws_detach(struct brcmf_pub *drvr)
+ {
+ 	struct brcmf_fws_info *fws = drvr->fws;
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
+@@ -18,8 +18,8 @@
+ #ifndef FWSIGNAL_H_
+ #define FWSIGNAL_H_
+ 
+-int brcmf_fws_init(struct brcmf_pub *drvr);
+-void brcmf_fws_deinit(struct brcmf_pub *drvr);
++int brcmf_fws_attach(struct brcmf_pub *drvr);
++void brcmf_fws_detach(struct brcmf_pub *drvr);
+ bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws);
+ bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
+ void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb);

package/kernel/mac80211/patches/319-v4.12-0041-brcmfmac-ignore-interfaces-when-fwsignal-is-disabled.patch

@@ -0,0 +1,30 @@
+From fc0471e3e884a13d293afae53917ef8ff33b8ae5 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 6 Apr 2017 13:14:38 +0100
+Subject: [PATCH] brcmfmac: ignore interfaces when fwsignal is disabled
+
+When brcmf_fws_add_interface() is called the struct brcmf_if::fws_desc
+field is initialized regardless the state of the fwsignal functionality,
+ie. the fcmode. This is not needed when fcmode is NONE, which is the
+default mode.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -2145,7 +2145,7 @@ void brcmf_fws_add_interface(struct brcm
+ 	struct brcmf_fws_info *fws = ifp->drvr->fws;
+ 	struct brcmf_fws_mac_descriptor *entry;
+ 
+-	if (!ifp->ndev)
++	if (!ifp->ndev || fws->fcmode == BRCMF_FWS_FCMODE_NONE)
+ 		return;
+ 
+ 	entry = &fws->desc.iface[ifp->ifidx];

package/kernel/mac80211/patches/319-v4.12-0042-brcmfmac-remove-reference-to-fwsignal-data-from-stru.patch

@@ -0,0 +1,313 @@
+From acf8ac41dd733508b9e77483f96e53610c87fa64 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 6 Apr 2017 13:14:39 +0100
+Subject: [PATCH] brcmfmac: remove reference to fwsignal data from struct
+ brcmf_pub
+
+The fwsignal module is part of the bcdc protocol and as such does
+its instance data is not needed in core structure. Moving it into
+struct brcmf_bcdc instead.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/bcdc.c        | 35 ++++++++++---
+ .../broadcom/brcm80211/brcmfmac/bcdc.h        |  1 +
+ .../broadcom/brcm80211/brcmfmac/core.h        |  2 -
+ .../broadcom/brcm80211/brcmfmac/fwsignal.c    | 51 +++++++++----------
+ .../broadcom/brcm80211/brcmfmac/fwsignal.h    |  4 +-
+ 5 files changed, 54 insertions(+), 39 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -103,9 +103,17 @@ struct brcmf_bcdc {
+ 	u8 bus_header[BUS_HEADER_LEN];
+ 	struct brcmf_proto_bcdc_dcmd msg;
+ 	unsigned char buf[BRCMF_DCMD_MAXLEN];
++	struct brcmf_fws_info *fws;
+ };
+ 
+ 
++struct brcmf_fws_info *drvr_to_fws(struct brcmf_pub *drvr)
++{
++	struct brcmf_bcdc *bcdc = drvr->proto->pd;
++
++	return bcdc->fws;
++}
++
+ static int
+ brcmf_proto_bcdc_msg(struct brcmf_pub *drvr, int ifidx, uint cmd, void *buf,
+ 		     uint len, bool set)
+@@ -330,8 +338,9 @@ static int brcmf_proto_bcdc_tx_queue_dat
+ 					  struct sk_buff *skb)
+ {
+ 	struct brcmf_if *ifp = brcmf_get_ifp(drvr, ifidx);
++	struct brcmf_bcdc *bcdc = drvr->proto->pd;
+ 
+-	if (!brcmf_fws_queue_skbs(drvr->fws))
++	if (!brcmf_fws_queue_skbs(bcdc->fws))
+ 		return brcmf_proto_txdata(drvr, ifidx, 0, skb);
+ 
+ 	return brcmf_fws_process_skb(ifp, skb);
+@@ -360,15 +369,15 @@ brcmf_proto_bcdc_txcomplete(struct devic
+ 			    bool success)
+ {
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+-	struct brcmf_pub *drvr = bus_if->drvr;
++	struct brcmf_bcdc *bcdc = bus_if->drvr->proto->pd;
+ 	struct brcmf_if *ifp;
+ 
+ 	/* await txstatus signal for firmware if active */
+-	if (brcmf_fws_fc_active(drvr->fws)) {
++	if (brcmf_fws_fc_active(bcdc->fws)) {
+ 		if (!success)
+-			brcmf_fws_bustxfail(drvr->fws, txp);
++			brcmf_fws_bustxfail(bcdc->fws, txp);
+ 	} else {
+-		if (brcmf_proto_bcdc_hdrpull(drvr, false, txp, &ifp))
++		if (brcmf_proto_bcdc_hdrpull(bus_if->drvr, false, txp, &ifp))
+ 			brcmu_pkt_buf_free_skb(txp);
+ 		else
+ 			brcmf_txfinalize(ifp, txp, success);
+@@ -420,7 +429,15 @@ brcmf_proto_bcdc_reset_if(struct brcmf_i
+ static int
+ brcmf_proto_bcdc_init_done(struct brcmf_pub *drvr)
+ {
+-	return brcmf_fws_attach(drvr);
++	struct brcmf_bcdc *bcdc = drvr->proto->pd;
++	struct brcmf_fws_info *fws;
++
++	fws = brcmf_fws_attach(drvr);
++	if (IS_ERR(fws))
++		return PTR_ERR(fws);
++
++	bcdc->fws = fws;
++	return 0;
+ }
+ 
+ int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr)
+@@ -464,7 +481,9 @@ fail:
+ 
+ void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr)
+ {
+-	brcmf_fws_detach(drvr);
+-	kfree(drvr->proto->pd);
++	struct brcmf_bcdc *bcdc = drvr->proto->pd;
++
+ 	drvr->proto->pd = NULL;
++	brcmf_fws_detach(bcdc->fws);
++	kfree(bcdc);
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
+@@ -22,6 +22,7 @@ void brcmf_proto_bcdc_detach(struct brcm
+ void brcmf_proto_bcdc_txflowblock(struct device *dev, bool state);
+ void brcmf_proto_bcdc_txcomplete(struct device *dev, struct sk_buff *txp,
+ 				 bool success);
++struct brcmf_fws_info *drvr_to_fws(struct brcmf_pub *drvr);
+ #else
+ static inline int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr) { return 0; }
+ static inline void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr) {}
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+@@ -127,8 +127,6 @@ struct brcmf_pub {
+ 
+ 	struct brcmf_fweh_info fweh;
+ 
+-	struct brcmf_fws_info *fws;
+-
+ 	struct brcmf_ampdu_rx_reorder
+ 		*reorder_flows[BRCMF_AMPDU_RX_REORDER_MAXFLOWS];
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -36,6 +36,7 @@
+ #include "p2p.h"
+ #include "cfg80211.h"
+ #include "proto.h"
++#include "bcdc.h"
+ #include "common.h"
+ 
+ /**
+@@ -1586,7 +1587,7 @@ static int brcmf_fws_notify_credit_map(s
+ 				       const struct brcmf_event_msg *e,
+ 				       void *data)
+ {
+-	struct brcmf_fws_info *fws = ifp->drvr->fws;
++	struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
+ 	int i;
+ 	u8 *credits = data;
+ 
+@@ -1617,7 +1618,7 @@ static int brcmf_fws_notify_bcmc_credit_
+ 						const struct brcmf_event_msg *e,
+ 						void *data)
+ {
+-	struct brcmf_fws_info *fws = ifp->drvr->fws;
++	struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
+ 
+ 	if (fws) {
+ 		brcmf_fws_lock(fws);
+@@ -1826,7 +1827,7 @@ netif_rx:
+ void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb)
+ {
+ 	struct brcmf_skb_reorder_data *rd;
+-	struct brcmf_fws_info *fws = ifp->drvr->fws;
++	struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
+ 	u8 *signal_data;
+ 	s16 data_len;
+ 	u8 type;
+@@ -2091,8 +2092,7 @@ static int brcmf_fws_assign_htod(struct
+ 
+ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
+ {
+-	struct brcmf_pub *drvr = ifp->drvr;
+-	struct brcmf_fws_info *fws = drvr->fws;
++	struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
+ 	struct brcmf_skbuff_cb *skcb = brcmf_skbcb(skb);
+ 	struct ethhdr *eh = (struct ethhdr *)(skb->data);
+ 	int fifo = BRCMF_FWS_FIFO_BCMC;
+@@ -2142,7 +2142,7 @@ void brcmf_fws_reset_interface(struct br
+ 
+ void brcmf_fws_add_interface(struct brcmf_if *ifp)
+ {
+-	struct brcmf_fws_info *fws = ifp->drvr->fws;
++	struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
+ 	struct brcmf_fws_mac_descriptor *entry;
+ 
+ 	if (!ifp->ndev || fws->fcmode == BRCMF_FWS_FCMODE_NONE)
+@@ -2160,16 +2160,17 @@ void brcmf_fws_add_interface(struct brcm
+ void brcmf_fws_del_interface(struct brcmf_if *ifp)
+ {
+ 	struct brcmf_fws_mac_descriptor *entry = ifp->fws_desc;
++	struct brcmf_fws_info *fws = drvr_to_fws(ifp->drvr);
+ 
+ 	if (!entry)
+ 		return;
+ 
+-	brcmf_fws_lock(ifp->drvr->fws);
++	brcmf_fws_lock(fws);
+ 	ifp->fws_desc = NULL;
+ 	brcmf_dbg(TRACE, "deleting %s\n", entry->name);
+ 	brcmf_fws_macdesc_deinit(entry);
+-	brcmf_fws_cleanup(ifp->drvr->fws, ifp->ifidx);
+-	brcmf_fws_unlock(ifp->drvr->fws);
++	brcmf_fws_cleanup(fws, ifp->ifidx);
++	brcmf_fws_unlock(fws);
+ }
+ 
+ static void brcmf_fws_dequeue_worker(struct work_struct *worker)
+@@ -2243,7 +2244,7 @@ static void brcmf_fws_dequeue_worker(str
+ static int brcmf_debugfs_fws_stats_read(struct seq_file *seq, void *data)
+ {
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(seq->private);
+-	struct brcmf_fws_stats *fwstats = &bus_if->drvr->fws->stats;
++	struct brcmf_fws_stats *fwstats = &(drvr_to_fws(bus_if->drvr)->stats);
+ 
+ 	seq_printf(seq,
+ 		   "header_pulls:      %u\n"
+@@ -2308,7 +2309,7 @@ static int brcmf_debugfs_fws_stats_read(
+ }
+ #endif
+ 
+-int brcmf_fws_attach(struct brcmf_pub *drvr)
++struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr)
+ {
+ 	struct brcmf_fws_info *fws;
+ 	struct brcmf_if *ifp;
+@@ -2316,17 +2317,15 @@ int brcmf_fws_attach(struct brcmf_pub *d
+ 	int rc;
+ 	u32 mode;
+ 
+-	drvr->fws = kzalloc(sizeof(*(drvr->fws)), GFP_KERNEL);
+-	if (!drvr->fws) {
++	fws = kzalloc(sizeof(*fws), GFP_KERNEL);
++	if (!fws) {
+ 		rc = -ENOMEM;
+ 		goto fail;
+ 	}
+ 
+-	fws = drvr->fws;
+-
+ 	spin_lock_init(&fws->spinlock);
+ 
+-	/* set linkage back */
++	/* store drvr reference */
+ 	fws->drvr = drvr;
+ 	fws->fcmode = drvr->settings->fcmode;
+ 
+@@ -2334,7 +2333,7 @@ int brcmf_fws_attach(struct brcmf_pub *d
+ 	    (fws->fcmode == BRCMF_FWS_FCMODE_NONE)) {
+ 		fws->avoid_queueing = true;
+ 		brcmf_dbg(INFO, "FWS queueing will be avoided\n");
+-		return 0;
++		return fws;
+ 	}
+ 
+ 	fws->fws_wq = create_singlethread_workqueue("brcmf_fws_wq");
+@@ -2396,6 +2395,7 @@ int brcmf_fws_attach(struct brcmf_pub *d
+ 	brcmf_fws_hanger_init(&fws->hanger);
+ 	brcmf_fws_macdesc_init(&fws->desc.other, NULL, 0);
+ 	brcmf_fws_macdesc_set_name(fws, &fws->desc.other);
++	brcmf_dbg(INFO, "added %s\n", fws->desc.other.name);
+ 	brcmu_pktq_init(&fws->desc.other.psq, BRCMF_FWS_PSQ_PREC_COUNT,
+ 			BRCMF_FWS_PSQ_LEN);
+ 
+@@ -2405,27 +2405,24 @@ int brcmf_fws_attach(struct brcmf_pub *d
+ 
+ 	brcmf_dbg(INFO, "%s bdcv2 tlv signaling [%x]\n",
+ 		  fws->fw_signals ? "enabled" : "disabled", tlv);
+-	return 0;
++	return fws;
+ 
+ fail:
+-	brcmf_fws_detach(drvr);
+-	return rc;
++	brcmf_fws_detach(fws);
++	return ERR_PTR(rc);
+ }
+ 
+-void brcmf_fws_detach(struct brcmf_pub *drvr)
++void brcmf_fws_detach(struct brcmf_fws_info *fws)
+ {
+-	struct brcmf_fws_info *fws = drvr->fws;
+-
+ 	if (!fws)
+ 		return;
+ 
+-	if (drvr->fws->fws_wq)
+-		destroy_workqueue(drvr->fws->fws_wq);
++	if (fws->fws_wq)
++		destroy_workqueue(fws->fws_wq);
+ 
+ 	/* cleanup */
+ 	brcmf_fws_lock(fws);
+ 	brcmf_fws_cleanup(fws, -1);
+-	drvr->fws = NULL;
+ 	brcmf_fws_unlock(fws);
+ 
+ 	/* free top structure */
+@@ -2461,7 +2458,7 @@ void brcmf_fws_bustxfail(struct brcmf_fw
+ 
+ void brcmf_fws_bus_blocked(struct brcmf_pub *drvr, bool flow_blocked)
+ {
+-	struct brcmf_fws_info *fws = drvr->fws;
++	struct brcmf_fws_info *fws = drvr_to_fws(drvr);
+ 	struct brcmf_if *ifp;
+ 	int i;
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
+@@ -18,8 +18,8 @@
+ #ifndef FWSIGNAL_H_
+ #define FWSIGNAL_H_
+ 
+-int brcmf_fws_attach(struct brcmf_pub *drvr);
+-void brcmf_fws_detach(struct brcmf_pub *drvr);
++struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr);
++void brcmf_fws_detach(struct brcmf_fws_info *fws);
+ bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws);
+ bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
+ void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb);

package/kernel/mac80211/patches/319-v4.12-0043-brcmfmac-add-length-checks-in-scheduled-scan-result-.patch

@@ -13,7 +13,7 @@ Reviewed-by: Franky Lin <franky.lin@broadcom.com>
 Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 ---
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 13 +++++++++++--
+ .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 13 +++++++++++--
  1 file changed, 11 insertions(+), 2 deletions(-)
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

package/kernel/mac80211/patches/319-v4.12-0045-brcmfmac-only-add-channels-and-ssids-once-in-scan-re.patch

@@ -13,7 +13,7 @@ Reviewed-by: Franky Lin <franky.lin@broadcom.com>
 Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 ---
- .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c  | 20 ++++++++++++++++----
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 20 +++++++++++++++----
  1 file changed, 16 insertions(+), 4 deletions(-)
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

package/kernel/mac80211/patches/319-v4.12-0050-brcmfmac-only-build-fwsignal-module-for-CONFIG_BRCMF.patch

@@ -0,0 +1,36 @@
+From 26ecfe01790381c4caa65ec9cce484c623f092c4 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Fri, 14 Apr 2017 22:27:37 +0100
+Subject: [PATCH] brcmfmac: only build fwsignal module for
+ CONFIG_BRCMFMAC_PROTO_BCDC
+
+The fwsignal module is only referenced by the bcdc module and part of the
+bcdc protocol. So only build it when CONFIG_BRCMFMAC_PROTO_BCDC is selected.
+
+Fixes: acf8ac41dd73 ("brcmfmac: remove reference to fwsignal data from struct brcmf_pub")
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/Makefile | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/Makefile
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/Makefile
+@@ -25,7 +25,6 @@ brcmfmac-objs += \
+ 		chip.o \
+ 		fwil.o \
+ 		fweh.o \
+-		fwsignal.o \
+ 		p2p.o \
+ 		proto.o \
+ 		common.o \
+@@ -36,7 +35,8 @@ brcmfmac-objs += \
+ 		vendor.o \
+ 		pno.o
+ brcmfmac-$(CPTCFG_BRCMFMAC_PROTO_BCDC) += \
+-		bcdc.o
++		bcdc.o \
++		fwsignal.o
+ brcmfmac-$(CPTCFG_BRCMFMAC_PROTO_MSGBUF) += \
+ 		commonring.o \
+ 		flowring.o \

package/kernel/mac80211/patches/319-v4.12-0051-brcmfmac-Ensure-pointer-correctly-set-if-skb-data-lo.patch

@@ -19,7 +19,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -198,7 +198,7 @@ static netdev_tx_t brcmf_netdev_start_xm
+@@ -197,7 +197,7 @@ static netdev_tx_t brcmf_netdev_start_xm
  	int ret;
  	struct brcmf_if *ifp = netdev_priv(ndev);
  	struct brcmf_pub *drvr = ifp->drvr;
@@ -28,7 +28,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  	brcmf_dbg(DATA, "Enter, bsscfgidx=%d\n", ifp->bsscfgidx);
  
-@@ -236,6 +236,8 @@ static netdev_tx_t brcmf_netdev_start_xm
+@@ -235,6 +235,8 @@ static netdev_tx_t brcmf_netdev_start_xm
  		goto done;
  	}
  

package/kernel/mac80211/patches/319-v4.12-0052-brcmfmac-Make-skb-header-writable-before-use.patch

@@ -18,7 +18,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -211,22 +211,13 @@ static netdev_tx_t brcmf_netdev_start_xm
+@@ -210,22 +210,13 @@ static netdev_tx_t brcmf_netdev_start_xm
  		goto done;
  	}
  

package/kernel/mac80211/patches/319-v4.12-0053-brcmfmac-fix-alignment-configuration-on-host-using-6.patch

@@ -29,7 +29,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -3420,7 +3420,7 @@ static int brcmf_sdio_bus_preinit(struct
+@@ -3422,7 +3422,7 @@ static int brcmf_sdio_bus_preinit(struct
  		/* otherwise, set txglomalign */
  		value = sdiodev->settings->bus.sdio.sd_sgentry_align;
  		/* SDIO ADMA requires at least 32 bit alignment */

package/kernel/mac80211/patches/323-v4.13-0003-brcmfmac-Use-separate-firmware-for-revision-0-of-the.patch

@@ -22,7 +22,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -611,7 +611,9 @@ BRCMF_FW_NVRAM_DEF(43340, "brcmfmac43340
+@@ -612,7 +612,9 @@ BRCMF_FW_NVRAM_DEF(43340, "brcmfmac43340
  BRCMF_FW_NVRAM_DEF(4335, "brcmfmac4335-sdio.bin", "brcmfmac4335-sdio.txt");
  BRCMF_FW_NVRAM_DEF(43362, "brcmfmac43362-sdio.bin", "brcmfmac43362-sdio.txt");
  BRCMF_FW_NVRAM_DEF(4339, "brcmfmac4339-sdio.bin", "brcmfmac4339-sdio.txt");
@@ -33,7 +33,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  BRCMF_FW_NVRAM_DEF(43455, "brcmfmac43455-sdio.bin", "brcmfmac43455-sdio.txt");
  BRCMF_FW_NVRAM_DEF(4354, "brcmfmac4354-sdio.bin", "brcmfmac4354-sdio.txt");
  BRCMF_FW_NVRAM_DEF(4356, "brcmfmac4356-sdio.bin", "brcmfmac4356-sdio.txt");
-@@ -629,7 +631,8 @@ static struct brcmf_firmware_mapping brc
+@@ -630,7 +632,8 @@ static struct brcmf_firmware_mapping brc
  	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, 4335),
  	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, 43362),
  	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, 4339),

package/kernel/mac80211/patches/323-v4.13-0005-brcmfmac-Fix-a-memory-leak-in-error-handling-path-in.patch

@@ -17,7 +17,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6842,7 +6842,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+@@ -6843,7 +6843,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
  	wiphy = wiphy_new(ops, sizeof(struct brcmf_cfg80211_info));
  	if (!wiphy) {
  		brcmf_err("Could not allocate wiphy device\n");
@@ -26,7 +26,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	}
  	memcpy(wiphy->perm_addr, drvr->mac, ETH_ALEN);
  	set_wiphy_dev(wiphy, busdev);
-@@ -6985,6 +6985,7 @@ priv_out:
+@@ -6986,6 +6986,7 @@ priv_out:
  	ifp->vif = NULL;
  wiphy_out:
  	brcmf_free_wiphy(wiphy);

package/kernel/mac80211/patches/326-v4.14-0001-brcmfmac-Add-support-for-CYW4373-SDIO-USB-chipset.patch

@@ -42,7 +42,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		break;
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -617,6 +617,7 @@ BRCMF_FW_NVRAM_DEF(43430A1, "brcmfmac434
+@@ -618,6 +618,7 @@ BRCMF_FW_NVRAM_DEF(43430A1, "brcmfmac434
  BRCMF_FW_NVRAM_DEF(43455, "brcmfmac43455-sdio.bin", "brcmfmac43455-sdio.txt");
  BRCMF_FW_NVRAM_DEF(4354, "brcmfmac4354-sdio.bin", "brcmfmac4354-sdio.txt");
  BRCMF_FW_NVRAM_DEF(4356, "brcmfmac4356-sdio.bin", "brcmfmac4356-sdio.txt");
@@ -50,7 +50,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  static struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = {
  	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
-@@ -635,7 +636,8 @@ static struct brcmf_firmware_mapping brc
+@@ -636,7 +637,8 @@ static struct brcmf_firmware_mapping brc
  	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43430_CHIP_ID, 0xFFFFFFFE, 43430A1),
  	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4345_CHIP_ID, 0xFFFFFFC0, 43455),
  	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, 4354),
@@ -62,7 +62,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  static void pkt_align(struct sk_buff *p, int len, int align)
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -49,6 +49,7 @@ BRCMF_FW_DEF(43143, "brcmfmac43143.bin")
+@@ -50,6 +50,7 @@ BRCMF_FW_DEF(43143, "brcmfmac43143.bin")
  BRCMF_FW_DEF(43236B, "brcmfmac43236b.bin");
  BRCMF_FW_DEF(43242A, "brcmfmac43242a.bin");
  BRCMF_FW_DEF(43569, "brcmfmac43569.bin");
@@ -70,7 +70,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  static struct brcmf_firmware_mapping brcmf_usb_fwnames[] = {
  	BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143),
-@@ -57,7 +58,8 @@ static struct brcmf_firmware_mapping brc
+@@ -58,7 +59,8 @@ static struct brcmf_firmware_mapping brc
  	BRCMF_FW_ENTRY(BRCM_CC_43238_CHIP_ID, 0x00000008, 43236B),
  	BRCMF_FW_ENTRY(BRCM_CC_43242_CHIP_ID, 0xFFFFFFFF, 43242A),
  	BRCMF_FW_ENTRY(BRCM_CC_43566_CHIP_ID, 0xFFFFFFFF, 43569),
@@ -80,7 +80,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  };
  
  #define TRX_MAGIC		0x30524448	/* "HDR0" */
-@@ -1461,15 +1463,20 @@ static int brcmf_usb_reset_resume(struct
+@@ -1462,15 +1464,20 @@ static int brcmf_usb_reset_resume(struct
  #define LINKSYS_USB_DEVICE(dev_id)	\
  	{ USB_DEVICE(BRCM_USB_VENDOR_ID_LINKSYS, dev_id) }
  

package/kernel/mac80211/patches/328-v4.15-0002-brcmfmac-handle-FWHALT-mailbox-indication.patch

@@ -23,7 +23,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -259,10 +259,11 @@ struct rte_console {
+@@ -260,10 +260,11 @@ struct rte_console {
  #define I_HMB_HOST_INT	I_HMB_SW3	/* Miscellaneous Interrupt */
  
  /* tohostmailboxdata */
@@ -39,7 +39,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  #define HMB_DATA_FCDATA_MASK	0xff000000
  #define HMB_DATA_FCDATA_SHIFT	24
-@@ -1093,6 +1094,10 @@ static u32 brcmf_sdio_hostmail(struct br
+@@ -1094,6 +1095,10 @@ static u32 brcmf_sdio_hostmail(struct br
  			  offsetof(struct sdpcmd_regs, tosbmailbox));
  	bus->sdcnt.f1regdata += 2;
  
@@ -50,7 +50,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	/* Dongle recomposed rx frames, accept them again */
  	if (hmb_data & HMB_DATA_NAKHANDLED) {
  		brcmf_dbg(SDIO, "Dongle reports NAK handled, expect rtx of %d\n",
-@@ -1150,6 +1155,7 @@ static u32 brcmf_sdio_hostmail(struct br
+@@ -1151,6 +1156,7 @@ static u32 brcmf_sdio_hostmail(struct br
  			 HMB_DATA_NAKHANDLED |
  			 HMB_DATA_FC |
  			 HMB_DATA_FWREADY |

package/kernel/mac80211/patches/329-v4.16-0002-brcmfmac-drop-Inter-Access-Point-Protocol-packets-by.patch

@@ -77,7 +77,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	union {
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -192,6 +192,37 @@ static void brcmf_netdev_set_multicast_l
+@@ -191,6 +191,37 @@ static void brcmf_netdev_set_multicast_l
  	schedule_work(&ifp->multicast_work);
  }
  
@@ -115,7 +115,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
  					   struct net_device *ndev)
  {
-@@ -211,6 +242,23 @@ static netdev_tx_t brcmf_netdev_start_xm
+@@ -210,6 +241,23 @@ static netdev_tx_t brcmf_netdev_start_xm
  		goto done;
  	}
  
@@ -139,7 +139,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	/* Make sure there's enough writable headroom*/
  	ret = skb_cow_head(skb, drvr->hdrlen);
  	if (ret < 0) {
-@@ -288,6 +336,15 @@ void brcmf_txflowblock(struct device *de
+@@ -277,6 +325,15 @@ void brcmf_txflowblock_if(struct brcmf_i
  
  void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb)
  {

package/kernel/mac80211/patches/329-v4.16-0003-brcmfmac-Fix-check-for-ISO3166-code.patch

@@ -18,7 +18,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6775,7 +6775,7 @@ static void brcmf_cfg80211_reg_notifier(
+@@ -6776,7 +6776,7 @@ static void brcmf_cfg80211_reg_notifier(
  		return;
  
  	/* ignore non-ISO3166 country codes */

package/kernel/mac80211/patches/329-v4.17-0001-brcmfmac-move-brcmf_bus_preinit-call-just-after-chan.patch

@@ -0,0 +1,45 @@
+From da472385a29f1fddcac7cfa0499482704310bd16 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 20 Feb 2018 00:14:18 +0100
+Subject: [PATCH] brcmfmac: move brcmf_bus_preinit() call just after changing
+ bus state
+
+Moving the brcmf_bus_preinit() call allows the bus code to do some
+required initialization before handling firmware control messages.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 3 ---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c   | 5 +++++
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -215,9 +215,6 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 
+ 	/* Enable tx beamforming, errors can be ignored (not supported) */
+ 	(void)brcmf_fil_iovar_int_set(ifp, "txbf", 1);
+-
+-	/* do bus specific preinit here */
+-	err = brcmf_bus_preinit(ifp->drvr->bus_if);
+ done:
+ 	return err;
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1030,6 +1030,11 @@ int brcmf_bus_started(struct device *dev
+ 	/* signal bus ready */
+ 	brcmf_bus_change_state(bus_if, BRCMF_BUS_UP);
+ 
++	/* do bus specific preinit here */
++	ret = brcmf_bus_preinit(ifp->drvr->bus_if);
++	if (ret < 0)
++		goto fail;
++
+ 	/* Bus is ready, do any initialization */
+ 	ret = brcmf_c_preinit_dcmds(ifp);
+ 	if (ret < 0)

package/kernel/mac80211/patches/329-v4.17-0002-brcmfmac-move-brcmf_attach-function-in-core.c.patch

@@ -0,0 +1,130 @@
+From 0542503c4c164c65cd1567b0f2b3f887af6c81eb Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 20 Feb 2018 00:14:22 +0100
+Subject: [PATCH] brcmfmac: move brcmf_attach() function in core.c
+
+Moving the function in preparation of subsequent patch.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 98 +++++++++++-----------
+ 1 file changed, 49 insertions(+), 49 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -933,55 +933,6 @@ static int brcmf_inet6addr_changed(struc
+ }
+ #endif
+ 
+-int brcmf_attach(struct device *dev, struct brcmf_mp_device *settings)
+-{
+-	struct brcmf_pub *drvr = NULL;
+-	int ret = 0;
+-	int i;
+-
+-	brcmf_dbg(TRACE, "Enter\n");
+-
+-	/* Allocate primary brcmf_info */
+-	drvr = kzalloc(sizeof(struct brcmf_pub), GFP_ATOMIC);
+-	if (!drvr)
+-		return -ENOMEM;
+-
+-	for (i = 0; i < ARRAY_SIZE(drvr->if2bss); i++)
+-		drvr->if2bss[i] = BRCMF_BSSIDX_INVALID;
+-
+-	mutex_init(&drvr->proto_block);
+-
+-	/* Link to bus module */
+-	drvr->hdrlen = 0;
+-	drvr->bus_if = dev_get_drvdata(dev);
+-	drvr->bus_if->drvr = drvr;
+-	drvr->settings = settings;
+-
+-	/* attach debug facilities */
+-	brcmf_debug_attach(drvr);
+-
+-	/* Attach and link in the protocol */
+-	ret = brcmf_proto_attach(drvr);
+-	if (ret != 0) {
+-		brcmf_err("brcmf_prot_attach failed\n");
+-		goto fail;
+-	}
+-
+-	/* Attach to events important for core code */
+-	brcmf_fweh_register(drvr, BRCMF_E_PSM_WATCHDOG,
+-			    brcmf_psm_watchdog_notify);
+-
+-	/* attach firmware event handler */
+-	brcmf_fweh_attach(drvr);
+-
+-	return ret;
+-
+-fail:
+-	brcmf_detach(dev);
+-
+-	return ret;
+-}
+-
+ static int brcmf_revinfo_read(struct seq_file *s, void *data)
+ {
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(s->private);
+@@ -1109,6 +1060,55 @@ fail:
+ 
+ 	return ret;
+ }
++
++int brcmf_attach(struct device *dev, struct brcmf_mp_device *settings)
++{
++	struct brcmf_pub *drvr = NULL;
++	int ret = 0;
++	int i;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	/* Allocate primary brcmf_info */
++	drvr = kzalloc(sizeof(*drvr), GFP_ATOMIC);
++	if (!drvr)
++		return -ENOMEM;
++
++	for (i = 0; i < ARRAY_SIZE(drvr->if2bss); i++)
++		drvr->if2bss[i] = BRCMF_BSSIDX_INVALID;
++
++	mutex_init(&drvr->proto_block);
++
++	/* Link to bus module */
++	drvr->hdrlen = 0;
++	drvr->bus_if = dev_get_drvdata(dev);
++	drvr->bus_if->drvr = drvr;
++	drvr->settings = settings;
++
++	/* attach debug facilities */
++	brcmf_debug_attach(drvr);
++
++	/* Attach and link in the protocol */
++	ret = brcmf_proto_attach(drvr);
++	if (ret != 0) {
++		brcmf_err("brcmf_prot_attach failed\n");
++		goto fail;
++	}
++
++	/* Attach to events important for core code */
++	brcmf_fweh_register(drvr, BRCMF_E_PSM_WATCHDOG,
++			    brcmf_psm_watchdog_notify);
++
++	/* attach firmware event handler */
++	brcmf_fweh_attach(drvr);
++
++	return ret;
++
++fail:
++	brcmf_detach(dev);
++
++	return ret;
++}
+ 
+ void brcmf_bus_add_txhdrlen(struct device *dev, uint len)
+ {

package/kernel/mac80211/patches/329-v4.17-0004-brcmfmac-allocate-struct-brcmf_pub-instance-using-wi.patch

@@ -0,0 +1,451 @@
+From 856d5a011c86b59f6564be4508912fb1d866adfc Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 22 Mar 2018 21:28:23 +0100
+Subject: [PATCH] brcmfmac: allocate struct brcmf_pub instance using
+ wiphy_new()
+
+Rework the driver so the wiphy instance holds the main driver information
+in its private buffer. Previously it held struct brcmf_cfg80211_info
+instance so a bit of reorg was needed. This was done so that the wiphy
+name or its parent device can be shown in debug output.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/btcoex.c  |  2 +-
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c         | 86 ++++++++++------------
+ .../broadcom/brcm80211/brcmfmac/cfg80211.h         | 17 +++--
+ .../wireless/broadcom/brcm80211/brcmfmac/common.c  |  2 +
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c    | 27 +++++--
+ .../wireless/broadcom/brcm80211/brcmfmac/core.h    |  1 +
+ .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c |  2 +-
+ 7 files changed, 76 insertions(+), 61 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/btcoex.c
+@@ -464,7 +464,7 @@ static void brcmf_btcoex_dhcp_end(struct
+ int brcmf_btcoex_set_mode(struct brcmf_cfg80211_vif *vif,
+ 			  enum brcmf_btcoex_mode mode, u16 duration)
+ {
+-	struct brcmf_cfg80211_info *cfg = wiphy_priv(vif->wdev.wiphy);
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
+ 	struct brcmf_btcoex_info *btci = cfg->btcoex;
+ 	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -783,7 +783,7 @@ s32 brcmf_notify_escan_complete(struct b
+ static int brcmf_cfg80211_del_ap_iface(struct wiphy *wiphy,
+ 				       struct wireless_dev *wdev)
+ {
+-	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct net_device *ndev = wdev->netdev;
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+ 	int ret;
+@@ -816,7 +816,7 @@ err_unarm:
+ static
+ int brcmf_cfg80211_del_iface(struct wiphy *wiphy, struct wireless_dev *wdev)
+ {
+-	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct net_device *ndev = wdev->netdev;
+ 
+ 	if (ndev && ndev == cfg_to_ndev(cfg))
+@@ -861,7 +861,7 @@ brcmf_cfg80211_change_iface(struct wiphy
+ 			 enum nl80211_iftype type, u32 *flags,
+ 			 struct vif_params *params)
+ {
+-	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+ 	struct brcmf_cfg80211_vif *vif = ifp->vif;
+ 	s32 infra = 0;
+@@ -2175,17 +2175,15 @@ static s32
+ brcmf_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
+ 			    s32 *dbm)
+ {
+-	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+-	struct net_device *ndev = cfg_to_ndev(cfg);
+-	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_cfg80211_vif *vif = wdev_to_vif(wdev);
+ 	s32 qdbm = 0;
+ 	s32 err;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+-	if (!check_vif_up(ifp->vif))
++	if (!check_vif_up(vif))
+ 		return -EIO;
+ 
+-	err = brcmf_fil_iovar_int_get(ifp, "qtxpower", &qdbm);
++	err = brcmf_fil_iovar_int_get(vif->ifp, "qtxpower", &qdbm);
+ 	if (err) {
+ 		brcmf_err("error (%d)\n", err);
+ 		goto done;
+@@ -3398,7 +3396,7 @@ brcmf_cfg80211_sched_scan_start(struct w
+ 				struct cfg80211_sched_scan_request *req)
+ {
+ 	struct brcmf_if *ifp = netdev_priv(ndev);
+-	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 
+ 	brcmf_dbg(SCAN, "Enter n_match_sets:%d n_ssids:%d\n",
+ 		  req->n_match_sets, req->n_ssids);
+@@ -5192,6 +5190,12 @@ static struct cfg80211_ops brcmf_cfg8021
+ 	.update_connect_params = brcmf_cfg80211_update_conn_params,
+ };
+ 
++struct cfg80211_ops *brcmf_cfg80211_get_ops(void)
++{
++	return kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
++		       GFP_KERNEL);
++}
++
+ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
+ 					   enum nl80211_iftype type)
+ {
+@@ -5866,7 +5870,7 @@ static void brcmf_update_bw40_channel_fl
+ static int brcmf_construct_chaninfo(struct brcmf_cfg80211_info *cfg,
+ 				    u32 bw_cap[])
+ {
+-	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
++	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
+ 	struct ieee80211_supported_band *band;
+ 	struct ieee80211_channel *channel;
+ 	struct wiphy *wiphy;
+@@ -5981,7 +5985,7 @@ fail_pbuf:
+ 
+ static int brcmf_enable_bw40_2g(struct brcmf_cfg80211_info *cfg)
+ {
+-	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
++	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
+ 	struct ieee80211_supported_band *band;
+ 	struct brcmf_fil_bwcap_le band_bwcap;
+ 	struct brcmf_chanspec_list *list;
+@@ -6166,10 +6170,10 @@ static void brcmf_update_vht_cap(struct
+ 	}
+ }
+ 
+-static int brcmf_setup_wiphybands(struct wiphy *wiphy)
++static int brcmf_setup_wiphybands(struct brcmf_cfg80211_info *cfg)
+ {
+-	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
+-	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
++	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
++	struct wiphy *wiphy;
+ 	u32 nmode = 0;
+ 	u32 vhtmode = 0;
+ 	u32 bw_cap[2] = { WLC_BW_20MHZ_BIT, WLC_BW_20MHZ_BIT };
+@@ -6765,8 +6769,8 @@ static s32 brcmf_translate_country_code(
+ static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
+ 					struct regulatory_request *req)
+ {
+-	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
+-	struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
++	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
+ 	struct brcmf_fil_country_le ccreq;
+ 	s32 err;
+ 	int i;
+@@ -6801,7 +6805,7 @@ static void brcmf_cfg80211_reg_notifier(
+ 		brcmf_err("Firmware rejected country setting\n");
+ 		return;
+ 	}
+-	brcmf_setup_wiphybands(wiphy);
++	brcmf_setup_wiphybands(cfg);
+ }
+ 
+ static void brcmf_free_wiphy(struct wiphy *wiphy)
+@@ -6828,17 +6832,15 @@ static void brcmf_free_wiphy(struct wiph
+ 	if (wiphy->wowlan != &brcmf_wowlan_support)
+ 		kfree(wiphy->wowlan);
+ #endif
+-	wiphy_free(wiphy);
+ }
+ 
+ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
+-						  struct device *busdev,
++						  struct cfg80211_ops *ops,
+ 						  bool p2pdev_forced)
+ {
++	struct wiphy *wiphy = drvr->wiphy;
+ 	struct net_device *ndev = brcmf_get_ifp(drvr, 0)->ndev;
+ 	struct brcmf_cfg80211_info *cfg;
+-	struct wiphy *wiphy;
+-	struct cfg80211_ops *ops;
+ 	struct brcmf_cfg80211_vif *vif;
+ 	struct brcmf_if *ifp;
+ 	s32 err = 0;
+@@ -6850,26 +6852,13 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 		return NULL;
+ 	}
+ 
+-	ops = kmemdup(&brcmf_cfg80211_ops, sizeof(*ops), GFP_KERNEL);
+-	if (!ops)
+-		return NULL;
+-
+-	ifp = netdev_priv(ndev);
+-#ifdef CONFIG_PM
+-	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
+-		ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
+-#endif
+-	wiphy = wiphy_new(ops, sizeof(struct brcmf_cfg80211_info));
+-	if (!wiphy) {
++	cfg = kzalloc(sizeof(*cfg), GFP_KERNEL);
++	if (!cfg) {
+ 		brcmf_err("Could not allocate wiphy device\n");
+-		goto ops_out;
++		return NULL;
+ 	}
+-	memcpy(wiphy->perm_addr, drvr->mac, ETH_ALEN);
+-	set_wiphy_dev(wiphy, busdev);
+ 
+-	cfg = wiphy_priv(wiphy);
+ 	cfg->wiphy = wiphy;
+-	cfg->ops = ops;
+ 	cfg->pub = drvr;
+ 	init_vif_event(&cfg->vif_event);
+ 	INIT_LIST_HEAD(&cfg->vif_list);
+@@ -6878,6 +6867,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 	if (IS_ERR(vif))
+ 		goto wiphy_out;
+ 
++	ifp = netdev_priv(ndev);
+ 	vif->ifp = ifp;
+ 	vif->wdev.netdev = ndev;
+ 	ndev->ieee80211_ptr = &vif->wdev;
+@@ -6904,6 +6894,11 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 	if (err < 0)
+ 		goto priv_out;
+ 
++	/* regulatory notifer below needs access to cfg so
++	 * assign it now.
++	 */
++	drvr->config = cfg;
++
+ 	brcmf_dbg(INFO, "Registering custom regulatory\n");
+ 	wiphy->reg_notifier = brcmf_cfg80211_reg_notifier;
+ 	wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
+@@ -6917,13 +6912,17 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 		cap = &wiphy->bands[NL80211_BAND_2GHZ]->ht_cap.cap;
+ 		*cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+ 	}
++#ifdef CONFIG_PM
++	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
++		ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
++#endif
+ 	err = wiphy_register(wiphy);
+ 	if (err < 0) {
+ 		brcmf_err("Could not register wiphy device (%d)\n", err);
+ 		goto priv_out;
+ 	}
+ 
+-	err = brcmf_setup_wiphybands(wiphy);
++	err = brcmf_setup_wiphybands(cfg);
+ 	if (err) {
+ 		brcmf_err("Setting wiphy bands failed (%d)\n", err);
+ 		goto wiphy_unreg_out;
+@@ -6940,12 +6939,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ 		else
+ 			*cap &= ~IEEE80211_HT_CAP_SUP_WIDTH_20_40;
+ 	}
+-	/* p2p might require that "if-events" get processed by fweh. So
+-	 * activate the already registered event handlers now and activate
+-	 * the rest when initialization has completed. drvr->config needs to
+-	 * be assigned before activating events.
+-	 */
+-	drvr->config = cfg;
++
+ 	err = brcmf_fweh_activate_events(ifp);
+ 	if (err) {
+ 		brcmf_err("FWEH activation failed (%d)\n", err);
+@@ -7005,8 +6999,7 @@ priv_out:
+ 	ifp->vif = NULL;
+ wiphy_out:
+ 	brcmf_free_wiphy(wiphy);
+-ops_out:
+-	kfree(ops);
++	kfree(cfg);
+ 	return NULL;
+ }
+ 
+@@ -7017,7 +7010,8 @@ void brcmf_cfg80211_detach(struct brcmf_
+ 
+ 	brcmf_btcoex_detach(cfg);
+ 	wiphy_unregister(cfg->wiphy);
+-	kfree(cfg->ops);
++	kfree(cfg->pub->cfg80211_ops);
+ 	wl_deinit_priv(cfg);
+ 	brcmf_free_wiphy(cfg->wiphy);
++	kfree(cfg);
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+@@ -290,7 +290,7 @@ struct brcmf_cfg80211_wowl {
+  */
+ struct brcmf_cfg80211_info {
+ 	struct wiphy *wiphy;
+-	struct cfg80211_ops *ops;
++//	struct cfg80211_ops *ops;	/* OpenWrt keeps it in the struct brcmf_pub */
+ 	struct brcmf_cfg80211_conf *conf;
+ 	struct brcmf_p2p_info p2p;
+ 	struct brcmf_btcoex_info *btcoex;
+@@ -342,20 +342,24 @@ static inline struct wiphy *cfg_to_wiphy
+ 
+ static inline struct brcmf_cfg80211_info *wiphy_to_cfg(struct wiphy *w)
+ {
+-	return (struct brcmf_cfg80211_info *)(wiphy_priv(w));
++	struct brcmf_pub *drvr = wiphy_priv(w);
++	return drvr->config;
+ }
+ 
+ static inline struct brcmf_cfg80211_info *wdev_to_cfg(struct wireless_dev *wd)
+ {
+-	return (struct brcmf_cfg80211_info *)(wdev_priv(wd));
++	return wiphy_to_cfg(wd->wiphy);
++}
++
++static inline struct brcmf_cfg80211_vif *wdev_to_vif(struct wireless_dev *wdev)
++{
++	return container_of(wdev, struct brcmf_cfg80211_vif, wdev);
+ }
+ 
+ static inline
+ struct net_device *cfg_to_ndev(struct brcmf_cfg80211_info *cfg)
+ {
+-	struct brcmf_cfg80211_vif *vif;
+-	vif = list_first_entry(&cfg->vif_list, struct brcmf_cfg80211_vif, list);
+-	return vif->wdev.netdev;
++	return brcmf_get_ifp(cfg->pub, 0)->ndev;
+ }
+ 
+ static inline struct brcmf_cfg80211_info *ndev_to_cfg(struct net_device *ndev)
+@@ -382,11 +386,12 @@ brcmf_cfg80211_connect_info *cfg_to_conn
+ }
+ 
+ struct brcmf_cfg80211_info *brcmf_cfg80211_attach(struct brcmf_pub *drvr,
+-						  struct device *busdev,
++						  struct cfg80211_ops *ops,
+ 						  bool p2pdev_forced);
+ void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg);
+ s32 brcmf_cfg80211_up(struct net_device *ndev);
+ s32 brcmf_cfg80211_down(struct net_device *ndev);
++struct cfg80211_ops *brcmf_cfg80211_get_ops(void);
+ enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp);
+ 
+ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -124,6 +124,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 		brcmf_err("Retreiving cur_etheraddr failed, %d\n", err);
+ 		goto done;
+ 	}
++	memcpy(ifp->drvr->wiphy->perm_addr, ifp->drvr->mac, ETH_ALEN);
+ 	memcpy(ifp->drvr->mac, ifp->mac_addr, sizeof(ifp->drvr->mac));
+ 
+ 	err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_REVINFO,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1008,7 +1008,7 @@ int brcmf_bus_started(struct device *dev
+ 
+ 	brcmf_proto_add_if(drvr, ifp);
+ 
+-	drvr->config = brcmf_cfg80211_attach(drvr, bus_if->dev,
++	drvr->config = brcmf_cfg80211_attach(drvr, drvr->cfg80211_ops,
+ 					     drvr->settings->p2p_enable);
+ 	if (drvr->config == NULL) {
+ 		ret = -ENOMEM;
+@@ -1063,17 +1063,26 @@ fail:
+ 
+ int brcmf_attach(struct device *dev, struct brcmf_mp_device *settings)
+ {
++	struct wiphy *wiphy;
++	struct cfg80211_ops *ops;
+ 	struct brcmf_pub *drvr = NULL;
+ 	int ret = 0;
+ 	int i;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+-	/* Allocate primary brcmf_info */
+-	drvr = kzalloc(sizeof(*drvr), GFP_ATOMIC);
+-	if (!drvr)
++	ops = brcmf_cfg80211_get_ops();
++	if (!ops)
+ 		return -ENOMEM;
+ 
++	wiphy = wiphy_new(ops, sizeof(*drvr));
++	if (!wiphy)
++		return -ENOMEM;
++
++	set_wiphy_dev(wiphy, dev);
++	drvr = wiphy_priv(wiphy);
++	drvr->wiphy = wiphy;
++
+ 	for (i = 0; i < ARRAY_SIZE(drvr->if2bss); i++)
+ 		drvr->if2bss[i] = BRCMF_BSSIDX_INVALID;
+ 
+@@ -1102,10 +1111,12 @@ int brcmf_attach(struct device *dev, str
+ 	/* attach firmware event handler */
+ 	brcmf_fweh_attach(drvr);
+ 
++	drvr->cfg80211_ops = ops;
+ 	return ret;
+ 
+ fail:
+ 	brcmf_detach(dev);
++	kfree(ops);
+ 
+ 	return ret;
+ }
+@@ -1163,6 +1174,7 @@ void brcmf_detach(struct device *dev)
+ 		brcmf_remove_interface(drvr->iflist[i], false);
+ 
+ 	brcmf_cfg80211_detach(drvr->config);
++	drvr->config = NULL;
+ 
+ 	brcmf_bus_stop(drvr->bus_if);
+ 
+@@ -1170,7 +1182,7 @@ void brcmf_detach(struct device *dev)
+ 
+ 	brcmf_debug_detach(drvr);
+ 	bus_if->drvr = NULL;
+-	kfree(drvr);
++	wiphy_free(drvr->wiphy);
+ }
+ 
+ s32 brcmf_iovar_data_set(struct device *dev, char *name, void *data, u32 len)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+@@ -108,6 +108,7 @@ struct brcmf_pub {
+ 	/* Linkage ponters */
+ 	struct brcmf_bus *bus_if;
+ 	struct brcmf_proto *proto;
++	struct wiphy *wiphy;
+ 	struct brcmf_cfg80211_info *config;
+ 
+ 	/* Internal brcmf items */
+@@ -141,6 +142,9 @@ struct brcmf_pub {
+ 	struct notifier_block inetaddr_notifier;
+ 	struct notifier_block inet6addr_notifier;
+ 	struct brcmf_mp_device *settings;
++
++	/* Pointer needed by OpenWrt due to backporting some fixes */
++	void *cfg80211_ops;
+ };
+ 
+ /* forward declarations */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -2236,7 +2236,7 @@ fail:
+  */
+ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
+ {
+-	struct brcmf_cfg80211_info *cfg = wiphy_priv(wiphy);
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct brcmf_p2p_info *p2p = &cfg->p2p;
+ 	struct brcmf_cfg80211_vif *vif;
+ 	enum nl80211_iftype iftype;

package/kernel/mac80211/patches/331-v4.18-0004-brcmfmac-set-WIPHY_FLAG_HAVE_AP_SME-flag.patch

@@ -24,10 +24,10 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6485,6 +6485,7 @@ static int brcmf_setup_wiphy(struct wiph
- 				    BIT(NL80211_BSS_SELECT_ATTR_RSSI_ADJUST);
+@@ -6490,6 +6490,7 @@ static int brcmf_setup_wiphy(struct wiph
  
- 	wiphy->flags |= WIPHY_FLAG_PS_ON_BY_DEFAULT |
+ 	wiphy->flags |= WIPHY_FLAG_NETNS_OK |
+ 			WIPHY_FLAG_PS_ON_BY_DEFAULT |
 +			WIPHY_FLAG_HAVE_AP_SME |
  			WIPHY_FLAG_OFFCHAN_TX |
  			WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;

package/kernel/mac80211/patches/331-v4.18-0006-brcmfmac-add-support-for-sysfs-initiated-coredump.patch

@@ -34,18 +34,18 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
-@@ -231,6 +231,8 @@ void brcmf_detach(struct device *dev);
+@@ -229,6 +229,8 @@ int brcmf_attach(struct device *dev, str
+ void brcmf_detach(struct device *dev);
+ /* Indication from bus module that dongle should be reset */
  void brcmf_dev_reset(struct device *dev);
- /* Indication from bus module to change flow-control state */
- void brcmf_txflowblock(struct device *dev, bool state);
 +/* Request from bus module to initiate a coredump */
 +void brcmf_dev_coredump(struct device *dev);
  
- /* Notify the bus has transferred the tx packet to firmware */
- void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success);
+ /* Configure the "global" bus state used by upper layers */
+ void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state);
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1159,6 +1159,14 @@ void brcmf_dev_reset(struct device *dev)
+@@ -1143,6 +1143,14 @@ void brcmf_dev_reset(struct device *dev)
  		brcmf_fil_cmd_int_set(drvr->iflist[0], BRCMF_C_TERMINATED, 1);
  }
  

package/kernel/mac80211/patches/331-v4.18-0009-brcmfmac-trigger-memory-dump-on-SDIO-firmware-halt-m.patch

@@ -18,7 +18,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -1078,6 +1078,7 @@ static void brcmf_sdio_get_console_addr(
+@@ -1079,6 +1079,7 @@ static void brcmf_sdio_get_console_addr(
  
  static u32 brcmf_sdio_hostmail(struct brcmf_sdio *bus)
  {
@@ -26,7 +26,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  	u32 intstatus = 0;
  	u32 hmb_data;
  	u8 fcbits;
-@@ -1095,8 +1096,10 @@ static u32 brcmf_sdio_hostmail(struct br
+@@ -1096,8 +1097,10 @@ static u32 brcmf_sdio_hostmail(struct br
  	bus->sdcnt.f1regdata += 2;
  
  	/* dongle indicates the firmware has halted/crashed */

package/kernel/mac80211/patches/332-v4.19-0003-brcmfmac-handle-msgbuf-packets-marked-with-monitor-m.patch

@@ -38,7 +38,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  #include <net/ipv6.h>
  #include <brcmu_utils.h>
  #include <brcmu_wifi.h>
-@@ -367,6 +368,34 @@ void brcmf_netif_rx(struct brcmf_if *ifp
+@@ -356,6 +357,34 @@ void brcmf_netif_rx(struct brcmf_if *ifp
  		netif_rx_ni(skb);
  }
  
@@ -75,7 +75,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  {
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
-@@ -121,6 +121,7 @@ struct brcmf_pub {
+@@ -122,6 +122,7 @@ struct brcmf_pub {
  
  	struct brcmf_if *iflist[BRCMF_MAX_IFS];
  	s32 if2bss[BRCMF_MAX_IFS];
@@ -83,7 +83,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  	struct mutex proto_block;
  	unsigned char proto_buf[BRCMF_DCMD_MAXLEN];
-@@ -215,6 +216,7 @@ void brcmf_txflowblock_if(struct brcmf_i
+@@ -217,6 +218,7 @@ void brcmf_txflowblock_if(struct brcmf_i
  			  enum brcmf_netif_stop_reason reason, bool state);
  void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success);
  void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb);

package/kernel/mac80211/patches/333-v4.20-0001-brcmfmac-add-CYW89342-mini-PCIe-device.patch

@@ -0,0 +1,25 @@
+From 2fef681a4cf7994c882190fd2417b95f30510afb Mon Sep 17 00:00:00 2001
+From: Jia-Shyr Chuang <saint.chuang@cypress.com>
+Date: Wed, 15 Aug 2018 04:23:09 -0500
+Subject: [PATCH] brcmfmac: add CYW89342 mini-PCIe device
+
+CYW89342 is a 2x2 MIMO, 802.11a/b/g/n/ac for WLAN. It is a member of
+4355/4359 family.
+
+Signed-off-by: Jia-Shyr Chuang <saint.chuang@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -1967,6 +1967,7 @@ static const struct dev_pm_ops brcmf_pci
+ 
+ static struct pci_device_id brcmf_pcie_devid_table[] = {
+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4350_DEVICE_ID),
++	BRCMF_PCIE_DEVICE_SUB(0x4355, BRCM_PCIE_VENDOR_ID_BROADCOM, 0x4355),
+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_4356_DEVICE_ID),
+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43567_DEVICE_ID),
+ 	BRCMF_PCIE_DEVICE(BRCM_PCIE_43570_DEVICE_ID),

package/kernel/mac80211/patches/333-v4.20-0002-brcmfmac-fix-for-proper-support-of-160MHz-bandwidth.patch

@@ -0,0 +1,117 @@
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 5 Sep 2018 09:48:58 +0200
+Subject: [PATCH] brcmfmac: fix for proper support of 160MHz bandwidth
+
+Decoding of firmware channel information was not complete for 160MHz
+support. This resulted in the following warning:
+
+  WARNING: CPU: 2 PID: 2222 at .../broadcom/brcm80211/brcmutil/d11.c:196
+	brcmu_d11ac_decchspec+0x2e/0x100 [brcmutil]
+  Modules linked in: brcmfmac(O) brcmutil(O) sha256_generic cfg80211 ...
+  CPU: 2 PID: 2222 Comm: kworker/2:0 Tainted: G           O
+  4.17.0-wt-testing-x64-00002-gf1bed50 #1
+  Hardware name: Dell Inc. Latitude E6410/07XJP9, BIOS A07 02/15/2011
+  Workqueue: events request_firmware_work_func
+  RIP: 0010:brcmu_d11ac_decchspec+0x2e/0x100 [brcmutil]
+  RSP: 0018:ffffc90000047bd0 EFLAGS: 00010206
+  RAX: 000000000000e832 RBX: ffff8801146fe910 RCX: ffff8801146fd3c0
+  RDX: 0000000000002800 RSI: 0000000000000070 RDI: ffffc90000047c30
+  RBP: ffffc90000047bd0 R08: 0000000000000000 R09: ffffffffa0798c80
+  R10: ffff88012bca55e0 R11: ffff880110a4ea00 R12: ffff8801146f8000
+  R13: ffffc90000047c30 R14: ffff8801146fe930 R15: ffff8801138e02e0
+  FS:  0000000000000000(0000) GS:ffff88012bc80000(0000) knlGS:0000000000000000
+  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+  CR2: 00007f18ce8b8070 CR3: 000000000200a003 CR4: 00000000000206e0
+  Call Trace:
+   brcmf_setup_wiphybands+0x212/0x780 [brcmfmac]
+   brcmf_cfg80211_attach+0xae2/0x11a0 [brcmfmac]
+   brcmf_attach+0x1fc/0x4b0 [brcmfmac]
+   ? __kmalloc+0x13c/0x1c0
+   brcmf_pcie_setup+0x99b/0xe00 [brcmfmac]
+   brcmf_fw_request_done+0x16a/0x1f0 [brcmfmac]
+   request_firmware_work_func+0x36/0x60
+   process_one_work+0x146/0x350
+   worker_thread+0x4a/0x3b0
+   kthread+0x102/0x140
+   ? process_one_work+0x350/0x350
+   ? kthread_bind+0x20/0x20
+   ret_from_fork+0x35/0x40
+  Code: 66 90 0f b7 07 55 48 89 e5 89 c2 88 47 02 88 47 03 66 81 e2 00 38
+	66 81 fa 00 18 74 6e 66 81 fa 00 20 74 39 66 81 fa 00 10 74 14 <0f>
+	0b 66 25 00 c0 74 20 66 3d 00 c0 75 20 c6 47 04 01 5d c3 66
+  ---[ end trace 550c46682415b26d ]---
+  brcmfmac: brcmf_construct_chaninfo: Ignoring unexpected firmware channel 50
+
+This patch adds the missing stuff to properly handle this.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+---
+ .../net/wireless/broadcom/brcm80211/brcmutil/d11.c | 34 +++++++++++++++++++++-
+ .../broadcom/brcm80211/include/brcmu_wifi.h        |  2 ++
+ 2 files changed, 35 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+@@ -77,6 +77,8 @@ static u16 d11ac_bw(enum brcmu_chan_bw b
+ 		return BRCMU_CHSPEC_D11AC_BW_40;
+ 	case BRCMU_CHAN_BW_80:
+ 		return BRCMU_CHSPEC_D11AC_BW_80;
++	case BRCMU_CHAN_BW_160:
++		return BRCMU_CHSPEC_D11AC_BW_160;
+ 	default:
+ 		WARN_ON(1);
+ 	}
+@@ -190,8 +192,38 @@ static void brcmu_d11ac_decchspec(struct
+ 			break;
+ 		}
+ 		break;
+-	case BRCMU_CHSPEC_D11AC_BW_8080:
+ 	case BRCMU_CHSPEC_D11AC_BW_160:
++		switch (ch->sb) {
++		case BRCMU_CHAN_SB_LLL:
++			ch->control_ch_num -= CH_70MHZ_APART;
++			break;
++		case BRCMU_CHAN_SB_LLU:
++			ch->control_ch_num -= CH_50MHZ_APART;
++			break;
++		case BRCMU_CHAN_SB_LUL:
++			ch->control_ch_num -= CH_30MHZ_APART;
++			break;
++		case BRCMU_CHAN_SB_LUU:
++			ch->control_ch_num -= CH_10MHZ_APART;
++			break;
++		case BRCMU_CHAN_SB_ULL:
++			ch->control_ch_num += CH_10MHZ_APART;
++			break;
++		case BRCMU_CHAN_SB_ULU:
++			ch->control_ch_num += CH_30MHZ_APART;
++			break;
++		case BRCMU_CHAN_SB_UUL:
++			ch->control_ch_num += CH_50MHZ_APART;
++			break;
++		case BRCMU_CHAN_SB_UUU:
++			ch->control_ch_num += CH_70MHZ_APART;
++			break;
++		default:
++			WARN_ON_ONCE(1);
++			break;
++		}
++		break;
++	case BRCMU_CHSPEC_D11AC_BW_8080:
+ 	default:
+ 		WARN_ON_ONCE(1);
+ 		break;
+--- a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h
+@@ -29,6 +29,8 @@
+ #define CH_UPPER_SB			0x01
+ #define CH_LOWER_SB			0x02
+ #define CH_EWA_VALID			0x04
++#define CH_70MHZ_APART			14
++#define CH_50MHZ_APART			10
+ #define CH_30MHZ_APART			6
+ #define CH_20MHZ_APART			4
+ #define CH_10MHZ_APART			2

package/kernel/mac80211/patches/333-v4.20-0003-brcmfmac-increase-buffer-for-obtaining-firmware-capa.patch

@@ -0,0 +1,28 @@
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Wed, 5 Sep 2018 09:48:59 +0200
+Subject: [PATCH] brcmfmac: increase buffer for obtaining firmware capabilities
+
+When obtaining the firmware capability a buffer is provided of 512
+bytes. However, if all features in firmware are supported the buffer
+needs to be 565 bytes as otherwise truncated information is retrieved
+from firmware. Increasing the buffer to 768 bytes on stack.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -151,7 +151,7 @@ static void brcmf_feat_iovar_int_get(str
+ 	}
+ }
+ 
+-#define MAX_CAPS_BUFFER_SIZE	512
++#define MAX_CAPS_BUFFER_SIZE	768
+ static void brcmf_feat_firmware_capabilities(struct brcmf_if *ifp)
+ {
+ 	char caps[MAX_CAPS_BUFFER_SIZE];

package/kernel/mac80211/patches/335-v4.20-0001-brcmfmac-reduce-timeout-for-action-frame-scan.patch

@@ -0,0 +1,67 @@
+From edb6d6885bef82d1eac432dbeca9fbf4ec349d7e Mon Sep 17 00:00:00 2001
+From: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+Date: Thu, 27 Sep 2018 14:59:44 +0000
+Subject: [PATCH] brcmfmac: reduce timeout for action frame scan
+
+Finding a common channel to send an action frame out is required for
+some action types. Since a loop with several scan retry is used to find
+the channel, a short wait time could be considered for each attempt.
+This patch reduces the wait time from 1500 to 450 msec for each action
+frame scan.
+
+This patch fixes the WFA p2p certification 5.1.20 failure caused by the
+long action frame send time.
+
+Signed-off-by: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -74,7 +74,7 @@
+ #define P2P_AF_MAX_WAIT_TIME		msecs_to_jiffies(2000)
+ #define P2P_INVALID_CHANNEL		-1
+ #define P2P_CHANNEL_SYNC_RETRY		5
+-#define P2P_AF_FRM_SCAN_MAX_WAIT	msecs_to_jiffies(1500)
++#define P2P_AF_FRM_SCAN_MAX_WAIT	msecs_to_jiffies(450)
+ #define P2P_DEFAULT_SLEEP_TIME_VSDB	200
+ 
+ /* WiFi P2P Public Action Frame OUI Subtypes */
+@@ -1141,7 +1141,6 @@ static s32 brcmf_p2p_af_searching_channe
+ {
+ 	struct afx_hdl *afx_hdl = &p2p->afx_hdl;
+ 	struct brcmf_cfg80211_vif *pri_vif;
+-	unsigned long duration;
+ 	s32 retry;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+@@ -1157,7 +1156,6 @@ static s32 brcmf_p2p_af_searching_channe
+ 	 * pending action frame tx is cancelled.
+ 	 */
+ 	retry = 0;
+-	duration = msecs_to_jiffies(P2P_AF_FRM_SCAN_MAX_WAIT);
+ 	while ((retry < P2P_CHANNEL_SYNC_RETRY) &&
+ 	       (afx_hdl->peer_chan == P2P_INVALID_CHANNEL)) {
+ 		afx_hdl->is_listen = false;
+@@ -1165,7 +1163,8 @@ static s32 brcmf_p2p_af_searching_channe
+ 			  retry);
+ 		/* search peer on peer's listen channel */
+ 		schedule_work(&afx_hdl->afx_work);
+-		wait_for_completion_timeout(&afx_hdl->act_frm_scan, duration);
++		wait_for_completion_timeout(&afx_hdl->act_frm_scan,
++					    P2P_AF_FRM_SCAN_MAX_WAIT);
+ 		if ((afx_hdl->peer_chan != P2P_INVALID_CHANNEL) ||
+ 		    (!test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL,
+ 			       &p2p->status)))
+@@ -1178,7 +1177,7 @@ static s32 brcmf_p2p_af_searching_channe
+ 			afx_hdl->is_listen = true;
+ 			schedule_work(&afx_hdl->afx_work);
+ 			wait_for_completion_timeout(&afx_hdl->act_frm_scan,
+-						    duration);
++						    P2P_AF_FRM_SCAN_MAX_WAIT);
+ 		}
+ 		if ((afx_hdl->peer_chan != P2P_INVALID_CHANNEL) ||
+ 		    (!test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL,

package/kernel/mac80211/patches/335-v4.20-0002-brcmfmac-fix-full-timeout-waiting-for-action-frame-o.patch

@@ -0,0 +1,79 @@
+From fbf07000960d9c8a13fdc17c6de0230d681c7543 Mon Sep 17 00:00:00 2001
+From: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+Date: Thu, 27 Sep 2018 14:59:49 +0000
+Subject: [PATCH] brcmfmac: fix full timeout waiting for action frame
+ on-channel tx
+
+The driver sends an action frame down and waits for a completion signal
+triggered by the received BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE event
+to continue the process. However, the action frame could be transmitted
+either on the current channel or on an off channel. For the on-channel
+case, only BRCMF_E_ACTION_FRAME_COMPLETE event will be received when
+the frame is transmitted, which make the driver always wait a full
+timeout duration. This patch has the completion signal be triggered by
+receiving the BRCMF_E_ACTION_FRAME_COMPLETE event for the on-channel
+case.
+
+This change fixes WFA p2p certification 5.1.19 failure.
+
+Signed-off-by: Chung-Hsien Hsu <stanley.hsu@cypress.com>
+Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 17 +++++++++++++++--
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h |  2 ++
+ 2 files changed, 17 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -1464,10 +1464,12 @@ int brcmf_p2p_notify_action_tx_complete(
+ 		return 0;
+ 
+ 	if (e->event_code == BRCMF_E_ACTION_FRAME_COMPLETE) {
+-		if (e->status == BRCMF_E_STATUS_SUCCESS)
++		if (e->status == BRCMF_E_STATUS_SUCCESS) {
+ 			set_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED,
+ 				&p2p->status);
+-		else {
++			if (!p2p->wait_for_offchan_complete)
++				complete(&p2p->send_af_done);
++		} else {
+ 			set_bit(BRCMF_P2P_STATUS_ACTION_TX_NOACK, &p2p->status);
+ 			/* If there is no ack, we don't need to wait for
+ 			 * WLC_E_ACTION_FRAME_OFFCHAN_COMPLETE event
+@@ -1518,6 +1520,17 @@ static s32 brcmf_p2p_tx_action_frame(str
+ 	p2p->af_sent_channel = le32_to_cpu(af_params->channel);
+ 	p2p->af_tx_sent_jiffies = jiffies;
+ 
++	if (test_bit(BRCMF_P2P_STATUS_DISCOVER_LISTEN, &p2p->status) &&
++	    p2p->af_sent_channel ==
++	    ieee80211_frequency_to_channel(p2p->remain_on_channel.center_freq))
++		p2p->wait_for_offchan_complete = false;
++	else
++		p2p->wait_for_offchan_complete = true;
++
++	brcmf_dbg(TRACE, "Waiting for %s tx completion event\n",
++		  (p2p->wait_for_offchan_complete) ?
++		   "off-channel" : "on-channel");
++
+ 	timeout = wait_for_completion_timeout(&p2p->send_af_done,
+ 					      P2P_AF_MAX_WAIT_TIME);
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
+@@ -124,6 +124,7 @@ struct afx_hdl {
+  * @gon_req_action: about to send go negotiation requets frame.
+  * @block_gon_req_tx: drop tx go negotiation requets frame.
+  * @p2pdev_dynamically: is p2p device if created by module param or supplicant.
++ * @wait_for_offchan_complete: wait for off-channel tx completion event.
+  */
+ struct brcmf_p2p_info {
+ 	struct brcmf_cfg80211_info *cfg;
+@@ -144,6 +145,7 @@ struct brcmf_p2p_info {
+ 	bool gon_req_action;
+ 	bool block_gon_req_tx;
+ 	bool p2pdev_dynamically;
++	bool wait_for_offchan_complete;
+ };
+ 
+ s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg, bool p2pdev_forced);

package/kernel/mac80211/patches/336-v4.20-0001-brcmutil-really-fix-decoding-channel-info-for-160-MH.patch

@@ -0,0 +1,41 @@
+From 3401d42c7ea2d064d15c66698ff8eb96553179ce Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 26 Oct 2018 12:50:39 +0200
+Subject: [PATCH] brcmutil: really fix decoding channel info for 160 MHz
+ bandwidth
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Previous commit /adding/ support for 160 MHz chanspecs was incomplete.
+It didn't set bandwidth info and didn't extract control channel info. As
+the result it was also using uninitialized "sb" var.
+
+This change has been tested for two chanspecs found to be reported by
+some devices/firmwares:
+1) 60/160 (0xee32)
+   Before: chnum:50 control_ch_num:36
+    After: chnum:50 control_ch_num:60
+2) 120/160 (0xed72)
+   Before: chnum:114 control_ch_num:100
+    After: chnum:114 control_ch_num:120
+
+Fixes: 330994e8e8ec ("brcmfmac: fix for proper support of 160MHz bandwidth")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+@@ -193,6 +193,9 @@ static void brcmu_d11ac_decchspec(struct
+ 		}
+ 		break;
+ 	case BRCMU_CHSPEC_D11AC_BW_160:
++		ch->bw = BRCMU_CHAN_BW_160;
++		ch->sb = brcmu_maskget16(ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK,
++					 BRCMU_CHSPEC_D11AC_SB_SHIFT);
+ 		switch (ch->sb) {
+ 		case BRCMU_CHAN_SB_LLL:
+ 			ch->control_ch_num -= CH_70MHZ_APART;

package/kernel/mac80211/patches/337-v4.20-brcmfmac-fix-reporting-support-for-160-MHz-channels.patch

@@ -0,0 +1,34 @@
+From 8eefb59de817125eeedde2a2cc1e4ac3660062f9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 8 Nov 2018 16:08:29 +0100
+Subject: [PATCH] brcmfmac: fix reporting support for 160 MHz channels
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Driver can report IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ so it's
+important to provide valid & complete info about supported bands for
+each channel. By default no support for 160 MHz should be assumed unless
+firmware reports it for a given channel later.
+
+This fixes info passed to the userspace. Without that change userspace
+could try to use invalid channel and fail to start an interface.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Cc: stable@vger.kernel.org
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -5960,7 +5960,8 @@ static int brcmf_construct_chaninfo(stru
+ 			 * for subsequent chanspecs.
+ 			 */
+ 			channel->flags = IEEE80211_CHAN_NO_HT40 |
+-					 IEEE80211_CHAN_NO_80MHZ;
++					 IEEE80211_CHAN_NO_80MHZ |
++					 IEEE80211_CHAN_NO_160MHZ;
+ 			ch.bw = BRCMU_CHAN_BW_20;
+ 			cfg->d11inf.encchspec(&ch);
+ 			chaninfo = ch.chspec;

package/kernel/mac80211/patches/338-v5.0-0001-brcmfmac-fix-spelling-mistake-Retreiving-Retrieving.patch

@@ -0,0 +1,34 @@
+From e966a79c2f761a696dec9cfb0e2d4aa977bf78cb Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 16 Oct 2018 18:43:42 +0100
+Subject: [PATCH] brcmfmac: fix spelling mistake "Retreiving" -> "Retrieving"
+
+Trivial fix to spelling mistake in brcmf_err error message.
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -121,7 +121,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	err = brcmf_fil_iovar_data_get(ifp, "cur_etheraddr", ifp->mac_addr,
+ 				       sizeof(ifp->mac_addr));
+ 	if (err < 0) {
+-		brcmf_err("Retreiving cur_etheraddr failed, %d\n", err);
++		brcmf_err("Retrieving cur_etheraddr failed, %d\n", err);
+ 		goto done;
+ 	}
+ 	memcpy(ifp->drvr->wiphy->perm_addr, ifp->drvr->mac, ETH_ALEN);
+@@ -158,7 +158,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	strcpy(buf, "ver");
+ 	err = brcmf_fil_iovar_data_get(ifp, "ver", buf, sizeof(buf));
+ 	if (err < 0) {
+-		brcmf_err("Retreiving version information failed, %d\n",
++		brcmf_err("Retrieving version information failed, %d\n",
+ 			  err);
+ 		goto done;
+ 	}

package/kernel/mac80211/patches/338-v5.0-0002-brcmutil-print-invalid-chanspec-when-WARN-ing.patch

@@ -0,0 +1,83 @@
+From ae5848cb4511bbbfe0306fcdbe5d9a95cd9546a9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 26 Oct 2018 13:22:32 +0200
+Subject: [PATCH] brcmutil: print invalid chanspec when WARN-ing
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+On one of my devices I got WARNINGs when brcmfmac tried to decode
+chanspec. I couldn't tell if it was some unsupported format or just a
+malformed value passed by a firmware.
+
+Print chanspec value so it's possible to debug a possible problem.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
+@@ -128,7 +128,7 @@ static void brcmu_d11n_decchspec(struct
+ 		}
+ 		break;
+ 	default:
+-		WARN_ON_ONCE(1);
++		WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ 		break;
+ 	}
+ 
+@@ -140,7 +140,7 @@ static void brcmu_d11n_decchspec(struct
+ 		ch->band = BRCMU_CHAN_BAND_2G;
+ 		break;
+ 	default:
+-		WARN_ON_ONCE(1);
++		WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ 		break;
+ 	}
+ }
+@@ -167,7 +167,7 @@ static void brcmu_d11ac_decchspec(struct
+ 			ch->sb = BRCMU_CHAN_SB_U;
+ 			ch->control_ch_num += CH_10MHZ_APART;
+ 		} else {
+-			WARN_ON_ONCE(1);
++			WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ 		}
+ 		break;
+ 	case BRCMU_CHSPEC_D11AC_BW_80:
+@@ -188,7 +188,7 @@ static void brcmu_d11ac_decchspec(struct
+ 			ch->control_ch_num += CH_30MHZ_APART;
+ 			break;
+ 		default:
+-			WARN_ON_ONCE(1);
++			WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ 			break;
+ 		}
+ 		break;
+@@ -222,13 +222,13 @@ static void brcmu_d11ac_decchspec(struct
+ 			ch->control_ch_num += CH_70MHZ_APART;
+ 			break;
+ 		default:
+-			WARN_ON_ONCE(1);
++			WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ 			break;
+ 		}
+ 		break;
+ 	case BRCMU_CHSPEC_D11AC_BW_8080:
+ 	default:
+-		WARN_ON_ONCE(1);
++		WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ 		break;
+ 	}
+ 
+@@ -240,7 +240,7 @@ static void brcmu_d11ac_decchspec(struct
+ 		ch->band = BRCMU_CHAN_BAND_2G;
+ 		break;
+ 	default:
+-		WARN_ON_ONCE(1);
++		WARN_ONCE(1, "Invalid chanspec 0x%04x\n", ch->chspec);
+ 		break;
+ 	}
+ }

package/kernel/mac80211/patches/338-v5.0-0003-brcmfmac-support-STA-info-struct-v7.patch

@@ -0,0 +1,78 @@
+From a4dad0334732f62c67058037d9edb17945bec598 Mon Sep 17 00:00:00 2001
+From: Dan Haab <riproute@gmail.com>
+Date: Fri, 9 Nov 2018 09:38:55 -0700
+Subject: [PATCH] brcmfmac: support STA info struct v7
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The newest firmwares provide STA info using v7 of the struct. As v7
+isn't backward compatible, a union is needed.
+
+Even though brcmfmac does not use any of the new info it's important to
+provide the proper struct buffer. Without this change new firmwares will
+fallback to the very limited v3 instead of something in between such as
+v4.
+
+Signed-off-by: Dan Haab <dan.haab@luxul.com>
+Reviewed-by: Rafał Miłecki <rafal@milecki.pl>
+---
+ .../broadcom/brcm80211/brcmfmac/fwil_types.h       | 40 ++++++++++++++++++----
+ 1 file changed, 33 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+@@ -167,6 +167,8 @@
+ #define BRCMF_MFP_REQUIRED		2
+  
+ #define BRCMF_VHT_CAP_MCS_MAP_NSS_MAX	8
++ 
++#define BRCMF_HE_CAP_MCS_MAP_NSS_MAX	8
+ 
+ /* join preference types for join_pref iovar */
+ enum brcmf_join_pref_types {
+@@ -565,13 +567,37 @@ struct brcmf_sta_info_le {
+ 	__le32 rx_pkts_retried;        /* # rx with retry bit set */
+ 	__le32 tx_rate_fallback;       /* lowest fallback TX rate */
+ 
+-	/* Fields valid for ver >= 5 */
+-	struct {
+-		__le32 count;					/* # rates in this set */
+-		u8 rates[BRCMF_MAXRATES_IN_SET];		/* rates in 500kbps units w/hi bit set if basic */
+-		u8 mcs[BRCMF_MCSSET_LEN];			/* supported mcs index bit map */
+-		__le16 vht_mcs[BRCMF_VHT_CAP_MCS_MAP_NSS_MAX];	/* supported mcs index bit map per nss */
+-	} rateset_adv;
++	union {
++		struct {
++			struct {
++				__le32 count;					/* # rates in this set */
++				u8 rates[BRCMF_MAXRATES_IN_SET];		/* rates in 500kbps units w/hi bit set if basic */
++				u8 mcs[BRCMF_MCSSET_LEN];			/* supported mcs index bit map */
++				__le16 vht_mcs[BRCMF_VHT_CAP_MCS_MAP_NSS_MAX];	/* supported mcs index bit map per nss */
++			} rateset_adv;
++		} v5;
++
++		struct {
++			__le32 rx_dur_total;	/* total user RX duration (estimated) */
++			__le16 chanspec;	/** chanspec this sta is on */
++			__le16 pad_1;
++			struct {
++				__le16 version;					/* version */
++				__le16 len;					/* length */
++				__le32 count;					/* # rates in this set */
++				u8 rates[BRCMF_MAXRATES_IN_SET];		/* rates in 500kbps units w/hi bit set if basic */
++				u8 mcs[BRCMF_MCSSET_LEN];			/* supported mcs index bit map */
++				__le16 vht_mcs[BRCMF_VHT_CAP_MCS_MAP_NSS_MAX];	/* supported mcs index bit map per nss */
++				__le16 he_mcs[BRCMF_HE_CAP_MCS_MAP_NSS_MAX];	/* supported he mcs index bit map per nss */
++			} rateset_adv;		/* rateset along with mcs index bitmap */
++			__le16 wpauth;		/* authentication type */
++			u8 algo;		/* crypto algorithm */
++			u8 pad_2;
++			__le32 tx_rspec;	/* Rate of last successful tx frame */
++			__le32 rx_rspec;	/* Rate of last successful rx frame */
++			__le32 wnm_cap;		/* wnm capabilities */
++		} v7;
++	};
+ };
+ 
+ struct brcmf_chanspec_list {

package/kernel/mac80211/patches/338-v5.0-0005-brcmfmac-fix-roamoff-1-modparam.patch

@@ -0,0 +1,68 @@
+From 8c892df41500469729e0d662816300196e4f463d Mon Sep 17 00:00:00 2001
+From: Stijn Tintel <stijn@linux-ipv6.be>
+Date: Tue, 4 Dec 2018 20:29:05 +0200
+Subject: [PATCH] brcmfmac: fix roamoff=1 modparam
+
+When the update_connect_param callback is set, nl80211 expects the flag
+WIPHY_FLAG_SUPPORTS_FW_ROAM to be set as well. However, this flag is
+only set when modparam roamoff=0, while the callback is set
+unconditionally. Since commit 7f9a3e150ec7 this causes a warning in
+wiphy_register, which breaks brcmfmac.
+
+Disable the update_connect_param callback when roamoff=0 to fix this.
+
+Fixes: 7f9a3e150ec7 ("nl80211: Update ERP info using NL80211_CMD_UPDATE_CONNECT_PARAMS")
+Cc: Stable <stable@vger.kernel.org> # 4.19+
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c   | 11 +++++++++--
+ .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.h   |  2 +-
+ .../net/wireless/broadcom/brcm80211/brcmfmac/core.c   |  2 +-
+ 3 files changed, 11 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -5190,10 +5190,17 @@ static struct cfg80211_ops brcmf_cfg8021
+ 	.update_connect_params = brcmf_cfg80211_update_conn_params,
+ };
+ 
+-struct cfg80211_ops *brcmf_cfg80211_get_ops(void)
++struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings)
+ {
+-	return kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
++	struct cfg80211_ops *ops;
++
++	ops = kmemdup(&brcmf_cfg80211_ops, sizeof(brcmf_cfg80211_ops),
+ 		       GFP_KERNEL);
++
++	if (ops && settings->roamoff)
++		ops->update_connect_params = NULL;
++
++	return ops;
+ }
+ 
+ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.h
+@@ -391,7 +391,7 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+ void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg);
+ s32 brcmf_cfg80211_up(struct net_device *ndev);
+ s32 brcmf_cfg80211_down(struct net_device *ndev);
+-struct cfg80211_ops *brcmf_cfg80211_get_ops(void);
++struct cfg80211_ops *brcmf_cfg80211_get_ops(struct brcmf_mp_device *settings);
+ enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp);
+ 
+ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1100,7 +1100,7 @@ int brcmf_attach(struct device *dev, str
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+-	ops = brcmf_cfg80211_get_ops();
++	ops = brcmf_cfg80211_get_ops(settings);
+ 	if (!ops)
+ 		return -ENOMEM;
+ 

package/kernel/mac80211/patches/338-v5.0-0006-brcmfmac-Fix-access-point-mode.patch

@@ -0,0 +1,41 @@
+From 861cb5eb467f5e38dce1aabe4e8db379255bd89b Mon Sep 17 00:00:00 2001
+From: Stefan Wahren <stefan.wahren@i2se.com>
+Date: Wed, 12 Dec 2018 20:20:06 +0100
+Subject: [PATCH] brcmfmac: Fix access point mode
+
+Since commit 1204aa17f3b4 ("brcmfmac: set WIPHY_FLAG_HAVE_AP_SME flag")
+the Raspberry Pi 3 A+ (BCM43455) isn't able to operate in AP mode with
+hostapd (device_ap_sme=1 use_monitor=0):
+
+brcmfmac: brcmf_cfg80211_stop_ap: setting AP mode failed -52
+
+So add the missing mgmt_stypes for AP mode to fix this.
+
+Fixes: 1204aa17f3b4 ("brcmfmac: set WIPHY_FLAG_HAVE_AP_SME flag")
+Suggested-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c    | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6271,6 +6271,16 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] =
+ 		.tx = 0xffff,
+ 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+ 		      BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
++	},
++	[NL80211_IFTYPE_AP] = {
++		.tx = 0xffff,
++		.rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
++		      BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
++		      BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
++		      BIT(IEEE80211_STYPE_DISASSOC >> 4) |
++		      BIT(IEEE80211_STYPE_AUTH >> 4) |
++		      BIT(IEEE80211_STYPE_DEAUTH >> 4) |
++		      BIT(IEEE80211_STYPE_ACTION >> 4)
+ 	}
+ };
+ 

package/kernel/mac80211/patches/339-v5.1-0001-brcmfmac-modify-__brcmf_err-to-take-bus-as-a-paramet.patch

@@ -0,0 +1,104 @@
+From 5cc898fbcb352b764f8d51c16e10e2eb0056173d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 6 Feb 2019 12:28:15 +0100
+Subject: [PATCH] brcmfmac: modify __brcmf_err() to take bus as a parameter
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+So far __brcmf_err() was using pr_err() which didn't allow identifying
+device that was affected by an error. It's crucial for systems with more
+than 1 device supported by brcmfmac (a common case for home routers).
+
+This change allows passing struct brcmf_bus to the __brcmf_err(). That
+struct has been agreed to be the most common one. It allows accessing
+struct device easily & using dev_err() printing helper.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/common.c    | 7 +++++--
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h | 8 +++++---
+ .../wireless/broadcom/brcm80211/brcmfmac/tracepoint.c    | 9 +++++++--
+ 3 files changed, 17 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -221,7 +221,7 @@ done:
+ }
+ 
+ #ifndef CPTCFG_BRCM_TRACING
+-void __brcmf_err(const char *func, const char *fmt, ...)
++void __brcmf_err(struct brcmf_bus *bus, const char *func, const char *fmt, ...)
+ {
+ 	struct va_format vaf;
+ 	va_list args;
+@@ -230,7 +230,10 @@ void __brcmf_err(const char *func, const
+ 
+ 	vaf.fmt = fmt;
+ 	vaf.va = &args;
+-	pr_err("%s: %pV", func, &vaf);
++	if (bus)
++		dev_err(bus->dev, "%s: %pV", func, &vaf);
++	else
++		pr_err("%s: %pV", func, &vaf);
+ 
+ 	va_end(args);
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
+@@ -45,8 +45,10 @@
+ #undef pr_fmt
+ #define pr_fmt(fmt)		KBUILD_MODNAME ": " fmt
+ 
+-__printf(2, 3)
+-void __brcmf_err(const char *func, const char *fmt, ...);
++struct brcmf_bus;
++
++__printf(3, 4)
++void __brcmf_err(struct brcmf_bus *bus, const char *func, const char *fmt, ...);
+ /* Macro for error messages. When debugging / tracing the driver all error
+  * messages are important to us.
+  */
+@@ -55,7 +57,7 @@ void __brcmf_err(const char *func, const
+ 		if (IS_ENABLED(CPTCFG_BRCMDBG) ||			\
+ 		    IS_ENABLED(CPTCFG_BRCM_TRACING) ||			\
+ 		    net_ratelimit())					\
+-			__brcmf_err(__func__, fmt, ##__VA_ARGS__);	\
++			__brcmf_err(NULL, __func__, fmt, ##__VA_ARGS__);\
+ 	} while (0)
+ 
+ #if defined(DEBUG) || defined(CPTCFG_BRCM_TRACING)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/tracepoint.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/tracepoint.c
+@@ -14,14 +14,16 @@
+  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+  */
+ 
++#include <linux/device.h>
+ #include <linux/module.h> /* bug in tracepoint.h, it should include this */
+ 
+ #ifndef __CHECKER__
+ #define CREATE_TRACE_POINTS
++#include "bus.h"
+ #include "tracepoint.h"
+ #include "debug.h"
+ 
+-void __brcmf_err(const char *func, const char *fmt, ...)
++void __brcmf_err(struct brcmf_bus *bus, const char *func, const char *fmt, ...)
+ {
+ 	struct va_format vaf = {
+ 		.fmt = fmt,
+@@ -30,7 +32,10 @@ void __brcmf_err(const char *func, const
+ 
+ 	va_start(args, fmt);
+ 	vaf.va = &args;
+-	pr_err("%s: %pV", func, &vaf);
++	if (bus)
++		dev_err(bus->dev, "%s: %pV", func, &vaf);
++	else
++		pr_err("%s: %pV", func, &vaf);
+ 	trace_brcmf_err(func, &vaf);
+ 	va_end(args);
+ }

package/kernel/mac80211/patches/339-v5.1-0002-brcmfmac-pass-bus-to-the-__brcmf_err-in-pcie.c.patch

@@ -0,0 +1,286 @@
+From 8602e62441aba276cafd68034b72162fbc5ca0a6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 6 Feb 2019 12:28:16 +0100
+Subject: [PATCH] brcmfmac: pass bus to the __brcmf_err() in pcie.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This enables dev_err() usage (instead of pr_err()) in the __brcmf_err().
+It makes error messages more meaningful and is important for debugging
+errors/bugs on systems with multiple brcmfmac supported devices.
+
+All bus files should follow & get updated similarly (soon).
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/debug.h       |  2 +
+ .../broadcom/brcm80211/brcmfmac/pcie.c        | 59 +++++++++++--------
+ 2 files changed, 38 insertions(+), 23 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
+@@ -52,6 +52,7 @@ void __brcmf_err(struct brcmf_bus *bus,
+ /* Macro for error messages. When debugging / tracing the driver all error
+  * messages are important to us.
+  */
++#ifndef brcmf_err
+ #define brcmf_err(fmt, ...)						\
+ 	do {								\
+ 		if (IS_ENABLED(CPTCFG_BRCMDBG) ||			\
+@@ -59,6 +60,7 @@ void __brcmf_err(struct brcmf_bus *bus,
+ 		    net_ratelimit())					\
+ 			__brcmf_err(NULL, __func__, fmt, ##__VA_ARGS__);\
+ 	} while (0)
++#endif
+ 
+ #if defined(DEBUG) || defined(CPTCFG_BRCM_TRACING)
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -30,6 +30,15 @@
+ #include <brcmu_wifi.h>
+ #include <brcm_hw_ids.h>
+ 
++/* Custom brcmf_err() that takes bus arg and passes it further */
++#define brcmf_err(bus, fmt, ...)					\
++	do {								\
++		if (IS_ENABLED(CPTCFG_BRCMDBG) ||			\
++		    IS_ENABLED(CPTCFG_BRCM_TRACING) ||			\
++		    net_ratelimit())					\
++			__brcmf_err(bus, __func__, fmt, ##__VA_ARGS__);	\
++	} while (0)
++
+ #include "debug.h"
+ #include "bus.h"
+ #include "commonring.h"
+@@ -529,6 +538,7 @@ static void
+ brcmf_pcie_select_core(struct brcmf_pciedev_info *devinfo, u16 coreid)
+ {
+ 	const struct pci_dev *pdev = devinfo->pdev;
++	struct brcmf_bus *bus = dev_get_drvdata(&pdev->dev);
+ 	struct brcmf_core *core;
+ 	u32 bar0_win;
+ 
+@@ -546,7 +556,7 @@ brcmf_pcie_select_core(struct brcmf_pcie
+ 			}
+ 		}
+ 	} else {
+-		brcmf_err("Unsupported core selected %x\n", coreid);
++		brcmf_err(bus, "Unsupported core selected %x\n", coreid);
+ 	}
+ }
+ 
+@@ -840,9 +850,8 @@ static irqreturn_t brcmf_pcie_isr_thread
+ 
+ static int brcmf_pcie_request_irq(struct brcmf_pciedev_info *devinfo)
+ {
+-	struct pci_dev *pdev;
+-
+-	pdev = devinfo->pdev;
++	struct pci_dev *pdev = devinfo->pdev;
++	struct brcmf_bus *bus = dev_get_drvdata(&pdev->dev);
+ 
+ 	brcmf_pcie_intr_disable(devinfo);
+ 
+@@ -853,7 +862,7 @@ static int brcmf_pcie_request_irq(struct
+ 				 brcmf_pcie_isr_thread, IRQF_SHARED,
+ 				 "brcmf_pcie_intr", devinfo)) {
+ 		pci_disable_msi(pdev);
+-		brcmf_err("Failed to request IRQ %d\n", pdev->irq);
++		brcmf_err(bus, "Failed to request IRQ %d\n", pdev->irq);
+ 		return -EIO;
+ 	}
+ 	devinfo->irq_allocated = true;
+@@ -863,15 +872,14 @@ static int brcmf_pcie_request_irq(struct
+ 
+ static void brcmf_pcie_release_irq(struct brcmf_pciedev_info *devinfo)
+ {
+-	struct pci_dev *pdev;
++	struct pci_dev *pdev = devinfo->pdev;
++	struct brcmf_bus *bus = dev_get_drvdata(&pdev->dev);
+ 	u32 status;
+ 	u32 count;
+ 
+ 	if (!devinfo->irq_allocated)
+ 		return;
+ 
+-	pdev = devinfo->pdev;
+-
+ 	brcmf_pcie_intr_disable(devinfo);
+ 	free_irq(pdev->irq, devinfo);
+ 	pci_disable_msi(pdev);
+@@ -883,7 +891,7 @@ static void brcmf_pcie_release_irq(struc
+ 		count++;
+ 	}
+ 	if (devinfo->in_irq)
+-		brcmf_err("Still in IRQ (processing) !!!\n");
++		brcmf_err(bus, "Still in IRQ (processing) !!!\n");
+ 
+ 	status = brcmf_pcie_read_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXINT);
+ 	brcmf_pcie_write_reg32(devinfo, BRCMF_PCIE_PCIE2REG_MAILBOXINT, status);
+@@ -1094,6 +1102,7 @@ static void brcmf_pcie_release_ringbuffe
+ 
+ static int brcmf_pcie_init_ringbuffers(struct brcmf_pciedev_info *devinfo)
+ {
++	struct brcmf_bus *bus = dev_get_drvdata(&devinfo->pdev->dev);
+ 	struct brcmf_pcie_ringbuf *ring;
+ 	struct brcmf_pcie_ringbuf *rings;
+ 	u32 d2h_w_idx_ptr;
+@@ -1246,7 +1255,7 @@ static int brcmf_pcie_init_ringbuffers(s
+ 	return 0;
+ 
+ fail:
+-	brcmf_err("Allocating ring buffers failed\n");
++	brcmf_err(bus, "Allocating ring buffers failed\n");
+ 	brcmf_pcie_release_ringbuffers(devinfo);
+ 	return -ENOMEM;
+ }
+@@ -1269,6 +1278,7 @@ brcmf_pcie_release_scratchbuffers(struct
+ 
+ static int brcmf_pcie_init_scratchbuffers(struct brcmf_pciedev_info *devinfo)
+ {
++	struct brcmf_bus *bus = dev_get_drvdata(&devinfo->pdev->dev);
+ 	u64 address;
+ 	u32 addr;
+ 
+@@ -1308,7 +1318,7 @@ static int brcmf_pcie_init_scratchbuffer
+ 	return 0;
+ 
+ fail:
+-	brcmf_err("Allocating scratch buffers failed\n");
++	brcmf_err(bus, "Allocating scratch buffers failed\n");
+ 	brcmf_pcie_release_scratchbuffers(devinfo);
+ 	return -ENOMEM;
+ }
+@@ -1409,6 +1419,7 @@ static int
+ brcmf_pcie_init_share_ram_info(struct brcmf_pciedev_info *devinfo,
+ 			       u32 sharedram_addr)
+ {
++	struct brcmf_bus *bus = dev_get_drvdata(&devinfo->pdev->dev);
+ 	struct brcmf_pcie_shared_info *shared;
+ 	u32 addr;
+ 
+@@ -1420,7 +1431,8 @@ brcmf_pcie_init_share_ram_info(struct br
+ 	brcmf_dbg(PCIE, "PCIe protocol version %d\n", shared->version);
+ 	if ((shared->version > BRCMF_PCIE_MAX_SHARED_VERSION) ||
+ 	    (shared->version < BRCMF_PCIE_MIN_SHARED_VERSION)) {
+-		brcmf_err("Unsupported PCIE version %d\n", shared->version);
++		brcmf_err(bus, "Unsupported PCIE version %d\n",
++			  shared->version);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -1462,6 +1474,7 @@ static int brcmf_pcie_download_fw_nvram(
+ 					const struct firmware *fw, void *nvram,
+ 					u32 nvram_len)
+ {
++	struct brcmf_bus *bus = dev_get_drvdata(&devinfo->pdev->dev);
+ 	u32 sharedram_addr;
+ 	u32 sharedram_addr_written;
+ 	u32 loop_counter;
+@@ -1516,7 +1529,7 @@ static int brcmf_pcie_download_fw_nvram(
+ 		loop_counter--;
+ 	}
+ 	if (sharedram_addr == sharedram_addr_written) {
+-		brcmf_err("FW failed to initialize\n");
++		brcmf_err(bus, "FW failed to initialize\n");
+ 		return -ENODEV;
+ 	}
+ 	brcmf_dbg(PCIE, "Shared RAM addr: 0x%08x\n", sharedram_addr);
+@@ -1527,16 +1540,15 @@ static int brcmf_pcie_download_fw_nvram(
+ 
+ static int brcmf_pcie_get_resource(struct brcmf_pciedev_info *devinfo)
+ {
+-	struct pci_dev *pdev;
++	struct pci_dev *pdev = devinfo->pdev;
++	struct brcmf_bus *bus = dev_get_drvdata(&pdev->dev);
+ 	int err;
+ 	phys_addr_t  bar0_addr, bar1_addr;
+ 	ulong bar1_size;
+ 
+-	pdev = devinfo->pdev;
+-
+ 	err = pci_enable_device(pdev);
+ 	if (err) {
+-		brcmf_err("pci_enable_device failed err=%d\n", err);
++		brcmf_err(bus, "pci_enable_device failed err=%d\n", err);
+ 		return err;
+ 	}
+ 
+@@ -1549,7 +1561,7 @@ static int brcmf_pcie_get_resource(struc
+ 	/* read Bar-1 mapped memory range */
+ 	bar1_size = pci_resource_len(pdev, 2);
+ 	if ((bar1_size == 0) || (bar1_addr == 0)) {
+-		brcmf_err("BAR1 Not enabled, device size=%ld, addr=%#016llx\n",
++		brcmf_err(bus, "BAR1 Not enabled, device size=%ld, addr=%#016llx\n",
+ 			  bar1_size, (unsigned long long)bar1_addr);
+ 		return -EINVAL;
+ 	}
+@@ -1558,7 +1570,7 @@ static int brcmf_pcie_get_resource(struc
+ 	devinfo->tcm = ioremap_nocache(bar1_addr, bar1_size);
+ 
+ 	if (!devinfo->regs || !devinfo->tcm) {
+-		brcmf_err("ioremap() failed (%p,%p)\n", devinfo->regs,
++		brcmf_err(bus, "ioremap() failed (%p,%p)\n", devinfo->regs,
+ 			  devinfo->tcm);
+ 		return -EINVAL;
+ 	}
+@@ -1585,16 +1597,17 @@ static void brcmf_pcie_release_resource(
+ 
+ static int brcmf_pcie_attach_bus(struct brcmf_pciedev_info *devinfo)
+ {
++	struct brcmf_bus *bus = dev_get_drvdata(&devinfo->pdev->dev);
+ 	int ret;
+ 
+ 	/* Attach to the common driver interface */
+ 	ret = brcmf_attach(&devinfo->pdev->dev, devinfo->settings);
+ 	if (ret) {
+-		brcmf_err("brcmf_attach failed\n");
++		brcmf_err(bus, "brcmf_attach failed\n");
+ 	} else {
+ 		ret = brcmf_bus_started(&devinfo->pdev->dev);
+ 		if (ret)
+-			brcmf_err("dongle is not responding\n");
++			brcmf_err(bus, "dongle is not responding\n");
+ 	}
+ 
+ 	return ret;
+@@ -1823,7 +1836,7 @@ fail_bus:
+ 	kfree(bus->msgbuf);
+ 	kfree(bus);
+ fail:
+-	brcmf_err("failed %x:%x\n", pdev->vendor, pdev->device);
++	brcmf_err(NULL, "failed %x:%x\n", pdev->vendor, pdev->device);
+ 	brcmf_pcie_release_resource(devinfo);
+ 	if (devinfo->ci)
+ 		brcmf_chip_detach(devinfo->ci);
+@@ -1897,7 +1910,7 @@ static int brcmf_pcie_pm_enter_D3(struct
+ 	wait_event_timeout(devinfo->mbdata_resp_wait, devinfo->mbdata_completed,
+ 			   BRCMF_PCIE_MBDATA_TIMEOUT);
+ 	if (!devinfo->mbdata_completed) {
+-		brcmf_err("Timeout on response for entering D3 substate\n");
++		brcmf_err(bus, "Timeout on response for entering D3 substate\n");
+ 		brcmf_bus_change_state(bus, BRCMF_BUS_UP);
+ 		return -EIO;
+ 	}
+@@ -1942,7 +1955,7 @@ cleanup:
+ 
+ 	err = brcmf_pcie_probe(pdev, NULL);
+ 	if (err)
+-		brcmf_err("probe after resume failed, err=%d\n", err);
++		brcmf_err(bus, "probe after resume failed, err=%d\n", err);
+ 
+ 	return err;
+ }
+@@ -2014,7 +2027,8 @@ void brcmf_pcie_register(void)
+ 	brcmf_dbg(PCIE, "Enter\n");
+ 	err = pci_register_driver(&brcmf_pciedrvr);
+ 	if (err)
+-		brcmf_err("PCIE driver registration failed, err=%d\n", err);
++		brcmf_err(NULL, "PCIE driver registration failed, err=%d\n",
++			  err);
+ }
+ 
+ 

package/kernel/mac80211/patches/339-v5.1-0004-brcmfmac-support-monitor-frames-with-the-hardware-uc.patch

@@ -0,0 +1,147 @@
+From e665988be29ccea3584528967b432a5cfd801ca4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 8 Feb 2019 07:42:30 +0100
+Subject: [PATCH] brcmfmac: support monitor frames with the hardware/ucode
+ header
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+So far there were two monitor frame formats:
+1) 802.11 frames (with frame (sub)type & all addresses)
+2) 802.11 frames with the radiotap header
+
+Testing the latest FullMAC firmwares for 4366b1/4366c0 resulted in
+discovering a new format being used. It seems (almost?) identical to the
+one known from ucode used in SoftMAC devices which is most likely the
+same codebase anyway.
+
+While new firmwares will /announce/ radiotap header support using the
+"rtap" fw capability string it seems no string was added for the new
+ucode header format.
+
+All above means that:
+1) We need new format support when dealing with a received frame
+2) A new feature bit & mapping quirks have to be added manually
+
+As for now only an empty radiotap is being created. Adding support for
+extracting some info (band, channel, signal, etc.) is planned for the
+future.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/core.c        | 55 +++++++++++++++++++
+ .../broadcom/brcm80211/brcmfmac/feature.c     |  4 ++
+ .../broadcom/brcm80211/brcmfmac/feature.h     |  4 +-
+ 3 files changed, 62 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -42,6 +42,36 @@
+ 
+ #define BRCMF_BSSIDX_INVALID			-1
+ 
++#define	RXS_PBPRES				BIT(2)
++
++#define	D11_PHY_HDR_LEN				6
++
++struct d11rxhdr_le {
++	__le16 RxFrameSize;
++	u16 PAD;
++	__le16 PhyRxStatus_0;
++	__le16 PhyRxStatus_1;
++	__le16 PhyRxStatus_2;
++	__le16 PhyRxStatus_3;
++	__le16 PhyRxStatus_4;
++	__le16 PhyRxStatus_5;
++	__le16 RxStatus1;
++	__le16 RxStatus2;
++	__le16 RxTSFTime;
++	__le16 RxChan;
++	u8 unknown[12];
++} __packed;
++
++struct wlc_d11rxhdr {
++	struct d11rxhdr_le rxhdr;
++	__le32 tsf_l;
++	s8 rssi;
++	s8 rxpwr0;
++	s8 rxpwr1;
++	s8 do_rssi_ma;
++	s8 rxpwr[4];
++} __packed;
++
+ char *brcmf_ifname(struct brcmf_if *ifp)
+ {
+ 	if (!ifp)
+@@ -361,6 +391,35 @@ void brcmf_netif_mon_rx(struct brcmf_if
+ {
+ 	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FMT_RADIOTAP)) {
+ 		/* Do nothing */
++	} else if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FMT_HW_RX_HDR)) {
++		struct wlc_d11rxhdr *wlc_rxhdr = (struct wlc_d11rxhdr *)skb->data;
++		struct ieee80211_radiotap_header *radiotap;
++		unsigned int offset;
++		u16 RxStatus1;
++
++		RxStatus1 = le16_to_cpu(wlc_rxhdr->rxhdr.RxStatus1);
++
++		offset = sizeof(struct wlc_d11rxhdr);
++		/* MAC inserts 2 pad bytes for a4 headers or QoS or A-MSDU
++		 * subframes
++		 */
++		if (RxStatus1 & RXS_PBPRES)
++			offset += 2;
++		offset += D11_PHY_HDR_LEN;
++
++		skb_pull(skb, offset);
++
++		/* TODO: use RX header to fill some radiotap data */
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 13, 0)
++		radiotap = skb_push(skb, sizeof(*radiotap));
++#else
++		radiotap = (struct ieee80211_radiotap_header *)skb_push(skb, sizeof(*radiotap));
++#endif
++		memset(radiotap, 0, sizeof(*radiotap));
++		radiotap->it_len = cpu_to_le16(sizeof(*radiotap));
++
++		/* TODO: 4 bytes with receive status? */
++		skb->len -= 4;
+ 	} else {
+ 		struct ieee80211_radiotap_header *radiotap;
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -102,6 +102,10 @@ static const struct brcmf_feat_fwfeat br
+ 	{ "01-6cb8e269", BIT(BRCMF_FEAT_MONITOR) },
+ 	/* brcmfmac4366b-pcie.bin from linux-firmware.git commit 52442afee990 */
+ 	{ "01-c47a91a4", BIT(BRCMF_FEAT_MONITOR) },
++	/* brcmfmac4366b-pcie.bin from linux-firmware.git commit 211de1679a68 */
++	{ "01-801fb449", BIT(BRCMF_FEAT_MONITOR_FMT_HW_RX_HDR) },
++	/* brcmfmac4366c-pcie.bin from linux-firmware.git commit 211de1679a68 */
++	{ "01-d2cbb8fd", BIT(BRCMF_FEAT_MONITOR_FMT_HW_RX_HDR) },
+ };
+ 
+ static void brcmf_feat_firmware_overrides(struct brcmf_pub *drv)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
+@@ -33,6 +33,7 @@
+  * MFP: 802.11w Management Frame Protection.
+  * MONITOR: firmware can pass monitor packets to host.
+  * MONITOR_FMT_RADIOTAP: firmware provides monitor packets with radiotap header
++ * MONITOR_FMT_HW_RX_HDR: firmware provides monitor packets with hw/ucode header
+  */
+ #define BRCMF_FEAT_LIST \
+ 	BRCMF_FEAT_DEF(MBSS) \
+@@ -48,7 +49,8 @@
+ 	BRCMF_FEAT_DEF(WOWL_ARP_ND) \
+ 	BRCMF_FEAT_DEF(MFP) \
+ 	BRCMF_FEAT_DEF(MONITOR) \
+-	BRCMF_FEAT_DEF(MONITOR_FMT_RADIOTAP)
++	BRCMF_FEAT_DEF(MONITOR_FMT_RADIOTAP) \
++	BRCMF_FEAT_DEF(MONITOR_FMT_HW_RX_HDR)
+ 
+ /*
+  * Quirks:

package/kernel/mac80211/patches/339-v5.1-0005-brcmfmac-print-firmware-reported-ring-status-errors.patch

@@ -0,0 +1,67 @@
+From c988b78244df8216902e20de536434e2f474a37e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 8 Feb 2019 15:24:39 +0100
+Subject: [PATCH] brcmfmac: print firmware reported ring status errors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Firmware is capable of reporting ring status. It's used e.g. to signal
+some problem with a specific ring setup. This patch adds support for
+printing ring & error number which may be useful for debugging setup
+issues.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/msgbuf.c      | 25 +++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -134,6 +134,14 @@ struct msgbuf_completion_hdr {
+ 	__le16				flow_ring_id;
+ };
+ 
++/* Data struct for the MSGBUF_TYPE_RING_STATUS */
++struct msgbuf_ring_status {
++	struct msgbuf_common_hdr	msg;
++	struct msgbuf_completion_hdr	compl_hdr;
++	__le16				write_idx;
++	__le32				rsvd0[5];
++};
++
+ struct msgbuf_rx_event {
+ 	struct msgbuf_common_hdr	msg;
+ 	struct msgbuf_completion_hdr	compl_hdr;
+@@ -1178,6 +1186,19 @@ brcmf_msgbuf_process_rx_complete(struct
+ 	brcmf_netif_rx(ifp, skb);
+ }
+ 
++static void brcmf_msgbuf_process_ring_status(struct brcmf_msgbuf *msgbuf,
++					     void *buf)
++{
++	struct msgbuf_ring_status *ring_status = buf;
++	int err;
++
++	err = le16_to_cpu(ring_status->compl_hdr.status);
++	if (err) {
++		int ring = le16_to_cpu(ring_status->compl_hdr.flow_ring_id);
++
++		brcmf_err("Firmware reported ring %d error: %d\n", ring, err);
++	}
++}
+ 
+ static void
+ brcmf_msgbuf_process_flow_ring_create_response(struct brcmf_msgbuf *msgbuf,
+@@ -1239,6 +1260,10 @@ static void brcmf_msgbuf_process_msgtype
+ 
+ 	msg = (struct msgbuf_common_hdr *)buf;
+ 	switch (msg->msgtype) {
++	case MSGBUF_TYPE_RING_STATUS:
++		brcmf_dbg(MSGBUF, "MSGBUF_TYPE_RING_STATUS\n");
++		brcmf_msgbuf_process_ring_status(msgbuf, buf);
++		break;
+ 	case MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT:
+ 		brcmf_dbg(MSGBUF, "MSGBUF_TYPE_FLOW_RING_CREATE_CMPLT\n");
+ 		brcmf_msgbuf_process_flow_ring_create_response(msgbuf, buf);

package/kernel/mac80211/patches/339-v5.1-0006-brcmfmac-improve-code-handling-bandwidth-of-firmware.patch

@@ -0,0 +1,42 @@
+From f4e183293b871c96c0220dcc549d5ca4c72628ad Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 11 Feb 2019 23:04:53 +0100
+Subject: [PATCH] brcmfmac: improve code handling bandwidth of firmware
+ reported channels
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+1) Use switch to simplify/improve the code & avoid some duplication
+2) Add warning for unsupported values
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6003,11 +6003,18 @@ static int brcmf_construct_chaninfo(stru
+ 		/* assuming the chanspecs order is HT20,
+ 		 * HT40 upper, HT40 lower, and VHT80.
+ 		 */
+-		if (ch.bw == BRCMU_CHAN_BW_80) {
++		switch (ch.bw) {
++		case BRCMU_CHAN_BW_80:
+ 			channel->flags &= ~IEEE80211_CHAN_NO_80MHZ;
+-		} else if (ch.bw == BRCMU_CHAN_BW_40) {
++			break;
++		case BRCMU_CHAN_BW_40:
+ 			brcmf_update_bw40_channel_flag(channel, &ch);
+-		} else {
++			break;
++		default:
++			wiphy_warn(wiphy, "Firmware reported unsupported bandwidth %d\n",
++				   ch.bw);
++			/* fall through */
++		case BRCMU_CHAN_BW_20:
+ 			/* enable the channel and disable other bandwidths
+ 			 * for now as mentioned order assure they are enabled
+ 			 * for subsequent chanspecs.

package/kernel/mac80211/patches/339-v5.1-0007-brcmfmac-support-firmware-reporting-160-MHz-channels.patch

@@ -0,0 +1,30 @@
+From 30519cbe339a45bd11a57ca8ece07f4f6a1cda2e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Mon, 11 Feb 2019 23:04:54 +0100
+Subject: [PATCH] brcmfmac: support firmware reporting 160 MHz channels
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+So far 160 MHz channels were treated as 20 MHz ones which was breaking
+support for 40/80 MHz due to the brcmf_construct_chaninfo() logic and
+its assumptions.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6004,6 +6004,9 @@ static int brcmf_construct_chaninfo(stru
+ 		 * HT40 upper, HT40 lower, and VHT80.
+ 		 */
+ 		switch (ch.bw) {
++		case BRCMU_CHAN_BW_160:
++			channel->flags &= ~IEEE80211_CHAN_NO_160MHZ;
++			break;
+ 		case BRCMU_CHAN_BW_80:
+ 			channel->flags &= ~IEEE80211_CHAN_NO_80MHZ;
+ 			break;

package/kernel/mac80211/patches/339-v5.1-0010-brcmfmac-add-basic-validation-of-shared-RAM-address.patch

@@ -0,0 +1,38 @@
+From e0a8ef4d7b4315bc4c1641fb3f3a7dfdfa6627b8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 20 Feb 2019 11:30:47 +0100
+Subject: [PATCH] brcmfmac: add basic validation of shared RAM address
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+While experimenting with firmware loading I ended up in a state of
+firmware reporting shared RAM address 0x04000001. It was causing:
+[   94.448015] Unable to handle kernel paging request at virtual address cd680001
+due to reading out of the mapped memory.
+
+This patch adds some basic validation to avoid kernel crashes due to the
+unexpected firmware behavior.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -1532,6 +1532,12 @@ static int brcmf_pcie_download_fw_nvram(
+ 		brcmf_err(bus, "FW failed to initialize\n");
+ 		return -ENODEV;
+ 	}
++	if (sharedram_addr < devinfo->ci->rambase ||
++	    sharedram_addr >= devinfo->ci->rambase + devinfo->ci->ramsize) {
++		brcmf_err(bus, "Invalid shared RAM address 0x%08x\n",
++			  sharedram_addr);
++		return -ENODEV;
++	}
+ 	brcmf_dbg(PCIE, "Shared RAM addr: 0x%08x\n", sharedram_addr);
+ 
+ 	return (brcmf_pcie_init_share_ram_info(devinfo, sharedram_addr));

package/kernel/mac80211/patches/339-v5.1-0011-brcmfmac-fix-size-of-the-struct-msgbuf_ring_status.patch

@@ -0,0 +1,29 @@
+From 0c7051610c577b60b01b3b5aec14d6765e177b0d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 21 Feb 2019 11:33:24 +0100
+Subject: [PATCH] brcmfmac: fix size of the struct msgbuf_ring_status
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This updates host struct to match the in-firmawre definition. It's a
+cosmetic change as it only applies to the reserved struct space.
+
+Fixes: c988b78244df ("brcmfmac: print firmware reported ring status errors")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -139,7 +139,7 @@ struct msgbuf_ring_status {
+ 	struct msgbuf_common_hdr	msg;
+ 	struct msgbuf_completion_hdr	compl_hdr;
+ 	__le16				write_idx;
+-	__le32				rsvd0[5];
++	__le16				rsvd0[5];
+ };
+ 
+ struct msgbuf_rx_event {

package/kernel/mac80211/patches/339-v5.1-0012-brcmfmac-print-firmware-reported-general-status-erro.patch

@@ -0,0 +1,69 @@
+From c91377495192cda096e52dc09c266b0d05f16d86 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 21 Feb 2019 11:33:25 +0100
+Subject: [PATCH] brcmfmac: print firmware reported general status errors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Firmware may report general errors using a special message type. Add
+basic support for it by simply decoding & printing an error number.
+
+A sample situation in which firmware reports a buf error:
+CONSOLE: 027084.733 no host response IOCTL buffer available..so fail the request
+will now produce a "Firmware reported general error: 9" on the host.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/msgbuf.c      | 24 +++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -134,6 +134,14 @@ struct msgbuf_completion_hdr {
+ 	__le16				flow_ring_id;
+ };
+ 
++/* Data struct for the MSGBUF_TYPE_GEN_STATUS */
++struct msgbuf_gen_status {
++	struct msgbuf_common_hdr	msg;
++	struct msgbuf_completion_hdr	compl_hdr;
++	__le16				write_idx;
++	__le32				rsvd0[3];
++};
++
+ /* Data struct for the MSGBUF_TYPE_RING_STATUS */
+ struct msgbuf_ring_status {
+ 	struct msgbuf_common_hdr	msg;
+@@ -1192,6 +1200,18 @@ brcmf_msgbuf_process_rx_complete(struct
+ 	brcmf_netif_rx(ifp, skb);
+ }
+ 
++static void brcmf_msgbuf_process_gen_status(struct brcmf_msgbuf *msgbuf,
++					    void *buf)
++{
++	struct msgbuf_gen_status *gen_status = buf;
++	struct brcmf_pub *drvr = msgbuf->drvr;
++	int err;
++
++	err = le16_to_cpu(gen_status->compl_hdr.status);
++	if (err)
++		bphy_err(drvr, "Firmware reported general error: %d\n", err);
++}
++
+ static void brcmf_msgbuf_process_ring_status(struct brcmf_msgbuf *msgbuf,
+ 					     void *buf)
+ {
+@@ -1271,6 +1291,10 @@ static void brcmf_msgbuf_process_msgtype
+ 
+ 	msg = (struct msgbuf_common_hdr *)buf;
+ 	switch (msg->msgtype) {
++	case MSGBUF_TYPE_GEN_STATUS:
++		brcmf_dbg(MSGBUF, "MSGBUF_TYPE_GEN_STATUS\n");
++		brcmf_msgbuf_process_gen_status(msgbuf, buf);
++		break;
+ 	case MSGBUF_TYPE_RING_STATUS:
+ 		brcmf_dbg(MSGBUF, "MSGBUF_TYPE_RING_STATUS\n");
+ 		brcmf_msgbuf_process_ring_status(msgbuf, buf);

package/kernel/mac80211/patches/340-v5.2-0001-brcmfmac-support-repeated-brcmf_fw_alloc_request-cal.patch

@@ -0,0 +1,32 @@
+From c9692820710f57c826b2e43a6fb1e4cd307508b0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 26 Feb 2019 14:11:16 +0100
+Subject: [PATCH] brcmfmac: support repeated brcmf_fw_alloc_request() calls
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+During a normal brcmfmac lifetime brcmf_fw_alloc_request() is called
+once only during the probe. It's safe to assume provided array is clear.
+
+Further brcmfmac improvements may require calling it multiple times
+though. This patch allows it by fixing invalid firmware paths like:
+brcm/brcmfmac4366c-pcie.binbrcm/brcmfmac4366c-pcie.bin
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -582,6 +582,7 @@ int brcmf_fw_map_chip_to_name(u32 chip,
+ 		return -ENODEV;
+ 	}
+ 
++	fw_name[0] = '\0';
+ 	/* check if firmware path is provided by module parameter */
+ 	if (brcmf_mp_global.firmware_path[0] != '\0') {
+ 		strlcpy(fw_name, brcmf_mp_global.firmware_path,

package/kernel/mac80211/patches/340-v5.2-0002-brcmfmac-add-a-function-designated-for-handling-firm.patch

@@ -0,0 +1,79 @@
+From a2ec87ddbf1637f854ffcfff9d12d392fa30758b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 26 Feb 2019 14:11:18 +0100
+Subject: [PATCH] brcmfmac: add a function designated for handling firmware
+ fails
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This improves handling PCIe firmware halts by printing a clear error
+message and replaces a similar code in the SDIO bus support.
+
+It will also allow further improvements like trying to recover from a
+firmware crash.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h |  2 ++
+ .../net/wireless/broadcom/brcm80211/brcmfmac/core.c    | 10 ++++++++++
+ .../net/wireless/broadcom/brcm80211/brcmfmac/pcie.c    |  2 +-
+ .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.c    |  4 ++--
+ 4 files changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -231,6 +231,8 @@ void brcmf_detach(struct device *dev);
+ void brcmf_dev_reset(struct device *dev);
+ /* Request from bus module to initiate a coredump */
+ void brcmf_dev_coredump(struct device *dev);
++/* Indication that firmware has halted or crashed */
++void brcmf_fw_crashed(struct device *dev);
+ 
+ /* Configure the "global" bus state used by upper layers */
+ void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1242,6 +1242,16 @@ void brcmf_dev_coredump(struct device *d
+ 		brcmf_dbg(TRACE, "failed to create coredump\n");
+ }
+ 
++void brcmf_fw_crashed(struct device *dev)
++{
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_pub *drvr = bus_if->drvr;
++
++	bphy_err(drvr, "Firmware has halted or crashed\n");
++
++	brcmf_dev_coredump(dev);
++}
++
+ void brcmf_detach(struct device *dev)
+ {
+ 	s32 i;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -728,7 +728,7 @@ static void brcmf_pcie_handle_mb_data(st
+ 	}
+ 	if (dtoh_mb_data & BRCMF_D2H_DEV_FWHALT) {
+ 		brcmf_dbg(PCIE, "D2H_MB_DATA: FW HALT\n");
+-		brcmf_dev_coredump(&devinfo->pdev->dev);
++		brcmf_fw_crashed(&devinfo->pdev->dev);
+ 	}
+ }
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -1098,8 +1098,8 @@ static u32 brcmf_sdio_hostmail(struct br
+ 
+ 	/* dongle indicates the firmware has halted/crashed */
+ 	if (hmb_data & HMB_DATA_FWHALT) {
+-		brcmf_err("mailbox indicates firmware halted\n");
+-		brcmf_dev_coredump(&sdiod->func[1]->dev);
++		brcmf_dbg(SDIO, "mailbox indicates firmware halted\n");
++		brcmf_fw_crashed(&sdiod->func[1]->dev);
+ 	}
+ 
+ 	/* Dongle recomposed rx frames, accept them again */

package/kernel/mac80211/patches/340-v5.2-0003-brcmfmac-reset-PCIe-bus-on-a-firmware-crash.patch

@@ -0,0 +1,160 @@
+From 4684997d9eea29380000e062755aa6d368d789a3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Tue, 26 Feb 2019 14:11:19 +0100
+Subject: [PATCH] brcmfmac: reset PCIe bus on a firmware crash
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This includes bus reset & reloading a firmware. It should be sufficient
+for a user space to (setup and) use a wireless device again.
+
+Support for reset on USB & SDIO can be added later.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/bus.h         | 10 ++++++
+ .../broadcom/brcm80211/brcmfmac/core.c        | 12 +++++++
+ .../broadcom/brcm80211/brcmfmac/core.h        |  2 ++
+ .../broadcom/brcm80211/brcmfmac/pcie.c        | 35 +++++++++++++++++++
+ 4 files changed, 59 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -87,6 +87,7 @@ struct brcmf_bus_ops {
+ 	void (*wowl_config)(struct device *dev, bool enabled);
+ 	size_t (*get_ramsize)(struct device *dev);
+ 	int (*get_memdump)(struct device *dev, void *data, size_t len);
++	int (*reset)(struct device *dev);
+ };
+ 
+ 
+@@ -214,6 +215,15 @@ int brcmf_bus_get_memdump(struct brcmf_b
+ 	return bus->ops->get_memdump(bus->dev, data, len);
+ }
+ 
++static inline
++int brcmf_bus_reset(struct brcmf_bus *bus)
++{
++	if (!bus->ops->reset)
++		return -EOPNOTSUPP;
++
++	return bus->ops->reset(bus->dev);
++}
++
+ /*
+  * interface functions from common layer
+  */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1052,6 +1052,14 @@ static int brcmf_revinfo_read(struct seq
+ 	return 0;
+ }
+ 
++static void brcmf_core_bus_reset(struct work_struct *work)
++{
++	struct brcmf_pub *drvr = container_of(work, struct brcmf_pub,
++					      bus_reset);
++
++	brcmf_bus_reset(drvr->bus_if);
++}
++
+ int brcmf_bus_started(struct device *dev)
+ {
+ 	int ret = -1;
+@@ -1133,6 +1141,8 @@ int brcmf_bus_started(struct device *dev
+ #endif
+ #endif /* CONFIG_INET */
+ 
++	INIT_WORK(&drvr->bus_reset, brcmf_core_bus_reset);
++
+ 	return 0;
+ 
+ fail:
+@@ -1250,6 +1260,8 @@ void brcmf_fw_crashed(struct device *dev
+ 	bphy_err(drvr, "Firmware has halted or crashed\n");
+ 
+ 	brcmf_dev_coredump(dev);
++
++	schedule_work(&drvr->bus_reset);
+ }
+ 
+ void brcmf_detach(struct device *dev)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+@@ -144,6 +144,8 @@ struct brcmf_pub {
+ 	struct notifier_block inet6addr_notifier;
+ 	struct brcmf_mp_device *settings;
+ 
++	struct work_struct bus_reset;
++
+ 	/* Pointer needed by OpenWrt due to backporting some fixes */
+ 	void *cfg80211_ops;
+ };
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -343,6 +343,8 @@ static const u32 brcmf_ring_itemsize[BRC
+ 	BRCMF_D2H_MSGRING_RX_COMPLETE_ITEMSIZE
+ };
+ 
++static void brcmf_pcie_setup(struct device *dev, const struct firmware *fw,
++			     void *nvram, u32 nvram_len);
+ 
+ static u32
+ brcmf_pcie_read_reg32(struct brcmf_pciedev_info *devinfo, u32 reg_offset)
+@@ -1382,6 +1384,45 @@ static int brcmf_pcie_get_memdump(struct
+ }
+ 
+ 
++static int brcmf_pcie_reset(struct device *dev)
++{
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_pciedev *buspub = bus_if->bus_priv.pcie;
++	struct brcmf_pciedev_info *devinfo = buspub->devinfo;
++	u16 domain_nr;
++	u16 bus_nr;
++	int err;
++
++	brcmf_detach(dev);
++
++	brcmf_pcie_release_irq(devinfo);
++	brcmf_pcie_release_scratchbuffers(devinfo);
++	brcmf_pcie_release_ringbuffers(devinfo);
++	brcmf_pcie_reset_device(devinfo);
++
++	err = brcmf_fw_map_chip_to_name(devinfo->ci->chip, devinfo->ci->chiprev,
++					brcmf_pcie_fwnames,
++					ARRAY_SIZE(brcmf_pcie_fwnames),
++					devinfo->fw_name, devinfo->nvram_name);
++	if (err) {
++		dev_err(dev, "Failed to prepare FW request\n");
++		return err;
++	}
++
++	domain_nr = pci_domain_nr(devinfo->pdev->bus) + 1;
++	bus_nr = devinfo->pdev->bus->number;
++	err = brcmf_fw_get_firmwares_pcie(bus_if->dev, BRCMF_FW_REQUEST_NVRAM |
++						       BRCMF_FW_REQ_NV_OPTIONAL,
++					  devinfo->fw_name, devinfo->nvram_name,
++					  brcmf_pcie_setup, domain_nr, bus_nr);
++	if (err) {
++		dev_err(dev, "Failed to prepare FW request\n");
++		return err;
++	}
++
++	return err;
++}
++
+ static const struct brcmf_bus_ops brcmf_pcie_bus_ops = {
+ 	.txdata = brcmf_pcie_tx,
+ 	.stop = brcmf_pcie_down,
+@@ -1390,6 +1431,7 @@ static const struct brcmf_bus_ops brcmf_
+ 	.wowl_config = brcmf_pcie_wowl_config,
+ 	.get_ramsize = brcmf_pcie_get_ramsize,
+ 	.get_memdump = brcmf_pcie_get_memdump,
++	.reset = brcmf_pcie_reset,
+ };
+ 
+ 

package/kernel/mac80211/patches/341-v5.2-0001-brcmfmac-fix-WARNING-during-USB-disconnect-in-case-o.patch

@@ -0,0 +1,124 @@
+From c80d26e81ef1802f30364b4ad1955c1443a592b9 Mon Sep 17 00:00:00 2001
+From: Piotr Figiel <p.figiel@camlintechnologies.com>
+Date: Mon, 4 Mar 2019 15:42:49 +0000
+Subject: [PATCH] brcmfmac: fix WARNING during USB disconnect in case of
+ unempty psq
+
+brcmu_pkt_buf_free_skb emits WARNING when attempting to free a sk_buff
+which is part of any queue. After USB disconnect this may have happened
+when brcmf_fws_hanger_cleanup() is called as per-interface psq was never
+cleaned when removing the interface.
+Change brcmf_fws_macdesc_cleanup() in a way that it removes the
+corresponding packets from hanger table (to avoid double-free when
+brcmf_fws_hanger_cleanup() is called) and add a call to clean-up the
+interface specific packet queue.
+
+Below is a WARNING during USB disconnect with Raspberry Pi WiFi dongle
+running in AP mode. This was reproducible when the interface was
+transmitting during the disconnect and is fixed with this commit.
+
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 1171 at drivers/net/wireless/broadcom/brcm80211/brcmutil/utils.c:49 brcmu_pkt_buf_free_skb+0x3c/0x40
+Modules linked in: nf_log_ipv4 nf_log_common xt_LOG xt_limit iptable_mangle xt_connmark xt_tcpudp xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter ip_tables x_tables usb_f_mass_storage usb_f_rndis u_ether cdc_acm smsc95xx usbnet ci_hdrc_imx ci_hdrc ulpi usbmisc_imx 8250_exar 8250_pci 8250 8250_base libcomposite configfs udc_core
+CPU: 0 PID: 1171 Comm: kworker/0:0 Not tainted 4.19.23-00075-gde33ed8 #99
+Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
+Workqueue: usb_hub_wq hub_event
+[<8010ff84>] (unwind_backtrace) from [<8010bb64>] (show_stack+0x10/0x14)
+[<8010bb64>] (show_stack) from [<80840278>] (dump_stack+0x88/0x9c)
+[<80840278>] (dump_stack) from [<8011f5ec>] (__warn+0xfc/0x114)
+[<8011f5ec>] (__warn) from [<8011f71c>] (warn_slowpath_null+0x40/0x48)
+[<8011f71c>] (warn_slowpath_null) from [<805a476c>] (brcmu_pkt_buf_free_skb+0x3c/0x40)
+[<805a476c>] (brcmu_pkt_buf_free_skb) from [<805bb6c4>] (brcmf_fws_cleanup+0x1e4/0x22c)
+[<805bb6c4>] (brcmf_fws_cleanup) from [<805bc854>] (brcmf_fws_del_interface+0x58/0x68)
+[<805bc854>] (brcmf_fws_del_interface) from [<805b66ac>] (brcmf_remove_interface+0x40/0x150)
+[<805b66ac>] (brcmf_remove_interface) from [<805b6870>] (brcmf_detach+0x6c/0xb0)
+[<805b6870>] (brcmf_detach) from [<805bdbb8>] (brcmf_usb_disconnect+0x30/0x4c)
+[<805bdbb8>] (brcmf_usb_disconnect) from [<805e5d64>] (usb_unbind_interface+0x5c/0x1e0)
+[<805e5d64>] (usb_unbind_interface) from [<804aab10>] (device_release_driver_internal+0x154/0x1ec)
+[<804aab10>] (device_release_driver_internal) from [<804a97f4>] (bus_remove_device+0xcc/0xf8)
+[<804a97f4>] (bus_remove_device) from [<804a6fc0>] (device_del+0x118/0x308)
+[<804a6fc0>] (device_del) from [<805e488c>] (usb_disable_device+0xa0/0x1c8)
+[<805e488c>] (usb_disable_device) from [<805dcf98>] (usb_disconnect+0x70/0x1d8)
+[<805dcf98>] (usb_disconnect) from [<805ddd84>] (hub_event+0x464/0xf50)
+[<805ddd84>] (hub_event) from [<80135a70>] (process_one_work+0x138/0x3f8)
+[<80135a70>] (process_one_work) from [<80135d5c>] (worker_thread+0x2c/0x554)
+[<80135d5c>] (worker_thread) from [<8013b1a0>] (kthread+0x124/0x154)
+[<8013b1a0>] (kthread) from [<801010e8>] (ret_from_fork+0x14/0x2c)
+Exception stack(0xecf8dfb0 to 0xecf8dff8)
+dfa0:                                     00000000 00000000 00000000 00000000
+dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
+---[ end trace 38d234018e9e2a90 ]---
+------------[ cut here ]------------
+
+Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/fwsignal.c    | 42 +++++++++++--------
+ 1 file changed, 24 insertions(+), 18 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -579,24 +579,6 @@ static bool brcmf_fws_ifidx_match(struct
+ 	return ifidx == *(int *)arg;
+ }
+ 
+-static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q,
+-				int ifidx)
+-{
+-	bool (*matchfn)(struct sk_buff *, void *) = NULL;
+-	struct sk_buff *skb;
+-	int prec;
+-
+-	if (ifidx != -1)
+-		matchfn = brcmf_fws_ifidx_match;
+-	for (prec = 0; prec < q->num_prec; prec++) {
+-		skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
+-		while (skb) {
+-			brcmu_pkt_buf_free_skb(skb);
+-			skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
+-		}
+-	}
+-}
+-
+ static void brcmf_fws_hanger_init(struct brcmf_fws_hanger *hanger)
+ {
+ 	int i;
+@@ -668,6 +650,28 @@ static inline int brcmf_fws_hanger_poppk
+ 	return 0;
+ }
+ 
++static void brcmf_fws_psq_flush(struct brcmf_fws_info *fws, struct pktq *q,
++				int ifidx)
++{
++	bool (*matchfn)(struct sk_buff *, void *) = NULL;
++	struct sk_buff *skb;
++	int prec;
++	u32 hslot;
++
++	if (ifidx != -1)
++		matchfn = brcmf_fws_ifidx_match;
++	for (prec = 0; prec < q->num_prec; prec++) {
++		skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
++		while (skb) {
++			hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
++			brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
++						true);
++			brcmu_pkt_buf_free_skb(skb);
++			skb = brcmu_pktq_pdeq_match(q, prec, matchfn, &ifidx);
++		}
++	}
++}
++
+ static int brcmf_fws_hanger_mark_suppressed(struct brcmf_fws_hanger *h,
+ 					    u32 slot_id)
+ {
+@@ -2174,6 +2178,8 @@ void brcmf_fws_del_interface(struct brcm
+ 	brcmf_fws_lock(fws);
+ 	ifp->fws_desc = NULL;
+ 	brcmf_dbg(TRACE, "deleting %s\n", entry->name);
++	brcmf_fws_macdesc_cleanup(fws, &fws->desc.iface[ifp->ifidx],
++				  ifp->ifidx);
+ 	brcmf_fws_macdesc_deinit(entry);
+ 	brcmf_fws_cleanup(fws, ifp->ifidx);
+ 	brcmf_fws_unlock(fws);

package/kernel/mac80211/patches/341-v5.2-0002-brcmfmac-fix-NULL-pointer-derefence-during-USB-disco.patch

@@ -0,0 +1,217 @@
+From 5cdb0ef6144f47440850553579aa923c20a63f23 Mon Sep 17 00:00:00 2001
+From: Piotr Figiel <p.figiel@camlintechnologies.com>
+Date: Mon, 4 Mar 2019 15:42:52 +0000
+Subject: [PATCH] brcmfmac: fix NULL pointer derefence during USB disconnect
+
+In case USB disconnect happens at the moment transmitting workqueue is in
+progress the underlying interface may be gone causing a NULL pointer
+dereference. Add synchronization of the workqueue destruction with the
+detach implementation in core so that the transmitting workqueue is stopped
+during detach before the interfaces are removed.
+
+Fix following Oops:
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000008
+pgd = 9e6a802d
+[00000008] *pgd=00000000
+Internal error: Oops: 5 [#1] PREEMPT SMP ARM
+Modules linked in: nf_log_ipv4 nf_log_common xt_LOG xt_limit iptable_mangle
+xt_connmark xt_tcpudp xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4
+iptable_filter ip_tables x_tables usb_f_mass_storage usb_f_rndis u_ether
+usb_serial_simple usbserial cdc_acm brcmfmac brcmutil smsc95xx usbnet
+ci_hdrc_imx ci_hdrc ulpi usbmisc_imx 8250_exar 8250_pci 8250 8250_base
+libcomposite configfs udc_core
+CPU: 0 PID: 7 Comm: kworker/u8:0 Not tainted 4.19.23-00076-g03740aa-dirty #102
+Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
+Workqueue: brcmf_fws_wq brcmf_fws_dequeue_worker [brcmfmac]
+PC is at brcmf_txfinalize+0x34/0x90 [brcmfmac]
+LR is at brcmf_fws_dequeue_worker+0x218/0x33c [brcmfmac]
+pc : [<7f0dee64>]    lr : [<7f0e4140>]    psr: 60010093
+sp : ee8abef0  ip : 00000000  fp : edf38000
+r10: ffffffed  r9 : edf38970  r8 : edf38004
+r7 : edf3e970  r6 : 00000000  r5 : ede69000  r4 : 00000000
+r3 : 00000a97  r2 : 00000000  r1 : 0000888e  r0 : ede69000
+Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment none
+Control: 10c5387d  Table: 7d03c04a  DAC: 00000051
+Process kworker/u8:0 (pid: 7, stack limit = 0x24ec3e04)
+Stack: (0xee8abef0 to 0xee8ac000)
+bee0:                                     ede69000 00000000 ed56c3e0 7f0e4140
+bf00: 00000001 00000000 edf38004 edf3e99c ed56c3e0 80d03d00 edfea43a edf3e970
+bf20: ee809880 ee804200 ee971100 00000000 edf3e974 00000000 ee804200 80135a70
+bf40: 80d03d00 ee804218 ee809880 ee809894 ee804200 80d03d00 ee804218 ee8aa000
+bf60: 00000088 80135d5c 00000000 ee829f00 ee829dc0 00000000 ee809880 80135d30
+bf80: ee829f1c ee873eac 00000000 8013b1a0 ee829dc0 8013b07c 00000000 00000000
+bfa0: 00000000 00000000 00000000 801010e8 00000000 00000000 00000000 00000000
+bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000
+[<7f0dee64>] (brcmf_txfinalize [brcmfmac]) from [<7f0e4140>] (brcmf_fws_dequeue_worker+0x218/0x33c [brcmfmac])
+[<7f0e4140>] (brcmf_fws_dequeue_worker [brcmfmac]) from [<80135a70>] (process_one_work+0x138/0x3f8)
+[<80135a70>] (process_one_work) from [<80135d5c>] (worker_thread+0x2c/0x554)
+[<80135d5c>] (worker_thread) from [<8013b1a0>] (kthread+0x124/0x154)
+[<8013b1a0>] (kthread) from [<801010e8>] (ret_from_fork+0x14/0x2c)
+Exception stack(0xee8abfb0 to 0xee8abff8)
+bfa0:                                     00000000 00000000 00000000 00000000
+bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+bfe0: 00000000 00000000 00000000 00000000 00000013 00000000
+Code: e1530001 0a000007 e3560000 e1a00005 (05942008)
+---[ end trace 079239dd31c86e90 ]---
+
+Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c  | 11 +++++++++--
+ .../wireless/broadcom/brcm80211/brcmfmac/bcdc.h  |  6 ++++--
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c  |  4 +++-
+ .../broadcom/brcm80211/brcmfmac/fwsignal.c       | 16 ++++++++++++----
+ .../broadcom/brcm80211/brcmfmac/fwsignal.h       |  3 ++-
+ .../wireless/broadcom/brcm80211/brcmfmac/proto.c | 10 ++++++++--
+ .../wireless/broadcom/brcm80211/brcmfmac/proto.h |  3 ++-
+ 7 files changed, 40 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -479,11 +479,18 @@ fail:
+ 	return -ENOMEM;
+ }
+ 
+-void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr)
++void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr)
++{
++	struct brcmf_bcdc *bcdc = drvr->proto->pd;
++
++	brcmf_fws_detach_pre_delif(bcdc->fws);
++}
++
++void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr)
+ {
+ 	struct brcmf_bcdc *bcdc = drvr->proto->pd;
+ 
+ 	drvr->proto->pd = NULL;
+-	brcmf_fws_detach(bcdc->fws);
++	brcmf_fws_detach_post_delif(bcdc->fws);
+ 	kfree(bcdc);
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
+@@ -18,14 +18,16 @@
+ 
+ #ifdef CPTCFG_BRCMFMAC_PROTO_BCDC
+ int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr);
+-void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr);
++void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr);
++void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr);
+ void brcmf_proto_bcdc_txflowblock(struct device *dev, bool state);
+ void brcmf_proto_bcdc_txcomplete(struct device *dev, struct sk_buff *txp,
+ 				 bool success);
+ struct brcmf_fws_info *drvr_to_fws(struct brcmf_pub *drvr);
+ #else
+ static inline int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr) { return 0; }
+-static inline void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr) {}
++static void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr) {};
++static inline void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr) {}
+ #endif
+ 
+ #endif /* BRCMFMAC_BCDC_H */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1290,6 +1290,8 @@ void brcmf_detach(struct device *dev)
+ 
+ 	brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
+ 
++	brcmf_proto_detach_pre_delif(drvr);
++
+ 	/* make sure primary interface removed last */
+ 	for (i = BRCMF_MAX_IFS-1; i > -1; i--)
+ 		brcmf_remove_interface(drvr->iflist[i], false);
+@@ -1299,7 +1301,7 @@ void brcmf_detach(struct device *dev)
+ 
+ 	brcmf_bus_stop(drvr->bus_if);
+ 
+-	brcmf_proto_detach(drvr);
++	brcmf_proto_detach_post_delif(drvr);
+ 
+ 	brcmf_debug_detach(drvr);
+ 	bus_if->drvr = NULL;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -2420,17 +2420,25 @@ struct brcmf_fws_info *brcmf_fws_attach(
+ 	return fws;
+ 
+ fail:
+-	brcmf_fws_detach(fws);
++	brcmf_fws_detach_pre_delif(fws);
++	brcmf_fws_detach_post_delif(fws);
+ 	return ERR_PTR(rc);
+ }
+ 
+-void brcmf_fws_detach(struct brcmf_fws_info *fws)
++void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws)
+ {
+ 	if (!fws)
+ 		return;
+-
+-	if (fws->fws_wq)
++	if (fws->fws_wq) {
+ 		destroy_workqueue(fws->fws_wq);
++		fws->fws_wq = NULL;
++	}
++}
++
++void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws)
++{
++	if (!fws)
++		return;
+ 
+ 	/* cleanup */
+ 	brcmf_fws_lock(fws);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
+@@ -19,7 +19,8 @@
+ #define FWSIGNAL_H_
+ 
+ struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr);
+-void brcmf_fws_detach(struct brcmf_fws_info *fws);
++void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws);
++void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws);
+ bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws);
+ bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
+ void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
+@@ -66,16 +66,22 @@ fail:
+ 	return -ENOMEM;
+ }
+ 
+-void brcmf_proto_detach(struct brcmf_pub *drvr)
++void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr)
+ {
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+ 	if (drvr->proto) {
+ 		if (drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
+-			brcmf_proto_bcdc_detach(drvr);
++			brcmf_proto_bcdc_detach_post_delif(drvr);
+ 		else if (drvr->bus_if->proto_type == BRCMF_PROTO_MSGBUF)
+ 			brcmf_proto_msgbuf_detach(drvr);
+ 		kfree(drvr->proto);
+ 		drvr->proto = NULL;
+ 	}
+ }
++
++void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr)
++{
++	if (drvr->proto && drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
++		brcmf_proto_bcdc_detach_pre_delif(drvr);
++}
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
+@@ -53,7 +53,8 @@ struct brcmf_proto {
+ 
+ 
+ int brcmf_proto_attach(struct brcmf_pub *drvr);
+-void brcmf_proto_detach(struct brcmf_pub *drvr);
++void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr);
++void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr);
+ 
+ static inline int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws,
+ 				      struct sk_buff *skb,

package/kernel/mac80211/patches/342-v5.2-0001-brcmfmac-fix-race-during-disconnect-when-USB-complet.patch

@@ -0,0 +1,84 @@
+From db3b9e2e1d58080d0754bdf9293dabf8c6491b67 Mon Sep 17 00:00:00 2001
+From: Piotr Figiel <p.figiel@camlintechnologies.com>
+Date: Fri, 8 Mar 2019 15:25:04 +0000
+Subject: [PATCH] brcmfmac: fix race during disconnect when USB completion is
+ in progress
+
+It was observed that rarely during USB disconnect happening shortly after
+connect (before full initialization completes) usb_hub_wq would wait
+forever for the dev_init_lock to be unlocked. dev_init_lock would remain
+locked though because of infinite wait during usb_kill_urb:
+
+[ 2730.656472] kworker/0:2     D    0   260      2 0x00000000
+[ 2730.660700] Workqueue: events request_firmware_work_func
+[ 2730.664807] [<809dca20>] (__schedule) from [<809dd164>] (schedule+0x4c/0xac)
+[ 2730.670587] [<809dd164>] (schedule) from [<8069af44>] (usb_kill_urb+0xdc/0x114)
+[ 2730.676815] [<8069af44>] (usb_kill_urb) from [<7f258b50>] (brcmf_usb_free_q+0x34/0xa8 [brcmfmac])
+[ 2730.684833] [<7f258b50>] (brcmf_usb_free_q [brcmfmac]) from [<7f2517d4>] (brcmf_detach+0xa0/0xb8 [brcmfmac])
+[ 2730.693557] [<7f2517d4>] (brcmf_detach [brcmfmac]) from [<7f251a34>] (brcmf_attach+0xac/0x3d8 [brcmfmac])
+[ 2730.702094] [<7f251a34>] (brcmf_attach [brcmfmac]) from [<7f2587ac>] (brcmf_usb_probe_phase2+0x468/0x4a0 [brcmfmac])
+[ 2730.711601] [<7f2587ac>] (brcmf_usb_probe_phase2 [brcmfmac]) from [<7f252888>] (brcmf_fw_request_done+0x194/0x220 [brcmfmac])
+[ 2730.721795] [<7f252888>] (brcmf_fw_request_done [brcmfmac]) from [<805748e4>] (request_firmware_work_func+0x4c/0x88)
+[ 2730.731125] [<805748e4>] (request_firmware_work_func) from [<80141474>] (process_one_work+0x228/0x808)
+[ 2730.739223] [<80141474>] (process_one_work) from [<80141a80>] (worker_thread+0x2c/0x564)
+[ 2730.746105] [<80141a80>] (worker_thread) from [<80147bcc>] (kthread+0x13c/0x16c)
+[ 2730.752227] [<80147bcc>] (kthread) from [<801010b4>] (ret_from_fork+0x14/0x20)
+
+[ 2733.099695] kworker/0:3     D    0  1065      2 0x00000000
+[ 2733.103926] Workqueue: usb_hub_wq hub_event
+[ 2733.106914] [<809dca20>] (__schedule) from [<809dd164>] (schedule+0x4c/0xac)
+[ 2733.112693] [<809dd164>] (schedule) from [<809e2a8c>] (schedule_timeout+0x214/0x3e4)
+[ 2733.119621] [<809e2a8c>] (schedule_timeout) from [<809dde2c>] (wait_for_common+0xc4/0x1c0)
+[ 2733.126810] [<809dde2c>] (wait_for_common) from [<7f258d00>] (brcmf_usb_disconnect+0x1c/0x4c [brcmfmac])
+[ 2733.135206] [<7f258d00>] (brcmf_usb_disconnect [brcmfmac]) from [<8069e0c8>] (usb_unbind_interface+0x5c/0x1e4)
+[ 2733.143943] [<8069e0c8>] (usb_unbind_interface) from [<8056d3e8>] (device_release_driver_internal+0x164/0x1fc)
+[ 2733.152769] [<8056d3e8>] (device_release_driver_internal) from [<8056c078>] (bus_remove_device+0xd0/0xfc)
+[ 2733.161138] [<8056c078>] (bus_remove_device) from [<8056977c>] (device_del+0x11c/0x310)
+[ 2733.167939] [<8056977c>] (device_del) from [<8069cba8>] (usb_disable_device+0xa0/0x1cc)
+[ 2733.174743] [<8069cba8>] (usb_disable_device) from [<8069507c>] (usb_disconnect+0x74/0x1dc)
+[ 2733.181823] [<8069507c>] (usb_disconnect) from [<80695e88>] (hub_event+0x478/0xf88)
+[ 2733.188278] [<80695e88>] (hub_event) from [<80141474>] (process_one_work+0x228/0x808)
+[ 2733.194905] [<80141474>] (process_one_work) from [<80141a80>] (worker_thread+0x2c/0x564)
+[ 2733.201724] [<80141a80>] (worker_thread) from [<80147bcc>] (kthread+0x13c/0x16c)
+[ 2733.207913] [<80147bcc>] (kthread) from [<801010b4>] (ret_from_fork+0x14/0x20)
+
+It was traced down to a case where usb_kill_urb would be called on an URB
+structure containing more or less random data, including large number in
+its use_count. During the debugging it appeared that in brcmf_usb_free_q()
+the traversal over URBs' lists is not synchronized with operations on those
+lists in brcmf_usb_rx_complete() leading to handling
+brcmf_usbdev_info structure (holding lists' head) as lists' element and in
+result causing above problem.
+
+Fix it by walking through all URBs during brcmf_cancel_all_urbs using the
+arrays of requests instead of linked lists.
+
+Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -684,12 +684,18 @@ static int brcmf_usb_up(struct device *d
+ 
+ static void brcmf_cancel_all_urbs(struct brcmf_usbdev_info *devinfo)
+ {
++	int i;
++
+ 	if (devinfo->ctl_urb)
+ 		usb_kill_urb(devinfo->ctl_urb);
+ 	if (devinfo->bulk_urb)
+ 		usb_kill_urb(devinfo->bulk_urb);
+-	brcmf_usb_free_q(&devinfo->tx_postq, true);
+-	brcmf_usb_free_q(&devinfo->rx_postq, true);
++	if (devinfo->tx_reqs)
++		for (i = 0; i < devinfo->bus_pub.ntxq; i++)
++			usb_kill_urb(devinfo->tx_reqs[i].urb);
++	if (devinfo->rx_reqs)
++		for (i = 0; i < devinfo->bus_pub.nrxq; i++)
++			usb_kill_urb(devinfo->rx_reqs[i].urb);
+ }
+ 
+ static void brcmf_usb_down(struct device *dev)

package/kernel/mac80211/patches/342-v5.2-0002-brcmfmac-remove-pending-parameter-from-brcmf_usb_fre.patch

@@ -0,0 +1,54 @@
+From 2b78e5f5223666d403d4fdb30af4ad65c8da3cdb Mon Sep 17 00:00:00 2001
+From: Piotr Figiel <p.figiel@camlintechnologies.com>
+Date: Fri, 8 Mar 2019 15:25:06 +0000
+Subject: [PATCH] brcmfmac: remove pending parameter from brcmf_usb_free_q
+
+brcmf_usb_free_q is no longer called with pending=true thus this boolean
+parameter is no longer needed.
+
+Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/usb.c    | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -445,9 +445,10 @@ fail:
+ 
+ }
+ 
+-static void brcmf_usb_free_q(struct list_head *q, bool pending)
++static void brcmf_usb_free_q(struct list_head *q)
+ {
+ 	struct brcmf_usbreq *req, *next;
++
+ 	int i = 0;
+ 	list_for_each_entry_safe(req, next, q, list) {
+ 		if (!req->urb) {
+@@ -455,12 +456,8 @@ static void brcmf_usb_free_q(struct list
+ 			break;
+ 		}
+ 		i++;
+-		if (pending) {
+-			usb_kill_urb(req->urb);
+-		} else {
+-			usb_free_urb(req->urb);
+-			list_del_init(&req->list);
+-		}
++		usb_free_urb(req->urb);
++		list_del_init(&req->list);
+ 	}
+ }
+ 
+@@ -1031,8 +1028,8 @@ static void brcmf_usb_detach(struct brcm
+ 	brcmf_dbg(USB, "Enter, devinfo %p\n", devinfo);
+ 
+ 	/* free the URBS */
+-	brcmf_usb_free_q(&devinfo->rx_freeq, false);
+-	brcmf_usb_free_q(&devinfo->tx_freeq, false);
++	brcmf_usb_free_q(&devinfo->rx_freeq);
++	brcmf_usb_free_q(&devinfo->tx_freeq);
+ 
+ 	usb_free_urb(devinfo->ctl_urb);
+ 	usb_free_urb(devinfo->bulk_urb);

package/kernel/mac80211/patches/342-v5.2-0003-brcmfmac-remove-unused-variable-i-from-brcmf_usb_fre.patch

@@ -0,0 +1,29 @@
+From 504f06725d015954a0fcafdf1d90a6795ca8f769 Mon Sep 17 00:00:00 2001
+From: Piotr Figiel <p.figiel@camlintechnologies.com>
+Date: Fri, 8 Mar 2019 15:25:09 +0000
+Subject: [PATCH] brcmfmac: remove unused variable i from brcmf_usb_free_q
+
+Variable i is not used so remove it.
+
+Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -449,13 +449,11 @@ static void brcmf_usb_free_q(struct list
+ {
+ 	struct brcmf_usbreq *req, *next;
+ 
+-	int i = 0;
+ 	list_for_each_entry_safe(req, next, q, list) {
+ 		if (!req->urb) {
+ 			brcmf_err("bad req\n");
+ 			break;
+ 		}
+-		i++;
+ 		usb_free_urb(req->urb);
+ 		list_del_init(&req->list);
+ 	}

package/kernel/mac80211/patches/343-v5.2-brcmfmac-fix-Oops-when-bringing-up-interface-during-.patch

@@ -0,0 +1,123 @@
+From 24d413a31afaee9bbbf79226052c386b01780ce2 Mon Sep 17 00:00:00 2001
+From: Piotr Figiel <p.figiel@camlintechnologies.com>
+Date: Wed, 13 Mar 2019 09:52:01 +0000
+Subject: [PATCH] brcmfmac: fix Oops when bringing up interface during USB
+ disconnect
+
+Fix a race which leads to an Oops with NULL pointer dereference.  The
+dereference is in brcmf_config_dongle() when cfg_to_ndev() attempts to get
+net_device structure of interface with index 0 via if2bss mapping. This
+shouldn't fail because of check for bus being ready in brcmf_netdev_open(),
+but it's not synchronised with USB disconnect and there is a race: after
+the check the bus can be marked down and the mapping for interface 0 may be
+gone.
+
+Solve this by modifying disconnect handling so that the removal of mapping
+of ifidx to brcmf_if structure happens after netdev removal (which is
+synchronous with brcmf_netdev_open() thanks to rtln being locked in
+devinet_ioctl()). This assures brcmf_netdev_open() returns before the
+mapping is removed during disconnect.
+
+Unable to handle kernel NULL pointer dereference at virtual address 00000008
+pgd = bcae2612
+[00000008] *pgd=8be73831
+Internal error: Oops: 17 [#1] PREEMPT SMP ARM
+Modules linked in: brcmfmac brcmutil nf_log_ipv4 nf_log_common xt_LOG xt_limit
+iptable_mangle xt_connmark xt_tcpudp xt_conntrack nf_conntrack nf_defrag_ipv6
+nf_defrag_ipv4 iptable_filter ip_tables x_tables usb_f_mass_storage usb_f_rndis
+u_ether usb_serial_simple usbserial cdc_acm smsc95xx usbnet ci_hdrc_imx ci_hdrc
+usbmisc_imx ulpi 8250_exar 8250_pci 8250 8250_base libcomposite configfs
+udc_core [last unloaded: brcmutil]
+CPU: 2 PID: 24478 Comm: ifconfig Not tainted 4.19.23-00078-ga62866d-dirty #115
+Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
+PC is at brcmf_cfg80211_up+0x94/0x29c [brcmfmac]
+LR is at brcmf_cfg80211_up+0x8c/0x29c [brcmfmac]
+pc : [<7f26a91c>]    lr : [<7f26a914>]    psr: a0070013
+sp : eca99d28  ip : 00000000  fp : ee9c6c00
+r10: 00000036  r9 : 00000000  r8 : ece4002c
+r7 : edb5b800  r6 : 00000000  r5 : 80f08448  r4 : edb5b968
+r3 : ffffffff  r2 : 00000000  r1 : 00000002  r0 : 00000000
+Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
+Control: 10c5387d  Table: 7ca0c04a  DAC: 00000051
+Process ifconfig (pid: 24478, stack limit = 0xd9e85a0e)
+Stack: (0xeca99d28 to 0xeca9a000)
+9d20:                   00000000 80f873b0 0000000d 80f08448 eca99d68 50d45f32
+9d40: 7f27de94 ece40000 80f08448 80f08448 7f27de94 ece4002c 00000000 00000036
+9d60: ee9c6c00 7f27262c 00001002 50d45f32 ece40000 00000000 80f08448 80772008
+9d80: 00000001 00001043 00001002 ece40000 00000000 50d45f32 ece40000 00000001
+9da0: 80f08448 00001043 00001002 807723d0 00000000 50d45f32 80f08448 eca99e58
+9dc0: 80f87113 50d45f32 80f08448 ece40000 ece40138 00001002 80f08448 00000000
+9de0: 00000000 80772434 edbd5380 eca99e58 edbd5380 80f08448 ee9c6c0c 80805f70
+9e00: 00000000 ede08e00 00008914 ece40000 00000014 ee9c6c0c 600c0013 00001043
+9e20: 0208a8c0 ffffffff 00000000 50d45f32 eca98000 80f08448 7ee9fc38 00008914
+9e40: 80f68e40 00000051 eca98000 00000036 00000003 80808b9c 6e616c77 00000030
+9e60: 00000000 00000000 00001043 0208a8c0 ffffffff 00000000 80f08448 00000000
+9e80: 00000000 816d8b20 600c0013 00000001 ede09320 801763d4 00000000 50d45f32
+9ea0: eca98000 80f08448 7ee9fc38 50d45f32 00008914 80f08448 7ee9fc38 80f68e40
+9ec0: ed531540 8074721c 00000800 00000001 00000000 6e616c77 00000030 00000000
+9ee0: 00000000 00001002 0208a8c0 ffffffff 00000000 50d45f32 80f08448 7ee9fc38
+9f00: ed531560 ec8fc900 80285a6c 80285138 edb910c0 00000000 ecd91008 ede08e00
+9f20: 80f08448 00000000 00000000 816d8b20 600c0013 00000001 ede09320 801763d4
+9f40: 00000000 50d45f32 00021000 edb91118 edb910c0 80f08448 01b29000 edb91118
+9f60: eca99f7c 50d45f32 00021000 ec8fc900 00000003 ec8fc900 00008914 7ee9fc38
+9f80: eca98000 00000036 00000003 80285a6c 00086364 7ee9fe1c 000000c3 00000036
+9fa0: 801011c4 80101000 00086364 7ee9fe1c 00000003 00008914 7ee9fc38 00086364
+9fc0: 00086364 7ee9fe1c 000000c3 00000036 0008630c 7ee9fe1c 7ee9fc38 00000003
+9fe0: 000a42b8 7ee9fbd4 00019914 76e09acc 600c0010 00000003 00000000 00000000
+[<7f26a91c>] (brcmf_cfg80211_up [brcmfmac]) from [<7f27262c>] (brcmf_netdev_open+0x74/0xe8 [brcmfmac])
+[<7f27262c>] (brcmf_netdev_open [brcmfmac]) from [<80772008>] (__dev_open+0xcc/0x150)
+[<80772008>] (__dev_open) from [<807723d0>] (__dev_change_flags+0x168/0x1b4)
+[<807723d0>] (__dev_change_flags) from [<80772434>] (dev_change_flags+0x18/0x48)
+[<80772434>] (dev_change_flags) from [<80805f70>] (devinet_ioctl+0x67c/0x79c)
+[<80805f70>] (devinet_ioctl) from [<80808b9c>] (inet_ioctl+0x210/0x3d4)
+[<80808b9c>] (inet_ioctl) from [<8074721c>] (sock_ioctl+0x350/0x524)
+[<8074721c>] (sock_ioctl) from [<80285138>] (do_vfs_ioctl+0xb0/0x9b0)
+[<80285138>] (do_vfs_ioctl) from [<80285a6c>] (ksys_ioctl+0x34/0x5c)
+[<80285a6c>] (ksys_ioctl) from [<80101000>] (ret_fast_syscall+0x0/0x28)
+Exception stack(0xeca99fa8 to 0xeca99ff0)
+9fa0:                   00086364 7ee9fe1c 00000003 00008914 7ee9fc38 00086364
+9fc0: 00086364 7ee9fe1c 000000c3 00000036 0008630c 7ee9fe1c 7ee9fc38 00000003
+9fe0: 000a42b8 7ee9fbd4 00019914 76e09acc
+Code: e5970328 eb002021 e1a02006 e3a01002 (e5909008)
+---[ end trace 5cbac2333f3ac5df ]---
+
+Signed-off-by: Piotr Figiel <p.figiel@camlintechnologies.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/core.c    | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -810,17 +810,17 @@ static void brcmf_del_if(struct brcmf_pu
+ 			 bool rtnl_locked)
+ {
+ 	struct brcmf_if *ifp;
++	int ifidx;
+ 
+ 	ifp = drvr->iflist[bsscfgidx];
+-	drvr->iflist[bsscfgidx] = NULL;
+ 	if (!ifp) {
+ 		bphy_err(drvr, "Null interface, bsscfgidx=%d\n", bsscfgidx);
+ 		return;
+ 	}
+ 	brcmf_dbg(TRACE, "Enter, bsscfgidx=%d, ifidx=%d\n", bsscfgidx,
+ 		  ifp->ifidx);
+-	if (drvr->if2bss[ifp->ifidx] == bsscfgidx)
+-		drvr->if2bss[ifp->ifidx] = BRCMF_BSSIDX_INVALID;
++	ifidx = ifp->ifidx;
++
+ 	if (ifp->ndev) {
+ 		if (bsscfgidx == 0) {
+ 			if (ifp->ndev->netdev_ops == &brcmf_netdev_ops_pri) {
+@@ -848,6 +848,10 @@ static void brcmf_del_if(struct brcmf_pu
+ 		brcmf_p2p_ifp_removed(ifp, rtnl_locked);
+ 		kfree(ifp);
+ 	}
++
++	drvr->iflist[bsscfgidx] = NULL;
++	if (drvr->if2bss[ifidx] == bsscfgidx)
++		drvr->if2bss[ifidx] = BRCMF_BSSIDX_INVALID;
+ }
+ 
+ void brcmf_remove_interface(struct brcmf_if *ifp, bool rtnl_locked)

package/kernel/mac80211/patches/344-v5.2-brcmfmac-fix-missing-checks-for-kmemdup.patch

@@ -0,0 +1,35 @@
+From 46953f97224d56a12ccbe9c6acaa84ca0dab2780 Mon Sep 17 00:00:00 2001
+From: Kangjie Lu <kjlu@umn.edu>
+Date: Fri, 15 Mar 2019 12:04:32 -0500
+Subject: [PATCH] brcmfmac: fix missing checks for kmemdup
+
+In case kmemdup fails, the fix sets conn_info->req_ie_len and
+conn_info->resp_ie_len to zero to avoid buffer overflows.
+
+Signed-off-by: Kangjie Lu <kjlu@umn.edu>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -5436,6 +5436,8 @@ static s32 brcmf_get_assoc_ies(struct br
+ 		conn_info->req_ie =
+ 		    kmemdup(cfg->extra_buf, conn_info->req_ie_len,
+ 			    GFP_KERNEL);
++		if (!conn_info->req_ie)
++			conn_info->req_ie_len = 0;
+ 	} else {
+ 		conn_info->req_ie_len = 0;
+ 		conn_info->req_ie = NULL;
+@@ -5452,6 +5454,8 @@ static s32 brcmf_get_assoc_ies(struct br
+ 		conn_info->resp_ie =
+ 		    kmemdup(cfg->extra_buf, conn_info->resp_ie_len,
+ 			    GFP_KERNEL);
++		if (!conn_info->resp_ie)
++			conn_info->resp_ie_len = 0;
+ 	} else {
+ 		conn_info->resp_ie_len = 0;
+ 		conn_info->resp_ie = NULL;

package/kernel/mac80211/patches/345-v5.2-brcmfmac-Loading-the-correct-firmware-for-brcm43456.patch

@@ -0,0 +1,35 @@
+From e3062e05e1cfe378bb9b3fa0bef46711372bcf13 Mon Sep 17 00:00:00 2001
+From: Ondrej Jirman <megous@megous.com>
+Date: Sat, 6 Apr 2019 01:45:13 +0200
+Subject: [PATCH] brcmfmac: Loading the correct firmware for brcm43456
+
+SDIO based brcm43456 is currently misdetected as brcm43455 and the wrong
+firmware name is used. Correct the detection and load the correct
+firmware file. Chiprev for brcm43456 is "9".
+
+Signed-off-by: Ondrej Jirman <megous@megous.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -617,6 +617,7 @@ BRCMF_FW_NVRAM_DEF(43430A0, "brcmfmac434
+ /* Note the names are not postfixed with a1 for backward compatibility */
+ BRCMF_FW_NVRAM_DEF(43430A1, "brcmfmac43430-sdio.bin", "brcmfmac43430-sdio.txt");
+ BRCMF_FW_NVRAM_DEF(43455, "brcmfmac43455-sdio.bin", "brcmfmac43455-sdio.txt");
++BRCMF_FW_NVRAM_DEF(43456, "brcmfmac43456-sdio.bin", "brcmfmac43456-sdio.txt");
+ BRCMF_FW_NVRAM_DEF(4354, "brcmfmac4354-sdio.bin", "brcmfmac4354-sdio.txt");
+ BRCMF_FW_NVRAM_DEF(4356, "brcmfmac4356-sdio.bin", "brcmfmac4356-sdio.txt");
+ BRCMF_FW_NVRAM_DEF(4373, "brcmfmac4373-sdio.bin", "brcmfmac4373-sdio.txt");
+@@ -636,7 +637,8 @@ static struct brcmf_firmware_mapping brc
+ 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, 4339),
+ 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43430_CHIP_ID, 0x00000001, 43430A0),
+ 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_43430_CHIP_ID, 0xFFFFFFFE, 43430A1),
+-	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4345_CHIP_ID, 0xFFFFFFC0, 43455),
++	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4345_CHIP_ID, 0x00000200, 43456),
++	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4345_CHIP_ID, 0xFFFFFDC0, 43455),
+ 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4354_CHIP_ID, 0xFFFFFFFF, 4354),
+ 	BRCMF_FW_NVRAM_ENTRY(BRCM_CC_4356_CHIP_ID, 0xFFFFFFFF, 4356),
+ 	BRCMF_FW_NVRAM_ENTRY(CY_CC_4373_CHIP_ID, 0xFFFFFFFF, 4373)

package/kernel/mac80211/patches/346-v5.2-brcmfmac-send-mailbox-interrupt-twice-for-specific-h.patch

@@ -0,0 +1,39 @@
+From 9ef77fbedad9ea8895cd5d7fb7aee16071f527dc Mon Sep 17 00:00:00 2001
+From: Wright Feng <Wright.Feng@cypress.com>
+Date: Fri, 26 Apr 2019 03:12:32 +0000
+Subject: [PATCH] brcmfmac: send mailbox interrupt twice for specific hardware
+ device
+
+For PCIE wireless device with core revision less than 14, device may miss
+PCIE to System Backplane Interrupt via PCIEtoSBMailbox. So add sending
+mail box interrupt twice as a hardware workaround.
+
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -671,6 +671,7 @@ static int
+ brcmf_pcie_send_mb_data(struct brcmf_pciedev_info *devinfo, u32 htod_mb_data)
+ {
+ 	struct brcmf_pcie_shared_info *shared;
++	struct brcmf_core *core;
+ 	u32 addr;
+ 	u32 cur_htod_mb_data;
+ 	u32 i;
+@@ -694,7 +695,11 @@ brcmf_pcie_send_mb_data(struct brcmf_pci
+ 
+ 	brcmf_pcie_write_tcm32(devinfo, addr, htod_mb_data);
+ 	pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1);
+-	pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1);
++
++	/* Send mailbox interrupt twice as a hardware workaround */
++	core = brcmf_chip_get_core(devinfo->ci, BCMA_CORE_PCIE2);
++	if (core->rev <= 13)
++		pci_write_config_dword(devinfo->pdev, BRCMF_PCIE_REG_SBMBX, 1);
+ 
+ 	return 0;
+ }

package/kernel/mac80211/patches/347-v5.2-brcm80211-potential-NULL-dereference-in-brcmf_cfg802.patch

@@ -0,0 +1,50 @@
+From e025da3d7aa4770bb1d1b3b0aa7cc4da1744852d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 24 Apr 2019 12:52:18 +0300
+Subject: [PATCH] brcm80211: potential NULL dereference in
+ brcmf_cfg80211_vndr_cmds_dcmd_handler()
+
+If "ret_len" is negative then it could lead to a NULL dereference.
+
+The "ret_len" value comes from nl80211_vendor_cmd(), if it's negative
+then we don't allocate the "dcmd_buf" buffer.  Then we pass "ret_len" to
+brcmf_fil_cmd_data_set() where it is cast to a very high u32 value.
+Most of the functions in that call tree check whether the buffer we pass
+is NULL but there are at least a couple places which don't such as
+brcmf_dbg_hex_dump() and brcmf_msgbuf_query_dcmd().  We memcpy() to and
+from the buffer so it would result in a NULL dereference.
+
+The fix is to change the types so that "ret_len" can't be negative.  (If
+we memcpy() zero bytes to NULL, that's a no-op and doesn't cause an
+issue).
+
+Fixes: 1bacb0487d0e ("brcmfmac: replace cfg80211 testmode with vendor command")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/vendor.c
+@@ -35,9 +35,10 @@ static int brcmf_cfg80211_vndr_cmds_dcmd
+ 	struct brcmf_if *ifp;
+ 	const struct brcmf_vndr_dcmd_hdr *cmdhdr = data;
+ 	struct sk_buff *reply;
+-	int ret, payload, ret_len;
++	unsigned int payload, ret_len;
+ 	void *dcmd_buf = NULL, *wr_pointer;
+ 	u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
++	int ret;
+ 
+ 	if (len < sizeof(*cmdhdr)) {
+ 		brcmf_err("vendor command too short: %d\n", len);
+@@ -65,7 +66,7 @@ static int brcmf_cfg80211_vndr_cmds_dcmd
+ 			brcmf_err("oversize return buffer %d\n", ret_len);
+ 			ret_len = BRCMF_DCMD_MAXLEN;
+ 		}
+-		payload = max(ret_len, len) + 1;
++		payload = max_t(unsigned int, ret_len, len) + 1;
+ 		dcmd_buf = vzalloc(payload);
+ 		if (NULL == dcmd_buf)
+ 			return -ENOMEM;

package/kernel/mac80211/patches/348-v5.2-brcmfmac-set-txflow-request-id-from-1-to-pktids-arra.patch

@@ -0,0 +1,49 @@
+From 2d91c8ad068a5cad4d9e7ece8dc811a697c7176a Mon Sep 17 00:00:00 2001
+From: Wright Feng <Wright.Feng@cypress.com>
+Date: Fri, 26 Apr 2019 03:41:46 +0000
+Subject: [PATCH] brcmfmac: set txflow request id from 1 to pktids array size
+
+Some PCIE firmwares drop txstatus if pktid is 0 and make packet held in
+host side and never be released. If that packet type is 802.1x, the
+pend_8021x_cnt value will be always greater than 0 and show "Timed out
+waiting for no pending 802.1x packets" error message when sending key to
+dongle every time.
+
+To be compatible with all firmwares, host should set txflow request id
+from 1 instead of from 0.
+
+Signed-off-by: Wright Feng <wright.feng@cypress.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -375,7 +375,7 @@ brcmf_msgbuf_get_pktid(struct device *de
+ 	struct brcmf_msgbuf_pktid *pktid;
+ 	struct sk_buff *skb;
+ 
+-	if (idx >= pktids->array_size) {
++	if (idx < 0 || idx >= pktids->array_size) {
+ 		brcmf_err("Invalid packet id %d (max %d)\n", idx,
+ 			  pktids->array_size);
+ 		return NULL;
+@@ -745,7 +745,7 @@ static void brcmf_msgbuf_txflow(struct b
+ 		tx_msghdr = (struct msgbuf_tx_msghdr *)ret_ptr;
+ 
+ 		tx_msghdr->msg.msgtype = MSGBUF_TYPE_TX_POST;
+-		tx_msghdr->msg.request_id = cpu_to_le32(pktid);
++		tx_msghdr->msg.request_id = cpu_to_le32(pktid + 1);
+ 		tx_msghdr->msg.ifidx = brcmf_flowring_ifidx_get(flow, flowid);
+ 		tx_msghdr->flags = BRCMF_MSGBUF_PKT_FLAGS_FRAME_802_3;
+ 		tx_msghdr->flags |= (skb->priority & 0x07) <<
+@@ -882,7 +882,7 @@ brcmf_msgbuf_process_txstatus(struct brc
+ 	u16 flowid;
+ 
+ 	tx_status = (struct msgbuf_tx_status *)buf;
+-	idx = le32_to_cpu(tx_status->msg.request_id);
++	idx = le32_to_cpu(tx_status->msg.request_id) - 1;
+ 	flowid = le16_to_cpu(tx_status->compl_hdr.flow_ring_id);
+ 	flowid -= BRCMF_H2D_MSGRING_FLOWRING_IDSTART;
+ 	skb = brcmf_msgbuf_get_pktid(msgbuf->drvr->bus_if->dev,

package/kernel/mac80211/patches/349-v5.2-brcmfmac-print-firmware-messages-after-a-firmware-cr.patch

@@ -0,0 +1,90 @@
+From 47dd82e3d25e85a7c7c4e4b0eac9d297d1e5e2d4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sun, 28 Apr 2019 23:38:26 +0200
+Subject: [PATCH] brcmfmac: print firmware messages after a firmware crash
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Normally firmware messages are printed with debugging enabled only. It's
+a good idea as firmware may print a lot of messages that normal users
+don't need to care about.
+
+However, on firmware crash, it may be very helpful to log all recent
+messages. There is almost always a backtrace available as well as rought
+info on the latest actions/state.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/pcie.c        | 24 ++++++++++++++-----
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -760,15 +760,22 @@ static void brcmf_pcie_bus_console_init(
+ 		  console->base_addr, console->buf_addr, console->bufsize);
+ }
+ 
+-
+-static void brcmf_pcie_bus_console_read(struct brcmf_pciedev_info *devinfo)
++/**
++ * brcmf_pcie_bus_console_read - reads firmware messages
++ *
++ * @error: specifies if error has occurred (prints messages unconditionally)
++ */
++static void brcmf_pcie_bus_console_read(struct brcmf_pciedev_info *devinfo,
++					bool error)
+ {
++	struct pci_dev *pdev = devinfo->pdev;
++	struct brcmf_bus *bus = dev_get_drvdata(&pdev->dev);
+ 	struct brcmf_pcie_console *console;
+ 	u32 addr;
+ 	u8 ch;
+ 	u32 newidx;
+ 
+-	if (!BRCMF_FWCON_ON())
++	if (!error && !BRCMF_FWCON_ON())
+ 		return;
+ 
+ 	console = &devinfo->shared.console;
+@@ -792,7 +799,10 @@ static void brcmf_pcie_bus_console_read(
+ 		}
+ 		if (ch == '\n') {
+ 			console->log_str[console->log_idx] = 0;
+-			pr_debug("CONSOLE: %s", console->log_str);
++			if (error)
++				brcmf_err(bus, "CONSOLE: %s", console->log_str);
++			else
++				pr_debug("CONSOLE: %s", console->log_str);
+ 			console->log_idx = 0;
+ 		}
+ 	}
+@@ -847,7 +857,7 @@ static irqreturn_t brcmf_pcie_isr_thread
+ 							&devinfo->pdev->dev);
+ 		}
+ 	}
+-	brcmf_pcie_bus_console_read(devinfo);
++	brcmf_pcie_bus_console_read(devinfo, false);
+ 	if (devinfo->state == BRCMFMAC_PCIE_STATE_UP)
+ 		brcmf_pcie_intr_enable(devinfo);
+ 	devinfo->in_irq = false;
+@@ -1398,6 +1408,8 @@ static int brcmf_pcie_reset(struct devic
+ 	u16 bus_nr;
+ 	int err;
+ 
++	brcmf_pcie_bus_console_read(devinfo, true);
++
+ 	brcmf_detach(dev);
+ 
+ 	brcmf_pcie_release_irq(devinfo);
+@@ -1799,7 +1811,7 @@ static void brcmf_pcie_setup(struct devi
+ 	if (brcmf_pcie_attach_bus(devinfo) == 0)
+ 		return;
+ 
+-	brcmf_pcie_bus_console_read(devinfo);
++	brcmf_pcie_bus_console_read(devinfo, false);
+ 
+ fail:
+ 	device_release_driver(dev);

package/kernel/mac80211/patches/350-v5.4-brcmfmac-use-strlcpy-instead-of-strcpy.patch

@@ -0,0 +1,26 @@
+From bbfab331e3abd9fa8767eea6bf5c4684cdd4b934 Mon Sep 17 00:00:00 2001
+From: Neo Jou <neojou@gmail.com>
+Date: Tue, 21 May 2019 17:12:20 +0800
+Subject: [PATCH] brcmfmac: use strlcpy() instead of strcpy()
+
+The function strcpy() is inherently not safe. Though the function
+works without problems here, it would be better to use other safer
+function, e.g. strlcpy(), to replace strcpy() still.
+
+Signed-off-by: Neo Jou <neojou@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -157,7 +157,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 
+ 	/* query for 'ver' to get version info from firmware */
+ 	memset(buf, 0, sizeof(buf));
+-	strcpy(buf, "ver");
++	strlcpy(buf, "ver", sizeof(buf));
+ 	err = brcmf_fil_iovar_data_get(ifp, "ver", buf, sizeof(buf));
+ 	if (err < 0) {
+ 		bphy_err(drvr, "Retrieving version information failed, %d\n",

package/kernel/mac80211/patches/351-v5.4-0001-brcmfmac-add-160MHz-in-chandef_to_chanspec.patch

@@ -0,0 +1,56 @@
+From f491645f039420fb7e14283e21b90772571c807c Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 11 Jul 2019 10:45:30 +0200
+Subject: [PATCH] brcmfmac: add 160MHz in chandef_to_chanspec()
+
+The function chandef_to_chanspec() was not handling 160MHz bandwidth
+resulting in wrong encoding of the channel. That resulting in firmware
+rejecting the provided channel specification.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 21 ++++++++++++++++++-
+ 1 file changed, 20 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -287,8 +287,26 @@ static u16 chandef_to_chanspec(struct br
+ 		else
+ 			ch_inf.sb = BRCMU_CHAN_SB_UU;
+ 		break;
+-	case NL80211_CHAN_WIDTH_80P80:
+ 	case NL80211_CHAN_WIDTH_160:
++		ch_inf.bw = BRCMU_CHAN_BW_160;
++		if (primary_offset == -70)
++			ch_inf.sb = BRCMU_CHAN_SB_LLL;
++		else if (primary_offset == -50)
++			ch_inf.sb = BRCMU_CHAN_SB_LLU;
++		else if (primary_offset == -30)
++			ch_inf.sb = BRCMU_CHAN_SB_LUL;
++		else if (primary_offset == -10)
++			ch_inf.sb = BRCMU_CHAN_SB_LUU;
++		else if (primary_offset == 10)
++			ch_inf.sb = BRCMU_CHAN_SB_ULL;
++		else if (primary_offset == 30)
++			ch_inf.sb = BRCMU_CHAN_SB_ULU;
++		else if (primary_offset == 50)
++			ch_inf.sb = BRCMU_CHAN_SB_UUL;
++		else
++			ch_inf.sb = BRCMU_CHAN_SB_UUU;
++		break;
++	case NL80211_CHAN_WIDTH_80P80:
+ 	case NL80211_CHAN_WIDTH_5:
+ 	case NL80211_CHAN_WIDTH_10:
+ 	default:
+@@ -307,6 +325,7 @@ static u16 chandef_to_chanspec(struct br
+ 	}
+ 	d11inf->encchspec(&ch_inf);
+ 
++	brcmf_dbg(TRACE, "chanspec: 0x%x\n", ch_inf.chspec);
+ 	return ch_inf.chspec;
+ }
+ 

package/kernel/mac80211/patches/352-v5.4-0001-Revert-brcmfmac-fix-NULL-pointer-derefence-during-US.patch

@@ -0,0 +1,168 @@
+From a84a60ccdd65278485fb495f468a5ab91a75c649 Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 11 Jul 2019 11:05:06 +0200
+Subject: [PATCH] Revert "brcmfmac: fix NULL pointer derefence during USB
+ disconnect"
+
+This reverts commit 5cdb0ef6144f47440850553579aa923c20a63f23. Subsequent
+changes make rework the driver code fixing the issue differently.
+
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../wireless/broadcom/brcm80211/brcmfmac/bcdc.c  | 11 ++---------
+ .../wireless/broadcom/brcm80211/brcmfmac/bcdc.h  |  6 ++----
+ .../wireless/broadcom/brcm80211/brcmfmac/core.c  |  4 +---
+ .../broadcom/brcm80211/brcmfmac/fwsignal.c       | 16 ++++------------
+ .../broadcom/brcm80211/brcmfmac/fwsignal.h       |  3 +--
+ .../wireless/broadcom/brcm80211/brcmfmac/proto.c | 10 ++--------
+ .../wireless/broadcom/brcm80211/brcmfmac/proto.h |  3 +--
+ 7 files changed, 13 insertions(+), 40 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.c
+@@ -479,18 +479,11 @@ fail:
+ 	return -ENOMEM;
+ }
+ 
+-void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr)
+-{
+-	struct brcmf_bcdc *bcdc = drvr->proto->pd;
+-
+-	brcmf_fws_detach_pre_delif(bcdc->fws);
+-}
+-
+-void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr)
++void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr)
+ {
+ 	struct brcmf_bcdc *bcdc = drvr->proto->pd;
+ 
+ 	drvr->proto->pd = NULL;
+-	brcmf_fws_detach_post_delif(bcdc->fws);
++	brcmf_fws_detach(bcdc->fws);
+ 	kfree(bcdc);
+ }
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcdc.h
+@@ -18,16 +18,14 @@
+ 
+ #ifdef CPTCFG_BRCMFMAC_PROTO_BCDC
+ int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr);
+-void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr);
+-void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr);
++void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr);
+ void brcmf_proto_bcdc_txflowblock(struct device *dev, bool state);
+ void brcmf_proto_bcdc_txcomplete(struct device *dev, struct sk_buff *txp,
+ 				 bool success);
+ struct brcmf_fws_info *drvr_to_fws(struct brcmf_pub *drvr);
+ #else
+ static inline int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr) { return 0; }
+-static void brcmf_proto_bcdc_detach_pre_delif(struct brcmf_pub *drvr) {};
+-static inline void brcmf_proto_bcdc_detach_post_delif(struct brcmf_pub *drvr) {}
++static inline void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr) {}
+ #endif
+ 
+ #endif /* BRCMFMAC_BCDC_H */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1294,8 +1294,6 @@ void brcmf_detach(struct device *dev)
+ 
+ 	brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
+ 
+-	brcmf_proto_detach_pre_delif(drvr);
+-
+ 	/* make sure primary interface removed last */
+ 	for (i = BRCMF_MAX_IFS-1; i > -1; i--)
+ 		brcmf_remove_interface(drvr->iflist[i], false);
+@@ -1305,7 +1303,7 @@ void brcmf_detach(struct device *dev)
+ 
+ 	brcmf_bus_stop(drvr->bus_if);
+ 
+-	brcmf_proto_detach_post_delif(drvr);
++	brcmf_proto_detach(drvr);
+ 
+ 	brcmf_debug_detach(drvr);
+ 	bus_if->drvr = NULL;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -2420,25 +2420,17 @@ struct brcmf_fws_info *brcmf_fws_attach(
+ 	return fws;
+ 
+ fail:
+-	brcmf_fws_detach_pre_delif(fws);
+-	brcmf_fws_detach_post_delif(fws);
++	brcmf_fws_detach(fws);
+ 	return ERR_PTR(rc);
+ }
+ 
+-void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws)
++void brcmf_fws_detach(struct brcmf_fws_info *fws)
+ {
+ 	if (!fws)
+ 		return;
+-	if (fws->fws_wq) {
+-		destroy_workqueue(fws->fws_wq);
+-		fws->fws_wq = NULL;
+-	}
+-}
+ 
+-void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws)
+-{
+-	if (!fws)
+-		return;
++	if (fws->fws_wq)
++		destroy_workqueue(fws->fws_wq);
+ 
+ 	/* cleanup */
+ 	brcmf_fws_lock(fws);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.h
+@@ -19,8 +19,7 @@
+ #define FWSIGNAL_H_
+ 
+ struct brcmf_fws_info *brcmf_fws_attach(struct brcmf_pub *drvr);
+-void brcmf_fws_detach_pre_delif(struct brcmf_fws_info *fws);
+-void brcmf_fws_detach_post_delif(struct brcmf_fws_info *fws);
++void brcmf_fws_detach(struct brcmf_fws_info *fws);
+ bool brcmf_fws_queue_skbs(struct brcmf_fws_info *fws);
+ bool brcmf_fws_fc_active(struct brcmf_fws_info *fws);
+ void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.c
+@@ -66,22 +66,16 @@ fail:
+ 	return -ENOMEM;
+ }
+ 
+-void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr)
++void brcmf_proto_detach(struct brcmf_pub *drvr)
+ {
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+ 	if (drvr->proto) {
+ 		if (drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
+-			brcmf_proto_bcdc_detach_post_delif(drvr);
++			brcmf_proto_bcdc_detach(drvr);
+ 		else if (drvr->bus_if->proto_type == BRCMF_PROTO_MSGBUF)
+ 			brcmf_proto_msgbuf_detach(drvr);
+ 		kfree(drvr->proto);
+ 		drvr->proto = NULL;
+ 	}
+ }
+-
+-void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr)
+-{
+-	if (drvr->proto && drvr->bus_if->proto_type == BRCMF_PROTO_BCDC)
+-		brcmf_proto_bcdc_detach_pre_delif(drvr);
+-}
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/proto.h
+@@ -53,8 +53,7 @@ struct brcmf_proto {
+ 
+ 
+ int brcmf_proto_attach(struct brcmf_pub *drvr);
+-void brcmf_proto_detach_pre_delif(struct brcmf_pub *drvr);
+-void brcmf_proto_detach_post_delif(struct brcmf_pub *drvr);
++void brcmf_proto_detach(struct brcmf_pub *drvr);
+ 
+ static inline int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws,
+ 				      struct sk_buff *skb,

package/kernel/mac80211/patches/352-v5.4-0002-brcmfmac-change-the-order-of-things-in-brcmf_detach.patch

@@ -0,0 +1,69 @@
+From 14fcfd1cc0c05ea58f47dd693fdd13f25dfe995e Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 11 Jul 2019 11:05:07 +0200
+Subject: [PATCH] brcmfmac: change the order of things in brcmf_detach()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When brcmf_detach() from the bus layer upon rmmod we can no longer
+communicate. Hence we will set the bus state to DOWN and cleanup
+the event and protocol layer. The network interfaces need to be
+deleted before brcmf_cfg80211_detach() because the latter does the
+wiphy_unregister() which issues a warning if there are still network
+devices linked to the wiphy instance.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Tested-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/core.c        | 27 ++++++++++---------
+ 1 file changed, 14 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1287,26 +1287,27 @@ void brcmf_detach(struct device *dev)
+ 	unregister_inet6addr_notifier(&drvr->inet6addr_notifier);
+ #endif
+ 
+-	/* stop firmware event handling */
+-	brcmf_fweh_detach(drvr);
+-	if (drvr->config)
+-		brcmf_p2p_detach(&drvr->config->p2p);
+-
+ 	brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
+-
+-	/* make sure primary interface removed last */
+-	for (i = BRCMF_MAX_IFS-1; i > -1; i--)
+-		brcmf_remove_interface(drvr->iflist[i], false);
+-
+-	brcmf_cfg80211_detach(drvr->config);
+-	drvr->config = NULL;
+-
+ 	brcmf_bus_stop(drvr->bus_if);
+ 
++	brcmf_fweh_detach(drvr);
+ 	brcmf_proto_detach(drvr);
+-
+ 	brcmf_debug_detach(drvr);
++
++	/* make sure primary interface removed last */
++	for (i = BRCMF_MAX_IFS - 1; i > -1; i--) {
++		if (drvr->iflist[i])
++			brcmf_del_if(drvr, drvr->iflist[i]->bsscfgidx, false);
++	}
++
++	if (drvr->config) {
++		brcmf_p2p_detach(&drvr->config->p2p);
++		brcmf_cfg80211_detach(drvr->config);
++		drvr->config = NULL;
++	}
++
+ 	bus_if->drvr = NULL;
++
+ 	wiphy_free(drvr->wiphy);
+ }
+ 

package/kernel/mac80211/patches/352-v5.4-0003-brcmfmac-avoid-firmware-command-in-brcmf_netdev_open.patch

@@ -0,0 +1,30 @@
+From c613085b74941024194e41b200601b9aa6ee388f Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 11 Jul 2019 11:05:08 +0200
+Subject: [PATCH] brcmfmac: avoid firmware command in brcmf_netdev_open() when
+ bus is down
+
+No point in sending a firmware command when bus is down so make it
+conditional checking the state.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -558,7 +558,8 @@ static int brcmf_netdev_stop(struct net_
+ 
+ 	brcmf_cfg80211_down(ndev);
+ 
+-	brcmf_fil_iovar_data_set(ifp, "arp_hostip_clear", NULL, 0);
++	if (ifp->drvr->bus_if->state == BRCMF_BUS_UP)
++		brcmf_fil_iovar_data_set(ifp, "arp_hostip_clear", NULL, 0);
+ 
+ 	brcmf_net_setcarrier(ifp, false);
+ 

package/kernel/mac80211/patches/352-v5.4-0004-brcmfmac-clear-events-in-brcmf_fweh_detach-will-alwa.patch

@@ -0,0 +1,38 @@
+From c33330ac06fe863289643e7a13ecdb6a2502dad7 Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 11 Jul 2019 11:05:09 +0200
+Subject: [PATCH] brcmfmac: clear events in brcmf_fweh_detach() will always
+ fail
+
+Clearing firmware events in brcmf_fweh_detach() is always failing
+because it is called only upon driver remove and communication
+with firmware is no longer possible.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
+@@ -319,16 +319,7 @@ void brcmf_fweh_attach(struct brcmf_pub
+ void brcmf_fweh_detach(struct brcmf_pub *drvr)
+ {
+ 	struct brcmf_fweh_info *fweh = &drvr->fweh;
+-	struct brcmf_if *ifp = brcmf_get_ifp(drvr, 0);
+-	s8 eventmask[BRCMF_EVENTING_MASK_LEN];
+ 
+-	if (ifp) {
+-		/* clear all events */
+-		memset(eventmask, 0, BRCMF_EVENTING_MASK_LEN);
+-		(void)brcmf_fil_iovar_data_set(ifp, "event_msgs",
+-					       eventmask,
+-					       BRCMF_EVENTING_MASK_LEN);
+-	}
+ 	/* cancel the worker */
+ 	cancel_work_sync(&fweh->event_work);
+ 	WARN_ON(!list_empty(&fweh->event_q));

package/kernel/mac80211/patches/352-v5.4-0005-brcmfmac-avoid-firmware-commands-when-bus-is-down.patch

@@ -0,0 +1,69 @@
+From 1ac11ae949dd883854f4523ef8e3a32aabfd6256 Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 11 Jul 2019 11:05:10 +0200
+Subject: [PATCH] brcmfmac: avoid firmware commands when bus is down
+
+Upon rmmod a few attempts are made to inform firmware, but there is
+no point as the bus is down and these will fail. Avoid them to keep
+the logs clean.
+
+Reported-by: Stefan Wahren <stefan.wahren@i2se.com>
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 23 +++++++++++--------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -1388,17 +1388,21 @@ static void brcmf_link_down(struct brcmf
+ {
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(vif->wdev.wiphy);
+ 	struct brcmf_pub *drvr = cfg->pub;
++	bool bus_up = drvr->bus_if->state == BRCMF_BUS_UP;
+ 	s32 err = 0;
+ 
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+ 	if (test_and_clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state)) {
+-		brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n ");
+-		err = brcmf_fil_cmd_data_set(vif->ifp,
+-					     BRCMF_C_DISASSOC, NULL, 0);
+-		if (err) {
+-			bphy_err(drvr, "WLC_DISASSOC failed (%d)\n", err);
++		if (bus_up) {
++			brcmf_dbg(INFO, "Call WLC_DISASSOC to stop excess roaming\n");
++			err = brcmf_fil_cmd_data_set(vif->ifp,
++						     BRCMF_C_DISASSOC, NULL, 0);
++			if (err)
++				bphy_err(drvr, "WLC_DISASSOC failed (%d)\n",
++					 err);
+ 		}
++
+ 		if ((vif->wdev.iftype == NL80211_IFTYPE_STATION) ||
+ 		    (vif->wdev.iftype == NL80211_IFTYPE_P2P_CLIENT))
+ 			cfg80211_disconnected(vif->wdev.netdev, reason, NULL, 0,
+@@ -5041,18 +5045,16 @@ static int brcmf_cfg80211_get_channel(st
+ 	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+ 	struct net_device *ndev = wdev->netdev;
+ 	struct brcmf_pub *drvr = cfg->pub;
+-	struct brcmf_if *ifp;
+ 	struct brcmu_chan ch;
+ 	enum nl80211_band band = 0;
+ 	enum nl80211_chan_width width = 0;
+ 	u32 chanspec;
+ 	int freq, err;
+ 
+-	if (!ndev)
++	if (!ndev || drvr->bus_if->state != BRCMF_BUS_UP)
+ 		return -ENODEV;
+-	ifp = netdev_priv(ndev);
+ 
+-	err = brcmf_fil_iovar_int_get(ifp, "chanspec", &chanspec);
++	err = brcmf_fil_iovar_int_get(netdev_priv(ndev), "chanspec", &chanspec);
+ 	if (err) {
+ 		bphy_err(drvr, "chanspec failed (%d)\n", err);
+ 		return err;

package/kernel/mac80211/patches/352-v5.4-0006-brcmfmac-simply-remove-flowring-if-bus-is-down.patch

@@ -0,0 +1,33 @@
+From e0bfb9601d4812719167cc4124a0d6db1e2f55e4 Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 11 Jul 2019 11:05:11 +0200
+Subject: [PATCH] brcmfmac: simply remove flowring if bus is down
+
+When the bus is down, eg. due to rmmod, there is no need to
+attempt to inform firmware about it.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -1406,6 +1406,13 @@ void brcmf_msgbuf_delete_flowring(struct
+ 	u8 ifidx;
+ 	int err;
+ 
++	/* no need to submit if firmware can not be reached */
++	if (drvr->bus_if->state != BRCMF_BUS_UP) {
++		brcmf_dbg(MSGBUF, "bus down, flowring will be removed\n");
++		brcmf_msgbuf_remove_flowring(msgbuf, flowid);
++		return;
++	}
++
+ 	commonring = msgbuf->commonrings[BRCMF_H2D_MSGRING_CONTROL_SUBMIT];
+ 	brcmf_commonring_lock(commonring);
+ 	ret_ptr = brcmf_commonring_reserve_for_write(commonring);

package/kernel/mac80211/patches/352-v5.4-0007-brcmfmac-remove-unnecessary-strlcpy-upon-obtaining-v.patch

@@ -0,0 +1,28 @@
+From 4b11c915f00caeef3292ed0429acc579b9da762a Mon Sep 17 00:00:00 2001
+From: Arend van Spriel <arend.vanspriel@broadcom.com>
+Date: Thu, 11 Jul 2019 11:05:12 +0200
+Subject: [PATCH] brcmfmac: remove unnecessary strlcpy() upon obtaining "ver"
+ iovar
+
+Recently a strcpy() was replaced by strlcpy(). However, the strcpy()
+was not needed in the first place. So removing that line of code.
+
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -157,7 +157,6 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 
+ 	/* query for 'ver' to get version info from firmware */
+ 	memset(buf, 0, sizeof(buf));
+-	strlcpy(buf, "ver", sizeof(buf));
+ 	err = brcmf_fil_iovar_data_get(ifp, "ver", buf, sizeof(buf));
+ 	if (err < 0) {
+ 		bphy_err(drvr, "Retrieving version information failed, %d\n",

package/kernel/mac80211/patches/353-v5.4-brcmfmac-remove-set-but-not-used-variable-dtim_perio.patch

@@ -0,0 +1,54 @@
+From cddecd92d1ec2fd05ed1123455e7c6cf6906b5a5 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Wed, 24 Jul 2019 22:12:01 +0800
+Subject: [PATCH] brcmfmac: remove set but not used variable 'dtim_period'
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In function brcmf_update_bss_info:
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:2962:5: warning: variable dtim_period set but not used [-Wunused-but-set-variable]
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In function brcmf_update_bss_info:
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:2961:6: warning: variable beacon_interval set but not used [-Wunused-but-set-variable]
+
+They are never used so can be removed.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c   | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -3033,8 +3033,6 @@ static s32 brcmf_update_bss_info(struct
+ 	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_bss_info_le *bi;
+ 	const struct brcmf_tlv *tim;
+-	u16 beacon_interval;
+-	u8 dtim_period;
+ 	size_t ie_len;
+ 	u8 *ie;
+ 	s32 err = 0;
+@@ -3058,12 +3056,9 @@ static s32 brcmf_update_bss_info(struct
+ 
+ 	ie = ((u8 *)bi) + le16_to_cpu(bi->ie_offset);
+ 	ie_len = le32_to_cpu(bi->ie_length);
+-	beacon_interval = le16_to_cpu(bi->beacon_period);
+ 
+ 	tim = brcmf_parse_tlvs(ie, ie_len, WLAN_EID_TIM);
+-	if (tim)
+-		dtim_period = tim->data[1];
+-	else {
++	if (!tim) {
+ 		/*
+ 		* active scan was done so we could not get dtim
+ 		* information out of probe response.
+@@ -3075,7 +3070,6 @@ static s32 brcmf_update_bss_info(struct
+ 			bphy_err(drvr, "wl dtim_assoc failed (%d)\n", err);
+ 			goto update_bss_info_out;
+ 		}
+-		dtim_period = (u8)var;
+ 	}
+ 
+ update_bss_info_out:

package/kernel/mac80211/patches/354-v5.4-brcmfmac-remove-redundant-assignment-to-pointer-hash.patch

@@ -0,0 +1,26 @@
+From 73c742bb9c9ba30871fdd5c730d5ca8b6712833a Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Fri, 9 Aug 2019 18:22:17 +0100
+Subject: [PATCH] brcmfmac: remove redundant assignment to pointer hash
+
+The pointer hash is being initialized with a value that is never read
+and is being re-assigned a little later on. The assignment is
+redundant and hence can be removed.
+
+Addresses-Coverity: ("Unused value")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -1476,7 +1476,6 @@ static int brcmf_msgbuf_stats_read(struc
+ 	seq_printf(seq, "\nh2d_flowrings: depth %u\n",
+ 		   BRCMF_H2D_TXFLOWRING_MAX_ITEM);
+ 	seq_puts(seq, "Active flowrings:\n");
+-	hash = msgbuf->flow->hash;
+ 	for (i = 0; i < msgbuf->flow->nrofrings; i++) {
+ 		if (!msgbuf->flow->rings[i])
+ 			continue;

package/kernel/mac80211/patches/355-v5.4-brcmfmac-replace-strncpy-by-strscpy.patch

@@ -0,0 +1,36 @@
+From 5f42b382ead278c1f6c3854765c97eb20491aa2a Mon Sep 17 00:00:00 2001
+From: Xulin Sun <xulin.sun@windriver.com>
+Date: Fri, 23 Aug 2019 15:47:08 +0800
+Subject: [PATCH] brcmfmac: replace strncpy() by strscpy()
+
+The strncpy() may truncate the copied string,
+replace it by the safer strscpy().
+
+To avoid below compile warning with gcc 8.2:
+
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:In function 'brcmf_vndr_ie':
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:4227:2:
+warning: 'strncpy' output truncated before terminating nul copying 3 bytes from a string of the same length [-Wstringop-truncation]
+  strncpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN - 1);
+  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Signed-off-by: Xulin Sun <xulin.sun@windriver.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -4280,9 +4280,7 @@ next:
+ static u32
+ brcmf_vndr_ie(u8 *iebuf, s32 pktflag, u8 *ie_ptr, u32 ie_len, s8 *add_del_cmd)
+ {
+-
+-	strncpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN - 1);
+-	iebuf[VNDR_IE_CMD_LEN - 1] = '\0';
++	strscpy(iebuf, add_del_cmd, VNDR_IE_CMD_LEN);
+ 
+ 	put_unaligned_le32(1, &iebuf[VNDR_IE_COUNT_OFFSET]);
+ 

package/kernel/mac80211/patches/356-v5.4-brcmfmac-get-chip-s-default-RAM-info-during-PCIe-set.patch

@@ -0,0 +1,80 @@
+From 82f93cf46d6007ffa003b2d4a2834563b6b84d21 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 29 Aug 2019 10:27:01 +0200
+Subject: [PATCH] brcmfmac: get chip's default RAM info during PCIe setup
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Getting RAM info just once per driver's lifetime (during chip
+recognition) is not enough as it may get adjusted later (depending on
+the used firmware). Subsequent inits may load different firmwares so a
+full RAM recognition is required on every PCIe setup. This is especially
+important since implementing hardware reset on a firmware crash.
+
+Moreover calling brcmf_chip_get_raminfo() makes sure that RAM core is
+up. It's important as having BCMA_CORE_SYS_MEM down on BCM4366 was
+resulting in firmware failing to initialize and following error:
+[   65.657546] brcmfmac 0000:01:00.0: brcmf_pcie_download_fw_nvram: Invalid shared RAM address 0x04000001
+
+This change makes brcmf_chip_get_raminfo() call during chip recognition
+redundant for PCIe devices but SDIO and USB still need it and it's a
+very small overhead anyway.
+
+Fixes: 4684997d9eea ("brcmfmac: reset PCIe bus on a firmware crash")
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c | 6 ++++--
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h | 1 +
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 ++++++
+ 3 files changed, 11 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+@@ -700,8 +700,10 @@ static u32 brcmf_chip_tcm_rambase(struct
+ 	return 0;
+ }
+ 
+-static int brcmf_chip_get_raminfo(struct brcmf_chip_priv *ci)
++int brcmf_chip_get_raminfo(struct brcmf_chip *pub)
+ {
++	struct brcmf_chip_priv *ci = container_of(pub, struct brcmf_chip_priv,
++						  pub);
+ 	struct brcmf_core_priv *mem_core;
+ 	struct brcmf_core *mem;
+ 
+@@ -981,7 +983,7 @@ static int brcmf_chip_recognition(struct
+ 		brcmf_chip_set_passive(&ci->pub);
+ 	}
+ 
+-	return brcmf_chip_get_raminfo(ci);
++	return brcmf_chip_get_raminfo(&ci->pub);
+ }
+ 
+ static void brcmf_chip_disable_arm(struct brcmf_chip_priv *chip, u16 id)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.h
+@@ -80,6 +80,7 @@ struct brcmf_buscore_ops {
+ 	void (*activate)(void *ctx, struct brcmf_chip *chip, u32 rstvec);
+ };
+ 
++int brcmf_chip_get_raminfo(struct brcmf_chip *pub);
+ struct brcmf_chip *brcmf_chip_attach(void *ctx,
+ 				     const struct brcmf_buscore_ops *ops);
+ void brcmf_chip_detach(struct brcmf_chip *chip);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -1761,6 +1761,12 @@ static void brcmf_pcie_setup(struct devi
+ 
+ 	brcmf_pcie_attach(devinfo);
+ 
++	ret = brcmf_chip_get_raminfo(devinfo->ci);
++	if (ret) {
++		brcmf_err(bus, "Failed to get RAM info\n");
++		goto fail;
++	}
++
+ 	/* Some of the firmwares have the size of the memory of the device
+ 	 * defined inside the firmware. This is because part of the memory in
+ 	 * the device is shared and the devision is determined by FW. Parse

package/kernel/mac80211/patches/357-v5.4-0001-brcmfmac-add-stub-version-of-brcmf_debugfs_get_devdi.patch

@@ -0,0 +1,31 @@
+From cb34212b1c25f7656a315f956d72696777e88340 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sun, 1 Sep 2019 13:34:35 +0200
+Subject: [PATCH] brcmfmac: add stub version of brcmf_debugfs_get_devdir()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+In case of compiling driver without DEBUG expose a stub function to make
+writing debug code much simpler (no extra conditions). This will allow
+e.g. using debugfs_create_file() without any magic if or #ifdef.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
+@@ -147,6 +147,10 @@ static inline int brcmf_debug_attach(str
+ static inline void brcmf_debug_detach(struct brcmf_pub *drvr)
+ {
+ }
++static inline struct dentry *brcmf_debugfs_get_devdir(struct brcmf_pub *drvr)
++{
++	return ERR_PTR(-ENOENT);
++}
+ static inline
+ int brcmf_debugfs_add_entry(struct brcmf_pub *drvr, const char *fn,
+ 			    int (*read_fn)(struct seq_file *seq, void *data))

package/kernel/mac80211/patches/357-v5.4-0002-brcmfmac-add-reset-debugfs-entry-for-testing-reset.patch

@@ -0,0 +1,59 @@
+From 2f8c8e62cd50d72ac68de884a09c6f5a969a269c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Sun, 1 Sep 2019 13:34:36 +0200
+Subject: [PATCH] brcmfmac: add "reset" debugfs entry for testing reset
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This is a trivial debugfs entry for triggering reset just like in case
+of firmware crash. It works by writing 1 to it:
+echo 1 > reset
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/core.c        | 25 +++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1065,6 +1065,29 @@ static void brcmf_core_bus_reset(struct
+ 	brcmf_bus_reset(drvr->bus_if);
+ }
+ 
++static ssize_t bus_reset_write(struct file *file, const char __user *user_buf,
++			       size_t count, loff_t *ppos)
++{
++	struct brcmf_pub *drvr = file->private_data;
++	u8 value;
++
++	if (kstrtou8_from_user(user_buf, count, 0, &value))
++		return -EINVAL;
++
++	if (value != 1)
++		return -EINVAL;
++
++	schedule_work(&drvr->bus_reset);
++
++	return count;
++}
++
++static const struct file_operations bus_reset_fops = {
++	.open	= simple_open,
++	.llseek	= no_llseek,
++	.write	= bus_reset_write,
++};
++
+ int brcmf_bus_started(struct device *dev)
+ {
+ 	int ret = -1;
+@@ -1096,6 +1119,8 @@ int brcmf_bus_started(struct device *dev
+ 		goto fail;
+ 
+ 	brcmf_debugfs_add_entry(drvr, "revinfo", brcmf_revinfo_read);
++	debugfs_create_file("reset", 0600, brcmf_debugfs_get_devdir(drvr), drvr,
++			    &bus_reset_fops);
+ 
+ 	/* assure we have chipid before feature attach */
+ 	if (!bus_if->chip) {